mixdog 0.9.46 → 0.9.49

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -570,6 +570,7 @@ export async function _acquireWithRetry({
                 if (err && typeof err === 'object') {
                     try { err.attempts = attempt; } catch {}
                     try { err.retryClassifier = classifier; } catch {}
+                    try { err.wsRetriesExhausted = true; } catch {}
                 }
                 try {
                     if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(
@@ -580,15 +581,10 @@ export async function _acquireWithRetry({
             }
             // Schedule backoff and emit progress.
             const backoff = _backoffFor(attempt);
-            try {
-                if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(
-                    `[openai-oauth-ws] worker retry ${attempt}/${attemptCap} (transient: ${classifier}, backoff ${backoff}ms)\n`,
-                );
-            } catch {}
             try {
                 onRetry?.({
                     attempt,
-                    max: attemptCap,
+                    max: attemptCap - 1,
                     classifier,
                     backoffMs: backoff,
                     error: err,
@@ -652,12 +648,6 @@ export async function sendViaWebSocket({
     traceProvider = 'openai-oauth',
     logSuppressedReasoningDeltas = true,
     warmupBody = null,
-    // Fast-fallback: when the caller has HTTP/SSE fallback enabled, cap the
-    // handshake acquire retry loop to a single attempt so a first
-    // acquire/first-byte failure surfaces immediately instead of burning the
-    // full exponential-backoff budget (measured 16.4s) before the caller can
-    // race HTTP. WS-only callers leave this false → full HANDSHAKE_MAX_ATTEMPTS.
-    fastFallback = false,
     // Test seams (undefined in production). Let the unit test drive the
     // retry state machine without opening real sockets or touching the
     // handshake-retry layer.
@@ -714,7 +704,6 @@ export async function sendViaWebSocket({
     // warmed. openai-oauth / openai-direct anchor by per-socket session_id, where
     // this carry-forward would not help and is therefore gated to xAI.
     let carryForwardCache = null;
-    const emittedProgress = [];
     const useCodexWsClientMetadata = traceProvider === 'openai-oauth';
     const codexMetadataContext = { poolKey, cacheKey, sendOpts };
     const codexHandshakeHeaders = useCodexWsClientMetadata
@@ -760,6 +749,22 @@ export async function sendViaWebSocket({
             });
         } catch {}
     };
+    // Single caller-visible recovery path for both handshake/acquire retries
+    // and retryable stream failures. The session/TUI stage bridge renders this
+    // as non-terminal reconnect progress; transport code must not also print it
+    // to stderr.
+    const emitReconnectProgress = ({ attempt, max, classifier }) => {
+        const retryAttempt = Number(attempt) || 1;
+        const retryMax = Number(max) || 1;
+        try {
+            onStageChange?.('reconnecting', {
+                attempt: retryAttempt,
+                max: retryMax,
+                classifier: classifier || null,
+                message: `Reconnecting... ${retryAttempt}/${retryMax}`,
+            });
+        } catch {}
+    };
 
