mixdog 1.3.5 → 1.4.1

package/src/session-runtime/handoff-attachments.mjs

@@ -453,8 +453,9 @@ function callArgs(call) {
   return args && typeof args === 'object' ? args : {};
 }
 
-/** The paths one tool call wrote or produced. */
-function toolCallOutputs(call) {
+/** The paths one tool call wrote or produced; `written`: only those it
+ *  actually created or modified (opening a file in visualize does neither). */
+function toolCallOutputs(call, written) {
   const name = String(call?.function?.name || call?.name || '');
   const args = callArgs(call);
   const text = (value) => (typeof value === 'string' && value.trim() ? [value.trim()] : []);
@@ -464,7 +465,7 @@ function toolCallOutputs(call) {
   if (name === 'office') return OFFICE_WRITE_ACTIONS.has(args.action) ? [...text(args.output), ...text(args.path)] : [];
   if (name === 'visualize') {
     const input = args.input && typeof args.input === 'object' ? args.input : {};
-    const targets = args.action === 'open' && Array.isArray(input.targets) ? input.targets : [];
+    const targets = !written && args.action === 'open' && Array.isArray(input.targets) ? input.targets : [];
     return [
       ...text(input.output),
       ...targets.filter((target) => typeof target === 'string' && !/^[a-z][a-z0-9+.-]*:\/\//i.test(target)),
@@ -520,8 +521,9 @@ export function turnSlice(messages, { runId = '', since = 0 } = {}) {
 
 /** The candidate artifact paths of a turn's messages, most relevant first:
  *  what its final reply names, then media/office/visualize outputs, then the
- *  files it edited. */
-export function turnArtifactCandidates(messages) {
+ *  files it edited. `written`: only the files it created or modified (no
+ *  reply paths, no visualize open targets). */
+export function turnArtifactCandidates(messages, { written = false } = {}) {
   const list = Array.isArray(messages) ? messages : [];
   const reply = list.findLast((message) => message?.role === 'assistant' && textOf(message.content).trim());
   const produced = [];
@@ -535,10 +537,10 @@ export function turnArtifactCandidates(messages) {
         : [];
     for (const call of calls) {
       const name = String(call?.function?.name || call?.name || '');
-      (name === 'edit' || name === 'apply_patch' ? edited : produced).push(...toolCallOutputs(call));
+      (name === 'edit' || name === 'apply_patch' ? edited : produced).push(...toolCallOutputs(call, written));
     }
   }
-  return [...(reply ? replyPaths(textOf(reply.content)) : []), ...produced, ...edited];
+  return [...(!written && reply ? replyPaths(textOf(reply.content)) : []), ...produced, ...edited];
 }
 
