mixdog 1.4.0 → 1.4.2

package/src/runtime/agent/orchestrator/session/manager/rules-cache.mjs

@@ -59,15 +59,19 @@ function omitToolsKey(omitTools) {
     .join(',');
 }
 
-export function _buildSharedRules({ omitTools = [], allowTools = null } = {}) {
+export function _buildSharedRules({ omitTools = [], allowTools = null, ownerIsAgent = false } = {}) {
   const PLUGIN_ROOT = mixdogRoot();
   const RULES_DIR = join(PLUGIN_ROOT, 'rules');
   return buildCachedRules(
     'buildSharedToolContent',
     'shared tool rules',
     [join(RULES_DIR, 'shared')],
-    { PLUGIN_ROOT, DATA_DIR: resolvePluginData(), omitTools, allowTools },
-    JSON.stringify([omitToolsKey(omitTools), Array.isArray(allowTools) ? omitToolsKey(allowTools) : null])
+    { PLUGIN_ROOT, DATA_DIR: resolvePluginData(), omitTools, allowTools, ownerIsAgent },
+    JSON.stringify([
+      omitToolsKey(omitTools),
+      Array.isArray(allowTools) ? omitToolsKey(allowTools) : null,
+      ownerIsAgent === true,
+    ])
   );
 }
 
@@ -98,14 +102,22 @@ export function _buildRouteRules({ provider = null, model = null, omitTools = []
 
 // BP1 = shared tool policy followed by this route's rules. Every site that
 // renders or re-identifies the BP1 block must use this one composition.
-export function _buildBaseRules({ provider = null, model = null, omitTools = [], allowTools = null } = {}) {
-  return [_buildSharedRules({ omitTools, allowTools }), _buildRouteRules({ provider, model, omitTools, allowTools })]
+export function _buildBaseRules({
+  provider = null,
+  model = null,
+  omitTools = [],
+  allowTools = null,
+  ownerIsAgent = false,
+} = {}) {
+  return [
+    _buildSharedRules({ omitTools, allowTools, ownerIsAgent }),
+    _buildRouteRules({ provider, model, omitTools, allowTools }),
+  ]
     .filter(Boolean)
     .join('\n\n---\n\n');
 }
 
-export function _buildAgentRules(profile = 'full') {
-  const key = String(profile || 'full');
+export function _buildAgentRules() {
   const PLUGIN_ROOT = mixdogRoot();
   const DATA_DIR = resolvePluginData();
   const RULES_DIR = join(PLUGIN_ROOT, 'rules');
@@ -113,8 +125,8 @@ export function _buildAgentRules(profile = 'full') {
     'buildAgentRoleContent',
     'agent role rules',
     [join(RULES_DIR, 'agent'), join(DATA_DIR, 'mixdog-config.json')],
-    { PLUGIN_ROOT, DATA_DIR, profile: key },
-    key
+    { PLUGIN_ROOT, DATA_DIR },
+    'full'
   );
 }
 
@@ -201,9 +213,14 @@ export function _buildLeadLanguage() {
   });
 }
 
-export function _buildLeadLanguageContext() {
+export function _buildLeadLanguageContext({ includeOutputStyle = true } = {}) {
+  const PLUGIN_ROOT = mixdogRoot();
   const DATA_DIR = resolvePluginData();
-  return buildCachedRules('buildLeadLanguageContent', 'lead language context', [join(DATA_DIR, 'mixdog-config.json')], {
-    DATA_DIR,
-  });
+  return buildCachedRules(
+    'buildLeadLanguageContent',
+    'lead language context',
+    [join(DATA_DIR, 'mixdog-config.json'), join(PLUGIN_ROOT, 'output-styles'), join(DATA_DIR, 'output-styles')],
+    { PLUGIN_ROOT, DATA_DIR, includeOutputStyle },
+    includeOutputStyle ? 'style' : 'no-style'
+  );
 }

