mixdog 1.2.2 → 1.2.4

package/src/runtime/tidy/apply.mjs

@@ -2,7 +2,9 @@
 // atomicWrite, and each written path runs the same post-write invalidation trio
 // the builtin edit adapters run (external-tool-adapters.mjs:16-26) — result
 // cache, code-graph dirty paths, read snapshot — so a formatted file is not
-// served from a stale cache or hidden behind "[file unchanged]".
+// served from a stale cache or hidden behind "[file unchanged]". Every write
+// also reaches the session's turn review as its own file change (counted and
+// undoable like an edit-tool write).
 import { readFileSync, statSync } from 'node:fs';
 import { isAbsolute, resolve } from 'node:path';
 import { atomicWrite } from '../agent/orchestrator/tools/builtin/atomic-write.mjs';
@@ -15,6 +17,7 @@ import {
   isWindowsDevicePath,
 } from '../shared/device-paths.mjs';
 import { markCodeGraphDirtyPaths } from '../shared/code-graph-state.mjs';
+import { reviewFileContent } from '../shared/bounded-file-read.mjs';
 
 /** Same write-target guards the builtin edit surfaces enforce. */
 export function guardTidyWritePath(fullPath) {
@@ -130,6 +133,8 @@ async function writeThroughPipeline(fullPath, content, { sessionId = null, signa
 export async function applyStructuralFixes({ cwd, matchesByFile, sessionId = null, signal = null } = {}) {
   const applied = [];
   const rejected = [];
+  // Every file written, with its exact before/after bytes, for the turn review.
+  const written = [];
   for (const [file, matches] of Object.entries(matchesByFile || {})) {
     const fixes = matches.filter((match) => match?.fix).map((match) => ({ ...match.fix, ruleId: match.ruleId }));
     if (fixes.length === 0) continue;
@@ -153,12 +158,52 @@ export async function applyStructuralFixes({ cwd, matchesByFile, sessionId = nul
       continue;
     }
     try {
-      const next = applyReplacements(readFileSync(fullPath), plan.replacements);
+      const current = readFileSync(fullPath);
+      const next = applyReplacements(current, plan.replacements);
       await writeThroughPipeline(fullPath, next, { sessionId, signal });
+      written.push({ fullPath, before: current, after: next });
       applied.push({ file, fixes: plan.replacements.length });
     } catch (error) {
       rejected.push({ file, reason: error?.message || String(error) });
     }
   }
+  await recordTidyWrites(cwd, sessionId, written);
   return { applied, rejected };
 }
+
+// The turn-review recorder is loaded on first use: it pulls in the edit-tool
+// stack, which a tidy check never needs.
+async function recordTidyWrites(cwd, sessionId, changes) {
+  if (!sessionId || changes.length === 0) return;
+  const { recordToolFileChanges } = await import('../agent/orchestrator/tools/patch/ui-diff.mjs');
+  recordToolFileChanges({ sessionId, basePath: cwd, changes });
+}
+
+/** Each file's state before an engine rewrites it in place, for the turn
+ *  review (see reviewFileContent); a path that cannot be read is left out. */
+export function captureWriteBaselines(fullPaths) {
+  const baselines = new Map();
+  for (const fullPath of fullPaths) {
+    try {
+      baselines.set(fullPath, reviewFileContent(fullPath));
+    } catch {
+      /* not a readable regular file: never recorded */
+    }
+  }
+  return baselines;
+}
+
+/** Record in-place engine rewrites of `fullPaths` as this session's own file
+ *  changes: their captured before-states against the disk now. */
+export async function recordEngineWrites({ cwd, sessionId, baselines, fullPaths }) {
+  const changes = [];
+  for (const fullPath of fullPaths) {
+    if (!baselines.has(fullPath)) continue;
+    try {
+      changes.push({ fullPath, before: baselines.get(fullPath), after: reviewFileContent(fullPath) });
+    } catch {
+      /* no longer a readable regular file: never recorded */
+    }
+  }
+  await recordTidyWrites(cwd, sessionId, changes);
+}

