mixdog 1.2.2 → 1.2.3

package/src/runtime/agent/orchestrator/session/loop/context-overflow.mjs

@@ -46,6 +46,62 @@ export function agentContextOverflowError(
   );
 }
 
+export const TOOL_SURFACE_EXCEEDS_CONTEXT = 'TOOL_SURFACE_EXCEEDS_CONTEXT';
+
+const tokens = (value) => `${Number(value || 0).toLocaleString('en-US')} tokens`;
+
+// Distinct from AgentContextOverflowError: the request's FIXED overhead (tool
+// definitions, protected system context, configured headroom) leaves no room
+// for any history, so compacting the history cannot help and is not tried.
+// The wording avoids provider context-overflow phrasing on purpose: this is
+// not a "conversation too long" refusal and must not be routed as one.
+export class ToolSurfaceExceedsContextError extends Error {
+  constructor({ sessionId, provider, model, overhead }) {
+    const target = [provider, model].filter(Boolean).join('/') || 'this model';
+    const reserve = overhead.kind === 'configured_reserve';
+    const headline = reserve
+      ? 'The configured compaction headroom leaves no room for conversation history'
+      : 'Tool definitions and system context leave no room for conversation history';
+    const remedy = reserve
+      ? 'Lower the configured headroom (compaction.reservedTokens or MIXDOG_AGENT_COMPACT_RESERVED_TOKENS), or use a model with a larger context window.'
+      : `Use a model with a larger context window, or send a smaller eager tool surface (disable MCP servers or custom tools this session does not need)${
+          overhead.configuredReserveTokens > 0 ? ', or configure fewer reserved tokens (compaction.reservedTokens)' : ''
+        }.`;
+    const largest = overhead.largestTools.map((tool) => `${tool.name} (${tokens(tool.tokens)})`).join(', ');
+    super(
+      [
+        `${headline} (${TOOL_SURFACE_EXCEEDS_CONTEXT}).`,
+        `${target}: context window ${tokens(overhead.contextWindowTokens)}, compaction boundary ${tokens(overhead.boundaryTokens)}.`,
+        `Fixed per-request overhead: tool definitions ${tokens(overhead.toolTokens)} (${overhead.toolCount} tools), ` +
+          `protected system context ${tokens(overhead.systemTokens)}, configured headroom ${tokens(overhead.configuredReserveTokens)}; ` +
+          'nothing remains for conversation history.',
+        ...(overhead.measuredRequestTokens
+          ? [`The provider measured the last request at ${tokens(overhead.measuredRequestTokens)}.`]
+          : []),
+        'Compacting the conversation history cannot reduce these.',
+        remedy,
+        ...(largest ? [`Largest tool definitions: ${largest}.`] : []),
+      ].join('\n')
+    );
+    this.name = 'ToolSurfaceExceedsContextError';
+    this.code = TOOL_SURFACE_EXCEEDS_CONTEXT;
+    this.sessionId = sessionId || null;
+    this.provider = provider || null;
+    this.model = model || null;
+    this.overheadKind = overhead.kind;
+    this.overhead = overhead;
+  }
+}
+
+export function toolSurfaceExceedsContextError({ sessionId, sessionRef, model, overhead }) {
+  return new ToolSurfaceExceedsContextError({
+    sessionId,
+    provider: sessionRef?.provider || null,
+    model: sessionRef?.model || model || null,
+    overhead,
+  });
+}
+
 // Distinct from AgentContextOverflowError: the compaction pipeline itself
 // failed (handoff-summary error, dead Memory runtime,
 // etc.). This is NOT "latest turn cannot fit the context budget" — masking it

package/src/runtime/agent/orchestrator/session/loop/deferred-call-through.mjs

@@ -1,12 +1,10 @@
 // Deferred catalog call-through: inactive catalog tool_use → discovery bookkeeping
 // then normal executeTool routing (runtime errors only; no pre-dispatch schema).
 import { clean } from '../../runtime-core/session-text.mjs';
-import {
-  deferredCatalogUnion,
-  isReadonlySelectable,
-  selectDeferredTools,
-} from '../../runtime-core/tool-catalog.mjs';
+import { deferredCatalogUnion, isReadonlySelectable, selectDeferredTools } from '../../runtime-core/tool-catalog.mjs';
 import { isDeferredToolAvailable } from '../../runtime-core/deferred-tool-availability.mjs';
+import { routeToolExclusionReason } from './provider-tool-exclusions.mjs';
+import { isBridgeReadonlySession, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
 
