@koda-sl/baker-bridge 0.109.0-dev.f28c07bd2 → 0.109.0-dev.f7ef4c7e1

package/dist/hono/bridge-job.js

@@ -11,15 +11,18 @@ import { avatarAwaitingItsFace, avatarCreatedInAssistantMessage, avatarHandleFro
 import { accentContradictsUser } from "./avatar-accent.js";
 import { AVATAR_CASTING_TOOL_NAME, normalizeAvatarCastingToolInput, } from "./avatar-casting.js";
 import { asksForAvatarFace, FACE_QUESTION_MESSAGE } from "./avatar-face-question.js";
-import { CONNECTION_INPUT_TOOL_NAME, CONNECTION_PLATFORMS, normalizeConnectionInputToolInput, } from "./connection-input.js";
+import { CONNECTION_INPUT_TOOL_NAME, CONNECTION_PLATFORMS, connectedButNotLoaded, normalizeConnectionInputToolInput, toolsConnected, } from "./connection-input.js";
 import { messageContextTokens, pickContextWindow, streamEventContextUsage, turnContextUsage, } from "./context-usage.js";
-import { FLOW_INPUT_TOOL_NAME, nodeTargetRefusals, normalizeFlowInputToolInput, readRawFlowTree, sanitizeFlowRequests, } from "./flow-input.js";
+import { CREDENTIAL_INPUT_TOOL_NAME, normalizeCredentialInputToolInput, } from "./credential-input.js";
+import { credentialScrubHooks } from "./credential-scrub.js";
+import { agentStatedFlowMessage, FLOW_INPUT_TOOL_NAME, nodeTargetRefusals, normalizeFlowInputToolInput, readRawFlowTree, sanitizeFlowRequests, unknownFlowPrefillMessage, } from "./flow-input.js";
 import { writesInventedLogo } from "./invented-logo.js";
-import { installedLatitudeHook, latitudeTelemetryFor } from "./latitude-telemetry.js";
+import { jevJudge } from "./jev.js";
 import { composioScopesToInvalidate, failedCustomServers, reportMcpInvalid, serversConnectedWithNoTools, } from "./mcp-servers.js";
 import { agentModelOverride, autoCompactWindowForModel, betasForModel, contextWindowForModel, } from "./model-capabilities.js";
+import { agentShellPrefixEnv, killFirstWrapper } from "./oom-priority.js";
 import { BEDROCK_SERVABLE_CAPABILITIES, buildAgentExtraBody, EXTRA_BODY_ENV, MODEL_CAPABILITIES_ENV, } from "./openrouter-session.js";
-import { currentReferenceReminder } from "./prompt-context.js";
+import { credentialReminder, currentReferenceReminder } from "./prompt-context.js";
 import { bridgeRuntimeFiles } from "./runtime-files.js";
 import { applyCurrentSenderAttribution, buildCleanBoundary, buildRehydratedPrompt, compactionRetryAttempt, emptyInProgressSession, isContextOverflowError, isResumeSessionError, observeInProgressSession, prepareSessionAttempt, stallContinuationAttempt, } from "./session-continuity.js";
 import { readSessionSkills } from "./session-skills.js";
@@ -29,6 +32,7 @@ import { createBakerUiServer, normalizeTagInputToolInput, sanitizeTagChanges, TA
 import { blockingToolDelegated, toolRunAsCommand } from "./tool-in-shell.js";
 import { recordTurnEvent } from "./turn-events.js";
 import { addQueryModelUsage, queryModelUsage, turnModelUsageList } from "./turn-model-usage.js";
+import { settleWorkspaceAfterTasks } from "./workspace-settle.js";
 export function parsePlanDecision(value) {
     if (!value || typeof value !== "object") {
         return null;
@@ -43,6 +47,35 @@ export function parsePlanDecision(value) {
     }
     return null;
 }
+/**
+ * How long a mid-turn MCP reload may hold the card's answer. Connecting a
+ * handful of HTTP servers takes seconds; past this the tools arrive next
+ * message instead, and the turn goes on.
+ */
+const MCP_RELOAD_TIMEOUT_MS = 30_000;
+/** The card's resolution, with what the reload did: ready now, or which servers would not start. */
+function withReload(resolution, reload) {
+    const missing = reload?.ready ? connectedButNotLoaded(resolution, reload.loaded) : [];
+    const failed = [...(reload?.failed ?? []), ...missing];
+    return {
+        ...resolution,
+        toolsReady: reload?.ready === true && missing.length === 0,
+        ...(failed.length > 0 ? { failedToLoad: failed } : {}),
+    };
+}
+/** The promise's value, or `undefined` once `ms` pass without one. */
+async function settleWithin(promise, ms) {
+    let timer;
+    const timedOut = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(undefined), ms);
+    });
+    try {
+        return await Promise.race([promise, timedOut]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * The Agent SDK matches AskUserQuestion answers to their questions by the
  * question TEXT (see `AskUserQuestionInput.answers`), but the dashboard submits
@@ -117,11 +150,10 @@ const BASE_DISALLOWED_TOOLS = [
     //
     // Since CLI 2.1.233 the CLI additionally withholds these from
     // Sonnet-5-and-newer models — so on Opus 5.5 this list is now
-    // belt-and-braces. It is NOT redundant, because development runs on
-    // Haiku 4.5, which predates that gate: read off the session's own
-    // `init` tool list on 2.1.239, Haiku is offered all four and Opus 5
-    // none. Removing them would hand the dev agent the backlog the
-    // production agent cannot see.
