mixdog 1.4.1 → 1.4.3

package/src/session-runtime/tool-policy/policy-stage.mjs

@@ -17,9 +17,19 @@ import {
 } from '../../runtime/agent/orchestrator/context/collect.mjs';
 import {
   _buildBaseRules,
+  _buildLeadLanguage,
+  _buildLeadLanguageContext,
   _buildLeadMetaContext,
 } from '../../runtime/agent/orchestrator/session/manager/rules-cache.mjs';
-import { sessionRolePromptFields } from '../../runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs';
+import {
+  notePromptSettingsPresented,
+  promptConfigSlice,
+} from '../../runtime/agent/orchestrator/session/manager/prompt-settings.mjs';
+import { normalizeInstructionFilesMode } from '../../runtime/shared/instruction-files-mode.mjs';
+import {
+  buildWorkspacePromptContext,
+  sessionRolePromptFields,
+} from '../../runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs';
 import {
   delegationDisabled,
   honoredSchemaAllowlist,
@@ -32,14 +42,19 @@ import { AGENT_MODE, sessionModeOf } from '../../runtime/agent/orchestrator/sess
 import { unusedModelEditToolName } from '../../runtime/shared/edit-tool-dialect.mjs';
 import {
   presentedAgentCatalogSlice,
+  refreshSessionBp3Environment,
+  replaceLanguageBlock,
+  replaceWorkspaceCoreSlices,
+  replaceWorkspaceEnvironment,
   withPresentedWorkspaceSlices,
 } from '../../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
-import { leadPartsFor, rewriteSystemHeading, toolNames } from './surface-helpers.mjs';
+import { leadPartsFor, rewriteConversationBp3Core, rewriteSystemHeading, toolNames } from './surface-helpers.mjs';
 
 export function createPolicyStage({
   getRoute,
   getMode,
   getDataDir,
+  getConfig,
   modelStandaloneTools,
   featureDisallowedTools,
   loadCoreMemoryContext,
@@ -96,17 +111,58 @@ export function createPolicyStage({
     }
   }
 
+  // The prompt-shaping settings sections `session` renders from `config` (the
+  // runtime's in-memory config) and `coreMemoryContext`, as session creation
+  // composes them (session-prompt-composition.mjs composeSessionSystem).
+  // `language` is the response language block closing the environment.
+  function promptSettingsSections(session, identity, config, coreMemoryContext) {
+    const ownerIsAgent = isAgentOwner(session);
+    const schemaAllowedTools = honoredSchemaAllowlist(session.schemaAllowedTools, {
+      ownerIsAgent,
+      agent: identity.agent,
+    });
+    const toolFreeRole = ownerIsAgent && schemaAllowedTools?.length === 0;
+    const agentMode = sessionModeOf(session) === AGENT_MODE;
+    const lead = !identity.skipAgentRules && !toolFreeRole && !ownerIsAgent;
+    const slice = promptConfigSlice(config);
+    const skip = identity.profileSkip || {};
+    const skills = schemaAllowedTools?.length === 0 ? [] : collectPromptSkillsCached(session.cwd, config);
+    const { packContext, summary, leadPromptParts, orchestrationMode } = activeWorkflowContext(config, getDataDir());
+    // A coding Lead's mode text, as session creation records it.
+    const codingLead = !ownerIsAgent && !agentMode;
+    return {
+      meta: lead ? _buildLeadMetaContext({ includeOutputStyle: !agentMode, config: slice }) : '',
+      // The workflow pack and the skill listing BP2 carries.
+      workflow: String(packContext || ''),
+      workflowName: summary?.name || summary?.id || null,
+      orchestration: codingLead ? String(leadPartsFor(session, leadPromptParts).orchestrationContext || '') : '',
+      orchestrationMode: codingLead ? orchestrationMode || '' : '',
+      skills: buildSkillManifest(skills),
+      instructionFilesMode: normalizeInstructionFilesMode(slice?.instructionFiles),
+      language: lead ? _buildLeadLanguageContext({ includeOutputStyle: !agentMode, config: slice }) : '',
+      instructionFiles:
+        toolFreeRole || agentMode || skip.claudemd ? '' : String(loadInstructionFilesContext?.(session) || ''),
+      coreMemory: skip.memory ? '' : String(coreMemoryContext || ''),
+      // Not a section: the language per-request rules match (tail-reminder-rules.mjs).
+      responseLanguage: lead ? _buildLeadLanguage({ config: slice }) || null : null,
+    };
+  }
+
   // The policy `config` gives `session`, computed without touching the
   // session, so a turn that starts during the async rebuild cannot lose tools
   // to it. `conversation`: the rebuilt BP3 core keeps the instruction files
   // and core memory the prompt presents now (withPresentedWorkspaceSlices).
-  async function stagePolicy(session, identity, config, { conversation = false } = {}) {
+  // `settings`: the prompt settings sections as they stand (a fold or an
+  // empty rebuild presents them); `coreMemoryContext` a snapshot already read.
+  async function stagePolicy(session, identity, config, { conversation = false, coreMemoryContext: memory } = {}) {
     const ownerIsAgent = isAgentOwner(session);
     const schemaAllowedTools = honoredSchemaAllowlist(session.schemaAllowedTools, {
       ownerIsAgent,
       agent: identity.agent,
     });
     const toolFreeRole = ownerIsAgent && schemaAllowedTools?.length === 0;
+    const freshMemory = memory ?? (await leadCoreMemoryContext());
+    const settings = promptSettingsSections(session, identity, config, freshMemory);
 
