mixdog 1.2.6 → 1.3.1

package/src/runtime/agent/orchestrator/session/human-gate/requests.mjs

@@ -0,0 +1,195 @@
+// session/human-gate/requests.mjs
+// The data model of a human-in-the-loop prompt. A request has one `kind`:
+//   approval   — allow or deny one tool call;
+//   outbound   — a call that posts, sends, pays or deletes outside (its action
+//                kind, target, account, the exact payload text, which fields
+//                the card may edit, and the mail/payment/delete detail lines);
+//   secret     — the user types a value into a target field; the request names
+//                the target and the field label, never a value;
+//   takeover   — the user does a step themselves and says "done";
+//   permission — the user picks one of the offered scopes.
+// A response is one of HUMAN_RESPONSES plus a `remember` scope; a policy lists
+// the scopes it allows and can leave out `always`. Nothing here ever carries a
+// secret value: a decision that names one is stripped to its verdict.
+
+export const HUMAN_REQUEST_KINDS = Object.freeze(['approval', 'outbound', 'secret', 'takeover', 'permission']);
+export const HUMAN_RESPONSES = Object.freeze(['approve', 'deny', 'edit-and-approve', 'provide-secret', 'skip', 'done']);
+export const REMEMBER_SCOPES = Object.freeze(['once', 'agent', 'always']);
+export const SECRET_REQUEST_TIMEOUT_MS = 120_000;
+
+const RESPONSES_BY_KIND = Object.freeze({
+  approval: ['approve', 'deny'],
+  outbound: ['approve', 'edit-and-approve', 'deny'],
+  secret: ['provide-secret', 'skip'],
+  takeover: ['done', 'deny'],
+  permission: ['approve', 'deny'],
+});
+const GRANTING_RESPONSES = new Set(['approve', 'edit-and-approve', 'provide-secret', 'done']);
+const TEXT_LIMIT = 200;
+/** An outbound card's extra lines: mail headers, the payment, the delete, the
+ *  trash card's message list (gate.mjs describeEmails) and its remainder. */
+const DETAIL_FIELDS = [
+  'to',
+  'cc',
+  'subject',
+  'merchant',
+  'amount',
+  'currency',
+  'recurrence',
+  'count',
+  'size',
+  'messages',
+  'more',
+];
+const DETAIL_LIMITS = { messages: 1_000 };
+const PAYLOAD_LIMIT = 40_000;
+
+const isRecord = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+const text = (value, limit = TEXT_LIMIT) => (typeof value === 'string' ? value.trim().slice(0, limit) : '');
+
+/** The human kind of a request; anything else (ask_user's 'question', a
+ *  hook's bare ask) is an ordinary approval for responses. */
+export function humanRequestKind(request) {
+  return HUMAN_REQUEST_KINDS.includes(request?.kind) ? request.kind : 'approval';
+}
+
+/** A login takeover's sign-in page: https, or http on loopback only (a local
+ *  site); never embedded credentials. `{ url, origin }`, or null. */
+export function loginPageUrl(value) {
+  if (typeof value !== 'string' || !value.trim() || value.length > 2048) return null;
+  let parsed;
+  try {
+    parsed = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  const host = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+  const loopback =
+    host === 'localhost' || host.endsWith('.localhost') || host === '::1' || /^127(?:\.\d{1,3}){3}$/.test(host);
+  if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && loopback)) return null;
+  if (parsed.username || parsed.password) return null;
+  return { url: parsed.href, origin: parsed.origin };
+}
+
+function rememberScopes(value) {
+  const listed = Array.isArray(value) ? value.filter((scope) => REMEMBER_SCOPES.includes(scope)) : [];
+  return ['once', ...new Set(listed.filter((scope) => scope !== 'once'))];
+}
+
+/** The kind-specific fields of a request, whitelisted. Spread onto the
+ *  presented request; `args` is replaced for a secret so no value rides it. */
+export function humanRequestFields(input = {}) {
+  const kind = input?.kind;
+  if (!HUMAN_REQUEST_KINDS.includes(kind)) return {};
+  const fields = { remember: rememberScopes(input.remember) };
+  // The agent the request acts for (its name on the card and the remembered grant).
+  if (text(input.agentId)) fields.agentId = text(input.agentId);
+  if (kind === 'outbound' && isRecord(input.outbound)) {
+    const outbound = input.outbound;
+    const details = isRecord(outbound.details) ? outbound.details : {};
+    fields.outbound = {
+      category: text(outbound.category),
+      target: text(outbound.target),
+      account: text(outbound.account),
+      payload: typeof outbound.payload === 'string' ? outbound.payload.slice(0, PAYLOAD_LIMIT) : '',
+      editable: Array.isArray(outbound.editable) ? outbound.editable.filter((name) => typeof name === 'string') : [],
