mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn/segments.mjs

@@ -1,13 +1,13 @@
 // Committed-but-unsealed text segments of one user turn.
 //
-// Max-output recovery parts plus (Lead/TUI only) text-only continuation
+// Max-output recovery parts plus text-only continuation
 // segments (provider pause_turn / terminal steering / stop hook). The terminal
 // response returns content = parts + terminal so the UI row that accumulated
 // every streamed segment is not overwritten down to only the last segment;
 // historyContent keeps persistence single-copy.
 import { buildIntermediateAssistantMessage, commitAssistantMessage } from '../assistant-commit.mjs';
 
-export function createTurnSegments({ messages, opts, suppressMidTurnText }) {
+export function createTurnSegments({ messages, opts }) {
   const parts = [];
   return {
     parts,
@@ -18,15 +18,9 @@ export function createTurnSegments({ messages, opts, suppressMidTurnText }) {
       return true;
     },
     // Record a mid-turn segment for the caller-facing aggregate and surface it
-    // live. A suppressed sub-agent session neither surfaces nor accumulates
-    // text — except on the max-output ladder, whose parts must still rebuild
-    // the complete answer the caller receives (keepWhenSuppressed).
+    // live for every session.
     // `committed: true` marks text that is the just-committed message's own.
-    record(text, { keepWhenSuppressed = false, committed = false } = {}) {
-      if (suppressMidTurnText) {
-        if (keepWhenSuppressed) parts.push(text);
-        return;
-      }
+    record(text, { committed = false } = {}) {
       parts.push(text);
       try {
         opts.onAssistantText?.(text, { committed });

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn.mjs

@@ -19,15 +19,8 @@ import { resolveRefusal } from './no-tool-turn/refusal.mjs';
 import { resumeContinuation } from './no-tool-turn/continuation.mjs';
 import { nudgeEmptyTurn } from './no-tool-turn/empty-nudge.mjs';
 
-export function createNoToolTurnResolver({
-  messages,
-  opts,
-  sessionId,
-  sessionAgent,
-  suppressMidTurnText,
-  drainSteering,
-}) {
-  const segments = createTurnSegments({ messages, opts, suppressMidTurnText });
+export function createNoToolTurnResolver({ messages, opts, sessionId, sessionAgent, drainSteering }) {
+  const segments = createTurnSegments({ messages, opts });
   // Per-turn recovery counters shared by the ladders.
   const state = {
     maxOutputRecoveryCount: 0,

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -13,8 +13,12 @@
 // registry knows its name.
 import { isAgentOwner } from '../../agent-owner.mjs';
 import { isOffReadonlySurface } from './deferred-call-through.mjs';
+import { BRIDGE_CALL_TOOL_NAME, bridgeErrorText, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
+import { sessionAllowlistExcludes, sessionDisallows } from '../../runtime-core/deferred-tool-availability.mjs';
+import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
 
-const WORKER_DENIED_TOOLS = new Set(['agent']);
+const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'session']);
+const BRIDGE_DISCOVERY_TOOL_NAMES = new Set(['load_tool']);
 
