mixdog 1.3.5 → 1.4.1

package/src/runtime/agent/orchestrator/session/manager/route-fallback-chain.mjs

@@ -0,0 +1,130 @@
+// The fallback chain a running session follows, read from its settings when
+// it is needed (a hop, a status read) instead of the copy taken at creation:
+// an edit made while the session runs applies from its next model request,
+// and a chain cleared to [] stops further hops at once.
+// - A Lead-class session (coding Lead, a bot's chat, Mixy) follows its
+//   owner's stored route (owner-route-fallbacks.mjs);
+// - a delegated agent follows the route it was spawned from
+//   (`routeFallbackSource`: its agent's route, else Main's, or a named preset).
+// The stored chain applies only while the session's primary — the route it
+// ran on before its first hop — is that stored route's model. A session
+// whose source cannot be read (an older record, a direct route) keeps its own.
+import { findPreset } from '../../runtime-core/config-helpers.mjs';
+import { normalizeWorkflowRoute } from '../../runtime-core/workflow.mjs';
+import { configuredAgentRouteCandidates } from '../../../../shared/agent-route-config.mjs';
+import { executionFallbacks } from '../../../../shared/model-route-chain.mjs';
+import { CODING_MODE, resolveSessionMode } from '../agent-mode.mjs';
+import { _liveSessions } from '../store/live-state.mjs';
+import { ownerConfiguredRoute, sameRouteModel } from './owner-route-fallbacks.mjs';
+
+const LEAF_FIELDS = ['effort', 'fast', 'autoEffort', 'modelParameters', 'contextPercent', 'contextTokens'];
+
+/** The switchable fields of a route or session record (no chain). */
+export function routeLeaf(route) {
+  const leaf = { provider: route?.provider || '', model: route?.model || '' };
+  for (const key of LEAF_FIELDS) if (route?.[key] !== undefined && route[key] !== null) leaf[key] = route[key];
+  return leaf;
+}
+
+/** The route the session ran on before its first fallback hop; its own route
+ *  while it has not hopped. */
+export function sessionRoutePrimary(session) {
+  if (session?.routeFallbackPrimary?.provider) return session.routeFallbackPrimary;
+  const first = session?.routeFallbackFailures?.[0];
+  if (first?.provider && first?.model) return { provider: first.provider, model: first.model };
+  return routeLeaf(session);
+}
+
+function normalizedOrNull(stored) {
+  if (!stored) return null;
+  try {
+    return normalizeWorkflowRoute(stored) || null;
+  } catch {
+    return null;
+  }
+}
+
+/** The stored route the session's chain comes from, read now; null when the
+ *  session has no readable source (it then keeps its own chain). */
+export function sessionChainSource(session, config) {
+  const { mode, agentId } = resolveSessionMode({ session });
+  if (agentId) return ownerConfiguredRoute({ sessionMode: mode, agentId, config });
+  const source = session?.routeFallbackSource;
+  if (source?.agent) {
+    // As the spawn resolved it: the agent's own route, else Main's.
+    const own = configuredAgentRouteCandidates(config, source.agent).map(normalizedOrNull).find(Boolean);
+    return own || normalizedOrNull(findPreset(config, config?.default));
+  }
+  if (source?.preset) return normalizedOrNull(findPreset(config, source.preset));
+  return null;
+}
+
+/** `{ chain, fromSettings }`: the fallback routes the session follows now. */
+export function liveRouteFallbacks(session, config) {
+  const source = sessionChainSource(session, config);
+  if (!source)
+    return { chain: Array.isArray(session?.routeFallbacks) ? session.routeFallbacks : [], fromSettings: false };
+  const onSourcePrimary = sameRouteModel(source, sessionRoutePrimary(session));
+  return { chain: onSourcePrimary ? executionFallbacks(source) : [], fromSettings: true };
+}
+
+/** Index in `chain` of the next route to try: the first after the session's
+ *  current model that this session has not already run (its primary and the
+ *  models it already left); `chain.length` when none is left. */
+export function nextRouteFallbackIndex(session, chain) {
+  const tried = [sessionRoutePrimary(session), ...(session?.routeFallbackFailures || []), session];
+  const at = chain.findIndex((entry) => sameRouteModel(entry, session));
+  for (let index = at + 1; index < chain.length; index += 1) {
+    if (!tried.some((route) => sameRouteModel(chain[index], route))) return index;
+  }
+  return chain.length;
+}
+
+const modelOf = (route) => ({ provider: route?.provider || '', model: route?.model || '' });
+
+/** The public fallback position of one session: the route it is on against
+ *  its primary, the hop index, the chain it follows now and why it left each model. */
+export function routeFallbackPosition(session, config) {
+  const { chain, fromSettings } = liveRouteFallbacks(session, config);
+  const next = chain[nextRouteFallbackIndex(session, chain)] || null;
+  const primary = sessionRoutePrimary(session);
+  const { mode, agentId } = resolveSessionMode({ session });
+  let kind = 'agent';
+  if (agentId) kind = mode === CODING_MODE ? 'lead' : 'bot';
+  return {
+    sessionId: session.id,
+    kind,
+    agent: agentId || session.agent || null,
+    current: modelOf(session),
+    primary: modelOf(primary),
+    onPrimary: sameRouteModel(primary, session),
+    fallbackIndex: Number(session.routeFallbackIndex) || 0,
+    fallbacks: chain.map(modelOf),
+    chainFrom: fromSettings ? 'settings' : 'session',
+    next: next ? modelOf(next) : null,
+    failures: (session.routeFallbackFailures || []).map(({ provider, model, kind: errorKind, error }) => ({
+      provider,
+      model,
+      kind: errorKind,
+      error,
+    })),
+  };
+}
+
+/** Whether the session has left its primary for a fallback model. */
+export const routeFallbackHopped = (session) =>
+  Number(session?.routeFallbackIndex) > 0 || Boolean(session?.routeFallbackFailures?.length);
+
+/** Positions of the sessions held in this process that follow a chain or have
+ *  hopped; `keep(position)` narrows them. */
+export function liveRouteFallbackPositions(config, keep = () => true) {
+  const rows = [];
+  for (const session of _liveSessions.values()) {
+    // Only a session with an agent hops (advanceAgentRoute).
+    if (!session?.id || session.closed === true || !session.agent) continue;
+    const position = routeFallbackPosition(session, config);
+    if (!position.fallbacks.length && !routeFallbackHopped(session)) continue;
+    if (keep(position)) rows.push(position);
+  }
+  return rows;
+}

