mixdog 1.3.5 → 1.4.1

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -19,7 +19,7 @@ import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
 import { workflowOverlayDenial } from '../manager/workflow-switch-notice.mjs';
 import { agentMcpToolPermission, connectorPolicyAgentOf, projectMcpToolDisabled } from '../../mcp/agent-connectors.mjs';
 
-const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'session']);
+const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'handoff_user', 'session']);
 const BRIDGE_DISCOVERY_TOOL_NAMES = new Set(['load_tool']);
 
 const IMAGE_PATH_RE = /\.(?:png|jpe?g|gif|webp)(?:$|[?#])/i;

package/src/runtime/agent/orchestrator/session/loop/provider-tool-exclusions.mjs

@@ -31,6 +31,13 @@ function exclusionsFor(sessionRef) {
 
 const isSessionRef = (value) => value !== null && typeof value === 'object';
 
+// A schema 400 drop holds for the schema rule that refused it: a route on
+// another wire family (a fallback hop, a model switch) sends the tool again.
+function droppedOnRoute(sessionRef, name) {
+  const entry = isSessionRef(sessionRef) ? sessions.get(sessionRef)?.dropped.get(String(name || '')) : null;
+  return entry && entry.family === routeSchemaFamily(sessionRef) ? entry : null;
+}
+
 /** A new provider request: exclusions describe the latest request only. */
 export function beginProviderToolExclusions(sessionRef) {
   if (isSessionRef(sessionRef)) sessions.get(sessionRef)?.current.clear();
@@ -64,15 +71,16 @@ export function providerToolExclusionReason(sessionRef, name) {
   if (!isSessionRef(sessionRef)) return null;
   const state = sessions.get(sessionRef);
   const key = String(name || '');
-  const exclusion = state?.current.get(key) || state?.dropped.get(key);
+  const exclusion = state?.current.get(key) || droppedOnRoute(sessionRef, key);
   return exclusion ? unavailableText(exclusion) : null;
 }
 
 /** The provider rejected `exclusion.name`'s schema with an HTTP 400: leave the
- *  tool out of every later request of the session and tell the user once. */
+ *  tool out of the session's later requests on this wire family and tell the
+ *  user once. */
 export function dropSessionTool(sessionRef, exclusion, onStageChange) {
   if (!isSessionRef(sessionRef)) return;
-  exclusionsFor(sessionRef).dropped.set(exclusion.name, exclusion);
+  exclusionsFor(sessionRef).dropped.set(exclusion.name, { ...exclusion, family: routeSchemaFamily(sessionRef) });
   recordProviderToolExclusion(sessionRef, exclusion, onStageChange);
 }
 
@@ -82,7 +90,7 @@ export function withoutDroppedTools(sessionRef, { sendTools, requestToolScope })
   const dropped = isSessionRef(sessionRef) ? sessions.get(sessionRef)?.dropped : null;
   if (!dropped?.size) return { sendTools, requestToolScope };
   const prefix = providerNativeToolPrefixCount(sendTools);
-  const kept = sendTools.filter((tool, index) => index < prefix || !dropped.has(tool?.name));
+  const kept = sendTools.filter((tool, index) => index < prefix || !droppedOnRoute(sessionRef, tool?.name));
   if (kept.length === sendTools.length) return { sendTools, requestToolScope };
   const next = finalizeProviderRequestTools(kept, prefix);
   return { sendTools: next, requestToolScope: { ...requestToolScope, requestTools: next } };
@@ -128,7 +136,7 @@ function schemaExclusion(session, family, tool) {
  *  tools are never excluded by the schema rule. */
 export function routeToolExclusionReason(session, tool) {
   if (!tool) return null;
-  const dropped = isSessionRef(session) ? sessions.get(session)?.dropped.get(String(tool.name || '')) : null;
+  const dropped = droppedOnRoute(session, tool.name);
   if (dropped) return unavailableText(dropped);
   const exclusion = schemaExclusion(session, routeSchemaFamily(session), tool);
   return exclusion ? unavailableText(exclusion) : null;

