mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -4,11 +4,12 @@
  */
 import { resolvePreToolAskApproval } from '../tool-helpers.mjs';
 import { runAbortable, throwIfAborted } from '../../../../../shared/abort-race.mjs';
+import { evaluateExecPolicy } from '../../../tools/bash-policy-scan.mjs';
 import { beginSessionApprovalWait } from '../../manager/runtime-liveness.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
-async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision }) {
+async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision, keepArgs = false }) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
   // While the user decides, the session is waiting on them, not working.
   const releaseApprovalWait = beginSessionApprovalWait(callerSessionId);
@@ -30,10 +31,35 @@ async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHoo
   }
   if (askOutcome.denial) return { denial: askOutcome.denial };
   const approval = askOutcome.approval;
-  if (approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
+  if (!keepArgs && approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
   return null;
 }
 
+/**
+ * Approval gate for a shell call (or a terminal `run`) whose exec policy
+ * decision is 'ask' (elevated launch). Runs after the final call is known. The
+ * approval is granted for the exact command being asked about: an approval
+ * reply cannot rewrite the args.
+ * @returns {Promise<{ denial: string } | { elevationApproved: boolean }>}
+ */
+export async function applyShellElevationGate(call, { callerSessionId, executeOpts, toolApprovalHook }) {
+  const gated = call.name === 'shell' || (call.name === 'terminal' && call.args?.action === 'run');
+  if (!gated || !isArgsObject(call.args) || call.args.command == null) {
+    return { elevationApproved: false };
+  }
+  const decision = evaluateExecPolicy(String(call.args.command));
+  if (decision.decision !== 'ask') return { elevationApproved: false };
+  const denied = await askApproval(call, {
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+    decision,
+    keepArgs: true,
+  });
+  if (denied) return denied;
+  return { elevationApproved: true };
+}
+
 /**
  * @returns {Promise<{ denial: string } | { name: string, args: any }>}
  *   the call as the hook left it, or the denial text to return instead
@@ -48,7 +74,8 @@ export async function applyBeforeToolHook({
   toolApprovalHook,
 }) {
   const call = { name, args, cwd };
-  if (!beforeToolHook) return call;
+  // ask_user is itself the user prompt; it never goes through the ordinary approval gate.
+  if (!beforeToolHook || name === 'ask_user') return call;
   try {
     const decision = await runAbortable(executeOpts.signal, () =>
       beforeToolHook(

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -15,6 +15,8 @@ import { executeInternalTool, isInternalTool } from '../../../internal-tools.mjs
 import { buildSkillsListResponse, viewSkill } from '../tool-helpers.mjs';
 import { isOnDeferredToolSurface } from '../deferred-call-through.mjs';
 import { _executeCodeGraphToolLazy } from '../../manager/runtime-loaders.mjs';
+import { requiresReadBody } from '../tool-classify.mjs';
+import { executeCursorNativeBuiltin } from '../../../tools/builtin/external-tool-adapters.mjs';
 
 function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts }) {
   const mcpScopeId = sessionRef?.mcpScopeId || null;
@@ -35,13 +37,19 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
   });
 }
 