package/src/runtime/agent/orchestrator/session/manager/runtime-liveness.mjs

@@ -17,6 +17,10 @@
 //   stage, lastStreamDeltaAt, lastTransportAt, firstSemanticAt,
 //   lastSemanticAt, lastReasoningAt, lastVisibleTextAt, lastToolProtocolAt,
 //   lastToolCall, lastError, updatedAt,
+//   modelRequestStartedAt, requestTransportAt, requestFirstSemanticAt,
+//   modelResponseAccepted,  // the current logical model request (see
+//                           // _setLogicalModelRequest); the fields above
+//                           // stay turn-level history
 //   controller?: AbortController,  // set while an ask is in flight
 //   generation?: number,            // snapshot taken at ask start
 //   closed?: boolean,               // flipped by closeSession()
@@ -31,6 +35,7 @@ import { registerSessionPurgeHook } from '../store.mjs';
 import { finishComputerTurn } from '../../../../computer-bridge/client.mjs';
 import { configureUsageMetricsRuntime, dropMetricSeenState, bumpUsageMetricsTurnId } from './usage-metrics.mjs';
 import { runtimeState as _runtimeState, isTurnInFlight } from './runtime-state.mjs';
+import { resetTurnShellReap } from './turn-reap.mjs';
 
 export { IN_FLIGHT_STAGES, inFlightSessionActivity } from './runtime-state.mjs';
 
@@ -131,6 +136,23 @@ function _startToolActivityHeartbeat(id) {
   _toolActivityHeartbeats.set(id, timer);
 }
 