 /**
@@ -549,38 +551,16 @@ export function turnArtifactCandidates(messages) {
  * the roots are left out silently; at most HANDOFF_LIMITS.count are kept.
  */
 export function collectTurnArtifacts(messages, { cwd = '', roots = [] } = {}) {
-  const seen = new Set();
   const files = [];
   let omitted = 0;
   const budget = createBudget();
-  for (const candidate of turnArtifactCandidates(messages)) {
-    // A candidate is a lexical path; its canonical form dedupes after the read.
-    const lexical = samePlatformPath(
-      isAbsolute(candidate) ? resolve(candidate) : resolve(cwd || process.cwd(), candidate)
-    );
-    if (seen.has(lexical)) continue;
-    seen.add(lexical);
-    let file;
-    try {
-      file = readContained(candidate, { cwd, roots, surface: 'artifact' });
-    } catch {
-      continue;
-    }
-    const key = samePlatformPath(file.path);
-    if (key !== lexical && seen.has(key)) continue;
-    seen.add(key);
+  for (const { file } of readableCandidates(turnArtifactCandidates(messages), { cwd, roots })) {
     if (files.length >= HANDOFF_LIMITS.count) {
       omitted += 1;
       continue;
     }
     const { type, bytes } = file;
-    const entry = {
-      path: file.path,
-      name: file.name,
-      kind: type?.kind || 'file',
-      mimeType: type?.mimeType || 'application/octet-stream',
-      size: file.size,
-    };
+    const entry = pathEntry(file);
     const storable = bytes && (type.kind !== 'image' || SUPPORTED_IMAGE_MIME_TYPES.has(type.mimeType));
     if (storable && budget.take(type.kind, bytes.length)) {
       try {
@@ -591,3 +571,74 @@ export function collectTurnArtifacts(messages, { cwd = '', roots = [] } = {}) {
   }
   return { files, omitted };
 }
+
+/**
+ * The files `messages` (one turn) created or modified, inside `roots`, that
+ * `report` (the text handed to the Lead) does not name: `{ files, omitted }`
+ * as path-only entries, which the Lead forwards by path. Nothing is stored.
+ */
+export function collectUnreportedWrites(messages, { cwd = '', roots = [], report }) {
+  const found = [...readableCandidates(turnArtifactCandidates(messages, { written: true }), { cwd, roots })];
+  const unnamed = found.filter((item) => !reportNames(report, item, found, cwd));
+  return {
+    files: unnamed.slice(0, HANDOFF_LIMITS.count).map(({ file }) => pathEntry(file)),
+    omitted: Math.max(0, unnamed.length - HANDOFF_LIMITS.count),
+  };
+}
+
+const lexicalKey = (path, cwd) => samePlatformPath(resolve(cwd || process.cwd(), path));
+
+const pathEntry = (file) => ({
+  path: file.path,
+  name: file.name,
+  kind: file.type?.kind || 'file',
+  mimeType: file.type?.mimeType || 'application/octet-stream',
+  size: file.size,
+});
+
+/** The distinct files among `candidates` that can be read inside `roots`, with
+ *  their lexical and canonical keys. A candidate is a lexical path; its
+ *  canonical form dedupes after the read. */
+function* readableCandidates(candidates, { cwd, roots }) {
+  const seen = new Set();
+  for (const candidate of candidates) {
+    const lexical = lexicalKey(candidate, cwd);
+    if (seen.has(lexical)) continue;
+    seen.add(lexical);
+    let file;
+    try {
+      file = readContained(candidate, { cwd, roots, surface: 'artifact' });
+    } catch {
+      continue;
+    }
+    const key = samePlatformPath(file.path);
+    if (key !== lexical && seen.has(key)) continue;
+    seen.add(key);
+    yield { file, lexical, key };
+  }
+}
+
+/** Whether `report` names the produced file `item` among `found`: by its full
+ *  path or a cwd-relative path resolving to it exactly, or by its bare file name
+ *  when no other produced file shares that name. */
+function reportNames(report, { file, lexical, key }, found, cwd) {
+  const flat = (value) => String(value).replaceAll('\\', '/');
+  const filePath = flat(file.path);
+  if (flat(report).includes(filePath)) return true;
+  const plain = report
+    .split(/[\s`"'<>()[\],;|]+/)
+    .map((token) => token.replace(/:\d+(?::\d+)?$/, '').replace(/[.:!?]+$/, ''))
+    .filter((token) => /\.[A-Za-z0-9]{1,8}$/.test(token) && !/^[a-z][a-z0-9+.-]*:\/\//i.test(token));
+  const refs = new Set([...replyPaths(report), ...plain]);
+  const unique = found.filter((other) => other.file.name === file.name).length === 1;
+  for (const ref of refs) {
+    const normalized = flat(ref).replace(/^(?:\.\/)+/, '');
+    if (!normalized.includes('/')) {
+      if (unique && normalized === file.name) return true;
+      continue;
+    }
+    const refKey = lexicalKey(ref, cwd);
+    if (refKey === lexical || refKey === key) return true;
+  }
+  return false;
+}