 /** Skill-list plumbing only; mutation/MCP/builtins must use the catalog+mode gate. */
 const INACTIVE_INFRA_BYPASS = new Set(['skills_list', 'skill_view']);
@@ -41,7 +39,7 @@ function toolExecutesWhenInactive(name) {
   return INACTIVE_INFRA_BYPASS.has(name);
 }
 
-function resolveDeferredSelectMode(session) {
+export function resolveDeferredSelectMode(session) {
   const spec = session?.toolSpec;
   if (spec == null || spec === '') return null;
   if (spec === 'readonly') return 'readonly';
@@ -89,20 +87,32 @@ export function prepareDeferredToolCallThrough(sessionRef, name) {
   }
   const tool = lookupDeferredCatalogTool(sessionRef, name);
   if (!tool) return null;
+  const routeExclusion = isToolBridgeEnabled(sessionRef) ? null : routeToolExclusionReason(sessionRef, tool);
+  if (routeExclusion) return denyDeferredCallThrough(`Error: ${routeExclusion}`);
   if (isActiveSessionTool(sessionRef, name)) return null;
   if (toolExecutesWhenInactive(name)) return null;
 
   const toolLabel = clean(tool.name) || clean(name) || 'tool';
+  const bridge = isToolBridgeEnabled(sessionRef);
   const resolvedMode = resolveDeferredSelectMode(sessionRef);
+  // Whatever the exposure, a deferred mutating tool never runs without a
+  // resolved tool mode, and never in a read-only one.
   if (resolvedMode === null) {
     if (!isReadonlySelectable(tool)) {
+      const remedy = bridge ? 'no call was sent.' : `load it with load_tool names:["${toolLabel}"].`;
       return denyDeferredCallThrough(
-        `Error: tool "${toolLabel}" is deferred and cannot be auto-loaded without a resolved tool mode; load it with load_tool names:["${toolLabel}"].`
+        `Error: tool "${toolLabel}" is deferred and cannot be auto-loaded without a resolved tool mode; ${remedy}`
       );
     }
-  } else if (resolvedMode === 'readonly' && !isReadonlySelectable(tool)) {
+  } else if (
+    (resolvedMode === 'readonly' || (bridge && isBridgeReadonlySession(sessionRef))) &&
+    !isReadonlySelectable(tool)
+  ) {
     return denyDeferredCallThrough(`Error: tool "${toolLabel}" is not available in readonly mode`);
   }
+  // Bridge sessions reach deferred tools through call_tool: the fixed
+  // provider surface is never extended.
+  if (bridge) return null;
 
   const selectMode = resolvedMode === null ? 'readonly' : resolvedMode;
   selectDeferredTools(sessionRef, [toolLabel], selectMode);

package/src/runtime/agent/orchestrator/session/loop/loop-state.mjs

@@ -114,6 +114,7 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     // One-shot repair of an assistant turn whose stored reasoning replay the
     // API refuses to take back (see thinking-replay-recovery.mjs).
     thinkingReplayRepairUsed: false,
+    toolSchemaDropUsed: false,
     // Pending image-strip retry: identities of the images every attempt leaves
     // out until a send succeeds, and whether to heal them from history then.
     imageStrip: null,

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -13,8 +13,12 @@
 // registry knows its name.
 import { isAgentOwner } from '../../agent-owner.mjs';
 import { isOffReadonlySurface } from './deferred-call-through.mjs';
+import { BRIDGE_CALL_TOOL_NAME, bridgeErrorText, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
+import { sessionAllowlistExcludes, sessionDisallows } from '../../runtime-core/deferred-tool-availability.mjs';
+import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
 
