mixdog 1.4.2 → 1.4.3

package/src/runtime/agent/orchestrator/runtime-core/tool-catalog.mjs

@@ -1,8 +1,10 @@
 // Deferred-tool catalog: measured-usage ordering, kind/bucket classification,
 // tool_search ranking + auto-selection, and the session tool-surface
 // application/selection logic. Pure module (session objects passed in).
+import { createHash } from 'node:crypto';
 import { clean } from './session-text.mjs';
-import { mergePendingDeferredToolDelta } from './deferred-tool-delta.mjs';
+import { dropPendingDeferredToolAdds, mergePendingDeferredToolDelta } from './deferred-tool-delta.mjs';
+import { isAgentOwner } from '../agent-owner.mjs';
 import { applyInitialDeferredToolManifestToBp2 } from '../context/collect.mjs';
 import {
   listedDeferredToolNames,
@@ -12,7 +14,11 @@ import {
 import { parseMcpToolName } from '../../../shared/tool-primitives.mjs';
 import { getMcpServerInstructionsMap, getMcpTools, getMcpToolGeneration } from '../mcp/client.mjs';
 import { filterMcpToolsForSession } from './extension-scopes.mjs';
-import { isDeferredToolAvailable, isToolPermittedBySessionPolicy } from './deferred-tool-availability.mjs';
+import {
+  isDeferredToolAvailable,
+  isToolPermittedBySessionPolicy,
+  sessionFeatureDenies,
+} from './deferred-tool-availability.mjs';
 import { routeToolExclusionReason } from '../session/loop/provider-tool-exclusions.mjs';
 import { isResponsesFreeformTool, toResponsesCustomTool } from '../providers/custom-tool-wire.mjs';
 import {
@@ -46,21 +52,8 @@ import {
   toolExposureModeForProvider,
 } from './tool-exposure.mjs';
 import { TOOL_BRIDGE_TOOLS } from './tool-defs.mjs';
-export {
-  toolKind,
-  toolSchemaBucket,
-  estimateToolSchemaBreakdown,
-  measuredToolUsage,
-  parseToolSelection,
-  sortedCatalogByMeasuredUsage,
-} from './tool-catalog-schema.mjs';
+export { estimateToolSchemaBreakdown } from './tool-catalog-schema.mjs';
 export { snapshotProviderRequestTools } from './provider-request-snapshot.mjs';
-export {
-  DEFERRED_DEFAULT_FULL_TOOLS,
-  DEFERRED_DEFAULT_LEAD_TOOLS,
-  DEFERRED_DEFAULT_READONLY_TOOLS,
-  MEASURED_TOOL_USAGE,
-} from './tool-catalog-data.mjs';
 
