mixdog 1.3.4 → 1.3.5

package/src/runtime/agent/orchestrator/session/human-gate/gate.mjs

@@ -14,17 +14,22 @@
 // allowed, payments and permanent deletes denied. Group-room members register
 // a port here (session-runtime/held-requests.mjs) that turns their asks into
 // held requests when no approval card is attached.
+// The "Allow all actions" developer option (shared/developer-options.mjs)
+// skips every ask below, the bot's per-action `ask` mode and a hook `ask`
+// included, except a payment or permanent delete; a `block` and a hook `deny`
+// still deny.
 import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../agent-home.mjs';
 import { serverConnector } from '../../mcp/server-connectors.mjs';
 import { readAgentDefinitionKind } from '../../../../shared/agent-kind.mjs';
 import { isContactAgentId } from '../../../../shared/agent-route-config.mjs';
+import { developerOptionEnabledStrict } from '../../../../shared/developer-options.mjs';
 import { mixdogRoot, resolvePluginData } from '../../../../shared/plugin-paths.mjs';
 import { roomMemberOfSession } from '../agent-room.mjs';
 import { agentDisplayName } from '../../context/role-instructions.mjs';
 import { delegationOf } from './delegation.mjs';
 import { setUnattendedApprovalPort, unattendedApprovalPort } from './unattended-port.mjs';
-import { classifyAsDelete, classifyOutboundCall, isRememberableAction } from './outbound-policy.mjs';
-import { humanGateStore } from './store.mjs';
+import { classifyAsDelete, classifyOutboundCall, isAlwaysAskAction, isRememberableAction } from './outbound-policy.mjs';
+import { DEV_ALLOW_ALL_DECISION, humanGateStore } from './store.mjs';
 import {
   AUTOMATION_GRANT_REASON,
   RUN_FORBIDDEN_REASON,
@@ -33,7 +38,7 @@ import {
   savesAutomation,
 } from './run-policy.mjs';
 
-export const OUTBOUND_APPROVAL_REASON = 'This sends or posts outside Mixdog; it needs your approval.';
+const OUTBOUND_APPROVAL_REASON = 'This sends or posts outside Mixdog; it needs your approval.';
 export const BLOCKED_ACTION_REASON = "This agent's permission blocks this action.";
 /** Outbound grants may be remembered for this agent, never for every agent;
  *  payments and deletes never. */
@@ -105,6 +110,22 @@ export function approvalSurface(sessionId) {
 
 const actionOf = (decision) => String(decision?.action || decision?.decision || '').toLowerCase();
 
+/** Whether the "Allow all actions" developer option is on (default off).
+ *  Fail-closed: an unreadable, missing or malformed config is off (the call
+ *  asks), and a value restored from a backup never counts. */
+export const allowAllActionsEnabled = () => developerOptionEnabledStrict('allowAllActions');
+
+/** Whether the option lets a call of this classification (or none) run without
+ *  a card: every ask, never a classified payment or permanent delete. */
+const skipsApproval = (classified) => !isAlwaysAskAction(classified?.category) && allowAllActionsEnabled();
+
+/** The hook decision once its card is skipped: an `ask` runs as an allow,
+ *  keeping any rewrite it carried. */
+function withoutAsk(decision) {
+  if (actionOf(decision) !== 'ask') return decision;
+  return { ...decision, action: decision.name || decision.args ? 'modify' : 'allow' };
+}
+
 async function mcpAnnotations(name, scopeId) {
   if (!String(name).startsWith('mcp__')) return undefined;
   try {
@@ -185,11 +206,17 @@ export async function humanGateDecision(call, decision, ctx = {}) {
   const outbound = classified && actingBotId(ctx.sessionId) ? classified : null;
   if (!outbound) {
     if (action !== 'ask') return { decision, request: null, gate: null };
+    const gate = { agentId, kind: 'approval', tool: String(call?.name || ''), target: '' };
+    if (skipsApproval(classified)) {
+      const store = ctx.store || (await humanGateStore());
+      await store.recordAudit({ ...gate, decision: DEV_ALLOW_ALL_DECISION, device: '' });
+      return { decision: withoutAsk(decision), request: null, gate: null };
+    }
     return {
       // Saving a schedule or webhook says plainly what the approval grants.
       decision: savesAutomation(call) ? { ...decision, reason: AUTOMATION_GRANT_REASON } : decision,
       request: { kind: 'approval', agentId, remember: ['once'] },
-      gate: { agentId, kind: 'approval', tool: String(call?.name || ''), target: '' },
+      gate,
     };
   }
   const gate = { agentId, kind: 'outbound', action: outbound.category, tool: outbound.tool, target: outbound.target };
@@ -215,6 +242,11 @@ export async function humanGateDecision(call, decision, ctx = {}) {
     await store.recordAudit({ ...gate, decision: 'blocked', device: '' });
     return { decision: { ...base, action: 'deny', reason: BLOCKED_ACTION_REASON }, request: null, gate: null };
   }
+  // The bot's `ask` mode (and a hook's `ask`) is bypassed; a payment or delete is not.
+  if (skipsApproval(outbound)) {
+    await store.recordAudit({ ...gate, decision: DEV_ALLOW_ALL_DECISION, device: '' });
+    return { decision: withoutAsk(decision), request: null, gate: null };
+  }
   if (action !== 'ask' && mode === 'allow') {
     await store.recordAudit({ ...gate, decision: 'remembered', device: '' });
     // The remembered grant answers this call: no later layer asks it again.