-const WORKER_DENIED_TOOLS = new Set(['agent']);
+const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'session']);
+const BRIDGE_DISCOVERY_TOOL_NAMES = new Set(['load_tool']);
 
 const IMAGE_PATH_RE = /\.(?:png|jpe?g|gif|webp)(?:$|[?#])/i;
 const COMPACTED_PATCH_LINE_RE = /^\s*\[mixdog compacted\b[^\]\n]*\]/;
@@ -95,17 +99,24 @@ export function routeWebFetchCall(call) {
 export function preDispatchDenyForSession(sessionRef, call) {
   const name = call?.name;
   if (typeof name !== 'string' || !name) return null;
+  // A call_tool request that could not be projected onto its target answers
+  // its wire id with the projection error; call_tool itself never dispatches.
+  if (typeof call.bridgeError === 'string') return call.bridgeError;
+  if (name === BRIDGE_CALL_TOOL_NAME && isToolBridgeEnabled(sessionRef)) {
+    return bridgeErrorText('BRIDGE_RECURSION', 'call_tool runs one tool named in its arguments and cannot be dispatched itself.');
+  }
   const schemaName = String(call?.schemaName || name);
-  if (Array.isArray(sessionRef?.schemaAllowedTools)) {
-    const allowed = new Set(sessionRef.schemaAllowedTools.map((toolName) => String(toolName).toLowerCase()));
-    if (!allowed.has(schemaName.toLowerCase())) {
-      return `Error: tool "${name}" is not available on this session's schema allowlist.`;
-    }
+  // A tool the provider left out of this request still exists in the session;
+  // a call to it is answered with why it is unavailable.
+  const excluded = providerToolExclusionReason(sessionRef, schemaName);
+  if (excluded) return `Error: ${excluded}`;
+  // The bridge's discovery tools grant no authority (every call_tool target
+  // is judged here under its own name), so an allowlist never strands them.
+  const bridgeDiscovery = isToolBridgeEnabled(sessionRef) && BRIDGE_DISCOVERY_TOOL_NAMES.has(schemaName);
+  if (!bridgeDiscovery && sessionAllowlistExcludes(sessionRef, schemaName)) {
+    return `Error: tool "${name}" is not available on this session's schema allowlist.`;
   }
-  if (
-    Array.isArray(sessionRef?.disallowedTools) &&
-    sessionRef.disallowedTools.some((toolName) => String(toolName).toLowerCase() === schemaName.toLowerCase())
-  ) {
+  if (sessionDisallows(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available in this session.`;
   }
   if (isOffReadonlySurface(sessionRef, schemaName)) {

