mixdog 0.9.94 → 0.9.95

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -35,6 +35,12 @@ let _initChain = Promise.resolve();
 let _inFlightPromise = null;
 let _inFlightSig = null;
 let _lastAppliedSig = null;
+// Provider instances are process-global inside the backend daemon. Catalog
+// readers use this revision to share one raw model snapshot while still
+// rebuilding their cheap route/config projection after auth/config changes.
+let _providerCatalogRevision = 0;
+let _startupCatalogRefreshPromise = null;
+let _catalogRefreshPromise = null;
 
 // Deterministic structural signature of a provider config. Recursively sorts
 // object keys so signature equality reflects config-value equality regardless
@@ -141,7 +147,12 @@ export async function initProviders(config, { signal = null } = {}) {
         }
     };
     const tracked = next.then(
-        (v) => { _lastAppliedSig = sig; settle(); return v; },
+        (v) => {
+            if (_lastAppliedSig !== sig) _providerCatalogRevision += 1;
+            _lastAppliedSig = sig;
+            settle();
+            return v;
+        },
         (err) => { settle(); throw err; },
     );
     _inFlightSig = sig;
@@ -236,6 +247,7 @@ export function getProvider(name) {
         if (!Ctor) return undefined;
         const inst = wrapProviderAdmission(new Ctor({}), name);
         providers.set(name, inst);
+        _providerCatalogRevision += 1;
         return inst;
     }
     if (name === 'openai-oauth' && hasOpenAIOAuthCredentials()) {
@@ -243,6 +255,7 @@ export function getProvider(name) {
         if (!Ctor) return undefined;
         const inst = wrapProviderAdmission(new Ctor({}), name);
         providers.set(name, inst);
+        _providerCatalogRevision += 1;
         return inst;
     }
     if (name === 'grok-oauth' && hasGrokOAuthCredentials()) {
@@ -250,6 +263,7 @@ export function getProvider(name) {
         if (!Ctor) return undefined;
         const inst = wrapProviderAdmission(new Ctor({}), name);
         providers.set(name, inst);
+        _providerCatalogRevision += 1;
         return inst;
     }
     return undefined;
@@ -287,6 +301,9 @@ export function getAllProviders() {
     // stale entries across re-init (initProviders rebuilds the map in place).
     return new Map(providers);
 }
+export function providerCatalogRevision() {
+    return _providerCatalogRevision;
+}
 // Narrow synchronous test seam for the lazy-OAuth boundary. It models a
 // constructor whose module is already loaded while guaranteeing every touched
 // registry entry is restored, even when the assertion callback throws.
@@ -311,6 +328,20 @@ export function _withLoadedProviderCtorForTest(name, Ctor, fn) {
         else signatures.delete(name);
     }
 }
+// Companion seam for registry walks that iterate live INSTANCES (what
+// initProviders leaves behind) rather than constructors — the startup catalog
+// refresh is one. Restores the prior entry even when the callback throws.
+export function _withRegisteredProviderForTest(name, instance, fn) {
+    const hadProvider = providers.has(name);
+    const priorProvider = providers.get(name);
+    providers.set(name, instance);
+    try {
+        return fn();
+    } finally {
+        if (hadProvider) providers.set(name, priorProvider);
+        else providers.delete(name);
+    }
+}
 // Background catalog warm-up. Each provider's listModels() either hits its
 // own cached model list (no-op) or fires a single HTTP refresh. Called from
 // agent.init() after providers are registered so the first agent dispatch call
@@ -336,7 +367,9 @@ function warmupCatalogs() {
     }
 }
 