+      details: Object.fromEntries(
+        DETAIL_FIELDS.filter((name) => text(details[name])).map((name) => [
+          name,
+          text(details[name], DETAIL_LIMITS[name]),
+        ])
+      ),
+    };
+  }
+  if (kind === 'secret') {
+    const secret = isRecord(input.secret) ? input.secret : {};
+    fields.secret = {
+      requestId: text(secret.requestId),
+      surface: secret.surface === 'computer' ? 'computer' : 'browser',
+      target: text(secret.target),
+      field: text(secret.field),
+    };
+    fields.args = { surface: fields.secret.surface, target: fields.secret.target, field: fields.secret.field };
+    fields.remember = ['once'];
+  }
+  if (kind === 'takeover') {
+    const takeover = isRecord(input.takeover) ? input.takeover : {};
+    const surface = takeover.surface === 'computer' ? 'computer' : 'browser';
+    // The window it is about (ask-user-tool-defs.mjs handoffIdentity): a
+    // browser page ID, or a computer window id and app, so the card can bring
+    // exactly that window forward on the user's click.
+    const token = (value, limit) => (/^[\w.:#@-]+$/.test(text(value, limit)) ? text(value, limit) : '');
+    const identity =
+      surface === 'browser'
+        ? { ...(token(takeover.tab, 64) ? { tab: token(takeover.tab, 64) } : {}) }
+        : {
+            ...(token(takeover.windowId, 128) ? { windowId: token(takeover.windowId, 128) } : {}),
+            ...(text(takeover.app, 120) ? { app: text(takeover.app, 120) } : {}),
+          };
+    // A login takeover (purpose 'login') opens the desktop's sign-in window on
+    // its validated page instead of handing over the side panel.
+    const login = surface === 'browser' && takeover.purpose === 'login' ? loginPageUrl(takeover.url) : null;
+    fields.takeover = {
+      surface,
+      instructions: text(takeover.instructions, 2_000),
+      ...(text(takeover.target) ? { target: text(takeover.target) } : {}),
+      ...identity,
+      ...(login ? { purpose: 'login', url: login.url, origin: login.origin } : {}),
+    };
+    fields.remember = ['once'];
+  }
+  if (kind === 'permission') {
+    const scopes = Array.isArray(input.permission?.scopes) ? input.permission.scopes : [];
+    fields.permission = {
+      scopes: scopes
+        .filter((scope) => isRecord(scope) && text(scope.id))
+        .map((scope) => ({ id: text(scope.id), label: text(scope.label) || text(scope.id) })),
+    };
+  }
+  return fields;
+}
+
+/** Only `editable` string fields of `editedArgs`; {} when nothing applies. */
+function editableArgs(editedArgs, editable) {
+  if (!isRecord(editedArgs)) return {};
+  const out = {};
+  for (const name of editable || []) {
+    if (typeof editedArgs[name] === 'string') out[name] = editedArgs[name].slice(0, PAYLOAD_LIMIT);
+  }
+  return out;
+}
+
+/**
+ * The canonical response to `request` from a decision: `approved` (the card's
+ * polarity) plus optional `{ response, editedArgs, remember, scope }`. An
+ * unknown or contradicting response falls back to the polarity's default;
+ * edits survive only on an outbound request and only for its editable fields;
+ * `remember` only when the request allows it and the call was granted.
+ */
+export function normalizeHumanResponse(request, approved, extra = {}) {
+  const kind = humanRequestKind(request);
+  const allowed = RESPONSES_BY_KIND[kind];
+  const polarity = approved === true;
+  const fallback = polarity ? allowed[0] : allowed[allowed.length - 1];
+  const asked = isRecord(extra) && allowed.includes(extra.response) ? extra.response : '';
+  let response = asked && GRANTING_RESPONSES.has(asked) === polarity ? asked : fallback;
+  const result = { approved: polarity, response };
+  if (response === 'edit-and-approve') {
+    const edits = editableArgs(extra.editedArgs, request?.outbound?.editable);
+    if (Object.keys(edits).length) result.editedArgs = edits;
+    else response = result.response = 'approve';
+  }
+  const scopes = Array.isArray(request?.remember) ? request.remember : ['once'];
+  result.remember = polarity && scopes.includes(extra?.remember) ? extra.remember : 'once';
+  if (kind === 'permission' && polarity) {
+    const ids = (request?.permission?.scopes || []).map((scope) => scope.id);
+    if (ids.includes(extra?.scope)) result.scope = extra.scope;
+  }
+  return result;
+}
+
+/** `args` with the card's edited fields in place of the model's. */
+export function applyEditedArgs(args, editedArgs, editable) {
+  const edits = editableArgs(editedArgs, editable);
+  return Object.keys(edits).length ? { ...(isRecord(args) ? args : {}), ...edits } : args;
+}

