mixdog 1.2.0 → 1.2.2

package/src/runtime/agent/orchestrator/session/explicit-skills.mjs

@@ -1,6 +1,10 @@
 import { randomUUID } from 'node:crypto';
 import { selectedSkillName } from '../../../shared/skill-selection.mjs';
+import { mentionedSkillNames, skillMentionCandidates } from '../../../shared/skill-mentions.mjs';
+import { isAttachmentReference } from '../../../attachments/store.mjs';
+import { collectPromptSkillsCached } from '../context/collect.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
+import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { parseNativeToolSearchPayload } from './loop/tool-helpers.mjs';
 import { normalizeToolEnvelope } from './tool-envelope.mjs';
 import { throwIfAborted } from '../../../shared/abort-race.mjs';
@@ -20,19 +24,91 @@ function nativeDefinitionsPresent(native, messages) {
   );
 }
 
+// At most this many skills are prepared for one user turn; further selections
+// stay prose.
+const MAX_EXPLICIT_SKILLS = 5;
+const LOADED_SKILL_RE = /^Loaded (?:built-in )?skill: /;
+
+// The user's own typed text: plain strings and text parts, never attachment
+// references (file contents the user attached, not words they typed).
+function userPromptText(prompt) {
+  if (typeof prompt === 'string') return prompt;
+  if (!Array.isArray(prompt)) return '';
+  return prompt
+    .map((part) => {
+      if (typeof part === 'string') return part;
+      if (part?.type === 'text' && typeof part.text === 'string' && !isAttachmentReference(part)) return part.text;
+      return '';
+    })
+    .join('\n');
+}
+
+/** The skills a prompt explicitly selects: the leading `Skill: "name"` header,
+ *  then every inline `$name`, each only when it names a skill enabled and in
+ *  scope for `cwd`, in first-mention order, deduplicated and capped. */
+export function explicitSkillNames(prompt, cwd) {
+  const header = selectedSkillName(prompt);
+  const text = userPromptText(prompt);
+  if (!header && !skillMentionCandidates(text).length) return [];
+  const available = new Set(collectPromptSkillsCached(cwd).map((skill) => skill.name));
+  const isSkill = (name) => available.has(name);
+  const names = header && isSkill(header) ? [header] : [];
+  for (const name of mentionedSkillNames(text, isSkill)) {
+    if (!names.includes(name)) names.push(name);
+  }
+  return names.slice(0, MAX_EXPLICIT_SKILLS);
+}
+
+/** Stamps the skills a user turn actually loaded on its transcript metadata,
+ *  where the live row, the persisted transcript and restore all read it.
+ *  The stamped message REPLACES `message` in `messages` (returned): the
+ *  session store ships reference-identical messages as an append-only delta,
+ *  so an in-place edit of a user message an earlier save already sent would
+ *  never reach disk. */
+export function recordAppliedSkills(messages, message, names) {
+  if (!message || !Array.isArray(names) || !names.length) return message;
+  const meta = message.meta && typeof message.meta === 'object' ? message.meta : {};
+  const transcript = meta.transcript && typeof meta.transcript === 'object' ? meta.transcript : {};
+  const stamped = { ...message, meta: { ...meta, transcript: { ...transcript, appliedSkills: [...names] } } };
+  const index = Array.isArray(messages) ? messages.indexOf(message) : -1;
+  if (index >= 0) messages[index] = stamped;
+  return stamped;
+}
+
+/** Tells the host which skills a user turn loaded; a host callback failure
+ *  never fails the turn. */
+export function notifySkillsApplied(onSkillsApplied, applied, message) {
+  if (!applied.length) return;
+  try {
+    onSkillsApplied?.(applied, { messageId: message?.meta?.transcript?.messageId || null });
+  } catch {
+    /* best-effort host callback */
+  }
+}
+
 // Called before the first model request for a real user turn. This performs the
 // same policy-checked Skill operation, without asking the model to request it.
 // Native schemas still travel as a properly paired loader execution, never as
-// new eager definitions or an orphan tool_search_output.
+// new eager definitions or an orphan tool_search_output. Returns the names of
+// the skills that loaded successfully, in selection order.
+// `selection`, when given (even empty), is the turn's TRUSTED selection input
+// and the only text skills are selected from: a host whose model-visible
+// prompt carries external data (webhook payloads) passes just the
+// operator-authored part, so nothing inside the data can load a skill.
 export async function prepareExplicitSkills(
   prompt,
   messages,
   session,
-  { cwd = session?.cwd, signal, execute = executeTool } = {}
+  { cwd = session?.cwd, signal, execute = executeTool, selection } = {}
 ) {
   throwIfAborted(signal);
-  const name = selectedSkillName(prompt);
-  if (name) {
+  const applied = [];
+  // A session that cannot call Skill (schema allowlist, denied tools, read-only
+  // surface — the dispatcher's own gate) has nothing to select: preparing would
+  // only push a refused-tool reminder into history on every matching turn.
+  if (preDispatchDenyForSession(session, { name: 'Skill' })) return applied;
+  const source = selection === undefined || selection === null ? prompt : selection;
+  for (const name of explicitSkillNames(source, cwd)) {
     const id = `skill-selection-${randomUUID()}`;
     const args = { name };
     const raw = await execute('Skill', args, cwd, session?.id, session, { signal, toolCallId: id });
@@ -55,6 +131,8 @@ export async function prepareExplicitSkills(
       });
     }
     messages.push(...envelope.newMessages);
+    if (LOADED_SKILL_RE.test(String(summary))) applied.push(name);
+    throwIfAborted(signal);
   }
-  throwIfAborted(signal);
+  return applied;
 }