+    // belt-and-braces. It is NOT redundant: Haiku 4.5 predates that gate
+    // (read off the session's own `init` tool list on 2.1.239, it is offered
+    // all four and Opus 5 none), and any override naming it would hand that
+    // agent the backlog the production agent cannot see.
     //
     // `TodoWrite` is gone from both — it is absent from an SDK session's
     // tool list on either model, so in-turn planning no longer has a tool
@@ -151,10 +183,11 @@ const BASE_DISALLOWED_TOOLS = [
     // not asked to fund a research fleet. Ordinary fan-out is unaffected:
     // `Task` stays, so the scaffold's subagents still run.
     "Workflow",
-    // Cross-session messaging. A Runtime holds exactly one session, so
-    // there is never a peer to reach; every call is a dead end that costs a
-    // round trip to discover.
-    "SendMessage",
+    // NOT listed: `SendMessage`. It is how the model follows up with a
+    // subagent it already ran, and the CLI tells it to on every Agent result.
+    // The continued subagent runs in the background, but it announces itself
+    // with `task_started` / `background_tasks_changed`, so the turn stays open
+    // until it finishes (`createTurnEndController`).
     // A Session review may not change anything. Removing the definitions is
     // the second of three layers — the key it carries is read-scoped and its
     // Bash calls go through `reviewBashPolicy` — because each fails
@@ -189,6 +222,16 @@ export function reviewQueryOptions(job) {
         ? { outputFormat: { type: "json_schema", schema: job.review.outputSchema }, hooks: reviewOutputHooks() }
         : {};
 }
+/**
+ * Every job's tool results pass through the credential scrub, appended after
+ * any other PostToolUse hook so its rewrite is the one the SDK keeps.
+ */
+function withCredentialScrub(options) {
+    const scrub = credentialScrubHooks();
+    const hooks = { ...(options.hooks ?? {}) };
+    hooks.PostToolUse = [...(hooks.PostToolUse ?? []), ...(scrub.PostToolUse ?? [])];
+    return { ...options, hooks };
+}
 /**
  * The review runs on Baker's own OpenRouter credential and its own read-only
  * key, both replacing whatever the Runtime was started with — the client never
@@ -215,6 +258,12 @@ export const REVIEW_DEBUG_LOG = "/tmp/baker-review-cli.jsonl";
 // briefly; model activity cancels it (the CLI clearly isn't idle). Turns that
 // never ran a task skip the delay entirely.
 const DEFAULT_TURN_END_SETTLE_MS = 1_000;
+// When the last task settles after the clean result, the CLI wakes the model on
+// it and streams nothing until the woken turn's first token — seconds, and 30+
+// on a slow route. Ending input inside that silence strands the woken turn on a
+// closed channel, and the CLI's exit at its result kills anything it backgrounds
+// (dev, Oct 2026: a render). A settle that wakes nobody waits this long once.
+const DEFAULT_TURN_END_WAKE_MS = 45_000;
 // After input ends, a healthy idle CLI exits within seconds. If the stream is
 // still open past this window with no messages arriving, the CLI is wedged —
 // close the query so the turn can finish instead of hanging to the watchdog.
@@ -242,10 +291,10 @@ const UNATTENDED_PROMPT_MESSAGE = "This run is unattended — it was started by
  * asked for in a text prompt renders a question nobody can answer. In each case the user
  * is left waiting for something that was never going to come.
  */
-function refuseMalformedCall(toolName, input, userText, priorUserText) {
+async function refuseMalformedCall(toolName, input, judge, userText, priorUserText) {
     if (toolName === "Bash") {
         const command = typeof input?.command === "string" ? input.command : undefined;
-        return toolRunAsCommand(command) ?? accentContradictsUser(command, userText, priorUserText);
+        return toolRunAsCommand(command) ?? (await accentContradictsUser(command, userText, priorUserText, judge));
     }
     if (toolName === "Agent" || toolName === "Task") {
         return blockingToolDelegated(typeof input?.prompt === "string" ? input.prompt : undefined);
@@ -253,11 +302,18 @@ function refuseMalformedCall(toolName, input, userText, priorUserText) {
     if (toolName === "Write" || toolName === "Edit" || toolName === "MultiEdit") {
         return writesInventedLogo(typeof input?.file_path === "string" ? input.file_path : undefined);
     }
-    if (toolName === "AskUserQuestion" && asksForAvatarFace(input)) {
+    if (toolName === "AskUserQuestion" && (await asksForAvatarFace(input, judge))) {
         return FACE_QUESTION_MESSAGE;
     }
     return null;
 }
+/**
+ * Whether this Runtime has Credentials: the backend sets `BAKER_CREDENTIALS=1`
+ * alongside the credential broker's proxy env. Read per turn, not at import.
