mixdog 1.4.1 → 1.4.2

package/src/runtime/agent/orchestrator/session/conversation-import/claude.mjs

@@ -14,6 +14,7 @@ import {
   IMAGE_OMITTED_TEXT,
   IMPORT_WARNING_IMAGE_OMITTED,
   isWholeElement,
+  stringOrNull,
   textPart,
   titleFromText,
   toolNote,
@@ -92,7 +93,7 @@ export function isClaudeEnvelopeText(text) {
 const tagValue = (text, tag) => new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`).exec(text)?.[1].trim() || '';
 
 /** A slash-command envelope as Claude Code shows it (`/name args`), else null. */
-export function claudeCommandText(text) {
+function claudeCommandText(text) {
   const trimmed = String(text || '').trim();
   if (!SLASH_COMMAND_RE.test(trimmed)) return null;
   const name = (tagValue(trimmed, 'command-name') || tagValue(trimmed, 'command-message')).replace(/^\//, '');
@@ -101,7 +102,6 @@ export function claudeCommandText(text) {
 }
 
 const isMessageEntry = (record) => record?.type === 'user' || record?.type === 'assistant';
-const stringOrNull = (value) => (typeof value === 'string' && value.trim() ? value.trim() : null);
 const uuidOrNull = (value) => (typeof value === 'string' ? value : null);
 const timestampOrNull = (value) => (typeof value === 'string' || typeof value === 'number' ? value : null);
 // Rough fixed cost of one retained entry object, so tiny entries still count.
@@ -193,7 +193,7 @@ function entryParts(role, content, warnings, marks) {
  * (a cleared rename) ends the name tier without falling back to the AI title.
  * Other record types, such as `task-summary` or `agent-name`, never name it.
  */
-export function createClaudeTitleScan() {
+function createClaudeTitleScan() {
   let custom;
   let ai;
   let summary;

package/src/runtime/agent/orchestrator/session/conversation-import/codex.mjs

@@ -5,7 +5,14 @@
  * messages, Codex's own wrapper user messages, tool outputs, reasoning,
  * event_msg, token counts and turn_context.
  */
-import { IMAGE_OMITTED_TEXT, IMPORT_WARNING_IMAGE_OMITTED, isWholeElement, textPart, toolNote } from './turns.mjs';
+import {
+  IMAGE_OMITTED_TEXT,
+  IMPORT_WARNING_IMAGE_OMITTED,
+  isWholeElement,
+  stringOrNull,
+  textPart,
+  toolNote,
+} from './turns.mjs';
 
 // User-role envelopes Codex injects itself (environment, instructions, abort
 // notices, plugin hints, shell-command echoes, image wrappers).
@@ -36,7 +43,7 @@ export function isCodexEnvelopeText(text) {
 const USER_REQUEST_HEADING = '## My request for Codex:';
 
 /** A user text part as Codex displays it. */
-export function codexUserDisplayText(text) {
+function codexUserDisplayText(text) {
   const at = text.lastIndexOf(USER_REQUEST_HEADING);
   return at < 0 ? text : text.slice(at + USER_REQUEST_HEADING.length).trim();
 }
@@ -64,8 +71,6 @@ function toolName(payload) {
   return payload.type === 'local_shell_call' ? 'local_shell' : '';
 }
 
-const stringOrNull = (value) => (typeof value === 'string' && value.trim() ? value.trim() : null);
-
 // `session_meta.thread_source` values Codex gives threads it runs for itself.
 const INTERNAL_THREAD_SOURCES = {
   subagent: 'subagent',
@@ -81,7 +86,7 @@ const INTERNAL_THREAD_SOURCES = {
  * is the approval reviewer) or `{ internal: … }`. Other sources (cli, vscode,
  * exec, mcp, custom) and features (automation, voice chat) are the user's.
  */
-export function codexInternalKind(payload) {
+function codexInternalKind(payload) {
   const byThread = INTERNAL_THREAD_SOURCES[payload?.thread_source];
   if (byThread) return byThread;
   const source = payload?.source;

