mixdog 1.3.2 → 1.3.3

package/src/runtime/office/portable/portable-soffice.mjs

@@ -1,6 +1,8 @@
 import { basename, dirname, extname, join } from 'node:path';
 import { homedir, tmpdir } from 'node:os';
 import { spawn } from 'node:child_process';
+import { redactDirectories } from '../../shared/redact-directories.mjs';
+import { removeDirectoryWithRetry } from '../../shared/remove-directory.mjs';
 import { constants as fsConstants, rmSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
 import JSZip from 'jszip';
@@ -44,6 +46,74 @@ function killQuietly(child) {
   }
 }
 
+// How long a killed conversion is waited for before it is reported anyway.
+const SOFFICE_KILL_GRACE_MS = 10_000;
+
+// soffice.com hands the work to a soffice.bin child, which a plain kill of the
+// launcher leaves running (and holding the files it was given); Windows needs
+// the whole tree stopped.
+// The tree is stopped asynchronously and the helper itself is bounded, so a
+// cancellation never blocks the event loop or waits on a stuck taskkill.
+const SOFFICE_TASKKILL_TIMEOUT_MS = 5_000;
+
+// The launcher is killed only once taskkill is done (or out of time): a launcher
+// that exits first leaves taskkill with no descendants to find.
+function killProcessTree(child) {
+  if (process.platform !== 'win32' || !child.pid) {
+    killQuietly(child);
+    return;
+  }
+  let launcherKilled = false;
+  const killLauncher = () => {
+    if (launcherKilled) return;
+    launcherKilled = true;
+    killQuietly(child);
+  };
+  let killer = null;
+  try {
+    killer = spawn('taskkill', ['/pid', String(child.pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore' });
+  } catch {
+    killLauncher();
+    return;
+  }
+  const bound = setTimeout(() => {
+    killQuietly(killer);
+    killLauncher();
+  }, SOFFICE_TASKKILL_TIMEOUT_MS);
+  bound.unref?.();
+  const settle = () => {
+    clearTimeout(bound);
+    killLauncher();
+  };
+  killer.once('error', settle);
+  killer.once('close', settle);
+}
+
+// Documents reach this LibreOffice from untrusted sources (chat attachments),
+// so the private profile it runs with turns every macro off: the strictest
+// security level, and macro execution disabled outright.
+export const MACRO_LOCKDOWN_REGISTRY = [
+  '<?xml version="1.0" encoding="UTF-8"?>',
+  '<oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">',
+  '<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="MacroSecurityLevel" oor:op="fuse"><value>3</value></prop></item>',
+  '<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="DisableMacrosExecution" oor:op="fuse"><value>true</value></prop></item>',
+  '</oor:items>',
+  '',
+].join('\n');
+
+/** The command line of one headless conversion, in a private profile. */
+export function sofficeConvertArguments(profile, { to, outDir, input }) {
+  return [
+    `-env:UserInstallation=${pathToFileURL(profile).href}`,
+    ...SOFFICE_QUIET_ARGS,
+    '--convert-to',
+    to,
+    '--outdir',
+    outDir,
+    input,
+  ];
+}
+
 // A detection probe must always answer. soffice.exe is a GUI launcher that can
 // sit forever without exiting, which deadlocked detection before the rendering
 // call was ever reached, so the probe is bounded and the child killed on expiry.
@@ -132,9 +202,20 @@ let exitHandlerRegistered = false;
 // window closes. It must not build a throwaway profile per call either —
 // creating the profile costs far more than the conversion it serves. One
 // private profile is built on first use and reused for the life of the process.
-function sharedProfileDir() {
-  pendingProfile ||= (async () => {
+export function sharedProfileDir() {
+  if (pendingProfile) return pendingProfile;
+  const attempt = (async () => {
     const created = await mkdtemp(join(tmpdir(), 'mixdog-office-profile-'));
+    try {
+      await mkdir(join(created, 'user'), { recursive: true });
+      await writeFile(join(created, 'user', 'registrymodifications.xcu'), MACRO_LOCKDOWN_REGISTRY);
+    } catch (error) {
+      // A half-built profile is never registered, so nothing else would remove it.
+      await rm(created, { recursive: true, force: true }).catch(() => {});
+      const failure = new Error(redactDirectories(error?.message || String(error), [created]));
+      if (error?.code) failure.code = error.code;
+      throw failure;
+    }
     // An exit handler cannot await, and a profile left behind accumulates one
     // directory per run of the app.
     createdProfiles.add(created);
@@ -152,7 +233,12 @@ function sharedProfileDir() {
     }
     return created;
   })();
-  return pendingProfile;
+  pendingProfile = attempt;
+  // A failed build must not stay cached: the next call starts over.
+  attempt.catch(() => {
+    if (pendingProfile === attempt) pendingProfile = null;
+  });
+  return attempt;
 }
 