     for (let attemptIndex = 0; attemptIndex <= MAX_MIDSTREAM_RETRIES; attemptIndex++) {
         const handshakeStart = performance.now();
@@ -778,16 +783,14 @@ export async function sendViaWebSocket({
                 // one is either torn down or in an unknown state.
                 forceFresh: forceFresh || attemptIndex > 0,
                 externalSignal,
-                // Fast-fallback caps the handshake acquire loop at 1 attempt so
-                // the caller can race HTTP immediately instead of waiting out
-                // the full backoff budget. Only the FIRST midstream attempt is
-                // capped — a midstream retry (attemptIndex>0) is already past
-                // the fallback decision and keeps the normal budget.
-                maxAttempts: (fastFallback && attemptIndex === 0) ? 1 : HANDSHAKE_MAX_ATTEMPTS,
+                maxAttempts: HANDSHAKE_MAX_ATTEMPTS,
                 onRetry: (info) => {
                     handshakeRetries += 1;
                     sendSpan.handshakeRetries += 1;
                     if (info?.classifier) handshakeRetryClassifiers.push(info.classifier);
+                    const attempt = Number(info?.attempt) || handshakeRetries;
+                    const max = Number(info?.max) || Math.max(HANDSHAKE_MAX_ATTEMPTS - 1, 1);
+                    emitReconnectProgress({ attempt, max, classifier: info?.classifier });
                 },
                 onBackoffSlept: (ms) => { sendSpan.retryBackoffMs += ms; },
             });
@@ -813,6 +816,9 @@ export async function sendViaWebSocket({
             // the caller's turn actually tripped on).
             if (attemptIndex > 0 && firstAttemptError) {
                 try { firstAttemptError.midstreamRetries = attemptIndex; } catch {}
+                if (err?.wsRetriesExhausted === true) {
+                    try { firstAttemptError.wsRetriesExhausted = true; } catch {}
+                }
                 emitSendSpan('error');
                 throw _stampTool(_stampLiveText(firstAttemptError));
             }
@@ -1109,16 +1115,7 @@ export async function sendViaWebSocket({
             _stampTool(err);
             const classifier = _classifyMidstreamError(err, midState);
             const retryLimit = classifier ? _midstreamRetryLimit(classifier) : 0;
-            // Fast-fallback: a first-byte timeout on the FIRST attempt means the
-            // socket opened but the server never ACKed — race HTTP now instead
-            // of burning a midstream retry (fresh acquire + first-byte window).
-            // Only suppresses the first_byte_timeout bucket on attemptIndex 0;
-            // ws_1006/1011 mid-stream drops still retry (a live socket that died
-            // is cheaper to re-acquire than to cold-fall-back).
-            const fastFallbackSkipRetry = fastFallback
-                && attemptIndex === 0
-                && (classifier === 'first_byte_timeout' || err?.firstByteTimeout === true);
-            if (classifier && attemptIndex < retryLimit && !fastFallbackSkipRetry) {
+            if (classifier && attemptIndex < retryLimit) {
                 // Retry-eligible: stash the first-attempt error, emit progress,
                 // and loop. The subsequent acquire uses forceFresh so no socket
                 // is shared between attempts.
@@ -1127,11 +1124,11 @@ export async function sendViaWebSocket({
                 try { err.midstreamClassifier = classifier; } catch {}
                 const retryNumber = attemptIndex + 1;
                 const backoff = _midstreamBackoffFor(retryNumber);
-                try {
-                    const line = `[openai-oauth-ws] mid-stream recovered: retry ${retryNumber}/${retryLimit} (cause: ${classifier}, backoff ${backoff}ms)\n`;
-                    if (!process.env.MIXDOG_QUIET_PROVIDER_LOG) process.stderr.write(line);
-                    emittedProgress.push(line);
-                } catch {}
+                emitReconnectProgress({
+                    attempt: retryNumber,
+                    max: retryLimit,
+                    classifier,
+                });
                 const sleepStart = performance.now();
                 try {
                     await _sleepWithAbort(backoff, externalSignal, _sleepFn);
@@ -1149,6 +1146,9 @@ export async function sendViaWebSocket({
                 // the user's turn actually tripped on), tag actual retry count.
                 try { firstAttemptError.midstreamRetries = attemptIndex; } catch {}
                 try { firstAttemptError.midstreamClassifier = firstAttemptClassifier; } catch {}
+                if (attemptIndex >= _midstreamRetryLimit(firstAttemptClassifier)) {
+                    try { firstAttemptError.wsRetriesExhausted = true; } catch {}
+                }
                 // Attach the retry attempt's error so post-mortem diagnostics
                 // can see WHY the retry also failed instead of silently
                 // dropping it. Use `cause` if free, else `suppressed`.

