@jungjaehoon/mama-os 0.51.2 → 0.52.1

package/dist/agent/agent-loop.js

@@ -69,6 +69,7 @@ const index_js_2 = require("../concurrency/index.js");
 const session_pool_js_1 = require("./session-pool.js");
 const principal_js_1 = require("../gateways/principal.js");
 const owner_runtime_js_1 = require("../operator/owner-runtime.js");
+const owner_event_policy_js_1 = require("../operator/owner-event-policy.js");
 const os_1 = require("os");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
@@ -278,31 +279,15 @@ function loadBackendAgentsMd(backend, verbose = false) {
     return '';
 }
 function loadComposedSystemPrompt(verbose = false, context) {
-    const mamaHome = (0, path_1.join)((0, os_1.homedir)(), '.mama');
     const layers = [];
-    // Load persona files: SOUL.md, IDENTITY.md, USER.md
-    const personaFiles = ['SOUL.md', 'IDENTITY.md', 'USER.md'];
-    for (const file of personaFiles) {
-        const path = (0, path_1.join)(mamaHome, file);
-        if ((0, fs_1.existsSync)(path)) {
-            if (verbose)
-                console.log(`[AgentLoop] Loaded persona: ${file}`);
-            const content = (0, fs_1.readFileSync)(path, 'utf-8');
-            layers.push(content);
-        }
-        else {
-            if (verbose)
-                console.log(`[AgentLoop] Persona file not found (skipping): ${file}`);
-        }
-    }
     // Load skill catalog (on-demand mode — full content injected per-message by PromptEnhancer)
-    const skillCatalog = (0, skill_loader_js_1.filterSkillCatalogForContext)((0, skill_loader_js_1.loadInstalledSkills)(verbose), context);
+    const skillCatalog = (0, skill_loader_js_1.filterSkillCatalogForContext)((0, skill_loader_js_1.loadInstalledSkills)(verbose, { includePaths: context?.roleName === 'owner_console' }), context);
     if (skillCatalog.length > 0) {
         const skillDirective = [
             '# Installed Skills',
             '',
-            'To invoke a skill, include its keywords in your message.',
-            'The full skill instructions will be injected automatically when matched.',
+            'Choose relevant skills from their descriptions and the current task; keywords are optional hints.',
+            'Read the selected instructions (source path when listed) before applying them. Learned procedures use procedure_list/read.',
             '',
             ...skillCatalog,
         ].join('\n');
@@ -344,6 +329,8 @@ function getRunGatewayToolsPrompt(context, disallowed) {
         privateConnectorPolicy: DEFAULT_PRIVATE_CONNECTOR_POLICY,
     }).prompt;
 }
+/** Korean/English phrasings that assert a correction, save, update or send has happened. */
+const COMPLETION_CLAIM_PATTERN = /(?:반영|저장|기록|등록|갱신|적용|수정|전송|발송)\s*(?:완료|했습니다|됐습니다|되었습니다|하였습니다)|\b(?:saved|updated|applied|recorded|sent)\b/i;
 const CANONICAL_CODE_ACT_HEADING = '## Code-Act: Gateway Tool Execution via Sandbox';
 const CODE_ACT_MCP_COMPAT_NAME = 'mcp__code-act__code_act';
 const GENERATED_CODE_ACT_START = '<!-- MAMA_GENERATED_CODE_ACT_START -->';
@@ -420,11 +407,13 @@ function combineCodeActSessionPolicyFingerprint(callerFingerprint, policy) {
         codeActPolicy: policy.fingerprintPayload,
     });
 }
-function ownerRuntimeSessionPolicyFingerprint(role, model) {
+function ownerRuntimeSessionPolicyFingerprint(role, model, supportsNativeSubagents) {
     return JSON.stringify({
         version: 1,
         subject: owner_runtime_js_1.OWNER_RUNTIME_SESSION_KEY,
-        subagentPolicy: owner_runtime_js_1.OWNER_SUBAGENT_INSTRUCTIONS,
+        // The fingerprint names the policy the session actually carries: a runner without
+        // native subagents is never told to delegate, so it must not be pinned to that text.
+        subagentPolicy: supportsNativeSubagents ? owner_runtime_js_1.OWNER_SUBAGENT_INSTRUCTIONS : null,
         telegramFormatPolicy: telegram_format_js_1.TELEGRAM_FORMAT_GUIDE,
         model: model ?? null,
         allowedTools: [...(role?.allowedTools ?? [])].sort(),
@@ -513,6 +502,34 @@ function withExecutionSurface(executionContext, executionSurface) {
         executionSurface,
     };
 }
+/** Normal coding tasks often need 10+ consecutive Bash calls; 5 was too low. */
+const MAX_CONSECUTIVE_SAME_HOST_TOOL = 15;
+/**
+ * The parent run's shape, kept only so a child announced mid-run (or after it) can be
+ * given an authority of its OWN: its own model run under the parent's, its own envelope,
+ * its own bridge with its own counters.
+ */
+/**
+ * The options a native child of this run inherits. Everything is carried EXCEPT the role,
+ * which is projected onto the unattended surface: the owner's 1:1 chat turn holds the
+ * gateway shell and file writer, and a child answers to no one inside the turn.