 const IMAGE_PATH_RE = /\.(?:png|jpe?g|gif|webp)(?:$|[?#])/i;
 const COMPACTED_PATCH_LINE_RE = /^\s*\[mixdog compacted\b[^\]\n]*\]/;
@@ -95,17 +99,27 @@ export function routeWebFetchCall(call) {
 export function preDispatchDenyForSession(sessionRef, call) {
   const name = call?.name;
   if (typeof name !== 'string' || !name) return null;
+  // A call_tool request that could not be projected onto its target answers
+  // its wire id with the projection error; call_tool itself never dispatches.
+  if (typeof call.bridgeError === 'string') return call.bridgeError;
+  if (name === BRIDGE_CALL_TOOL_NAME && isToolBridgeEnabled(sessionRef)) {
+    return bridgeErrorText(
+      'BRIDGE_RECURSION',
+      'call_tool runs one tool named in its arguments and cannot be dispatched itself.'
+    );
+  }
   const schemaName = String(call?.schemaName || name);
-  if (Array.isArray(sessionRef?.schemaAllowedTools)) {
-    const allowed = new Set(sessionRef.schemaAllowedTools.map((toolName) => String(toolName).toLowerCase()));
-    if (!allowed.has(schemaName.toLowerCase())) {
-      return `Error: tool "${name}" is not available on this session's schema allowlist.`;
-    }
+  // A tool the provider left out of this request still exists in the session;
+  // a call to it is answered with why it is unavailable.
+  const excluded = providerToolExclusionReason(sessionRef, schemaName);
+  if (excluded) return `Error: ${excluded}`;
+  // The bridge's discovery tools grant no authority (every call_tool target
+  // is judged here under its own name), so an allowlist never strands them.
+  const bridgeDiscovery = isToolBridgeEnabled(sessionRef) && BRIDGE_DISCOVERY_TOOL_NAMES.has(schemaName);
+  if (!bridgeDiscovery && sessionAllowlistExcludes(sessionRef, schemaName)) {
+    return `Error: tool "${name}" is not available on this session's schema allowlist.`;
   }
-  if (
-    Array.isArray(sessionRef?.disallowedTools) &&
-    sessionRef.disallowedTools.some((toolName) => String(toolName).toLowerCase() === schemaName.toLowerCase())
-  ) {
+  if (sessionDisallows(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available in this session.`;
   }
   if (isOffReadonlySurface(sessionRef, schemaName)) {