+// One logical model request owns one first-output allowance: its request
+// clock and its own first transport / first semantic marks. It begins with the
+// ask's first request, with the first request after the model's previous
+// response was accepted (its tool calls ran — the request that carries the
+// tool results), and with a request after a settled turn. Every other entry
+// into `requesting` — a provider or loop retry, a route fallback, a no-tool
+// recovery continuation — re-sends the same logical request and keeps all of
+// it, so a retry never earns a fresh allowance. The turn-level marks
+// (firstSemanticAt, lastTransportAt, …) are history and are not touched.
+// `startedAt` null: no request yet (an ask starting).
+function _setLogicalModelRequest(entry, startedAt) {
+  entry.modelRequestStartedAt = startedAt;
+  entry.requestTransportAt = null;
+  entry.requestFirstSemanticAt = null;
+  entry.modelResponseAccepted = false;
+}
+
 export function updateSessionStage(id, stage) {
   if (stage === MODEL_THINKING_STAGE) {
     markSessionRequestSent(id);
@@ -143,8 +165,11 @@ export function updateSessionStage(id, stage) {
   entry.stage = stage;
   // A new stage (a retried attempt included) has not sent its request yet.
   entry.requestSentAt = null;
-  if (stage === 'requesting' && priorStage !== 'requesting') {
-    entry.modelRequestStartedAt = now;
+  if (
+    stage === 'requesting' &&
+    (!entry.modelRequestStartedAt || entry.modelResponseAccepted || TERMINAL_STAGES.has(priorStage))
+  ) {
+    _setLogicalModelRequest(entry, now);
   }
   entry.lastProgressAt = now;
   entry.updatedAt = now;
@@ -192,7 +217,8 @@ export function markSessionAskStart(id) {
   // after provider admission (the scheduler emits stage=requesting).
   const now = Date.now();
   entry.askStartedAt = now;
-  entry.modelRequestStartedAt = null;
+  resetTurnShellReap(id, entry);
+  _setLogicalModelRequest(entry, null);
   entry.lastProgressAt = now;
   entry.updatedAt = now;
   entry.taskWaits = 0;
@@ -229,13 +255,14 @@ export function markSessionTransportActivity(id) {
   if (!entry || entry.closed || entry.controller?.signal?.aborted || TERMINAL_STAGES.has(entry.stage)) return;
   const now = Date.now();
   entry.lastTransportAt = now;
+  entry.requestTransportAt = now;
   entry.updatedAt = now;
 }
 function _normalizeModelProgressKind(kind) {
   let value = 'semantic';
   if (typeof kind === 'string') value = kind;
   else if (kind && typeof kind.kind === 'string') value = kind.kind;
-  if (value === 'transport' || value === 'reasoning' || value === 'text' || value === 'tool') {
+  if (value === 'transport' || value === 'keepalive' || value === 'reasoning' || value === 'text' || value === 'tool') {
     return value;
   }
   return 'semantic';
@@ -257,12 +284,22 @@ export async function markSessionStreamDelta(id, kind = 'semantic') {
     markSessionTransportActivity(id);
     return;
   }
+  if (progressKind === 'keepalive') {
+    markSessionTransportActivity(id);
+    // A keepalive before the request's first semantic event is covered by the
+    // first-output window and never counts as progress. lastProgressAt stays
+    // untouched: the watchdog caps how long keepalives may extend it.
+    if (entry.requestFirstSemanticAt) entry.lastKeepaliveAt = Date.now();
+    return;
+  }
   _stopToolActivityHeartbeat(id);
   const now = Date.now();
   // Every semantic model event also proves transport health. The inverse is
   // intentionally false: raw chunks/keepalives update only lastTransportAt.
   entry.lastTransportAt = now;
+  entry.requestTransportAt = now;
   if (!entry.firstSemanticAt) entry.firstSemanticAt = now;
+  if (!entry.requestFirstSemanticAt) entry.requestFirstSemanticAt = now;
   entry.lastSemanticAt = now;
   entry.lastSemanticKind = progressKind;
   if (progressKind === 'reasoning') entry.lastReasoningAt = now;
@@ -296,7 +333,12 @@ export function markSessionToolCall(id, toolName) {
   entry.toolOutputTailAt = null;
   entry.toolStartedAt = Date.now();
   entry.lastTransportAt = entry.toolStartedAt;
+  entry.requestTransportAt = entry.toolStartedAt;
   if (!entry.firstSemanticAt) entry.firstSemanticAt = entry.toolStartedAt;
+  if (!entry.requestFirstSemanticAt) entry.requestFirstSemanticAt = entry.toolStartedAt;
+  // The response whose tool call runs now was accepted: the next model
+  // request carries its tool results and is a new logical request.
+  entry.modelResponseAccepted = true;
   entry.lastSemanticAt = entry.toolStartedAt;
   entry.lastSemanticKind = 'tool';
   entry.lastToolProtocolAt = entry.toolStartedAt;
@@ -436,6 +478,18 @@ export function markSessionCancelled(id) {
   entry.emptyFinalAt = null;
   _unlinkParentAbortListener(entry);
 }
+/**
+ * The session's current logical model request: when it started and whether
+ * it has produced semantic output yet. A provider stream opened for it — a
+ * retry or a route fallback included — bounds its first-output phase by this
+ * request instead of starting a fresh one. Null without a request.
+ */
+export function getLogicalModelRequest(sessionId) {
+  const entry = sessionId ? _runtimeState.get(sessionId) : null;
+  if (!entry?.modelRequestStartedAt) return null;
+  return { startedAt: entry.modelRequestStartedAt, outputSeen: Boolean(entry.requestFirstSemanticAt) };
+}
+
 export function getSessionRuntime(id) {
   return id ? _runtimeState.get(id) || null : null;
 }
@@ -458,8 +512,10 @@ export function getSessionProgressSnapshot(sessionId) {
   const firstActivityAt = firstSemanticAt;
   const stage = entry.stage || 'idle';
   const activeModelStage = stage === 'connecting' || stage === 'requesting' || stage === 'streaming';
-  const waitingForTransport = Boolean(modelRequestStartedAt && activeModelStage && !entry.lastTransportAt);
-  const waitingForFirstSemantic = Boolean(modelRequestStartedAt && activeModelStage && !firstSemanticAt);
+  // Judged per logical model request: output an earlier request of this turn
+  // produced never ends a later request's first-output phase.
+  const waitingForTransport = Boolean(modelRequestStartedAt && activeModelStage && !entry.requestTransportAt);
+  const waitingForFirstSemantic = Boolean(modelRequestStartedAt && activeModelStage && !entry.requestFirstSemanticAt);
   return {
     stage,
     askStartedAt,
@@ -481,6 +537,7 @@ export function getSessionProgressSnapshot(sessionId) {
     toolOutputTail: entry.toolOutputTail || null,
     toolOutputTailAt: entry.toolOutputTailAt || 0,
     lastProgressAt: entry.lastProgressAt || 0,
+    lastKeepaliveAt: entry.lastKeepaliveAt || 0,
     updatedAt: entry.updatedAt || 0,
     hasFirstActivity: Boolean(firstSemanticAt && (!askStartedAt || firstSemanticAt >= askStartedAt)),
     hasFirstSemantic: Boolean(firstSemanticAt && (!askStartedAt || firstSemanticAt >= askStartedAt)),

