mixdog 1.3.4 → 1.4.0

package/src/session-runtime/setup-tool/executor.mjs

@@ -7,11 +7,16 @@ import { builtinFeatureActive } from '../../runtime/agent/orchestrator/runtime-c
 import { ORCHESTRATION_MODES } from '../../runtime/shared/orchestration.mjs';
 import { AUTO_EFFORT_BASES } from '../../runtime/agent/orchestrator/providers/auto-effort.mjs';
 import { INSTRUCTION_FILES_MODES } from '../../runtime/shared/instruction-files-mode.mjs';
+import {
+  normalizeHeartbeatIntervalMinutes,
+  requireHeartbeatIntervalMinutes,
+} from '../../runtime/shared/heartbeat-interval.mjs';
 import { MEDIA_KINDS } from '../../runtime/media/tool-defs.mjs';
 import { SETUP_DESKTOP_DOMAINS, SETUP_HANDOFFS } from './settings-contract.mjs';
 import { executeExtendedSetupAction, publicAutomation, publicHookRule, validateMcpInput } from './extended-actions.mjs';
 import {
   assertAgentEditorAccess,
+  assertHeartbeatSetupAction,
   assertInteractiveCaller,
   assertOwnAgentSettings,
   scheduleCallerScope,
@@ -29,8 +34,32 @@ import { schemaValueError } from '../../runtime/shared/schema-value-error.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { CONNECTOR_IDS, connectorById } from '../../runtime/shared/connector-catalog.mjs';
 import profileConfig from '../../runtime/shared/profile-config.cjs';
+import { SESSION_ROUTE_HANDLERS, routePositionsStatus } from './session-route-actions.mjs';
+import { AGENT_SETTINGS_HANDLERS } from './agent-settings-actions.mjs';
+import {
+  routeFallbackPosition,
+  sessionChainSource,
+  sessionRoutePrimary,
+} from '../../runtime/agent/orchestrator/session/manager/route-fallback-chain.mjs';
+import { sameRouteModel } from '../../runtime/agent/orchestrator/session/manager/owner-route-fallbacks.mjs';
+
+const AGENT_DEFINITION_ACTIONS = new Set([
+  'create_definition',
+  'save_definition',
+  'delete_definition',
+  'restore_definition',
+]);
+// Actions on one agent's own settings: another agent's thread changes only its own.
+const OWN_AGENT_ACTIONS = new Set([
+  'set_agent_route',
+  'set_agent_permission',
+  'set_agent_connector',
+  'set_agent_connector_tool',
+]);
 
-const AGENT_DEFINITION_ACTIONS = new Set(['create_definition', 'save_definition', 'delete_definition']);
+// How a fallback chain edit reaches sessions that already run (route-fallback-chain.mjs).
+const CHAIN_APPLIES =
+  'a changed fallback chain reaches running sessions on that route from their next fallback hop ([] stops further hops at once; the turn ends with the provider error)';
 
 const PROFILE_VALUE_IDS = Object.freeze({
   language: profileConfig.PROFILE_LANGUAGES.map((entry) => entry.id),
@@ -38,12 +67,32 @@ const PROFILE_VALUE_IDS = Object.freeze({
 });
 
