mixdog 1.3.4 → 1.4.0

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn.mjs

@@ -18,6 +18,9 @@ import { resetOutputLimitRecovery, resolveOutputLimit } from './no-tool-turn/out
 import { resolveRefusal } from './no-tool-turn/refusal.mjs';
 import { resumeContinuation } from './no-tool-turn/continuation.mjs';
 import { nudgeEmptyTurn } from './no-tool-turn/empty-nudge.mjs';
+import { isReactionSuccess, reactionCallIds, takeReactionTarget } from '../../runtime-core/reaction-tool-defs.mjs';
+import { messageIdOf } from '../message-ids.mjs';
+import { isReactableMessage } from '../message-reactions.mjs';
 
 // `escalateMaxTokens()` asks the live provider for a higher one-shot max_tokens
 // (number) or reports none (null/undefined) — the loop stays provider-agnostic.
@@ -37,8 +40,11 @@ export function createNoToolTurnResolver({
     outputEscalationUsed: false,
     refusalRetryUsed: false,
     emptyNudgeStreak: 0,
+    // Successful reactions (react tool): the input each was left against and
+    // whether it answered that input.
+    reactions: [],
     // Structured provider continuation signals honored this turn. Diagnostic
-    // only: the loop has no iteration cap, so this count bounds nothing. A
+    // only: this count bounds nothing. A
     // text-only continuation runaway is bounded by continuationsSinceToolBatch
     // below; continuations interleaved with tool batches are not limited.
     providerContinuationCount: 0,
@@ -46,6 +52,39 @@ export function createNoToolTurnResolver({
     // continuation runaway (see PROVIDER_CONTINUATION_NO_TOOL_LIMIT).
     continuationsSinceToolBatch: 0,
   };
+  // The stable id (message-ids.mjs, kept across compaction) of the newest
+  // real user input; runtime reminders and notices are not reactable.
+  // A group-room member turn's prompt is a runtime message (not reactable)
+  // that carries the newest room-log user row it shows (`roomRow`).
+  const roomRowOf = (message) => message?.meta?.transcript?.roomRow || '';
+  const latestInput = () => messages.findLast((message) => isReactableMessage(message) || roomRowOf(message));
+  const latestInputId = () => messageIdOf(latestInput());
+  // A reaction exempts the input only while no newer input arrived since it
+  // landed (same latest input id) and it answered that input.
+  const reactionAnswersLatest = () => {
+    const id = latestInputId();
+    return state.reactions.some((reaction) => reaction.answered && reaction.inputId === id);
+  };
+  // What this batch's react calls hit, from the id the react tool recorded
+  // for each (never rebuilt from this transcript: a room reaction runs
+  // against the room's own log). Every record is consumed; a success that
+  // recorded none exempts nothing. A home-chat reaction answers the input
+  // only when it hit that very message; a room reaction, whose message is in
+  // another log, only when it hit the row this turn's prompt showed.
+  const batchReactions = (calls, results) => {
+    const input = latestInput();
+    const inputId = messageIdOf(input);
+    const hit = [];
+    for (const id of reactionCallIds(calls)) {
+      const target = takeReactionTarget(sessionId, id);
+      if (!target || !results.some((message) => isReactionSuccess(message, new Set([id])))) continue;
+      const answered = target.room
+        ? roomRowOf(input) === target.messageId
+        : inputId !== '' && target.messageId === inputId;
+      hit.push({ inputId, answered });
+    }
+    return hit;
+  };
   const trace = (iteration, kind, payload) => {
     try {
       appendAgentTrace({ sessionId, iteration, kind, payload, agent: sessionAgent || null });
@@ -101,7 +140,9 @@ export function createNoToolTurnResolver({
       // output, …) and a text-only terminal turn is the correct shape —
       // nudging them produces a contradictory user message that traps the
       // model in a tool-call-blocked vs contract-required oscillation.
-      if (!hasContent && !HIDDEN_AGENT_NAMES.has(sessionAgent)) {
+      // A turn that left a reaction on the user's message may end with no
+      // text: the reaction is its answer (react tool), never an empty turn.
+      if (!hasContent && !HIDDEN_AGENT_NAMES.has(sessionAgent) && !reactionAnswersLatest()) {
         return nudgeEmptyTurn(
           response,
           { stopReason, isIncompleteStop: stopReason && INCOMPLETE_STOP_REASONS.has(stopReason) },
@@ -132,9 +173,16 @@ export function createNoToolTurnResolver({
       state.emptyNudgeStreak = 0;
       resetOutputLimitRecovery(state);
     },
-    noteToolBatchCompleted() {
+    // `results` are the batch's tool result messages: only a react call that
+    // succeeded marks the turn as having reacted.
+    noteToolBatchCompleted(calls = [], results = []) {
       state.continuationsSinceToolBatch = 0;
       segments.clear();
+      state.reactions.push(...batchReactions(calls, results));
+    },
+    // The loop ended on a reaction that answered the latest user input.
+    get reactionCompleted() {
+      return reactionAnswersLatest();
     },
     get providerContinuations() {
       return state.providerContinuationCount;

