mixdog 1.2.2 → 1.2.3

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -35,13 +35,19 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
   });
 }
 
-function dispatchInternal(name, args, { cwd, callerSessionId, sessionRef, executeOpts, notifyFn, toolApprovalHook }) {
+function dispatchInternal(
+  name,
+  args,
+  { cwd, callerSessionId, sessionRef, executeOpts, notifyFn, toolApprovalHook, elevationApproved }
+) {
   // callerSessionId propagates into server.mjs dispatchTool so that
   // dispatchAiWrapped can detect and reject recursive calls from a
   // hidden-role session (recall/search → self).
   return executeInternalTool(name, args, {
     scopeId: sessionRef?.mcpScopeId || null,
     callerSessionId,
+    // The calling session itself: bridge tools answer within its scope.
+    callerSession: sessionRef || null,
     callerCwd: cwd,
     setCallerCwd: async (nextCwd) => {
       const applyForCaller = sessionRef?._applyResolvedCwdForCaller;
@@ -58,6 +64,8 @@ function dispatchInternal(name, args, { cwd, callerSessionId, sessionRef, execut
     notifyFn,
     toolApprovalHook,
     toolCallId: executeOpts.toolCallId || null,
+    // Runtime-granted for this call only (terminal run); never from model args.
+    elevationApproved: elevationApproved === true,
     invocationSource: 'model-tool',
   });
 }
@@ -90,9 +98,12 @@ export function dispatchToolCall({ name, args }, ctx) {
   // variants) adapt to a native execution inside executeBuiltinTool's default
   // case; on a shape mismatch it falls back to the redirect guidance message.
   if (name === 'shell' || isBuiltinTool(name) || isExternalAdapterTool(name)) {
-    const builtinOpts = executeOpts.suppressReadUnchangedStub
-      ? { ...completionToolOpts, suppressReadUnchangedStub: true }
-      : completionToolOpts;
+    const builtinOpts = {
+      ...completionToolOpts,
+      ...(executeOpts.suppressReadUnchangedStub ? { suppressReadUnchangedStub: true } : {}),
+      // Runtime-granted only; any value inherited from executeOpts is overridden.
+      elevationApproved: ctx.elevationApproved === true,
+    };
     return executeBuiltinTool(name, args, cwd, builtinOpts);
   }
   return formatUnknownBuiltinToolMessage(name, args, 'tool');

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -8,12 +8,13 @@
 import { isMcpTool } from '../../mcp/client.mjs';
 import { prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
 import { refreshDeferredMcpToolCatalog } from '../../runtime-core/tool-catalog.mjs';
+import { bridgeTargetUnavailable } from '../../runtime-core/tool-bridge.mjs';
 import { preDispatchDenyForSession, routeWebFetchCall } from './pre-dispatch-deny.mjs';
 import { runWithToolExecutionOwner } from '../../../../shared/tool-execution-owner.mjs';
 import { runWithLocalSearchTelemetry } from '../../tools/builtin/local-search-telemetry.mjs';
 import { throwIfAborted } from '../../../../shared/abort-race.mjs';
 import { prepareToolCall } from './tool-exec/call-prep.mjs';
-import { applyBeforeToolHook } from './tool-exec/before-hook.mjs';
+import { applyBeforeToolHook, applyShellElevationGate } from './tool-exec/before-hook.mjs';
 import { dispatchToolCall } from './tool-exec/dispatch.mjs';
 import { applyAfterToolHook } from './tool-exec/after-hook.mjs';
 import { runReadOnlyIoWithDeadline } from './tool-exec/read-only-deadline.mjs';
@@ -65,6 +66,18 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
   if (isMcpTool(call.name)) refreshDeferredMcpToolCatalog(sessionRef);
   const deferredPrep = prepareDeferredToolCallThrough(sessionRef, call.name);
   if (deferredPrep?.deny) return deferredPrep.deny;
+  // A bridged target was resolved when its call_tool was projected; it must
+  // still be available in this session's scope (also after a hook rewrite).
+  // The authorized identity is the public tool name, not its transport
+  // (web_fetch routed to local_fetch/image_fetch stays web_fetch here).
+  if (executeOpts.bridgeWireCall) {
+    const unavailable = bridgeTargetUnavailable(sessionRef, finalCall.schemaName || finalCall.name);
+    if (unavailable) return unavailable;
+  }
+  // Elevated launches ask the user first; denied / no approval UI refuses the call.
+  const elevation = await applyShellElevationGate(call, { callerSessionId, executeOpts, toolApprovalHook });
+  if (elevation.denial) return elevation.denial;
+  throwIfAborted(executeOpts.signal);
   const result = await runReadOnlyIoWithDeadline(call.name, executeOpts.signal || null, async (deadlineSignal) => {
     let callOpts = executeOpts;
     if (deadlineSignal !== executeOpts.signal) {
@@ -80,6 +93,7 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
       completionToolOpts,
       notifyFn,
       toolApprovalHook,
+      elevationApproved: elevation.elevationApproved === true,
     });
   });
   return applyAfterToolHook(result, hookFrom(executeOpts, sessionRef, 'afterToolHook'), {