package/src/runtime/agent/orchestrator/session/loop/provider-tool-exclusions.mjs

@@ -0,0 +1,132 @@
+// Tools a provider left out of a request because it cannot accept their input
+// schema even after the wire's normalization (a schema with an unknown type
+// name, an unresolvable $ref, a non-object root), or that the provider
+// rejected with an HTTP 400 naming the schema (dropped for the session).
+// The user is told once per session and tool on the turn's display-only stage
+// channel (stage 'notice'); a call the model still makes to such a tool is
+// answered with the reason instead of running it.
+import { geminiToolExclusion } from '../../providers/gemini-schema.mjs';
+import { isGeminiFamilyModel } from '../../providers/gemini-family.mjs';
+import { anthropicToolExclusion } from '../../providers/lib/anthropic-request-utils.mjs';
+import { claudeBridgeInputSchema, wireInputSchema } from '../../providers/lib/claude-bridge-schema.mjs';
+import { actionInputUnionFor } from '../../providers/lib/action-input-contract.mjs';
+import { isAntigravityClaude } from '../../providers/antigravity-request.mjs';
+import { isResponsesFreeformTool } from '../../providers/custom-tool-wire.mjs';
+import { ANTHROPIC_NATIVE_PROVIDERS } from '../../runtime-core/tool-catalog-schema.mjs';
+import { finalizeProviderRequestTools, providerNativeToolPrefixCount } from '../../runtime-core/provider-request-tools.mjs';
+
+const sessions = new WeakMap();
+
+function exclusionsFor(sessionRef) {
+  let state = sessions.get(sessionRef);
+  if (!state) {
+    state = { noticed: new Set(), current: new Map(), dropped: new Map() };
+    sessions.set(sessionRef, state);
+  }
+  return state;
+}
+
+const isSessionRef = (value) => value !== null && typeof value === 'object';
+
+/** A new provider request: exclusions describe the latest request only. */
+export function beginProviderToolExclusions(sessionRef) {
+  if (isSessionRef(sessionRef)) sessions.get(sessionRef)?.current.clear();
+}
+
+export function excludedToolNoticeText({ name, pointer, reason }) {
+  return `Tool "${name}" was excluded from this session's requests: its input schema is invalid at ${pointer || '/'} (${reason}). Fix the tool's schema or disable the tool.`;
+}
+
+/** Record `exclusion` ({ name, pointer, reason }) for the session's current
+ *  request and raise the user notice the first time this tool is excluded. */
+export function recordProviderToolExclusion(sessionRef, exclusion, onStageChange) {
+  const name = String(exclusion?.name || '');
+  if (!name || !isSessionRef(sessionRef)) return;
+  const state = exclusionsFor(sessionRef);
+  state.current.set(name, exclusion);
+  if (state.noticed.has(name)) return;
+  state.noticed.add(name);
+  try {
+    onStageChange?.('notice', { tone: 'warn', message: excludedToolNoticeText(exclusion) });
+  } catch {
+    /* display-only */
+  }
+}
+
+const unavailableText = (exclusion) =>
+  `tool "${exclusion.name}" is unavailable with the current model: the provider rejected its input schema at ${exclusion.pointer || '/'} (${exclusion.reason}), so it was left out of the request; no call was sent. Use another tool, or ask the user to fix the tool's schema or disable it.`;
+
+/** Why `name` cannot be called in the session's current request, or null. */
+export function providerToolExclusionReason(sessionRef, name) {
+  if (!isSessionRef(sessionRef)) return null;
+  const state = sessions.get(sessionRef);
+  const key = String(name || '');
+  const exclusion = state?.current.get(key) || state?.dropped.get(key);
+  return exclusion ? unavailableText(exclusion) : null;
+}
+
+/** The provider rejected `exclusion.name`'s schema with an HTTP 400: leave the
+ *  tool out of every later request of the session and tell the user once. */
+export function dropSessionTool(sessionRef, exclusion, onStageChange) {
+  if (!isSessionRef(sessionRef)) return;
+  exclusionsFor(sessionRef).dropped.set(exclusion.name, exclusion);
+  recordProviderToolExclusion(sessionRef, exclusion, onStageChange);
+}
+
+/** The request's tool surface without the tools dropped for the session
+ *  ({ sendTools, requestToolScope }, the same objects when none apply). */
+export function withoutDroppedTools(sessionRef, { sendTools, requestToolScope }) {
+  const dropped = isSessionRef(sessionRef) ? sessions.get(sessionRef)?.dropped : null;
+  if (!dropped?.size) return { sendTools, requestToolScope };
+  const prefix = providerNativeToolPrefixCount(sendTools);
+  const kept = sendTools.filter((tool, index) => index < prefix || !dropped.has(tool?.name));
+  if (kept.length === sendTools.length) return { sendTools, requestToolScope };
+  const next = finalizeProviderRequestTools(kept, prefix);
+  return { sendTools: next, requestToolScope: { ...requestToolScope, requestTools: next } };
+}
+
+// The schema rule of the wire a session's requests use: 'gemini', 'anthropic'
+// (Messages), 'antigravity-claude' (Anthropic bridge behind Antigravity) or
+// 'openai' (Responses, Codex and every OpenAI-compatible chat route).
+function routeSchemaFamily(session) {
+  const provider = String(session?.provider || '').toLowerCase();
+  const wire = session?.wireRoute?.wire;
+  if (provider === 'antigravity-oauth' && isAntigravityClaude(session?.model)) return 'antigravity-claude';
+  if (provider === 'gemini' || isGeminiFamilyModel(session?.model)) return 'gemini';
+  if (ANTHROPIC_NATIVE_PROVIDERS.has(provider) || wire === 'messages') return 'anthropic';
+  return 'openai';
+}
+
+function wireExclusion(tool, result) {
+  return result.schema ? null : { name: tool.name, pointer: result.pointer || '/', reason: result.reason };
+}
+
+// The same normalization + validation the wire applies to `tool`, as
+// { name, pointer, reason } when the route leaves it out of its requests.
+function schemaExclusion(session, family, tool) {
+  switch (family) {
+    case 'gemini':
+      return geminiToolExclusion(tool);
+    case 'anthropic':
+      return anthropicToolExclusion(tool, String(session?.provider || 'anthropic').toLowerCase());
+    case 'antigravity-claude':
+      return wireExclusion(tool, claudeBridgeInputSchema(actionInputUnionFor(tool.inputSchema)));
+    default:
+      if (tool.inputSchema == null) return null;
+      if (/^openai(-oauth)?$/.test(String(session?.provider || '')) && isResponsesFreeformTool(tool)) return null;
+      return wireExclusion(tool, wireInputSchema(tool.inputSchema, 'openai'));
+  }
+}
+
+/** Why `tool` is left out of every request on the session's route, or null.
+ *  Validation is a pure function of the tool's schema and the route's wire, so
+ *  this holds before the tool was ever sent and stays stable across turns; a
+ *  tool the provider rejected with a 400 is dropped for the session. Built-in
+ *  tools are never excluded by the schema rule. */
+export function routeToolExclusionReason(session, tool) {
+  if (!tool) return null;
+  const dropped = isSessionRef(session) ? sessions.get(session)?.dropped.get(String(tool.name || '')) : null;
+  if (dropped) return unavailableText(dropped);
+  const exclusion = schemaExclusion(session, routeSchemaFamily(session), tool);
+  return exclusion ? unavailableText(exclusion) : null;
+}