 // Provider modes without native tool search. Their bridge-v1 sessions
 // (tool-exposure.mjs) get the native roster and late delta notices; only a
@@ -548,24 +541,30 @@ export function rebuildDeferredToolSurfaceForProvider(session, provider) {
 // <available-deferred-tools> manifest IN PLACE and pre-mark names announced;
 // bridge-v1 sessions do the same (roster + bridge guidance). Only a fixed
 // surface not yet on the bridge updates its scoped catalog alone. Fully sync
-// and idempotent: no genuinely-new MCP name => no-op / no mutation.
+// and idempotent: no MCP name added or gone => no-op / no mutation.
 export function refreshInitialDeferredMcpSurface(session, liveMcpTools) {
   if (!session || !Array.isArray(session.messages)) return false;
   if (session.deferredProviderMode === 'full') return false;
   const live = filterDisallowedTools(Array.isArray(liveMcpTools) ? liveMcpTools : [], session.disallowedTools);
+  const liveNames = new Set(live.map((tool) => clean(tool?.name)).filter(isMcpToolName));
   const byName = new Map();
+  // Nothing was sent yet: a server gone since create leaves the initial surface.
+  let changed = false;
   for (const tool of Array.isArray(session.deferredToolCatalog) ? session.deferredToolCatalog : []) {
     const name = clean(tool?.name);
+    if (isMcpToolName(name) && !liveNames.has(name)) {
+      changed = true;
+      continue;
+    }
     if (name && !byName.has(name)) byName.set(name, tool);
   }
-  let added = false;
   for (const tool of live) {
     const name = clean(tool?.name);
     if (!name || !isMcpToolName(name) || byName.has(name)) continue;
     byName.set(name, activeToolForSurface(tool));
-    added = true;
+    changed = true;
   }
-  if (!added) return false;
+  if (!changed) return false;
   session.deferredToolCatalog = sortedCatalogByMeasuredUsage([...byName.values()]);
   if (fixedSurfaceSession(session)) {
     session.updatedAt = Date.now();
@@ -720,10 +719,12 @@ function reconcileDeferredMcpToolCatalogUncached(session, liveMcpTools) {
   // connected OR the tool is already loaded, including native history-only
   // discoveries. Availability is determined by deferredMcpToolNames, not this pool.
   const nextByName = new Map();
+  // A built-in a settings gate opened (tool-availability.mjs) is no MCP tool:
+  // its availability is the session's deny set, so it stays.
   for (const tool of lateCatalog) {
     const name = clean(tool?.name);
     if (!name || nextByName.has(name)) continue;
-    if (!liveMcpByName.has(name) && !active.has(name)) continue;
+    if (isMcpToolName(name) && !liveMcpByName.has(name) && !active.has(name)) continue;
     nextByName.set(name, tool);
   }
   for (const [name, tool] of liveMcpByName) nextByName.set(name, tool);
@@ -773,28 +774,84 @@ function reconcileDeferredMcpToolCatalogUncached(session, liveMcpTools) {
  * connected tool the boot manifest never listed and the session has not loaded
  * or discovered rides the next real prompt as one more delta, acknowledged
  * only once the provider accepts that turn.
+ * Only a session whose prompt is never rebuilt at a cold point (a delegated
+ * worker, or a prompt without a recorded identity) is re-armed, by name; any
+ * other session folds its late tools into the rebuilt manifest instead
+ * (foldLateDeferredTools).
  * Returns the re-armed names, or null when there are none.
  */
 export function rearmLateDeferredTools(session) {
   // The compaction also drops the load results that carried a server's
-  // instruction text, so the next load of its tools delivers it again.
-  if (session) delete session.mcpInstructionsAnnounced;
+  // instruction text (the account and configuration guidance, which no prompt
+  // manifest carries), so the next load of its tools delivers it again. It
+  // rides a tool result, never the cached prefix, and ordinary turns still
+  // send it once.
+  if (session) {
+    delete session.mcpInstructionsAnnounced;
+    delete session.mcpInstructionHashes;
+  }
   if (!session || !Array.isArray(session.tools) || fixedSurfaceSession(session)) return null;
-  if (!Array.isArray(session.deferredMcpToolNames) || !Array.isArray(session.deferredAnnouncedTools)) return null;
+  if (session.promptIdentity && !isAgentOwner(session)) return null;
+  if (!Array.isArray(session.deferredAnnouncedTools)) return null;
   // Listed in the boot manifest, or already loaded/discovered: still visible.
   const listed = new Set([...session.deferredAnnouncedTools, ...persistentToolSurfaceNames(session)]);
-  const connected = new Set(session.deferredMcpToolNames);
+  const connected = new Set(Array.isArray(session.deferredMcpToolNames) ? session.deferredMcpToolNames : []);
   const added = [];
   for (const tool of Array.isArray(session.deferredLateToolCatalog) ? session.deferredLateToolCatalog : []) {
     const name = clean(tool?.name);
-    if (!name || !connected.has(name) || listed.has(name) || !rosterPermits(session, tool)) continue;
-    added.push({ name, description: lateAnnouncementDescription(tool?.description) });
+    if (!name || listed.has(name) || !rosterPermits(session, tool)) continue;
+    // MCP tools while connected; a built-in a settings gate opened while permitted.
+    if (isMcpToolName(name) ? !connected.has(name) : !isToolPermittedBySessionPolicy(session, name)) continue;
+    // Names only: the model was told the description before.
+    added.push({ name, description: '' });
   }
   if (!added.length) return null;
   mergePendingDeferredToolDelta(session, { added });
   return added.map((entry) => entry.name);
 }
 