+ */
+function withUnattendedSubagentRole(options) {
+    const agentContext = options?.agentContext;
+    if (!agentContext) {
+        return { ...options };
+    }
+    const role = (0, owner_event_policy_js_1.projectUnattendedRole)(agentContext.role);
+    return {
+        ...options,
+        agentContext: {
+            ...agentContext,
+            role,
+            capabilities: [...role.allowedTools],
+            limitations: (role.blockedTools ?? []).map((tool) => `Cannot use ${tool}`),
+        },
+    };
+}
 class AgentLoop {
     /**
      * Construction-wide child-runtime tool capability.
@@ -526,6 +543,22 @@ class AgentLoop {
     probesDurableSession;
     ownerRecoveryJournalEnabled;
     agent;
+    /**
+     * Whether the ACTIVE runner can spawn a native subagent the host can observe.
+     *
+     * Read by the owner prompt path and forwarded to the scheduled work-order contract, so
+     * neither has to string-match a backend name. A mocked runner that predates this field
+     * is treated as incapable rather than silently promised delegation.
+     */
+    get supportsNativeSubagents() {
+        return this.agent.supportsNativeSubagents === true;
+    }
+    /**
+     * What a native child started by a run on this session needs to be given its own
+     * authority. Keyed by session key, overwritten by each run on that session, and dropped
+     * once the run finished and no child of it is still registered.
+     */
+    subagentRunContexts = new Map();
     persistentCLI = null;
     mcpExecutor;
     maxTurns;
@@ -622,27 +655,12 @@ class AgentLoop {
             // Priority 1 (never cut): CLAUDE.md base instructions
             // Priority 2 (cut if extreme): personas (SOUL, IDENTITY, USER) + gateway tools
             // Priority 3 (cut first): context prompt + skills + onboarding
-            const mamaHome = (0, path_1.join)((0, os_1.homedir)(), '.mama');
             const claudeMd = loadSystemPrompt();
-            const personaFiles = ['SOUL.md', 'IDENTITY.md', 'USER.md'];
-            const personaParts = [];
-            for (const file of personaFiles) {
-                const p = (0, path_1.join)(mamaHome, file);
-                if ((0, fs_1.existsSync)(p))
-                    personaParts.push((0, fs_1.readFileSync)(p, 'utf-8'));
-            }
-            const skillCatalog = (0, skill_loader_js_1.filterSkillCatalogForContext)((0, skill_loader_js_1.loadInstalledSkills)(), options.agentContext ?? null);
+            const skillCatalog = (0, skill_loader_js_1.filterSkillCatalogForContext)((0, skill_loader_js_1.loadInstalledSkills)(false, {
+                includePaths: options.agentContext?.roleName === 'owner_console',
+            }), options.agentContext ?? null);
             promptLayers = [
                 { name: 'claudeMd', content: claudeMd, priority: 1 },
-                ...(personaParts.length > 0
-                    ? [
-                        {
-                            name: 'personas',
-                            content: personaParts.join('\n\n---\n\n'),
-                            priority: 2,
-                        },
-                    ]
-                    : []),
                 ...(skillCatalog.length > 0
                     ? [
                         {
@@ -650,7 +668,7 @@ class AgentLoop {
                             content: [
                                 '# Installed Skills',
                                 '',
-                                'To invoke a skill, include its keywords in your message.',
+                                'Choose skills by their purpose and the current task, not only literal keywords.',
                                 '',
                                 ...skillCatalog,
                             ].join('\n'),
@@ -750,6 +768,9 @@ class AgentLoop {
                 mcpConfigPath: this.useCodeAct
                     ? undefined
                     : (options.mcpConfigPath ?? (useMCPMode ? mcpConfigPath : undefined)),
+                // A Codex-native child outlives the parent turn. The host - not the child's
+                // parent bridge - issues its authority: own model run, own envelope, own counters.
+                createSubagentBridge: (info) => this.createSubagentBridge(info),
             });
             logger.debug('Codex app-server backend enabled');
         }
@@ -792,6 +813,8 @@ class AgentLoop {
                 // ToolSearch/Agent, native gathering that bypasses report verification).
                 // Callers opt in per loop; agent-loop-init locks down the main persona.
                 tools: options.builtinTools,
+                // agent.effort: the boot gate already proved it is a level this backend accepts.
+                effort: options.codexEffort,
                 // Pass configured timeout (default in PersistentCLI: 120s — too short for complex tasks)
                 requestTimeout: options.timeoutMs,
             });
@@ -952,6 +975,15 @@ class AgentLoop {
     setAgentEventBus(eventBus) {
         this.mcpExecutor.setAgentEventBus(eventBus);
     }
+    /**
+     * The model runner backing this loop, for host adapters that subscribe to runner
+     * lifecycle events (e.g. native subagent completion waking the standing owner).
+     * Returned as `unknown` on purpose: the runner surface differs per backend, so the
+     * caller must feature-detect rather than assume an emitter.