package/src/runtime/agent/orchestrator/session/manager/rules-cache.mjs

@@ -59,15 +59,19 @@ function omitToolsKey(omitTools) {
     .join(',');
 }
 
-export function _buildSharedRules({ omitTools = [], allowTools = null } = {}) {
+export function _buildSharedRules({ omitTools = [], allowTools = null, ownerIsAgent = false } = {}) {
   const PLUGIN_ROOT = mixdogRoot();
   const RULES_DIR = join(PLUGIN_ROOT, 'rules');
   return buildCachedRules(
     'buildSharedToolContent',
     'shared tool rules',
     [join(RULES_DIR, 'shared')],
-    { PLUGIN_ROOT, DATA_DIR: resolvePluginData(), omitTools, allowTools },
-    JSON.stringify([omitToolsKey(omitTools), Array.isArray(allowTools) ? omitToolsKey(allowTools) : null])
+    { PLUGIN_ROOT, DATA_DIR: resolvePluginData(), omitTools, allowTools, ownerIsAgent },
+    JSON.stringify([
+      omitToolsKey(omitTools),
+      Array.isArray(allowTools) ? omitToolsKey(allowTools) : null,
+      ownerIsAgent === true,
+    ])
   );
 }
 
@@ -98,8 +102,17 @@ export function _buildRouteRules({ provider = null, model = null, omitTools = []
 
 // BP1 = shared tool policy followed by this route's rules. Every site that
 // renders or re-identifies the BP1 block must use this one composition.
-export function _buildBaseRules({ provider = null, model = null, omitTools = [], allowTools = null } = {}) {
-  return [_buildSharedRules({ omitTools, allowTools }), _buildRouteRules({ provider, model, omitTools, allowTools })]
+export function _buildBaseRules({
+  provider = null,
+  model = null,
+  omitTools = [],
+  allowTools = null,
+  ownerIsAgent = false,
+} = {}) {
+  return [
+    _buildSharedRules({ omitTools, allowTools, ownerIsAgent }),
+    _buildRouteRules({ provider, model, omitTools, allowTools }),
+  ]
     .filter(Boolean)
     .join('\n\n---\n\n');
 }
@@ -201,9 +214,14 @@ export function _buildLeadLanguage() {
   });
 }
 