 const ACTION_APPLIES_TO = {
-  set_agent_route:
-    "the bot's chats from their next turn (a running turn finishes on the old model); an agent switched on or off reaches open conversations from their next turn as an agent list reminder",
+  set_route: `new sessions (an established conversation keeps its model); ${CHAIN_APPLIES}: Lead conversations and agents that inherit Main`,
+  set_agent_route: `the bot's chats from their next turn (a running turn finishes on the old model); ${CHAIN_APPLIES}: its chats and sub-agents; an agent switched on or off reaches open conversations from their next turn as an agent list reminder`,
+  reset_route_fallback:
+    'each listed session from its next turn (a running turn finishes on its fallback model): it returns to its primary and its chain starts over',
+  continue_in_model: 'that session now; its stopped turn is not resent',
+  schedule_quota_resume: "that session's stopped turn, resent at the provider's reset time",
+  cancel_quota_resume: 'that session: its pending resume is dropped; the turn stays stopped',
+  set_cache_warming_enabled: 'the next prompt-cache warm of every session; no restart required',
+  set_agent_permission: "that agent's next action of the kind, in every session",
+  set_agent_connector: "that agent's next connector tool call, in every session",
+  set_agent_connector_tool: "that agent's next call of the tool, in every session",
+  set_project_connector: 'the next connector tool call of sessions in that Project',
+  restore_definition: 'now: the bot and its chat return; its routines stay off',
+  set_bot_order: 'the Bots page and the Sessions bot section on every device',
   set_orchestration_mode:
     "new sessions and an empty current one (the default mode); a conversation keeps its own mode until it is switched with the composer's mode selector",
   set_recap_enabled: 'background Memory cycles; no restart required',
   set_auto_update: 'subsequent automatic update checks',
+  set_ai_session_titles: 'titles generated from now on; existing titles are unchanged',
+  set_quota_auto_resume: 'subsequent usage-limit stops; turning it off cancels pending resumes',
+  set_model_preferences: 'the /model picker and model management lists',
+  set_heartbeat_enabled: "Mixy's next heartbeat check; no restart required",
+  set_heartbeat_interval:
+    "Mixy's heartbeat from the next tick: the next check is due the new interval after the last one; no restart required",
+  set_reactions_enabled:
+    "bots' chats; while off a reaction is refused at once and new chats are not offered the tool; reactions already left stay visible",
   set_worktree_settings: 'new tasks and worktrees created afterwards; existing worktrees are unchanged',
   set_system_shell: 'subsequent shell calls',
   save_automation: 'the automation worker; scheduled runs follow the saved timing',
@@ -54,7 +103,7 @@ const ACTION_APPLIES_TO = {
   add_hook_rule: 'subsequent tool calls; no restart required',
   set_hook_rule_enabled: 'subsequent tool calls; no restart required',
   delete_hook_rule: 'subsequent tool calls; no restart required',
-  set_media_default: 'media generations that omit lane/model, and the Studio selection',
+  set_media_default: 'media generations that name no lane/model; lane "" returns the kind to Auto',
 };
 
 const OPEN_TARGET_HINTS = Object.freeze({
@@ -65,11 +114,11 @@ const OPEN_TARGET_HINTS = Object.freeze({
   workflow: 'Desktop: Workflows · TUI: /workflow',
   agents: 'Desktop: Workflows → Agents · TUI: /agents',
   outputstyle: 'Desktop: Settings → Output style · TUI: /OutputStyle',
-  theme: 'Desktop: Settings → General → Theme · TUI: /theme',
+  theme: 'Desktop: Settings → Theme · TUI: /theme',
   profile: 'Desktop: Settings → General → Profile · TUI: /profile',
   autoclear: 'Desktop: Settings → Context · TUI: /autoclear',
   memory:
-    'Desktop: Extensions → Plugin → Built-in (Memory); core memories under Projects → project → Memories · TUI: /memory',
+    'Desktop: Extensions tab → Built-in (Memory); core memories under Projects → project → Memories · TUI: /memory',
   mcp: 'Desktop: Extensions → Connectors tab · TUI: /mcp',
   skills: 'Desktop: Skills (activity rail) · TUI: /skills',
   plugins:
@@ -79,7 +128,7 @@ const OPEN_TARGET_HINTS = Object.freeze({
   doctor: 'Desktop: Settings → System → Doctor, or /doctor in the composer · TUI: /doctor',
   context: 'Desktop: /context in the composer · TUI: /context',
   developer: 'Desktop: Settings → Developer options · TUI: /setting → Developer',
-  voice: 'Desktop: Extensions → Plugin → Built-in (Voice) · TUI: /setting → Voice',
+  voice: 'Desktop: Extensions tab → Built-in (Voice) · TUI: /setting → Voice',
   connection: 'Desktop only: Settings → Connection',
 });
 
