mixdog 1.3.5 → 1.4.0

package/src/runtime/agent/orchestrator/session/compaction-archive.mjs

@@ -194,38 +194,63 @@ async function archiveIndexFor(path, handle) {
   return entries;
 }
 
-/** One page of a session's archive sidecar (see pageFromSegments). The
- *  open handle pins the file a concurrent atomic replace may swap out, so
- *  the index and the segment reads describe the same bytes. */
-export async function readCompactionArchivePage(storeDir, sessionId, range = {}) {
+/** Runs `use(entries, load)` over a session's archive sidecar: its segment
+ *  index and a loader of one segment's items. The open handle pins the file
+ *  a concurrent atomic replace may swap out, so the index and the segment
+ *  reads describe the same bytes. `fallback` when the archive is absent or
+ *  unreadable (display-only history: it shows nothing then). */
+async function withArchive(storeDir, sessionId, fallback, use) {
   const path = compactionArchivePath(storeDir, sessionId);
-  if (!path) return { items: [], hasOlder: false };
+  if (!path) return fallback;
   let handle;
   try {
     handle = await open(path, 'r');
   } catch {
-    // Display-only history: an absent or unreadable archive shows nothing.
     archiveIndexes.delete(path);
-    return { items: [], hasOlder: false };
+    return fallback;
   }
   try {
     const entries = await archiveIndexFor(path, handle);
-    return await pageFromSegments(
-      entries,
-      async (entry) => {
-        const buffer = Buffer.alloc(entry.length);
-        await handle.read(buffer, 0, entry.length, entry.start);
-        return segmentItems(buffer.toString('utf8'));
-      },
-      range
-    );
+    return await use(entries, async (entry) => {
+      const buffer = Buffer.alloc(entry.length);
+      await handle.read(buffer, 0, entry.length, entry.start);
+      return segmentItems(buffer.toString('utf8'));
+    });
   } catch {
-    return { items: [], hasOlder: false };
+    return fallback;
   } finally {
     await handle.close().catch(() => {});
   }
 }
 
+/** One page of a session's archive sidecar (see pageFromSegments). */
+export function readCompactionArchivePage(storeDir, sessionId, range = {}) {
+  return withArchive(storeDir, sessionId, { items: [], hasOlder: false }, (entries, load) =>
+    pageFromSegments(entries, load, range)
+  );
+}
+
+/** Hands every visible segment of the archive (numbered in (after, before),
+ *  oldest first) to `visit` as its items, one segment at a time, so a whole
+ *  walk never holds more than one segment. True when the walk completed;
+ *  false when the archive was absent or unreadable (the visits made so far
+ *  are then incomplete). */
+export function visitCompactionArchive(
+  storeDir,
+  sessionId,
+  { after = 0, before = Number.POSITIVE_INFINITY } = {},
+  visit
+) {
+  return withArchive(storeDir, sessionId, false, async (entries, load) => {
+    for (const entry of entries) {
+      const { seq, count } = entry.head;
+      if (seq <= after || seq >= before || count < 1) continue;
+      visit(await load(entry));
+    }
+    return true;
+  });
+}
+
 // Delete fence: every deletion bumps the session's epoch. A writer captures
 // the epoch before it starts and publishes only if it is unchanged at the
 // (synchronous) rename, so a delete that lands while a segment is being

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -24,6 +24,7 @@ export function createEagerDispatcher({
   getIterations,
   getNextIteration,
   repeatFailLimit,
+  isTurnLimitNoticed = () => false,
   executeToolFn = executeTool,
 }) {
   const pending = new Map();
@@ -56,7 +57,9 @@ export function createEagerDispatcher({
   const startEagerTool = (wireCall) => {
     // Streamed call_tool requests are admitted, ordered and executed as their
     // targets; a projection error is answered by the serial batch instead.
-    if (capped) return null;
+    // Once the turn was told to reply (any limit), no call runs: the batch
+    // refuses them, so none may start while the wrap-up response streams.
+    if (capped || isTurnLimitNoticed()) return null;
     const call = resolveExecutionToolCall(wireCall, sessionRef);
     if (!call?.id || pending.has(call.id) || !isParallelDispatchable(call.name)) return null;
     const admitted = admission.admit(call);