+     */
+    getModelRunner() {
+        return this.agent;
+    }
     /**
      * Run the agent loop with a user prompt
      *
@@ -1010,15 +1042,29 @@ class AgentLoop {
         // Queue wait consumes no execution authority. Never renew a signed envelope implicitly:
         // only a host-supplied issuer can prepare the current grant after both lane waits.
         if (options?.prepareEnvelope) {
+            const runEnvelopeIssuer = options.prepareEnvelope;
             options = {
                 ...options,
-                envelope: await options.prepareEnvelope(),
+                envelope: await runEnvelopeIssuer(),
                 prepareEnvelope: undefined,
+                // A native child outlives this envelope and needs one of its OWN. The run's issuer
+                // is the fallback when the host supplied no dedicated subagent issuer, so it is kept
+                // reachable here instead of being lost with this rewrite - without it a child would
+                // silently get no authority at all.
+                prepareSubagentEnvelope: options.prepareSubagentEnvelope ?? (async () => await runEnvelopeIssuer()),
             };
             if (this.stopped) {
                 throw new types_js_1.AgentError('Agent loop is stopping', 'AGENT_STOPPED', undefined, false);
             }
         }
+        if (options?.prepareContent) {
+            const admitted = await options.prepareContent();
+            content = admitted.content;
+            options = { ...options, procedureRefs: admitted.procedureRefs, prepareContent: undefined };
+            if (this.stopped) {
+                throw new types_js_1.AgentError('Agent loop is stopping', 'AGENT_STOPPED', undefined, false);
+            }
+        }
         if (options?.agentContext) {
             options = {
                 ...options,
@@ -1057,6 +1103,13 @@ class AgentLoop {
             },
         };
         let toolExecutionContext = this.withBackgroundTaskRegistry(this.buildToolExecutionContext(options), backgroundTasks);
+        if (toolExecutionContext) {
+            toolExecutionContext = {
+                ...toolExecutionContext,
+                procedureStimulus: ownerJournalPrompt,
+                procedureRefs: options?.procedureRefs,
+            };
+        }
         // Track this run's tier for code-act execution and prompt sizing.
         if (options?.agentContext) {
             const rawTier = options.agentContext.tier ?? 1;
@@ -1069,11 +1122,14 @@ class AgentLoop {
         // Infinite loop prevention
         let consecutiveToolCalls = 0;
         let lastToolName = '';
-        const MAX_CONSECUTIVE_SAME_TOOL = 15; // Increased from 5 - normal coding tasks often need 10+ consecutive Bash calls
-        const EMERGENCY_MAX_TURNS = Math.max(this.maxTurns + 10, 50); // Always above maxTurns
+        const MAX_CONSECUTIVE_SAME_TOOL = MAX_CONSECUTIVE_SAME_HOST_TOOL;
+        const EMERGENCY_MAX_TURNS = this.emergencyMaxCalls(); // Always above maxTurns
         // Track channel key for session release
         const channelKey = options?.sessionKey ??
             (0, session_pool_js_1.buildChannelKey)(options?.source ?? 'default', (0, principal_js_1.laneChannelId)(options?.channelId ?? this.sessionKey, 'owner'));
+        // The context object THIS run created, compared by identity before the finally marks
+        // it finished: a later run on the same session key replaces the map entry.
+        let ownedSubagentRunContext;
         // Use session pool for conversation continuity
         // IMPORTANT: If caller passes cliSessionId, use it directly to avoid double-locking
         // MessageRouter already calls getSession() and passes the result via options
@@ -1125,7 +1181,7 @@ class AgentLoop {
             : undefined;
         const outerCodeActAllowed = this.useCodeAct && roleAllowsOuterCodeAct(options?.agentContext?.role, this.disallowedTools);
         const ownerPolicyFingerprint = ownerRuntime
-            ? ownerRuntimeSessionPolicyFingerprint(sessionPolicyRole, options?.model ?? this.model)
+            ? ownerRuntimeSessionPolicyFingerprint(sessionPolicyRole, options?.model ?? this.model, this.supportsNativeSubagents)
             : undefined;
         const effectiveSessionPolicyFingerprint = isDurableRuntime && codeActPolicy
             ? combineCodeActSessionPolicyFingerprint(ownerPolicyFingerprint ?? options?.sessionPolicyFingerprint, codeActPolicy)
@@ -1175,112 +1231,92 @@ class AgentLoop {
                     ...options,
                     modelRunId: ownedModelRunId,
                 }), backgroundTasks);
+                if (toolExecutionContext) {
+                    toolExecutionContext = {
+                        ...toolExecutionContext,
+                        procedureStimulus: ownerJournalPrompt,
+                        procedureRefs: options?.procedureRefs,
+                    };
+                }
             }
             nativeEffects = new native_effect_observer_js_1.NativeEffectReplayBoundary(this.createNativeEffectObserver?.(toolExecutionContext));
-            let nativeToolCallCount = 0;
-            let nativeConsecutiveToolCalls = 0;
-            let nativeLastToolSignature = '';
+            // This run's bridge is ITS OWN: the loop guards, the emergency budget, the history
+            // writes and the turn observers all belong to this run. A Codex-native child gets a
+            // separate bridge from `createSubagentBridge` - sharing this closure let a child trip
+            // the parent's loop guard and append its traces to the parent's committed model run.