+/**
+ * A cold point (a compaction, a rebuilt prompt): the late tools join the boot
+ * catalog and the rebuilt BP2 manifest lists them, so nothing about them rides
+ * a notice. Pending
+ * announcements the manifest now carries are dropped. Returns the folded names.
+ */
+export function foldLateDeferredTools(session) {
+  if (!session || !Array.isArray(session.tools) || fixedSurfaceSession(session)) return [];
+  const late = Array.isArray(session.deferredLateToolCatalog) ? session.deferredLateToolCatalog : [];
+  const connected = new Set(Array.isArray(session.deferredMcpToolNames) ? session.deferredMcpToolNames : []);
+  const byName = new Map();
+  for (const tool of Array.isArray(session.deferredToolCatalog) ? session.deferredToolCatalog : []) {
+    const name = clean(tool?.name);
+    if (name && !byName.has(name)) byName.set(name, tool);
+  }
+  const folded = [];
+  for (const tool of late) {
+    const name = clean(tool?.name);
+    if (!name || byName.has(name) || !rosterPermits(session, tool)) continue;
+    if (isMcpToolName(name) ? !connected.has(name) : !isToolPermittedBySessionPolicy(session, name)) continue;
+    byName.set(name, activeToolForSurface(tool));
+    folded.push(name);
+  }
+  session.deferredToolCatalog = sortedCatalogByMeasuredUsage([...byName.values()]);
+  // Whatever the boot catalog holds now (folded here, or by the rebuilt surface) leaves the late pool.
+  session.deferredLateToolCatalog = late.filter((tool) => !byName.has(clean(tool?.name)));
+  session.mcpServerInstructions = getMcpServerInstructionsMap(session.mcpScopeId);
+  if (Array.isArray(session.messages) && session.messages.some((m) => m?.role === 'system')) {
+    applyInitialDeferredToolManifestToBp2(session, deferredPoolToolNames(session), { rebuild: true });
+    session.deferredAnnouncedTools = listedDeferredToolNames(
+      session,
+      deferredPoolToolNames(session),
+      renderedDeferredManifest(session)
+    );
+  }
+  // The manifest lists only short triggers, never a server's instruction text:
+  // what a load has told stays as recorded (a compaction clears it).
+  const listed = new Set(Array.isArray(session.deferredAnnouncedTools) ? session.deferredAnnouncedTools : []);
+  dropPendingDeferredToolAdds(session, listed);
+  return folded;
+}
+
 export function scopedMcpToolsFor(session, config = null) {
   return filterMcpToolsForSession(getMcpTools(session?.mcpScopeId), session?.cwd || null, config);
 }
@@ -916,24 +973,41 @@ function resolvableCatalog(session) {
   return filterSessionToolPolicy(tools, session);
 }
 
+const instructionHash = (text) =>
+  createHash('sha256')
+    .update(String(text || ''))
+    .digest('hex')
+    .slice(0, 16);
+
 // A server's instruction text rides the first load_tool naming any of its
-// tools (loaded now, already active, or described on the bridge), once until
-// compaction (`mcpInstructionsAnnounced`; rearmLateDeferredTools clears it with
-// the transcript that held the text): `## <server>` + body, sanitized and
-// capped like the BP2 block it replaces. No text, nothing sent or recorded.
+// tools (loaded now, already active, or described on the bridge), once per
+// text (`mcpInstructionsAnnounced`, `mcpInstructionHashes`: a connector whose
+// accounts changed sends its new text again; a compaction clears the record,
+// rearmLateDeferredTools): `## <server>` + body,
+// sanitized and capped (sanitizeMcpInstructionText, well under 4 KB). No
+// text, nothing sent or recorded.
 function pendingMcpInstructions(session, catalog, names) {
   const map = session?.mcpServerInstructions;
   if (!map || typeof map !== 'object' || !names.length) return [];
   const byName = new Map(catalog.map((tool) => [clean(tool?.name), tool]));
   const announced = new Set(Array.isArray(session.mcpInstructionsAnnounced) ? session.mcpInstructionsAnnounced : []);
+  const hashes =
+    session.mcpInstructionHashes && typeof session.mcpInstructionHashes === 'object'
+      ? session.mcpInstructionHashes
+      : {};
+  const seen = new Set();
   const pending = [];
   for (const name of names) {
     const server = parseMcpToolName(byName.get(name) || name)?.server;
-    if (!server || announced.has(server) || !mcpServerManifestLabel(server)) continue;
+    if (!server || seen.has(server) || !mcpServerManifestLabel(server)) continue;
     const text = sanitizeMcpInstructionText(map[server]);
     if (!text) continue;
-    announced.add(server);
-    pending.push({ server, block: `## ${server}\n${text}` });
+    const hash = instructionHash(text);
+    // Told already, and the text is the one told. A record from before hashes
+    // were kept cannot tell which text it carried: sent once more, and hashed.
+    if (announced.has(server) && hashes[server] === hash) continue;
+    seen.add(server);
+    pending.push({ server, hash, block: `## ${server}\n${text}` });
   }
   return pending;
 }
@@ -943,6 +1017,10 @@ function announceMcpServers(session, pending) {
   session.mcpInstructionsAnnounced = [
     ...new Set([...(session.mcpInstructionsAnnounced || []), ...pending.map((entry) => entry.server)]),
   ];
+  session.mcpInstructionHashes = {
+    ...(session.mcpInstructionHashes || {}),
+    ...Object.fromEntries(pending.map((entry) => [entry.server, entry.hash])),
+  };
 }
 