-export function _buildLeadLanguageContext() {
+export function _buildLeadLanguageContext({ includeOutputStyle = true } = {}) {
+  const PLUGIN_ROOT = mixdogRoot();
   const DATA_DIR = resolvePluginData();
-  return buildCachedRules('buildLeadLanguageContent', 'lead language context', [join(DATA_DIR, 'mixdog-config.json')], {
-    DATA_DIR,
-  });
+  return buildCachedRules(
+    'buildLeadLanguageContent',
+    'lead language context',
+    [join(DATA_DIR, 'mixdog-config.json'), join(PLUGIN_ROOT, 'output-styles'), join(DATA_DIR, 'output-styles')],
+    { PLUGIN_ROOT, DATA_DIR, includeOutputStyle },
+    includeOutputStyle ? 'style' : 'no-style'
+  );
 }

package/src/runtime/agent/orchestrator/session/manager/runtime-liveness.mjs

@@ -17,16 +17,22 @@
 //   stage, lastStreamDeltaAt, lastTransportAt, firstSemanticAt,
 //   lastSemanticAt, lastReasoningAt, lastVisibleTextAt, lastToolProtocolAt,
 //   lastToolCall, lastError, updatedAt,
+//   modelRequestStartedAt, requestTransportAt, requestFirstSemanticAt,
+//   modelResponseAccepted,  // the current logical model request (see
+//                           // _setLogicalModelRequest); the fields above
+//                           // stay turn-level history
 //   controller?: AbortController,  // set while an ask is in flight
 //   generation?: number,            // snapshot taken at ask start
 //   closed?: boolean,               // flipped by closeSession()
 // }
 import { createAbortController } from '../../../../shared/abort-controller.mjs';
 import { emitSessionApprovalWaitChange } from '../../../../shared/session-approval-wait.mjs';
-import { emitSessionActivityChange } from '../../../../shared/session-activity-signal.mjs';
+import { emitSessionActivityChange, emitSessionTurnStart } from '../../../../shared/session-activity-signal.mjs';
 import { DEFAULT_ACTIVITY_HEARTBEAT_MS } from '../../stall-policy.mjs';
 import { MODEL_THINKING_STAGE, awaitingModelResponse, lastProgressAt } from '../../../../shared/quiet-progress.mjs';
-import { finishBrowserTurn } from '../../../../browser-bridge/client.mjs';
+import { beginBrowserTurn, finishBrowserTurn, forgetBrowserSession } from '../../../../browser-bridge/client.mjs';
+import { registerSessionPurgeHook } from '../store.mjs';
+import { finishComputerTurn } from '../../../../computer-bridge/client.mjs';
 import { configureUsageMetricsRuntime, dropMetricSeenState, bumpUsageMetricsTurnId } from './usage-metrics.mjs';
 import { runtimeState as _runtimeState, isTurnInFlight } from './runtime-state.mjs';
 
@@ -48,11 +54,25 @@ const VALID_STAGES = new Set([
 ]);
 const TERMINAL_STAGES = new Set(['done', 'error']);
 
+function beginBrowserWork(id, entry) {
+  void beginBrowserTurn(id, entry.browserTurnId).catch((error) => {
+    process.stderr.write(`[browser] Task start failed: ${error?.message || error}\n`);
+  });
+}
+
+// A session deleted for good no longer has browser turns to report.
+registerSessionPurgeHook(forgetBrowserSession);
+
 function finishBrowserWork(id, entry, aborted = false) {
   const turnId = Number(entry.browserTurnId ?? entry.session?.usageMetricsTurnId) || 0;
   void finishBrowserTurn(id, turnId, { aborted }).catch((error) => {
     process.stderr.write(`[browser] Task cleanup failed: ${error?.message || error}\n`);
   });
+  // The same terminal state settles the turn's Computer Use saved-login fills
+  // (lead and sub-agent sessions alike).
+  void finishComputerTurn(id, turnId).catch((error) => {
+    process.stderr.write(`[computer] Turn settlement failed: ${error?.message || error}\n`);
+  });
 }
 
 // Injected deps that would otherwise pull manager.mjs's store/provider surface
@@ -115,6 +135,23 @@ function _startToolActivityHeartbeat(id) {
   _toolActivityHeartbeats.set(id, timer);
 }
 