+            const hostToolDefinitions = this.hostToolDefinitionsFor(options, outerCodeActAllowed);
             const hostToolBridge = isDurableRuntime && this.isGatewayMode
-                ? {
-                    tools: this.useCodeAct
-                        ? outerCodeActAllowed
-                            ? tool_registry_js_1.ToolRegistry.getHostToolDefinitions({ allowedTools: [index_js_1.CODE_ACT_MARKER] })
-                            : []
-                        : tool_registry_js_1.ToolRegistry.getHostToolDefinitions({
-                            allowedTools: options?.agentContext?.role.allowedTools,
-                            blockedTools: options?.agentContext?.role.blockedTools,
-                            disallowedTools: this.disallowedTools,
-                            viewer: options?.agentContext?.platform === 'viewer',
-                        }),
-                    execute: async (call) => {
-                        const callSignal = call.signal ?? new AbortController().signal;
-                        callSignal.throwIfAborted();
-                        if (nativeToolCallCount >= EMERGENCY_MAX_TURNS) {
-                            return {
-                                content: `Native tool call budget exceeded emergency maximum turns (${EMERGENCY_MAX_TURNS})`,
-                                isError: true,
-                                abort: true,
-                            };
-                        }
-                        const toolSignature = call.name === index_js_1.CODE_ACT_MARKER && typeof call.input.code === 'string'
-                            ? `${call.name}:${call.input.code.trim()}`
-                            : call.name;
-                        const nextConsecutiveCount = toolSignature === nativeLastToolSignature ? nativeConsecutiveToolCalls + 1 : 1;
-                        if (nextConsecutiveCount >= MAX_CONSECUTIVE_SAME_TOOL) {
-                            return {
-                                content: `Infinite loop detected: Tool "${call.name}" called ${nextConsecutiveCount} times consecutively`,
-                                isError: true,
-                                abort: true,
-                            };
-                        }
-                        nativeToolCallCount += 1;
-                        nativeConsecutiveToolCalls = nextConsecutiveCount;
-                        nativeLastToolSignature = toolSignature;
-                        const toolUse = {
-                            type: 'tool_use',
-                            id: call.callId,
-                            name: call.name,
-                            input: call.input,
-                        };
-                        // Codex does not return completed host exchanges, so record them
-                        // here. Cline reports the paired custom-tool exchange from its Hub
-                        // event stream and AgentLoop appends it exactly once below.
-                        if (isCodex) {
-                            history.push({ role: 'assistant', content: [toolUse] });
-                            runScope.onTurn?.({
-                                turn,
-                                role: 'assistant',
-                                content: [toolUse],
-                                stopReason: 'tool_use',
-                            });
-                        }
-                        const callExecutionContext = toolExecutionContext
-                            ? {
-                                ...toolExecutionContext,
-                                gatewayCallId: call.callId,
-                                signal: callSignal,
-                            }
-                            : null;
-                        const [toolResult] = await this.executeTools([toolUse], options?.stopAfterSuccessfulTools ?? [], callExecutionContext, runScope);
-                        if (!toolResult) {
-                            callSignal.throwIfAborted();
-                            return {
-                                content: `Native tool "${call.name}" returned no result`,
-                                isError: true,
-                                abort: true,
-                            };
-                        }
-                        if (!toolResult.terminalCode) {
-                            callSignal.throwIfAborted();
-                        }
-                        if (isCodex) {
-                            const persistedToolResult = historyToolResult(toolResult);
-                            history.push({ role: 'user', content: [persistedToolResult] });
-                            runScope.onTurn?.({
-                                turn,
-                                role: 'user',
-                                content: [persistedToolResult],
-                            });
+                ? this.buildHostToolBridge({
+                    tools: hostToolDefinitions,
+                    runScope,
+                    executionContext: () => toolExecutionContext,
+                    stopAfterSuccessfulTools: options?.stopAfterSuccessfulTools ?? [],
+                    emergencyMaxCalls: EMERGENCY_MAX_TURNS,
+                    maxConsecutiveSameTool: MAX_CONSECUTIVE_SAME_TOOL,
+                    // Codex does not return completed host exchanges, so record them here. Cline
+                    // reports the paired custom-tool exchange from its Hub event stream and
+                    // AgentLoop appends it exactly once below.
+                    ...(isCodex
+                        ? {
+                            recordExchange: {
+                                assistant: (toolUse) => {
+                                    history.push({ role: 'assistant', content: [toolUse] });
+                                    runScope.onTurn?.({
+                                        turn,
+                                        role: 'assistant',
+                                        content: [toolUse],
+                                        stopReason: 'tool_use',
+                                    });
+                                },
+                                result: (toolResult) => {
+                                    const persistedToolResult = historyToolResult(toolResult);
+                                    history.push({ role: 'user', content: [persistedToolResult] });
+                                    runScope.onTurn?.({
+                                        turn,
+                                        role: 'user',
+                                        content: [persistedToolResult],
+                                    });
+                                },
+                            },
                         }
-                        return {
-                            content: toolResult.content,
-                            isError: toolResult.is_error === true,
-                            abort: toolResult.abort === true,
-                            terminalCode: toolResult.terminalCode,
-                            stop: toolResult.is_error !== true &&
-                                (options?.stopAfterSuccessfulTools ?? []).includes(call.name),
-                        };
-                    },
-                }
+                        : {}),
+                })
                 : undefined;
+            if (hostToolBridge && isCodex) {
+                // A child can be announced during this run and outlive it, so what its authority
+                // needs is recorded now, per session key, and dropped when nothing needs it.