-function dispatchInternal(name, args, { cwd, callerSessionId, sessionRef, executeOpts, notifyFn, toolApprovalHook }) {
+function dispatchInternal(
+  name,
+  args,
+  { cwd, callerSessionId, sessionRef, executeOpts, notifyFn, toolApprovalHook, elevationApproved }
+) {
   // callerSessionId propagates into server.mjs dispatchTool so that
   // dispatchAiWrapped can detect and reject recursive calls from a
   // hidden-role session (recall/search → self).
   return executeInternalTool(name, args, {
     scopeId: sessionRef?.mcpScopeId || null,
     callerSessionId,
+    // The calling session itself: bridge tools answer within its scope.
+    callerSession: sessionRef || null,
     callerCwd: cwd,
     setCallerCwd: async (nextCwd) => {
       const applyForCaller = sessionRef?._applyResolvedCwdForCaller;
@@ -58,6 +66,8 @@ function dispatchInternal(name, args, { cwd, callerSessionId, sessionRef, execut
     notifyFn,
     toolApprovalHook,
     toolCallId: executeOpts.toolCallId || null,
+    // Runtime-granted for this call only (terminal run); never from model args.
+    elevationApproved: elevationApproved === true,
     invocationSource: 'model-tool',
   });
 }
@@ -90,10 +100,24 @@ export function dispatchToolCall({ name, args }, ctx) {
   // variants) adapt to a native execution inside executeBuiltinTool's default
   // case; on a shape mismatch it falls back to the redirect guidance message.
   if (name === 'shell' || isBuiltinTool(name) || isExternalAdapterTool(name)) {
-    const builtinOpts = executeOpts.suppressReadUnchangedStub
-      ? { ...completionToolOpts, suppressReadUnchangedStub: true }
-      : completionToolOpts;
-    return executeBuiltinTool(name, args, cwd, builtinOpts);
+    const builtinOpts = {
+      ...completionToolOpts,
+      ...(executeOpts.suppressReadUnchangedStub || requiresReadBody(name, sessionRef)
+        ? { suppressReadUnchangedStub: true }
+        : {}),
+      // Runtime-granted only; any value inherited from executeOpts is overridden.
+      elevationApproved: ctx.elevationApproved === true,
+    };
+    return executeCursorNativeBuiltin(
+      name,
+      args,
+      cwd,
+      {
+        ...builtinOpts,
+        toolCallId: executeOpts.toolCallId || null,
+      },
+      executeBuiltinTool
+    );
   }
   return formatUnknownBuiltinToolMessage(name, args, 'tool');
 }

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -8,12 +8,13 @@
 import { isMcpTool } from '../../mcp/client.mjs';
 import { prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
 import { refreshDeferredMcpToolCatalog } from '../../runtime-core/tool-catalog.mjs';
+import { bridgeTargetUnavailable } from '../../runtime-core/tool-bridge.mjs';
 import { preDispatchDenyForSession, routeWebFetchCall } from './pre-dispatch-deny.mjs';
 import { runWithToolExecutionOwner } from '../../../../shared/tool-execution-owner.mjs';
 import { runWithLocalSearchTelemetry } from '../../tools/builtin/local-search-telemetry.mjs';
 import { throwIfAborted } from '../../../../shared/abort-race.mjs';
 import { prepareToolCall } from './tool-exec/call-prep.mjs';
-import { applyBeforeToolHook } from './tool-exec/before-hook.mjs';
+import { applyBeforeToolHook, applyShellElevationGate } from './tool-exec/before-hook.mjs';
 import { dispatchToolCall } from './tool-exec/dispatch.mjs';
 import { applyAfterToolHook } from './tool-exec/after-hook.mjs';
 import { runReadOnlyIoWithDeadline } from './tool-exec/read-only-deadline.mjs';
@@ -65,6 +66,18 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
   if (isMcpTool(call.name)) refreshDeferredMcpToolCatalog(sessionRef);
   const deferredPrep = prepareDeferredToolCallThrough(sessionRef, call.name);
   if (deferredPrep?.deny) return deferredPrep.deny;
+  // A bridged target was resolved when its call_tool was projected; it must
+  // still be available in this session's scope (also after a hook rewrite).
+  // The authorized identity is the public tool name, not its transport
+  // (web_fetch routed to local_fetch/image_fetch stays web_fetch here).
+  if (executeOpts.bridgeWireCall) {
+    const unavailable = bridgeTargetUnavailable(sessionRef, finalCall.schemaName || finalCall.name);
+    if (unavailable) return unavailable;
+  }
+  // Elevated launches ask the user first; denied / no approval UI refuses the call.
+  const elevation = await applyShellElevationGate(call, { callerSessionId, executeOpts, toolApprovalHook });
+  if (elevation.denial) return elevation.denial;
+  throwIfAborted(executeOpts.signal);
   const result = await runReadOnlyIoWithDeadline(call.name, executeOpts.signal || null, async (deadlineSignal) => {
     let callOpts = executeOpts;
     if (deadlineSignal !== executeOpts.signal) {
@@ -80,6 +93,7 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
       completionToolOpts,
       notifyFn,
       toolApprovalHook,
+      elevationApproved: elevation.elevationApproved === true,
     });
   });
   return applyAfterToolHook(result, hookFrom(executeOpts, sessionRef, 'afterToolHook'), {

