mixdog 1.3.5 → 1.4.1

package/src/runtime/agent/orchestrator/session/store-summary-reader.mjs

@@ -22,6 +22,7 @@ import {
   scanSessionFiles,
   scanSessionFilesAsync,
   stampedDerivation,
+  storedSessionCatalogRow,
 } from './store-summary-catalog.mjs';
 import { createStoredTranscriptCache, nextProjectionStamp } from './store-transcript-cache.mjs';
 import {
@@ -34,10 +35,21 @@ import { projectStoredTranscript } from './store-transcript-projection.mjs';
 import { dataDir } from './store-summary-locations.mjs';
 import { isStoredSessionId, workspaceSummary } from './store-summary-fields.mjs';
 import { readArchivedAgentResult } from './store-summary-archived-agent.mjs';
-import { compactionArchivePath, readCompactionArchivePage } from './compaction-archive.mjs';
+import {
+  compactionArchivePath,
+  compactionArchiveRange,
+  readCompactionArchivePage,
+  visitCompactionArchive,
+} from './compaction-archive.mjs';
+import { attachmentHistoryRows } from './stored-attachment-history.mjs';
 import { currentSessionCatalogDb, onSessionCatalogDbChange, sessionCatalogDb } from './catalog-db/index.mjs';
 import { decodeCatalogCursor, encodeCatalogCursor, isAfterCursor } from './catalog-db/schema.mjs';
-import { onSessionActivityChange } from '../../../shared/session-activity-signal.mjs';
+import {
+  onSessionActivityChange,
+  onSessionApprovalCardChange,
+  onSessionBotWorkChange,
+} from '../../../shared/session-activity-signal.mjs';
+import { inFlightSessionActivity } from './manager/runtime-state.mjs';
 import {
   readCanonicalSessionRecord as readCanonicalLifecycle,
   offerStrictSessionRecord,
@@ -59,6 +71,11 @@ export { storedAgentWorkerIndexPath } from './store-summary-locations.mjs';
 // the desktop service worker keeps its own for the deep-history prefetch.
 const storedTranscriptCache = createStoredTranscriptCache();
 
+// The attachment rows of whole stored conversations: the same cache mechanism
+// and byte budget as the windows above, as an instance of its own, which a
+// lookup can neither fill nor evict.
+const attachmentHistoryCache = createStoredTranscriptCache();
+
 /** Test seam: forget every cached projection. */
 export function clearStoredTranscriptCache() {
   storedTranscriptCache.clear();
@@ -106,7 +123,27 @@ onSessionCatalogDbChange(() => notifyCatalogListeners());
 // Runtime activity transitions (turn start/settle, task wait, background
 // hand-off/finish) change only the Agents pool projection: `agent-activity`
 // lets the reader refresh just that, at once.
-onSessionActivityChange(() => notifyCatalogListeners('agent-activity'));
+// A transition that starts or settles a turn also changes the catalog rows'
+// `working` / `agentWorking` overlay. The listing that a turn's final save
+// triggers can run before the turn leaves the runtime map, and nothing else
+// re-lists: a bot home (no title write after its turn) kept `working` — a
+// spinner and no completion dot — until its next file change.
+let catalogActivity = '';
+onSessionActivityChange(() => {
+  notifyCatalogListeners('agent-activity');
+  const { working, agentWorking } = inFlightSessionActivity();
+  const next = `${[...working].sort().join(',')}|${[...agentWorking].sort().join(',')}`;
+  if (next === catalogActivity) return;
+  catalogActivity = next;
+  notifyCatalogListeners('turn-activity');
+});
+// A session started or stopped waiting on the user's approval: its catalog row
+// (`awaitingApproval`) changed, though no store file did.
+onSessionApprovalCardChange(() => notifyCatalogListeners('approval'));
+// A bot started or stopped having a send in flight in a session: its catalog
+// row (`handedBy`) changed, though neither a file nor the set of working
+// sessions did (the work may already be running, or continue past the end).
+onSessionBotWorkChange(() => notifyCatalogListeners('bot-work'));
 