+ */
+function credentialsEnabled() {
+    return process.env.BAKER_CREDENTIALS === "1";
+}
 /** Blocking prompts: every tool that would leave a card the backend parks on. */
 function deniedUnattendedPrompt(toolName) {
     return (toolName === "AskUserQuestion" ||
@@ -265,6 +321,7 @@ function deniedUnattendedPrompt(toolName) {
         toolName === TAG_INPUT_TOOL_NAME ||
         toolName === FLOW_INPUT_TOOL_NAME ||
         toolName === CONNECTION_INPUT_TOOL_NAME ||
+        toolName === CREDENTIAL_INPUT_TOOL_NAME ||
         toolName === AVATAR_CASTING_TOOL_NAME);
 }
 export class StreamStallError extends Error {
@@ -341,8 +398,7 @@ function enrichImageError(message) {
     return `${message} — likely a file whose extension lies about its format (e.g. PNG renamed .jpg) or a corrupted download. Run the image validator and check magic bytes with \`file <path>\`.`;
 }
 /**
- * Which hooks a job runs. The client's agent runs the workspace's own and is
- * traced to Latitude. A Session review runs none: every workspace hook is
+ * Which hooks a job runs. The client's agent runs the workspace's own. A Session review runs none: every workspace hook is
  * written for the client's agent, and in the reviewer they speak about "this
  * Session" with the review's read-scoped key. The SessionStart probes are
  * refused on full-scope routes, and the reviewer filed its own "status unknown"
@@ -359,12 +415,11 @@ function hookSettingsForJob(job) {
     if (job.review) {
         return { disableAllHooks: true, permissions: { ask: ["Bash"] } };
     }
-    const hooks = latitudeTelemetryFor(process.env, installedLatitudeHook());
-    return hooks ? { hooks } : {};
+    return {};
 }
 // Carry a Runtime-wide model override down to the fan-out workers.
 //
-// The shared subagents pin themselves to Sonnet 5 in their own frontmatter (see
+// The shared subagents pin themselves to Sonnet 5.5 in their own frontmatter (see
 // `DEFAULT_MODEL`). Since CLI 2.1.251 `CLAUDE_CODE_SUBAGENT_MODEL` is only the
 // default beneath that pin; `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` (2.1.257) makes it
 // win over the frontmatter and any per-spawn model again. Absent (production),
@@ -498,9 +553,9 @@ function sdkResultError(msg) {
 // the whole turn; the deny THRESHOLD below still guards a one-off end-of-turn race.
 // The trailing colon matters: the CLI always emits the envelope followed by the
 // error that caused it ("…failed: Error: Stream closed", "…failed: AbortError: …").
-// Prose that merely NAMES the failure quotes it without one, which is how the
-// scaffold's guard-background-commands hook describes what it prevents — and its
-// block is an is_error tool_result, so a colon-less match counted a healthy
+// Prose that merely NAMES the failure quotes it without one, which is how a
+// hook explaining a block quotes it (the scaffold's former background-subagent
+// block did) — and a hook block is an is_error tool_result, so a colon-less match counted a healthy
 // blocked spawn as a deny and could trip the breaker on a healthy turn.
 const CONTROL_CHANNEL_DENY_MARKER = "Tool permission request failed:";
 // Hook failures are reported through the same is_error tool_result channel but
@@ -658,14 +713,37 @@ export function createStallDetector(input) {
     timer.unref?.();
     return {
         observeMessage: (msg) => {
+            // A tool's progress says nothing about the model: a background task's
+            // heartbeat arrives while the model's stream is stalled.
+            if (msg.type === "tool_progress") {
+                return;
+            }
             lastMessageAt = input.now();
             trackPendingToolUses(pendingToolUses, msg);
             awaitingModel = (msg.type === "user" || msg.type === "stream_event") && pendingToolUses.size === 0;
         },
         stalled: () => stalled,
+        hasPendingToolUses: () => pendingToolUses.size > 0,
         dispose: () => clearInterval(timer),
     };
 }
+// A query's cost and `modelUsage` are cumulative — on every result message and
+// on the CLI's usage reply alike — so the latest reading replaces the last one
+// rather than adding to it. It is folded into the turn totals when the query
+// settles (see `runQueryOnce`). A spuriously empty later reading never wipes a
+// real earlier one.
+function recordCumulativeUsage(state, reading) {
+    const own = ownQueryUsage(reading, state.queryUsageBaseline);
+    state.observedCostUsd = own.costUsd;
+    const snapshot = queryModelUsage(own.modelUsage);
+    if (snapshot.size > 0) {
+        state.queryModelUsage = snapshot;
+    }
+    return own.costUsd;
+}
+// How long ending a turn waits on the CLI's usage reply before going ahead
+// without it. Billing a turn late is recoverable; hanging one is not.
+const USAGE_READING_TIMEOUT_MS = 5_000;
 // Decides when the turn is really over and the CLI may be told to exit.