 // One profile means one LibreOffice at a time: a second process sharing it
@@ -177,6 +263,8 @@ export function runSoffice(program, args, { signal, timeoutMs, timeoutMessage, c
   return new Promise((resolve) => {
     let settled = false;
     let timer = null;
+    let killTimer = null;
+    let stopped = null;
     let stderr = '';
     const child = spawn(program, args, {
       windowsHide: true,
@@ -187,25 +275,33 @@ export function runSoffice(program, args, { signal, timeoutMs, timeoutMessage, c
       if (settled) return;
       settled = true;
       clearTimeout(timer);
+      clearTimeout(killTimer);
       signal?.removeEventListener?.('abort', onAbort);
       resolve(value);
     };
-    const onAbort = () => {
-      killQuietly(child);
-      finish({ ok: false, error: cancelMessage });
+    // A conversion that is cancelled or out of time is reported once the
+    // process has closed, so the caller never removes files it still holds.
+    const stop = (value) => {
+      if (settled || stopped) return;
+      stopped = value;
+      clearTimeout(timer);
+      signal?.removeEventListener?.('abort', onAbort);
+      killTimer = setTimeout(() => finish(value), SOFFICE_KILL_GRACE_MS);
+      killProcessTree(child);
     };
+    const onAbort = () => stop({ ok: false, error: cancelMessage });
     child.stderr.setEncoding('utf8');
     child.stderr.on('data', (chunk) => {
       if (stderr.length < MAX_SOFFICE_STDERR_CHARS) stderr = `${stderr}${chunk}`.slice(0, MAX_SOFFICE_STDERR_CHARS);
     });
     child.once('error', (error) => finish({ ok: false, error: error?.message || String(error) }));
     child.once('close', (code) =>
-      finish(code === 0 ? { ok: true } : { ok: false, error: stderr.trim() || `LibreOffice exited with code ${code}` })
+      finish(
+        stopped ||
+          (code === 0 ? { ok: true } : { ok: false, error: stderr.trim() || `LibreOffice exited with code ${code}` })
+      )
     );
-    timer = setTimeout(() => {
-      killQuietly(child);
-      finish({ ok: false, error: timeoutMessage });
-    }, timeoutMs);
+    timer = setTimeout(() => stop({ ok: false, error: timeoutMessage }), timeoutMs);
     if (signal?.aborted) onAbort();
     else signal?.addEventListener?.('abort', onAbort, { once: true });
   });
@@ -228,21 +324,17 @@ function convertWithLibreOffice(program, input, { to, outDir, signal = null, tim
   return queueConversion(async () => {
     const profile = await sharedProfileDir();
     const env = await headlessFontEnvironment(profile);
-    const result = await runSoffice(
-      program,
-      [
-        `-env:UserInstallation=${pathToFileURL(profile).href}`,
-        ...SOFFICE_QUIET_ARGS,
-        '--convert-to',
-        to,
-        '--outdir',
-        outDir,
-        input,
-      ],
-      { signal, timeoutMs, timeoutMessage: messages.timeout, cancelMessage: messages.cancelled, env }
-    );
-    if (!result.ok) await discardProfileDir();
-    return result;
+    const result = await runSoffice(program, sofficeConvertArguments(profile, { to, outDir, input }), {
+      signal,
+      timeoutMs,
+      timeoutMessage: messages.timeout,
+      cancelMessage: messages.cancelled,
+      env,
+    });
+    if (result.ok) return result;
+    await discardProfileDir();
+    // The profile is the converter's private folder; what it printed about it stays out of the error.
+    return { ...result, error: redactDirectories(result.error, [profile]) };
   });
 }
 