package/src/runtime/agent/orchestrator/session/human-gate/outbound-policy.mjs

@@ -39,6 +39,12 @@ export function isRememberableAction(kind) {
   return ACTION_KINDS.includes(kind) && !UNREMEMBERED_ACTIONS.has(kind);
 }
 
+/** Whether `kind` is a payment or permanent delete: it asks every time,
+ *  whatever else is allowed (also by the "Allow all actions" developer option). */
+export function isAlwaysAskAction(kind) {
+  return UNREMEMBERED_ACTIONS.has(kind);
+}
+
 const GITHUB_OUTBOUND = new Map([
   ['issue.comment', 'comment'],
   ['pr.comment', 'comment'],

package/src/runtime/agent/orchestrator/session/human-gate/store.mjs

@@ -17,7 +17,7 @@ import { ACTION_KINDS, isRememberableAction } from './outbound-policy.mjs';
 const ANY_AGENT = '*';
 const FIELD_LIMIT = 200;
 const AUDIT_KEYS = ['agentId', 'kind', 'action', 'tool', 'target', 'decision', 'device'];
-export const PERMISSION_MODES = Object.freeze(['ask', 'allow', 'block']);
+const PERMISSION_MODES = Object.freeze(['ask', 'allow', 'block']);
 
 const field = (value) => String(value ?? '').slice(0, FIELD_LIMIT);
 const grantId = (agentId, action) =>
@@ -173,12 +173,24 @@ export async function setAgentPermission(agentId, action, mode, options) {
   return store.permissions(agent);
 }
 
-const BROWSER_AUDIT_DECISIONS = Object.freeze(['approve', 'deny', 'granted', 'remembered', 'run-allowed', 'blocked']);
+/** The audit decision of a call the "Allow all actions" developer option let through unasked. */
+export const DEV_ALLOW_ALL_DECISION = 'dev-allow-all';
+
+const BROWSER_AUDIT_DECISIONS = Object.freeze([
+  'approve',
+  'deny',
+  'granted',
+  'remembered',
+  'run-allowed',
+  'blocked',
+  DEV_ALLOW_ALL_DECISION,
+]);
 
 /** Audit one Browser Use approval of a bot (capability recordAgentApprovalAudit):
  *  the bot, the action kind and what happened — `approve` / `deny` for the card,
  *  `granted` when "always allow" was saved, `remembered` when a saved allow let
- *  a step run unasked. Never a page address, target or value. */
+ *  a step run unasked, `dev-allow-all` when the developer option did. Never a
+ *  page address, target or value. */
 export async function recordAgentApprovalAudit(agentId, action, decision) {
   const agent = requiredAgentId(agentId);
   if (!ACTION_KINDS.includes(action)) throw new Error(`action must be one of ${ACTION_KINDS.join(', ')}`);