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -0,0 +1,147 @@
+// Tool-exposure migration (native ↔ bridge-v1, and pre-versioned fixed
+// surfaces → bridge-v1). The surface itself is rebuilt by
+// applyDeferredToolSurface; this module adds what a changed request prefix
+// invalidates: provider state, the prefix guard, the context baseline and the
+// cache-break tag. Historical tool calls are never rewritten.
+import { applyDeferredToolSurface, rebuildDeferredToolSurfaceForProvider } from '../../runtime-core/tool-catalog.mjs';
+import {
+  bridgeSurfaceOutdated,
+  sessionToolExposure,
+  TOOL_EXPOSURE_BRIDGE,
+  TOOL_SURFACE_MIGRATION_INTENT,
+  toolExposureMigrationNeeded,
+  toolExposureModeForProvider,
+} from '../../runtime-core/tool-exposure.mjs';
+import { applyInitialDeferredToolManifestToBp2 } from '../../context/collect.mjs';
+import { isAgentOwner } from '../../agent-owner.mjs';
+import { honoredSchemaAllowlist } from '../manager/session-tool-surface.mjs';
+import { syncSystemPrefix } from '../manager/prompt-utils.mjs';
+import { invalidateProviderContextBaseline } from './compact-policy.mjs';
+
+/** Drop everything measured against the previous tool surface. */
+function invalidateForToolSurfaceMigration(session) {
+  delete session.providerState;
+  delete session._providerPrefixGuardState;
+  invalidateProviderContextBaseline(session);
+  session.updatedAt = Date.now();
+}
+
+/**
+ * After a surface re-apply outside a request (resume, provider switch)
+ * migrated the exposure: the first send of the next turn carries the tag.
+ */
+export function markToolSurfaceMigrated(session) {
+  invalidateForToolSurfaceMigration(session);
+  session.pendingCacheBreakIntent = TOOL_SURFACE_MIGRATION_INTENT;
+}
+
+/** Provider switch: rebuild the surface for `provider`, migrating bridge ↔ native. */
+export function rebuildToolSurfaceForProviderWithMigration(session, provider) {
+  if (!session) return false;
+  const migrating = toolExposureMigrationNeeded(session, provider);
+  rebuildDeferredToolSurfaceForProvider(session, provider);
+  if (migrating) markToolSurfaceMigrated(session);
+  return migrating;
+}
+
+// The latest assistant tool turn still waits for a result: not a safe boundary.
+function hasUnansweredToolCalls(messages) {
+  const list = Array.isArray(messages) ? messages : [];
+  const index = list.findLastIndex((message) => message?.role === 'assistant' && message.toolCalls?.length);
+  if (index < 0) return false;
+  const answered = new Set(
+    list.slice(index + 1).flatMap((message) => (message?.role === 'tool' ? [message.toolCallId] : []))
+  );
+  return list[index].toolCalls.some((call) => call?.id && !answered.has(call.id));
+}
+
+/**
+ * Request-boundary migration of a live session whose persisted exposure
+ * differs from its provider's. `messages` is the transcript the request is
+ * built from; the fixed-guidance rewrite lands there (and on the session).
+ * Returns true when the surface changed; the caller drops its frozen tool
+ * snapshot and provider state and tags the send.
+ */
+export function migrateToolExposureAtBoundary(session, messages) {
+  if (!session || !toolExposureMigrationNeeded(session) || hasUnansweredToolCalls(messages)) return false;
+  const stored = session.messages;
+  const working = Array.isArray(messages) ? messages : stored;
+  if (Array.isArray(working)) session.messages = working;
+  try {
+    applyDeferredToolSurface(session, session.deferredSurfaceMode || 'lead', [], {
+      provider: session.provider,
+      model: session.model,
