mixdog 1.4.1 → 1.4.3

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn.mjs

@@ -18,9 +18,12 @@ import { resetOutputLimitRecovery, resolveOutputLimit } from './no-tool-turn/out
 import { resolveRefusal } from './no-tool-turn/refusal.mjs';
 import { resumeContinuation } from './no-tool-turn/continuation.mjs';
 import { nudgeEmptyTurn } from './no-tool-turn/empty-nudge.mjs';
+import { noteTodoProgress, staleTodoReminder, todoCompletionReminder } from './no-tool-turn/todo-check.mjs';
 import { isReactionSuccess, reactionCallIds, takeReactionTarget } from '../../runtime-core/reaction-tool-defs.mjs';
 import { messageIdOf } from '../message-ids.mjs';
 import { isReactableMessage } from '../message-reactions.mjs';
+import { joinReports, withEarlierReport } from './turn-report.mjs';
+import { TODO_TOOL } from '../../runtime-core/todo-tool-defs.mjs';
 
 // `escalateMaxTokens()` asks the live provider for a higher one-shot max_tokens
 // (number) or reports none (null/undefined) — the loop stays provider-agnostic.
@@ -32,6 +35,7 @@ export function createNoToolTurnResolver({
   drainSteering,
   escalateMaxTokens = () => null,
   streamedChars = () => 0,
+  turnLimited = () => false,
 }) {
   const segments = createTurnSegments({ messages, opts });
   // Per-turn recovery counters shared by the ladders.
@@ -51,6 +55,14 @@ export function createNoToolTurnResolver({
     // Continuations since the last executed tool batch — bounds the text-only
     // continuation runaway (see PROVIDER_CONTINUATION_NO_TOOL_LIMIT).
     continuationsSinceToolBatch: 0,
+    // Answers the turn went on past (keepEndedAnswer): those still in the
+    // segments (parts before endedPartsEnd), and those a tool batch cleared
+    // from them.
+    endedPartsEnd: 0,
+    carriedAnswers: [],
+    // The newest kept answer was followed by nothing but todo bookkeeping:
+    // it is the turn's answer, and an empty end after it is no failure.
+    reportStands: false,
   };
   // The stable id (message-ids.mjs, kept across compaction) of the newest
   // real user input; runtime reminders and notices are not reactable.
@@ -112,60 +124,108 @@ export function createNoToolTurnResolver({
     };
   };
 