package/src/runtime/tidy/run-engines.mjs

@@ -8,7 +8,13 @@ import { filesForLanguages } from './languages.mjs';
 import { mapLimit } from './process.mjs';
 import { runnerFor } from './runners/index.mjs';
 import { DEFAULT_ENGINE_TIMEOUT_MS } from './runners/shared.mjs';
-import { fullPathFor, guardTidyWritePath, noteWrittenFiles } from './apply.mjs';
+import {
+  captureWriteBaselines,
+  fullPathFor,
+  guardTidyWritePath,
+  noteWrittenFiles,
+  recordEngineWrites,
+} from './apply.mjs';
 
 const CHECK_CONCURRENCY = 3;
 
@@ -75,6 +81,7 @@ async function runOne({ engine, files, cwd, mode, apply, timeoutMs, signal, sess
     return result;
   }
   const before = new Map(candidates.map((file) => [file, fileDigest(fullPathFor(cwd, file))]));
+  const baselines = sessionId ? captureWriteBaselines(candidates.map((file) => fullPathFor(cwd, file))) : null;
   let fixResult;
   try {
     fixResult = await runner.fix({
@@ -92,10 +99,9 @@ async function runOne({ engine, files, cwd, mode, apply, timeoutMs, signal, sess
   const changed = candidates.filter((file) => fileDigest(fullPathFor(cwd, file)) !== before.get(file));
   // The engine wrote in place; run the same invalidation trio a pipeline write
   // would have run for each file it touched.
-  noteWrittenFiles(
-    changed.map((file) => fullPathFor(cwd, file)),
-    { sessionId }
-  );
+  const changedPaths = changed.map((file) => fullPathFor(cwd, file));
+  noteWrittenFiles(changedPaths, { sessionId });
+  if (baselines) await recordEngineWrites({ cwd, sessionId, baselines, fullPaths: changedPaths });
   result.filesChanged = changed;
   if (fixResult?.error) result.error = fixResult.error;
   if (fixResult?.truncated) result.truncated = true;

package/src/session-runtime/agent-tool-routing.mjs

@@ -15,19 +15,25 @@ export function createRoutedAgentTool({ rt, agentTool, executeAgentControl = nul
       if (typeof executeAgentControl !== 'function') {
         return agentTool.closeAll(reason, scope);
       }
-      void executeAgentControl(
-        {
-          type: '__close_all',
-          reason: String(reason || 'agent owner closed'),
-        },
-        {
-          callerCwd: rt.currentCwd,
-          invocationSource: 'runtime-lifecycle',
-          callerSessionId: scope?.callerSessionId || rt.session?.id || null,
-          clientHostPid: rt.session?.clientHostPid || process.pid,
-        }
-      ).catch(() => {});
-      return undefined;
+      // The promise is returned so teardown can wait for closing to finish
+      // producing its final index writes before it drains them.
+      return Promise.resolve(
+        executeAgentControl(
+          {
+            type: '__close_all',
+            reason: String(reason || 'agent owner closed'),
+          },
+          {
+            callerCwd: rt.currentCwd,
+            invocationSource: 'runtime-lifecycle',
+            callerSessionId: scope?.callerSessionId || rt.session?.id || null,
+            clientHostPid: rt.session?.clientHostPid || process.pid,
+          }
+        )
+      ).then(
+        () => undefined,
+        () => undefined
+      );
     },
   };
   const agentStatusState = () => {