package/src/runtime/agent/orchestrator/session/loop/request-boundary.mjs

@@ -14,6 +14,10 @@ import {
   providerNativeToolPrefixCount,
   runWithProviderRequestToolsScope,
 } from '../../runtime-core/provider-request-tools.mjs';
+import { TOOL_SURFACE_MIGRATION_INTENT } from '../../runtime-core/tool-exposure.mjs';
+import { migrateToolExposureAtBoundary } from './tool-exposure-migration.mjs';
+import { fixedRequestOverhead, fixedRequestOverheadInputs, resolveWorkerCompactPolicy } from './compact-policy.mjs';
+import { toolSurfaceExceedsContextError } from './context-overflow.mjs';
 
 const isDynamicTool = (tool) =>
   tool.deferLoading === true || tool.defer_loading === true || String(tool.name || '').startsWith('mcp__');
@@ -61,6 +65,18 @@ export async function prepareProviderRequest(state) {
   let compactChanged;
   let sendTools;
   let requestToolScope;
+  // Fixed inputs of the last passing overhead verdict in this boundary.
+  let passedOverheadInputs;
+  // A session persisted with another tool exposure migrates here, once, at a
+  // boundary with no pending calls: new surface and fixed guidance, a fresh
+  // tool snapshot and provider state, and a tagged cache break.
+  if (migrateToolExposureAtBoundary(sessionRef, messages)) {
+    fixedProviderToolSurface = null;
+    providerState = undefined;
+    providerStateCleared = true;
+    delete sessionRef.pendingCacheBreakIntent;
+    opts.cacheBreakIntent = TOOL_SURFACE_MIGRATION_INTENT;
+  }
   refreshDeferredMcpToolCatalog(sessionRef);
   do {
     // Provider-history normalization is part of the request boundary:
@@ -90,6 +106,20 @@ export async function prepareProviderRequest(state) {
       requestTools: sendTools,
       nativePrefixCount: providerNativeToolPrefixCount(sendTools),
     };
+    // A request whose fixed overhead alone leaves no room for history fails
+    // here with an actionable error: no compaction could make it fit. A
+    // passing verdict holds while its fixed inputs (tool schemas, protected
+    // system context, headroom, boundary) are unchanged — a later pass whose
+    // compaction only removed history (and the provider reading with it) is
+    // not re-judged — but adopted MCP schema changes or a re-rooted system
+    // prompt are.
+    const overheadPolicy = resolveWorkerCompactPolicy(sessionRef, sendTools);
+    const overheadInputs = fixedRequestOverheadInputs(overheadPolicy, messages);
+    if (overheadInputs === null || overheadInputs !== passedOverheadInputs) {
+      const overhead = fixedRequestOverhead(overheadPolicy, messages, sendTools, sessionRef);
+      if (overhead) throw toolSurfaceExceedsContextError({ sessionId, sessionRef, model, overhead });
+      passedOverheadInputs = overheadInputs;
+    }
     const pass = await runWithProviderRequestToolsScope(requestToolScope, () =>
       runPreSendCompactPass({
         provider,

