mixdog 1.4.0 → 1.4.2

package/src/runtime/agent/orchestrator/session/loop/fresh-context.mjs

@@ -278,14 +278,21 @@ function currentSkillResolver(sessionRef, { preview = false } = {}) {
   return (name) => {
     const delivery = currentSkillDelivery(name, cwd, config, skills);
     if (!delivery) return null;
-    if (preview) return { body: delivery.body, native: undefined };
     const { resource } = delivery;
+    // The tools whose use counts as use of the skill: its tool dependencies,
+    // an MCP server as `mcp:<server>`.
+    const tools = (resource.toolDependencies || []).flatMap(({ type, value }) => {
+      if (type === 'tool') return [value];
+      if (type === 'mcp') return [`mcp:${value}`];
+      return [];
+    });
+    if (preview) return { body: delivery.body, native: undefined, tools };
     const envelope = loadSkillToolDependencies(
       buildSkillToolEnvelope(name, resource.content, resource.dir, resource),
       sessionRef
     );
     const native = parseNativeToolSearchPayload('Skill', envelope.result);
-    return { body: delivery.body, native, summary: native?.summary ?? envelope.result };
+    return { body: delivery.body, native, summary: native?.summary ?? envelope.result, tools };
   };
 }
 

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -19,7 +19,7 @@ import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
 import { workflowOverlayDenial } from '../manager/workflow-switch-notice.mjs';
 import { agentMcpToolPermission, connectorPolicyAgentOf, projectMcpToolDisabled } from '../../mcp/agent-connectors.mjs';
 
-const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'session']);
+const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'handoff_user', 'session']);
 const BRIDGE_DISCOVERY_TOOL_NAMES = new Set(['load_tool']);
 
 const IMAGE_PATH_RE = /\.(?:png|jpe?g|gif|webp)(?:$|[?#])/i;

package/src/runtime/agent/orchestrator/session/loop/provider-tool-exclusions.mjs

@@ -31,6 +31,13 @@ function exclusionsFor(sessionRef) {
 
 const isSessionRef = (value) => value !== null && typeof value === 'object';
 
+// A schema 400 drop holds for the schema rule that refused it: a route on
+// another wire family (a fallback hop, a model switch) sends the tool again.
+function droppedOnRoute(sessionRef, name) {
+  const entry = isSessionRef(sessionRef) ? sessions.get(sessionRef)?.dropped.get(String(name || '')) : null;
+  return entry && entry.family === routeSchemaFamily(sessionRef) ? entry : null;
+}
+
 /** A new provider request: exclusions describe the latest request only. */
 export function beginProviderToolExclusions(sessionRef) {
   if (isSessionRef(sessionRef)) sessions.get(sessionRef)?.current.clear();
@@ -64,15 +71,16 @@ export function providerToolExclusionReason(sessionRef, name) {
   if (!isSessionRef(sessionRef)) return null;
   const state = sessions.get(sessionRef);
   const key = String(name || '');
-  const exclusion = state?.current.get(key) || state?.dropped.get(key);
+  const exclusion = state?.current.get(key) || droppedOnRoute(sessionRef, key);
   return exclusion ? unavailableText(exclusion) : null;
 }
 
 /** The provider rejected `exclusion.name`'s schema with an HTTP 400: leave the
- *  tool out of every later request of the session and tell the user once. */
+ *  tool out of the session's later requests on this wire family and tell the
+ *  user once. */
 export function dropSessionTool(sessionRef, exclusion, onStageChange) {
   if (!isSessionRef(sessionRef)) return;
-  exclusionsFor(sessionRef).dropped.set(exclusion.name, exclusion);
+  exclusionsFor(sessionRef).dropped.set(exclusion.name, { ...exclusion, family: routeSchemaFamily(sessionRef) });
   recordProviderToolExclusion(sessionRef, exclusion, onStageChange);
 }
 