 function claimMcpServerInstructions(session, catalog, names) {
@@ -1016,7 +1094,9 @@ export function renderToolSearch(args = {}, session, mode = 'full', options = {}
   ]);
   const loaded = toolSelection.added || [];
   const alreadyActive = toolSelection.already || [];
-  const missing = toolSelection.missing || [];
+  // A tool a settings gate closed is named as such, not as unknown.
+  const disabledInSettings = (toolSelection.missing || []).filter((name) => sessionFeatureDenies(session, name));
+  const missing = (toolSelection.missing || []).filter((name) => !disabledInSettings.includes(name));
   const blocked = toolSelection.blocked || [];
   // Native discovery is history-driven: an explicit re-selection must emit
   // the tool reference/spec again even when the callable registry already has
@@ -1040,6 +1120,9 @@ export function renderToolSearch(args = {}, session, mode = 'full', options = {}
     ? { ...nativeToolSearchBase, summary: nativeSummary || nativeToolSearchBase.summary }
     : null;
   const notes = [];
+  if (disabledInSettings.length) {
+    notes.push(`Disabled in settings: ${disabledInSettings.join(', ')}. Do not retry unless the user turns it on.`);
+  }
   if (missing.length && pendingMcpServers.length) {
     notes.push('Some requested names may belong to an MCP server still connecting — retry next turn.');
   }
@@ -1059,6 +1142,7 @@ export function renderToolSearch(args = {}, session, mode = 'full', options = {}
       alreadyActive,
       ...(alreadyActiveSchemas.length ? { alreadyActiveSchemas } : {}),
       missing,
+      ...(disabledInSettings.length ? { disabledInSettings } : {}),
       ...(blocked.length ? { blocked } : {}),
       ...mcpFields,
       activeTools: sortedNamesByMeasuredUsage(

package/src/runtime/agent/orchestrator/runtime-core/tool-defs.mjs

@@ -101,7 +101,7 @@ export const SESSION_TOOL = {
           'suggest',
         ],
         description:
-          'status defaults to current; list pages sessions, without sub-agent or archived ones unless include_agents/include_archived; bots shows each bot’s activity, work, approvals, routines and attention flags, or with session_id (a bot id or its chat) its routines and recent sessions; read returns latest items; send queues prompt (reportsBack: the turn result reports back here); cancel stops the turn; delete removes the session. create (bot conversations) starts a visible agent task session from brief (started, not done yet); unknown Project: list-projects first, still ambiguous: ask the user. compact runs after this turn; fork copies it without switching. suggest (Mixy’s chat only) records a proposal made to the user under key; value false records that the user declined it.',
+          'status defaults to current; list pages sessions, without sub-agent or archived ones unless include_agents/include_archived; bots shows each bot’s activity, work, approvals, routines and attention flags, or with session_id (a bot id or its chat) its routines and recent sessions; read returns latest items; send queues prompt (reportsBack: the turn result reports back here); cancel stops the turn; delete removes the session. create (bot conversations; only for a big multi-step plan, smaller work goes to agent) starts a visible agent task session from brief (started, not done yet); unknown Project: list-projects first, still ambiguous: ask the user. compact runs after this turn; fork copies it without switching. suggest (Mixy’s chat only) records a proposal made to the user under key; value false records that the user declined it.',
       },
       title: {
         type: 'string',

package/src/runtime/agent/orchestrator/runtime-core/workflow/context.mjs

@@ -32,7 +32,7 @@ export function createWorkflowContext({ packs, agents }) {
   function workflowContextBlockFromPack(pack) {
     if (!pack) return '';
     // The pack body opens with its own `# <name>` title, so header + description
-    // + body used to repeat the workflow name three times in the prompt. Emit one
+    // + body would repeat the workflow name three times in the prompt. Emit one
     // header line and drop the body's duplicate title (only when it matches).
     const rawBody = String(pack.body || '');
     const firstBreak = rawBody.indexOf('\n');

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -14,6 +14,7 @@ import { clearReactionTargets } from '../runtime-core/reaction-tool-defs.mjs';
 import { applyRetryAction, beginIteration, sendProviderRequest, settleSendResult } from './loop/send-phase.mjs';
 import { runToolPhase } from './loop/tool-phase.mjs';
 import { endedWithoutReply } from './loop/turn-limits.mjs';
+import { carryReportOnError } from './loop/turn-report.mjs';
 
