mixdog 1.3.5 → 1.4.0

package/src/runtime/agent/orchestrator/session/side-question-store.mjs

@@ -3,6 +3,7 @@
 // side question or a compaction summary forks) and the side question in flight. It holds live
 // provider/tool objects, so it never reaches the session record or disk.
 import { isAgentOwner } from '../agent-owner.mjs';
+import { armCacheWarm, cancelCacheWarm, forgetCacheWarm, noteCacheWarmActivity } from './cache-warm.mjs';
 
 // sessionId -> { provider, model, messages, tools, opts, response }
 const requests = new Map();
@@ -42,21 +43,27 @@ export function sideQuestionRequestSnapshot({ provider, model, messages, tools,
 
 /**
  * Record a provider request the main loop is sending as the session's latest
- * one. Agent sessions record nothing (/btw is a Lead command). The handle
- * attaches the reply once the send proceeds, or puts the previous request
- * back when this one fails, so only a successfully sent request is kept.
+ * one. Agent sessions keep nothing here (/btw is a Lead command); their
+ * request only reaches the cache warmer. The handle attaches the reply once
+ * the send proceeds, or puts the previous request back when this one fails,
+ * so only a successfully sent request is kept.
  */
 export function captureSideQuestionRequest({ sessionId, sessionRef, provider, model, messages, tools, opts }) {
-  if (!sessionId || !provider || isAgentOwner(sessionRef)) return null;
+  if (!sessionId || !provider) return null;
+  const kept = !isAgentOwner(sessionRef);
   const previous = requests.get(sessionId);
   const request = sideQuestionRequestSnapshot({ provider, model, messages, tools, opts });
-  requests.set(sessionId, request);
+  if (kept) requests.set(sessionId, request);
+  // A real request is session activity: it closes the session's idle gap and
+  // replaces any cache warm (cache-warm.mjs); a settled one arms the next.
+  noteCacheWarmActivity(sessionId, request);
   return {
     settle(response) {
       request.response = response || null;
+      armCacheWarm(sessionId, request, response);
     },
     discard() {
-      if (requests.get(sessionId) !== request) return;
+      if (!kept || requests.get(sessionId) !== request) return;
       if (previous) requests.set(sessionId, previous);
       else requests.delete(sessionId);
     },
@@ -80,6 +87,7 @@ export function compactionForkRequest(sessionId) {
 export function retireCompactionFork(sessionId) {
   const request = sideQuestionRequest(sessionId);
   if (request) request.compacted = true;
+  forgetCacheWarm(sessionId);
 }
 
 /** Start the session's side question, aborting the one still in flight. */
@@ -109,5 +117,10 @@ export function cancelSideQuestion(sessionId) {
 export function forgetSideQuestion(sessionId, { cancel = false } = {}) {
   if (!sessionId) return;
   requests.delete(sessionId);
-  if (cancel) cancelSideQuestion(sessionId);
+  // Clear / rewind drop the cached prefix; a close or runtime unload (daemon
+  // shutdown) keeps its durable touch for the restart re-arm.
+  if (cancel) {
+    cancelCacheWarm(sessionId);
+    cancelSideQuestion(sessionId);
+  } else forgetCacheWarm(sessionId);
 }

package/src/runtime/agent/orchestrator/session/side-question.mjs

@@ -98,6 +98,24 @@ function nextMainRequest(sessionId) {
   });
 }
 
+/**
+ * The session's last provider request as its next turn would rebuild it from
+ * the record (a runtime restart lost the in-memory one): the next request
+ * without the reply that last request produced, stamped with the session's
+ * last send time. Null when the transcript does not end in that reply or the
+ * session has no rebuildable request (nextMainRequest).
+ */
+export function lastSentMainRequest(sessionId) {
+  const request = nextMainRequest(sessionId);
+  if (!request) return null;
+  let end = request.messages.length;
+  while (end > 0 && request.messages[end - 1]?.role === 'assistant') end -= 1;
+  if (end === 0 || end === request.messages.length) return null;
+  const sentAt = Number(request.opts.session?.lastProviderSendAt);
+  if (!(sentAt > 0)) return null;
+  return { ...request, messages: request.messages.slice(0, end), sentAt };
+}
+
 function answerText(response) {
   if (response?.toolCalls?.length) return SIDE_QUESTION_TOOL_ATTEMPT;
   const text = typeof response?.content === 'string' ? response.content.trim() : '';

