mixdog 1.2.5 → 1.3.0

package/src/runtime/agent/orchestrator/session/loop/fresh-context.mjs

@@ -15,6 +15,8 @@ import {
   SUMMARY_OUTPUT_TOKENS,
   COMPACT_TARGET_MIN_TOKENS,
 } from '../compact.mjs';
+import { summarizeOnSharedPrefix } from '../compact/forked-summary.mjs';
+import { retireCompactionFork } from '../side-question-store.mjs';
 
 // Conversation summarization triggers independently of the post-compact target:
 // at 5% of the window, capped so a large window does not carry tens of
@@ -110,6 +112,39 @@ function summarizeConversation(target, ctx) {
   );
 }
 
+function sumUsage(a, b) {
+  if (!a || !b) return a || b || null;
+  return Object.fromEntries(Object.keys(a).map((key) => [key, (a[key] || 0) + (Number(b[key]) || 0)]));
+}
+
+// Summary policy. On the session's own provider and model the summary forks
+// the latest cached request (compact/forked-summary.mjs): the context is
+// already in the prompt cache, so reading it costs a tenth to a twentieth of
+// sending the text-only transcript uncached, and the summary sees the full
+// execution context. A different summary route (the maintenance model)
+// cannot share that cache; there the isolated text-only request runs: on
+// the usage ledger it cost a median $0.16 and 24.5 s against a projected
+// $0.19 and 27 s for a cache-read fork of the main model's median 500k-token
+// context (the fork is cheaper than a same-model isolated request, $0.20).
+// A fork that cannot run or fails falls back to the isolated request.
+async function summarizeOnRoute(route, ctx) {
+  const shared = await summarizeOnSharedPrefix({
+    sessionId: ctx.sessionId,
+    route,
+    conversationInput: ctx.conversationInput,
+    signal: ctx.signal,
+    timeoutMs: ctx.compactPolicy.handoffTimeoutMs,
+  });
+  if (shared.generated) return shared.generated;
+  ctx.signal?.throwIfAborted();
+  const generated = await summarizeConversation(route, ctx);
+  return {
+    ...generated,
+    usage: sumUsage(generated.usage, shared.usage),
+    diagnostics: { ...generated.diagnostics, mode: 'isolated', sharedPrefixFallback: shared.fallback },
+  };
+}
+
 // A maintenance summary model that is out of quota must not take the whole
 // turn down: the conversation's own model still has budget and can
 // summarize. Only exhaustion reroutes — every other compaction failure
@@ -118,7 +153,7 @@ function summarizeConversation(target, ctx) {
 async function summarizeWithQuotaFallback(ctx, routeInput) {
   const route = await resolveCompactionRoute(routeInput);
   try {
-    return { route, generated: await summarizeConversation(route, ctx) };
+    return { route, generated: await summarizeOnRoute(route, ctx) };
   } catch (error) {
     ctx.signal?.throwIfAborted();
     const status = Number(error?.status || error?.httpStatus || error?.response?.status || 0);
@@ -132,7 +167,7 @@ async function summarizeWithQuotaFallback(ctx, routeInput) {
       throw error;
     }
     try {
-      return { route: fallback, generated: await summarizeConversation(fallback, ctx) };
+      return { route: fallback, generated: await summarizeOnRoute(fallback, ctx) };
     } catch (fallbackError) {
       fallbackError.compactRoute = { provider: fallback.providerName, model: fallback.model };
       throw fallbackError;
@@ -236,6 +271,8 @@ export async function runFreshContextCompact({
         diagnostics: { ...result.diagnostics, noOp: true, reason: 'no_token_reduction' },
       };
     }
+    // The rewritten transcript is no longer what the saved request carried.
+    if (result.freshContext) retireCompactionFork(sessionId);
     return result;
   };
   const pipeline = {