package/src/runtime/agent/orchestrator/session/loop/route-fallback.mjs

@@ -6,6 +6,12 @@ import { getProvider, initProviders } from '../../providers/registry.mjs';
 import { loadConfig } from '../../config.mjs';
 import { ensureProviderEnabled } from '../../runtime-core/config-helpers.mjs';
 import { updateSessionRoute } from '../manager/session-lifecycle.mjs';
+import {
+  liveRouteFallbacks,
+  nextRouteFallbackIndex,
+  routeFallbackHopped,
+  routeLeaf,
+} from '../manager/route-fallback-chain.mjs';
 import { pinSessionWireRoute } from '../../providers/wire-route.mjs';
 import { buildRequestSendOptions } from '../manager/ask-turn-loop-options.mjs';
 import { prepareTurnEffortConfiguration } from '../../providers/effort-configuration.mjs';
@@ -78,9 +84,13 @@ async function nextContextGrows(state, next) {
 
 export async function advanceAgentRoute(state, error) {
   const session = state.sessionRef;
-  if (!session?.agent || !session.routeFallbacks?.length) return false;
-  const index = session.routeFallbackIndex || 0;
-  const next = session.routeFallbacks[index];
+  if (!session?.agent) return false;
+  // Read from the session's settings at this hop: a chain edited while it runs
+  // applies now, and one cleared to [] leaves the provider's own error.
+  const { chain } = liveRouteFallbacks(session, loadConfig({ secrets: false }));
+  if (!chain.length) return false;
+  const index = nextRouteFallbackIndex(session, chain);
+  const next = chain[index];
   // Only THIS request must have produced nothing (its stream outcome says so):
   // earlier requests of the turn may have run tools. Their calls and results
   // are already in the live turn, which the next model continues from, so no
@@ -97,6 +107,8 @@ export async function advanceAgentRoute(state, error) {
   const provider = getProvider(next.provider);
   if (!provider) throw new Error(`Provider "${next.provider}" not available`);
   const failed = routeFailure(session, error);
+  // The route a reset returns to (setup reset_route_fallback), kept from the first hop.
+  const primary = routeFallbackHopped(session) ? session.routeFallbackPrimary : routeLeaf(session);
   // The left model's share of the turn ends here: the running total at the
   // switch bounds it, so each model's tokens are booked at its own rates.
   state.routeUsageHops = [
@@ -131,6 +143,8 @@ export async function advanceAgentRoute(state, error) {
     { crossProvider: true, session }
   );
   if (!updated) throw new Error('agent session closed during model fallback');
+  updated.routeFallbacks = chain;
+  if (primary) updated.routeFallbackPrimary = primary;
   updated.routeFallbackIndex = index + 1;
   updated.routeFallbackFailures = [...(session.routeFallbackFailures || []), failed];
   await pinSessionWireRoute(updated, provider);

