mixdog 1.4.1 → 1.4.3

package/src/session-runtime/settings-system-api.mjs

@@ -57,7 +57,7 @@ export function createSystemSettings({
     },
     getHeartbeatSettings() {
       return {
-        heartbeat: getConfig()?.heartbeat !== false,
+        heartbeat: getConfig()?.heartbeat === true,
         intervalMinutes: normalizeHeartbeatIntervalMinutes(getConfig()?.heartbeatIntervalMinutes),
       };
     },

package/src/session-runtime/setup-tool/agent-settings-actions.mjs

@@ -3,8 +3,12 @@
  *  prompt-cache warming. Each goes through the runtime method its settings
  *  surface uses. Permission and connector writes are made as a remote client's
  *  are (`noWiden`): a chat may take authority away, never give an agent more
- *  without asking — that stays with the person in the desktop app. */
+ *  without asking — that stays with the person: in the desktop app, or on
+ *  the approval card a connector tool's widening raises
+ *  (connector-widen-approval.mjs). */
+import { CONNECTOR_POLICY_WIDENS } from '../../runtime/agent/orchestrator/mcp/agent-connectors.mjs';
 import { agentPermissions, setAgentPermission } from '../../runtime/agent/orchestrator/session/human-gate/store.mjs';
+import { askToWidenConnectorTool } from './connector-widen-approval.mjs';
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 
 const NO_WIDEN = Object.freeze({ noWiden: true });
@@ -38,11 +42,17 @@ export const AGENT_SETTINGS_HANDLERS = {
     const name = requireText(args.name, 'name');
     return { agent, connectors: await rt.setAgentConnectorEnabled(agent, name, args.enabled, NO_WIDEN) };
   },
-  async set_agent_connector_tool(rt, args) {
+  // A narrowing applies at once; a widening waits on the person's card.
+  async set_agent_connector_tool(rt, args, context) {
     const agent = requireText(args.agent, 'agent');
     const name = requireText(args.name, 'name');
     const tool = requireText(args.tool, 'tool');
-    await rt.setAgentConnectorToolPermission(agent, name, tool, args.permission, NO_WIDEN);
+    try {
+      await rt.setAgentConnectorToolPermission(agent, name, tool, args.permission, NO_WIDEN);
+    } catch (error) {
+      if (error?.code !== CONNECTOR_POLICY_WIDENS) throw error;
+      return askToWidenConnectorTool(rt, { agent, server: name, tool, requested: args.permission }, context);
+    }
     return { agent, connector: name, tool, permission: args.permission };
   },
   async set_project_connector(rt, args) {

