mixdog 1.3.5 → 1.4.1

package/src/standalone/channel-transport/client-registry/client-records.mjs

@@ -0,0 +1,65 @@
+// The live client records of the channel transport: pid-liveness reads and
+// pruning, the one removal primitive every path uses, and the UI control
+// pointer lookup. `replays` and `grace` are the registry's replay records and
+// self-shutdown grace timer.
+import { isPidAlive } from '../../../runtime/shared/pid-liveness.mjs';
+
+export function createClientRecords({ state, log, publishRemoteState, replays, grace }) {
+  const { clients } = state;
+
+  // pid death is the authoritative signal for client liveness: a client whose
+  // SSE stream closed may still reconnect, one whose lead pid is gone cannot.
+  function pruneDeadClients() {
+    for (const [token, c] of clients) {
+      if (!isPidAlive(c.leadPid)) dropClient(token, 'pid dead');
+    }
+  }
+
+  function liveClients() {
+    const out = [];
+    for (const [token, c] of clients) {
+      if (isPidAlive(c.leadPid)) out.push([token, c]);
+    }
+    return out;
+  }
+
+  // Every removal path uses this primitive, including replacement's deliberate
+  // no-failover retirement, so replay records/timers never target absent tokens.
+  function removeClientRecord(token) {
+    const c = clients.get(token);
+    if (!c) return null;
+    clients.delete(token);
+    replays.forgetFor(token);
+    try {
+      c.sse?.end?.();
+    } catch {
+      // The stream may already be closed by the peer.
+    }
+    return c;
+  }
+
+  function dropClient(token, reason) {
+    const c = removeClientRecord(token);
+    if (!c) return;
+    if (state.pointerToken === token) state.pointerToken = null;
+    log(`client ${token} (lead=${c.leadPid}) removed: ${reason}`);
+    // Client presence is not channel authority. The durable session pin stays
+    // active until that same session explicitly turns Remote OFF.
+    publishRemoteState();
+    grace.maybeArm('client removed');
+  }
+
+  // Resolve the active UI pointer for state delivery only. Session routing
+  // never depends on this client.
+  function resolveTarget() {
+    if (state.pointerToken) {
+      const c = clients.get(state.pointerToken);
+      if (c && isPidAlive(c.leadPid)) return c;
+      if (c) dropClient(state.pointerToken, 'pid dead (notify-time)');
+      else state.pointerToken = null;
+    }
+    return null;
+  }
+
+  return { pruneDeadClients, liveClients, removeClientRecord, dropClient, resolveTarget };
+}