package/src/runtime/agent/orchestrator/session/loop/route-fallback.mjs

@@ -6,11 +6,19 @@ import { getProvider, initProviders } from '../../providers/registry.mjs';
 import { loadConfig } from '../../config.mjs';
 import { ensureProviderEnabled } from '../../runtime-core/config-helpers.mjs';
 import { updateSessionRoute } from '../manager/session-lifecycle.mjs';
+import {
+  liveRouteFallbacks,
+  nextRouteFallbackIndex,
+  routeFallbackHopped,
+  routeLeaf,
+} from '../manager/route-fallback-chain.mjs';
 import { pinSessionWireRoute } from '../../providers/wire-route.mjs';
 import { buildRequestSendOptions } from '../manager/ask-turn-loop-options.mjs';
 import { prepareTurnEffortConfiguration } from '../../providers/effort-configuration.mjs';
 import { resolveSessionContextMeta } from '../manager/context-meta.mjs';
 import { stripProviderReplayMessages } from '../manager/provider-replay.mjs';
+import { isAgentOwner } from '../../agent-owner.mjs';
+import { rebuildToolSurfaceForProviderWithMigration } from './tool-exposure-migration.mjs';
 
 // The short reason a notice gives for leaving a model, by provider kind.
 const HOP_REASONS = {
@@ -78,9 +86,13 @@ async function nextContextGrows(state, next) {
 
 export async function advanceAgentRoute(state, error) {
   const session = state.sessionRef;
-  if (!session?.agent || !session.routeFallbacks?.length) return false;
-  const index = session.routeFallbackIndex || 0;
-  const next = session.routeFallbacks[index];
+  if (!session?.agent) return false;
+  // Read from the session's settings at this hop: a chain edited while it runs
+  // applies now, and one cleared to [] leaves the provider's own error.
+  const { chain } = liveRouteFallbacks(session, loadConfig({ secrets: false }));
+  if (!chain.length) return false;
+  const index = nextRouteFallbackIndex(session, chain);
+  const next = chain[index];
   // Only THIS request must have produced nothing (its stream outcome says so):
   // earlier requests of the turn may have run tools. Their calls and results
   // are already in the live turn, which the next model continues from, so no
@@ -97,6 +109,8 @@ export async function advanceAgentRoute(state, error) {
   const provider = getProvider(next.provider);
   if (!provider) throw new Error(`Provider "${next.provider}" not available`);
   const failed = routeFailure(session, error);
+  // The route a reset returns to (setup reset_route_fallback), kept from the first hop.
+  const primary = routeFallbackHopped(session) ? session.routeFallbackPrimary : routeLeaf(session);
   // The left model's share of the turn ends here: the running total at the
   // switch bounds it, so each model's tokens are booked at its own rates.
   state.routeUsageHops = [
@@ -131,10 +145,17 @@ export async function advanceAgentRoute(state, error) {
     { crossProvider: true, session }
   );
   if (!updated) throw new Error('agent session closed during model fallback');
+  updated.routeFallbacks = chain;
+  if (primary) updated.routeFallbackPrimary = primary;
   updated.routeFallbackIndex = index + 1;
   updated.routeFallbackFailures = [...(session.routeFallbackFailures || []), failed];
   await pinSessionWireRoute(updated, provider);
   state.throwIfAborted();
+  // The route change replaced the session's tools with its whole resolved list.
+  // A delegated agent's surface was already re-applied by updateSessionRoute
+  // (applyAgentToolExposure); a Lead-class session gets its deferred surface
+  // restored for the new provider, as a manual model switch does.
+  if (!isAgentOwner(updated)) rebuildToolSurfaceForProviderWithMigration(updated, next.provider, state.messages);
   // The live turn (prompt, assistant tool calls, tool results) carries on;
   // only the previous provider's native replay state is dropped from it.
   state.messages.splice(0, state.messages.length, ...stripProviderReplayMessages(state.messages));
@@ -150,6 +171,13 @@ export async function advanceAgentRoute(state, error) {
   state.cacheBreakTraceKeys.clear();
   state.transportRetriesUsed = 0;
   state.transportRetryMax = 0;
+  // The one-shot recoveries the left model spent belong to its requests; the
+  // next model's first request gets its own (its window, images and schemas).
+  state.contextOverflowRetryUsed = false;
+  state.imageStripUsed = false;
+  state.imageStrip = null;
+  state.thinkingReplayRepairUsed = false;
+  state.toolSchemaDropUsed = false;
   for (const key of Object.keys(oldOptions)) delete state.opts[key];
   Object.assign(
     state.opts,