+// One logical model request owns one first-output allowance: its request
+// clock and its own first transport / first semantic marks. It begins with the
+// ask's first request, with the first request after the model's previous
+// response was accepted (its tool calls ran — the request that carries the
+// tool results), and with a request after a settled turn. Every other entry
+// into `requesting` — a provider or loop retry, a route fallback, a no-tool
+// recovery continuation — re-sends the same logical request and keeps all of
+// it, so a retry never earns a fresh allowance. The turn-level marks
+// (firstSemanticAt, lastTransportAt, …) are history and are not touched.
+// `startedAt` null: no request yet (an ask starting).
+function _setLogicalModelRequest(entry, startedAt) {
+  entry.modelRequestStartedAt = startedAt;
+  entry.requestTransportAt = null;
+  entry.requestFirstSemanticAt = null;
+  entry.modelResponseAccepted = false;
+}
+
 export function updateSessionStage(id, stage) {
   if (stage === MODEL_THINKING_STAGE) {
     markSessionRequestSent(id);
@@ -127,8 +164,11 @@ export function updateSessionStage(id, stage) {
   entry.stage = stage;
   // A new stage (a retried attempt included) has not sent its request yet.
   entry.requestSentAt = null;
-  if (stage === 'requesting' && priorStage !== 'requesting') {
-    entry.modelRequestStartedAt = now;
+  if (
+    stage === 'requesting' &&
+    (!entry.modelRequestStartedAt || entry.modelResponseAccepted || TERMINAL_STAGES.has(priorStage))
+  ) {
+    _setLogicalModelRequest(entry, now);
   }
   entry.lastProgressAt = now;
   entry.updatedAt = now;
@@ -149,6 +189,7 @@ export function markSessionAskStart(id) {
   const sessionForTurn = entry.session ?? _deps.loadSession(id);
   if (sessionForTurn) bumpUsageMetricsTurnId(sessionForTurn);
   entry.browserTurnId = Number(sessionForTurn?.usageMetricsTurnId) || 0;
+  beginBrowserWork(id, entry);
   entry.stage = 'connecting';
   entry.lastStreamDeltaAt = null;
   entry.lastTransportAt = null;
@@ -175,10 +216,11 @@ export function markSessionAskStart(id) {
   // after provider admission (the scheduler emits stage=requesting).
   const now = Date.now();
   entry.askStartedAt = now;
-  entry.modelRequestStartedAt = null;
+  _setLogicalModelRequest(entry, null);
   entry.lastProgressAt = now;
   entry.updatedAt = now;
   entry.taskWaits = 0;
+  emitSessionTurnStart(id);
   emitSessionActivityChange(id);
 }
 /** The provider put the request on the wire; its response headers are
@@ -211,13 +253,14 @@ export function markSessionTransportActivity(id) {
   if (!entry || entry.closed || entry.controller?.signal?.aborted || TERMINAL_STAGES.has(entry.stage)) return;
   const now = Date.now();
   entry.lastTransportAt = now;
+  entry.requestTransportAt = now;
   entry.updatedAt = now;
 }
 function _normalizeModelProgressKind(kind) {
   let value = 'semantic';
   if (typeof kind === 'string') value = kind;
   else if (kind && typeof kind.kind === 'string') value = kind.kind;
-  if (value === 'transport' || value === 'reasoning' || value === 'text' || value === 'tool') {
+  if (value === 'transport' || value === 'keepalive' || value === 'reasoning' || value === 'text' || value === 'tool') {
     return value;
   }
   return 'semantic';
@@ -239,12 +282,22 @@ export async function markSessionStreamDelta(id, kind = 'semantic') {
     markSessionTransportActivity(id);
     return;
   }
+  if (progressKind === 'keepalive') {
+    markSessionTransportActivity(id);
+    // A keepalive before the request's first semantic event is covered by the
+    // first-output window and never counts as progress. lastProgressAt stays