package/src/runtime/agent/orchestrator/session/skill-update-notice.mjs

@@ -0,0 +1,60 @@
+// A thread can live for days while its loaded skills change underneath it (an
+// app update ships a new SKILL.md, the user edits or switches one off). Compact
+// restores every skill from its current source; between Compacts, each turn
+// tells the model once that a skill it holds instructions for changed, as a
+// new runtime message after the history, never by rewriting what was sent.
+import { createHash } from 'node:crypto';
+import { loadConfig } from '../config.mjs';
+import { collectSkillsCached, currentSkillDelivery } from '../context/collect.mjs';
+import { latestSkillBodies, skillMessageText } from '../context/skill-state.mjs';
+
+export const SKILL_UPDATE_SOURCE = 'skill-update-notice';
+
+const UNAVAILABLE = 'unavailable';
+// The loaded body is what the Skill tool delivers again (after an
+// unavailable notice): its instructions are back in force.
+const CURRENT = 'current';
+
+function skillUpdateNotice(name, version) {
+  let text = `[mixdog-runtime] Skill "${name}" was updated since it was loaded. Reload it with the Skill tool before relying on it.`;
+  if (version === UNAVAILABLE) {
+    text = `[mixdog-runtime] Skill "${name}" is no longer available in this session (switched off, removed, or outside this project's scope). Do not rely on its instructions.`;
+  } else if (version === CURRENT) {
+    text = `[mixdog-runtime] Skill "${name}" is available again, unchanged; its loaded instructions apply again.`;
+  }
+  return { role: 'user', content: text, meta: { source: SKILL_UPDATE_SOURCE, synthetic: true, skill: name, version } };
+}
+
+/**
+ * For every skill whose latest body is in `messages`, compare it with what the
+ * Skill tool would deliver at `cwd` now. Its state — the loaded body still
+ * current, a changed version, or unavailable — is announced whenever it
+ * differs from the last state told after that body (none told: current).
+ * So each transition notifies once: changed, switched off, and back again
+ * unchanged. A reload replaces the body and starts over. Returns the
+ * appended notices.
+ */
+export function appendSkillUpdateNotices(messages, cwd) {
+  const bodies = latestSkillBodies(messages);
+  if (!bodies.length) return [];
+  const config = loadConfig({ secrets: false });
+  const skills = collectSkillsCached(cwd);
+  const notices = [];
+  for (const { name, message } of bodies) {
+    const delivery = currentSkillDelivery(name, cwd, config, skills);
+    let version = UNAVAILABLE;
+    if (delivery) {
+      version =
+        skillMessageText(message.content).trimStart() === delivery.body
+          ? CURRENT
+          : createHash('sha256').update(delivery.body).digest('hex').slice(0, 16);
+    }
+    const told =
+      messages
+        .slice(messages.lastIndexOf(message) + 1)
+        .findLast((m) => m?.meta?.source === SKILL_UPDATE_SOURCE && m.meta.skill === name)?.meta.version || CURRENT;
+    if (told !== version) notices.push(skillUpdateNotice(name, version));
+  }
+  messages.push(...notices);
+  return notices;
+}

package/src/runtime/agent/orchestrator/session/store/live-state.mjs

@@ -1,4 +1,5 @@
 import { contentCarriesLiveMedia } from '../../providers/media-normalization.mjs';
+import { publishSessionPersistence } from './session-persistence-events.mjs';
 
 const _lastSaveError = new Map(); // id -> { message, at }
 
@@ -287,9 +288,11 @@ export function _recordSaveDrop(id, epoch = null) {
 export function _clearSaveStateIfCurrent(id, epoch = null) {
   if (!id) return false;
   const marked = _failureEpochs.get(id);
-  if (marked !== undefined && Number.isFinite(epoch) && epoch < marked) return false;
-  _clearSessionSaveState(id);
-  return true;
+  const cleared = !(marked !== undefined && Number.isFinite(epoch) && epoch < marked);
+  if (cleared) _clearSessionSaveState(id);
+  // A landed write put the record on disk whether or not it clears the markers.
+  publishSessionPersistence(id, 'landed');
+  return cleared;
 }
 