@@ -525,11 +617,11 @@ export async function validateLibreOfficeReopen(path, { signal = null } = {}) {
  * folder and lands with an exclusive copy, so a file already at `output` is
  * never replaced.
  */
-export async function convertLegacyOffice(path, output, { signal = null } = {}) {
+export async function convertLegacyOffice(path, output, { signal = null, remove = undefined, log = undefined } = {}) {
   const program = await libreOfficeProgram();
   if (!program) {
     throw new Error(
-      `${path} is a legacy binary file, not an Office package, and converting it needs LibreOffice. Install LibreOffice, or open it in Microsoft Office and save it as ${output}.`
+      `${path} is a legacy binary file, not an Office package, and converting it needs LibreOffice. Install the Office feature in Mixdog settings (it installs LibreOffice), or open it in Microsoft Office and save it as ${output}.`
     );
   }
   const extension = extname(output).slice(1).toLowerCase();
@@ -545,6 +637,8 @@ export async function convertLegacyOffice(path, output, { signal = null } = {})
         cancelled: 'LibreOffice conversion was cancelled',
       },
     });
+    // A cancellation is the caller's abort, not a conversion failure.
+    if (signal?.aborted) throw signal.reason ?? Object.assign(new Error(result.error), { name: 'AbortError' });
     if (!result.ok) throw new Error(`LibreOffice could not convert ${path} to .${extension}: ${result.error}`);
     const generated = convertedOutputPath(outputDir, path, extension);
     if (!(await producedFileSize(generated))) {
@@ -554,8 +648,14 @@ export async function convertLegacyOffice(path, output, { signal = null } = {})
     }
     await copyFile(generated, output, fsConstants.COPYFILE_EXCL);
     return output;
+  } catch (error) {
+    // The scratch folder is this function's own: no error leaves naming it
+    // (a failed copy reports both of its paths). A cancellation stays an abort.
+    if (error?.name === 'AbortError') throw error;
+    if (signal?.aborted) throw signal.reason;
+    throw new Error(redactDirectories(error instanceof Error ? error.message : String(error), [outputDir]));
   } finally {
-    await rm(outputDir, { recursive: true, force: true }).catch(() => {});
+    await removeDirectoryWithRetry(outputDir, { remove, log });
   }
 }
 
@@ -581,7 +681,9 @@ export async function renderPortableOoxml(path, output, { signal = null } = {})
   const generated = convertedOutputPath(outputDir, path, 'pdf');
   // LibreOffice can exit 0 without writing anything (a missing or unreadable source).
   if (!(await producedFileSize(generated))) {
-    throw new Error(`LibreOffice produced no PDF from ${path}; the file may be missing, damaged or password-protected.`);
+    throw new Error(
+      `LibreOffice produced no PDF from ${path}; the file may be missing, damaged or password-protected.`
+    );
   }
   if (generated !== output) await rename(generated, output);
   return output;