+                // A previous run's context object stays referenced by ITS still-live children, so
+                // this run starts its own count rather than inheriting one it can never settle.
+                // The child NEVER inherits this turn's role verbatim: an owner 1:1 chat turn holds
+                // the gateway shell and file writer, and a child is unattended by definition.
+                const childOptions = withUnattendedSubagentRole(options);
+                ownedSubagentRunContext = {
+                    options: childOptions,
+                    parentModelRunId: ownedModelRunId ?? options?.modelRunId ?? null,
+                    cliSessionId: resolvedCliSessionId,
+                    tools: this.hostToolDefinitionsFor(childOptions),
+                    tier: runScope.tier,
+                    activeChildren: 0,
+                    runFinished: false,
+                };
+                this.subagentRunContexts.set(channelKey, ownedSubagentRunContext);
+            }
             const prepareSystemPrompt = (requestedSystemPrompt, isResumingSession, includeOwnerRecovery = false) => {
                 let baseSystemPrompt = requestedSystemPrompt ?? this.defaultSystemPrompt;
-                if (ownerRuntime && !baseSystemPrompt.includes(owner_runtime_js_1.OWNER_SUBAGENT_INSTRUCTIONS)) {
+                if (ownerRuntime &&
+                    this.supportsNativeSubagents &&
+                    !baseSystemPrompt.includes(owner_runtime_js_1.OWNER_SUBAGENT_INSTRUCTIONS)) {
+                    // On a runner with no native subagent (persistent Claude persona, Cline) the
+                    // delegation policy asks for something the runtime cannot do. It is omitted, and
+                    // nothing replaces it: the turn's own result contract already says what must exist.
                     baseSystemPrompt = `${baseSystemPrompt}\n\n${owner_runtime_js_1.OWNER_SUBAGENT_INSTRUCTIONS}`;
                 }
                 if (ownerRuntime && !baseSystemPrompt.includes(telegram_format_js_1.TELEGRAM_FORMAT_GUIDE)) {
                     baseSystemPrompt = `${baseSystemPrompt}\n\n${telegram_format_js_1.TELEGRAM_FORMAT_GUIDE}`;
                 }
+                if (ownerRuntime && !baseSystemPrompt.includes(owner_runtime_js_1.OWNER_RUNTIME_RULES)) {
+                    baseSystemPrompt = `${baseSystemPrompt}\n\n${owner_runtime_js_1.OWNER_RUNTIME_RULES}`;
+                }
                 let gatewayToolsPrompt = '';
                 if (this.isGatewayMode && this.useCodeAct) {
                     baseSystemPrompt = stripTrailingCanonicalCodeActSection(stripGenericGatewayToolsCatalog(baseSystemPrompt));
@@ -1386,9 +1422,19 @@ class AgentLoop {
             // That rebuild costs an embedding search, so hand the backend a lazy builder it
             // invokes only inside the resume branch; a live thread never pays for it.
             const freshSystemPromptBuilder = options?.freshSessionSystemPrompt;
-            const resumeInstructions = isDurableRuntime && freshSystemPromptBuilder
-                ? async () => prepareSystemPrompt(await freshSystemPromptBuilder(), false, false)
-                : undefined;
+            // The owner-event and scheduled lanes carry no per-call systemPrompt at all: their
+            // perCallSystemPrompt IS the complete composed owner policy (the ownerRuntime branch
+            // above). Without a resume builder those lanes fell back to the turn-text
+            // <system-reminder> replay - the same full prompt, but billed as USER text on the
+            // first turn after every daemon restart. Re-anchor it through baseInstructions
+            // instead; the reminder is then never needed.
+            const resumeInstructions = !isDurableRuntime
+                ? undefined
+                : freshSystemPromptBuilder
+                    ? async () => prepareSystemPrompt(await freshSystemPromptBuilder(), false, false)
+                    : ownerRuntime
+                        ? async () => perCallSystemPrompt
+                        : undefined;
             // Reset StopContinuation state for this channel to prevent leaking
             // retry counts from previous invocations
             if (this.stopContinuationHandler) {
@@ -1434,6 +1480,12 @@ class AgentLoop {
                         nativeEffects.settled(name, toolUseId, isError);
                         ext?.onToolComplete?.(name, toolUseId, isError);
                     },
+                    // A spawn is an admission, not an external effect: forwarded verbatim with NO
+                    // nativeEffects call, so it never writes a `native_tool` ledger row and never
+                    // makes the occurrence unsafe to replay.
+                    onSubagentStart: (info) => {
+                        ext?.onSubagentStart?.(info);
+                    },
                     onFinal: (finalResponse) => {
                         ext?.onFinal?.(finalResponse);
                     },
@@ -1453,7 +1505,8 @@ class AgentLoop {
                 let requestSystemPrompt = perCallSystemPrompt;
                 let provisionalDurableSessionId;
                 // All three backends preserve context and receive only the new user message.
