mixdog 1.3.4 → 1.4.0

package/src/runtime/agent/orchestrator/session/compaction-archive.mjs

@@ -194,38 +194,63 @@ async function archiveIndexFor(path, handle) {
   return entries;
 }
 
-/** One page of a session's archive sidecar (see pageFromSegments). The
- *  open handle pins the file a concurrent atomic replace may swap out, so
- *  the index and the segment reads describe the same bytes. */
-export async function readCompactionArchivePage(storeDir, sessionId, range = {}) {
+/** Runs `use(entries, load)` over a session's archive sidecar: its segment
+ *  index and a loader of one segment's items. The open handle pins the file
+ *  a concurrent atomic replace may swap out, so the index and the segment
+ *  reads describe the same bytes. `fallback` when the archive is absent or
+ *  unreadable (display-only history: it shows nothing then). */
+async function withArchive(storeDir, sessionId, fallback, use) {
   const path = compactionArchivePath(storeDir, sessionId);
-  if (!path) return { items: [], hasOlder: false };
+  if (!path) return fallback;
   let handle;
   try {
     handle = await open(path, 'r');
   } catch {
-    // Display-only history: an absent or unreadable archive shows nothing.
     archiveIndexes.delete(path);
-    return { items: [], hasOlder: false };
+    return fallback;
   }
   try {
     const entries = await archiveIndexFor(path, handle);
-    return await pageFromSegments(
-      entries,
-      async (entry) => {
-        const buffer = Buffer.alloc(entry.length);
-        await handle.read(buffer, 0, entry.length, entry.start);
-        return segmentItems(buffer.toString('utf8'));
-      },
-      range
-    );
+    return await use(entries, async (entry) => {
+      const buffer = Buffer.alloc(entry.length);
+      await handle.read(buffer, 0, entry.length, entry.start);
+      return segmentItems(buffer.toString('utf8'));
+    });
   } catch {
-    return { items: [], hasOlder: false };
+    return fallback;
   } finally {
     await handle.close().catch(() => {});
   }
 }
 
+/** One page of a session's archive sidecar (see pageFromSegments). */
+export function readCompactionArchivePage(storeDir, sessionId, range = {}) {
+  return withArchive(storeDir, sessionId, { items: [], hasOlder: false }, (entries, load) =>
+    pageFromSegments(entries, load, range)
+  );
+}
+
+/** Hands every visible segment of the archive (numbered in (after, before),
+ *  oldest first) to `visit` as its items, one segment at a time, so a whole
+ *  walk never holds more than one segment. True when the walk completed;
+ *  false when the archive was absent or unreadable (the visits made so far
+ *  are then incomplete). */
+export function visitCompactionArchive(
+  storeDir,
+  sessionId,
+  { after = 0, before = Number.POSITIVE_INFINITY } = {},
+  visit
+) {
+  return withArchive(storeDir, sessionId, false, async (entries, load) => {
+    for (const entry of entries) {
+      const { seq, count } = entry.head;
+      if (seq <= after || seq >= before || count < 1) continue;
+      visit(await load(entry));
+    }
+    return true;
+  });
+}
+
 // Delete fence: every deletion bumps the session's epoch. A writer captures
 // the epoch before it starts and publishes only if it is unchanged at the
 // (synchronous) rename, so a delete that lands while a segment is being

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -11,6 +11,7 @@ import { createEagerEntry, runEagerEntry } from './eager-dispatch/entry.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
 import { isParallelDispatchable } from './loop/tool-helpers.mjs';
 import { resolveExecutionToolCall } from './loop/tool-call-resolution.mjs';
+import { turnLimitsOf } from './loop/turn-limits.mjs';
 