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -0,0 +1,150 @@
+// Tool-exposure migration (native ↔ bridge-v1, and pre-versioned fixed
+// surfaces → bridge-v1). The surface itself is rebuilt by
+// applyDeferredToolSurface; this module adds what a changed request prefix
+// invalidates: provider state, the prefix guard, the context baseline and the
+// cache-break tag. Historical tool calls are never rewritten.
+import {
+  applyDeferredToolSurface,
+  rebuildDeferredToolSurfaceForProvider,
+} from '../../runtime-core/tool-catalog.mjs';
+import {
+  bridgeSurfaceOutdated,
+  sessionToolExposure,
+  TOOL_EXPOSURE_BRIDGE,
+  TOOL_SURFACE_MIGRATION_INTENT,
+  toolExposureMigrationNeeded,
+  toolExposureModeForProvider,
+} from '../../runtime-core/tool-exposure.mjs';
+import { applyInitialDeferredToolManifestToBp2 } from '../../context/collect.mjs';
+import { isAgentOwner } from '../../agent-owner.mjs';
+import { honoredSchemaAllowlist } from '../manager/session-tool-surface.mjs';
+import { syncSystemPrefix } from '../manager/prompt-utils.mjs';
+import { invalidateProviderContextBaseline } from './compact-policy.mjs';
+
+/** Drop everything measured against the previous tool surface. */
+function invalidateForToolSurfaceMigration(session) {
+  delete session.providerState;
+  delete session._providerPrefixGuardState;
+  invalidateProviderContextBaseline(session);
+  session.updatedAt = Date.now();
+}
+
+/**
+ * After a surface re-apply outside a request (resume, provider switch)
+ * migrated the exposure: the first send of the next turn carries the tag.
+ */
+export function markToolSurfaceMigrated(session) {
+  invalidateForToolSurfaceMigration(session);
+  session.pendingCacheBreakIntent = TOOL_SURFACE_MIGRATION_INTENT;
+}
+
+/** Provider switch: rebuild the surface for `provider`, migrating bridge ↔ native. */
+export function rebuildToolSurfaceForProviderWithMigration(session, provider) {
+  if (!session) return false;
+  const migrating = toolExposureMigrationNeeded(session, provider);
+  rebuildDeferredToolSurfaceForProvider(session, provider);
+  if (migrating) markToolSurfaceMigrated(session);
+  return migrating;
+}
+
+// The latest assistant tool turn still waits for a result: not a safe boundary.
+function hasUnansweredToolCalls(messages) {
+  const list = Array.isArray(messages) ? messages : [];
+  const index = list.findLastIndex((message) => message?.role === 'assistant' && message.toolCalls?.length);
+  if (index < 0) return false;
+  const answered = new Set(
+    list.slice(index + 1).flatMap((message) => (message?.role === 'tool' ? [message.toolCallId] : []))
+  );
+  return list[index].toolCalls.some((call) => call?.id && !answered.has(call.id));
+}
+
+/**
+ * Request-boundary migration of a live session whose persisted exposure
+ * differs from its provider's. `messages` is the transcript the request is
+ * built from; the fixed-guidance rewrite lands there (and on the session).
+ * Returns true when the surface changed; the caller drops its frozen tool
+ * snapshot and provider state and tags the send.
+ */
+export function migrateToolExposureAtBoundary(session, messages) {
+  if (!session || !toolExposureMigrationNeeded(session) || hasUnansweredToolCalls(messages)) return false;
+  const stored = session.messages;
+  const working = Array.isArray(messages) ? messages : stored;
+  if (Array.isArray(working)) session.messages = working;
+  try {
+    applyDeferredToolSurface(session, session.deferredSurfaceMode || 'lead', [], {
+      provider: session.provider,