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -96,6 +96,9 @@ export async function beginIteration(state) {
   opts.providerState = state.providerState;
   if (state.forcedFirstTool && state.toolCallsTotal === 0) {
     opts.toolChoice = 'required';
+  } else if (state.turnLimitNoticed) {
+    // A capped turn told to reply may only answer (turn-limits.mjs).
+    opts.toolChoice = 'none';
   } else {
     delete opts.toolChoice;
   }
@@ -123,13 +126,16 @@ export async function beginIteration(state) {
     getIterations: () => state.iterations,
     getNextIteration: () => nextIteration,
     repeatFailLimit: REPEAT_FAIL_LIMIT,
+    isTurnLimitNoticed: () => state.turnLimitNoticed === true,
   });
   const resolveToolCallId = createToolCallIdResolver(messages);
   opts.onToolCall = (call) => {
     resolveToolCallId(call);
     try {
       opts.onAssistantToolCallObserved?.(call, { eagerStarted: false });
-    } catch {}
+    } catch {
+      // the tool-call observer is advisory
+    }
     return eager.onToolCall(call);
   };
   return {
@@ -170,7 +176,9 @@ export async function sendProviderRequest(state, round) {
   });
   try {
     opts.onProviderSendStarted?.();
-  } catch {}
+  } catch {
+    // the send-started observer is advisory
+  }
   // The request a /btw side question forks: kept while it is in flight, with
   // its reply once it proceeds, and dropped again if it fails.
   const sideQuestion = captureSideQuestionRequest({

package/src/runtime/agent/orchestrator/session/loop/tool-exec/after-hook.mjs

@@ -4,6 +4,7 @@
  */
 import { normalizeToolEnvelope, makeToolEnvelope } from '../../tool-envelope.mjs';
 import { resolveToolResultAfterHook } from '../tool-helpers.mjs';
+import { effectiveToolCwd } from '../../../tools/builtin/bash-tool/shell-cwd.mjs';
 
 export async function applyAfterToolHook(result, afterToolHook, { name, args, cwd, callerSessionId, toolCallId }) {
   if (typeof afterToolHook !== 'function') return result;
@@ -15,7 +16,7 @@ export async function applyAfterToolHook(result, afterToolHook, { name, args, cw
     const hookResult = await afterToolHook({
       name,
       args,
-      cwd,
+      cwd: effectiveToolCwd(name, args, cwd),
       sessionId: callerSessionId,
       toolCallId,
       result: visible,

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -7,8 +7,15 @@ import { runAbortable, throwIfAborted } from '../../../../../shared/abort-race.m
 import { evaluateExecPolicy } from '../../../tools/bash-policy-scan.mjs';
 import { beginSessionApprovalWait } from '../../manager/runtime-liveness.mjs';
 import { agentMcpToolPermission, writeAgentMcpToolPermission } from '../../../mcp/agent-connectors.mjs';
-import { actingBotId, actingContactBotId, humanGateDecision, recordHumanDecision } from '../../human-gate/gate.mjs';
+import {
+  actingBotId,
+  actingContactBotId,
+  allowAllActionsEnabled,
+  humanGateDecision,
+  recordHumanDecision,
+} from '../../human-gate/gate.mjs';
 import { applyEditedArgs } from '../../human-gate/requests.mjs';
+import { effectiveToolCwd } from '../../../tools/builtin/bash-tool/shell-cwd.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
@@ -25,7 +32,7 @@ async function askApproval(
       resolvePreToolAskApproval({
         toolName: call.name,
         args: call.args,
-        cwd: call.cwd,
+        cwd: effectiveToolCwd(call.name, call.args, call.cwd),
         sessionId: callerSessionId,
         toolCallId: executeOpts.toolCallId || null,
         askReason,
@@ -62,13 +69,16 @@ export const CONNECTOR_APPROVAL_REASON = 'This connector tool is set to ask befo
  * coding Lead, a task session, a workflow agent, a sub-agent) runs it unasked.
  * Run after the hooks, on the final call: a renamed call is judged under its
  * final name. A call the outbound gate owns (its card approved it, or a
- * remembered outbound grant answered it) is not asked a second time.
+ * remembered outbound grant answered it) is not asked a second time. With the
+ * "Allow all actions" developer option on, `needs_approval` is not asked
+ * either (a payment or permanent delete was asked by the outbound gate above).
  * @returns {Promise<{ denial: string } | null>} the denial, or null to run
  */
 export function applyConnectorApproval(call, { agentId, callerSessionId, executeOpts, toolApprovalHook }) {
   if (call.outboundApproved) return null;
   if (!actingBotId(callerSessionId)) return null;
   if (agentMcpToolPermission(agentId, call.name) !== 'needs_approval') return null;
+  if (allowAllActionsEnabled()) return null;
   // "Always allow" is offered only to the contact bot that is acting, for its
   // own policy entry for this one tool: never another bot or Mixy.
   const botId = actingContactBotId(callerSessionId);
@@ -131,7 +141,7 @@ export async function applyBeforeToolHook({
             {
               name,
               args,
-              cwd,
+              cwd: effectiveToolCwd(name, args, cwd),
               sessionId: callerSessionId,
               toolCallId: executeOpts.toolCallId || null,
             },