package/src/runtime/agent/orchestrator/session/loop/provider-tool-exclusions.mjs

@@ -0,0 +1,135 @@
+// Tools a provider left out of a request because it cannot accept their input
+// schema even after the wire's normalization (a schema with an unknown type
+// name, an unresolvable $ref, a non-object root), or that the provider
+// rejected with an HTTP 400 naming the schema (dropped for the session).
+// The user is told once per session and tool on the turn's display-only stage
+// channel (stage 'notice'); a call the model still makes to such a tool is
+// answered with the reason instead of running it.
+import { geminiToolExclusion } from '../../providers/gemini-schema.mjs';
+import { isGeminiFamilyModel } from '../../providers/gemini-family.mjs';
+import { anthropicToolExclusion } from '../../providers/lib/anthropic-request-utils.mjs';
+import { claudeBridgeInputSchema, wireInputSchema } from '../../providers/lib/claude-bridge-schema.mjs';
+import { actionInputUnionFor } from '../../providers/lib/action-input-contract.mjs';
+import { isAntigravityClaude } from '../../providers/antigravity-request.mjs';
+import { isResponsesFreeformTool } from '../../providers/custom-tool-wire.mjs';
+import { ANTHROPIC_NATIVE_PROVIDERS } from '../../runtime-core/tool-catalog-schema.mjs';
+import {
+  finalizeProviderRequestTools,
+  providerNativeToolPrefixCount,
+} from '../../runtime-core/provider-request-tools.mjs';
+
+const sessions = new WeakMap();
+
+function exclusionsFor(sessionRef) {
+  let state = sessions.get(sessionRef);
+  if (!state) {
+    state = { noticed: new Set(), current: new Map(), dropped: new Map() };
+    sessions.set(sessionRef, state);
+  }
+  return state;
+}
+
+const isSessionRef = (value) => value !== null && typeof value === 'object';
+
+/** A new provider request: exclusions describe the latest request only. */
+export function beginProviderToolExclusions(sessionRef) {
+  if (isSessionRef(sessionRef)) sessions.get(sessionRef)?.current.clear();
+}
+
+export function excludedToolNoticeText({ name, pointer, reason }) {
+  return `Tool "${name}" was excluded from this session's requests: its input schema is invalid at ${pointer || '/'} (${reason}). Fix the tool's schema or disable the tool.`;
+}
+
+/** Record `exclusion` ({ name, pointer, reason }) for the session's current
+ *  request and raise the user notice the first time this tool is excluded. */
+export function recordProviderToolExclusion(sessionRef, exclusion, onStageChange) {
+  const name = String(exclusion?.name || '');
+  if (!name || !isSessionRef(sessionRef)) return;
+  const state = exclusionsFor(sessionRef);
+  state.current.set(name, exclusion);
+  if (state.noticed.has(name)) return;
+  state.noticed.add(name);
+  try {
+    onStageChange?.('notice', { tone: 'warn', message: excludedToolNoticeText(exclusion) });
+  } catch {
+    /* display-only */
+  }
+}
+
+const unavailableText = (exclusion) =>
+  `tool "${exclusion.name}" is unavailable with the current model: the provider rejected its input schema at ${exclusion.pointer || '/'} (${exclusion.reason}), so it was left out of the request; no call was sent. Use another tool, or ask the user to fix the tool's schema or disable it.`;
+
+/** Why `name` cannot be called in the session's current request, or null. */
+export function providerToolExclusionReason(sessionRef, name) {
+  if (!isSessionRef(sessionRef)) return null;
+  const state = sessions.get(sessionRef);
+  const key = String(name || '');
+  const exclusion = state?.current.get(key) || state?.dropped.get(key);
+  return exclusion ? unavailableText(exclusion) : null;
+}
+
+/** The provider rejected `exclusion.name`'s schema with an HTTP 400: leave the
+ *  tool out of every later request of the session and tell the user once. */
+export function dropSessionTool(sessionRef, exclusion, onStageChange) {
+  if (!isSessionRef(sessionRef)) return;
+  exclusionsFor(sessionRef).dropped.set(exclusion.name, exclusion);
+  recordProviderToolExclusion(sessionRef, exclusion, onStageChange);
+}
+
+/** The request's tool surface without the tools dropped for the session
+ *  ({ sendTools, requestToolScope }, the same objects when none apply). */
+export function withoutDroppedTools(sessionRef, { sendTools, requestToolScope }) {
+  const dropped = isSessionRef(sessionRef) ? sessions.get(sessionRef)?.dropped : null;
+  if (!dropped?.size) return { sendTools, requestToolScope };
+  const prefix = providerNativeToolPrefixCount(sendTools);
+  const kept = sendTools.filter((tool, index) => index < prefix || !dropped.has(tool?.name));
+  if (kept.length === sendTools.length) return { sendTools, requestToolScope };
+  const next = finalizeProviderRequestTools(kept, prefix);
+  return { sendTools: next, requestToolScope: { ...requestToolScope, requestTools: next } };
+}
+
+// The schema rule of the wire a session's requests use: 'gemini', 'anthropic'
+// (Messages), 'antigravity-claude' (Anthropic bridge behind Antigravity) or
+// 'openai' (Responses, Codex and every OpenAI-compatible chat route).
+function routeSchemaFamily(session) {
+  const provider = String(session?.provider || '').toLowerCase();
+  const wire = session?.wireRoute?.wire;
+  if (provider === 'antigravity-oauth' && isAntigravityClaude(session?.model)) return 'antigravity-claude';
+  if (provider === 'gemini' || isGeminiFamilyModel(session?.model)) return 'gemini';
+  if (ANTHROPIC_NATIVE_PROVIDERS.has(provider) || wire === 'messages') return 'anthropic';
+  return 'openai';
+}
+
+function wireExclusion(tool, result) {
+  return result.schema ? null : { name: tool.name, pointer: result.pointer || '/', reason: result.reason };
+}
+
+// The same normalization + validation the wire applies to `tool`, as
+// { name, pointer, reason } when the route leaves it out of its requests.
+function schemaExclusion(session, family, tool) {
+  switch (family) {
+    case 'gemini':
+      return geminiToolExclusion(tool);
+    case 'anthropic':
+      return anthropicToolExclusion(tool, String(session?.provider || 'anthropic').toLowerCase());
+    case 'antigravity-claude':
+      return wireExclusion(tool, claudeBridgeInputSchema(actionInputUnionFor(tool.inputSchema)));
+    default:
+      if (tool.inputSchema == null) return null;
+      if (/^openai(-oauth)?$/.test(String(session?.provider || '')) && isResponsesFreeformTool(tool)) return null;
+      return wireExclusion(tool, wireInputSchema(tool.inputSchema, 'openai'));
+  }
+}
+
+/** Why `tool` is left out of every request on the session's route, or null.
+ *  Validation is a pure function of the tool's schema and the route's wire, so
+ *  this holds before the tool was ever sent and stays stable across turns; a
+ *  tool the provider rejected with a 400 is dropped for the session. Built-in
+ *  tools are never excluded by the schema rule. */
+export function routeToolExclusionReason(session, tool) {
+  if (!tool) return null;
+  const dropped = isSessionRef(session) ? sessions.get(session)?.dropped.get(String(tool.name || '')) : null;
+  if (dropped) return unavailableText(dropped);
+  const exclusion = schemaExclusion(session, routeSchemaFamily(session), tool);
+  return exclusion ? unavailableText(exclusion) : null;
+}