@@ -82,7 +90,7 @@ export function withoutDroppedTools(sessionRef, { sendTools, requestToolScope })
   const dropped = isSessionRef(sessionRef) ? sessions.get(sessionRef)?.dropped : null;
   if (!dropped?.size) return { sendTools, requestToolScope };
   const prefix = providerNativeToolPrefixCount(sendTools);
-  const kept = sendTools.filter((tool, index) => index < prefix || !dropped.has(tool?.name));
+  const kept = sendTools.filter((tool, index) => index < prefix || !droppedOnRoute(sessionRef, tool?.name));
   if (kept.length === sendTools.length) return { sendTools, requestToolScope };
   const next = finalizeProviderRequestTools(kept, prefix);
   return { sendTools: next, requestToolScope: { ...requestToolScope, requestTools: next } };
@@ -128,7 +136,7 @@ function schemaExclusion(session, family, tool) {
  *  tools are never excluded by the schema rule. */
 export function routeToolExclusionReason(session, tool) {
   if (!tool) return null;
-  const dropped = isSessionRef(session) ? sessions.get(session)?.dropped.get(String(tool.name || '')) : null;
+  const dropped = droppedOnRoute(session, tool.name);
   if (dropped) return unavailableText(dropped);
   const exclusion = schemaExclusion(session, routeSchemaFamily(session), tool);
   return exclusion ? unavailableText(exclusion) : null;

package/src/runtime/agent/orchestrator/session/loop/route-fallback.mjs

@@ -17,6 +17,8 @@ import { buildRequestSendOptions } from '../manager/ask-turn-loop-options.mjs';
 import { prepareTurnEffortConfiguration } from '../../providers/effort-configuration.mjs';
 import { resolveSessionContextMeta } from '../manager/context-meta.mjs';
 import { stripProviderReplayMessages } from '../manager/provider-replay.mjs';
+import { isAgentOwner } from '../../agent-owner.mjs';
+import { rebuildToolSurfaceForProviderWithMigration } from './tool-exposure-migration.mjs';
 
 // The short reason a notice gives for leaving a model, by provider kind.
 const HOP_REASONS = {
@@ -149,6 +151,11 @@ export async function advanceAgentRoute(state, error) {
   updated.routeFallbackFailures = [...(session.routeFallbackFailures || []), failed];
   await pinSessionWireRoute(updated, provider);
   state.throwIfAborted();
+  // The route change replaced the session's tools with its whole resolved list.
+  // A delegated agent's surface was already re-applied by updateSessionRoute
+  // (applyAgentToolExposure); a Lead-class session gets its deferred surface
+  // restored for the new provider, as a manual model switch does.
+  if (!isAgentOwner(updated)) rebuildToolSurfaceForProviderWithMigration(updated, next.provider, state.messages);
   // The live turn (prompt, assistant tool calls, tool results) carries on;
   // only the previous provider's native replay state is dropped from it.
   state.messages.splice(0, state.messages.length, ...stripProviderReplayMessages(state.messages));
@@ -164,6 +171,13 @@ export async function advanceAgentRoute(state, error) {
   state.cacheBreakTraceKeys.clear();
   state.transportRetriesUsed = 0;
   state.transportRetryMax = 0;
+  // The one-shot recoveries the left model spent belong to its requests; the
+  // next model's first request gets its own (its window, images and schemas).
+  state.contextOverflowRetryUsed = false;
+  state.imageStripUsed = false;
+  state.imageStrip = null;
+  state.thinkingReplayRepairUsed = false;
+  state.toolSchemaDropUsed = false;
   for (const key of Object.keys(oldOptions)) delete state.opts[key];
   Object.assign(
     state.opts,