package/src/runtime/agent/orchestrator/session/conversation-import/convert.mjs

@@ -58,7 +58,7 @@ export function createConversationConverter(
   let records = 0;
   let malformed = 0;
   let tooLarge = false;
-  let historyPartial = false;
+  let historyPartial = null;
   return {
     /** True while every message seen so far is a Claude sidechain message. */
     get sidechainOnly() {
@@ -67,9 +67,9 @@ export function createConversationConverter(
     markTooLarge() {
       tooLarge = true;
     },
-    /** A history base could not be followed in full. */
-    markHistoryPartial() {
-      historyPartial = true;
+    /** A history base could not be followed in full; `warning` names why. */
+    markHistoryPartial(warning = IMPORT_WARNING_HISTORY_PARTIAL) {
+      historyPartial = warning;
     },
     /** Feed a line for the stored title only (Claude Code's tail window); other sources ignore it. */
     pushTitleLine(raw) {
@@ -117,7 +117,7 @@ export function createConversationConverter(
       if (transcriptChars(turns) > maxTranscriptChars) tooLarge = true;
       const warnings = new Set(parsed.warnings);
       if (malformed) warnings.add(IMPORT_WARNING_MALFORMED);
-      if (historyPartial) warnings.add(IMPORT_WARNING_HISTORY_PARTIAL);
+      if (historyPartial) warnings.add(historyPartial);
       let errorCode = null;
       if (tooLarge) errorCode = IMPORT_ERROR_TOO_LARGE;
       else if (parsed.internalKind) errorCode = IMPORT_ERROR_INTERNAL;

package/src/runtime/agent/orchestrator/session/conversation-import/turns.mjs

@@ -11,6 +11,13 @@ export const IMPORT_WARNING_MALFORMED = 'malformed';
 export const IMPORT_WARNING_CWD_MISSING = 'cwdMissing';
 /** The conversation continues a history stored in another file that was not followed. */
 export const IMPORT_WARNING_HISTORY_PARTIAL = 'historyPartial';
+/** Earlier history was left out because following it would pass the import size limit. */
+export const IMPORT_WARNING_HISTORY_SIZE_LIMIT = 'historySizeLimit';
+/** Earlier history was left out because its file is missing or could not be read. */
+export const IMPORT_WARNING_HISTORY_UNAVAILABLE = 'historyUnavailable';
+
+/** A compressed rollout needs a Node.js runtime with zstd; used as the failure code and as the warning of an unreadable base. */
+export const IMPORT_ERROR_NEEDS_NEWER_NODE = 'needsNewerNode';
 
 /** Failure code of a record the source app writes for its own use (not a conversation). */
 export const IMPORT_ERROR_INTERNAL = 'internalRecord';
@@ -33,7 +40,7 @@ export function toolNote(name) {
 }
 
 /** Longest model-facing run line, and the longest tool name shown in it. */
-export const TOOL_RUN_LINE_MAX_CHARS = 400;
+const TOOL_RUN_LINE_MAX_CHARS = 400;
 const TOOL_RUN_NAME_MAX_CHARS = 40;
 
 /**
@@ -67,6 +74,9 @@ function toolRunCounts(notes) {
   return [...counts].map(([name, count]) => ({ name, count }));
 }
 
+/** A trimmed non-blank string, else null. */
+export const stringOrNull = (value) => (typeof value === 'string' && value.trim() ? value.trim() : null);
+
 export function textPart(text) {
   return { text: String(text), note: false };
 }

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -39,9 +39,10 @@ export function createEagerDispatcher({
     repeatFailLimit,
   });
   const barriers = createEagerBarriers({ cwd });
-  // A capped turn runs its calls in order, so none past its cap starts early
-  // (loop/turn-limits.mjs).
-  const capped = turnLimitsOf(opts) !== null;
+  // A turn capped by calls or time runs its calls in order, so none past its
+  // cap starts early (loop/turn-limits.mjs).
+  const limits = turnLimitsOf(opts);
+  const capped = limits !== null && (limits.maxToolCalls !== Infinity || limits.wrapUpAt !== Infinity);
   const execute = (call, entry) =>
     executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, {
       toolCallId: call.id,

package/src/runtime/agent/orchestrator/session/human-gate/requests.mjs

@@ -7,12 +7,19 @@
 //   secret     — the user types a value into a target field; the request names
 //                the target and the field label, never a value;
 //   takeover   — the user does a step themselves and says "done";
-//   permission — the user picks one of the offered scopes.
+//   permission — the user picks one of the offered scopes;
+//   connector  — a bot asks for more authority on one connector tool of its
+//                own: the card names the tool, its current level and the one
+//                asked for, and the person picks the level (`scope`: one of
+//                `choices`) or denies. Answered once, never remembered.
 // A response is one of HUMAN_RESPONSES plus a `remember` scope; a policy lists
 // the scopes it allows and can leave out `always`. Nothing here ever carries a
 // secret value: a decision that names one is stripped to its verdict.
 
