talon-agent 3.15.0 → 3.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.15.0",
+  "version": "3.15.1",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",

package/src/app.ts

@@ -24,6 +24,7 @@ import {
 import { shutdownTriggers } from "./core/background/triggers/index.js";
 import { pruneSettledTriggers } from "./storage/trigger-store.js";
 import { startWatchdog, stopWatchdog } from "./util/watchdog.js";
+import { spawnSuccessor } from "./util/respawn.js";
 import { log, logError, logWarn } from "./util/log.js";
 import {
   getVfs,
@@ -121,6 +122,14 @@ async function gracefulShutdown(signal: string): Promise<void> {
 
   const forceTimer = setTimeout(() => {
     logError("shutdown", "Timeout exceeded, forcing exit");
+    // Hand off even on the forced path. A restart must survive a
+    // subsystem that won't stop (a wedged FUSE unmount, an MCP server
+    // ignoring SIGTERM, a backend child that never acks): without this
+    // the timeout exits without a successor and `/restart` silently
+    // takes the daemon down for good. The successor may briefly race
+    // the long-poll we failed to release, but grammy retries the 409 —
+    // a few seconds of overlap beats staying down.
+    spawnSuccessor();
     process.exit(1);
   }, SHUTDOWN_TIMEOUT_MS);
   forceTimer.unref();
@@ -148,13 +157,14 @@ async function gracefulShutdown(signal: string): Promise<void> {
   await shutdownStep("frontends", () =>
     Promise.allSettled(frontends.map((frontend) => frontend.stop())),
   );
-  if (config.backend === "opencode") {
-    await shutdownStep("opencode server", async () => {
-      const { stopOpenCodeServer } =
-        await import("./backend/opencode/index.js");
-      stopOpenCodeServer();
-    });
-  }
+  // Tear down every instantiated backend, including per-chat overrides.
+  // Checking only config.backend orphaned an OpenCode child whenever the
+  // process default was Claude but one chat had switched to OpenCode.
+  await shutdownStep("backend pool", async () => {
+    const { cleanupBackendPool } =
+      await import("./core/engine/backend-controller/index.js");
+    await cleanupBackendPool();
+  });
   // Destroy plugins (cleanup resources)
   if (config.plugins.length > 0) {
     await shutdownStep("plugins", async () => {
@@ -181,11 +191,15 @@ async function gracefulShutdown(signal: string): Promise<void> {
     await shutdownHub();
   });
   flushDatabase();
-  // Guarded removal: after a /restart handoff the successor has already
-  // written its own pid here — deleting unconditionally would orphan it
-  // (the bug that made `talon restart` spawn duplicate daemons).
+  // Guarded removal: only clear the record if it still names us. A
+  // successor that raced ahead and wrote its own pid here must not be
+  // orphaned (the bug that made `talon restart` spawn duplicate daemons).
   removePidRecordIfOwnedBy(process.pid);
   log("shutdown", "State saved");
+  // Hand off last: the frontends are stopped, so the successor binds
+  // Telegram's long-poll only after we have released it. No-op unless
+  // /restart or /update armed a respawn.
+  spawnSuccessor();
   process.exit(0);
 }
 

package/src/backend/kilo/factory.ts

@@ -19,6 +19,9 @@ import {
   type ChatBackend,
   type BackgroundRunner,
   type ModelCatalog,
+  type SessionBackend,
+  type SystemControl,
+  type ToolRuntime,
   type UsageTelemetry,
 } from "../../core/agent-runtime/capabilities.js";
 
@@ -35,6 +38,9 @@ import {
   getProviderModels as kiloGetProviderModels,
   formatModelError as kiloFormatModelError,
   listModels as kiloListModels,
+  refreshPluginMcpServers as kiloRefreshPluginMcpServers,
+  updateSystemPrompt as kiloUpdateSystemPrompt,
+  warmSession as kiloWarmSession,
 } from "./index.js";
 
 const kiloFactory: BackendFactory = {
@@ -102,6 +108,23 @@ const kiloFactory: BackendFactory = {
       },
     };
 