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -4,7 +4,12 @@
  * consume a retry verdict, and settle a completed send into the loop state.
  */
 import { traceCacheBreak } from '../../cache-break-trace.mjs';
-import { anthropicPrefixChanges } from '../../providers/lib/anthropic-prefix-trace.mjs';
+import {
+  anthropicPrefixChanges,
+  latestAnthropicPrefix,
+  persistableAnthropicPrefix,
+  seedAnthropicPrefix,
+} from '../../providers/lib/anthropic-prefix-trace.mjs';
 import { resolveLiveToolCwd } from './tool-exec.mjs';
 import { notifySkillsApplied, prepareExplicitSkills, recordAppliedSkills } from '../explicit-skills.mjs';
 import { addUsage, usageDeltaEvent } from './usage.mjs';
@@ -179,6 +184,9 @@ export async function sendProviderRequest(state, round) {
   } catch {
     // the send-started observer is advisory
   }
+  // Diagnostic only: a restarted process compares its first request with the
+  // last prefix fingerprint the session record kept (anthropic-prefix-trace.mjs).
+  seedAnthropicPrefix(sessionId, sessionRef?.providerPrefixBaseline);
   // The request a /btw side question forks: kept while it is in flight, with
   // its reply once it proceeds, and dropped again if it fails.
   const sideQuestion = captureSideQuestionRequest({
@@ -374,6 +382,10 @@ function traceActualCacheMiss(state, sent, response, { previousGuardState, previ
     );
   }
   sessionRef.lastProviderCachedPrefixTokens = cachePrefixTokens;
+  // The fingerprint of this request survives a restart on the record, so the
+  // next process's first miss can still name what moved.
+  const fingerprint = persistableAnthropicPrefix(latestAnthropicPrefix(sessionId));
+  if (fingerprint) sessionRef.providerPrefixBaseline = fingerprint;
 }
 
 /** Fold a completed send into the state: prefix guard, image-strip

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -21,9 +21,20 @@ const isArgsObject = (value) => value && typeof value === 'object' && !Array.isA
 
 async function askApproval(
   call,
-  { callerSessionId, executeOpts, toolApprovalHook, decision, request = null, gate = null, onApproved = null }
+  {
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+    decision,
+    request = null,
+    gate = null,
+    onApproved = null,
+    account = '',
+  }
 ) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
+  // The connector account the call is bound to rides on the card.
+  if (account) request = { ...(request || {}), account };
   // While the user decides, the session is waiting on them, not working.
   const releaseApprovalWait = beginSessionApprovalWait(callerSessionId);
   let askOutcome;
@@ -72,9 +83,13 @@ export const CONNECTOR_APPROVAL_REASON = 'This connector tool is set to ask befo
  * remembered outbound grant answered it) is not asked a second time. With the
  * "Allow all actions" developer option on, `needs_approval` is not asked
  * either (a payment or permanent delete was asked by the outbound gate above).
+ * `account` is the connector account the call is bound to, for the card.
  * @returns {Promise<{ denial: string } | null>} the denial, or null to run
  */
-export function applyConnectorApproval(call, { agentId, callerSessionId, executeOpts, toolApprovalHook }) {
+export function applyConnectorApproval(
+  call,
+  { agentId, callerSessionId, executeOpts, toolApprovalHook, account = '' }
+) {
   if (call.outboundApproved) return null;
   if (!actingBotId(callerSessionId)) return null;
   if (agentMcpToolPermission(agentId, call.name) !== 'needs_approval') return null;
@@ -89,6 +104,7 @@ export function applyConnectorApproval(call, { agentId, callerSessionId, execute
     toolApprovalHook,
     decision: { reason: CONNECTOR_APPROVAL_REASON },
     request: rememberable ? { kind: 'approval', agentId: botId, remember: ['once', 'agent'] } : null,
+    account,
     onApproved: async (approval) => {
       if (!rememberable || approval?.remember !== 'agent') return;
       try {
@@ -130,10 +146,11 @@ export async function applyBeforeToolHook({
   beforeToolHook,
   toolApprovalHook,
   mcpScopeId = null,
+  account = '',
 }) {
   const call = { name, args, cwd };
-  // ask_user is itself the user prompt; it never goes through the ordinary approval gate.
-  if (name === 'ask_user') return call;
+  // ask_user and handoff_user are themselves the user prompt; they never go through the ordinary approval gate.
+  if (name === 'ask_user' || name === 'handoff_user') return call;
   try {
     const hookDecision = beforeToolHook
       ? await runAbortable(executeOpts.signal, () =>
@@ -183,6 +200,8 @@ export async function applyBeforeToolHook({
         decision,
         request,
         gate,
+        // Only while the call is still the one bound to it.
+        account: call.name === name ? account : '',
       });
       if (denied) return denied;
     }