package/src/runtime/agent/orchestrator/session/imported-message.mjs

@@ -0,0 +1,11 @@
+/**
+ * Provenance of messages carried over from another app's conversation
+ * (conversation-import). Their text is prose someone wrote elsewhere: it may
+ * look like a runtime reminder, a task envelope or a compaction summary, but
+ * restore and the model wire treat it as plain user/assistant text. Leaf, no IO.
+ */
+export const IMPORTED_MESSAGE_SOURCE = 'import';
+
+export function isImportedMessage(message) {
+  return message?.meta?.source === IMPORTED_MESSAGE_SOURCE;
+}

package/src/runtime/agent/orchestrator/session/loop/completion-guards.mjs

@@ -2,6 +2,7 @@
 // (signature + stub) and the edit-progress classification.
 // Pure string/signature helpers; the loop body only wires state + messages.
 // No provider/manager coupling.
+import { knownMcpToolIdentity } from '../../../../shared/tool-primitives.mjs';
 
 // Deterministic, key-sorted stringify for cross-turn call signatures (recursive,
 // unlike tool-classify's top-level-only _canonicalArgs).
@@ -43,7 +44,7 @@ const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', '
 // not in the meta/non-progress set. apply_patch and shell/bash always count.
 export function isEditProgressTool(name, isEager) {
   if (isEager) return false;
-  const bare = name?.startsWith('mcp__') ? name.split('__').pop() : name;
+  const bare = name?.startsWith('mcp__') ? knownMcpToolIdentity(name)?.tool || name.split('__').pop() : name;
   if (bare === 'apply_patch' || bare === 'shell' || bare === 'bash' || bare === 'bash_session') return true;
   return !NON_PROGRESS_TOOLS.has(bare);
 }

package/src/runtime/agent/orchestrator/session/loop/loop-state.mjs

@@ -146,7 +146,7 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     messages,
     opts,
     sessionId,
-    onSkillPrompt: (content) => state.pendingSkillPrompts.push(content),
+    onSkillPrompt: (content, message) => state.pendingSkillPrompts.push({ content, message }),
   });
   // Bounded recovery for provider turns that returned no client tool calls
   // (max-output ladder, refusal retry, provider continuation, empty-turn

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn.mjs

@@ -34,8 +34,9 @@ export function createNoToolTurnResolver({
     refusalRetryUsed: false,
     emptyNudgeStreak: 0,
     // Structured provider continuation signals honored this turn. Diagnostic
-    // only; the hard iteration cap remains the sole bound on how long a
-    // provider may keep declaring "not done" inside one user turn.
+    // only: the loop has no iteration cap, so this count bounds nothing. A
+    // text-only continuation runaway is bounded by continuationsSinceToolBatch
+    // below; continuations interleaved with tool batches are not limited.
     providerContinuationCount: 0,
     // Continuations since the last executed tool batch — bounds the text-only
     // continuation runaway (see PROVIDER_CONTINUATION_NO_TOOL_LIMIT).