package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs

@@ -51,6 +51,8 @@ import {
     customToolInputFromArguments,
     isCustomToolCallRecord,
     isResponsesFreeformTool,
+    nativeToolSearchCallInput,
+    nativeToolSearchOutputInput,
     toResponsesCustomTool,
 } from './custom-tool-wire.mjs';
 import {
@@ -401,6 +403,15 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
                 if (mediaContent) pendingToolMedia.push(...mediaContent);
                 continue;
             }
+            const nativeSearchOutput = nativeToolSearchOutputInput(
+                m,
+                opts.nativeToolSearchProvider || 'openai-oauth',
+            );
+            if (nativeSearchOutput) {
+                out.push(nativeSearchOutput);
+                if (mediaContent) pendingToolMedia.push(...mediaContent);
+                continue;
+            }
             out.push({
                 type: 'function_call_output',
                 call_id: m.toolCallId || '',
@@ -419,7 +430,10 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
             // reasoning in `input` triggers "Duplicate item".
             if (m.content) out.push(wireMessage('assistant', normalizeContentForOpenAIResponses(m.content, { role: 'assistant' })));
             for (const tc of m.toolCalls) {
-                if (isCustomToolCallRecord(tc)) {
+                const nativeSearchCall = nativeToolSearchCallInput(tc);
+                if (nativeSearchCall) {
+                    out.push(nativeSearchCall);
+                } else if (isCustomToolCallRecord(tc)) {
                     if (tc.id) customToolCallNameById.set(tc.id, tc.name || '');
                     out.push({
                         type: 'custom_tool_call',
@@ -450,8 +464,8 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
 function toOpenAIResponsesTool(t) {
     if (t?.name === 'load_tool' || t?.name === 'tool_search') {
         return {
-            type: 'function',
-            name: 'load_tool',
+            type: 'tool_search',
+            execution: 'client',
             description: t.description,
             parameters: t.inputSchema,
         };
@@ -465,6 +479,8 @@ function toOpenAIResponsesTool(t) {
     };
 }
 