 export function createEagerDispatcher({
   tools,
@@ -23,6 +24,7 @@ export function createEagerDispatcher({
   getIterations,
   getNextIteration,
   repeatFailLimit,
+  isTurnLimitNoticed = () => false,
   executeToolFn = executeTool,
 }) {
   const pending = new Map();
@@ -37,6 +39,9 @@ export function createEagerDispatcher({
     repeatFailLimit,
   });
   const barriers = createEagerBarriers({ cwd });
+  // A capped turn runs its calls in order, so none past its cap starts early
+  // (loop/turn-limits.mjs).
+  const capped = turnLimitsOf(opts) !== null;
   const execute = (call, entry) =>
     executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, {
       toolCallId: call.id,
@@ -52,6 +57,9 @@ export function createEagerDispatcher({
   const startEagerTool = (wireCall) => {
     // Streamed call_tool requests are admitted, ordered and executed as their
     // targets; a projection error is answered by the serial batch instead.
+    // Once the turn was told to reply (any limit), no call runs: the batch
+    // refuses them, so none may start while the wrap-up response streams.
+    if (capped || isTurnLimitNoticed()) return null;
     const call = resolveExecutionToolCall(wireCall, sessionRef);
     if (!call?.id || pending.has(call.id) || !isParallelDispatchable(call.name)) return null;
     const admitted = admission.admit(call);

package/src/runtime/agent/orchestrator/session/human-gate/gate.mjs

@@ -14,17 +14,22 @@
 // allowed, payments and permanent deletes denied. Group-room members register
 // a port here (session-runtime/held-requests.mjs) that turns their asks into
 // held requests when no approval card is attached.
+// The "Allow all actions" developer option (shared/developer-options.mjs)
+// skips every ask below, the bot's per-action `ask` mode and a hook `ask`
+// included, except a payment or permanent delete; a `block` and a hook `deny`
+// still deny.
 import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../agent-home.mjs';
 import { serverConnector } from '../../mcp/server-connectors.mjs';
 import { readAgentDefinitionKind } from '../../../../shared/agent-kind.mjs';
 import { isContactAgentId } from '../../../../shared/agent-route-config.mjs';
+import { developerOptionEnabledStrict } from '../../../../shared/developer-options.mjs';
 import { mixdogRoot, resolvePluginData } from '../../../../shared/plugin-paths.mjs';
 import { roomMemberOfSession } from '../agent-room.mjs';
 import { agentDisplayName } from '../../context/role-instructions.mjs';
 import { delegationOf } from './delegation.mjs';
 import { setUnattendedApprovalPort, unattendedApprovalPort } from './unattended-port.mjs';
-import { classifyAsDelete, classifyOutboundCall, isRememberableAction } from './outbound-policy.mjs';
-import { humanGateStore } from './store.mjs';
+import { classifyAsDelete, classifyOutboundCall, isAlwaysAskAction, isRememberableAction } from './outbound-policy.mjs';
+import { DEV_ALLOW_ALL_DECISION, humanGateStore } from './store.mjs';
 import {
   AUTOMATION_GRANT_REASON,
   RUN_FORBIDDEN_REASON,
@@ -33,7 +38,7 @@ import {
   savesAutomation,
 } from './run-policy.mjs';
 
-export const OUTBOUND_APPROVAL_REASON = 'This sends or posts outside Mixdog; it needs your approval.';
+const OUTBOUND_APPROVAL_REASON = 'This sends or posts outside Mixdog; it needs your approval.';
 export const BLOCKED_ACTION_REASON = "This agent's permission blocks this action.";
 /** Outbound grants may be remembered for this agent, never for every agent;
  *  payments and deletes never. */
@@ -93,7 +98,8 @@ const LEAD_NAME = 'Lead';
  *  bot-created task session, a bot's home chat or room member session) and
  *  the names from there down to the asker ("Lead › Reviewer", "사무관 ›
  *  Worker"). Only where the card shows: no bot identity, grant or remember
- *  scope follows from it. Null for a top-level session. */
+ *  scope follows from it. Null for a top-level session (whose requests show
+ *  in the chats handing it work instead: tui/session/tool-approval.mjs). */
 export function approvalSurface(sessionId) {
   const delegation = delegationOf(sessionId);
   if (delegation.state !== 'resolved') return null;
@@ -105,6 +111,22 @@ export function approvalSurface(sessionId) {
 
 const actionOf = (decision) => String(decision?.action || decision?.decision || '').toLowerCase();
 