package/src/runtime/shared/agent-avatar-sprites.mjs

@@ -48,6 +48,21 @@ export const MASCOT_SPRITES = Object.freeze({
       '................',
       '................',
     ],
+    // Mixy's: a low 2x2 block with a lighter tip, clear of her ears.
+    thick: [
+      '................',
+      '................',
+      '................',
+      '................',
+      '................',
+      '................',
+      '................',
+      '................',
+      '.............BL.',
+      '.............BL.',
+      '................',
+      '................',
+    ],
   },
   legs: {
     dog: [
@@ -279,17 +294,17 @@ export const MASCOT_SPRITES = Object.freeze({
       ],
     },
     mixy: {
-      tail: 'dog',
+      tail: 'thick',
       legs: 'dog',
       eye: 'K',
       ears: [
-        '............D...',
-        '............DD..',
-        '.............D..',
-        '.DD..........D..',
-        '.DD.............',
-        '.DD.............',
-        '.DD.............',
+        '................',
+        '................',
+        '................',
+        '.DD..........DD.',
+        '.DD..........DD.',
+        '.DD..........DD.',
+        '.DD..........DD.',
         '................',
         '................',
         '................',

package/src/runtime/shared/agent-avatar.mjs

@@ -31,8 +31,9 @@ const RETIRED_SPECIES = { dalmatian: 'labrador', cat: 'labrador', bird: 'labrado
 const RETIRED_ACCESSORIES = { headset: 'glasses' };
 export const MASCOT_EXPRESSIONS = Object.freeze(['calm', 'happy', 'wink', 'sleepy']);
 
-/** Mixy, the primary assistant: its own silver pup with one ear up and a
- *  slate collar with the gold star medal. Never offered in the picker. */
+/** Mixy, the primary assistant: its own silver pup with both ears down, a low
+ *  thick tail with a lighter tip and a slate collar with the gold star medal.
+ *  Never offered in the picker. */
 export const MIXY_AVATAR = Object.freeze({
   kind: 'mascot',
   species: 'mixy',

package/src/runtime/shared/agent-room-host.d.mts

@@ -0,0 +1,31 @@
+export interface AgentRoomTurnDetail {
+  status: string;
+  result?: { content: string };
+  error?: string;
+}
+export interface AgentRoomHost {
+  member(
+    roomSessionId: string,
+    request: { to?: unknown; prompt?: unknown }
+  ): Promise<{ agentId: string; name: string; sessionId: string; text: string }>;
+  ask(
+    roomSessionId: string,
+    request: {
+      agentId: string;
+      prompt: unknown;
+      from: { sessionId: string; agentId?: string };
+      id?: string;
+      hop?: number;
+      onSettled?: (detail: AgentRoomTurnDetail) => void;
+      follow?: (submissionId: string) => unknown;
+    }
+  ): Promise<boolean>;
+  relay(
+    memberSessionId: string,
+    prompt: string,
+    options?: { id?: string; hop?: number; follow?: (submissionId: string) => unknown }
+  ): Promise<{ settled: Promise<string> }>;
+  stop(roomSessionId: string): boolean;
+}
+export function registerAgentRoomHost(host: AgentRoomHost): () => void;
+export function agentRoomHost(): AgentRoomHost;