package/src/standalone/channel-transport/client-registry/client-registration.mjs

@@ -0,0 +1,118 @@
+// Client registration for the channel transport: a fresh record per attach,
+// a passive reconnect's response-loss replay, the replaced token's retirement
+// with its token-scoped state carried over, and the replacement's
+// cancellation. `records` is the registry's client records (client-records).
+import { randomUUID } from 'node:crypto';
+import { parsePid } from '../../../runtime/shared/pid-liveness.mjs';
+import { replayMatchesCancellation, replayMatchesRegistration } from './registration-replays.mjs';
+
+export function createClientRegistration({ state, log, onClientRegistered, replays, grace, records }) {
+  const { clients } = state;
+
+  function cancelReplacementRegistration(request) {
+    const replay = replays.lookup(request.registrationId);
+    if (!replay) return 'missing';
+    if (!replayMatchesCancellation(replay, request)) return 'forbidden';
+    records.dropClient(replay.token, 'replacement deregister');
+    return 'cancelled';
+  }
+
+  /** A passive reconnect retrying under a known registration id gets the fresh
+   *  token it already created; a different identity under that id is a 409. */
+  function replayedToken(replayId, identity) {
+    const existing = replays.lookup(replayId);
+    if (!existing) return null;
+    if (replayMatchesRegistration(existing, identity) && clients.has(existing.token)) {
+      replays.arm(replayId, existing);
+      log(`client reconnect replay token=${existing.token} lead=${identity.pid}`);
+      return existing.token;
+    }
+    if (clients.has(existing.token)) {
+      const err = new Error('registration replay identity mismatch');
+      err.statusCode = 409;
+      throw err;
+    }
+    replays.remove(replayId, existing);
+    return null;
+  }
+
+  /** A reconnect names the exact token it replaces. Token-scoped state belongs
+   *  to the logical client, so the fresh record inherits the buffered frame,
+   *  remote session and pointer; the old token is retired even when it is not
+   *  the pointer — retaining it would let it later call or accumulate a
+   *  buffered frame after the fresh client has gone away. */
+  function adoptReplacedClient(fresh, replaced) {
+    const replacedWasPointer = state.pointerToken === replaced.token;
+    if (replaced.pendingRemoteStateFrame) {
+      fresh.pendingRemoteStateFrame = replaced.pendingRemoteStateFrame;
+      replaced.pendingRemoteStateFrame = null;
+    }
+    if (replaced.remoteSessionId) fresh.remoteSessionId = replaced.remoteSessionId;
+    if (replaced.restoreSessionId) fresh.restoreSessionId = replaced.restoreSessionId;
+    if (replacedWasPointer) state.pointerToken = fresh.token;
+    records.removeClientRecord(replaced.token);
+    log(`client reconnect replaced token=${replaced.token} -> ${fresh.token} lead=${fresh.leadPid}`);
+  }
+
+  function registerClient({
+    leadPid,
+    cwd,
+    passive = false,
+    replaceToken = null,
+    registrationId = null,
+    restoreSessionId = null,
+  }) {
+    const pid = parsePid(leadPid) ?? 0;
+    const restoreId = /^[A-Za-z0-9_-]+$/.test(String(restoreSessionId || '')) ? String(restoreSessionId) : null;
+    const replacementToken = replaceToken ? String(replaceToken) : null;
+    const replayId = passive && registrationId ? replays.replayIdOf(registrationId) : null;
+    const replayed = replayedToken(replayId, { pid, cwd, replacementToken, restoreId });
+    if (replayed) return replayed;
+    const token = randomUUID();
+    const fresh = {
+      token,
+      leadPid: pid,
+      cwd: cwd || null,
+      sse: null,
+      pendingRemoteStateFrame: null,
+      lastSeen: Date.now(),
+      registeredAt: Date.now(),
+      restoreSessionId: restoreId,
+    };
+    clients.set(token, fresh);
+    if (state.remoteAcquired && restoreId && restoreId === state.pinnedSessionId) fresh.remoteSessionId = restoreId;
+    state.everHadClient = true;
+    grace.cancel();
+    grace.resetBackoff();
+    grace.startSweep();
+    log(`client registered token=${token} lead=${pid} cwd=${cwd || '-'}`);
+    // The unified daemon starts the channels runtime (automation, webhooks)
+    // only once a CHANNELS client is actually present — a
+    // session runtime-only daemon must not run tunnels nobody asked for.
+    if (typeof onClientRegistered === 'function') {
+      try {
+        onClientRegistered({ token, leadPid: pid, cwd: cwd || null });
+      } catch {
+        // The registered-client hook must not fail the registration itself.
+      }
+    }
+    // Token replacement never crosses leadPid boundaries. Registration is
+    // otherwise transport-only, including same-pid fresh attaches.
+    const replaced = passive && replacementToken ? clients.get(replacementToken) : null;
+    if (replaced && replaced.leadPid === pid) adoptReplacedClient(fresh, replaced);
+    if (replayId) {
+      replays.remember(replayId, {
+        token,
+        leadPid: pid,
+        cwd: cwd || null,
+        replaceToken: replacementToken,
+        restoreSessionId: restoreId,
+        responseFinished: false,
+        timer: null,
+      });
+    }
+    return token;
+  }
+
+  return { registerClient, cancelReplacementRegistration };
+}