+export const _convertMessagesToResponsesInputForTest = convertMessagesToResponsesInput;
+
 // codex build_reasoning() (core/src/client.rs:785-805) only attaches the
 // reasoning object when model_info.supports_reasoning_summaries; models
 // without summary support get NO reasoning field at all. Mirror that via the
@@ -501,6 +517,7 @@ export function buildRequestBody(messages, model, tools, sendOpts) {
     const input = convertMessagesToResponsesInput(messages, {
         providerState: opts.providerState,
         model,
+        nativeToolSearchProvider: opts.promptCacheProvider || 'openai-oauth',
     });
     // Match the request body shape the OAuth backend expects so the
     // server-side auto-cache routes correctly. text.verbosity / include /
@@ -625,8 +642,11 @@ export class OpenAIOAuthProvider {
     name = 'openai-oauth';
     tokens = null;
     _refreshFallbackUntil = 0;
-    _forceHttpFallback = false;
-    _forceHttpFallbackUntil = 0;
+    // Sticky transport fallback is isolated by the WS pool/session key. A
+    // provider instance is shared across concurrent sessions, so singleton
+    // booleans here would let one unhealthy session force every other session
+    // onto HTTP.
+    _httpFallbackUntilByPoolKey = new Map();
     config;
     constructor(config) {
         this.config = config || {};
@@ -801,17 +821,17 @@ export class OpenAIOAuthProvider {
             return result;
         };
         const httpFallbackActive = () => {
-            if (this._forceHttpFallbackUntil > Date.now()) return true;
-            if (this._forceHttpFallback || this._forceHttpFallbackUntil) {
-                this._forceHttpFallback = false;
-                this._forceHttpFallbackUntil = 0;
+            if (!poolKey) return false;
+            const now = Date.now();
+            for (const [key, expiresAt] of this._httpFallbackUntilByPoolKey) {
+                if (!(expiresAt > now)) this._httpFallbackUntilByPoolKey.delete(key);
             }
-            return false;
+            return (this._httpFallbackUntilByPoolKey.get(poolKey) || 0) > now;
         };
         const markStickyHttpFallback = () => {
+            if (!poolKey) return;
             const ttlMs = _envPositiveInt('MIXDOG_OPENAI_OAUTH_HTTP_FALLBACK_STICKY_MS', 60_000);
-            this._forceHttpFallback = true;
-            this._forceHttpFallbackUntil = Date.now() + ttlMs;
+            this._httpFallbackUntilByPoolKey.set(poolKey, Date.now() + ttlMs);
         };
         const traceWsError = (err, stage = 'primary') => {
             try {
@@ -898,9 +918,8 @@ export class OpenAIOAuthProvider {
             // a fresh WS entry; only after the bounded WS retry budget is
             // exhausted does openai-oauth fall back to HTTP/SSE. This preserves
             // the hot WS/cache path for temporary blips while still preventing
-            // TUI-level hangs. Operators can opt into immediate HTTP fallback
-            // for diagnostics with MIXDOG_OPENAI_OAUTH_FAST_HTTP_FALLBACK=1.
-            fastFallback: httpFallbackEnabled && _envFlag('MIXDOG_OPENAI_OAUTH_FAST_HTTP_FALLBACK', false),
+            // TUI-level hangs. Sticky HTTP fallback is only armed after this
+            // bounded reconnect budget is exhausted.
             // codex-parity prewarm (generate:false full frame on a fresh
             // socket, wire-verified 2026-07-03). DEFAULT ON: R19(off) vs
             // R20(on) A/B shows prewarm removes ALL early-session zero-cache
@@ -951,7 +970,9 @@ export class OpenAIOAuthProvider {
                     return recordLiveModel(result);
                 } catch (retryErr) {
                     traceWsError(retryErr, 'auth_retry');
-                    if (httpFallbackEnabled && _shouldUseOpenAIHttpFallback(retryErr, externalSignal)) {
+                    if (httpFallbackEnabled
+                        && retryErr?.wsRetriesExhausted === true
+                        && _shouldUseOpenAIHttpFallback(retryErr, externalSignal)) {
                         try {
                             return await dispatchHttp(
                                 retryErr?.retryClassifier || retryErr?.code || retryErr?.message || 'ws_auth_retry_failed',
@@ -973,32 +994,18 @@ export class OpenAIOAuthProvider {
             const msg = err?.message || '';
             const isUnknownModel = status === 404
                 || /unknown[_\s-]?model|model[_\s-]?not[_\s-]?found/i.test(msg);
-            if (isUnknownModel && !opts._modelRetry) {
+            // Catalog recovery reissues the full turn. Once any text/tool
+            // output has escaped, that replay can duplicate rendered output or
+            // a dispatched side effect, so honor the same unsafe gate as auth
+            // retry and transport fallback.
+            if (isUnknownModel && !opts._modelRetry && !liveTextEmitted) {
                 process.stderr.write(`[openai-oauth-ws] unknown model — refreshing catalog + 1 retry\n`);
                 await this._refreshModelCache();
                 return this.send(messages, model, tools, { ...opts, _modelRetry: true });
             }
-            if (httpFallbackEnabled && _shouldUseOpenAIHttpFallback(err, externalSignal)) {
-                // Fast-path trace: the WS handshake acquire/first-byte failed on
-                // its FIRST attempt while fast-fallback was armed, so the
-                // remaining backoff retries were skipped and HTTP starts now.
-                // err.attempts===1 means the capped single-attempt path fired.
-                if (httpFallbackEnabled && Number(err?.attempts) === 1) {
-                    appendAgentTrace({
-                        sessionId: poolKey,
-                        iteration,
-                        kind: 'ws_fallback_fast',
-                        provider: 'openai-oauth',
-                        model: useModel,
-                        transport: 'websocket',
-                        elapsed_ms: Date.now() - _t1,
-                        payload: {
-                            elapsed_ms: Date.now() - _t1,
-                            classifier: err?.retryClassifier || err?.midstreamClassifier || null,
-                            code: err?.code || null,
-                        },
-                    });
-                }
+            if (httpFallbackEnabled
+                && err?.wsRetriesExhausted === true
+                && _shouldUseOpenAIHttpFallback(err, externalSignal)) {
                 try {
                     return await dispatchHttp(
                         err?.retryClassifier || err?.midstreamClassifier || err?.code || err?.message || 'ws_failed',