package/src/runtime/agent/orchestrator/session/loop/request-boundary.mjs

@@ -5,15 +5,16 @@
 import { repairTranscriptBeforeProviderSend } from './transcript-repair.mjs';
 import { messagesArrayChanged } from './tool-helpers.mjs';
 import { runPreSendCompactPass } from '../pre-send-compact.mjs';
-import {
-  refreshDeferredMcpToolCatalog,
-  snapshotProviderRequestTools,
-} from '../../runtime-core/tool-catalog.mjs';
+import { refreshDeferredMcpToolCatalog, snapshotProviderRequestTools } from '../../runtime-core/tool-catalog.mjs';
 import {
   finalizeProviderRequestTools,
   providerNativeToolPrefixCount,
   runWithProviderRequestToolsScope,
 } from '../../runtime-core/provider-request-tools.mjs';
+import { TOOL_SURFACE_MIGRATION_INTENT } from '../../runtime-core/tool-exposure.mjs';
+import { migrateToolExposureAtBoundary } from './tool-exposure-migration.mjs';
+import { fixedRequestOverhead, fixedRequestOverheadInputs, resolveWorkerCompactPolicy } from './compact-policy.mjs';
+import { toolSurfaceExceedsContextError } from './context-overflow.mjs';
 
 const isDynamicTool = (tool) =>
   tool.deferLoading === true || tool.defer_loading === true || String(tool.name || '').startsWith('mcp__');
@@ -61,6 +62,18 @@ export async function prepareProviderRequest(state) {
   let compactChanged;
   let sendTools;
   let requestToolScope;
+  // Fixed inputs of the last passing overhead verdict in this boundary.
+  let passedOverheadInputs;
+  // A session persisted with another tool exposure migrates here, once, at a
+  // boundary with no pending calls: new surface and fixed guidance, a fresh
+  // tool snapshot and provider state, and a tagged cache break.
+  if (migrateToolExposureAtBoundary(sessionRef, messages)) {
+    fixedProviderToolSurface = null;
+    providerState = undefined;
+    providerStateCleared = true;
+    delete sessionRef.pendingCacheBreakIntent;
+    opts.cacheBreakIntent = TOOL_SURFACE_MIGRATION_INTENT;
+  }
   refreshDeferredMcpToolCatalog(sessionRef);
   do {
     // Provider-history normalization is part of the request boundary:
@@ -90,6 +103,20 @@ export async function prepareProviderRequest(state) {
       requestTools: sendTools,
       nativePrefixCount: providerNativeToolPrefixCount(sendTools),
     };
+    // A request whose fixed overhead alone leaves no room for history fails
+    // here with an actionable error: no compaction could make it fit. A
+    // passing verdict holds while its fixed inputs (tool schemas, protected
+    // system context, headroom, boundary) are unchanged — a later pass whose
+    // compaction only removed history (and the provider reading with it) is
+    // not re-judged — but adopted MCP schema changes or a re-rooted system
+    // prompt are.
+    const overheadPolicy = resolveWorkerCompactPolicy(sessionRef, sendTools);
+    const overheadInputs = fixedRequestOverheadInputs(overheadPolicy, messages);
+    if (overheadInputs === null || overheadInputs !== passedOverheadInputs) {
+      const overhead = fixedRequestOverhead(overheadPolicy, messages, sendTools, sessionRef);
+      if (overhead) throw toolSurfaceExceedsContextError({ sessionId, sessionRef, model, overhead });
+      passedOverheadInputs = overheadInputs;
+    }
     const pass = await runWithProviderRequestToolsScope(requestToolScope, () =>
       runPreSendCompactPass({
         provider,

