mixdog 1.4.0 → 1.4.2

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -3,7 +3,7 @@
 import { compareCodePoints } from '../../../../shared/code-point-order.mjs';
 import { getMcpTools } from '../../mcp/client.mjs';
 import { getInternalTools } from '../../internal-tools.mjs';
-import { BUILTIN_TOOLS, bindShellKind } from '../../tools/builtin/builtin-tools.mjs';
+import { BUILTIN_TOOLS, bindAgentOwner, bindShellKind } from '../../tools/builtin/builtin-tools.mjs';
 import { resolveShellFor } from '../../tools/builtin/shell-runtime.mjs';
 import { PATCH_TOOL_DEFS } from '../../tools/patch-tool-defs.mjs';
 import { CODE_GRAPH_TOOL_DEFS } from '../../tools/code-graph-tool-defs.mjs';
@@ -51,7 +51,7 @@ const FILESYSTEM_TOOL_NAMES = new Set(['code_graph', 'find', 'glob', 'list', 'gr
 const READONLY_FS_TOOL_NAMES = new Set(['code_graph', 'find', 'glob', 'list', 'grep', 'read']);
 
 // Lead-only control tools: never part of a worker/sub-agent session surface.
-export const AGENT_WORKER_DENIED_TOOLS = Object.freeze(new Set(['agent', 'ask_user', 'session']));
+export const AGENT_WORKER_DENIED_TOOLS = Object.freeze(new Set(['agent', 'ask_user', 'handoff_user', 'session']));
 
 export function finalizeSessionToolList(
   tools,
@@ -70,7 +70,7 @@ export function finalizeSessionToolList(
   }
   if (ownerIsAgent) {
     out = out.filter((t) => !AGENT_WORKER_DENIED_TOOLS.has(String(t?.name || '').toLowerCase()));
-    out = orderSessionTools(out);
+    out = orderSessionTools(out.map(bindAgentOwner));
   }
   return out;
 }
@@ -91,6 +91,11 @@ const ALL_BUILTIN_SESSION_TOOLS = orderSessionTools(
   _dedupByName([...BUILTIN_TOOLS, ...PATCH_TOOL_DEFS, ...CODE_GRAPH_TOOL_DEFS])
 );
 
+/** The read-only filesystem tools (`tools:readonly`), in session route order. */
+export function readOnlyFilesystemTools() {
+  return ALL_BUILTIN_SESSION_TOOLS.filter((t) => READONLY_FS_TOOL_NAMES.has(t.name));
+}
+
 export function resolveSessionTools(
   toolSpec,
   skills,
@@ -154,7 +159,7 @@ function _computeBaseTools(toolSpec, mcp, skillTools) {
           addMany(ALL_BUILTIN_SESSION_TOOLS.filter((t) => FILESYSTEM_TOOL_NAMES.has(t.name)));
           break;
         case 'tools:readonly':
-          addMany(ALL_BUILTIN_SESSION_TOOLS.filter((t) => READONLY_FS_TOOL_NAMES.has(t.name)));
+          addMany(readOnlyFilesystemTools());
           break;
         case 'tools:shell':
         case 'tools:analysis':
@@ -186,8 +191,7 @@ function _computeBaseTools(toolSpec, mcp, skillTools) {
     case 'mcp':
       return orderSessionTools(_dedupByName([...mcp, ...skillTools]));
     case 'readonly': {
-      const readTools = ALL_BUILTIN_SESSION_TOOLS.filter((t) => READONLY_FS_TOOL_NAMES.has(t.name));
-      return orderSessionTools(_dedupByName([...readTools, ...mcp, ...skillTools]));
+      return orderSessionTools(_dedupByName([...readOnlyFilesystemTools(), ...mcp, ...skillTools]));
     }
     // 'full' and any unknown spec.
     default:

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint-context.mjs

@@ -93,6 +93,10 @@ export function captureTurnCheckpointContextState(session, messages, currentUser
     ),
     ...(kind === 'post_compact' ? { usageSnapshot: { ...usageSnapshot } } : {}),
     compaction: compactCheckpointState(session.compaction),
+    // Diagnostic only: the prefix fingerprint of the turn's last settled
+    // request (anthropic-prefix-trace.mjs), so the first request after a
+    // crash is still traced against it.
+    ...(session.providerPrefixBaseline ? { prefixBaseline: session.providerPrefixBaseline } : {}),
   };
 }
 

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint.mjs

@@ -224,6 +224,9 @@ export function recoverTurnCheckpoint(session) {
   // mark it unanchored so the first resumed send cannot compact from a gross
   // whole-transcript estimate.
   const contextStateRestored = restoreTurnCheckpointContextState(session, checkpoint);
+  // Diagnostic only (anthropic-prefix-trace.mjs): the turn's last settled
+  // request, whatever the context reading's alignment.
+  if (checkpoint.contextState?.prefixBaseline) session.providerPrefixBaseline = checkpoint.contextState.prefixBaseline;
   delete session.activeTurnCheckpoint;
   delete session.providerState;
   delete session._providerPrefixGuardState;

package/src/runtime/agent/orchestrator/session/manager/turn-interruption.mjs

@@ -110,6 +110,15 @@ function finalizeInterruptedTurn({
     };
   }
 
+  // Killed with a request on the wire (phase 'streaming' after a tool run):
+  // the provider received the transcript up to its last message, and may
+  // have cached it. Stamping that message keeps what this interruption
+  // appends (the marker, the next prompt) out of the tool_result it ends —
+  // see toAnthropicMessages. The stamp is meta only; no wire bytes change.
+  const sentTail = messages.length - 1;
+  if (phase === 'streaming' && (messages[sentTail]?.role === 'tool' || messages[sentTail]?.role === 'user')) {
+    messages[sentTail] = { ...messages[sentTail], meta: { ...messages[sentTail].meta, sentRequestTail: true } };
+  }
   appendObservedTurnOutput(messages, {
     partialAssistantContent,
     partialReasoningContent,
@@ -186,8 +195,8 @@ function appendObservedTurnOutput(
   }
 }
 
-export function createTurnInterruptionTracker() {
-  const state = {
+function newInterruptionState() {
+  return {
     responseStarted: false,
     partialAssistantContent: '',
     tombstonedAssistantContent: '',
@@ -204,7 +213,10 @@ export function createTurnInterruptionTracker() {
     tombEpoch: 0,
     callsEpoch: 0,
   };
+}
 