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -16,6 +16,7 @@ import { isOffReadonlySurface } from './deferred-call-through.mjs';
 import { BRIDGE_CALL_TOOL_NAME, bridgeErrorText, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
 import { sessionAllowlistExcludes, sessionDisallows } from '../../runtime-core/deferred-tool-availability.mjs';
 import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
+import { agentMcpToolPermission, projectMcpToolDisabled } from '../../mcp/agent-connectors.mjs';
 
 const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'session']);
 const BRIDGE_DISCOVERY_TOOL_NAMES = new Set(['load_tool']);
@@ -122,6 +123,15 @@ export function preDispatchDenyForSession(sessionRef, call) {
   if (sessionDisallows(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available in this session.`;
   }
+  // An agent's connectors: a tool of a server it does not mount, or one set
+  // to `disabled`, stays refused though the process-wide registry knows it.
+  if (agentMcpToolPermission(sessionRef?.agent, schemaName) === 'disabled') {
+    return `Error: tool "${name}" is not available to this agent.`;
+  }
+  // The project the session runs in may switch a connector off as well.
+  if (projectMcpToolDisabled(sessionRef, schemaName)) {
+    return `Error: tool "${name}" is switched off in this project.`;
+  }
   if (isOffReadonlySurface(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available in this read-only session.`;
   }

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -7,6 +7,7 @@ import { traceCacheBreak } from '../../cache-break-trace.mjs';
 import { resolveLiveToolCwd } from './tool-exec.mjs';
 import { notifySkillsApplied, prepareExplicitSkills, recordAppliedSkills } from '../explicit-skills.mjs';
 import { addUsage, usageDeltaEvent } from './usage.mjs';
+import { isVisibleStreamProgress } from '../../../../shared/stream-progress.mjs';
 import { prepareProviderRequest } from './request-boundary.mjs';
 import { applyStepEffort } from './step-auto-effort.mjs';
 import { projectProviderRequest } from './request-projection.mjs';
@@ -181,6 +182,15 @@ export async function sendProviderRequest(state, round) {
     tools: round.sendTools,
     opts,
   });
+  // The first visible token of this request, for its generation time (queue,
+  // preflight and time-to-first-token stay out of the speed figures).
+  let firstVisibleAt = 0;
+  const callerOnStreamDelta = opts.onStreamDelta;
+  const observeStreamDelta = (kind, ...rest) => {
+    if (!firstVisibleAt && isVisibleStreamProgress(kind)) firstVisibleAt = Date.now();
+    return callerOnStreamDelta?.(kind, ...rest);
+  };
+  opts.onStreamDelta = observeStreamDelta;
   let result;
   try {
     result = await runWithProviderRequestToolsScope(round.requestToolScope, () =>
@@ -208,15 +218,19 @@ export async function sendProviderRequest(state, round) {
     sideQuestion?.discard();
     if (!(await advanceAgentRoute(state, error))) throw error;
     result = { action: 'retry_route' };
+  } finally {
+    if (opts.onStreamDelta === observeStreamDelta) opts.onStreamDelta = callerOnStreamDelta;
   }
   if (result.action === 'proceed') sideQuestion?.settle(result.response);
   else sideQuestion?.discard();
+  const sendEndedAt = Date.now();
   return {
     result,
     providerMessages,
     prefixGuardCandidate,
     sendStartedAt,
-    sendEndedAt: Date.now(),
+    sendEndedAt,
+    generationMs: firstVisibleAt ? Math.max(0, sendEndedAt - firstVisibleAt) : 0,
     preSendMs,
     toolResumeMs,
   };
@@ -429,6 +443,7 @@ export function settleSendResult(state, round, sent) {
             usage: reportedUsage,
             sendTools: round.sendTools,
             toolCalls: response.toolCalls?.length || 0,
+            generationMs: sent.generationMs,
           })
         )
       );

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -6,10 +6,16 @@ import { resolvePreToolAskApproval } from '../tool-helpers.mjs';
 import { runAbortable, throwIfAborted } from '../../../../../shared/abort-race.mjs';
 import { evaluateExecPolicy } from '../../../tools/bash-policy-scan.mjs';
 import { beginSessionApprovalWait } from '../../manager/runtime-liveness.mjs';
+import { agentMcpToolPermission } from '../../../mcp/agent-connectors.mjs';
+import { humanGateDecision, recordHumanDecision } from '../../human-gate/gate.mjs';
+import { applyEditedArgs } from '../../human-gate/requests.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
-async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision, keepArgs = false }) {
+async function askApproval(
+  call,
+  { callerSessionId, executeOpts, toolApprovalHook, decision, request = null, gate = null }
+) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
   // While the user decides, the session is waiting on them, not working.
   const releaseApprovalWait = beginSessionApprovalWait(callerSessionId);
@@ -24,40 +30,58 @@ async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHoo
         toolCallId: executeOpts.toolCallId || null,
         askReason,
         toolApprovalHook,
+        request,
       })
     );
   } finally {
     releaseApprovalWait();
   }
-  if (askOutcome.denial) return { denial: askOutcome.denial };
   const approval = askOutcome.approval;
-  if (!keepArgs && approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
+  await recordHumanDecision(gate, approval);
+  if (askOutcome.denial) return { denial: askOutcome.denial };
+  if (approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
+  // The card's edited text replaces the model's before the call runs.
+  if (request?.kind === 'outbound' && approval?.editedArgs) {
+    call.args = applyEditedArgs(call.args, approval.editedArgs, request.outbound?.editable);
+  }
+  // The user approved this very call on the richer outbound card.
+  if (request?.kind === 'outbound') call.outboundApproved = true;
   return null;
 }
 