+    });
+  } finally {
+    if (Array.isArray(working) && session.messages !== working) {
+      // The rewrite may drop an emptied system message: keep the request
+      // transcript array identity the loop holds.
+      working.splice(0, working.length, ...session.messages);
+    }
+    session.messages = stored;
+  }
+  // The rewritten prompt messages are fresh objects; the canonical transcript
+  // the save path persists takes them too, so the next save writes the new
+  // prompt together with the new exposure.
+  if (Array.isArray(stored) && Array.isArray(working) && stored !== working) syncSystemPrefix(stored, working);
+  invalidateForToolSurfaceMigration(session);
+  return true;
+}
+
+// Bridge state an agent surface carries; dropped when it returns to the full array.
+const AGENT_BRIDGE_FIELDS = [
+  'toolExposureMode',
+  'deferredProviderMode',
+  'deferredNativeTools',
+  'deferredSurfaceMode',
+  'deferredToolUsage',
+  'deferredDefaultTools',
+  'deferredSelectedTools',
+  'deferredDiscoveredTools',
+  'deferredCallableTools',
+  'deferredAnnouncedTools',
+  'deferredToolDeltaRevision',
+  'nativeDeferredDiscovery',
+  'mcpServerInstructions',
+];
+
+/**
+ * Agent (worker) sessions. Call right after their tools were resolved
+ * (create, resume, route change): on a bridge provider the eager surface
+ * becomes the full-mode core plus the bridge, built only from those
+ * role/policy-filtered tools; a native provider keeps the full array. A
+ * session honouring its own schema allowlist (a hidden specialist role) is
+ * already a small explicit surface and keeps it. `existing`: the session had
+ * a surface before, so a changed exposure is a migration.
+ */
+export function applyAgentToolExposure(session, { existing = false } = {}) {
+  if (!session || !Array.isArray(session.tools) || !isAgentOwner(session)) return false;
+  const before = sessionToolExposure(session);
+  const allowlisted = honoredSchemaAllowlist(session.schemaAllowedTools, { ownerIsAgent: true, agent: session.agent });
+  const bridge =
+    !allowlisted && toolExposureModeForProvider(session.provider, session.wireRoute) === TOOL_EXPOSURE_BRIDGE;
+  if (!bridge && before === null) return false;
+  // A surface an earlier bridge revision built is rebuilt now.
+  const outdated = bridgeSurfaceOutdated(session);
+  // The tools just resolved are the whole authority: no earlier catalog, MCP
+  // availability snapshot or pending MCP delta survives. (A bridge surface
+  // re-takes the snapshot at its next request boundary; a native agent has no
+  // refresh, so a stale snapshot would hide a connected server's tools.)
+  delete session.deferredToolCatalog;
+  delete session.deferredLateToolCatalog;
+  delete session.deferredMcpToolNames;
+  delete session.pendingDeferredToolDelta;
+  if (bridge) {
+    // The resolved list may be shared (prepared-resume cache): rebuild a copy.
+    session.tools = session.tools.slice();
+    applyDeferredToolSurface(session, 'full', [], { provider: session.provider, model: session.model });
+  } else {
+    for (const field of AGENT_BRIDGE_FIELDS) delete session[field];
+    // Without bridge state the fixed slot composes empty: the guidance goes.
+    if (Array.isArray(session.messages)) applyInitialDeferredToolManifestToBp2(session, [], { rebuild: true });
+    delete session.deferredToolBp2Applied;
+  }
+  const changed = before !== sessionToolExposure(session) || outdated;
+  if (existing && changed) markToolSurfaceMigrated(session);
+  return changed;
+}

