mixdog 1.4.0 → 1.4.2

package/src/session-runtime/provider-models/catalog-load.mjs

@@ -4,7 +4,8 @@
 // catalog flattened into deduplicated rows with per-provider profiling.
 import { modelProxyClientMode } from '../../runtime/shared/model-proxy-mode.mjs';
 import { isSelectableLlmModel } from '../model-recency.mjs';
-import { sharedProviderCatalog } from '../provider-catalog-cache.mjs';
+import { scopedProviderCatalog, sharedProviderCatalog } from '../provider-catalog-cache.mjs';
+import { providerRows } from '../services/agent-tool/model-select.mjs';
 import { NO_ENABLED_PROVIDERS } from '../../runtime/agent/orchestrator/providers/registry-errors.mjs';
 
 export function createCatalogLoader({
@@ -42,7 +43,7 @@ export function createCatalogLoader({
    *  refresh invalidates it, leaving the UI on the stale first-open rows.
    *  Resolves false when no provider is enabled: a fresh install has nothing
    *  to load, and the registry refuses an all-disabled init by design. */
-  async function prepare({ forceRefresh, loadSecrets }) {
+  async function prepare({ forceRefresh, loadSecrets, provider }) {
     if (loadSecrets) {
       const secretsStartedAt = performance.now();
       await awaitKeychainPrewarm();
@@ -69,7 +70,15 @@ export function createCatalogLoader({
     if (!forceRefresh && typeof reg().refreshProviderCatalogsOnStartup === 'function') {
       await reg().refreshProviderCatalogsOnStartup();
     }
-    if (forceRefresh && typeof reg().refreshCatalogs === 'function') {
+    if (forceRefresh && provider) {
+      // A provider-scoped refresh asks only the registry providers the name
+      // matches and folds their entries into the shared catalog; every other
+      // provider keeps what it loaded.
+      const known = [...reg().getAllProviders().keys()].map((name) => ({ provider: name }));
+      const names = providerRows(known, provider).map((row) => row.provider);
+      await reg().refreshProviderCatalogsFor(names);
+      await scopedProviderCatalog(reg(), names, { timeoutMs: providerTimeoutMs });
+    } else if (forceRefresh && typeof reg().refreshCatalogs === 'function') {
       await reg().refreshCatalogs({ force: true });
     }
     profile('catalog-refresh-ready', { ms: (performance.now() - refreshStartedAt).toFixed(1) });
@@ -81,13 +90,18 @@ export function createCatalogLoader({
    *  providers that failed or timed out, `request.partial` marks a load
    *  where some but not all providers answered, and `request.retryAt` is when
    *  the first missing provider may be asked again. */
-  return async function loadProviderModelsFresh({ forceRefresh = false, loadSecrets = true, request = null } = {}) {
+  return async function loadProviderModelsFresh({
+    forceRefresh = false,
+    loadSecrets = true,
+    request = null,
+    provider = null,
+  } = {}) {
     const startedAt = performance.now();
     profile('load:start', { forceRefresh, loadSecrets });
     // No enabled provider is an empty catalog, not a failure. The request
     // stays incomplete so this answer is never cached: connecting a provider
     // is picked up by the next read.
-    if (!(await prepare({ forceRefresh, loadSecrets }))) {
+    if (!(await prepare({ forceRefresh, loadSecrets, provider }))) {
       profile('load:done', { ms: (performance.now() - startedAt).toFixed(1), providers: 0, rows: 0 });
       return [];
     }
@@ -97,7 +111,10 @@ export function createCatalogLoader({
     // forward only for the still-current request, never for a superseded load.
     if (ownsLoad) request.seq = caches.providerModelsLoadSeq;
     const seq = request?.seq ?? caches.providerModelsLoadSeq;
-    const catalogEntries = await sharedProviderCatalog(reg(), { force: forceRefresh, timeoutMs: providerTimeoutMs });
+    const catalogEntries = await sharedProviderCatalog(reg(), {
+      force: forceRefresh && !provider,
+      timeoutMs: providerTimeoutMs,
+    });
     if (request) {
       const failed = catalogEntries.filter((entry) => Object.hasOwn(entry, 'error'));
       request.missing = failed.map((entry) => entry.name);

package/src/session-runtime/provider-models.mjs

@@ -156,7 +156,9 @@ export function createProviderModels({
     return promise;
   }
 