+      model: session.model,
+    });
+  } finally {
+    if (Array.isArray(working) && session.messages !== working) {
+      // The rewrite may drop an emptied system message: keep the request
+      // transcript array identity the loop holds.
+      working.splice(0, working.length, ...session.messages);
+    }
+    session.messages = stored;
+  }
+  // The rewritten prompt messages are fresh objects; the canonical transcript
+  // the save path persists takes them too, so the next save writes the new
+  // prompt together with the new exposure.
+  if (Array.isArray(stored) && Array.isArray(working) && stored !== working) syncSystemPrefix(stored, working);
+  invalidateForToolSurfaceMigration(session);
+  return true;
+}
+
+// Bridge state an agent surface carries; dropped when it returns to the full array.
+const AGENT_BRIDGE_FIELDS = [
+  'toolExposureMode',
+  'deferredProviderMode',
+  'deferredNativeTools',
+  'deferredSurfaceMode',
+  'deferredToolUsage',
+  'deferredDefaultTools',
+  'deferredSelectedTools',
+  'deferredDiscoveredTools',
+  'deferredCallableTools',
+  'deferredAnnouncedTools',
+  'deferredToolDeltaRevision',
+  'nativeDeferredDiscovery',
+  'mcpServerInstructions',
+];
+
+/**
+ * Agent (worker) sessions. Call right after their tools were resolved
+ * (create, resume, route change): on a bridge provider the eager surface
+ * becomes the full-mode core plus the bridge, built only from those
+ * role/policy-filtered tools; a native provider keeps the full array. A
+ * session honouring its own schema allowlist (a hidden specialist role) is
+ * already a small explicit surface and keeps it. `existing`: the session had
+ * a surface before, so a changed exposure is a migration.
+ */
+export function applyAgentToolExposure(session, { existing = false } = {}) {
+  if (!session || !Array.isArray(session.tools) || !isAgentOwner(session)) return false;
+  const before = sessionToolExposure(session);
+  const allowlisted = honoredSchemaAllowlist(session.schemaAllowedTools, { ownerIsAgent: true, agent: session.agent });
+  const bridge =
+    !allowlisted && toolExposureModeForProvider(session.provider, session.wireRoute) === TOOL_EXPOSURE_BRIDGE;
+  if (!bridge && before === null) return false;
+  // A surface an earlier bridge revision built is rebuilt now.
+  const outdated = bridgeSurfaceOutdated(session);
+  // The tools just resolved are the whole authority: no earlier catalog, MCP
+  // availability snapshot or pending MCP delta survives. (A bridge surface
+  // re-takes the snapshot at its next request boundary; a native agent has no
+  // refresh, so a stale snapshot would hide a connected server's tools.)
+  delete session.deferredToolCatalog;
+  delete session.deferredLateToolCatalog;
+  delete session.deferredMcpToolNames;
+  delete session.pendingDeferredToolDelta;
+  if (bridge) {
+    // The resolved list may be shared (prepared-resume cache): rebuild a copy.
+    session.tools = session.tools.slice();
+    applyDeferredToolSurface(session, 'full', [], { provider: session.provider, model: session.model });
+  } else {
+    for (const field of AGENT_BRIDGE_FIELDS) delete session[field];
+    // Without bridge state the fixed slot composes empty: the guidance goes.
+    if (Array.isArray(session.messages)) applyInitialDeferredToolManifestToBp2(session, [], { rebuild: true });
+    delete session.deferredToolBp2Applied;
+  }
+  const changed = before !== sessionToolExposure(session) || outdated;
+  if (existing && changed) markToolSurfaceMigrated(session);
+  return changed;
+}