package/src/session-runtime/boot/apis.mjs

@@ -138,6 +138,7 @@ function wireToolPolicyRefresh(boot) {
     getMode: () => rt.mode,
     getConfig: () => rt.config,
     getDataDir: () => dataDirOf(cfgMod),
+    getActiveTurnCount: () => rt.activeTurnCount || 0,
     modelStandaloneTools: boot.modelStandaloneTools,
     featureDisallowedTools: boot.featureDisallowedTools,
     loadCoreMemoryContext: boot.loadCoreMemoryContext,
@@ -231,7 +232,11 @@ function developerAdapters(boot) {
         reg.disableProvider?.(provider);
         return;
       }
-      await ensureProvidersReady(config?.providers || {});
+      // Provider init can take long (OAuth/network); the option is already saved
+      // and adopted, so the toggle must not wait on it.
+      void ensureProvidersReady(config?.providers || {}).catch((error) => {
+        console.warn(`[providers] ${provider} init after enabling failed: ${error?.message || error}`);
+      });
     },
   };
 }
@@ -488,6 +493,7 @@ function modelRouteApiFor(boot) {
       rt.route = v;
     },
     getSession: () => rt.session,
+    getSessionGeneration: () => rt.sessionGeneration,
     setSession: boot.adoptSession,
     getAddressedSessionId: () => rt.addressedSessionId,
     getConfigHasSecrets: () => rt.configHasSecrets,
@@ -562,12 +568,18 @@ function workspaceApiFor(boot) {
     getReservedSessionId: () => rt.reservedSessionId,
     getCurrentCwd: () => rt.currentCwd,
     getDesktopSession: () => rt.desktopSession,
+    setDesktopSession: (next) => {
+      rt.desktopSession = next;
+    },
     getConfig: () => rt.config,
     createCurrentSession: (reason) => boot.createCurrentSession(reason),
-    applyResolvedCwd: (cwd) => boot.applyResolvedCwd(cwd),
-    persistSession: (session) => saveSession(session, { immediate: true }),
-    refreshWorkspaceContext: (session, cwd) =>
-      refreshWorkspacePrompt(session, cwd, { loadCoreMemoryContext: boot.loadCoreMemoryContext }),
+    applyResolvedCwd: (cwd, options) => boot.applyResolvedCwd(cwd, options),
+    // Durable save: on disk when it returns, throws when the write fails
+    // (immediate mode only queues it). Synchronous, so a transition never
+    // waits on the save worker, which may never come up.
+    persistSession: (session) => saveSession(session, { sync: true }),
+    refreshWorkspaceContext: (session, cwd, move) =>
+      refreshWorkspacePrompt(session, cwd, { loadCoreMemoryContext: boot.loadCoreMemoryContext, move }),
     invalidateCaches: () => {
       boot.invalidateContextStatusCache();
       boot.invalidatePreSessionToolSurface();
@@ -583,6 +595,7 @@ function workspaceApiFor(boot) {
 function sessionTurnApiFor(boot) {
   const { rt, tunables, remoteTranscript, routePreparation } = boot;
   return createSessionTurnApi({
+    applyPendingRoute: () => boot.modelRouteApi.applyPendingRoute(),
     prepareTurnWorkspace: boot.workspaceApi.prepareTurnWorkspace,
     admitTurnWorkspace: boot.workspaceApi.admitTurnWorkspace,
     getSession: () => rt.session,
@@ -594,6 +607,7 @@ function sessionTurnApiFor(boot) {
       rt.mode = v;
     },
     getActiveTurnCount: () => rt.activeTurnCount,
+    takePendingCompact: (sessionId) => rt.pendingCompactSessionIds?.delete(sessionId) === true,
     setActiveTurnCount: (v) => {
       rt.activeTurnCount = v;
     },
@@ -631,7 +645,7 @@ function sessionTurnApiFor(boot) {
     invalidatePreSessionToolSurface: boot.invalidatePreSessionToolSurface,
     refreshEmptySessionToolPolicy: boot.refreshEmptySessionToolPolicy,
     activeToolSurface: boot.activeToolSurface,
-    applyResolvedCwd: boot.applyResolvedCwd,
+    switchProject: boot.workspaceApi.switchProject,
     resolveCwdPath: boot.resolveCwdPath,
     agentStatusState: boot.agentStatusState,
     notificationListeners: boot.notificationListeners,