 // Facade re-exports: these symbols live in ./loop/ modules and are part of
 // loop.mjs's public surface (imported by scripts/tests and other runtime
@@ -62,29 +63,34 @@ async function runAgentLoop(provider, messages, model, tools, onToolCall, cwd, s
   resetAccountProbePacing();
   const state = createLoopState({ provider, messages, model, tools, cwd, sendOpts });
   // Completion, cancellation, and terminal failures end execution.
-  while (true) {
-    const round = await beginIteration(state);
-    const sent = await sendProviderRequest(state, round);
-    if (applyRetryAction(state, sent.result)) continue;
-    settleSendResult(state, round, sent);
-    // A turn without client tool calls is not automatically the final answer:
-    // the provider may have hit its output ceiling, been cut by a safety
-    // classifier, declared the turn unfinished, or returned nothing. Each case
-    // owns a bounded recovery ladder in ./loop/no-tool-turn.mjs, which either
-    // appended a recovery turn ('continue') or produced the terminal response.
-    if (!state.response.toolCalls?.length) {
-      const outcome = await state.noToolTurn.resolve(state.response, state.iterations);
-      state.response = outcome.response;
-      if (outcome.action === 'continue') continue;
-      break;
-    }
-    await runToolPhase(state, round, sent, onToolCall);
-    // A capped turn that kept calling tools after it was told to reply ends
-    // here with no reply (./loop/turn-limits.mjs).
-    if (state.turnLimitEnded) {
-      state.response = endedWithoutReply(state.response);
-      break;
+  try {
+    while (true) {
+      const round = await beginIteration(state);
+      const sent = await sendProviderRequest(state, round);
+      if (applyRetryAction(state, sent.result)) continue;
+      settleSendResult(state, round, sent);
+      // A turn without client tool calls is not automatically the final answer:
+      // the provider may have hit its output ceiling, been cut by a safety
+      // classifier, declared the turn unfinished, or returned nothing. Each case
+      // owns a bounded recovery ladder in ./loop/no-tool-turn.mjs, which either
+      // appended a recovery turn ('continue') or produced the terminal response.
+      if (!state.response.toolCalls?.length) {
+        const outcome = await state.noToolTurn.resolve(state.response, state.iterations);
+        state.response = outcome.response;
+        if (outcome.action === 'continue') continue;
+        break;
+      }
+      await runToolPhase(state, round, sent, onToolCall);
+      // A capped turn that kept calling tools after it was told to reply ends
+      // here with no reply (./loop/turn-limits.mjs), keeping the answers it
+      // went past.
+      if (state.turnLimitEnded) {
+        state.response = state.noToolTurn.finalize(endedWithoutReply(state.response));
+        break;
+      }
     }
+  } catch (error) {
+    throw carryReportOnError(error, state.noToolTurn.endedReport());
   }
   return finishLoop(state);
 }

package/src/runtime/agent/orchestrator/session/agent-pool-progress.mjs

@@ -4,6 +4,36 @@
 // only — nothing here reads or changes the watchdog's abort policy.
 import { displayProgressStage, lastProgressAt } from '../../../shared/quiet-progress.mjs';
 import { resolveAgentStallThresholds } from '../stall-policy.mjs';
+import { todoProgress } from '../runtime-core/todo-list.mjs';
+import { sessionUsageTotals } from '../../../shared/session-usage-totals.mjs';
+
+/** `rows` with each agent's todo progress taken from its live session when
+ *  this process holds one: the list changes before the session is saved, and
+ *  the stored copy lags. A live session is authoritative, so one without a
+ *  list (cleared) drops the row's stored `todo`; rows with no live session
+ *  keep the stored one. */
+export function withLiveTodo(rows, liveSession) {
+  return rows.map((row) => {
+    const live = row?.sessionId ? liveSession(row.sessionId) : null;
+    if (!live) return row;
+    const { todo: _stored, ...rest } = row;
+    const todo = todoProgress(live);
+    return todo ? { ...rest, todo } : rest;
+  });
+}
+
+/** `rows` with each agent's running token and tool-call totals taken from its
+ *  live session when this process holds one: the counters advance with every
+ *  model response, while the stored copy follows a throttled save. A total the
+ *  live session does not know keeps the stored one. */
+export function withLiveUsage(rows, liveSession) {
+  return rows.map((row) => {
+    const live = row?.sessionId ? liveSession(row.sessionId) : null;
+    if (!live) return row;
+    const { usage, toolCalls } = sessionUsageTotals(live);
+    return { ...row, ...(usage ? { usage } : {}), ...(toolCalls === null ? {} : { toolCalls }) };
+  });
+}
 
