mixdog 1.3.1 → 1.3.3

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -16,7 +16,8 @@ import { isOffReadonlySurface } from './deferred-call-through.mjs';
 import { BRIDGE_CALL_TOOL_NAME, bridgeErrorText, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
 import { sessionAllowlistExcludes, sessionDisallows } from '../../runtime-core/deferred-tool-availability.mjs';
 import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
-import { agentMcpToolPermission, projectMcpToolDisabled } from '../../mcp/agent-connectors.mjs';
+import { workflowOverlayDenial } from '../manager/workflow-switch-notice.mjs';
+import { agentMcpToolPermission, connectorPolicyAgentOf, projectMcpToolDisabled } from '../../mcp/agent-connectors.mjs';
 
 const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'session']);
 const BRIDGE_DISCOVERY_TOOL_NAMES = new Set(['load_tool']);
@@ -120,12 +121,15 @@ export function preDispatchDenyForSession(sessionRef, call) {
   if (!bridgeDiscovery && sessionAllowlistExcludes(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available on this session's schema allowlist.`;
   }
+  // A workflow switched mid-conversation keeps the schema; its denials apply here.
+  const workflowDenial = workflowOverlayDenial(sessionRef, schemaName);
+  if (workflowDenial) return workflowDenial;
   if (sessionDisallows(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available in this session.`;
   }
   // An agent's connectors: a tool of a server it does not mount, or one set
   // to `disabled`, stays refused though the process-wide registry knows it.
-  if (agentMcpToolPermission(sessionRef?.agent, schemaName) === 'disabled') {
+  if (agentMcpToolPermission(connectorPolicyAgentOf(sessionRef), schemaName) === 'disabled') {
     return `Error: tool "${name}" is not available to this agent.`;
   }
   // The project the session runs in may switch a connector off as well.

package/src/runtime/agent/orchestrator/session/loop/route-fallback.mjs

@@ -67,8 +67,7 @@ function annotateEndedChain(session, error, skipped = null) {
 
 // A context overflow moves only to a model whose window is larger.
 async function nextContextGrows(state, next) {
-  const config = ensureProviderEnabled(loadConfig(), next.provider);
-  await initProviders(config.providers, { signal: state.signal });
+  await initProviders(ensureProviderEnabled(loadConfig(), next.provider), { signal: state.signal });
   state.throwIfAborted();
   const provider = getProvider(next.provider);
   if (!provider) return false;
@@ -93,8 +92,7 @@ export async function advanceAgentRoute(state, error) {
     return false;
   }
   state.throwIfAborted();
-  const config = ensureProviderEnabled(loadConfig(), next.provider);
-  await initProviders(config.providers, { signal: state.signal });
+  await initProviders(ensureProviderEnabled(loadConfig(), next.provider), { signal: state.signal });
   state.throwIfAborted();
   const provider = getProvider(next.provider);
   if (!provider) throw new Error(`Provider "${next.provider}" not available`);
@@ -128,7 +126,9 @@ export async function advanceAgentRoute(state, error) {
       contextTokens: next.contextTokens,
       selectedContextWindow: resolveSessionContextMeta(provider, next.model, next).rawContextWindow,
     },
-    { crossProvider: true }
+    // The live turn object is what changes: the route is applied to it in place, never to
+    // another copy of the id (a disk reload after a generation takeover).
+    { crossProvider: true, session }
   );
   if (!updated) throw new Error('agent session closed during model fallback');
   updated.routeFallbackIndex = index + 1;