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -67,6 +67,8 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
     signal: executeOpts.signal || null,
     ownerKey: callerSessionId,
     scopeId: mcpScopeId,
+    // A connector account defaults to (and becomes) this conversation's last used.
+    conversation: callerSessionId,
   });
   if (!isBuiltinMailRead(name, mcpScopeId)) return call;
   // The runtime's own record of the links in a mail it read for this session:

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -5,7 +5,7 @@
 //   tool-exec/dispatch.mjs           — executor per tool family
 //   tool-exec/after-hook.mjs         — PostToolUse result override
 //   tool-exec/read-only-deadline.mjs — bounded read-only I/O with partial-output grace
-import { isMcpTool } from '../../mcp/client.mjs';
+import { isMcpTool, resolveMcpToolAccount } from '../../mcp/client.mjs';
 import { connectorPolicyAgentOf } from '../../mcp/agent-connectors.mjs';
 import { prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
 import { refreshDeferredMcpToolCatalog } from '../../runtime-core/tool-catalog.mjs';
@@ -58,6 +58,24 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     callArgs = guarded.args;
     completionToolOpts.shellGuardNotes = guarded.notes;
   }
+  // A connector call is bound to its account before any hook or card sees it,
+  // so an approval approves that account, whatever is used last meanwhile.
+  // It is bound by its unique name; `account` is its label, for display.
+  let bound = '';
+  let account = '';
+  if (isMcpTool(name)) {
+    try {
+      const chosen = resolveMcpToolAccount(name, callArgs, {
+        scopeId: sessionRef?.mcpScopeId || null,
+        conversation: callerSessionId,
+      });
+      bound = chosen?.name || '';
+      account = chosen?.label || '';
+    } catch (error) {
+      return `Error: ${error?.message || String(error)}`;
+    }
+    if (bound) callArgs = { ...callArgs, account: bound };
+  }
   const hooked = await applyBeforeToolHook({
     name,
     args: callArgs,
@@ -67,6 +85,7 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     beforeToolHook: hookFrom(executeOpts, sessionRef, 'beforeToolHook'),
     toolApprovalHook,
     mcpScopeId: sessionRef?.mcpScopeId || null,
+    account,
   });
   if (hooked.denial) return hooked.denial;
   const connectorDenied = await applyConnectorApproval(hooked, {
@@ -74,8 +93,11 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     callerSessionId,
     executeOpts,
     toolApprovalHook,
+    account: hooked.name === name ? account : '',
   });
   if (connectorDenied) return connectorDenied.denial;
+  // A hook's rewrite of the same tool keeps the bound account.
+  if (bound && hooked.name === name) hooked.args = { ...hooked.args, account: bound };
   // A decision can settle after its turn was cancelled. It must never
   // authorize a new mutation, even if the hook ignores the abort signal.
   throwIfAborted(executeOpts.signal);

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -46,12 +46,44 @@ export function markToolSurfaceMigrated(session, intent = TOOL_SURFACE_MIGRATION
   session.pendingCacheBreakIntent = intent;
 }
 