package/src/session-runtime/setup-tool/connector-widen-approval.mjs

@@ -0,0 +1,96 @@
+/** A bot's request for more authority on one connector tool (setup
+ *  set_agent_connector_tool toward auto or needs_approval): the model cannot
+ *  tell the user's words from text it read, so the change waits on an
+ *  approval card (human-gate/requests.mjs kind `connector`) that only a
+ *  person answers. The card offers each level above the tool's current one
+ *  (needs_approval, auto) and Deny; nothing is remembered, so every widening
+ *  asks again. The picked level is applied to that one tool, re-judged on the
+ *  stored policy inside its write (mcp/agent-connectors.mjs
+ *  withApprovedConnectorToolChange): a restriction that landed meanwhile stays. */
+import {
+  CONNECTOR_TOOL_ALREADY,
+  CONNECTOR_TOOL_NARROWED,
+  NO_WIDEN_MESSAGE,
+  PERMISSION_RANK,
+  agentConnectors,
+  connectorGroupId,
+  connectorToolPermission,
+  withApprovedConnectorToolChange,
+} from '../../runtime/agent/orchestrator/mcp/agent-connectors.mjs';
+import { recordHumanDecision } from '../../runtime/agent/orchestrator/session/human-gate/gate.mjs';
+import { CONNECTOR_WIDEN_LEVELS } from '../../runtime/agent/orchestrator/session/human-gate/requests.mjs';
+import { runAbortable } from '../../runtime/shared/abort-race.mjs';
+
+const NO_WIDEN = Object.freeze({ noWiden: true });
+
+/** The tool's effective level for `agent` now, as dispatch reads it. */
+function currentLevel(agent, server, tool) {
+  return connectorToolPermission(agentConnectors(agent), {
+    name: `mcp__${server}__${tool}`,
+    mcpServerName: server,
+    mcpToolName: tool,
+  });
+}
+
+/** Ask the person on a card, then apply the level they picked.
+ *  `requestApproval` is the calling turn's approval hook. */
+export async function askToWidenConnectorTool(
+  rt,
+  { agent, server, tool, requested },
+  { requestApproval, signal, sessionId, toolCallId } = {}
+) {
+  const from = currentLevel(agent, server, tool);
+  const receipt = { agent, connector: server, tool, requested };
+  if (PERMISSION_RANK[from] >= PERMISSION_RANK[requested]) {
+    return { ...receipt, saved: false, permission: from, note: `The tool is already ${from}; nothing changed.` };
+  }
+  // Nobody can be shown a card here: the person makes it in the desktop app.
+  if (typeof requestApproval !== 'function') throw new Error(NO_WIDEN_MESSAGE);
+  const choices = CONNECTOR_WIDEN_LEVELS.filter((level) => PERMISSION_RANK[level] > PERMISSION_RANK[from]);
+  const answer = await runAbortable(signal, () =>
+    requestApproval({
+      name: 'setup',
+      kind: 'connector',
+      agentId: agent,
+      // The card names the connector, not one of its accounts.
+      connector: { server: connectorGroupId(server), tool, from, requested, choices },
+      args: { action: 'set_agent_connector_tool', agent, name: server, tool, permission: requested },
+      reason: `Bot "${agent}" asks to change the permission of ${tool} (${connectorGroupId(server)}) from ${from} to ${requested}.`,
+      remember: ['once'],
+      sessionId,
+      toolCallId,
+    })
+  );
+  const level = answer?.approved === true && choices.includes(answer.scope) ? answer.scope : '';
+  // Audited with the answering device; no grant is ever stored (no action kind).
+  await recordHumanDecision(
+    { agentId: agent, kind: 'connector', tool: `${server}/${tool}`, target: `${from}>${level || requested}` },
+    answer
+  );
+  // A decision that settles after its turn was cancelled authorizes nothing.
+  signal?.throwIfAborted();
+  if (!level) {
+    const why = answer?.timedOut ? 'The approval card timed out' : 'The user did not approve this change';
+    return { ...receipt, saved: false, approved: false, permission: from, note: `${why}; nothing changed.` };
+  }
+  try {
+    await withApprovedConnectorToolChange({ server, tool, from, to: level }, () =>
+      rt.setAgentConnectorToolPermission(agent, server, tool, level, NO_WIDEN)
+    );
+  } catch (error) {
+    if (error?.code !== CONNECTOR_TOOL_NARROWED && error?.code !== CONNECTOR_TOOL_ALREADY) throw error;
+    return {
+      ...receipt,
+      saved: false,
+      approved: true,
+      permission: currentLevel(agent, server, tool),
+      note: `The user approved ${level}, but it was not applied: ${error.message}`,
+    };
+  }
+  return {
+    ...receipt,
+    approved: true,
+    permission: level,
+    note: `The user approved on the card; ${tool} is now ${level}.`,
+  };
+}

package/src/session-runtime/setup-tool/executor.mjs

@@ -92,7 +92,14 @@ const ACTION_APPLIES_TO = {
   set_heartbeat_interval:
     "Mixy's heartbeat from the next tick: the next check is due the new interval after the last one; no restart required",
   set_reactions_enabled:
-    "bots' chats; while off a reaction is refused at once and new chats are not offered the tool; reactions already left stay visible",
+    "bots' chats, this conversation included, from their next turn; while off a reaction is refused at once; reactions already left stay visible",
+  set_profile: 'every conversation, this one included, from its next turn',
+  set_instruction_files: 'every conversation, this one included, from its next turn',
+  set_memory_enabled: 'every conversation, this one included, from its next turn',
+  set_web_search_enabled: 'every conversation, this one included, from its next turn',
+  set_builtin_enabled: 'every conversation, this one included, from its next turn',
+  install_builtin: 'every conversation, this one included, from its next turn',
+  set_output_style: 'every conversation, this one included, from its next turn',
   set_worktree_settings: 'new tasks and worktrees created afterwards; existing worktrees are unchanged',
   set_system_shell: 'subsequent shell calls',
   save_automation: 'the automation worker; scheduled runs follow the saved timing',
@@ -364,7 +371,7 @@ async function featureStatus(rt, getConfig) {
     computer: { active: builtinFeatureActive(config, 'computer') },
     terminal: { active: builtinFeatureActive(config, 'terminal') },
     heartbeat: {
-      enabled: config?.heartbeat !== false,
+      enabled: config?.heartbeat === true,
       intervalMinutes: normalizeHeartbeatIntervalMinutes(config?.heartbeatIntervalMinutes),
     },
     reactions: { enabled: config?.reactions !== false },
@@ -909,7 +916,7 @@ export function createSetupToolExecutor({
     };
   }
 