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -4,6 +4,7 @@
  * consume a retry verdict, and settle a completed send into the loop state.
  */
 import { traceCacheBreak } from '../../cache-break-trace.mjs';
+import { anthropicPrefixChanges } from '../../providers/lib/anthropic-prefix-trace.mjs';
 import { resolveLiveToolCwd } from './tool-exec.mjs';
 import { notifySkillsApplied, prepareExplicitSkills, recordAppliedSkills } from '../explicit-skills.mjs';
 import { addUsage, usageDeltaEvent } from './usage.mjs';
@@ -185,10 +186,16 @@ export async function sendProviderRequest(state, round) {
   // included: the span the usage ledger recorded as `duration_ms` (stamped on
   // the response); wall time only for a response no ledger row timed.
   const requestStartedAt = Date.now();
+  // The output-limit escalation is one-shot: take it off the shared options
+  // before sending, so this attempt alone carries it whatever the outcome
+  // (retry, route fallback, thrown error, abort).
+  const maxOutputTokensOverride = opts.maxOutputTokensOverride;
+  delete opts.maxOutputTokensOverride;
   let result;
   try {
     result = await runWithProviderRequestToolsScope(round.requestToolScope, () =>
       sendWithRecovery({
+        maxOutputTokensOverride,
         provider,
         messages: providerMessages,
         recoveryMessages: messageSource,
@@ -352,6 +359,8 @@ function traceActualCacheMiss(state, sent, response, { previousGuardState, previ
         previousCachedPrefixTokens: baseline,
         idleMs,
         missingPrefixGuardBaseline: !previousGuardState,
+        // Which wire block moved ('none': same bytes, so the cache itself dropped it).
+        ...anthropicPrefixChanges(sessionId),
       },
       state.cacheBreakTraceOptions
     );
@@ -381,6 +390,7 @@ export function settleSendResult(state, round, sent) {
   if (state.imageStrip) settleImageStrip(state, round, sent);
   opts.onToolCall = undefined;
   delete opts.cacheBreakIntent;
+  state.lastStreamedChars = sent.result.streamedChars || 0;
   state.contextOverflowRetryUsed = false;
   // A completed send ends the outage this budget was covering; the next
   // iteration is a fresh request and must get the full replay budget again.

package/src/runtime/agent/orchestrator/session/loop/steering.mjs

@@ -1,6 +1,7 @@
 // Steering-message normalization/merge helpers.
 // Merges queued steering entries into a single content payload + display text.
 import { stableMessageId } from '../../../../shared/transcript-metadata.mjs';
+import { raiseTurnHop } from '../../../../shared/bot-hops.mjs';
 
 function steeringContentText(content) {
   if (typeof content === 'string') return content;
@@ -140,6 +141,8 @@ function injectSteeringEntry(merged, { messages, opts, stage, onSkillPrompt }) {
   // gets it back (onSteerMessage) for the row it draws. A steered prompt
   // keeps the id the surface gave it, else gets one.
   const messageId = stableMessageId(merged.transcriptMeta?.messageId);
+  // A bot's message at a higher hop makes the running turn bot-descended at that hop.
+  raiseTurnHop(opts.session, merged.transcriptMeta);
   const steeringTranscriptMeta =
     merged.transcriptMeta && typeof merged.transcriptMeta === 'object'
       ? { at: submittedAt ?? injectedAt, ...merged.transcriptMeta, messageId }

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -6,15 +6,15 @@ import { resolvePreToolAskApproval } from '../tool-helpers.mjs';
 import { runAbortable, throwIfAborted } from '../../../../../shared/abort-race.mjs';
 import { evaluateExecPolicy } from '../../../tools/bash-policy-scan.mjs';
 import { beginSessionApprovalWait } from '../../manager/runtime-liveness.mjs';
-import { agentMcpToolPermission } from '../../../mcp/agent-connectors.mjs';
-import { humanGateDecision, recordHumanDecision } from '../../human-gate/gate.mjs';
+import { agentMcpToolPermission, writeAgentMcpToolPermission } from '../../../mcp/agent-connectors.mjs';
+import { actingBotId, actingContactBotId, humanGateDecision, recordHumanDecision } from '../../human-gate/gate.mjs';
 import { applyEditedArgs } from '../../human-gate/requests.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
 async function askApproval(
   call,
-  { callerSessionId, executeOpts, toolApprovalHook, decision, request = null, gate = null }
+  { callerSessionId, executeOpts, toolApprovalHook, decision, request = null, gate = null, onApproved = null }
 ) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
   // While the user decides, the session is waiting on them, not working.
@@ -46,26 +46,49 @@ async function askApproval(
   }
   // The user approved this very call on the richer outbound card.
   if (request?.kind === 'outbound') call.outboundApproved = true;
+  await onApproved?.(approval);
   return null;
 }
 