+  // An answer the turn goes on past (queued input or a todo reminder arrived
+  // after it) is committed like any segment and also kept as part of the
+  // turn's report: a tool batch clears the segments, and the caller (an
+  // agent's owner) must still receive that answer, not only the short reply
+  // that follows it. The answer is every part since the previous one or the
+  // last tool batch (an output-limit cut and its resumption included).
+  const keepEndedAnswer = (response, hasContent) => {
+    if (!segments.commitIntermediate(response) || !hasContent) return false;
+    segments.record(response.content, { committed: true });
+    state.endedPartsEnd = segments.parts.length;
+    return true;
+  };
+  const endedReport = () =>
+    joinReports([...state.carriedAnswers, segments.parts.slice(0, state.endedPartsEnd).join('')]);
+  // Answers still in the segments are in the response's own aggregate.
+  const finalize = (response) =>
+    state.carriedAnswers.length === 0 ? response : withEarlierReport(response, joinReports(state.carriedAnswers));
+
+  async function resolveTurn(response, iteration) {
+    const hasContent = typeof response.content === 'string' && response.content.trim().length > 0;
+    const stopReason = response.stopReason ?? response.stop_reason ?? null;
+    const isOutputLimitStop = isOutputLimitStopReason(stopReason);
+    if (isOutputLimitStop || (hasContent && response.streamCut === true)) {
+      return resolveOutputLimit(response, ladder);
+    }
+    if (stopReason === 'refusal') return resolveRefusal(response, hasContent, ladder);
+    // Output-limit stops keep the bounded max-output ladder above and
+    // refusals (already returned) keep the bounded refusal retry; both
+    // own their own continuation semantics. No lexical/progress-text
+    // heuristic is consulted.
+    const continuationSignal = isOutputLimitStop ? null : providerContinuationSignal(response);
+    if (
+      continuationSignal &&
+      resumeContinuation(response, { iteration, signal: continuationSignal, hasContent, stopReason }, ladder)
+    ) {
+      return { action: 'continue', response };
+    }
+    // Hidden roles are exempt from the empty-turn nudge: their own role
+    // rules define a different output contract (pipe-separated chunker
+    // output, …) and a text-only terminal turn is the correct shape —
+    // nudging them produces a contradictory user message that traps the
+    // model in a tool-call-blocked vs contract-required oscillation.
+    // A turn that left a reaction on the user's message may end with no
+    // text: the reaction is its answer (react tool), never an empty turn.
+    // Nor does a turn whose kept answer only todo bookkeeping followed: that
+    // answer is its reply.
+    if (!hasContent && !HIDDEN_AGENT_NAMES.has(sessionAgent) && !reactionAnswersLatest() && !state.reportStands) {
+      return nudgeEmptyTurn(
+        response,
+        { stopReason, isIncompleteStop: stopReason && INCOMPLETE_STOP_REASONS.has(stopReason) },
+        ladder
+      );
+    }
+    // Pending-input rule: queued user input is folded into
+    // needs_follow_up before terminal completion. Commit the terminal
+    // text first (beforeAppend), then resume.
+    if (
+      drainSteering('terminal', {
+        maxPriority: 'next',
+        beforeAppend: () => keepEndedAnswer(response, hasContent),
+      })
+    ) {
+      state.emptyNudgeStreak = 0;
+      resetOutputLimitRecovery(state);
+      return { action: 'continue', response };
+    }
+    const reminder = todoCompletionReminder(opts.session, {
+      sessionId,
+      sessionAgent,
+      turnLimited: turnLimited(),
+    });
+    if (reminder) {
+      if (keepEndedAnswer(response, hasContent)) state.reportStands = true;
+      messages.push({ role: 'user', content: reminder });
+      return { action: 'continue', response };
+    }
+    return finishTurn(response);
+  }
+
   return {
     // { action: 'continue' | 'break', response }. 'continue' means the
     // recovery appended to the transcript and the loop must re-send;
-    // 'break' returns the (possibly aggregated) terminal response.
+    // 'break' returns the (possibly aggregated) terminal response, with the
+    // ended answers a tool batch cleared from it as its report.
     async resolve(response, iteration) {
-      const hasContent = typeof response.content === 'string' && response.content.trim().length > 0;
-      const stopReason = response.stopReason ?? response.stop_reason ?? null;
-      const isOutputLimitStop = isOutputLimitStopReason(stopReason);
-      if (isOutputLimitStop || (hasContent && response.streamCut === true)) {
-        return resolveOutputLimit(response, ladder);
-      }
-      if (stopReason === 'refusal') return resolveRefusal(response, hasContent, ladder);
-      // Output-limit stops keep the bounded max-output ladder above and
-      // refusals (already returned) keep the bounded refusal retry; both
-      // own their own continuation semantics. No lexical/progress-text
-      // heuristic is consulted.
-      const continuationSignal = isOutputLimitStop ? null : providerContinuationSignal(response);
-      if (
-        continuationSignal &&
-        resumeContinuation(response, { iteration, signal: continuationSignal, hasContent, stopReason }, ladder)
-      ) {
-        return { action: 'continue', response };
-      }
-      // Hidden roles are exempt from the empty-turn nudge: their own role
-      // rules define a different output contract (pipe-separated chunker
-      // output, …) and a text-only terminal turn is the correct shape —
-      // nudging them produces a contradictory user message that traps the
-      // model in a tool-call-blocked vs contract-required oscillation.
-      // A turn that left a reaction on the user's message may end with no
-      // text: the reaction is its answer (react tool), never an empty turn.
-      if (!hasContent && !HIDDEN_AGENT_NAMES.has(sessionAgent) && !reactionAnswersLatest()) {
-        return nudgeEmptyTurn(
-          response,
-          { stopReason, isIncompleteStop: stopReason && INCOMPLETE_STOP_REASONS.has(stopReason) },
-          ladder
-        );
-      }
-      // Pending-input rule: queued user input is folded into
-      // needs_follow_up before terminal completion. Commit the terminal
-      // text first (beforeAppend), then resume.
-      if (
-        drainSteering('terminal', {
-          maxPriority: 'next',
-          beforeAppend: () => {
-            if (segments.commitIntermediate(response) && hasContent)
-              segments.record(response.content, { committed: true });
-          },
-        })
-      ) {
-        state.emptyNudgeStreak = 0;
-        resetOutputLimitRecovery(state);
-        return { action: 'continue', response };
-      }
-      return finishTurn(response);
+      const outcome = await resolveTurn(response, iteration);
+      if (outcome.action !== 'break') return outcome;
+      return { ...outcome, response: finalize(outcome.response) };
+    },
+    // The terminal response of a turn that ended any other way (a capped
+    // turn's overrun) gets the same report.
+    finalize,
+    // Every answer the turn went on past, for a turn that fails after them.
+    endedReport,
+    // Input the turn took in (steering at any boundary) is new work: its
+    // outcome is the turn's, not the kept answer's.
+    noteNewInput() {
+      state.reportStands = false;
+    },
+    // An empty end after the kept answer is that answer's turn ending.
+    get reportStands() {
+      return state.reportStands;
     },
     // A turn that produced tool calls is never an empty contract violation,
     // and it is real progress: a later output-limit cut starts a fresh ladder.
@@ -177,6 +237,12 @@ export function createNoToolTurnResolver({
     // succeeded marks the turn as having reacted.
     noteToolBatchCompleted(calls = [], results = []) {
       state.continuationsSinceToolBatch = 0;
+      noteTodoProgress(opts.session);
+      const stale = staleTodoReminder(opts.session, calls, results, { sessionAgent });
+      if (stale) messages.push({ role: 'user', content: stale, meta: 'hook' });
+      if (state.endedPartsEnd > 0) state.carriedAnswers.push(segments.parts.slice(0, state.endedPartsEnd).join(''));
+      state.endedPartsEnd = 0;
+      if (calls.some((call) => (call?.name ?? call?.function?.name) !== TODO_TOOL.name)) state.reportStands = false;
       segments.clear();
       state.reactions.push(...batchReactions(calls, results));
     },