 /** True while this process's last save attempt for `id` failed. */

package/src/runtime/agent/orchestrator/session/store/save-delta.mjs

@@ -1,5 +1,6 @@
 import { hash } from 'node:crypto';
 import { _messagesForDisk, _sessionForDisk } from './serialize.mjs';
+import { sensitiveValuesVersion } from '../sensitive-values.mjs';
 
 // ── Delta handoff to the save worker ─────────────────────────────────────────
 // Worker.postMessage structured-clones on the CALLER's thread, so a full-
@@ -93,7 +94,7 @@ function _attemptRecord(header, refs, prints) {
  */
 export function _attemptEvidence(attempt) {
   if (!attempt) return null;
-  const messages = _messagesForDisk(attempt.refs);
+  const messages = _messagesForDisk(attempt.refs, attempt.header.id);
   for (let index = 0; index < messages.length; index += 1) {
     const print = attempt.prints[index];
     if (print === null || _messagePrint(messages[index]) !== print) return null;
@@ -112,14 +113,17 @@ function _isPureAppend(refs, live) {
 export function _buildWirePayload(id, session, forceFull = false) {
   const live = Array.isArray(session.messages) ? session.messages : [];
   const base = forceFull ? null : _deltaBaseline.get(id);
-  const resyncDue = !base || base.deltasSinceFull >= DELTA_FULL_RESYNC_EVERY;
+  // A value marked sensitive since the baseline was sent must leave the
+  // messages the worker already holds too: write the whole transcript again.
+  const sensitive = sensitiveValuesVersion(id);
+  const resyncDue = !base || base.deltasSinceFull >= DELTA_FULL_RESYNC_EVERY || base.sensitive !== sensitive;
   if (!resyncDue && _isPureAppend(base.refs, live)) {
     // Header: full disk projection with an empty message list (strips
     // transient aliases); tail: per-message projection of the appended
     // suffix only. Both use the same idempotent per-message projection
     // as a full send, so worker-side reconstruction is byte-identical.
     const header = _sessionForDisk({ ...session, messages: [] });
-    const tailMessages = _messagesForDisk(live.slice(base.refs.length));
+    const tailMessages = _messagesForDisk(live.slice(base.refs.length), id);
     // The EXACT payload the worker will reconstruct and write is the sent
     // baseline + this delta. Its evidence is fingerprint-checked against
     // what was sent, never a fresh projection of the mutable live session
@@ -127,7 +131,7 @@ export function _buildWirePayload(id, session, forceFull = false) {
     // reference-identity delta). Only the tail is fingerprinted.
     const prints = base.prints ? base.prints.concat(tailMessages.map(_messagePrint)) : null;
     const refs = live.slice();
-    _deltaBaseline.set(id, { refs, deltasSinceFull: base.deltasSinceFull + 1, prints });
+    _deltaBaseline.set(id, { refs, deltasSinceFull: base.deltasSinceFull + 1, prints, sensitive });
     return {
       delta: { baseCount: base.refs.length, header, tailMessages },
       attempt: _attemptRecord(header, refs, prints),
@@ -142,7 +146,7 @@ export function _buildWirePayload(id, session, forceFull = false) {
   // DELTA_FULL_RESYNC_EVERY saves.
   const refs = live.slice();
   const prints = _printMessages(live, diskMessages, resyncDue ? null : base);
-  _deltaBaseline.set(id, { refs, deltasSinceFull: 0, prints });
+  _deltaBaseline.set(id, { refs, deltasSinceFull: 0, prints, sensitive });
   // (saveSessionAsync normalizes `messages` to an array before any post.)
   return { session: full, attempt: _attemptRecord(full, refs, prints) };
 }

package/src/runtime/agent/orchestrator/session/store/serialize.mjs

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { renameWithRetrySync } from '../../../../shared/atomic-file.mjs';
 import { sanitizeContentForStoredHistory } from '../../providers/media-normalization.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../lifecycle-scan.mjs';
+import { redactSensitiveMessage } from '../sensitive-projection.mjs';
 