+/** The renderer translates this exact text (desktop-toasts.tsx ALLOW_NOT_SAVED_TEXT). */
+export const ALLOW_NOT_SAVED_NOTICE = 'Allowed this once. The setting could not be saved.';
 export const CONNECTOR_APPROVAL_REASON = 'This connector tool is set to ask before it runs for this agent.';
 
 /**
- * A connector tool the running agent set to `needs_approval` asks through the
- * ordinary approval hook, whatever the PreToolUse hooks decided. Run after
- * them, on the final call: a renamed call is judged under its final name.
- * A call the outbound card already got approved is not asked a second time.
+ * A connector tool a bot's own session (its home chat or room seat; a
+ * schedule/webhook run, which the approval hook then answers by run policy)
+ * runs, and the bot set to `needs_approval`, asks through the ordinary
+ * approval hook, whatever the PreToolUse hooks decided. Any other session (a
+ * coding Lead, a task session, a workflow agent, a sub-agent) runs it unasked.
+ * Run after the hooks, on the final call: a renamed call is judged under its
+ * final name. A call the outbound gate owns (its card approved it, or a
+ * remembered outbound grant answered it) is not asked a second time.
  * @returns {Promise<{ denial: string } | null>} the denial, or null to run
  */
 export function applyConnectorApproval(call, { agentId, callerSessionId, executeOpts, toolApprovalHook }) {
   if (call.outboundApproved) return null;
+  if (!actingBotId(callerSessionId)) return null;
   if (agentMcpToolPermission(agentId, call.name) !== 'needs_approval') return null;
+  // "Always allow" is offered only to the contact bot that is acting, for its
+  // own policy entry for this one tool: never another bot or Mixy.
+  const botId = actingContactBotId(callerSessionId);
+  const rememberable = Boolean(botId) && botId === agentId;
   return askApproval(call, {
     callerSessionId,
     executeOpts,
     toolApprovalHook,
     decision: { reason: CONNECTOR_APPROVAL_REASON },
+    request: rememberable ? { kind: 'approval', agentId: botId, remember: ['once', 'agent'] } : null,
+    onApproved: async (approval) => {
+      if (!rememberable || approval?.remember !== 'agent') return;
+      try {
+        if (await writeAgentMcpToolPermission(botId, call.name, 'auto')) return;
+      } catch {
+        // fall through to the notice below
+      }
+      // Not saved: this call still runs once, and the next one asks again.
+      toolApprovalHook?.notice?.(ALLOW_NOT_SAVED_NOTICE, 'warn');
+    },
   });
 }
 
@@ -120,7 +143,7 @@ export async function applyBeforeToolHook({
     // Judged as the call will run: only a rewriting decision changes name/args.
     const hookAction = String(hookDecision?.action || hookDecision?.decision || '').toLowerCase();
     const rewritten = hookAction === 'ask' || hookAction === 'modify' || hookAction === 'rewrite';
-    const { decision, request, gate } = await humanGateDecision(
+    const { decision, request, gate, remembered } = await humanGateDecision(
       {
         name:
           rewritten && typeof hookDecision?.name === 'string' && hookDecision.name.trim()
@@ -132,6 +155,8 @@ export async function applyBeforeToolHook({
       { sessionId: callerSessionId, mcpScopeId }
     );
     const action = String(decision?.action || decision?.decision || '').toLowerCase();
+    // A remembered outbound grant answered this call: the connector ask is not repeated.
+    if (remembered) call.outboundApproved = true;
     if (action === 'deny' || action === 'block') {
       const reason = decision?.reason ? `: ${decision.reason}` : '';
       return { denial: `Error: tool "${name}" denied by hook${reason}` };