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -14,7 +14,11 @@
 import { isAgentOwner } from '../../agent-owner.mjs';
 import { isOffReadonlySurface } from './deferred-call-through.mjs';
 import { BRIDGE_CALL_TOOL_NAME, bridgeErrorText, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
-import { sessionAllowlistExcludes, sessionDisallows } from '../../runtime-core/deferred-tool-availability.mjs';
+import {
+  sessionAllowlistExcludes,
+  sessionDisallows,
+  sessionFeatureDenies,
+} from '../../runtime-core/deferred-tool-availability.mjs';
 import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
 import { workflowOverlayDenial } from '../manager/workflow-switch-notice.mjs';
 import { agentMcpToolPermission, connectorPolicyAgentOf, projectMcpToolDisabled } from '../../mcp/agent-connectors.mjs';
@@ -125,6 +129,9 @@ export function preDispatchDenyForSession(sessionRef, call) {
   const workflowDenial = workflowOverlayDenial(sessionRef, schemaName);
   if (workflowDenial) return workflowDenial;
   if (sessionDisallows(sessionRef, schemaName)) {
+    if (sessionFeatureDenies(sessionRef, schemaName)) {
+      return `Error: tool "${schemaName}" is disabled in settings by the user. Do not retry unless the user turns it back on.`;
+    }
     return `Error: tool "${name}" is not available in this session.`;
   }
   // An agent's connectors: a tool of a server it does not mount, or one set

package/src/runtime/agent/orchestrator/session/loop/provider-tool-exclusions.mjs

@@ -43,7 +43,7 @@ export function beginProviderToolExclusions(sessionRef) {
   if (isSessionRef(sessionRef)) sessions.get(sessionRef)?.current.clear();
 }
 