package/src/runtime/agent/orchestrator/session/human-gate/store.mjs

@@ -0,0 +1,167 @@
+// session/human-gate/store.mjs
+// Per-agent permissions and the decision audit, both under the plugin data dir.
+// A grant is keyed by agent + action kind (outbound-policy.mjs ACTION_KINDS)
+// and says `allow` (never ask: "다시 묻지 않기") or `block` (deny without a
+// card); no grant means ask. `agent` scope names the agent, `always` stands for
+// every agent ('*'), and an agent's own grant wins over an every-agent one;
+// `once` is never stored. Payments and deletes are never allowed. Grants are
+// listed and revoked by id. The audit is one JSONL line per decision with
+// agent, kind, action, tool, target, decision, deciding device and time —
+// never a value, an argument or a payload — read back newest first.
+import { createHash } from 'node:crypto';
+import { appendFile, mkdir, readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { parseJsonText, updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
+import { ACTION_KINDS, isRememberableAction } from './outbound-policy.mjs';
+
+const ANY_AGENT = '*';
+const FIELD_LIMIT = 200;
+const AUDIT_KEYS = ['agentId', 'kind', 'action', 'tool', 'target', 'decision', 'device'];
+export const PERMISSION_MODES = Object.freeze(['ask', 'allow', 'block']);
+
+const field = (value) => String(value ?? '').slice(0, FIELD_LIMIT);
+const grantId = (agentId, action) =>
+  `grant_${createHash('sha256').update(`${agentId}\n${action}`).digest('hex').slice(0, 24)}`;
+const isGrant = (row) => ACTION_KINDS.includes(row?.action) && (row.mode === 'allow' || row.mode === 'block');
+
+export function createHumanGateStore(directory) {
+  const grantsFile = join(directory, 'grants.json');
+  const auditFile = join(directory, 'audit.jsonl');
+  const grantsOf = (doc) => (Array.isArray(doc?.grants) ? doc.grants.filter(isGrant) : []);
+  async function readGrants() {
+    try {
+      return grantsOf(parseJsonText(await readFile(grantsFile, 'utf8')));
+    } catch (error) {
+      if (error?.code === 'ENOENT') return [];
+      throw error;
+    }
+  }
+  async function updateGrants(mutate) {
+    await mkdir(directory, { recursive: true });
+    let result;
+    await updateJsonAtomic(grantsFile, (doc) => {
+      const out = mutate(grantsOf(doc));
+      if (!out) return undefined;
+      result = out.result;
+      return { grants: out.grants };
+    });
+    return result;
+  }
+  /** Set `agentId`'s mode for `action`; `ask` removes its grant. Returns the
+   *  grant, or null for `ask` and for an `allow` that may not exist. */
+  async function setMode({ agentId, action, mode, device = '' }) {
+    if (!ACTION_KINDS.includes(action) || !PERMISSION_MODES.includes(mode)) return null;
+    if (mode === 'allow' && !isRememberableAction(action)) return null;
+    const owner = field(agentId);
+    const id = grantId(owner, action);
+    const grant = mode === 'ask' ? null : { id, agentId: owner, action, mode, device: field(device), at: Date.now() };
+    await updateGrants((grants) => ({
+      grants: [...grants.filter((row) => row.id !== id), ...(grant ? [grant] : [])],
+      result: grant,
+    }));
+    return grant;
+  }
+  /** `allow`, `block` or `ask` for `agentId` + `action`; the agent's own grant wins. */
+  async function modeFor({ agentId, action }) {
+    const grants = (await readGrants()).filter((grant) => grant.action === action);
+    const own =
+      grants.find((grant) => grant.agentId === agentId) || grants.find((grant) => grant.agentId === ANY_AGENT);
+    if (own?.mode === 'allow' && !isRememberableAction(action)) return 'ask';
+    return own?.mode || 'ask';
+  }
+  return {
+    setMode,
+    modeFor,
+    /** Stores an `allow` for `agent`/`always` scope; `once` stores nothing. Returns the grant or null. */