package/src/runtime/agent/orchestrator/session/loop/tool-phase.mjs

@@ -8,6 +8,7 @@ import { traceLoopPhaseTiming } from './diagnostics.mjs';
 import { processToolBatch } from '../tool-batch.mjs';
 import { CROSS_TURN_CAP, REPEAT_FAIL_LIMIT } from './loop-state.mjs';
 import { markStepEffort } from './step-auto-effort.mjs';
+import { resolveExecutionToolCalls } from './tool-call-resolution.mjs';
 
 function isSleepLikeToolCall(call) {
   const name = String(call?.name || call?.toolName || call?.function?.name || '').toLowerCase();
@@ -15,7 +16,7 @@ function isSleepLikeToolCall(call) {
 }
 
 export async function runToolPhase(state, round, sent, onToolCall) {
-  const { opts, messages, tools, sessionId, sessionRef, signal, response, suppressMidTurnText } = state;
+  const { opts, messages, tools, sessionId, sessionRef, signal, response } = state;
   state.noToolTurn.noteToolCallTurn();
   const calls = response.toolCalls;
   round.resolveToolCallId.all(calls);
@@ -24,8 +25,7 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   // UI. Providers that stream via onTextDelta already rendered it; providers
   // that return text only in response.content would otherwise show nothing
   // before the tool card. The engine de-dups against already-streamed text.
-  // Sub-agent sessions suppress it entirely — Lead only consumes the answer.
-  if (!suppressMidTurnText && typeof response.content === 'string' && response.content.trim()) {
+  if (typeof response.content === 'string' && response.content.trim()) {
     try {
       opts.onAssistantText?.(response.content);
     } catch {
@@ -34,9 +34,11 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   }
   // Per-turn batch shape — one row per assistant turn so trace consumers can
   // derive the multi-tool adoption ratio without scanning message bodies.
-  const toolBatchId = recordToolBatch(sessionId, calls, state.iterations);
+  // Audit records what runs: a bridged call_tool is recorded as its target.
+  // The wire calls stay the transcript identity (assistant turn below).
+  const toolBatchId = recordToolBatch(sessionId, resolveExecutionToolCalls(calls, sessionRef), state.iterations);
   await Promise.resolve(onToolCall?.(state.iterations, calls));
-  const assistantTurnMsg = buildToolCallAssistantMessage(response, { calls, suppressMidTurnText, opts });
+  const assistantTurnMsg = buildToolCallAssistantMessage(response, { calls, opts });
   commitAssistantMessage(messages, assistantTurnMsg, opts);
   try {
     opts.onToolPhaseStarted?.();

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -6,6 +6,7 @@
 // abort-aware call wrapper is ask-call-interrupt. This file owns the lock,
 // the loop and the runtime bookkeeping around each turn.
 import { createHash } from 'node:crypto';
+import { admitWorkspaceActivity } from '../../../../shared/worktrees/activity-gate.mjs';
 import {
   persistedAssistantTranscriptMetadata,
   persistedUserTranscriptMetadata,
@@ -38,6 +39,16 @@ const traceAskStart = (sessionId, explicitPrefetch) => {
   );
 };
 
+/** A background follow-up ask has no caller to reject to; its failure would
+ *  otherwise strand the pending input silently. */
+const logFollowUpFailure = (sessionId) => (error) => {
+  try {
+    process.stderr.write(`[agent-ask] follow-up ask failed session=${sessionId}: ${error?.message || error}\n`);
+  } catch {
+    /* best-effort */
+  }
+};
+
 /** The transcript timestamps the caller supplied for this ask: the persisted
  *  user metadata plus a one-shot reader for the assistant metadata. */
 export function createAskTranscriptMeta(rawTranscriptMeta) {
@@ -66,7 +77,13 @@ export function createAskTranscriptMeta(rawTranscriptMeta) {
  *  the turn state and rethrows. Returns the terminal result preview and the
  *  follow-ups drained right after the provider accepted the turn. */
 async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOverride, transcript, askStartedAt }) {
+  let releaseWorkspace;
   try {
+    releaseWorkspace = await admitWorkspaceActivity(
+      sessionId,
+      cwdOverride || opened.turn.session.cwd || process.cwd(),
+      opened.runtime.controller?.signal
+    );
     const prepared = await prepareAskTurn({ sessionId, opened, input, cwdOverride, transcriptMeta: transcript.user });
     const result = await runAskAgentLoop({
       sessionId,
@@ -105,8 +122,12 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       generation: opened.askGeneration,
       turnCheckpointToken: opened.turnToken,
       runtime: opened.runtime,
+      transcriptMeta: transcript.raw,
+      askStartedAt,
     });
     throw err;
+  } finally {
+    releaseWorkspace?.();
   }
 }
 