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -3,7 +3,14 @@
  * MCP, code graph, internal tools, shell, apply_patch, built-ins and foreign
  * CLI adapters.
  */
-import { executeMcpTool, isMcpTool, isRegisteredMcpTool, mcpToolHasField } from '../../../mcp/client.mjs';
+import {
+  executeMcpTool,
+  isBuiltinMailRead,
+  isMcpTool,
+  isRegisteredMcpTool,
+  mcpToolHasField,
+} from '../../../mcp/client.mjs';
+import { recordMailLinks } from '../../../../../browser-bridge/mail-links.mjs';
 import {
   executeBuiltinTool,
   formatUnknownBuiltinToolMessage,
@@ -56,11 +63,18 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
   // an unknown argument.
   const needsCwdInjection = cwd && mcpToolHasField(name, 'cwd', mcpScopeId) && (args == null || args.cwd == null);
   const finalArgs = needsCwdInjection ? { ...(args || {}), cwd } : args;
-  return executeMcpTool(name, finalArgs, {
+  const call = executeMcpTool(name, finalArgs, {
     signal: executeOpts.signal || null,
     ownerKey: callerSessionId,
     scopeId: mcpScopeId,
   });
+  if (!isBuiltinMailRead(name, mcpScopeId)) return call;
+  // The runtime's own record of the links in a mail it read for this session:
+  // the only way Browser Use may open a link carrying a token.
+  return call.then((result) => {
+    recordMailLinks(callerSessionId, result);
+    return result;
+  });
 }
 
 function dispatchInternal(

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -19,6 +19,7 @@ import { applyBeforeToolHook, applyConnectorApproval, applyShellElevationGate }
 import { dispatchToolCall } from './tool-exec/dispatch.mjs';
 import { applyAfterToolHook } from './tool-exec/after-hook.mjs';
 import { runReadOnlyIoWithDeadline } from './tool-exec/read-only-deadline.mjs';
+import { guardShellCall, requestedShellType } from '../../tools/builtin/bash-tool/misuse-guard.mjs';
 
 export { runReadOnlyIoWithDeadline as _runReadOnlyIoWithDeadlineForTest };
 export {
@@ -43,9 +44,23 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
   const prepared = prepareToolCall(name, args, cwd, callerSessionId, sessionRef, executeOpts);
   const { toolOpts, notifyFn, completionToolOpts } = prepared;
   const toolApprovalHook = hookFrom(executeOpts, sessionRef, 'toolApprovalHook');
+  // Shell misuse is judged before any hook or approval sees the call, so they
+  // read the command that will run and the directory it runs in.
+  let callArgs = prepared.args;
+  if (name === 'shell') {
+    const guarded = guardShellCall(callArgs, {
+      shellType: requestedShellType(callArgs),
+      agent: sessionRef?.agent || null,
+      sessionId: callerSessionId,
+      telemetry: executeOpts.resultTelemetry,
+    });
+    if (guarded.failure) return guarded.failure;
+    callArgs = guarded.args;
+    completionToolOpts.shellGuardNotes = guarded.notes;
+  }
   const hooked = await applyBeforeToolHook({
     name,
-    args: prepared.args,
+    args: callArgs,
     cwd: prepared.cwd,
     callerSessionId,
     executeOpts,

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -18,6 +18,7 @@ import { isAgentOwner } from '../../agent-owner.mjs';
 import { honoredSchemaAllowlist } from '../manager/session-tool-surface.mjs';
 import { syncSystemPrefix } from '../manager/prompt-utils.mjs';
 import { invalidateProviderContextBaseline } from './compact-policy.mjs';
+import { rebindToChangedPrefix } from '../thinking-binding.mjs';
 