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -5,9 +5,10 @@
  */
 import { traceCacheBreak } from '../../cache-break-trace.mjs';
 import { resolveLiveToolCwd } from './tool-exec.mjs';
-import { prepareExplicitSkills } from '../explicit-skills.mjs';
+import { notifySkillsApplied, prepareExplicitSkills, recordAppliedSkills } from '../explicit-skills.mjs';
 import { addUsage, usageDeltaEvent } from './usage.mjs';
 import { prepareProviderRequest } from './request-boundary.mjs';
+import { applyStepEffort } from './step-auto-effort.mjs';
 import { projectProviderRequest } from './request-projection.mjs';
 import { traceProviderSend, traceOutputTruncation } from './diagnostics.mjs';
 import { createEagerDispatcher } from '../eager-dispatch.mjs';
@@ -44,10 +45,13 @@ export async function beginIteration(state) {
   // policy-checked selection before the next provider snapshot instead of
   // starting detached work from a drain callback.
   while (state.pendingSkillPrompts.length) {
-    await prepareExplicitSkills(state.pendingSkillPrompts.shift(), messages, sessionRef, {
+    const { content, message: queued } = state.pendingSkillPrompts.shift();
+    const applied = await prepareExplicitSkills(content, messages, sessionRef, {
       cwd: state.cwd,
       signal: opts.signal,
     });
+    const message = recordAppliedSkills(messages, queued, applied);
+    notifySkillsApplied(opts.onSkillsApplied, applied, message);
   }
   const boundary = await prepareProviderRequest({
     provider,
@@ -129,6 +133,9 @@ export async function sendProviderRequest(state, round) {
   const sendStartedAt = Date.now();
   const preSendMs = sendStartedAt - round.iterT0;
   const toolResumeMs = state.lastToolBatchEndedAt ? sendStartedAt - state.lastToolBatchEndedAt : null;
+  // The step judgment ran beside opening the iteration; wait for it only up to
+  // its grace, then it rides on this request or on the next.
+  await applyStepEffort(state);
   // Every attempt is built from the live transcript, so a compaction between
   // attempts reaches the provider; a pending image strip only filters it.
   const messageSource = state.imageStrip
@@ -263,8 +270,7 @@ function traceActualCacheMiss(state, sent, response, { previousGuardState, previ
   const ttlMs = MESSAGES_CACHE_TTL_MS[sessionRef.providerCacheOpts?.cacheStrategy?.messages];
   const idleMs = sent.sendStartedAt - previousSendAt;
   const requestPrefixChanged =
-    !!previousGuardState &&
-    previousGuardState.requestPrefixHash !== sent.prefixGuardCandidate?.requestPrefixHash;
+    !!previousGuardState && previousGuardState.requestPrefixHash !== sent.prefixGuardCandidate?.requestPrefixHash;
   if (
     baseline > 0 &&
     ttlMs &&

package/src/runtime/agent/orchestrator/session/loop/steering.mjs

@@ -156,7 +156,7 @@ function injectSteeringEntry(merged, { messages, opts, stage, onSkillPrompt }) {
   const notification = merged.mode === 'task-notification';
   const execution =
     notification && merged.execution && typeof merged.execution === 'object' ? { ...merged.execution } : null;
-  messages.push({
+  const message = {
     role: 'user',
     content: merged.content,
     meta: {
@@ -165,8 +165,9 @@ function injectSteeringEntry(merged, { messages, opts, stage, onSkillPrompt }) {
       ...(submissionIds.length ? { submissionIds } : {}),
       transcript: steeringTranscriptMeta,
     },
-  });
-  if (!notification) onSkillPrompt(merged.content);
+  };
+  messages.push(message);
+  if (!notification) onSkillPrompt(merged.content, message);
   const text = merged.text || steeringContentText(merged.content);
   try {
     opts.onSteerMessage?.(text, {