+    // untouched: the watchdog caps how long keepalives may extend it.
+    if (entry.requestFirstSemanticAt) entry.lastKeepaliveAt = Date.now();
+    return;
+  }
   _stopToolActivityHeartbeat(id);
   const now = Date.now();
   // Every semantic model event also proves transport health. The inverse is
   // intentionally false: raw chunks/keepalives update only lastTransportAt.
   entry.lastTransportAt = now;
+  entry.requestTransportAt = now;
   if (!entry.firstSemanticAt) entry.firstSemanticAt = now;
+  if (!entry.requestFirstSemanticAt) entry.requestFirstSemanticAt = now;
   entry.lastSemanticAt = now;
   entry.lastSemanticKind = progressKind;
   if (progressKind === 'reasoning') entry.lastReasoningAt = now;
@@ -278,7 +331,12 @@ export function markSessionToolCall(id, toolName) {
   entry.toolOutputTailAt = null;
   entry.toolStartedAt = Date.now();
   entry.lastTransportAt = entry.toolStartedAt;
+  entry.requestTransportAt = entry.toolStartedAt;
   if (!entry.firstSemanticAt) entry.firstSemanticAt = entry.toolStartedAt;
+  if (!entry.requestFirstSemanticAt) entry.requestFirstSemanticAt = entry.toolStartedAt;
+  // The response whose tool call runs now was accepted: the next model
+  // request carries its tool results and is a new logical request.
+  entry.modelResponseAccepted = true;
   entry.lastSemanticAt = entry.toolStartedAt;
   entry.lastSemanticKind = 'tool';
   entry.lastToolProtocolAt = entry.toolStartedAt;
@@ -418,6 +476,18 @@ export function markSessionCancelled(id) {
   entry.emptyFinalAt = null;
   _unlinkParentAbortListener(entry);
 }
+/**
+ * The session's current logical model request: when it started and whether
+ * it has produced semantic output yet. A provider stream opened for it — a
+ * retry or a route fallback included — bounds its first-output phase by this
+ * request instead of starting a fresh one. Null without a request.
+ */
+export function getLogicalModelRequest(sessionId) {
+  const entry = sessionId ? _runtimeState.get(sessionId) : null;
+  if (!entry?.modelRequestStartedAt) return null;
+  return { startedAt: entry.modelRequestStartedAt, outputSeen: Boolean(entry.requestFirstSemanticAt) };
+}
+
 export function getSessionRuntime(id) {
   return id ? _runtimeState.get(id) || null : null;
 }
@@ -440,8 +510,10 @@ export function getSessionProgressSnapshot(sessionId) {
   const firstActivityAt = firstSemanticAt;
   const stage = entry.stage || 'idle';
   const activeModelStage = stage === 'connecting' || stage === 'requesting' || stage === 'streaming';
-  const waitingForTransport = Boolean(modelRequestStartedAt && activeModelStage && !entry.lastTransportAt);
-  const waitingForFirstSemantic = Boolean(modelRequestStartedAt && activeModelStage && !firstSemanticAt);
+  // Judged per logical model request: output an earlier request of this turn
+  // produced never ends a later request's first-output phase.
+  const waitingForTransport = Boolean(modelRequestStartedAt && activeModelStage && !entry.requestTransportAt);
+  const waitingForFirstSemantic = Boolean(modelRequestStartedAt && activeModelStage && !entry.requestFirstSemanticAt);
   return {
     stage,
     askStartedAt,
@@ -463,6 +535,7 @@ export function getSessionProgressSnapshot(sessionId) {
     toolOutputTail: entry.toolOutputTail || null,
     toolOutputTailAt: entry.toolOutputTailAt || 0,
     lastProgressAt: entry.lastProgressAt || 0,
+    lastKeepaliveAt: entry.lastKeepaliveAt || 0,
     updatedAt: entry.updatedAt || 0,
     hasFirstActivity: Boolean(firstSemanticAt && (!askStartedAt || firstSemanticAt >= askStartedAt)),
     hasFirstSemantic: Boolean(firstSemanticAt && (!askStartedAt || firstSemanticAt >= askStartedAt)),