package/src/session-runtime/internal-tool-executor/ask-user-tool.mjs

@@ -1,40 +1,85 @@
 // ask_user: put 1-4 multiple-choice questions to the user through the session's
 // tool-approval hook (kind: 'question') and report the answers to the model.
+// handoff_user (the secret / takeover handoff) shares this module's human-gate code.
 import { randomUUID } from 'node:crypto';
 import {
-  validateAskUserHandoff,
+  validateUserHandoff,
   validateAskUserQuestions,
   ASK_USER_MAX_TEXT,
 } from '../../runtime/agent/orchestrator/runtime-core/ask-user-tool-defs.mjs';
 import { createCallerContextResolvers } from './caller-context.mjs';
 import { runAbortable } from '../../runtime/shared/abort-race.mjs';
-import { SECRET_REQUEST_TIMEOUT_MS } from '../../runtime/agent/orchestrator/session/human-gate/requests.mjs';
+import {
+  HANDOFF_OUTCOMES as AGENT_OUTCOMES,
+  SECRET_REQUEST_TIMEOUT_MS,
+} from '../../runtime/agent/orchestrator/session/human-gate/requests.mjs';
 import {
   agentIdForSession,
   recordHumanDecision,
   unattendedApprovalPort,
 } from '../../runtime/agent/orchestrator/session/human-gate/gate.mjs';
-import { browserSecretInput } from '../../runtime/browser-bridge/client.mjs';
-import { computerSecretInput } from '../../runtime/computer-bridge/client.mjs';
+import { browserHandoffPage, browserSecretInput } from '../../runtime/browser-bridge/client.mjs';
+import { computerSecretBind, computerSecretInput } from '../../runtime/computer-bridge/client.mjs';
+
+/** The settle reason of a takeover that expired (desktop takeover-gate.ts
+ *  TAKEOVER_EXPIRED_REASON). */
+const TAKEOVER_EXPIRED_REASON = 'expired';
+
+/**
+ * The agent's result of a secret request, from the card's answer and the
+ * desktop's fill: one of requests.mjs HANDOFF_OUTCOMES. `fill` runs only for a provided
+ * value and answers 'entered' / 'no_field' / 'page_changed' / 'blocked' /
+ * 'expired'.
+ */
+export async function secretOutcome(result, fill) {
+  if (result?.timedOut === true || result?.reason === TAKEOVER_EXPIRED_REASON) return 'expired';
+  if (result?.approved !== true || result.response !== 'provide-secret') return 'user_skipped';
+  const filled = await fill();
+  return AGENT_OUTCOMES.includes(filled) && filled !== 'user_skipped' ? filled : 'blocked';
+}
+
+/** A page address as the agent may see it: origin and path, no query or
+ *  fragment (a sign-in redirect can carry a code or token there). */
+function factUrl(value) {
+  try {
+    const url = new URL(String(value || ''));
+    return url.protocol === 'http:' || url.protocol === 'https:' ? `${url.origin}${url.pathname}` : '';
+  } catch {
+    return '';
+  }
+}
+
+/** The agent's result of a takeover: what the user did and where the page is
+ *  now, never "signed in" (the agent checks the page). */
+export function takeoverOutcome(result, pageUrl = '') {
+  if (result?.timedOut === true || result?.reason === TAKEOVER_EXPIRED_REASON) return 'expired';
+  if (result?.approved !== true) return 'user_skipped';
+  const url = factUrl(pageUrl);
+  const did = result.reason === 'saved_login' ? 'User chose a saved login; it was filled in' : 'User pressed Done';
+  return url ? `${did}; page now at ${url}` : did;
+}
 