package/src/runtime/agent/orchestrator/session/loop/step-auto-effort.mjs

@@ -8,12 +8,13 @@
  * later request rebuilds the same history and the prompt cache keeps hitting.
  * A judge that is missing, slow or failing leaves the step at the effort in
  * force (the turn's or the previous step's).
- * A custom route (snapshot mode 'custom') has no mid-conversation update: the
- * judged effort, snapped onto the model's levels, becomes the effort of the
- * turn's following requests.
+ * A custom route snaps the judged effort onto the model's levels. Without a
+ * mid-conversation update (snapshot mode 'custom') it becomes the effort of
+ * the turn's following requests; a custom GPT-6+ Responses route (mode
+ * 'responses') also marks it as the update.
  */
 import { resolveAutoEffort } from '../../providers/auto-effort.mjs';
-import { resolveCustomReasoning } from '../../providers/custom-reasoning.mjs';
+import { isCustomProviderName, resolveCustomReasoning } from '../../providers/custom-reasoning.mjs';
 import { autoEffortModel, stepEffortConfiguration } from '../../providers/effort-configuration.mjs';
 import { effortOptionsFor } from '../../runtime-core/effort.mjs';
 import { judgeTurn, recordEffortDecision } from '../../../../effort-judge/judge-client.mjs';
@@ -35,12 +36,58 @@ const argText = (args) =>
     .slice(0, 600)
     .join('');
 
+// A judgment runs beside the next iteration instead of in front of it. Its
+// record lives on the loop state (`state.stepEffort`), so it can only ever
+// reach the turn that started it; its promise settles the record and touches
+// nothing else, so an aborted loop is never mutated afterwards. The result
+// lands on the batch's last tool result in one of two places:
+//  - resolved before the next request is projected: on that tool result, so
+//    the request carries it (applyStepEffort);
+//  - resolved later: the request already went out with the earlier effort and
+//    its history is never rewritten (that would break the prompt cache), so
+//    the result marks the last tool result of the next batch, and the
+//    following request carries it (markStepEffort).
+function applyResult(state, target, result) {
+  if (result.level) state.opts.effort = result.level;
+  if (result.marked) target.meta = { ...target.meta, effortConfiguration: result.marked };
+}
+
+// How long a request waits for its step judgment (measured judge p90 ≈ 284 ms).
+export const STEP_EFFORT_GRACE_MS = 300;
+
+/**
+ * Before a provider request is projected: wait up to the grace for the pending
+ * judgment and apply it if it resolved. A slower one leaves this request at
+ * the effort in force and lands on the following request.
+ */
+export async function applyStepEffort(state) {
+  const pending = state.stepEffort;
+  if (!pending || pending.sent) return;
+  if (!pending.settled && !state.signal?.aborted) {
+    let timer;
+    await Promise.race([
+      pending.promise,
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, STEP_EFFORT_GRACE_MS);
+      }),
+    ]);
+    clearTimeout(timer);
+    // Another caller may have handled it while this one waited.
+    if (pending.sent) return;
+  }
+  pending.sent = true;
+  if (!pending.result || state.signal?.aborted || !state.messages.includes(pending.target)) return;
+  applyResult(state, pending.target, pending.result);
+  pending.applied = true;
+}
+
 /**
- * Judge the step after this batch and mark its last tool result.
+ * Start judging the step after this batch (not awaited). The result applies to
+ * the next request if it is ready by then, else to the one after.
  * `state.opts.stepAutoEffort` ({ request, base }) is set only when auto effort
  * is on for this turn and the installed judge was trained on steps.
  */
-export async function markStepEffort(state, assistantTurnMsg) {
+export function markStepEffort(state, assistantTurnMsg) {
   const auto = state.opts?.stepAutoEffort;
   const snapshot = state.opts?.effortConfiguration;
   if (!auto || !snapshot || state.signal?.aborted) return;
@@ -55,11 +102,27 @@ export async function markStepEffort(state, assistantTurnMsg) {
     }
   }
   if (!last) return;
+  const previous = state.stepEffort;
+  if (previous) {
+    // It resolved after its request went out: this batch carries it. One still
+    // running is superseded: the newest step's judgment queues behind it and
+    // any judgment still waiting in between is skipped (latest wins), so the
+    // judge never has more than one running and one queued.
+    if (previous.settled) {
+      if (previous.result && !previous.applied) applyResult(state, last, previous.result);
+    } else {
+      previous.superseded = true;
+    }
+  }
   state.autoEffortSteps = (state.autoEffortSteps || 0) + 1;
   const step = state.autoEffortSteps;
   const provider = state.sessionRef?.provider;
   const model = state.model;
-  const judged = await judgeTurn({
+  const pending = { target: last, sent: false, settled: false, applied: false, superseded: false, result: null };
+  const behind = previous && !previous.settled ? previous.promise : Promise.resolve();
+  state.stepEffort = pending;
+  const context = { auto, snapshot, step, provider, model, providerClient: state.provider, sessionId: state.sessionId };
+  const input = {
     step: {
       request: auto.request,
       step,
@@ -70,11 +133,26 @@ export async function markStepEffort(state, assistantTurnMsg) {
         result: stepResultWindow(textOf(results.get(call.id)?.content)),
       })),
     },
-  });
+  };
+  pending.promise = behind
+    .then(() => (pending.superseded ? null : judgeTurn(input)))
+    .then((judged) => (judged ? stepResult(context, judged) : null))
+    // A failed judgment leaves the step at the effort in force.
+    .catch(() => null)
+    .then((result) => {
+      // Only this record changes here; the loop reads it at its next boundary.
+      pending.result = result;
+      pending.settled = true;
+    });
+}
+
+// What a resolved judgment sets: `{ marked, level }` (the tool result's effort
+// configuration, and the per-request effort of a custom route), or null.
+function stepResult({ auto, snapshot, step, provider, model, providerClient, sessionId }, judged) {
   // `atStep` numbers the tool-result step; `step` in a resolved decision is the ladder move.
   const record = {
     at: new Date().toISOString(),
-    sessionId: state.sessionId,
+    sessionId,
     provider,
     model,
     mode: 'on',
@@ -82,9 +160,9 @@ export async function markStepEffort(state, assistantTurnMsg) {
   };
   if (!judged.probs) {
     recordEffortDecision({ ...record, skipped: judged.skipped });
-    return;
+    return null;
   }
-  const modelMeta = autoEffortModel(provider, state.provider, model);
+  const modelMeta = autoEffortModel(provider, providerClient, model);
   const resolved = resolveAutoEffort({
     base: auto.base,
     options: effortOptionsFor(provider, modelMeta),
@@ -96,19 +174,25 @@ export async function markStepEffort(state, assistantTurnMsg) {
     ms: judged.ms,
     probs: judged.probs.map((value) => Number(value.toFixed(3))),
   });
-  if (snapshot.mode === 'custom') {
+  if (isCustomProviderName(provider)) {
     const level =
       resolved &&
       resolveCustomReasoning({
-        protocol: state.provider?.customConfig?.protocol,
+        protocol: providerClient?.customConfig?.protocol,
         model: modelMeta,
         effort: resolved.effort,
       }).level;
-    if (!level) return;
-    state.opts.effort = level;
-    last.meta = { ...last.meta, effortConfiguration: { ...snapshot, effort: level } };
-    return;
+    if (!level) return null;
+    // The per-request effort also carries the step on an update route,
+    // where a rejected update replays the request with it.
+    return {
+      level,
+      marked:
+        snapshot.mode === 'custom'
+          ? { ...snapshot, effort: level }
+          : stepEffortConfiguration(snapshot, provider, model, level),
+    };
   }
   const marked = resolved && stepEffortConfiguration(snapshot, provider, model, resolved.effort);
-  if (marked) last.meta = { ...last.meta, effortConfiguration: marked };
+  return marked ? { level: null, marked } : null;
 }