     const {
       summary: workflow,
@@ -139,12 +195,11 @@ export function createPolicyStage({
             provider: getRoute()?.provider,
             model: getRoute()?.model,
           });
-    const coreMemoryContext = conversation ? '' : await leadCoreMemoryContext();
+    const coreMemoryContext = conversation ? '' : freshMemory;
     // BP2's stable part as session creation composes it
     // (session-prompt-composition.mjs): the Lead meta context and the skill
     // manifest of the skills in scope now.
     const skipRules = identity.skipAgentRules || toolFreeRole;
-    const skills = schemaAllowedTools?.length === 0 ? [] : collectPromptSkillsCached(session.cwd);
     const { sessionMarkerCore, stableSystemContext } = composeSystemPrompt({
       ...sessionRolePromptFields(identity, {
         ownerIsAgent,
@@ -160,8 +215,8 @@ export function createPolicyStage({
       // setting; agent mode carries none.
       instructionFilesContext:
         conversation || toolFreeRole || agentMode ? null : loadInstructionFilesContext?.(session) || null,
-      metaContext: skipRules || ownerIsAgent ? undefined : _buildLeadMetaContext({ includeOutputStyle: !agentMode }),
-      skillManifest: buildSkillManifest(skills),
+      metaContext: settings.meta || undefined,
+      skillManifest: settings.skills,
     });
     return {
       workflow,
@@ -174,9 +229,44 @@ export function createPolicyStage({
       core: conversation ? withPresentedWorkspaceSlices(session, sessionMarkerCore) : sessionMarkerCore,
       // Without BP1 the BP2 block cannot be located: null leaves it as it is.
       stableContext: skipRules ? null : stableSystemContext,
+      settings,
     };
   }
 
+  /**
+   * Make the prompt present `staged.settings` (an empty session's rebuild, a
+   * fold): the BP3 core's instruction files and core memory and the language
+   * block closing the environment; the caller has written BP2 and the core.
+   * A staged workspace re-root keeps the slices it will replace itself.
+   */
+  function presentPromptSettings(session, staged) {
+    const { settings } = staged;
+    if (!session.workspaceReroot) {
+      rewriteConversationBp3Core(
+        session,
+        replaceWorkspaceCoreSlices(staged.core, {
+          coreMemoryContext: settings.coreMemory,
+          instructionFilesContext: settings.instructionFiles,
+        })
+      );
+    }
+    if (typeof session.bp3EnvironmentContext === 'string') {
+      session.bp3EnvironmentContext = replaceLanguageBlock(session.bp3EnvironmentContext, settings.language);
+      refreshSessionBp3Environment(session, session.cwd);
+    }
+    notePromptSettingsPresented(session, settings);
+  }
+
+  /** An empty session's rebuild: the shell, git and listing facts as they stand. */
+  function refreshEnvironmentFacts(session) {
+    if (typeof session.bp3EnvironmentContext !== 'string' || !session.cwd || session.workspaceReroot) return;
+    const { environmentContext } = buildWorkspacePromptContext(session, session.cwd, {
+      instructionFilesMode: promptConfigSlice(getConfig?.())?.instructionFiles,
+    });
+    session.bp3EnvironmentContext = replaceWorkspaceEnvironment(session.bp3EnvironmentContext, environmentContext);
+    refreshSessionBp3Environment(session, session.cwd);
+  }
+
   // Apply a staged policy synchronously; the BP3 core is the caller's. The
   // prompt then carries the session's workflow and tools as they stand.
   function applyPolicy(session, staged) {
@@ -184,6 +274,7 @@ export function createPolicyStage({
     delete session.orchestrationModeOverlay;
     delete session.workflowOpenedTools;
     delete session.promptFoldPending;
+    delete session.compactionFoldPending;
     session.workflow = toSessionWorkflowMeta(staged.workflow);
     session.orchestrationMode = staged.orchestrationMode;
     session.sessionMode = staged.sessionMode;
@@ -197,5 +288,12 @@ export function createPolicyStage({
     session.updatedAt = Date.now();
   }
 