-  async function collectProviderModels({ force = false, quick = false } = {}) {
+  /** `provider` (a name or fragment of one) scopes a forced read: only the
+   *  providers it names are refreshed, the rest keep their loaded entries. */
+  async function collectProviderModels({ force = false, quick = false, provider = null } = {}) {
     meta.syncCatalogRevision();
     const cached = caches.providerModelsCache;
     if (!force && Array.isArray(cached.models)) {
@@ -180,7 +182,7 @@ export function createProviderModels({
     }
     if (force) {
       const request = { seq: ++caches.providerModelsLoadSeq };
-      const models = await loadProviderModelsFresh({ forceRefresh: true, loadSecrets: true, request });
+      const models = await loadProviderModelsFresh({ forceRefresh: true, loadSecrets: true, request, provider });
       adoptProviderModelCache(models, request);
       return withCatalogState(rows.providerModelsFromCacheRows(models), partialOf(request));
     }

package/src/session-runtime/resource-mcp-api.mjs

@@ -14,9 +14,11 @@ import { migrateMergedConnectorServers } from './connector-merge-migration.mjs';
 import {
   connectorAccountServers,
   connectorAccountsOf,
+  connectorAppPasswordOnly,
   connectorById,
-  connectorMultiAccount,
+  connectorServerInput,
   gmailAppPasswordAccount,
+  gmailAppPasswordServerInput,
   mergeConnectorAccountServers,
 } from '../runtime/shared/connector-catalog.mjs';
 import { saveMcpOAuthClientSecret } from '../runtime/agent/orchestrator/mcp/oauth-client.mjs';
@@ -75,14 +77,24 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     resolveMcpCatalog,
     pluginMcpServer,
   });
-  const { storeOAuthClientSecret, storeGmailAppPassword, releaseOAuth, forgetUnusedGmailAppPassword, releaseAccount } =
-    createMcpServerSecrets({
-      gmailAppPassword,
-      saveOAuthClientSecret,
-      clearMcpServerOAuth,
-      resolveConfiguredMcpCatalog,
-    });
-  const { addConnectorAccount, saveConnectorAccount, setConnectorAccountEnabled } = createConnectorAccountEdits({
+  const {
+    storeOAuthClientSecret,
+    storeGmailAppPassword,
+    releaseOAuth,
+    forgetUnusedGmailAppPassword,
+    forgetStoredSecrets,
+    releaseAccount,
+  } = createMcpServerSecrets({
+    gmailAppPassword,
+    saveOAuthClientSecret,
+    clearMcpServerOAuth,
+    resolveConfiguredMcpCatalog,
+  });
+  const {
+    addConnectorAccount: joinConnectorAccount,
+    saveConnectorAccount,
+    setConnectorAccountEnabled,
+  } = createConnectorAccountEdits({
     normalizeMcpServerInput,
     pluginMcpServer,
     sync,
@@ -91,16 +103,65 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     storeOAuthClientSecret,
     storeGmailAppPassword,
     forgetUnusedGmailAppPassword,
+    forgetStoredSecrets,
     releaseOAuth,
   });
   // Peers reload config from disk on receipt: land the write before publishing.
   const persisted = async () => {
     await flushSkillsSave?.();
   };
+  // One account addition of a connector at a time, each reading the servers
+  // the one before it saved: two at once never take the same name, nor does
+  // one's save drop the other's account.
+  const connectorAdds = new Map();
+  const oneAddAtATime = (connector, run) => {
+    const next = (connectorAdds.get(connector) || Promise.resolve()).then(run, run);
+    const settled = next.then(
+      () => {},
+      () => {}
+    );
+    connectorAdds.set(connector, settled);
+    void settled.then(() => {
+      if (connectorAdds.get(connector) === settled) connectorAdds.delete(connector);
+    });
+    return next;
+  };
+
+  async function addMcpServer(input = {}) {
+    // A catalog connector's account (as its own server config) joins that
+    // connector's one server.
+    const connector = clean(input.connector);
+    if (connector && !Array.isArray(input.accounts)) return oneAddAtATime(connector, () => addServerNow(input));
+    return addServerNow(input);
+  }
+
+  async function addServerNow(input) {
+    const { name, config: serverConfig } = normalizeMcpServerInput(input);
+    // A catalog connector's server keeps its catalog id (connector-catalog.mjs).
+    const connector = clean(input.connector);
+    if (connector) {
+      if (!connectorById(connector)) throw new Error(`Unknown connector: ${connector}`);
+      serverConfig.connector = connector;
+    }
+    const servers = userServers();
+    if (connector && !Array.isArray(input.accounts)) {
+      return joinConnectorAccount(servers, connector, name, serverConfig, input);
+    }
+    if (Object.hasOwn(servers, name) || accountTarget(servers, name)) {
+      throw nameTakenError(servers, name);
+    }
+    const owned = pluginMcpServer(name);
+    if (owned) throw new Error(`MCP server already exists: ${name} (provided by plugin "${owned.owner.id}")`);
+    await storeOAuthClientSecret(input, serverConfig);
+    await storeGmailAppPassword(input, serverConfig, true);
+    saveServers({ ...servers, [name]: serverConfig });
+    const status = await sync.reconnectMcpAndAnnounce({ only: name, enabled: serverConfig.enabled !== false });
+    return { name, status };
+  }
 