package/src/runtime/agent/orchestrator/session/loop/tool-exec/call-prep.mjs

@@ -7,6 +7,7 @@ import { enqueuePendingMessage, markCompletionEntry } from '../../manager/pendin
 import { markSessionToolOutputTail } from '../../manager/runtime-liveness.mjs';
 import { createScopedCacheOutcome } from '../../cache/scoped-cache-outcome.mjs';
 import { modelVisibleToolCompletionMessage } from '../../../../../shared/tool-execution-contract.mjs';
+import { turnHopOf } from '../../../../../shared/bot-hops.mjs';
 import { _isScopedCacheableTool } from '../tool-classify.mjs';
 import { refreshDeferredMcpToolCatalog } from '../../../runtime-core/tool-catalog.mjs';
 import { coerceToolArgsForSession } from '../arg-schema-coerce.mjs';
@@ -84,8 +85,12 @@ export function prepareToolCall(name, args, cwd, callerSessionId, sessionRef, ex
   const notificationSessionId = resolveToolCompletionSessionId({ callerSessionId });
   const notifyFn =
     typeof executeOpts.notifyFn === 'function' ? executeOpts.notifyFn : completionNotifier(notificationSessionId);
+  // Background work launched in a bot-descended turn reports back at that hop:
+  // it rides the job's notify context, so every completion's meta carries it.
+  const hop = turnHopOf(sessionRef);
   const completionToolOpts = {
     ...toolOpts,
+    ...(hop > 0 ? { hop } : {}),
     sessionId: callerSessionId,
     agent: sessionRef?.agent || null,
     callerSessionId: notificationSessionId || callerSessionId,

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -17,6 +17,32 @@ import { isOnDeferredToolSurface } from '../deferred-call-through.mjs';
 import { _executeCodeGraphToolLazy } from '../../manager/runtime-loaders.mjs';
 import { requiresReadBody } from '../tool-classify.mjs';
 import { executeCursorNativeBuiltin } from '../../../tools/builtin/external-tool-adapters.mjs';
+import { providerModelVisionOverride, providerNativePdf, providerReadsImages } from '../../../providers/registry.mjs';
+import { getModelMetadataSync } from '../../../../../shared/llm/model-catalog.mjs';
+
+/**
+ * How read returns a PDF to this session's model. Native PDF support decides
+ * only whether a short PDF may arrive whole as a document block. A scanned
+ * page arrives as a page image whenever the model sees images — the provider
+ * sends image input (only the text-only local runtime does not) and the
+ * catalog does not say the model lacks it — and as OCR text otherwise. A
+ * custom model's own image-input setting (on or off) beats the catalog.
+ */
+export function pdfReadModes(
+  sessionRef,
+  {
+    nativePdf = providerNativePdf,
+    readsImages = providerReadsImages,
+    catalogRow = getModelMetadataSync,
+    visionOverride = providerModelVisionOverride,
+  } = {}
+) {
+  const provider = sessionRef?.provider;
+  const model = sessionRef?.model;
+  const vision = model ? (visionOverride(provider, model) ?? catalogRow(model, provider)?.supportsVision) : undefined;
+  const seesImages = readsImages(provider) && vision !== false;
+  return { pdfPageMode: seesImages ? 'image' : 'ocr', pdfNativeDocument: nativePdf(provider) };
+}
 
 function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts }) {
   const mcpScopeId = sessionRef?.mcpScopeId || null;
@@ -107,6 +133,7 @@ export function dispatchToolCall({ name, args }, ctx) {
         : {}),
       // Runtime-granted only; any value inherited from executeOpts is overridden.
       elevationApproved: ctx.elevationApproved === true,
+      ...pdfReadModes(sessionRef),
     };
     return executeCursorNativeBuiltin(
       name,

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -6,6 +6,7 @@
 //   tool-exec/after-hook.mjs         — PostToolUse result override
 //   tool-exec/read-only-deadline.mjs — bounded read-only I/O with partial-output grace
 import { isMcpTool } from '../../mcp/client.mjs';
+import { connectorPolicyAgentOf } from '../../mcp/agent-connectors.mjs';
 import { prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
 import { refreshDeferredMcpToolCatalog } from '../../runtime-core/tool-catalog.mjs';
 import { bridgeTargetUnavailable } from '../../runtime-core/tool-bridge.mjs';
@@ -54,7 +55,7 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
   });
   if (hooked.denial) return hooked.denial;
   const connectorDenied = await applyConnectorApproval(hooked, {
-    agentId: sessionRef?.agent,
+    agentId: connectorPolicyAgentOf(sessionRef),
     callerSessionId,
     executeOpts,
     toolApprovalHook,