+/** Streamed assistant text, including the tombstone of a retracted attempt. */
+function textBufferMethods(state) {
   return {
     recordTextDelta(chunk) {
       const value = String(chunk ?? '');
@@ -254,33 +266,12 @@ export function createTurnInterruptionTracker() {
       state.tombEpoch += 1;
       return true;
     },
-    hasResponseStarted() {
-      return state.responseStarted;
-    },
-    recordReasoningDelta(chunk) {
-      const value = String(chunk ?? '');
-      if (!value) return;
-      state.responseStarted = true;
-      state.partialReasoningContent += value;
-    },
-    recordAssistantText(text) {
-      const value = String(text ?? '');
-      if (!value.trim()) return;
-      state.responseStarted = true;
-      // Buffered providers report the whole segment here; streaming
-      // providers already accumulated the same segment via text deltas.
-      if (!state.partialAssistantContent.trim()) state.partialAssistantContent += value;
-    },
-    markAssistantMessageCommitted() {
-      state.partialAssistantContent = '';
-      state.tombstonedAssistantContent = '';
-      state.partialReasoningContent = '';
-      state.observedToolCalls.clear();
-      state.textEpoch += 1;
-      state.reasoningEpoch += 1;
-      state.tombEpoch += 1;
-      state.callsEpoch += 1;
-    },
+  };
+}
+
+/** Tool calls and early-notified results observed during the turn. */
+function toolObservationMethods(state) {
+  return {
     recordToolCalls(calls, { eagerStarted = false } = {}) {
       for (const call of Array.isArray(calls) ? calls : []) {
         if (!call?.id) continue;
@@ -308,6 +299,42 @@ export function createTurnInterruptionTracker() {
         state.observedToolResults.delete(callId);
       }
     },
+  };
+}
+
+export function createTurnInterruptionTracker() {
+  const state = newInterruptionState();
+
+  return {
+    ...textBufferMethods(state),
+    ...toolObservationMethods(state),
+    hasResponseStarted() {
+      return state.responseStarted;
+    },
+    recordReasoningDelta(chunk) {
+      const value = String(chunk ?? '');
+      if (!value) return;
+      state.responseStarted = true;
+      state.partialReasoningContent += value;
+    },
+    recordAssistantText(text) {
+      const value = String(text ?? '');
+      if (!value.trim()) return;
+      state.responseStarted = true;
+      // Buffered providers report the whole segment here; streaming
+      // providers already accumulated the same segment via text deltas.
+      if (!state.partialAssistantContent.trim()) state.partialAssistantContent += value;
+    },
+    markAssistantMessageCommitted() {
+      state.partialAssistantContent = '';
+      state.tombstonedAssistantContent = '';
+      state.partialReasoningContent = '';
+      state.observedToolCalls.clear();
+      state.textEpoch += 1;
+      state.reasoningEpoch += 1;
+      state.tombEpoch += 1;
+      state.callsEpoch += 1;
+    },
     markProviderSendStarted() {
       state.phase = 'streaming';
     },