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -30,6 +30,7 @@ import { releaseReadSnapshotScope } from '../../tools/builtin/snapshot-store.mjs
 import { cancelOwnedShellTrees } from '../../tools/lib/owned-shell-trees.mjs';
 import { noteShellOwnerSessionClosed } from '../../tools/builtin/lib/shell-job-records.mjs';
 import { forgetSideQuestion } from '../side-question-store.mjs';
+import { cancelBackgroundTasks } from '../../../../shared/background-tasks.mjs';
 
 /**
  * Close a session. Plants a `closed=true` tombstone on disk with a bumped
@@ -214,6 +215,12 @@ function cancelOwnedShellProcesses({ id, reason, tombstone }) {
   } catch {
     unconfirmed();
   }
+  // What a finished command left running is a tracked task, not an owned tree.
+  try {
+    cancelBackgroundTasks({ surface: 'shell', executionSessionId: id, reason, notify: false });
+  } catch {
+    unconfirmed();
+  }
   noteShellOwnerSessionClosed(id);
 }
 

package/src/runtime/agent/orchestrator/session/manager/session-crud.mjs

@@ -14,6 +14,7 @@ import { runSessionCompaction, resolveSessionCompactionPolicy } from './compacti
 import {
   currentContextEstimateTokens,
   invalidateContextUsageSnapshot,
+  invalidateProviderContextBaseline,
   recordContextUsageSnapshot,
   resolveGaugeContextTokens,
 } from '../loop/compact-policy.mjs';
@@ -26,6 +27,8 @@ import {
 import { getProvider } from '../../providers/registry.mjs';
 import { isSessionCompactionBlocked, getSessionAbortSignal, _runtimeEntries } from './runtime-liveness.mjs';
 import { mintSessionId } from './session-id.mjs';
+import { useOwnScratchEnvironment } from './session-scratch-environment.mjs';
+import { rebindToChangedPrefix } from '../thinking-binding.mjs';
 import { hideCompactionArchive } from '../compaction-archive-capture.mjs';
 import { writeStderrBestEffort } from '../../../../shared/best-effort-stderr.mjs';
 import { forgetSideQuestion } from '../side-question-store.mjs';
@@ -234,6 +237,18 @@ function forkOutgoingTranscript(session, messages, now, archiveAs = '') {
       ...clearedTokenAccounting(now),
     };
     delete fork.liveTurnMessages;
+    // The spread copied the source's environment: the fork names its own
+    // scratch directory (its shell commands use it), not the source's.
+    if (useOwnScratchEnvironment(fork)) {
+      // The system prefix changed: thinking stored in the copy was bound to the
+      // source's prefix (and an open tool round ended), and every measurement
+      // taken against it is stale. Resume then finds a matching prefix and
+      // would repair nothing.
+      fork.messages = rebindToChangedPrefix(fork.messages);
+      delete fork._providerPrefixGuardState;
+      invalidateContextUsageSnapshot(fork);
+      invalidateProviderContextBaseline(fork);
+    }
     // The archive sidecar belongs to the source id; the fork has none.
     if (fork.compaction?.archive) {
       fork.compaction = { ...fork.compaction };

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -42,11 +42,14 @@ import { ensureCodexWireSessionId, mintSessionId } from './session-id.mjs';
 import { providerCacheKey } from './provider-cache-key.mjs';
 import { buildSessionRecord, normalizeDesktopSessionMetadata, sessionOriginFields } from './session-record.mjs';
 import { normalizeWorkflowRoute } from '../../runtime-core/workflow.mjs';
+import { executionFallbacks } from '../../../../shared/model-route-chain.mjs';
 import { ownerRouteFallbacks } from './owner-route-fallbacks.mjs';
 import { applyPendingWorkspaceReroot, refreshSessionBp3Environment } from './prompt-utils.mjs';
 import { isWorktreeBound } from '../../../../shared/worktrees/contract.mjs';
-import { applyAgentToolExposure } from '../loop/tool-exposure-migration.mjs';
+import { applyAgentToolExposure, markToolSurfaceMigrated } from '../loop/tool-exposure-migration.mjs';
+import { useOwnScratchEnvironment } from './session-scratch-environment.mjs';
 import { prewarmSessionAutoEffort } from './ask-turn-auto-effort.mjs';
+import { cancelCacheWarm } from '../cache-warm.mjs';
 