@@ -117,6 +166,31 @@ function routeInput(source) {
   return next;
 }
 
+/** A fallback chain edit's receipt: whether the calling conversation now
+ *  follows the saved chain, and the position it reads it from. `owner` is
+ *  whose route was edited: `{ kind: 'lead' }` (set_route) or `{ kind: 'bot',
+ *  agent }` (set_agent_route); only a caller whose chain comes from that
+ *  route's settings follows it. */
+function chainReceipt(route, { caller, getConfig }, owner) {
+  if (!Object.hasOwn(route, 'fallbacks') || !caller?.agent) return {};
+  const config = getConfig();
+  const position = routeFallbackPosition(caller, config);
+  // Settings-sourced and still on that route's primary: a conversation left on
+  // a previous model follows no chain, whatever the saved one is.
+  const source = sessionChainSource(caller, config);
+  const followsEdited =
+    position.chainFrom === 'settings' &&
+    sameRouteModel(source, sessionRoutePrimary(caller)) &&
+    position.kind === owner.kind &&
+    (owner.kind !== 'bot' || position.agent === owner.agent);
+  const saved = route.fallbacks.map((entry) => `${entry.provider}/${entry.model}`);
+  const followed = position.fallbacks.map((entry) => `${entry.provider}/${entry.model}`);
+  return {
+    appliedToCurrentSession: followsEdited && saved.join('\n') === followed.join('\n'),
+    currentSession: position,
+  };
+}
+
 function apiKeySource(row) {
   if (row.env) return `env:${row.envName}`;
   return row.stored ? 'keychain' : 'none';
@@ -225,6 +299,18 @@ function mcpRows(status) {
       error: server.error || null,
       ...(server.warnings?.length ? { warnings: server.warnings } : {}),
       scope: Array.isArray(server.scope) ? server.scope : null,
+      ...(server.connector ? { connector: server.connector } : {}),
+      // A multi-account connector's accounts: remove_mcp_server / sign-in take an account's name.
+      ...(Array.isArray(server.accounts)
+        ? {
+            accounts: server.accounts.map((account) => ({
+              name: account.name,
+              email: account.email || '',
+              ...(account.authRequired ? { authRequired: true } : {}),
+              ...(account.error ? { error: account.error } : {}),
+            })),
+          }
+        : {}),
     })),
     ...(status?.warnings?.length ? { warnings: status.warnings } : {}),
     ...(status?.declarationErrors?.length ? { declarationErrors: status.declarationErrors } : {}),
@@ -277,16 +363,26 @@ async function featureStatus(rt, getConfig) {
     browser: { active: builtinFeatureActive(config, 'browser') },
     computer: { active: builtinFeatureActive(config, 'computer') },
     terminal: { active: builtinFeatureActive(config, 'terminal') },
+    heartbeat: {
+      enabled: config?.heartbeat !== false,
+      intervalMinutes: normalizeHeartbeatIntervalMinutes(config?.heartbeatIntervalMinutes),
+    },
+    reactions: { enabled: config?.reactions !== false },
     voice: rt.getVoiceStatus ? voiceFeatureStatus(await rt.getVoiceStatus()) : null,
   };
 }
 
 async function mediaDefaults(rt) {
-  const rows = await Promise.all(MEDIA_KINDS.map((kind) => rt.getMediaDefault(kind)));
+  const [pins, ...rows] = await Promise.all([
+    rt.getMediaPins(),
+    ...MEDIA_KINDS.map((kind) => rt.getMediaDefault(kind)),
+  ]);
+  const fieldsOf = (row, fields) => (row ? Object.fromEntries(fields.map((field) => [field, row[field]])) : null);
   return {
-    defaults: Object.fromEntries(
-      MEDIA_KINDS.map((kind, i) => [kind, rows[i] ? { lane: rows[i].lane, model: rows[i].model } : null])
-    ),
+    // The default generator (Settings → Built-in → Media generation); null = Auto.
+    pinned: Object.fromEntries(MEDIA_KINDS.map((kind) => [kind, fieldsOf(pins[kind], ['lane', 'model', 'account'])])),
+    // The last generator used; applies only to a kind that is on Auto.
+    remembered: Object.fromEntries(MEDIA_KINDS.map((kind, i) => [kind, fieldsOf(rows[i], ['lane', 'model'])])),
   };
 }
 