package/src/runtime/agent/orchestrator/session/loop/assistant-commit.mjs

@@ -62,6 +62,12 @@ function assistantEchoFields(payloads) {
   };
 }
 
+// The tail reminder the response was generated under (send-with-recovery.mjs),
+// kept verbatim so a turn-scoped provider replays it byte-identically.
+export function turnReminderField(resp) {
+  return typeof resp?.turnReminder === 'string' && resp.turnReminder ? { turnReminder: resp.turnReminder } : {};
+}
+
 // Intermediate (non-tool) assistant turn: max-output partials, refusal
 // narration, provider continuations, and the terminal turn committed before a
 // steering drain. Returns null when the turn carries nothing committable — a
@@ -89,6 +95,7 @@ export function buildIntermediateAssistantMessage(resp, opts) {
       role: 'assistant',
       content,
       ...assistantEchoFields(payloads),
+      ...turnReminderField(resp),
       ...(stopReason ? { stopReason } : {}),
       ...(terminationReason ? { terminationReason } : {}),
     },
@@ -108,6 +115,7 @@ export function buildToolCallAssistantMessage(response, { calls, opts }) {
       content: response.content || '',
       toolCalls: compactToolCallsForHistory(calls, { deferBodies: true }),
       ...assistantEchoFields(assistantEchoPayloads(response, { keepAssistantBlocks: true })),
+      ...turnReminderField(response),
     },
     opts
   );

package/src/runtime/agent/orchestrator/session/loop/loop-state.mjs

@@ -55,6 +55,9 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     cwd: resolveLiveToolCwd(cwd, sessionRef),
     iterations: 0,
     toolCallsTotal: 0,
+    // A capped turn (turn-limits.mjs): told to reply, and ended by calling tools anyway.
+    turnLimitNoticed: false,
+    turnLimitEnded: false,
     lastUsage: undefined,
     firstTurnUsage: undefined,
     response: undefined,
@@ -147,6 +150,9 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
  *  promote an empty/abnormal finish to an explicit Lead-facing error). */
 export function finishLoop(state) {
   const { response } = state;
+  // A reaction-only turn is a successful completion, never an empty finish.
+  const terminationReason = classifyTerminationReason(response, { sessionAgent: state.sessionAgent });
+  const reactionCompleted = terminationReason === 'empty' && state.noToolTurn.reactionCompleted;
   return {
     ...response,
     usage: state.lastUsage || response.usage,
@@ -157,7 +163,8 @@ export function finishLoop(state) {
     toolCallsTotal: state.toolCallsTotal,
     providerState: state.providerState,
     providerStateUpdated: state.providerStateUpdated,
-    terminationReason: classifyTerminationReason(response, { sessionAgent: state.sessionAgent }),
+    terminationReason: reactionCompleted ? undefined : terminationReason,
+    ...(reactionCompleted ? { reactionCompleted: true } : {}),
     providerContinuations: state.noToolTurn.providerContinuations,
     ...(state.routeUsageHops?.length
       ? {

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn/segments.mjs

@@ -20,8 +20,11 @@ export function createTurnSegments({ messages, opts }) {
     // Record a mid-turn segment for the caller-facing aggregate and surface it
     // live for every session.
     // `committed: true` marks text that is the just-committed message's own.
+    // A committed message is whole, so the text after it is another message
+    // and a break keeps the aggregate from running the two together; a part
+    // that was cut off (max-output recovery) resumes right where it stopped.
     record(text, { committed = false } = {}) {
-      parts.push(text);
+      parts.push(committed ? `${text.trimEnd()}\n\n` : text);
       try {
         opts.onAssistantText?.(text, { committed });
       } catch {

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn.mjs

@@ -18,6 +18,9 @@ import { resetOutputLimitRecovery, resolveOutputLimit } from './no-tool-turn/out
 import { resolveRefusal } from './no-tool-turn/refusal.mjs';
 import { resumeContinuation } from './no-tool-turn/continuation.mjs';
 import { nudgeEmptyTurn } from './no-tool-turn/empty-nudge.mjs';
+import { isReactionSuccess, reactionCallIds, takeReactionTarget } from '../../runtime-core/reaction-tool-defs.mjs';
+import { messageIdOf } from '../message-ids.mjs';
+import { isReactableMessage } from '../message-reactions.mjs';
 
