mixdog 1.2.1 → 1.2.3

package/src/runtime/agent/orchestrator/session/loop/step-auto-effort.mjs

@@ -8,14 +8,15 @@
  * later request rebuilds the same history and the prompt cache keeps hitting.
  * A judge that is missing, slow or failing leaves the step at the effort in
  * force (the turn's or the previous step's).
- * A custom route (snapshot mode 'custom') has no mid-conversation update: the
- * judged effort, snapped onto the model's levels, becomes the effort of the
- * turn's following requests.
+ * A custom route snaps the judged effort onto the model's levels. Without a
+ * mid-conversation update (snapshot mode 'custom') it becomes the effort of
+ * the turn's following requests; a custom GPT-6+ Responses route (mode
+ * 'responses') also marks it as the update.
  */
 import { resolveAutoEffort } from '../../providers/auto-effort.mjs';
-import { resolveCustomReasoning } from '../../providers/custom-reasoning.mjs';
+import { isCustomProviderName, resolveCustomReasoning } from '../../providers/custom-reasoning.mjs';
 import { autoEffortModel, stepEffortConfiguration } from '../../providers/effort-configuration.mjs';
-import { effortOptionsFor } from '../../runtime-core/effort.mjs';
+import { effortOptionsFor, warnEmptyAutoEffortLadder } from '../../runtime-core/effort.mjs';
 import { judgeTurn, recordEffortDecision } from '../../../../effort-judge/judge-client.mjs';
 import { stepResultWindow } from '../../../../effort-judge/judge-input.mjs';
 
@@ -35,12 +36,58 @@ const argText = (args) =>
     .slice(0, 600)
     .join('');
 