+export const CONNECTOR_APPROVAL_REASON = 'This connector tool is set to ask before it runs for this agent.';
+
 /**
- * Approval gate for a shell call (or a terminal `run`) whose exec policy
- * decision is 'ask' (elevated launch). Runs after the final call is known. The
- * approval is granted for the exact command being asked about: an approval
- * reply cannot rewrite the args.
- * @returns {Promise<{ denial: string } | { elevationApproved: boolean }>}
+ * A connector tool the running agent set to `needs_approval` asks through the
+ * ordinary approval hook, whatever the PreToolUse hooks decided. Run after
+ * them, on the final call: a renamed call is judged under its final name.
+ * A call the outbound card already got approved is not asked a second time.
+ * @returns {Promise<{ denial: string } | null>} the denial, or null to run
  */
-export async function applyShellElevationGate(call, { callerSessionId, executeOpts, toolApprovalHook }) {
-  const gated = call.name === 'shell' || (call.name === 'terminal' && call.args?.action === 'run');
-  if (!gated || !isArgsObject(call.args) || call.args.command == null) {
-    return { elevationApproved: false };
-  }
-  const decision = evaluateExecPolicy(String(call.args.command));
-  if (decision.decision !== 'ask') return { elevationApproved: false };
-  const denied = await askApproval(call, {
+export function applyConnectorApproval(call, { agentId, callerSessionId, executeOpts, toolApprovalHook }) {
+  if (call.outboundApproved) return null;
+  if (agentMcpToolPermission(agentId, call.name) !== 'needs_approval') return null;
+  return askApproval(call, {
     callerSessionId,
     executeOpts,
     toolApprovalHook,
-    decision,
-    keepArgs: true,
+    decision: { reason: CONNECTOR_APPROVAL_REASON },
   });
-  if (denied) return denied;
-  return { elevationApproved: true };
+}
+
+/**
+ * Elevation pass for a shell call (or a terminal `run`) whose exec policy
+ * decision is 'ask' (elevated launch). Runs after the final call is known.
+ * Mixdog does not prompt first: the OS elevation prompt (Windows UAC) is the
+ * user's confirmation. A deny is never lifted.
+ * @returns {{ elevationApproved: boolean }}
+ */
+export function applyShellElevationGate(call) {
+  const gated = call.name === 'shell' || (call.name === 'terminal' && call.args?.action === 'run');
+  if (!gated || !isArgsObject(call.args) || call.args.command == null) {
+    return { elevationApproved: false };
+  }
+  return { elevationApproved: evaluateExecPolicy(String(call.args.command)).decision === 'ask' };
 }
 