-  return { liveDeniedTools, stagePolicy, applyPolicy };
+  return {
+    liveDeniedTools,
+    stagePolicy,
+    applyPolicy,
+    promptSettingsSections,
+    presentPromptSettings,
+    refreshEnvironmentFacts,
+  };
 }

package/src/session-runtime/tool-policy/workflow-overlay.mjs

@@ -78,7 +78,8 @@ export function createWorkflowOverlay({ liveDeniedTools, modelStandaloneTools })
     if (!loadableTools.length) return;
     const opened = session.workflowOpenedTools || [];
     session.workflowOpenedTools = [...new Set([...opened, ...loadableTools])];
-    if (fresh.length) session.deferredToolCatalog = [...(session.deferredToolCatalog || []), ...fresh];
+    // The late pool, never the boot catalog a native request keeps byte-stable.
+    if (fresh.length) session.deferredLateToolCatalog = [...(session.deferredLateToolCatalog || []), ...fresh];
     session.disallowedTools = (session.disallowedTools || []).filter((name) => !loadableTools.includes(String(name)));
     const byName = new Map(schemaTools(session).map((tool) => [toolName(tool), tool]));
     // Announced on every switch that opens them: a pending removal (a switch

package/src/session-runtime/tool-policy-refresh.mjs

@@ -1,7 +1,7 @@
-// Refresh the empty Lead session's model-facing tool surface and BP1/BP3
-// layers after workflow or search/memory settings change. Conversation
-// sessions keep their frozen schema; the next new session picks up the
-// updated policy. The exceptions are a workflow or orchestration mode switch
+// Bring a session to the settings as they stand at each turn start
+// (reconcileTurnSettings): an empty session's tool surface and BP1/BP3 are
+// rebuilt; a conversation keeps its prefix and takes moved tool gates live.
+// Setters only save config. The exceptions are a workflow or orchestration mode switch
 // made in the session itself (switchSessionWorkflow,
 // switchSessionOrchestrationMode), which that conversation takes as an overlay.
 import { sessionHasConversationMessages } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
@@ -9,6 +9,17 @@ import { createAgentProfileFold } from './tool-policy/agent-profile-fold.mjs';
 import { createPolicyStage } from './tool-policy/policy-stage.mjs';
 import { createSessionSwitches } from './tool-policy/session-switches.mjs';
 import { rewriteBp3Core } from './tool-policy/surface-helpers.mjs';
+import {
+  stageConnectorAvailability,
+  stageToolAvailability,
+} from '../runtime/agent/orchestrator/runtime-core/tool-availability.mjs';
+import { resetBp2StableContext } from '../runtime/agent/orchestrator/context/collect.mjs';
+import {
+  promptSettingsRecord,
+  stagePromptSettingsNotice,
+} from '../runtime/agent/orchestrator/session/manager/prompt-settings.mjs';
+import { isAgentOwner } from '../runtime/agent/orchestrator/agent-owner.mjs';
+import { configForSession, currentMode } from './tool-policy/surface-helpers.mjs';
 
 export function createToolPolicyRefresh({
   getSession,
@@ -24,11 +35,21 @@ export function createToolPolicyRefresh({
   activeWorkflowContext,
   invalidatePreSessionToolSurface,
   persistSession,
+  toolDefinitionsFor = () => [],
+  getSurfaceGeneration,
 }) {
-  const { liveDeniedTools, stagePolicy, applyPolicy } = createPolicyStage({
+  const {
+    liveDeniedTools,
+    stagePolicy,
+    applyPolicy,
+    promptSettingsSections,
+    presentPromptSettings,
+    refreshEnvironmentFacts,
+  } = createPolicyStage({
     getRoute,
     getMode,
     getDataDir,
+    getConfig,
     modelStandaloneTools,
     featureDisallowedTools,
     loadCoreMemoryContext,
@@ -55,6 +76,153 @@ export function createToolPolicyRefresh({
     );
   }
 