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -41,6 +41,11 @@ export const WS_IDLE_MS = resolveTimeoutMs(
 );
 const WS_HANDSHAKE_TIMEOUT_MS = PROVIDER_WS_HANDSHAKE_TIMEOUT_MS;
 const WS_ACQUIRE_TIMEOUT_MS = PROVIDER_WS_ACQUIRE_TIMEOUT_MS;
+// A write that never reaches the ws callback is indistinguishable from a
+// wedged transport. Keep it under the same short bound as socket acquisition
+// so the caller can discard the entry and reconnect before arming stream
+// watchdogs.
+const WS_SEND_TIMEOUT_MS = WS_ACQUIRE_TIMEOUT_MS;
 const WS_PING_INTERVAL_MS = PROVIDER_WS_PING_INTERVAL_MS;
 const WS_PONG_TIMEOUT_MS = PROVIDER_WS_PONG_TIMEOUT_MS;
 const WS_LIVENESS_STALE_MS = PROVIDER_WS_LIVENESS_STALE_MS;
@@ -386,7 +391,7 @@ function _armLiveness(poolKey, entry) {
 // for a server event that will never arrive. Tag any failure with
 // `wsSendFailed=true` so _classifyMidstreamError routes the next attempt
 // through a fresh socket.
-export function _sendFrame(entry, frame, sendSpan = null) {
+export function _sendFrame(entry, frame, sendSpan = null, timeoutMs = WS_SEND_TIMEOUT_MS) {
     return new Promise((resolve, reject) => {
         const socket = entry?.socket;
         if (!socket || socket.readyState !== WebSocket.OPEN) {
@@ -409,18 +414,38 @@ export function _sendFrame(entry, frame, sendSpan = null) {
                 + (performance.now() - serializeStart);
         }
         _dumpFrame(payload);
+        let settled = false;
+        let timer = null;
+        const finish = (err = null) => {
+            if (settled) return;
+            settled = true;
+            if (timer) clearTimeout(timer);
+            if (!err) {
+                resolve();
+                return;
+            }
+            const sendErr = err instanceof Error ? err : new Error(String(err));
+            sendErr.wsSendFailed = true;
+            // A callback error/timeout leaves the transport state unknown.
+            // Drop it immediately; releaseWebSocket will also remove the entry
+            // from its pool, and the retry path force-acquires a fresh socket.
+            try { entry.closing = true; } catch {}
+            try { socket.terminate?.(); } catch {}
+            reject(sendErr);
+        };
+        const boundedTimeoutMs = Number.isFinite(timeoutMs) && timeoutMs > 0
+            ? timeoutMs
+            : WS_SEND_TIMEOUT_MS;
+        timer = setTimeout(() => {
+            finish(Object.assign(
+                new Error(`WS send callback timed out after ${boundedTimeoutMs}ms`),
+                { code: 'EWSSENDTIMEOUT', wsSendTimeoutMs: boundedTimeoutMs },
+            ));
+        }, boundedTimeoutMs);
         try {
-            // Do NOT await the send callback: on a wedged-but-OPEN socket the
-            // ws write callback may never fire, which would hang this Promise
-            // before _streamResponse arms its first-byte watchdog. Fire and
-            // resolve immediately; transport failures surface via the socket
-            // 'error'/'close' handlers and the first-byte watchdog.
-            socket.send(payload, () => {});
-            resolve();
+            socket.send(payload, (err) => finish(err || null));
         } catch (e) {
-            const err = e instanceof Error ? e : new Error(String(e));
-            err.wsSendFailed = true;
-            reject(err);
+            finish(e);
         }
     });
 }

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -292,10 +292,10 @@ export function classifyMidstreamError(err, signals, policy = {}) {
 // userAbort / watchdogAbort / responseFailedPayload exactly as before.
 function _classifyMidstreamWs(err, state, attemptIndex, policy) {
   if (state.sawCompleted) return null
-  if (state.emittedToolCall) {
-    const _cc = Number(err?.wsCloseCode || state.wsCloseCode || 0)
-    if (!(_cc === 1000 && state.sawResponseCreated && !state.sawCompleted)) return null
-  }
+  // Once a tool call has been dispatched, no transport outcome is replay-safe.
+  // This includes a nominal close-1000 before response.completed: the tool may
+  // already be executing, so retry/fallback could duplicate its side effect.
+  if (state.emittedToolCall) return null
   if (state.emittedText || err?.liveTextEmitted) return null
   if (state.firstByteTimeout || err?.firstByteTimeout) {
     return _allowMidstream('first_byte_timeout', attemptIndex, policy)