 /**
- * A secret or takeover handoff. Secret: the card collects the value on the
- * desktop, which holds it for `requestId` and fills it into the target field
- * (isolated-world fill for the browser, one-shot typed input for computer
- * use); here only the verdict travels, and the result is exactly 'provided',
- * 'skipped' or 'timeout'. Takeover: the run waits until the user says done
- * (computer and browser actions stay blocked meanwhile, desktop
- * main/takeover-gate.ts); the result is 'done' or 'denied'.
+ * A secret or takeover handoff. Secret: at request time the desktop binds the
+ * request to its page ({pageId, origin}) or, for computer use, it is bound to
+ * {window_id, ref}; the card collects the value on the desktop, which holds it
+ * for `requestId` and fills only that page, only while its origin is
+ * unchanged. Here only the outcome travels (secretOutcome). Takeover: the run
+ * waits until the user says done (that session's actions stay blocked
+ * meanwhile, desktop main/takeover-gate.ts); the result is takeoverOutcome's.
  */
 export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId, signal, inputs = {} }) {
   const secretInput = {
     browser: inputs.browser || browserSecretInput,
     computer: inputs.computer || computerSecretInput,
   };
+  const page = inputs.page || browserHandoffPage;
+  const bindComputer = inputs.computerBind || computerSecretBind;
+  const identity = handoff.identity || {};
   const gate = {
     agentId: agentIdForSession(sessionId),
     kind: handoff.kind,
-    tool: `ask_user:${handoff.surface}`,
+    tool: `handoff_user:${handoff.surface}`,
     target: handoff.target || handoff.field || '',
   };
   // A schedule or webhook run has nobody to take over: the step ends it now,
@@ -47,43 +92,96 @@ export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId,
     return UNATTENDED_TAKEOVER;
   }
   if (typeof hook !== 'function') {
-    // Nobody can take over here: blocked, never "proceed".
+    // Nobody can take over or type here: blocked, never "proceed".
     if (handoff.kind === 'takeover') return NO_TAKEOVER;
-    await recordHumanDecision(gate, { response: 'skipped' });
-    return 'skipped';
+    await recordHumanDecision(gate, { response: 'blocked' });
+    return 'blocked';
   }
   if (handoff.kind === 'secret') {
     const requestId = `secret_${randomUUID()}`;
+    // Bound now: the page (and its origin) the value may go to, and what its
+    // field is. A browser page that cannot be bound, or has no such field,
+    // never asks the user for a value it could not place.
+    let bound = {};
+    if (handoff.surface === 'browser') {
+      const facts = await page(
+        sessionId,
+        'secret_bind',
+        { request_id: requestId, ...(identity.tab ? { tab: identity.tab } : {}), field: handoff.field },
+        { signal }
+      );
+      let outcome = '';
+      if (!facts?.origin) outcome = 'blocked';
+      else if (!facts.form) outcome = 'no_field';
+      if (outcome) {
+        await recordHumanDecision(gate, { response: outcome });
+        return outcome;
+      }
+      bound = { origin: facts.origin, form: facts.form, ...(facts.length ? { length: facts.length } : {}) };
+    } else {
+      // Computer Use: bound to the exact window and field ref the agent named
+      // (from snapshot/find). Without both there is no field to confirm, and
+      // none is made up (never the focused field or the front window).
+      const outcome =
+        identity.windowId && identity.ref
+          ? await bindComputer(sessionId, requestId, { windowId: identity.windowId, ref: identity.ref, signal })
+          : 'no_field';
+      if (outcome !== 'bound') {
+        const refused = outcome === 'no_field' ? 'no_field' : 'blocked';
+        await recordHumanDecision(gate, { response: refused });
+        return refused;
+      }
+    }
     const result = await runAbortable(signal, () =>
       hook({
-        name: 'ask_user',
+        name: 'handoff_user',
         kind: 'secret',
-        secret: { requestId, surface: handoff.surface, target: handoff.target, field: handoff.field },
+        secret: { requestId, surface: handoff.surface, target: handoff.target, field: handoff.field, ...bound },
         reason: '',
         timeoutMs: SECRET_REQUEST_TIMEOUT_MS,
         sessionId,
         toolCallId,
       })
     );
-    let verdict = 'skipped';
-    if (result?.timedOut === true) verdict = 'timeout';
-    else if (result?.approved === true && result.response === 'provide-secret') {
-      verdict = await secretInput[handoff.surface](sessionId, requestId, { signal });
-    }
-    await recordHumanDecision(gate, { response: verdict, device: result?.device });
-    return verdict;
+    const computerTarget = {
+      ...(identity.ref ? { ref: identity.ref } : {}),
+      ...(identity.windowId ? { windowId: identity.windowId } : {}),
+    };
+    const outcome = await secretOutcome(result, () =>
+      secretInput[handoff.surface](sessionId, requestId, {
+        signal,
+        ...(handoff.surface === 'computer' ? computerTarget : {}),
+      })
+    );
+    await recordHumanDecision(gate, { response: outcome, device: result?.device });
+    return outcome;
   }
+  // A sign-in page's saved logins (masked) let the card fill one for the
+  // user: the desktop offers them only for a page on that origin, bound now
+  // under `fillId` so the fill reaches that page alone (host-agent.ts fillBoundLogin).
+  const fillId = handoff.login ? `secret_${randomUUID()}` : '';
+  const accounts = handoff.login
+    ? (
+        await page(
+          sessionId,
+          'login_accounts',
+          { url: handoff.login.url, request_id: fillId, ...(identity.tab ? { tab: identity.tab } : {}) },
+          { signal }
+        )
+      )?.accounts
+    : null;
   const result = await runAbortable(signal, () =>
     hook({
-      name: 'ask_user',
+      name: 'handoff_user',
       kind: 'takeover',
       takeover: {
         surface: handoff.surface,
         instructions: handoff.instructions,
         target: handoff.target,
-        ...handoff.identity,
+        ...identity,
         // A login takeover: the desktop opens its sign-in window on this page.
         ...(handoff.login ? { purpose: 'login', url: handoff.login.url } : {}),
+        ...(Array.isArray(accounts) && accounts.length ? { accounts, fillId } : {}),
       },
       args: { surface: handoff.surface, instructions: handoff.instructions },
       reason: '',
@@ -92,8 +190,15 @@ export async function runAskUserHandoff(handoff, { hook, sessionId, toolCallId,
       toolCallId,
     })
   );
-  const answer = result?.approved === true ? 'done' : 'denied';
-  await recordHumanDecision(gate, { response: answer, device: result?.device });
+  const pageUrl =
+    result?.approved === true && handoff.surface === 'browser'
+      ? (await page(sessionId, 'page_url', identity.tab ? { tab: identity.tab } : {}, { signal }))?.url
+      : '';
+  const answer = takeoverOutcome(result, pageUrl);
+  await recordHumanDecision(gate, {
+    response: answer.startsWith('User ') ? 'done' : answer,
+    device: result?.device,
+  });
   return answer;
 }
 