+  // What the gates a surface is built from read: the config object (replaced,
+  // never mutated, on every adopt and every reload of a change made
+  // elsewhere), the surface generation (skills/plugins invalidate it) and the
+  // live gate list (which carries bridge presence).
+  const configGenerations = new WeakMap();
+  let configCount = 0;
+  function availabilityKey() {
+    const config = getConfig?.() || {};
+    let generation = configGenerations.get(config);
+    if (generation === undefined) {
+      generation = ++configCount;
+      configGenerations.set(config, generation);
+    }
+    return `${generation}|${getSurfaceGeneration?.() || 0}|${featureDisallowedTools().join(',')}`;
+  }
+  // Session → the key it was last brought to (process-local, so a session
+  // first seen here, e.g. resumed, is checked once).
+  const appliedKeys = new WeakMap();
+
+  const conversationEmpty = (session) =>
+    !sessionHasConversationMessages(session) && !sessionHasConversationMessages({ messages: session.liveTurnMessages });
+
+  // The revision of the prompt settings `session` would be built from now.
+  function settingsRevision(session, coreMemory) {
+    const identity = session.promptIdentity;
+    if (!identity) return undefined;
+    const config = configForSession(getConfig(), session.workflow?.id, currentMode(session));
+    return promptSettingsRecord(promptSettingsSections(session, identity, config, coreMemory)).revision;
+  }
+
+  /** A session just built from the current settings (`coreMemory`: the
+   *  snapshot its prompt was composed with). */
+  function noteToolAvailability(session, coreMemory = '') {
+    if (session) {
+      appliedKeys.set(session, {
+        gates: availabilityKey(),
+        settings: settingsRevision(session, String(coreMemory || '')),
+      });
+    }
+  }
+
+  /** Whether a settings change reaches the current session's whole prompt
+   *  (no session yet, or one without a conversation, rebuilt at its turn). */
+  function settingsReachCurrentSession() {
+    const session = getSession?.();
+    return !session?.id || (Boolean(session.promptIdentity) && conversationEmpty(session));
+  }
+
+  async function readCoreMemory() {
+    try {
+      return String((await loadCoreMemoryContext?.()) || '');
+    } catch {
+      return '';
+    }
+  }
+
+  async function reconcileSession(session) {
+    // Connector switches are read from their (stat-cached) files every turn.
+    const connectors = stageConnectorAvailability(session);
+    const coreMemory = await readCoreMemory();
+    const gates = availabilityKey();
+    const identity = session.promptIdentity;
+    // The prompt settings as they stand, file-based ones included (core
+    // memory, instruction files, output-style files, the workflow pack, the
+    // skill listing): their revision is part of the key.
+    const sections = identity
+      ? promptSettingsSections(
+          session,
+          identity,
+          configForSession(getConfig(), session.workflow?.id, currentMode(session)),
+          coreMemory
+        )
+      : null;
+    const settings = sections ? promptSettingsRecord(sections).revision : undefined;
+    const applied = appliedKeys.get(session);
+    if (applied?.gates === gates && applied.settings === settings && !session.promptSettingsRecheck) {
+      return connectors ? { rebuilt: false, ...connectors } : null;
+    }
+    let rebuilt = false;
+    let settingsChanged = [];
+    if (identity && conversationEmpty(session)) {
+      // Nothing was sent: the whole prompt is rebuilt in place.
+      const staged = await stagePolicy(session, identity, getConfig(), { coreMemoryContext: coreMemory });
+      if (getSession?.() === session && conversationEmpty(session)) {
