mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/session/compact/user-message-kind.mjs

@@ -0,0 +1,148 @@
+// Classification of role:'user' messages: the human's own instruction versus
+// compact summaries and runtime-injected turns. Import-light on purpose (no
+// context-utils graph) so the session store can count real human turns;
+// compact/messages.mjs re-exports everything here.
+import { SUMMARY_PREFIX_ANCHOR } from './summary-anchor.mjs';
+import { isImportedMessage } from '../imported-message.mjs';
+import {
+  isInternalRuntimeNotificationText,
+  isModelVisibleToolCompletionWrapper,
+} from '../../../../shared/tool-execution-contract.mjs';
+
+// A compact summary message is a synthetic role:'user' message carrying the
+// SUMMARY_PREFIX anchor. It is NOT a real user turn: it must be excluded from
+// real user-turn boundary calculations and treated as merge input, otherwise
+// an old summary can sit in the preserved tail as a live user message,
+// duplicate, or fail to merge across repeated compaction.
+export function isSummaryMessage(m) {
+  return (
+    m?.role === 'user' &&
+    !isImportedMessage(m) &&
+    (String(m?.meta?.source || '') === 'compact-summary' ||
+      (typeof m.content === 'string' &&
+        m.content.startsWith(SUMMARY_PREFIX_ANCHOR) &&
+        /\nmessages=\d+\s+(?:sha256=|compact_type=)/.test(m.content)))
+  );
+}
+
+export function isProtectedContextUserMessage(m) {
+  if (m?.role !== 'user' || typeof m.content !== 'string' || isImportedMessage(m)) return false;
+  let content = m.content.trim();
+  if (!content.toLowerCase().startsWith('<system-reminder>')) return false;
+  const closingTag = '</system-reminder>';
+  // A runtime turn may carry several reminders (Goal, clock, tool delta).
+  // Only text outside those envelopes is a human instruction. Keep this
+  // compatible with stored turns that predate explicit source metadata.
+  while (content.toLowerCase().startsWith('<system-reminder>')) {
+    const closingIndex = content.toLowerCase().indexOf(closingTag);
+    if (closingIndex < 0) return true;
+    content = content.slice(closingIndex + closingTag.length).trim();
+  }
+  return content === '';
+}
+
+// An injected Skill-body user message (the general newMessages channel carries
+// the full SKILL.md body as a role:'user' message after the Skill tool_result).
+// Like isSummaryMessage / isProtectedContextUserMessage, it is detected by
+// content prefix (the `<skill>` envelope from buildSkillResultEnvelope) so the
+// check survives even if the synthetic `meta` field is dropped during a tail
+// rebuild. It is NOT the human's latest prompt and must be excluded from
+// "latest human request" selection (deriveCurrentRequest). The `meta:'skill'`
+// marker is also honoured.
+export function isInjectedSkillBodyMessage(m) {
+  if (m?.role !== 'user' || isImportedMessage(m)) return false;
+  if (m.meta === 'skill') return true;
+  return typeof m.content === 'string' && m.content.trimStart().startsWith('<skill>');
+}
+
+const CONTEXT_ACK_SOURCE = 'context-ack';
+
+/** The assistant `.` that closes an injected context turn (compact summary,
+ *  reminder, reference files) so the next prompt stays its own message. It is
+ *  model context only and never displayed. */
+export function contextAckMessage() {
+  return { role: 'assistant', content: '.', meta: { source: CONTEXT_ACK_SOURCE } };
+}
+
+/** Whether `message` is a context ack: marked, or (stored before the marker
+ *  existed) a bare `.` right after injected context (`previous`). */
+export function isContextAckMessage(message, previous = null) {
+  if (
+    message?.role !== 'assistant' ||
+    typeof message.content !== 'string' ||
+    message.content.trim() !== '.' ||
+    Array.isArray(message.toolCalls)
+  ) {
+    return false;
+  }
+  if (message.meta?.source === CONTEXT_ACK_SOURCE) return true;
+  return (
+    isSummaryMessage(previous) ||
+    isProtectedContextUserMessage(previous) ||
+    (previous?.role === 'user' && /^Reference files:\s*/i.test(userMessageText(previous).trimStart()))
+  );
+}
+
+const SYNTHETIC_USER_SOURCES = new Set([
+  'goal-continuation',
+  'goal-closeout',
+  'compact-context',
+  'compact-active-turn-continuation',
+  'compact-execution-recovery',
+  'max-output-recovery',
+  'refusal-recovery',
+  'stream-cut-recovery',
+]);
+const SYNTHETIC_USER_CONTROL_RE =
+  /^(?:\[mixdog-runtime\]|\[request interrupted(?: by user(?: for tool use)?| by process restart)?\])(?:\s|$)/i;
+
+function userMessageText(message) {
+  if (typeof message?.content === 'string') return message.content;
+  if (!Array.isArray(message?.content)) return '';
+  return message.content.map((block) => (typeof block === 'string' ? block : block?.text || '')).join('');
+}
+
+export function isActualUserInstructionMessage(message) {
+  if (
+    message?.role !== 'user' ||
+    isSummaryMessage(message) ||
+    isProtectedContextUserMessage(message) ||
+    isInjectedSkillBodyMessage(message)
+  ) {
+    return false;
+  }
+  const text = userMessageText(message);
+  // Imported prose is the user's own words whatever it looks like.
+  if (isImportedMessage(message)) return text.trim().length > 0;
+  if (/^Reference files:\s*/i.test(text.trimStart())) return false;
+  if (
+    SYNTHETIC_USER_CONTROL_RE.test(text.trimStart()) ||
+    isInternalRuntimeNotificationText(text) ||
+    isModelVisibleToolCompletionWrapper(text) ||
+    SYNTHETIC_USER_SOURCES.has(String(message?.meta?.source || ''))
+  ) {
+    return false;
+  }
+  return text.trim().length > 0 || (Array.isArray(message.content) && message.content.length > 0);
+}
+
+// Control rows the runtime writes as user turns when a turn is cut short.
+// isActualUserInstructionMessage deliberately keeps treating "[truncated]" as
+// an instruction (compaction tail selection depends on it), so the real-turn
+// predicate below recognizes it on its own.
+const CONTROL_MARKER_RE = /^\[(?:truncated|request interrupted(?: by user(?: for tool use)?| by process restart)?)\]$/i;
+
+/** Whether a message stands for real human conversation: a compact summary
+ *  (it replaced earlier human turns), imported prose, or the user's own
+ *  instruction without runtime provenance (`meta.source`/`meta.synthetic`,
+ *  `internal`/`synthetic` flags) or a recognized control marker. Used to tell
+ *  a real conversation from a synthetic-only transcript in catalog rows. */
+export function isRealTurnMessage(message) {
+  if (isSummaryMessage(message)) return true;
+  if (!isActualUserInstructionMessage(message)) return false;
+  if (isImportedMessage(message)) return true;
+  if (message.internal === true || message.synthetic === true) return false;
+  const meta = message.meta;
+  if (meta && typeof meta === 'object' && (meta.synthetic === true || meta.source)) return false;
+  return !CONTROL_MARKER_RE.test(userMessageText(message).trim());
+}