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -24,6 +24,7 @@ import {
 } from './runtime-liveness.mjs';
 import { clearTurnCheckpoint } from './turn-checkpoint.mjs';
 import { forgetSessionSaveBaseline } from '../store/save-worker.mjs';
+import { publishSessionPersistence } from '../store/session-persistence-events.mjs';
 import { forgetSessionLoadCache } from '../store/load-cache.mjs';
 import { releaseReadSnapshotScope } from '../../tools/builtin/snapshot-store.mjs';
 import { cancelOwnedShellTrees } from '../../tools/lib/owned-shell-trees.mjs';
@@ -142,6 +143,7 @@ function finishClose({ id, reason, tombstone, entry, closeSnapshot, newGen, outc
   // above; committing it stops the turn's checkpoint writer. Only now is it
   // safe to remove the crash fallback.
   closeSnapshot?.commit();
+  publishSessionPersistence(id, 'closed');
   _stopToolActivityHeartbeat(id);
   cancelOwnedShellProcesses({ id, reason, tombstone });
   clearTurnCheckpoint(id);

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -42,11 +42,13 @@ import { ensureCodexWireSessionId, mintSessionId } from './session-id.mjs';
 import { providerCacheKey } from './provider-cache-key.mjs';
 import { buildSessionRecord, normalizeDesktopSessionMetadata, sessionOriginFields } from './session-record.mjs';
 import { normalizeWorkflowRoute } from '../../runtime-core/workflow.mjs';
+import { executionFallbacks } from '../../../../shared/model-route-chain.mjs';
 import { ownerRouteFallbacks } from './owner-route-fallbacks.mjs';
 import { applyPendingWorkspaceReroot, refreshSessionBp3Environment } from './prompt-utils.mjs';
 import { isWorktreeBound } from '../../../../shared/worktrees/contract.mjs';
 import { applyAgentToolExposure } from '../loop/tool-exposure-migration.mjs';
 import { prewarmSessionAutoEffort } from './ask-turn-auto-effort.mjs';
+import { cancelCacheWarm } from '../cache-warm.mjs';
 
 // Durable turn-checkpoint recovery; re-exported so prior importers of this
 // module stay unchanged.
@@ -239,11 +241,13 @@ export function createSession(createOpts) {
     ? Object.hasOwn(opts, 'routeFallbacks')
       ? opts.routeFallbacks
       : ownerRouteFallbacks({ sessionMode, agentId: actingAgent, provider: providerName, model: modelName })
-    : normalizeWorkflowRoute({
-        provider: providerName,
-        model: modelName,
-        fallbacks: Object.hasOwn(opts, 'routeFallbacks') ? opts.routeFallbacks : presetObj?.fallbacks,
-      })?.fallbacks;
+    : executionFallbacks(
+        normalizeWorkflowRoute({
+          provider: providerName,
+          model: modelName,
+          fallbacks: Object.hasOwn(opts, 'routeFallbacks') ? opts.routeFallbacks : presetObj?.fallbacks,
+        })
+      );
   // Provider cache strategy — agentRuntime.resolveSync() above is a
   // best-effort injection point (setAgentRuntime() has no live caller
   // today, so that branch never fires); build it directly here so every
@@ -262,7 +266,7 @@ export function createSession(createOpts) {
     : agentProfileRevision(surface.resolvedAgent, { mixy: sessionMode === AGENT_MODE });
   // A bot thread lives on across releases: the rules it was built from.
   const rulesRevision = agentProfile && sessionMode === AGENT_MODE ? promptRulesRevision() : '';
-  const prompt = composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode });
+  const prompt = composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode, sessionId: id });
   const messages = seedSessionMessages(prompt, opts.files);
   logSessionSurface(surface);
   const contextMeta = resolveSessionContextMeta(provider, modelName, {
@@ -288,6 +292,13 @@ export function createSession(createOpts) {
     if (rulesRevision) session.rulesRevision = rulesRevision;
   }
   if (routeFallbacks?.length) session.routeFallbacks = routeFallbacks;
+  // Where an agent's chain is read from at each hop (route-fallback-chain.mjs).
+  const fallbackSource = Object.hasOwn(opts, 'routeFallbackSource')
+    ? opts.routeFallbackSource
+    : presetObj?.fallbackSource;
+  if (!actingAgent && fallbackSource && typeof fallbackSource === 'object') {
+    session.routeFallbackSource = { ...fallbackSource };
+  }
   // A non-native agent sends core + bridge, built from its filtered tools.
   applyAgentToolExposure(session);
   refreshSessionBp3Environment(session, opts.cwd);
@@ -315,24 +326,27 @@ export function contextSeedForRouteUpdate(session, routeChanged, selectedContext
 // ever replaced; custom-prompt or agent layouts without that block are left
 // untouched, and a same-variant switch is a no-op.
 export function _refreshSessionRuleVariantsForModel(session, previousModel, previousProvider = session?.provider) {
+  const ownerIsAgent = isAgentOwner(session);
   const deny = [
     ...(Array.isArray(session?.disallowedTools) ? session.disallowedTools : []),
     ...(getHiddenAgent(session?.agent || null) ? ['Skill'] : []),
-    ...(delegationDisabled(session, isAgentOwner(session)) ? ['agent'] : []),
+    ...(delegationDisabled(session, ownerIsAgent) ? ['agent'] : []),
   ];
   const allowTools = honoredSchemaAllowlist(session?.schemaAllowedTools, {
-    ownerIsAgent: isAgentOwner(session),
+    ownerIsAgent,
     agent: session?.agent || null,
   });
   const previousRules = _buildBaseRules({
     omitTools: [...deny, unusedModelEditToolName(previousModel)],
     allowTools,
+    ownerIsAgent,
     provider: previousProvider,
     model: previousModel,
   });
   const nextRules = _buildBaseRules({
     omitTools: [...deny, unusedModelEditToolName(session?.model)],
     allowTools,
+    ownerIsAgent,
     provider: session?.provider,
     model: session?.model,
   });
@@ -364,6 +378,7 @@ function applyRouteFields(session, route) {
     else delete session.routeFallbacks;
     delete session.routeFallbackIndex;
     delete session.routeFallbackFailures;
+    delete session.routeFallbackPrimary;
   }
   ensureCodexWireSessionId(session);
   if (Object.hasOwn(route, 'modelParameters')) {
@@ -428,6 +443,10 @@ function resetSessionForRouteChange(id, session, previousModel, previousProvider
   delete session._providerPrefixGuardState;
   // The new route resolves its own wire before its first request.
   session.wireRoute = null;
+  // A warm chain replays the previous route's request: stop it. Its recorded
+  // warm use names that route, so it never counts as fresh cache for the new
+  // one (compact-policy.mjs shouldCompactForExpiredAgentCache).
+  cancelCacheWarm(id);
   const prepared = _prepareResumeTools(session, session.preset || 'full');
   session.tools = prepared.tools;
   session.toolSpec = prepared.toolSpec;