package/src/session-runtime/boot/config.mjs

@@ -10,6 +10,7 @@ import { bootProfile } from '../boot-profile.mjs';
 import { createHookPayload } from '../hook-payload.mjs';
 import { readRuntimeTunables } from '../runtime-tunables.mjs';
 import { initSessionAddress } from '../session-address.mjs';
+import { trackSessionGeneration } from '../model-route/route-ownership.mjs';
 import { resolveRoute } from './shared.mjs';
 
 export async function resolveConfig(boot) {
@@ -74,6 +75,7 @@ export async function resolveConfig(boot) {
 
 function initRuntimeState(rt, params) {
   rt.mode = normalizeToolMode(params.toolMode);
+  trackSessionGeneration(rt);
   rt.session = null;
   // A daemon-issued address may exist before provider setup. It is consumed by
   // createCurrentSession on the first actual turn, avoiding eager auth/model

package/src/session-runtime/boot/facade.mjs

@@ -38,16 +38,20 @@ export function buildFacade(boot) {
       },
       applyWorkspaceTransition: boot.workspaceApi.applyWorkspaceTransition,
       getWorkspace: boot.workspaceApi.getWorkspace,
+      getLiveWorkspace: boot.workspaceApi.getLiveWorkspace,
       getBranchMenu: boot.workspaceApi.getBranchMenu,
       getProjectBranchMenu: boot.workspaceApi.getProjectBranchMenu,
       selectBranch: boot.workspaceApi.selectBranch,
       selectProjectBranch: boot.workspaceApi.selectProjectBranch,
       mergeProjectBranch: boot.workspaceApi.mergeProjectBranch,
+      inspectProjectBranch: boot.workspaceApi.inspectProjectBranch,
+      manageProjectBranch: boot.workspaceApi.manageProjectBranch,
       requestWorktree: boot.workspaceApi.requestWorktree,
       mergeWorkspace: boot.workspaceApi.mergeWorkspace,
       removeWorktree: boot.workspaceApi.removeWorktree,
       listWorktrees: boot.workspaceApi.listWorktrees,
       pruneWorktrees: boot.workspaceApi.pruneWorktrees,
+      onWorktreeSetup: boot.workspaceApi.onWorktreeSetup,
       claimSetupRequest: setupTool.claimSetupRequest,
       isSetupRequestActive: setupTool.isSetupRequestActive,
       completeSetupRequest: setupTool.completeSetupRequest,

package/src/session-runtime/boot/infrastructure.mjs

@@ -14,6 +14,8 @@ import { createSelfUpdateController } from '../self-update.mjs';
 import { createCompletionWakeScheduler, createNotificationBus } from '../notification-bus.mjs';
 import { createSkillsApi } from '../skills-api.mjs';
 import { createCwdPlugins } from '../cwd-plugins.mjs';
+import { listProjectsStrict } from '../../runtime/shared/projects.mjs';
+import { isWithin } from '../../runtime/shared/worktrees/paths.mjs';
 import { STANDALONE_DATA_DIR } from '../runtime-paths.mjs';
 import { SessionAddressError, isAdmissionOpen, ownerLifecycle } from '../session-address.mjs';
 import { dataDirOf } from './shared.mjs';
@@ -188,10 +190,12 @@ export function sessionAdopter(boot) {
       // Bind every adopted session, including a cold resume and a session
       // materialized before ask(). The shared tool executor must never fall
       // back to changing only a detached session object's cwd.
+      // The Lead's own `session set-project` call: the Project switch
+      // authority, tolerating the calling turn.
       Object.defineProperty(v, '_applyResolvedCwdForCaller', {
         value: (nextCwd) => {
           if (rt.session?.id !== v.id) throw new Error('cwd: the calling session is no longer active');
-          return boot.applyResolvedCwd(nextCwd, { persistProjectSelection: true });
+          return boot.workspaceApi.switchProject(nextCwd, { ownTurn: true });
         },
         enumerable: false,
         configurable: true,
@@ -268,6 +272,7 @@ function wireCwdPlugins(boot) {
     onCwdChanged: () => {
       void boot.connectConfiguredMcp({ reconcile: true }).catch(() => {});
     },
+    isProjectFolder: (cwd) => listProjectsStrict().some((project) => isWithin(project.path, cwd)),
     countSkillFiles,
     writeLastSessionCwd,
     updateCurrentCwdOverride,