 //
 // The prompt rides a held-open input stream (see `createHeldOpenQuery` in
@@ -687,7 +765,10 @@ export function createStallDetector(input) {
 // events must not, or the end would never re-arm. After input ends, an exit
 // guard closes the query if the CLI neither speaks nor exits, so a wedged
 // process cannot hang the turn until the session watchdog.
-function createTurnEndController(job, query, closeQuery, timings, onTurnEvent) {
+function createTurnEndController(job, query, closeQuery, timings, onTurnEvent, 
+// Runs once, before input ends on a turn that ran tasks: a task can settle
+// without waking the model, so the last result may not include what it spent.
+beforeEndInput) {
     const inFlightTasks = new Set();
     // The background_tasks_changed LEVEL signal, tracked separately from the
     // edge-paired set above: a foreground command the CLI auto-backgrounds emits
@@ -700,15 +781,52 @@ function createTurnEndController(job, query, closeQuery, timings, onTurnEvent) {
     let cleanResultSeen = false;
     let lastWasTaskLifecycle = false;
     let inputEnded = false;
+    // Between deciding to end and ending, while the usage reading is in flight.
+    // Anything that would have cancelled a pending end — model activity, a task
+    // starting — is recorded here and abandons the end instead.
+    let ending;
+    // The query stopped being drained (a Stop, a crash): a reading answering
+    // after that has no turn left to end.
+    let disposed = false;
     let settleTimer;
     let exitGuard;
     const endInput = () => {
         settleTimer = undefined;
         // Fire-time guard: a task that started during the settle window keeps the
         // channel open; a later settle re-arms the end.
-        if (inputEnded || hasInFlightWork()) {
+        if (inputEnded || ending || hasInFlightWork()) {
+            return;
+        }
+        if (sawAnyTask && beforeEndInput) {
+            const attempt = { interrupted: false };
+            ending = attempt;
+            let timeout;
+            const timedOut = new Promise((resolveTimeout) => {
+                timeout = setTimeout(resolveTimeout, USAGE_READING_TIMEOUT_MS);
+                timeout.unref?.();
+            });
+            void Promise.race([beforeEndInput().catch(() => undefined), timedOut]).finally(() => {
+                clearTimeout(timeout);
+                ending = undefined;
+                if (disposed) {
+                    return;
+                }
+                // Re-check at the moment input would end, as the fire-time guard above
+                // does: a wake or a task that landed during the reading keeps the
+                // channel open, and the woken turn's own result or settle ends it.
+                if (attempt.interrupted || hasInFlightWork()) {
+                    if (cleanResultSeen && !hasInFlightWork()) {
+                        scheduleEnd();
+                    }
+                    return;
+                }
+                finishEndInput();
+            });
             return;
         }
+        finishEndInput();
+    };
+    const finishEndInput = () => {
         inputEnded = true;
         query.endInput?.();
         onTurnEvent({
@@ -728,7 +846,7 @@ function createTurnEndController(job, query, closeQuery, timings, onTurnEvent) {
         }, timings.exitGuardMs);
         exitGuard.unref?.();
     };
-    const scheduleEnd = () => {
+    const scheduleEnd = (delayMs = timings.settleMs) => {
         if (settleTimer) {
             return;
         }
@@ -740,7 +858,7 @@ function createTurnEndController(job, query, closeQuery, timings, onTurnEvent) {
             endInput();
             return;
         }
-        settleTimer = setTimeout(endInput, timings.settleMs);
+        settleTimer = setTimeout(endInput, delayMs);
         settleTimer.unref?.();
     };
     return {
@@ -778,6 +896,9 @@ function createTurnEndController(job, query, closeQuery, timings, onTurnEvent) {
                 clearTimeout(settleTimer);
                 settleTimer = undefined;
             }
+            if (ending && (isModelActivity || hasInFlightWork())) {
+                ending.interrupted = true;
+            }
             if (exitGuard) {
                 exitGuard.refresh();
             }
@@ -803,10 +924,13 @@ function createTurnEndController(job, query, closeQuery, timings, onTurnEvent) {
             // second result) would strand the turn until the watchdog. An emptied
             // background_tasks_changed level counts as a settle the same way.
             if (lastWasTaskLifecycle && cleanResultSeen && !hasInFlightWork()) {
-                scheduleEnd();
+                scheduleEnd(timings.wakeMs);
             }
         },
+        hasInFlightWork,
+        ranTasks: () => sawAnyTask,
         dispose: () => {
+            disposed = true;
             if (settleTimer) {
                 clearTimeout(settleTimer);
                 settleTimer = undefined;
@@ -893,11 +1017,14 @@ export class BridgeJobExecutor {
     stallCheckIntervalMs;
     recordTurnEvent;
     turnEndSettleMs;
+    turnEndWakeMs;
     turnEndExitGuardMs;
     now;
     readUsageBaseline;
     stalledCliExitMs;
     readFlowTree;
+    settleWorkspace;
+    judge;
     constructor(dependencies) {
         this.sdk = dependencies.sdk;
         this.relay = dependencies.relay;
@@ -910,14 +1037,17 @@ export class BridgeJobExecutor {
         this.stallCheckIntervalMs = dependencies.stallCheckIntervalMs ?? DEFAULT_STALL_CHECK_INTERVAL_MS;
         this.recordTurnEvent = dependencies.recordTurnEvent ?? recordTurnEvent;
         this.turnEndSettleMs = dependencies.turnEndSettleMs ?? DEFAULT_TURN_END_SETTLE_MS;
+        this.turnEndWakeMs = dependencies.turnEndWakeMs ?? DEFAULT_TURN_END_WAKE_MS;
         this.turnEndExitGuardMs = dependencies.turnEndExitGuardMs ?? DEFAULT_TURN_END_EXIT_GUARD_MS;
         this.now = dependencies.now ?? Date.now;
         this.readUsageBaseline =
             dependencies.readUsageBaseline ??