+    const tools: ToolRuntime = {
+      refreshTools: (chatId) => kiloRefreshPluginMcpServers(chatId),
+    };
+
+    // Session state lives on the Kilo server, and `/reset` already clears
+    // Talon's stored id centrally (storage/sessions.ts), so the next turn
+    // creates a fresh one — no `resetChat` needed. `warmSession` front-loads
+    // that creation plus the plugin-MCP sweep, matching what the Claude
+    // backend does after a reset.
+    const sessions: SessionBackend = {
+      warmSession: (chatId) => kiloWarmSession(chatId),
+    };
+
+    const control: SystemControl = {
+      updateSystemPrompt: (prompt) => kiloUpdateSystemPrompt(prompt),
+    };
+
     const backend = composeBackend({
       id: "kilo",
       label: "Kilo",
@@ -109,7 +132,10 @@ const kiloFactory: BackendFactory = {
       chat,
       background,
       models,
+      sessions,
+      tools,
       usage,
+      control,
     });
 
     return {

package/src/backend/kilo/handler/message.ts

@@ -23,6 +23,7 @@ import {
   ensureSession,
   ensureChatMcpServer,
   ensurePluginMcpServers,
+  buildToolOverrides,
   resolveProviderID,
   parseStoredKiloModelSelection,
   getConfig,
@@ -86,12 +87,13 @@ export async function handleMessage(
       (selectedProviderID ? "" : " (provider via catalog lookup)"),
   );
   const sessionId = await ensureSession(oc, chatId);
-  await ensureChatMcpServer(oc, chatId);
-  await ensurePluginMcpServers(oc, chatId);
-  // Note: we deliberately don't pass `tools` to promptAsync. The session
-  // was created with a `permission` ruleset (ensureSession in server.ts)
-  // that allow-lists this chat's MCP tools and auto-allows built-in
-  // read/bash/edit. The deprecated `tools` map is subsumed by that.
+  const chatMcpServerName = await ensureChatMcpServer(oc, chatId);
+  const pluginMcpServerNames = await ensurePluginMcpServers(oc, chatId);
+  const toolOverrides = await buildToolOverrides(
+    oc,
+    chatMcpServerName,
+    pluginMcpServerNames,
+  );
 
   // Build the prompt (time tag + sender + msg_id reference)
   const prompt = formatUserPrompt({
@@ -132,6 +134,7 @@ export async function handleMessage(
   });
   const promptStartedAt = Date.now();
   const seenQuestionIds = new Set<string>();
+  const seenPermissionIds = new Set<string>();
   const seenToolCallIds = new Set<string>();
 
   const setupMs = Date.now() - t0;
@@ -155,7 +158,9 @@ export async function handleMessage(
       state,
       chatId,
       seenQuestionIds,
+      seenPermissionIds,
       seenToolCallIds,
+      toolOverrides,
       onStreamDelta: undefined,
       onTextBlock,
       onToolUse,
@@ -203,6 +208,7 @@ export async function handleMessage(
     // Note: we deliberately do NOT disconnect the chat MCP server here.
     // The server is named per-chat so it's safe to keep across turns;
     // re-spawning the subprocess each turn cost ~800ms per message.
+    // Per-prompt overrides isolate visibility across concurrent chats.
   }
 
   // ── Post-loop accounting ──────────────────────────────────────────────────

package/src/backend/kilo/handler/turn.ts

@@ -4,13 +4,14 @@
  * `runKiloTurn` subscribes to SSE before issuing the prompt (so no early
  * events are lost), fires `promptAsync`, awaits the SSE close, then reads the
  * authoritative parts list. `subscribeToTurnEvents` translates relevant SSE
- * events into shared stream-state mutations and fires the terminator abort.
+ * events into shared stream-state mutations and observes natural turn idle.
  */
 
 import type { KiloClient } from "@kilocode/sdk/v2";
 import { logWarn } from "../../../util/log.js";
 import { errMsg } from "../server.js";
 import {
+  approvePendingPermissions,
   extractAssistantUsage,
   rejectPendingQuestions,
   type KiloAssistantInfo,
@@ -18,6 +19,7 @@ import {
 import { createStreamState, recordTokens, sleep } from "../../shared/index.js";
 import { processStreamEvent, finalizePartsIntoState } from "../events.js";
 import { subscribeSseStream } from "../../remote-server/sse-stream.js";
+import { awaitRemoteTurn } from "../../remote-server/turn-timeout.js";
 import { findLastAssistantMessage as findLastAssistantMessageShared } from "../../remote-server/messages.js";
 