package/src/session-runtime/boot/session.mjs

@@ -24,7 +24,6 @@ export function wireSessionLifecycle(boot) {
       params.modelParameters !== undefined,
     invalidatePreSessionToolSurface: boot.invalidatePreSessionToolSurface,
     invalidateOutputStyleStatusCache: boot.invalidateOutputStyleStatusCache,
-    invalidateSkills: boot.invalidateSkills,
     connectConfiguredMcp: boot.connectConfiguredMcp,
     configureEmbedding,
   });
@@ -125,6 +124,7 @@ export function wireSessionLifecycle(boot) {
   scheduleModelCatalogWarmup();
   scheduleStatuslineUsageWarmup();
   scheduleAutomationAutostart(tunables.remoteAutoStartDelayMs);
-  // Auto effort touches neither network nor memory at boot: the first judged
-  // turn fetches/updates the model and loads the judge (judge-client.mjs).
+  // Auto effort touches neither network nor memory at boot: creating or
+  // opening a session loads the judge, and the first judged turn
+  // fetches/updates the model (judge-client.mjs).
 }

package/src/session-runtime/boot/tools.mjs

@@ -21,6 +21,7 @@ import { TOOL_DEFS as OFFICE_TOOL_DEFS } from '../../runtime/office/tool-defs.mj
 import { TOOL_DEFS as MEDIA_TOOL_DEFS } from '../../runtime/media/tool-defs.mjs';
 import { TOOL_DEFS as TIDY_TOOL_DEFS } from '../../runtime/tidy/tool-defs.mjs';
 import { TOOL_DEFS as VISUALIZE_BRIDGE_TOOL_DEFS } from '../../runtime/visualize-bridge/tool-defs.mjs';
+import { ASK_USER_TOOL_DEFS } from '../../runtime/agent/orchestrator/runtime-core/ask-user-tool-defs.mjs';
 import { SETUP_TOOL_DEFS } from '../setup-tool/tool-defs.mjs';
 import { createSetupToolExecutor } from '../setup-tool/executor.mjs';
 import { bootProfile } from '../boot-profile.mjs';
@@ -70,6 +71,8 @@ function wireAgent(boot) {
     mcpScopeId: rt.mcpScopeId,
     awaitKeychainPrewarm,
     isKeychainPrewarmReady: () => rt.keychainPrewarmWaitDone,
+    // Lazy: wireProviders runs after wireTools and defines the catalog.
+    listProviderModels: (options) => boot.collectProviderModels(options),
     notifySessionCompletion,
     // SubagentStart/SubagentStop: bridge internal worker spawn/finish to the
     // standard hook bus. agent_type is passed top-level via hookCommonPayload.
@@ -159,6 +162,7 @@ function wireToolSurface(boot) {
     tidyToolDefs: TIDY_TOOL_DEFS,
     visualizeToolDefs: VISUALIZE_BRIDGE_TOOL_DEFS,
     setupToolDefs: SETUP_TOOL_DEFS,
+    askUserToolDefs: ASK_USER_TOOL_DEFS,
     goalTools: goalRuntime.tools,
     agentTools: agentTool.tools,
     skillToolEnabled: !envFlag('MIXDOG_DISABLE_SKILLS'),
@@ -246,10 +250,12 @@ function wireInternalTools(boot) {
       runNativeWebSearch: (...a) => boot.runNativeWebSearch(...a),
       activeToolSurface: boot.activeToolSurface,
       mcpStatus: boot.mcpStatus,
-      applyResolvedCwd: boot.applyResolvedCwd,
       skillToolContent: boot.skillToolContent,
       // Late-bound: the workspace authority is built with the API slices.
       getWorkspaceApi: () => boot.workspaceApi || null,
+      getSessionManager: () => boot.mgr || null,
+      getLifecycleApi: () => boot.lifecycleApi || null,
+      executeSessionControl: boot.params.executeSessionControl,
     }),
   });
   Object.assign(boot, { setupTool, disposeInternalTools });