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -4,7 +4,12 @@
  * consume a retry verdict, and settle a completed send into the loop state.
  */
 import { traceCacheBreak } from '../../cache-break-trace.mjs';
-import { anthropicPrefixChanges } from '../../providers/lib/anthropic-prefix-trace.mjs';
+import {
+  anthropicPrefixChanges,
+  latestAnthropicPrefix,
+  persistableAnthropicPrefix,
+  seedAnthropicPrefix,
+} from '../../providers/lib/anthropic-prefix-trace.mjs';
 import { resolveLiveToolCwd } from './tool-exec.mjs';
 import { notifySkillsApplied, prepareExplicitSkills, recordAppliedSkills } from '../explicit-skills.mjs';
 import { addUsage, usageDeltaEvent } from './usage.mjs';
@@ -126,13 +131,16 @@ export async function beginIteration(state) {
     getIterations: () => state.iterations,
     getNextIteration: () => nextIteration,
     repeatFailLimit: REPEAT_FAIL_LIMIT,
+    isTurnLimitNoticed: () => state.turnLimitNoticed === true,
   });
   const resolveToolCallId = createToolCallIdResolver(messages);
   opts.onToolCall = (call) => {
     resolveToolCallId(call);
     try {
       opts.onAssistantToolCallObserved?.(call, { eagerStarted: false });
-    } catch {}
+    } catch {
+      // the tool-call observer is advisory
+    }
     return eager.onToolCall(call);
   };
   return {
@@ -173,7 +181,12 @@ export async function sendProviderRequest(state, round) {
   });
   try {
     opts.onProviderSendStarted?.();
-  } catch {}
+  } catch {
+    // the send-started observer is advisory
+  }
+  // Diagnostic only: a restarted process compares its first request with the
+  // last prefix fingerprint the session record kept (anthropic-prefix-trace.mjs).
+  seedAnthropicPrefix(sessionId, sessionRef?.providerPrefixBaseline);
   // The request a /btw side question forks: kept while it is in flight, with
   // its reply once it proceeds, and dropped again if it fails.
   const sideQuestion = captureSideQuestionRequest({
@@ -369,6 +382,10 @@ function traceActualCacheMiss(state, sent, response, { previousGuardState, previ
     );
   }
   sessionRef.lastProviderCachedPrefixTokens = cachePrefixTokens;
+  // The fingerprint of this request survives a restart on the record, so the
+  // next process's first miss can still name what moved.
+  const fingerprint = persistableAnthropicPrefix(latestAnthropicPrefix(sessionId));
+  if (fingerprint) sessionRef.providerPrefixBaseline = fingerprint;
 }
 
 /** Fold a completed send into the state: prefix guard, image-strip

package/src/runtime/agent/orchestrator/session/loop/tool-exec/after-hook.mjs

@@ -4,6 +4,7 @@
  */
 import { normalizeToolEnvelope, makeToolEnvelope } from '../../tool-envelope.mjs';
 import { resolveToolResultAfterHook } from '../tool-helpers.mjs';
+import { effectiveToolCwd } from '../../../tools/builtin/bash-tool/shell-cwd.mjs';
 
 export async function applyAfterToolHook(result, afterToolHook, { name, args, cwd, callerSessionId, toolCallId }) {
   if (typeof afterToolHook !== 'function') return result;
@@ -15,7 +16,7 @@ export async function applyAfterToolHook(result, afterToolHook, { name, args, cw
     const hookResult = await afterToolHook({
       name,
       args,
-      cwd,
+      cwd: effectiveToolCwd(name, args, cwd),
       sessionId: callerSessionId,
       toolCallId,
       result: visible,