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -11,11 +11,12 @@ import { tryReadCached, tryScopedToolCached } from './read-dedup.mjs';
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
 import { crossTurnSignature } from './loop/completion-guards.mjs';
-import { getToolKind, isEagerDispatchable } from './loop/tool-helpers.mjs';
+import { getToolKind, isEagerDispatchable, isToolCallDedupEligible } from './loop/tool-helpers.mjs';
 
 export function createEagerDispatcher({
     tools, cwd, sessionId, sessionRef, signal, opts,
     crossTurnCalls, getIterations, getNextIteration, repeatFailLimit,
+    executeToolFn = executeTool,
 }) {
         const pending = new Map();
         // Streaming-time intra-turn dedup. When the LLM emits two
@@ -24,7 +25,9 @@ export function createEagerDispatcher({
         // the iter for-body runs, so the batch-level pre-pass would be
         // too late to prevent the eager dispatch of the second one.
         // Track signatures of in-flight eager calls and skip starting a
-        // second one for the same sig. The duplicate's executeTool is
+        // second one for the same sig. Loader calls are the narrow exception:
+        // each invocation must run and report loaded vs already-active state.
+        // Every other duplicate's executeTool is
         // never invoked; the for-body's pre-pass marks it as a duplicate
         // and emits a stub tool_result. The sig is NOT cleared when the
         // eager promise settles (see finally below): a streaming onToolCall
@@ -43,7 +46,8 @@ export function createEagerDispatcher({
             // body handles it via the invalid-args feedback path.
             if (isInvalidToolArgsMarker(call.arguments)) return null;
             const _sig = _intraTurnSig(call.name, call.arguments);
-            if (_eagerInFlightSigs.has(_sig)) return null;
+            const _dedupEligible = isToolCallDedupEligible(call.name, tools);
+            if (_dedupEligible && _eagerInFlightSigs.has(_sig)) return null;
             // Repeat-failure guard also gates eager dispatch (reviewer-flagged):
             // streaming onToolCall / startEagerRun would otherwise re-run an
             // identical read-only call that already failed repeatFailLimit
@@ -59,7 +63,7 @@ export function createEagerDispatcher({
             // re-executed — the serial for-body pushes the [cross-turn-dedup]
             // stub instead. Without this gate startEagerRun/onToolCall would
             // re-run the call before the serial dedup check ever sees it.
-            {
+            if (isToolCallDedupEligible(call.name, tools)) {
                 const _ctSig = crossTurnSignature(call.name, call.arguments);
                 const _prior = crossTurnCalls.get(_ctSig);
                 if (_prior && _prior.firstIteration < getIterations()) return null;
@@ -87,10 +91,10 @@ export function createEagerDispatcher({
             // this call there, never start it eagerly here.
             if (preDispatchDenyForSession(sessionRef, call, toolKind) !== null) return null;
             const entry = { startedAt: Date.now(), endedAt: null, mutationEpoch: epoch.mutation };
-            _eagerInFlightSigs.set(_sig, call.id);
+            if (_dedupEligible) _eagerInFlightSigs.set(_sig, call.id);
             entry.promise = (async () => {
                 try {
-                    return { ok: true, value: await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration() }) };
+                    return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration() }) };
                 } catch (error) {
                     return { ok: false, error };
                 }

package/src/runtime/agent/orchestrator/session/loop/deferred-call-through.mjs

@@ -15,7 +15,7 @@ function isActiveSessionTool(session, name) {
 function lookupDeferredCatalogTool(session, name) {
     // Union of the boot-frozen catalog and the late-connected MCP catalog so a
     // direct call to a tool whose server connected after boot resolves and
-    // auto-loads (selectDeferredTools promotes it onto session.tools).
+    // records it in the independent callable registry.
     const catalog = deferredCatalogUnion(session);
     const key = clean(name);
     if (!key) return null;
@@ -54,7 +54,8 @@ function denyDeferredCallThrough(message) {
 }
 