-export function excludedToolNoticeText({ name, pointer, reason }) {
+function excludedToolNoticeText({ name, pointer, reason }) {
   return `Tool "${name}" was excluded from this session's requests: its input schema is invalid at ${pointer || '/'} (${reason}). Fix the tool's schema or disable the tool.`;
 }
 

package/src/runtime/agent/orchestrator/session/loop/route-fallback.mjs

@@ -38,7 +38,7 @@ const HOP_REASONS = {
 const routeLabel = (route) => displayModelName(route.model, route.provider) || `${route.provider}/${route.model}`;
 
 /** The muted transcript line for a hop: `<from> <reason> — switched to <to>.` */
-export function routeFallbackNoticeText(from, to, error) {
+function routeFallbackNoticeText(from, to, error) {
   const reason = HOP_REASONS[providerErrorKind(error).kind] || 'unavailable';
   return `${routeLabel(from)} ${reason} — switched to ${routeLabel(to)}.`;
 }

package/src/runtime/agent/orchestrator/session/loop/steering.mjs

@@ -198,7 +198,8 @@ function injectSteeringEntry(merged, { messages, opts, stage, onSkillPrompt }) {
 // The drain is synchronous (terminal guards depend on that) and returns whether
 // anything was injected. `onSkillPrompt` receives each typed entry so the loop
 // can run its policy-checked skill selection before the next provider snapshot.
-export function createSteeringDrain({ messages, opts, sessionId, onSkillPrompt }) {
+// `onInjected` learns of every drain that added input, whatever its stage.
+export function createSteeringDrain({ messages, opts, sessionId, onSkillPrompt, onInjected = () => {} }) {
   return function drainSteeringIntoMessages(stage = 'mid-turn', options = {}) {
     if (typeof opts.drainSteering !== 'function') return false;
     let steerMsgs = [];
@@ -232,6 +233,7 @@ export function createSteeringDrain({ messages, opts, sessionId, onSkillPrompt }
       totalTextLen += injected.textLength;
       maxQueueWaitMs = Math.max(maxQueueWaitMs, injected.queueWaitMs);
     }
+    onInjected(stage);
     if (sessionId) {
       try {
         process.stderr.write(

package/src/runtime/agent/orchestrator/session/loop/stored-tool-args.mjs

@@ -6,12 +6,11 @@
 // copy `[mixdog compacted …]` back as literal patch input.
 //
 // Mutation bodies (patch / old_string / new_string / content / rewrite) are
-// never collapsed after the fact. The sweep that used to do it (deferBodies
-// plus a settled-body pass on the next push) rewrote a prefix the provider had
-// already cached, and every rewrite re-billed that whole request at the
-// uncached rate. Measured over one 89-task run: $1.20 lost to recover $0.16,
-// because the collapsed tokens only come back at the cached rate over the
-// REMAINING turns, and a task rarely has enough of them left. Bodies now stay
+// never collapsed after the fact. A later sweep would rewrite a prefix the
+// provider has already cached, and every rewrite re-bills that whole request at
+// the uncached rate. Measured over one 89-task run: $1.20 lost to recover
+// $0.16, because the collapsed tokens only come back at the cached rate over
+// the REMAINING turns, and a task rarely has enough of them left. Bodies stay
 // verbatim in history, so the prefix — and its cache — survives the session.
 import { createHash } from 'node:crypto';
 