 // `escalateMaxTokens()` asks the live provider for a higher one-shot max_tokens
 // (number) or reports none (null/undefined) — the loop stays provider-agnostic.
@@ -37,6 +40,9 @@ export function createNoToolTurnResolver({
     outputEscalationUsed: false,
     refusalRetryUsed: false,
     emptyNudgeStreak: 0,
+    // Successful reactions (react tool): the input each was left against and
+    // whether it answered that input.
+    reactions: [],
     // Structured provider continuation signals honored this turn. Diagnostic
     // only: the loop has no iteration cap, so this count bounds nothing. A
     // text-only continuation runaway is bounded by continuationsSinceToolBatch
@@ -46,6 +52,39 @@ export function createNoToolTurnResolver({
     // continuation runaway (see PROVIDER_CONTINUATION_NO_TOOL_LIMIT).
     continuationsSinceToolBatch: 0,
   };
+  // The stable id (message-ids.mjs, kept across compaction) of the newest
+  // real user input; runtime reminders and notices are not reactable.
+  // A group-room member turn's prompt is a runtime message (not reactable)
+  // that carries the newest room-log user row it shows (`roomRow`).
+  const roomRowOf = (message) => message?.meta?.transcript?.roomRow || '';
+  const latestInput = () => messages.findLast((message) => isReactableMessage(message) || roomRowOf(message));
+  const latestInputId = () => messageIdOf(latestInput());
+  // A reaction exempts the input only while no newer input arrived since it
+  // landed (same latest input id) and it answered that input.
+  const reactionAnswersLatest = () => {
+    const id = latestInputId();
+    return state.reactions.some((reaction) => reaction.answered && reaction.inputId === id);
+  };
+  // What this batch's react calls hit, from the id the react tool recorded
+  // for each (never rebuilt from this transcript: a room reaction runs
+  // against the room's own log). Every record is consumed; a success that
+  // recorded none exempts nothing. A home-chat reaction answers the input
+  // only when it hit that very message; a room reaction, whose message is in
+  // another log, only when it hit the row this turn's prompt showed.
+  const batchReactions = (calls, results) => {
+    const input = latestInput();
+    const inputId = messageIdOf(input);
+    const hit = [];
+    for (const id of reactionCallIds(calls)) {
+      const target = takeReactionTarget(sessionId, id);
+      if (!target || !results.some((message) => isReactionSuccess(message, new Set([id])))) continue;
+      const answered = target.room
+        ? roomRowOf(input) === target.messageId
+        : inputId !== '' && target.messageId === inputId;
+      hit.push({ inputId, answered });
+    }
+    return hit;
+  };
   const trace = (iteration, kind, payload) => {
     try {
       appendAgentTrace({ sessionId, iteration, kind, payload, agent: sessionAgent || null });
@@ -101,7 +140,9 @@ export function createNoToolTurnResolver({
       // output, …) and a text-only terminal turn is the correct shape —
       // nudging them produces a contradictory user message that traps the
       // model in a tool-call-blocked vs contract-required oscillation.
-      if (!hasContent && !HIDDEN_AGENT_NAMES.has(sessionAgent)) {
+      // A turn that left a reaction on the user's message may end with no
+      // text: the reaction is its answer (react tool), never an empty turn.
+      if (!hasContent && !HIDDEN_AGENT_NAMES.has(sessionAgent) && !reactionAnswersLatest()) {
         return nudgeEmptyTurn(
           response,
           { stopReason, isIncompleteStop: stopReason && INCOMPLETE_STOP_REASONS.has(stopReason) },
@@ -132,9 +173,16 @@ export function createNoToolTurnResolver({
       state.emptyNudgeStreak = 0;
       resetOutputLimitRecovery(state);
     },
-    noteToolBatchCompleted() {
+    // `results` are the batch's tool result messages: only a react call that
+    // succeeded marks the turn as having reacted.
+    noteToolBatchCompleted(calls = [], results = []) {
       state.continuationsSinceToolBatch = 0;
       segments.clear();
+      state.reactions.push(...batchReactions(calls, results));
+    },
+    // The loop ended on a reaction that answered the latest user input.
+    get reactionCompleted() {
+      return reactionAnswersLatest();
     },
     get providerContinuations() {
       return state.providerContinuationCount;