package/src/runtime/agent/orchestrator/session/manager/turn-reap.mjs

@@ -0,0 +1,125 @@
+// manager/turn-reap.mjs
+// A turn abandoned by a timeout or stall stops the background shell work that
+// turn started — a job auto-promoted during it, and the survivors its commands
+// left running. Only those: a user cancel, a steering interrupt, a normal
+// finish, and jobs from earlier turns keep their jobs. Only the entry's own
+// turn start is armed, and a new turn clears it, so a reap that runs late
+// never touches a newer turn's work.
+import { cancelBackgroundTasks, getBackgroundTask } from '../../../../shared/background-tasks.mjs';
+import { runtimeState } from './runtime-state.mjs';
+
+// Timeout ownership is explicit and turn-scoped: the code that makes a timeout
+// WIN (the watchdog's own abort, the provider's terminal error) arms the reap
+// itself, and only while nothing else has stopped the turn. An abort that
+// arrives first stays a cancel; an error chain is never read afterwards.
+
+// Codes of the runtime's own timeout/stall errors (stall-policy's
+// streamStalledError / providerTimeoutError, the Gemini stream timeout).
+const PROVIDER_TIMEOUT_CODES = new Set(['ESTREAMSTALL', 'EPROVIDERTIMEOUT', 'EGEMINITIMEOUT']);
+
+/** A timeout is the first thing to stop this session's turn: arm its reap now,
+ *  before the abort propagates. No-op when the turn's controller is already
+ *  aborted (a cancel, interrupt or close won) or no turn runs. */
+export function armTurnTimeout(id) {
+  const entry = runtimeState.get(id);
+  if (!entry || entry.controller?.signal.aborted) return;
+  armTurnShellReap(id, entry);
+}
+
+/** The turn ended with a provider timeout/stall error that no retry recovered
+ *  from: arm only while the turn's own signal is un-aborted and the error
+ *  itself carries a timeout code or the producer's own `streamStalled` flag. */
+export function armTurnTimeoutOnProviderError(id, entry, turnSignal, err) {
+  if (turnSignal?.aborted) return;
+  if (!PROVIDER_TIMEOUT_CODES.has(err?.code) && err?.streamStalled !== true) return;
+  armTurnShellReap(id, entry);
+}
+
+// session id -> jobs stopped by a timeout reap, until the owner's handoff
+// reports them (or the session's next turn starts).
+const stoppedJobs = new Map();
+
+// What the cancel path already produces, read without waiting: a task whose
+// own cancel hook kills (survivors of a finished command) answers with its
+// kill outcome; a promoted job is over once its process tree is no longer
+// tracked.
+function trackStoppedJob(taskId) {
+  const job = { taskId, outcome: null, terminated: false };
+  const kill = getBackgroundTask(taskId)?.cancelOutcome;
+  if (kill) {
+    job.outcome = kill;
+    Promise.resolve(kill).then(
+      (result) => {
+        job.terminated = result?.terminated === true;
+      },
+      () => {}
+    );
+  }
+  return job;
+}
+
+// shell-jobs depends on the session manager, which loads this module, so it is
+// loaded at the first reap. The classification awaits only this module load,
+// never a process; a probe that cannot be loaded leaves a job "still stopping".
+let shellJobProbe = null;
+function loadShellJobProbe() {
+  shellJobProbe ??= import('../../tools/builtin/shell-jobs.mjs').then(
+    (shellJobs) => shellJobs.isShellJobRunning,
+    () => null
+  );
+  return shellJobProbe;
+}
+
+// Confirmed by the runtime's own state, never assumed: a task whose cancel hook
+// kills is confirmed by that kill's `terminated`; a promoted job once neither
+// its native task nor its process-tree tracker is live. Without the probe
+// (shell-jobs not loaded) nothing is confirmed.
+function isConfirmedGone(job, isRunning) {
+  if (job.outcome) return job.terminated;
+  return Boolean(isRunning) && !isRunning(job.taskId);
+}
+
+function reap(id, entry) {
+  loadShellJobProbe();
+  const { taskIds } = cancelBackgroundTasks({
+    surface: 'shell',
+    executionSessionId: id,
+    startedSinceMs: entry.shellReapSince,
+    reason: 'turn-timeout',
+    notify: false,
+  });
+  if (taskIds.length > 0) stoppedJobs.set(id, [...(stoppedJobs.get(id) || []), ...taskIds.map(trackStoppedJob)]);
+}
+
+/** The turn is being abandoned by a timeout: remember when it started and stop
+ *  what it has started so far. A settled (idle) entry has no turn to reap. */
+export function armTurnShellReap(id, entry) {
+  if (!(entry?.askStartedAt > 0) || entry.closed) return;
+  entry.shellReapSince = entry.askStartedAt;
+  reap(id, entry);
+}
+
+/** The abandoned turn has unwound: sweep what it registered while stopping
+ *  (survivors of its aborted commands). No-op unless this turn was armed. */
+export function reapTurnShellJobs(id, entry) {
+  if (entry?.shellReapSince > 0 && !entry.closed && runtimeState.get(id) === entry) reap(id, entry);
+}
+
+/** A new turn owns the session: nothing earlier may be reaped on its account. */
+export function resetTurnShellReap(id, entry) {
+  entry.shellReapSince = null;
+  stoppedJobs.delete(id);
+}
+
+/** The jobs the reap stopped, split by what is known now: `stopped` are
+ *  confirmed gone, `stopping` were killed but their processes are not yet
+ *  confirmed gone (they keep being terminated). */
+export async function takeStoppedShellJobs(id) {
+  const jobs = stoppedJobs.get(id) || [];
+  stoppedJobs.delete(id);
+  if (jobs.length === 0) return { stopped: [], stopping: [] };
+  const isRunning = await loadShellJobProbe();
+  const taskIds = (confirmed) =>
+    jobs.filter((job) => isConfirmedGone(job, isRunning) === confirmed).map((job) => job.taskId);
+  return { stopped: taskIds(true), stopping: taskIds(false) };
+}