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -8,6 +8,7 @@ import {
   bridgeSurfaceOutdated,
   sessionToolExposure,
   TOOL_EXPOSURE_BRIDGE,
+  TOOL_EXPOSURE_NATIVE,
   TOOL_SURFACE_MIGRATION_INTENT,
   toolExposureMigrationNeeded,
   toolExposureModeForProvider,
@@ -122,6 +123,17 @@ export function applyAgentToolExposure(session, { existing = false } = {}) {
   const bridge =
     !allowlisted && toolExposureModeForProvider(session.provider, session.wireRoute) === TOOL_EXPOSURE_BRIDGE;
   if (!bridge && before === null) return false;
+  // A native deferred surface (the session runtime builds one) stays one:
+  // re-selected over the tools just resolved, never stripped to the full
+  // array. Native → native is no exposure change, so nothing is tagged.
+  if (!bridge && before === TOOL_EXPOSURE_NATIVE) {
+    session.tools = session.tools.slice();
+    applyDeferredToolSurface(session, session.deferredSurfaceMode || 'full', [], {
+      provider: session.provider,
+      model: session.model,
+    });
+    return false;
+  }
   // A surface an earlier bridge revision built is rebuilt now.
   const outdated = bridgeSurfaceOutdated(session);
   // The tools just resolved are the whole authority: no earlier catalog, MCP

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -3,6 +3,7 @@
 // native tool-search payload parsing, bash-session routing, and approval.
 import { isMcpTool } from '../../mcp/client.mjs';
 import { unattendedApprovalPort } from '../human-gate/gate.mjs';
+import { isGrantedRun, runAskOutcome } from '../human-gate/run-policy.mjs';
 import { isBuiltinTool } from '../../tools/builtin.mjs';
 import { isInternalTool } from '../../internal-tools.mjs';
 import { loadSkillToolDependencies } from '../../runtime-core/skill-tool-loading.mjs';
@@ -212,12 +213,13 @@ export async function resolvePreToolAskApproval({
 }) {
   const name = String(toolName || 'tool');
   const reason = String(askReason || 'approval requested by hook').trim();
-  // Unattended runs never auto-approve and have no card: a schedule or webhook
-  // run always holds the request for its owner; a room member does when no
+  // A schedule or webhook run never asks: saving it was the user's grant
+  // (human-gate/run-policy.mjs). A room member is held for its owner when no
   // approval UI is attached (session-runtime/held-requests.mjs).
   const unattended = unattendedApprovalPort();
   const run = unattended?.runOf?.(sessionId) || null;
-  const held = run && (run.kind !== 'room' || typeof toolApprovalHook !== 'function');
+  if (isGrantedRun(run)) return runAskOutcome({ name, request });
+  const held = run && typeof toolApprovalHook !== 'function';
   const ask = held ? unattended.hold : toolApprovalHook;
   if (typeof ask !== 'function') {
     return { denial: formatMissingToolApprovalUiDenial(name, reason) };
@@ -238,8 +240,12 @@ export async function resolvePreToolAskApproval({
     return { denial: `Error: tool "${name}" denied by hook: ${detail}` };
   }
   if (!approvalGranted(approval)) {
-    const detail = approvalReason(approval, reason || 'not approved');
-    return { denial: `Error: tool "${name}" denied by hook: ${detail}`, approval };
+    // A person (or the hold for one) said no: never a policy hook to work around.
+    const detail = String(approvalReason(approval, reason || 'not approved')).replace(/[.\s]+$/, '');
+    return {
+      denial: `Error: tool "${name}" was not approved: ${detail}. Do not retry it or reach the same result another way; report it.`,
+      approval,
+    };
   }
   return { approval };
 }