package/src/runtime/agent/orchestrator/session/human-gate/gate.mjs

@@ -98,7 +98,8 @@ const LEAD_NAME = 'Lead';
  *  bot-created task session, a bot's home chat or room member session) and
  *  the names from there down to the asker ("Lead › Reviewer", "사무관 ›
  *  Worker"). Only where the card shows: no bot identity, grant or remember
- *  scope follows from it. Null for a top-level session. */
+ *  scope follows from it. Null for a top-level session (whose requests show
+ *  in the chats handing it work instead: tui/session/tool-approval.mjs). */
 export function approvalSurface(sessionId) {
   const delegation = delegationOf(sessionId);
   if (delegation.state !== 'resolved') return null;
@@ -156,7 +157,13 @@ async function describeEmails(call, outbound, ctx) {
     const { executeMcpTool } = await import('../../mcp/client.mjs');
     const ids = outbound.category === 'trash' && Array.isArray(call.args?.ids) ? call.args.ids.map(String) : [];
     const shown = ids.slice(0, PREVIEW_MESSAGES);
-    const raw = await executeMcpTool(name, { ids: shown }, { scopeId: ctx.mcpScopeId });
+    // The account the call acts as (one server holds every Gmail account).
+    const chosen = typeof call.args?.account === 'string' ? call.args.account.trim() : '';
+    const raw = await executeMcpTool(
+      name,
+      { ids: shown, ...(chosen ? { account: chosen } : {}) },
+      { scopeId: ctx.mcpScopeId }
+    );
     const { account, emails } = JSON.parse(raw);
     const messages = (Array.isArray(emails) ? emails : []).map((mail) =>
       [mail.from, mail.subject, String(mail.date || '').slice(0, 10)].filter(Boolean).join(' · ')
@@ -231,10 +238,9 @@ export async function humanGateDecision(call, decision, ctx = {}) {
       editable: outbound.editable,
       details: outbound.details,
     },
-    remember: ['once'],
+    // "Don't ask again" is the bot's permission.
+    remember: outboundRemember(outbound.category),
   };
-  // "Don't ask again" is the bot's permission.
-  request.remember = outboundRemember(outbound.category);
   const store = ctx.store || (await humanGateStore());
   const mode = await store.modeFor({ agentId, action: outbound.category });
   const base = decision && typeof decision === 'object' ? decision : {};

package/src/runtime/agent/orchestrator/session/human-gate/outbound-policy.mjs

@@ -74,8 +74,6 @@ const MCP_OUTBOUND = new Map([
     'slack_post_message',
     'slack_reply_to_thread',
     'chat_post_message',
-    'discord_send_message',
-    'telegram_send_message',
   ].map((name) => [name, 'message']),
   ...['create_post', 'publish_post', 'create_tweet', 'post_tweet', 'send_tweet'].map((name) => [name, 'publish']),
   ['submit_form', 'form'],

package/src/runtime/agent/orchestrator/session/human-gate/requests.mjs

@@ -12,10 +12,23 @@
 // the scopes it allows and can leave out `always`. Nothing here ever carries a
 // secret value: a decision that names one is stripped to its verdict.
 
-export const HUMAN_REQUEST_KINDS = Object.freeze(['approval', 'outbound', 'secret', 'takeover', 'permission']);
-export const HUMAN_RESPONSES = Object.freeze(['approve', 'deny', 'edit-and-approve', 'provide-secret', 'skip', 'done']);
-export const REMEMBER_SCOPES = Object.freeze(['once', 'agent', 'always']);
+const HUMAN_REQUEST_KINDS = Object.freeze(['approval', 'outbound', 'secret', 'takeover', 'permission']);
+const HUMAN_RESPONSES = Object.freeze(['approve', 'deny', 'edit-and-approve', 'provide-secret', 'skip', 'done']);
+const REMEMBER_SCOPES = Object.freeze(['once', 'agent', 'always']);
 export const SECRET_REQUEST_TIMEOUT_MS = 120_000;
+/** What a secret's bound field is: a sign-in form (아이디 + 비밀번호), a lone
+ *  password, a new password, or a one-time code; '' when unknown (computer). */
+export const SECRET_FORMS = Object.freeze(['login', 'password', 'new-password', 'otp']);
+/** Every result a secret handoff (and a declined or expired takeover) gives
+ *  the agent: facts, never a verdict about the site. */
+export const HANDOFF_OUTCOMES = Object.freeze([
+  'entered',
+  'user_skipped',
+  'no_field',
+  'page_changed',
+  'blocked',
+  'expired',
+]);
 