 /** `listener()` runs when a background pass finds a session file that changed
  *  without a directory or index change, i.e. when an ordinary listing would
@@ -232,6 +269,12 @@ export async function listStoredSessionSummaryPage(options = {}) {
   };
 }
 
+/** One session's catalog row by id, read off its record (not the paged
+ *  listing): null when the catalog would not list it. */
+export function readStoredSessionCatalogRow(id) {
+  return storedSessionCatalogRow(join(dataDir(), 'sessions'), String(id || '').trim());
+}
+
 /** Exact, fail-closed existence check for a durable session address.
  * Summary indexes and desktop metadata are presentation caches; neither may
  * make a missing sessions/<id>.json record addressable again. */
@@ -269,6 +312,7 @@ function storedSessionMetadata(sessionId, session) {
     ownerSessionId: session.ownerSessionId || session.parentSessionId || null,
     visibility: sessionVisibility(session),
     agentTag: session.agentTag || null,
+    title: session.title || null,
     cwd: session.cwd || '',
     ...(workspaceSummary(session.workspace) ? { workspace: workspaceSummary(session.workspace) } : {}),
     provider: session.provider || null,
@@ -405,6 +449,49 @@ async function produceStoredTranscript(text, stamp, context) {
   }
 }
 
+/** The rows of one session's whole stored conversation that name attachments
+ *  (see attachmentHistoryRows): its record's messages and every visible
+ *  segment of its compaction archive (a cleared or capped archive stays
+ *  excluded, as for a window). Read from the files alone, under the same
+ *  strict record authority as a transcript read, and cached by content
+ *  identity in a cache of its own: the transcript windows are untouched.
+ *  Null when the record is absent, unreadable or not this session's. */
+async function readStoredAttachmentHistory(sessionId, recordPath, archivePath) {
+  const recordStat = probePath(recordPath);
+  if (recordStat.state !== PROBE_PRESENT) return null;
+  const archive = probePath(archivePath);
+  const key = `${sessionId}|attachments`;
+  let complete = true;
+  const { value } = await attachmentHistoryCache.read({
+    key,
+    fingerprint: [archive.state, archive.mtimeMs, archive.ctimeMs, archive.size, archive.ino, archive.dev].join(':'),
+    fileStat: recordStat,
+    loadText: () => {
+      const body = readTextFile(recordPath);
+      return body.state === PROBE_PRESENT ? body.text : null;
+    },
+    produce: async (text) => {
+      const record = readTopLevelLifecycleRecord(text);
+      if (isLifecycleUnreadable(record) || record.id !== sessionId) return null;
+      const { restoreTranscriptItems } = await import('./transcript-restore/restore.mjs');
+      const items = [];
+      const range = compactionArchiveRange(record.doc);
+      // An archive that exists but could not be walked is a transient miss,
+      // not a state worth keeping.
+      const walked = range
+        ? await visitCompactionArchive(join(dataDir(), 'sessions'), sessionId, range, (segment) =>
+            items.push(...attachmentHistoryRows(segment))
+          )
+        : true;
+      complete = walked || archive.state !== PROBE_PRESENT;
+      items.push(...attachmentHistoryRows(restoreTranscriptItems(record.doc.messages, { sessionId })));
+      return { sessionId, items };
+    },
+  });
+  if (!complete) attachmentHistoryCache.forget(key);
+  return value ?? null;
+}
+
 /** Read exactly one persisted session for a visible desktop pane. This never
  * enumerates siblings. Normal reads stay independent of runtime ownership;
  * interrupted turns conditionally use the same durable reconnect recovery as
@@ -416,6 +503,8 @@ export async function readStoredSessionTranscript(id, options = {}) {
   // absent, unreadable, ambiguous or foreign record yields no transcript.
   const { recordPath, checkpointPath, archivePath } = storedTranscriptInputPaths(sessionId);
   if (options.metadataOnly === true) return readStoredSessionMetadata(recordPath, sessionId);
+  // The attachments the whole conversation names, apart from any window.
+  if (options.attachmentHistory === true) return readStoredAttachmentHistory(sessionId, recordPath, archivePath);
   // One page of the display-only compaction archive (the live head loader
   // pages it once a runtime's in-memory rows are exhausted).
   if (options.compactionArchive && typeof options.compactionArchive === 'object') {

