mixdog 1.3.4 → 1.4.0

package/src/session-runtime/internal-tool-executor/ask-user-tool.mjs

@@ -8,29 +8,73 @@ import {
 } from '../../runtime/agent/orchestrator/runtime-core/ask-user-tool-defs.mjs';
 import { createCallerContextResolvers } from './caller-context.mjs';
 import { runAbortable } from '../../runtime/shared/abort-race.mjs';
-import { SECRET_REQUEST_TIMEOUT_MS } from '../../runtime/agent/orchestrator/session/human-gate/requests.mjs';
+import {
+  HANDOFF_OUTCOMES as AGENT_OUTCOMES,
+  SECRET_REQUEST_TIMEOUT_MS,
+} from '../../runtime/agent/orchestrator/session/human-gate/requests.mjs';
 import {
   agentIdForSession,
   recordHumanDecision,
   unattendedApprovalPort,
 } from '../../runtime/agent/orchestrator/session/human-gate/gate.mjs';
-import { browserSecretInput } from '../../runtime/browser-bridge/client.mjs';
-import { computerSecretInput } from '../../runtime/computer-bridge/client.mjs';
+import { browserHandoffPage, browserSecretInput } from '../../runtime/browser-bridge/client.mjs';
+import { computerSecretBind, computerSecretInput } from '../../runtime/computer-bridge/client.mjs';
+
+/** The settle reason of a takeover that expired (desktop takeover-gate.ts
+ *  TAKEOVER_EXPIRED_REASON). */
+const TAKEOVER_EXPIRED_REASON = 'expired';
+
+/**
+ * The agent's result of a secret request, from the card's answer and the
+ * desktop's fill: one of requests.mjs HANDOFF_OUTCOMES. `fill` runs only for a provided
+ * value and answers 'entered' / 'no_field' / 'page_changed' / 'blocked' /
+ * 'expired'.
+ */
+export async function secretOutcome(result, fill) {
+  if (result?.timedOut === true || result?.reason === TAKEOVER_EXPIRED_REASON) return 'expired';
+  if (result?.approved !== true || result.response !== 'provide-secret') return 'user_skipped';
+  const filled = await fill();
+  return AGENT_OUTCOMES.includes(filled) && filled !== 'user_skipped' ? filled : 'blocked';
+}
+
+/** A page address as the agent may see it: origin and path, no query or
+ *  fragment (a sign-in redirect can carry a code or token there). */
+function factUrl(value) {
+  try {
+    const url = new URL(String(value || ''));
+    return url.protocol === 'http:' || url.protocol === 'https:' ? `${url.origin}${url.pathname}` : '';
+  } catch {
+    return '';
+  }
+}
+
+/** The agent's result of a takeover: what the user did and where the page is
+ *  now, never "signed in" (the agent checks the page). */
+export function takeoverOutcome(result, pageUrl = '') {
+  if (result?.timedOut === true || result?.reason === TAKEOVER_EXPIRED_REASON) return 'expired';
+  if (result?.approved !== true) return 'user_skipped';
+  const url = factUrl(pageUrl);
+  const did = result.reason === 'saved_login' ? 'User chose a saved login; it was filled in' : 'User pressed Done';
+  return url ? `${did}; page now at ${url}` : did;
+}
 