 /**
- * Inactive deferred catalog hits: readonly/mode gate + promoteToActive, or deny.
+ * Inactive deferred catalog hits: readonly/mode gate + callable registration,
+ * or deny. Native provider schema arrays are never mutated here.
  * Returns null when not applicable (not in catalog, already active, infra allowlist).
  */
 export function prepareDeferredToolCallThrough(sessionRef, name, _args) {
@@ -77,6 +78,6 @@ export function prepareDeferredToolCallThrough(sessionRef, name, _args) {
     }
 
     const selectMode = resolvedMode === null ? 'readonly' : resolvedMode;
-    selectDeferredTools(sessionRef, [toolLabel], selectMode, { promoteToActive: true });
+    selectDeferredTools(sessionRef, [toolLabel], selectMode);
     return null;
 }

package/src/runtime/agent/orchestrator/session/loop/recall-fasttrack.mjs

@@ -42,15 +42,17 @@ export function truncateToKb(text, maxKb) {
     const s = String(text || '');
     if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;
     const lines = s.split('\n');
+    const marker = '[digest truncated at ' + maxKb + 'KB]';
+    const contentBudget = maxBytes - Buffer.byteLength(marker, 'utf8');
     const out = [];
     let used = 0;
     for (const line of lines) {
         const cost = Buffer.byteLength(line, 'utf8') + 1;
-        if (used + cost > maxBytes) break;
+        if (used + cost > contentBudget) break;
         out.push(line);
         used += cost;
     }
-    return out.join('\n') + '\n[digest truncated at ' + maxKb + 'KB — pull the rest via recall]';
+    return out.length ? out.join('\n') + '\n' + marker : marker;
 }
 
 function buildRecallDigestText(sessionId, digestBody, maxKb) {
@@ -61,7 +63,6 @@ function buildRecallDigestText(sessionId, digestBody, maxKb) {
     // the model needs for a scoped recall.
     return [
         `[context compacted — session ${sessionId}]`,
-        `Full history is in memory — use the recall tool for details beyond this digest.`,
         `Recent digest (newest first):`,
         truncateToKb(digestBody, maxKb),
     ].join('\n');

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -29,12 +29,25 @@ export function isEagerDispatchable(name, tools) {
         for (const t of tools) {
             if (t?.annotations?.readOnlyHint === true && typeof t.name === 'string') {
                 set.add(t.name);
+                // `tool_search` is the legacy provider/runtime call name for the
+                // active `load_tool` schema; both must share eager semantics.
+                if (t.name === 'load_tool') set.add('tool_search');
+                else if (t.name === 'tool_search') set.add('load_tool');
             }
         }
         _eagerNameSetByTools.set(tools, set);
     }
     return set.has(name);
 }
+
+// Read-only is necessary but not sufficient for result deduplication. Loader
+// calls mutate the active session tool surface and must execute on every
+// explicit invocation so repeats can truthfully report `alreadyActive`.
+export function isToolCallDedupEligible(name, tools) {
+    return name !== 'load_tool'
+        && name !== 'tool_search'
+        && isEagerDispatchable(name, tools);
+}
 export function messagesArrayChanged(before, after) {
     if (!Array.isArray(before) || !Array.isArray(after)) return before !== after;
     if (before.length !== after.length) return true;
@@ -114,7 +127,8 @@ export function parseNativeToolSearchPayload(toolName, result) {
             && tool.name.trim()
             && (tool.type === undefined || typeof tool.type === 'string')
         ));
-        if (!toolReferences.length && !openaiTools.length) return null;
+        const provider = typeof native.provider === 'string' ? native.provider.trim().toLowerCase() : '';
+        if (!toolReferences.length && !openaiTools.length && !provider) return null;
         const baseSummary = typeof native.summary === 'string' && native.summary
             ? native.summary
             : `Loaded deferred tools: ${toolReferences.join(', ') || openaiTools.map((tool) => tool.name).filter(Boolean).join(', ')}`;
@@ -140,6 +154,7 @@ export function parseNativeToolSearchPayload(toolName, result) {
         if (blocked.length) extraLines.push(`blocked: ${blocked.join(', ')}`);
         const summary = extraLines.length ? `${baseSummary}\n${extraLines.join('; ')}` : baseSummary;
         return {
+            provider,
             toolReferences,
             openaiTools,
             summary,

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -397,9 +397,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     // don't get overridden by defaults. When session has no profile,
                     // providerCacheOpts is null and this spread is a no-op.
                     ...(session.providerCacheOpts || {}),
-                    onStageChange: (stage) => {
+                    onStageChange: (stage, detail) => {
                         updateSessionStage(sessionId, stage);
-                        try { askOpts?.onStageChange?.(stage); } catch {}
+                        try { askOpts?.onStageChange?.(stage, detail); } catch {}
                     },
                     onStreamDelta: (kind = 'semantic') => {
                         markSessionStreamDelta(sessionId, kind).catch(() => {});

