mixdog 1.3.5 → 1.4.1

package/src/runtime/shared/llm/cost.mjs

@@ -100,7 +100,11 @@ export function priceUsage(args) {
   // A provider-billed figure for a media request (e.g. xAI cost_in_usd_ticks)
   // is the price, with or without a catalog row.
   const media = args.media || null;
-  if (typeof media?.reportedCostUsd === 'number' && Number.isFinite(media.reportedCostUsd) && media.reportedCostUsd >= 0)
+  if (
+    typeof media?.reportedCostUsd === 'number' &&
+    Number.isFinite(media.reportedCostUsd) &&
+    media.reportedCostUsd >= 0
+  )
     return {
       input,
       costUsd: Number(media.reportedCostUsd.toFixed(6)),

package/src/runtime/shared/llm/usage-rollup.mjs

@@ -22,7 +22,7 @@ export function usageRollupDayKey(ts) {
 // background runners. An unknown source counts as conversation on purpose: a
 // new runner showing up in the user's totals is visible and correctable, while
 // silently dropping the user's own turns is neither.
-const BACKGROUND_SOURCES = new Set(['memory-cycle', 'schedule', 'webhook', 'native-web-search']);
+const BACKGROUND_SOURCES = new Set(['memory-cycle', 'schedule', 'webhook', 'native-web-search', 'cache-warm']);
 
 export function isConversationUsageSource(sourceType) {
   const id = typeof sourceType === 'string' ? sourceType.trim().toLowerCase() : '';

package/src/runtime/shared/loopback-listener.mjs

@@ -1,3 +1,5 @@
+import { FETCH_BLOCKED_PORTS, FETCH_SAFE_ATTEMPTS } from './fetch-safe-listen.mjs';
+
 // One loopback listener owns each bind attempt, its event handlers, and stop.
 export function createLoopbackListener({
   server,
@@ -24,7 +26,15 @@ export function createLoopbackListener({
 
     const { promise, resolve, reject } = Promise.withResolvers();
     const controller = new AbortController();
-    const attempt = { promise, reject, controller, port: basePort, bound: false, detach };
+    const attempt = {
+      promise,
+      reject,
+      controller,
+      port: basePort,
+      bound: false,
+      blockedRetries: FETCH_SAFE_ATTEMPTS,
+      detach,
+    };
     current = attempt;
 
     function detach() {
@@ -35,6 +45,19 @@ export function createLoopbackListener({
     function onListening() {
       if (current !== attempt) return;
       const boundPort = server.address().port;
+      // An OS-assigned port can be one fetch clients refuse ("bad port"):
+      // close it and take another, a bounded number of times.
+      if (attempt.port === 0 && FETCH_BLOCKED_PORTS.has(boundPort)) {
+        const exhausted = attempt.blockedRetries <= 0;
+        attempt.blockedRetries -= 1;
+        server.close(() => {
+          if (current !== attempt) return;
+          if (exhausted) onError(new Error('no fetch-safe loopback port was assigned'));
+          else listen();
+        });
+        return;
+      }
+      server.off('listening', onListening);
       attempt.bound = true;
       reportListening(boundPort);
       resolve(boundPort);
@@ -67,7 +90,7 @@ export function createLoopbackListener({
     }
 
     server.on('error', onError);
-    server.once('listening', onListening);
+    server.on('listening', onListening);
     listen();
     return promise;
   }