 // Durable turn-checkpoint recovery; re-exported so prior importers of this
 // module stay unchanged.
@@ -162,9 +165,9 @@ function resolveSessionRoute(opts, presetObj, profile) {
   const modelName = opts.model || presetObj?.model;
   // opts.tools (caller-supplied) wins over presetObj.tools — caller
   // intent ('tools:readonly' from Pool C, etc.) must override the
-  // preset's default 'full'. Previous priority let HAIKU's tools='full'
-  // shadow Pool C's explicit readonly request, leaking write tools and
-  // bash into a read-only agent.
+  // preset's default 'full'; otherwise a preset's tools='full' would shadow
+  // an explicit readonly request and leak write tools and bash into a
+  // read-only agent.
   const toolPreset = opts.tools || presetObj?.tools || (typeof opts.preset === 'string' ? opts.preset : null) || 'full';
   const effort = Object.hasOwn(opts, 'effort') ? opts.effort || null : presetObj?.effort || null;
   const fast = presetObj?.fast === true || opts.fast === true;
@@ -235,15 +238,21 @@ export function createSession(createOpts) {
       : { ...createOpts, sessionMode };
   // A Lead-class session (actingAgent set) takes its owner's chain while it
   // runs on the owner's primary model; an agent keeps its preset's.
-  const routeFallbacks = actingAgent
-    ? Object.hasOwn(opts, 'routeFallbacks')
+  const explicitRouteFallbacks = Object.hasOwn(opts, 'routeFallbacks');
+  let routeFallbacks;
+  if (actingAgent) {
+    routeFallbacks = explicitRouteFallbacks
       ? opts.routeFallbacks
-      : ownerRouteFallbacks({ sessionMode, agentId: actingAgent, provider: providerName, model: modelName })
-    : normalizeWorkflowRoute({
+      : ownerRouteFallbacks({ sessionMode, agentId: actingAgent, provider: providerName, model: modelName });
+  } else {
+    routeFallbacks = executionFallbacks(
+      normalizeWorkflowRoute({
         provider: providerName,
         model: modelName,
-        fallbacks: Object.hasOwn(opts, 'routeFallbacks') ? opts.routeFallbacks : presetObj?.fallbacks,
-      })?.fallbacks;
+        fallbacks: explicitRouteFallbacks ? opts.routeFallbacks : presetObj?.fallbacks,
+      })
+    );
+  }
   // Provider cache strategy — agentRuntime.resolveSync() above is a
   // best-effort injection point (setAgentRuntime() has no live caller
   // today, so that branch never fires); build it directly here so every
@@ -262,7 +271,7 @@ export function createSession(createOpts) {
     : agentProfileRevision(surface.resolvedAgent, { mixy: sessionMode === AGENT_MODE });
   // A bot thread lives on across releases: the rules it was built from.
   const rulesRevision = agentProfile && sessionMode === AGENT_MODE ? promptRulesRevision() : '';
-  const prompt = composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode });
+  const prompt = composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode, sessionId: id });
   const messages = seedSessionMessages(prompt, opts.files);
   logSessionSurface(surface);
   const contextMeta = resolveSessionContextMeta(provider, modelName, {
@@ -322,24 +331,27 @@ export function contextSeedForRouteUpdate(session, routeChanged, selectedContext
 // ever replaced; custom-prompt or agent layouts without that block are left
 // untouched, and a same-variant switch is a no-op.
 export function _refreshSessionRuleVariantsForModel(session, previousModel, previousProvider = session?.provider) {
+  const ownerIsAgent = isAgentOwner(session);
   const deny = [
     ...(Array.isArray(session?.disallowedTools) ? session.disallowedTools : []),
     ...(getHiddenAgent(session?.agent || null) ? ['Skill'] : []),
-    ...(delegationDisabled(session, isAgentOwner(session)) ? ['agent'] : []),
+    ...(delegationDisabled(session, ownerIsAgent) ? ['agent'] : []),
   ];
   const allowTools = honoredSchemaAllowlist(session?.schemaAllowedTools, {
-    ownerIsAgent: isAgentOwner(session),
+    ownerIsAgent,
     agent: session?.agent || null,
   });
   const previousRules = _buildBaseRules({
     omitTools: [...deny, unusedModelEditToolName(previousModel)],
     allowTools,
+    ownerIsAgent,
     provider: previousProvider,
     model: previousModel,
   });
   const nextRules = _buildBaseRules({
     omitTools: [...deny, unusedModelEditToolName(session?.model)],
     allowTools,
+    ownerIsAgent,
     provider: session?.provider,
     model: session?.model,
   });
@@ -436,6 +448,10 @@ function resetSessionForRouteChange(id, session, previousModel, previousProvider
   delete session._providerPrefixGuardState;
   // The new route resolves its own wire before its first request.
   session.wireRoute = null;
+  // A warm chain replays the previous route's request: stop it. Its recorded
+  // warm use names that route, so it never counts as fresh cache for the new
+  // one (compact-policy.mjs shouldCompactForExpiredAgentCache).
+  cancelCacheWarm(id);
   const prepared = _prepareResumeTools(session, session.preset || 'full');
   session.tools = prepared.tools;
   session.toolSpec = prepared.toolSpec;
@@ -583,6 +599,12 @@ export async function resumeSession(sessionId, preset, options = {}) {
   _recoverTurnCheckpointDurably(session, sessionId);
   _refreshResumedTools(session, sessionId, preset);
   refreshSessionProviderCacheOpts(session);
+  // An archive saved before clear learned to rename it still names the
+  // session it was copied from: a changed prefix is one cache break.
+  if (useOwnScratchEnvironment(session)) {
+    invalidateContextUsageSnapshot(session);
+    markToolSurfaceMigrated(session, 'prompt_fold');
+  }
   // The live session already owns the refreshed tools and desktop scope.
   // Defer the structured clone + worker round-trip so opening a conversation
   // is not blocked on persisting the same in-memory state back to disk.