package/src/runtime/agent/orchestrator/session/manager/agent-listing-notice.mjs

@@ -0,0 +1,102 @@
+// manager/agent-listing-notice.mjs
+// The agents a coding Lead may delegate to, kept current without touching the
+// request prefix (the workflow switch's pattern, workflow-switch-notice.mjs).
+// What the conversation was told is read from the conversation itself, every
+// turn: the "# Available Agents" list the system prompt carries (the one the
+// session was built with: a rebuilt prompt keeps it, prompt-utils.mjs
+// presentedAgentCatalogSlice), then each agent list reminder still in
+// `session.messages`, in order (the user turn that carried one records its
+// change as `meta.agentListing`). A turn whose message stays (answered or
+// failed) counts; one rolled back or compacted away does not, so its change is
+// told again. When the agents enabled at this turn's start (resolved by the
+// session runtime, passed in with the turn) differ from that, the turn carries
+// one reminder naming the agents added and removed.
+import { agentListEntries, presentedAgentCatalogSlice, suffixUserTurnReminders } from './prompt-utils.mjs';
+import { stripRuntimeUserContext, withRuntimeUserContext } from '../runtime-user-context.mjs';
+
+/** The agent list the system prompt carries: one complete generated slice of
+ *  the BP3 block, [] when it carries none (or none valid). */
+function promptAgentList(session) {
+  return (session && agentListEntries(presentedAgentCatalogSlice(session) || '')) || [];
+}
+
+const ref = (entry) => ({ id: String(entry.id), name: String(entry.name) });
+
+/** The agents the conversation was told about: the prompt's list, then every
+ *  agent list reminder the conversation still holds, in order. */
+export function announcedAgents(session) {
+  const told = new Map(promptAgentList(session).map((entry) => [entry.id, ref(entry)]));
+  for (const message of Array.isArray(session?.messages) ? session.messages : []) {
+    const change = message?.role === 'user' ? message.meta?.agentListing : null;
+    if (!change) continue;
+    for (const entry of Array.isArray(change.removed) ? change.removed : []) told.delete(entry?.id);
+    for (const entry of Array.isArray(change.added) ? change.added : []) {
+      if (entry?.id) told.set(entry.id, ref(entry));
+    }
+  }
+  return [...told.values()];
+}
+
+function agentListingContent(added, removed, current) {
+  return [
+    '<system-reminder>',
+    '# Available Agents Changed',
+    'This updates the Available Agents list in the system prompt and every earlier Available Agents Changed reminder.',
+    ...(added.length
+      ? ['New agents are now available to delegate to with `agent`:', ...added.map((entry) => entry.line)]
+      : []),
+    ...(removed.length
+      ? [
+          'These agents are no longer available; an `agent` call naming one is refused:',
+          ...removed.map((entry) => `- ${entry.name} (${entry.id})`),
+        ]
+      : []),
+    ...(current.length ? [] : ['No agents are enabled now: do the work yourself until one is enabled.']),
+    '</system-reminder>',
+  ].join('\n');
+}
+
+/**
+ * The agent list reminder this user turn carries, or null when the
+ * conversation already knows `current`, the agents enabled at this turn's
+ * start (`agentListEntries` entries, from the session runtime's ask options;
+ * absent for agent-mode threads and delegated workers: no reminder).
+ * @returns {{ content: string, meta: { added: object[], removed: object[] } } | null}
+ */
+export function buildAgentListingNotice(session, current) {
+  if (!Array.isArray(current)) return null;
+  const announced = announcedAgents(session);
+  const now = new Set(current.map((entry) => entry.id));
+  const told = new Set(announced.map((entry) => entry.id));
+  const added = current.filter((entry) => !told.has(entry.id));
+  const removed = announced.filter((entry) => !now.has(entry.id));
+  if (!added.length && !removed.length) return null;
+  return {
+    content: agentListingContent(added, removed, current),
+    meta: { added: added.map(ref), removed: removed.map(ref) },
+  };
+}
+
+/**
+ * A retained failed turn resubmitted as it was (its own message, its input
+ * untouched) learns what changed since: the reminder joins its runtime
+ * context, and `meta.agentListing` becomes the net change against what the
+ * conversation was told before that message, so later turns read it back as a
+ * normal turn's. `index` is the message's place in `session.messages`.
+ */
+export function withAgentListingNotice(session, index, message, current) {
+  const notice = buildAgentListingNotice(session, current);
+  if (!notice) return message;
+  const before = { ...session, messages: session.messages.filter((_, i) => i !== index) };
+  const net = buildAgentListingNotice(before, current);
+  const { agentListing: _told, ...meta } = message.meta || {};
+  const stripped = stripRuntimeUserContext({ ...message, meta });
+  const owned = stripped.meta?.runtimeUserContext ? null : message.meta?.runtimeUserContext;
+  return withRuntimeUserContext(
+    { ...stripped, meta: { ...stripped.meta, ...(net ? { agentListing: net.meta } : {}) } },
+    {
+      prefix: owned?.prefix || '',
+      suffix: `${owned?.suffix || ''}${suffixUserTurnReminders('', notice.content)}`,
+    }
+  );
+}