package/src/standalone/channel-transport/client-registry.mjs

@@ -3,6 +3,8 @@
  * transport: the live client records, registration with reconnect
  * replacement, pid-liveness pruning, and the UI control pointer lookup. The
  * supporting state machines live under ./client-registry/:
+ *   client-records       — live records, removal, pruning, pointer lookup
+ *   client-registration  — registration, replay and reconnect replacement
  *   registration-replays — response-loss replay records and their TTL
  *   client-grace         — self-shutdown grace timer + dead-pid sweep
  *   sse-attach           — binding a client's notify stream
@@ -11,14 +13,10 @@
  * pointerToken, everHadClient, closed, remoteAcquired, pinnedSessionId,
  * stickyRemoteFrame.
  */
-import { randomUUID } from 'node:crypto';
-import { isPidAlive, parsePid } from '../../runtime/shared/pid-liveness.mjs';
 import { createClientGrace } from './client-registry/client-grace.mjs';
-import {
-  createRegistrationReplays,
-  replayMatchesCancellation,
-  replayMatchesRegistration,
-} from './client-registry/registration-replays.mjs';
+import { createClientRecords } from './client-registry/client-records.mjs';
+import { createClientRegistration } from './client-registry/client-registration.mjs';
+import { createRegistrationReplays } from './client-registry/registration-replays.mjs';
 import { attachClientStream } from './client-registry/sse-attach.mjs';
 