package/src/runtime/agent/orchestrator/session/stored-attachment-history.mjs

@@ -0,0 +1,32 @@
+// The attachments a session's whole stored conversation names (its record and
+// its compaction archive), reduced to the metadata that says which rows name
+// which attachment. Whether an attachment id belongs to a session is decided
+// against this, not against a transcript window (a tail plus the pages paged
+// in), which no longer holds rows a compaction moved into the archive.
+
+const pick = (entry, keys) =>
+  Object.fromEntries(keys.filter((key) => entry?.[key] != null).map((key) => [key, entry[key]]));
+const picked = (list, keys) => (Array.isArray(list) ? list.map((entry) => pick(entry, keys)) : []);
+
+/** The rows of `items` that name attachments, reduced to the fields the
+ *  desktop reads to attribute an id to its row: the row kind (and a notice's
+ *  routine / room kind) and each attachment's id, name, type and size. No
+ *  text, tool output or other row content is kept. */
+export function attachmentHistoryRows(items) {
+  const rows = [];
+  for (const item of Array.isArray(items) ? items : []) {
+    const attachments = picked(item?.attachments, ['id', 'name', 'mimeType', 'kind', 'size']);
+    const images = picked(item?.images, ['attachmentRef', 'name', 'mimeType', 'bytes']);
+    const imageRefs = picked(item?.imageRefs, ['ref']);
+    if (!attachments.length && !images.length && !imageRefs.length) continue;
+    rows.push({
+      kind: item.kind,
+      ...(item.routine?.kind ? { routine: { kind: item.routine.kind } } : {}),
+      ...(item.room?.kind ? { room: { kind: item.room.kind } } : {}),
+      ...(attachments.length ? { attachments } : {}),
+      ...(images.length ? { images } : {}),
+      ...(imageRefs.length ? { imageRefs } : {}),
+    });
+  }
+  return rows;
+}