package/src/runtime/shared/mixy-presence.mjs

@@ -0,0 +1,22 @@
+// Whether the representative bot (Mixy) exists: the one rule. The desktop
+// answers from it (getLeadStatus `exists`, main/mixy-first.ts), and so do
+// Mixy's routines (routine-owner.mjs `no-mixy`), her heartbeat and the
+// heartbeat reports queued for her chat (mixy-heartbeat.mjs,
+// agent-home-delivery.mjs), all through routine-owner.mjs readMixyExists.
+//
+// `created: false` (Mixy's agent.json) is no. Otherwise she exists on
+// evidence that the user made or uses her:
+//   - a name (the 대표 에이전트 dialog always sets one; her profile can);
+//   - a message the user wrote in her thread (`homeChatted`,
+//     agent-kind.mjs homeThreadEvidence);
+//   - a schedule or webhook she owns (`ownsRoutines`): the user set it up,
+//     and since v1.3.0 it ran for her whether or not she was named.
+// Without any of them she does not exist: v1.3.0's untouched automatic
+// `{"created": true}`, and an undecided profile (`created` null). Her own
+// posts in her thread, heartbeat reports and routine results, are no
+// evidence. `ownsRoutines` is read only when nothing else decides.
+export async function mixyExists(status, ownsRoutines) {
+  if (status?.created === false) return false;
+  if (String(status?.name ?? '').trim() || status?.homeChatted === true) return true;
+  return (await ownsRoutines()) === true;
+}

package/src/runtime/shared/model-route-chain.d.mts

@@ -1,8 +1,13 @@
 export function canonicalRouteProvider(value: unknown): string;
 export function routeChain(route: Record<string, unknown>): Record<string, unknown>[];
-export function validateRouteChainProviders(routes: Record<string, unknown>[]): void;
+export function executionFallbacks(route: Record<string, unknown> | null | undefined): Record<string, unknown>[];
+export function validateRouteChainProviders(
+  routes: Record<string, unknown>[],
+  options?: { allowDuplicates?: boolean }
+): void;
 export function normalizeRouteChain(
   route: Record<string, unknown>,
   normalizeLeaf: (route: Record<string, unknown>, fallback: Record<string, unknown>) => Record<string, unknown> | null,
-  fallback?: Record<string, unknown>
+  fallback?: Record<string, unknown>,
+  options?: { strict?: boolean }
 ): Record<string, unknown> | null;

package/src/runtime/shared/model-route-chain.mjs

@@ -22,18 +22,36 @@ export function routeChain(route) {
   return [primary, ...fallbacks];
 }
 
-export function validateRouteChainProviders(routes) {
+/** The fallbacks a chain runs: those on a provider not already used by the
+ *  primary or an earlier fallback. The stored list is never changed; a fallback
+ *  on the main model's own provider (left there by a later main-model change)
+ *  is simply inactive. */
+export function executionFallbacks(route) {
+  const [primary, ...fallbacks] = routeChain(route);
+  if (!primary) return [];
+  const seen = new Set([canonicalRouteProvider(primary.provider)]);
+  return fallbacks.filter((entry) => {
+    const provider = canonicalRouteProvider(entry.provider);
+    if (seen.has(provider)) return false;
+    seen.add(provider);
+    return true;
+  });
+}
+
+/** `allowDuplicates` accepts a stored chain whose fallbacks repeat a provider
+ *  (see executionFallbacks); an explicit save validates without it. */
+export function validateRouteChainProviders(routes, { allowDuplicates = false } = {}) {
   const providers = new Set();
   for (const route of routes) {
     const provider = canonicalRouteProvider(route.provider);
     if (!provider || !String(route.model || '').trim()) throw new Error('route requires provider and model');
-    if (providers.has(provider)) throw new Error(`duplicate route provider "${provider}"`);
+    if (!allowDuplicates && providers.has(provider)) throw new Error(`duplicate route provider "${provider}"`);
     if (providers.size && provider === 'default') throw new Error('follow Main is only allowed as the primary route');
     providers.add(provider);
   }
 }
 
-export function normalizeRouteChain(route, normalizeLeaf, fallback = {}) {
+export function normalizeRouteChain(route, normalizeLeaf, fallback = {}, { strict = true } = {}) {
   const raw = routeChain({ ...fallback, ...route });
   const primary = normalizeLeaf(route, fallback);
   if (!primary) return null;
@@ -42,7 +60,7 @@ export function normalizeRouteChain(route, normalizeLeaf, fallback = {}) {
     if (!normalized) throw new Error('fallback route requires provider and model');
     return { ...normalized, provider: canonicalRouteProvider(normalized.provider) };
   });
-  validateRouteChainProviders(routes);
+  validateRouteChainProviders(routes, { allowDuplicates: !strict });
   const [first, ...rest] = routes;
   return rest.length ? { ...first, fallbacks: rest } : first;
 }

package/src/runtime/shared/open-url.mjs

@@ -2,6 +2,16 @@ import { spawn } from 'node:child_process';
 import { isWSL } from './wsl.mjs';
 import { detachedSpawnOpts } from './spawn-flags.mjs';
 