-/** Provider switch: rebuild the surface for `provider`, migrating bridge ↔ native. */
-export function rebuildToolSurfaceForProviderWithMigration(session, provider) {
+/**
+ * Run `apply` with `messages` (the transcript a running turn works on) as the
+ * session's messages, so a fixed-guidance rewrite lands there; the canonical
+ * transcript takes the rewritten system prefix. Without `messages`, `apply`
+ * runs on the session's own. `apply` runs synchronously.
+ */
+function applyOnWorkingMessages(session, messages, apply) {
+  const stored = session.messages;
+  const working = Array.isArray(messages) ? messages : stored;
+  if (Array.isArray(working)) session.messages = working;
+  try {
+    apply();
+  } finally {
+    if (Array.isArray(working) && session.messages !== working) {
+      // The rewrite may drop an emptied system message: keep the array
+      // identity the request loop holds.
+      working.splice(0, working.length, ...session.messages);
+    }
+    session.messages = stored;
+  }
+  // The rewritten prompt messages are fresh objects; the canonical transcript
+  // the save path persists takes them too, so the next save writes the new
+  // prompt together with the new exposure.
+  if (Array.isArray(stored) && Array.isArray(working) && stored !== working) syncSystemPrefix(stored, working);
+}
+
+/**
+ * Provider switch: rebuild the surface for `provider`, migrating bridge ↔
+ * native. `messages`: the running turn's transcript, when a switch happens
+ * mid-turn (a route fallback hop).
+ */
+export function rebuildToolSurfaceForProviderWithMigration(session, provider, messages) {
   if (!session) return false;
   const migrating = toolExposureMigrationNeeded(session, provider);
-  rebuildDeferredToolSurfaceForProvider(session, provider);
-  if (migrating) markToolSurfaceMigrated(session);
+  applyOnWorkingMessages(session, messages, () => {
+    rebuildDeferredToolSurfaceForProvider(session, provider);
+    if (migrating) markToolSurfaceMigrated(session);
+  });
   return migrating;
 }
 
@@ -75,26 +107,12 @@ function hasUnansweredToolCalls(messages) {
  */
 export function migrateToolExposureAtBoundary(session, messages) {
   if (!session || !toolExposureMigrationNeeded(session) || hasUnansweredToolCalls(messages)) return false;
-  const stored = session.messages;
-  const working = Array.isArray(messages) ? messages : stored;
-  if (Array.isArray(working)) session.messages = working;
-  try {
+  applyOnWorkingMessages(session, messages, () =>
     applyDeferredToolSurface(session, session.deferredSurfaceMode || 'lead', [], {
       provider: session.provider,
       model: session.model,
-    });
-  } finally {
-    if (Array.isArray(working) && session.messages !== working) {
-      // The rewrite may drop an emptied system message: keep the request
-      // transcript array identity the loop holds.
-      working.splice(0, working.length, ...session.messages);
-    }
-    session.messages = stored;
-  }
-  // The rewritten prompt messages are fresh objects; the canonical transcript
-  // the save path persists takes them too, so the next save writes the new
-  // prompt together with the new exposure.
-  if (Array.isArray(stored) && Array.isArray(working) && stored !== working) syncSystemPrefix(stored, working);
+    })
+  );
   invalidateForToolSurfaceMigration(session);
   return true;
 }

package/src/runtime/agent/orchestrator/session/loop/turn-limits.mjs

@@ -1,12 +1,14 @@
 /**
  * turn-limits.mjs — a turn's caps (sendOpts.turnLimits; a heartbeat turn's,
- * manager/ask-turn-loop-options.mjs): `maxToolCalls` tool calls and
- * `wrapUpAt` (epoch ms). A call past the cap, or one made after the wrap-up
- * time, is answered without running. Once a cap is reached the model is told
- * to reply, and every later request of the turn forbids tool use
- * (toolChoice 'none'). A response that still calls tools after that ends the
- * turn with no reply, its calls answered unrun. A capped turn runs no call
- * eagerly (eager-dispatch.mjs), so none past the cap starts while streaming.
+ * manager/ask-turn-loop-options.mjs): `maxToolCalls` tool calls,
+ * `wrapUpAt` (epoch ms) and `maxToolRounds` tool-calling responses (an
+ * explorer's, runtime/explore/explorer.mjs). A call past the cap, or one made
+ * after the wrap-up time, is answered without running. Once a cap is reached
+ * the model is told to reply, and every later request of the turn forbids
+ * tool use (toolChoice 'none'). A response that still calls tools after that
+ * ends the turn with no reply, its calls answered unrun. A turn capped by
+ * calls or time runs no call eagerly (eager-dispatch.mjs), so none past the
+ * cap starts while streaming; a round cap cuts only between rounds.
  */
 