 /**
- * A secret or takeover handoff. Secret: the card collects the value on the
- * desktop, which holds it for `requestId` and fills it into the target field
- * (isolated-world fill for the browser, one-shot typed input for computer
- * use); here only the verdict travels, and the result is exactly 'provided',
- * 'skipped' or 'timeout'. Takeover: the run waits until the user says done
- * (computer and browser actions stay blocked meanwhile, desktop
- * main/takeover-gate.ts); the result is 'done' or 'denied'.
+ * A secret or takeover handoff. Secret: at request time the desktop binds the
+ * request to its page ({pageId, origin}) or, for computer use, it is bound to
+ * {window_id, ref}; the card collects the value on the desktop, which holds it
+ * for `requestId` and fills only that page, only while its origin is
+ * unchanged. Here only the outcome travels (secretOutcome). Takeover: the run
+ * waits until the user says done (that session's actions stay blocked
+ * meanwhile, desktop main/takeover-gate.ts); the result is takeoverOutcome's.
  */
 export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId, signal, inputs = {} }) {
   const secretInput = {
     browser: inputs.browser || browserSecretInput,
     computer: inputs.computer || computerSecretInput,
   };
+  const page = inputs.page || browserHandoffPage;
+  const bindComputer = inputs.computerBind || computerSecretBind;
+  const identity = handoff.identity || {};
   const gate = {
     agentId: agentIdForSession(sessionId),
     kind: handoff.kind,
@@ -47,32 +91,84 @@ export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId,
     return UNATTENDED_TAKEOVER;
   }
   if (typeof hook !== 'function') {
-    // Nobody can take over here: blocked, never "proceed".
+    // Nobody can take over or type here: blocked, never "proceed".
     if (handoff.kind === 'takeover') return NO_TAKEOVER;
-    await recordHumanDecision(gate, { response: 'skipped' });
-    return 'skipped';
+    await recordHumanDecision(gate, { response: 'blocked' });
+    return 'blocked';
   }
   if (handoff.kind === 'secret') {
     const requestId = `secret_${randomUUID()}`;
+    // Bound now: the page (and its origin) the value may go to, and what its
+    // field is. A browser page that cannot be bound, or has no such field,
+    // never asks the user for a value it could not place.
+    let bound = {};
+    if (handoff.surface === 'browser') {
+      const facts = await page(
+        sessionId,
+        'secret_bind',
+        { request_id: requestId, ...(identity.tab ? { tab: identity.tab } : {}), field: handoff.field },
+        { signal }
+      );
+      let outcome = '';
+      if (!facts?.origin) outcome = 'blocked';
+      else if (!facts.form) outcome = 'no_field';
+      if (outcome) {
+        await recordHumanDecision(gate, { response: outcome });
+        return outcome;
+      }
+      bound = { origin: facts.origin, form: facts.form, ...(facts.length ? { length: facts.length } : {}) };
+    } else {
+      // Computer Use: bound to the exact window and field ref the agent named
+      // (from snapshot/find). Without both there is no field to confirm, and
+      // none is made up (never the focused field or the front window).
+      const outcome =
+        identity.windowId && identity.ref
+          ? await bindComputer(sessionId, requestId, { windowId: identity.windowId, ref: identity.ref, signal })
+          : 'no_field';
+      if (outcome !== 'bound') {
+        const refused = outcome === 'no_field' ? 'no_field' : 'blocked';
+        await recordHumanDecision(gate, { response: refused });
+        return refused;
+      }
+    }
     const result = await runAbortable(signal, () =>
       hook({
         name: 'ask_user',
         kind: 'secret',
-        secret: { requestId, surface: handoff.surface, target: handoff.target, field: handoff.field },
+        secret: { requestId, surface: handoff.surface, target: handoff.target, field: handoff.field, ...bound },
         reason: '',
         timeoutMs: SECRET_REQUEST_TIMEOUT_MS,
         sessionId,
         toolCallId,
       })
     );
-    let verdict = 'skipped';
-    if (result?.timedOut === true) verdict = 'timeout';
-    else if (result?.approved === true && result.response === 'provide-secret') {
-      verdict = await secretInput[handoff.surface](sessionId, requestId, { signal });
-    }
-    await recordHumanDecision(gate, { response: verdict, device: result?.device });
-    return verdict;
+    const computerTarget = {
+      ...(identity.ref ? { ref: identity.ref } : {}),
+      ...(identity.windowId ? { windowId: identity.windowId } : {}),
+    };
+    const outcome = await secretOutcome(result, () =>
+      secretInput[handoff.surface](sessionId, requestId, {
+        signal,
+        ...(handoff.surface === 'computer' ? computerTarget : {}),
+      })
+    );
+    await recordHumanDecision(gate, { response: outcome, device: result?.device });
+    return outcome;
   }
+  // A sign-in page's saved logins (masked) let the card fill one for the
+  // user: the desktop offers them only for a page on that origin, bound now
+  // under `fillId` so the fill reaches that page alone (host-agent.ts fillBoundLogin).
+  const fillId = handoff.login ? `secret_${randomUUID()}` : '';
+  const accounts = handoff.login
+    ? (
+        await page(
+          sessionId,
+          'login_accounts',
+          { url: handoff.login.url, request_id: fillId, ...(identity.tab ? { tab: identity.tab } : {}) },
+          { signal }
+        )
+      )?.accounts
+    : null;
   const result = await runAbortable(signal, () =>
     hook({
       name: 'ask_user',
@@ -81,9 +177,10 @@ export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId,
         surface: handoff.surface,
         instructions: handoff.instructions,
         target: handoff.target,
-        ...handoff.identity,
+        ...identity,
         // A login takeover: the desktop opens its sign-in window on this page.
         ...(handoff.login ? { purpose: 'login', url: handoff.login.url } : {}),
+        ...(Array.isArray(accounts) && accounts.length ? { accounts, fillId } : {}),
       },
       args: { surface: handoff.surface, instructions: handoff.instructions },
       reason: '',
@@ -92,8 +189,15 @@ export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId,
       toolCallId,
     })
   );
-  const answer = result?.approved === true ? 'done' : 'denied';
-  await recordHumanDecision(gate, { response: answer, device: result?.device });
+  const pageUrl =
+    result?.approved === true && handoff.surface === 'browser'
+      ? (await page(sessionId, 'page_url', identity.tab ? { tab: identity.tab } : {}, { signal }))?.url
+      : '';
+  const answer = takeoverOutcome(result, pageUrl);
+  await recordHumanDecision(gate, {
+    response: answer.startsWith('User ') ? 'done' : answer,
+    device: result?.device,
+  });
   return answer;
 }
 