+/** Whether the "Allow all actions" developer option is on (default off).
+ *  Fail-closed: an unreadable, missing or malformed config is off (the call
+ *  asks), and a value restored from a backup never counts. */
+export const allowAllActionsEnabled = () => developerOptionEnabledStrict('allowAllActions');
+
+/** Whether the option lets a call of this classification (or none) run without
+ *  a card: every ask, never a classified payment or permanent delete. */
+const skipsApproval = (classified) => !isAlwaysAskAction(classified?.category) && allowAllActionsEnabled();
+
+/** The hook decision once its card is skipped: an `ask` runs as an allow,
+ *  keeping any rewrite it carried. */
+function withoutAsk(decision) {
+  if (actionOf(decision) !== 'ask') return decision;
+  return { ...decision, action: decision.name || decision.args ? 'modify' : 'allow' };
+}
+
 async function mcpAnnotations(name, scopeId) {
   if (!String(name).startsWith('mcp__')) return undefined;
   try {
@@ -135,7 +157,13 @@ async function describeEmails(call, outbound, ctx) {
     const { executeMcpTool } = await import('../../mcp/client.mjs');
     const ids = outbound.category === 'trash' && Array.isArray(call.args?.ids) ? call.args.ids.map(String) : [];
     const shown = ids.slice(0, PREVIEW_MESSAGES);
-    const raw = await executeMcpTool(name, { ids: shown }, { scopeId: ctx.mcpScopeId });
+    // The account the call acts as (one server holds every Gmail account).
+    const chosen = typeof call.args?.account === 'string' ? call.args.account.trim() : '';
+    const raw = await executeMcpTool(
+      name,
+      { ids: shown, ...(chosen ? { account: chosen } : {}) },
+      { scopeId: ctx.mcpScopeId }
+    );
     const { account, emails } = JSON.parse(raw);
     const messages = (Array.isArray(emails) ? emails : []).map((mail) =>
       [mail.from, mail.subject, String(mail.date || '').slice(0, 10)].filter(Boolean).join(' · ')
@@ -185,11 +213,17 @@ export async function humanGateDecision(call, decision, ctx = {}) {
   const outbound = classified && actingBotId(ctx.sessionId) ? classified : null;
   if (!outbound) {
     if (action !== 'ask') return { decision, request: null, gate: null };
+    const gate = { agentId, kind: 'approval', tool: String(call?.name || ''), target: '' };
+    if (skipsApproval(classified)) {
+      const store = ctx.store || (await humanGateStore());
+      await store.recordAudit({ ...gate, decision: DEV_ALLOW_ALL_DECISION, device: '' });
+      return { decision: withoutAsk(decision), request: null, gate: null };
+    }
     return {
       // Saving a schedule or webhook says plainly what the approval grants.
       decision: savesAutomation(call) ? { ...decision, reason: AUTOMATION_GRANT_REASON } : decision,
       request: { kind: 'approval', agentId, remember: ['once'] },
-      gate: { agentId, kind: 'approval', tool: String(call?.name || ''), target: '' },
+      gate,
     };
   }
   const gate = { agentId, kind: 'outbound', action: outbound.category, tool: outbound.tool, target: outbound.target };
@@ -204,10 +238,9 @@ export async function humanGateDecision(call, decision, ctx = {}) {
       editable: outbound.editable,
       details: outbound.details,
     },
-    remember: ['once'],
+    // "Don't ask again" is the bot's permission.
+    remember: outboundRemember(outbound.category),
   };
-  // "Don't ask again" is the bot's permission.
-  request.remember = outboundRemember(outbound.category);
   const store = ctx.store || (await humanGateStore());
   const mode = await store.modeFor({ agentId, action: outbound.category });
   const base = decision && typeof decision === 'object' ? decision : {};
@@ -215,6 +248,11 @@ export async function humanGateDecision(call, decision, ctx = {}) {
     await store.recordAudit({ ...gate, decision: 'blocked', device: '' });
     return { decision: { ...base, action: 'deny', reason: BLOCKED_ACTION_REASON }, request: null, gate: null };
   }
+  // The bot's `ask` mode (and a hook's `ask`) is bypassed; a payment or delete is not.
+  if (skipsApproval(outbound)) {
+    await store.recordAudit({ ...gate, decision: DEV_ALLOW_ALL_DECISION, device: '' });
+    return { decision: withoutAsk(decision), request: null, gate: null };
+  }
   if (action !== 'ask' && mode === 'allow') {
     await store.recordAudit({ ...gate, decision: 'remembered', device: '' });
     // The remembered grant answers this call: no later layer asks it again.