@@ -125,7 +230,7 @@ const DISMISSED =
   'User closed the questions without answering. Proceed with your best judgment; ask again only if something new depends on it.';
 
 /** Wire answers -> array aligned with questions; invalid entries become null. */
-export function normalizeAskUserAnswers(answers, questions) {
+function normalizeAskUserAnswers(answers, questions) {
   const list = Array.isArray(answers) ? answers.slice(0, 4) : [];
   return questions.map((q, i) => {
     const entry = list[i];
@@ -143,7 +248,7 @@ export function normalizeAskUserAnswers(answers, questions) {
 
 // Strings are JSON-quoted so a quote inside one cannot end it early; typed
 // text stays apart from the picked labels (`"picked" + "typed" (typed)`).
-export function formatAskUserAnswers(questions, answers) {
+function formatAskUserAnswers(questions, answers) {
   const quote = (text) => JSON.stringify(text);
   const parts = questions.map((q, i) => {
     const a = answers[i];
@@ -157,14 +262,14 @@ export function formatAskUserAnswers(questions, answers) {
 
 /** A composer message sent instead of (or with) picking: kept when it is a
  *  non-empty string within the typed-answer limit, else dropped. */
-export function normalizeAskUserReply(reply) {
+function normalizeAskUserReply(reply) {
   if (typeof reply !== 'string' || reply.length > ASK_USER_MAX_TEXT) return '';
   return reply.trim();
 }
 
 // `User replied in chat: "<reply>". ` leads, then the usual picks sentence
 // when any question was answered, else just the closing sentence.
-export function formatAskUserResult(questions, answers, reply) {
+function formatAskUserResult(questions, answers, reply) {
   if (!reply) return formatAskUserAnswers(questions, answers);
   const lead = `User replied in chat: ${JSON.stringify(reply)}. `;
   if (answers.some(Boolean)) return `${lead}${formatAskUserAnswers(questions, answers)}`;
@@ -174,16 +279,14 @@ export function formatAskUserResult(questions, answers, reply) {
 export function createAskUserToolHandlers({ rt }) {
   const { sessionIdFor, signalFor } = createCallerContextResolvers(rt);
   return {
+    handoff_user: async (args, { callerCtx }) =>
+      runAskUserHandoff(validateUserHandoff(args), {
+        hook: callerCtx?.toolApprovalHook,
+        sessionId: sessionIdFor(callerCtx),
+        toolCallId: callerCtx?.toolCallId || null,
+        signal: signalFor(callerCtx),
+      }),
     ask_user: async (args, { callerCtx }) => {
-      const handoff = validateAskUserHandoff(args);
-      if (handoff) {
-        return runAskUserHandoff(handoff, {
-          hook: callerCtx?.toolApprovalHook,
-          sessionId: sessionIdFor(callerCtx),
-          toolCallId: callerCtx?.toolCallId || null,
-          signal: signalFor(callerCtx),
-        });
-      }
       const questions = validateAskUserQuestions(args);
       const hook = callerCtx?.toolApprovalHook;
       if (typeof hook !== 'function') return NO_USER;

package/src/session-runtime/internal-tool-executor/bridge-tools.mjs

@@ -45,6 +45,8 @@ export function createBridgeToolHandlers({ rt }) {
       cwd: callerCwd,
       requestApproval: callerCtx?.toolApprovalHook,
       toolCallId: callerCtx?.toolCallId || null,
+      // The agent turn, as for the browser: it scopes a saved-login fill's protection.
+      turnId: callerCtx?.turnId || rt.session?.usageMetricsTurnId,
       signal: signalFor(callerCtx),
     });
   };
@@ -81,6 +83,7 @@ export function createBridgeToolHandlers({ rt }) {
     }
     return await executeVisualizeTool(args, {
       sessionId: sessionIdFor(callerCtx),
+      callId: callerCtx?.toolCallId,
       cwd: callerCwd,
       signal: signalFor(callerCtx),
     });