@@ -125,7 +229,7 @@ const DISMISSED =
   'User closed the questions without answering. Proceed with your best judgment; ask again only if something new depends on it.';
 
 /** Wire answers -> array aligned with questions; invalid entries become null. */
-export function normalizeAskUserAnswers(answers, questions) {
+function normalizeAskUserAnswers(answers, questions) {
   const list = Array.isArray(answers) ? answers.slice(0, 4) : [];
   return questions.map((q, i) => {
     const entry = list[i];
@@ -143,7 +247,7 @@ export function normalizeAskUserAnswers(answers, questions) {
 
 // Strings are JSON-quoted so a quote inside one cannot end it early; typed
 // text stays apart from the picked labels (`"picked" + "typed" (typed)`).
-export function formatAskUserAnswers(questions, answers) {
+function formatAskUserAnswers(questions, answers) {
   const quote = (text) => JSON.stringify(text);
   const parts = questions.map((q, i) => {
     const a = answers[i];
@@ -157,14 +261,14 @@ export function formatAskUserAnswers(questions, answers) {
 
 /** A composer message sent instead of (or with) picking: kept when it is a
  *  non-empty string within the typed-answer limit, else dropped. */
-export function normalizeAskUserReply(reply) {
+function normalizeAskUserReply(reply) {
   if (typeof reply !== 'string' || reply.length > ASK_USER_MAX_TEXT) return '';
   return reply.trim();
 }
 
 // `User replied in chat: "<reply>". ` leads, then the usual picks sentence
 // when any question was answered, else just the closing sentence.
-export function formatAskUserResult(questions, answers, reply) {
+function formatAskUserResult(questions, answers, reply) {
   if (!reply) return formatAskUserAnswers(questions, answers);
   const lead = `User replied in chat: ${JSON.stringify(reply)}. `;
   if (answers.some(Boolean)) return `${lead}${formatAskUserAnswers(questions, answers)}`;

package/src/session-runtime/internal-tool-executor/bridge-tools.mjs

@@ -45,6 +45,8 @@ export function createBridgeToolHandlers({ rt }) {
       cwd: callerCwd,
       requestApproval: callerCtx?.toolApprovalHook,
       toolCallId: callerCtx?.toolCallId || null,
+      // The agent turn, as for the browser: it scopes a saved-login fill's protection.
+      turnId: callerCtx?.turnId || rt.session?.usageMetricsTurnId,
       signal: signalFor(callerCtx),
     });
   };