package/src/runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs

@@ -21,9 +21,22 @@ import {
   describeShellToolsStartupState,
 } from '../../tools/builtin/runtime-capabilities.mjs';
 import { captureOriginalUserCwd } from '../../../../shared/user-cwd.mjs';
+import { sessionScratchDir } from '../../../../shared/session-scratch.mjs';
 import { delegationDisabled } from './session-tool-surface.mjs';
 import { contextAckMessage } from '../compact/user-message-kind.mjs';
 
+/** What the generated scratch line starts with; the one place that line is recognised. */
+export const SCRATCH_LINE_PREFIX = '- Scratch: ';
+
+/** The environment line naming `sessionId`'s scratch directory, '' without one. */
+export function scratchEnvironmentLine(sessionId) {
+  // Fixed per session id and data dir, so the line never changes across turns.
+  const scratchDir = sessionScratchDir(sessionId);
+  return scratchDir
+    ? `${SCRATCH_LINE_PREFIX}${scratchDir} — this session's scratch directory; TEMP, TMP and TMPDIR in shell commands point here.`
+    : '';
+}
+
 // Preserve the exact pre-layout environment payload: Lead carried the
 // shell preference in Profile Preferences, while any routing surface with
 // shell carried the startup capability line in BP1.
@@ -31,7 +44,7 @@ import { contextAckMessage } from '../compact/user-message-kind.mjs';
 // it still get a location line via captureOriginalUserCwd(), which
 // resolves explicit session signals first and never leaks the daemon's
 // install root (user-cwd.mjs safe fallback chain).
-function buildShellEnvironmentContext(opts, ownerIsAgent, toolsForRouting) {
+function buildShellEnvironmentContext(opts, ownerIsAgent, toolsForRouting, sessionId = null) {
   const sessionCwdLine = opts.cwd || captureOriginalUserCwd();
   const wantsGitStartupLine = toolsForRouting.some((tool) => tool?.name === 'git');
   let cwdContextLine = '';
@@ -45,6 +58,7 @@ function buildShellEnvironmentContext(opts, ownerIsAgent, toolsForRouting) {
   return [
     cwdContextLine,
     `- Shell: ${shellName}. Use ${shellName} syntax unless the user specifies otherwise.`,
+    scratchEnvironmentLine(sessionId),
     // Which common tools the shell can run, measured where commands run
     // (login shell on POSIX, this process's PATH on Windows); see
     // runtime-capabilities.mjs. Recorded runs spent a round per session
@@ -84,7 +98,7 @@ export function buildWorkspacePromptContext(session, cwd) {
     ...(Array.isArray(session?.deferredToolCatalog) ? session.deferredToolCatalog : []),
   ];
   return {
-    environmentContext: buildShellEnvironmentContext({ cwd }, ownerIsAgent, tools),
+    environmentContext: buildShellEnvironmentContext({ cwd }, ownerIsAgent, tools, session?.id),
     // Agent mode never carries project instruction files.
     instructionFilesContext:
       session?.skipInstructionFiles === true || sessionModeOf(session) === AGENT_MODE
@@ -107,15 +121,11 @@ export function sessionRolePromptFields(identity, { ownerIsAgent, toolFreeRole,
   const mixy = (identity.agent || MIXY_AGENT_ID) === MIXY_AGENT_ID;
   let roleRules = '';
   if (!skipRules) {
-    roleRules = ownerIsAgent
-      ? _buildAgentRules(identity.agentRulesProfile)
-      : _buildLeadRules({ includeLeadBrief: !delegationFree });
+    roleRules = ownerIsAgent ? _buildAgentRules() : _buildLeadRules({ includeLeadBrief: !delegationFree });
   }
-  const identityLine = agentMode
-    ? agentModeIdentityLine(identity.agent || MIXY_AGENT_ID)
-    : lead
-      ? _buildLeadRules({ includeLeadBrief: !delegationFree, part: 'identity' })
-      : '';
+  let identityLine = '';
+  if (agentMode) identityLine = agentModeIdentityLine(identity.agent || MIXY_AGENT_ID);
+  else if (lead) identityLine = _buildLeadRules({ includeLeadBrief: !delegationFree, part: 'identity' });
   return {
     roleRules,
     ...(lead
@@ -143,7 +153,7 @@ export function sessionRolePromptFields(identity, { ownerIsAgent, toolFreeRole,
   };
 }
 