package/src/runtime/agent/orchestrator/session/compaction-archive-capture.mjs

@@ -25,7 +25,7 @@ import { renameWithRetrySync } from '../../../shared/atomic-file.mjs';
 import { writeStderrBestEffort } from '../../../shared/best-effort-stderr.mjs';
 
 import { sanitizeContentForStoredHistory } from '../providers/media-normalization.mjs';
-import { getStoreDir } from './store/paths-heartbeat.mjs';
+import { getStoreDir } from './store/session-paths.mjs';
 import { forgetSessionSaveBaseline } from './store/save-worker.mjs';
 import { messageIdOf, stampMessageIds } from './message-ids.mjs';
 import { restoreTranscriptItems } from './transcript-restore/restore.mjs';

package/src/runtime/agent/orchestrator/session/context-tool-schema.mjs

@@ -8,6 +8,13 @@ import {
 } from '../runtime-core/provider-request-tools.mjs';
 
 const toolSchemaAnalysisMemo = new WeakMap();
+// Token cost by schema signature. Every new session builds its own tools array
+// with the same schemas; re-estimating the whole serialization (tens of ms,
+// synchronous) per first turn blocked the event loop during session creation.
+// The signature hashes the full serialization, deferred flags included, so it
+// determines the metered text exactly.
+const toolSchemaTokensBySignature = new Map();
+const TOOL_SCHEMA_TOKENS_LIMIT = 32;
 