package/src/runtime/agent/orchestrator/session/thinking-binding.mjs

@@ -0,0 +1,108 @@
+// Thinking replay is bound to the request prefix that produced it.
+//
+// An Anthropic thinking block's signature records the conversation prefix it
+// was generated under: the top-level system prompt, the tool set, and every
+// earlier message. A request whose system or tools changed since then carries
+// blocks the API drops before the model sees them (unbilled, so the provider's
+// count no longer includes them) or, where the check is enforced, refuses with
+// a 400. The drop also takes every LATER thinking block, so a transcript that
+// keeps the stale blocks loses the reasoning of every turn that follows them.
+//
+// Where the runtime itself changes that prefix — a heir carrying a conversation
+// into a prompt built for it, a folded or migrated prompt — the stored thinking
+// can never be replayed again. It is stripped once, at that boundary, the
+// documented recovery: each turn keeps its text and tool calls, and the next
+// turns' thinking binds to the new prefix and is replayed normally. Leaving it
+// in place also kept charging every signature to the local context estimate,
+// which then ran far above what the provider actually counted.
+//
+// One round is never stripped: a trailing tool round whose next request still
+// continues it (the latest assistant turn called tools and no final reply
+// followed — an idle session can stop there after a provider error). Its
+// latest assistant turn must go back starting with its thinking, so removing
+// that thinking is a refused request too. When the prefix changed under such a
+// round, the round is ended explicitly instead (`rebindToChangedPrefix`).
+import { contextAckMessage } from './compact/user-message-kind.mjs';
+import { collectAssistantToolCallIds } from './context-tool-pairs.mjs';
+import { assistantMessageWithoutThinkingReplay } from './thinking-replay-recovery.mjs';
+
+/** The runtime turn that ends an open tool round: a context ack, so the
+ *  transcript never shows it and Compact never reads it as a reply. */
+function toolRoundClosure() {
+  const ack = contextAckMessage();
+  return { ...ack, meta: { ...ack.meta, synthetic: true } };
+}
+
+const callsTools = (message) =>
+  collectAssistantToolCallIds(message).length > 0 ||
+  (Array.isArray(message?.providerReplay?.items) &&
+    message.providerReplay.items.some((item) => item?.type === 'tool_use'));
+
+/**
+ * Index where the trailing open tool round starts (the assistant/tool run that
+ * ends with the latest assistant turn's results; later user or notification
+ * input may follow), or -1 when the latest assistant turn is a final reply.
+ * Read from the persisted transcript alone.
+ */
+export function openToolRoundStart(messages) {
+  if (!Array.isArray(messages)) return -1;
+  const latest = messages.findLastIndex((message) => message?.role === 'assistant');
+  if (latest < 0 || !callsTools(messages[latest])) return -1;
+  let start = latest;
+  while (start > 0 && ['assistant', 'tool'].includes(messages[start - 1]?.role)) start -= 1;
+  return start;
+}
+
+/** What the next request sends ahead of the conversation: the system blocks and tools. */
+export function requestPrefixIdentity(session) {
+  return JSON.stringify([
+    (Array.isArray(session?.messages) ? session.messages : [])
+      .filter((message) => message?.role === 'system')
+      .map((message) => message.content),
+    session?.tools,
+  ]);
+}
+
+/**
+ * `messages` without Anthropic thinking replay (thinking / redacted_thinking
+ * blocks, wherever an assistant turn stores them); text and tool calls stay.
+ * The trailing open tool round keeps its thinking: everything stripped is a
+ * leading run, which leaves the round's own blocks valid.
+ * Replaces changed messages, never mutates; the same array when none changed.
+ */
+export function withoutThinkingReplay(messages) {
+  if (!Array.isArray(messages)) return messages;
+  const open = openToolRoundStart(messages);
+  const end = open < 0 ? messages.length : open;
+  let changed = false;
+  const out = messages.map((message, index) => {
+    const stripped = index < end ? assistantMessageWithoutThinkingReplay(message) : null;
+    if (!stripped) return message;
+    changed = true;
+    return stripped;
+  });
+  return changed ? out : messages;
+}
+
+/**
+ * `messages` for a request prefix that changed under them: no thinking replay
+ * at all. An open tool round that carries thinking can neither keep it (bound
+ * to the old prefix) nor lose it (its continuation must start with it), so it
+ * is ended first by a runtime turn right after its last tool result, ahead of
+ * any later input (a task notification stays pending after it); the next
+ * request then starts a new turn. Never mutates; the same array when nothing
+ * changed.
+ */
+export function rebindToChangedPrefix(messages) {
+  if (!Array.isArray(messages)) return messages;
+  const open = openToolRoundStart(messages);
+  if (open < 0) return withoutThinkingReplay(messages);
+  let end = messages.findLastIndex((message) => message?.role === 'assistant') + 1;
+  while (messages[end]?.role === 'tool') end += 1;
+  const roundThinks = messages
+    .slice(open, end)
+    .some((message) => assistantMessageWithoutThinkingReplay(message) !== null);
+  return withoutThinkingReplay(
+    roundThinks ? [...messages.slice(0, end), toolRoundClosure(), ...messages.slice(end)] : messages
+  );
+}

package/src/runtime/agent/orchestrator/session/tool-batch/pre-dispatch.mjs

@@ -103,8 +103,8 @@ function crossTurnStub(batch, call, ctSig) {
 // (which spans ONE assistant turn): when the model re-issues an IDENTICAL
 // normalized call that has already failed repeatFailLimit times in a row
 // across iterations, stop re-executing — the result will not change, and
-// each retry burns a full LLM round-trip with no iteration cap to end it. The
-// call stays unresolved; the guard only skips re-execution.
+// each retry burns a full LLM round-trip. The call stays unresolved; the
+// guard only skips re-execution.
 function repeatFailureSkip(batch, call, sigs) {
   const { sessionRef, repeatFailLimit } = batch;
   const rfg = sessionRef?._repeatFailGuard;