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -96,6 +96,9 @@ export async function beginIteration(state) {
   opts.providerState = state.providerState;
   if (state.forcedFirstTool && state.toolCallsTotal === 0) {
     opts.toolChoice = 'required';
+  } else if (state.turnLimitNoticed) {
+    // A capped turn told to reply may only answer (turn-limits.mjs).
+    opts.toolChoice = 'none';
   } else {
     delete opts.toolChoice;
   }

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -7,7 +7,13 @@ import { runAbortable, throwIfAborted } from '../../../../../shared/abort-race.m
 import { evaluateExecPolicy } from '../../../tools/bash-policy-scan.mjs';
 import { beginSessionApprovalWait } from '../../manager/runtime-liveness.mjs';
 import { agentMcpToolPermission, writeAgentMcpToolPermission } from '../../../mcp/agent-connectors.mjs';
-import { actingBotId, actingContactBotId, humanGateDecision, recordHumanDecision } from '../../human-gate/gate.mjs';
+import {
+  actingBotId,
+  actingContactBotId,
+  allowAllActionsEnabled,
+  humanGateDecision,
+  recordHumanDecision,
+} from '../../human-gate/gate.mjs';
 import { applyEditedArgs } from '../../human-gate/requests.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
@@ -62,13 +68,16 @@ export const CONNECTOR_APPROVAL_REASON = 'This connector tool is set to ask befo
  * coding Lead, a task session, a workflow agent, a sub-agent) runs it unasked.
  * Run after the hooks, on the final call: a renamed call is judged under its
  * final name. A call the outbound gate owns (its card approved it, or a
- * remembered outbound grant answered it) is not asked a second time.
+ * remembered outbound grant answered it) is not asked a second time. With the
+ * "Allow all actions" developer option on, `needs_approval` is not asked
+ * either (a payment or permanent delete was asked by the outbound gate above).
  * @returns {Promise<{ denial: string } | null>} the denial, or null to run
  */
 export function applyConnectorApproval(call, { agentId, callerSessionId, executeOpts, toolApprovalHook }) {
   if (call.outboundApproved) return null;
   if (!actingBotId(callerSessionId)) return null;
   if (agentMcpToolPermission(agentId, call.name) !== 'needs_approval') return null;
+  if (allowAllActionsEnabled()) return null;
   // "Always allow" is offered only to the contact bot that is acting, for its
   // own policy entry for this one tool: never another bot or Mixy.
   const botId = actingContactBotId(callerSessionId);

package/src/runtime/agent/orchestrator/session/loop/tool-phase.mjs

@@ -9,6 +9,7 @@ import { processToolBatch } from '../tool-batch.mjs';
 import { CROSS_TURN_CAP, REPEAT_FAIL_LIMIT } from './loop-state.mjs';
 import { markStepEffort } from './step-auto-effort.mjs';
 import { resolveExecutionToolCalls } from './tool-call-resolution.mjs';
+import { callsAllowed, settleTurnLimits, turnLimitsOf } from './turn-limits.mjs';
 
 function isSleepLikeToolCall(call) {
   const name = String(call?.name || call?.toolName || call?.function?.name || '').toLowerCase();
@@ -17,9 +18,13 @@ function isSleepLikeToolCall(call) {
 