 const RESPONSES_BY_KIND = Object.freeze({
   approval: ['approve', 'deny'],
@@ -49,7 +62,7 @@ const text = (value, limit = TEXT_LIMIT) => (typeof value === 'string' ? value.t
 
 /** The human kind of a request; anything else (ask_user's 'question', a
  *  hook's bare ask) is an ordinary approval for responses. */
-export function humanRequestKind(request) {
+function humanRequestKind(request) {
   return HUMAN_REQUEST_KINDS.includes(request?.kind) ? request.kind : 'approval';
 }
 
@@ -103,11 +116,21 @@ export function humanRequestFields(input = {}) {
   }
   if (kind === 'secret') {
     const secret = isRecord(input.secret) ? input.secret : {};
+    // The bound page's origin and what its field is (the desktop read it at
+    // request time, ask-user-tool.mjs): the card's title and inputs; no value.
+    const origin = loginPageUrl(secret.origin)?.origin || '';
+    const form = SECRET_FORMS.includes(secret.form) ? secret.form : '';
+    // A code's length is the bound field's own (credential-autofill.ts
+    // codeLength); absent, it stays unspecified.
+    const length = Number.isInteger(secret.length) && secret.length > 0 ? secret.length : 0;
     fields.secret = {
       requestId: text(secret.requestId),
       surface: secret.surface === 'computer' ? 'computer' : 'browser',
       target: text(secret.target),
       field: text(secret.field),
+      ...(origin ? { origin } : {}),
+      ...(form ? { form } : {}),
+      ...(form === 'otp' && length ? { length } : {}),
     };
     fields.args = { surface: fields.secret.surface, target: fields.secret.target, field: fields.secret.field };
     fields.remember = ['once'];
@@ -132,12 +155,21 @@ export function humanRequestFields(input = {}) {
     // A login takeover (purpose 'login') opens the desktop's sign-in window on
     // its validated page instead of handing over the side panel.
     const login = surface === 'browser' && takeover.purpose === 'login' ? loginPageUrl(takeover.url) : null;
+    // The saved logins of the sign-in page's origin: opaque ids and masked
+    // labels only (profile-import.ts credentialSuggestions), never a password.
+    const accounts = (login && Array.isArray(takeover.accounts) ? takeover.accounts : [])
+      .filter((account) => isRecord(account) && token(account.id, 128) && text(account.label, 120))
+      .map((account) => ({ id: token(account.id, 128), label: text(account.label, 120) }));
+    // The page those logins may be filled into, bound by the desktop at
+    // request time (ask-user-tool.mjs fillId): without it none is offered.
+    const fillId = /^secret_[A-Za-z0-9-]{8,80}$/.test(text(takeover.fillId, 100)) ? text(takeover.fillId, 100) : '';
     fields.takeover = {
       surface,
       instructions: text(takeover.instructions, 2_000),
       ...(text(takeover.target) ? { target: text(takeover.target) } : {}),
       ...identity,
       ...(login ? { purpose: 'login', url: login.url, origin: login.origin } : {}),
+      ...(accounts.length && fillId ? { accounts, fillId } : {}),
     };
     fields.remember = ['once'];
   }