package/src/runtime/agent/orchestrator/session/loop/tool-phase.mjs

@@ -8,6 +8,7 @@ import { traceLoopPhaseTiming } from './diagnostics.mjs';
 import { processToolBatch } from '../tool-batch.mjs';
 import { CROSS_TURN_CAP, REPEAT_FAIL_LIMIT } from './loop-state.mjs';
 import { markStepEffort } from './step-auto-effort.mjs';
+import { resolveExecutionToolCalls } from './tool-call-resolution.mjs';
 
 function isSleepLikeToolCall(call) {
   const name = String(call?.name || call?.toolName || call?.function?.name || '').toLowerCase();
@@ -34,7 +35,9 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   }
   // Per-turn batch shape — one row per assistant turn so trace consumers can
   // derive the multi-tool adoption ratio without scanning message bodies.
-  const toolBatchId = recordToolBatch(sessionId, calls, state.iterations);
+  // Audit records what runs: a bridged call_tool is recorded as its target.
+  // The wire calls stay the transcript identity (assistant turn below).
+  const toolBatchId = recordToolBatch(sessionId, resolveExecutionToolCalls(calls, sessionRef), state.iterations);
   await Promise.resolve(onToolCall?.(state.iterations, calls));
   const assistantTurnMsg = buildToolCallAssistantMessage(response, { calls, suppressMidTurnText, opts });
   commitAssistantMessage(messages, assistantTurnMsg, opts);

package/src/runtime/agent/orchestrator/session/manager/ask-turn-auto-effort.mjs

@@ -15,7 +15,7 @@ import {
   resolveAutoEffort,
 } from '../../providers/auto-effort.mjs';
 import { builtinFeatureActive } from '../../runtime-core/builtin-features.mjs';
-import { effortOptionsFor } from '../../runtime-core/effort.mjs';
+import { effortOptionsFor, warnEmptyAutoEffortLadder } from '../../runtime-core/effort.mjs';
 import { effortJudgeSupportsSteps, judgeTurn, recordEffortDecision } from '../../../../effort-judge/judge-client.mjs';
 import { promptContentText } from './prompt-utils.mjs';
 
@@ -98,6 +98,7 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
   // the judge is not asked (in observe mode too: nothing would be logged).
   if (!autoEffortApplicable({ base, options })) {
     recordEffortDecision({ ...record, skipped: 'default-outside-auto-range' });
+    warnEmptyAutoEffortLadder(session.provider, session.model, base);
     return null;
   }
   // The previous user request shows the work a short follow-up continues.

package/src/runtime/agent/orchestrator/session/manager/ask-turn-commit.mjs

@@ -120,22 +120,44 @@ function recordAgentRuntimeCall(session, result) {
 export async function recordAskUsage({ session, result, askStartedAt, turnSignal }) {
   const prefixHashForLog = recordAgentRuntimeCall(session, result);
   if (!result.usage) return;
-  const inputTokens = result.usage.inputTokens || 0;
-  const outputTokens = result.usage.outputTokens || 0;
-  const cacheReadTokens = result.usage.cachedTokens || 0;
-  const cacheWriteTokens = result.usage.cacheWriteTokens || 0;
+  await logSessionLlmUsage({
+    session,
+    usage: result.usage,
+    startedAt: askStartedAt,
+    signal: turnSignal,
+    prefixHash: prefixHashForLog,
+    transportTiming: result.transportTiming || null,
+  });
+  recordStandaloneStatusTelemetry(session, result, Date.now() - askStartedAt);
+}
+
+/** The usage-ledger row of one provider call billed to `session`. `mode`
+ *  labels a call made outside the turn loop (a /btw side question). */
+export async function logSessionLlmUsage({
+  session,
+  usage,
+  startedAt,
+  signal = null,
+  prefixHash = null,
+  transportTiming = null,
+  mode = null,
+}) {
+  const inputTokens = usage.inputTokens || 0;
+  const outputTokens = usage.outputTokens || 0;
+  const cacheReadTokens = usage.cachedTokens || 0;
+  const cacheWriteTokens = usage.cacheWriteTokens || 0;
   // Unified total-prompt field. Anthropic = input+cache_read+cache_write
   // (additive); OpenAI OAuth/API/Gemini = input_tokens already includes the
   // cached portion (inclusive), so the fallback must not double-count.
   const { isInclusiveProvider, computeCostUsd } = await runAbortable(
-    turnSignal,
+    signal,
     () => import('../../../../shared/llm/cost.mjs')
   );
   const inclusive = isInclusiveProvider(session.provider);
   let promptTokens = inputTokens + cacheReadTokens + cacheWriteTokens;
-  if (typeof result.usage.promptTokens === 'number') promptTokens = result.usage.promptTokens;
+  if (typeof usage.promptTokens === 'number') promptTokens = usage.promptTokens;
   else if (inclusive) promptTokens = Math.max(inputTokens, cacheReadTokens + cacheWriteTokens);
-  let costUsd = result.usage.costUsd || 0;
+  let costUsd = usage.costUsd || 0;
   if (!costUsd) {
     try {
       costUsd = computeCostUsd({
@@ -145,7 +167,7 @@ export async function recordAskUsage({ session, result, askStartedAt, turnSignal
         outputTokens,
         cacheReadTokens,
         cacheWriteTokens,
-        cacheWrite1hTokens: result.usage.cacheWrite1hTokens || 0,
+        cacheWrite1hTokens: usage.cacheWrite1hTokens || 0,
       });
     } catch {
       /* best-effort */
@@ -158,7 +180,8 @@ export async function recordAskUsage({ session, result, askStartedAt, turnSignal
     preset: session.presetName || null,
     model: session.model,
     provider: session.provider,
-    duration: Date.now() - askStartedAt,
+    ...(mode ? { mode } : {}),
+    duration: Date.now() - startedAt,
     profileId: session.profileId || null,
     sessionId: session.id,
     inputTokens,
@@ -166,11 +189,10 @@ export async function recordAskUsage({ session, result, askStartedAt, turnSignal
     cacheReadTokens,
     cacheWriteTokens,
     promptTokens,
-    prefixHash: prefixHashForLog,
+    prefixHash,
     costUsd,
-    transportTiming: result.transportTiming || null,
+    transportTiming,
   });
-  recordStandaloneStatusTelemetry(session, result, Date.now() - askStartedAt);
 }
 