package/src/runtime/agent/orchestrator/session/mixy-name.mjs

@@ -3,9 +3,13 @@
 // Every model- or user-facing string that names it reads this, re-read on each
 // use so a rename applies at once. Text shared across agents (tool schemas,
 // other agents' shared prompt block) says "the representative agent" instead,
-// so a rename never changes cached bytes.
-import { dirname, join } from 'node:path';
-import { mixdogGlobalDir, readSafe } from '../context/skill-catalog.mjs';
+// so a rename never changes those cached bytes. Each other bot's own contact
+// catalog (workflow/context.mjs) names her, so a request naming her finds her.
+// Light imports only: the prompt's contact catalog (workflow/context.mjs) reads
+// the name too, and must not pull the skill catalog and config in with it.
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { mixyIdentityDir } from '../../../shared/agent-store.mjs';
 
 export const DEFAULT_MIXY_NAME = 'Mixy';
@@ -19,9 +23,11 @@ export function mixyNameOf(manifest) {
 export function mixyDisplayName() {
   try {
     // bots/mixy once Mixy is its own bot, agents/lead before (agent-store.mjs).
-    const dir = mixyIdentityDir(dirname(mixdogGlobalDir('agents')));
-    return mixyNameOf(JSON.parse(readSafe(join(dir, 'agent.json')) || '{}'));
+    const dir = mixyIdentityDir(resolvePluginData());
+    return mixyNameOf(JSON.parse(readFileSync(join(dir, 'agent.json'), 'utf8')));
   } catch {
+    // Never throws: prompt composition calls this unguarded, and the name only labels Mixy.
+    // A missing, empty, unreadable or malformed agent.json is the unrenamed default.
     return DEFAULT_MIXY_NAME;
   }
 }

package/src/runtime/agent/orchestrator/session/pre-send-compact.mjs

@@ -92,7 +92,11 @@ function preSendCompactDecision(state, compactPolicy) {
     messages,
     sessionRef,
   });
-  const cacheExpired = shouldCompactForExpiredAgentCache(sessionRef, state.opts);
+  const cacheExpired = shouldCompactForExpiredAgentCache(sessionRef, state.opts, {
+    provider: sessionRef?.provider || state.provider?.name,
+    model: state.model,
+    messages,
+  });
   const mediaPressure = shouldCompactForRequestMedia(messages, sessionRef?.provider);
   const requireReduction = !reactivePending && !mediaPressure;
   let shouldCompact =

package/src/runtime/agent/orchestrator/session/prompt-cache-touch-store.mjs

@@ -26,6 +26,20 @@ function validTouch(value) {
   );
 }
 
+// A warm use as stored: `{ at, provider, model, accountId }` — the route and
+// account whose cached prefix the warm read. A bare time (written before the
+// identity was recorded) keeps its time and matches no route.
+function warmUseRecord(value) {
+  const record = value && typeof value === 'object' ? value : { at: value };
+  if (!(Number(record.at) > 0)) return null;
+  return {
+    at: Number(record.at),
+    provider: String(record.provider || ''),
+    model: String(record.model || ''),
+    accountId: String(record.accountId || ''),
+  };
+}
+
 /** A touch store backed by `path` (default: the data dir's file). */
 export function createPromptCacheTouchStore(
   path = () => join(resolvePluginData(), PROMPT_CACHE_TOUCH_FILE),
@@ -43,8 +57,9 @@ export function createPromptCacheTouchStore(
     for (const [sessionId, touch] of Object.entries(stored?.touches || {})) {
       if (validTouch(touch)) touches.set(sessionId, { ...touch });
     }
-    for (const [sessionId, at] of Object.entries(stored?.warmUses || {})) {
-      if (Number(at) > 0) warmUses.set(sessionId, Number(at));
+    for (const [sessionId, use] of Object.entries(stored?.warmUses || {})) {
+      const record = warmUseRecord(use);
+      if (record) warmUses.set(sessionId, record);
     }
     return touches;
   };
@@ -102,12 +117,20 @@ export function createPromptCacheTouchStore(
     },
     /** When a warm last used the session's cache successfully, or 0. */
     lastWarmUse(sessionId) {
-      return uses().get(String(sessionId || '')) || 0;
+      return uses().get(String(sessionId || ''))?.at || 0;
+    },
+    /** The session's last successful warm use `{ at, provider, model,
+     *  accountId }`, or null. */
+    warmUse(sessionId) {
+      const use = uses().get(String(sessionId || ''));
+      return use ? { ...use } : null;
     },
-    /** A warm read the session's cache without writing at `at`. */
-    recordWarmUse(sessionId, at) {
-      if (!sessionId || !(Number(at) > 0)) return;
-      uses().set(String(sessionId), Number(at));
+    /** A warm read the session's cache without writing at `at`, on the
+     *  route and account `{ provider, model, accountId }`. */
+    recordWarmUse(sessionId, at, identity = {}) {
+      const record = warmUseRecord({ ...identity, at });
+      if (!sessionId || !record) return;
+      uses().set(String(sessionId), record);
       scheduleFlush();
     },
     /** The session's own activity supersedes its warm use (a real request