 export function createClientRegistry({
@@ -37,162 +35,25 @@ export function createClientRegistry({
     ttlMs: registrationReplayTtlMs,
     onExpiredUnflushed: (token) => dropClient(token, 'unflushed registration replay expired'),
   });
-  const grace = createClientGrace({ state, clients, log, clientGraceMs, sweepMs, onClientsEmpty, pruneDeadClients });
-
-  // pid death is the authoritative signal for client liveness: a client whose
-  // SSE stream closed may still reconnect, one whose lead pid is gone cannot.
-  function pruneDeadClients() {
-    for (const [token, c] of clients) {
-      if (!isPidAlive(c.leadPid)) dropClient(token, 'pid dead');
-    }
-  }
-
-  function liveClients() {
-    const out = [];
-    for (const [token, c] of clients) {
-      if (isPidAlive(c.leadPid)) out.push([token, c]);
-    }
-    return out;
-  }
-
-  // Every removal path uses this primitive, including replacement's deliberate
-  // no-failover retirement, so replay records/timers never target absent tokens.
-  function removeClientRecord(token) {
-    const c = clients.get(token);
-    if (!c) return null;
-    clients.delete(token);
-    replays.forgetFor(token);
-    try {
-      c.sse?.end?.();
-    } catch {}
-    return c;
-  }
-
-  function dropClient(token, reason) {
-    const c = removeClientRecord(token);
-    if (!c) return;
-    if (state.pointerToken === token) state.pointerToken = null;
-    log(`client ${token} (lead=${c.leadPid}) removed: ${reason}`);
-    // Client presence is not channel authority. The durable session pin stays
-    // active until that same session explicitly turns Remote OFF.
-    publishRemoteState();
-    grace.maybeArm('client removed');
-  }
-
-  function cancelReplacementRegistration(request) {
-    const replay = replays.lookup(request.registrationId);
-    if (!replay) return 'missing';
-    if (!replayMatchesCancellation(replay, request)) return 'forbidden';
-    dropClient(replay.token, 'replacement deregister');
-    return 'cancelled';
-  }
-
-  // Resolve the active UI pointer for state delivery only. Session routing
-  // never depends on this client.
-  function resolveTarget() {
-    if (state.pointerToken) {
-      const c = clients.get(state.pointerToken);
-      if (c && isPidAlive(c.leadPid)) return c;
-      if (c) dropClient(state.pointerToken, 'pid dead (notify-time)');
-      else state.pointerToken = null;
-    }
-    return null;
-  }
-
-  /** A passive reconnect retrying under a known registration id gets the fresh
-   *  token it already created; a different identity under that id is a 409. */
-  function replayedToken(replayId, identity) {
-    const existing = replays.lookup(replayId);
-    if (!existing) return null;
-    if (replayMatchesRegistration(existing, identity) && clients.has(existing.token)) {
-      replays.arm(replayId, existing);
-      log(`client reconnect replay token=${existing.token} lead=${identity.pid}`);
-      return existing.token;
-    }
-    if (clients.has(existing.token)) {
-      const err = new Error('registration replay identity mismatch');
-      err.statusCode = 409;
-      throw err;
-    }
-    replays.remove(replayId, existing);
-    return null;
-  }
-
-  /** A reconnect names the exact token it replaces. Token-scoped state belongs
-   *  to the logical client, so the fresh record inherits the buffered frame,
-   *  remote session and pointer; the old token is retired even when it is not
-   *  the pointer — retaining it would let it later call or accumulate a
-   *  buffered frame after the fresh client has gone away. */
-  function adoptReplacedClient(fresh, replaced) {
-    const replacedWasPointer = state.pointerToken === replaced.token;
-    if (replaced.pendingRemoteStateFrame) {
-      fresh.pendingRemoteStateFrame = replaced.pendingRemoteStateFrame;
-      replaced.pendingRemoteStateFrame = null;
-    }
-    if (replaced.remoteSessionId) fresh.remoteSessionId = replaced.remoteSessionId;
-    if (replaced.restoreSessionId) fresh.restoreSessionId = replaced.restoreSessionId;
-    if (replacedWasPointer) state.pointerToken = fresh.token;
-    removeClientRecord(replaced.token);
-    log(`client reconnect replaced token=${replaced.token} -> ${fresh.token} lead=${fresh.leadPid}`);
-  }
-
-  function registerClient({
-    leadPid,
-    cwd,
-    passive = false,
-    replaceToken = null,
-    registrationId = null,
-    restoreSessionId = null,
-  }) {
-    const pid = parsePid(leadPid) ?? 0;
-    const restoreId = /^[A-Za-z0-9_-]+$/.test(String(restoreSessionId || '')) ? String(restoreSessionId) : null;
-    const replacementToken = replaceToken ? String(replaceToken) : null;
-    const replayId = passive && registrationId ? replays.replayIdOf(registrationId) : null;
-    const replayed = replayedToken(replayId, { pid, cwd, replacementToken, restoreId });
-    if (replayed) return replayed;
-    const token = randomUUID();
-    const fresh = {
-      token,
-      leadPid: pid,
-      cwd: cwd || null,
-      sse: null,
-      pendingRemoteStateFrame: null,
-      lastSeen: Date.now(),
-      registeredAt: Date.now(),
-      restoreSessionId: restoreId,
-    };
-    clients.set(token, fresh);
-    if (state.remoteAcquired && restoreId && restoreId === state.pinnedSessionId) fresh.remoteSessionId = restoreId;
-    state.everHadClient = true;
-    grace.cancel();
-    grace.resetBackoff();
-    grace.startSweep();
-    log(`client registered token=${token} lead=${pid} cwd=${cwd || '-'}`);
-    // The unified daemon starts the channels runtime (automation, webhooks,
-    // messaging provider) only once a CHANNELS client is actually present — a
-    // session runtime-only daemon must not run tunnels nobody asked for.
-    if (typeof onClientRegistered === 'function') {
-      try {
-        onClientRegistered({ token, leadPid: pid, cwd: cwd || null });
-      } catch {}
-    }
-    // Token replacement never crosses leadPid boundaries. Registration is
-    // otherwise transport-only, including same-pid fresh attaches.
-    const replaced = passive && replacementToken ? clients.get(replacementToken) : null;
-    if (replaced && replaced.leadPid === pid) adoptReplacedClient(fresh, replaced);
-    if (replayId) {
-      replays.remember(replayId, {
-        token,
-        leadPid: pid,
-        cwd: cwd || null,
-        replaceToken: replacementToken,
-        restoreSessionId: restoreId,
-        responseFinished: false,
-        timer: null,
-      });
-    }
-    return token;
-  }
+  const grace = createClientGrace({
+    state,
+    clients,
+    log,
+    clientGraceMs,
+    sweepMs,
+    onClientsEmpty,
+    pruneDeadClients: () => records.pruneDeadClients(),
+  });
+  const records = createClientRecords({ state, log, publishRemoteState, replays, grace });
+  const { liveClients, dropClient, resolveTarget } = records;
+  const { registerClient, cancelReplacementRegistration } = createClientRegistration({
+    state,
+    log,
+    onClientRegistered,
+    replays,
+    grace,
+    records,
+  });
 
   function attachSse(token, res) {
     const c = clients.get(token);

package/src/standalone/channel-transport.mjs

@@ -10,7 +10,7 @@
 // This module owns ONLY the transport (sockets, client registry, notify
 // routing and lifecycle). The channels runtime is injected via `handleCall`
 // so the same transport is exercised by the real daemon entry AND the smoke
-// harness (stub runtime, no Discord token).
+// harness (stub runtime).
 //
 // Composition root: the shared transport state below is read and written by
 // the sub-services in channel-transport/ (remote binding, client registry,

package/src/standalone/daemon-channels-loader.mjs

@@ -26,16 +26,16 @@ export function createChannelsRuntimeLoader({ log, onLoaded = () => {}, setOwner
     return channelsReady;
   }
 