 function isDeferredToolSchema(tool) {
   return tool?.deferLoading === true || tool?.defer_loading === true;
@@ -58,8 +65,16 @@ function analyzeToolSchemas(tools) {
   // full weight inflated the request reserve. The SIGNATURE keeps hashing
   // the full serialization (a deferred tool joining/leaving must still
   // re-fingerprint the surface); only the token cost drops deferred entries.
-  const meterText = list.some(isDeferredToolSchema) ? serializeToolSchemas(list, { excludeDeferred: true }) : text;
-  const analysis = { signature, tokens: estimateTokens(meterText) };
+  let tokens = toolSchemaTokensBySignature.get(signature);
+  if (tokens === undefined) {
+    const meterText = list.some(isDeferredToolSchema) ? serializeToolSchemas(list, { excludeDeferred: true }) : text;
+    tokens = estimateTokens(meterText);
+    if (toolSchemaTokensBySignature.size >= TOOL_SCHEMA_TOKENS_LIMIT) {
+      toolSchemaTokensBySignature.delete(toolSchemaTokensBySignature.keys().next().value);
+    }
+    toolSchemaTokensBySignature.set(signature, tokens);
+  }
+  const analysis = { signature, tokens };
   if (Array.isArray(tools)) toolSchemaAnalysisMemo.set(tools, analysis);
   return analysis;
 }

package/src/runtime/agent/orchestrator/session/context-utils.mjs

@@ -225,10 +225,14 @@ function messageTextTokens(m, precomputedText = null, precomputedReplay = null)
     m?.role === 'assistant' && Array.isArray(m.providerReplay?.items) && m.providerReplay.items.length
       ? m.providerReplay.items
       : null;
-  const fullTokens = estimateTokens(text);
-  if (!replayItems) return fullTokens;
-  const replayTokens = estimateTokens(precomputedReplay ?? nativeBlocksEstimateText(replayItems));
-  return Math.max(fullTokens - replayTokens, replayTokens);
+  if (!replayItems) return estimateTokens(text);
+  // With visible replay items the text is exactly `${base}\n${replay}`. Meter
+  // each half on its own: the estimator's minimum-cost floors apply to the
+  // joined string, so subtracting est(replay) from est(base + replay)
+  // overstates base.
+  const replay = precomputedReplay ?? nativeBlocksEstimateText(replayItems);
+  const base = text.slice(0, text.length - replay.length - 1);
+  return Math.max(estimateTokens(base), estimateTokens(replay));
 }
 function imageDescriptorAllowance(descriptor) {
   if (descriptor.width && descriptor.height) {

package/src/runtime/agent/orchestrator/session/conversation-import/claude.mjs

@@ -176,9 +176,3 @@ export function createClaudeReducer() {
     },
   };
 }
-
-export function convertClaudeRecords(records) {
-  const reducer = createClaudeReducer();
-  for (const record of records) reducer.push(record);
-  return reducer.result();
-}

package/src/runtime/agent/orchestrator/session/conversation-import/codex.mjs

@@ -113,12 +113,6 @@ export function createCodexReducer() {
   };
 }
 
-export function convertCodexRecords(records) {
-  const reducer = createCodexReducer();
-  for (const record of records) reducer.push(record);
-  return reducer.result();
-}
-
 /** id/cwd of a `session_meta` first line cut off by a bounded prefix read. */
 export function codexMetaFromTruncatedLine(line) {
   const text = String(line || '');

package/src/runtime/agent/orchestrator/session/eager-dispatch/admission.mjs

@@ -12,6 +12,7 @@ import {
 } from '../loop/tool-classify.mjs';
 import { isSingleCallPerTurnTool, isToolCallDedupEligible } from '../loop/tool-helpers.mjs';
 import { lookupToolResultReuse } from '../cache/tool-result-reuse.mjs';
+import { bridgeClassificationTools } from '../loop/tool-call-resolution.mjs';
 
 export function createEagerAdmission({ tools, cwd, sessionId, sessionRef, repeatFailLimit }) {
   // Streaming-time intra-turn dedup. When the LLM emits two
@@ -63,7 +64,7 @@ export function createEagerAdmission({ tools, cwd, sessionId, sessionRef, repeat
     // Authorization precedes cache lookup and dedup, not just IO.
     if (preDispatchDenyForSession(sessionRef, call) !== null) return null;
     const sig = _intraTurnSig(call.name, call.arguments);
-    const dedupEligible = isToolCallDedupEligible(call.name, tools);
+    const dedupEligible = isToolCallDedupEligible(call.name, bridgeClassificationTools(tools, [call]));
     if (dedupEligible && _eagerInFlightSigs.has(sig)) return null;
     // Repeat-failure guard also gates eager dispatch (reviewer-flagged):
     // streaming onToolCall / startEagerRun would otherwise re-run an
@@ -75,7 +76,7 @@ export function createEagerAdmission({ tools, cwd, sessionId, sessionRef, repeat
     // The same cache policy authorizes both serial cache hits and short
     // cross-turn references. Recheck there: an entry can expire or be
     // invalidated between streaming admission and serial consumption.
-    if (lookupToolResultReuse({ sessionId, call, cwd, touch: false }) !== null) return null;
+    if (lookupToolResultReuse({ sessionId, call, cwd, touch: false, sessionRef }) !== null) return null;
     return { sig, dedupEligible };
   }
 