@@ -324,11 +420,24 @@ const SETUP_STATUS_READERS = {
     features: await featureStatus(rt, getConfig),
     onboarding: rt.getOnboardingStatus?.() || null,
   }),
-  model: (rt) => ({ route: mainRoute(rt), effortOptions: rt.effortOptions || [] }),
-  agents: (rt) => ({
+  model: (rt, { getConfig, caller }) => ({
+    route: {
+      ...mainRoute(rt),
+      autoEffort: rt.autoEffort !== false,
+      // The Lead preset (workflow-lead) holds the Lead route's fallback chain, as the Workflows page reads it.
+      fallbacks: (rt.listPresets?.() || []).find((preset) => preset?.id === 'workflow-lead')?.fallbacks || [],
+    },
+    effortOptions: rt.effortOptions || [],
+    // Where this conversation and the other Lead conversations are on their chain.
+    ...routePositionsStatus({ caller, config: getConfig(), keep: (row) => row.kind === 'lead' }),
+  }),
+  agents: (rt, { getConfig, caller }) => ({
     agents: rt.listAgents?.() || [],
     orchestrationMode: rt.getOrchestrationMode(),
     orchestrationModes: ORCHESTRATION_MODES,
+    ...(rt.getBotOrder ? { botOrder: rt.getBotOrder().order } : {}),
+    // Bot chats and sub-agents on their fallback chains.
+    sessions: routePositionsStatus({ caller, config: getConfig(), keep: (row) => row.kind !== 'lead' }).sessions,
   }),
   workflow: (rt) => ({ workflows: rt.listWorkflows?.() || [] }),
   websearch: (rt) => ({
@@ -347,19 +456,27 @@ const SETUP_STATUS_READERS = {
     };
   },
   autoclear: (rt) => rt.getAutoClear?.() || {},
-  compaction: (rt) => rt.getCompactionSettings?.() || {},
+  compaction: (rt) => ({
+    ...(rt.getCompactionSettings?.() || {}),
+    ...(rt.getSessionTitleSettings?.() || {}),
+    ...(rt.getCacheWarmingSettings ? { promptCacheWarming: rt.getCacheWarmingSettings().enabled } : {}),
+  }),
   memory: (rt) => ({ ...(rt.getToolModuleSettings?.()?.memory || {}), recap: rt.getRecapSettings?.() || null }),
   'local-provider': (rt) => rt.getToolModuleSettings().localProvider,
   features: (rt, { getConfig }) => featureStatus(rt, getConfig),
   shell: (rt) => rt.getSystemShell?.() || {},
   providers: async (rt, { detail }) => {
     const rows = publicProviderRows(await rt.getProviderSetup?.({}));
+    const quotaResume = rt.getQuotaAutoResume ? { quotaAutoResume: rt.getQuotaAutoResume() } : {};
     // Client mode: the desktop owns accounts, so the server roster is never read.
     if (rows.managedByClient) {
-      if (detail) return rows;
-      return { managedByClient: true, unavailable: rows.unavailable, ...configuredProviderRows(rows) };
+      if (detail) return { ...rows, ...quotaResume };
+      return { managedByClient: true, unavailable: rows.unavailable, ...configuredProviderRows(rows), ...quotaResume };
     }
-    if (!detail) return configuredProviderRows(rows, (id) => rt.getProviderAccounts(id).accounts.length);
+    if (!detail) {
+      return { ...configuredProviderRows(rows, (id) => rt.getProviderAccounts(id).accounts.length), ...quotaResume };
+    }
+    Object.assign(rows, quotaResume);
     rows.oauth = rows.oauth.map((row) =>
       row.authenticated ? { ...row, accounts: publicAccounts(rt.getProviderAccounts(row.id)) } : row
     );
@@ -473,22 +590,28 @@ const SETUP_INSTALLABLE_FEATURES = [
 // Action handlers: (rt, args, { requestDesktop, readStatus, openSurface }).
 // `rt` is null for `status` and `open`, which never touch the facade.
 const SETUP_ACTION_HANDLERS = {
-  status: async (_rt, args, { readStatus, requestDesktop }) => {
+  status: async (_rt, args, { readStatus, requestDesktop, caller }) => {
     const domain = clean(args.domain) || 'summary';
     requireEnum(domain, SETUP_STATUS_DOMAINS, 'domain');
-    return { domain, ...(await readStatus(domain, requestDesktop, args.detail === true)) };
+    return { domain, ...(await readStatus(domain, requestDesktop, args.detail === true, caller)) };