+/**
+ * Whether a browser can plausibly open on this machine: not inside an SSH
+ * session, and on non-WSL Linux a DISPLAY or WAYLAND_DISPLAY exists.
+ */
+export function canOpenBrowser(env = process.env, platform = process.platform, wsl = isWSL()) {
+  if (env.SSH_TTY || env.SSH_CONNECTION) return false;
+  if (platform !== 'linux' || wsl) return true;
+  return Boolean(env.DISPLAY || env.WAYLAND_DISPLAY);
+}
+
 /**
  * Open a URL in the user's default browser. Best-effort and non-blocking.
  * Callers also print the URL, so opener failure should never block OAuth.

package/src/runtime/shared/orchestration.d.mts

@@ -0,0 +1,2 @@
+export type OrchestrationMode = 'none' | 'focused' | 'balanced' | 'swarm';
+export function configuredOrchestrationMode(config: unknown): OrchestrationMode;

package/src/runtime/shared/pg-schema-db.mjs

@@ -1,21 +1,32 @@
-/** Lazy per-dataDir PG handle: one in-flight init, bootstrap lock, retry after failure. */
+import { createSharedAbortable } from './abort-race.mjs';
+
+/** Lazy per-dataDir PG handle: one in-flight init, bootstrap lock, retry after
+ *  failure. `signal` withdraws a caller; the init (a PG runtime install
+ *  included) is cancelled once every caller has (createSharedAbortable). */
 export function createPgSchemaDb({ schema, ddl, defaultDataDir, ensurePg, withLock }) {
   const ready = new Map();
-  return async function getDb(dataDir = defaultDataDir()) {
-    if (ready.has(dataDir)) return ready.get(dataDir);
-    const p = (async () => {
-      const { db, pool } = await ensurePg(dataDir, { schema });
-      // Serialize CREATE TABLE across concurrent first-boot processes on the
-      // same cluster-global advisory lock the adapter uses for schema bootstrap.
-      await withLock(pool, () => db.exec(ddl));
-      return db;
-    })();
-    ready.set(dataDir, p);
-    try {
-      return await p;
-    } catch (err) {
-      ready.delete(dataDir); // let the next call retry after a transient failure
-      throw err;
+  return function getDb(dataDir = defaultDataDir(), { signal = null } = {}) {
+    let shared = ready.get(dataDir);
+    if (!shared) {
+      const entry = createSharedAbortable(
+        async (initSignal) => {
+          const { db, pool } = await ensurePg(dataDir, { schema, signal: initSignal });
+          initSignal.throwIfAborted();
+          // Serialize CREATE TABLE across concurrent first-boot processes on the
+          // same cluster-global advisory lock the adapter uses for schema bootstrap.
+          await withLock(pool, () => db.exec(ddl));
+          return db;
+        },
+        {
+          // Let the next call retry after a transient failure or a cancellation.
+          onSettled: (failed) => {
+            if (failed && ready.get(dataDir) === entry) ready.delete(dataDir);
+          },
+        }
+      );
+      shared = entry;
+      ready.set(dataDir, entry);
     }
+    return shared.join(signal);
   };
 }

package/src/runtime/shared/profile-config.cjs

@@ -5,7 +5,7 @@
 const PROFILE_LANGUAGES = Object.freeze([
   { id: 'system', label: 'System (locale)', prompt: null },
   { id: 'en', label: 'English', prompt: 'English' },
-  { id: 'ko', label: 'Korean', prompt: 'Korean' },
+  { id: 'ko', label: '한국어', prompt: 'Korean' },
   { id: 'ja', label: '日本語', prompt: 'Japanese (日本語)' },
   { id: 'zh-Hans', label: '中文（简体）', prompt: 'Simplified Chinese (简体中文)' },
   { id: 'zh-Hant', label: '中文（繁體）', prompt: 'Traditional Chinese (繁體中文)' },