-  // Channels bring automation with them (schedules, webhook listener + tunnel,
-  // optional messaging service). A daemon spawned by a TUI starts them exactly
-  // as before; a daemon spawned for session views stays dormant until a channels
-  // client actually registers, so an app-only service runs no tunnels.
+  // Channels bring automation with them (schedules, webhook listener + tunnel).
+  // A daemon spawned by a TUI starts them exactly as before; a daemon spawned
+  // for session views stays dormant until a channels client actually registers,
+  // so an app-only service runs no tunnels. The channel bridge is activated
+  // separately, by the activate_channel_bridge call.
   let channelsStartPromise = null;
-  function start(options = {}) {
+  function start() {
     if (channelsStartPromise) return channelsStartPromise;
-    const messaging = options.messaging === true;
     channelsStartPromise = ensure()
-      .then((module) => module.start({ messaging }))
+      .then((module) => module.start({ bridge: false }))
       .catch((e) => {
         channelsStartPromise = null;
         log(`channels.start failed (non-fatal): ${e?.message || e}`);
@@ -50,7 +50,9 @@ export function createChannelsRuntimeLoader({ log, onLoaded = () => {}, setOwner
     if (ctx && BINDING_TOOLS.has(name)) {
       try {
         setOwnerContext({ leadPid: ctx.leadPid, cwd: ctx.cwd });
-      } catch {}
+      } catch {
+        // Binding context is advisory; the tool call still runs without it.
+      }
     }
     return module.handleToolCall(name, args || {});
   }

package/src/standalone/daemon-session-control/list-page.mjs

@@ -0,0 +1,72 @@
+import { sessionBotOf } from '../../session-runtime/bot-status.mjs';
+import { isAgentOnlySession } from '../../runtime/agent/orchestrator/session/store-summary-visibility.mjs';
+import { activityOf, encodeCatalogCursor } from '../../runtime/agent/orchestrator/session/catalog-db/schema.mjs';
+
+// The keyset position before every catalog row: a page continuing from a
+// pinned live row starts over at the top of the catalog order.
+export const TOP_CURSOR = encodeCatalogCursor({ id: '', lastUsedAt: Number.MAX_SAFE_INTEGER });
+
+/** Throws unless the list's opt-in flags are booleans when given. */
+export function assertListFlags(args) {
+  for (const flag of ['include_agents', 'include_archived']) {
+    if (args[flag] !== undefined && typeof args[flag] !== 'boolean') {
+      throw new Error(`session: ${flag} must be a boolean`);
+    }
+  }
+}
+
+/** Whether the listing keeps a catalog row: sub-agent sessions and archived
+ *  ones (`archived`, the desktop's flags) only on request. */
+export function listRowFilter(args, archived) {
+  return (row) =>
+    (args.include_agents === true || !isAgentOnlySession(row)) &&
+    (args.include_archived === true || !Object.hasOwn(archived, row.id));
+}
+
+/** A row with the live work of `live` (storedLiveWork) overlaid. */
+export function liveRowOverlay(live) {
+  return (row) => {
+    const working = row.working === true || live.own.has(row.id);
+    const agentWorking = row.agentWorking === true || live.agents.has(row.id);
+    if (!working && !agentWorking) return row;
+    return {
+      ...row,
+      ...(working ? { working: true, liveAt: live.own.get(row.id) || 0 } : {}),
+      ...(agentWorking ? { agentWorking: true } : {}),
+    };
+  };
+}
+
+const liveActivity = (row) => Math.max(row.liveAt || 0, activityOf(row), Number(row.updatedAt) || 0);
+
+/** Every session with live work in `live`, each once. */
+export function liveCandidates(live) {
+  return [...new Set([...live.own.keys(), ...live.agents])];
+}
+
+/** The live rows a first page leads with: kept like the listing, overlaid,
+ *  newest sign of work first, at most `limit`. */
+export function pinnedLiveRows(rows, keep, withLive, limit) {
+  return rows
+    .filter((row) => row && keep(row))
+    .map(withLive)
+    .sort((left, right) => liveActivity(right) - liveActivity(left) || (left.id < right.id ? -1 : 1))
+    .slice(0, limit);
+}
+
+/** The page's sessions: the pinned live rows, then the scanned ones overlaid,
+ *  archived ones marked. */
+export function listedSessions(pinned, scanned, withLive, archived) {
+  return [...pinned, ...scanned.map(withLive)].map((row) =>
+    Object.hasOwn(archived, row.id) ? { ...row, archived: true } : row
+  );
+}
+
+/** sessionListOutput options: rich rows for the human, or only the caller
+ *  bot's own (`own`, scopedBot); a pinned row continues from the top. */
+export function listOutputOptions(own, pinnedIds) {
+  return {
+    rich: own ? (row) => sessionBotOf(row) === own : own !== null,
+    cursorOf: (row) => (pinnedIds.has(row.id) ? TOP_CURSOR : encodeCatalogCursor(row)),
+  };
+}