-  async function execute(args, { signal, callerSessionId }) {
+  async function execute(args, { signal, callerSessionId, requestApproval = null, toolCallId = null }) {
     signal?.throwIfAborted();
     const requestDesktop = (request) => desktop.request(request, { signal });
     const action = validateSetupInput(args);
@@ -948,6 +955,10 @@ export function createSetupToolExecutor({
       getSession: getCallerSession,
       getConfig: () => getConfig?.() || {},
       executeSessionControl,
+      // The calling turn's approval card (a connector tool's widening asks the person).
+      requestApproval,
+      signal,
+      toolCallId,
     });
   }
 

package/src/session-runtime/setup-tool/extended-actions.mjs

@@ -307,6 +307,8 @@ export const EXTENDED_SETUP_HANDLERS = Object.freeze({
       owner: input.owner,
     });
     const next = { ...pick(previous, entryKeys), ...input };
+    // Omitted keeps the saved executor without checking it again (channel-admin.mjs).
+    if (!own(input, 'executorAgentId')) delete next.executorAgentId;
     if (kind === 'schedule') {
       if (previous.whenAt && !own(input, 'time') && !own(input, 'at')) {
         next.at = new Date(previous.whenAt).toISOString();

package/src/session-runtime/setup-tool/settings-contract.mjs

@@ -212,6 +212,11 @@ export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
         description:
           "The bot id that owns the schedule or webhook; each run is a turn in that bot's chat, where it replies with the result. The bot must exist (no representative bot yet = refused). New entries default to the bot of the calling thread (the representative bot = lead); on overwrite, omission keeps the owner.",
       },
+      executorAgentId: {
+        ...removableText,
+        description:
+          'The workflow sub-agent id (Worker, …) that carries out each run first, on its own model; only its final report goes to the owner bot, which relays it in its own words. Must be an enabled workflow sub-agent: never a bot (the representative bot included); unknown or turned-off ids are refused. Set it for recurring work that suits a sub-agent; leave it unset for trivial chat-only routines (the owner bot then does the work itself). null or "" clears it; on overwrite, omission keeps it.',
+      },
       overwrite: { ...boolean, description: 'Explicitly update an existing entry; omitted fields are preserved.' },
     },
     ['name']
@@ -238,6 +243,16 @@ export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
       maximum: 400,
       description: 'Windows only: notification sound volume percent.',
     },
+    sessionAutoArchiveDays: {
+      type: 'integer',
+      enum: [0, 1, 7, 14, 30, 90],
+      description: 'Days without conversation before a session is archived; 0 = never (default 7).',
+    },
+    sessionAutoDeleteDays: {
+      type: 'integer',
+      enum: [0, 7, 30, 90],
+      description: 'Days archived before a session is deleted; 0 = never (default 90).',
+    },
     botOverlay: object(
       {
         enabled: {
@@ -302,6 +317,17 @@ export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
     markdownDefaultView: { type: 'string', enum: ['preview', 'rich', 'source'] },
     linkPreview: boolean,
     toolActivityExpansion: { type: 'string', enum: ['collapsed', 'commands', 'all'] },
+    composerStyle: {
+      type: 'string',
+      enum: ['simple', 'basic', 'detail'],
+      description:
+        'How much the composer shows: simple = the model only; basic (UI label "Normal") = plus usage; detail = plus workflow and delegation (default detail).',
+    },
+    questionAnswerConfirm: {
+      ...boolean,
+      description:
+        'On: picking a single-choice question option only selects it until Send/Next; off: the pick answers at once (default off).',
+    },
     uiFont: { ...text, description: 'Installed font family for the UI; "" restores the built-in font.' },
     codeFont: { ...text, description: 'Installed font family for code; "" restores the built-in font.' },
     skinTransparency: {
@@ -377,4 +403,6 @@ export const SETUP_HANDOFFS = Object.freeze({
   notifications: 'Notification permission/subscription requires a user gesture on the device receiving notifications.',
   pairing: 'Pairing credentials and OS permission approvals remain in the visible UI.',
   memoryContent: 'Use the memory tool for Core Memory, not setup.',
+  instructionTexts:
+    'The Delegation and Output style instruction texts are edited in Settings → Delegation / Output style (revision-checked free text); choose the active output style with set_output_style.',
 });