 /** Persist opaque providerState for stateful providers. The update bit

package/src/runtime/agent/orchestrator/session/manager/ask-turn-execute.mjs

@@ -5,6 +5,7 @@
 // (runAskAgentLoop). Provider-not-available and trim failures throw here so
 // the caller marks the session errored instead of leaving stage='connecting'.
 import { getProvider } from '../../providers/registry.mjs';
+import { pinSessionWireRoute } from '../../providers/wire-route.mjs';
 import { notifySkillsApplied, prepareExplicitSkills, recordAppliedSkills } from '../explicit-skills.mjs';
 import { prepareTurnEffortConfiguration } from '../../providers/effort-configuration.mjs';
 import { resolveTurnAutoEffort, turnStepAutoEffort } from './ask-turn-auto-effort.mjs';
@@ -17,6 +18,7 @@ import { applyTurnContextMeta, buildUserTurn, startProviderPrewarm, traceTurnCon
 import { rewindUnansweredPrompt } from './failed-turn-rewind.mjs';
 import { buildAgentLoopOptions, trackedToolCallHook } from './ask-turn-loop-options.mjs';
 import { _api_call_with_interrupt } from './ask-call-interrupt.mjs';
+import { backfillFallbackSessionTitle } from './session-fallback-title.mjs';
 
 /** Resolves the provider, builds the user turn and pre-commits it; returns
  *  what the loop and the commit need from this preparation. */
@@ -27,6 +29,10 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
   // Register the live session object for synchronous close snapshots.
   runtime.session = session;
   if (!provider) throw new Error(`Provider "${session.provider}" not available`);
+  // The session's wire is pinned before its first request (an existing
+  // session keeps the wire it started on); read from the history as the turn
+  // found it, awaited with the user turn below.
+  const wireRoutePending = pinSessionWireRoute(session, provider);
   // The turn-level judgment runs while the rest of the turn is prepared; it
   // reads the session as the turn found it (synchronously, on this call).
   // The first request still carries its decision: it is awaited below,
@@ -65,6 +71,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
       turnPromptSource: input.promptSource,
       effortConfiguration: null,
     }),
+    wireRoutePending,
   ]);
   const turnEffort = autoEffort?.applied ? autoEffort.effort : session.effort || null;
   const effortConfiguration = prepareTurnEffortConfiguration(
@@ -107,6 +114,14 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
   // user turn is introduced.
   session.messages = filterModelVisibleSessionMessages(outgoing);
   session.liveTurnMessages = outgoing;
+  // Name a titleless session from its first human prompt before the first
+  // save, so the title outlives any later compaction of the transcript. The
+  // earliest human turn already in the history wins; this turn's prompt is the
+  // fallback (runtime-injected turns carrying a promptSource never name it).
+  backfillFallbackSessionTitle(session, [
+    ...historyMessages,
+    ...(input.promptSource ? [] : [{ role: 'user', content: input.prompt }]),
+  ]);
   session.activeTurnCheckpoint = {
     version: 1,
     turnToken,
@@ -147,6 +162,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
     beforeCount: historyMessages.length + 1,
     deferredToolDelta: userTurn.deferredToolDelta,
     goalReminder: userTurn.goalReminder,
+    workspaceNotice: userTurn.workspaceNotice,
   };
 }
 

package/src/runtime/agent/orchestrator/session/manager/ask-turn-loop-options.mjs

@@ -18,6 +18,53 @@ const relay = (fn, ...args) => {
   }
 };
 