 /** Drop everything measured against the previous tool surface. */
 function invalidateForToolSurfaceMigration(session) {
@@ -34,6 +35,14 @@ function invalidateForToolSurfaceMigration(session) {
  */
 export function markToolSurfaceMigrated(session, intent = TOOL_SURFACE_MIGRATION_INTENT) {
   invalidateForToolSurfaceMigration(session);
+  // The stored thinking was bound to the previous prefix and can never be
+  // replayed again (../thinking-binding.mjs); an open tool round a stopped
+  // turn left behind is ended first. Outside a turn only: a running turn sends
+  // from its own working transcript, whose latest tool round must keep its
+  // thinking.
+  if (Array.isArray(session.messages) && !Array.isArray(session.liveTurnMessages)) {
+    session.messages = rebindToChangedPrefix(session.messages);
+  }
   session.pendingCacheBreakIntent = intent;
 }
 
@@ -105,6 +114,7 @@ const AGENT_BRIDGE_FIELDS = [
   'deferredToolDeltaRevision',
   'nativeDeferredDiscovery',
   'mcpServerInstructions',
+  'mcpInstructionsAnnounced',
 ];
 
 /**

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -12,10 +12,7 @@ import {
   loadSkillResource,
   buildSkillToolEnvelope,
   filterSkillsExcludingDisabled,
-  isSkillDisabled,
-  skillMissingFeature,
-  skillOutsideScope,
-  skillOutsideScopeError,
+  skillLoadRefusal,
 } from '../../context/collect.mjs';
 
 // Eager-dispatch: tools with readOnlyHint:true in their declaration are safe
@@ -95,12 +92,8 @@ export function buildSkillsListResponse(cwd) {
 export function viewSkill(cwd, name, session = null) {
   const skillName = String(name || '').trim();
   if (!skillName) return 'Error: skill name is required';
-  const missingFeature = skillMissingFeature(skillName);
-  if (missingFeature) {
-    return `Error: skill "${skillName}" needs the ${missingFeature} built-in feature, which is not installed or is switched off in Extensions → Plugin → Built-in`;
-  }
-  if (isSkillDisabled(skillName)) return `Error: skill "${skillName}" is disabled`;
-  if (skillOutsideScope(skillName, cwd)) return skillOutsideScopeError(skillName);
+  const refusal = skillLoadRefusal(skillName, cwd);
+  if (refusal) return refusal;
   const res = loadSkillResource(skillName, cwd);
   if (!res) return `Error: skill "${skillName}" not found`;
   // Return the general tool envelope: the model-visible tool_result is the

package/src/runtime/agent/orchestrator/session/loop/tool-phase.mjs

@@ -9,6 +9,8 @@ import { processToolBatch } from '../tool-batch.mjs';
 import { CROSS_TURN_CAP, REPEAT_FAIL_LIMIT } from './loop-state.mjs';
 import { markStepEffort } from './step-auto-effort.mjs';
 import { resolveExecutionToolCalls } from './tool-call-resolution.mjs';
+import { rememberSensitiveValues } from '../sensitive-values.mjs';
+import { callsAllowed, settleTurnLimits, turnLimitsOf } from './turn-limits.mjs';
 
 function isSleepLikeToolCall(call) {
   const name = String(call?.name || call?.toolName || call?.function?.name || '').toLowerCase();
@@ -17,9 +19,13 @@ function isSleepLikeToolCall(call) {
 