-// Force-refresh each provider's /models catalog on every MCP start. Unlike
+// Force-refresh each provider's /models catalog ONCE per backend-daemon
+// lifetime. Every session runtime joins this process-global promise and then
+// reads the same provider-instance caches. Unlike
 // warmupCatalogs (which calls listModels() and so respects the 24h provider
 // TTL → no-op when the cache is fresh), this bypasses the TTL via
 // _refreshModelCache so a model released since the last refresh is picked up
@@ -345,6 +378,7 @@ function warmupCatalogs() {
 // context metadata stays on its own 24h TTL. Fire-and-forget: never awaited,
 // per-provider failures logged to stderr like warmupCatalogs.
 export function refreshProviderCatalogsOnStartup() {
+    if (_startupCatalogRefreshPromise) return _startupCatalogRefreshPromise;
     const pending = [];
     for (const [name, provider] of providers) {
         const refreshFn = typeof provider?._refreshModelCache === 'function'
@@ -361,7 +395,11 @@ export function refreshProviderCatalogsOnStartup() {
     // Returns a completion promise so callers can invalidate stale model
     // caches once the fresh catalogs land. Still fire-and-forget: unawaited
     // callers keep the previous nonblocking startup behavior.
-    return Promise.allSettled(pending);
+    _startupCatalogRefreshPromise = Promise.allSettled(pending).then((results) => {
+        _providerCatalogRevision += 1;
+        return results;
+    });
+    return _startupCatalogRefreshPromise;
 }
 
 // Force-refresh provider catalogs after an operator changes model/provider
@@ -369,6 +407,7 @@ export function refreshProviderCatalogsOnStartup() {
 // the shared LiteLLM metadata cache first so context/pricing metadata follows
 // newly released models without waiting for the next process restart.
 export function refreshCatalogs() {
+    if (_catalogRefreshPromise) return _catalogRefreshPromise;
     const pending = [];
     const metadataReady = Promise.resolve()
         .then(() => refreshMetadataCatalog())
@@ -391,5 +430,13 @@ export function refreshCatalogs() {
             }));
     }
     // Completion promise: lets callers drop stale model caches after refresh.
-    return Promise.allSettled([metadataReady, ...pending]);
+    _catalogRefreshPromise = Promise.allSettled([metadataReady, ...pending])
+        .then((results) => {
+            _providerCatalogRevision += 1;
+            return results;
+        })
+        .finally(() => {
+            _catalogRefreshPromise = null;
+        });
+    return _catalogRefreshPromise;
 }

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -252,7 +252,7 @@ function isRetryable(err) {
   return classifyError(err) === 'transient'
 }
 
-/** Claude Code compatible Anthropic request budget: 10 retries (11 attempts).
+/** Anthropic request budget: 10 retries (11 attempts).
  * CLAUDE_CODE_MAX_RETRIES is intentionally read per request for reload/tests.
  * The upper bound prevents an accidental unbounded retry loop. */
 export function anthropicMaxAttempts() {
@@ -262,16 +262,16 @@ export function anthropicMaxAttempts() {
   return retries + 1
 }
 
-// Claude Code request defaults (withRetry.ts): 500ms exponential backoff,
+// Anthropic retry defaults: 500ms exponential backoff,
 // capped at 32s, with positive-only jitter up to 25% of the base delay.
-// The leading duplicate accounts for withRetry's sleep-before-attempt index:
+// The leading duplicate accounts for the sleep-before-attempt index:
 // retry attempt 2 reads index 1.
 export const ANTHROPIC_RETRY_BACKOFF_MS = Object.freeze([
   500, 500, 1000, 2000, 4000, 8000, 16000, 32000, 32000, 32000, 32000,
 ])
 export const ANTHROPIC_RETRY_JITTER_RATIO = 0.25
 
-// Claude Code's Anthropic SDK client defaults API_TIMEOUT_MS to ten minutes.
+// The Anthropic SDK client defaults API_TIMEOUT_MS to ten minutes.
 // Read per request, like CLAUDE_CODE_MAX_RETRIES, so env reload/tests work.
 export function anthropicRequestTimeoutMs() {
   const parsed = Number.parseInt(process.env.API_TIMEOUT_MS || '', 10)
@@ -318,10 +318,10 @@ export function jitterDelayMs(ms, ratio = PROVIDER_RETRY_JITTER_RATIO, mode = 's
 // Mid-stream 'stream_stalled' recoveries retry in place, which is right for a
 // one-off blip but lets a chronically dying stream burn a whole task budget
 // slowly (observed live: one send stretched 149s→298s→556s across stall
-// retries before the agent deadline killed the task). Reference stacks bound
-// this instead of retrying forever: Claude Code caps each request at ~300s
-// wall clock (API_TIMEOUT_MS) and Codex kills a stream after one 300s silent
-// gap (stream_idle_timeout). This guard is the equivalent for our in-place
+// retries before the agent deadline killed the task). A stalling stream is
+// bounded instead of retried forever: a request is capped at ~300s wall
+// clock (API_TIMEOUT_MS) and a stream dies after one 300s silent gap
+// (stream idle timeout). This guard is the equivalent for our in-place
 // recovery: the clock starts at the FIRST stall of a send, and stall-classified
 // retries are allowed only inside that window; past it the stall error
 // surfaces so loop-level transport retry issues a FRESH request. Healthy
@@ -357,7 +357,7 @@ export function createStallRetryBudget(budgetMs = STREAM_STALL_RETRY_BUDGET_MS,
 // branched on a hardcoded provider name.
 