@@ -122,9 +143,12 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
     process.stderr.write(`[agent-trace] lock-acquired waitedMs=${Date.now() - askStartedAt}\n`);
   }
   // A non-empty cross-process sweep starts an empty follow-up ask once the
-  // current session lock is released; it never delays completion.
+  // current session lock is released; it never delays completion. The
+  // failed-turn retry identity is one-shot: a follow-up runs queued input,
+  // never the retried turn. Nobody awaits it, so a failure is logged.
+  const followUpOpts = { ...askOpts, retryFailedTurn: undefined, retryTurnId: undefined, retryAttemptId: undefined };
   const kickFollowUpAsk = () => {
-    askSession(sessionId, '', null, onToolCall, cwdOverride, null, askOpts).catch(() => {});
+    askSession(sessionId, '', null, onToolCall, cwdOverride, null, followUpOpts).catch(logFollowUpFailure(sessionId));
   };
   // The mutex is held for the WHOLE askSession call, including any follow-up
   // turns drained from the pending-message queue below — the single outer
@@ -141,6 +165,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
   // A failed-turn retry rewinds only the turn it retries, never a drained
   // follow-up turn.
   let retryFailedTurn = askOpts.retryFailedTurn === true;
+  let retryTurnId = askOpts.retryTurnId;
   try {
     // Turn loop (pendingMessages pattern): run the current prompt, then drain
     // any `agent type=send` messages that were queued while this turn was in
@@ -163,6 +188,11 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         input.retryFailedTurn = true;
         retryFailedTurn = false;
       }
+      if (retryTurnId) {
+        input.retryTurnId = retryTurnId;
+        input.retryAttemptId = askOpts.retryAttemptId;
+        retryTurnId = null;
+      }
       // Synchronous pre-await setup (must happen before any await so
       // closeSession() can't interleave between load and registration).
       const claimed = claimTurnRuntime({
@@ -217,7 +247,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             if (count <= 0) return;
             kickFollowUpAsk();
           })
-          .catch(() => {});
+          .catch(logFollowUpFailure(sessionId));
       });
       return result;
     }

package/src/runtime/agent/orchestrator/session/manager/ask-support.mjs

@@ -13,10 +13,6 @@ export async function settleAskCleanup(promise, { timeoutMs } = {}) {
 }
 
 // Live Agent projection is a per-ask send opt, never a session field.
-// Callers that pass onTextDelta/onAssistantText still need `liveProjection`
-// to un-suppress provider streaming: askSession always wraps those
-// callbacks for interruption tracking, so agent-loop cannot infer intent
-// from `typeof opts.onTextDelta === 'function'`.
 export function resolveAskLiveProjection(askOpts = {}) {
   return askOpts?.liveProjection === true;
 }

package/src/runtime/agent/orchestrator/session/manager/ask-turn-auto-effort.mjs

@@ -15,8 +15,13 @@ import {
   resolveAutoEffort,
 } from '../../providers/auto-effort.mjs';
 import { builtinFeatureActive } from '../../runtime-core/builtin-features.mjs';
-import { effortOptionsFor } from '../../runtime-core/effort.mjs';
-import { effortJudgeSupportsSteps, judgeTurn, recordEffortDecision } from '../../../../effort-judge/judge-client.mjs';
+import { effortOptionsFor, warnEmptyAutoEffortLadder } from '../../runtime-core/effort.mjs';
+import {
+  effortJudgeSupportsSteps,
+  judgeTurn,
+  prewarmEffortJudge,
+  recordEffortDecision,
+} from '../../../../effort-judge/judge-client.mjs';
 import { promptContentText } from './prompt-utils.mjs';
 
 // Every cache-safe route judges its tool-result steps the same way. Measured
@@ -53,6 +58,21 @@ export function autoEffortMode() {
   }
 }
 
+/**
+ * Starts the judge worker when a session is created or opened on a route that
+ * Auto effort can judge, so the first judged turn does not wait for the cold
+ * load. Fire-and-forget: it never throws and never waits on the load.
+ */
+export function prewarmSessionAutoEffort(session, provider) {
+  try {
+    if (autoEffortMode() === 'off' || session?.autoEffort === false) return false;
+    if (!turnEffortConfigurationMode(session, provider)) return false;
+    return prewarmEffortJudge();
+  } catch {
+    return false;
+  }
+}
+
 function lastText(messages, role) {
   for (let i = (messages?.length || 0) - 1; i >= 0; i--) {
     const message = messages[i];
@@ -98,6 +118,7 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
   // the judge is not asked (in observe mode too: nothing would be logged).
   if (!autoEffortApplicable({ base, options })) {
     recordEffortDecision({ ...record, skipped: 'default-outside-auto-range' });
+    warnEmptyAutoEffortLadder(session.provider, session.model, base);
     return null;
   }
   // The previous user request shows the work a short follow-up continues.