                 ((sessionId) => readUsageBaseline(sessionId, process.env.CLAUDE_CONFIG_DIR || resolve(process.env.HOME || homedir(), ".claude")));
         this.stalledCliExitMs = dependencies.stalledCliExitMs ?? STALLED_CLI_EXIT_MS;
+        this.settleWorkspace = dependencies.settleWorkspace ?? (() => settleWorkspaceAfterTasks());
         this.readFlowTree =
             dependencies.readFlowTree ?? ((flowSlug) => readRawFlowTree(bridgeRuntimeFiles.flowsDir(), flowSlug));
+        this.judge = dependencies.judge ?? jevJudge(process.env.OPENROUTER_API_KEY);
     }
     async execute(job, controls) {
         const state = createBridgeJobState();
@@ -990,7 +1120,11 @@ export class BridgeJobExecutor {
         const verbatim = verbatimSlashCommand(job.prompt) ??
             leadingSkillCommand(job.prompt, (await readSessionSkills(bridgeRuntimeFiles.projectRoot())) ?? []);
         let requestPrompt = verbatim ?? applyCurrentSenderAttribution(job.prompt, job.currentSender);
-        const reminder = verbatim === null ? currentReferenceReminder(job.currentReference) : undefined;
+        const reminders = [
+            verbatim === null ? currentReferenceReminder(job.currentReference) : undefined,
+            credentialReminder(job.credentials ?? [], credentialsEnabled()),
+        ].filter((text) => text !== undefined);
+        const reminder = reminders.length > 0 ? reminders.join("\n\n") : undefined;
         if (job.attachments && job.attachments.length > 0) {
             requestPrompt += await this.prepareAttachments(job.attachments, "message");
         }
@@ -1247,6 +1381,39 @@ export class BridgeJobExecutor {
             return undefined;
         }
     }
+    /**
+     * Load what the user just connected into the running query, so its tools
+     * answer in this turn instead of the next. Asks Convex for the whole set
+     * afresh (the same set the next turn starts from, so the tool list changes
+     * once, not twice) and hands it to the CLI with `baker_ui` kept — the SDK
+     * drops any in-process server missing from the call, and `baker_ui` is the
+     * server whose tool call is resolving right now. Never throws. A server the
+     * CLI could not start is named, because it will not start next message
+     * either; anything else that goes wrong here loads next message.
+     */
+    async reloadMcpServers(job, query) {
+        const notReady = { ready: false, loaded: [], failed: [] };
+        if (!this.mcpServersProvider || !query.setMcpServers) {
+            return notReady;
+        }
+        try {
+            const servers = await this.mcpServersProvider(job.threadId, job.currentSender?.userId, { fresh: true });
+            if (!servers) {
+                return notReady;
+            }
+            const result = await settleWithin(query.setMcpServers({ ...servers, baker_ui: createBakerUiServer({ credentials: credentialsEnabled() }) }), MCP_RELOAD_TIMEOUT_MS);
+            const failed = Object.keys(result?.errors ?? {});
+            if (failed.length > 0) {
+                console.error(`[mcp] reload after a connection could not start ${failed.join(", ")}`);
+            }
+            const loaded = Object.keys(servers).filter((name) => !failed.includes(name));
+            return { ready: result !== undefined && failed.length === 0, loaded, failed };
+        }
+        catch (error) {
+            console.error(`[mcp] reload after a connection failed: ${error instanceof Error ? error.message : String(error)}`);
+            return notReady;
+        }
+    }
     reportMcpFailures(job, msg) {
         for (const scope of composioScopesToInvalidate(msg)) {
             void reportMcpInvalid(job.threadId, { scope }, job.currentSender?.userId);
@@ -1266,7 +1433,7 @@ export class BridgeJobExecutor {
      * handlers — except on an unattended turn, where there is nobody to answer and
      * every one of them is refused up front (see `UNATTENDED_PROMPT_MESSAGE`).