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -15,6 +15,7 @@ import {
   recordHumanDecision,
 } from '../../human-gate/gate.mjs';
 import { applyEditedArgs } from '../../human-gate/requests.mjs';
+import { effectiveToolCwd } from '../../../tools/builtin/bash-tool/shell-cwd.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
@@ -31,7 +32,7 @@ async function askApproval(
       resolvePreToolAskApproval({
         toolName: call.name,
         args: call.args,
-        cwd: call.cwd,
+        cwd: effectiveToolCwd(call.name, call.args, call.cwd),
         sessionId: callerSessionId,
         toolCallId: executeOpts.toolCallId || null,
         askReason,
@@ -131,8 +132,8 @@ export async function applyBeforeToolHook({
   mcpScopeId = null,
 }) {
   const call = { name, args, cwd };
-  // ask_user is itself the user prompt; it never goes through the ordinary approval gate.
-  if (name === 'ask_user') return call;
+  // ask_user and handoff_user are themselves the user prompt; they never go through the ordinary approval gate.
+  if (name === 'ask_user' || name === 'handoff_user') return call;
   try {
     const hookDecision = beforeToolHook
       ? await runAbortable(executeOpts.signal, () =>
@@ -140,7 +141,7 @@ export async function applyBeforeToolHook({
             {
               name,
               args,
-              cwd,
+              cwd: effectiveToolCwd(name, args, cwd),
               sessionId: callerSessionId,
               toolCallId: executeOpts.toolCallId || null,
             },

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -3,7 +3,14 @@
  * MCP, code graph, internal tools, shell, apply_patch, built-ins and foreign
  * CLI adapters.
  */
-import { executeMcpTool, isMcpTool, isRegisteredMcpTool, mcpToolHasField } from '../../../mcp/client.mjs';
+import {
+  executeMcpTool,
+  isBuiltinMailRead,
+  isMcpTool,
+  isRegisteredMcpTool,
+  mcpToolHasField,
+} from '../../../mcp/client.mjs';
+import { recordMailLinks } from '../../../../../browser-bridge/mail-links.mjs';
 import {
   executeBuiltinTool,
   formatUnknownBuiltinToolMessage,
@@ -56,11 +63,18 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
   // an unknown argument.
   const needsCwdInjection = cwd && mcpToolHasField(name, 'cwd', mcpScopeId) && (args == null || args.cwd == null);
   const finalArgs = needsCwdInjection ? { ...(args || {}), cwd } : args;
-  return executeMcpTool(name, finalArgs, {
+  const call = executeMcpTool(name, finalArgs, {
     signal: executeOpts.signal || null,
     ownerKey: callerSessionId,
     scopeId: mcpScopeId,
   });
+  if (!isBuiltinMailRead(name, mcpScopeId)) return call;
+  // The runtime's own record of the links in a mail it read for this session:
+  // the only way Browser Use may open a link carrying a token.
+  return call.then((result) => {
+    recordMailLinks(callerSessionId, result);
+    return result;
+  });
 }
 
 function dispatchInternal(

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -19,6 +19,7 @@ import { applyBeforeToolHook, applyConnectorApproval, applyShellElevationGate }
 import { dispatchToolCall } from './tool-exec/dispatch.mjs';
 import { applyAfterToolHook } from './tool-exec/after-hook.mjs';
 import { runReadOnlyIoWithDeadline } from './tool-exec/read-only-deadline.mjs';
+import { guardShellCall, requestedShellType } from '../../tools/builtin/bash-tool/misuse-guard.mjs';
 