 const NOTICE =
@@ -21,6 +23,8 @@ export function turnLimitsOf(opts) {
   return {
     maxToolCalls: Number.isInteger(limits.maxToolCalls) && limits.maxToolCalls >= 0 ? limits.maxToolCalls : Infinity,
     wrapUpAt: Number.isFinite(limits.wrapUpAt) ? limits.wrapUpAt : Infinity,
+    maxToolRounds:
+      Number.isInteger(limits.maxToolRounds) && limits.maxToolRounds >= 0 ? limits.maxToolRounds : Infinity,
   };
 }
 
@@ -49,7 +53,8 @@ export function settleTurnLimits(state, overrun, now = Date.now()) {
   }
   const limits = turnLimitsOf(state.opts);
   if (!limits || state.turnLimitNoticed) return;
-  if (state.toolCallsTotal < limits.maxToolCalls && now < limits.wrapUpAt) return;
+  if (state.toolCallsTotal < limits.maxToolCalls && now < limits.wrapUpAt && state.iterations < limits.maxToolRounds)
+    return;
   state.turnLimitNoticed = true;
   state.messages.push({ role: 'user', content: NOTICE, meta: { source: 'turn-limit' } });
 }

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -19,6 +19,7 @@ import { armTurnDurability, claimTurnRuntime } from './ask-turn-open.mjs';
 import { prepareAskTurn, runAskAgentLoop } from './ask-turn-execute.mjs';
 import { commitAskTurn, publishAskTurn } from './ask-turn-settle.mjs';
 import { finalizeAskTurnFailure } from './ask-turn-failure.mjs';
+import { armTurnTimeoutOnProviderError, reapTurnShellJobs } from './turn-reap.mjs';
 import { cacheWarmTurnKind, endCacheWarmTurn, failedTurnProvenance, noteCacheWarmTurn } from '../cache-warm.mjs';
 
 export { _api_call_with_interrupt } from './ask-call-interrupt.mjs';
@@ -125,6 +126,9 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
     });
     return { result: terminalResultPreview, drained };
   } catch (err) {
+    // The turn's terminal error: a provider timeout/stall that ended it (a
+    // retry the turn recovered from never reaches here) stops its shell work.
+    armTurnTimeoutOnProviderError(sessionId, opened.runtime, opened.turnSignal, err);
     await finalizeAskTurnFailure({
       sessionId,
       err,
@@ -138,12 +142,49 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       transcriptMeta: transcript.raw,
       askStartedAt,
     });
+    reapTurnShellJobs(sessionId, opened.runtime);
     throw err;
   } finally {
-    releaseWorkspace?.();
+    // The result is already published; this only holds the session lock until
+    // the reader lease is removed, so the next turn's admission follows it. A
+    // failed release (the admission thread stopped) never replaces the turn's
+    // own outcome.
+    try {
+      await releaseWorkspace?.();
+    } catch {
+      // Intentionally ignored: see the comment above.
+    }
   }
 }
 