 export async function runToolPhase(state, round, sent, onToolCall) {
   const { opts, messages, tools, sessionId, sessionRef, signal, response } = state;
-  state.noToolTurn.noteToolCallTurn();
   const calls = response.toolCalls;
+  state.noToolTurn.noteToolCallTurn();
   round.resolveToolCallId.all(calls);
+  // A capped turn (turn-limits.mjs): calls past its cap are answered unrun,
+  // and a batch after it was told to reply ends it.
+  const allowed = callsAllowed(state);
+  const overrun = state.turnLimitNoticed === true;
   state.toolCallsTotal += calls.length;
   // Surface any mid-turn assistant text (preamble before a tool call) to the
   // UI. Providers that stream via onTextDelta already rendered it; providers
@@ -36,14 +42,21 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   // derive the multi-tool adoption ratio without scanning message bodies.
   // Audit records what runs: a bridged call_tool is recorded as its target.
   // The wire calls stay the transcript identity (assistant turn below).
-  const toolBatchId = recordToolBatch(sessionId, resolveExecutionToolCalls(calls, sessionRef), state.iterations);
+  const executionCalls = resolveExecutionToolCalls(calls, sessionRef);
+  const toolBatchId = recordToolBatch(sessionId, executionCalls, state.iterations);
+  // A sensitive fill (a verification code): every stored copy of the
+  // transcript keeps a marker instead of the value; the call runs as is.
+  rememberSensitiveValues(sessionId, executionCalls);
   await Promise.resolve(onToolCall?.(state.iterations, calls));
   const assistantTurnMsg = buildToolCallAssistantMessage(response, { calls, opts });
   commitAssistantMessage(messages, assistantTurnMsg, opts);
   try {
     opts.onToolPhaseStarted?.();
-  } catch {}
+  } catch {
+    // the tool-phase-started observer is advisory
+  }
   const toolsT0 = Date.now();
+  const resultsFrom = messages.length;
   ({ dedupStubTotal: state.dedupStubTotal, editCount: state.editCount } = await processToolBatch({
     calls,
     messages,
@@ -67,10 +80,13 @@ export async function runToolPhase(state, round, sent, onToolCall) {
     pushToolResultMessage: state.pushToolResultMessage,
     throwIfAborted: state.throwIfAborted,
     repeatFailLimit: REPEAT_FAIL_LIMIT,
+    callsAllowed: allowed,
+    wrapUpAt: turnLimitsOf(state.opts)?.wrapUpAt,
   }));
   // A turn recovered from a stream cut that dropped an in-flight tool call
   // carries a runtime notice for the model, delivered after its results.
   if (response.recoveryNotice) messages.push(response.recoveryNotice);
+  settleTurnLimits(state, overrun);
   const toolsEndedAt = Date.now();
   // Starts the step judgment; the next request uses it if it has resolved by
   // then (send-phase.mjs applyStepEffort), else the one after.
@@ -81,7 +97,9 @@ export async function runToolPhase(state, round, sent, onToolCall) {
       calls: calls.length,
       elapsedMs: toolsEndedAt - toolsT0,
     });
-  } catch {}
+  } catch {
+    // the tool-phase-completed observer is advisory
+  }
   traceLoopPhaseTiming({
     iteration: round.nextIteration,
     preSendMs: sent.preSendMs,
@@ -91,6 +109,6 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   });
   state.lastToolBatchEndedAt = toolsEndedAt;
   state.toolBatchJustCompleted = true;
-  state.noToolTurn.noteToolBatchCompleted();
+  state.noToolTurn.noteToolBatchCompleted(calls, messages.slice(resultsFrom));
   state.lastToolBatchHadSleep = calls.some(isSleepLikeToolCall);
 }

package/src/runtime/agent/orchestrator/session/loop/turn-limits.mjs

@@ -0,0 +1,60 @@
+/**
+ * turn-limits.mjs — a turn's caps (sendOpts.turnLimits; a heartbeat turn's,
+ * manager/ask-turn-loop-options.mjs): `maxToolCalls` tool calls and
+ * `wrapUpAt` (epoch ms). A call past the cap, or one made after the wrap-up
+ * time, is answered without running. Once a cap is reached the model is told
+ * to reply, and every later request of the turn forbids tool use
+ * (toolChoice 'none'). A response that still calls tools after that ends the
+ * turn with no reply, its calls answered unrun. A capped turn runs no call
+ * eagerly (eager-dispatch.mjs), so none past the cap starts while streaming.
+ */
+
+const NOTICE =
+  '[mixdog-runtime] This turn has reached its tool-call or time limit: no further tool call runs. Reply now with your final answer from what you already have.';
+const REFUSAL =
+  '[turn-limit] This turn has reached its tool-call or time limit; this call was not run. Reply now without tools.';
+
+/** `{ maxToolCalls, wrapUpAt }` of a capped turn (Infinity where unset), else null. */
+export function turnLimitsOf(opts) {
+  const limits = opts?.turnLimits;
+  if (!limits || typeof limits !== 'object') return null;
+  return {
+    maxToolCalls: Number.isInteger(limits.maxToolCalls) && limits.maxToolCalls >= 0 ? limits.maxToolCalls : Infinity,
+    wrapUpAt: Number.isFinite(limits.wrapUpAt) ? limits.wrapUpAt : Infinity,
+  };
+}
+
+/** How many calls of the next batch may run, before the loop counts them. */
+export function callsAllowed(state, now = Date.now()) {
+  const limits = turnLimitsOf(state.opts);
+  if (!limits) return Infinity;
+  if (state.turnLimitNoticed || now >= limits.wrapUpAt) return 0;
+  return Math.max(0, limits.maxToolCalls - state.toolCallsTotal);
+}
+
+/** The answer to a call the cap kept from running. */
+export function turnLimitRefusal(call) {
+  return { role: 'tool', content: REFUSAL, toolCallId: call.id, toolKind: 'error' };
+}
+
+/**
+ * After a tool batch: `overrun` when the batch came after the turn was told
+ * to reply, which ends the turn (state.turnLimitEnded). Otherwise, once a cap
+ * is reached, the model is told once to reply.
+ */
+export function settleTurnLimits(state, overrun, now = Date.now()) {
+  if (overrun) {
+    state.turnLimitEnded = true;
+    return;
+  }
+  const limits = turnLimitsOf(state.opts);
+  if (!limits || state.turnLimitNoticed) return;
+  if (state.toolCallsTotal < limits.maxToolCalls && now < limits.wrapUpAt) return;
+  state.turnLimitNoticed = true;
+  state.messages.push({ role: 'user', content: NOTICE, meta: { source: 'turn-limit' } });
+}
+
+/** The turn's end after an overrun: no reply. */
+export function endedWithoutReply(response) {
+  return { ...response, content: '', toolCalls: [] };
+}