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -16,14 +16,26 @@ import {
 } from '../../human-gate/gate.mjs';
 import { applyEditedArgs } from '../../human-gate/requests.mjs';
 import { effectiveToolCwd } from '../../../tools/builtin/bash-tool/shell-cwd.mjs';
+import { noteTodoUserWait } from '../no-tool-turn/todo-check.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
 async function askApproval(
   call,
-  { callerSessionId, executeOpts, toolApprovalHook, decision, request = null, gate = null, onApproved = null }
+  {
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+    decision,
+    request = null,
+    gate = null,
+    onApproved = null,
+    account = '',
+  }
 ) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
+  // The connector account the call is bound to rides on the card.
+  if (account) request = { ...(request || {}), account };
   // While the user decides, the session is waiting on them, not working.
   const releaseApprovalWait = beginSessionApprovalWait(callerSessionId);
   let askOutcome;
@@ -45,7 +57,11 @@ async function askApproval(
   }
   const approval = askOutcome.approval;
   await recordHumanDecision(gate, approval);
-  if (askOutcome.denial) return { denial: askOutcome.denial };
+  if (askOutcome.denial) {
+    // The user said no: this turn may end waiting on them (todo-check.mjs).
+    noteTodoUserWait(callerSessionId);
+    return { denial: askOutcome.denial };
+  }
   if (approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
   // The card's edited text replaces the model's before the call runs.
   if (request?.kind === 'outbound' && approval?.editedArgs) {
@@ -72,9 +88,13 @@ export const CONNECTOR_APPROVAL_REASON = 'This connector tool is set to ask befo
  * remembered outbound grant answered it) is not asked a second time. With the
  * "Allow all actions" developer option on, `needs_approval` is not asked
  * either (a payment or permanent delete was asked by the outbound gate above).
+ * `account` is the connector account the call is bound to, for the card.
  * @returns {Promise<{ denial: string } | null>} the denial, or null to run
  */
-export function applyConnectorApproval(call, { agentId, callerSessionId, executeOpts, toolApprovalHook }) {
+export function applyConnectorApproval(
+  call,
+  { agentId, callerSessionId, executeOpts, toolApprovalHook, account = '' }
+) {
   if (call.outboundApproved) return null;
   if (!actingBotId(callerSessionId)) return null;
   if (agentMcpToolPermission(agentId, call.name) !== 'needs_approval') return null;
@@ -89,6 +109,7 @@ export function applyConnectorApproval(call, { agentId, callerSessionId, execute
     toolApprovalHook,
     decision: { reason: CONNECTOR_APPROVAL_REASON },
     request: rememberable ? { kind: 'approval', agentId: botId, remember: ['once', 'agent'] } : null,
+    account,
     onApproved: async (approval) => {
       if (!rememberable || approval?.remember !== 'agent') return;
       try {
@@ -130,6 +151,7 @@ export async function applyBeforeToolHook({
   beforeToolHook,
   toolApprovalHook,
   mcpScopeId = null,
+  account = '',
 }) {
   const call = { name, args, cwd };
   // ask_user and handoff_user are themselves the user prompt; they never go through the ordinary approval gate.
@@ -183,6 +205,8 @@ export async function applyBeforeToolHook({
         decision,
         request,
         gate,
+        // Only while the call is still the one bound to it.
+        account: call.name === name ? account : '',
       });
       if (denied) return denied;
     }

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -19,7 +19,9 @@ import {
 } from '../../../tools/builtin.mjs';
 import { executePatchTool } from '../../../tools/patch.mjs';
 import { executeInternalTool, isInternalTool } from '../../../internal-tools.mjs';
+import { settingDisabledTool } from '../../../runtime-core/tool-availability.mjs';
 import { buildSkillsListResponse, viewSkill } from '../tool-helpers.mjs';
+import { executeTodoTool } from '../../../runtime-core/todo-list.mjs';
 import { isOnDeferredToolSurface } from '../deferred-call-through.mjs';
 import { _executeCodeGraphToolLazy } from '../../manager/runtime-loaders.mjs';
 import { requiresReadBody } from '../tool-classify.mjs';
@@ -57,8 +59,8 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
     return formatUnknownBuiltinToolMessage(name, args, 'tool');
   }
   // 24h trace data shows ~24% of external MCP calls are cwd-sensitive
-  // (bash / grep / read / list / glob etc.) but the worker session's
-  // cwd was previously dropped here. Inject cwd only when the tool's
+  // (bash / grep / read / list / glob etc.), so the worker session's
+  // cwd must reach them. Inject cwd only when the tool's
   // inputSchema declares the field — schemas without it would reject
   // an unknown argument.
   const needsCwdInjection = cwd && mcpToolHasField(name, 'cwd', mcpScopeId) && (args == null || args.cwd == null);
@@ -67,6 +69,8 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
     signal: executeOpts.signal || null,
     ownerKey: callerSessionId,
     scopeId: mcpScopeId,
+    // A connector account defaults to (and becomes) this conversation's last used.
+    conversation: callerSessionId,
   });
   if (!isBuiltinMailRead(name, mcpScopeId)) return call;
   // The runtime's own record of the links in a mail it read for this session:
@@ -118,8 +122,20 @@ function dispatchInternal(
  */
 export function dispatchToolCall({ name, args }, ctx) {
   const { cwd, callerSessionId, sessionRef, executeOpts, toolOpts, completionToolOpts } = ctx;
+  const disabled = settingDisabledTool(name, sessionRef?.mcpScopeId);
+  if (disabled) {
+    return `Error: tool "${disabled}" is disabled in settings by the user; do not retry unless the user turns it back on`;
+  }
   if (name === 'Skill' || name === 'skill_view') return viewSkill(cwd, args?.name, sessionRef);
   if (name === 'skills_list') return buildSkillsListResponse(cwd);
+  // The step list belongs to the calling session itself (Lead or agent).
+  if (name === 'todo') {
+    try {
+      return executeTodoTool(sessionRef, args || {});
+    } catch (error) {
+      return `Error: ${error?.message || String(error)}`;
+    }
+  }
   if (isMcpTool(name)) return dispatchMcp(name, args, ctx);
   if (name === 'code_graph') {
     // cwd chain: args.cwd (caller-explicit) → session cwd → undefined (handler throws)