 export interface RunKiloTurnInputs {
@@ -30,7 +32,9 @@ export interface RunKiloTurnInputs {
   state: ReturnType<typeof createStreamState>;
   chatId: string;
   seenQuestionIds: Set<string>;
+  seenPermissionIds: Set<string>;
   seenToolCallIds: Set<string>;
+  toolOverrides?: Record<string, boolean>;
   onStreamDelta?: (accumulated: string, phase?: "thinking" | "text") => void;
   onTextBlock?: (text: string) => Promise<void>;
   onToolUse?: (toolName: string, input: Record<string, unknown>) => void;
@@ -61,7 +65,9 @@ export async function runKiloTurn(inputs: RunKiloTurnInputs): Promise<void> {
     state,
     chatId,
     seenQuestionIds,
+    seenPermissionIds,
     seenToolCallIds,
+    toolOverrides,
     onStreamDelta,
     onTextBlock,
     onToolUse,
@@ -80,27 +86,18 @@ export async function runKiloTurn(inputs: RunKiloTurnInputs): Promise<void> {
     onStreamDelta,
     onTextBlock,
     onToolUse,
-    onTerminator: async () => {
-      // End_turn fired — abort the in-flight session so Kilo doesn't
-      // burn another round-trip "wrapping up" after the model declared
-      // done. session.idle then fires for our session and the SSE
-      // iterator exits cleanly.
-      try {
-        await oc.session.abort({ sessionID: sessionId });
-      } catch (err) {
-        logWarn("agent", `[${chatId}] session.abort failed: ${errMsg(err)}`);
-      }
-    },
     abortSignal: sseAbort.signal,
   });
 
-  // Question watchdog: Talon manages its own tool permissions, so any
-  // Kilo-side question (tool approval, clarification) is rejected
-  // automatically.
+  // Headless-interaction watchdog: resolve upstream questions and any
+  // permission requests that escaped the session ruleset.
   const questionWatchdog = (async () => {
     while (!sseAbort.signal.aborted) {
       try {
-        await rejectPendingQuestions(oc, sessionId, chatId, seenQuestionIds);
+        await Promise.all([
+          rejectPendingQuestions(oc, sessionId, chatId, seenQuestionIds),
+          approvePendingPermissions(oc, sessionId, chatId, seenPermissionIds),
+        ]);
       } catch (err) {
         logWarn(
           "agent",
@@ -113,18 +110,23 @@ export async function runKiloTurn(inputs: RunKiloTurnInputs): Promise<void> {
 
   try {
     // Fire and forget — promptAsync returns immediately. The await below
-    // is on the SSE close event. No `tools` field: the deprecated
-    // per-prompt tool override map is merged into session-level
-    // `permission` rules set in ensureSession.
-    await oc.session.promptAsync({
-      sessionID: sessionId,
-      parts: [{ type: "text", text: prompt }],
-      model: { providerID, modelID },
-      system: systemPrompt,
-    });
+    // is on the SSE close event. Per-prompt overrides hide sibling chats'
+    // MCP tools while session permissions independently deny execution.
+    await awaitRemoteTurn(
+      (async () => {
+        await oc.session.promptAsync({
+          sessionID: sessionId,
+          parts: [{ type: "text", text: prompt }],
+          model: { providerID, modelID },
+          system: systemPrompt,
+          ...(toolOverrides ? { tools: toolOverrides } : {}),
+        });
 
-    // Await turn completion via SSE.
-    await sseDone;
+        // Await turn completion via SSE.
+        await sseDone;
+      })(),
+      { client: oc, sessionId, chatId, label: "Kilo" },
+    );
 
     // Read authoritative final state from the messages endpoint. The SSE
     // handler already populated state mid-flight; this re-reads to fill
@@ -156,17 +158,23 @@ export async function runKiloTurn(inputs: RunKiloTurnInputs): Promise<void> {
       }
     }
   } catch (err) {
-    // If the model called end_turn we aborted intentionally — swallow.
+    // Explicit user interrupts abort intentionally — swallow that close path.
     if (state.turnTerminated && /abort/i.test(errMsg(err))) {
       return;
     }
     throw err;
   } finally {
     sseAbort.abort();
-    await sseDone.catch(() => {});
+    // A dead SSE socket may ignore the local abort flag until another event
+    // arrives. Bound cleanup so a timed-out turn cannot wedge its caller in
+    // the finally block it was meant to escape.
+    await Promise.race([sseDone.catch(() => {}), sleep(1_000)]);
     await questionWatchdog.catch(() => {});
     try {
-      await rejectPendingQuestions(oc, sessionId, chatId, seenQuestionIds);
+      await Promise.all([
+        rejectPendingQuestions(oc, sessionId, chatId, seenQuestionIds),
+        approvePendingPermissions(oc, sessionId, chatId, seenPermissionIds),
+      ]);
     } catch {
       /* noop */
     }
@@ -194,7 +202,6 @@ interface SubscribeInputs {
   onStreamDelta?: (accumulated: string, phase?: "thinking" | "text") => void;
   onTextBlock?: (text: string) => Promise<void>;
   onToolUse?: (toolName: string, input: Record<string, unknown>) => void;
-  onTerminator: () => Promise<void>;
   abortSignal: AbortSignal;
 }
 