+/**
+ * The callback-free send options that shape a turn's provider request (effort,
+ * model parameters, cache routing, continuation state, Codex wire identity and
+ * the session's provider cache settings). agentLoop's options spread them, and
+ * a /btw request built before any turn has run uses them as they are.
+ */
+export function buildRequestSendOptions({
+  sessionId,
+  session,
+  turnEffort,
+  effortConfiguration,
+  stepAutoEffort,
+  codexTurnId,
+  startedAtMs,
+  signal,
+}) {
+  return {
+    effort: turnEffort,
+    effortConfiguration,
+    // { request, base } when each tool-result step is judged (step-auto-effort.mjs).
+    stepAutoEffort: stepAutoEffort || null,
+    fast: session.fast === true,
+    modelParameters: session.modelParameters || {},
+    selectedContextWindow: session.selectedContextWindow || session.contextWindow || null,
+    sessionId,
+    // Same projection compaction uses, so a session presents one identity on
+    // every request it makes.
+    ...(codexWireSendOpts(session, { turnId: codexTurnId, startedAtMs }) || {}),
+    promptCacheKey: session.promptCacheKey || sessionId,
+    // Provider-scoped cache key (mixdog-codex, mixdog-claude…). Distinct
+    // from sessionId — providers that pool sockets per-session (openai-oauth
+    // WS) use sessionId as the pool bucket and providerCacheKey as the
+    // server-side prompt-cache shard so parallel callers don't collide on a
+    // mid-turn socket while still sharing prefix cache.
+    providerCacheKey: session.promptCacheKey || null,
+    signal,
+    providerState: session.providerState ?? undefined,
+    // The wire this session is pinned to (wire-route.mjs).
+    wireRoute: session.wireRoute ?? undefined,
+    session,
+    // Agent Runtime cache settings — merged last so session overrides don't
+    // get overridden by defaults. When session has no profile,
+    // providerCacheOpts is null and this spread is a no-op.
+    ...(session.providerCacheOpts || {}),
+  };
+}
+
 /**
  * @param {object} input
  * @param {string} input.sessionId
@@ -49,14 +96,6 @@ export function buildAgentLoopOptions({
   // (ask-turn-steering-drain.mjs).
   const drainSteering = createAskSteeringDrain({ sessionId, turn, askOpts });
   return {
-    effort: turnEffort,
-    effortConfiguration,
-    // { request, base } when each tool-result step is judged (step-auto-effort.mjs).
-    stepAutoEffort: stepAutoEffort || null,
-    fast: session.fast === true,
-    modelParameters: session.modelParameters || {},
-    selectedContextWindow: session.selectedContextWindow || session.contextWindow || null,
-    sessionId,
     onTextDelta: (chunk) => {
       interruption.recordTextDelta(chunk);
       checkpoint.schedule();
@@ -157,23 +196,16 @@ export function buildAgentLoopOptions({
       relay(askOpts?.onSkillsApplied, names, detail);
     },
     notifyFn: optionalFn(askOpts?.notifyFn),
-    // Same projection compaction uses, so a session presents one identity on
-    // every request it makes.
-    ...(codexWireSendOpts(session, { turnId: codexTurnId, startedAtMs }) || {}),
-    promptCacheKey: session.promptCacheKey || sessionId,
-    // Provider-scoped cache key (mixdog-codex, mixdog-claude…). Distinct
-    // from sessionId — providers that pool sockets per-session (openai-oauth
-    // WS) use sessionId as the pool bucket and providerCacheKey as the
-    // server-side prompt-cache shard so parallel callers don't collide on a
-    // mid-turn socket while still sharing prefix cache.
-    providerCacheKey: session.promptCacheKey || null,
-    signal,
-    providerState: session.providerState ?? undefined,
-    session,
-    // Agent Runtime cache settings — merged last so session overrides don't
-    // get overridden by defaults. When session has no profile,
-    // providerCacheOpts is null and this spread is a no-op.
-    ...(session.providerCacheOpts || {}),
+    ...buildRequestSendOptions({
+      sessionId,
+      session,
+      turnEffort,
+      effortConfiguration,
+      stepAutoEffort,
+      codexTurnId,
+      startedAtMs,
+      signal,
+    }),
     onStageChange: (stage, detail) => {
       updateSessionStage(sessionId, stage);
       relay(askOpts?.onStageChange, stage, detail);