package/src/runtime/agent/orchestrator/session/loop/route-fallback.mjs

@@ -0,0 +1,76 @@
+import { canFallbackRoute } from '../../../../shared/model-route-fallback.mjs';
+import { getProvider, initProviders } from '../../providers/registry.mjs';
+import { loadConfig } from '../../config.mjs';
+import { ensureProviderEnabled } from '../../runtime-core/config-helpers.mjs';
+import { updateSessionRoute } from '../manager/session-lifecycle.mjs';
+import { pinSessionWireRoute } from '../../providers/wire-route.mjs';
+import { buildRequestSendOptions } from '../manager/ask-turn-loop-options.mjs';
+import { prepareTurnEffortConfiguration } from '../../providers/effort-configuration.mjs';
+import { resolveSessionContextMeta } from '../manager/context-meta.mjs';
+
+export async function advanceAgentRoute(state, error) {
+  const session = state.sessionRef;
+  const index = session?.routeFallbackIndex || 0;
+  const next = session?.routeFallbacks?.[index];
+  const committed = state.toolCallsTotal > 0 || state.response != null;
+  if (!session?.agent || !next || !canFallbackRoute(error, { signal: state.signal, committed })) return false;
+  state.throwIfAborted();
+  const config = ensureProviderEnabled(loadConfig(), next.provider);
+  await initProviders(config.providers, { signal: state.signal });
+  state.throwIfAborted();
+  const provider = getProvider(next.provider);
+  if (!provider) throw new Error(`Provider "${next.provider}" not available`);
+  const oldOptions = buildRequestSendOptions({
+    sessionId: state.sessionId,
+    session,
+    signal: state.signal,
+  });
+  const updated = updateSessionRoute(
+    session.id,
+    {
+      ...next,
+      effort: next.effort || null,
+      fast: next.fast === true,
+      autoEffort: next.autoEffort !== false,
+      modelParameters: next.modelParameters || {},
+      contextPercent: next.contextPercent,
+      contextTokens: next.contextTokens,
+      selectedContextWindow: resolveSessionContextMeta(provider, next.model, next).rawContextWindow,
+    },
+    { crossProvider: true }
+  );
+  if (!updated) throw new Error('agent session closed during model fallback');
+  updated.routeFallbackIndex = index + 1;
+  await pinSessionWireRoute(updated, provider);
+  state.throwIfAborted();
+  state.messages.splice(0, state.messages.length, ...updated.messages);
+  updated.liveTurnMessages = state.messages;
+  state.sessionRef = updated;
+  state.provider = provider;
+  state.model = updated.model;
+  state.tools = updated.tools;
+  state.providerState = undefined;
+  state.providerStateUpdated = true;
+  state.prefixGuardState = null;
+  state.fixedProviderToolSurface = null;
+  state.cacheBreakTraceKeys.clear();
+  state.transportRetriesUsed = 0;
+  state.transportRetryMax = 0;
+  for (const key of Object.keys(oldOptions)) delete state.opts[key];
+  Object.assign(
+    state.opts,
+    buildRequestSendOptions({
+      sessionId: state.sessionId,
+      session: updated,
+      turnEffort: updated.effort,
+      effortConfiguration: prepareTurnEffortConfiguration(updated, provider),
+      signal: state.signal,
+    })
+  );
+  state.opts.onStageChange?.('connecting', {
+    provider: updated.provider,
+    model: updated.model,
+    reason: 'model-fallback',
+  });
+  return true;
+}

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -17,6 +17,14 @@ import { stripInlineImages } from '../image-strip-recovery.mjs';
 import { runWithProviderRequestToolsScope } from '../../runtime-core/provider-request-tools.mjs';
 import { REPEAT_FAIL_LIMIT } from './loop-state.mjs';
 import { createToolCallIdResolver } from './tool-call-ids.mjs';
+import { captureSideQuestionRequest } from '../side-question-store.mjs';
+import { advanceAgentRoute } from './route-fallback.mjs';
+import {
+  beginProviderToolExclusions,
+  dropSessionTool,
+  recordProviderToolExclusion,
+  withoutDroppedTools,
+} from './provider-tool-exclusions.mjs';
 