+// A judgment runs beside the next iteration instead of in front of it. Its
+// record lives on the loop state (`state.stepEffort`), so it can only ever
+// reach the turn that started it; its promise settles the record and touches
+// nothing else, so an aborted loop is never mutated afterwards. The result
+// lands on the batch's last tool result in one of two places:
+//  - resolved before the next request is projected: on that tool result, so
+//    the request carries it (applyStepEffort);
+//  - resolved later: the request already went out with the earlier effort and
+//    its history is never rewritten (that would break the prompt cache), so
+//    the result marks the last tool result of the next batch, and the
+//    following request carries it (markStepEffort).
+function applyResult(state, target, result) {
+  if (result.level) state.opts.effort = result.level;
+  if (result.marked) target.meta = { ...target.meta, effortConfiguration: result.marked };
+}
+
+// How long a request waits for its step judgment (measured judge p90 ≈ 284 ms).
+export const STEP_EFFORT_GRACE_MS = 300;
+
+/**
+ * Before a provider request is projected: wait up to the grace for the pending
+ * judgment and apply it if it resolved. A slower one leaves this request at
+ * the effort in force and lands on the following request.
+ */
+export async function applyStepEffort(state) {
+  const pending = state.stepEffort;
+  if (!pending || pending.sent) return;
+  if (!pending.settled && !state.signal?.aborted) {
+    let timer;
+    await Promise.race([
+      pending.promise,
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, STEP_EFFORT_GRACE_MS);
+      }),
+    ]);
+    clearTimeout(timer);
+    // Another caller may have handled it while this one waited.
+    if (pending.sent) return;
+  }
+  pending.sent = true;
+  if (!pending.result || state.signal?.aborted || !state.messages.includes(pending.target)) return;
+  applyResult(state, pending.target, pending.result);
+  pending.applied = true;
+}
+
 /**
- * Judge the step after this batch and mark its last tool result.
+ * Start judging the step after this batch (not awaited). The result applies to
+ * the next request if it is ready by then, else to the one after.
  * `state.opts.stepAutoEffort` ({ request, base }) is set only when auto effort
  * is on for this turn and the installed judge was trained on steps.
  */
-export async function markStepEffort(state, assistantTurnMsg) {
+export function markStepEffort(state, assistantTurnMsg) {
   const auto = state.opts?.stepAutoEffort;
   const snapshot = state.opts?.effortConfiguration;
   if (!auto || !snapshot || state.signal?.aborted) return;
@@ -55,11 +102,27 @@ export async function markStepEffort(state, assistantTurnMsg) {
     }
   }
   if (!last) return;
+  const previous = state.stepEffort;
+  if (previous) {
+    // It resolved after its request went out: this batch carries it. One still
+    // running is superseded: the newest step's judgment queues behind it and
+    // any judgment still waiting in between is skipped (latest wins), so the
+    // judge never has more than one running and one queued.
+    if (previous.settled) {
+      if (previous.result && !previous.applied) applyResult(state, last, previous.result);
+    } else {
+      previous.superseded = true;
+    }
+  }
   state.autoEffortSteps = (state.autoEffortSteps || 0) + 1;
   const step = state.autoEffortSteps;
   const provider = state.sessionRef?.provider;
   const model = state.model;
-  const judged = await judgeTurn({
+  const pending = { target: last, sent: false, settled: false, applied: false, superseded: false, result: null };
+  const behind = previous && !previous.settled ? previous.promise : Promise.resolve();
+  state.stepEffort = pending;
+  const context = { auto, snapshot, step, provider, model, providerClient: state.provider, sessionId: state.sessionId };
+  const input = {
     step: {
       request: auto.request,
       step,
@@ -70,11 +133,26 @@ export async function markStepEffort(state, assistantTurnMsg) {
         result: stepResultWindow(textOf(results.get(call.id)?.content)),
       })),
     },
-  });
+  };
+  pending.promise = behind
+    .then(() => (pending.superseded ? null : judgeTurn(input)))
+    .then((judged) => (judged ? stepResult(context, judged) : null))
+    // A failed judgment leaves the step at the effort in force.
+    .catch(() => null)
+    .then((result) => {
+      // Only this record changes here; the loop reads it at its next boundary.
+      pending.result = result;
+      pending.settled = true;
+    });
+}
+
+// What a resolved judgment sets: `{ marked, level }` (the tool result's effort
+// configuration, and the per-request effort of a custom route), or null.
+function stepResult({ auto, snapshot, step, provider, model, providerClient, sessionId }, judged) {
   // `atStep` numbers the tool-result step; `step` in a resolved decision is the ladder move.
   const record = {
     at: new Date().toISOString(),
-    sessionId: state.sessionId,
+    sessionId,
     provider,
     model,
     mode: 'on',
@@ -82,9 +160,9 @@ export async function markStepEffort(state, assistantTurnMsg) {
   };
   if (!judged.probs) {
     recordEffortDecision({ ...record, skipped: judged.skipped });
-    return;
+    return null;
   }
-  const modelMeta = autoEffortModel(provider, state.provider, model);
+  const modelMeta = autoEffortModel(provider, providerClient, model);
   const resolved = resolveAutoEffort({
     base: auto.base,
     options: effortOptionsFor(provider, modelMeta),
@@ -96,19 +174,26 @@ export async function markStepEffort(state, assistantTurnMsg) {
     ms: judged.ms,
     probs: judged.probs.map((value) => Number(value.toFixed(3))),
   });
-  if (snapshot.mode === 'custom') {
+  if (!resolved) warnEmptyAutoEffortLadder(provider, model, auto.base);
+  if (isCustomProviderName(provider)) {
     const level =
       resolved &&
       resolveCustomReasoning({
-        protocol: state.provider?.customConfig?.protocol,
+        protocol: providerClient?.customConfig?.protocol,
         model: modelMeta,
         effort: resolved.effort,
       }).level;
-    if (!level) return;
-    state.opts.effort = level;
-    last.meta = { ...last.meta, effortConfiguration: { ...snapshot, effort: level } };
-    return;
+    if (!level) return null;
+    // The per-request effort also carries the step on an update route,
+    // where a rejected update replays the request with it.
+    return {
+      level,
+      marked:
+        snapshot.mode === 'custom'
+          ? { ...snapshot, effort: level }
+          : stepEffortConfiguration(snapshot, provider, model, level),
+    };
   }
   const marked = resolved && stepEffortConfiguration(snapshot, provider, model, resolved.effort);
-  if (marked) last.meta = { ...last.meta, effortConfiguration: marked };
+  return marked ? { level: null, marked } : null;
 }