 export { runReadOnlyIoWithDeadline as _runReadOnlyIoWithDeadlineForTest };
 export {
@@ -43,9 +44,23 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
   const prepared = prepareToolCall(name, args, cwd, callerSessionId, sessionRef, executeOpts);
   const { toolOpts, notifyFn, completionToolOpts } = prepared;
   const toolApprovalHook = hookFrom(executeOpts, sessionRef, 'toolApprovalHook');
+  // Shell misuse is judged before any hook or approval sees the call, so they
+  // read the command that will run and the directory it runs in.
+  let callArgs = prepared.args;
+  if (name === 'shell') {
+    const guarded = guardShellCall(callArgs, {
+      shellType: requestedShellType(callArgs),
+      agent: sessionRef?.agent || null,
+      sessionId: callerSessionId,
+      telemetry: executeOpts.resultTelemetry,
+    });
+    if (guarded.failure) return guarded.failure;
+    callArgs = guarded.args;
+    completionToolOpts.shellGuardNotes = guarded.notes;
+  }
   const hooked = await applyBeforeToolHook({
     name,
-    args: prepared.args,
+    args: callArgs,
     cwd: prepared.cwd,
     callerSessionId,
     executeOpts,

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -18,6 +18,7 @@ import { isAgentOwner } from '../../agent-owner.mjs';
 import { honoredSchemaAllowlist } from '../manager/session-tool-surface.mjs';
 import { syncSystemPrefix } from '../manager/prompt-utils.mjs';
 import { invalidateProviderContextBaseline } from './compact-policy.mjs';
+import { rebindToChangedPrefix } from '../thinking-binding.mjs';
 
 /** Drop everything measured against the previous tool surface. */
 function invalidateForToolSurfaceMigration(session) {
@@ -34,15 +35,55 @@ function invalidateForToolSurfaceMigration(session) {
  */
 export function markToolSurfaceMigrated(session, intent = TOOL_SURFACE_MIGRATION_INTENT) {
   invalidateForToolSurfaceMigration(session);
+  // The stored thinking was bound to the previous prefix and can never be
+  // replayed again (../thinking-binding.mjs); an open tool round a stopped
+  // turn left behind is ended first. Outside a turn only: a running turn sends
+  // from its own working transcript, whose latest tool round must keep its
+  // thinking.
+  if (Array.isArray(session.messages) && !Array.isArray(session.liveTurnMessages)) {
+    session.messages = rebindToChangedPrefix(session.messages);
+  }
   session.pendingCacheBreakIntent = intent;
 }
 
-/** Provider switch: rebuild the surface for `provider`, migrating bridge ↔ native. */
-export function rebuildToolSurfaceForProviderWithMigration(session, provider) {
+/**
+ * Run `apply` with `messages` (the transcript a running turn works on) as the
+ * session's messages, so a fixed-guidance rewrite lands there; the canonical
+ * transcript takes the rewritten system prefix. Without `messages`, `apply`
+ * runs on the session's own. `apply` runs synchronously.
+ */
+function applyOnWorkingMessages(session, messages, apply) {
+  const stored = session.messages;
+  const working = Array.isArray(messages) ? messages : stored;
+  if (Array.isArray(working)) session.messages = working;
+  try {
+    apply();
+  } finally {
+    if (Array.isArray(working) && session.messages !== working) {
+      // The rewrite may drop an emptied system message: keep the array
+      // identity the request loop holds.
+      working.splice(0, working.length, ...session.messages);
+    }
+    session.messages = stored;
+  }
+  // The rewritten prompt messages are fresh objects; the canonical transcript
+  // the save path persists takes them too, so the next save writes the new
+  // prompt together with the new exposure.
+  if (Array.isArray(stored) && Array.isArray(working) && stored !== working) syncSystemPrefix(stored, working);
+}
+
+/**
+ * Provider switch: rebuild the surface for `provider`, migrating bridge ↔
+ * native. `messages`: the running turn's transcript, when a switch happens
+ * mid-turn (a route fallback hop).
+ */
+export function rebuildToolSurfaceForProviderWithMigration(session, provider, messages) {
   if (!session) return false;
   const migrating = toolExposureMigrationNeeded(session, provider);
-  rebuildDeferredToolSurfaceForProvider(session, provider);
-  if (migrating) markToolSurfaceMigrated(session);
+  applyOnWorkingMessages(session, messages, () => {
+    rebuildDeferredToolSurfaceForProvider(session, provider);
+    if (migrating) markToolSurfaceMigrated(session);
+  });
   return migrating;
 }
 