package/src/runtime/agent/orchestrator/session/manager/ask-queue.mjs

@@ -34,6 +34,7 @@ const promptSourceFields = (source, execution) => {
 const tailTurnFor = (group) => ({
   content: group.content,
   entries: group.entries,
+  ...(group.hop ? { hop: group.hop } : {}),
   ...(group.mode === PENDING_MODE_TASK_NOTIFICATION
     ? promptSourceFields(PENDING_MODE_TASK_NOTIFICATION, group.execution)
     : {}),
@@ -46,6 +47,7 @@ const queuedTurnInput = (tailTurn) => ({
   context: null,
   explicitPrefetch: null,
   pendingEntries: tailTurn.entries,
+  ...(tailTurn.hop ? { hop: tailTurn.hop } : {}),
   promptSource: promptSourceFields(tailTurn.source, tailTurn.execution),
 });
 

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -84,7 +84,19 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       cwdOverride || opened.turn.session.cwd || process.cwd(),
       opened.runtime.controller?.signal
     );
-    const prepared = await prepareAskTurn({ sessionId, opened, input, cwdOverride, transcriptMeta: transcript.user });
+    const prepared = await prepareAskTurn({
+      sessionId,
+      opened,
+      input,
+      cwdOverride,
+      // A task notification resumes the bot-chain hop of the turn that launched its work.
+      transcriptMeta: input.hop ? { ...transcript.user, hop: input.hop } : transcript.user,
+      // The agents enabled as this user turn is prepared (the session
+      // runtime's resolver; coding Leads): the agent list reminder compares
+      // them with what the model was told. Asked again for every user turn
+      // the ask runs, queued and background follow-ups included.
+      currentAgents: askOpts?.agentsNow?.(),
+    });
     const result = await runAskAgentLoop({
       sessionId,
       opened,

package/src/runtime/agent/orchestrator/session/manager/ask-turn-auto-effort.mjs

@@ -11,6 +11,7 @@ import { autoEffortModel, turnEffortConfigurationMode } from '../../providers/ef
 import {
   autoEffortApplicable,
   autoEffortBase,
+  clampAutoEffortBase,
   normalizeAutoEffortMode,
   resolveAutoEffort,
 } from '../../providers/auto-effort.mjs';
@@ -58,6 +59,15 @@ export function autoEffortMode() {
   }
 }
 
+/** The global "Auto reasoning base" setting; absent or unreadable is medium. */
+export function autoEffortBaseSetting() {
+  try {
+    return autoEffortBase(readSection('agent')?.autoEffortBase);
+  } catch {
+    return autoEffortBase(undefined);
+  }
+}
+
 /**
  * Starts the judge worker when a session is created or opened on a route that
  * Auto effort can judge, so the first judged turn does not wait for the cold
@@ -102,7 +112,9 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
   if (!request || request.startsWith('<')) return null;
   if (!turnEffortConfigurationMode(session, provider)) return null;
   const chosen = String(session.effort || '').toLowerCase();
-  const base = autoEffortBase(chosen);
+  const options = effortOptionsFor(session.provider, autoEffortModel(session.provider, provider, session.model));
+  const setting = autoEffortBaseSetting();
+  const base = clampAutoEffortBase({ base: setting, options }) ?? autoEffortBase(setting);
   const record = {
     at: new Date().toISOString(),
     sessionId,
@@ -113,7 +125,6 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
     base,
     requestChars: request.length,
   };
-  const options = effortOptionsFor(session.provider, autoEffortModel(session.provider, provider, session.model));
   // No judged outcome can apply when the base is off the model's ladder, so
   // the judge is not asked (in observe mode too: nothing would be logged).
   if (!autoEffortApplicable({ base, options })) {