package/src/runtime/agent/orchestrator/session/restart-prefix-parity.fixture.mjs

@@ -0,0 +1,154 @@
+// Child process of restart-prefix-parity.slow.test.mjs: one phase of a scripted
+// anthropic-oauth session in its own process, so a "restart" is a real new
+// process reading the data dir the previous one left. The fake provider
+// records the request body the real OAuth builder makes for every main-loop
+// send (providers/anthropic-oauth.mjs buildRequestBody, after the same
+// tool-pair sanitize its send path runs) and answers from a script.
+//
+//   node restart-prefix-parity.fixture.mjs <phase> <dataDir> <outFile> [sessionId]
+//   phase idle    two complete turns, then exit
+//   phase killtool    one complete turn; the second turn's second request is
+//                     answered with a tool call whose run settles the journal,
+//                     prints READY and hangs until the parent kills the process
+//   phase killrequest the same, but it hangs in the second request itself
+//                     (sent, never answered)
+//   phase resume  one turn on the stored session (crash recovery included)
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const [phase, dataDir, outFile, resumeId] = process.argv.slice(2);
+process.env.MIXDOG_DATA_DIR = dataDir;
+process.env.MIXDOG_AGENT_TRACE_DISABLE = '1';
+const workDir = join(dataDir, '..', 'work');
+mkdirSync(workDir, { recursive: true });
+// The response language defaults to the system locale, and only a Korean one
+// gets Opus 5.5's turn-scoped tail reminder (tail-reminder-rules.mjs), so the
+// language is pinned: every host sends the same requests. The resume phase
+// reads what the first phase wrote.
+if (phase !== 'resume') {
+  writeFileSync(join(dataDir, 'mixdog-config.json'), JSON.stringify({ agent: { profile: { language: 'ko' } } }));
+}
+// One file per call: a repeated read is answered from the read cache, which
+// never reaches the tool run the midturn phase hangs in.
+for (const name of ['call_1', 'call_2', 'call_3']) writeFileSync(join(workDir, `${name}.txt`), `${name}\n`);
+
+const { createSession } = await import('./manager/session-lifecycle.mjs');
+const { askSession } = await import('./manager/ask-session.mjs');
+const { settleTurnCheckpointWrites } = await import('./manager/turn-checkpoint.mjs');
+const { sanitizeToolPairs } = await import('./context-utils.mjs');
+const { _withRegisteredProviderForTestAsync } = await import('../providers/registry.mjs');
+const { _buildRequestBodyForCacheSmoke } = await import('../providers/anthropic-oauth.mjs');
+const { modelToolSchemaAllowlist } = await import('../runtime-core/tool-profile.mjs');
+const { anthropicPrefixChanges, anthropicPrefixFingerprint, anthropicPrefixSessionId, recordAnthropicPrefix } =
+  await import('../providers/lib/anthropic-prefix-trace.mjs');
+
+const MODEL = 'claude-opus-5-5';
+const USAGE = { inputTokens: 10, outputTokens: 5, cachedTokens: 0, cacheWriteTokens: 0 };
+const thinking = (id) => [{ type: 'thinking', thinking: `plan ${id}`, signature: `sig-${id}` }];
+const toolStep = (id) => async () => ({
+  content: 'Reading.',
+  thinkingBlocks: thinking(id),
+  hasThinkingContent: true,
+  toolCalls: [{ id, name: 'read', arguments: { path: `${id}.txt` } }],
+  stopReason: 'tool_use',
+  usage: USAGE,
+});
+const textStep = (text) => async () => ({
+  content: text,
+  thinkingBlocks: thinking(text),
+  hasThinkingContent: true,
+  stopReason: 'end_turn',
+  usage: USAGE,
+});
+
+const bodies = [];
+const changes = [];
+let warmBody = null;
+let script = [];