+/** The prompt-cache warmer learns idle gaps from real turns only; a retry is
+ *  classified by the failed turn's stored provenance. The rebuilt retry
+ *  message keeps that provenance (ask-turn-execute.mjs). Returns the warmer's
+ *  turn handle. */
+function noteTurnForCacheWarm(sessionId, claimed, input) {
+  const retryProvenance = failedTurnProvenance(claimed.preSession?.messages, input);
+  if (retryProvenance) input.retryProvenance = retryProvenance;
+  return noteCacheWarmTurn(sessionId, cacheWarmTurnKind(input, claimed.preSession?.messages));
+}
+
+/** Clear the controller only if it's still ours (closeSession may have
+ *  swapped it). The rest of the runtime entry stays intact so agent type=list
+ *  can still surface the final stage (done/error/cancelling). */
+function detachAskRuntime(sessionId, askGeneration) {
+  const entry = _getRuntimeEntry(sessionId);
+  if (entry && entry.generation === askGeneration) {
+    _unlinkParentAbortListener(entry);
+    entry.controller = null;
+    // Detach the live session reference; ask is over.
+    entry.session = null;
+  }
+  // Final-stage runtime diagnostics are useful only while the turn is
+  // unwinding. Once its controller is detached, retaining the full entry
+  // (and any accidental references hanging from it) for the host lifetime
+  // turns one-shot agent traffic into an unbounded manager Map.
+  _evictTerminalSessionRuntime(sessionId);
+}
+
 export async function askSession(sessionId, prompt, context, onToolCall, cwdOverride, explicitPrefetch, askOpts = {}) {
   const askStartedAt = Date.now();
   const transcript = createAskTranscriptMeta(askOpts?.transcriptMeta);
@@ -180,8 +221,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
   // Hoisted so the outer finally (which runs once after the whole turn loop)
   // can compare against the last turn's generation.
   let askGeneration = 0;
-  let crashRecoveryChecked = false;
-  let sessionStartEmitted = false;
+  // Crash-checkpoint recovery and the session-start event belong to the first
+  // turn of this ask only.
+  let firstTurn = true;
   // A failed-turn retry rewinds only the turn it retries, never a drained
   // follow-up turn.
   let retryFailedTurn = askOpts.retryFailedTurn === true;
@@ -218,17 +260,11 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
       const claimed = claimTurnRuntime({
         sessionId,
         askOpts,
-        recoverCheckpoint: !crashRecoveryChecked,
-        emitStart: !sessionStartEmitted,
+        recoverCheckpoint: firstTurn,
+        emitStart: firstTurn,
       });
-      // The prompt-cache warmer learns idle gaps from real turns only; a
-      // retry is classified by the failed turn's stored provenance.
-      // The rebuilt retry message keeps that provenance (ask-turn-execute.mjs).
-      const retryProvenance = failedTurnProvenance(claimed.preSession?.messages, input);
-      if (retryProvenance) input.retryProvenance = retryProvenance;
-      warmTurn = noteCacheWarmTurn(sessionId, cacheWarmTurnKind(input, claimed.preSession?.messages));
-      crashRecoveryChecked = true;
-      sessionStartEmitted = true;
+      warmTurn = noteTurnForCacheWarm(sessionId, claimed, input);
+      firstTurn = false;
       askGeneration = claimed.askGeneration;
       const opened = {
         ...claimed,
@@ -287,21 +323,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
     queue.releaseUnstarted();
     // A thrown setup/provider path must never leave a delayed checkpoint
     // writer alive after the turn lock is released.
-    // Clear the controller only if it's still ours (closeSession may have
-    // swapped it). Leave the rest of the runtime entry intact so agent type=list
-    // can still surface the final stage (done/error/cancelling).
-    const entry = _getRuntimeEntry(sessionId);
-    if (entry && entry.generation === askGeneration) {
-      _unlinkParentAbortListener(entry);
-      entry.controller = null;
-      // Detach the live session reference; ask is over.
-      entry.session = null;
-    }
-    // Final-stage runtime diagnostics are useful only while the turn is
-    // unwinding. Once its controller is detached, retaining the full entry
-    // (and any accidental references hanging from it) for the host lifetime
-    // turns one-shot agent traffic into an unbounded manager Map.
-    _evictTerminalSessionRuntime(sessionId);
+    detachAskRuntime(sessionId, askGeneration);
     unlock();
   }
 }

package/src/runtime/agent/orchestrator/session/manager/ask-turn-loop-options.mjs

@@ -231,9 +231,9 @@ export function buildAgentLoopOptions({
     },
     onStreamDelta: (kind = 'semantic') => {
       markSessionStreamDelta(sessionId, kind).catch(() => {});
-      // Raw transport is an internal health signal, not model progress.
-      // Preserve the public callback's historical semantic-only contract.
-      if (kind !== 'transport') relay(askOpts?.onStreamDelta, kind);
+      // Raw transport and keepalives are internal health signals, not model
+      // progress. Preserve the public callback's historical semantic-only contract.
+      if (kind !== 'transport' && kind !== 'keepalive') relay(askOpts?.onStreamDelta, kind);
     },
   };
 }