      */
-    routeToolUse(job, controls, toolName, input, opts) {
+    async routeToolUse(job, controls, toolName, input, opts) {
         const refusedShell = reviewShellRefusal(job, toolName, input);
         if (refusedShell) {
             return Promise.resolve({ behavior: "deny", message: refusedShell });
@@ -1282,9 +1449,9 @@ export class BridgeJobExecutor {
             });
             return Promise.resolve({ behavior: "deny", message: UNATTENDED_PROMPT_MESSAGE });
         }
-        const malformed = refuseMalformedCall(toolName, input, job.prompt, userTurnsBefore(job));
+        const malformed = await refuseMalformedCall(toolName, input, this.judge, job.prompt, userTurnsBefore(job));
         if (malformed)
-            return Promise.resolve({ behavior: "deny", message: malformed });
+            return { behavior: "deny", message: malformed };
         // Cast what is owed FIRST, whatever comes next — including another create. Checked
         // the other way round, a second create (the agent retrying after a rejected flag,
         // which is what happens in practice) would overwrite the handle and the first
@@ -1337,6 +1504,15 @@ export class BridgeJobExecutor {
         if (toolName === CONNECTION_INPUT_TOOL_NAME) {
             return this.handleConnectionInputRequest(job, controls, input, opts.toolUseID, opts.signal);
         }
+        if (toolName === CREDENTIAL_INPUT_TOOL_NAME) {
+            if (!credentialsEnabled()) {
+                return Promise.resolve({
+                    behavior: "deny",
+                    message: "Saved credentials are not available in this workspace. Ask the user to share what you need another way, and never ask them to paste a password or key into the chat.",
+                });
+            }
+            return this.handleCredentialInputRequest(job, controls, input, opts.toolUseID, opts.signal);
+        }
         if (toolName === AVATAR_CASTING_TOOL_NAME) {
             return this.handleAvatarCastingRequest(job, controls, input, opts.toolUseID, opts.signal);
         }
@@ -1375,6 +1551,10 @@ export class BridgeJobExecutor {
             // warning to the user. Pinning it takes that threshold out of remote control.
             // See `autoCompactWindowForModel` for the full chain and its ceiling.
             ...(autoCompactWindow !== undefined ? { autoCompactWindow } : {}),
+            // Subagents, workflows and helper requests default to a 5-minute prompt
+            // cache outside a Claude subscription, so a subagent waiting on a render
+            // longer than that rewrites its whole prefix on the next call.
+            subagentPromptCacheTtl: "1h",
             // SDK rejects autoMemoryDirectory from project settings for security; must use settings tier. Gate on BAKER_CHAT_ID so local dev never writes into the monorepo.
             ...(process.env.BAKER_CHAT_ID
                 ? {
@@ -1407,11 +1587,8 @@ export class BridgeJobExecutor {
             settingSources: ["project"],
             // `baker_ui` hosts in-process interactive dashboard tools (secure tag
             // form). Always present; HTTP (Composio) servers merge alongside it.
-            mcpServers: { ...(mcpServers ?? {}), baker_ui: createBakerUiServer() },
-            // Only send the key when there is something in it: the SDK forwards
-            // `settings` to the CLI whenever it is present, so an empty object still
-            // becomes a `--settings {}` flag tier for the CLI to parse.
-            ...(Object.keys(settings).length > 0 ? { settings } : {}),
+            mcpServers: { ...(mcpServers ?? {}), baker_ui: createBakerUiServer({ credentials: credentialsEnabled() }) },
+            settings,
             includePartialMessages: true,
             // Only the workspace's own skills. Omitting the option is NOT "skills
             // off" — the CLI's defaults still load its built-in developer skills
@@ -1420,8 +1597,11 @@ export class BridgeJobExecutor {
             // the workspace could not be read; omit rather than allowlist nothing.
             ...(skills ? { skills } : {}),
             disallowedTools: disallowedToolsFor(job),
-            ...reviewQueryOptions(job),
-            ...(job.planMode ? { permissionMode: "plan" } : {}),
+            ...withCredentialScrub(reviewQueryOptions(job)),
+            // Never omitted: since SDK 0.3.286 an omitted mode starts a third-party-provider
+            // session (OpenRouter) in auto mode, where a classifier rather than `canUseTool`
+            // decides tool calls.
+            permissionMode: job.planMode ? "plan" : "default",
             canUseTool: (toolName, input, opts) => this.routeToolUse(job, controls, toolName, input, opts),
             // No `fallbackModel`, and no server-side refusal `fallbacks` in the extra
             // body: the CLI's refusal fallback is gated on a first-party base URL (see
@@ -1445,14 +1625,13 @@ export class BridgeJobExecutor {
                 // system-reminder repeatedly pushed the agent toward that ephemeral
                 // backlog instead of the product's own Tasks (`baker actions`).
                 CLAUDE_CODE_ENABLE_TASKS: "0",
-                // Defer MCP tool schemas to their names until `ToolSearch` loads one.
-                // Unset, the CLI loads every schema up front whenever ANTHROPIC_BASE_URL
-                // is not first-party (the OpenRouter passthrough): a connected Make
-                // toolkit put ~180 schemas, ~115k tokens, into every request of a Session
-                // that called two. Measured through OpenRouter on Bedrock: `tool_reference`
-                // round-trips, and a 150-tool server's prefix fell from 134k to 17k.