package/src/runtime/agent/orchestrator/session/loop/tool-call-resolution.mjs

@@ -0,0 +1,95 @@
+// Execution-call projection for the fixed tool bridge. A wire call
+// `call_tool {name: T, arguments: A}` (id X) becomes the execution call
+// `{ id: X, name: T, arguments: A, wireCall }` before eager admission and
+// classification, so every policy, ordering, cache, hook, approval and audit
+// layer sees the target itself. The tool result still answers wire id X and
+// the transcript keeps the original wire call (`wireCall`, an immutable copy).
+// Non-bridge sessions and every other call pass through unchanged.
+import { formatInvalidToolArgsResult, isInvalidToolArgsMarker } from '../../providers/lib/openai-tool-args.mjs';
+import {
+  BRIDGE_CALL_TOOL_NAME,
+  bridgeErrorText,
+  isToolBridgeEnabled,
+  resolveBridgeTarget,
+} from '../../runtime-core/tool-bridge.mjs';
+
+const CALL_TOOL_KEYS = new Set(['name', 'arguments']);
+
+const isPlainObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+
+function deepFreeze(value) {
+  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const key of Object.keys(value)) deepFreeze(value[key]);
+  }
+  return value;
+}
+
+function projectionFailure(wireCall, wire, text) {
+  return { id: wireCall.id, name: wireCall.name, arguments: wireCall.arguments, wireCall: wire, bridgeError: text };
+}
+
+/**
+ * @returns the execution call for `wireCall`: the projected target call, a
+ *   call carrying `bridgeError` (answered with that error, never executed),
+ *   or `wireCall` itself when no projection applies. Idempotent.
+ */
+export function resolveExecutionToolCall(wireCall, session) {
+  if (!wireCall || wireCall.name !== BRIDGE_CALL_TOOL_NAME || wireCall.wireCall || !isToolBridgeEnabled(session)) {
+    return wireCall;
+  }
+  const wire = deepFreeze(structuredClone(wireCall));
+  const args = wireCall.arguments;
+  if (isInvalidToolArgsMarker(args)) return projectionFailure(wireCall, wire, formatInvalidToolArgsResult(wireCall));
+  if (!isPlainObject(args)) {
+    return projectionFailure(
+      wireCall,
+      wire,
+      bridgeErrorText('INVALID_ARGUMENTS', 'call_tool requires {name, arguments}.')
+    );
+  }
+  const extra = Object.keys(args).filter((key) => !CALL_TOOL_KEYS.has(key));
+  if (extra.length) {
+    return projectionFailure(
+      wireCall,
+      wire,
+      bridgeErrorText('INVALID_ARGUMENTS', `call_tool does not accept: ${extra.join(', ')}.`)
+    );
+  }
+  if (!isPlainObject(args.arguments)) {
+    return projectionFailure(
+      wireCall,
+      wire,
+      bridgeErrorText('INVALID_ARGUMENTS', 'call_tool arguments must be an object of the target tool arguments.')
+    );
+  }
+  const target = resolveBridgeTarget(session, args.name);
+  if (target.error) return projectionFailure(wireCall, wire, bridgeErrorText(target.error.code, target.error.message));
+  const call = { id: wireCall.id, name: target.name, arguments: structuredClone(args.arguments), wireCall: wire };
+  // The target definition drives read-only classification of the call; it is
+  // never serialized with the call.
+  Object.defineProperty(call, 'bridgeTool', { value: target.tool, enumerable: false });
+  return call;
+}
+
+export function resolveExecutionToolCalls(calls, session) {
+  return Array.isArray(calls) ? calls.map((call) => resolveExecutionToolCall(call, session)) : calls;
+}
+
+/**
+ * The classification tool list for `calls`: `tools` plus the definitions of
+ * bridged targets that are not on it, so a bridged target is classified
+ * (read-only, dedup, stale-read invalidation) exactly like a direct call.
+ */
+export function bridgeClassificationTools(tools, calls) {
+  const base = Array.isArray(tools) ? tools : [];
+  const seen = new Set(base.map((tool) => tool?.name));
+  const extra = [];
+  for (const call of calls || []) {
+    const definition = call?.bridgeTool;
+    if (!definition || seen.has(definition.name)) continue;
+    seen.add(definition.name);
+    extra.push(definition);
+  }
+  return extra.length ? [...base, ...extra] : tools;
+}