 export async function runToolPhase(state, round, sent, onToolCall) {
   const { opts, messages, tools, sessionId, sessionRef, signal, response } = state;
-  state.noToolTurn.noteToolCallTurn();
   const calls = response.toolCalls;
+  state.noToolTurn.noteToolCallTurn();
   round.resolveToolCallId.all(calls);
+  // A capped turn (turn-limits.mjs): calls past its cap are answered unrun,
+  // and a batch after it was told to reply ends it.
+  const allowed = callsAllowed(state);
+  const overrun = state.turnLimitNoticed === true;
   state.toolCallsTotal += calls.length;
   // Surface any mid-turn assistant text (preamble before a tool call) to the
   // UI. Providers that stream via onTextDelta already rendered it; providers
@@ -44,6 +49,7 @@ export async function runToolPhase(state, round, sent, onToolCall) {
     opts.onToolPhaseStarted?.();
   } catch {}
   const toolsT0 = Date.now();
+  const resultsFrom = messages.length;
   ({ dedupStubTotal: state.dedupStubTotal, editCount: state.editCount } = await processToolBatch({
     calls,
     messages,
@@ -67,10 +73,13 @@ export async function runToolPhase(state, round, sent, onToolCall) {
     pushToolResultMessage: state.pushToolResultMessage,
     throwIfAborted: state.throwIfAborted,
     repeatFailLimit: REPEAT_FAIL_LIMIT,
+    callsAllowed: allowed,
+    wrapUpAt: turnLimitsOf(state.opts)?.wrapUpAt,
   }));
   // A turn recovered from a stream cut that dropped an in-flight tool call
   // carries a runtime notice for the model, delivered after its results.
   if (response.recoveryNotice) messages.push(response.recoveryNotice);
+  settleTurnLimits(state, overrun);
   const toolsEndedAt = Date.now();
   // Starts the step judgment; the next request uses it if it has resolved by
   // then (send-phase.mjs applyStepEffort), else the one after.
@@ -91,6 +100,6 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   });
   state.lastToolBatchEndedAt = toolsEndedAt;
   state.toolBatchJustCompleted = true;
-  state.noToolTurn.noteToolBatchCompleted();
+  state.noToolTurn.noteToolBatchCompleted(calls, messages.slice(resultsFrom));
   state.lastToolBatchHadSleep = calls.some(isSleepLikeToolCall);
 }

package/src/runtime/agent/orchestrator/session/loop/turn-limits.mjs

@@ -0,0 +1,60 @@
+/**
+ * turn-limits.mjs — a turn's caps (sendOpts.turnLimits; a heartbeat turn's,
+ * manager/ask-turn-loop-options.mjs): `maxToolCalls` tool calls and
+ * `wrapUpAt` (epoch ms). A call past the cap, or one made after the wrap-up
+ * time, is answered without running. Once a cap is reached the model is told
+ * to reply, and every later request of the turn forbids tool use
+ * (toolChoice 'none'). A response that still calls tools after that ends the
+ * turn with no reply, its calls answered unrun. A capped turn runs no call
+ * eagerly (eager-dispatch.mjs), so none past the cap starts while streaming.
+ */
+
+const NOTICE =
+  '[mixdog-runtime] This turn has reached its tool-call or time limit: no further tool call runs. Reply now with your final answer from what you already have.';
+const REFUSAL =
+  '[turn-limit] This turn has reached its tool-call or time limit; this call was not run. Reply now without tools.';
+
+/** `{ maxToolCalls, wrapUpAt }` of a capped turn (Infinity where unset), else null. */
+export function turnLimitsOf(opts) {
+  const limits = opts?.turnLimits;
+  if (!limits || typeof limits !== 'object') return null;
+  return {
+    maxToolCalls: Number.isInteger(limits.maxToolCalls) && limits.maxToolCalls >= 0 ? limits.maxToolCalls : Infinity,
+    wrapUpAt: Number.isFinite(limits.wrapUpAt) ? limits.wrapUpAt : Infinity,
+  };
+}
+
+/** How many calls of the next batch may run, before the loop counts them. */
+export function callsAllowed(state, now = Date.now()) {
+  const limits = turnLimitsOf(state.opts);
+  if (!limits) return Infinity;
+  if (state.turnLimitNoticed || now >= limits.wrapUpAt) return 0;
+  return Math.max(0, limits.maxToolCalls - state.toolCallsTotal);
+}
+
+/** The answer to a call the cap kept from running. */
+export function turnLimitRefusal(call) {
+  return { role: 'tool', content: REFUSAL, toolCallId: call.id, toolKind: 'error' };
+}
+
+/**
+ * After a tool batch: `overrun` when the batch came after the turn was told
+ * to reply, which ends the turn (state.turnLimitEnded). Otherwise, once a cap
+ * is reached, the model is told once to reply.
+ */
+export function settleTurnLimits(state, overrun, now = Date.now()) {
+  if (overrun) {
+    state.turnLimitEnded = true;
+    return;
+  }
+  const limits = turnLimitsOf(state.opts);
+  if (!limits || state.turnLimitNoticed) return;
+  if (state.toolCallsTotal < limits.maxToolCalls && now < limits.wrapUpAt) return;
+  state.turnLimitNoticed = true;
+  state.messages.push({ role: 'user', content: NOTICE, meta: { source: 'turn-limit' } });
+}
+
+/** The turn's end after an overrun: no reply. */
+export function endedWithoutReply(response) {
+  return { ...response, content: '', toolCalls: [] };
+}