-                // `baker_ui` opts out with `alwaysLoad` (see `createBakerUiServer`).
-                ENABLE_TOOL_SEARCH: "true",
+                // Every Bash command runs through a wrapper that makes it, not the agent
+                // or the credential broker, what the OOM killer takes first (oom-priority.ts).
+                ...agentShellPrefixEnv(killFirstWrapper(), process.env),
+                // The CLI clamps any Bash timeout to 10 minutes unless told otherwise;
+                // the workspace's `inject-timeouts` hook gives a render up to 30, and at
+                // the clamp the render was moved to the background mid-repair.
+                BASH_MAX_TIMEOUT_MS: String(30 * 60_000),
                 // `citty` writes ANSI escapes into `baker --help` unconditionally —
                 // they are never TTY-gated, so every help read the agent does inside
                 // the sandbox pays ~5-10% of its tokens on colour codes it can't see.
@@ -1474,6 +1653,7 @@ export class BridgeJobExecutor {
             ...attempt.resumeOptions,
         };
         const query = this.sdk.query({ prompt: attempt.prompt, reminder: attempt.reminder, options });
+        controls.reloadMcpServers = () => this.reloadMcpServers(job, query);
         let queryClosed = false;
         const closeQuery = () => {
             if (queryClosed) {
@@ -1495,6 +1675,7 @@ export class BridgeJobExecutor {
             throw error;
         }
         finally {
+            controls.reloadMcpServers = undefined;
             controls.abortSignal.removeEventListener("abort", closeQuery);
             // Release the held-open input if the turn-end policy never fired (the
             // stream ended on its own, or an error path closed the query). Idempotent.
@@ -1518,7 +1699,19 @@ export class BridgeJobExecutor {
     // in-progress session.
     async drainQuery(job, controls, state, query, closeQuery) {
         const stallDetector = this.createStallDetector(job, controls, closeQuery);
-        const turnEnd = createTurnEndController(job, query, closeQuery, { settleMs: this.turnEndSettleMs, exitGuardMs: this.turnEndExitGuardMs }, this.recordTurnEvent);
+        // What the query had spent when its turn ended, read from the CLI — set
+        // only when a task ran, and higher than the last result's figure when a
+        // task kept working after it.
+        let settledCostUsd = 0;
+        // A reading that answers after the query drained (past its timeout) belongs
+        // to a query already folded into the turn — and a retry reuses `state`.
+        let drained = false;
+        const turnEnd = createTurnEndController(job, query, closeQuery, { settleMs: this.turnEndSettleMs, wakeMs: this.turnEndWakeMs, exitGuardMs: this.turnEndExitGuardMs }, this.recordTurnEvent, async () => {
+            const reading = await query.usage?.();
+            if (reading && !drained) {
+                settledCostUsd = recordCumulativeUsage(state, reading);
+            }
+        });
         let costUsd = 0;
         // Errors thrown while HANDLING a message (control-channel breaker, error
         // results) are real verdicts and must surface as-is; only errors from the
@@ -1528,6 +1721,7 @@ export class BridgeJobExecutor {
             for await (const msg of query) {
                 stallDetector.observeMessage(msg);
                 turnEnd.observeMessage(msg);
+                controls.setWorkInFlight?.(stallDetector.hasPendingToolUses() || turnEnd.hasInFlightWork());
                 try {
                     costUsd = await this.consumeSdkMessage(job, controls, state, msg, costUsd);
                 }
@@ -1550,6 +1744,8 @@ export class BridgeJobExecutor {
             throw error;
         }
         finally {
+            drained = true;
+            controls.setWorkInFlight?.(false);
             stallDetector.dispose();
             turnEnd.dispose();
             await this.openPendingCastingAtTurnEnd(job, controls);
@@ -1557,7 +1753,11 @@ export class BridgeJobExecutor {
         if (stallDetector.stalled() && controls.isActive()) {
             throw new StreamStallError();
         }
-        return costUsd;
+        // Not for a Session review: it runs with every hook off and may not change anything.
+        if (turnEnd.ranTasks() && controls.isActive() && !job.review) {
+            await this.settleWorkspace();
+        }
+        return Math.max(costUsd, settledCostUsd);
     }
     /**
      * Open a casting the turn recorded but never reached.
@@ -1614,6 +1814,7 @@ export class BridgeJobExecutor {
                 controls.pendingTagInputs.size > 0 ||
                 controls.pendingFlowInputs.size > 0 ||
                 controls.pendingConnectionInputs.size > 0 ||
+                controls.pendingCredentialInputs.size > 0 ||
                 controls.pendingAvatarCastings.size > 0,
             onStall: () => {
                 console.error(`[BridgeJob] no stream data for ${this.stallTimeoutMs}ms while awaiting the model — closing query for retry (thread ${job.threadId})`);
@@ -1650,17 +1851,7 @@ export class BridgeJobExecutor {
         }
         trackMainRequestUsage(state, msg);
         if (msg.type === "result") {
-            const own = ownQueryUsage({ totalCostUsd: msg.total_cost_usd, modelUsage: msg.modelUsage }, state.queryUsageBaseline);
-            state.observedCostUsd = own.costUsd;
-            // A query's result `modelUsage` is cumulative (like `total_cost_usd`, which
-            // we overwrite above), so keep the latest snapshot rather than summing —
-            // it is folded into the turn totals when the query settles (see
-            // `runQueryOnce`). Guard against a spuriously empty later result wiping a
-            // real earlier one.