-const HUMAN_REQUEST_KINDS = Object.freeze(['approval', 'outbound', 'secret', 'takeover', 'permission']);
+const HUMAN_REQUEST_KINDS = Object.freeze(['approval', 'outbound', 'secret', 'takeover', 'permission', 'connector']);
+/** The levels a connector card may raise a tool to. */
+export const CONNECTOR_WIDEN_LEVELS = Object.freeze(['needs_approval', 'auto']);
+const CONNECTOR_LEVELS = ['disabled', ...CONNECTOR_WIDEN_LEVELS];
 const HUMAN_RESPONSES = Object.freeze(['approve', 'deny', 'edit-and-approve', 'provide-secret', 'skip', 'done']);
 const REMEMBER_SCOPES = Object.freeze(['once', 'agent', 'always']);
 export const SECRET_REQUEST_TIMEOUT_MS = 120_000;
@@ -36,6 +43,7 @@ const RESPONSES_BY_KIND = Object.freeze({
   secret: ['provide-secret', 'skip'],
   takeover: ['done', 'deny'],
   permission: ['approve', 'deny'],
+  connector: ['approve', 'deny'],
 });
 const GRANTING_RESPONSES = new Set(['approve', 'edit-and-approve', 'provide-secret', 'done']);
 const TEXT_LIMIT = 200;
@@ -89,12 +97,15 @@ function rememberScopes(value) {
   return ['once', ...new Set(listed.filter((scope) => scope !== 'once'))];
 }
 
-/** The kind-specific fields of a request, whitelisted. Spread onto the
- *  presented request; `args` is replaced for a secret so no value rides it. */
+/** The kind-specific fields of a request, whitelisted, plus the connector
+ *  `account` a tool call is bound to (any kind; the card names it). Spread
+ *  onto the presented request; `args` is replaced for a secret so no value
+ *  rides it. */
 export function humanRequestFields(input = {}) {
+  const bound = text(input?.account) ? { account: text(input.account) } : {};
   const kind = input?.kind;
-  if (!HUMAN_REQUEST_KINDS.includes(kind)) return {};
-  const fields = { remember: rememberScopes(input.remember) };
+  if (!HUMAN_REQUEST_KINDS.includes(kind)) return bound;
+  const fields = { ...bound, remember: rememberScopes(input.remember) };
   // The agent the request acts for (its name on the card and the remembered grant).
   if (text(input.agentId)) fields.agentId = text(input.agentId);
   if (kind === 'outbound' && isRecord(input.outbound)) {
@@ -187,6 +198,20 @@ export function humanRequestFields(input = {}) {
         })),
     };
   }
+  if (kind === 'connector') {
+    const connector = isRecord(input.connector) ? input.connector : {};
+    const level = (value) => (CONNECTOR_LEVELS.includes(value) ? value : '');
+    fields.connector = {
+      server: text(connector.server),
+      tool: text(connector.tool),
+      from: level(connector.from),
+      requested: level(connector.requested),
+      choices: (Array.isArray(connector.choices) ? connector.choices : []).filter((choice) =>
+        CONNECTOR_WIDEN_LEVELS.includes(choice)
+      ),
+    };
+    fields.remember = ['once'];
+  }
   return fields;
 }
 