 /**
@@ -72,22 +96,40 @@ export async function applyBeforeToolHook({
   executeOpts,
   beforeToolHook,
   toolApprovalHook,
+  mcpScopeId = null,
 }) {
   const call = { name, args, cwd };
   // ask_user is itself the user prompt; it never goes through the ordinary approval gate.
-  if (!beforeToolHook || name === 'ask_user') return call;
+  if (name === 'ask_user') return call;
   try {
-    const decision = await runAbortable(executeOpts.signal, () =>
-      beforeToolHook(
-        {
-          name,
-          args,
-          cwd,
-          sessionId: callerSessionId,
-          toolCallId: executeOpts.toolCallId || null,
-        },
-        { signal: executeOpts.signal }
-      )
+    const hookDecision = beforeToolHook
+      ? await runAbortable(executeOpts.signal, () =>
+          beforeToolHook(
+            {
+              name,
+              args,
+              cwd,
+              sessionId: callerSessionId,
+              toolCallId: executeOpts.toolCallId || null,
+            },
+            { signal: executeOpts.signal }
+          )
+        )
+      : null;
+    // Outbound sends ask the user whatever the hooks allowed (human-gate/gate.mjs).
+    // Judged as the call will run: only a rewriting decision changes name/args.
+    const hookAction = String(hookDecision?.action || hookDecision?.decision || '').toLowerCase();
+    const rewritten = hookAction === 'ask' || hookAction === 'modify' || hookAction === 'rewrite';
+    const { decision, request, gate } = await humanGateDecision(
+      {
+        name:
+          rewritten && typeof hookDecision?.name === 'string' && hookDecision.name.trim()
+            ? hookDecision.name.trim()
+            : name,
+        args: rewritten && isArgsObject(hookDecision?.args) ? hookDecision.args : args,
+      },
+      hookDecision,
+      { sessionId: callerSessionId, mcpScopeId }
     );
     const action = String(decision?.action || decision?.decision || '').toLowerCase();
     if (action === 'deny' || action === 'block') {
@@ -99,7 +141,14 @@ export async function applyBeforeToolHook({
       if (typeof decision?.name === 'string' && decision.name.trim()) call.name = decision.name.trim();
     }
     if (action === 'ask') {
-      const denied = await askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision });
+      const denied = await askApproval(call, {
+        callerSessionId,
+        executeOpts,
+        toolApprovalHook,
+        decision,
+        request,
+        gate,
+      });
       if (denied) return denied;
     }
   } catch (error) {

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -14,7 +14,7 @@ import { runWithToolExecutionOwner } from '../../../../shared/tool-execution-own
 import { runWithLocalSearchTelemetry } from '../../tools/builtin/local-search-telemetry.mjs';
 import { throwIfAborted } from '../../../../shared/abort-race.mjs';
 import { prepareToolCall } from './tool-exec/call-prep.mjs';
-import { applyBeforeToolHook, applyShellElevationGate } from './tool-exec/before-hook.mjs';
+import { applyBeforeToolHook, applyConnectorApproval, applyShellElevationGate } from './tool-exec/before-hook.mjs';
 import { dispatchToolCall } from './tool-exec/dispatch.mjs';
 import { applyAfterToolHook } from './tool-exec/after-hook.mjs';
 import { runReadOnlyIoWithDeadline } from './tool-exec/read-only-deadline.mjs';
@@ -50,8 +50,16 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     executeOpts,
     beforeToolHook: hookFrom(executeOpts, sessionRef, 'beforeToolHook'),
     toolApprovalHook,
+    mcpScopeId: sessionRef?.mcpScopeId || null,
   });
   if (hooked.denial) return hooked.denial;
+  const connectorDenied = await applyConnectorApproval(hooked, {
+    agentId: sessionRef?.agent,
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+  });
+  if (connectorDenied) return connectorDenied.denial;
   // A decision can settle after its turn was cancelled. It must never
   // authorize a new mutation, even if the hook ignores the abort signal.
   throwIfAborted(executeOpts.signal);
@@ -74,9 +82,8 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     const unavailable = bridgeTargetUnavailable(sessionRef, finalCall.schemaName || finalCall.name);
     if (unavailable) return unavailable;
   }
-  // Elevated launches ask the user first; denied / no approval UI refuses the call.
-  const elevation = await applyShellElevationGate(call, { callerSessionId, executeOpts, toolApprovalHook });
-  if (elevation.denial) return elevation.denial;
+  // Elevated launches skip Mixdog's own prompt; the OS elevation prompt confirms them.
+  const elevation = applyShellElevationGate(call);
   throwIfAborted(executeOpts.signal);
   const result = await runReadOnlyIoWithDeadline(call.name, executeOpts.signal || null, async (deadlineSignal) => {
     let callOpts = executeOpts;

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -27,12 +27,13 @@ function invalidateForToolSurfaceMigration(session) {
 }
 
 /**
- * After a surface re-apply outside a request (resume, provider switch)
- * migrated the exposure: the first send of the next turn carries the tag.
+ * After a surface re-apply outside a request (resume, provider switch, a
+ * workflow switch: `intent`) changed the request prefix: the first send of the
+ * next turn carries the tag.
  */
-export function markToolSurfaceMigrated(session) {
+export function markToolSurfaceMigrated(session, intent = TOOL_SURFACE_MIGRATION_INTENT) {
   invalidateForToolSurfaceMigration(session);
-  session.pendingCacheBreakIntent = TOOL_SURFACE_MIGRATION_INTENT;
+  session.pendingCacheBreakIntent = intent;
 }
 