package/src/session-runtime/setup-tool/tool-defs.mjs

@@ -447,13 +447,38 @@ export const SETUP_TOOL_DEFS = Object.freeze([
               enum: [...WORKTREE_NEW_TASK_DEFAULTS],
               description: 'branch = new tasks use the current branch (default); worktree = a new worktree.',
             },
-            branchPrefix: { type: 'string', description: 'Ref prefix ending with "/"; default "mixdog/".' },
+            branchPrefix: {
+              type: 'string',
+              description:
+                'Optional ref prefix ending with "/", e.g. "mixdog/"; "" (default) names branches after the task alone.',
+            },
             sizeWarnBytes: {
               type: 'integer',
               minimum: 0,
               description: 'Repository size that asks for confirmation first; 0 never asks.',
             },
             autoCleanup: { type: 'boolean', description: 'Remove clean, merged worktrees when their task ends.' },
+            maxWorktrees: {
+              type: 'integer',
+              minimum: 0,
+              maximum: 1000,
+              description:
+                'With autoCleanup: keep at most this many worktrees, least recently used cleaned first; 0 = no limit. Default 15.',
+            },
+            unusedDays: {
+              type: 'integer',
+              minimum: 0,
+              maximum: 3650,
+              description: 'With autoCleanup: clean up worktrees unused this many days; 0 = never. Default 30.',
+            },
+            cleanupArchived: {
+              type: 'boolean',
+              description: 'With autoCleanup: archiving a session cleans up its worktrees. Default true.',
+            },
+            deleteBranch: {
+              type: 'boolean',
+              description: 'Cleanup also deletes the branch (its tip stays under a recovery ref). Default false.',
+            },
           },
           description: 'set_worktree_settings: only the given fields change.',
         },
@@ -477,7 +502,8 @@ export const SETUP_TOOL_DEFS = Object.freeze([
         permission: {
           type: 'string',
           enum: [...CONNECTOR_PERMISSIONS],
-          description: 'set_agent_connector_tool: needs_approval or disabled; auto is made in the desktop app.',
+          description:
+            'set_agent_connector_tool: a narrowing (toward disabled) applies at once; a widening (disabled → needs_approval/auto, needs_approval → auto) waits on an approval card the user answers (needs_approval, auto or deny, whatever was asked) and the result says what was applied.',
         },
         botOrder: {
           type: 'array',

package/src/session-runtime/tool-policy/agent-profile-fold.mjs

@@ -13,10 +13,7 @@ import {
 } from '../../runtime/agent/orchestrator/session/manager/workflow-switch-notice.mjs';
 import { sessionTailCacheExpired } from '../../runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs';
 import { mergePendingDeferredToolDelta } from '../../runtime/agent/orchestrator/runtime-core/deferred-tool-delta.mjs';
-import {
-  agentMcpToolPermission,
-  connectorPolicyAgentOf,
-} from '../../runtime/agent/orchestrator/mcp/agent-connectors.mjs';
+import { foldLateDeferredTools } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
 import { agentListEntries } from '../../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
 import { markToolSurfaceMigrated } from '../../runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs';
 import { resetBp2StableContext } from '../../runtime/agent/orchestrator/context/collect.mjs';
@@ -92,24 +89,14 @@ function cacheCold(session) {
   );
 }
 