 // F) Retry-budget profiles as DATA. The numbers live ONLY here now.
-//    ws.*Retries (5)              — one Codex Responses stream retry budget.
+//    ws.*Retries (5)              — one Responses stream retry budget.
 //    sse.defaultRetries (3)       — anthropic single-shot SSE mid-stream budget.
 export const MIDSTREAM_RETRY_POLICY = {
   ws: { transientCloseRetries: 5, defaultRetries: 5, backoff: [250, 1000, 2000, 4000, 5000] },
@@ -490,7 +490,7 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
 }
 
 // Explicit `response.failed` error codes/types that describe a transport-level
-// interruption (Codex retries these); every other code is terminal.
+// interruption (these are retryable); every other code is terminal.
 const RESPONSE_FAILED_CODE_CLASSIFIERS = new Map([
   ['stream_disconnected', 'response_failed_disconnected'],
   ['network_error', 'response_failed_network'],
@@ -550,7 +550,7 @@ export function shouldFallbackTransport(err, { signal, enabled = true } = {}) {
   if (signal?.aborted) return false
   // Transport fallback re-issues the request on another transport: it is a
   // replay, so the exposure deny applies. Eligibility itself stays typed
-  // (status / errno / classifier), matching Codex's WS→HTTPS switch.
+  // (status / errno / classifier) for the WS→HTTPS switch.
   if (readStreamOutcome(err).replaySafe !== true) return false
   const status = Number(err?.httpStatus || err?.status || 0)
   // 401 is auth recovery, never transport fallback. 426 is the explicit
@@ -660,7 +660,7 @@ function _sleepChunkWithAbort(ms, signal, sleepFn, abortMessage) {
 // E) Handshake classifier (moved here from openai-oauth-ws). Default-deny:
 //    anything not recognized as transient returns null. HTTP 401 is reserved
 //    for auth recovery and 426 for immediate HTTPS fallback. The OpenAI OAuth
-//    caller opts out of 429 retries (Codex retry_429:false); all other callers
+//    caller opts out of 429 retries (retry429:false); all other callers
 //    retain the historical retryable UnexpectedStatus policy.
 export function classifyHandshakeError(err, { retry429 = true } = {}) {
   if (!err) return null
@@ -764,8 +764,8 @@ export async function withRetry(fn, opts = {}) {
       // an eligible failure is actually retried remains the typed question
       // resolved by classifyError()/status below.
       if (readStreamOutcome(caught).replaySafe !== true) throw caught
-      // Claude Code treats x-should-retry:false as an explicit server veto
-      // (except an internal-only 5xx override that Mixdog does not have).
+      // x-should-retry:false is an explicit server veto on retrying and is
+      // honored as-is.
       // Keep this ahead of status defaults, including the request-local 429 path.
       const shouldRetryHeader = _headerValue(
         caught?.headers || caught?.response?.headers || caught?.data?.responseHeaders,
@@ -786,7 +786,7 @@ export async function withRetry(fn, opts = {}) {
         }
         continue
       }
-      // Claude Code's optional model fallback fires on the third 529. This
+      // The optional model fallback fires on the third 529. This
       // remains opt-in: providers pass fallbackModel only when the caller set
       // one. The hard progress veto above must run first so fallback can never
       // replay partial thinking/tool output.