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -4,11 +4,12 @@
  */
 import { resolvePreToolAskApproval } from '../tool-helpers.mjs';
 import { runAbortable, throwIfAborted } from '../../../../../shared/abort-race.mjs';
+import { evaluateExecPolicy } from '../../../tools/bash-policy-scan.mjs';
 import { beginSessionApprovalWait } from '../../manager/runtime-liveness.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
-async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision }) {
+async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision, keepArgs = false }) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
   // While the user decides, the session is waiting on them, not working.
   const releaseApprovalWait = beginSessionApprovalWait(callerSessionId);
@@ -30,10 +31,35 @@ async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHoo
   }
   if (askOutcome.denial) return { denial: askOutcome.denial };
   const approval = askOutcome.approval;
-  if (approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
+  if (!keepArgs && approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
   return null;
 }
 
+/**
+ * Approval gate for a shell call (or a terminal `run`) whose exec policy
+ * decision is 'ask' (elevated launch). Runs after the final call is known. The
+ * approval is granted for the exact command being asked about: an approval
+ * reply cannot rewrite the args.
+ * @returns {Promise<{ denial: string } | { elevationApproved: boolean }>}
+ */
+export async function applyShellElevationGate(call, { callerSessionId, executeOpts, toolApprovalHook }) {
+  const gated = call.name === 'shell' || (call.name === 'terminal' && call.args?.action === 'run');
+  if (!gated || !isArgsObject(call.args) || call.args.command == null) {
+    return { elevationApproved: false };
+  }
+  const decision = evaluateExecPolicy(String(call.args.command));
+  if (decision.decision !== 'ask') return { elevationApproved: false };
+  const denied = await askApproval(call, {
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+    decision,
+    keepArgs: true,
+  });
+  if (denied) return denied;
+  return { elevationApproved: true };
+}
+
 /**
  * @returns {Promise<{ denial: string } | { name: string, args: any }>}
  *   the call as the hook left it, or the denial text to return instead
@@ -48,7 +74,8 @@ export async function applyBeforeToolHook({
   toolApprovalHook,
 }) {
   const call = { name, args, cwd };
-  if (!beforeToolHook) return call;
+  // ask_user is itself the user prompt; it never goes through the ordinary approval gate.
+  if (!beforeToolHook || name === 'ask_user') return call;
   try {
     const decision = await runAbortable(executeOpts.signal, () =>
       beforeToolHook(

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -35,13 +35,19 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
   });
 }
 