-            const snapshot = queryModelUsage(own.modelUsage);
-            if (snapshot.size > 0) {
-                state.queryModelUsage = snapshot;
-            }
+            const ownCostUsd = recordCumulativeUsage(state, { totalCostUsd: msg.total_cost_usd, modelUsage: msg.modelUsage });
             await this.publishContextUsage(job, state, msg.modelUsage);
             // What a Session review returns. The SDK enforces the JSON schema, so this
             // either parses against the findings contract or the review failed to
@@ -1677,7 +1868,7 @@ export class BridgeJobExecutor {
                 await this.clearIfDirty(job, controls, state, "result_error");
                 throw resultError;
             }
-            return own.costUsd;
+            return ownCostUsd;
         }
         if (isUserVisibleSdkMessage(msg)) {
             state.sawUserVisibleSdkMessage = true;
@@ -2052,6 +2243,16 @@ export class BridgeJobExecutor {
         // Strip any secret values the model tried to prefill; their names still reach
         // the user as requested fields. The backend strips again.
         const sanitizedRequests = sanitizeFlowRequests(requests);
+        // A key the card does not render is dropped there without a word, and the
+        // person retypes what the agent already knew — refuse it before the card opens.
+        const stated = agentStatedFlowMessage(sanitizedRequests);
+        if (stated) {
+            return { behavior: "deny", message: stated };
+        }
+        const unknownPrefill = unknownFlowPrefillMessage(sanitizedRequests);
+        if (unknownPrefill) {
+            return { behavior: "deny", message: unknownPrefill };
+        }
         const posted = await this.relay.flowInputRequest(target, { toolUseId, requests: sanitizedRequests });
         if (!posted) {
             console.error(`[request_flow_input] failed to post flow-input-request for ${toolUseId} — denying to avoid a hang`);
@@ -2102,7 +2303,7 @@ export class BridgeJobExecutor {
         if (connections.length === 0) {
             return {
                 behavior: "deny",
-                message: `request_connection requires \`connections: [...]\` with at least one entry { platform, reason }. Platform must be one of ${CONNECTION_PLATFORMS.join(", ")}. Retry with that shape.`,
+                message: `request_connection requires \`connections: [...]\` with at least one entry: { platform, reason } where platform is one of ${CONNECTION_PLATFORMS.join(", ")}; { server: { name, url, auth?, keyHeader?, scope? }, reason } for a remote MCP server; or { app, reason } for a managed app from \`baker mcp catalog\`. Retry with that shape.`,
             };
         }
         const posted = await this.relay.connectionInputRequest(target, { toolUseId, connections });
@@ -2124,7 +2325,43 @@ export class BridgeJobExecutor {
             return { behavior: "deny", message: PROMPT_UNANSWERED_MESSAGE };
         }
         void this.relay.connectionInputResolved(target);
-        return { behavior: "allow", updatedInput: { connections, resolution: decision.value } };
+        // Loaded before the tool answers, so the model's next request already
+        // carries the new tools. Only when an app or server came through: a
+        // platform adds no tool, and reloading for nothing rewrites the tool list.
+        const resolution = toolsConnected(decision.value)
+            ? withReload(decision.value, await controls.reloadMcpServers?.())
+            : decision.value;
+        return { behavior: "allow", updatedInput: { connections, resolution } };
+    }
+    async handleCredentialInputRequest(job, controls, input, toolUseId, signal) {
+        const target = { threadId: job.threadId, turnId: job.turnId };
+        const request = normalizeCredentialInputToolInput(input);
+        if (!request) {
+            return {
+                behavior: "deny",
+                message: "request_credential requires { label, reason, allowedHosts: [...] } (and optionally a lowercase `name`). Retry with that shape.",
+            };
+        }
+        const posted = await this.relay.credentialInputRequest(target, { toolUseId, ...request });
+        if (!posted) {
+            console.error(`[request_credential] failed to post credential-input-request for ${toolUseId} — denying`);
+            return {
+                behavior: "deny",
+                message: "The credential request could not be delivered to the dashboard — retry request_credential in a moment.",
+            };
+        }
+        const decision = await this.awaitPromptDecision({
+            label: "request_credential",
+            signal,
+            controls,
+            pending: controls.pendingCredentialInputs,
+            toolUseId,
+        });
+        if (decision.kind === "unanswered") {
+            return { behavior: "deny", message: PROMPT_UNANSWERED_MESSAGE };
+        }
+        void this.relay.credentialInputResolved(target);
+        return { behavior: "allow", updatedInput: { ...request, resolution: decision.value } };
     }
     async handlePlanReview(job, controls, input, toolUseId, signal) {
         const target = { threadId: job.threadId, turnId: job.turnId };