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -17,6 +17,13 @@ import { stripInlineImages } from '../image-strip-recovery.mjs';
 import { runWithProviderRequestToolsScope } from '../../runtime-core/provider-request-tools.mjs';
 import { REPEAT_FAIL_LIMIT } from './loop-state.mjs';
 import { createToolCallIdResolver } from './tool-call-ids.mjs';
+import { captureSideQuestionRequest } from '../side-question-store.mjs';
+import {
+  beginProviderToolExclusions,
+  dropSessionTool,
+  recordProviderToolExclusion,
+  withoutDroppedTools,
+} from './provider-tool-exclusions.mjs';
 
 /**
  * Open an iteration: refresh the live cwd, drain queued steering after a
@@ -73,6 +80,8 @@ export async function beginIteration(state) {
     loopUsageMetricsTurnId: state.usageMetricsTurnId,
     loopUsageMetricsEpoch: state.usageMetricsEpoch,
   });
+  // A tool the provider rejected with a schema 400 stays out of the session.
+  Object.assign(boundary, withoutDroppedTools(sessionRef, boundary));
   state.iterations = boundary.iterations;
   state.lastUsage = boundary.lastUsage;
   state.firstTurnUsage = boundary.firstTurnUsage;
@@ -92,6 +101,10 @@ export async function beginIteration(state) {
   // callers omit the flag and retain legacy live deferred resolution.
   opts.providerToolSnapshotAuthoritative = true;
   opts.providerNativeToolPrefixCount = boundary.requestToolScope.nativePrefixCount;
+  // A tool the provider leaves out of this request (a schema it cannot
+  // accept) is noticed once per session and refused if the model calls it.
+  beginProviderToolExclusions(sessionRef);
+  opts.onToolExcluded = (exclusion) => recordProviderToolExclusion(sessionRef, exclusion, opts.onStageChange);
   state.lastSendTools = boundary.sendTools;
   // Eager-dispatch queue (see ../eager-dispatch.mjs): read-only tools start
   // the instant the provider streams a tool-call event; writes and unknown
@@ -156,26 +169,46 @@ export async function sendProviderRequest(state, round) {
   try {
     opts.onProviderSendStarted?.();
   } catch {}
-  const result = await runWithProviderRequestToolsScope(round.requestToolScope, () =>
-    sendWithRecovery({
-      provider,
-      messages: providerMessages,
-      recoveryMessages: messageSource,
-      model,
-      sendTools: round.sendTools,
-      tools: round.sendTools,
-      opts,
-      sessionId,
-      sessionRef,
-      nextIteration: round.nextIteration,
-      contextOverflowRetryUsed: state.contextOverflowRetryUsed,
-      transportRetriesUsed: state.transportRetriesUsed,
-      transportRetryMax: state.transportRetryMax,
-      imageStripUsed: state.imageStripUsed,
-      thinkingReplayRepairUsed: state.thinkingReplayRepairUsed,
-      signal: state.signal,
-    })
-  );
+  // The request a /btw side question forks: kept while it is in flight, with
+  // its reply once it proceeds, and dropped again if it fails.
+  const sideQuestion = captureSideQuestionRequest({
+    sessionId,
+    sessionRef,
+    provider,
+    model,
+    messages: providerMessages,
+    tools: round.sendTools,
+    opts,
+  });
+  let result;
+  try {
+    result = await runWithProviderRequestToolsScope(round.requestToolScope, () =>
+      sendWithRecovery({
+        provider,
+        messages: providerMessages,
+        recoveryMessages: messageSource,
+        model,
+        sendTools: round.sendTools,
+        tools: round.sendTools,
+        opts,
+        sessionId,
+        sessionRef,
+        nextIteration: round.nextIteration,
+        contextOverflowRetryUsed: state.contextOverflowRetryUsed,
+        transportRetriesUsed: state.transportRetriesUsed,
+        transportRetryMax: state.transportRetryMax,
+        imageStripUsed: state.imageStripUsed,
+        thinkingReplayRepairUsed: state.thinkingReplayRepairUsed,
+        toolSchemaDropUsed: state.toolSchemaDropUsed,
+        signal: state.signal,
+      })
+    );
+  } catch (error) {
+    sideQuestion?.discard();
+    throw error;
+  }
+  if (result.action === 'proceed') sideQuestion?.settle(result.response);
+  else sideQuestion?.discard();
   return {
     result,
     providerMessages,
@@ -217,6 +250,16 @@ export function applyRetryAction(state, result) {
       // transport budget is consumed: nothing was generated.
       state.thinkingReplayRepairUsed = true;
       return true;
+    case 'retry_tool_schema_drop':
+      // The provider named a tool whose schema it rejects: the session drops
+      // it (with the notice) and the turn is rebuilt without it, once. The
+      // frozen tool surface and provider state are rebuilt around the change.
+      state.toolSchemaDropUsed = true;
+      dropSessionTool(state.sessionRef, result.exclusion, state.opts.onStageChange);
+      state.fixedProviderToolSurface = null;
+      state.providerState = undefined;
+      state.providerStateUpdated = true;
+      return true;
     case 'retry_image_strip':
       state.transportRetriesUsed += 1;
       state.imageStripUsed = true;