@@ -66,26 +107,12 @@ function hasUnansweredToolCalls(messages) {
  */
 export function migrateToolExposureAtBoundary(session, messages) {
   if (!session || !toolExposureMigrationNeeded(session) || hasUnansweredToolCalls(messages)) return false;
-  const stored = session.messages;
-  const working = Array.isArray(messages) ? messages : stored;
-  if (Array.isArray(working)) session.messages = working;
-  try {
+  applyOnWorkingMessages(session, messages, () =>
     applyDeferredToolSurface(session, session.deferredSurfaceMode || 'lead', [], {
       provider: session.provider,
       model: session.model,
-    });
-  } finally {
-    if (Array.isArray(working) && session.messages !== working) {
-      // The rewrite may drop an emptied system message: keep the request
-      // transcript array identity the loop holds.
-      working.splice(0, working.length, ...session.messages);
-    }
-    session.messages = stored;
-  }
-  // The rewritten prompt messages are fresh objects; the canonical transcript
-  // the save path persists takes them too, so the next save writes the new
-  // prompt together with the new exposure.
-  if (Array.isArray(stored) && Array.isArray(working) && stored !== working) syncSystemPrefix(stored, working);
+    })
+  );
   invalidateForToolSurfaceMigration(session);
   return true;
 }
@@ -105,6 +132,7 @@ const AGENT_BRIDGE_FIELDS = [
   'deferredToolDeltaRevision',
   'nativeDeferredDiscovery',
   'mcpServerInstructions',
+  'mcpInstructionsAnnounced',
 ];
 
 /**

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -12,10 +12,7 @@ import {
   loadSkillResource,
   buildSkillToolEnvelope,
   filterSkillsExcludingDisabled,
-  isSkillDisabled,
-  skillMissingFeature,
-  skillOutsideScope,
-  skillOutsideScopeError,
+  skillLoadRefusal,
 } from '../../context/collect.mjs';
 
 // Eager-dispatch: tools with readOnlyHint:true in their declaration are safe
@@ -95,12 +92,8 @@ export function buildSkillsListResponse(cwd) {
 export function viewSkill(cwd, name, session = null) {
   const skillName = String(name || '').trim();
   if (!skillName) return 'Error: skill name is required';
-  const missingFeature = skillMissingFeature(skillName);
-  if (missingFeature) {
-    return `Error: skill "${skillName}" needs the ${missingFeature} built-in feature, which is not installed or is switched off in Extensions → Plugin → Built-in`;
-  }
-  if (isSkillDisabled(skillName)) return `Error: skill "${skillName}" is disabled`;
-  if (skillOutsideScope(skillName, cwd)) return skillOutsideScopeError(skillName);
+  const refusal = skillLoadRefusal(skillName, cwd);
+  if (refusal) return refusal;
   const res = loadSkillResource(skillName, cwd);
   if (!res) return `Error: skill "${skillName}" not found`;
   // Return the general tool envelope: the model-visible tool_result is the

package/src/runtime/agent/orchestrator/session/loop/tool-phase.mjs

@@ -9,6 +9,7 @@ import { processToolBatch } from '../tool-batch.mjs';
 import { CROSS_TURN_CAP, REPEAT_FAIL_LIMIT } from './loop-state.mjs';
 import { markStepEffort } from './step-auto-effort.mjs';
 import { resolveExecutionToolCalls } from './tool-call-resolution.mjs';
+import { rememberSensitiveValues } from '../sensitive-values.mjs';
 import { callsAllowed, settleTurnLimits, turnLimitsOf } from './turn-limits.mjs';
 