 /** `rows` with progress fields on every row `runtimeEntry(sessionId)` reports
  *  in flight. `awaitingTask` marks a row whose agent waits on its background

package/src/runtime/agent/orchestrator/session/attachment-preflight.mjs

@@ -11,7 +11,7 @@ import { imagePartAllowance, pdfPartAllowance } from './context-utils.mjs';
 // over the transcript. The rest stays for the conversation, tool results and
 // the answer; above it the read-what-you-need path costs far less than the
 // whole files.
-export const ATTACHMENT_INLINE_SHARE = 0.25;
+const ATTACHMENT_INLINE_SHARE = 0.25;
 
 /** The inline-attachment budget of a model window (0 when unknown). */
 export function attachmentInlineBudget(contextWindow) {

package/src/runtime/agent/orchestrator/session/cache-warm.mjs

@@ -141,7 +141,7 @@ export function sessionReturnChance(gaps, elapsedMs, withinMs) {
 
 // A write below this many tokens is prompt growth, never a rewrite: 4096 is
 // the largest minimum cacheable prompt length of the supported models.
-export const CACHE_WARM_REWRITE_FLOOR_TOKENS = 4096;
+const CACHE_WARM_REWRITE_FLOOR_TOKENS = 4096;
 
 /** Whether a warm's `usage` shows a substantial rewrite with poor read
  *  coverage: the write reaches the floor and the read covers less than half
@@ -155,7 +155,7 @@ export function warmRewrote(usage) {
 /** Whether an entry last used at `touchAt` and living `ttlMs` will have
  *  expired by the time a warm sent at `now` reaches the provider (`latencyMs`
  *  later): a warm into an expired entry rewrites the whole prompt. */
-export function cacheEntryLapsed(touchAt, ttlMs, now, latencyMs = null) {
+function cacheEntryLapsed(touchAt, ttlMs, now, latencyMs = null) {
   return touchAt + ttlMs - now <= (Number(latencyMs) || 0);
 }
 

package/src/runtime/agent/orchestrator/session/catalog-db/index.mjs

@@ -26,7 +26,7 @@ export const SESSION_CATALOG_DB_FILE = 'session-catalog.sqlite';
  *  path (an off-switch); absent or true uses the DB whenever it can. */
 export const SESSION_STORE_CONFIG_DEFAULTS = Object.freeze({ sqliteCatalog: true });
 /** Stable prefix of every daemon.log line of the catalog DB. */
-export const SESSION_CATALOG_LOG_PREFIX = '[session-catalog-db]';
+const SESSION_CATALOG_LOG_PREFIX = '[session-catalog-db]';
 
 // A worker that keeps dying is given up on for a while.
 const CRASH_WINDOW_MS = 10 * 60_000;
@@ -93,7 +93,7 @@ function workerSettings() {
  * worker threads are not the main thread, and a daemon started by the CLI
  * under system Node stays on JSON.
  */
-export function isSessionCatalogDbWriter() {
+function isSessionCatalogDbWriter() {
   if (testOptions && 'writer' in testOptions) return testOptions.writer === true;
   return (
     isMainThread &&

package/src/runtime/agent/orchestrator/session/catalog-db/schema.mjs

@@ -127,7 +127,7 @@ export function byActivityThenId(left, right) {
 }
 
 /** Title normalized once at write: what a title lookup or sort compares. */
-export function normalizedTitle(row) {
+function normalizedTitle(row) {
   return String(row.title || row.preview || '')
     .normalize('NFKC')
     .toLowerCase()

package/src/runtime/agent/orchestrator/session/compact/execution-tail.mjs

@@ -18,7 +18,7 @@ export const EXECUTION_RECOVERY_SOURCE = 'compact-execution-recovery';
 const TOOL_HISTORY_CONTEXT_RATIO = 0.05;
 // The working set of recent execution evidence does not grow with the window:
 // above 800k, 5% kept a large block of old tool output after every Compact.
-export const TOOL_HISTORY_MAX_TOKENS = 40_000;
+const TOOL_HISTORY_MAX_TOKENS = 40_000;
 const ARCHIVE_THRESHOLD_TOKENS = 512;
 // Only the newest reminder survives a Compact; it names the dumps it replaced
 // (each dump holds the reminder that preceded it, so older ones stay reachable).