package/src/runtime/agent/orchestrator/session/human-gate/store.mjs

@@ -17,7 +17,7 @@ import { ACTION_KINDS, isRememberableAction } from './outbound-policy.mjs';
 const ANY_AGENT = '*';
 const FIELD_LIMIT = 200;
 const AUDIT_KEYS = ['agentId', 'kind', 'action', 'tool', 'target', 'decision', 'device'];
-const PERMISSION_MODES = Object.freeze(['ask', 'allow', 'block']);
+export const PERMISSION_MODES = Object.freeze(['ask', 'allow', 'block']);
 
 const field = (value) => String(value ?? '').slice(0, FIELD_LIMIT);
 const grantId = (agentId, action) =>

package/src/runtime/agent/orchestrator/session/loop/compact-policy.mjs

@@ -21,6 +21,7 @@ import { isAgentModeSession } from '../agent-mode.mjs';
 import { providerInputExcludesCache, providerNativePdf } from '../../providers/registry.mjs';
 import { contentMediaBytes, contentMediaCount } from '../../providers/media-normalization.mjs';
 import { splitProtectedContext } from '../compact/messages.mjs';
+import { withLiveCompactionConfig } from '../../runtime-core/compaction-config-keys.mjs';
 
 // Unified context-share rule (compact/constants.mjs CONTEXT_SHARE_RATIO): the
 // post-compaction target is 25% of the boundary/context window. One
@@ -394,13 +395,6 @@ export function invalidateProviderContextBaseline(sessionRef) {
   delete sessionRef.contextPressureUnanchoredReason;
 }
 
-// A baseline is refreshed on every provider_send/turn-end. When the transcript
-// has grown but no fresh recording landed for this long, recording is failing
-// (zero/absent usage keeps the OLD baseline because record() only returns
-// false) — distrust it and fall back to the estimate. An idle session whose
-// transcript did NOT grow keeps its baseline regardless of age.
-const BASELINE_MAX_STALE_GROWTH_MS = 30 * 60 * 1000;
-
 /**
  * Does this anchor still describe this message prefix?
  *
@@ -480,17 +474,19 @@ function providerBaselinePressureTokens(messages, sessionRef, policy, { includeC
         ? Math.max(0, tokens - Math.round(storedRequestReserve) + currentRequestReserve)
         : tokens + currentRequestReserve;
   }
-  // Staleness means a baseline that stopped being refreshed WHILE the session
-  // kept working — never age on the wall clock. Measured against `now`, this
-  // discarded the reading of every session that simply sat unopened for a
-  // while (88 of 983 stored sessions), and the whole-transcript estimate that
-  // replaced it was the less accurate number in both directions: 1.12x over
-  // on the median, 0.82x under on a session already past its window.
-  // Comparing against the session's own last activity keeps the rule aimed at
-  // its actual target — a live session whose usage recording is failing while
-  // its transcript grows — and leaves a session at rest on its measurement.
-  const activityAt = Math.max(Number(sessionRef.updatedAt) || 0, Number(sessionRef.lastContextTokensUpdatedAt) || 0);
-  if (messages.length > count && baselineAt > 0 && activityAt - baselineAt > BASELINE_MAX_STALE_GROWTH_MS) return null;
+  // Staleness means usage recording is failing: a provider request completed
+  // AFTER this reading without replacing it (every send records its usage
+  // after it starts, so a working recorder always leaves the reading newer
+  // than the last send) — zero/absent usage keeps the OLD baseline because
+  // record() only returns false. Never age on a clock: measured against `now`
+  // it discarded the reading of every session that sat unopened for a while
+  // (88 of 983 stored sessions), and measured against the session's last
+  // activity it discarded it whenever anything was appended more than half an
+  // hour after the last request — a user back from a break, an agent's result
+  // posted to a waiting Lead — so the next send compacted on the
+  // whole-transcript estimate, far above the provider's own count.
+  const lastSendAt = Number(sessionRef.lastProviderSendAt) || 0;
+  if (messages.length > count && baselineAt > 0 && lastSendAt > baselineAt) return null;
   try {
     // Baseline tokens are authoritative provider billing; only the growth
     // after the baseline is a local estimate and needs billing calibration.
@@ -795,9 +791,9 @@ function compactionTelemetryRecord(sessionRef, policy, meta, prev) {
     if (terminalSuccess) return null;
     return present ? (next ?? null) : (previous ?? null);
   };
-  return {
-    ...prev,
-    auto: policy.auto !== false,
+  // Config-owned fields stay the live ones (withLiveCompactionConfig): `policy`
+  // was resolved before a compaction that a reload may have outlived.
+  return withLiveCompactionConfig(prev, {
     requestReserveTokens: policy.requestReserveTokens || 0,
     reserveTokens: policy.reserveTokens || 0,
     boundaryTokens: policy.boundaryTokens || null,
@@ -848,7 +844,7 @@ function compactionTelemetryRecord(sessionRef, policy, meta, prev) {
     compactCount: (prev.compactCount || 0) + (changed ? 1 : 0),
     singleShotConsumed:
       policy.singleShot === true && meta.stage === 'compacting' ? true : prev.singleShotConsumed === true,
-  };
+  });
 }
 