package/src/runtime/agent/orchestrator/session/manager/ask-queue.mjs

@@ -9,6 +9,7 @@ import {
   drainPendingMessages,
   releasePendingMessages,
 } from './pending-messages.mjs';
+import { promptOriginOf } from '../../../../shared/prompt-origin.mjs';
 
 const SYNTHETIC_PROMPT_SOURCES = ['goal-continuation', 'goal-closeout'];
 
@@ -35,6 +36,7 @@ const tailTurnFor = (group) => ({
   content: group.content,
   entries: group.entries,
   ...(group.hop ? { hop: group.hop } : {}),
+  ...(group.origin ? { origin: group.origin } : {}),
   ...(group.mode === PENDING_MODE_TASK_NOTIFICATION
     ? promptSourceFields(PENDING_MODE_TASK_NOTIFICATION, group.execution)
     : {}),
@@ -49,13 +51,19 @@ const queuedTurnInput = (tailTurn) => ({
   pendingEntries: tailTurn.entries,
   ...(tailTurn.hop ? { hop: tailTurn.hop } : {}),
   promptSource: promptSourceFields(tailTurn.source, tailTurn.execution),
+  ...(tailTurn.origin ? { promptOrigin: tailTurn.origin } : {}),
 });
 
-export function createAskPromptQueue({ sessionId, promptSource }) {
+// The caller's provenance of its initial prompt, apart from its presentation
+// source: an inbound channel message or an agent report (shared/prompt-origin.mjs).
+const initialPromptOriginFor = (promptOrigin) => promptOriginOf(promptOrigin);
+
+export function createAskPromptQueue({ sessionId, promptSource, promptOrigin }) {
   // Local FIFO of follow-up prompts drained from the pending-message queue
   // after each turn — keeps queued `agent type=send` messages in order.
   const tail = [];
   let initialPromptSource = initialPromptSourceFor(promptSource);
+  let initialPromptOrigin = initialPromptOriginFor(promptOrigin);
   // Queue entries of the input nextTurn handed out that no turn owns yet.
   // Once a turn starts, its failure path acks or releases them instead.
   let unstartedEntries = [];
@@ -67,13 +75,15 @@ export function createAskPromptQueue({ sessionId, promptSource }) {
    *  and provenance — or null when nothing model-visible is left to run. */
   const nextTurn = (original) => {
     const source = initialPromptSource;
+    const origin = initialPromptOrigin;
     initialPromptSource = null;
+    initialPromptOrigin = null;
     let input;
     if (tail.length > 0) {
       // After the first turn, the next prompt comes from the drained queue.
       input = queuedTurnInput(tail.shift());
     } else if (hasModelVisiblePromptContent(original.prompt)) {
-      input = { ...original, pendingEntries: [], promptSource: source };
+      input = { ...original, pendingEntries: [], promptSource: source, ...(origin ? { promptOrigin: origin } : {}) };
     } else {
       // Idle resume: TUI kicks an empty ask() after execution completions
       // mirror model-visible bodies into session pending. Drain that queue