package/src/runtime/shared/prompt-origin.d.mts

@@ -0,0 +1,4 @@
+export declare const PROMPT_ORIGIN_CHANNEL: 'channel';
+export declare const PROMPT_ORIGIN_AGENT_REPORT: 'agent-report';
+export type PromptOrigin = typeof PROMPT_ORIGIN_CHANNEL | typeof PROMPT_ORIGIN_AGENT_REPORT;
+export declare function promptOriginOf(value: unknown): PromptOrigin | null;

package/src/runtime/shared/prompt-origin.mjs

@@ -0,0 +1,21 @@
+// A submitted prompt's provenance, carried apart from its presentation mode
+// (`origin` on the submit options, the queue entry, the turn input and the
+// stored user message's meta). Dependency-free: the desktop main process
+// stamps it too (agent-room-turn.ts).
+
+/** Real external activity presented as a task notification: an inbound
+ *  channel message (Discord, Telegram, webhook event rules …). */
+export const PROMPT_ORIGIN_CHANNEL = 'channel';
+
+/** A turn the runtime starts because another bot or agent reported back: a
+ *  bot-home wake (daemon.mjs `wake`) or a group-room member's relay of its
+ *  reported work (agent-room-turn.ts). System-caused, though presented as a
+ *  prompt. */
+export const PROMPT_ORIGIN_AGENT_REPORT = 'agent-report';
+
+const KNOWN_ORIGINS = new Set([PROMPT_ORIGIN_CHANNEL, PROMPT_ORIGIN_AGENT_REPORT]);
+
+/** `value` when it is a known provenance, else null. */
+export function promptOriginOf(value) {
+  return KNOWN_ORIGINS.has(value) ? value : null;
+}

package/src/runtime/shared/provider-accounts.mjs

@@ -15,7 +15,7 @@ export const ACCOUNT_PROVIDERS = Object.freeze([
   'antigravity-oauth',
   'opencode-go-oauth',
 ]);
-const MAX_ACCOUNTS = 20;
+export const MAX_ACCOUNTS = 20;
 // `dataDir` defaults to this process's data dir; an isolated runtime passes
 // the host's dir explicitly while its own MIXDOG_DATA_DIR points elsewhere.
 const file = (dataDir = resolvePluginData()) => join(dataDir, 'provider-accounts.json');
@@ -597,6 +597,12 @@ export function providerAccountExhaustedForModelOnly(row, now = Date.now(), mode
 // enough that yesterday's number cannot send every fallback to one account.
 const USAGE_EVIDENCE_MAX_AGE_MS = 60 * 60_000;
 
+/** Whether a usage reading taken at `checkedAt` may still steer a decision. */
+export function quotaReadingFresh(checkedAt, now = Date.now()) {
+  const at = Number(checkedAt);
+  return at > 0 && now - at <= USAGE_EVIDENCE_MAX_AGE_MS;
+}
+
 // Remaining headroom across every window that applies to this model, or null
 // when nothing recent measured the account. The fullest window decides: an
 // account with 4% of its burst window left cannot serve now, however untouched