 /**
  * Open an iteration: refresh the live cwd, drain queued steering after a
@@ -73,6 +81,8 @@ export async function beginIteration(state) {
     loopUsageMetricsTurnId: state.usageMetricsTurnId,
     loopUsageMetricsEpoch: state.usageMetricsEpoch,
   });
+  // A tool the provider rejected with a schema 400 stays out of the session.
+  Object.assign(boundary, withoutDroppedTools(sessionRef, boundary));
   state.iterations = boundary.iterations;
   state.lastUsage = boundary.lastUsage;
   state.firstTurnUsage = boundary.firstTurnUsage;
@@ -92,6 +102,10 @@ export async function beginIteration(state) {
   // callers omit the flag and retain legacy live deferred resolution.
   opts.providerToolSnapshotAuthoritative = true;
   opts.providerNativeToolPrefixCount = boundary.requestToolScope.nativePrefixCount;
+  // A tool the provider leaves out of this request (a schema it cannot
+  // accept) is noticed once per session and refused if the model calls it.
+  beginProviderToolExclusions(sessionRef);
+  opts.onToolExcluded = (exclusion) => recordProviderToolExclusion(sessionRef, exclusion, opts.onStageChange);
   state.lastSendTools = boundary.sendTools;
   // Eager-dispatch queue (see ../eager-dispatch.mjs): read-only tools start
   // the instant the provider streams a tool-call event; writes and unknown
@@ -156,26 +170,47 @@ export async function sendProviderRequest(state, round) {
   try {
     opts.onProviderSendStarted?.();
   } catch {}
-  const result = await runWithProviderRequestToolsScope(round.requestToolScope, () =>
-    sendWithRecovery({
-      provider,
-      messages: providerMessages,
-      recoveryMessages: messageSource,
-      model,
-      sendTools: round.sendTools,
-      tools: round.sendTools,
-      opts,
-      sessionId,
-      sessionRef,
-      nextIteration: round.nextIteration,
-      contextOverflowRetryUsed: state.contextOverflowRetryUsed,
-      transportRetriesUsed: state.transportRetriesUsed,
-      transportRetryMax: state.transportRetryMax,
-      imageStripUsed: state.imageStripUsed,
-      thinkingReplayRepairUsed: state.thinkingReplayRepairUsed,
-      signal: state.signal,
-    })
-  );
+  // The request a /btw side question forks: kept while it is in flight, with
+  // its reply once it proceeds, and dropped again if it fails.
+  const sideQuestion = captureSideQuestionRequest({
+    sessionId,
+    sessionRef,
+    provider,
+    model,
+    messages: providerMessages,
+    tools: round.sendTools,
+    opts,
+  });
+  let result;
+  try {
+    result = await runWithProviderRequestToolsScope(round.requestToolScope, () =>
+      sendWithRecovery({
+        provider,
+        messages: providerMessages,
+        recoveryMessages: messageSource,
+        model,
+        sendTools: round.sendTools,
+        tools: round.sendTools,
+        opts,
+        sessionId,
+        sessionRef,
+        nextIteration: round.nextIteration,
+        contextOverflowRetryUsed: state.contextOverflowRetryUsed,
+        transportRetriesUsed: state.transportRetriesUsed,
+        transportRetryMax: state.transportRetryMax,
+        imageStripUsed: state.imageStripUsed,
+        thinkingReplayRepairUsed: state.thinkingReplayRepairUsed,
+        toolSchemaDropUsed: state.toolSchemaDropUsed,
+        signal: state.signal,
+      })
+    );
+  } catch (error) {
+    sideQuestion?.discard();
+    if (!(await advanceAgentRoute(state, error))) throw error;
+    result = { action: 'retry_route' };
+  }
+  if (result.action === 'proceed') sideQuestion?.settle(result.response);
+  else sideQuestion?.discard();
   return {
     result,
     providerMessages,
@@ -200,6 +235,8 @@ function appendRecoveryNotice(state, notice) {
  *  instead of processing a response. */
 export function applyRetryAction(state, result) {
   switch (result.action) {
+    case 'retry_route':
+      return true;
     case 'retry':
       // Keep opts.cacheBreakIntent: the failed send never consumed the tag,
       // and the reactive-compact retry that follows IS the tagged transition.
@@ -217,6 +254,16 @@ export function applyRetryAction(state, result) {
       // transport budget is consumed: nothing was generated.
       state.thinkingReplayRepairUsed = true;
       return true;
+    case 'retry_tool_schema_drop':
+      // The provider named a tool whose schema it rejects: the session drops
+      // it (with the notice) and the turn is rebuilt without it, once. The
+      // frozen tool surface and provider state are rebuilt around the change.
+      state.toolSchemaDropUsed = true;
+      dropSessionTool(state.sessionRef, result.exclusion, state.opts.onStageChange);
+      state.fixedProviderToolSurface = null;
+      state.providerState = undefined;
+      state.providerStateUpdated = true;
+      return true;
     case 'retry_image_strip':
       state.transportRetriesUsed += 1;
       state.imageStripUsed = true;