 // Inline base64 images (tool screenshots included) are written as
 // content-addressed refs, like prompt media, so session JSON stays small while
@@ -13,17 +14,17 @@ import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../lifecycle
 // Per-message disk projection shared by _sessionForDisk and the save-worker
 // delta path (tail-only projection). Returns the SAME array reference when no
 // message changed. Idempotent: already-sanitized content passes through
-// unchanged, so projecting a projected message is a no-op.
-export function _messagesForDisk(messages) {
+// unchanged, so projecting a projected message is a no-op. A value session
+// `sessionId` marked sensitive (sensitive-values.mjs) is stored as a marker in
+// the message's text (sensitive-projection.mjs).
+export function _messagesForDisk(messages, sessionId) {
   let changed = false;
   const out = messages.map((m) => {
     if (!m || typeof m !== 'object') return m;
     const content = sanitizeContentForStoredHistory(m.content);
-    if (content !== m.content) {
-      changed = true;
-      return { ...m, content };
-    }
-    return m;
+    const projected = redactSensitiveMessage(sessionId, content === m.content ? m : { ...m, content });
+    if (projected !== m) changed = true;
+    return projected;
   });
   return changed ? out : messages;
 }
@@ -46,7 +47,7 @@ export function _sessionForDisk(session) {
       Object.hasOwn(session, 'toolApprovalHook') ||
       Object.hasOwn(session, '_providerPrefixGuardState'));
   const messages = Array.isArray(session?.messages) ? session.messages : null;
-  const out = messages?.length ? _messagesForDisk(messages) : messages;
+  const out = messages?.length ? _messagesForDisk(messages, session.id) : messages;
   if (out === messages) {
     if (!hasTransient) return session;
     return _withMidTurnContextAnchor(_withoutTransientFields(session), session);

package/src/runtime/agent/orchestrator/session/store/session-persistence-events.mjs

@@ -0,0 +1,29 @@
+/**
+ * Read-only notifications about a session's persistence lifecycle, for owners
+ * of derived sidecars (the compaction archive) that must wait for the session
+ * record instead of polling for it. A pure registry: it persists nothing and
+ * imports no write path.
+ *
+ *   'landed' — a save of the session reached disk (its record exists);
+ *   'closed' — the session was closed (no further save is to be expected).
+ *
+ * A hard delete is announced through the existing purge hooks
+ * (session-observers.mjs registerSessionPurgeHook).
+ */
+const listeners = new Set();
+
+export function subscribeSessionPersistence(listener) {
+  if (typeof listener !== 'function') return () => {};
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+export function publishSessionPersistence(id, event) {
+  for (const listener of [...listeners]) {
+    try {
+      listener(id, event);
+    } catch {
+      /* observers never affect persistence */
+    }
+  }
+}

package/src/runtime/agent/orchestrator/session/store-agent-worker-rows.mjs

@@ -161,12 +161,12 @@ function cancelState(source) {
 function effectiveCancel(row, session) {
   const rowCancel = cancelState(row);
   const sessionCancel = cancelState(session);
-  const cancel =
-    rowCancel && sessionCancel && CANCEL_UNCONFIRMED_AGENT_STATUS.test(sessionCancel.status)
-      ? CANCEL_UNCONFIRMED_AGENT_STATUS.test(rowCancel.status)
-        ? rowCancel
-        : sessionCancel
-      : rowCancel || sessionCancel;
+  let cancel;
+  if (rowCancel && sessionCancel && CANCEL_UNCONFIRMED_AGENT_STATUS.test(sessionCancel.status)) {
+    cancel = CANCEL_UNCONFIRMED_AGENT_STATUS.test(rowCancel.status) ? rowCancel : sessionCancel;
+  } else {
+    cancel = rowCancel || sessionCancel;
+  }
   if (!cancel) return null;
   const newerWork = cancel.at > 0 && Math.max(workStampMs(row), workStampMs(session)) > cancel.at;
   return newerWork ? null : cancel;
@@ -633,6 +633,8 @@ function projectChildWorkerRow(row, context) {
     // A live turn blocked on the user's approval (persisted by the agent
     // tool's worker index); never carried by a row that is no longer working.
     ...(working && row.awaitingUser === 'approval' ? { awaitingUser: 'approval' } : {}),
+    // The owner closed this agent (status unchanged); reused work clears it.
+    ...(!working && row.released === true ? { released: true } : {}),
     // Why a settled failed row failed; a row working again has no failure.
     ...(!working && failedAgentWorker(row) && cleanValue(row.failureReason)
       ? { failureReason: cleanValue(row.failureReason) }