package/src/runtime/agent/orchestrator/session/loop/step-auto-effort.mjs

@@ -16,7 +16,7 @@
 import { resolveAutoEffort } from '../../providers/auto-effort.mjs';
 import { isCustomProviderName, resolveCustomReasoning } from '../../providers/custom-reasoning.mjs';
 import { autoEffortModel, stepEffortConfiguration } from '../../providers/effort-configuration.mjs';
-import { effortOptionsFor } from '../../runtime-core/effort.mjs';
+import { effortOptionsFor, warnEmptyAutoEffortLadder } from '../../runtime-core/effort.mjs';
 import { judgeTurn, recordEffortDecision } from '../../../../effort-judge/judge-client.mjs';
 import { stepResultWindow } from '../../../../effort-judge/judge-input.mjs';
 
@@ -174,6 +174,7 @@ function stepResult({ auto, snapshot, step, provider, model, providerClient, ses
     ms: judged.ms,
     probs: judged.probs.map((value) => Number(value.toFixed(3))),
   });
+  if (!resolved) warnEmptyAutoEffortLadder(provider, model, auto.base);
   if (isCustomProviderName(provider)) {
     const level =
       resolved &&

package/src/runtime/agent/orchestrator/session/loop/tool-call-resolution.mjs

@@ -0,0 +1,95 @@
+// Execution-call projection for the fixed tool bridge. A wire call
+// `call_tool {name: T, arguments: A}` (id X) becomes the execution call
+// `{ id: X, name: T, arguments: A, wireCall }` before eager admission and
+// classification, so every policy, ordering, cache, hook, approval and audit
+// layer sees the target itself. The tool result still answers wire id X and
+// the transcript keeps the original wire call (`wireCall`, an immutable copy).
+// Non-bridge sessions and every other call pass through unchanged.
+import { formatInvalidToolArgsResult, isInvalidToolArgsMarker } from '../../providers/lib/openai-tool-args.mjs';
+import {
+  BRIDGE_CALL_TOOL_NAME,
+  bridgeErrorText,
+  isToolBridgeEnabled,
+  resolveBridgeTarget,
+} from '../../runtime-core/tool-bridge.mjs';
+
+const CALL_TOOL_KEYS = new Set(['name', 'arguments']);
+
+const isPlainObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+
+function deepFreeze(value) {
+  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const key of Object.keys(value)) deepFreeze(value[key]);
+  }
+  return value;
+}
+
+function projectionFailure(wireCall, wire, text) {
+  return { id: wireCall.id, name: wireCall.name, arguments: wireCall.arguments, wireCall: wire, bridgeError: text };
+}
+
+/**
+ * @returns the execution call for `wireCall`: the projected target call, a
+ *   call carrying `bridgeError` (answered with that error, never executed),
+ *   or `wireCall` itself when no projection applies. Idempotent.
+ */
+export function resolveExecutionToolCall(wireCall, session) {
+  if (!wireCall || wireCall.name !== BRIDGE_CALL_TOOL_NAME || wireCall.wireCall || !isToolBridgeEnabled(session)) {
+    return wireCall;
+  }
+  const wire = deepFreeze(structuredClone(wireCall));
+  const args = wireCall.arguments;
+  if (isInvalidToolArgsMarker(args)) return projectionFailure(wireCall, wire, formatInvalidToolArgsResult(wireCall));
+  if (!isPlainObject(args)) {
+    return projectionFailure(
+      wireCall,
+      wire,
+      bridgeErrorText('INVALID_ARGUMENTS', 'call_tool requires {name, arguments}.')
+    );
+  }
+  const extra = Object.keys(args).filter((key) => !CALL_TOOL_KEYS.has(key));
+  if (extra.length) {
+    return projectionFailure(
+      wireCall,
+      wire,
+      bridgeErrorText('INVALID_ARGUMENTS', `call_tool does not accept: ${extra.join(', ')}.`)
+    );
+  }
+  if (!isPlainObject(args.arguments)) {
+    return projectionFailure(
+      wireCall,
+      wire,
+      bridgeErrorText('INVALID_ARGUMENTS', 'call_tool arguments must be an object of the target tool arguments.')
+    );
+  }
+  const target = resolveBridgeTarget(session, args.name);
+  if (target.error) return projectionFailure(wireCall, wire, bridgeErrorText(target.error.code, target.error.message));
+  const call = { id: wireCall.id, name: target.name, arguments: structuredClone(args.arguments), wireCall: wire };
+  // The target definition drives read-only classification of the call; it is
+  // never serialized with the call.
+  Object.defineProperty(call, 'bridgeTool', { value: target.tool, enumerable: false });
+  return call;
+}
+
+export function resolveExecutionToolCalls(calls, session) {
+  return Array.isArray(calls) ? calls.map((call) => resolveExecutionToolCall(call, session)) : calls;
+}
+
+/**
+ * The classification tool list for `calls`: `tools` plus the definitions of
+ * bridged targets that are not on it, so a bridged target is classified
+ * (read-only, dedup, stale-read invalidation) exactly like a direct call.
+ */
+export function bridgeClassificationTools(tools, calls) {
+  const base = Array.isArray(tools) ? tools : [];
+  const seen = new Set(base.map((tool) => tool?.name));
+  const extra = [];
+  for (const call of calls || []) {
+    const definition = call?.bridgeTool;
+    if (!definition || seen.has(definition.name)) continue;
+    seen.add(definition.name);
+    extra.push(definition);
+  }
+  return extra.length ? [...base, ...extra] : tools;
+}