@@ -214,7 +221,6 @@ async function subscribeToTurnEvents(inputs: SubscribeInputs): Promise<void> {
     onStreamDelta,
     onTextBlock,
     onToolUse,
-    onTerminator,
     abortSignal,
   } = inputs;
 
@@ -222,7 +228,7 @@ async function subscribeToTurnEvents(inputs: SubscribeInputs): Promise<void> {
   // subscribe-failed warning. Returns `undefined` for both "subscribe
   // rejected" and "no iterable in the response shape".
   const stream = await subscribeSseStream(oc, chatId);
-  if (!stream) return;
+  if (!stream) throw new Error("Kilo SSE connection unavailable");
 
   try {
     for await (const evt of stream) {
@@ -260,10 +266,7 @@ async function subscribeToTurnEvents(inputs: SubscribeInputs): Promise<void> {
               data?: Record<string, unknown>;
             }
           | undefined;
-        // MessageAbortedError is OUR own abort signal — fired when a
-        // terminator tool led us to call `oc.session.abort` to
-        // short-circuit the model's wrap-up. It's the EXPECTED close
-        // path, not an upstream failure.
+        // MessageAbortedError is expected for an explicit user interrupt.
         const isOurAbort =
           state.turnTerminated &&
           (errProp?.name === "MessageAbortedError" ||
@@ -301,9 +304,9 @@ async function subscribeToTurnEvents(inputs: SubscribeInputs): Promise<void> {
       if (outcome.kind === "terminator_fired") {
         // tool_calls counter increment happens per-tool inside
         // events.ts processPartUpdate. Don't double-count here.
-        // Fire-and-forget — abort the session so the model's post-end_turn
-        // wrap-up doesn't burn another API call.
-        onTerminator().catch(() => {});
+        // Aborting here can race with a prompt accepted immediately after
+        // this turn settles and cancel that next turn on the reused session.
+        // Delivery is already complete, so wait for natural idle instead.
         continue;
       }
 

package/src/backend/kilo/index.ts

@@ -41,7 +41,13 @@ export {
 } from "./sessions.js";
 
 // ── Server / lifecycle ─────────────────────────────────────────────────────
-export { initKiloAgent, stopKiloServer } from "./server.js";
+export {
+  initKiloAgent,
+  stopKiloServer,
+  refreshPluginMcpServers,
+  updateSystemPrompt,
+  warmSession,
+} from "./server.js";
 
 // ── Handler ────────────────────────────────────────────────────────────────
 export { handleMessage } from "./handler/index.js";