package/src/standalone/daemon-session-control/request.mjs

@@ -0,0 +1,51 @@
+import { SESSION_ID_PATTERN } from '../../runtime/agent/orchestrator/runtime-core/session-id.mjs';
+
+const TARGET_ACTIONS = new Set(['status', 'read', 'send', 'cancel', 'delete']);
+const MUTATING_ACTIONS = new Set(['send', 'cancel', 'delete']);
+
+/** The calling session of a `session` request; throws on an action the tool
+ *  does not run or a request without a valid caller session. */
+export function requestCaller(action, context) {
+  if (
+    action !== 'list' &&
+    action !== 'create' &&
+    action !== 'bots' &&
+    action !== 'worktree' &&
+    action !== 'route' &&
+    !TARGET_ACTIONS.has(action)
+  ) {
+    throw new Error(`session: unsupported remote action "${action}"`);
+  }
+  const caller = context.callerSessionId;
+  if (typeof caller !== 'string' || !SESSION_ID_PATTERN.test(caller)) {
+    throw new Error('session: caller session is required');
+  }
+  return caller;
+}
+
+/** The addressed session and transcript paging of a `list` or target action:
+ *  `{ sessionId, limit, offset, textOffset }`; throws on a missing target, a
+ *  self mutation or paging out of range. */
+export function targetRequest(args, action, caller) {
+  const sessionId = typeof args.session_id === 'string' ? args.session_id.trim() : '';
+  if (TARGET_ACTIONS.has(action) && !SESSION_ID_PATTERN.test(sessionId)) {
+    throw new Error(`session: session_id is required for action=${action}`);
+  }
+  if (MUTATING_ACTIONS.has(action) && sessionId === caller) {
+    throw new Error(`session: ${action} must target another session`);
+  }
+  const limit = args.limit ?? 25;
+  if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+    throw new Error('session: limit must be an integer from 1 to 100');
+  }
+  const offset = args.offset ?? 0;
+  const textOffset = args.text_offset ?? 0;
+  if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(offset + limit)) {
+    throw new Error('session: offset must be a nonnegative safe integer');
+  }
+  if (!Number.isSafeInteger(textOffset) || textOffset < 0) throw new Error('session: invalid text_offset');
+  if (args.text_offset !== undefined && (args.offset === undefined || limit !== 1 || !args.item_id)) {
+    throw new Error('session: text_offset requires offset, limit:1 and item_id from read');
+  }
+  return { sessionId, limit, offset, textOffset };
+}