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -91,7 +91,6 @@ import {
     isOutputLimitStopReason,
     providerContinuationSignal,
 } from './loop/termination.mjs';
-import { createSteeringLadder } from './loop/steering-ladder.mjs';
 import { runPreSendCompactPass } from './pre-send-compact.mjs';
 import { createEagerDispatcher } from './eager-dispatch.mjs';
 import { sendWithRecovery } from './send-with-recovery.mjs';
@@ -238,7 +237,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     if (compactSettledToolCallBodies(messages) && !opts.cacheBreakIntent) {
         opts.cacheBreakIntent = 'deferred_body_compaction';
     }
-    // ---- Codex turn stop hook (refs/codex core/src/session/turn.rs:372-404) --
+    // ---- Turn stop hook ----------------------------------------------------
     // A no-tool assistant message is TERMINAL. Only a structured provider
     // follow-up signal (end_turn=false / pause_turn), pending input, tool
     // calls/results, or a stop hook that blocks with a continuation prompt keep
@@ -280,8 +279,8 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             }
             // Tag steering-origin user messages so provider lowering keeps them
             // distinct from preceding tool results. Keep each queued command as
-            // its own user turn, matching Claude Code queued_command attachment
-            // semantics instead of collapsing priority/mode buckets together.
+            // its own user turn instead of collapsing priority/mode buckets
+            // together.
             messages.push({
                 role: 'user',
                 content: merged.content,
@@ -366,9 +365,10 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     };
     const maxLoopIterations = resolveSessionMaxLoopIterations(sessionRef);
     // ---- Completion-first loop guards (worker runaway prevention) ----
-    // Step 1 (escalation ladder) + the missed-parallelism / serial-rewording
-    // steering hints live in the createSteeringLadder controller below; it owns
-    // their cumulative counters and emits at most one hint per turn.
+    // Behavior-steering hints (missed-parallelism, all-read-only, read-only
+    // shell, level-2 "stop exploring") were removed: they nudged tool shape
+    // instead of protecting resources. Only the staged iteration warnings, the
+    // hard cap, and the cross-turn dedup stub remain.
     // _editCount counts any executed tool call whose def lacks readOnlyHint
     // (i.e. edit/progress: apply_patch, bash, MCP writes, skills, ...).
     let _editCount = 0;
@@ -406,7 +406,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     // Loop-level transport replays consumed this ask (see send-with-recovery
     // TRANSPORT_RETRY_MAX): bounded per turn, reset only with a fresh ask.
     let _transportRetriesUsed = 0;
-    // Claude Code parity: queued prompt/task notifications are attached after a
+    // Queued prompt/task notifications are attached after a
     // tool batch, before the continuation provider send. Normal batches drain
     // up to 'next'; a Sleep-like tool grants a 'later' flush.
     let _toolBatchJustCompleted = false;
@@ -415,20 +415,6 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         const name = String(call?.name || call?.toolName || call?.function?.name || '').toLowerCase();
         return name === 'sleep' || name.endsWith('/sleep') || name.endsWith('.sleep');
     };
-    // Completion-first steering ladder controller. Owns the (cumulative) level-1
-    // fire count, the all-read-only / serial-single / same-file-grep streaks,
-    // and the level-2 latch. Threaded via live getters so it reads the loop's
-    // current `iterations` / `_editCount` on every call (no stale snapshots).
-    const _steeringLadder = createSteeringLadder({
-        sessionId,
-        sessionAgent,
-        tools,
-        getIterations: () => iterations,
-        getEditCount: () => _editCount,
-        readOnlyRole: String(sessionRef?.permission || sessionRef?.toolPermission || '') === 'read',
-        pushUserMessage: (msg) => messages.push(msg),
-        pushSystemReminder: (text) => messages.push({ role: 'user', content: `<system-reminder>\n${text}\n</system-reminder>`, meta: 'hook' }),
-    });
     // Tool execution must use the session cwd even when the caller omitted the
     // legacy positional cwd argument. Agent workers always carry their cwd on
     // sessionRef; falling through to pwd()/process.cwd() resolves relatives
@@ -503,8 +489,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             } catch { /* best-effort */ }
         }
         // Drain queued steering/prompts BEFORE the pre-send compact check, but
-        // only immediately after a tool batch has completed. This mirrors
-        // Claude Code's query.ts queued_command attachment drain: queued entries
+        // only immediately after a tool batch has completed: queued entries
         // are attached after tool results are appended and before the recursive
         // continuation, not on arbitrary non-tool continuations (empty nudges,
         // iteration-cap final text turns, etc.).
@@ -792,11 +777,6 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         // tool-call-blocked vs contract-required oscillation.
         if (!response.toolCalls?.length) {
             // No tool calls. Decide between final-answer accept vs nudge.
-            // Reviewer fix: a zero-tool turn (final-pre-send steering drain or
-            // contract nudge `continue`) must not bridge the all-read-only
-            // streak across non-tool turns — that would fire level-2 early on
-            // a worker that paused to synthesize text mid-run.
-            _steeringLadder.resetAllReadOnlyStreak();
             //   - has content + non-hidden role → valid final, break.
             //   - empty content + hidden role → contract allows text-only
             //     terminal turn, break.
@@ -915,7 +895,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 messages.push({ role: 'user', content: nudgeMsg });
                 continue;
             }
-            // Codex `has_pending_input` (turn.rs:304-318): queued user input is
+            // Pending-input rule: queued user input is
             // folded into needs_follow_up and evaluated BEFORE the stop hooks,
             // so real steering always wins over a synthetic continuation prompt.
             // Commit the terminal text first (beforeAppend), then resume.
@@ -926,7 +906,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 _emptyNudgeStreak = 0;
                 continue;
             }
-            // Codex parity (turn.rs:372-404): this no-tool message ends the turn
+            // This no-tool message ends the turn
             // unless a stop hook blocks it. The unresolved-tool-failure hook may
             // block exactly once — commit the assistant text, record the
             // structural continuation prompt, resume sampling. Skipped on the
@@ -1064,7 +1044,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             pending: eager.pending, epoch: eager.epoch, startEagerRun: eager.startEagerRun,
             crossTurnCalls: _crossTurnCalls, crossTurnCap: _CROSS_TURN_CAP,
             dedupStubTotal: _dedupStubTotal, editCount: _editCount,
-            sessionAgent, steeringLadder: _steeringLadder,
+            sessionAgent,
             pushToolResultMessage, throwIfAborted,
             repeatFailLimit: REPEAT_FAIL_LIMIT,
         }));