@@ -226,6 +251,11 @@ export function normalizeHumanResponse(request, approved, extra = {}) {
     const ids = (request?.permission?.scopes || []).map((scope) => scope.id);
     if (ids.includes(extra?.scope)) result.scope = extra.scope;
   }
+  // The level the person picked; none of the offered ones picks nothing.
+  if (kind === 'connector' && polarity) {
+    const choices = Array.isArray(request?.connector?.choices) ? request.connector.choices : [];
+    if (choices.includes(extra?.scope)) result.scope = extra.scope;
+  }
   return result;
 }
 

package/src/runtime/agent/orchestrator/session/loop/fresh-context.mjs

@@ -281,9 +281,11 @@ function currentSkillResolver(sessionRef, { preview = false } = {}) {
     const { resource } = delivery;
     // The tools whose use counts as use of the skill: its tool dependencies,
     // an MCP server as `mcp:<server>`.
-    const tools = (resource.toolDependencies || []).flatMap(({ type, value }) =>
-      type === 'tool' ? [value] : type === 'mcp' ? [`mcp:${value}`] : []
-    );
+    const tools = (resource.toolDependencies || []).flatMap(({ type, value }) => {
+      if (type === 'tool') return [value];
+      if (type === 'mcp') return [`mcp:${value}`];
+      return [];
+    });
     if (preview) return { body: delivery.body, native: undefined, tools };
     const envelope = loadSkillToolDependencies(
       buildSkillToolEnvelope(name, resource.content, resource.dir, resource),

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -21,9 +21,20 @@ const isArgsObject = (value) => value && typeof value === 'object' && !Array.isA
 
 async function askApproval(
   call,
-  { callerSessionId, executeOpts, toolApprovalHook, decision, request = null, gate = null, onApproved = null }
+  {
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+    decision,
+    request = null,
+    gate = null,
+    onApproved = null,
+    account = '',
+  }
 ) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
+  // The connector account the call is bound to rides on the card.
+  if (account) request = { ...(request || {}), account };
   // While the user decides, the session is waiting on them, not working.
   const releaseApprovalWait = beginSessionApprovalWait(callerSessionId);
   let askOutcome;
@@ -72,9 +83,13 @@ export const CONNECTOR_APPROVAL_REASON = 'This connector tool is set to ask befo
  * remembered outbound grant answered it) is not asked a second time. With the
  * "Allow all actions" developer option on, `needs_approval` is not asked
  * either (a payment or permanent delete was asked by the outbound gate above).
+ * `account` is the connector account the call is bound to, for the card.
  * @returns {Promise<{ denial: string } | null>} the denial, or null to run
  */
-export function applyConnectorApproval(call, { agentId, callerSessionId, executeOpts, toolApprovalHook }) {
+export function applyConnectorApproval(
+  call,
+  { agentId, callerSessionId, executeOpts, toolApprovalHook, account = '' }
+) {
   if (call.outboundApproved) return null;
   if (!actingBotId(callerSessionId)) return null;
   if (agentMcpToolPermission(agentId, call.name) !== 'needs_approval') return null;
@@ -89,6 +104,7 @@ export function applyConnectorApproval(call, { agentId, callerSessionId, execute
     toolApprovalHook,
     decision: { reason: CONNECTOR_APPROVAL_REASON },
     request: rememberable ? { kind: 'approval', agentId: botId, remember: ['once', 'agent'] } : null,
+    account,
     onApproved: async (approval) => {
       if (!rememberable || approval?.remember !== 'agent') return;
       try {
@@ -130,6 +146,7 @@ export async function applyBeforeToolHook({
   beforeToolHook,
   toolApprovalHook,
   mcpScopeId = null,
+  account = '',
 }) {
   const call = { name, args, cwd };
   // ask_user and handoff_user are themselves the user prompt; they never go through the ordinary approval gate.
@@ -183,6 +200,8 @@ export async function applyBeforeToolHook({
         decision,
         request,
         gate,
+        // Only while the call is still the one bound to it.
+        account: call.name === name ? account : '',
       });
       if (denied) return denied;
     }

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -67,6 +67,8 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
     signal: executeOpts.signal || null,
     ownerKey: callerSessionId,
     scopeId: mcpScopeId,
+    // A connector account defaults to (and becomes) this conversation's last used.
+    conversation: callerSessionId,
   });
   if (!isBuiltinMailRead(name, mcpScopeId)) return call;
   // The runtime's own record of the links in a mail it read for this session:

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -5,7 +5,7 @@
 //   tool-exec/dispatch.mjs           — executor per tool family
 //   tool-exec/after-hook.mjs         — PostToolUse result override
 //   tool-exec/read-only-deadline.mjs — bounded read-only I/O with partial-output grace
-import { isMcpTool } from '../../mcp/client.mjs';
+import { isMcpTool, resolveMcpToolAccount } from '../../mcp/client.mjs';
 import { connectorPolicyAgentOf } from '../../mcp/agent-connectors.mjs';
 import { prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
 import { refreshDeferredMcpToolCatalog } from '../../runtime-core/tool-catalog.mjs';
@@ -58,6 +58,24 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     callArgs = guarded.args;
     completionToolOpts.shellGuardNotes = guarded.notes;
   }
+  // A connector call is bound to its account before any hook or card sees it,
+  // so an approval approves that account, whatever is used last meanwhile.
+  // It is bound by its unique name; `account` is its label, for display.
+  let bound = '';
+  let account = '';
+  if (isMcpTool(name)) {
+    try {
+      const chosen = resolveMcpToolAccount(name, callArgs, {
+        scopeId: sessionRef?.mcpScopeId || null,
+        conversation: callerSessionId,
+      });
+      bound = chosen?.name || '';
+      account = chosen?.label || '';
+    } catch (error) {
+      return `Error: ${error?.message || String(error)}`;
+    }
+    if (bound) callArgs = { ...callArgs, account: bound };
+  }
   const hooked = await applyBeforeToolHook({
     name,
     args: callArgs,
@@ -67,6 +85,7 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     beforeToolHook: hookFrom(executeOpts, sessionRef, 'beforeToolHook'),
     toolApprovalHook,
     mcpScopeId: sessionRef?.mcpScopeId || null,
+    account,
   });
   if (hooked.denial) return hooked.denial;
   const connectorDenied = await applyConnectorApproval(hooked, {
@@ -74,8 +93,11 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     callerSessionId,
     executeOpts,
     toolApprovalHook,
+    account: hooked.name === name ? account : '',
   });
   if (connectorDenied) return connectorDenied.denial;
+  // A hook's rewrite of the same tool keeps the bound account.
+  if (bound && hooked.name === name) hooked.args = { ...hooked.args, account: bound };
   // A decision can settle after its turn was cancelled. It must never
   // authorize a new mutation, even if the hook ignores the abort signal.
   throwIfAborted(executeOpts.signal);

package/src/runtime/agent/orchestrator/session/loop/turn-limits.mjs

@@ -1,12 +1,14 @@
 /**
  * turn-limits.mjs — a turn's caps (sendOpts.turnLimits; a heartbeat turn's,
- * manager/ask-turn-loop-options.mjs): `maxToolCalls` tool calls and
- * `wrapUpAt` (epoch ms). A call past the cap, or one made after the wrap-up
- * time, is answered without running. Once a cap is reached the model is told
- * to reply, and every later request of the turn forbids tool use
- * (toolChoice 'none'). A response that still calls tools after that ends the
- * turn with no reply, its calls answered unrun. A capped turn runs no call
- * eagerly (eager-dispatch.mjs), so none past the cap starts while streaming.
+ * manager/ask-turn-loop-options.mjs): `maxToolCalls` tool calls,
+ * `wrapUpAt` (epoch ms) and `maxToolRounds` tool-calling responses (an
+ * explorer's, runtime/explore/explorer.mjs). A call past the cap, or one made
+ * after the wrap-up time, is answered without running. Once a cap is reached
+ * the model is told to reply, and every later request of the turn forbids
+ * tool use (toolChoice 'none'). A response that still calls tools after that
+ * ends the turn with no reply, its calls answered unrun. A turn capped by
+ * calls or time runs no call eagerly (eager-dispatch.mjs), so none past the
+ * cap starts while streaming; a round cap cuts only between rounds.
  */
 
 const NOTICE =
@@ -21,6 +23,8 @@ export function turnLimitsOf(opts) {
   return {
     maxToolCalls: Number.isInteger(limits.maxToolCalls) && limits.maxToolCalls >= 0 ? limits.maxToolCalls : Infinity,
     wrapUpAt: Number.isFinite(limits.wrapUpAt) ? limits.wrapUpAt : Infinity,
+    maxToolRounds:
+      Number.isInteger(limits.maxToolRounds) && limits.maxToolRounds >= 0 ? limits.maxToolRounds : Infinity,
   };
 }
 