+let sessionId = resumeId || null;
+const provider = {
+  name: 'anthropic-oauth',
+  contextWindow: 200_000,
+  async send(messages, model, tools, opts) {
+    if (opts?.requestKind && opts.requestKind !== 'turn') return { content: 'Title', usage: USAGE };
+    const body = await _buildRequestBodyForCacheSmoke(sanitizeToolPairs(messages), model, tools || [], opts);
+    bodies.push(JSON.parse(JSON.stringify(body)));
+    // The diagnostic fingerprint the real send records, and what it reports
+    // against the previous request (the record's, after a restart).
+    recordAnthropicPrefix(anthropicPrefixSessionId(opts), anthropicPrefixFingerprint(body));
+    changes.push(anthropicPrefixChanges(anthropicPrefixSessionId(opts)));
+    const step = script.shift();
+    if (!step) throw new Error(`unscripted send #${bodies.length}`);
+    return step();
+  },
+};
+
+// Where the interrupted turn stops: the checkpoint made durable, the recorded
+// bodies handed over, and nothing ever finishes (the parent kills the process).
+const hang = async () => {
+  await settleTurnCheckpointWrites(sessionId);
+  await new Promise((resolve) => setTimeout(resolve, 300));
+  await settleTurnCheckpointWrites(sessionId);
+  writeFileSync(outFile, JSON.stringify({ sessionId, bodies, changes }));
+  process.stdout.write('READY\n');
+  return new Promise(() => {});
+};
+// killtool: in the second tool run of the turn (after its second request settled).
+let toolRuns = 0;
+const hangInSecondTool = async () => {
+  toolRuns += 1;
+  if (toolRuns >= 2) await hang();
+};
+
+await _withRegisteredProviderForTestAsync('anthropic-oauth', provider, async () => {
+  if (phase === 'resume') {
+    // The cache warm a restart re-arms (cache-warm.mjs rearmCacheWarmsAfterRestart)
+    // replays this request, built before the next turn touches the session.
+    const { lastSentMainRequest } = await import('./side-question.mjs');
+    const { cacheWarmSend } = await import('./cache-warm.mjs');
+    const request = lastSentMainRequest(sessionId);
+    if (request) {
+      const send = cacheWarmSend(request);
+      warmBody = await _buildRequestBodyForCacheSmoke(
+        sanitizeToolPairs(send.messages),
+        send.model,
+        send.tools || [],
+        send.opts
+      );
+    }
+    script = [textStep('resumed')];
+    await askSession(sessionId, 'third task', null, null, null, null, {});
+    return;
+  }
+  const session = createSession({
+    provider: 'anthropic-oauth',
+    model: MODEL,
+    cwd: workDir,
+    skipSkills: true,
+    schemaAllowedTools: modelToolSchemaAllowlist('headless'),
+    workflow: { id: 'headless', delegatesAgents: false },
+  });
+  sessionId = session.id;
+  if (phase === 'idle') {
+    script = [toolStep('call_1'), textStep('done one'), toolStep('call_2'), textStep('done two')];
+    await askSession(sessionId, 'first task', null, null, null, null, {});
+    await askSession(sessionId, 'second task', null, null, null, null, {});
+    return;
+  }
+  // killrequest: while the turn's second request is on the wire.
+  const killTool = phase === 'killtool';
+  script = [toolStep('call_1'), textStep('done one'), toolStep('call_2'), killTool ? toolStep('call_3') : hang];
+  await askSession(sessionId, 'first task', null, null, null, null, {});
+  await askSession(
+    sessionId,
+    'second task',
+    null,
+    null,
+    null,
+    null,
+    killTool ? { beforeToolExecution: hangInSecondTool } : {}
+  );
+});
+
+writeFileSync(outFile, JSON.stringify({ sessionId, bodies, changes, warmBody }));
+process.exit(0);