package/src/session-runtime/internal-tool-executor/reaction-tool.mjs

@@ -0,0 +1,45 @@
+// react: a bot's emoji reaction on the user's message (message-reactions.mjs).
+// Only a bot's own chat with the user may react: its home chat, where the
+// message is in the chat's own transcript, or its seat in a group room, where
+// the message is the user's row in the room's log. Never a coding session, a
+// delegated worker, or a run nobody attends.
+import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
+import { noteReactionTarget, validateReactionArgs } from '../../runtime/agent/orchestrator/runtime-core/reaction-tool-defs.mjs';
+import { agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { roomMemberOfSession, roomSessionId } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
+import { reactInSession } from '../../runtime/agent/orchestrator/session/message-reactions.mjs';
+import { agentHomeLiveSurface } from '../agent-home-delivery.mjs';
+import { reactInRoom } from '../agent-room-delivery.mjs';
+import { scheduleCallerScope } from '../services/schedule-access.mjs';
+
+const DONE =
+  'The user sees it under their message. Say nothing about it; reply only if the message also needs an answer.';
+
+export function createReactionToolHandlers({ rt, live = agentHomeLiveSurface, roomReact = reactInRoom }) {
+  return {
+    react: async (args, { callerCtx }) => {
+      const sessionId = callerCtx?.callerSessionId || rt.session?.id || '';
+      const session = rt.session?.id === sessionId ? rt.session : null;
+      const member = roomMemberOfSession(sessionId);
+      const agentId = member?.agentId || agentIdOfHomeSession(sessionId);
+      if (!session || !agentId || isAgentOwner(session)) {
+        throw new Error("react: reactions belong to a bot's own chat with the user");
+      }
+      if (scheduleCallerScope(session).unattended === true) {
+        throw new Error('react: nobody is in this run to see a reaction');
+      }
+      const { emoji, messagesBack } = validateReactionArgs(args);
+      const change = { agentId, emoji, messagesBack };
+      let result;
+      if (member) result = await roomReact(roomSessionId(member.roomId), change);
+      else {
+        result = reactInSession(session, change);
+        // The chat's own turn saves the transcript; its open views show it now.
+        if (result.changed) live()?.react?.(sessionId, result.messageId, result.reactions);
+      }
+      if (!emoji) return result.changed ? 'Removed your reaction.' : 'You had no reaction on that message.';
+      noteReactionTarget(sessionId, callerCtx?.toolCallId, { messageId: result.messageId, room: Boolean(member) });
+      return `Reacted ${emoji}. ${DONE}`;
+    },
+  };
+}

package/src/session-runtime/internal-tool-executor/workspace-tools.mjs

@@ -6,11 +6,17 @@ import { listProjects } from '../../runtime/shared/projects.mjs';
 import { applySessionSidebarChange } from '../../runtime/shared/session-sidebar-host.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { AGENT_MODE, resolveSessionMode } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
-import { agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import {
+  MIXY_AGENT_ID,
+  agentHomeSessionId,
+  agentIdOfHomeSession,
+} from '../../runtime/agent/orchestrator/session/agent-home.mjs';
 import { turnHopOf } from '../../runtime/shared/bot-hops.mjs';
+import { isHeartbeatSession } from '../../runtime/shared/routine-trigger.mjs';
 import { scheduleCallerScope } from '../services/schedule-access.mjs';
 import { worktreeCallerScope } from '../services/worktree-access.mjs';
 import { resolveHandoffAttachments, sessionRoots } from '../handoff-attachments.mjs';
+import { delegationChainOf } from '../bot-chain.mjs';
 
 const USER_TITLE_ERROR = 'session: the user already titled this session; the title was not changed';
 
@@ -53,6 +59,14 @@ export function createWorkspaceToolHandlers({
     return rt.session.id;
   };
 
+  // Mixy's hidden heartbeat session (mixy-heartbeat.mjs), by the in-process
+  // mark on the calling session, never by tool input or stored fields.
+  const callerIsHeartbeat = (callerCtx) => isHeartbeatSession(callerCtx?.callerSessionId || rt.session?.id);
+  const HEARTBEAT_NO_HANDOFF =
+    'a heartbeat turn cannot hand work off: its result would reach nobody. Propose it to the user instead (session action suggest).';
+  // What a heartbeat turn does with sessions: read them and the bots, and record proposals.
+  const HEARTBEAT_SESSION_ACTIONS = new Set(['read', 'status', 'list', 'bots', 'suggest']);
+
   const SIDEBAR_ACTIONS = new Set(['favorite', 'archive']);
 