-                const promptText = this.formatLastMessageOnly(history);
+                const basePromptText = this.formatLastMessageOnly(history);
+                let promptText = basePromptText;
                 const promptStart = Date.now();
                 const throwFinalCliError = (error) => {
                     const normalizedError = error instanceof Error ? error : new Error(String(error));
@@ -1562,11 +1615,22 @@ class AgentLoop {
                         }
                         shouldResume = false;
                     }
+                    promptText = this.withProcedureHints(basePromptText, turn, {
+                        threadId: resolvedCliSessionId ?? channelKey,
+                        // A NEW pool session has no prior thread to carry procedures forward from, even
+                        // when the durable runtime is asked to resume: fresh is about the thread.
+                        fresh: !shouldResume || sessionIsNew,
+                        context: toolExecutionContext,
+                    });
                     piResult = await this.agent.prompt(promptText, callbacks, {
                         model: options?.model,
                         resumeSession: shouldResume,
                         systemPrompt: requestSystemPrompt,
                         resumeInstructions,
+                        promptTelemetry: {
+                            kind: options?.promptKind ?? (options?.source === 'operator' ? 'scheduled' : 'chat'),
+                            brief: options?.promptBrief ?? 'omitted',
+                        },
                         sessionKey: channelKey,
                         sessionPolicyFingerprint: effectiveSessionPolicyFingerprint,
                         sessionId: resolvedCliSessionId ?? undefined,
@@ -1704,6 +1768,11 @@ class AgentLoop {
                             else if (ownerRuntime) {
                                 resetSystemPrompt = prepareSystemPrompt(options?.systemPrompt, false, true);
                             }
+                            promptText = this.withProcedureHints(basePromptText, turn, {
+                                threadId: newSessionId,
+                                fresh: true,
+                                context: toolExecutionContext,
+                            });
                             piResult = await this.agent.prompt(promptText, callbacks, {
                                 model: options?.model,
                                 resumeSession: false, // Force new session
@@ -2037,6 +2106,11 @@ class AgentLoop {
                 result.modelRunProvenance = 'commit_failed';
                 logger.error(`Model run ${ownedModelRunId} may remain uncommitted; provenance reported as commit_failed`);
             }
+            if (ownerRuntime && finalResponse.trim()) {
+                // Observation only: a completion claim with no durable write in this run is the
+                // failure the owner sees as "corrected" work that never persisted (2026-09-09).
+                void this.observeCompletionClaim(ownedModelRunId, finalResponse);
+            }
             if (ownerRuntime && this.ownerRuntimeJournal && finalResponse.trim()) {
                 try {
                     this.ownerRuntimeJournal.append({
@@ -2076,6 +2150,16 @@ class AgentLoop {
             throw nativeEffects.failure(error);
         }
         finally {
+            this.mcpExecutor.releaseProcedureRun?.(toolExecutionContext);
+            // A child that outlives this run still needs its authority recipe, so the context is
+            // dropped only once the run finished AND no child of it is still registered.
+            if (ownedSubagentRunContext) {
+                ownedSubagentRunContext.runFinished = true;
+                if (ownedSubagentRunContext.activeChildren === 0 &&
+                    this.subagentRunContexts.get(channelKey) === ownedSubagentRunContext) {
+                    this.subagentRunContexts.delete(channelKey);
+                }
+            }
             // Always release session lock, even on error
             // BUT only if we own the session (not passed by caller)
             if (ownedSession) {
@@ -2126,6 +2210,250 @@ class AgentLoop {
             },
         };
     }
+    /** Always above maxTurns: the last-resort stop for a runaway native tool loop. */
+    emergencyMaxCalls() {
+        return Math.max(this.maxTurns + 10, 50);
+    }
+    /**
+     * The host tool surface the given options' role grants.
+     *
+     * The Code-Act gate is derived from THOSE options by default, never from the caller's
+     * own role: a child runs under a projected unattended role, so a parent that may hold
+     * outer Code-Act must not hand that marker to a child whose role forbids it.
+     */
+    hostToolDefinitionsFor(options, outerCodeActAllowed = this.useCodeAct &&
+        roleAllowsOuterCodeAct(options?.agentContext?.role, this.disallowedTools)) {
+        return this.useCodeAct
+            ? outerCodeActAllowed
+                ? tool_registry_js_1.ToolRegistry.getHostToolDefinitions({ allowedTools: [index_js_1.CODE_ACT_MARKER] })
+                : []
+            : tool_registry_js_1.ToolRegistry.getHostToolDefinitions({
+                allowedTools: options?.agentContext?.role.allowedTools,
+                blockedTools: options?.agentContext?.role.blockedTools,
+                disallowedTools: this.disallowedTools,
+                viewer: options?.agentContext?.platform === 'viewer',
+            });
+    }
+    /**
+     * One dynamic-tool bridge. Every guard it applies - the emergency call budget and the
+     * same-signature loop guard - is private to the bridge, so a parent and its children
+     * never share a counter. `recordExchange` is the ONLY way a bridge writes to a
+     * conversation: a child passes none and therefore cannot touch the parent's history.