@@ -49,7 +53,8 @@ export function settleTurnLimits(state, overrun, now = Date.now()) {
   }
   const limits = turnLimitsOf(state.opts);
   if (!limits || state.turnLimitNoticed) return;
-  if (state.toolCallsTotal < limits.maxToolCalls && now < limits.wrapUpAt) return;
+  if (state.toolCallsTotal < limits.maxToolCalls && now < limits.wrapUpAt && state.iterations < limits.maxToolRounds)
+    return;
   state.turnLimitNoticed = true;
   state.messages.push({ role: 'user', content: NOTICE, meta: { source: 'turn-limit' } });
 }

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -19,6 +19,7 @@ import { armTurnDurability, claimTurnRuntime } from './ask-turn-open.mjs';
 import { prepareAskTurn, runAskAgentLoop } from './ask-turn-execute.mjs';
 import { commitAskTurn, publishAskTurn } from './ask-turn-settle.mjs';
 import { finalizeAskTurnFailure } from './ask-turn-failure.mjs';
+import { armTurnTimeoutOnProviderError, reapTurnShellJobs } from './turn-reap.mjs';
 import { cacheWarmTurnKind, endCacheWarmTurn, failedTurnProvenance, noteCacheWarmTurn } from '../cache-warm.mjs';
 
 export { _api_call_with_interrupt } from './ask-call-interrupt.mjs';
@@ -125,6 +126,9 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
     });
     return { result: terminalResultPreview, drained };
   } catch (err) {
+    // The turn's terminal error: a provider timeout/stall that ended it (a
+    // retry the turn recovered from never reaches here) stops its shell work.
+    armTurnTimeoutOnProviderError(sessionId, opened.runtime, opened.turnSignal, err);
     await finalizeAskTurnFailure({
       sessionId,
       err,
@@ -138,12 +142,49 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       transcriptMeta: transcript.raw,
       askStartedAt,
     });
+    reapTurnShellJobs(sessionId, opened.runtime);
     throw err;
   } finally {
-    releaseWorkspace?.();
+    // The result is already published; this only holds the session lock until
+    // the reader lease is removed, so the next turn's admission follows it. A
+    // failed release (the admission thread stopped) never replaces the turn's
+    // own outcome.
+    try {
+      await releaseWorkspace?.();
+    } catch {
+      // Intentionally ignored: see the comment above.
+    }
   }
 }
 