package/src/runtime/shared/provider-display-name.mjs

@@ -0,0 +1,29 @@
+// Display names for provider ids; an unknown id displays as itself.
+const PROVIDER_DISPLAY_NAMES = new Map([
+  ['openai-oauth', 'OpenAI OAuth'],
+  ['anthropic-oauth', 'Anthropic OAuth'],
+  ['grok-oauth', 'Grok OAuth'],
+  ['muse-code-oauth', 'Muse Code'],
+  ['command-code-oauth', 'Command Code'],
+  ['mimo-oauth', 'MiMo'],
+  ['cursor-oauth', 'Cursor OAuth'],
+  ['devin-oauth', 'Devin'],
+  ['antigravity-oauth', 'Antigravity OAuth'],
+  ['openai', 'OpenAI API'],
+  ['openai-api', 'OpenAI API'],
+  ['anthropic', 'Anthropic API'],
+  ['anthropic-api', 'Anthropic API'],
+  ['gemini', 'Gemini API'],
+  ['gemini-api', 'Gemini API'],
+  ['xai', 'xAI API'],
+  ['xai-api', 'xAI API'],
+  ['deepseek', 'DeepSeek API'],
+  ['deepseek-api', 'DeepSeek API'],
+  ['opencode-go-oauth', 'OpenCode Go OAuth'],
+  ['openrouter', 'OpenRouter'],
+  ['mixdog-local', 'Local Provider'],
+  ['default', 'Default'],
+]);
+
+export const providerDisplayName = (provider) =>
+  PROVIDER_DISPLAY_NAMES.get(String(provider || '').toLowerCase()) ?? (provider || 'Provider');

package/src/runtime/shared/provider-timeout-phase.mjs

@@ -8,6 +8,8 @@ export const TIMEOUT_PHASE = Object.freeze({
   FIRST_CHUNK: 'first-chunk',
   // A stream that already produced output went silent.
   IDLE: 'idle',
+  // A sign-in token refresh did not answer: an auth problem, not a slow model.
+  AUTH: 'auth',
 });
 
 /** A timeout before the model produced anything: headers or first chunk. */

package/src/runtime/shared/routine-trigger.d.mts

@@ -4,6 +4,8 @@ export interface RoutineTrigger {
   event?: string;
 }
 
+export declare const ROUTINE_QUIET: 'ROUTINE_QUIET';
+export declare function isRoutineQuietReply(text: unknown): boolean;
 export declare function routineTriggerHeader(input: {
   kind: string;
   name: string;

package/src/runtime/shared/routine-trigger.mjs

@@ -9,6 +9,15 @@ import { localTimestampParts } from './time-format.mjs';
 const HEADER_PREFIX = '[Routine trigger]';
 const KINDS = new Set(['schedule', 'webhook']);
 
+/** The whole reply of a routine turn with nothing new to tell: kept in the
+ *  record, never painted, previewed, counted unread or notified. */
+export const ROUTINE_QUIET = 'ROUTINE_QUIET';
+
+/** Whether a reply is exactly the routine quiet sentinel. */
+export function isRoutineQuietReply(text) {
+  return String(text ?? '').trim() === ROUTINE_QUIET;
+}
+
 /** The first line of a routine turn's prompt: which routine fired, when (local
  *  time and zone: the turn gets no other date), and how to treat the turn.
  *  It is the routine's only conduct text. Only the turn's content carries it,
@@ -24,6 +33,7 @@ export function routineTriggerHeader({ kind, name, project = '', now = new Date(
     'Payments and permanent deletes are refused here: report that and suggest doing it from the chat.',
     'If a sign-in, code or CAPTCHA blocks you, stop and say which site needs the user.',
     'Reply in this chat in plain words, without tool names; if you handed work off, say it started — its result arrives here later.',
+    `Tell what is new in a fitting tone; if nothing is worth telling, reply with exactly ${ROUTINE_QUIET}.`,
     ...(project ? [`Project folder: ${project}`] : []),
   ].join(' ');
 }

package/src/runtime/shared/sensitive-path-rules.d.mts

@@ -1,15 +1,7 @@
 export interface SensitiveScope {
+  /** A Mixdog home or data folder, as path segments; only its secret subset is denied. */
   root: string[];
-  /** Subfolders of the root that stay reachable. */
-  except: readonly string[];
-  /** Whole tree (a registered private root) or Mixdog's secret subset. */
-  whole: boolean;
 }
-export function sensitivePathSegments(path: string): string[];
-export function matchesSensitivePath(
-  path: string,
-  within?: readonly SensitiveScope[],
-  options?: { envTemplates?: boolean }
-): boolean;
+export function matchesSensitivePath(path: string, within?: readonly SensitiveScope[]): boolean;
 export function mixdogSensitiveScopes(extraData?: readonly string[]): SensitiveScope[];
 export function isSensitiveLocalPath(path: string, options?: { extraData?: readonly string[] }): boolean;