package/src/runtime/agent/orchestrator/session/manager/ask-turn-prepare.mjs

@@ -16,6 +16,7 @@ import {
   prefixUserTurnContent,
   suffixUserTurnReminders,
   buildCurrentTimeBlock,
+  snapshotPendingWorkspaceNotice,
 } from './prompt-utils.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
 import { _tryBridgeExplicitPrefetch } from './prefetch-bridge.mjs';
@@ -173,7 +174,11 @@ export async function buildUserTurn({
   // input intake: either can precede the previous turn's pause.
   // This supplies context only; it never resumes the Goal.
   const goalReminder = snapshotPendingGoalReminder(session, { includePaused: true });
+  // A mid-conversation working-folder change: the system prompt keeps its
+  // old root (cache intact) and the new folder's facts ride this turn.
+  const workspaceNotice = snapshotPendingWorkspaceNotice(session);
   const reminderBlock = [
+    workspaceNotice?.content || '',
     currentTimeBlock ? `<system-reminder>\n# Current Time\n${currentTimeBlock}\n</system-reminder>` : '',
     deferredToolDelta?.content || '',
     goalReminder?.content || '',
@@ -200,6 +205,7 @@ export async function buildUserTurn({
     historyMessages,
     deferredToolDelta,
     goalReminder,
+    workspaceNotice,
     userTurnMessage,
     outgoing: [...historyMessages, userTurnMessage],
   };

package/src/runtime/agent/orchestrator/session/manager/ask-turn-settle.mjs

@@ -8,6 +8,7 @@ import { ingestSessionTurn } from '../../../../session-search/session-search-ing
 import { persistedAssistantTranscriptMetadata } from '../../../../shared/transcript-metadata.mjs';
 import { acknowledgePendingDeferredToolDelta } from '../../runtime-core/deferred-tool-delta.mjs';
 import { acknowledgePendingGoalReminder } from '../../runtime-core/goal-reminder.mjs';
+import { acknowledgePendingWorkspaceNotice } from './prompt-utils.mjs';
 import {
   finalizePendingMessageDelivery,
   drainPendingMessages,
@@ -121,6 +122,9 @@ export async function commitAskTurn({ sessionId, opened, prepared, result, rawTr
   if (prepared.goalReminder) {
     acknowledgePendingGoalReminder(session, prepared.goalReminder.revision);
   }
+  if (prepared.workspaceNotice) {
+    acknowledgePendingWorkspaceNotice(session, prepared.workspaceNotice.revision);
+  }
   return {
     ...result,
     trimmed: messagesDropped > 0,

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -21,7 +21,9 @@ import { uncachedInputTokensForProvider } from './usage-metrics.mjs';
 import { pruneOffloadSession } from '../tool-result-offload.mjs';
 import { _getPendingMessagesForSession } from './pending-messages.mjs';
 import { isSessionCompactionBlocked } from './runtime-liveness.mjs';
+import { backfillFallbackSessionTitle } from './session-fallback-title.mjs';
 import { resetReadStateAfterCompaction } from '../read-dedup.mjs';
+import { applyPendingWorkspaceReroot } from './prompt-utils.mjs';
 import {
   compactTargetBudget as compactTargetBudgetForPolicy,
   compactDisplayBeforeTokens,
@@ -629,7 +631,13 @@ async function commitSessionCompaction(plan, run, compactStartedAt) {
   let unchangedReason = null;
   if (!changed) unchangedReason = force ? 'nothing to compact' : 'below threshold';
   const now = Date.now();
+  // Older titleless sessions: keep a name before the transcript that carries
+  // the first prompt is replaced.
+  if (changed) backfillFallbackSessionTitle(session, messages);
   session.messages = transcript;
+  // The compacted transcript breaks the cache anyway: a staged working-folder
+  // change re-roots the system prompt now and needs no notice any more.
+  if (changed) applyPendingWorkspaceReroot(session);
   if (changed) resetReadStateAfterCompaction(resolvedSessionId);
   await pruneCompactedOffloads(session, resolvedSessionId);
   if (changed) session.providerState = undefined;