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -10,6 +10,7 @@ import { createEagerBarriers } from './eager-dispatch/barriers.mjs';
 import { createEagerEntry, runEagerEntry } from './eager-dispatch/entry.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
 import { isParallelDispatchable } from './loop/tool-helpers.mjs';
+import { resolveExecutionToolCall } from './loop/tool-call-resolution.mjs';
 
 export function createEagerDispatcher({
   tools,
@@ -45,9 +46,13 @@ export function createEagerDispatcher({
       iteration: getNextIteration(),
       localSearchTelemetry: entry.localSearchTelemetry,
       resultTelemetry: entry.resultTelemetry,
+      ...(call.wireCall ? { bridgeWireCall: call.wireCall } : {}),
     });
 
-  const startEagerTool = (call) => {
+  const startEagerTool = (wireCall) => {
+    // Streamed call_tool requests are admitted, ordered and executed as their
+    // targets; a projection error is answered by the serial batch instead.
+    const call = resolveExecutionToolCall(wireCall, sessionRef);
     if (!call?.id || pending.has(call.id) || !isParallelDispatchable(call.name)) return null;
     const admitted = admission.admit(call);
     if (!admitted) return null;

package/src/runtime/agent/orchestrator/session/historical-session-closure.mjs

@@ -0,0 +1,10 @@
+// Named sessions no longer receive automatic tombstones. Ownerless legacy
+// records still follow idle retention, so their closures are not historical.
+export function isHistoricalAutomaticClosure(session) {
+  return (
+    typeof session?.owner === 'string' &&
+    session.owner.length > 0 &&
+    (session?.closed === true || session?.status === 'closed') &&
+    (session.closedReason === 'idle-sweep' || session.closedReason === 'terminal-reap')
+  );
+}

package/src/runtime/agent/orchestrator/session/loop/assistant-commit.mjs

@@ -100,15 +100,12 @@ export function buildIntermediateAssistantMessage(resp, opts) {
 // recovery, and interruption; deferBodies keeps mutation bodies verbatim for
 // the rest of the session (collapsing them later rewrote an already-cached
 // prefix and re-billed the request uncached).
-export function buildToolCallAssistantMessage(response, { calls, suppressMidTurnText, opts }) {
+export function buildToolCallAssistantMessage(response, { calls, opts }) {
   return attachAssistantTranscriptMetadata(
     {
       role: 'assistant',
       createdAt: Date.now(),
-      // Sub-agent tool-call turns carry only mid-turn preamble in
-      // response.content (the real result rides the later final-answer
-      // turn). Blank it so it never accumulates as input tokens.
-      content: suppressMidTurnText ? '' : response.content || '',
+      content: response.content || '',
       toolCalls: compactToolCallsForHistory(calls, { deferBodies: true }),
       ...assistantEchoFields(assistantEchoPayloads(response, { keepAssistantBlocks: true })),
     },

package/src/runtime/agent/orchestrator/session/loop/compact-policy.mjs

@@ -7,6 +7,7 @@ import {
   contextMessagesSignature,
   estimateMessagesTokens,
   estimateRequestReserveTokens,
+  estimateToolSchemaTokens,
   providerTokenCalibration,
   resolveSessionCompactPolicy,
   toolSchemaSignature,
@@ -18,6 +19,7 @@ import { positiveInt } from '../../../../shared/numbers.mjs';
 import { isAgentOwner } from '../../agent-owner.mjs';
 import { providerInputExcludesCache, providerNativePdf } from '../../providers/registry.mjs';
 import { contentMediaBytes, contentMediaCount } from '../../providers/media-normalization.mjs';
+import { splitProtectedContext } from '../compact/messages.mjs';
 