package/src/runtime/agent/orchestrator/session/tool-batch/record-outcome.mjs

@@ -4,6 +4,7 @@
 // consumes.
 import { resolve as resolvePath, isAbsolute } from 'node:path';
 import { normalizeToolEnvelope } from '../tool-envelope.mjs';
+import { effectiveToolCwd } from '../../tools/builtin/bash-tool/shell-cwd.mjs';
 import {
   invalidatePathForSession,
   clearReadDedupSession,
@@ -85,7 +86,7 @@ async function fireToolFailureHook(batch, call, result) {
     await hook({
       name: call.name,
       args: call.arguments,
-      cwd: batch.cwd,
+      cwd: effectiveToolCwd(call.name, call.arguments, batch.cwd),
       sessionId: batch.sessionId,
       toolCallId: call.id,
       result: typeof result === 'string' ? result : String(result ?? ''),

package/src/runtime/agent/orchestrator/session/transcript-restore/restore.mjs

@@ -44,6 +44,7 @@ import {
 } from '../../../../shared/transcript-metadata.mjs';
 import { routineTriggerField } from '../../../../shared/routine-trigger.mjs';
 import { isImportedMessage } from '../imported-message.mjs';
+import { toolRunLine } from '../conversation-import/turns.mjs';
 import { isContextAckMessage } from '../compact/user-message-kind.mjs';
 import { isRoutineResultMessage, routineResultNotice } from '../routine-result.mjs';
 import { heldRequestNotice, isHeldRequestMessage } from '../human-gate/held-message.mjs';
@@ -64,6 +65,20 @@ function restoredFailureFields(value) {
   };
 }
 
+/** Whether `message` was posted into the thread outside any turn: it says so
+ *  (`transcript.posted`, stamped by agent-home-delivery.mjs), or it is a row
+ *  stored before that marker existed. Those carry the id agent-home-delivery
+ *  mints for every posted row (`messageIdOf`: `routine_<runId>`) and are not
+ *  prompts: an agent's own message (assistant role) or a result/held-request
+ *  notice (stored under the user role, but not a prompt). The `routine_` scheme
+ *  alone is not enough: routine-home-turn.mjs:144 gives the prompt of a routine
+ *  fire (user role) the same prefix, and that prompt opens a real turn. */
+function isPostedMessage(message, transcript) {
+  if (transcript.posted === true) return true;
+  if (typeof transcript.messageId !== 'string' || !transcript.messageId.startsWith('routine_')) return false;
+  return message?.role !== 'user' || isRoutineResultMessage(message) || isHeldRequestMessage(message);
+}
+
 function restoredTranscriptMetadata(message) {
   const value = message?.meta?.transcript;
   if (!value || typeof value !== 'object') return {};
@@ -87,6 +102,8 @@ function restoredTranscriptMetadata(message) {
     // messages back to these rows.
     ...(typeof value.messageId === 'string' && value.messageId ? { messageId: value.messageId } : {}),
     ...(Number.isFinite(Number(value.at)) ? { at: Number(value.at) } : {}),
+    // Delivered into the thread outside any turn (agent-home-delivery.mjs).
+    ...(isPostedMessage(message, value) ? { posted: true } : {}),
     ...transcriptRouteMetadataFields(value),
     ...(typeof value.sender === 'string' && value.sender ? { sender: value.sender } : {}),
     ...(typeof value.device === 'string' && value.device ? { device: value.device } : {}),
@@ -124,7 +141,64 @@ function restoredContentText(message) {
   return typeof message?.content === 'string' ? message.content : toolResultText(message?.content);
 }
 