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -12,6 +12,8 @@ import {
   filterSkillsExcludingDisabled,
   isSkillDisabled,
   skillMissingFeature,
+  skillOutsideScope,
+  skillOutsideScopeError,
 } from '../../context/collect.mjs';
 
 // Eager-dispatch: tools with readOnlyHint:true in their declaration are safe
@@ -96,6 +98,7 @@ export function viewSkill(cwd, name, session = null) {
     return `Error: skill "${skillName}" needs the ${missingFeature} built-in feature, which is not installed or is switched off in Extensions → Plugin → Built-in`;
   }
   if (isSkillDisabled(skillName)) return `Error: skill "${skillName}" is disabled`;
+  if (skillOutsideScope(skillName, cwd)) return skillOutsideScopeError(skillName);
   const res = loadSkillResource(skillName, cwd);
   if (!res) return `Error: skill "${skillName}" not found`;
   // Return the general tool envelope: the model-visible tool_result is the

package/src/runtime/agent/orchestrator/session/loop/tool-phase.mjs

@@ -70,7 +70,9 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   // carries a runtime notice for the model, delivered after its results.
   if (response.recoveryNotice) messages.push(response.recoveryNotice);
   const toolsEndedAt = Date.now();
-  await markStepEffort(state, assistantTurnMsg);
+  // Starts the step judgment; the next request uses it if it has resolved by
+  // then (send-phase.mjs applyStepEffort), else the one after.
+  markStepEffort(state, assistantTurnMsg);
   try {
     opts.onToolPhaseCompleted?.({
       iteration: round.nextIteration,

package/src/runtime/agent/orchestrator/session/manager/ask-queue.mjs

@@ -12,6 +12,17 @@ import {
 
 const SYNTHETIC_PROMPT_SOURCES = ['goal-continuation', 'goal-closeout'];
 