 // Unified context-share rule (compact/constants.mjs CONTEXT_SHARE_RATIO): the
 // post-compaction target is 25% of the boundary/context window. One
@@ -589,6 +591,93 @@ export function compactTargetBudget(policy) {
   const singleShot = policy?.singleShot === true || (rawTrigger > 0 && reserve >= rawTrigger);
   return compactTargetBudgetForTrigger(rawBoundary, rawTarget, reserve, rawTrigger, singleShot, policy?.force === true);
 }
+const OVERHEAD_TOP_TOOLS = 5;
+
+/**
+ * The per-request overhead no compaction can shrink — the finalized wire tool
+ * schemas (policy.requestReserveTokens), the protected system/fixed prompt
+ * every compaction keeps verbatim, and the configured operator headroom — in
+ * the provider-scale units of the compact boundary (calibrated estimates, the
+ * configured headroom as configured). Only that fixed estimate can justify a
+ * refusal; a provider reading aligned to this prefix and these tool schemas
+ * can only withdraw one (it includes compactable history). Null unless the
+ * fixed part reaches the boundary: kind 'fixed_overhead' when schemas +
+ * system alone do, 'configured_reserve' when the configured headroom pushes
+ * the fixed part there.
+ */
+export function fixedRequestOverhead(policy, messages, tools, sessionRef = null) {
+  if (!policy?.auto) return null;
+  const boundary = positiveInt(policy.boundaryTokens);
+  if (!boundary) return null;
+  const calibration = policyTokenCalibration(policy);
+  const toProviderScale = (raw) => Math.ceil(Math.max(0, raw) * calibration);
+  const toolTokens = toProviderScale(policyRequestReserveTokens(policy));
+  const systemTokens = toProviderScale(estimateMessagesTokens(splitProtectedContext(messages || []).protectedPrefix));
+  const configuredReserve = Math.max(0, Number(policy.configuredReserveTokens) || 0);
+  const fixed = toolTokens + systemTokens;
+  // A provider reading of this very prefix with these very tools measured
+  // the whole request, compactable history included: an upper bound of the
+  // fixed part, never proof of it. When it is not above the estimate, the
+  // estimate is known to overstate the fixed part by an unknown amount, so
+  // nothing here can show that compaction is futile.
+  const measuredRequestTokens = measuredFixedRequestTokens(sessionRef, messages, policy);
+  if (measuredRequestTokens !== null && measuredRequestTokens <= fixed) return null;
+  // Refuse only when the fixed part itself (plus the headroom, for the
+  // reserve kind) reaches the boundary — never on a near miss of a heuristic
+  // estimate: those requests compact or go out, and the provider's own
+  // overflow handling decides.
+  let kind = null;
+  if (fixed >= boundary) kind = 'fixed_overhead';
+  else if (configuredReserve > 0 && fixed + configuredReserve >= boundary) kind = 'configured_reserve';
+  if (!kind) return null;
+  const counted = (Array.isArray(tools) ? tools : []).filter(
+    (tool) => tool?.deferLoading !== true && tool?.defer_loading !== true
+  );
+  const largestTools = counted
+    .map((tool) => ({
+      name: String(tool?.name || tool?.type || 'tool'),
+      tokens: toProviderScale(estimateToolSchemaTokens([tool])),
+    }))
+    .sort((a, b) => b.tokens - a.tokens || a.name.localeCompare(b.name))
+    .slice(0, OVERHEAD_TOP_TOOLS);
+  return {
+    kind,
+    contextWindowTokens: positiveInt(policy.contextWindow) || boundary,
+    boundaryTokens: boundary,
+    toolCount: counted.length,
+    toolTokens,
+    systemTokens,
+    configuredReserveTokens: configuredReserve,
+    measuredRequestTokens,
+    largestTools,
+  };
+}
+
+/**
+ * Identity of the fixed inputs fixedRequestOverhead judges: the wire tool
+ * schemas, the protected system context, the configured headroom and the
+ * boundary. A verdict holds while this is unchanged; the provider reading is
+ * deliberately not part of it (compaction clears it, fixed overhead stays).
+ */
+export function fixedRequestOverheadInputs(policy, messages) {
+  if (!policy?.auto) return null;
+  return JSON.stringify([
+    policy.toolSchemaSignature || '',
+    contextMessagesSignature(splitProtectedContext(messages || []).protectedPrefix),
+    Math.max(0, Number(policy.configuredReserveTokens) || 0),
+    positiveInt(policy.boundaryTokens) || 0,
+  ]);
+}
+
+// The provider-measured size of the last request when it still describes
+// this transcript prefix and was sent with the same tool schemas; else null.
+function measuredFixedRequestTokens(sessionRef, messages, policy) {
+  if (!sessionRef || !Array.isArray(messages)) return null;
+  const aligned = providerBaselineCoverage(sessionRef, messages);
+  if (!aligned?.toolSignature || aligned.toolSignature !== policy?.toolSchemaSignature) return null;
+  return aligned.tokens;
+}
+
 // Anthropic refuses a request body over 32 MB (HTTP 413) however few tokens it
 // holds, and inline media is what gets there: an image is priced at no more
 // than ~1.6k tokens yet carries up to 5 MB of base64. Tool-result media is the
@@ -707,7 +796,6 @@ function compactionTelemetryRecord(sessionRef, policy, meta, prev) {
   return {
     ...prev,
     auto: policy.auto !== false,
-    reservedTokens: policy.configuredReserveTokens || prev.reservedTokens || null,
     requestReserveTokens: policy.requestReserveTokens || 0,
     reserveTokens: policy.reserveTokens || 0,
     boundaryTokens: policy.boundaryTokens || null,