package/src/runtime/agent/orchestrator/session/store-summary-catalog.mjs

@@ -131,8 +131,9 @@ export function isLeadVisibleRow(row) {
   if (!agentSession && !isRootLeadSession(row) && owner && !LEAD_OWNERS.has(owner)) return false;
   // Mirror listLeadSessions: a previewless zero-message row is an unusable
   // scratch (desktop boot leftovers, crashed first turns) — resuming it
-  // shows an empty conversation, so the catalog hides it.
-  if (!row.preview && row.messageCount === 0) return false;
+  // shows an empty conversation, so the catalog hides it. A titled one is a
+  // real conversation whose prompts were rewound away: it stays listed.
+  if (!row.preview && row.messageCount === 0 && !row.title) return false;
   const sourceType = String(row.sourceType || '')
     .trim()
     .toLowerCase();
@@ -282,6 +283,15 @@ function rowFromSession(session) {
   });
 }
 
+/** The catalog row of one session read off `<directory>/<sessionId>.json` by
+ *  id — the same strict, stamp-cached derivation a listing uses — or null
+ *  when it is absent, unreadable, foreign or not one the catalog lists. */
+export function storedSessionCatalogRow(directory, sessionId) {
+  if (!isStoredSessionId(sessionId)) return null;
+  const entry = reconcileSessionFile(directory, sessionId, null, false);
+  return entry?.kind === 'row' && isLeadVisibleRow(entry.row) ? entry.row : null;
+}
+
 // ── Session file reconcile ──────────────────────────────────────────────────
 // What one `sessions/<id>.json` name contributes to the catalog, with the full
 // stamp { dev, ino, size, mtimeNs, ctimeNs } it was judged at (and the

package/src/runtime/agent/orchestrator/session/store-summary-index.mjs

@@ -391,31 +391,58 @@ const _pendingRemovals = new Set(); // ids to drop (upsert/removal are mutually
 let _summaryRetryTimer = null;
 let _summaryFlushScheduled = false;
 let _summaryFlushInflight = 0;
-const _summarySettleWaiters = new Set();
+// Ids whose ops the async flush in flight took (they are requeued if it fails).
+const _inflightSummaryIds = new Set();
+const _summarySettleWaiters = new Set(); // { ids: string[]|null, resolve }
 
 export function _hasUnsettledSummaryOps() {
   return _pendingUpserts.size > 0 || _pendingRemovals.size > 0 || _summaryFlushScheduled || _summaryFlushInflight > 0;
 }
 
+/** The ids among `ids` whose summary ops are queued or being written. */
+export function pendingSummaryIndexIds(ids) {
+  return ids.filter((id) => _pendingUpserts.has(id) || _pendingRemovals.has(id) || _inflightSummaryIds.has(id));
+}
+
+function _waiterSettled({ ids }) {
+  return ids ? pendingSummaryIndexIds(ids).length === 0 : !_hasUnsettledSummaryOps();
+}
+
 function _notifySummarySettled() {
-  if (_hasUnsettledSummaryOps()) return;
-  for (const resolve of _summarySettleWaiters) resolve();
-  _summarySettleWaiters.clear();
+  for (const waiter of _summarySettleWaiters) {
+    if (_waiterSettled(waiter)) waiter.settle(true);
+  }
 }
 