package/src/session-runtime/conversation-import/service.mjs

@@ -20,7 +20,7 @@ import {
   importOriginKey,
 } from '../../runtime/agent/orchestrator/session/conversation-import/imported-session.mjs';
 import { IMPORT_WARNING_CWD_MISSING } from '../../runtime/agent/orchestrator/session/conversation-import/turns.mjs';
-import { sessionPath } from '../../runtime/agent/orchestrator/session/store/paths-heartbeat.mjs';
+import { sessionPath } from '../../runtime/agent/orchestrator/session/store/session-paths.mjs';
 import {
   cachedMeta,
   convertCandidateFile,

package/src/session-runtime/cwd-plugins/cwd-apply.mjs

@@ -21,20 +21,21 @@ export function createCwdApply({
   updateCurrentCwdOverride,
   persistSession,
   onCwdChanged,
+  isProjectFolder,
   clean,
   resolve,
   statSync,
 }) {
   function resolveCwdPath(value) {
     const raw = clean(value);
-    if (!raw) throw new Error('cwd: path is required for action=set');
+    if (!raw) throw new Error('session: path is required for action=set-project');
     const next = resolve(getCurrentCwd() || process.cwd(), raw);
     const stat = statSync(next);
     if (!stat.isDirectory()) throw new Error(`cwd: not a directory: ${next}`);
     return next;
   }
 
-  function persistProjectSelection(session, currentCwd) {
+  function persistProjectSelection(session, currentCwd, classifyByMembership) {
     // A Lead in its worktree keeps the registered Project as projectPath; a
     // switch elsewhere leaves the worktree at a new workspace revision.
     const { workspace, projectPath } = workspaceForProjectSelection(session, currentCwd);
@@ -44,7 +45,13 @@ export function createCwdApply({
     }
     const desktop = getDesktopSession?.() || session?.desktopSession;
     if (desktop && typeof desktop === 'object') {
-      const nextDesktop = { classification: 'project', projectPath };
+      // A desktop/remote move (classifyByMembership) names a registered
+      // Project or the task workspace: outside every registered Project it is
+      // a task again. The model's own set-project keeps any folder it picked.
+      const nextDesktop =
+        classifyByMembership && !isProjectFolder(projectPath)
+          ? { classification: 'task', projectPath: null }
+          : { classification: 'project', projectPath };
       setDesktopSession?.(nextDesktop);
       if (session) session.desktopSession = nextDesktop;
     }
@@ -59,7 +66,7 @@ export function createCwdApply({
   // message history. The live execution cwd is retargeted in place; the BP3
   // session snapshot remains the session-start environment. `onCwdChanged`
   // lets MCP reconnect only the plugin servers that run in the session cwd.
-  function applyResolvedCwd(nextCwd, { persistProjectSelection: persist = false } = {}) {
+  function applyResolvedCwd(nextCwd, { persistProjectSelection: persist = false, classifyByMembership = false } = {}) {
     const resolved = resolve(nextCwd);
     const stat = statSync(resolved);
     if (!stat.isDirectory()) throw new Error(`cwd: not a directory: ${resolved}`);
@@ -70,7 +77,7 @@ export function createCwdApply({
     if (session) session.cwd = currentCwd;
     updateCurrentCwdOverride?.(currentCwd);
     writeLastSessionCwd(currentCwd, session?.clientHostPid);
-    if (persist) persistProjectSelection(session, currentCwd);
+    if (persist) persistProjectSelection(session, currentCwd, classifyByMembership);
     // Lazy mode: before the first turn (e.g. the initial project-selection
     // cwd set), do NOT prewarm — that is exactly the post-first-frame freeze
     // we are avoiding. Once a turn has run, an in-session cwd switch DOES