-function dispatchInternal(name, args, { cwd, callerSessionId, sessionRef, executeOpts, notifyFn, toolApprovalHook }) {
+function dispatchInternal(
+  name,
+  args,
+  { cwd, callerSessionId, sessionRef, executeOpts, notifyFn, toolApprovalHook, elevationApproved }
+) {
   // callerSessionId propagates into server.mjs dispatchTool so that
   // dispatchAiWrapped can detect and reject recursive calls from a
   // hidden-role session (recall/search → self).
   return executeInternalTool(name, args, {
     scopeId: sessionRef?.mcpScopeId || null,
     callerSessionId,
+    // The calling session itself: bridge tools answer within its scope.
+    callerSession: sessionRef || null,
     callerCwd: cwd,
     setCallerCwd: async (nextCwd) => {
       const applyForCaller = sessionRef?._applyResolvedCwdForCaller;
@@ -58,6 +64,8 @@ function dispatchInternal(name, args, { cwd, callerSessionId, sessionRef, execut
     notifyFn,
     toolApprovalHook,
     toolCallId: executeOpts.toolCallId || null,
+    // Runtime-granted for this call only (terminal run); never from model args.
+    elevationApproved: elevationApproved === true,
     invocationSource: 'model-tool',
   });
 }
@@ -90,9 +98,12 @@ export function dispatchToolCall({ name, args }, ctx) {
   // variants) adapt to a native execution inside executeBuiltinTool's default
   // case; on a shape mismatch it falls back to the redirect guidance message.
   if (name === 'shell' || isBuiltinTool(name) || isExternalAdapterTool(name)) {
-    const builtinOpts = executeOpts.suppressReadUnchangedStub
-      ? { ...completionToolOpts, suppressReadUnchangedStub: true }
-      : completionToolOpts;
+    const builtinOpts = {
+      ...completionToolOpts,
+      ...(executeOpts.suppressReadUnchangedStub ? { suppressReadUnchangedStub: true } : {}),
+      // Runtime-granted only; any value inherited from executeOpts is overridden.
+      elevationApproved: ctx.elevationApproved === true,
+    };
     return executeBuiltinTool(name, args, cwd, builtinOpts);
   }
   return formatUnknownBuiltinToolMessage(name, args, 'tool');

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -8,12 +8,13 @@
 import { isMcpTool } from '../../mcp/client.mjs';
 import { prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
 import { refreshDeferredMcpToolCatalog } from '../../runtime-core/tool-catalog.mjs';
+import { bridgeTargetUnavailable } from '../../runtime-core/tool-bridge.mjs';
 import { preDispatchDenyForSession, routeWebFetchCall } from './pre-dispatch-deny.mjs';
 import { runWithToolExecutionOwner } from '../../../../shared/tool-execution-owner.mjs';
 import { runWithLocalSearchTelemetry } from '../../tools/builtin/local-search-telemetry.mjs';
 import { throwIfAborted } from '../../../../shared/abort-race.mjs';
 import { prepareToolCall } from './tool-exec/call-prep.mjs';
-import { applyBeforeToolHook } from './tool-exec/before-hook.mjs';
+import { applyBeforeToolHook, applyShellElevationGate } from './tool-exec/before-hook.mjs';
 import { dispatchToolCall } from './tool-exec/dispatch.mjs';
 import { applyAfterToolHook } from './tool-exec/after-hook.mjs';
 import { runReadOnlyIoWithDeadline } from './tool-exec/read-only-deadline.mjs';
@@ -65,6 +66,18 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
   if (isMcpTool(call.name)) refreshDeferredMcpToolCatalog(sessionRef);
   const deferredPrep = prepareDeferredToolCallThrough(sessionRef, call.name);
   if (deferredPrep?.deny) return deferredPrep.deny;
+  // A bridged target was resolved when its call_tool was projected; it must
+  // still be available in this session's scope (also after a hook rewrite).
+  // The authorized identity is the public tool name, not its transport
+  // (web_fetch routed to local_fetch/image_fetch stays web_fetch here).
+  if (executeOpts.bridgeWireCall) {
+    const unavailable = bridgeTargetUnavailable(sessionRef, finalCall.schemaName || finalCall.name);
+    if (unavailable) return unavailable;
+  }
+  // Elevated launches ask the user first; denied / no approval UI refuses the call.
+  const elevation = await applyShellElevationGate(call, { callerSessionId, executeOpts, toolApprovalHook });
+  if (elevation.denial) return elevation.denial;
+  throwIfAborted(executeOpts.signal);
   const result = await runReadOnlyIoWithDeadline(call.name, executeOpts.signal || null, async (deadlineSignal) => {
     let callOpts = executeOpts;
     if (deadlineSignal !== executeOpts.signal) {
@@ -80,6 +93,7 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
       completionToolOpts,
       notifyFn,
       toolApprovalHook,
+      elevationApproved: elevation.elevationApproved === true,
     });
   });
   return applyAfterToolHook(result, hookFrom(executeOpts, sessionRef, 'afterToolHook'), {