+// The runs of tool use an imported assistant message recorded (conversation-import
+// turns.mjs), kept only where the text still holds exactly their canonical line.
+function importedToolRuns(message) {
+  const runs = message?.meta?.importedToolRuns;
+  if (!isImportedMessage(message) || typeof message.content !== 'string' || !Array.isArray(runs)) return [];
+  let cursor = 0;
+  return runs.filter((run) => {
+    const valid =
+      Number.isInteger(run?.start) &&
+      Number.isInteger(run?.end) &&
+      run.start >= cursor &&
+      run.end > run.start &&
+      run.end <= message.content.length &&
+      Array.isArray(run.tools) &&
+      run.tools.length > 0 &&
+      run.tools.every((tool) => typeof tool?.name === 'string' && Number.isInteger(tool.count) && tool.count > 0) &&
+      message.content.slice(run.start, run.end) === toolRunLine(run.tools);
+    if (valid) cursor = run.end;
+    return valid;
+  });
+}
+
+// An imported reply with tool use: its text around each run as assistant rows,
+// each run as tool rows (one per tool, counted). The calls' results were never
+// imported; the `imported` mark lets the row say so.
+function restoredImportedAssistantItems(message, runs, nextId) {
+  const { completion: _completion, ...metadata } = restoredTranscriptMetadata(message);
+  const at = Number(message?.meta?.transcript?.at);
+  const items = [];
+  const pushText = (raw) => {
+    const text = raw.trim();
+    if (text) items.push({ kind: 'assistant', id: nextId(), text, ...metadata });
+  };
+  let cursor = 0;
+  for (const run of runs) {
+    pushText(message.content.slice(cursor, run.start));
+    for (const { name, count } of run.tools) {
+      if (isTranscriptHiddenControlToolName(name)) continue;
+      items.push({
+        kind: 'tool',
+        id: nextId(),
+        name,
+        imported: true,
+        expanded: false,
+        count,
+        completedCount: count,
+        ...(Number.isFinite(at) ? { at, startedAt: at, completedAt: at } : {}),
+      });
+    }
+    cursor = run.end;
+  }
+  pushText(message.content.slice(cursor));
+  return items;
+}
+
 function restoredAssistantTranscriptItems(message, nextId) {
+  const runs = importedToolRuns(message);
+  if (runs.length) return restoredImportedAssistantItems(message, runs, nextId);
   const text = restoredContentText(message).trim();
   if (!text) return [];
   const { completion, ...metadata } = restoredTranscriptMetadata(message);
@@ -323,7 +397,7 @@ function mergeRestoredToolItems(items) {
     // Result-dependent hiding (built-in skill loads) resolves here, after
     // every role:'tool' result has been attached to its restored call.
     if (item?.kind === 'tool' && isTranscriptHiddenToolItem(item)) continue;
-    const mergeable = item?.kind === 'tool' && item.aggregate !== true;
+    const mergeable = item?.kind === 'tool' && item.aggregate !== true && item.imported !== true;
     if (!mergeable) {
       flushRun();
       merged.push(item);
@@ -363,7 +437,8 @@ function restoredMessageItemUpperBound(message) {
   const calls = restoredMessageToolCalls(message);
   const content = message?.content;
   const hasContent = typeof content === 'string' ? content.length > 0 : Array.isArray(content) && content.length > 0;
-  return Number(hasContent) + completionCount + calls.length + boundaries;
+  const importedRows = importedToolRuns(message).reduce((total, run) => total + run.tools.length + 1, 0);
+  return Number(hasContent) + completionCount + calls.length + importedRows + boundaries;
 }
 
 // One restored tool card for a parsed notification/completion envelope.
@@ -400,7 +475,7 @@ function restoredUserTranscriptItems(message, nextId, userText) {
   // A schedule's result in its owner's home thread: a notice row.
   // A held request of an unattended run (human-gate/held-message.mjs) likewise.
   if (isRoutineResultMessage(message) || isHeldRequestMessage(message)) {
-    const { messageId, at } = restoredTranscriptMetadata(message);
+    const { messageId, at, posted } = restoredTranscriptMetadata(message);
     return [
       {
         kind: 'notice',
@@ -408,6 +483,7 @@ function restoredUserTranscriptItems(message, nextId, userText) {
         ...(isHeldRequestMessage(message) ? heldRequestNotice(message) : routineResultNotice(message)),
         ...(messageId ? { messageId } : {}),
         ...(at ? { at } : {}),
+        ...(posted ? { posted } : {}),
       },
     ];
   }

package/src/runtime/agent/orchestrator/session/transcript-restore/tool-result-status.mjs