-// The connector tools among `names` the session's agent may run now.
-function connectorTools(session, names) {
-  const agent = connectorPolicyAgentOf(session);
-  return [...names]
-    .filter((name) => name.startsWith('mcp__') && agentMcpToolPermission(agent, name) !== 'disabled')
-    .sort();
-}
-
-// A bot thread's tools that changed without its prompt: feature gates that
-// opened (or closed) and connectors added or removed. Nothing in the request
-// prefix moves. An opened tool joins the deferred catalog — reachable by
+// A bot thread's tools that changed without its prompt: workflow and
+// reaction gates that opened (or closed). Nothing in the request prefix
+// moves. An opened tool joins the late deferred catalog — reachable by
 // deferred loading, which brings its schema into the conversation — and a
 // gone one is refused at call time; the next turn's deferred_tools_delta
 // notice names both. Gate changes are folded into the prompt at the next
-// cold point (promptFoldPending). Connectors live in the bot's agent.json,
-// so they are compared only when its profile stamp moved (`edited`).
-// Returns true when anything changed.
-function stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session, workflow, { edited = false } = {}) {
+// cold point (promptFoldPending). Returns true when anything changed.
+function stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session, workflow) {
   const added = [];
   const removed = [];
   const known = new Map(schemaTools(session).map((tool) => [toolName(tool), tool]));
@@ -121,24 +108,17 @@ function stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session
     const fresh = modelStandaloneTools().filter(
       (tool) => opened.includes(toolName(tool)) && !known.has(toolName(tool))
     );
-    if (fresh.length) session.deferredToolCatalog = [...(session.deferredToolCatalog || []), ...fresh];
+    // The late pool, never the boot catalog a native request keeps byte-stable.
+    if (fresh.length) session.deferredLateToolCatalog = [...(session.deferredLateToolCatalog || []), ...fresh];
     for (const tool of fresh) known.set(toolName(tool), tool);
     session.disallowedTools = [...live];
     added.push(...opened.filter((name) => known.has(name)));
     removed.push(...closed);
     session.promptFoldPending = true;
   }
-  // Connectors gate MCP tools at call time only (pre-dispatch-deny.mjs).
-  const previous = session.agentConnectorTools;
-  const permitted = edited || !Array.isArray(previous) ? connectorTools(session, known.keys()) : previous;
-  session.agentConnectorTools = permitted;
-  if (edited && Array.isArray(previous)) {
-    added.push(...permitted.filter((name) => !previous.includes(name)));
-    removed.push(...previous.filter((name) => !permitted.includes(name)));
-  }
-  if (!added.length && !removed.length) {
-    return opened.length + closed.length > 0 || !Array.isArray(previous);
-  }
+  // Connector moves are staged at every turn start, for every session kind
+  // (tool-availability.mjs stageConnectorAvailability).
+  if (!added.length && !removed.length) return opened.length + closed.length > 0;
   mergePendingDeferredToolDelta(session, {
     added: added.map((name) => ({ name, description: known.get(name)?.description || '' })),
     removed,
@@ -162,7 +142,8 @@ function liftAgentDenial({ liveDeniedTools, modelStandaloneTools }, session) {
   if (!known.has('agent')) {
     const fresh = modelStandaloneTools().filter((tool) => toolName(tool) === 'agent');
     if (!fresh.length) return false;
-    session.deferredToolCatalog = [...(session.deferredToolCatalog || []), ...fresh];
+    // The late pool, never the boot catalog a native request keeps byte-stable.
+    session.deferredLateToolCatalog = [...(session.deferredLateToolCatalog || []), ...fresh];
     known.set('agent', fresh[0]);
   }
   session.disallowedTools = disallowed.filter((name) => name !== 'agent');
@@ -185,6 +166,7 @@ export function createAgentProfileFold({
   liveDeniedTools,
   stagePolicy,
   applyPolicy,
+  presentPromptSettings = () => {},
   turnInFlight,
 }) {
   // An agent profile edit that met a running turn: the next turn applies it.
@@ -206,7 +188,13 @@ export function createAgentProfileFold({
     // re-appends its deferred manifest.
     if (typeof staged.stableContext === 'string') resetBp2StableContext(session, staged.stableContext);
     applyPolicy(session, staged);
+    // Late tools join the rebuilt manifest (MCP instructions return with the
+    // server's next tool load): no notice.
+    foldLateDeferredTools(session);
     rewriteConversationBp3Core(session, staged.core);
+    // Every prompt setting as it stands — style, profile, language, core