package/src/session-runtime/goal-facade-api.mjs

@@ -44,9 +44,9 @@ export function createGoalFacadeApi({ agentStatusState, createCurrentSession, ge
       const sessionId = getSessionId();
       return sessionId ? goalRuntime.settleTurn(sessionId, detail) : null;
     },
-    reactivateUsageLimitedGoal(goalId) {
+    reactivateUsageLimitedGoal(goalId, options) {
       const sessionId = getSessionId();
-      return sessionId ? goalRuntime.reactivateUsageLimited(sessionId, goalId) : null;
+      return sessionId ? goalRuntime.reactivateUsageLimited(sessionId, goalId, options) : null;
     },
     archiveCompletedGoalOnUserInput() {
       const sessionId = getSessionId();

package/src/session-runtime/internal-tool-executor/ask-user-tool.mjs

@@ -0,0 +1,91 @@
+// ask_user: put 1-4 multiple-choice questions to the user through the session's
+// tool-approval hook (kind: 'question') and report the answers to the model.
+import {
+  validateAskUserQuestions,
+  ASK_USER_MAX_TEXT,
+} from '../../runtime/agent/orchestrator/runtime-core/ask-user-tool-defs.mjs';
+import { createCallerContextResolvers } from './caller-context.mjs';
+import { runAbortable } from '../../runtime/shared/abort-race.mjs';
+
+const NO_USER =
+  'No user is available to answer in this session. Proceed with your best judgment and state the choices you made.';
+const DISMISSED =
+  'User closed the questions without answering. Proceed with your best judgment; ask again only if something new depends on it.';
+
+/** Wire answers -> array aligned with questions; invalid entries become null. */
+export function normalizeAskUserAnswers(answers, questions) {
+  const list = Array.isArray(answers) ? answers.slice(0, 4) : [];
+  return questions.map((q, i) => {
+    const entry = list[i];
+    if (!entry || typeof entry !== 'object') return null;
+    const labels = new Set(q.options.map((o) => o.label));
+    const rawSelected = entry.selected == null ? [] : entry.selected;
+    if (!Array.isArray(rawSelected) || !rawSelected.every((l) => typeof l === 'string' && labels.has(l))) return null;
+    if (entry.text != null && (typeof entry.text !== 'string' || entry.text.length > ASK_USER_MAX_TEXT)) return null;
+    const selected = q.multi_select === true ? [...new Set(rawSelected)] : rawSelected.slice(0, 1);
+    const text = typeof entry.text === 'string' ? entry.text.trim() : '';
+    if (!selected.length && !text) return null;
+    return text ? { selected, text } : { selected };
+  });
+}
+
+// Strings are JSON-quoted so a quote inside one cannot end it early; typed
+// text stays apart from the picked labels (`"picked" + "typed" (typed)`).
+export function formatAskUserAnswers(questions, answers) {
+  const quote = (text) => JSON.stringify(text);
+  const parts = questions.map((q, i) => {
+    const a = answers[i];
+    if (!a) return `${quote(q.question)}=(no answer)`;
+    const picked = a.selected.length ? quote(a.selected.join(', ')) : '';
+    const typed = a.text ? `${quote(a.text)} (typed)` : '';
+    return `${quote(q.question)}=${[picked, typed].filter(Boolean).join(' + ')}`;
+  });
+  return `User has answered your questions: ${parts.join('; ')}. You can now continue with these answers in mind.`;
+}
+
+/** A composer message sent instead of (or with) picking: kept when it is a
+ *  non-empty string within the typed-answer limit, else dropped. */
+export function normalizeAskUserReply(reply) {
+  if (typeof reply !== 'string' || reply.length > ASK_USER_MAX_TEXT) return '';
+  return reply.trim();
+}
+
+// `User replied in chat: "<reply>". ` leads, then the usual picks sentence
+// when any question was answered, else just the closing sentence.
+export function formatAskUserResult(questions, answers, reply) {
+  if (!reply) return formatAskUserAnswers(questions, answers);
+  const lead = `User replied in chat: ${JSON.stringify(reply)}. `;
+  if (answers.some(Boolean)) return `${lead}${formatAskUserAnswers(questions, answers)}`;
+  return `${lead}You can now continue with these answers in mind.`;
+}
+
+export function createAskUserToolHandlers({ rt }) {
+  const { sessionIdFor, signalFor } = createCallerContextResolvers(rt);
+  return {
+    ask_user: async (args, { callerCtx }) => {
+      const questions = validateAskUserQuestions(args);
+      const hook = callerCtx?.toolApprovalHook;
+      if (typeof hook !== 'function') return NO_USER;
+      // No wait limit (timeoutMs: null): the question settles when the user
+      // answers or dismisses it, or the turn is aborted.
+      const result = await runAbortable(signalFor(callerCtx), () =>
+        hook({
+          name: 'ask_user',
+          kind: 'question',
+          args: { questions },
+          reason: '',
+          timeoutMs: null,
+          sessionId: sessionIdFor(callerCtx),
+          toolCallId: callerCtx?.toolCallId || null,
+        })
+      );
+      if (result?.approved === true)
+        return formatAskUserResult(
+          questions,
+          normalizeAskUserAnswers(result.answers, questions),
+          normalizeAskUserReply(result.reply)
+        );
+      return DISMISSED;
+    },
+  };
+}