package/src/runtime/agent/orchestrator/session/loop/completion-guards.mjs

@@ -37,7 +37,7 @@ export function crossTurnSignature(name, args) {
 // they must not reset the escalation ladder's "zero edit" condition. Skill /
 // recall / agent / task / cwd / load_tool are exploration/meta plumbing.
 // (tool_search kept as legacy alias for old transcripts.)
-const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', 'load_tool', 'tool_search']);
+const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', 'session', 'load_tool', 'tool_search']);
 
 // True when a successfully-executed tool represents real edit/progress. A tool
 // counts as progress only if its def lacks readOnlyHint (not eager) AND it is

package/src/runtime/agent/orchestrator/session/loop/context-overflow.mjs

@@ -46,6 +46,62 @@ export function agentContextOverflowError(
   );
 }
 
+export const TOOL_SURFACE_EXCEEDS_CONTEXT = 'TOOL_SURFACE_EXCEEDS_CONTEXT';
+
+const tokens = (value) => `${Number(value || 0).toLocaleString('en-US')} tokens`;
+
+// Distinct from AgentContextOverflowError: the request's FIXED overhead (tool
+// definitions, protected system context, configured headroom) leaves no room
+// for any history, so compacting the history cannot help and is not tried.
+// The wording avoids provider context-overflow phrasing on purpose: this is
+// not a "conversation too long" refusal and must not be routed as one.
+export class ToolSurfaceExceedsContextError extends Error {
+  constructor({ sessionId, provider, model, overhead }) {
+    const target = [provider, model].filter(Boolean).join('/') || 'this model';
+    const reserve = overhead.kind === 'configured_reserve';
+    const headline = reserve
+      ? 'The configured compaction headroom leaves no room for conversation history'
+      : 'Tool definitions and system context leave no room for conversation history';
+    const fewerReservedHint =
+      overhead.configuredReserveTokens > 0 ? ', or configure fewer reserved tokens (compaction.reservedTokens)' : '';
+    const remedy = reserve
+      ? 'Lower the configured headroom (compaction.reservedTokens or MIXDOG_AGENT_COMPACT_RESERVED_TOKENS), or use a model with a larger context window.'
+      : `Use a model with a larger context window, or send a smaller eager tool surface (disable MCP servers or custom tools this session does not need)${fewerReservedHint}.`;
+    const largest = overhead.largestTools.map((tool) => `${tool.name} (${tokens(tool.tokens)})`).join(', ');
+    super(
+      [
+        `${headline} (${TOOL_SURFACE_EXCEEDS_CONTEXT}).`,
+        `${target}: context window ${tokens(overhead.contextWindowTokens)}, compaction boundary ${tokens(overhead.boundaryTokens)}.`,
+        `Fixed per-request overhead: tool definitions ${tokens(overhead.toolTokens)} (${overhead.toolCount} tools), ` +
+          `protected system context ${tokens(overhead.systemTokens)}, configured headroom ${tokens(overhead.configuredReserveTokens)}; ` +
+          'nothing remains for conversation history.',
+        ...(overhead.measuredRequestTokens
+          ? [`The provider measured the last request at ${tokens(overhead.measuredRequestTokens)}.`]
+          : []),
+        'Compacting the conversation history cannot reduce these.',
+        remedy,
+        ...(largest ? [`Largest tool definitions: ${largest}.`] : []),
+      ].join('\n')
+    );
+    this.name = 'ToolSurfaceExceedsContextError';
+    this.code = TOOL_SURFACE_EXCEEDS_CONTEXT;
+    this.sessionId = sessionId || null;
+    this.provider = provider || null;
+    this.model = model || null;
+    this.overheadKind = overhead.kind;
+    this.overhead = overhead;
+  }
+}
+
+export function toolSurfaceExceedsContextError({ sessionId, sessionRef, model, overhead }) {
+  return new ToolSurfaceExceedsContextError({
+    sessionId,
+    provider: sessionRef?.provider || null,
+    model: sessionRef?.model || model || null,
+    overhead,
+  });
+}
+
 // Distinct from AgentContextOverflowError: the compaction pipeline itself
 // failed (handoff-summary error, dead Memory runtime,
 // etc.). This is NOT "latest turn cannot fit the context budget" — masking it