+    async grant({ agentId, action, scope, device = '' }) {
+      if (scope !== 'agent' && scope !== 'always') return null;
+      return setMode({ agentId: scope === 'always' ? ANY_AGENT : agentId, action, mode: 'allow', device });
+    },
+    /** Every action kind with `agentId`'s mode, for the profile's permission table. */
+    async permissions(agentId) {
+      const out = [];
+      for (const action of ACTION_KINDS) {
+        out.push({ action, mode: await modeFor({ agentId, action }), rememberable: isRememberableAction(action) });
+      }
+      return out;
+    },
+    /** Grants that apply to `agentId` (its own and every-agent ones); all when omitted. */
+    async listGrants({ agentId } = {}) {
+      const grants = await readGrants();
+      return agentId ? grants.filter((grant) => grant.agentId === agentId || grant.agentId === ANY_AGENT) : grants;
+    },
+    async revokeGrant(id) {
+      return (
+        (await updateGrants((grants) => {
+          const rest = grants.filter((grant) => grant.id !== id);
+          return rest.length === grants.length ? null : { grants: rest, result: true };
+        })) === true
+      );
+    },
+    async recordAudit(entry) {
+      const line = { at: Number.isFinite(entry?.at) ? entry.at : Date.now() };
+      for (const key of AUDIT_KEYS) line[key] = field(entry?.[key]);
+      await mkdir(dirname(auditFile), { recursive: true });
+      await appendFile(auditFile, `${JSON.stringify(line)}\n`, 'utf8');
+      return line;
+    },
+    /** Newest first; `agentId` filters to one agent. */
+    async readAudit({ agentId = '', limit = 100 } = {}) {
+      let raw = '';
+      try {
+        raw = await readFile(auditFile, 'utf8');
+      } catch (error) {
+        if (error?.code === 'ENOENT') return [];
+        throw error;
+      }
+      const rows = [];
+      for (const line of raw.split('\n').reverse()) {
+        if (!line) continue;
+        try {
+          const row = JSON.parse(line);
+          if (!agentId || row.agentId === agentId) rows.push(row);
+        } catch {}
+        if (rows.length >= limit) break;
+      }
+      return rows;
+    },
+  };
+}
+
+let processStore = null;
+/** The process store under the plugin data dir; built on first use. */
+export async function humanGateStore() {
+  if (!processStore) {
+    const { getPluginData } = await import('../../config.mjs');
+    processStore = createHumanGateStore(join(getPluginData(), 'human-gate'));
+  }
+  return processStore;
+}
+
+function requiredAgentId(agentId) {
+  if (typeof agentId !== 'string' || !agentId.trim() || agentId.length > FIELD_LIMIT || agentId === ANY_AGENT) {
+    throw new Error('agent id is invalid');
+  }
+  return agentId;
+}
+
+/** The profile's "권한" table for `agentId` (capability getAgentPermissions). */
+export async function agentPermissions(agentId) {
+  return (await humanGateStore()).permissions(requiredAgentId(agentId));
+}
+
+/** Set one row of that table (capability setAgentPermission); returns the table. */
+export async function setAgentPermission(agentId, action, mode) {
+  const agent = requiredAgentId(agentId);
+  if (!ACTION_KINDS.includes(action)) throw new Error(`action must be one of ${ACTION_KINDS.join(', ')}`);
+  if (!PERMISSION_MODES.includes(mode)) throw new Error(`mode must be one of ${PERMISSION_MODES.join(', ')}`);
+  if (mode === 'allow' && !isRememberableAction(action)) throw new Error(`${action} always asks; it cannot be allowed`);
+  const store = await humanGateStore();
+  await store.setMode({ agentId: agent, action, mode });
+  return store.permissions(agent);
+}
+
+/** Replace the process store (tests); null restores the default. */
+export function setHumanGateStore(store) {
+  processStore = store || null;
+}