package/src/runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs

@@ -21,6 +21,7 @@ import {
   describeShellToolsStartupState,
 } from '../../tools/builtin/runtime-capabilities.mjs';
 import { captureOriginalUserCwd } from '../../../../shared/user-cwd.mjs';
+import { sessionScratchDir } from '../../../../shared/session-scratch.mjs';
 import { delegationDisabled } from './session-tool-surface.mjs';
 import { contextAckMessage } from '../compact/user-message-kind.mjs';
 
@@ -31,7 +32,9 @@ import { contextAckMessage } from '../compact/user-message-kind.mjs';
 // it still get a location line via captureOriginalUserCwd(), which
 // resolves explicit session signals first and never leaks the daemon's
 // install root (user-cwd.mjs safe fallback chain).
-function buildShellEnvironmentContext(opts, ownerIsAgent, toolsForRouting) {
+function buildShellEnvironmentContext(opts, ownerIsAgent, toolsForRouting, sessionId = null) {
+  // Fixed per session id and data dir, so the line never changes across turns.
+  const scratchDir = sessionScratchDir(sessionId);
   const sessionCwdLine = opts.cwd || captureOriginalUserCwd();
   const wantsGitStartupLine = toolsForRouting.some((tool) => tool?.name === 'git');
   let cwdContextLine = '';
@@ -45,6 +48,9 @@ function buildShellEnvironmentContext(opts, ownerIsAgent, toolsForRouting) {
   return [
     cwdContextLine,
     `- Shell: ${shellName}. Use ${shellName} syntax unless the user specifies otherwise.`,
+    scratchDir
+      ? `- Scratch: ${scratchDir} — this session's scratch directory; TEMP, TMP and TMPDIR in shell commands point here.`
+      : '',
     // Which common tools the shell can run, measured where commands run
     // (login shell on POSIX, this process's PATH on Windows); see
     // runtime-capabilities.mjs. Recorded runs spent a round per session
@@ -84,7 +90,7 @@ export function buildWorkspacePromptContext(session, cwd) {
     ...(Array.isArray(session?.deferredToolCatalog) ? session.deferredToolCatalog : []),
   ];
   return {
-    environmentContext: buildShellEnvironmentContext({ cwd }, ownerIsAgent, tools),
+    environmentContext: buildShellEnvironmentContext({ cwd }, ownerIsAgent, tools, session?.id),
     // Agent mode never carries project instruction files.
     instructionFilesContext:
       session?.skipInstructionFiles === true || sessionModeOf(session) === AGENT_MODE
@@ -143,7 +149,7 @@ export function sessionRolePromptFields(identity, { ownerIsAgent, toolFreeRole,
   };
 }
 
-export function composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode }) {
+export function composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode, sessionId }) {
   const agentMode = sessionMode === AGENT_MODE;
   const { ownerIsAgent, resolvedAgent, skills } = surface;
   // A tool-free hidden role (a one-shot classifier or title writer) carries
@@ -156,6 +162,7 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
     : _buildBaseRules({
         omitTools: surface.ruleOmitTools,
         allowTools: surface.schemaAllowedTools,
+        ownerIsAgent,
         provider: providerName,
         model: modelName,
       });
@@ -177,12 +184,12 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
   const metaContext = leadOnly ? _buildLeadMetaContext({ includeOutputStyle: !agentMode }) : '';
   // Lead-only response language; closes the environment block so no English
   // system text (session/shell/git lines) follows it.
-  const languageContext = leadOnly ? _buildLeadLanguageContext() : '';
+  const languageContext = leadOnly ? _buildLeadLanguageContext({ includeOutputStyle: !agentMode }) : '';
   // Cwd, shell and repository facts only serve tool calls; a tool-free role
   // gets none, which also keeps its prompt identical across projects.
   const shellEnvironmentContext = toolFreeRole
     ? ''
-    : buildShellEnvironmentContext(opts, ownerIsAgent, surface.toolsForRouting);
+    : buildShellEnvironmentContext(opts, ownerIsAgent, surface.toolsForRouting, sessionId);
   // Persisted env tail: refreshSessionBp3Environment rebuilds the env block
   // as [session, bp3EnvironmentContext], so the language block must
   // already sit at the end of this string to stay last after a refresh.