+// A caller-declared prompt source the runtime trusts as provenance of the
+// initial prompt: Goal turns are runtime-synthetic; a task notification (an
+// idle-drained completion, an automation run's agent results) is stored like
+// one the steering/queue drains inject, never as the user speaking — so none
+// of these run explicit skill selection.
+function initialPromptSourceFor(promptSource) {
+  if (SYNTHETIC_PROMPT_SOURCES.includes(promptSource)) return { source: promptSource, synthetic: true };
+  if (promptSource === PENDING_MODE_TASK_NOTIFICATION) return { source: promptSource };
+  return null;
+}
+
 /** Prompt provenance for a drained queue turn: the source plus its execution when one exists. */
 const promptSourceFields = (source, execution) => {
   if (!source) return null;
@@ -42,9 +53,13 @@ export function createAskPromptQueue({ sessionId, promptSource }) {
   // Local FIFO of follow-up prompts drained from the pending-message queue
   // after each turn — keeps queued `agent type=send` messages in order.
   const tail = [];
-  let initialPromptSource = SYNTHETIC_PROMPT_SOURCES.includes(promptSource)
-    ? { source: promptSource, synthetic: true }
-    : null;
+  let initialPromptSource = initialPromptSourceFor(promptSource);
+  // Queue entries of the input nextTurn handed out that no turn owns yet.
+  // Once a turn starts, its failure path acks or releases them instead.
+  let unstartedEntries = [];
+  const release = (entries) => {
+    if (entries?.length > 0) releasePendingMessages(sessionId, entries);
+  };
 
   /** The next turn's input — prompt, caller context, consumed queue entries
    *  and provenance — or null when nothing model-visible is left to run. */
@@ -74,7 +89,26 @@ export function createAskPromptQueue({ sessionId, promptSource }) {
       tail.unshift(...groups.slice(1).map(tailTurnFor));
       input = queuedTurnInput(tailTurnFor(first));
     }
-    return hasModelVisiblePromptContent(input.prompt) ? input : null;
+    if (!hasModelVisiblePromptContent(input.prompt)) {
+      release(input.pendingEntries);
+      return null;
+    }
+    unstartedEntries = input.pendingEntries;
+    return input;
+  };
+
+  /** The turn for the last nextTurn input started: it now owns its entries. */
+  const markStarted = () => {
+    unstartedEntries = [];
+  };
+
+  /** Hands every drained entry no turn started back to the pending queue —
+   *  the waiting follow-up turns and an input whose turn never opened.
+   *  Called once when the ask unwinds; each entry is released once. */
+  const releaseUnstarted = () => {
+    const entries = [...unstartedEntries, ...tail.splice(0).flatMap((turn) => turn.entries || [])];
+    unstartedEntries = [];
+    release(entries);
   };
 
   /** Queues drained pending-message entries as follow-up turns; true when
@@ -92,5 +126,8 @@ export function createAskPromptQueue({ sessionId, promptSource }) {
     return true;
   };
 
-  return { nextTurn, pushDrained };
+  /** True while drained follow-up turns are still waiting to run. */
+  const hasQueuedTurns = () => tail.length > 0;
+
+  return { nextTurn, pushDrained, hasQueuedTurns, markStarted, releaseUnstarted };
 }