@@ -13,6 +13,7 @@ import { formatAggregateDetail, summarizeToolResult, toolLoadingTargets } from '
 import { normalizeToolName } from '../../../../shared/tool-primitives.mjs';
 import { gitResultError, gitResultExitCode } from '../../../../shared/tool-card-model/git-result.mjs';
 import { readRowsForDisplay } from '../../../../shared/read-row-numbers.mjs';
+import { visualizeOwnerMetaSessionId } from '../../../../visualize-bridge/tool-meta.mjs';
 
 const CANCELLED_RESULT_STATUS_LINE = '[status: cancelled]';
 
@@ -292,15 +293,16 @@ export function assignUiDiffFromMessage(target, source) {
 }
 
 /** Structured side channel a tool result may carry next to its text (the
- * Computer Use capability refusal): a stable code plus the capability names.
- * Anything else is dropped so stored history stays small and predictable. */
-export function toolMetaFromMessage(source) {
+ * Computer Use capability refusal): a stable code plus the capability names,
+ * and the owner conversation of a `visualize` call run for another session's
+ * work (visualize-bridge/tool-meta.mjs). Anything else is dropped so stored
+ * history stays small and predictable. */
+function toolMetaFromMessage(source) {
   const meta = source?.toolMeta ?? source?.content?.toolMeta;
   if (!meta || typeof meta !== 'object' || typeof meta.code !== 'string' || !meta.code) return undefined;
-  const missing = Array.isArray(meta.missing)
-    ? meta.missing.filter((name) => typeof name === 'string' && name)
-    : [];
-  return { code: meta.code, missing };
+  const missing = Array.isArray(meta.missing) ? meta.missing.filter((name) => typeof name === 'string' && name) : [];
+  const ownerSessionId = visualizeOwnerMetaSessionId(meta.ownerSessionId);
+  return { code: meta.code, missing, ...(ownerSessionId ? { ownerSessionId } : {}) };
 }
 
 export function toolMetaPatchFromMessage(source) {

package/src/runtime/agent/orchestrator/session/transcript-restore/tool-result-text.mjs

@@ -132,8 +132,8 @@ export function toolGroupedDisplayFallback(resultText, text, rawText) {
   return resultText;
 }
 
-export function toolErrorDisplay(value, surface = 'tool') {
-  const text = presentErrorText(value, { surface });
+export function toolErrorDisplay(value, surface = 'tool', { providerLabel } = {}) {
+  const text = presentErrorText(value, { surface, providerLabel });
   if (
     /^(?:Search failed|Fetch failed|No first response|No progress|Cancelled|The .+ went stale|(?:Web search agent|Agent|Tool|Request) (?:stopped|was cancelled))/i.test(
       text

package/src/runtime/agent/orchestrator/session/turn-failure.mjs

@@ -3,6 +3,7 @@
 // session shows the same failure, reason and quota stop as the live one.
 import { errText } from '../../../shared/err-text.mjs';
 import { safeErrorDetails } from '../../../shared/error-presentation.mjs';
+import { providerDisplayName } from '../../../shared/provider-display-name.mjs';
 import { providerErrorKind } from '../providers/provider-error-kind.mjs';
 import { toolErrorDisplay } from './transcript-restore/tool-result-text.mjs';
 
@@ -39,7 +40,10 @@ export function turnFailureRecord(error, route = {}) {
     providerKind,
     errorKind,
     quota,
-    detail: toolErrorDisplay(error, 'turn').replace(/^Error:\s*/i, ''),
+    // The provider is named from the turn's own route, never from the error.
+    detail: toolErrorDisplay(error, 'turn', {
+      providerLabel: route.provider ? providerDisplayName(route.provider) : undefined,
+    }).replace(/^Error:\s*/i, ''),
     errorDetails: safeErrorDetails(errText(error)),
   };
 }

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -259,6 +259,29 @@ export const PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS = resolveTimeoutMs(
   { minMs: 10_000, maxMs: Math.max(10_000, STALL_ABORT_MS - STALL_TICK_MS) }
 );
 