+        if (typeof staged.stableContext === 'string') resetBp2StableContext(session, staged.stableContext);
+        applyPolicy(session, staged);
+        rewriteBp3Core(session, staged.core);
+        presentPromptSettings(session, staged);
+        refreshEnvironmentFacts(session);
+        // The first-turn MCP fold may rebuild it in place too (an empty
+        // session reopened from disk was never marked).
+        session.deferredInitialRefreshPending = true;
+        rebuilt = true;
+      }
+    } else if (identity) {
+      // A conversation keeps its prefix: told once, folded at the next cold point.
+      settingsChanged = stagePromptSettingsNotice(session, sections);
+      // A delegated worker is never folded: after a compaction it is told
+      // again instead (rearmPromptSettingsNotice).
+      if (settingsChanged.length && !isAgentOwner(session)) session.promptFoldPending = true;
+    }
+    const staged = stageToolAvailability(session, featureDisallowedTools(), toolDefinitionsFor);
+    appliedKeys.set(session, { gates, settings: rebuilt ? session.promptSettings?.revision : settings });
+    const tools = staged || connectors;
+    const merged =
+      staged && connectors
+        ? { added: [...staged.added, ...connectors.added], removed: [...staged.removed, ...connectors.removed] }
+        : tools;
+    return rebuilt || tools || settingsChanged.length
+      ? { rebuilt, ...(merged || {}), ...(settingsChanged.length ? { settingsChanged } : {}) }
+      : null;
+  }
+
+  // One reconcile per session at a time: a turn start and a surface read of
+  // the same empty session share it.
+  const inflight = new WeakMap();
+
+  /** Turn start, any session kind: an empty session is rebuilt from current
+   *  settings; a conversation keeps its prefix, takes moved tool gates live
+   *  (stageToolAvailability) and prompt settings as a one-time notice. */
+  function reconcileTurnSettings() {
+    const session = getSession?.();
+    if (!session?.id) return Promise.resolve(null);
+    let running = inflight.get(session);
+    if (!running) {
+      running = reconcileSession(session).finally(() => inflight.delete(session));
+      inflight.set(session, running);
+    }
+    return running;
+  }
+
+  /** A read of an empty session's surface or status: the same reconcile, so
+   *  what is shown is what its first turn will send. A conversation (or a
+   *  running turn) is left to its turn start. */
+  function reconcileEmptySession() {
+    const session = getSession?.();
+    if (!session?.id || turnInFlight(session) || !conversationEmpty(session)) return Promise.resolve(null);
+    return reconcileTurnSettings();
+  }
+
+  /** Sync: whether an empty session's surface lags the settings gates. */
+  function emptySessionStale() {
+    const session = getSession?.();
+    if (!session?.id || turnInFlight(session) || !conversationEmpty(session)) return false;
+    return appliedKeys.get(session)?.gates !== availabilityKey();
+  }
+
   async function refreshEmptySessionToolPolicy() {
     invalidatePreSessionToolSurface?.();
     const session = getSession?.();
@@ -67,8 +235,11 @@ export function createToolPolicyRefresh({
     const staged = await stagePolicy(session, identity, getConfig());
     // Apply: re-check admission after the await, then mutate synchronously.
     if (!admitsRefresh(session)) return { appliedToCurrentSession: false };
+    if (typeof staged.stableContext === 'string') resetBp2StableContext(session, staged.stableContext);
     applyPolicy(session, staged);
     rewriteBp3Core(session, staged.core);
+    presentPromptSettings(session, staged);
+    refreshEnvironmentFacts(session);
     return { appliedToCurrentSession: true };
   }
 