 /**
- * Resolves once every queued summary-index mutation has landed and no flush
- * is scheduled or in flight — from then on this process no longer touches
- * the index, its lock or its temp files. Callers are told a save/sweep is
- * done before its deferred index flush runs, so an owner that removes or
- * switches the data dir awaits this first. A flush refused by a held lock
- * (an overlapping flush of this process, or another process) stays queued
- * and settles when its retry lands.
+ * Resolves true once the queued summary-index mutations have landed — of
+ * `ids` only when given, else every one with no flush scheduled or in flight;
+ * from then on this process no longer touches the index for them. Callers
+ * are told a save/sweep is done before its deferred index flush runs, so an
+ * owner that removes or switches the data dir awaits this first. A flush
+ * refused by a held lock (an overlapping flush of this process, or another
+ * process) stays queued and settles when its retry lands. When `signal`
+ * aborts first it resolves false and stops waiting; the ops stay queued.
  */
-export function settleSummaryIndexWrites() {
-  if (!_hasUnsettledSummaryOps()) return Promise.resolve();
+export function settleSummaryIndexWrites({ ids = null, signal = null } = {}) {
+  const waiter = { ids, settle: null };
+  if (_waiterSettled(waiter)) return Promise.resolve(true);
+  if (signal?.aborted) return Promise.resolve(false);
   _summaryRetryTimer?.ref?.();
-  return new Promise((resolve) => _summarySettleWaiters.add(resolve));
+  return new Promise((resolve) => {
+    const onAbort = () => waiter.settle(false);
+    // The one exit, landed or abandoned: the waiter and its abort listener
+    // both go, so a long-lived signal collects nothing per settle.
+    waiter.settle = (landed) => {
+      if (!_summarySettleWaiters.delete(waiter)) return;
+      signal?.removeEventListener('abort', onAbort);
+      // Only an awaited settlement keeps the process alive for the retry.
+      if (_summarySettleWaiters.size === 0) _summaryRetryTimer?.unref?.();
+      resolve(landed);
+    };
+    _summarySettleWaiters.add(waiter);
+    signal?.addEventListener('abort', onAbort, { once: true });
+  });
 }
 
 function _scheduleSummaryRetry() {
@@ -498,11 +525,14 @@ export function _flushPendingSummaryOps({ sync = false } = {}) {
     return;
   }
   _summaryFlushInflight++;
+  const taken = [...upserts.keys(), ...removals];
+  for (const id of taken) _inflightSummaryIds.add(id);
   withFileLock(`${path}.lock`, () => _appendSummaryOpsLocked(path, text), { timeoutMs: SUMMARY_LOCK_TIMEOUT_MS })
     .then(() => _sweepStaleSummaryTempOnce(path))
     .catch(requeue)
     .finally(() => {
       _summaryFlushInflight--;
+      for (const id of taken) _inflightSummaryIds.delete(id);
       if (_pendingUpserts.size > 0 || _pendingRemovals.size > 0) _scheduleSummaryFlush();
       _notifySummarySettled();
     });

package/src/runtime/agent/orchestrator/session/store-summary-reader.mjs

@@ -22,6 +22,7 @@ import {
   scanSessionFiles,
   scanSessionFilesAsync,
   stampedDerivation,
+  storedSessionCatalogRow,
 } from './store-summary-catalog.mjs';
 import { createStoredTranscriptCache, nextProjectionStamp } from './store-transcript-cache.mjs';
 import {
@@ -34,10 +35,17 @@ import { projectStoredTranscript } from './store-transcript-projection.mjs';
 import { dataDir } from './store-summary-locations.mjs';
 import { isStoredSessionId, workspaceSummary } from './store-summary-fields.mjs';
 import { readArchivedAgentResult } from './store-summary-archived-agent.mjs';
-import { compactionArchivePath, readCompactionArchivePage } from './compaction-archive.mjs';
+import {
+  compactionArchivePath,
+  compactionArchiveRange,
+  readCompactionArchivePage,
+  visitCompactionArchive,
+} from './compaction-archive.mjs';
+import { attachmentHistoryRows } from './stored-attachment-history.mjs';
 import { currentSessionCatalogDb, onSessionCatalogDbChange, sessionCatalogDb } from './catalog-db/index.mjs';
 import { decodeCatalogCursor, encodeCatalogCursor, isAfterCursor } from './catalog-db/schema.mjs';
-import { onSessionActivityChange } from '../../../shared/session-activity-signal.mjs';
+import { onSessionActivityChange, onSessionApprovalCardChange } from '../../../shared/session-activity-signal.mjs';
+import { inFlightSessionActivity } from './manager/runtime-state.mjs';
 import {
   readCanonicalSessionRecord as readCanonicalLifecycle,
   offerStrictSessionRecord,
@@ -59,6 +67,11 @@ export { storedAgentWorkerIndexPath } from './store-summary-locations.mjs';
 // the desktop service worker keeps its own for the deep-history prefetch.
 const storedTranscriptCache = createStoredTranscriptCache();
 