   // Sidebar flags only (the desktop's favorite/archive metadata).
@@ -71,12 +85,26 @@ export function createWorkspaceToolHandlers({
   const session = async (args, { callerCtx, callerCwd }) => {
     const action = clean(args?.action || (args?.path ? 'set-project' : 'status')).toLowerCase();
     const target = clean(args?.session_id);
+    if (callerIsHeartbeat(callerCtx) && !HEARTBEAT_SESSION_ACTIONS.has(action)) {
+      throw new Error(
+        `session: ${
+          action === 'create' || action === 'send'
+            ? HEARTBEAT_NO_HANDOFF
+            : `a heartbeat turn only reads sessions and bots and records proposals; action=${action} is refused`
+        }`
+      );
+    }
     if (
       ['list', 'bots', 'read', 'send', 'cancel', 'delete', 'create'].includes(action) ||
       (action === 'status' && target)
     ) {
       const callerSessionId = assertLead(action, callerCtx);
+      // `callerAgentId`: the bot whose conversation gets results reported
+      // back; `callerBotId`: the bot the caller acts as, attended or not,
+      // for what only a bot's own sessions allow (an effort change).
       const callerAgentId = attendedAgentOf(rt.session);
+      const acting = resolveSessionMode({ session: rt.session });
+      const callerBotId = acting.mode === AGENT_MODE ? acting.agentId : '';
       if (action === 'create' && !callerAgentId) {
         throw new Error(
           'session: create belongs to a bot conversation; delegated workers, agent task sessions and schedule/webhook runs cannot create agent task sessions'
@@ -105,8 +133,24 @@ export function createWorkspaceToolHandlers({
           {
             callerSessionId,
             callerAgentId,
+            callerBotId,
             callerCwd,
-            ...(action === 'send' || action === 'create' ? { callerHop: turnHopOf(rt.session) } : {}),
+            ...(action === 'send' || action === 'create'
+              ? {
+                  callerHop: turnHopOf(rt.session),
+                  // The bot chain this turn acts in (bot-chain.mjs), checked
+                  // against the target and carried to the turn it starts —
+                  // only when the sender is a bot conversation (a bot's chat,
+                  // room seat or run); any other session hands work to any
+                  // bot as before, whatever started its turn (the hop limit
+                  // still bounds a loop).
+                  callerBotChain: callerBotId
+                    ? delegationChainOf(callerSessionId, (id) =>
+                        id === rt.session?.id ? rt.session : getSessionManager()?.getSession?.(id) || null
+                      )
+                    : [],
+                }
+              : {}),
             // Whether a create may provision a worktree (worktree-access.mjs).
             ...(action === 'create' ? { callerScope: worktreeCallerScope(rt.session) } : {}),
             // Which bots and sessions it may see (bot-status.mjs).
@@ -116,6 +160,16 @@ export function createWorkspaceToolHandlers({
         )
       );
     }
+    // Mixy's proposals to the user (mixy-heartbeat.mjs): kept so none repeats.
+    if (action === 'suggest') {
+      const sessionId = assertLead(action, callerCtx);
+      if (sessionId !== agentHomeSessionId(MIXY_AGENT_ID) && !callerIsHeartbeat(callerCtx)) {
+        throw new Error("session: suggest belongs to Mixy's chat");
+      }
+      const { recordSuggestion } = await import('../mixy-heartbeat.mjs');
+      const receipt = recordSuggestion({ key: args?.key, text: args?.title, dismissed: args?.value === false });
+      return JSON.stringify({ action, ...receipt }, null, 2);
+    }
     if (target && target !== assertLead(action, callerCtx)) {
       throw new Error(`session: action=${action} only applies to the current session`);
     }
@@ -184,6 +238,9 @@ export function createWorkspaceToolHandlers({
           project: current?.workspace?.projectPath || current?.desktopSession?.projectPath || currentCwd,
           provider: current?.provider || null,
           model: current?.model || null,
+          effort: current?.effort || null,
+          autoEffort: current?.autoEffort !== false,
+          fast: current?.fast === true,
         },
         null,
         2
@@ -229,12 +286,22 @@ export function createWorkspaceToolHandlers({
 