package/src/runtime/agent/orchestrator/session/cache/read-cache.mjs

@@ -3,6 +3,8 @@
 import { _normalizeAbs, _statTuple, _statEqual } from './util.mjs';
 import { clearScopedToolsForSession, clearScopedCounters } from './scoped-cache.mjs';
 import { clearPostEditMarks } from './post-edit-marks.mjs';
+import { registerSessionPurgeHook } from '../store.mjs';
+import { releaseReadSnapshotScope } from '../../tools/builtin/snapshot-store.mjs';
 
 const MAX_PER_SESSION = 100;
 
@@ -260,6 +262,11 @@ export function clearReadDedupSession(sessionId) {
     clearScopedCounters(sessionId);
 }
 
+registerSessionPurgeHook((sessionId) => {
+    clearReadDedupSession(sessionId);
+    releaseReadSnapshotScope(sessionId, { deletePersisted: true, persist: false });
+});
+
 /**
  * Extract the set of touched filesystem paths from a unified-diff patch text.
  * Handles git-style `--- a/<path>` / `+++ b/<path>` headers and `/dev/null` markers.

package/src/runtime/agent/orchestrator/session/context-compaction-policy.mjs

@@ -2,7 +2,9 @@ import { isAgentOwner } from '../agent-owner.mjs';
 