@@ -91,10 +262,16 @@ export function createToolPolicyRefresh({
     liveDeniedTools,
     stagePolicy,
     applyPolicy,
+    presentPromptSettings,
     turnInFlight,
   });
 
   return {
+    reconcileTurnSettings,
+    reconcileEmptySession,
+    emptySessionStale,
+    noteToolAvailability,
+    settingsReachCurrentSession,
     refreshEmptySessionToolPolicy,
     switchSessionWorkflow: switches.switchSessionWorkflow,
     switchSessionOrchestrationMode: switches.switchSessionOrchestrationMode,

package/src/session-runtime/tool-surface.mjs

@@ -6,7 +6,10 @@ import {
   filterDisallowedTools,
   selectDeferredTools,
 } from '../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
-import { AGENT_WORKER_DENIED_TOOLS } from '../runtime/agent/orchestrator/session/manager/tool-resolution.mjs';
+import {
+  AGENT_WORKER_DENIED_TOOLS,
+  finalizeSessionToolList,
+} from '../runtime/agent/orchestrator/session/manager/tool-resolution.mjs';
 import { LEAD_DISALLOWED_TOOLS } from '../runtime/agent/orchestrator/runtime-core/tool-defs.mjs';
 import { deferredSurfaceModeForLead, toolSpecForMode } from '../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { loadSkillToolDependencies } from '../runtime/agent/orchestrator/runtime-core/skill-tool-loading.mjs';
@@ -39,6 +42,11 @@ export function createToolSurface({
   getFeatureDisallowedTools = () => [],
 }) {
   let preSessionSurface = null;
+  // The inputs the cached preview was built from (setters no longer
+  // invalidate it; a config adopt or reload replaces the config object).
+  let preSessionInputs = '';
+  let preSessionConfig = null;
+  let surfaceGeneration = 0;
 
   // A coding Lead keeps `agent` whichever agents exist (the agents reach it as
   // a listing reminder); Solo still offers it (deferred) for explicit user
@@ -122,16 +130,45 @@ export function createToolSurface({
     return selectDeferredTools(session, names, surfaceMode);
   }
 
+  /** Definitions the current session's kind may hold — built-ins included —
+   *  for tools a settings gate opened mid-conversation. */
+  function toolDefinitionsFor(names) {
+    const wanted = new Set((names || []).map(String));
+    const session = getSession();
+    const ownerIsAgent = isAgentOwner(session);
+    const previewTools =
+      typeof mgr.previewSessionTools === 'function'
+        ? mgr.previewSessionTools(toolSpecForMode(mode), [], {
+            mcpScopeId: getMcpScopeId(),
+            modelName: getRoute().model,
+            cwd: getCurrentCwd?.() || null,
+          })
+        : [];
+    const byName = new Map();
+    for (const tool of [...modelStandaloneTools(), ...filterModelToolsForProfile(previewTools, getToolProfile())]) {
+      const name = String(tool?.name || '');
+      if (wanted.has(name) && !byName.has(name)) byName.set(name, tool);
+    }
+    return finalizeSessionToolList([...byName.values()], { ownerIsAgent });
+  }
+
   return {
     modelStandaloneTools,
     activateTools,
+    toolDefinitionsFor,
+    surfaceGeneration: () => surfaceGeneration,
     invalidatePreSessionToolSurface() {
       preSessionSurface = null;
+      surfaceGeneration += 1;
     },
     /** The live session once it exists; the preview surface until then. */
     activeToolSurface() {
       const session = getSession();
       if (session) return session;
+      const inputs = getFeatureDisallowedTools().join(',');
+      if (preSessionConfig !== getConfig() || preSessionInputs !== inputs) preSessionSurface = null;
+      preSessionConfig = getConfig();
+      preSessionInputs = inputs;
       preSessionSurface ??= buildPreSessionSurface();
       return preSessionSurface;
     },

package/src/session-runtime/turn/agent-ops.mjs

@@ -31,6 +31,7 @@ export function createAgentOps(deps) {
     subscribeRuntimeNotification,
     agentTool,
     activeToolSurface,
+    reconcileEmptySession,
     notificationListeners,
     getReservedSessionId,
   } = deps;
@@ -72,6 +73,27 @@ export function createAgentOps(deps) {
     });
   }
 
+  // `/stop`: the background shells this session would stop, then stopping all
+  // of them through the same per-task cancel.
+  async function listStoppableShellJobs() {
+    const session = getSession();
+    const { listStoppableShellJobs: list } = await import(
+      '../../runtime/agent/orchestrator/tools/builtin/task-tool.mjs'
+    );
+    return {
+      jobs: list({ callerSessionId: session?.id || null, clientHostPid: session?.clientHostPid || process.pid }),
+    };
+  }
+
+  async function stopShellJobs() {
+    const session = getSession();
+    const { stopBackgroundShellJobs } = await import('../../runtime/agent/orchestrator/tools/builtin/task-tool.mjs');
+    return stopBackgroundShellJobs({
+      callerSessionId: session?.id || null,
+      clientHostPid: session?.clientHostPid || process.pid,
+    });
+  }
+
   // Explicit user force-release ("Release anyway") of a shell job whose
   // termination is unconfirmed: drops its workspace hold. The surface has
   // already asked the user to confirm. The caller session's own holds, and
@@ -115,7 +137,14 @@ export function createAgentOps(deps) {
     return () => notificationListeners.delete(listener);
   }
 