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -5,7 +5,7 @@
 //   tool-exec/dispatch.mjs           — executor per tool family
 //   tool-exec/after-hook.mjs         — PostToolUse result override
 //   tool-exec/read-only-deadline.mjs — bounded read-only I/O with partial-output grace
-import { isMcpTool } from '../../mcp/client.mjs';
+import { isMcpTool, resolveMcpToolAccount } from '../../mcp/client.mjs';
 import { connectorPolicyAgentOf } from '../../mcp/agent-connectors.mjs';
 import { prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
 import { refreshDeferredMcpToolCatalog } from '../../runtime-core/tool-catalog.mjs';
@@ -58,6 +58,24 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     callArgs = guarded.args;
     completionToolOpts.shellGuardNotes = guarded.notes;
   }
+  // A connector call is bound to its account before any hook or card sees it,
+  // so an approval approves that account, whatever is used last meanwhile.
+  // It is bound by its unique name; `account` is its label, for display.
+  let bound = '';
+  let account = '';
+  if (isMcpTool(name)) {
+    try {
+      const chosen = resolveMcpToolAccount(name, callArgs, {
+        scopeId: sessionRef?.mcpScopeId || null,
+        conversation: callerSessionId,
+      });
+      bound = chosen?.name || '';
+      account = chosen?.label || '';
+    } catch (error) {
+      return `Error: ${error?.message || String(error)}`;
+    }
+    if (bound) callArgs = { ...callArgs, account: bound };
+  }
   const hooked = await applyBeforeToolHook({
     name,
     args: callArgs,
@@ -67,6 +85,7 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     beforeToolHook: hookFrom(executeOpts, sessionRef, 'beforeToolHook'),
     toolApprovalHook,
     mcpScopeId: sessionRef?.mcpScopeId || null,
+    account,
   });
   if (hooked.denial) return hooked.denial;
   const connectorDenied = await applyConnectorApproval(hooked, {
@@ -74,8 +93,11 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     callerSessionId,
     executeOpts,
     toolApprovalHook,
+    account: hooked.name === name ? account : '',
   });
   if (connectorDenied) return connectorDenied.denial;
+  // A hook's rewrite of the same tool keeps the bound account.
+  if (bound && hooked.name === name) hooked.args = { ...hooked.args, account: bound };
   // A decision can settle after its turn was cancelled. It must never
   // authorize a new mutation, even if the hook ignores the abort signal.
   throwIfAborted(executeOpts.signal);