package/src/runtime/shared/agent-room-host.mjs

@@ -0,0 +1,58 @@
+// Runtime → desktop request channel for group rooms. Rooms run only in the
+// desktop service hosted in this daemon (apps/desktop agent-rooms.ts): it
+// registers a host here, and the `session` tool's sends to a room, and the
+// relay turns of a member's own reported work, go through it.
+//
+// Deliberately dependency-free, like session-sidebar-host.mjs: the desktop
+// service bundle imports this file too, and both copies share one registry
+// through a global symbol.
+
+const HOSTS_KEY = Symbol.for('mixdog.agentRoomHosts.v1');
+
+function hosts() {
+  globalThis[HOSTS_KEY] ??= [];
+  return globalThis[HOSTS_KEY];
+}
+
+/**
+ * Register a desktop room host:
+ * - `member(roomSessionId, { to, prompt })` → `{ agentId, name, sessionId, text }`:
+ *   the addressed member (by `to`, an agent id or display name, else a leading
+ *   `@name` in `prompt`), its member session, and the message without that
+ *   mention; throws when none resolves.
+ * - `ask(roomSessionId, { agentId, prompt, from, id?, hop?, onSettled? })` →
+ *   true: a message from another session (`from: { sessionId, agentId? }`)
+ *   posted as its row and answered by that member alone; `onSettled(detail)`
+ *   gets the member's turn end as a session turn's (`{ status, result?,
+ *   error? }`).
+ * - `relay(memberSessionId, prompt, { id?, hop? })` → `{ settled }`: the
+ *   member's turn in its room relaying `prompt` (its reported work); `settled`
+ *   resolves the turn's end status ('done' when it finished).
+ * - `stop(roomSessionId)` → boolean: the room's stop button: the speaking
+ *   member's turn is cancelled, queued calls settle cancelled, and no one else
+ *   gets a turn; true when an exchange was running.
+ * `hop`: the send's or report's place in a bot-to-bot chain (bot-hops.mjs);
+ * the member's turn carries it, so the sends it makes count on from there.
+ * `follow(submissionId)` (both): the turn that answers is submitted under
+ * another id than `id` (one turn for several calls, or a fresh turn for one
+ * cut short); the host awaits it before submitting, so the caller's durable
+ * record follows that turn across a restart.
+ * @returns {() => void} Unregister.
+ */
+export function registerAgentRoomHost(host) {
+  const entry = { host };
+  hosts().push(entry);
+  return () => {
+    const list = hosts();
+    const index = list.indexOf(entry);
+    if (index >= 0) list.splice(index, 1);
+  };
+}
+
+/** The active (most recently registered) desktop room host; throws when no
+ *  desktop app is attached, since nothing else runs a room. */
+export function agentRoomHost() {
+  const active = hosts().at(-1);
+  if (!active) throw new Error('group rooms run in the desktop app, and no desktop app is attached to this runtime');
+  return active.host;
+}

package/src/runtime/shared/bot-hops.mjs

@@ -2,22 +2,27 @@
 // transcript meta of the message it delivers, and in the report that answers
 // it). A turn knows the hop of the submission that started it (`turnHop`,
 // stamped on the session when the turn is prepared); a send made in it goes
-// out at turnHop + 1. A turn started by the user or by a routine starts at 0;
-// a runtime notification keeps the hop of the work it belongs to.
+// out at turnHop + 1. Only a message another bot sent counts: a turn started by
+// the user, a routine or a runtime notification (a task report, a wake) starts
+// at 0, so a bot's reports of its own sends never use up its budget. Background
+// work (a command, an agent task) launched in a bot-descended turn carries that
+// turn's hop on its completion notification (`hop` in the completion meta and
+// entry), and the turn the notification starts or joins resumes at it.
 export const MAX_BOT_HOPS = 3;
 export const BOT_HOP_LIMIT_ERROR = 'session: Bot-to-bot chain limit reached; ask the user before continuing.';
 
-const hopOf = (value) => (Number.isInteger(value) && value > 0 ? value : 0);
+export const hopOf = (value) => (Number.isInteger(value) && value > 0 ? value : 0);
 
-/** The hop a turn starts at: its submission's own, else (a runtime
- *  notification, `runtimeSource`) the hop the session was already at, else 0. */
-export function startingTurnHop(transcriptMeta, runtimeSource, previous) {
-  return hopOf(transcriptMeta?.hop) || (runtimeSource ? hopOf(previous) : 0);
-}
+/** The hop of the turn that made a send, from the send's own place in the chain
+ *  (`hop`, as a task report or watch carries it, with its `target`): a send to
+ *  another session is one hop past its turn, one to a task session the bot
+ *  created only continues it. A report wakes the sender's turn back at this
+ *  depth: bot-descended work resumes where it was, independent work at 0. */
+export const sendDepth = ({ hop, target } = {}) => Math.max(0, hopOf(hop) - (target === 'session' ? 1 : 0));
 