package/src/runtime/agent/orchestrator/session/loop/compact-policy.mjs

@@ -17,6 +17,7 @@ import { HANDOFF_TIMEOUT_MAX_MS } from '../compact/constants.mjs';
 import { envFlag, envPositiveInt } from '../../../../shared/env.mjs';
 import { positiveInt } from '../../../../shared/numbers.mjs';
 import { isAgentOwner } from '../../agent-owner.mjs';
+import { isAgentModeSession } from '../agent-mode.mjs';
 import { providerInputExcludesCache, providerNativePdf } from '../../providers/registry.mjs';
 import { contentMediaBytes, contentMediaCount } from '../../providers/media-normalization.mjs';
 import { splitProtectedContext } from '../compact/messages.mjs';
@@ -133,7 +134,8 @@ function effectiveContextWindowPercent(sessionRef, cfg) {
 export function resolveWorkerCompactPolicy(sessionRef, tools) {
   if (!sessionRef) return null;
   const cfg = sessionRef.compaction || {};
-  const auto = cfg.auto !== false && envFlag('MIXDOG_AGENT_COMPACT_AUTO', true);
+  // Agent mode always compacts on its own: the user is never asked to.
+  const auto = (cfg.auto !== false || isAgentModeSession(sessionRef)) && envFlag('MIXDOG_AGENT_COMPACT_AUTO', true);
   if (!auto) return { auto: false };
   const { contextWindow, boundaryTokens } = compactBoundaryFor(sessionRef, cfg);
   if (!boundaryTokens) return null;

package/src/runtime/agent/orchestrator/session/loop/loop-state.mjs

@@ -8,6 +8,7 @@ import { resolveLiveToolCwd } from './tool-exec.mjs';
 import { createSteeringDrain } from './steering.mjs';
 import { createNoToolTurnResolver } from './no-tool-turn.mjs';
 import { classifyTerminationReason } from './termination.mjs';
+import { routeUsageSegments } from './usage.mjs';
 
 // Consecutive identical-AND-failing tool calls (same name+args, error result)
 // tolerated across iterations before the loop refuses to re-execute and steers
@@ -153,5 +154,13 @@ export function finishLoop(state) {
     providerStateUpdated: state.providerStateUpdated,
     terminationReason: classifyTerminationReason(response, { sessionAgent: state.sessionAgent }),
     providerContinuations: state.noToolTurn.providerContinuations,
+    ...(state.routeUsageHops?.length
+      ? {
+          usageSegments: routeUsageSegments(state.routeUsageHops, state.lastUsage, {
+            provider: state.sessionRef?.provider,
+            model: state.sessionRef?.model,
+          }),
+        }
+      : {}),
   };
 }

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -16,6 +16,7 @@ import { isOffReadonlySurface } from './deferred-call-through.mjs';
 import { BRIDGE_CALL_TOOL_NAME, bridgeErrorText, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
 import { sessionAllowlistExcludes, sessionDisallows } from '../../runtime-core/deferred-tool-availability.mjs';
 import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
+import { agentMcpToolPermission, projectMcpToolDisabled } from '../../mcp/agent-connectors.mjs';
 
 const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'session']);
 const BRIDGE_DISCOVERY_TOOL_NAMES = new Set(['load_tool']);
@@ -122,6 +123,15 @@ export function preDispatchDenyForSession(sessionRef, call) {
   if (sessionDisallows(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available in this session.`;
   }
+  // An agent's connectors: a tool of a server it does not mount, or one set
+  // to `disabled`, stays refused though the process-wide registry knows it.
+  if (agentMcpToolPermission(sessionRef?.agent, schemaName) === 'disabled') {
+    return `Error: tool "${name}" is not available to this agent.`;
+  }
+  // The project the session runs in may switch a connector off as well.
+  if (projectMcpToolDisabled(sessionRef, schemaName)) {
+    return `Error: tool "${name}" is switched off in this project.`;
+  }
   if (isOffReadonlySurface(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available in this read-only session.`;
   }