package/src/runtime/agent/orchestrator/session/manager/session-record.mjs

@@ -36,7 +36,7 @@ export function normalizeDesktopSessionMetadata(value, cwd = null) {
   return null;
 }
 
-function initialCompactionConfig(compaction = {}, contextMeta = {}) {
+export function initialCompactionConfig(compaction = {}, contextMeta = {}) {
   return {
     auto: compaction?.auto !== false,
     model: compaction?.model || null,

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -3,7 +3,8 @@
 import { compareCodePoints } from '../../../../shared/code-point-order.mjs';
 import { getMcpTools } from '../../mcp/client.mjs';
 import { getInternalTools } from '../../internal-tools.mjs';
-import { BUILTIN_TOOLS } from '../../tools/builtin/builtin-tools.mjs';
+import { BUILTIN_TOOLS, bindAgentOwner, bindShellKind } from '../../tools/builtin/builtin-tools.mjs';
+import { resolveShellFor } from '../../tools/builtin/shell-runtime.mjs';
 import { PATCH_TOOL_DEFS } from '../../tools/patch-tool-defs.mjs';
 import { CODE_GRAPH_TOOL_DEFS } from '../../tools/code-graph-tool-defs.mjs';
 import { buildSkillToolDefs } from '../../context/collect.mjs';
@@ -50,7 +51,7 @@ const FILESYSTEM_TOOL_NAMES = new Set(['code_graph', 'find', 'glob', 'list', 'gr
 const READONLY_FS_TOOL_NAMES = new Set(['code_graph', 'find', 'glob', 'list', 'grep', 'read']);
 
 // Lead-only control tools: never part of a worker/sub-agent session surface.
-export const AGENT_WORKER_DENIED_TOOLS = Object.freeze(new Set(['agent', 'ask_user', 'session']));
+export const AGENT_WORKER_DENIED_TOOLS = Object.freeze(new Set(['agent', 'ask_user', 'handoff_user', 'session']));
 
 export function finalizeSessionToolList(
   tools,
@@ -69,7 +70,7 @@ export function finalizeSessionToolList(
   }
   if (ownerIsAgent) {
     out = out.filter((t) => !AGENT_WORKER_DENIED_TOOLS.has(String(t?.name || '').toLowerCase()));
-    out = orderSessionTools(out);
+    out = orderSessionTools(out.map(bindAgentOwner));
   }
   return out;
 }
@@ -101,7 +102,11 @@ export function resolveSessionTools(
   // time (loop.mjs), so the schema bytes stay bit-identical across roles /
   // cwds and the provider cache shard does not fragment.
   const skillTools = buildSkillToolDefs(skills, { ownerIsAgentSession });
-  return filterModelEditTools(_computeBaseTools(toolSpec, mcp, skillTools), modelName);
+  // The shell text follows the system shell the runtime actually resolves
+  // (Git Bash/WSL on Windows, pwsh on POSIX), before the edit-dialect rewrite.
+  const shellKind = resolveShellFor('default')?.shellType;
+  const base = _computeBaseTools(toolSpec, mcp, skillTools).map((tool) => bindShellKind(tool, shellKind));
+  return filterModelEditTools(base, modelName);
 }
 
 export function previewSessionTools(toolSpec, skills = [], options = {}) {

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint-context.mjs

@@ -93,6 +93,10 @@ export function captureTurnCheckpointContextState(session, messages, currentUser
     ),
     ...(kind === 'post_compact' ? { usageSnapshot: { ...usageSnapshot } } : {}),
     compaction: compactCheckpointState(session.compaction),
+    // Diagnostic only: the prefix fingerprint of the turn's last settled
+    // request (anthropic-prefix-trace.mjs), so the first request after a
+    // crash is still traced against it.
+    ...(session.providerPrefixBaseline ? { prefixBaseline: session.providerPrefixBaseline } : {}),
   };
 }