package/src/runtime/agent/orchestrator/session/loop/deferred-call-through.mjs

@@ -1,12 +1,10 @@
 // Deferred catalog call-through: inactive catalog tool_use → discovery bookkeeping
 // then normal executeTool routing (runtime errors only; no pre-dispatch schema).
 import { clean } from '../../runtime-core/session-text.mjs';
-import {
-  deferredCatalogUnion,
-  isReadonlySelectable,
-  selectDeferredTools,
-} from '../../runtime-core/tool-catalog.mjs';
+import { deferredCatalogUnion, isReadonlySelectable, selectDeferredTools } from '../../runtime-core/tool-catalog.mjs';
 import { isDeferredToolAvailable } from '../../runtime-core/deferred-tool-availability.mjs';
+import { routeToolExclusionReason } from './provider-tool-exclusions.mjs';
+import { isBridgeReadonlySession, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
 
 /** Skill-list plumbing only; mutation/MCP/builtins must use the catalog+mode gate. */
 const INACTIVE_INFRA_BYPASS = new Set(['skills_list', 'skill_view']);
@@ -41,7 +39,7 @@ function toolExecutesWhenInactive(name) {
   return INACTIVE_INFRA_BYPASS.has(name);
 }
 
-function resolveDeferredSelectMode(session) {
+export function resolveDeferredSelectMode(session) {
   const spec = session?.toolSpec;
   if (spec == null || spec === '') return null;
   if (spec === 'readonly') return 'readonly';
@@ -89,20 +87,32 @@ export function prepareDeferredToolCallThrough(sessionRef, name) {
   }
   const tool = lookupDeferredCatalogTool(sessionRef, name);
   if (!tool) return null;
+  const routeExclusion = isToolBridgeEnabled(sessionRef) ? null : routeToolExclusionReason(sessionRef, tool);
+  if (routeExclusion) return denyDeferredCallThrough(`Error: ${routeExclusion}`);
   if (isActiveSessionTool(sessionRef, name)) return null;
   if (toolExecutesWhenInactive(name)) return null;
 
   const toolLabel = clean(tool.name) || clean(name) || 'tool';
+  const bridge = isToolBridgeEnabled(sessionRef);
   const resolvedMode = resolveDeferredSelectMode(sessionRef);
+  // Whatever the exposure, a deferred mutating tool never runs without a
+  // resolved tool mode, and never in a read-only one.
   if (resolvedMode === null) {
     if (!isReadonlySelectable(tool)) {
+      const remedy = bridge ? 'no call was sent.' : `load it with load_tool names:["${toolLabel}"].`;
       return denyDeferredCallThrough(
-        `Error: tool "${toolLabel}" is deferred and cannot be auto-loaded without a resolved tool mode; load it with load_tool names:["${toolLabel}"].`
+        `Error: tool "${toolLabel}" is deferred and cannot be auto-loaded without a resolved tool mode; ${remedy}`
       );
     }
-  } else if (resolvedMode === 'readonly' && !isReadonlySelectable(tool)) {
+  } else if (
+    (resolvedMode === 'readonly' || (bridge && isBridgeReadonlySession(sessionRef))) &&
+    !isReadonlySelectable(tool)
+  ) {
     return denyDeferredCallThrough(`Error: tool "${toolLabel}" is not available in readonly mode`);
   }
+  // Bridge sessions reach deferred tools through call_tool: the fixed
+  // provider surface is never extended.
+  if (bridge) return null;
 