package/src/runtime/shared/sensitive-path-rules.mjs

@@ -1,8 +1,7 @@
-// The credential / secret file deny list, shared by every lane that hands a
-// local file to someone else: the desktop's remote (paired-device) file lanes
-// (apps/desktop/src/main/remote-sensitive-paths.ts adds its registered private
-// roots and async canonicalization) and the runtime's attachment hand-offs
-// between bots and agents (session-runtime/handoff-attachments.mjs).
+// The credential / secret file deny list of the runtime's attachment
+// hand-offs between bots and agents (session-runtime/handoff-attachments.mjs):
+// an automatic transfer never carries a secret-bearing file. A paired device
+// is the user's own and gets no such list (it opens what the desktop opens).
 //
 // Matching is on SEGMENTS of a path, lower-cased on every platform, so a
 // denied name cannot hide behind letter case, trailing dots/spaces or an NTFS
@@ -113,10 +112,6 @@ const CREDENTIAL_FILES = new Set([
  *  checked in often enough with real values that no name is exempt) and
  *  `<stage>.env`. */
 const ENV_FILE = /^(?:\.env.*|[^.]{1,64}(?:\.[^.]{1,64}){0,3}\.env)$/;
-/** The dotenv templates a person may still open on purpose from a paired
- *  device (the desktop's remote file lanes, `envTemplates: true`); automatic
- *  transfers between bots and agents never get this allowance. */
-const ENV_TEMPLATES = new Set(['.env.example', '.env.sample', '.env.template', '.env.dist']);
 /** Credential JSON a cloud or OAuth client writes or downloads:
  *  `credentials.json`, `*credentials*.json`, `service-account*.json`,
  *  `client_secret*.json`. */
@@ -143,10 +138,9 @@ function backupOriginal(name) {
 
 /** A file whose own name says it holds a secret, wherever it lives: a
  *  credential file, a dotenv file, a key or keystore, or a backup of one. */
-function secretFileName(name, { envTemplates = false } = {}) {
+function secretFileName(name) {
   const original = backupOriginal(name);
-  if (CREDENTIAL_FILES.has(original) || CREDENTIAL_JSON.test(original)) return true;
-  if (ENV_FILE.test(original)) return !(envTemplates && ENV_TEMPLATES.has(original));
+  if (CREDENTIAL_FILES.has(original) || CREDENTIAL_JSON.test(original) || ENV_FILE.test(original)) return true;
   const dot = original.lastIndexOf('.');
   if (dot >= 0 && KEY_EXTENSIONS.has(original.slice(dot))) return true;
   return SSH_PRIVATE_KEY.test(original);
@@ -156,14 +150,7 @@ function secretFileName(name, { envTemplates = false } = {}) {
 // (tool results, shell output, media), which stay reachable; only the files
 // and folders that carry provider tokens, API keys, pairing and bridge secrets
 // are denied.
-const MIXDOG_SECRET_DIRECTORIES = new Set([
-  'secrets',
-  'mcp-oauth',
-  'provider-accounts',
-  'telegram',
-  'relay-data',
-  'dev-profile',
-]);
+const MIXDOG_SECRET_DIRECTORIES = new Set(['secrets', 'mcp-oauth', 'provider-accounts', 'relay-data', 'dev-profile']);
 const MIXDOG_SECRET_FILE =
   /^\.?(mixdog-config|provider-accounts|relay-hook-device|auth\.json|[a-z0-9-]+-oauth(-credentials)?\.json|[a-z0-9-]+-bridge\.json)/;
 const MIXDOG_SECRET_EXTENSIONS = new Set(['.dpapi', '.token']);
@@ -177,7 +164,7 @@ function mixdogSecret(rest) {
 