 // Postmortem ring buffer: the per-check telemetry record is overwritten on

package/src/runtime/agent/orchestrator/session/loop/fresh-context.mjs

@@ -18,6 +18,9 @@ import { summarizeOnSharedPrefix } from '../compact/forked-summary.mjs';
 import { normalizeCompactionSummaryMode } from '../compact/summary-mode.mjs';
 import { compactionCacheWarm, lighterSubscriptionModel } from '../compact/summary-route.mjs';
 import { retireCompactionFork } from '../side-question-store.mjs';
+import { buildSkillToolEnvelope, collectSkillsCached, currentSkillDelivery } from '../../context/collect.mjs';
+import { loadSkillToolDependencies } from '../../runtime-core/skill-tool-loading.mjs';
+import { parseNativeToolSearchPayload } from './tool-helpers.mjs';
 
 // Conversation summarization triggers independently of the post-compact target:
 // at 5% of the window, capped so a large window does not carry tens of
@@ -262,11 +265,37 @@ function freshContextBudget({ compactPolicy, sessionRef, provider, compactBudget
   return { contextWindow, hardBudget, conversationInput, conversationTokens, conversationThresholdTokens };
 }
 
+// Compact restores each active skill from its current source, as the Skill
+// tool would deliver it in this session now (null: it no longer loads). The
+// real pass also re-arms the skill's current tool dependencies on the session
+// surface and answers the native tool-search payload they produce (or, with
+// none, the Skill result summary); a preview never touches the surface and
+// keeps the transcript's loader pairs.
+function currentSkillResolver(sessionRef, { preview = false } = {}) {
+  const cwd = sessionRef?.cwd || null;
+  const config = loadConfig({ secrets: false });
+  const skills = collectSkillsCached(cwd);
+  return (name) => {
+    const delivery = currentSkillDelivery(name, cwd, config, skills);
+    if (!delivery) return null;
+    if (preview) return { body: delivery.body, native: undefined };
+    const { resource } = delivery;
+    const envelope = loadSkillToolDependencies(
+      buildSkillToolEnvelope(name, resource.content, resource.dir, resource),
+      sessionRef
+    );
+    const native = parseNativeToolSearchPayload('Skill', envelope.result);
+    return { body: delivery.body, native, summary: native?.summary ?? envelope.result };
+  };
+}
+
 function freshContextBuildOptions(
-  { compactPolicy = {}, sessionId, goalReminderText, activeTurn, referenceLatestAttachments },
+  { sessionRef, compactPolicy = {}, sessionId, goalReminderText, activeTurn, referenceLatestAttachments, preview },
   budget
 ) {
   return {
+    // A sessionless call (no session gates to apply) keeps the transcript copies.
+    currentSkill: sessionRef ? currentSkillResolver(sessionRef, { preview }) : null,
     reserveTokens: compactPolicy.reserveTokens,
     maxBudgetTokens: budget.hardBudget,
     force: true,
@@ -287,7 +316,7 @@ export function previewFreshContextCompaction(input) {
   const budget = freshContextBudget(input);
   const summaryTriggered = budget.conversationTokens >= budget.conversationThresholdTokens;
   const result = freshContextCompactMessages(input.messages, input.compactBudgetTokens, {
-    ...freshContextBuildOptions(input, budget),
+    ...freshContextBuildOptions({ ...input, preview: true }, budget),
     preview: true,
     previewSummary: summaryTriggered,
   });
@@ -346,7 +375,7 @@ export async function runFreshContextCompact({
   });
   const summaryTriggered = conversationTokens >= conversationThresholdTokens;
   const buildOptions = freshContextBuildOptions(
-    { compactPolicy, sessionId, goalReminderText, activeTurn, referenceLatestAttachments },
+    { sessionRef, compactPolicy, sessionId, goalReminderText, activeTurn, referenceLatestAttachments },
     { contextWindow, hardBudget }
   );
   const build = (handoffText) =>