   return {
-    /** One-time, idempotent: merge the one-account servers of a multi-account
-     *  connector (`gmail`, `gmail-2`…) into one server holding the accounts
+    /** One-time, idempotent: merge the one-account servers of a catalog
+     *  connector (`notion`, `notion-2`…) into one server holding the accounts
      *  (connector-catalog.mjs mergeConnectorAccountServers). Every account
      *  keeps its address, so its stored sign-in and app password stay as
      *  they are. Settings keyed by a merged-away server name go with it:
@@ -155,30 +216,32 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     },
     // Sign-in / sign-out (resource-mcp-oauth-api.mjs), in this key position.
     ...oauthApi,
-    async addMcpServer(input = {}) {
-      const { name, config: serverConfig } = normalizeMcpServerInput(input);
-      // A catalog connector's server keeps its catalog id (connector-catalog.mjs).
-      const connector = clean(input.connector);
-      if (connector) {
-        if (!connectorById(connector)) throw new Error(`Unknown connector: ${connector}`);
-        serverConfig.connector = connector;
-      }
-      const servers = userServers();
-      // A multi-account connector's account (as its own server config) joins
-      // that connector's one server.
-      if (connector && connectorMultiAccount(connectorById(connector)) && !Array.isArray(input.accounts)) {
-        return addConnectorAccount(servers, connector, name, serverConfig, input);
-      }
-      if (Object.hasOwn(servers, name) || accountTarget(servers, name)) {
-        throw nameTakenError(servers, name);
-      }
-      const owned = pluginMcpServer(name);
-      if (owned) throw new Error(`MCP server already exists: ${name} (provided by plugin "${owned.owner.id}")`);
-      await storeOAuthClientSecret(input, serverConfig);
-      await storeGmailAppPassword(input, serverConfig, true);
-      saveServers({ ...servers, [name]: serverConfig });
-      const status = await sync.reconnectMcpAndAnnounce({ only: name, enabled: serverConfig.enabled !== false });
-      return { name, status };
+    addMcpServer,
+    /** One more account of catalog connector `input.connector`, connected as
+     *  its catalog entry says: `key` for an API-key service (Hugging Face,
+     *  Stripe; Postgres takes its connection string), `email` and
+     *  `appPassword` for Gmail, nothing more for a sign-in service (the
+     *  account then signs in with beginMcpOAuthLogin(account)); the user's own
+     *  OAuth client rides on `oauthClientId` / `oauthClientSecret`. The account
+     *  gets a free name (`notion`, `notion-2`…) and joins the connector's one
+     *  server, which is made when there is none. Resolves `{ name, account,
+     *  status }`: the server's name and the new account's (for a Gmail
+     *  address already connected, that account, which took the new password). */
+    async addConnectorAccount(input = {}) {
+      const entry = connectorById(clean(input.connector));
+      if (!entry) throw new Error(`Unknown connector: ${clean(input.connector)}`);
+      // Its name is picked from the servers the additions before it saved.
+      return oneAddAtATime(entry.id, () => {
+        const name = freeName(userServers(), entry.id);
+        const account = connectorAppPasswordOnly(entry)
+          ? gmailAppPasswordServerInput(name, input.email, input.appPassword)
+          : connectorServerInput(entry, name, input.key);
+        const ownClient = clean(input.oauthClientId);
+        return addServerNow({
+          ...account,
+          ...(ownClient ? { oauthClientId: ownClient, oauthClientSecret: input.oauthClientSecret } : {}),
+        });
+      });
     },
     async saveMcpServer(input = {}) {
       const servers = userServers();