package/src/runtime/agent/orchestrator/session/manager/ask-turn-commit.mjs

@@ -3,6 +3,7 @@
 // its empty-final forensic record), the usage/cost ledger row, and the
 // opaque provider continuation state.
 import { cloneProviderReplay } from '../../providers/lib/provider-replay.mjs';
+import { turnReminderField } from '../loop/assistant-commit.mjs';
 import { logLlmCall } from '../../usage-log.mjs';
 import { runAbortable } from '../../../../shared/abort-race.mjs';
 import { getAgentRuntimeSync } from './agent-runtime-singleton.mjs';
@@ -31,6 +32,7 @@ export function appendAssistantTurnMessage({ session, sessionId, result, transcr
       ...(result.providerMetadata && typeof result.providerMetadata === 'object'
         ? { providerMetadata: result.providerMetadata }
         : {}),
+      ...turnReminderField(result),
       // Keep terminal provider evidence for non-empty turns too. A safety
       // classifier can emit narration and then refuse; omitting this
       // metadata made that shape indistinguishable from an ordinary

package/src/runtime/agent/orchestrator/session/manager/ask-turn-loop-options.mjs

@@ -9,8 +9,21 @@ import { updateSessionStage, markSessionStreamDelta } from './runtime-liveness.m
 import { codexWireSendOpts } from './session-id.mjs';
 import { persistIterationMetrics } from './usage-metrics.mjs';
 import { isAgentModeSession } from '../agent-mode.mjs';
+import { HEARTBEAT_TURN_LIMITS, isHeartbeatSession } from '../../../../shared/routine-trigger.mjs';
 
 const optionalFn = (value) => (typeof value === 'function' ? value : undefined);
+
+/** Mixy's heartbeat turn is capped (loop/turn-limits.mjs): its tool calls, and
+ *  the time after which it must reply. Keyed by the in-process heartbeat mark. */
+export function heartbeatTurnLimits(sessionId, now = Date.now()) {
+  if (!isHeartbeatSession(sessionId)) return {};
+  return {
+    turnLimits: {
+      maxToolCalls: HEARTBEAT_TURN_LIMITS.maxToolCalls,
+      wrapUpAt: now + HEARTBEAT_TURN_LIMITS.wrapUpMs,
+    },
+  };
+}
 const relay = (fn, ...args) => {
   try {
     fn?.(...args);
@@ -201,6 +214,7 @@ export function buildAgentLoopOptions({
       relay(askOpts?.onSkillsApplied, names, detail);
     },
     notifyFn: optionalFn(askOpts?.notifyFn),
+    ...heartbeatTurnLimits(sessionId),
     ...buildRequestSendOptions({
       sessionId,
       session,

package/src/runtime/agent/orchestrator/session/manager/ask-turn-settle.mjs

@@ -224,7 +224,8 @@ export function publishAskTurn({ sessionId, opened, terminalResultPreview, askOp
   // Tag empty-synthesis BEFORE markSessionDone so the watchdog
   // (which inspects entry.emptyFinal first) classifies the
   // terminal state correctly even if it ticks during unwind.
-  const isEmptyFinal = !terminalResultPreview.content && !terminalResultPreview.reasoningContent;
+  const isEmptyFinal =
+    !terminalResultPreview.content && !terminalResultPreview.reasoningContent && !terminalResultPreview.reactionCompleted;
   if (isEmptyFinal) {
     markSessionEmptyFinal(sessionId);
   }