package/src/runtime/agent/orchestrator/session/loop/loop-state.mjs

@@ -120,7 +120,9 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     messages.push(message);
     try {
       opts.onToolResult?.(message);
-    } catch {}
+    } catch {
+      // the tool-result observer is advisory
+    }
   };
   state.drainSteering = createSteeringDrain({
     messages,

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn.mjs

@@ -44,7 +44,7 @@ export function createNoToolTurnResolver({
     // whether it answered that input.
     reactions: [],
     // Structured provider continuation signals honored this turn. Diagnostic
-    // only: the loop has no iteration cap, so this count bounds nothing. A
+    // only: this count bounds nothing. A
     // text-only continuation runaway is bounded by continuationsSinceToolBatch
     // below; continuations interleaved with tool batches are not limited.
     providerContinuationCount: 0,

package/src/runtime/agent/orchestrator/session/loop/route-fallback.mjs

@@ -6,6 +6,12 @@ import { getProvider, initProviders } from '../../providers/registry.mjs';
 import { loadConfig } from '../../config.mjs';
 import { ensureProviderEnabled } from '../../runtime-core/config-helpers.mjs';
 import { updateSessionRoute } from '../manager/session-lifecycle.mjs';
+import {
+  liveRouteFallbacks,
+  nextRouteFallbackIndex,
+  routeFallbackHopped,
+  routeLeaf,
+} from '../manager/route-fallback-chain.mjs';
 import { pinSessionWireRoute } from '../../providers/wire-route.mjs';
 import { buildRequestSendOptions } from '../manager/ask-turn-loop-options.mjs';
 import { prepareTurnEffortConfiguration } from '../../providers/effort-configuration.mjs';
@@ -78,9 +84,13 @@ async function nextContextGrows(state, next) {
 
 export async function advanceAgentRoute(state, error) {
   const session = state.sessionRef;
-  if (!session?.agent || !session.routeFallbacks?.length) return false;
-  const index = session.routeFallbackIndex || 0;
-  const next = session.routeFallbacks[index];
+  if (!session?.agent) return false;
+  // Read from the session's settings at this hop: a chain edited while it runs
+  // applies now, and one cleared to [] leaves the provider's own error.
+  const { chain } = liveRouteFallbacks(session, loadConfig({ secrets: false }));
+  if (!chain.length) return false;
+  const index = nextRouteFallbackIndex(session, chain);
+  const next = chain[index];
   // Only THIS request must have produced nothing (its stream outcome says so):
   // earlier requests of the turn may have run tools. Their calls and results
   // are already in the live turn, which the next model continues from, so no
@@ -97,6 +107,8 @@ export async function advanceAgentRoute(state, error) {
   const provider = getProvider(next.provider);
   if (!provider) throw new Error(`Provider "${next.provider}" not available`);
   const failed = routeFailure(session, error);
+  // The route a reset returns to (setup reset_route_fallback), kept from the first hop.
+  const primary = routeFallbackHopped(session) ? session.routeFallbackPrimary : routeLeaf(session);
   // The left model's share of the turn ends here: the running total at the
   // switch bounds it, so each model's tokens are booked at its own rates.
   state.routeUsageHops = [
@@ -131,6 +143,8 @@ export async function advanceAgentRoute(state, error) {
     { crossProvider: true, session }
   );
   if (!updated) throw new Error('agent session closed during model fallback');
+  updated.routeFallbacks = chain;
+  if (primary) updated.routeFallbackPrimary = primary;
   updated.routeFallbackIndex = index + 1;
   updated.routeFallbackFailures = [...(session.routeFallbackFailures || []), failed];
   await pinSessionWireRoute(updated, provider);