package/src/runtime/agent/orchestrator/session/manager/ask-turn-execute.mjs

@@ -15,16 +15,20 @@ import { filterModelVisibleSessionMessages } from './message-sanitize.mjs';
 import { _getAgentLoop } from './runtime-loaders.mjs';
 import { runAbortable, throwIfAborted } from '../../../../shared/abort-race.mjs';
 import { applyTurnContextMeta, buildUserTurn, startProviderPrewarm, traceTurnContext } from './ask-turn-prepare.mjs';
+import { withAgentListingNotice } from './agent-listing-notice.mjs';
 import { retainedFailedTurnInput, rewindUnansweredPrompt } from './failed-turn-rewind.mjs';
 import { buildAgentLoopOptions, trackedToolCallHook } from './ask-turn-loop-options.mjs';
 import { _api_call_with_interrupt } from './ask-call-interrupt.mjs';
 import { backfillFallbackSessionTitle } from './session-fallback-title.mjs';
+import { stampTurnHop } from '../../../../shared/bot-hops.mjs';
 
 /** Resolves the provider, builds the user turn and pre-commits it; returns
  *  what the loop and the commit need from this preparation. */
-export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, transcriptMeta }) {
+export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, transcriptMeta, currentAgents }) {
   const { turn, runtime, turnSignal, askGeneration, checkpoint, turnToken, startedAt, codexTurnId } = opened;
   const session = turn.session;
+  // Where the turn sits in a bot-to-bot chain (session-runtime/bot-hops.mjs).
+  stampTurnHop(session, transcriptMeta);
   const retained = input.retryTurnId
     ? retainedFailedTurnInput(session.messages, input.retryTurnId, input.retryAttemptId)
     : null;
@@ -68,21 +72,28 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
       ? (() => {
           const historyMessages = filterModelVisibleSessionMessages(session.messages.slice(0, retained.index));
           const { completion, ...previousTranscript } = retained.message.meta.transcript;
-          const userTurnMessage = {
-            ...retained.message,
-            meta: {
-              ...retained.message.meta,
-              transcript: {
-                ...previousTranscript,
-                ...transcriptMeta,
-                messageId: previousTranscript.messageId,
-                previousCompletions: [
-                  ...(previousTranscript.previousCompletions || []),
-                  { ...completion, at: completion.at ?? previousTranscript.at },
-                ],
+          // The retained message keeps its input; agents enabled or switched
+          // off since it was built ride its runtime context.
+          const userTurnMessage = withAgentListingNotice(
+            session,
+            retained.index,
+            {
+              ...retained.message,
+              meta: {
+                ...retained.message.meta,
+                transcript: {
+                  ...previousTranscript,
+                  ...transcriptMeta,
+                  messageId: previousTranscript.messageId,
+                  previousCompletions: [
+                    ...(previousTranscript.previousCompletions || []),
+                    { ...completion, at: completion.at ?? previousTranscript.at },
+                  ],
+                },
               },
             },
-          };
+            currentAgents
+          );
           return { historyMessages, userTurnMessage, outgoing: [...historyMessages, userTurnMessage] };
         })()
       : buildUserTurn({
@@ -94,6 +105,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
           transcriptMeta,
           turnPromptSource: input.promptSource,
           effortConfiguration: null,
+          currentAgents,
         }),
     wireRoutePending,
   ]);
@@ -187,6 +199,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
     deferredToolDelta: userTurn.deferredToolDelta,
     goalReminder: userTurn.goalReminder,
     workflowNotice: userTurn.workflowNotice,
+    orchestrationModeNotice: userTurn.orchestrationModeNotice,
     workspaceNotice: userTurn.workspaceNotice,
     setupNotice: userTurn.setupNotice,
   };