package/src/standalone/daemon-session-control/room-host.mjs

@@ -0,0 +1,57 @@
+import { rememberSubmissionBotChain } from '../../runtime/shared/bot-hops.mjs';
+import { agentRoomHost } from '../../runtime/shared/agent-room-host.mjs';
+
+/** The member a send to room log `sessionId` addresses, through the desktop
+ *  room host: `{ host, agentId, sessionId, text }`; throws when no desktop is
+ *  attached or no member resolves. */
+export async function roomAddressee(sessionId, args) {
+  let host;
+  try {
+    host = agentRoomHost();
+  } catch (error) {
+    throw new Error(`session: cannot send to ${sessionId}: ${error.message}`);
+  }
+  const member = await host.member(sessionId, { to: args.to, prompt: args.prompt }).catch((error) => {
+    throw new Error(`session: ${error?.message || error}`);
+  });
+  return { host, ...member };
+}
+
+/** The submit of a send to `room` (roomAddressee) at room log `sessionId`:
+ *  the member's turn carries the send's hop (`transcriptMeta.hop`), so a
+ *  chain through the room counts on toward MAX_BOT_HOPS; its bot chain is
+ *  recorded under every submission id that turn may take. */
+export function roomSubmitter(room, sessionId, prompt, from) {
+  return async ({ id, onSettled, follow, transcriptMeta } = {}) => {
+    rememberSubmissionBotChain(id, transcriptMeta?.botChain);
+    const followed = follow
+      ? (submissionId) => {
+          rememberSubmissionBotChain(submissionId, transcriptMeta?.botChain);
+          return follow(submissionId);
+        }
+      : null;
+    return {
+      accepted:
+        (await room.host.ask(sessionId, {
+          agentId: room.agentId,
+          prompt,
+          from,
+          ...(id ? { id } : {}),
+          ...(transcriptMeta?.hop > 0 ? { hop: transcriptMeta.hop } : {}),
+          ...(onSettled ? { onSettled } : {}),
+          ...(followed ? { follow: followed } : {}),
+        })) === true,
+    };
+  };
+}
+
+/** Stops the exchange of room log `sessionId` through the desktop room host. */
+export function stopRoomExchange(sessionId) {
+  let host;
+  try {
+    host = agentRoomHost();
+  } catch (error) {
+    throw new Error(`session: cannot cancel ${sessionId}: ${error.message}`);
+  }
+  return { sessionId, aborted: host.stop(sessionId) === true };
+}

package/src/standalone/daemon-session-control/route-control.mjs

@@ -0,0 +1,48 @@
+import { SESSION_ID_PATTERN } from '../../runtime/agent/orchestrator/runtime-core/session-id.mjs';
+
+// The route methods the setup tool reaches on another session (all on the
+// session protocol's configure allowlist), through the same configure lane
+// the desktop's model picker and quota card use.
+const ROUTE_METHODS = new Set(['setRoute', 'continueSessionInModel', 'scheduleQuotaResume', 'cancelQuotaResume']);
+const ROUTE_FIELDS = [
+  'provider',
+  'model',
+  'effort',
+  'fast',
+  'autoEffort',
+  'modelParameters',
+  'contextPercent',
+  'contextTokens',
+];
+
+// Only route fields cross: no option of the picker's write (keepMainModel,
+// applyToCurrentSession) can ride along and change the Lead route.
+function routeFields(input) {
+  const route = {};
+  for (const key of ROUTE_FIELDS) if (input?.[key] !== undefined && input[key] !== null) route[key] = input[key];
+  if (!route.provider || !route.model) throw new Error('session: route provider and model are required');
+  return route;
+}
+
+/**
+ * One route method on another session, for the setup tool
+ * (setup-tool/session-route-actions.mjs): `setRoute` is the session's own
+ * model pick (session-only, from its next turn: a running turn finishes on
+ * its model), the others its quota card's buttons. The caller's own session
+ * is changed by its runtime directly, never through here.
+ */
+export function createRouteControl(getSessionService) {
+  return async function routeControl(args, caller) {
+    const sessionId = typeof args.session_id === 'string' ? args.session_id.trim() : '';
+    if (!SESSION_ID_PATTERN.test(sessionId)) throw new Error('session: session_id is required for action=route');
+    if (sessionId === caller) throw new Error('session: route control must target another session');
+    if (!ROUTE_METHODS.has(args.method)) throw new Error(`session: unsupported route method "${args.method}"`);
+    const service = getSessionService();
+    if (!service) throw new Error('session: session service is unavailable');
+    let input = [sessionId];
+    if (args.method === 'setRoute') input = [{ ...routeFields(args.input), sessionOnly: true }];
+    else if (args.method === 'continueSessionInModel') input = [sessionId, routeFields(args.input)];
+    const result = await service.configureSession({ sessionId, action: args.method, args: input }, { revision: 1 });
+    return result.value;
+  };
+}