package/src/runtime/agent/orchestrator/session/manager/ask-turn-settle.mjs

@@ -225,7 +225,9 @@ export function publishAskTurn({ sessionId, opened, terminalResultPreview, askOp
   // (which inspects entry.emptyFinal first) classifies the
   // terminal state correctly even if it ticks during unwind.
   const isEmptyFinal =
-    !terminalResultPreview.content && !terminalResultPreview.reasoningContent && !terminalResultPreview.reactionCompleted;
+    !terminalResultPreview.content &&
+    !terminalResultPreview.reasoningContent &&
+    !terminalResultPreview.reactionCompleted;
   if (isEmptyFinal) {
     markSessionEmptyFinal(sessionId);
   }

package/src/runtime/agent/orchestrator/session/manager/owner-route-fallbacks.mjs

@@ -13,7 +13,7 @@
 import { loadConfig } from '../../config.mjs';
 import { findPreset } from '../../runtime-core/config-helpers.mjs';
 import { normalizeWorkflowRoute } from '../../runtime-core/workflow.mjs';
-import { canonicalRouteProvider } from '../../../../shared/model-route-chain.mjs';
+import { canonicalRouteProvider, executionFallbacks } from '../../../../shared/model-route-chain.mjs';
 import { storedBotRoute } from '../../../../shared/agent-store.mjs';
 import { configuredAgentRouteCandidates } from '../../../../shared/agent-route-config.mjs';
 import { CODING_MODE } from '../agent-mode.mjs';
@@ -48,5 +48,5 @@ export function ownerConfiguredRoute({ sessionMode, agentId, config = null }) {
 export function ownerRouteFallbacks({ sessionMode, agentId, provider, model, config = null }) {
   const route = ownerConfiguredRoute({ sessionMode, agentId, config });
   if (!route?.fallbacks?.length) return [];
-  return sameRouteModel(route, { provider, model }) ? route.fallbacks : [];
+  return sameRouteModel(route, { provider, model }) ? executionFallbacks(route) : [];
 }

package/src/runtime/agent/orchestrator/session/manager/prompt-utils.mjs

@@ -578,6 +578,7 @@ function isReferenceFilesMessage(message) {
 }
 
 export { isProtectedContextUserMessage };
+export { BP3_PART_SEPARATOR, bp3SystemMessage, bpEnvSystemMessage, replaceSystemMessageContent };
 
 // Compact summary messages (role:'user', content startsWith SUMMARY_PREFIX)
 // are synthetic anchors, not a real human turn — they must not count as

package/src/runtime/agent/orchestrator/session/manager/route-fallback-chain.mjs

@@ -12,6 +12,7 @@
 import { findPreset } from '../../runtime-core/config-helpers.mjs';
 import { normalizeWorkflowRoute } from '../../runtime-core/workflow.mjs';
 import { configuredAgentRouteCandidates } from '../../../../shared/agent-route-config.mjs';
+import { executionFallbacks } from '../../../../shared/model-route-chain.mjs';
 import { CODING_MODE, resolveSessionMode } from '../agent-mode.mjs';
 import { _liveSessions } from '../store/live-state.mjs';
 import { ownerConfiguredRoute, sameRouteModel } from './owner-route-fallbacks.mjs';
@@ -64,7 +65,7 @@ export function liveRouteFallbacks(session, config) {
   if (!source)
     return { chain: Array.isArray(session?.routeFallbacks) ? session.routeFallbacks : [], fromSettings: false };
   const onSourcePrimary = sameRouteModel(source, sessionRoutePrimary(session));
-  return { chain: onSourcePrimary ? source.fallbacks || [] : [], fromSettings: true };
+  return { chain: onSourcePrimary ? executionFallbacks(source) : [], fromSettings: true };
 }
 
 /** Index in `chain` of the next route to try: the first after the session's