package/src/runtime/agent/orchestrator/session/loop/route-fallback.mjs

@@ -1,4 +1,7 @@
-import { canFallbackRoute } from '../../../../shared/model-route-fallback.mjs';
+import { routeFallbackVerdict } from '../../../../shared/model-route-fallback.mjs';
+import { providerErrorKind } from '../../providers/provider-error-kind.mjs';
+import { displayModelName } from '../../../../shared/model-display.mjs';
+import { presentErrorText } from '../../../../shared/err-text.mjs';
 import { getProvider, initProviders } from '../../providers/registry.mjs';
 import { loadConfig } from '../../config.mjs';
 import { ensureProviderEnabled } from '../../runtime-core/config-helpers.mjs';
@@ -7,19 +10,107 @@ import { pinSessionWireRoute } from '../../providers/wire-route.mjs';
 import { buildRequestSendOptions } from '../manager/ask-turn-loop-options.mjs';
 import { prepareTurnEffortConfiguration } from '../../providers/effort-configuration.mjs';
 import { resolveSessionContextMeta } from '../manager/context-meta.mjs';
+import { stripProviderReplayMessages } from '../manager/provider-replay.mjs';
+
+// The short reason a notice gives for leaving a model, by provider kind.
+const HOP_REASONS = {
+  quota_exhausted: 'usage limit reached',
+  entitlement: 'not included in the plan',
+  billing: 'out of credits',
+  rate_limited: 'rate-limited',
+  overloaded: 'unavailable',
+  transient: 'unavailable',
+  service_tier_unavailable: 'unavailable',
+  auth: 'sign-in failed',
+  permission: 'access denied',
+  invalid_request: 'model not available',
+  context_overflow: 'context too long',
+};
+
+const routeLabel = (route) => displayModelName(route.model, route.provider) || `${route.provider}/${route.model}`;
+
+/** The muted transcript line for a hop: `<from> <reason> — switched to <to>.` */
+export function routeFallbackNoticeText(from, to, error) {
+  const reason = HOP_REASONS[providerErrorKind(error).kind] || 'unavailable';
+  return `${routeLabel(from)} ${reason} — switched to ${routeLabel(to)}.`;
+}
+
+function routeFailure(route, error) {
+  return {
+    provider: route.provider,
+    model: route.model,
+    kind: providerErrorKind(error).kind,
+    error: presentErrorText(error),
+  };
+}
+
+// The chain ended after at least one hop: the final error keeps its own kind
+// and names every model that was tried and why each failed. `skipped` is the
+// next route when the chain stopped before it (a context overflow whose next
+// window is no larger), so the text says why instead of "every model failed".
+function annotateEndedChain(session, error, skipped = null) {
+  const tried = session?.routeFallbackFailures;
+  if (!tried?.length || !error || typeof error !== 'object' || error.routeFallbackAttempts) return;
+  const attempts = [...tried, routeFailure(session, error)];
+  try {
+    error.routeFallbackAttempts = attempts;
+    const lines = attempts.map((attempt) => `${routeLabel(attempt)}: ${attempt.error}`).join('; ');
+    const head = skipped
+      ? `Fallback chain stopped before ${routeLabel(skipped)} (its context window is not larger) — tried`
+      : 'Every model in the fallback chain failed —';
+    error.message = `${error.message}\n${head} ${lines}`;
+    if (skipped) error.routeFallbackStoppedBefore = { provider: skipped.provider, model: skipped.model };
+  } catch {
+    /* frozen errors keep their own message */
+  }
+}
+
+// A context overflow moves only to a model whose window is larger.
+async function nextContextGrows(state, next) {
+  const config = ensureProviderEnabled(loadConfig(), next.provider);
+  await initProviders(config.providers, { signal: state.signal });
+  state.throwIfAborted();
+  const provider = getProvider(next.provider);
+  if (!provider) return false;
+  const current = resolveSessionContextMeta(state.provider, state.sessionRef.model, state.sessionRef).rawContextWindow;
+  const window = resolveSessionContextMeta(provider, next.model, next).rawContextWindow;
+  return Number(window) > Number(current || state.sessionRef.selectedContextWindow || 0);
+}
 