   return {
     session,
-    goal: async (args, { name, callerCtx }) =>
-      await goalRuntime.executeTool(name, args || {}, {
+    goal: async (args, { name, callerCtx }) => {
+      // A Goal keeps working in its session across turns: a heartbeat's would
+      // run on unseen in the hidden session.
+      if (['create', 'resume'].includes(clean(args?.action).toLowerCase()) && callerIsHeartbeat(callerCtx)) {
+        throw new Error(`goal: ${HEARTBEAT_NO_HANDOFF}`);
+      }
+      return await goalRuntime.executeTool(name, args || {}, {
         callerSessionId: callerCtx?.callerSessionId || rt.session?.id || rt.reservedSessionId || null,
-      }),
+      });
+    },
     agent: async (args, { callerCtx, callerCwd }) => {
       const callerSessionId = callerCtx?.callerSessionId || rt.session?.id || null;
+      // The agent tool's action is `type`, spawn when omitted (agent-tool/execute.mjs).
+      if (['spawn', 'send'].includes((clean(args?.type) || 'spawn').toLowerCase()) && callerIsHeartbeat(callerCtx)) {
+        throw new Error(`agent: ${HEARTBEAT_NO_HANDOFF}`);
+      }
       // `attachmentParts` is never the model's to set: only the resolved
       // `attachments` reach the agent's turn.
       const { attachments, attachmentParts: _ignored, ...rest } = args || {};

package/src/session-runtime/internal-tool-executor.mjs

@@ -10,6 +10,7 @@ import { createAskUserToolHandlers } from './internal-tool-executor/ask-user-too
 import { createBridgeToolHandlers } from './internal-tool-executor/bridge-tools.mjs';
 import { createFeatureToolHandlers } from './internal-tool-executor/feature-tools.mjs';
 import { createKnowledgeToolHandlers } from './internal-tool-executor/knowledge-tools.mjs';
+import { createReactionToolHandlers } from './internal-tool-executor/reaction-tool.mjs';
 import { createWorkspaceToolHandlers } from './internal-tool-executor/workspace-tools.mjs';
 
 export function createInternalToolExecutor({
@@ -40,6 +41,7 @@ export function createInternalToolExecutor({
   const handlers = {
     ...createBridgeToolHandlers({ rt }),
     ...createAskUserToolHandlers({ rt }),
+    ...createReactionToolHandlers({ rt }),
     ...createFeatureToolHandlers({ rt, setupTool, officeToolsEnabled, mediaToolEnabled, tidyToolEnabled }),
     ...createKnowledgeToolHandlers({
       rt,
@@ -80,6 +82,8 @@ export function createInternalToolExecutor({
 
   return async (name, args, callerCtx = {}) => {
     const callerCwd = clean(callerCtx?.callerCwd) || rt.currentCwd;
+    // The Reactions setting gates the tool whoever calls it, not only the model.
+    if (name === 'react' && rt.config?.reactions === false) throw new Error('reactions are turned off in settings');
     if (callerCtx?.invocationSource === 'model-tool') guardModelCall(name);
     if (Object.hasOwn(handlers, name)) return handlers[name](args, { name, callerCtx, callerCwd });
     if (channels.isChannelTool(name)) {

package/src/session-runtime/lifecycle/inheritance.mjs

@@ -15,6 +15,10 @@ import {
   inheritanceRouteTarget,
 } from '../inheritance-fit.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import {
+  rebindToChangedPrefix,
+  requestPrefixIdentity,
+} from '../../runtime/agent/orchestrator/session/thinking-binding.mjs';
 import { buildColdHeir, committedSource, persistColdHeir } from './cold-heir.mjs';
 