package/src/runtime/agent/orchestrator/session/compact/runner.mjs

@@ -421,6 +421,9 @@ function prependLatestUserContext(message, prefix) {
   if (replacesGoalState) {
     suffix = suffix.replace(/<system-reminder>\s*<goal_state>[\s\S]*?<\/goal_state>\s*<\/system-reminder>\s*/gi, '');
   }
+  if (text.includes('<todo_state>')) {
+    suffix = suffix.replace(/<system-reminder>\s*<todo_state>[\s\S]*?<\/todo_state>\s*<\/system-reminder>\s*/gi, '');
+  }
   // The kept suffix still carries the turn's agent list reminder: it stays told.
   const told = bare !== message && message.meta.agentListing ? { agentListing: message.meta.agentListing } : null;
   return withRuntimeUserContext(told ? { ...bare, meta: { ...bare.meta, ...told } } : bare, {

package/src/runtime/agent/orchestrator/session/compact/summary-route.mjs

@@ -64,7 +64,7 @@ const LIGHTER_FAMILY = Object.freeze({
   },
   'openai-oauth': {
     catalog: loadSavedCodexCatalog,
-    matches: (row, id) => id.includes('-luna') && gptVersion(id) !== null,
+    matches: (_row, id) => id.includes('-luna') && gptVersion(id) !== null,
     compare: compareGptVersion,
   },
 });

package/src/runtime/agent/orchestrator/session/context-utils.mjs

@@ -55,14 +55,10 @@ export {
 // deployment recalibrate without a code change; values are clamped to a
 // plausible band.
 //
-// The Anthropic factor was 1.9 while opaque replay blobs were projected as a
-// fixed marker — that is, while a transcript's entire reasoning stream (15-35%
-// of it) was priced at zero, and the multiplier was silently covering the gap.
-// Now that those blobs carry their measured cost, the ratio was re-measured
-// against the provider's own token counter on twenty real transcripts:
-// 1.23-1.40, median 1.32 (previously 1.72-2.48 — a fifth of the spread, since
-// the multiplier no longer has to absorb a variable amount of reasoning).
-// 1.4 covers the measured maximum without double counting.
+// Opaque replay blobs carry their measured cost, so the Anthropic ratio does
+// not have to absorb a variable amount of reasoning. Measured against the
+// provider's own token counter on twenty real transcripts: 1.23-1.40, median
+// 1.32. 1.4 covers the measured maximum without double counting.
 //
 // Only Anthropic-style providers can be calibrated against reported usage at
 // all, because only they resend the whole transcript every turn. OpenAI/xAI
@@ -96,10 +92,10 @@ export { estimateRequestReserveTokens, estimateToolSchemaTokens, toolSchemaSigna
 
 // Opaque replay payloads (Anthropic thinking signatures, OpenAI encrypted
 // reasoning blobs, redacted data) are long base64-ish strings that ARE billed
-// proportionally to their serialized length — see the measurement below. They
-// were previously replaced with a fixed marker, which priced a provider's
-// entire reasoning stream at nearly zero. Project them at their measured cost
-// instead. Projection is KEY-SCOPED: only fields that structurally carry
+// proportionally to their serialized length — see the measurement below. A
+// fixed marker would price a provider's entire reasoning stream at nearly zero,
+// so they are projected at their measured cost. Projection is KEY-SCOPED: only
+// fields that structurally carry
 // opaque replay
 // material (signatures / encrypted / redacted / raw data blobs) are eligible,
 // so genuine long model text (e.g. Gemini thought text) keeps its real cost.

package/src/runtime/agent/orchestrator/session/conversation-import/claude.mjs

@@ -79,7 +79,7 @@ export function unwrapClaudePastes(text) {
   return unwrapped.trim() ? unwrapped : text;
 }
 
-export function isClaudeEnvelopeText(text) {
+function isClaudeEnvelopeText(text) {
   const trimmed = String(text || '').trim();
   if (!trimmed) return true;
   return (

package/src/runtime/agent/orchestrator/session/conversation-import/codex.mjs

@@ -28,7 +28,7 @@ const CODEX_ENVELOPE_TAGS = [
 ];
 const TOOL_CALL_TYPES = new Set(['function_call', 'custom_tool_call', 'local_shell_call']);
 
-export function isCodexEnvelopeText(text) {
+function isCodexEnvelopeText(text) {
   const trimmed = String(text || '').trim();
   if (!trimmed) return true;
   if (/^# AGENTS\.md instructions\b/.test(trimmed) && trimmed.includes('<INSTRUCTIONS>')) return true;

package/src/runtime/agent/orchestrator/session/conversation-import/convert.mjs

@@ -14,7 +14,7 @@ import {
   normalizeTurns,
 } from './turns.mjs';
 