+// The attachment rows of whole stored conversations: the same cache mechanism
+// and byte budget as the windows above, as an instance of its own, which a
+// lookup can neither fill nor evict.
+const attachmentHistoryCache = createStoredTranscriptCache();
+
 /** Test seam: forget every cached projection. */
 export function clearStoredTranscriptCache() {
   storedTranscriptCache.clear();
@@ -106,7 +119,23 @@ onSessionCatalogDbChange(() => notifyCatalogListeners());
 // Runtime activity transitions (turn start/settle, task wait, background
 // hand-off/finish) change only the Agents pool projection: `agent-activity`
 // lets the reader refresh just that, at once.
-onSessionActivityChange(() => notifyCatalogListeners('agent-activity'));
+// A transition that starts or settles a turn also changes the catalog rows'
+// `working` / `agentWorking` overlay. The listing that a turn's final save
+// triggers can run before the turn leaves the runtime map, and nothing else
+// re-lists: a bot home (no title write after its turn) kept `working` — a
+// spinner and no completion dot — until its next file change.
+let catalogActivity = '';
+onSessionActivityChange(() => {
+  notifyCatalogListeners('agent-activity');
+  const { working, agentWorking } = inFlightSessionActivity();
+  const next = `${[...working].sort().join(',')}|${[...agentWorking].sort().join(',')}`;
+  if (next === catalogActivity) return;
+  catalogActivity = next;
+  notifyCatalogListeners('turn-activity');
+});
+// A session started or stopped waiting on the user's approval: its catalog row
+// (`awaitingApproval`) changed, though no store file did.
+onSessionApprovalCardChange(() => notifyCatalogListeners('approval'));
 
 /** `listener()` runs when a background pass finds a session file that changed
  *  without a directory or index change, i.e. when an ordinary listing would
@@ -232,6 +261,12 @@ export async function listStoredSessionSummaryPage(options = {}) {
   };
 }
 
+/** One session's catalog row by id, read off its record (not the paged
+ *  listing): null when the catalog would not list it. */
+export function readStoredSessionCatalogRow(id) {
+  return storedSessionCatalogRow(join(dataDir(), 'sessions'), String(id || '').trim());
+}
+
 /** Exact, fail-closed existence check for a durable session address.
  * Summary indexes and desktop metadata are presentation caches; neither may
  * make a missing sessions/<id>.json record addressable again. */
@@ -269,6 +304,7 @@ function storedSessionMetadata(sessionId, session) {
     ownerSessionId: session.ownerSessionId || session.parentSessionId || null,
     visibility: sessionVisibility(session),
     agentTag: session.agentTag || null,
+    title: session.title || null,
     cwd: session.cwd || '',
     ...(workspaceSummary(session.workspace) ? { workspace: workspaceSummary(session.workspace) } : {}),
     provider: session.provider || null,
@@ -405,6 +441,49 @@ async function produceStoredTranscript(text, stamp, context) {
   }
 }
 