 export function createInheritance(deps, { compactConversation, saveSession }) {
@@ -155,8 +159,17 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
   async function carryConversation(source, target, { compact = false } = {}) {
     // System blocks belong to the session that BUILT them: the target's own
     // prompt was composed for the current model, tool surface, and workflow.
-    // Only the conversation itself travels.
-    let carried = inheritableMessages(source.messages);
+    // Only the conversation itself travels — without its thinking replay when
+    // the heir's prompt or tools differ from the source's: that replay is
+    // bound to the source's prefix, so the provider would drop it (and every
+    // thinking block after it) or refuse it, while the heir's context estimate
+    // kept counting it (thinking-binding.mjs); an open tool round the source
+    // stopped in is ended for the heir. An identical prefix keeps it all.
+    const carrySource =
+      requestPrefixIdentity(source) === requestPrefixIdentity(target)
+        ? source
+        : { ...source, messages: rebindToChangedPrefix(source.messages) };
+    let carried = inheritableMessages(carrySource.messages);
     if (!hasUserConversationMessage(carried)) {
       throw new Error('inheritFrom: the source session has no conversation to carry');
     }
@@ -169,7 +182,7 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
     // compact:true summarizes even a conversation that fits; otherwise only
     // one that cannot fit is compacted.
     if (compact || (fit.known && !fit.fits)) {
-      const next = await fitConversationForHeir(source, target, carried, fit, { required: compact });
+      const next = await fitConversationForHeir(carrySource, target, carried, fit, { required: compact });
       compacted = next !== carried;
       carried = next;
     }

package/src/session-runtime/lifecycle/session-catalog.mjs

@@ -77,7 +77,9 @@ export function leadSessionRow(s, working = false) {
   if (sourceType === 'exec') return null;
   if (!agentSession && !isLeadShaped(s, owner, sourceType)) return null;
   const { preview, messageCount, realTurnCount, incomingTail } = previewOf(s);
-  if (!preview && messageCount === 0) return null;
+  // A titled one is not scratch: its prompt was rewound away (Esc-Esc message
+  // selector), so it stays listed rather than vanishing with its open tab.
+  if (!preview && messageCount === 0 && !cleanSessionPreview(s.title || '', 100)) return null;
   const lastMessageRoutine = normalizeRoutineProvenance(s.lastMessageRoutine);
   return {
     id: s.id,

package/src/session-runtime/lifecycle/teardown/runtime-stops.mjs

@@ -5,6 +5,17 @@
  * close, all-settled for a full one.
  */
 import { releaseComputerSession } from '../../../runtime/computer-bridge/client.mjs';
+import {
+  pendingSummaryIndexIds,
+  settleSummaryIndexWrites,
+} from '../../../runtime/agent/orchestrator/session/store-summary-index.mjs';
+import { settleGatewayUsageWrites } from '../../../runtime/agent/orchestrator/providers/statusline-route-meta.mjs';
+import { closeSessionSearch } from '../../../runtime/session-search/session-search-ingest.mjs';
+
+// How long a close waits for a stop that owns files (memory, goals, and the
+// close's own persistence): briefly for a detached close, longer for a full one.
+const DETACHED_FILE_STOP_MS = 1500;
+const FULL_FILE_STOP_MS = 5500;
 
 export function startRuntimeStops(deps, reason, { detach, isProcessExit }) {
   const { mcpClient, getMcpScopeId, closePatchRuntimeIfLoaded, getMemoryModPromise, setMemoryModPromise } = deps;
@@ -66,8 +77,8 @@ export async function settleDetached(withTeardownDeadline, stops) {
   const bounded = [
     [stops.channelStop, 300],
     [stops.shellJobsStop, 300],
-    [stops.memoryStop, 1500],
-    [stops.goalStop, 1500],
+    [stops.memoryStop, DETACHED_FILE_STOP_MS],
+    [stops.goalStop, DETACHED_FILE_STOP_MS],
   ];
   for (const [stop, deadlineMs] of bounded) {
     try {
@@ -79,14 +90,49 @@ export async function settleDetached(withTeardownDeadline, stops) {
   }
 }
 