+/** The prompt-cache warmer learns idle gaps from real turns only; a retry is
+ *  classified by the failed turn's stored provenance. The rebuilt retry
+ *  message keeps that provenance (ask-turn-execute.mjs). Returns the warmer's
+ *  turn handle. */
+function noteTurnForCacheWarm(sessionId, claimed, input) {
+  const retryProvenance = failedTurnProvenance(claimed.preSession?.messages, input);
+  if (retryProvenance) input.retryProvenance = retryProvenance;
+  return noteCacheWarmTurn(sessionId, cacheWarmTurnKind(input, claimed.preSession?.messages));
+}
+
+/** Clear the controller only if it's still ours (closeSession may have
+ *  swapped it). The rest of the runtime entry stays intact so agent type=list
+ *  can still surface the final stage (done/error/cancelling). */
+function detachAskRuntime(sessionId, askGeneration) {
+  const entry = _getRuntimeEntry(sessionId);
+  if (entry && entry.generation === askGeneration) {
+    _unlinkParentAbortListener(entry);
+    entry.controller = null;
+    // Detach the live session reference; ask is over.
+    entry.session = null;
+  }
+  // Final-stage runtime diagnostics are useful only while the turn is
+  // unwinding. Once its controller is detached, retaining the full entry
+  // (and any accidental references hanging from it) for the host lifetime
+  // turns one-shot agent traffic into an unbounded manager Map.
+  _evictTerminalSessionRuntime(sessionId);
+}
+
 export async function askSession(sessionId, prompt, context, onToolCall, cwdOverride, explicitPrefetch, askOpts = {}) {
   const askStartedAt = Date.now();
   const transcript = createAskTranscriptMeta(askOpts?.transcriptMeta);
@@ -180,8 +221,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
   // Hoisted so the outer finally (which runs once after the whole turn loop)
   // can compare against the last turn's generation.
   let askGeneration = 0;
-  let crashRecoveryChecked = false;
-  let sessionStartEmitted = false;
+  // Crash-checkpoint recovery and the session-start event belong to the first
+  // turn of this ask only.
+  let firstTurn = true;
   // A failed-turn retry rewinds only the turn it retries, never a drained
   // follow-up turn.
   let retryFailedTurn = askOpts.retryFailedTurn === true;
@@ -218,17 +260,11 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
       const claimed = claimTurnRuntime({
         sessionId,
         askOpts,
-        recoverCheckpoint: !crashRecoveryChecked,
-        emitStart: !sessionStartEmitted,
+        recoverCheckpoint: firstTurn,
+        emitStart: firstTurn,
       });
-      // The prompt-cache warmer learns idle gaps from real turns only; a
-      // retry is classified by the failed turn's stored provenance.
-      // The rebuilt retry message keeps that provenance (ask-turn-execute.mjs).
-      const retryProvenance = failedTurnProvenance(claimed.preSession?.messages, input);
-      if (retryProvenance) input.retryProvenance = retryProvenance;
-      warmTurn = noteCacheWarmTurn(sessionId, cacheWarmTurnKind(input, claimed.preSession?.messages));
-      crashRecoveryChecked = true;
-      sessionStartEmitted = true;
+      warmTurn = noteTurnForCacheWarm(sessionId, claimed, input);
+      firstTurn = false;
       askGeneration = claimed.askGeneration;
       const opened = {
         ...claimed,
@@ -287,21 +323,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
     queue.releaseUnstarted();
     // A thrown setup/provider path must never leave a delayed checkpoint
     // writer alive after the turn lock is released.
-    // Clear the controller only if it's still ours (closeSession may have
-    // swapped it). Leave the rest of the runtime entry intact so agent type=list
-    // can still surface the final stage (done/error/cancelling).
-    const entry = _getRuntimeEntry(sessionId);
-    if (entry && entry.generation === askGeneration) {
-      _unlinkParentAbortListener(entry);
-      entry.controller = null;
-      // Detach the live session reference; ask is over.
-      entry.session = null;
-    }
-    // Final-stage runtime diagnostics are useful only while the turn is
-    // unwinding. Once its controller is detached, retaining the full entry
-    // (and any accidental references hanging from it) for the host lifetime
-    // turns one-shot agent traffic into an unbounded manager Map.
-    _evictTerminalSessionRuntime(sessionId);
+    detachAskRuntime(sessionId, askGeneration);
     unlock();
   }
 }

package/src/runtime/agent/orchestrator/session/manager/prompt-utils.mjs

@@ -578,6 +578,7 @@ function isReferenceFilesMessage(message) {
 }
 
 export { isProtectedContextUserMessage };
+export { BP3_PART_SEPARATOR, bp3SystemMessage, bpEnvSystemMessage, replaceSystemMessageContent };
 
 // Compact summary messages (role:'user', content startsWith SUMMARY_PREFIX)
 // are synthetic anchors, not a real human turn — they must not count as

package/src/runtime/agent/orchestrator/session/manager/rules-cache.mjs

@@ -117,8 +117,7 @@ export function _buildBaseRules({
     .join('\n\n---\n\n');
 }
 
-export function _buildAgentRules(profile = 'full') {
-  const key = String(profile || 'full');
+export function _buildAgentRules() {
   const PLUGIN_ROOT = mixdogRoot();
   const DATA_DIR = resolvePluginData();
   const RULES_DIR = join(PLUGIN_ROOT, 'rules');
@@ -126,8 +125,8 @@ export function _buildAgentRules(profile = 'full') {
     'buildAgentRoleContent',
     'agent role rules',
     [join(RULES_DIR, 'agent'), join(DATA_DIR, 'mixdog-config.json')],
-    { PLUGIN_ROOT, DATA_DIR, profile: key },
-    key
+    { PLUGIN_ROOT, DATA_DIR },
+    'full'
   );
 }
 