package/src/session-runtime/internal-tool-executor/reaction-tool.mjs

@@ -4,7 +4,10 @@
 // the message is the user's row in the room's log. Never a coding session, a
 // delegated worker, or a run nobody attends.
 import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
-import { noteReactionTarget, validateReactionArgs } from '../../runtime/agent/orchestrator/runtime-core/reaction-tool-defs.mjs';
+import {
+  noteReactionTarget,
+  validateReactionArgs,
+} from '../../runtime/agent/orchestrator/runtime-core/reaction-tool-defs.mjs';
 import { agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
 import { roomMemberOfSession, roomSessionId } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
 import { reactInSession } from '../../runtime/agent/orchestrator/session/message-reactions.mjs';

package/src/session-runtime/internal-tool-executor/workspace-tools.mjs

@@ -17,6 +17,7 @@ import { scheduleCallerScope } from '../services/schedule-access.mjs';
 import { worktreeCallerScope } from '../services/worktree-access.mjs';
 import { resolveHandoffAttachments, sessionRoots } from '../handoff-attachments.mjs';
 import { delegationChainOf } from '../bot-chain.mjs';
+import { BOT_TARGET_ACTIONS, resolveBotTarget } from '../bot-target.mjs';
 
 const USER_TITLE_ERROR = 'session: the user already titled this session; the title was not changed';
 
@@ -50,6 +51,7 @@ export function createWorkspaceToolHandlers({
   getSessionManager = () => null,
   getLifecycleApi = () => null,
   executeSessionControl = null,
+  listBots,
 }) {
   const assertLead = (action, callerCtx) => {
     const callerSessionId = callerCtx?.callerSessionId || rt.session?.id || null;
@@ -110,12 +112,16 @@ export function createWorkspaceToolHandlers({
           'session: create belongs to a bot conversation; delegated workers, agent task sessions and schedule/webhook runs cannot create agent task sessions'
         );
       }
+      // A bot id names that bot's home chat; every check below and in the
+      // control runs on the chat it resolves to.
+      const sessionTarget =
+        BOT_TARGET_ACTIONS.has(action) && target ? await resolveBotTarget(target, listBots) : target;
       // A task session reaches its agent only through its reported result.
       const origin = rt.session?.taskOrigin;
       if (
         action === 'send' &&
         origin &&
-        (target === origin.sessionId || agentIdOfHomeSession(target) === origin.agentId)
+        (sessionTarget === origin.sessionId || agentIdOfHomeSession(sessionTarget) === origin.agentId)
       ) {
         throw new Error('session: a task session reports to its agent only through its result');
       }
@@ -129,7 +135,7 @@ export function createWorkspaceToolHandlers({
       const attachmentParts = callerAttachmentParts(rt, args, callerCwd, 'session');
       return JSON.stringify(
         await executeSessionControl(
-          { ...rest, action },
+          { ...rest, action, ...(sessionTarget !== target ? { session_id: sessionTarget } : {}) },
           {
             callerSessionId,
             callerAgentId,

package/src/session-runtime/lifecycle/cold-heir.mjs

@@ -150,14 +150,19 @@ export function buildColdHeir(source, now = Date.now()) {
   // earlier folder) is the source's own: the heir's prompt is built for the
   // folder it actually starts in. Project memory follows the Project, which a
   // worktree shares, so the source's current memory slice carries over.
+  // In the same folder only the environment facts are rebuilt: they name the
+  // heir's own scratch directory, never the source's, while the inherited
+  // instruction files and memory stay as the source presented them.
   const pending = source.workspaceReroot;
   delete heir.workspaceReroot;
-  if ((projectFolder || pending) && heir.cwd) {
-    refreshSessionWorkspaceContext(heir, {
-      cwd: heir.cwd,
-      ...buildWorkspacePromptContext(heir, heir.cwd),
-      coreMemoryContext: pending?.target?.coreMemoryContext,
-    });
+  if (heir.cwd) {
+    const context = buildWorkspacePromptContext(heir, heir.cwd);
+    refreshSessionWorkspaceContext(
+      heir,
+      projectFolder || pending
+        ? { cwd: heir.cwd, ...context, coreMemoryContext: pending?.target?.coreMemoryContext }
+        : { cwd: heir.cwd, environmentContext: context.environmentContext }
+    );
   }
   invalidateContextUsageSnapshot(heir);
   invalidateProviderContextBaseline(heir);