-  function toolsStatus(query = '') {
+  // An empty session has nothing cached: it is brought to the settings first
+  // (the turn-start reconcile), so the list is what its first turn sends.
+  async function toolsStatus(query = '') {
+    await reconcileEmptySession?.();
+    return toolsStatusNow(query);
+  }
+
+  function toolsStatusNow(query = '') {
     const surface = activeToolSurface();
     let catalog = [];
     if (Array.isArray(surface?.deferredToolCatalog)) catalog = surface.deferredToolCatalog;
@@ -140,13 +169,15 @@ export function createAgentOps(deps) {
   function selectTools(names) {
     const list = Array.isArray(names) ? names : String(names || '').split(/[,\s]+/);
     const result = selectDeferredTools(activeToolSurface(), list, getMode());
-    return { ...result, status: toolsStatus() };
+    return { ...result, status: toolsStatusNow() };
   }
 
   return {
     agentControl,
     taskControl,
     stopShellJob,
+    listStoppableShellJobs,
+    stopShellJobs,
     releaseShellJob,
     listShellJobs,
     onNotification,

package/src/session-runtime/turn/session-ops.mjs

@@ -6,6 +6,7 @@ import { normalizeToolMode } from '../../runtime/agent/orchestrator/runtime-core
 import { interruptTaskWaitForSession } from '../../runtime/agent/orchestrator/session/task-wait-control.mjs';
 import { markPendingGoalReminder } from '../../runtime/agent/orchestrator/runtime-core/goal-reminder.mjs';
 import { rearmLateDeferredTools } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import { rearmPromptSettingsNotice } from '../../runtime/agent/orchestrator/session/manager/prompt-settings.mjs';
 
 export function createSessionOps(deps) {
   const {
@@ -101,6 +102,7 @@ export function createSessionOps(deps) {
     // The same compaction strips late MCP tool announcements from older turns.
     try {
       rearmLateDeferredTools(getSession());
+      rearmPromptSettingsNotice(getSession());
     } catch {
       /* best-effort: a tool reminder must never break manual compact */
     }

package/src/session-runtime/turn/turn-run/turn-prepare.mjs

@@ -90,6 +90,7 @@ export function createTurnPreparation({
   applyPendingRoute,
   applyPendingAgentProfile,
   applyPendingSessionSwitches,
+  reconcileTurnSettings,
 }) {
   async function admitWorkspace(turn, prompt, options) {
     // Turn admission: waits while this session's workspace transitions or
@@ -149,6 +150,10 @@ export function createTurnPreparation({
     // An orchestration mode or workflow chosen while the previous turn ran
     // applies from this one (before a cold-cache fold can take it in).
     const sessionSwitches = applyPendingSessionSwitches?.();
+    // Settings saved since this session last ran (here or in any other
+    // runtime): an empty session is rebuilt, a conversation takes moved tool
+    // gates live — before a cold-cache fold below can take them in.
+    await reconcileTurnSettings?.();
     // An agent profile saved while the previous turn ran applies from this one.
     await applyPendingAgentProfile?.();
     options.onRouteApplied?.(getSession());

package/src/session-runtime/turn/turn-run.mjs

@@ -85,7 +85,7 @@ export function createTurnRunner(deps) {
           // The agents enabled now (coding Leads), asked for each user turn
           // the ask prepares, for its agent list reminder
           // (manager/agent-listing-notice.mjs).
-          { ...callbacks, agentsNow: currentAgents }
+          { ...callbacks, agentsNow: currentAgents, agentConfig: getConfig }
         );
       } finally {
         releaseWebSearchUsage?.();

package/src/session-runtime/webhook-session-run.mjs

@@ -43,6 +43,7 @@ function runWebhookTurn({
   name,
   prompt,
   ownerAgentId = null,
+  executorAgentId = null,
   cwd = null,
   attachments = null,
   event = '',
@@ -55,6 +56,7 @@ function runWebhookTurn({
     kind: 'webhook',
     name: endpoint,
     ownerAgentId,
+    executorAgentId: executorAgentId || null,
     prompt,
     skillSelection: String(skillSelection ?? ''),
     attachments,