 function isSleepLikeToolCall(call) {
@@ -41,13 +42,19 @@ export async function runToolPhase(state, round, sent, onToolCall) {
   // derive the multi-tool adoption ratio without scanning message bodies.
   // Audit records what runs: a bridged call_tool is recorded as its target.
   // The wire calls stay the transcript identity (assistant turn below).
-  const toolBatchId = recordToolBatch(sessionId, resolveExecutionToolCalls(calls, sessionRef), state.iterations);
+  const executionCalls = resolveExecutionToolCalls(calls, sessionRef);
+  const toolBatchId = recordToolBatch(sessionId, executionCalls, state.iterations);
+  // A sensitive fill (a verification code): every stored copy of the
+  // transcript keeps a marker instead of the value; the call runs as is.
+  rememberSensitiveValues(sessionId, executionCalls);
   await Promise.resolve(onToolCall?.(state.iterations, calls));
   const assistantTurnMsg = buildToolCallAssistantMessage(response, { calls, opts });
   commitAssistantMessage(messages, assistantTurnMsg, opts);
   try {
     opts.onToolPhaseStarted?.();
-  } catch {}
+  } catch {
+    // the tool-phase-started observer is advisory
+  }
   const toolsT0 = Date.now();
   const resultsFrom = messages.length;
   ({ dedupStubTotal: state.dedupStubTotal, editCount: state.editCount } = await processToolBatch({
@@ -90,7 +97,9 @@ export async function runToolPhase(state, round, sent, onToolCall) {
       calls: calls.length,
       elapsedMs: toolsEndedAt - toolsT0,
     });
-  } catch {}
+  } catch {
+    // the tool-phase-completed observer is advisory
+  }
   traceLoopPhaseTiming({
     iteration: round.nextIteration,
     preSendMs: sent.preSendMs,

package/src/runtime/agent/orchestrator/session/manager/ask-queue.mjs

@@ -9,6 +9,7 @@ import {
   drainPendingMessages,
   releasePendingMessages,
 } from './pending-messages.mjs';
+import { promptOriginOf } from '../../../../shared/prompt-origin.mjs';
 
 const SYNTHETIC_PROMPT_SOURCES = ['goal-continuation', 'goal-closeout'];
 
@@ -35,6 +36,7 @@ const tailTurnFor = (group) => ({
   content: group.content,
   entries: group.entries,
   ...(group.hop ? { hop: group.hop } : {}),
+  ...(group.origin ? { origin: group.origin } : {}),
   ...(group.mode === PENDING_MODE_TASK_NOTIFICATION
     ? promptSourceFields(PENDING_MODE_TASK_NOTIFICATION, group.execution)
     : {}),
@@ -49,13 +51,19 @@ const queuedTurnInput = (tailTurn) => ({
   pendingEntries: tailTurn.entries,
   ...(tailTurn.hop ? { hop: tailTurn.hop } : {}),
   promptSource: promptSourceFields(tailTurn.source, tailTurn.execution),
+  ...(tailTurn.origin ? { promptOrigin: tailTurn.origin } : {}),
 });
 