package/src/runtime/agent/orchestrator/session/human-gate/outbound-policy.mjs

@@ -39,6 +39,12 @@ export function isRememberableAction(kind) {
   return ACTION_KINDS.includes(kind) && !UNREMEMBERED_ACTIONS.has(kind);
 }
 
+/** Whether `kind` is a payment or permanent delete: it asks every time,
+ *  whatever else is allowed (also by the "Allow all actions" developer option). */
+export function isAlwaysAskAction(kind) {
+  return UNREMEMBERED_ACTIONS.has(kind);
+}
+
 const GITHUB_OUTBOUND = new Map([
   ['issue.comment', 'comment'],
   ['pr.comment', 'comment'],
@@ -68,8 +74,6 @@ const MCP_OUTBOUND = new Map([
     'slack_post_message',
     'slack_reply_to_thread',
     'chat_post_message',
-    'discord_send_message',
-    'telegram_send_message',
   ].map((name) => [name, 'message']),
   ...['create_post', 'publish_post', 'create_tweet', 'post_tweet', 'send_tweet'].map((name) => [name, 'publish']),
   ['submit_form', 'form'],

package/src/runtime/agent/orchestrator/session/human-gate/requests.mjs

@@ -12,10 +12,23 @@
 // the scopes it allows and can leave out `always`. Nothing here ever carries a
 // secret value: a decision that names one is stripped to its verdict.
 
-export const HUMAN_REQUEST_KINDS = Object.freeze(['approval', 'outbound', 'secret', 'takeover', 'permission']);
-export const HUMAN_RESPONSES = Object.freeze(['approve', 'deny', 'edit-and-approve', 'provide-secret', 'skip', 'done']);
-export const REMEMBER_SCOPES = Object.freeze(['once', 'agent', 'always']);
+const HUMAN_REQUEST_KINDS = Object.freeze(['approval', 'outbound', 'secret', 'takeover', 'permission']);
+const HUMAN_RESPONSES = Object.freeze(['approve', 'deny', 'edit-and-approve', 'provide-secret', 'skip', 'done']);
+const REMEMBER_SCOPES = Object.freeze(['once', 'agent', 'always']);
 export const SECRET_REQUEST_TIMEOUT_MS = 120_000;
+/** What a secret's bound field is: a sign-in form (아이디 + 비밀번호), a lone
+ *  password, a new password, or a one-time code; '' when unknown (computer). */
+export const SECRET_FORMS = Object.freeze(['login', 'password', 'new-password', 'otp']);
+/** Every result a secret handoff (and a declined or expired takeover) gives
+ *  the agent: facts, never a verdict about the site. */
+export const HANDOFF_OUTCOMES = Object.freeze([
+  'entered',
+  'user_skipped',
+  'no_field',
+  'page_changed',
+  'blocked',
+  'expired',
+]);
 
 const RESPONSES_BY_KIND = Object.freeze({
   approval: ['approve', 'deny'],
@@ -49,7 +62,7 @@ const text = (value, limit = TEXT_LIMIT) => (typeof value === 'string' ? value.t
 
 /** The human kind of a request; anything else (ask_user's 'question', a
  *  hook's bare ask) is an ordinary approval for responses. */
-export function humanRequestKind(request) {
+function humanRequestKind(request) {
   return HUMAN_REQUEST_KINDS.includes(request?.kind) ? request.kind : 'approval';
 }
 