-export function composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode }) {
+export function composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode, sessionId }) {
   const agentMode = sessionMode === AGENT_MODE;
   const { ownerIsAgent, resolvedAgent, skills } = surface;
   // A tool-free hidden role (a one-shot classifier or title writer) carries
@@ -156,6 +166,7 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
     : _buildBaseRules({
         omitTools: surface.ruleOmitTools,
         allowTools: surface.schemaAllowedTools,
+        ownerIsAgent,
         provider: providerName,
         model: modelName,
       });
@@ -165,7 +176,6 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
     skipAgentRules: opts.skipAgentRules === true,
     profileSkip: { ...profile?.skip },
     agent: resolvedAgent,
-    agentRulesProfile: surface.agentRulesProfile,
   };
   const roleFields = sessionRolePromptFields(promptIdentity, {
     ownerIsAgent,
@@ -177,12 +187,12 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
   const metaContext = leadOnly ? _buildLeadMetaContext({ includeOutputStyle: !agentMode }) : '';
   // Lead-only response language; closes the environment block so no English
   // system text (session/shell/git lines) follows it.
-  const languageContext = leadOnly ? _buildLeadLanguageContext() : '';
+  const languageContext = leadOnly ? _buildLeadLanguageContext({ includeOutputStyle: !agentMode }) : '';
   // Cwd, shell and repository facts only serve tool calls; a tool-free role
   // gets none, which also keeps its prompt identical across projects.
   const shellEnvironmentContext = toolFreeRole
     ? ''
-    : buildShellEnvironmentContext(opts, ownerIsAgent, surface.toolsForRouting);
+    : buildShellEnvironmentContext(opts, ownerIsAgent, surface.toolsForRouting, sessionId);
   // Persisted env tail: refreshSessionBp3Environment rebuilds the env block
   // as [session, bp3EnvironmentContext], so the language block must
   // already sit at the end of this string to stay last after a refresh.

package/src/runtime/agent/orchestrator/session/manager/session-scratch-environment.mjs