-export const IMPORT_SOURCES = Object.freeze(['codex', 'claude']);
+const IMPORT_SOURCES = Object.freeze(['codex', 'claude', 'cowork']);
 /** A line or converted transcript beyond the import limits fails the file. */
 export const IMPORT_ERROR_TOO_LARGE = 'tooLarge';
 export const IMPORT_MAX_LINE_BYTES = 32 * 1024 * 1024;

package/src/runtime/agent/orchestrator/session/conversation-import/imported-session.mjs

@@ -12,11 +12,15 @@ import { writeStderrBestEffort } from '../../../../shared/best-effort-stderr.mjs
 import { IMPORTED_MESSAGE_SOURCE } from '../imported-message.mjs';
 import { ingestSessionTurn } from '../../../../session-search/session-search-ingest.mjs';
 
-export const IMPORT_ORIGIN_VERSION = 1;
+const IMPORT_ORIGIN_VERSION = 1;
 
-/** Dedupe identity: the foreign session id, else the canonical source path. */
+/**
+ * Dedupe identity: the foreign session id, else the canonical source path.
+ * Cowork transcripts are Claude Code transcripts, so both share the `claude` namespace.
+ */
 export function importOriginKey(source, foreignSessionId, canonicalPath) {
-  return foreignSessionId ? `${source}:${foreignSessionId}` : `${source}:path:${canonicalPath}`;
+  const namespace = source === 'cowork' ? 'claude' : source;
+  return foreignSessionId ? `${namespace}:${foreignSessionId}` : `${namespace}:path:${canonicalPath}`;
 }
 
 export function buildImportOrigin({ source, sourcePath, foreignSessionId = null, sourceCwd = null, importedAt }) {

package/src/runtime/agent/orchestrator/session/human-gate/held-message.mjs

@@ -7,7 +7,7 @@
 // user's words; the structured `heldRequest` payload is for the UI only.
 import { escapeHarnessTags } from '../../../../shared/shell-output-summary.mjs';
 
-export const HELD_REQUEST_SOURCE = 'held-request';
+const HELD_REQUEST_SOURCE = 'held-request';
 const STATUSES = new Set(['pending', 'approved', 'denied', 'expired']);
 
 const clean = (value, limit = 200) =>

package/src/runtime/agent/orchestrator/session/human-gate/requests.mjs

@@ -12,7 +12,7 @@
 //                own: the card names the tool, its current level and the one
 //                asked for, and the person picks the level (`scope`: one of
 //                `choices`) or denies. Answered once, never remembered.
-// A response is one of HUMAN_RESPONSES plus a `remember` scope; a policy lists
+// A response is one of RESPONSES_BY_KIND for its kind plus a `remember` scope; a policy lists
 // the scopes it allows and can leave out `always`. Nothing here ever carries a
 // secret value: a decision that names one is stripped to its verdict.
 
@@ -20,7 +20,6 @@ const HUMAN_REQUEST_KINDS = Object.freeze(['approval', 'outbound', 'secret', 'ta
 /** The levels a connector card may raise a tool to. */
 export const CONNECTOR_WIDEN_LEVELS = Object.freeze(['needs_approval', 'auto']);
 const CONNECTOR_LEVELS = ['disabled', ...CONNECTOR_WIDEN_LEVELS];
-const HUMAN_RESPONSES = Object.freeze(['approve', 'deny', 'edit-and-approve', 'provide-secret', 'skip', 'done']);
 const REMEMBER_SCOPES = Object.freeze(['once', 'agent', 'always']);
 export const SECRET_REQUEST_TIMEOUT_MS = 120_000;
 /** What a secret's bound field is: a sign-in form (아이디 + 비밀번호), a lone

package/src/runtime/agent/orchestrator/session/human-gate/run-policy.mjs

@@ -20,7 +20,7 @@ export const AUTOMATION_GRANT_REASON =
 export const isGrantedRun = (run) => Boolean(run) && run.kind !== 'room';
 
 /** Whether an outbound request is a payment or permanent delete. */
-export function isForbiddenInRun(request) {
+function isForbiddenInRun(request) {
   const category = request?.kind === 'outbound' ? request.outbound?.category : '';
   return ACTION_KINDS.includes(category) && !isRememberableAction(category);
 }

package/src/runtime/agent/orchestrator/session/image-strip-recovery.mjs

@@ -151,7 +151,7 @@ export function persistsConfirmedImageRejection(err, strip) {
   return strip.uniqueImages === 1;
 }
 
-export const PREPARATION_FAILED_CODE = 'anthropic_image_preparation_failed';
+const PREPARATION_FAILED_CODE = 'anthropic_image_preparation_failed';
 
 /** True for prepareAnthropicImages' local "this image is invalid" rejection. */
 export function isImagePreparationFailed(err) {