@@ -103,11 +116,21 @@ export function humanRequestFields(input = {}) {
   }
   if (kind === 'secret') {
     const secret = isRecord(input.secret) ? input.secret : {};
+    // The bound page's origin and what its field is (the desktop read it at
+    // request time, ask-user-tool.mjs): the card's title and inputs; no value.
+    const origin = loginPageUrl(secret.origin)?.origin || '';
+    const form = SECRET_FORMS.includes(secret.form) ? secret.form : '';
+    // A code's length is the bound field's own (credential-autofill.ts
+    // codeLength); absent, it stays unspecified.
+    const length = Number.isInteger(secret.length) && secret.length > 0 ? secret.length : 0;
     fields.secret = {
       requestId: text(secret.requestId),
       surface: secret.surface === 'computer' ? 'computer' : 'browser',
       target: text(secret.target),
       field: text(secret.field),
+      ...(origin ? { origin } : {}),
+      ...(form ? { form } : {}),
+      ...(form === 'otp' && length ? { length } : {}),
     };
     fields.args = { surface: fields.secret.surface, target: fields.secret.target, field: fields.secret.field };
     fields.remember = ['once'];
@@ -132,12 +155,21 @@ export function humanRequestFields(input = {}) {
     // A login takeover (purpose 'login') opens the desktop's sign-in window on
     // its validated page instead of handing over the side panel.
     const login = surface === 'browser' && takeover.purpose === 'login' ? loginPageUrl(takeover.url) : null;
+    // The saved logins of the sign-in page's origin: opaque ids and masked
+    // labels only (profile-import.ts credentialSuggestions), never a password.
+    const accounts = (login && Array.isArray(takeover.accounts) ? takeover.accounts : [])
+      .filter((account) => isRecord(account) && token(account.id, 128) && text(account.label, 120))
+      .map((account) => ({ id: token(account.id, 128), label: text(account.label, 120) }));
+    // The page those logins may be filled into, bound by the desktop at
+    // request time (ask-user-tool.mjs fillId): without it none is offered.
+    const fillId = /^secret_[A-Za-z0-9-]{8,80}$/.test(text(takeover.fillId, 100)) ? text(takeover.fillId, 100) : '';
     fields.takeover = {
       surface,
       instructions: text(takeover.instructions, 2_000),
       ...(text(takeover.target) ? { target: text(takeover.target) } : {}),
       ...identity,
       ...(login ? { purpose: 'login', url: login.url, origin: login.origin } : {}),
+      ...(accounts.length && fillId ? { accounts, fillId } : {}),
     };
     fields.remember = ['once'];
   }

package/src/runtime/agent/orchestrator/session/human-gate/store.mjs

@@ -173,12 +173,24 @@ export async function setAgentPermission(agentId, action, mode, options) {
   return store.permissions(agent);
 }
 
-const BROWSER_AUDIT_DECISIONS = Object.freeze(['approve', 'deny', 'granted', 'remembered', 'run-allowed', 'blocked']);
+/** The audit decision of a call the "Allow all actions" developer option let through unasked. */
+export const DEV_ALLOW_ALL_DECISION = 'dev-allow-all';
+
+const BROWSER_AUDIT_DECISIONS = Object.freeze([
+  'approve',
+  'deny',
+  'granted',
+  'remembered',
+  'run-allowed',
+  'blocked',
+  DEV_ALLOW_ALL_DECISION,
+]);
 
 /** Audit one Browser Use approval of a bot (capability recordAgentApprovalAudit):
  *  the bot, the action kind and what happened — `approve` / `deny` for the card,
  *  `granted` when "always allow" was saved, `remembered` when a saved allow let
- *  a step run unasked. Never a page address, target or value. */
+ *  a step run unasked, `dev-allow-all` when the developer option did. Never a
+ *  page address, target or value. */
 export async function recordAgentApprovalAudit(agentId, action, decision) {
   const agent = requiredAgentId(agentId);
   if (!ACTION_KINDS.includes(action)) throw new Error(`action must be one of ${ACTION_KINDS.join(', ')}`);