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -19,6 +19,7 @@ import { armTurnDurability, claimTurnRuntime } from './ask-turn-open.mjs';
 import { prepareAskTurn, runAskAgentLoop } from './ask-turn-execute.mjs';
 import { commitAskTurn, publishAskTurn } from './ask-turn-settle.mjs';
 import { finalizeAskTurnFailure } from './ask-turn-failure.mjs';
+import { cacheWarmTurnKind, endCacheWarmTurn, failedTurnProvenance, noteCacheWarmTurn } from '../cache-warm.mjs';
 
 export { _api_call_with_interrupt } from './ask-call-interrupt.mjs';
 export {
@@ -168,7 +169,14 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
   // return value (the queued tail turns supersede the original prompt's
   // result, mirroring how a live chat returns the latest turn).
   let result;
-  const queue = createAskPromptQueue({ sessionId, promptSource: askOpts.promptSource });
+  const queue = createAskPromptQueue({
+    sessionId,
+    promptSource: askOpts.promptSource,
+    promptOrigin: askOpts.promptOrigin,
+  });
+  // The turn the prompt-cache warmer is told about last; it forgets it when
+  // the turn ends (endCacheWarmTurn), whatever way the ask unwinds.
+  let warmTurn = null;
   // Hoisted so the outer finally (which runs once after the whole turn loop)
   // can compare against the last turn's generation.
   let askGeneration = 0;
@@ -213,6 +221,12 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         recoverCheckpoint: !crashRecoveryChecked,
         emitStart: !sessionStartEmitted,
       });
+      // The prompt-cache warmer learns idle gaps from real turns only; a
+      // retry is classified by the failed turn's stored provenance.
+      // The rebuilt retry message keeps that provenance (ask-turn-execute.mjs).
+      const retryProvenance = failedTurnProvenance(claimed.preSession?.messages, input);
+      if (retryProvenance) input.retryProvenance = retryProvenance;
+      warmTurn = noteCacheWarmTurn(sessionId, cacheWarmTurnKind(input, claimed.preSession?.messages));
       crashRecoveryChecked = true;
       sessionStartEmitted = true;
       askGeneration = claimed.askGeneration;
@@ -234,6 +248,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         askStartedAt,
       });
       result = turn.result;
+      endCacheWarmTurn(sessionId, warmTurn);
       // Turn complete. Drain the pending-message queue: any `agent type=send`
       // that arrived while this turn was in flight runs next, in order, as a
       // follow-up user turn. The mutex is still held, so a send racing this
@@ -264,6 +279,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
       return result;
     }
   } finally {
+    // A failed/cancelled turn ends here too: its warmer turn entry goes (a
+    // later ask's own turn is never removed by this one).
+    endCacheWarmTurn(sessionId, warmTurn);
     // A failed/cancelled turn ends the ask: the follow-up turns drained
     // behind it never ran, so their entries go back to the pending queue.
     queue.releaseUnstarted();

package/src/runtime/agent/orchestrator/session/manager/ask-turn-commit.mjs

@@ -3,6 +3,7 @@
 // its empty-final forensic record), the usage/cost ledger row, and the
 // opaque provider continuation state.
 import { cloneProviderReplay } from '../../providers/lib/provider-replay.mjs';
+import { turnReminderField } from '../loop/assistant-commit.mjs';
 import { logLlmCall } from '../../usage-log.mjs';
 import { runAbortable } from '../../../../shared/abort-race.mjs';
 import { getAgentRuntimeSync } from './agent-runtime-singleton.mjs';
@@ -31,6 +32,7 @@ export function appendAssistantTurnMessage({ session, sessionId, result, transcr
       ...(result.providerMetadata && typeof result.providerMetadata === 'object'
         ? { providerMetadata: result.providerMetadata }
         : {}),
+      ...turnReminderField(result),
       // Keep terminal provider evidence for non-empty turns too. A safety
       // classifier can emit narration and then refuse; omitting this
       // metadata made that shape indistinguishable from an ordinary