   },
   open: (_rt, args, { openSurface }) => openSurface(args.target),
-  set_route: async (rt, args) => {
+  set_route: async (rt, args, context) => {
     const route = routeInput(args.route);
     const next = await rt.setRoute(route, { keepMainModel: false });
-    return { route: next, appliesTo: 'next session (a conversation keeps its frozen route)' };
+    return { route: next, ...chainReceipt(args.route, context, { kind: 'lead' }) };
   },
-  set_agent_route: async (rt, args) => {
+  set_agent_route: async (rt, args, context) => {
     const agent = requireText(args.agent, 'agent');
     const route = routeInput(args.route);
-    return { agent, route: await rt.setAgentRoute(agent, route) };
+    return {
+      agent,
+      route: await rt.setAgentRoute(agent, route),
+      ...chainReceipt(args.route, context, { kind: 'bot', agent }),
+    };
   },
+  ...SESSION_ROUTE_HANDLERS,
+  ...AGENT_SETTINGS_HANDLERS,
   set_web_search_route: async (rt, args) => ({ route: await rt.setWebSearchRoute(routeInput(args.route)) }),
   set_workflow: (rt, args) => rt.setWorkflow(requireText(args.workflow, 'workflow')),
   set_output_style: async (rt, args) => {
@@ -597,6 +720,20 @@ const SETUP_ACTION_HANDLERS = {
     rt.deleteLocalProviderModel(requireText(args.confirmationToken, 'confirmationToken')),
   set_system_shell: (rt, args) => rt.setSystemShell({ command: clean(args.command) }),
   set_auto_update: (rt, args) => rt.setAutoUpdate(requireBoolean(args.enabled)),
+  set_ai_session_titles: (rt, args) => rt.setAiSessionTitles(requireBoolean(args.enabled)),
+  set_quota_auto_resume: async (rt, args) => ({
+    quotaAutoResume: await rt.setQuotaAutoResume(requireBoolean(args.enabled)),
+  }),
+  set_model_preferences: async (rt, args) => {
+    const change = { model: requireText(args.model, 'model') };
+    for (const key of ['hidden', 'favorite'])
+      if (Object.hasOwn(args, key)) change[key] = requireBoolean(args[key], key);
+    if (Object.keys(change).length === 1) throw new Error('hidden or favorite is required');
+    return rt.setModelPreferences(requireText(args.provider, 'provider'), [change]);
+  },
+  set_heartbeat_enabled: (rt, args) => rt.setHeartbeatEnabled(requireBoolean(args.enabled)),
+  set_heartbeat_interval: (rt, args) => rt.setHeartbeatInterval(requireHeartbeatIntervalMinutes(args.minutes)),
+  set_reactions_enabled: (rt, args) => rt.setReactionsEnabled(requireBoolean(args.enabled)),
   set_worktree_settings: (rt, args) => rt.setWorktreeSettings(args.worktree),
   forget_provider_auth: async (rt, args) => {
     const name = requireText(args.name, 'name');
@@ -666,7 +803,7 @@ const SETUP_ACTION_HANDLERS = {
   // as Extensions → 커넥터. Nothing is connected here.
   connect_connector: async (rt, args) => {
     const entry = connectorById(requireText(args.connector, 'connector'));
-    if (!entry || entry.ownKey) throw new Error(`connector must be one of ${CONNECTOR_IDS.join(', ')}`);
+    if (!entry) throw new Error(`connector must be one of ${CONNECTOR_IDS.join(', ')}`);
     const server = (rt.mcpStatus?.()?.servers || []).find((row) => row.connector === entry.id) || null;
     const connected = server?.connected === true;
     return {
@@ -703,6 +840,8 @@ const READ_ONLY_SETUP_ACTIONS = new Set([
   'search_local_models',
   'inspect_hf_model',
   'local_model_details',
+  'read_agent_settings',
+  'read_project_connectors',
 ]);
 // Actions that start or steer work rather than saving a setting.
 const BACKGROUND_SETUP_ACTIONS = new Set([
@@ -711,6 +850,10 @@ const BACKGROUND_SETUP_ACTIONS = new Set([
   'cancel_local_installation',
   'reconnect_mcp',
   'run_automation',
+  'reset_route_fallback',
+  'continue_in_model',
+  'schedule_quota_resume',
+  'cancel_quota_resume',
 ]);
 