package/src/runtime/agent/orchestrator/session/loop/assistant-commit.mjs

@@ -62,6 +62,12 @@ function assistantEchoFields(payloads) {
   };
 }
 
+// The tail reminder the response was generated under (send-with-recovery.mjs),
+// kept verbatim so a turn-scoped provider replays it byte-identically.
+export function turnReminderField(resp) {
+  return typeof resp?.turnReminder === 'string' && resp.turnReminder ? { turnReminder: resp.turnReminder } : {};
+}
+
 // Intermediate (non-tool) assistant turn: max-output partials, refusal
 // narration, provider continuations, and the terminal turn committed before a
 // steering drain. Returns null when the turn carries nothing committable — a
@@ -89,6 +95,7 @@ export function buildIntermediateAssistantMessage(resp, opts) {
       role: 'assistant',
       content,
       ...assistantEchoFields(payloads),
+      ...turnReminderField(resp),
       ...(stopReason ? { stopReason } : {}),
       ...(terminationReason ? { terminationReason } : {}),
     },
@@ -108,6 +115,7 @@ export function buildToolCallAssistantMessage(response, { calls, opts }) {
       content: response.content || '',
       toolCalls: compactToolCallsForHistory(calls, { deferBodies: true }),
       ...assistantEchoFields(assistantEchoPayloads(response, { keepAssistantBlocks: true })),
+      ...turnReminderField(response),
     },
     opts
   );

package/src/runtime/agent/orchestrator/session/loop/compact-policy.mjs

@@ -21,6 +21,7 @@ import { isAgentModeSession } from '../agent-mode.mjs';
 import { providerInputExcludesCache, providerNativePdf } from '../../providers/registry.mjs';
 import { contentMediaBytes, contentMediaCount } from '../../providers/media-normalization.mjs';
 import { splitProtectedContext } from '../compact/messages.mjs';
+import { withLiveCompactionConfig } from '../../runtime-core/compaction-config-keys.mjs';
 
 // Unified context-share rule (compact/constants.mjs CONTEXT_SHARE_RATIO): the
 // post-compaction target is 25% of the boundary/context window. One
@@ -394,13 +395,6 @@ export function invalidateProviderContextBaseline(sessionRef) {
   delete sessionRef.contextPressureUnanchoredReason;
 }
 
-// A baseline is refreshed on every provider_send/turn-end. When the transcript
-// has grown but no fresh recording landed for this long, recording is failing
-// (zero/absent usage keeps the OLD baseline because record() only returns
-// false) — distrust it and fall back to the estimate. An idle session whose
-// transcript did NOT grow keeps its baseline regardless of age.
-const BASELINE_MAX_STALE_GROWTH_MS = 30 * 60 * 1000;
-
 /**
  * Does this anchor still describe this message prefix?
  *
@@ -480,17 +474,19 @@ function providerBaselinePressureTokens(messages, sessionRef, policy, { includeC
         ? Math.max(0, tokens - Math.round(storedRequestReserve) + currentRequestReserve)
         : tokens + currentRequestReserve;
   }
-  // Staleness means a baseline that stopped being refreshed WHILE the session
-  // kept working — never age on the wall clock. Measured against `now`, this
-  // discarded the reading of every session that simply sat unopened for a
-  // while (88 of 983 stored sessions), and the whole-transcript estimate that
-  // replaced it was the less accurate number in both directions: 1.12x over
-  // on the median, 0.82x under on a session already past its window.
-  // Comparing against the session's own last activity keeps the rule aimed at
-  // its actual target — a live session whose usage recording is failing while
-  // its transcript grows — and leaves a session at rest on its measurement.
-  const activityAt = Math.max(Number(sessionRef.updatedAt) || 0, Number(sessionRef.lastContextTokensUpdatedAt) || 0);
-  if (messages.length > count && baselineAt > 0 && activityAt - baselineAt > BASELINE_MAX_STALE_GROWTH_MS) return null;
+  // Staleness means usage recording is failing: a provider request completed
+  // AFTER this reading without replacing it (every send records its usage
+  // after it starts, so a working recorder always leaves the reading newer
+  // than the last send) — zero/absent usage keeps the OLD baseline because
+  // record() only returns false. Never age on a clock: measured against `now`
+  // it discarded the reading of every session that sat unopened for a while
+  // (88 of 983 stored sessions), and measured against the session's last
+  // activity it discarded it whenever anything was appended more than half an
+  // hour after the last request — a user back from a break, an agent's result
+  // posted to a waiting Lead — so the next send compacted on the
+  // whole-transcript estimate, far above the provider's own count.
+  const lastSendAt = Number(sessionRef.lastProviderSendAt) || 0;
+  if (messages.length > count && baselineAt > 0 && lastSendAt > baselineAt) return null;
   try {
     // Baseline tokens are authoritative provider billing; only the growth
     // after the baseline is a local estimate and needs billing calibration.
@@ -795,9 +791,9 @@ function compactionTelemetryRecord(sessionRef, policy, meta, prev) {
     if (terminalSuccess) return null;
     return present ? (next ?? null) : (previous ?? null);
   };
-  return {
-    ...prev,
-    auto: policy.auto !== false,
+  // Config-owned fields stay the live ones (withLiveCompactionConfig): `policy`
+  // was resolved before a compaction that a reload may have outlived.
+  return withLiveCompactionConfig(prev, {
     requestReserveTokens: policy.requestReserveTokens || 0,
     reserveTokens: policy.reserveTokens || 0,
     boundaryTokens: policy.boundaryTokens || null,
@@ -848,7 +844,7 @@ function compactionTelemetryRecord(sessionRef, policy, meta, prev) {
     compactCount: (prev.compactCount || 0) + (changed ? 1 : 0),
     singleShotConsumed:
       policy.singleShot === true && meta.stage === 'compacting' ? true : prev.singleShotConsumed === true,
-  };
+  });
 }
 