 export const DEFAULT_COMPACTION_BUFFER_TOKENS = 0;
 export const DEFAULT_COMPACTION_BUFFER_RATIO = 0.1;
-export const DEFAULT_MAIN_COMPACTION_BUFFER_RATIO = 0.05;
+// Main/user sessions default to full-window trigger (buffer 0): RFT compact
+// runs at the boundary. Agent sessions keep DEFAULT_COMPACTION_BUFFER_RATIO.
+export const DEFAULT_MAIN_COMPACTION_BUFFER_RATIO = 0;
 export const MAX_COMPACTION_BUFFER_RATIO = 0.25;
 const MAX_BUFFER_INPUT_RATIO = 0.999_999;
 export const DEFAULT_COMPACTION_KEEP_TOKENS = 8_000;
@@ -16,9 +18,14 @@ function envTokenInt(name) {
     return positiveTokenInt(process.env[name]);
 }
 export function normalizeCompactionBufferRatio(value, fallback = DEFAULT_COMPACTION_BUFFER_RATIO) {
+    // Explicit 0 is a valid buffer (main full-window trigger). Only nullish /
+    // empty / non-finite / negative values fall back. Do not treat Number(null)
+    // as zero here — null must mean "unset".
+    if (value == null || value === '') return fallback;
     const n = Number(value);
-    if (Number.isFinite(n) && n > 0) return n > 1 ? n / 100 : n;
-    return fallback;
+    if (!Number.isFinite(n) || n < 0) return fallback;
+    if (n === 0) return 0;
+    return n > 1 ? n / 100 : n;
 }
 export function resolveBufferRatioCandidate(percentInputs = [], ratioInputs = []) {
     for (const raw of percentInputs) {

package/src/runtime/agent/orchestrator/session/context-utils.mjs

@@ -160,11 +160,10 @@ export function providerTokenCalibration(provider) {
     if (p.startsWith('gemini') || p.startsWith('google')) return calibrationEnv('MIXDOG_TOKEN_CALIBRATION_GEMINI') ?? 1.15;
     return calibrationEnv('MIXDOG_TOKEN_CALIBRATION_DEFAULT') ?? 1.0;
 }
-// Claude Code parity (services/tokenEstimation.ts): images/documents count a
-// flat 2000 tokens when dimensions are unknown — the conservative constant CC
-// shares with microCompact's IMAGE_MAX_TOKEN_SIZE. Known dimensions may only
-// RAISE the allowance via Anthropic's real vision formula (w*h/750), capped at
-// the 2000x2000 resize ceiling (5333 tokens).
+// Images/documents count a flat 2000 tokens when dimensions are unknown —
+// the conservative constant also used by the micro-compaction path. Known
+// dimensions may only RAISE the allowance via Anthropic's real vision
+// formula (w*h/750), capped at the 2000x2000 resize ceiling (5333 tokens).
 export const IMAGE_VISUAL_TOKEN_ALLOWANCE = 2_000;
 const IMAGE_MAX_TOKEN_ALLOWANCE = 5_333;
 
@@ -249,8 +248,8 @@ function legacyEstimateTokens(s) {
     // for those runs without penalizing ordinary spaced prose.
     let denseAsciiFloor = 0;
     for (const match of s.matchAll(/[\x21-\x7e]{16,}/g)) {
-        // Claude Code prices dense JSON/JSONL at chars/2 (bytesPerTokenForFileType);
-        // 0.5/char keeps that parity for long unmerged printable runs.
+        // Dense JSON/JSONL prices at chars/2; 0.5/char keeps that ratio for
+        // long unmerged printable runs.
         denseAsciiFloor += match[0].length * 0.5;
     }
     const encodedWords = s.match(/\b(?=[A-Za-z0-9]{8,}\b)(?=[A-Za-z0-9]*[A-Za-z])(?=[A-Za-z0-9]*\d)[A-Za-z0-9]+\b/g) || [];
@@ -272,7 +271,7 @@ function legacyEstimateTokens(s) {
         && (jsonLikeLines >= Math.ceil(lines.length / 2) || structural / nonWhitespace >= 0.12)) {
         // JSONL, compact tables and generated line protocols can consist
         // entirely of short runs while still tokenizing like minified data.
-        // chars/2 on the dense payload chars (Claude Code JSON parity).
+        // chars/2 on the dense payload chars (dense-JSON pricing).
         denseAsciiFloor = Math.max(denseAsciiFloor, (nonWhitespace * 0.5) + ((s.length - nonWhitespace) * 0.25));
     }
     const asciiFloor = s.length / 4; // never below the legacy chars/4 lower bound
@@ -355,8 +354,8 @@ function messageEstimateText(m) {
 function imageDescriptorAllowance(descriptor) {
     if (descriptor.width && descriptor.height) {
         // Anthropic vision cost: tokens = (width * height) / 750, with images
-        // resized down to at most 2000x2000 (5333 tokens) — Claude Code uses
-        // the same formula/cap. Caller-supplied dimensions may RAISE the
+        // resized down to at most 2000x2000 (5333 tokens). Caller-supplied
+        // dimensions may RAISE the
         // allowance above the unknown-image floor but never lower it (the
         // provider normalizer may not preserve caller metadata).
         const formula = Math.ceil((descriptor.width * descriptor.height) / 750);
@@ -365,7 +364,7 @@ function imageDescriptorAllowance(descriptor) {
             Math.max(IMAGE_VISUAL_TOKEN_ALLOWANCE, formula),
         );
     }
-    // Unknown-size images: flat conservative allowance (Claude Code parity).
+    // Unknown-size images: flat conservative allowance.
     return IMAGE_VISUAL_TOKEN_ALLOWANCE;
 }
 function messageImageDescriptors(m) {