package/src/session-runtime/resource-mcp-connector-accounts.mjs

@@ -1,6 +1,7 @@
-// The accounts of a multi-account connector server as the MCP server API
-// edits them: adding one more account (into its server, or a new server
-// holding it) and editing one account's transport, app password or client.
+// The accounts of a connector server as the MCP server API edits them: adding
+// one more account (into its server, or a new server holding it) and editing
+// one account's transport, app password or client.
+import { randomUUID } from 'node:crypto';
 import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import {
   mergeMcpServerConfig,
@@ -13,15 +14,16 @@ import {
   connectorAccountServers,
   connectorAccountsOf,
   connectorAccountsUrl,
-  connectorById,
   connectorOfServer,
+  connectorServerSettings,
   gmailAppPasswordAccount,
   withConnectorAccountEnabled,
 } from '../runtime/shared/connector-catalog.mjs';
 import { forgetConnectorAccountHealth } from '../runtime/connectors/connector-accounts-mcp.mjs';
-import { accountTarget, mergedServerInput, nameTakenError, oauthUrlOf } from './resource-mcp-servers.mjs';
+import { hasConfiguredMcpAuth } from '../runtime/agent/orchestrator/mcp/client-transport.mjs';
+import { accountTarget, mergedServerInput, nameTakenError, oauthCredentialOf } from './resource-mcp-servers.mjs';
 