 /** The segments of a path as the rules compare them: no extended-path prefix,
  *  no NTFS stream suffix, no trailing dots or spaces, lower case. */
-export function sensitivePathSegments(path) {
+function sensitivePathSegments(path) {
   return String(path)
     .replace(/^[\\/]{2}[?.][\\/]/, '')
     .split(/[\\/]+/)
@@ -198,30 +185,21 @@ function hasRun(segments, run) {
 }
 
 /**
- * Whether `path` is denied under `within`: scopes `{ root: segments, except:
- * subfolder names, whole }` — Mixdog's home and data folders (`whole: false`,
- * only their secret subset is denied) and registered private roots (`whole:
- * true`, everything but `except`). Pass both the lexical and canonical form.
- * `envTemplates`: a user-initiated remote open may read the dotenv
- * templates; nothing else gets that allowance.
+ * Whether `path` is denied under `within`: scopes `{ root: segments }` —
+ * Mixdog's home and data folders, where only their secret subset is denied.
+ * Pass both the lexical and canonical form.
  */
-export function matchesSensitivePath(path, within = [], { envTemplates = false } = {}) {
+export function matchesSensitivePath(path, within = []) {
   const segments = sensitivePathSegments(resolve(path));
   const name = segments[segments.length - 1] ?? '';
   if (segments.some((segment) => SECRET_DIRECTORIES.has(segment))) return true;
-  if (secretFileName(name, { envTemplates }) || SECRET_SEQUENCES.some((run) => hasRun(segments, run))) return true;
-  const containing = within.filter(
-    ({ root }) => root.length > 0 && root.every((segment, index) => segments[index] === segment)
+  if (secretFileName(name) || SECRET_SEQUENCES.some((run) => hasRun(segments, run))) return true;
+  return within.some(
+    ({ root }) =>
+      root.length > 0 &&
+      root.every((segment, index) => segments[index] === segment) &&
+      mixdogSecret(segments.slice(root.length))
   );
-  // Mixdog's home and data folders follow Mixdog's own rule even inside a
-  // registered private root: a dev or isolated profile keeps them in the app
-  // profile, and the tool output and media there stay reachable.
-  const own = containing.filter(({ whole }) => !whole);
-  if (own.length) return own.some(({ root }) => mixdogSecret(segments.slice(root.length)));
-  return containing.some(({ root, except }) => {
-    const rest = segments.slice(root.length);
-    return rest.length > 0 && !except.includes(rest[0]);
-  });
 }
 
 function realOrSelf(path) {
@@ -241,7 +219,7 @@ export function mixdogSensitiveScopes(extraData = []) {
   const scopes = [];
   for (const root of roots) {
     for (const form of new Set([resolve(root), realOrSelf(resolve(root))])) {
-      scopes.push({ root: sensitivePathSegments(form), except: [], whole: false });
+      scopes.push({ root: sensitivePathSegments(form) });
     }
   }
   return scopes;