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -100,6 +100,7 @@ export function createEagerDispatcher({
             if (_dedupEligible) _eagerInFlightSigs.set(_sig, call.id);
             entry.promise = (async () => {
                 try {
+                    await opts.beforeToolExecution?.();
                     return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration(), deferShellCwdCommit: true }) };
                 } catch (error) {
                     return { ok: false, error };

package/src/runtime/agent/orchestrator/session/loop/compact-policy.mjs

@@ -112,8 +112,8 @@ export function resolveWorkerCompactPolicy(sessionRef, tools) {
     if (!boundaryTokens) return null;
     const compactBoundaryTokens = Math.max(1, Math.floor(boundaryTokens * COMPACT_SAFETY_PERCENT));
     // Shared session-compaction policy (context-utils): agent semantic keeps the
-    // default early-trigger buffer (90%); main/user use their independently
-    // configurable 25% default headroom (75%);
+    // default early-trigger buffer (90%); main/user default to full-window
+    // trigger (buffer 0 / 100%), still overridable via mainBuffer*;
     // a truly-explicit sub-boundary limit wins. explicitAutoCompactTokenLimit
     // is the sanitized (null when legacy full-window) value so telemetry never
     // re-persists a boundary-collapsing limit.
@@ -216,7 +216,7 @@ function providerPressureTokens(sessionRef, usage) {
 /**
  * Align an authoritative provider usage snapshot to the message prefix it
  * covers. Later pressure checks add estimates only for messages after this
- * baseline, matching Claude Code's actual-usage-plus-growth accounting.
+ * baseline: actual-usage-plus-growth accounting.
  */
 export function recordProviderContextBaseline(sessionRef, messages, usage, {
     boundary = 'complete',

package/src/runtime/agent/orchestrator/session/loop/completion-guards.mjs

@@ -38,20 +38,6 @@ export function isEditProgressTool(name, isEager) {
     return !NON_PROGRESS_TOOLS.has(bare);
 }
 
-// Step 1 — level-2 escalation steering. N = cumulative level-1 fires.
-// `readOnlyRole` swaps the edit-oriented directive for a report-oriented one:
-// read-permission sessions (reviewer-style) cannot apply_patch, so telling
-// them to edit is self-contradictory and pushes premature termination.
-const LEVEL2_DIMINISHING_RETURNS = ' Further reads add cost, not evidence.';
-
-export function level2SteerMessage(n, readOnlyRole = false, level2Fires = 1) {
-    const tail = Number(level2Fires) >= 2 ? LEVEL2_DIMINISHING_RETURNS : '';
-    if (readOnlyRole) {
-        return `<system-reminder>\nEnough evidence gathered — report findings now; name any gaps.${tail}\n</system-reminder>`;
-    }
-    return `<system-reminder>\nStop exploring — apply the edit you know, or report blocked with what's missing.${tail}\n</system-reminder>`;
-}
-
 // Step 2 — cross-turn dedup stub. `stuck` appends the escalation tail at the
 // 5th+ dedup stub in the session.
 export function crossTurnDedupStub(name, firstIteration, stuck) {