-/** The server of multi-account connector `connector` in `servers`, or ''. */
+/** The server of connector `connector` in `servers`, or ''. */
 function connectorServerName(servers, connector) {
   return (
     Object.keys(servers).find(
@@ -36,7 +38,7 @@ function connectorServerName(servers, connector) {
 export const editsServerItself = (target, input) => {
   if (target.serverName !== target.account.name || !clean(input.url)) return false;
   try {
-    return oauthUrlOf({ type: input.type || 'http', url: input.url }) === oauthUrlOf(target.cfg);
+    return oauthCredentialOf({ type: input.type || 'http', url: input.url }) === oauthCredentialOf(target.cfg);
   } catch {
     return false;
   }
@@ -51,12 +53,14 @@ export function createConnectorAccountEdits({
   storeOAuthClientSecret,
   storeGmailAppPassword,
   forgetUnusedGmailAppPassword,
+  forgetStoredSecrets,
   releaseOAuth,
 }) {
-  /** One more account of multi-account connector `connector` (one-account
-   *  config `accountCfg` as normalized from `input`): into its server, or a
-   *  new server named `name` holding it. The same Gmail address again takes
-   *  the new app password. Resolves `{ name, account, status }`. */
+  /** One more account of connector `connector` (one-account config
+   *  `accountCfg` as normalized from `input`): into its server, or a new
+   *  server named `name` holding it. The same Gmail address again takes the
+   *  new app password. `servers` is read under the caller's per-connector
+   *  serialization (resource-mcp-api.mjs). Resolves `{ name, account, status }`. */
   async function addConnectorAccount(servers, connector, name, accountCfg, input) {
     const serverName = connectorServerName(servers, connector);
     const address = gmailAppPasswordAccount(accountCfg);
@@ -77,29 +81,38 @@ export function createConnectorAccountEdits({
     }
     const accountName = serverName ? freeName(servers, name) : name;
     const account = connectorAccountEntry(accountName, accountCfg);
-    // Sign-in tokens are stored per exact URL: another account needs its own.
-    const backendUrl = connectorById(connector)?.backend?.url;
-    if (
-      !address &&
-      cfg &&
-      connectorAccountServers(cfg).some((other) => oauthUrlOf(other) === oauthUrlOf({ type: 'http', url: account.url }))
-    ) {
-      account.url = `${backendUrl}?account=${encodeURIComponent(accountName)}`;
+    // A sign-in is stored per exact URL: another account signing in at the
+    // same URL gets its own key, so the two never share tokens.
+    const asServer = connectorAccountServer({ connector }, account);
+    const signIn = hasConfiguredMcpAuth(asServer) ? null : oauthCredentialOf(asServer);
+    if (signIn && cfg && connectorAccountServers(cfg).some((other) => oauthCredentialOf(other) === signIn)) {
+      account.oauthKey = randomUUID();
     }
     const storedCfg = connectorAccountServer({ connector }, account);
-    await storeOAuthClientSecret(input, storedCfg);
-    await storeGmailAppPassword(input, storedCfg, true);
-    forgetConnectorAccountHealth(accountName);
     let target = serverName;
-    if (cfg) {
-      servers[serverName] = { ...cfg, accounts: [...connectorAccountsOf(cfg), account] };
-    } else {
-      // The server's own settings (timeouts, enabled) ride on the input.
-      const { type: _type, url: _url, headers: _headers, oauthClientId: _client, ...rest } = accountCfg;
-      target = name;
-      servers[name] = { ...rest, type: 'http', url: connectorAccountsUrl(connector), connector, accounts: [account] };
+    // Its secrets and its config land together: a failed step takes back the secrets.
+    try {
+      await storeOAuthClientSecret(input, storedCfg);
+      await storeGmailAppPassword(input, storedCfg, true);
+      if (cfg) {
+        servers[serverName] = { ...cfg, accounts: [...connectorAccountsOf(cfg), account] };
+      } else {
+        // The server's own settings (timeouts, enabled) ride on the input.
+        target = name;
+        servers[name] = {
+          ...connectorServerSettings(accountCfg),
+          type: 'http',
+          url: connectorAccountsUrl(connector),
+          connector,
+          accounts: [account],
+        };
+      }
+      saveServers(servers);
+    } catch (error) {
+      await forgetStoredSecrets(storedCfg);
+      throw error;
     }
-    saveServers(servers);
+    forgetConnectorAccountHealth(accountName);
     const status = await sync.reconnectMcpAndAnnounce({ only: target, enabled: servers[target].enabled !== false });
     return { name: target, account: accountName, status };
   }
@@ -116,7 +129,7 @@ export function createConnectorAccountEdits({
     await storeOAuthClientSecret(input, next, accountCfg);
     await storeGmailAppPassword(input, next, false);
     // Settings that are not the account's transport (timeouts) are the server's.
-    const { type: _type, url: _url, headers: _headers, oauthClientId: _client, ...serverFields } = config;
+    const serverFields = connectorServerSettings(config);
     const server = { ...cfg };
     for (const group of MCP_TIMEOUT_FIELD_GROUPS) {
       if (group.some((field) => Object.hasOwn(serverFields, field))) for (const field of group) delete server[field];

package/src/session-runtime/resource-mcp-secrets.mjs

@@ -6,8 +6,8 @@ import {
   gmailAppPasswordValue,
   connectorAccountServers,
 } from '../runtime/shared/connector-catalog.mjs';
-import { forgetConnectorAccountHealth } from '../runtime/connectors/connector-accounts-mcp.mjs';
-import { oauthUrlOf } from './resource-mcp-servers.mjs';
+import { forgetConnectorAccountHealth, retireConnectorAccount } from '../runtime/connectors/connector-accounts-mcp.mjs';
+import { oauthCredentialOf } from './resource-mcp-servers.mjs';
 