+     */
+    buildHostToolBridge(params) {
+        let toolCallCount = 0;
+        let consecutiveToolCalls = 0;
+        let lastToolSignature = '';
+        return {
+            tools: params.tools,
+            execute: async (call) => {
+                const callSignal = call.signal ?? new AbortController().signal;
+                callSignal.throwIfAborted();
+                if (toolCallCount >= params.emergencyMaxCalls) {
+                    return {
+                        content: `Native tool call budget exceeded emergency maximum turns (${params.emergencyMaxCalls})`,
+                        isError: true,
+                        abort: true,
+                    };
+                }
+                const toolSignature = call.name === index_js_1.CODE_ACT_MARKER && typeof call.input.code === 'string'
+                    ? `${call.name}:${call.input.code.trim()}`
+                    : call.name;
+                const nextConsecutiveCount = toolSignature === lastToolSignature ? consecutiveToolCalls + 1 : 1;
+                if (nextConsecutiveCount >= params.maxConsecutiveSameTool) {
+                    return {
+                        content: `Infinite loop detected: Tool "${call.name}" called ${nextConsecutiveCount} times consecutively`,
+                        isError: true,
+                        abort: true,
+                    };
+                }
+                toolCallCount += 1;
+                consecutiveToolCalls = nextConsecutiveCount;
+                lastToolSignature = toolSignature;
+                const toolUse = {
+                    type: 'tool_use',
+                    id: call.callId,
+                    name: call.name,
+                    input: call.input,
+                };
+                params.recordExchange?.assistant(toolUse);
+                const executionContext = params.executionContext();
+                const callExecutionContext = executionContext
+                    ? {
+                        ...executionContext,
+                        gatewayCallId: call.callId,
+                        signal: callSignal,
+                    }
+                    : null;
+                const [toolResult] = await this.executeTools([toolUse], [...params.stopAfterSuccessfulTools], callExecutionContext, params.runScope);
+                if (!toolResult) {
+                    callSignal.throwIfAborted();
+                    return {
+                        content: `Native tool "${call.name}" returned no result`,
+                        isError: true,
+                        abort: true,
+                    };
+                }
+                if (!toolResult.terminalCode) {
+                    callSignal.throwIfAborted();
+                }
+                params.recordExchange?.result(toolResult);
+                return {
+                    content: toolResult.content,
+                    isError: toolResult.is_error === true,
+                    abort: toolResult.abort === true,
+                    terminalCode: toolResult.terminalCode,
+                    stop: toolResult.is_error !== true && params.stopAfterSuccessfulTools.includes(call.name),
+                };
+            },
+        };
+    }
+    /**
+     * Give one Codex-native child its OWN authority.
+     *
+     * The parent's bridge closes over an envelope issued for the PARENT's wall, which the
+     * child cannot renew - inheriting it meant a long delegated run losing every tool
+     * mid-flight and still reporting "done". So the child gets: its own model run under the
+     * parent's, its own envelope from a host issuer, its own execution context, and its own
+     * bridge counters. When no issuer is reachable it gets nothing and says so - the process
+     * refuses its calls with `subagent authority unavailable` rather than quietly borrowing.
+     */
+    async createSubagentBridge(info) {
+        const context = this.subagentRunContexts.get(info.sessionKey);
+        if (!context) {
+            console.warn(`[AgentLoop] subagent authority unavailable: no run context for session ${info.sessionKey} ` +
+                `(thread=${info.agentThreadId})`);
+            return null;
+        }
+        if (context.runFinished) {
+            // Only a child announced DURING the run inherits that run's issuer. A finished run
+            // stays reachable while a sibling is live; it must not mint authority hours later.
+            console.warn(`[AgentLoop] subagent authority refused: run for session ${info.sessionKey} already ended ` +
+                `(thread=${info.agentThreadId})`);
+            return null;
+        }
+        // Claimed synchronously: the parent's finally must not drop the context while this
+        // factory is still awaiting an envelope or a model run.
+        context.activeChildren += 1;
+        const abandon = (reason) => {
+            console.warn(reason);
+            this.releaseSubagentRunContext(info.sessionKey, context);
+            return null;
+        };
+        const issuer = context.options.prepareSubagentEnvelope ?? context.options.prepareEnvelope;
+        if (!issuer) {
+            return abandon(`[AgentLoop] subagent authority unavailable: no host envelope issuer for ${info.sessionKey} ` +
+                `(thread=${info.agentThreadId})`);
+        }
+        let envelope;
+        try {
+            envelope = await issuer();
+        }
+        catch (error) {
+            return abandon(`[AgentLoop] subagent authority issuance failed thread=${info.agentThreadId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!envelope) {
+            return abandon(`[AgentLoop] subagent authority unavailable: issuer returned no envelope ` +
+                `(thread=${info.agentThreadId})`);
+        }
+        const childOptions = {
+            ...context.options,
+            envelope,
+            prepareEnvelope: undefined,
+            parentModelRunId: context.parentModelRunId,
+            sourceMessageRef: `subagent:${info.agentThreadId}`,
+        };
+        let modelRunId;
+        try {
+            const modelRun = await this.mcpExecutor.beginRuntimeModelRun(this.buildModelRunInput(childOptions, context.cliSessionId));
+            modelRunId = modelRun.model_run_id;
+        }
+        catch (error) {
+            return abandon(`[AgentLoop] subagent model run could not begin thread=${info.agentThreadId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const childTasks = [];
+        const backgroundTasks = {
+            register(task) {
+                const observedTask = Promise.resolve(task);
+                observedTask.catch(() => {
+                    // Re-thrown later by the child's release drain.