@@ -0,0 +1,70 @@
+// manager/session-scratch-environment.mjs
+// A session record that was copied from another session (a clear archive)
+// still names the SOURCE's scratch directory in its generated environment,
+// while its shell commands use its own. This rewrites only that line.
+import {
+  BP3_PART_SEPARATOR,
+  bp3SystemMessage,
+  bpEnvSystemMessage,
+  replaceSystemMessageContent,
+  replaceWorkspaceEnvironment,
+} from './prompt-utils.mjs';
+import { SCRATCH_LINE_PREFIX, scratchEnvironmentLine } from './session-prompt-composition.mjs';
+
+// The first line the generator's own prefix starts is the scratch line.
+function withLine(text, line) {
+  if (typeof text !== 'string') return text;
+  const rows = text.split('\n');
+  const at = rows.findIndex((row) => row.startsWith(SCRATCH_LINE_PREFIX));
+  if (at < 0) return text;
+  rows[at] = line;
+  return rows.join('\n');
+}
+
+// Only the generated environment facts (the first part of the environment
+// tail) hold the line; memory and instruction files never do.
+function tailWithLine(tail, line) {
+  if (typeof tail !== 'string') return tail;
+  const facts = tail.split(BP3_PART_SEPARATOR)[0];
+  const fixed = withLine(facts, line);
+  return fixed === facts ? tail : replaceWorkspaceEnvironment(tail, fixed);
+}
+
+/**
+ * Make `session`'s generated environment name its own scratch directory:
+ * the persisted environment tail, the system block carrying it and the
+ * environment facts of a staged workspace change. Instruction files, memory
+ * and every conversation message stay as they are; a session that already
+ * names its own directory is left byte-identical (message objects included).
+ * System messages are replaced in the session's own array, never mutated.
+ * @returns {boolean} whether the system prefix changed
+ */
+export function useOwnScratchEnvironment(session) {
+  const line = scratchEnvironmentLine(session?.id);
+  if (!line) return false;
+  const oldTail = session.bp3EnvironmentContext;
+  const newTail = tailWithLine(oldTail, line);
+  session.bp3EnvironmentContext = newTail;
+  const pending = session.workspaceReroot;
+  const seen = tailWithLine(pending?.seen?.environmentContext, line);
+  const target = tailWithLine(pending?.target?.environmentContext, line);
+  if (seen !== pending?.seen?.environmentContext || target !== pending?.target?.environmentContext) {
+    // The staged state may be shared with the session this one was copied
+    // from: replace it, never edit it.
+    session.workspaceReroot = {
+      ...pending,
+      seen: { ...pending.seen, environmentContext: seen },
+      target: { ...pending.target, environmentContext: target },
+    };
+  }
+  if (newTail === oldTail || typeof oldTail !== 'string') return false;
+  // The generated environment closes its block (split env block, or the
+  // combined tier3 block after core + session start): swap that suffix.
+  const block = session.bp3EnvSplit === true ? bpEnvSystemMessage(session) : bp3SystemMessage(session);
+  const content = block?.content;
+  const suffix = oldTail.trim();
+  if (typeof content !== 'string' || !suffix || !content.endsWith(suffix)) return false;
+  const next = content.slice(0, -suffix.length) + newTail.trim();
+  // The prefix changed exactly when the system block's text did.
+  return replaceSystemMessageContent(session, block, next) && next !== content;
+}

package/src/runtime/agent/orchestrator/session/manager/session-tool-surface.mjs

@@ -74,8 +74,6 @@ function schemaOmittedToolNames(toolsForRouting, tools) {
 export function resolveSessionToolSurface(opts, { profile, toolPreset, modelName }) {
   const ownerIsAgent = isAgentOwner(opts.owner);
   const resolvedAgent = opts.agent || opts.role || profile?.taskType || null;
-  const hiddenAgent = getHiddenAgent(resolvedAgent);
-  const isRetrievalAgent = hiddenAgent?.kind === 'retrieval';
   const hasCallerAllow = Array.isArray(opts.schemaAllowedTools);
   const schemaAllowedTools = honoredSchemaAllowlist(opts.schemaAllowedTools, { ownerIsAgent, agent: resolvedAgent });
   // Lead and Agent share the same cwd-scoped Skill inventory. A session that
@@ -112,7 +110,6 @@ export function resolveSessionToolSurface(opts, { profile, toolPreset, modelName
   return {
     ownerIsAgent,
     resolvedAgent,
-    agentRulesProfile: isRetrievalAgent ? 'retrieval' : 'full',
     skills,
     sessionDeny,
     toolPermission,