package/src/backend/kilo/server.ts

@@ -23,7 +23,6 @@ import {
 } from "@kilocode/sdk/v2";
 import type { TalonConfig } from "../../util/config.js";
 import type { FrontendName } from "../../core/agent-runtime/backend-registry.js";
-import { logWarn } from "../../util/log.js";
 import { buildDeliveryContract } from "../shared/delivery-contract.js";
 import {
   guessProviderID,
@@ -39,7 +38,9 @@ import {
   ensurePluginMcpServers as ensurePluginMcpServersShared,
   buildToolOverrides as buildToolOverridesShared,
   disconnectChatMcpServer as disconnectChatMcpServerShared,
+  refreshPluginMcpServers as refreshPluginMcpServersShared,
   ensureRemoteSession,
+  warmRemoteSession,
   resolveProviderID as resolveProviderIDShared,
   getRegisteredMcpServerNames as getRegisteredMcpServerNamesShared,
   errMsg as sharedErrMsg,
@@ -121,35 +122,6 @@ export function initKiloAgent(
   state.config = cfg;
   if (getGatewayPort) state.gatewayPortFn = getGatewayPort;
   if (frontend) state.frontendName = frontend;
-
-  // Pre-warm plugin MCP servers in the background so the first chat
-  // message doesn't pay the ~12s subprocess-spawn cost. We don't pre-warm
-  // chat-namespaced servers (those depend on chatId, not known yet); the
-  // first turn for any chat still incurs ~800ms for that one server, but
-  // the dominant cost (16+ plugin servers in series) is amortised away.
-  // Errors are swallowed — pre-warm is best-effort, the per-turn ensure
-  // still runs and would log any real failures.
-  prewarmPluginMcpServers().catch((err) => {
-    logWarn(
-      "agent",
-      `Plugin MCP pre-warm failed (non-fatal): ${sharedErrMsg(err)}`,
-    );
-  });
-}
-
-/**
- * Background pre-warm of plugin MCP servers. Connects each
- * plugin-provided MCP server to the Kilo HTTP server eagerly so the
- * first turn doesn't spend 12+ seconds spawning subprocesses in
- * series.
- */
-async function prewarmPluginMcpServers(): Promise<void> {
-  const client = await ensureServer();
-  // Sentinel chat id so plugin MCP servers don't bind their bridge calls
-  // to a real chat (those calls would fail the gateway's active-context
-  // check anyway). Plugin tools that need a real chat context get
-  // re-bound when a chat actually starts.
-  await ensurePluginMcpServers(client, "prewarm");
 }
 
 /**
@@ -226,8 +198,9 @@ export function ensurePluginMcpServers(
 export function buildToolOverrides(
   oc: KiloClient,
   chatServerName: string,
+  pluginServerNames: readonly string[] = [],
 ): Promise<Record<string, boolean> | undefined> {
-  return buildToolOverridesShared(oc, state, chatServerName);
+  return buildToolOverridesShared(oc, state, chatServerName, pluginServerNames);
 }
 
 /** Disconnect a per-chat MCP server (explicit teardown for hot-swap paths). */
@@ -238,6 +211,15 @@ export function disconnectChatMcpServer(
   return disconnectChatMcpServerShared(oc, state, serverName);
 }
 
+export async function refreshPluginMcpServers(chatId: string) {
+  const oc = await ensureServer();
+  return refreshPluginMcpServersShared(oc, state, chatId);
+}
+
+export function updateSystemPrompt(prompt: string): void {
+  if (state.config) state.config.systemPrompt = prompt;
+}
+
 // ── Session management ─────────────────────────────────────────────────────
 
 /**
@@ -249,6 +231,20 @@ export function ensureSession(oc: KiloClient, chatId: string): Promise<string> {
   return ensureRemoteSession(oc, state, chatId);
 }
 
+/**
+ * Front-load a chat's cold start after `/reset`. Mirrors the Claude
+ * backend's `warmSession` so the `sessions` capability slot behaves the
+ * same across backends. Never throws — see `warmRemoteSession`.
+ */
+export function warmSession(chatId: string): Promise<void> {
+  return warmRemoteSession(state, chatId, {
+    ensureServer,
+    ensureSession,
+    ensureChatMcpServer,
+    ensurePluginMcpServers,
+  });
+}
+
 // ── Provider resolution ────────────────────────────────────────────────────
 
 /**
@@ -312,7 +308,7 @@ export function getConfig(): TalonConfig {
 /**
  * Snapshot of the locally-cached MCP server registrations. Test-only:
  * Kilo's `GET /mcp` returns `{}` regardless of state, so integration
- * tests need this to assert chat-switch isolation actually fired.
+ * tests use this to assert concurrent chat registrations are retained.
  */
 export function getRegisteredMcpServerNames(): string[] {
   return getRegisteredMcpServerNamesShared(state);

package/src/backend/kilo/sessions.ts

@@ -20,6 +20,7 @@ import {
   getTurnSummary,
   getSessionSnapshot,
   rejectPendingQuestions as rejectPendingQuestionsShared,
+  approvePendingPermissions as approvePendingPermissionsShared,
   type RemoteAssistantInfo,
   type RemoteSessionSnapshot,
   type RemoteSessionClient,
@@ -99,3 +100,19 @@ export function rejectPendingQuestions(
     "Kilo",
   );
 }
+
+/** Auto-approve pending Kilo permissions for this headless session. */
+export function approvePendingPermissions(
+  oc: KiloClient,
+  sessionId: string,
+  chatId: string,
+  seenPermissionIds: Set<string>,
+): Promise<void> {
+  return approvePendingPermissionsShared(
+    oc as unknown as RemoteSessionClient,
+    sessionId,
+    chatId,
+    seenPermissionIds,
+    "Kilo",
+  );
+}

package/src/backend/opencode/factory.ts

@@ -19,6 +19,9 @@ import {
   type ChatBackend,
   type BackgroundRunner,
   type ModelCatalog,
+  type SessionBackend,
+  type SystemControl,
+  type ToolRuntime,
   type UsageTelemetry,
 } from "../../core/agent-runtime/capabilities.js";
 