-/** Stamp the starting hop on `session` for the turn about to run. */
-export function stampTurnHop(session, transcriptMeta, runtimeSource) {
-  session.turnHop = startingTurnHop(transcriptMeta, runtimeSource, session.turnHop);
+/** Stamp the hop of the submission that starts the turn (else 0) on `session`. */
+export function stampTurnHop(session, transcriptMeta) {
+  session.turnHop = hopOf(transcriptMeta?.hop);
 }
 
 /** A bot's message steered into the running turn raises the turn's hop. */

package/src/runtime/shared/redact-directories.mjs

@@ -0,0 +1,18 @@
+import { pathToFileURL } from 'node:url';
+
+/**
+ * `text` with every mention of the given directories taken out (and the
+ * separator after it), whether written as a native path, with forward slashes
+ * or as a file URL, so an error never discloses a private scratch location.
+ */
+export function redactDirectories(text, directories) {
+  let out = String(text ?? '');
+  for (const directory of directories) {
+    if (!directory) continue;
+    const forms = new Set([directory, directory.replaceAll('\\', '/'), pathToFileURL(directory).href]);
+    for (const form of [...forms].sort((a, b) => b.length - a.length)) {
+      out = out.split(`${form}\\`).join('').split(`${form}/`).join('').split(form).join('');
+    }
+  }
+  return out;
+}

package/src/runtime/shared/remove-directory.mjs

@@ -0,0 +1,28 @@
+import { rm } from 'node:fs/promises';
+
+export const REMOVE_RETRY_MS = 100;
+const REMOVE_ATTEMPTS = 6;
+const RETRYABLE_REMOVE_CODES = new Set(['EBUSY', 'EPERM', 'ENOTEMPTY', 'EACCES']);
+
+/**
+ * Removes a private scratch folder. A process that just exited can still hold
+ * its files for a moment on Windows, so a busy folder is retried briefly; a
+ * failure that persists is logged (never swallowed) and does not throw.
+ */
+export async function removeDirectoryWithRetry(
+  dir,
+  { remove = rm, log = (line) => process.stderr.write(line), retryMs = REMOVE_RETRY_MS } = {}
+) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await remove(dir, { recursive: true, force: true });
+      return;
+    } catch (error) {
+      if (attempt >= REMOVE_ATTEMPTS || !RETRYABLE_REMOVE_CODES.has(error?.code)) {
+        log(`scratch folder ${dir} could not be removed: ${error?.message || error}\n`);
+        return;
+      }
+      await new Promise((resolve) => setTimeout(resolve, retryMs * attempt));
+    }
+  }
+}

package/src/runtime/shared/session-sidebar-host.d.mts

@@ -1,4 +1,13 @@
-export type SessionSidebarChange = { favorite: boolean } | { archived: boolean };
+export type SessionSidebarChange =
+  | { favorite: boolean }
+  | { archived: boolean }
+  | { archived: true; cascade: false }
+  | { forgotten: true };
 export type SessionSidebarHost = (sessionId: unknown, change: unknown) => unknown;
-export function registerSessionSidebarHost(host: SessionSidebarHost): () => void;
+export type SessionSidebarState = { archived: Record<string, number> };
+export function registerSessionSidebarHost(
+  host: SessionSidebarHost,
+  options?: { state?: (() => SessionSidebarState | Promise<SessionSidebarState>) | null }
+): () => void;
 export function applySessionSidebarChange(sessionId: string, change: SessionSidebarChange): Promise<void>;
+export function readSessionSidebarState(): Promise<SessionSidebarState | null>;