 /** Provider switch: rebuild the surface for `provider`, migrating bridge ↔ native. */

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -2,6 +2,7 @@
 // message-array change detect, tool-kind classification, skills, hook overrides,
 // native tool-search payload parsing, bash-session routing, and approval.
 import { isMcpTool } from '../../mcp/client.mjs';
+import { unattendedApprovalPort } from '../human-gate/gate.mjs';
 import { isBuiltinTool } from '../../tools/builtin.mjs';
 import { isInternalTool } from '../../internal-tools.mjs';
 import { loadSkillToolDependencies } from '../../runtime-core/skill-tool-loading.mjs';
@@ -207,15 +208,24 @@ export async function resolvePreToolAskApproval({
   toolCallId,
   askReason,
   toolApprovalHook,
+  request = null,
 }) {
   const name = String(toolName || 'tool');
   const reason = String(askReason || 'approval requested by hook').trim();
-  if (typeof toolApprovalHook !== 'function') {
+  // Unattended runs never auto-approve and have no card: a schedule or webhook
+  // run always holds the request for its owner; a room member does when no
+  // approval UI is attached (session-runtime/held-requests.mjs).
+  const unattended = unattendedApprovalPort();
+  const run = unattended?.runOf?.(sessionId) || null;
+  const held = run && (run.kind !== 'room' || typeof toolApprovalHook !== 'function');
+  const ask = held ? unattended.hold : toolApprovalHook;
+  if (typeof ask !== 'function') {
     return { denial: formatMissingToolApprovalUiDenial(name, reason) };
   }
   let approval;
   try {
-    approval = await toolApprovalHook({
+    approval = await ask({
+      ...(request || {}),
       name,
       args,
       cwd,
@@ -229,7 +239,7 @@ export async function resolvePreToolAskApproval({
   }
   if (!approvalGranted(approval)) {
     const detail = approvalReason(approval, reason || 'not approved');
-    return { denial: `Error: tool "${name}" denied by hook: ${detail}` };
+    return { denial: `Error: tool "${name}" denied by hook: ${detail}`, approval };
   }
   return { approval };
 }

package/src/runtime/agent/orchestrator/session/loop/usage.mjs

@@ -41,6 +41,7 @@ export function usageDeltaEvent({
   usage,
   sendTools,
   toolCalls = 0,
+  generationMs = 0,
 }) {
   return {
     sessionId,
@@ -56,6 +57,12 @@ export function usageDeltaEvent({
     deltaToolCalls: toolCalls,
     ...reasoningUsage(usage),
     deltaPrompt: usage.promptTokens || 0,
+    // First visible token → end of this response; 0 when the call was not
+    // timed (nothing visible streamed). Only timed output enters speed figures.
+    generationMs,
+    // A provider that cannot measure the prompt or its cache split says so;
+    // its zeros are unknowns, not readings (no cache hit can be derived).
+    promptKnown: usage.inputTokensKnown !== false && usage.cacheTokensKnown !== false,
     // Cache delta carried alongside input/output so live metrics reflect
     // the same token classes the terminal aggregate adds; additive —
     // callers that ignore these fields keep working.

package/src/runtime/agent/orchestrator/session/manager/ask-turn-execute.mjs

@@ -186,6 +186,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
     beforeCount: historyMessages.length + 1,
     deferredToolDelta: userTurn.deferredToolDelta,
     goalReminder: userTurn.goalReminder,
+    workflowNotice: userTurn.workflowNotice,
     workspaceNotice: userTurn.workspaceNotice,
     setupNotice: userTurn.setupNotice,
   };

package/src/runtime/agent/orchestrator/session/manager/ask-turn-loop-options.mjs

@@ -8,6 +8,7 @@ import { createAskSteeringDrain } from './ask-turn-steering-drain.mjs';
 import { updateSessionStage, markSessionStreamDelta } from './runtime-liveness.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
 import { persistIterationMetrics } from './usage-metrics.mjs';
+import { isAgentModeSession } from '../agent-mode.mjs';
 