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -213,7 +213,6 @@ async function runRecallFastTrackForSession(session, messages, opts = {}) {
         querySha,
         recallText: [
             `session_id=${sessionId}`,
-            `Full history is in memory — use the recall tool for details beyond this digest.`,
             // Same byte cap as the loop digest path (recallDigestMaxKb,
             // default = shared tool-output limit) — without it the memory
             // renderer bounds the browse at ~200 rows × 1000 chars, letting a

package/src/runtime/agent/orchestrator/session/tool-batch.mjs

@@ -29,7 +29,12 @@ import {
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
 import { crossTurnSignature, crossTurnDedupStub, isEditProgressTool } from './loop/completion-guards.mjs';
-import { getToolKind, isEagerDispatchable, parseNativeToolSearchPayload } from './loop/tool-helpers.mjs';
+import {
+    getToolKind,
+    isEagerDispatchable,
+    isToolCallDedupEligible,
+    parseNativeToolSearchPayload,
+} from './loop/tool-helpers.mjs';
 import { restoreToolCallBodyForId } from './loop/stored-tool-args.mjs';
 
 function classifyToolReturn(value) {
@@ -51,8 +56,8 @@ export async function processToolBatch(ctx) {
         // Intra-turn duplicate suppression: when an LLM emits two tool_use
         // blocks with identical (name, args) inside the SAME assistant turn,
                 // re-executing wastes tokens. Restricted to tools with
-                // `readOnlyHint:true` (= isEagerDispatchable) — bash/apply_patch
-                // may be intentional repeats with distinct side effects.
+                // `readOnlyHint:true` plus result-dedup eligibility — loader calls
+                // are read-only-dispatchable but must execute to report state.
         // Pre-pass identifies duplicates BEFORE startEagerRun so eager
         // dispatch also skips them, not just the for-body.
         const _duplicateCallIds = new Set();
@@ -61,7 +66,7 @@ export async function processToolBatch(ctx) {
             const _firstIdBySig = new Map();
             for (const c of calls) {
                 if (!c?.id) continue;
-                if (!isEagerDispatchable(c.name, tools)) {
+                if (!isToolCallDedupEligible(c.name, tools)) {
                     _firstIdBySig.clear();
                     continue;
                 }
@@ -115,12 +120,12 @@ export async function processToolBatch(ctx) {
                 continue;
             }
             // Cross-turn identical-call stub (Step 2): a SUCCESSFUL read-only
-            // (isEagerDispatchable) call whose (name,args) signature already ran
+            // dedup-eligible call whose (name,args) signature already ran
             // in an EARLIER turn is not re-executed — its result is unchanged and
             // already in context. Warn at the 2nd occurrence; append the "stuck"
             // escalation tail once the session has emitted 5+ dedup stubs total.
             // Never applies to write/bash/MCP/skill tools (not eager-dispatchable).
-            if (isEagerDispatchable(call.name, tools)) {
+            if (isToolCallDedupEligible(call.name, tools)) {
                 _ctSig = crossTurnSignature(call.name, call.arguments);
                 const _prior = crossTurnCalls.get(_ctSig);
                 if (_prior && _prior.firstIteration < iterations) {
@@ -582,7 +587,7 @@ export async function processToolBatch(ctx) {
                 // Read-only successful calls seed the cross-turn dedup map.
                 if (_executeOk) {
                     const _isEager = isEagerDispatchable(call.name, tools);
-                    if (_isEager) {
+                    if (isToolCallDedupEligible(call.name, tools)) {
                         if (_ctSig === null) _ctSig = crossTurnSignature(call.name, call.arguments);
                         if (!crossTurnCalls.has(_ctSig)) {
                             crossTurnCalls.set(_ctSig, { count: 1, firstIteration: iterations });
@@ -591,7 +596,7 @@ export async function processToolBatch(ctx) {
                                 crossTurnCalls.delete(_oldest);
                             }
                         }
-                    } else {
+                    } else if (!_isEager) {
                         // A successful mutating (non-eager) tool invalidates the
                         // cross-turn dedup map wholesale: any prior read/grep may
                         // now return different content, so a post-edit