package/src/runtime/shared/session-activity-signal.mjs

@@ -13,7 +13,54 @@ export function onSessionActivityChange(listener) {
 }
 
 export function emitSessionActivityChange(sessionId = '') {
-  for (const listener of [...listeners]) {
+  emit(listeners, sessionId);
+}
+
+// A turn started on a session: the one point every turn passes through, whoever
+// started it. Unlike the activity pulse it never fires on a settle or a wait.
+const turnStartListeners = new Set();
+
+export function onSessionTurnStart(listener) {
+  if (typeof listener !== 'function') return () => {};
+  turnStartListeners.add(listener);
+  return () => turnStartListeners.delete(listener);
+}
+
+export function emitSessionTurnStart(sessionId = '') {
+  emit(turnStartListeners, sessionId);
+}
+
+// A live session started or stopped showing an approval card waiting on the
+// user (its runtime state's `toolApproval`): the session catalog, which
+// stamps that on each row, listens and re-reads.
+const approvalCardListeners = new Set();
+
+export function onSessionApprovalCardChange(listener) {
+  if (typeof listener !== 'function') return () => {};
+  approvalCardListeners.add(listener);
+  return () => approvalCardListeners.delete(listener);
+}
+
+export function emitSessionApprovalCardChange(sessionId = '') {
+  emit(approvalCardListeners, sessionId);
+}
+
+// The bots whose sends are in flight in a session changed (bot-owned-work.mjs):
+// the session catalog stamps them on each row (`handedBy`) and re-reads.
+const botWorkListeners = new Set();
+
+export function onSessionBotWorkChange(listener) {
+  if (typeof listener !== 'function') return () => {};
+  botWorkListeners.add(listener);
+  return () => botWorkListeners.delete(listener);
+}
+
+export function emitSessionBotWorkChange(sessionId = '') {
+  emit(botWorkListeners, sessionId);
+}
+
+function emit(targets, sessionId) {
+  for (const listener of [...targets]) {
     try {
       listener(String(sessionId || ''));
     } catch {

package/src/runtime/shared/session-scratch.mjs

@@ -0,0 +1,37 @@
+// Per-session scratch directory under Mixdog's data directory. Processes the
+// `shell` tool starts see it as TEMP/TMP/TMPDIR, so scratch files never land in
+// the project, and it is removed with its session (session-delete.mjs).
+import { mkdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolvePluginData } from './plugin-paths.mjs';
+
+const SESSION_ID = /^[A-Za-z0-9_-]+$/;
+
+/** The session's scratch path (not created), or '' for an unusable id. */
+export function sessionScratchDir(sessionId) {
+  const id = typeof sessionId === 'string' ? sessionId : '';
+  return SESSION_ID.test(id) ? join(resolvePluginData(), 'scratch', id) : '';
+}
+
+/** Create the session's scratch directory if absent; returns its path ('' without a session id). */
+export function ensureSessionScratchDir(sessionId) {
+  const dir = sessionScratchDir(sessionId);
+  if (dir) mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+export function removeSessionScratchDir(sessionId) {
+  const dir = sessionScratchDir(sessionId);
+  if (dir) rmSync(dir, { recursive: true, force: true });
+}
+
+/** Point an env's temp variables at the session's scratch directory. */
+export function applySessionScratchEnv(env, sessionId) {
+  const dir = ensureSessionScratchDir(sessionId);
+  if (dir) {
+    env.TEMP = dir;
+    env.TMP = dir;
+    env.TMPDIR = dir;
+  }
+  return env;
+}

package/src/runtime/shared/session-sidebar-host.d.mts

@@ -4,7 +4,7 @@ export type SessionSidebarChange =
   | { archived: true; cascade: false }
   | { forgotten: true };
 export type SessionSidebarHost = (sessionId: unknown, change: unknown) => unknown;
-export type SessionSidebarState = { archived: Record<string, number> };
+export type SessionSidebarState = { archived: Record<string, number>; favorites?: Record<string, number> };
 export function registerSessionSidebarHost(
   host: SessionSidebarHost,
   options?: { state?: (() => SessionSidebarState | Promise<SessionSidebarState>) | null }

package/src/runtime/shared/session-sidebar-host.mjs

@@ -41,11 +41,15 @@ export async function applySessionSidebarChange(sessionId, change) {
   await active.host(sessionId, change);
 }
 
-/** The active desktop's flags, `{ archived }` (session id → epoch-ms stamp);
- *  null when no desktop (or one without a state reader) is attached. */
+/** The active desktop's flags, `{ archived, favorites? }` (session id →
+ *  epoch-ms stamp; `favorites` only from a desktop that reports them); null
+ *  when no desktop (or one without a state reader) is attached. */
 export async function readSessionSidebarState() {
   const active = hosts().at(-1);
   if (!active?.state) return null;
   const state = await active.state();
-  return { archived: { ...state?.archived } };
+  return {
+    archived: { ...state?.archived },
+    ...(state?.favorites && typeof state.favorites === 'object' ? { favorites: { ...state.favorites } } : {}),
+  };
 }