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -0,0 +1,150 @@
+// Tool-exposure migration (native ↔ bridge-v1, and pre-versioned fixed
+// surfaces → bridge-v1). The surface itself is rebuilt by
+// applyDeferredToolSurface; this module adds what a changed request prefix
+// invalidates: provider state, the prefix guard, the context baseline and the
+// cache-break tag. Historical tool calls are never rewritten.
+import {
+  applyDeferredToolSurface,
+  rebuildDeferredToolSurfaceForProvider,
+} from '../../runtime-core/tool-catalog.mjs';
+import {
+  bridgeSurfaceOutdated,
+  sessionToolExposure,
+  TOOL_EXPOSURE_BRIDGE,
+  TOOL_SURFACE_MIGRATION_INTENT,
+  toolExposureMigrationNeeded,
+  toolExposureModeForProvider,
+} from '../../runtime-core/tool-exposure.mjs';
+import { applyInitialDeferredToolManifestToBp2 } from '../../context/collect.mjs';
+import { isAgentOwner } from '../../agent-owner.mjs';
+import { honoredSchemaAllowlist } from '../manager/session-tool-surface.mjs';
+import { syncSystemPrefix } from '../manager/prompt-utils.mjs';
+import { invalidateProviderContextBaseline } from './compact-policy.mjs';
+
+/** Drop everything measured against the previous tool surface. */
+function invalidateForToolSurfaceMigration(session) {
+  delete session.providerState;
+  delete session._providerPrefixGuardState;
+  invalidateProviderContextBaseline(session);
+  session.updatedAt = Date.now();
+}
+
+/**
+ * After a surface re-apply outside a request (resume, provider switch)
+ * migrated the exposure: the first send of the next turn carries the tag.
+ */
+export function markToolSurfaceMigrated(session) {
+  invalidateForToolSurfaceMigration(session);
+  session.pendingCacheBreakIntent = TOOL_SURFACE_MIGRATION_INTENT;
+}
+
+/** Provider switch: rebuild the surface for `provider`, migrating bridge ↔ native. */
+export function rebuildToolSurfaceForProviderWithMigration(session, provider) {
+  if (!session) return false;
+  const migrating = toolExposureMigrationNeeded(session, provider);
+  rebuildDeferredToolSurfaceForProvider(session, provider);
+  if (migrating) markToolSurfaceMigrated(session);
+  return migrating;
+}
+
+// The latest assistant tool turn still waits for a result: not a safe boundary.
+function hasUnansweredToolCalls(messages) {
+  const list = Array.isArray(messages) ? messages : [];
+  const index = list.findLastIndex((message) => message?.role === 'assistant' && message.toolCalls?.length);
+  if (index < 0) return false;
+  const answered = new Set(
+    list.slice(index + 1).flatMap((message) => (message?.role === 'tool' ? [message.toolCallId] : []))
+  );
+  return list[index].toolCalls.some((call) => call?.id && !answered.has(call.id));
+}
+
+/**
+ * Request-boundary migration of a live session whose persisted exposure
+ * differs from its provider's. `messages` is the transcript the request is
+ * built from; the fixed-guidance rewrite lands there (and on the session).
+ * Returns true when the surface changed; the caller drops its frozen tool
+ * snapshot and provider state and tags the send.
+ */
+export function migrateToolExposureAtBoundary(session, messages) {
+  if (!session || !toolExposureMigrationNeeded(session) || hasUnansweredToolCalls(messages)) return false;
+  const stored = session.messages;
+  const working = Array.isArray(messages) ? messages : stored;
+  if (Array.isArray(working)) session.messages = working;
+  try {
+    applyDeferredToolSurface(session, session.deferredSurfaceMode || 'lead', [], {
+      provider: session.provider,