+// First-OUTPUT window of one provider stream: from the stream opening until
+// the model's first semantic output (reasoning, text or a tool call). Server
+// metadata and keepalives (response.created / in_progress, an empty reasoning
+// or message item, a role-only chunk, pings) neither end this phase nor start
+// the semantic-idle clock, so a reasoning model may think silently past the
+// idle window (issue #244: 4–6 min on a large post-tool-result prompt). The
+// window sits one tick under the stall abort — the same ceiling the semantic
+// idle uses — so the provider still fails (and may retry or fall back) before
+// the agent watchdog's first-output deadline (600s default), and it is never
+// shorter than the idle window it replaces. Not separately tunable: it
+// follows STALL_TIMEOUT_S.
+export const PROVIDER_FIRST_OUTPUT_TIMEOUT_MS = Math.max(
+  PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+  PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS,
+  STALL_ABORT_MS - STALL_TICK_MS
+);
+
+/** The first-output window of a stream whose semantic idle is `idleMs`: a
+ *  longer idle window (a provider profile) is never cut short by it. */
+export function providerFirstOutputTimeoutMs(idleMs) {
+  return Math.max(idleMs, PROVIDER_FIRST_OUTPUT_TIMEOUT_MS);
+}
+
 /**
  * The longest a provider's own first-byte handling may legitimately run
  * before it gives up, over every attempt it permits: `windowMs(n)` is the wait

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -780,10 +780,13 @@ function guardRead(a) {
 }
 
 function guardShell(a) {
-  const allowed = new Set(['command', 'timeout_ms', 'wait_ms', 'background']);
+  const allowed = new Set(['command', 'cwd', 'timeout_ms', 'wait_ms', 'background']);
   const unsupported = Object.keys(a).find((key) => !allowed.has(key));
   if (unsupported) {
-    return `Error: shell arg "${unsupported}" is unsupported; use only command, timeout_ms, wait_ms, and background`;
+    return `Error: shell arg "${unsupported}" is unsupported; use only command, cwd, timeout_ms, wait_ms, and background`;
+  }
+  if (hasOwn(a, 'cwd') && (typeof a.cwd !== 'string' || a.cwd.trim().length === 0)) {
+    return `Error: shell arg "cwd" must be a non-empty string (got ${describeType(a.cwd)})`;
   }
   if (hasOwn(a, 'background') && typeof a.background !== 'boolean') {
     return `Error: shell arg "background" must be a boolean (got ${describeType(a.background)})`;

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/backgrounded-result.mjs

@@ -52,7 +52,17 @@ function registerPromotedTask({ result, command, cwd, options, startedAtMs }) {
 // running, now promoted as a tracked shell-job. Surface the task_id + partial
 // output for manual task control instead of keeping the tool call open until
 // the hard timeout.
-export function renderBackgroundedResult({ result, command, cwd, options, startedAtMs, teePlan, stdout, stderr }) {
+export function renderBackgroundedResult({
+  result,
+  command,
+  cwd,
+  options,
+  startedAtMs,
+  teePlan,
+  stdout,
+  stderr,
+  notes = '',
+}) {
   let task = null;
   if (result.jobId) {
     task = registerPromotedTask({ result, command, cwd, options, startedAtMs });
@@ -91,6 +101,7 @@ export function renderBackgroundedResult({ result, command, cwd, options, starte
       )
     : renderBackgroundPartialOutput(stdout, stderr);
   const lines = _backgroundResultLines({
+    warning: notes,
     taskBlock,
     message: result.backgroundMessage || DEFAULT_BACKGROUND_MESSAGE,
     partialOutput,

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/invocation-plan.mjs

@@ -28,9 +28,9 @@ function prefixPowerShellUtf8(command) {
 // UTF-8 prefix (+ optional filter-tee rescue), or a POSIX bash/zsh snapshot
 // wrapper delivered through the environment. Returns `{ failure }` when the
 // snapshot wrapper cannot be built.
-export async function planShellInvocation({ command, resolvedSpec, cwd }) {
+export async function planShellInvocation({ command, resolvedSpec, cwd, sessionId = null }) {
   const { shell, shellArg, shellArgs, shellType } = resolvedSpec;
-  const spawnEnv = buildShellSpawnEnv(cwd);
+  const spawnEnv = buildShellSpawnEnv(cwd, process.env, sessionId);
   const plan = {
     execShell: shell,
     execShellArg: shellArg,