@@ -35,6 +38,9 @@ import {
   getProviderModels as ocGetProviderModels,
   formatModelError as ocFormatModelError,
   listModels as ocListModels,
+  refreshPluginMcpServers as ocRefreshPluginMcpServers,
+  updateSystemPrompt as ocUpdateSystemPrompt,
+  warmSession as ocWarmSession,
 } from "./index.js";
 
 const opencodeFactory: BackendFactory = {
@@ -95,6 +101,23 @@ const opencodeFactory: BackendFactory = {
       },
     };
 
+    const tools: ToolRuntime = {
+      refreshTools: (chatId) => ocRefreshPluginMcpServers(chatId),
+    };
+
+    // Session state lives on the OpenCode server, and `/reset` already
+    // clears Talon's stored id centrally (storage/sessions.ts), so the
+    // next turn creates a fresh one — no `resetChat` needed. `warmSession`
+    // front-loads that creation plus the plugin-MCP sweep, matching what
+    // the Claude backend does after a reset.
+    const sessions: SessionBackend = {
+      warmSession: (chatId) => ocWarmSession(chatId),
+    };
+
+    const control: SystemControl = {
+      updateSystemPrompt: (prompt) => ocUpdateSystemPrompt(prompt),
+    };
+
     const backend = composeBackend({
       id: "opencode",
       label: "OpenCode",
@@ -102,7 +125,10 @@ const opencodeFactory: BackendFactory = {
       chat,
       background,
       models,
+      sessions,
+      tools,
       usage,
+      control,
     });
 
     return {

package/src/backend/opencode/handler/message.ts

@@ -24,6 +24,7 @@ import {
   ensureSession,
   ensureChatMcpServer,
   ensurePluginMcpServers,
+  buildToolOverrides,
   resolveProviderID,
   parseStoredOpenCodeModelSelection,
   getConfig,
@@ -87,8 +88,13 @@ export async function handleMessage(
       (selectedProviderID ? "" : " (provider via catalog lookup)"),
   );
   const sessionId = await ensureSession(oc, chatId);
-  await ensureChatMcpServer(oc, chatId);
-  await ensurePluginMcpServers(oc, chatId);
+  const chatMcpServerName = await ensureChatMcpServer(oc, chatId);
+  const pluginMcpServerNames = await ensurePluginMcpServers(oc, chatId);
+  const toolOverrides = await buildToolOverrides(
+    oc,
+    chatMcpServerName,
+    pluginMcpServerNames,
+  );
 
   // Build the prompt (time tag + sender + msg_id reference)
   const prompt = formatUserPrompt({
@@ -129,6 +135,7 @@ export async function handleMessage(
   });
   const promptStartedAt = Date.now();
   const seenQuestionIds = new Set<string>();
+  const seenPermissionIds = new Set<string>();
   const seenToolCallIds = new Set<string>();
 
   const setupMs = Date.now() - t0;
@@ -152,7 +159,9 @@ export async function handleMessage(
       state,
       chatId,
       seenQuestionIds,
+      seenPermissionIds,
       seenToolCallIds,
+      toolOverrides,
       onStreamDelta: undefined,
       onTextBlock,
       onToolUse,
@@ -202,9 +211,8 @@ export async function handleMessage(
     }
     // Note: we deliberately do NOT disconnect the chat MCP server here.
     // The server is named per-chat so it's safe to keep across turns;
-    // re-spawning the subprocess each turn cost ~800ms per message. The
-    // chat-switch disconnect dance (remote-server/mcp.ts) handles
-    // visibility scoping when the active chat changes.
+    // re-spawning the subprocess each turn cost ~800ms per message.
+    // Per-prompt overrides isolate visibility across concurrent chats.
   }
 
   // ── Post-loop accounting ──────────────────────────────────────────────────