package/src/runtime/agent/orchestrator/session/loop/turn-limits.mjs

@@ -1,12 +1,14 @@
 /**
  * turn-limits.mjs — a turn's caps (sendOpts.turnLimits; a heartbeat turn's,
- * manager/ask-turn-loop-options.mjs): `maxToolCalls` tool calls and
- * `wrapUpAt` (epoch ms). A call past the cap, or one made after the wrap-up
- * time, is answered without running. Once a cap is reached the model is told
- * to reply, and every later request of the turn forbids tool use
- * (toolChoice 'none'). A response that still calls tools after that ends the
- * turn with no reply, its calls answered unrun. A capped turn runs no call
- * eagerly (eager-dispatch.mjs), so none past the cap starts while streaming.
+ * manager/ask-turn-loop-options.mjs): `maxToolCalls` tool calls,
+ * `wrapUpAt` (epoch ms) and `maxToolRounds` tool-calling responses (an
+ * explorer's, runtime/explore/explorer.mjs). A call past the cap, or one made
+ * after the wrap-up time, is answered without running. Once a cap is reached
+ * the model is told to reply, and every later request of the turn forbids
+ * tool use (toolChoice 'none'). A response that still calls tools after that
+ * ends the turn with no reply, its calls answered unrun. A turn capped by
+ * calls or time runs no call eagerly (eager-dispatch.mjs), so none past the
+ * cap starts while streaming; a round cap cuts only between rounds.
  */
 
 const NOTICE =
@@ -21,6 +23,8 @@ export function turnLimitsOf(opts) {
   return {
     maxToolCalls: Number.isInteger(limits.maxToolCalls) && limits.maxToolCalls >= 0 ? limits.maxToolCalls : Infinity,
     wrapUpAt: Number.isFinite(limits.wrapUpAt) ? limits.wrapUpAt : Infinity,
+    maxToolRounds:
+      Number.isInteger(limits.maxToolRounds) && limits.maxToolRounds >= 0 ? limits.maxToolRounds : Infinity,
   };
 }
 
@@ -49,7 +53,8 @@ export function settleTurnLimits(state, overrun, now = Date.now()) {
   }
   const limits = turnLimitsOf(state.opts);
   if (!limits || state.turnLimitNoticed) return;
-  if (state.toolCallsTotal < limits.maxToolCalls && now < limits.wrapUpAt) return;
+  if (state.toolCallsTotal < limits.maxToolCalls && now < limits.wrapUpAt && state.iterations < limits.maxToolRounds)
+    return;
   state.turnLimitNoticed = true;
   state.messages.push({ role: 'user', content: NOTICE, meta: { source: 'turn-limit' } });
 }

package/src/runtime/agent/orchestrator/session/loop/turn-report.mjs

@@ -0,0 +1,35 @@
+// The report a finished ask hands its caller (an agent's owner).
+//
+// A turn's `content` is what the live view still needs at its end: the text
+// since the last tool batch. An answer the turn kept going past (a todo
+// reminder or queued input arrived after it) and a turn that queued input
+// followed in the same ask are both older than that, so the result carries
+// them in `reportContent`, ahead of the newest text.
+
+export function joinReports(parts) {
+  return parts
+    .map((part) => String(part || '').trim())
+    .filter(Boolean)
+    .join('\n\n');
+}
+
+/** The whole report of a result: `reportContent` when the ask carried earlier
+ *  answers, else its content. */
+export function turnReportText(result) {
+  if (typeof result?.reportContent === 'string') return result.reportContent;
+  return typeof result?.content === 'string' ? result.content : '';
+}
+
+/** `result` with `earlier` answers ahead of its own report. */
+export function withEarlierReport(result, earlier) {
+  if (!earlier) return result;
+  return { ...result, reportContent: joinReports([earlier, turnReportText(result)]) };
+}
+
+/** A turn that fails after such answers still hands them on: `error` carries
+ *  them (`carriedReport`, earliest first) to whoever reports the failure. */
+export function carryReportOnError(error, earlier) {
+  if (!earlier || !error || typeof error !== 'object') return error;
+  error.carriedReport = joinReports([earlier, typeof error.carriedReport === 'string' ? error.carriedReport : '']);
+  return error;
+}

package/src/runtime/agent/orchestrator/session/loop/usage.mjs

@@ -90,7 +90,7 @@ const SUMMED_USAGE_FIELDS = [
 ];
 
 /** What `total` added after the running total `earlier` (both from addUsage); null when nothing. */
-export function usageSince(total, earlier) {
+function usageSince(total, earlier) {
   if (!total) return null;
   if (!earlier) return { ...total };
   const delta = {};