 // Postmortem ring buffer: the per-check telemetry record is overwritten on

package/src/runtime/agent/orchestrator/session/loop/fresh-context.mjs

@@ -18,6 +18,9 @@ import { summarizeOnSharedPrefix } from '../compact/forked-summary.mjs';
 import { normalizeCompactionSummaryMode } from '../compact/summary-mode.mjs';
 import { compactionCacheWarm, lighterSubscriptionModel } from '../compact/summary-route.mjs';
 import { retireCompactionFork } from '../side-question-store.mjs';
+import { buildSkillToolEnvelope, collectSkillsCached, currentSkillDelivery } from '../../context/collect.mjs';
+import { loadSkillToolDependencies } from '../../runtime-core/skill-tool-loading.mjs';
+import { parseNativeToolSearchPayload } from './tool-helpers.mjs';
 
 // Conversation summarization triggers independently of the post-compact target:
 // at 5% of the window, capped so a large window does not carry tens of
@@ -262,11 +265,37 @@ function freshContextBudget({ compactPolicy, sessionRef, provider, compactBudget
   return { contextWindow, hardBudget, conversationInput, conversationTokens, conversationThresholdTokens };
 }
 
+// Compact restores each active skill from its current source, as the Skill
+// tool would deliver it in this session now (null: it no longer loads). The
+// real pass also re-arms the skill's current tool dependencies on the session
+// surface and answers the native tool-search payload they produce (or, with
+// none, the Skill result summary); a preview never touches the surface and
+// keeps the transcript's loader pairs.
+function currentSkillResolver(sessionRef, { preview = false } = {}) {
+  const cwd = sessionRef?.cwd || null;
+  const config = loadConfig({ secrets: false });
+  const skills = collectSkillsCached(cwd);
+  return (name) => {
+    const delivery = currentSkillDelivery(name, cwd, config, skills);
+    if (!delivery) return null;
+    if (preview) return { body: delivery.body, native: undefined };
+    const { resource } = delivery;
+    const envelope = loadSkillToolDependencies(
+      buildSkillToolEnvelope(name, resource.content, resource.dir, resource),
+      sessionRef
+    );
+    const native = parseNativeToolSearchPayload('Skill', envelope.result);
+    return { body: delivery.body, native, summary: native?.summary ?? envelope.result };
+  };
+}
+
 function freshContextBuildOptions(
-  { compactPolicy = {}, sessionId, goalReminderText, activeTurn, referenceLatestAttachments },
+  { sessionRef, compactPolicy = {}, sessionId, goalReminderText, activeTurn, referenceLatestAttachments, preview },
   budget
 ) {
   return {
+    // A sessionless call (no session gates to apply) keeps the transcript copies.
+    currentSkill: sessionRef ? currentSkillResolver(sessionRef, { preview }) : null,
     reserveTokens: compactPolicy.reserveTokens,
     maxBudgetTokens: budget.hardBudget,
     force: true,
@@ -287,7 +316,7 @@ export function previewFreshContextCompaction(input) {
   const budget = freshContextBudget(input);
   const summaryTriggered = budget.conversationTokens >= budget.conversationThresholdTokens;
   const result = freshContextCompactMessages(input.messages, input.compactBudgetTokens, {
-    ...freshContextBuildOptions(input, budget),