package/src/runtime/agent/orchestrator/session/loop/step-auto-effort.mjs

@@ -16,20 +16,19 @@
 import { resolveAutoEffort } from '../../providers/auto-effort.mjs';
 import { isCustomProviderName, resolveCustomReasoning } from '../../providers/custom-reasoning.mjs';
 import { autoEffortModel, stepEffortConfiguration } from '../../providers/effort-configuration.mjs';
-import { effortOptionsFor } from '../../runtime-core/effort.mjs';
+import { effortOptionsFor, warnEmptyAutoEffortLadder } from '../../runtime-core/effort.mjs';
 import { judgeTurn, recordEffortDecision } from '../../../../effort-judge/judge-client.mjs';
 import { stepResultWindow } from '../../../../effort-judge/judge-input.mjs';
 
 const TEXT_BLOCKS = new Set(['text', 'input_text', 'output_text']);
-const textOf = (content) =>
-  typeof content === 'string'
-    ? content
-    : Array.isArray(content)
-      ? content
-          .filter((block) => block && TEXT_BLOCKS.has(block.type))
-          .map((block) => block.text)
-          .join('\n')
-      : '';
+function textOf(content) {
+  if (typeof content === 'string') return content;
+  if (!Array.isArray(content)) return '';
+  return content
+    .filter((block) => block && TEXT_BLOCKS.has(block.type))
+    .map((block) => block.text)
+    .join('\n');
+}
 // Same argument text the training data was built from (head 600 code points).
 const argText = (args) =>
   Array.from(typeof args === 'string' ? args : JSON.stringify(args ?? {}))
@@ -174,6 +173,7 @@ function stepResult({ auto, snapshot, step, provider, model, providerClient, ses
     ms: judged.ms,
     probs: judged.probs.map((value) => Number(value.toFixed(3))),
   });
+  if (!resolved) warnEmptyAutoEffortLadder(provider, model, auto.base);
   if (isCustomProviderName(provider)) {
     const level =
       resolved &&