+                });
+                childTasks.push(observedTask);
+            },
+        };
+        let childContext;
+        let bridge;
+        // The child's model run is already OPEN. Anything that throws while assembling its
+        // context or bridge must fail that run and release the parent's context, or the run
+        // stays `running` forever and the context stays pinned by a child that never existed.
+        try {
+            childContext = this.withBackgroundTaskRegistry(this.buildToolExecutionContext({ ...childOptions, modelRunId }), backgroundTasks);
+            if (childContext) {
+                childContext = { ...childContext, subagentThreadId: info.agentThreadId };
+            }
+            // The child's own run scope: no stream callbacks, no onTurn, no onToolUse. Its work
+            // is not this run's turns, and the parent's model run is already committed by then.
+            const runScope = { tier: context.tier, ...(0, temporal_code_act_breaker_js_1.createTemporalCodeActBreakerState)() };
+            bridge = this.buildHostToolBridge({
+                tools: context.tools,
+                runScope,
+                executionContext: () => childContext,
+                stopAfterSuccessfulTools: [],
+                emergencyMaxCalls: this.emergencyMaxCalls(),
+                maxConsecutiveSameTool: MAX_CONSECUTIVE_SAME_HOST_TOOL,
+            });
+        }
+        catch (error) {
+            const summary = error instanceof Error ? error.message : String(error);
+            try {
+                await this.mcpExecutor.failRuntimeModelRun(modelRunId, `subagent authority could not be assembled: ${summary}`);
+            }
+            catch (failError) {
+                logger.warn(`Failed to mark subagent model run ${modelRunId} failed: ${failError instanceof Error ? failError.message : String(failError)}`);
+            }
+            return abandon(`[AgentLoop] subagent authority could not be assembled thread=${info.agentThreadId}: ${summary}`);
+        }
+        let released = false;
+        return {
+            bridge,
+            release: async (outcome) => {
+                if (released) {
+                    return;
+                }
+                released = true;
+                try {
+                    await this.drainBackgroundTasks(childTasks);
+                }
+                catch (error) {
+                    logger.warn(`AgentLoop subagent background drain failed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                try {
+                    if (outcome.status === 'completed') {
+                        await this.mcpExecutor.commitRuntimeModelRun(modelRunId, `agent_loop subagent ${info.agentPath || info.agentThreadId} completed`);
+                    }
+                    else {
+                        // `unknown` is not success: the run is marked failed with the reason so the
+                        // ledger never carries a completion nobody confirmed.
+                        await this.mcpExecutor.failRuntimeModelRun(modelRunId, outcome.error ?? `subagent ${outcome.status}`);
+                    }
+                }
+                catch (error) {
+                    logger.warn(`AgentLoop subagent model run ${modelRunId} could not be closed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                this.mcpExecutor.releaseProcedureRun?.(childContext);
+                this.releaseSubagentRunContext(info.sessionKey, context);
+            },
+        };
+    }
+    /** Drop a run's subagent context once the run finished and no child still holds it. */
+    releaseSubagentRunContext(sessionKey, context) {
+        context.activeChildren = Math.max(0, context.activeChildren - 1);
+        if (context.runFinished &&
+            context.activeChildren === 0 &&
+            this.subagentRunContexts.get(sessionKey) === context) {
+            this.subagentRunContexts.delete(sessionKey);
+        }
+    }
     /**
      * Execute tools from response content blocks
      */
@@ -2379,6 +2707,39 @@ class AgentLoop {
      * Format only the last user message for persistent CLI
      * Persistent CLI maintains context automatically, so we only send the new message
      */
+    /**
+     * Turn 1 only, once the backend has said whether the thread is live: a fresh or re-opened
+     * thread is told the relevant procedures once, a live thread only what it has not been
+     * told (procedure-runtime.ts). Later turns of a run carry tool results, not hints.
+     */
+    withProcedureHints(basePromptText, turn, input) {
+        if (turn !== 1)
+            return basePromptText;
+        const hints = this.mcpExecutor.prepareProcedureContext?.(input.context, {
+            threadId: input.threadId,
+            fresh: input.fresh,
+        });
+        // Logged even when empty: with no procedures stored, this is the only sign the
+        // assembler ran and the thread decision it saw.
+        console.log(`[experience] thread=${input.threadId} fresh=${input.fresh} hints=${hints?.hints.length ?? 0}${hints?.hints.length ? `(${hints.hints.join(',')})` : ''} chars=${hints?.text.length ?? 0}`);
+        if (!hints?.text)
+            return basePromptText;
+        return `${hints.text}\n\n${basePromptText}`;
+    }
+    async observeCompletionClaim(modelRunId, finalResponse) {
+        const claim = finalResponse.match(COMPLETION_CLAIM_PATTERN)?.[0];
+        if (!claim || !modelRunId)
+            return;
+        try {
+            const wrote = await this.mcpExecutor.runHadDurableWrite?.(modelRunId);
+            if (wrote === false) {
+                console.warn(`[evidence] completion claim without a durable write: run=${modelRunId} claim="${claim}"`);
+            }
+        }
+        catch (error) {
+            console.warn(`[evidence] claim check unavailable: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     formatLastMessageOnly(history) {
         const imageReaderTool = this.backend === 'cline' ? 'read_files' : this.backend === 'codex' ? 'view_image' : 'Read';
         // Find the last user message in the history