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -4,11 +4,12 @@
  */
 import { resolvePreToolAskApproval } from '../tool-helpers.mjs';
 import { runAbortable, throwIfAborted } from '../../../../../shared/abort-race.mjs';
+import { evaluateExecPolicy } from '../../../tools/bash-policy-scan.mjs';
 import { beginSessionApprovalWait } from '../../manager/runtime-liveness.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
-async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision }) {
+async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision, keepArgs = false }) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
   // While the user decides, the session is waiting on them, not working.
   const releaseApprovalWait = beginSessionApprovalWait(callerSessionId);
@@ -30,10 +31,35 @@ async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHoo
   }
   if (askOutcome.denial) return { denial: askOutcome.denial };
   const approval = askOutcome.approval;
-  if (approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
+  if (!keepArgs && approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
   return null;
 }
 
+/**
+ * Approval gate for a shell call (or a terminal `run`) whose exec policy
+ * decision is 'ask' (elevated launch). Runs after the final call is known. The
+ * approval is granted for the exact command being asked about: an approval
+ * reply cannot rewrite the args.
+ * @returns {Promise<{ denial: string } | { elevationApproved: boolean }>}
+ */
+export async function applyShellElevationGate(call, { callerSessionId, executeOpts, toolApprovalHook }) {
+  const gated = call.name === 'shell' || (call.name === 'terminal' && call.args?.action === 'run');
+  if (!gated || !isArgsObject(call.args) || call.args.command == null) {
+    return { elevationApproved: false };
+  }
+  const decision = evaluateExecPolicy(String(call.args.command));
+  if (decision.decision !== 'ask') return { elevationApproved: false };
+  const denied = await askApproval(call, {
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+    decision,
+    keepArgs: true,
+  });
+  if (denied) return denied;
+  return { elevationApproved: true };
+}
+
 /**
  * @returns {Promise<{ denial: string } | { name: string, args: any }>}
  *   the call as the hook left it, or the denial text to return instead
@@ -48,7 +74,8 @@ export async function applyBeforeToolHook({
   toolApprovalHook,
 }) {
   const call = { name, args, cwd };
-  if (!beforeToolHook) return call;
+  // ask_user is itself the user prompt; it never goes through the ordinary approval gate.
+  if (!beforeToolHook || name === 'ask_user') return call;
   try {
     const decision = await runAbortable(executeOpts.signal, () =>
       beforeToolHook(