package/src/runtime/agent/orchestrator/session/manager/ask-turn-commit.mjs

@@ -120,22 +120,44 @@ function recordAgentRuntimeCall(session, result) {
 export async function recordAskUsage({ session, result, askStartedAt, turnSignal }) {
   const prefixHashForLog = recordAgentRuntimeCall(session, result);
   if (!result.usage) return;
-  const inputTokens = result.usage.inputTokens || 0;
-  const outputTokens = result.usage.outputTokens || 0;
-  const cacheReadTokens = result.usage.cachedTokens || 0;
-  const cacheWriteTokens = result.usage.cacheWriteTokens || 0;
+  await logSessionLlmUsage({
+    session,
+    usage: result.usage,
+    startedAt: askStartedAt,
+    signal: turnSignal,
+    prefixHash: prefixHashForLog,
+    transportTiming: result.transportTiming || null,
+  });
+  recordStandaloneStatusTelemetry(session, result, Date.now() - askStartedAt);
+}
+
+/** The usage-ledger row of one provider call billed to `session`. `mode`
+ *  labels a call made outside the turn loop (a /btw side question). */
+export async function logSessionLlmUsage({
+  session,
+  usage,
+  startedAt,
+  signal = null,
+  prefixHash = null,
+  transportTiming = null,
+  mode = null,
+}) {
+  const inputTokens = usage.inputTokens || 0;
+  const outputTokens = usage.outputTokens || 0;
+  const cacheReadTokens = usage.cachedTokens || 0;
+  const cacheWriteTokens = usage.cacheWriteTokens || 0;
   // Unified total-prompt field. Anthropic = input+cache_read+cache_write
   // (additive); OpenAI OAuth/API/Gemini = input_tokens already includes the
   // cached portion (inclusive), so the fallback must not double-count.
   const { isInclusiveProvider, computeCostUsd } = await runAbortable(
-    turnSignal,
+    signal,
     () => import('../../../../shared/llm/cost.mjs')
   );
   const inclusive = isInclusiveProvider(session.provider);
   let promptTokens = inputTokens + cacheReadTokens + cacheWriteTokens;
-  if (typeof result.usage.promptTokens === 'number') promptTokens = result.usage.promptTokens;
+  if (typeof usage.promptTokens === 'number') promptTokens = usage.promptTokens;
   else if (inclusive) promptTokens = Math.max(inputTokens, cacheReadTokens + cacheWriteTokens);
-  let costUsd = result.usage.costUsd || 0;
+  let costUsd = usage.costUsd || 0;
   if (!costUsd) {
     try {
       costUsd = computeCostUsd({
@@ -145,7 +167,7 @@ export async function recordAskUsage({ session, result, askStartedAt, turnSignal
         outputTokens,
         cacheReadTokens,
         cacheWriteTokens,
-        cacheWrite1hTokens: result.usage.cacheWrite1hTokens || 0,
+        cacheWrite1hTokens: usage.cacheWrite1hTokens || 0,
       });
     } catch {
       /* best-effort */
@@ -158,7 +180,8 @@ export async function recordAskUsage({ session, result, askStartedAt, turnSignal
     preset: session.presetName || null,
     model: session.model,
     provider: session.provider,
-    duration: Date.now() - askStartedAt,
+    ...(mode ? { mode } : {}),
+    duration: Date.now() - startedAt,
     profileId: session.profileId || null,
     sessionId: session.id,
     inputTokens,
@@ -166,11 +189,10 @@ export async function recordAskUsage({ session, result, askStartedAt, turnSignal
     cacheReadTokens,
     cacheWriteTokens,
     promptTokens,
-    prefixHash: prefixHashForLog,
+    prefixHash,
     costUsd,
-    transportTiming: result.transportTiming || null,
+    transportTiming,
   });
-  recordStandaloneStatusTelemetry(session, result, Date.now() - askStartedAt);
 }
 
 /** Persist opaque providerState for stateful providers. The update bit