 function setupMutationReceipt(action, result) {
@@ -735,6 +878,7 @@ export function createSetupToolExecutor({
   getSessionId,
   getCallerSession,
   flushSettings,
+  executeSessionControl = null,
 }) {
   const desktop = createSetupUiRequests({ notifySessionUi, getSessionId });
   const api = () => {
@@ -743,11 +887,11 @@ export function createSetupToolExecutor({
     return facade;
   };
 
-  async function readStatus(domain, requestDesktop, detail) {
+  async function readStatus(domain, requestDesktop, detail, caller = null) {
     const rt = api();
     if (SETUP_DESKTOP_DOMAINS.includes(domain)) return requestDesktop({ action: 'status', domain });
     if (!Object.hasOwn(SETUP_STATUS_READERS, domain)) throw new Error(`setup: unknown status domain "${domain}"`);
-    return SETUP_STATUS_READERS[domain](rt, { domain, detail, getConfig: () => getConfig?.() || {} });
+    return SETUP_STATUS_READERS[domain](rt, { domain, detail, caller, getConfig: () => getConfig?.() || {} });
   }
 
   function openSurface(target) {
@@ -776,21 +920,35 @@ export function createSetupToolExecutor({
     // it never creates agents, definitions or automations, nor changes any
     // other setting. Hosts without session provenance (no getCallerSession)
     // skip this gate; automation actions still refuse an unknown caller.
+    let scope = null;
     if (getCallerSession && !READ_ONLY_SETUP_ACTIONS.has(action)) {
-      const scope = scheduleCallerScope(caller);
+      scope = scheduleCallerScope(caller);
       assertInteractiveCaller(scope, action);
       // Agent definitions (contacts) change only from Mixy; another agent's
       // home changes only its own agent settings.
       if (AGENT_DEFINITION_ACTIONS.has(action) && args.definitionKind === 'agent') {
         assertAgentEditorAccess(scope, caller, action);
       }
-      if (action === 'set_agent_route') assertOwnAgentSettings(scope, args.agent, action);
+      if (OWN_AGENT_ACTIONS.has(action)) assertOwnAgentSettings(scope, args.agent, action);
     }
+    // Mixy's heartbeat session takes only its two routine actions, reads included.
+    assertHeartbeatSetupAction(sessionId, action, args);
     const rt = action === 'status' || action === 'open' ? null : api();
     if (!Object.hasOwn(SETUP_ACTION_HANDLERS, action)) {
       return executeExtendedSetupAction(rt, args, requestDesktop, { sessionId, caller });
     }
-    return SETUP_ACTION_HANDLERS[action](rt, args, { requestDesktop, readStatus, openSurface });
+    return SETUP_ACTION_HANDLERS[action](rt, args, {
+      requestDesktop,
+      readStatus,
+      openSurface,
+      sessionId,
+      caller,
+      // The session-scoped actions authorize each target against it (session-route-actions.mjs).
+      scope,
+      getSession: getCallerSession,
+      getConfig: () => getConfig?.() || {},
+      executeSessionControl,
+    });
   }
 
   return {

package/src/session-runtime/setup-tool/extended-actions.mjs

@@ -33,9 +33,16 @@ function compactModelRow(row) {
     efforts: (row.effortOptions || []).map((option) => option.value),
     ...(row.fastCapable === true ? { fast: true } : {}),
     ...(row.supportsVision === true ? { vision: true } : {}),
+    ...modelPreferenceFields(row),
   };
 }
 
+/** The model-management choices, only when set (savedHidden is an explicit /model visibility choice). */
+const modelPreferenceFields = (row) => ({
+  ...(typeof row.savedHidden === 'boolean' ? { hidden: row.savedHidden } : {}),
+  ...(row.favorite === true ? { favorite: true } : {}),
+});
+
 const isPresent = (value) =>
   value != null && value !== '' && value !== false && !(typeof value === 'object' && !Object.keys(value).length);
 
@@ -64,7 +71,10 @@ function modelDetail(row) {
     defaultModelParameters: row.defaultModelParameters,
     supportsMaxMode: row.supportsMaxMode,
   };
-  return Object.fromEntries(Object.entries(detail).filter(([, value]) => isPresent(value)));
+  return {
+    ...Object.fromEntries(Object.entries(detail).filter(([, value]) => isPresent(value))),
+    ...modelPreferenceFields(row),
+  };
 }
 