+    ...freshContextBuildOptions({ ...input, preview: true }, budget),
     preview: true,
     previewSummary: summaryTriggered,
   });
@@ -346,7 +375,7 @@ export async function runFreshContextCompact({
   });
   const summaryTriggered = conversationTokens >= conversationThresholdTokens;
   const buildOptions = freshContextBuildOptions(
-    { compactPolicy, sessionId, goalReminderText, activeTurn, referenceLatestAttachments },
+    { sessionRef, compactPolicy, sessionId, goalReminderText, activeTurn, referenceLatestAttachments },
     { contextWindow, hardBudget }
   );
   const build = (handoffText) =>

package/src/runtime/agent/orchestrator/session/loop/loop-state.mjs

@@ -55,6 +55,9 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     cwd: resolveLiveToolCwd(cwd, sessionRef),
     iterations: 0,
     toolCallsTotal: 0,
+    // A capped turn (turn-limits.mjs): told to reply, and ended by calling tools anyway.
+    turnLimitNoticed: false,
+    turnLimitEnded: false,
     lastUsage: undefined,
     firstTurnUsage: undefined,
     response: undefined,
@@ -117,7 +120,9 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     messages.push(message);
     try {
       opts.onToolResult?.(message);
-    } catch {}
+    } catch {
+      // the tool-result observer is advisory
+    }
   };
   state.drainSteering = createSteeringDrain({
     messages,
@@ -147,6 +152,9 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
  *  promote an empty/abnormal finish to an explicit Lead-facing error). */
 export function finishLoop(state) {
   const { response } = state;
+  // A reaction-only turn is a successful completion, never an empty finish.
+  const terminationReason = classifyTerminationReason(response, { sessionAgent: state.sessionAgent });
+  const reactionCompleted = terminationReason === 'empty' && state.noToolTurn.reactionCompleted;
   return {
     ...response,
     usage: state.lastUsage || response.usage,
@@ -157,7 +165,8 @@ export function finishLoop(state) {
     toolCallsTotal: state.toolCallsTotal,
     providerState: state.providerState,
     providerStateUpdated: state.providerStateUpdated,
-    terminationReason: classifyTerminationReason(response, { sessionAgent: state.sessionAgent }),
+    terminationReason: reactionCompleted ? undefined : terminationReason,
+    ...(reactionCompleted ? { reactionCompleted: true } : {}),
     providerContinuations: state.noToolTurn.providerContinuations,
     ...(state.routeUsageHops?.length
       ? {

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn/segments.mjs

@@ -20,8 +20,11 @@ export function createTurnSegments({ messages, opts }) {
     // Record a mid-turn segment for the caller-facing aggregate and surface it
     // live for every session.
     // `committed: true` marks text that is the just-committed message's own.
+    // A committed message is whole, so the text after it is another message
+    // and a break keeps the aggregate from running the two together; a part
+    // that was cut off (max-output recovery) resumes right where it stopped.
     record(text, { committed = false } = {}) {
-      parts.push(text);
+      parts.push(committed ? `${text.trimEnd()}\n\n` : text);
       try {
         opts.onAssistantText?.(text, { committed });
       } catch {