+      model: session.model,
+    });
+  } finally {
+    if (Array.isArray(working) && session.messages !== working) {
+      // The rewrite may drop an emptied system message: keep the request
+      // transcript array identity the loop holds.
+      working.splice(0, working.length, ...session.messages);
+    }
+    session.messages = stored;
+  }
+  // The rewritten prompt messages are fresh objects; the canonical transcript
+  // the save path persists takes them too, so the next save writes the new
+  // prompt together with the new exposure.
+  if (Array.isArray(stored) && Array.isArray(working) && stored !== working) syncSystemPrefix(stored, working);
+  invalidateForToolSurfaceMigration(session);
+  return true;
+}
+
+// Bridge state an agent surface carries; dropped when it returns to the full array.
+const AGENT_BRIDGE_FIELDS = [
+  'toolExposureMode',
+  'deferredProviderMode',
+  'deferredNativeTools',
+  'deferredSurfaceMode',
+  'deferredToolUsage',
+  'deferredDefaultTools',
+  'deferredSelectedTools',
+  'deferredDiscoveredTools',
+  'deferredCallableTools',
+  'deferredAnnouncedTools',
+  'deferredToolDeltaRevision',
+  'nativeDeferredDiscovery',
+  'mcpServerInstructions',
+];
+
+/**
+ * Agent (worker) sessions. Call right after their tools were resolved
+ * (create, resume, route change): on a bridge provider the eager surface
+ * becomes the full-mode core plus the bridge, built only from those
+ * role/policy-filtered tools; a native provider keeps the full array. A
+ * session honouring its own schema allowlist (a hidden specialist role) is
+ * already a small explicit surface and keeps it. `existing`: the session had
+ * a surface before, so a changed exposure is a migration.
+ */
+export function applyAgentToolExposure(session, { existing = false } = {}) {
+  if (!session || !Array.isArray(session.tools) || !isAgentOwner(session)) return false;
+  const before = sessionToolExposure(session);
+  const allowlisted = honoredSchemaAllowlist(session.schemaAllowedTools, { ownerIsAgent: true, agent: session.agent });
+  const bridge =
+    !allowlisted && toolExposureModeForProvider(session.provider, session.wireRoute) === TOOL_EXPOSURE_BRIDGE;
+  if (!bridge && before === null) return false;
+  // A surface an earlier bridge revision built is rebuilt now.
+  const outdated = bridgeSurfaceOutdated(session);
+  // The tools just resolved are the whole authority: no earlier catalog, MCP
+  // availability snapshot or pending MCP delta survives. (A bridge surface
+  // re-takes the snapshot at its next request boundary; a native agent has no
+  // refresh, so a stale snapshot would hide a connected server's tools.)
+  delete session.deferredToolCatalog;
+  delete session.deferredLateToolCatalog;
+  delete session.deferredMcpToolNames;
+  delete session.pendingDeferredToolDelta;
+  if (bridge) {
+    // The resolved list may be shared (prepared-resume cache): rebuild a copy.
+    session.tools = session.tools.slice();
+    applyDeferredToolSurface(session, 'full', [], { provider: session.provider, model: session.model });
+  } else {
+    for (const field of AGENT_BRIDGE_FIELDS) delete session[field];
+    // Without bridge state the fixed slot composes empty: the guidance goes.
+    if (Array.isArray(session.messages)) applyInitialDeferredToolManifestToBp2(session, [], { rebuild: true });
+    delete session.deferredToolBp2Applied;
+  }
+  const changed = before !== sessionToolExposure(session) || outdated;
+  if (existing && changed) markToolSurfaceMigrated(session);
+  return changed;
+}