 function findModel(rows, id, provider) {
@@ -283,6 +293,7 @@ export const EXTENDED_SETUP_HANDLERS = Object.freeze({
     if (kind === 'webhook' && ['time', 'at', 'timezone', 'days'].some((key) => own(input, key))) {
       throw new Error('Schedule fields (timing) are not accepted for webhooks');
     }
+    if (kind === 'webhook' && own(input, 'newName')) throw new Error('newName (rename) is schedule-only');
     if (kind === 'schedule' && own(input, 'parser')) throw new Error('parser is a webhook-only field');
     let previous = {};
     if (input.overwrite) {
@@ -363,6 +374,12 @@ export const EXTENDED_SETUP_HANDLERS = Object.freeze({
       .sections.flatMap((section) => section.options)
       .find((row) => row.id === args.name);
     if (!option) throw new Error(`Unknown developer option "${args.name}"; read status developer`);
+    // An agent must never remove its own approval cards: only the person turns this on.
+    if (args.enabled && option.id === 'allowAllActions') {
+      throw new Error(
+        `"${option.label}" cannot be turned on by an agent; only the person can turn it on in Settings → Developer options.`
+      );
+    }
     if (args.enabled && option.warning && !args.riskAccepted) {
       throw new Error(
         `Enabling ${option.label} requires riskAccepted:true after the user explicitly accepts: ${option.warning}`
@@ -401,6 +418,11 @@ export const EXTENDED_SETUP_HANDLERS = Object.freeze({
   },
   async set_media_default(rt, args) {
     if (!MEDIA_KINDS.includes(args.kind)) throw new Error(`kind must be one of ${MEDIA_KINDS.join(', ')}`);
+    // A blank lane returns the kind to Auto, as the Settings control does.
+    if (!String(args.lane).trim()) {
+      if (own(args, 'model') || own(args, 'accountId')) throw new Error('model and accountId need a lane');
+      return { kind: args.kind, media: await rt.setMediaPin({ kind: args.kind, lane: '' }) };
+    }
     const lane = (await rt.listMediaLanes()).find((row) => row.id === args.lane);
     if (!lane) throw new Error(`Unknown media lane "${args.lane}"; list lanes with the media tool`);
     if (!lane.authenticated) throw new Error(`${lane.label} is not signed in; open providers first`);
@@ -409,7 +431,16 @@ export const EXTENDED_SETUP_HANDLERS = Object.freeze({
     if (own(args, 'model') && !spec.models.some((model) => model.id === args.model)) {
       throw new Error(`model "${args.model}" is not available on ${lane.id}/${args.kind}`);
     }
-    return { media: await rt.setMediaDefault(pick(args, ['kind', 'lane', 'model'])) };
+    if (own(args, 'accountId')) {
+      if (lane.authType !== 'oauth') throw new Error(`${lane.id} signs in with an API key; it has no accounts`);
+      if (!rt.getProviderAccounts(lane.authProvider).accounts.some((row) => row.id === args.accountId)) {
+        throw new Error(
+          `Unknown ${lane.authProvider} account "${args.accountId}"; list accounts with status providers`
+        );
+      }
+    }
+    const pin = await rt.setMediaPin({ kind: args.kind, lane: args.lane, model: args.model, account: args.accountId });
+    return { kind: args.kind, media: pin };
   },
 });
 