 export async function advanceAgentRoute(state, error) {
   const session = state.sessionRef;
-  const index = session?.routeFallbackIndex || 0;
-  const next = session?.routeFallbacks?.[index];
-  const committed = state.toolCallsTotal > 0 || state.response != null;
-  if (!session?.agent || !next || !canFallbackRoute(error, { signal: state.signal, committed })) return false;
+  if (!session?.agent || !session.routeFallbacks?.length) return false;
+  const index = session.routeFallbackIndex || 0;
+  const next = session.routeFallbacks[index];
+  // Only THIS request must have produced nothing (its stream outcome says so):
+  // earlier requests of the turn may have run tools. Their calls and results
+  // are already in the live turn, which the next model continues from, so no
+  // completed tool runs again.
+  const verdict = routeFallbackVerdict(error, { signal: state.signal });
+  const hops = verdict === 'hop' || (verdict === 'context' && next && (await nextContextGrows(state, next)));
+  if (!next || !hops) {
+    if (verdict !== 'stay') annotateEndedChain(session, error, next || null);
+    return false;
+  }
   state.throwIfAborted();
   const config = ensureProviderEnabled(loadConfig(), next.provider);
   await initProviders(config.providers, { signal: state.signal });
   state.throwIfAborted();
   const provider = getProvider(next.provider);
   if (!provider) throw new Error(`Provider "${next.provider}" not available`);
+  const failed = routeFailure(session, error);
+  // The left model's share of the turn ends here: the running total at the
+  // switch bounds it, so each model's tokens are booked at its own rates.
+  state.routeUsageHops = [
+    ...(state.routeUsageHops || []),
+    { provider: session.provider, model: session.model, usage: state.lastUsage ? { ...state.lastUsage } : null },
+  ];
+  const notice = routeFallbackNoticeText(session, next, error);
+  // Saved with the new route: a crash before the live turn is checkpointed
+  // again recovers that turn without the previous provider's native state.
+  if (session.activeTurnCheckpoint && typeof session.activeTurnCheckpoint === 'object') {
+    session.activeTurnCheckpoint = { ...session.activeTurnCheckpoint, routeChanged: true };
+  }
   const oldOptions = buildRequestSendOptions({
     sessionId: state.sessionId,
     session,
@@ -41,9 +132,12 @@ export async function advanceAgentRoute(state, error) {
   );
   if (!updated) throw new Error('agent session closed during model fallback');
   updated.routeFallbackIndex = index + 1;
+  updated.routeFallbackFailures = [...(session.routeFallbackFailures || []), failed];
   await pinSessionWireRoute(updated, provider);
   state.throwIfAborted();
-  state.messages.splice(0, state.messages.length, ...updated.messages);
+  // The live turn (prompt, assistant tool calls, tool results) carries on;
+  // only the previous provider's native replay state is dropped from it.
+  state.messages.splice(0, state.messages.length, ...stripProviderReplayMessages(state.messages));
   updated.liveTurnMessages = state.messages;
   state.sessionRef = updated;
   state.provider = provider;
@@ -67,6 +161,14 @@ export async function advanceAgentRoute(state, error) {
       signal: state.signal,
     })
   );
+  try {
+    process.stderr.write(
+      `[route-fallback] ${failed.provider}/${failed.model} (${failed.kind}) -> ${updated.provider}/${updated.model}\n`
+    );
+    state.opts.onStageChange?.('notice', { tone: 'info', message: notice });
+  } catch {
+    /* display-only */
+  }
   state.opts.onStageChange?.('connecting', {
     provider: updated.provider,
     model: updated.model,

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -181,6 +181,10 @@ export async function sendProviderRequest(state, round) {
     tools: round.sendTools,
     opts,
   });
+  // The request's time for the speed figures, the wait for the first token
+  // included: the span the usage ledger recorded as `duration_ms` (stamped on
+  // the response); wall time only for a response no ledger row timed.
+  const requestStartedAt = Date.now();
   let result;
   try {
     result = await runWithProviderRequestToolsScope(round.requestToolScope, () =>
@@ -211,12 +215,16 @@ export async function sendProviderRequest(state, round) {
   }
   if (result.action === 'proceed') sideQuestion?.settle(result.response);
   else sideQuestion?.discard();
+  const sendEndedAt = Date.now();
   return {
     result,
     providerMessages,
     prefixGuardCandidate,
     sendStartedAt,
-    sendEndedAt: Date.now(),
+    sendEndedAt,
+    requestMs: Number.isFinite(result.response?.usageDurationMs)
+      ? Math.max(0, result.response.usageDurationMs)
+      : Math.max(0, sendEndedAt - requestStartedAt),
     preSendMs,
     toolResumeMs,
   };
@@ -429,6 +437,7 @@ export function settleSendResult(state, round, sent) {
             usage: reportedUsage,
             sendTools: round.sendTools,
             toolCalls: response.toolCalls?.length || 0,
+            requestMs: sent.requestMs,
           })
         )
       );