 const optionalFn = (value) => (typeof value === 'function' ? value : undefined);
 const relay = (fn, ...args) => {
@@ -130,6 +131,9 @@ export function buildAgentLoopOptions({
       checkpoint.schedule(true);
       relay(askOpts?.onAssistantToolCallObserved, call, detail);
     },
+    // A provider output item started (a tool call, a phased message): display
+    // only, so it bypasses the interruption journal.
+    onStreamItemStart: optionalFn(askOpts?.onStreamItemStart),
     onProviderSendStarted: () => {
       interruption.markProviderSendStarted();
       checkpoint.schedule(true);
@@ -181,7 +185,8 @@ export function buildAgentLoopOptions({
     onCompactEvent: (event) => {
       checkpoint.refreshContextState();
       checkpoint.schedule(true);
-      relay(askOpts?.onCompactEvent, event);
+      // Agent mode compacts silently: no compaction notice reaches the host.
+      if (!isAgentModeSession(session)) relay(askOpts?.onCompactEvent, event);
     },
     // Pre-send gauge sync. Defined only when a host listens so the loop
     // never computes a display number nobody reads.

package/src/runtime/agent/orchestrator/session/manager/ask-turn-prepare.mjs

@@ -19,6 +19,7 @@ import {
   snapshotPendingWorkspaceNotice,
   snapshotPendingSetupNotice,
 } from './prompt-utils.mjs';
+import { snapshotPendingWorkflowNotice } from './workflow-switch-notice.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
 import { _tryBridgeExplicitPrefetch } from './prefetch-bridge.mjs';
 import { filterModelVisibleSessionMessages } from './message-sanitize.mjs';
@@ -180,7 +181,11 @@ export async function buildUserTurn({
   const workspaceNotice = snapshotPendingWorkspaceNotice(session);
   // What preparing a new worktree linked, installed, ran, failed or skipped.
   const setupNotice = snapshotPendingSetupNotice(session);
+  // A mid-conversation workflow switch: the prompt and tools were rebuilt
+  // for the new workflow; this turn tells the model once.
+  const workflowNotice = snapshotPendingWorkflowNotice(session);
   const reminderBlock = [
+    workflowNotice?.content || '',
     workspaceNotice?.content || '',
     setupNotice?.content || '',
     currentTimeBlock ? `<system-reminder>\n# Current Time\n${currentTimeBlock}\n</system-reminder>` : '',
@@ -209,6 +214,7 @@ export async function buildUserTurn({
     historyMessages,
     deferredToolDelta,
     goalReminder,
+    workflowNotice,
     workspaceNotice,
     setupNotice,
     userTurnMessage,

package/src/runtime/agent/orchestrator/session/manager/ask-turn-settle.mjs

@@ -9,6 +9,7 @@ import { persistedAssistantTranscriptMetadata } from '../../../../shared/transcr
 import { acknowledgePendingDeferredToolDelta } from '../../runtime-core/deferred-tool-delta.mjs';
 import { acknowledgePendingGoalReminder } from '../../runtime-core/goal-reminder.mjs';
 import { acknowledgePendingSetupNotice, acknowledgePendingWorkspaceNotice } from './prompt-utils.mjs';
+import { acknowledgePendingWorkflowNotice } from './workflow-switch-notice.mjs';
 import {
   finalizePendingMessageDelivery,
   drainPendingMessages,
@@ -139,6 +140,7 @@ export async function commitAskTurn({ sessionId, opened, prepared, result, rawTr
   if (prepared.goalReminder) {
     acknowledgePendingGoalReminder(session, prepared.goalReminder.revision);
   }
+  if (prepared.workflowNotice) acknowledgePendingWorkflowNotice(session, prepared.workflowNotice.revision);
   if (prepared.workspaceNotice) {
     acknowledgePendingWorkspaceNotice(session, prepared.workspaceNotice.revision);
   }

package/src/runtime/agent/orchestrator/session/manager/ask-turn-steering-drain.mjs

@@ -3,7 +3,12 @@
 // prompts at every continuation boundary, plus — at the TERMINAL boundary only
 // — the manager's pending-message entries, grouped into one steering item per
 // mode and adopted by this turn (so their delivery/ack/release rides it).
-import { _groupPendingMessageEntries, drainPendingMessages, releasePendingMessages } from './pending-messages.mjs';
+import {
+  _groupPendingMessageEntries,
+  drainPendingMessages,
+  pendingQueueHoldsOnlyNotifications,
+  releasePendingMessages,
+} from './pending-messages.mjs';
 