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -148,7 +148,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
     // queued send always lands AFTER the in-flight prompt here, ordering is
     // preserved and the spawn/connecting startup race disappears.
     for (;;) {
-      const input = queue.nextTurn({ prompt, context, explicitPrefetch });
+      // `skillSelection` (askOpts) is the trusted selection input of the
+      // caller's own prompt only; drained follow-up turns never inherit it.
+      const input = queue.nextTurn({ prompt, context, explicitPrefetch, skillSelection: askOpts.skillSelection });
       if (!input) {
         void takeoverHydration.then((count) => {
           if (count <= 0) return;
@@ -176,6 +178,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         ...claimed,
         ...armTurnDurability({ sessionId, ...claimed, pendingEntries: input.pendingEntries }),
       };
+      // From here the turn's own unwind (ask-turn-failure) acks or releases
+      // its entries; the queue keeps owning only the not-yet-started ones.
+      queue.markStarted();
       const turn = await runAskTurn({
         sessionId,
         opened,
@@ -191,9 +196,12 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
       // that arrived while this turn was in flight runs next, in order, as a
       // follow-up user turn. The mutex is still held, so a send racing this
       // drain either landed before (picked up here) or enqueues for the next
-      // loop. When the queue is empty we return the latest turn's result.
+      // loop. Follow-ups an idle ask already drained wait in the queue's
+      // tail and run before anything new. When both are empty we return the
+      // latest turn's result.
       const drained = turn.drained.length > 0 ? turn.drained : drainPendingMessages(sessionId);
-      if (queue.pushDrained(drained)) {
+      queue.pushDrained(drained);
+      if (queue.hasQueuedTurns()) {
         // Carry the just-committed in-memory session into the follow-up
         // turn so the queued tail sees the preceding assistant/tool
         // context. loadSession() would return this same live snapshot
@@ -214,6 +222,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
       return result;
     }
   } finally {
+    // A failed/cancelled turn ends the ask: the follow-up turns drained
+    // behind it never ran, so their entries go back to the pending queue.
+    queue.releaseUnstarted();
     // A thrown setup/provider path must never leave a delayed checkpoint
     // writer alive after the turn lock is released.
     // Clear the controller only if it's still ours (closeSession may have

package/src/runtime/agent/orchestrator/session/manager/ask-turn-auto-effort.mjs

@@ -8,7 +8,12 @@
 // model declares effort levels (the effort is sent with each request).
 import { readSection } from '../../../../shared/config.mjs';
 import { autoEffortModel, turnEffortConfigurationMode } from '../../providers/effort-configuration.mjs';
-import { autoEffortBase, normalizeAutoEffortMode, resolveAutoEffort } from '../../providers/auto-effort.mjs';
+import {
+  autoEffortApplicable,
+  autoEffortBase,
+  normalizeAutoEffortMode,
+  resolveAutoEffort,
+} from '../../providers/auto-effort.mjs';
 import { builtinFeatureActive } from '../../runtime-core/builtin-features.mjs';
 import { effortOptionsFor } from '../../runtime-core/effort.mjs';
 import { effortJudgeSupportsSteps, judgeTurn, recordEffortDecision } from '../../../../effort-judge/judge-client.mjs';
@@ -78,12 +83,6 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
   if (!turnEffortConfigurationMode(session, provider)) return null;
   const chosen = String(session.effort || '').toLowerCase();
   const base = autoEffortBase(chosen);
-  // The previous user request shows the work a short follow-up continues.
-  const judged = await judgeTurn({
-    request,
-    prev: lastText(session.messages, 'assistant'),
-    prevRequest: lastText(session.messages, 'user'),
-  });
   const record = {
     at: new Date().toISOString(),
     sessionId,
@@ -94,15 +93,24 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
     base,
     requestChars: request.length,
   };
+  const options = effortOptionsFor(session.provider, autoEffortModel(session.provider, provider, session.model));
+  // No judged outcome can apply when the base is off the model's ladder, so
+  // the judge is not asked (in observe mode too: nothing would be logged).
+  if (!autoEffortApplicable({ base, options })) {
+    recordEffortDecision({ ...record, skipped: 'default-outside-auto-range' });
+    return null;
+  }
+  // The previous user request shows the work a short follow-up continues.
+  const judged = await judgeTurn({
+    request,
+    prev: lastText(session.messages, 'assistant'),
+    prevRequest: lastText(session.messages, 'user'),
+  });
   if (!judged.probs) {
     recordEffortDecision({ ...record, skipped: judged.skipped });
     return null;
   }
-  const resolved = resolveAutoEffort({
-    base,
-    options: effortOptionsFor(session.provider, autoEffortModel(session.provider, provider, session.model)),
-    probs: judged.probs,
-  });
+  const resolved = resolveAutoEffort({ base, options, probs: judged.probs });
   recordEffortDecision({
     ...record,
     ...(resolved || { skipped: 'default-outside-auto-range' }),