package/src/session-runtime/lifecycle/inheritance.mjs

@@ -15,6 +15,10 @@ import {
   inheritanceRouteTarget,
 } from '../inheritance-fit.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import {
+  rebindToChangedPrefix,
+  requestPrefixIdentity,
+} from '../../runtime/agent/orchestrator/session/thinking-binding.mjs';
 import { buildColdHeir, committedSource, persistColdHeir } from './cold-heir.mjs';
 
 export function createInheritance(deps, { compactConversation, saveSession }) {
@@ -155,8 +159,17 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
   async function carryConversation(source, target, { compact = false } = {}) {
     // System blocks belong to the session that BUILT them: the target's own
     // prompt was composed for the current model, tool surface, and workflow.
-    // Only the conversation itself travels.
-    let carried = inheritableMessages(source.messages);
+    // Only the conversation itself travels — without its thinking replay when
+    // the heir's prompt or tools differ from the source's: that replay is
+    // bound to the source's prefix, so the provider would drop it (and every
+    // thinking block after it) or refuse it, while the heir's context estimate
+    // kept counting it (thinking-binding.mjs); an open tool round the source
+    // stopped in is ended for the heir. An identical prefix keeps it all.
+    const carrySource =
+      requestPrefixIdentity(source) === requestPrefixIdentity(target)
+        ? source
+        : { ...source, messages: rebindToChangedPrefix(source.messages) };
+    let carried = inheritableMessages(carrySource.messages);
     if (!hasUserConversationMessage(carried)) {
       throw new Error('inheritFrom: the source session has no conversation to carry');
     }
@@ -169,7 +182,7 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
     // compact:true summarizes even a conversation that fits; otherwise only
     // one that cannot fit is compacted.
     if (compact || (fit.known && !fit.fits)) {
-      const next = await fitConversationForHeir(source, target, carried, fit, { required: compact });
+      const next = await fitConversationForHeir(carrySource, target, carried, fit, { required: compact });
       compacted = next !== carried;
       carried = next;
     }

package/src/session-runtime/lifecycle/session-catalog.mjs

@@ -21,7 +21,11 @@ import {
   wantsIncomingTail,
 } from '../../runtime/agent/orchestrator/session/store-summary-last-message.mjs';
 import { isRealTurnMessage } from '../../runtime/agent/orchestrator/session/compact/user-message-kind.mjs';
-import { realTurnCount as realTurnCountOf } from '../../runtime/agent/orchestrator/session/store-summary-fields.mjs';
+import {
+  compactCount as compactCountOf,
+  compactCountField,
+  realTurnCount as realTurnCountOf,
+} from '../../runtime/agent/orchestrator/session/store-summary-fields.mjs';
 
 const VISIBLE_OWNERS = ['cli', 'user', 'mixdog'];
 
@@ -77,7 +81,9 @@ export function leadSessionRow(s, working = false) {
   if (sourceType === 'exec') return null;
   if (!agentSession && !isLeadShaped(s, owner, sourceType)) return null;
   const { preview, messageCount, realTurnCount, incomingTail } = previewOf(s);
-  if (!preview && messageCount === 0) return null;
+  // A titled one is not scratch: its prompt was rewound away (Esc-Esc message
+  // selector), so it stays listed rather than vanishing with its open tab.
+  if (!preview && messageCount === 0 && !cleanSessionPreview(s.title || '', 100)) return null;
   const lastMessageRoutine = normalizeRoutineProvenance(s.lastMessageRoutine);
   return {
     id: s.id,
@@ -105,6 +111,10 @@ export function leadSessionRow(s, working = false) {
     // sit among the counted ones: a bot row's unread pill counts those past
     // the read cursor. Absent when unknown; clients then show one.
     ...(incomingTail ? { incomingTail } : {}),
+    // The numbering epoch of messageCount: each compaction restarts it. A
+    // summary row carries it at the top; a stored session in its compaction
+    // record. Unknown stays absent.
+    ...compactCountField(compactCountOf(s) === null ? s.compaction : s),
     title: cleanSessionPreview(s.title || '', 100),
     preview,
     // The latest user or assistant line (an agent contact's row shows it).