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -126,13 +126,16 @@ export async function beginIteration(state) {
     getIterations: () => state.iterations,
     getNextIteration: () => nextIteration,
     repeatFailLimit: REPEAT_FAIL_LIMIT,
+    isTurnLimitNoticed: () => state.turnLimitNoticed === true,
   });
   const resolveToolCallId = createToolCallIdResolver(messages);
   opts.onToolCall = (call) => {
     resolveToolCallId(call);
     try {
       opts.onAssistantToolCallObserved?.(call, { eagerStarted: false });
-    } catch {}
+    } catch {
+      // the tool-call observer is advisory
+    }
     return eager.onToolCall(call);
   };
   return {
@@ -173,7 +176,9 @@ export async function sendProviderRequest(state, round) {
   });
   try {
     opts.onProviderSendStarted?.();
-  } catch {}
+  } catch {
+    // the send-started observer is advisory
+  }
   // The request a /btw side question forks: kept while it is in flight, with
   // its reply once it proceeds, and dropped again if it fails.
   const sideQuestion = captureSideQuestionRequest({

package/src/runtime/agent/orchestrator/session/loop/tool-exec/after-hook.mjs

@@ -4,6 +4,7 @@
  */
 import { normalizeToolEnvelope, makeToolEnvelope } from '../../tool-envelope.mjs';
 import { resolveToolResultAfterHook } from '../tool-helpers.mjs';
+import { effectiveToolCwd } from '../../../tools/builtin/bash-tool/shell-cwd.mjs';
 
 export async function applyAfterToolHook(result, afterToolHook, { name, args, cwd, callerSessionId, toolCallId }) {
   if (typeof afterToolHook !== 'function') return result;
@@ -15,7 +16,7 @@ export async function applyAfterToolHook(result, afterToolHook, { name, args, cw
     const hookResult = await afterToolHook({
       name,
       args,
-      cwd,
+      cwd: effectiveToolCwd(name, args, cwd),
       sessionId: callerSessionId,
       toolCallId,
       result: visible,

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -15,6 +15,7 @@ import {
   recordHumanDecision,
 } from '../../human-gate/gate.mjs';
 import { applyEditedArgs } from '../../human-gate/requests.mjs';
+import { effectiveToolCwd } from '../../../tools/builtin/bash-tool/shell-cwd.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
@@ -31,7 +32,7 @@ async function askApproval(
       resolvePreToolAskApproval({
         toolName: call.name,
         args: call.args,
-        cwd: call.cwd,
+        cwd: effectiveToolCwd(call.name, call.args, call.cwd),
         sessionId: callerSessionId,
         toolCallId: executeOpts.toolCallId || null,
         askReason,
@@ -140,7 +141,7 @@ export async function applyBeforeToolHook({
             {
               name,
               args,
-              cwd,
+              cwd: effectiveToolCwd(name, args, cwd),
               sessionId: callerSessionId,
               toolCallId: executeOpts.toolCallId || null,
             },

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -3,7 +3,14 @@
  * MCP, code graph, internal tools, shell, apply_patch, built-ins and foreign
  * CLI adapters.
  */
-import { executeMcpTool, isMcpTool, isRegisteredMcpTool, mcpToolHasField } from '../../../mcp/client.mjs';
+import {
+  executeMcpTool,
+  isBuiltinMailRead,
+  isMcpTool,
+  isRegisteredMcpTool,
+  mcpToolHasField,
+} from '../../../mcp/client.mjs';
+import { recordMailLinks } from '../../../../../browser-bridge/mail-links.mjs';
 import {
   executeBuiltinTool,
   formatUnknownBuiltinToolMessage,
@@ -56,11 +63,18 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
   // an unknown argument.
   const needsCwdInjection = cwd && mcpToolHasField(name, 'cwd', mcpScopeId) && (args == null || args.cwd == null);
   const finalArgs = needsCwdInjection ? { ...(args || {}), cwd } : args;
-  return executeMcpTool(name, finalArgs, {
+  const call = executeMcpTool(name, finalArgs, {
     signal: executeOpts.signal || null,
     ownerKey: callerSessionId,
     scopeId: mcpScopeId,
   });
+  if (!isBuiltinMailRead(name, mcpScopeId)) return call;
+  // The runtime's own record of the links in a mail it read for this session:
+  // the only way Browser Use may open a link carrying a token.
+  return call.then((result) => {
+    recordMailLinks(callerSessionId, result);
+    return result;
+  });
 }
 