-export function createAskPromptQueue({ sessionId, promptSource }) {
+// The caller's provenance of its initial prompt, apart from its presentation
+// source: an inbound channel message or an agent report (shared/prompt-origin.mjs).
+const initialPromptOriginFor = (promptOrigin) => promptOriginOf(promptOrigin);
+
+export function createAskPromptQueue({ sessionId, promptSource, promptOrigin }) {
   // Local FIFO of follow-up prompts drained from the pending-message queue
   // after each turn — keeps queued `agent type=send` messages in order.
   const tail = [];
   let initialPromptSource = initialPromptSourceFor(promptSource);
+  let initialPromptOrigin = initialPromptOriginFor(promptOrigin);
   // Queue entries of the input nextTurn handed out that no turn owns yet.
   // Once a turn starts, its failure path acks or releases them instead.
   let unstartedEntries = [];
@@ -67,13 +75,15 @@ export function createAskPromptQueue({ sessionId, promptSource }) {
    *  and provenance — or null when nothing model-visible is left to run. */
   const nextTurn = (original) => {
     const source = initialPromptSource;
+    const origin = initialPromptOrigin;
     initialPromptSource = null;
+    initialPromptOrigin = null;
     let input;
     if (tail.length > 0) {
       // After the first turn, the next prompt comes from the drained queue.
       input = queuedTurnInput(tail.shift());
     } else if (hasModelVisiblePromptContent(original.prompt)) {
-      input = { ...original, pendingEntries: [], promptSource: source };
+      input = { ...original, pendingEntries: [], promptSource: source, ...(origin ? { promptOrigin: origin } : {}) };
     } else {
       // Idle resume: TUI kicks an empty ask() after execution completions
       // mirror model-visible bodies into session pending. Drain that queue

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -19,6 +19,7 @@ import { armTurnDurability, claimTurnRuntime } from './ask-turn-open.mjs';
 import { prepareAskTurn, runAskAgentLoop } from './ask-turn-execute.mjs';
 import { commitAskTurn, publishAskTurn } from './ask-turn-settle.mjs';
 import { finalizeAskTurnFailure } from './ask-turn-failure.mjs';
+import { cacheWarmTurnKind, endCacheWarmTurn, failedTurnProvenance, noteCacheWarmTurn } from '../cache-warm.mjs';
 
 export { _api_call_with_interrupt } from './ask-call-interrupt.mjs';
 export {
@@ -168,7 +169,14 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
   // return value (the queued tail turns supersede the original prompt's
   // result, mirroring how a live chat returns the latest turn).
   let result;
-  const queue = createAskPromptQueue({ sessionId, promptSource: askOpts.promptSource });
+  const queue = createAskPromptQueue({
+    sessionId,
+    promptSource: askOpts.promptSource,
+    promptOrigin: askOpts.promptOrigin,
+  });
+  // The turn the prompt-cache warmer is told about last; it forgets it when
+  // the turn ends (endCacheWarmTurn), whatever way the ask unwinds.
+  let warmTurn = null;
   // Hoisted so the outer finally (which runs once after the whole turn loop)
   // can compare against the last turn's generation.
   let askGeneration = 0;
@@ -213,6 +221,12 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         recoverCheckpoint: !crashRecoveryChecked,
         emitStart: !sessionStartEmitted,
       });
+      // The prompt-cache warmer learns idle gaps from real turns only; a
+      // retry is classified by the failed turn's stored provenance.
+      // The rebuilt retry message keeps that provenance (ask-turn-execute.mjs).
+      const retryProvenance = failedTurnProvenance(claimed.preSession?.messages, input);
+      if (retryProvenance) input.retryProvenance = retryProvenance;
+      warmTurn = noteCacheWarmTurn(sessionId, cacheWarmTurnKind(input, claimed.preSession?.messages));
       crashRecoveryChecked = true;
       sessionStartEmitted = true;
       askGeneration = claimed.askGeneration;
@@ -234,6 +248,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         askStartedAt,
       });
       result = turn.result;
+      endCacheWarmTurn(sessionId, warmTurn);
       // Turn complete. Drain the pending-message queue: any `agent type=send`
       // that arrived while this turn was in flight runs next, in order, as a
       // follow-up user turn. The mutex is still held, so a send racing this
@@ -264,6 +279,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
       return result;
     }
   } finally {
+    // A failed/cancelled turn ends here too: its warmer turn entry goes (a
+    // later ask's own turn is never removed by this one).
+    endCacheWarmTurn(sessionId, warmTurn);
     // A failed/cancelled turn ends the ask: the follow-up turns drained
     // behind it never ran, so their entries go back to the pending queue.
     queue.releaseUnstarted();