package/src/runtime/agent/orchestrator/session/loop/stop-hooks.mjs

@@ -1,11 +1,12 @@
-// Codex-style turn stop hook (refs/codex core/src/session/turn.rs:372-404).
+// Turn stop hook.
 //
-// Codex semantics: a sampling request that needs no follow-up ends the turn.
-// Before breaking, the turn runs its stop hooks; a hook may block ONCE by
-// returning continuation fragments, which are recorded as a prompt message
-// before sampling resumes (`stop_hook_active = true`, never cleared inside the
-// turn). Nothing else can force another turn: no mandatory terminal tool, no
-// completion strikes, no lexical inspection of the assistant text.
+// Termination semantics: a sampling request that needs no follow-up ends the
+// turn. Before breaking, the turn runs its stop hooks; a hook may block ONCE
+// by returning continuation fragments, which are recorded as a prompt message
+// before sampling resumes (the hook stays armed for the rest of the turn and
+// is never cleared inside it). Nothing else can force another turn: no
+// mandatory terminal tool, no completion strikes, no lexical inspection of
+// the assistant text.
 //
 // The single hook implemented here preserves the original failed-apply_patch
 // protection: while a real tool failure is unresolved, the first terminal
@@ -41,7 +42,7 @@ export function toolFailureContinuationPrompt(failedTool) {
  *    success clears it.
  *  - takeContinuationPrompt(): returns the continuation prompt the FIRST time
  *    a terminal assistant message arrives while a failure is unresolved, then
- *    stays silent for the rest of the turn (Codex `stop_hook_active`).
+ *    stays silent for the rest of the turn.
  */
 export function createToolFailureStopHook() {
     let unresolvedFailure = false;

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -672,11 +672,14 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     },
                     onToolResult: _trackToolResult,
                     onToolApproval: typeof askOpts?.onToolApproval === 'function' ? askOpts.onToolApproval : undefined,
+                    beforeToolExecution: typeof askOpts?.beforeToolExecution === 'function'
+                        ? askOpts.beforeToolExecution
+                        : undefined,
                     onCompactEvent: (event) => {
                         _scheduleTurnCheckpoint(true);
                         try { askOpts?.onCompactEvent?.(event); } catch {}
                     },
-                    // Claude Code parity: mid-chain queued prompt/notification
+                    // Mid-chain queued prompt/notification
                     // drain is owned by agentLoop at provider-continuation
                     // boundaries (after a tool batch, before the next send).
                     // The post-loop _pendingTail drain below still handles
@@ -692,9 +695,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                         // Manager/pending-messages entries carry no
                         // mode/priority/slash metadata, so they stay OUT of the
                         // mid-chain (post-tool-batch) drain — that would bypass
-                        // Claude Code's queued_command filters. At the TERMINAL
-                        // boundary they are exactly Codex `has_pending_input`
-                        // (turn.rs:304-318): an `agent type=send` queued while
+                        // the queued-command filters. At the TERMINAL boundary
+                        // they are exactly pending input: an `agent type=send`
+                        // queued while
                         // the terminal sample was in flight must be folded into
                         // THIS turn before any stop hook runs, instead of losing
                         // its slot to a synthetic continuation prompt. The mutex

package/src/runtime/agent/orchestrator/session/manager/context-meta.mjs

@@ -210,7 +210,7 @@ export function resolveSessionContextMeta(provider, model, seed = {}) {
 }
 export function compactTriggerForSession(session, boundaryTokens) {
     // Delegates to the shared session-compaction policy (context-utils):
-    // agent semantic -> 90% (default buffer), main/user -> 75% (default),
+    // agent semantic -> 90% (default buffer), main/user -> 100% (buffer 0),
     // truly-explicit sub-boundary limit wins.
     return resolveSessionCompactPolicy(session, boundaryTokens).triggerTokens;
 }

package/src/runtime/agent/orchestrator/session/manager/idle-cleanup.mjs

@@ -150,7 +150,7 @@ export function _runCleanupCycle() {
         // Drain every settled runtime entry on each pass, not just the one or two
         // sessions whose on-disk idle TTL happened to expire in this interval.
         _sweepTerminalSessionRuntimes();
-        sweepOrphanedPendingMessages();
+        await sweepOrphanedPendingMessages();
         await sweepIdleSessions({ includeTombstones: true });
         // Reclaim same-process session snapshots whose state is durable on disk
         // (memory-leak guard: _liveSessions used to grow for process lifetime).