 /** Every config `servers` connects with, a multi-account server's accounts
  *  as the one-account configs they are. */
@@ -44,15 +44,16 @@ export function createMcpServerSecrets({
     }
   };
   // A server's OAuth tokens and client registration go with it, unless another
-  // configured server (plugin or disabled ones included, even with MCP
-  // disabled for this runtime) still uses them through the same exact URL.
-  // `signIn` tells the caller what happened to the sign-in: `removed` (local
-  // secrets deleted, `revoked` when the provider confirmed the revocation
-  // too), `shared` (another server still uses it), or none (null).
+  // configured server or account (plugin or disabled ones included, even with
+  // MCP disabled for this runtime) still uses them through the same exact URL
+  // (or the same account key). `signIn` tells the caller what happened to the
+  // sign-in: `removed` (local secrets deleted, `revoked` when the provider
+  // confirmed the revocation too), `shared` (another server still uses it),
+  // or none (null).
   const releaseOAuth = async (cfg) => {
-    const url = oauthUrlOf(cfg);
-    if (!url) return null;
-    if (expandedConfigs(resolveConfiguredMcpCatalog().servers).some((other) => oauthUrlOf(other) === url)) {
+    const key = oauthCredentialOf(cfg);
+    if (!key) return null;
+    if (expandedConfigs(resolveConfiguredMcpCatalog().servers).some((other) => oauthCredentialOf(other) === key)) {
       return { signIn: 'shared', revoked: false };
     }
     const { revoked = false } = (await clearMcpServerOAuth(cfg, { revoke: true })) || {};
@@ -66,10 +67,19 @@ export function createMcpServerSecrets({
     await gmailAppPassword.forget(account);
     return true;
   };
+  // What storeOAuthClientSecret / storeGmailAppPassword stored for `cfg`, gone
+  // again unless a configured server uses it (an add that was not saved).
+  const forgetStoredSecrets = async (cfg) => {
+    await forgetUnusedGmailAppPassword(gmailAppPasswordAccount(cfg));
+    if (!cfg?.url || !cfg.oauthClientId) return;
+    const servers = expandedConfigs(resolveConfiguredMcpCatalog().servers);
+    if (!servers.some((other) => other.url === cfg.url && other.oauthClientId)) await saveOAuthClientSecret(cfg.url, '');
+  };
   // A removed account keeps no sign-in another configured server or account
   // does not share: `{ signIn, revoked }` as removeMcpServer reports it.
   const releaseAccount = async (accountCfg) => {
     forgetConnectorAccountHealth(accountCfg.name);
+    retireConnectorAccount(accountCfg.connector, accountCfg.name);
     const address = gmailAppPasswordAccount(accountCfg);
     if (address) {
       const forgotten = await forgetUnusedGmailAppPassword(address);
@@ -78,5 +88,12 @@ export function createMcpServerSecrets({
     return releaseOAuth(accountCfg);
   };
 
-  return { storeOAuthClientSecret, storeGmailAppPassword, releaseOAuth, forgetUnusedGmailAppPassword, releaseAccount };
+  return {
+    storeOAuthClientSecret,
+    storeGmailAppPassword,
+    releaseOAuth,
+    forgetUnusedGmailAppPassword,
+    forgetStoredSecrets,
+    releaseAccount,
+  };
 }

package/src/session-runtime/resource-mcp-servers.mjs

@@ -3,7 +3,7 @@
 // name refusals and the merge of a partial server edit.
 import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { MCP_TIMEOUT_FIELD_GROUPS } from '../runtime/agent/orchestrator/runtime-core/plugin-mcp.mjs';
-import { resolveMcpOAuthUrl } from '../runtime/agent/orchestrator/mcp/client-config.mjs';
+import { resolveMcpOAuthCredentialKey } from '../runtime/agent/orchestrator/mcp/client-config.mjs';
 import {
   connectorAccountServer,
   connectorAccountsOf,
@@ -11,10 +11,11 @@ import {
   connectorOfServer,
 } from '../runtime/shared/connector-catalog.mjs';
 
-/** The URL a server's OAuth credentials are stored under, or null. */
-export function oauthUrlOf(cfg) {
+/** What a server's OAuth credentials are stored under (its URL, or a
+ *  connector account's own key), or null. */
+export function oauthCredentialOf(cfg) {
   try {
-    return resolveMcpOAuthUrl(cfg);
+    return resolveMcpOAuthCredentialKey(cfg);
   } catch {
     // No valid remote URL: such a server never logged in.
     return null;

package/src/session-runtime/resource-recall-api.mjs

@@ -1,6 +1,11 @@
 // Memory control and recall: the current session's own rows first, then the
 // memory runtime (with a forced ingest of the live session when it is empty).
-import { clean, toolResponseText, isEmptyRecallText, currentSessionRecallRows } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import {
+  clean,
+  toolResponseText,
+  isEmptyRecallText,
+  currentSessionRecallRows,
+} from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 
 function isIdentityRecallQuery(query) {
   const q = clean(query).toLowerCase().replace(/\s+/g, '');