package/src/session-runtime/setup-tool/session-route-actions.mjs

@@ -0,0 +1,152 @@
+/** Setup actions that act on one running session rather than a setting: its
+ *  fallback position (read in status model/agents), a return to its primary
+ *  route, and its quota card's actions. The caller's own session changes
+ *  through its runtime; another session through the daemon's configure lane
+ *  (daemon-session-control/route-control.mjs), the lane the model picker and
+ *  quota card use. */
+import {
+  liveRouteFallbackPositions,
+  routeFallbackHopped,
+  routeFallbackPosition,
+  routeLeaf,
+  sessionChainSource,
+  sessionRoutePrimary,
+} from '../../runtime/agent/orchestrator/session/manager/route-fallback-chain.mjs';
+import { sameRouteModel } from '../../runtime/agent/orchestrator/session/manager/owner-route-fallbacks.mjs';
+import { resolveSessionMode } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
+import { agentHomeSessionId } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { _liveSessions } from '../../runtime/agent/orchestrator/session/store/live-state.mjs';
+import { assertOwnAgentSettings } from '../services/schedule-access.mjs';
+import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+
+const modelOf = (route) => ({ provider: route?.provider || '', model: route?.model || '' });
+
+/** The calling session's fallback position, and those of the other sessions
+ *  held here that `keep` selects (status model: Leads; status agents: bots and agents). */
+export function routePositionsStatus({ caller, config, keep }) {
+  return {
+    ...(caller?.agent ? { session: routeFallbackPosition(caller, config) } : {}),
+    sessions: liveRouteFallbackPositions(config, (row) => row.sessionId !== caller?.id && keep(row)),
+  };
+}
+
+/** The route a reset returns `session` to: the one it left at its first hop,
+ *  else its settings' route when that is still its primary. */
+function primaryRoute(session, config) {
+  if (session.routeFallbackPrimary?.provider) return routeLeaf(session.routeFallbackPrimary);
+  const primary = sessionRoutePrimary(session);
+  const source = sessionChainSource(session, config);
+  return source && sameRouteModel(source, primary) ? routeLeaf(source) : routeLeaf(primary);
+}
+
+const actingAgentOf = (session) => resolveSessionMode({ session }).agentId || clean(session?.agent);
+
+function createSessionTargets(ctx) {
+  const { sessionId: callerId, caller, getSession, scope, executeSessionControl } = ctx;
+  const load = (id) => (id === callerId ? caller : getSession?.(id)) || null;
+  // A bot's thread acts only on its own sessions; the human's on any.
+  const assertTarget = (session, action) => {
+    if (scope) assertOwnAgentSettings(scope, actingAgentOf(session), action);
+  };
+  const target = (id, action, { other = false } = {}) => {
+    const sessionId = clean(id) || callerId;
+    if (!sessionId) throw new Error('sessionId is required');
+    if (other && sessionId === callerId) {
+      throw new Error(`${action} applies to another session: this one is running the setup call`);
+    }
+    const session = load(sessionId);
+    if (!session || session.closed === true) throw new Error(`session ${sessionId} not found`);
+    assertTarget(session, action);
+    return session;
+  };
+  const control = async (session, method, input) => {
+    if (typeof executeSessionControl !== 'function') {
+      throw new Error('Another session is reachable only through the Mixdog app or daemon; none hosts this runtime');
+    }
+    return executeSessionControl(
+      { action: 'route', session_id: session.id, method, ...(input ? { input } : {}) },
+      { callerSessionId: callerId }
+    );
+  };
+  return { load, target, control, assertTarget };
+}
+
+export const SESSION_ROUTE_HANDLERS = {
+  async reset_route_fallback(rt, args, ctx) {
+    if (Object.hasOwn(args, 'sessionId') && Object.hasOwn(args, 'agent')) {
+      throw new Error('Pass sessionId or agent, not both');
+    }
+    const config = ctx.getConfig();
+    const sessions = createSessionTargets(ctx);
+    let targets;
+    if (Object.hasOwn(args, 'agent')) {
+      const agent = clean(args.agent);
+      if (!agent) throw new Error('agent is required');
+      if (ctx.scope) assertOwnAgentSettings(ctx.scope, agent, 'reset_route_fallback');
+      // Its chats held here (home, room seats) and its home thread from disk.
+      const byId = new Map();
+      for (const session of _liveSessions.values()) {
+        if (session?.id && session.closed !== true && resolveSessionMode({ session }).agentId === agent) {
+          byId.set(session.id, session);
+        }
+      }
+      const home = agentHomeSessionId(agent);
+      if (home && !byId.has(home)) {
+        const stored = sessions.load(home);
+        if (stored && stored.closed !== true) byId.set(home, stored);
+      }
+      targets = [...byId.values()];
+    } else {
+      targets = [sessions.target(args.sessionId, 'reset_route_fallback')];
+    }
+    const reset = [];
+    const unchanged = [];
+    for (const session of targets) {
+      if (!routeFallbackHopped(session)) {
+        unchanged.push({ sessionId: session.id, current: modelOf(session) });
+        continue;
+      }
+      const route = primaryRoute(session, config);
+      // The session's own model pick, from its next turn: the switch restarts
+      // its chain (fallback index and failures cleared).
+      if (session.id === ctx.sessionId) {
+        await rt.setRoute(route, { sessionOnly: true, switchEstablished: true, deferUntilNextTurn: true });
+      } else {
+        await sessions.control(session, 'setRoute', route);
+      }
+      reset.push({ sessionId: session.id, from: modelOf(session), to: modelOf(route) });
+    }
+    return { scope: 'session', reset, ...(unchanged.length ? { alreadyOnPrimary: unchanged } : {}) };
+  },
+  async continue_in_model(_rt, args, ctx) {
+    const sessions = createSessionTargets(ctx);
+    const session = sessions.target(args.sessionId, 'continue_in_model', { other: true });
+    const route = routeLeaf(args.route);
+    const continued = (await sessions.control(session, 'continueSessionInModel', route)) !== false;
+    return {
+      scope: 'session',
+      sessionId: session.id,
+      continued,
+      route: modelOf(route),
+      note: 'The stopped turn is not resent: the user resumes it from that conversation (Resume, or a new message).',
+    };
+  },
+  async schedule_quota_resume(_rt, args, ctx) {
+    const sessions = createSessionTargets(ctx);
+    const session = sessions.target(args.sessionId, 'schedule_quota_resume', { other: true });
+    return {
+      scope: 'session',
+      sessionId: session.id,
+      scheduled: (await sessions.control(session, 'scheduleQuotaResume')) === true,
+    };
+  },
+  async cancel_quota_resume(_rt, args, ctx) {
+    const sessions = createSessionTargets(ctx);
+    const session = sessions.target(args.sessionId, 'cancel_quota_resume', { other: true });
+    return {
+      scope: 'session',
+      sessionId: session.id,
+      cancelled: (await sessions.control(session, 'cancelQuotaResume')) === true,
+    };
+  },
+};