+    // memory, instruction files — so no part of the prompt contradicts another.
+    presentPromptSettings(session, staged);
     if (session.agentProfileRevision !== undefined) {
       session.agentProfileRevision = agentProfileRevision(identity.agent, { mixy: agentMode });
       const { leadPromptParts } = activeWorkflowContext(config, getDataDir());
@@ -231,7 +219,9 @@ export function createAgentProfileFold({
     // prompt they were created with; they are task-scoped, and their skill
     // bodies are still restored from current sources at Compact.
     if (!session?.id || !session.promptIdentity || isAgentOwner(session)) return false;
-    const compacted = COLD_INTENTS.has(session.pendingCacheBreakIntent);
+    // A compaction is a cold point: the prompt is rebuilt instead of the
+    // dropped notices being sent again (pre-send compaction marks it).
+    const compacted = COLD_INTENTS.has(session.pendingCacheBreakIntent) || session.compactionFoldPending === true;
     if (!compacted && !(foldPending(session) && cacheCold(session))) return false;
     return foldPrompt(session, PROMPT_FOLD_INTENT);
   }
@@ -256,7 +246,7 @@ export function createAgentProfileFold({
    * release changed wait silently; both are folded in at the next cold point
    * (foldPromptIfCold). Returns true when the session changed (save it).
    */
-  async function refreshAgentProfile({ trigger = 'save' } = {}) {
+  async function refreshAgentProfile({ trigger = 'save', onlyIfEdited = false } = {}) {
     const session = getSession?.();
     const identity = session?.promptIdentity;
     const agent = identity?.agent;
@@ -276,15 +266,14 @@ export function createAgentProfileFold({
     const edited =
       recoverMode || session.agentProfileRevision !== revision || (agentMode && session.agentRosterRevision !== roster);
     // At a turn's start its own turn is the one counted; nothing runs yet.
+    if (onlyIfEdited && !edited) return false;
     const busy = () => getSession?.() !== session || (trigger !== 'turn' && turnInFlight(session));
     if (busy()) {
       agentProfilePending = true;
       return false;
     }
     const toolsChanged = agentMode
-      ? stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session, workflow, {
-          edited: session.agentProfileRevision !== revision,
-        })
+      ? stageLiveToolChanges({ liveDeniedTools, modelStandaloneTools }, session, workflow)
       : trigger === 'resume' && syncAgentListing(session);
     if (!edited) return (trigger === 'resume' && (await foldPromptIfCold())) || toolsChanged;
     // A coding session from before profile stamps keeps its prompt when it
@@ -315,14 +304,22 @@ export function createAgentProfileFold({
    *  fold pending prompt changes if the cache is cold anyway. */
   async function applyPendingAgentProfile() {
     let changed = false;
-    // A bot thread's connector baseline, before any edit can be compared to it.
     const session = getSession?.();
-    if (session?.id && sessionModeOf(session) === AGENT_MODE && !Array.isArray(session.agentConnectorTools)) {
-      session.agentConnectorTools = connectorTools(session, schemaTools(session).map(toolName));
-    }
-    if (agentProfilePending || orchestrationRecoveryNeeded(session)) {
+    // A bot thread compares its profile and roster stamps every turn, so hand
+    // edits and other processes' saves of AGENT.md, PERSONA.md and the roster
+    // reach it too.
+    // A thread from before profile stamps keeps its prompt until a save.
+    const botThread = Boolean(
+      session?.id &&
+        session.promptIdentity?.agent &&
+        sessionModeOf(session) === AGENT_MODE &&
+        session.agentProfileRevision !== undefined
+    );
+    const pending = agentProfilePending || orchestrationRecoveryNeeded(session);
+    if (pending || botThread) {
       agentProfilePending = false;
-      changed = await refreshAgentProfile({ trigger: 'turn' });
+      // A turn with nothing pending acts only on moved stamps.
+      changed = await refreshAgentProfile({ trigger: 'turn', onlyIfEdited: !pending });
     }
     changed = (await foldPromptIfCold()) || changed;
     return syncAgentListing(session) || changed;

package/src/session-runtime/tool-policy/mode-switch.mjs

@@ -17,7 +17,7 @@ function modeLoadableTools(session, mode) {
     ...toolNames(session.deferredCallableTools),
     ...toolNames(session.deferredDiscoveredTools),
   ]);
-  const deferred = new Set(toolNames(session.deferredToolCatalog));
+  const deferred = new Set([...toolNames(session.deferredToolCatalog), ...toolNames(session.deferredLateToolCatalog)]);
   const denied = new Set(
     [...(session.disallowedTools || []), ...(session.workflowOverlay?.deniedTools || [])].map(String)
   );