package/src/session-runtime/runtime-feature-gates.mjs

@@ -4,7 +4,11 @@
 //
 // Key names mirror the dependency names of settings-api.mjs / the session-build
 // deps, so the runtime can hand them straight through.
-import { builtinFeatureActive, featureDisallowedToolsFor, localGitToolsActive } from '../runtime/agent/orchestrator/runtime-core/builtin-features.mjs';
+import {
+  builtinFeatureActive,
+  featureDisallowedToolsFor,
+  localGitToolsActive,
+} from '../runtime/agent/orchestrator/runtime-core/builtin-features.mjs';
 import { recapEnabled } from '../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
 import { browserBridgeAvailableSync } from '../runtime/browser-bridge/client.mjs';
 import { computerBridgeAvailableSync } from '../runtime/computer-bridge/client.mjs';

package/src/session-runtime/services/agent-tool/execute.mjs

@@ -66,15 +66,20 @@ export function createAgentExecute({
             });
           }
           // Targetless status is the same compact overview as list.
-          return renderResult({
-            // Idle workers stay open for follow-ups; the model must see them to close them.
-            workers: views.list({
-              scanSessions: registry.wantsSessionScan(args),
-              context: scopedContext,
-              includeIdle: true,
-            }),
-            jobs: views.listJobs(scopedContext),
-          });
+          return renderResult(
+            {
+              // Idle workers stay open for follow-ups; the roster counts them and
+              // lists a bounded tail (or the `tag` matches) so they can be closed.
+              workers: views.list({
+                scanSessions: registry.wantsSessionScan(args),
+                context: scopedContext,
+                includeIdle: true,
+                includeClosed: true,
+              }),
+              jobs: views.listJobs(scopedContext),
+            },
+            { listFilter: clean(args.tag) }
+          );
         case 'read':
           return await readJob(args, scopedContext);
         case 'cleanup':

package/src/session-runtime/services/agent-tool/job-views/agent-list.mjs

@@ -27,8 +27,12 @@ export function isActiveWorkerRow(row = {}) {
 
 // A finished worker that is still open: it takes follow-ups and can be closed.
 function isOpenIdleRow(row = {}) {
-  const status = String(row.status ?? '').trim().toLowerCase();
-  const stage = String(row.stage ?? '').trim().toLowerCase();
+  const status = String(row.status ?? '')
+    .trim()
+    .toLowerCase();
+  const stage = String(row.stage ?? '')
+    .trim()
+    .toLowerCase();
   if (CANCELLED_WORKER_STATUS.test(stage) || CANCELLED_WORKER_STATUS.test(status)) return false;
   return (status || stage) === 'idle';
 }
@@ -86,7 +90,13 @@ function agentRow({ tag, session, runtime, progress, now, indexRow = null }) {
 }
 
 export function createAgentList({ mgr, refreshTagsFromSessions, agentSessionEntries, progress }) {
-  return function list({ scanSessions = false, context = {}, includeTerminal = false, includeIdle = false } = {}) {
+  return function list({
+    scanSessions = false,
+    context = {},
+    includeTerminal = false,
+    includeIdle = false,
+    includeClosed = false,
+  } = {}) {
     refreshTagsFromSessions({ scanSessions, context });
     const now = Date.now();
     const rows = [];
@@ -98,7 +108,13 @@ export function createAgentList({ mgr, refreshTagsFromSessions, agentSessionEntr
       // 2 s) would otherwise read every worker it ever ran, whole transcripts
       // on first sight, synchronously on the daemon loop.
       const state = rowState(session, runtime);
-      if (!includeTerminal && !isActiveWorkerRow(state) && !(includeIdle && isOpenIdleRow(state))) continue;
+      if (
+        !includeTerminal &&
+        !isActiveWorkerRow(state) &&
+        !(includeIdle && isOpenIdleRow(state)) &&
+        !(includeClosed && state.status === 'closed')
+      )
+        continue;
       rows.push(
         agentRow({
           tag,