package/src/runtime/agent/orchestrator/session/loop/tool-call-resolution.mjs

@@ -0,0 +1,95 @@
+// Execution-call projection for the fixed tool bridge. A wire call
+// `call_tool {name: T, arguments: A}` (id X) becomes the execution call
+// `{ id: X, name: T, arguments: A, wireCall }` before eager admission and
+// classification, so every policy, ordering, cache, hook, approval and audit
+// layer sees the target itself. The tool result still answers wire id X and
+// the transcript keeps the original wire call (`wireCall`, an immutable copy).
+// Non-bridge sessions and every other call pass through unchanged.
+import { formatInvalidToolArgsResult, isInvalidToolArgsMarker } from '../../providers/lib/openai-tool-args.mjs';
+import {
+  BRIDGE_CALL_TOOL_NAME,
+  bridgeErrorText,
+  isToolBridgeEnabled,
+  resolveBridgeTarget,
+} from '../../runtime-core/tool-bridge.mjs';
+
+const CALL_TOOL_KEYS = new Set(['name', 'arguments']);
+
+const isPlainObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+
+function deepFreeze(value) {
+  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const key of Object.keys(value)) deepFreeze(value[key]);
+  }
+  return value;
+}
+
+function projectionFailure(wireCall, wire, text) {
+  return { id: wireCall.id, name: wireCall.name, arguments: wireCall.arguments, wireCall: wire, bridgeError: text };
+}
+
+/**
+ * @returns the execution call for `wireCall`: the projected target call, a
+ *   call carrying `bridgeError` (answered with that error, never executed),
+ *   or `wireCall` itself when no projection applies. Idempotent.
+ */
+export function resolveExecutionToolCall(wireCall, session) {
+  if (!wireCall || wireCall.name !== BRIDGE_CALL_TOOL_NAME || wireCall.wireCall || !isToolBridgeEnabled(session)) {
+    return wireCall;
+  }
+  const wire = deepFreeze(structuredClone(wireCall));
+  const args = wireCall.arguments;
+  if (isInvalidToolArgsMarker(args)) return projectionFailure(wireCall, wire, formatInvalidToolArgsResult(wireCall));
+  if (!isPlainObject(args)) {
+    return projectionFailure(
+      wireCall,
+      wire,
+      bridgeErrorText('INVALID_ARGUMENTS', 'call_tool requires {name, arguments}.')
+    );
+  }
+  const extra = Object.keys(args).filter((key) => !CALL_TOOL_KEYS.has(key));
+  if (extra.length) {
+    return projectionFailure(
+      wireCall,
+      wire,
+      bridgeErrorText('INVALID_ARGUMENTS', `call_tool does not accept: ${extra.join(', ')}.`)
+    );
+  }
+  if (!isPlainObject(args.arguments)) {
+    return projectionFailure(
+      wireCall,
+      wire,
+      bridgeErrorText('INVALID_ARGUMENTS', 'call_tool arguments must be an object of the target tool arguments.')
+    );
+  }
+  const target = resolveBridgeTarget(session, args.name);
+  if (target.error) return projectionFailure(wireCall, wire, bridgeErrorText(target.error.code, target.error.message));
+  const call = { id: wireCall.id, name: target.name, arguments: structuredClone(args.arguments), wireCall: wire };
+  // The target definition drives read-only classification of the call; it is
+  // never serialized with the call.
+  Object.defineProperty(call, 'bridgeTool', { value: target.tool, enumerable: false });
+  return call;
+}
+
+export function resolveExecutionToolCalls(calls, session) {
+  return Array.isArray(calls) ? calls.map((call) => resolveExecutionToolCall(call, session)) : calls;
+}
+
+/**
+ * The classification tool list for `calls`: `tools` plus the definitions of
+ * bridged targets that are not on it, so a bridged target is classified
+ * (read-only, dedup, stale-read invalidation) exactly like a direct call.
+ */
+export function bridgeClassificationTools(tools, calls) {
+  const base = Array.isArray(tools) ? tools : [];
+  const seen = new Set(base.map((tool) => tool?.name));
+  const extra = [];
+  for (const call of calls || []) {
+    const definition = call?.bridgeTool;
+    if (!definition || seen.has(definition.name)) continue;
+    seen.add(definition.name);
+    extra.push(definition);
+  }
+  return extra.length ? [...base, ...extra] : tools;
+}

package/src/runtime/agent/orchestrator/session/loop/tool-classify.mjs

@@ -14,6 +14,12 @@ export function _stripMcpPrefix(name) {
 export function _isReadTool(name) {
   return _stripMcpPrefix(name) === 'read';
 }
+
+// Cursor's native file protocol needs source content, not a receipt saying
+// the model has already seen it. Keep actual read caching and permissions.
+export function requiresReadBody(name, sessionRef) {
+  return name === 'read' && (sessionRef?.provider === 'cursor-oauth' || sessionRef?.provider === 'cursor-api');
+}
 export function _isMutationTool(name, args = null) {
   const n = String(_stripMcpPrefix(name) || '').toLowerCase();
   return n === 'apply_patch' || n === 'edit' || _isGitMutationTool(name, args);