package/src/runtime/agent/orchestrator/session/loop/tool-phase.mjs

@@ -8,6 +8,7 @@ import { traceLoopPhaseTiming } from './diagnostics.mjs';
 import { processToolBatch } from '../tool-batch.mjs';
 import { CROSS_TURN_CAP, REPEAT_FAIL_LIMIT } from './loop-state.mjs';
 import { markStepEffort } from './step-auto-effort.mjs';
+import { resolveExecutionToolCalls } from './tool-call-resolution.mjs';
 
 function isSleepLikeToolCall(call) {
   const name = String(call?.name || call?.toolName || call?.function?.name || '').toLowerCase();
@@ -34,7 +35,9 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   }
   // Per-turn batch shape — one row per assistant turn so trace consumers can
   // derive the multi-tool adoption ratio without scanning message bodies.
-  const toolBatchId = recordToolBatch(sessionId, calls, state.iterations);
+  // Audit records what runs: a bridged call_tool is recorded as its target.
+  // The wire calls stay the transcript identity (assistant turn below).
+  const toolBatchId = recordToolBatch(sessionId, resolveExecutionToolCalls(calls, sessionRef), state.iterations);
   await Promise.resolve(onToolCall?.(state.iterations, calls));
   const assistantTurnMsg = buildToolCallAssistantMessage(response, { calls, suppressMidTurnText, opts });
   commitAssistantMessage(messages, assistantTurnMsg, opts);
@@ -70,7 +73,9 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   // carries a runtime notice for the model, delivered after its results.
   if (response.recoveryNotice) messages.push(response.recoveryNotice);
   const toolsEndedAt = Date.now();
-  await markStepEffort(state, assistantTurnMsg);
+  // Starts the step judgment; the next request uses it if it has resolved by
+  // then (send-phase.mjs applyStepEffort), else the one after.
+  markStepEffort(state, assistantTurnMsg);
   try {
     opts.onToolPhaseCompleted?.({
       iteration: round.nextIteration,

package/src/runtime/agent/orchestrator/session/manager/ask-queue.mjs

@@ -54,6 +54,12 @@ export function createAskPromptQueue({ sessionId, promptSource }) {
   // after each turn — keeps queued `agent type=send` messages in order.
   const tail = [];
   let initialPromptSource = initialPromptSourceFor(promptSource);
+  // Queue entries of the input nextTurn handed out that no turn owns yet.
+  // Once a turn starts, its failure path acks or releases them instead.
+  let unstartedEntries = [];
+  const release = (entries) => {
+    if (entries?.length > 0) releasePendingMessages(sessionId, entries);
+  };
 
   /** The next turn's input — prompt, caller context, consumed queue entries
    *  and provenance — or null when nothing model-visible is left to run. */
@@ -83,7 +89,26 @@ export function createAskPromptQueue({ sessionId, promptSource }) {
       tail.unshift(...groups.slice(1).map(tailTurnFor));
       input = queuedTurnInput(tailTurnFor(first));
     }
-    return hasModelVisiblePromptContent(input.prompt) ? input : null;
+    if (!hasModelVisiblePromptContent(input.prompt)) {
+      release(input.pendingEntries);
+      return null;
+    }
+    unstartedEntries = input.pendingEntries;
+    return input;
+  };
+
+  /** The turn for the last nextTurn input started: it now owns its entries. */
+  const markStarted = () => {
+    unstartedEntries = [];
+  };
+
+  /** Hands every drained entry no turn started back to the pending queue —
+   *  the waiting follow-up turns and an input whose turn never opened.
+   *  Called once when the ask unwinds; each entry is released once. */
+  const releaseUnstarted = () => {
+    const entries = [...unstartedEntries, ...tail.splice(0).flatMap((turn) => turn.entries || [])];
+    unstartedEntries = [];
+    release(entries);
   };
 
   /** Queues drained pending-message entries as follow-up turns; true when
@@ -101,5 +126,8 @@ export function createAskPromptQueue({ sessionId, promptSource }) {
     return true;
   };
 
-  return { nextTurn, pushDrained };
+  /** True while drained follow-up turns are still waiting to run. */
+  const hasQueuedTurns = () => tail.length > 0;
+
+  return { nextTurn, pushDrained, hasQueuedTurns, markStarted, releaseUnstarted };
 }