+/** The rows of one session's whole stored conversation that name attachments
+ *  (see attachmentHistoryRows): its record's messages and every visible
+ *  segment of its compaction archive (a cleared or capped archive stays
+ *  excluded, as for a window). Read from the files alone, under the same
+ *  strict record authority as a transcript read, and cached by content
+ *  identity in a cache of its own: the transcript windows are untouched.
+ *  Null when the record is absent, unreadable or not this session's. */
+async function readStoredAttachmentHistory(sessionId, recordPath, archivePath) {
+  const recordStat = probePath(recordPath);
+  if (recordStat.state !== PROBE_PRESENT) return null;
+  const archive = probePath(archivePath);
+  const key = `${sessionId}|attachments`;
+  let complete = true;
+  const { value } = await attachmentHistoryCache.read({
+    key,
+    fingerprint: [archive.state, archive.mtimeMs, archive.ctimeMs, archive.size, archive.ino, archive.dev].join(':'),
+    fileStat: recordStat,
+    loadText: () => {
+      const body = readTextFile(recordPath);
+      return body.state === PROBE_PRESENT ? body.text : null;
+    },
+    produce: async (text) => {
+      const record = readTopLevelLifecycleRecord(text);
+      if (isLifecycleUnreadable(record) || record.id !== sessionId) return null;
+      const { restoreTranscriptItems } = await import('./transcript-restore/restore.mjs');
+      const items = [];
+      const range = compactionArchiveRange(record.doc);
+      // An archive that exists but could not be walked is a transient miss,
+      // not a state worth keeping.
+      const walked = range
+        ? await visitCompactionArchive(join(dataDir(), 'sessions'), sessionId, range, (segment) =>
+            items.push(...attachmentHistoryRows(segment))
+          )
+        : true;
+      complete = walked || archive.state !== PROBE_PRESENT;
+      items.push(...attachmentHistoryRows(restoreTranscriptItems(record.doc.messages, { sessionId })));
+      return { sessionId, items };
+    },
+  });
+  if (!complete) attachmentHistoryCache.forget(key);
+  return value ?? null;
+}
+
 /** Read exactly one persisted session for a visible desktop pane. This never
  * enumerates siblings. Normal reads stay independent of runtime ownership;
  * interrupted turns conditionally use the same durable reconnect recovery as
@@ -416,6 +495,8 @@ export async function readStoredSessionTranscript(id, options = {}) {
   // absent, unreadable, ambiguous or foreign record yields no transcript.
   const { recordPath, checkpointPath, archivePath } = storedTranscriptInputPaths(sessionId);
   if (options.metadataOnly === true) return readStoredSessionMetadata(recordPath, sessionId);
+  // The attachments the whole conversation names, apart from any window.
+  if (options.attachmentHistory === true) return readStoredAttachmentHistory(sessionId, recordPath, archivePath);
   // One page of the display-only compaction archive (the live head loader
   // pages it once a runtime's in-memory rows are exhausted).
   if (options.compactionArchive && typeof options.compactionArchive === 'object') {

package/src/runtime/agent/orchestrator/session/stored-attachment-history.mjs

@@ -0,0 +1,32 @@
+// The attachments a session's whole stored conversation names (its record and
+// its compaction archive), reduced to the metadata that says which rows name
+// which attachment. Whether an attachment id belongs to a session is decided
+// against this, not against a transcript window (a tail plus the pages paged
+// in), which no longer holds rows a compaction moved into the archive.
+
+const pick = (entry, keys) =>
+  Object.fromEntries(keys.filter((key) => entry?.[key] != null).map((key) => [key, entry[key]]));
+const picked = (list, keys) => (Array.isArray(list) ? list.map((entry) => pick(entry, keys)) : []);
+
+/** The rows of `items` that name attachments, reduced to the fields the
+ *  desktop reads to attribute an id to its row: the row kind (and a notice's
+ *  routine / room kind) and each attachment's id, name, type and size. No
+ *  text, tool output or other row content is kept. */
+export function attachmentHistoryRows(items) {
+  const rows = [];
+  for (const item of Array.isArray(items) ? items : []) {
+    const attachments = picked(item?.attachments, ['id', 'name', 'mimeType', 'kind', 'size']);
+    const images = picked(item?.images, ['attachmentRef', 'name', 'mimeType', 'bytes']);
+    const imageRefs = picked(item?.imageRefs, ['ref']);
+    if (!attachments.length && !images.length && !imageRefs.length) continue;
+    rows.push({
+      kind: item.kind,
+      ...(item.routine?.kind ? { routine: { kind: item.routine.kind } } : {}),
+      ...(item.room?.kind ? { room: { kind: item.room.kind } } : {}),
+      ...(attachments.length ? { attachments } : {}),
+      ...(images.length ? { images } : {}),
+      ...(imageRefs.length ? { imageRefs } : {}),
+    });
+  }
+  return rows;
+}