package/src/runtime/agent/orchestrator/session/store/session-delete.mjs

@@ -36,6 +36,7 @@ import { _savePending, _clearDebounce, _releasePendingSlot } from './pending-sav
 import { _runtimeLivenessVeto } from './liveness-veto.mjs';
 import { _runSessionPurgeHooks } from './session-observers.mjs';
 import { deleteCompactionArchive } from '../compaction-archive.mjs';
+import { removeSessionScratchDir } from '../../../../shared/session-scratch.mjs';
 
 /** Child-agent session ids linked to one visible parent. Candidates come from
  * metadata only (the summary rows and the agent-worker links — no folder
@@ -154,6 +155,12 @@ export function deleteSession(id, options = {}) {
     _runSessionPurgeHooks(id, { cwds: knownSessionCwds(id) });
     // The display-only compaction archive has no meaning without its session.
     deleteCompactionArchive(getStoreDir(), id);
+    // The session's scratch directory (shell TEMP/TMP/TMPDIR) goes with it.
+    try {
+      removeSessionScratchDir(id);
+    } catch {
+      /* a locked scratch file never fails the delete */
+    }
     _clearLiveSession(id);
     // The file is gone: every marker of the retired incarnation goes with it
     // (save error + failed-snapshot evidence, split-brain drop flag, lifecycle

package/src/runtime/agent/orchestrator/session/store-summary-catalog.mjs

@@ -30,6 +30,7 @@ import {
   inheritedFromSessionId,
   isStoredSessionId,
   positiveNumber,
+  compactCountField,
   realTurnCount,
   workspaceSummary,
 } from './store-summary-fields.mjs';
@@ -216,6 +217,9 @@ export function normalizedRow(row) {
     // Absent from a row read off a session file: its assistant text is not
     // decoded there, so the unread count falls back until the next save.
     ...(Array.isArray(row.incomingTail) ? { incomingTail: normalizedIncomingTail(row.incomingTail) } : {}),
+    // Absent from a row read off a session file (its compaction record is not
+    // decoded there) until the next save.
+    ...compactCountField(row),
     realTurnCount: realTurnCount(row),
     title: cleanText(row.title, 100),
     preview: cleanText(row.preview),

package/src/runtime/agent/orchestrator/session/store-summary-fields.mjs

@@ -63,6 +63,21 @@ export function realTurnCount(value) {
   return typeof count === 'number' && Number.isFinite(count) && count >= 0 ? Math.floor(count) : null;
 }
 
+/** How many compactions a session has had (`compaction.compactCount`): each
+ *  one trims the live messages and so restarts their numbering (the unread
+ *  cursors count them). Null for a value without it, e.g. a row written
+ *  before the field existed. */
+export function compactCount(value) {
+  const count = value?.compactCount;
+  return typeof count === 'number' && Number.isSafeInteger(count) && count >= 0 ? count : null;
+}
+
+/** `{ compactCount }` for a row that carries one, else nothing. */
+export function compactCountField(value) {
+  const count = compactCount(value);
+  return count === null ? {} : { compactCount: count };
+}
+
 export function importKey(value) {
   const key = typeof value?.importKey === 'string' ? value.importKey : value?.importOrigin?.key;
   return typeof key === 'string' && key.trim() ? key : null;