package/src/runtime/agent/orchestrator/session/manager/runtime-liveness.mjs

@@ -35,6 +35,7 @@ import { registerSessionPurgeHook } from '../store.mjs';
 import { finishComputerTurn } from '../../../../computer-bridge/client.mjs';
 import { configureUsageMetricsRuntime, dropMetricSeenState, bumpUsageMetricsTurnId } from './usage-metrics.mjs';
 import { runtimeState as _runtimeState, isTurnInFlight } from './runtime-state.mjs';
+import { resetTurnShellReap } from './turn-reap.mjs';
 
 export { IN_FLIGHT_STAGES, inFlightSessionActivity } from './runtime-state.mjs';
 
@@ -216,6 +217,7 @@ export function markSessionAskStart(id) {
   // after provider admission (the scheduler emits stage=requesting).
   const now = Date.now();
   entry.askStartedAt = now;
+  resetTurnShellReap(id, entry);
   _setLogicalModelRequest(entry, null);
   entry.lastProgressAt = now;
   entry.updatedAt = now;

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -30,6 +30,7 @@ import { releaseReadSnapshotScope } from '../../tools/builtin/snapshot-store.mjs
 import { cancelOwnedShellTrees } from '../../tools/lib/owned-shell-trees.mjs';
 import { noteShellOwnerSessionClosed } from '../../tools/builtin/lib/shell-job-records.mjs';
 import { forgetSideQuestion } from '../side-question-store.mjs';
+import { cancelBackgroundTasks } from '../../../../shared/background-tasks.mjs';
 
 /**
  * Close a session. Plants a `closed=true` tombstone on disk with a bumped
@@ -214,6 +215,12 @@ function cancelOwnedShellProcesses({ id, reason, tombstone }) {
   } catch {
     unconfirmed();
   }
+  // What a finished command left running is a tracked task, not an owned tree.
+  try {
+    cancelBackgroundTasks({ surface: 'shell', executionSessionId: id, reason, notify: false });
+  } catch {
+    unconfirmed();
+  }
   noteShellOwnerSessionClosed(id);
 }
 

package/src/runtime/agent/orchestrator/session/manager/session-crud.mjs

@@ -14,6 +14,7 @@ import { runSessionCompaction, resolveSessionCompactionPolicy } from './compacti
 import {
   currentContextEstimateTokens,
   invalidateContextUsageSnapshot,
+  invalidateProviderContextBaseline,
   recordContextUsageSnapshot,
   resolveGaugeContextTokens,
 } from '../loop/compact-policy.mjs';
@@ -26,6 +27,8 @@ import {
 import { getProvider } from '../../providers/registry.mjs';
 import { isSessionCompactionBlocked, getSessionAbortSignal, _runtimeEntries } from './runtime-liveness.mjs';
 import { mintSessionId } from './session-id.mjs';
+import { useOwnScratchEnvironment } from './session-scratch-environment.mjs';
+import { rebindToChangedPrefix } from '../thinking-binding.mjs';
 import { hideCompactionArchive } from '../compaction-archive-capture.mjs';
 import { writeStderrBestEffort } from '../../../../shared/best-effort-stderr.mjs';
 import { forgetSideQuestion } from '../side-question-store.mjs';
@@ -234,6 +237,18 @@ function forkOutgoingTranscript(session, messages, now, archiveAs = '') {
       ...clearedTokenAccounting(now),
     };
     delete fork.liveTurnMessages;
+    // The spread copied the source's environment: the fork names its own
+    // scratch directory (its shell commands use it), not the source's.
+    if (useOwnScratchEnvironment(fork)) {
+      // The system prefix changed: thinking stored in the copy was bound to the
+      // source's prefix (and an open tool round ended), and every measurement
+      // taken against it is stale. Resume then finds a matching prefix and
+      // would repair nothing.
+      fork.messages = rebindToChangedPrefix(fork.messages);
+      delete fork._providerPrefixGuardState;
+      invalidateContextUsageSnapshot(fork);
+      invalidateProviderContextBaseline(fork);
+    }
     // The archive sidecar belongs to the source id; the fork has none.
     if (fork.compaction?.archive) {
       fork.compaction = { ...fork.compaction };