 /**
  * @param {object} input
@@ -26,9 +31,12 @@ export function createAskSteeringDrain({ sessionId, turn, askOpts }) {
         /* best-effort steering drain */
       }
     }
-    // Manager/pending-messages entries carry no mode/priority/slash
-    // metadata, so they stay OUT of the mid-chain (post-tool-batch) drain —
-    // that would bypass the queued-command filters. At the TERMINAL boundary
+    // Manager/pending-messages prompts carry no priority/slash metadata, so
+    // they stay OUT of the mid-chain (post-tool-batch) drain — that would
+    // bypass the queued-command filters. A queue holding only task
+    // notifications (agent/shell completions, which also end a passive wait)
+    // is taken at every boundary, so a completion reaches the very next model
+    // request instead of waiting for the model to stop. At the TERMINAL boundary
     // they are exactly pending input: an `agent type=send` queued while the
     // terminal sample was in flight must be folded into THIS turn before any
     // stop hook runs, instead of losing its slot to a synthetic continuation
@@ -36,7 +44,7 @@ export function createAskSteeringDrain({ sessionId, turn, askOpts }) {
     // nothing. Entries consumed here join the turn's pending entries: their
     // delivery/ack (and release on failure) rides this turn, and the
     // post-loop drain can no longer see them.
-    if (drainOptions?.stage === 'terminal') {
+    if (drainOptions?.stage === 'terminal' || pendingQueueHoldsOnlyNotifications(sessionId)) {
       const pendingNow = drainPendingMessages(sessionId);
       if (pendingNow.length > 0) {
         // One steering entry per mode group: the merged prompt (if any) and

package/src/runtime/agent/orchestrator/session/manager/pending-lifecycle-epoch.mjs

@@ -40,14 +40,6 @@ export function currentPendingLifecycleToken(sessionId) {
   return pendingLifecycleToken(pendingSessionLifecycle(sessionId));
 }
 
-// Refusal verdict of the lifecycle a token was minted from (tombstoned or
-// unreadable) — exactly pendingLifecycleInvalidated(sessionId) for that same
-// read, so a caller holding a fresh token needs no second durable read.
-export function lifecycleTokenClosed(token) {
-  const { source } = parseLifecycleToken(token);
-  return source === 'closed' || source === 'unreadable';
-}
-
 // Parses a `source:generation` epoch token.
 function parseLifecycleToken(token) {
   const text = String(token);

package/src/runtime/agent/orchestrator/session/manager/pending-message-entry.mjs

@@ -103,12 +103,15 @@ function completionEntryFields(entry) {
   };
 }
 
-export function completionWasDelivered(entry, site) {
+/** True when this completion entry already reached the model (no log). */
+export function completionIsDelivered(entry) {
   if (!isCompletionNotificationEntry(entry)) return false;
-  const executionId = completionExecutionId(entry);
-  const text = pendingMessageText(entry);
-  if (!isDeliveredCompletion({ executionId, text })) return false;
-  logDuplicateSkip(site, { executionId, text });
+  return isDeliveredCompletion({ executionId: completionExecutionId(entry), text: pendingMessageText(entry) });
+}
+
+export function completionWasDelivered(entry, site) {
+  if (!completionIsDelivered(entry)) return false;
+  logDuplicateSkip(site, { executionId: completionExecutionId(entry), text: pendingMessageText(entry) });
   return true;
 }
 
@@ -166,7 +169,7 @@ function explicitModeField(entry) {
   return entry?.mode === PENDING_MODE_TASK_NOTIFICATION ? { mode: PENDING_MODE_TASK_NOTIFICATION } : {};
 }
 
-export function normalizePendingMessageEntry(entry) {
+function normalizePendingMessageEntry(entry) {
   if (typeof entry === 'string') {
     const text = entry.trim();
     return text ? { content: text, text } : null;
@@ -211,7 +214,7 @@ export function normalizePendingMessageEntry(entry) {
   return carryLifecycleToken(marker ? { ...out, ...identity, ...marker } : { ...out, ...identity }, entry);
 }
 
-export function pendingMessageText(entry) {
+function pendingMessageText(entry) {
   const normalized = normalizePendingMessageEntry(entry);
   return normalized ? String(normalized.text || promptContentText(normalized.content) || '').trim() : '';
 }