+/**
+ * The close's deferred data-dir writes, under the file-stop deadline: this
+ * session's summary-index ops (every queued op when no session is closing),
+ * the buffered gateway usage events with their compaction, and this session's
+ * session-search writes (cancelled, PostgreSQL install included). Past the
+ * deadline the close stops waiting and reports what is still pending; those
+ * writes stay queued and land later.
+ */
+export async function settlePersistence(withTeardownDeadline, { detach, closingSessionId }) {
+  const ids = closingSessionId ? [closingSessionId] : null;
+  const giveUp = new AbortController();
+  const pending = new Set(['summary index', 'gateway usage', 'session search']);
+  const track = (name, work) =>
+    Promise.resolve(work).then((settled) => {
+      if (settled !== false) pending.delete(name);
+    });
+  const settled = await withTeardownDeadline(
+    Promise.all([
+      track('summary index', settleSummaryIndexWrites({ ids, signal: giveUp.signal })),
+      track('gateway usage', settleGatewayUsageWrites()),
+      track('session search', closingSessionId ? closeSessionSearch(closingSessionId) : null),
+    ]).then(() => true),
+    detach ? DETACHED_FILE_STOP_MS : FULL_FILE_STOP_MS,
+    false
+  );
+  if (settled) return;
+  giveUp.abort();
+  const detail = [...pending].map((name) =>
+    name === 'summary index' && ids ? `summary index (sessions: ${pendingSummaryIndexIds(ids).join(', ')})` : name
+  );
+  process.emitWarning(`close persistence incomplete; still pending: ${detail.join('; ')}`, {
+    code: 'TEARDOWN_PERSISTENCE_PENDING',
+  });
+}
+
 export async function settleAll(withTeardownDeadline, stops) {
   await Promise.allSettled([
     withTeardownDeadline(stops.channelStop, 5500, false),
     withTeardownDeadline(stops.mcpStop, 1500, false),
     withTeardownDeadline(stops.openaiWsStop, 1500, false),
     withTeardownDeadline(stops.patchStop, 1500, false),
-    withTeardownDeadline(stops.memoryStop, 5500, false),
-    withTeardownDeadline(stops.goalStop, 5500, false),
+    withTeardownDeadline(stops.memoryStop, FULL_FILE_STOP_MS, false),
+    withTeardownDeadline(stops.goalStop, FULL_FILE_STOP_MS, false),
     withTeardownDeadline(stops.shellJobsStop, 1500, false),
     withTeardownDeadline(stops.nativeToolStop, 1500, false),
     withTeardownDeadline(stops.computerStop, 1500, false),

package/src/session-runtime/lifecycle/teardown.mjs

@@ -11,7 +11,13 @@ import { flushAllIndexWrites } from '../services/agent-tool/index-write-queue.mj
 import { PROCESS_RESTART_FAILURE } from '../services/agent-tool/worker-index/row-liveness.mjs';
 import { unregisterLiveSession } from '../../runtime/shared/staged-update.mjs';
 import { abortRuntime, closeCanonicalSession, closeOwnSession, dispatchSessionEnd } from './teardown/session-close.mjs';
-import { settleAll, settleDetached, startRuntimeStops, startWorkStops } from './teardown/runtime-stops.mjs';
+import {
+  settleAll,
+  settleDetached,
+  settlePersistence,
+  startRuntimeStops,
+  startWorkStops,
+} from './teardown/runtime-stops.mjs';
 
 const CLOSE_ALL_DEADLINE_MS = 5000;
 const PROCESS_EXIT_REASON = /exit|quit|shutdown|sighup|sigint|sigterm/;
@@ -243,9 +249,22 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
     else await settleAll(withTeardownDeadline, stops);
     // Reported closed only once the barrier is on disk (closeSessionAsync),
     // and its write control is released only after that.
-    const ok = await ownClose;
-    // The session went away (idle eviction included): free its save baselines.
-    if (scope.closingSessionId) forgetSessionSaveBaseline(scope.closingSessionId, { releaseWriteControl: true });
+    let ok = false;
+    try {
+      ok = await ownClose;
+      // The session went away (idle eviction included): free its save baselines.
+      if (scope.closingSessionId) forgetSessionSaveBaseline(scope.closingSessionId, { releaseWriteControl: true });
+      // The close's saves and turns queued buffered data-dir writes (summary
+      // index ops, gateway usage events, session-search writes) that run on
+      // later ticks: land or cancel them under the teardown deadline.
+      await settlePersistence(withTeardownDeadline, scope);
+    } finally {
+      finishClose(scope);
+    }
+    return ok;
+  }
+
+  function finishClose(scope) {
     // Self-update stages in the background and swaps on the next clean launch
     // (see staged-update.mjs) — nothing installs at shutdown. On a real
     // process exit we just drop this session's live-refcount pid file so a
@@ -257,7 +276,6 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
         /* advisory refcount only */
       }
     }
-    return ok;
   }
 
   return {