   const selectMode = resolvedMode === null ? 'readonly' : resolvedMode;
   selectDeferredTools(sessionRef, [toolLabel], selectMode);

package/src/runtime/agent/orchestrator/session/loop/loop-state.mjs

@@ -3,7 +3,6 @@
  * request-loop bookkeeping, plus the
  * helpers every phase shares (abort check, steering drain, no-tool resolver).
  */
-import { isAgentOwner } from '../../agent-owner.mjs';
 import { SessionClosedError } from '../manager/session-errors.mjs';
 import { resolveLiveToolCwd } from './tool-exec.mjs';
 import { createSteeringDrain } from './steering.mjs';
@@ -20,19 +19,6 @@ export const REPEAT_FAIL_LIMIT = 3;
 // (drop-oldest / insertion order).
 export const CROSS_TURN_CAP = 500;
 
-// Agent mid-turn text is suppressed unless THIS send explicitly requested a
-// live projection. The request is a send-opt (`liveProjection`) — never a
-// durable session field — so a transient Agent pane cannot leak into later
-// silent dispatches or stored session JSON. The standalone surface still
-// flips `interactiveSessionSurface` on the in-memory session; honor that
-// in-process hint without treating it as something dispatch should persist.
-export function shouldSuppressAgentMidTurnText(sessionRef, opts = {}) {
-  if (!isAgentOwner(sessionRef)) return false;
-  if (opts?.liveProjection === true) return false;
-  if (sessionRef?.interactiveSessionSurface === true) return false;
-  return true;
-}
-
 export function createLoopState({ provider, messages, model, tools, cwd, sendOpts }) {
   const opts = sendOpts || {};
   const sessionId = opts.sessionId || null;
@@ -44,17 +30,6 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
   if (sessionRef && Object.hasOwn(sessionRef, '_providerToolSurfaceSnapshot')) {
     delete sessionRef._providerToolSurfaceSnapshot;
   }
-  // Sub-agent (worker/heavy-worker/reviewer/…) sessions drop mid-turn
-  // assistant preamble text outright. Only the final <final-answer> reply is
-  // consumed by Lead, so any "Now let me…" prose that precedes a tool call is
-  // pure noise — for live surfacing AND for the agent's own history (where it
-  // re-enters context as input tokens on every later turn):
-  //   - streaming  : opts.onTextDelta suppressed (token-by-token preamble)
-  //   - buffered   : opts.onAssistantText skipped (response.content)
-  //   - history    : tool-call turn content blanked before messages.push
-  // Reasoning/thinking deltas, tool calls, and the final answer are kept.
-  const suppressMidTurnText = shouldSuppressAgentMidTurnText(sessionRef, opts);
-  if (suppressMidTurnText) opts.onTextDelta = undefined;
   // Out-of-loop transcript mutations (post-turn/manual compaction in
   // manager/compaction-runner.mjs) run where no send opts exist; they park a
   // one-shot intent on the session so the FIRST send of the next turn tags
@@ -74,7 +49,6 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     sessionRef,
     sessionAgent: opts.session?.agent,
     forcedFirstTool: opts.forcedFirstTool ?? null,
-    suppressMidTurnText,
     // sessionRef.cwd is the live SSOT. The legacy positional cwd is only the
     // turn-start snapshot and becomes stale after an in-turn cwd tool call.
     cwd: resolveLiveToolCwd(cwd, sessionRef),
@@ -114,6 +88,7 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     // One-shot repair of an assistant turn whose stored reasoning replay the
     // API refuses to take back (see thinking-replay-recovery.mjs).
     thinkingReplayRepairUsed: false,
+    toolSchemaDropUsed: false,
     // Pending image-strip retry: identities of the images every attempt leaves
     // out until a send succeeds, and whether to heal them from history then.
     imageStrip: null,
@@ -156,7 +131,6 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     opts,
     sessionId,
     sessionAgent: state.sessionAgent,
-    suppressMidTurnText,
     drainSteering: state.drainSteering,
   });
   return state;

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn/output-limit.mjs

@@ -20,7 +20,7 @@ function resumePrompt(response, attempt) {
 }
 
 export function resolveOutputLimit(response, { state, segments, messages }) {
-  segments.record(response.content, { keepWhenSuppressed: true });
+  segments.record(response.content);
   if (state.maxOutputRecoveryCount < MAX_OUTPUT_RECOVERY_LIMIT) {
     // The partial assistant turn must be visible to the model so it can
     // resume at the exact cutoff instead of reconstructing or repeating