package/src/runtime/agent/orchestrator/session/manager/session-tool-surface.mjs

@@ -10,6 +10,9 @@ import { isAgentOwner } from '../../agent-owner.mjs';
 import { getHiddenAgent } from '../../internal-agents.mjs';
 import { workflowDisallowsAgentTool } from '../../runtime-core/workflow.mjs';
 import { isAgentModeSession } from '../agent-mode.mjs';
+import { agentIdOfHomeSession } from '../agent-home.mjs';
+import { roomMemberOfSession } from '../agent-room.mjs';
+import { REACTION_TOOL_NAME } from '../../runtime-core/reaction-tool-defs.mjs';
 import { finalizeSessionToolList, resolveSessionTools, permissionFromToolSpec } from './tool-resolution.mjs';
 import { unusedModelEditToolName } from '../../../../shared/edit-tool-dialect.mjs';
 import { getAgentRuntimeSync } from './agent-runtime-singleton.mjs';
@@ -24,6 +27,14 @@ export function delegationDisabled(source, ownerIsAgent) {
   );
 }
 
+// The react tool belongs to a bot's own chat with the user: its home chat
+// (`sess_home_<id>`) or its seat in a group room (`sess_rmem_…`), decided by the
+// session's id, never a coding session or a delegated worker.
+export function reactionDisabled(source, ownerIsAgent) {
+  const id = String(source?.id || '');
+  return ownerIsAgent || !(agentIdOfHomeSession(id) || roomMemberOfSession(id));
+}
+
 // Exactly two schema surfaces exist: Lead and Agent. Every Agent role gets
 // the full Lead-capable base bundle; the recursive `agent` control tool is
 // removed later at the owner boundary. Role permission remains prompt/
@@ -79,6 +90,7 @@ export function resolveSessionToolSurface(opts, { profile, toolPreset, modelName
   const sessionDeny = [
     ...(Array.isArray(opts.disallowedTools) ? opts.disallowedTools : []),
     ...(delegationDisabled(opts, ownerIsAgent) ? ['agent'] : []),
+    ...(reactionDisabled(opts, ownerIsAgent) ? [REACTION_TOOL_NAME] : []),
   ];
   // Role permission is prompt/diagnostic metadata only. Resolve and persist
   // it without shaping the provider-visible Agent schema.
@@ -144,6 +156,7 @@ export function _prepareResumeTools(session, preset) {
       disallowedTools: [
         ...(Array.isArray(session.disallowedTools) ? session.disallowedTools : []),
         ...(delegationDisabled(session, ownerIsAgent) ? ['agent'] : []),
+        ...(reactionDisabled(session, ownerIsAgent) ? [REACTION_TOOL_NAME] : []),
       ],
       ownerIsAgent,
     }),

package/src/runtime/agent/orchestrator/session/message-ids.mjs

@@ -26,7 +26,7 @@ export function messageIdOf(message) {
 }
 
 /** Whether `meta` can hold a transcript id (absent or a plain object). */
-export function canCarryMessageId(message) {
+function canCarryMessageId(message) {
   if (!message || typeof message !== 'object') return false;
   const meta = message.meta;
   return meta === undefined || meta === null || (typeof meta === 'object' && !Array.isArray(meta));
@@ -101,12 +101,14 @@ export function stampMessageIds(messages, { sessionId = '' } = {}) {
 
 /** JSON.stringify replacer that leaves stable ids out: hashes and archives
  *  the compactor derives from message JSON describe the conversation, not
- *  its display bookkeeping (a meta that only held the id is left out too). */
+ *  its display bookkeeping (a meta that only held the id is left out too).
+ *  Reactions on a message (message-reactions.mjs) are display bookkeeping of
+ *  the same kind, written in place mid-turn, and are left out with the id. */
 export function withoutMessageIdsReplacer(key, value) {
   if (key !== 'meta' || !value || typeof value !== 'object' || typeof value.transcript?.messageId !== 'string') {
     return value;
   }
-  const { messageId: _id, ...transcript } = value.transcript;
+  const { messageId: _id, reactions: _reactions, ...transcript } = value.transcript;
   const meta = { ...value };
   if (Object.keys(transcript).length) meta.transcript = transcript;
   else delete meta.transcript;