package/src/runtime/shared/session-sidebar-host.mjs

@@ -15,11 +15,15 @@ function hosts() {
 
 /**
  * Register a desktop host. `host(sessionId, change)` applies one change:
- * `{ favorite: boolean }` or `{ archived: boolean }`.
+ * `{ favorite: boolean }`, `{ archived: boolean }` (an archive takes the
+ * session's sub-agent sessions with it, a restore brings back the ones it took),
+ * `{ archived: true, cascade: false }` (that session alone)
+ * or `{ forgotten: true }` (a session the store deleted: its records go).
+ * `state()` answers the archive flags: `{ archived }`, session id → stamp.
  * @returns {() => void} Unregister.
  */
-export function registerSessionSidebarHost(host) {
-  const entry = { host };
+export function registerSessionSidebarHost(host, { state = null } = {}) {
+  const entry = { host, state: typeof state === 'function' ? state : null };
   hosts().push(entry);
   return () => {
     const list = hosts();
@@ -36,3 +40,12 @@ export async function applySessionSidebarChange(sessionId, change) {
   if (!active) throw new Error('no desktop app is attached to this runtime');
   await active.host(sessionId, change);
 }
+
+/** The active desktop's flags, `{ archived }` (session id → epoch-ms stamp);
+ *  null when no desktop (or one without a state reader) is attached. */
+export async function readSessionSidebarState() {
+  const active = hosts().at(-1);
+  if (!active?.state) return null;
+  const state = await active.state();
+  return { archived: { ...state?.archived } };
+}

package/src/runtime/shared/tool-execution-contract.mjs

@@ -1,4 +1,5 @@
 import { clean } from './clean.mjs';
+import { hopOf } from './bot-hops.mjs';
 import {
   parseTaskNotification,
   renderTaskCompletionEnvelope,
@@ -113,6 +114,8 @@ export function normalizeToolNotifyContext(context = {}) {
     callerSessionId: callerSessionId || null,
     routingSessionId: routingSessionId || null,
     clientHostPid,
+    // The bot-chain hop of the turn that launched the work (bot-hops.mjs).
+    ...(hopOf(context.hop) ? { hop: context.hop } : {}),
   };
 }
 
@@ -133,6 +136,7 @@ function toolCompletionMeta({ surface = 'tool', id, status, resultType, instruct
       ? { routing_session_id: ctx.routingSessionId }
       : {}),
     ...(ctx.clientHostPid ? { client_host_pid: String(ctx.clientHostPid) } : {}),
+    ...(ctx.hop ? { hop: ctx.hop } : {}),
   };
 }
 

package/src/runtime/shared/tool-work-units.mjs

@@ -573,6 +573,15 @@ function gitStageUnit(a) {
   });
 }
 
+function gitWorktreeUnit(a) {
+  return unitDescriptor('Git', {
+    active: 'Managing',
+    done: 'Managed',
+    noun: 'worktree',
+    effect: String(a.worktree_action || '').toLowerCase() !== 'list',
+  });
+}
+
 function cwdUnit(a) {
   const action = String(a.action || a.type || '').toLowerCase();
   // A bare `path` selects that Project even when action is omitted.
@@ -604,14 +613,6 @@ function cwdUnit(a) {
     const [active, done] = words;
     return unitDescriptor('Setup', { active, done, noun: 'session', effect: true });
   }
-  if (action.endsWith('-worktree') || action.endsWith('-worktrees')) {
-    return unitDescriptor('Setup', {
-      active: 'Managing',
-      done: 'Managed',
-      noun: 'worktree',
-      effect: !action.startsWith('list'),
-    });
-  }
   if (action === 'status') {
     return unitDescriptor('Setup', { active: 'Checking', done: 'Checked', noun: 'session' });
   }
@@ -715,7 +716,9 @@ const TOOL_UNITS = new Map([
     (a) =>
       a.action === 'stage'
         ? gitStageUnit(a)
-        : unitDescriptor('Git', { count: queryCount(a, 'command', 'commands') || 1, noun: 'Git command' }),
+        : a.action === 'worktree'
+          ? gitWorktreeUnit(a)
+          : unitDescriptor('Git', { count: queryCount(a, 'command', 'commands') || 1, noun: 'Git command' }),
   ],
   ['github', githubUnit],
   // Preserve the staging work unit when rendering historical transcripts.