 function dispatchInternal(

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -19,6 +19,7 @@ import { applyBeforeToolHook, applyConnectorApproval, applyShellElevationGate }
 import { dispatchToolCall } from './tool-exec/dispatch.mjs';
 import { applyAfterToolHook } from './tool-exec/after-hook.mjs';
 import { runReadOnlyIoWithDeadline } from './tool-exec/read-only-deadline.mjs';
+import { guardShellCall, requestedShellType } from '../../tools/builtin/bash-tool/misuse-guard.mjs';
 
 export { runReadOnlyIoWithDeadline as _runReadOnlyIoWithDeadlineForTest };
 export {
@@ -43,9 +44,23 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
   const prepared = prepareToolCall(name, args, cwd, callerSessionId, sessionRef, executeOpts);
   const { toolOpts, notifyFn, completionToolOpts } = prepared;
   const toolApprovalHook = hookFrom(executeOpts, sessionRef, 'toolApprovalHook');
+  // Shell misuse is judged before any hook or approval sees the call, so they
+  // read the command that will run and the directory it runs in.
+  let callArgs = prepared.args;
+  if (name === 'shell') {
+    const guarded = guardShellCall(callArgs, {
+      shellType: requestedShellType(callArgs),
+      agent: sessionRef?.agent || null,
+      sessionId: callerSessionId,
+      telemetry: executeOpts.resultTelemetry,
+    });
+    if (guarded.failure) return guarded.failure;
+    callArgs = guarded.args;
+    completionToolOpts.shellGuardNotes = guarded.notes;
+  }
   const hooked = await applyBeforeToolHook({
     name,
-    args: prepared.args,
+    args: callArgs,
     cwd: prepared.cwd,
     callerSessionId,
     executeOpts,

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -18,6 +18,7 @@ import { isAgentOwner } from '../../agent-owner.mjs';
 import { honoredSchemaAllowlist } from '../manager/session-tool-surface.mjs';
 import { syncSystemPrefix } from '../manager/prompt-utils.mjs';
 import { invalidateProviderContextBaseline } from './compact-policy.mjs';
+import { rebindToChangedPrefix } from '../thinking-binding.mjs';
 
 /** Drop everything measured against the previous tool surface. */
 function invalidateForToolSurfaceMigration(session) {
@@ -34,6 +35,14 @@ function invalidateForToolSurfaceMigration(session) {
  */
 export function markToolSurfaceMigrated(session, intent = TOOL_SURFACE_MIGRATION_INTENT) {
   invalidateForToolSurfaceMigration(session);
+  // The stored thinking was bound to the previous prefix and can never be
+  // replayed again (../thinking-binding.mjs); an open tool round a stopped
+  // turn left behind is ended first. Outside a turn only: a running turn sends
+  // from its own working transcript, whose latest tool round must keep its
+  // thinking.
+  if (Array.isArray(session.messages) && !Array.isArray(session.liveTurnMessages)) {
+    session.messages = rebindToChangedPrefix(session.messages);
+  }
   session.pendingCacheBreakIntent = intent;
 }
 
@@ -105,6 +114,7 @@ const AGENT_BRIDGE_FIELDS = [
   'deferredToolDeltaRevision',
   'nativeDeferredDiscovery',
   'mcpServerInstructions',
+  'mcpInstructionsAnnounced',
 ];
 
 /**