package/src/session-runtime/internal-tool-executor/bridge-tools.mjs

@@ -40,13 +40,15 @@ export function createBridgeToolHandlers({ rt }) {
     });
   };
 
-  // Read-only: no approval hook, no working directory.
+  // `run` is gated by the exec policy; the elevation approval comes from the
+  // runtime's gate (callerCtx), never from the model's args.
   const terminal = async (args, { callerCtx }) => {
     if (environmentDisabled(callerCtx, 'MIXDOG_FEATURE_TERMINAL')) {
       throw new Error('the terminal tool is disabled in this environment');
     }
     return await executeTerminalTool(args, {
       sessionId: sessionIdFor(callerCtx),
+      elevationApproved: callerCtx?.elevationApproved === true,
       signal: signalFor(callerCtx),
     });
   };

package/src/session-runtime/internal-tool-executor/knowledge-tools.mjs

@@ -1,6 +1,10 @@
 // Tools that read rather than act: web search/fetch, memory, the code graph,
 // the deferred tool catalog, and skill bodies.
-import { refreshDeferredMcpToolCatalog, renderToolSearch } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import {
+  refreshDeferredMcpToolCatalog,
+  renderToolSearch,
+} from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import { resolveDeferredSelectMode } from '../../runtime/agent/orchestrator/session/loop/deferred-call-through.mjs';
 import { dispatchWebSearchRuntimeTool, memoryToolArgsForCaller } from '../runtime-tool-routing.mjs';
 import { createCallerContextResolvers } from './caller-context.mjs';
 
@@ -31,10 +35,16 @@ export function createKnowledgeToolHandlers({
     return await memoryMod.handleToolCall(name, memoryToolArgsForCaller(args, callerCwd), signalFor(callerCtx));
   };
 
-  const toolSearch = (args) => {
-    const surface = activeToolSurface();
-    refreshDeferredMcpToolCatalog(surface, rt.config);
-    return renderToolSearch(args, surface, rt.mode, { mcpStatus });
+  // Catalog tools answer for the calling session's own scope, bridge or
+  // native: a worker sees its own catalog (its own allow/deny), never the
+  // lead's. Only a call that names no session uses the active surface.
+  const scopeSession = (callerCtx) => callerCtx?.callerSession || activeToolSurface();
+  const scopeMode = (session) => session?.deferredSurfaceMode || resolveDeferredSelectMode(session) || rt.mode;
+
+  const toolSearch = (args, { callerCtx } = {}) => {
+    const session = scopeSession(callerCtx);
+    refreshDeferredMcpToolCatalog(session, rt.config);
+    return renderToolSearch(args, session, scopeMode(session), { mcpStatus });
   };
 
   return {