mixdog 1.4.2 → 1.4.3

package/src/runtime/agent/orchestrator/session/loop/completion-guards.mjs

@@ -37,7 +37,17 @@ export function crossTurnSignature(name, args) {
 // they must not reset the escalation ladder's "zero edit" condition. Skill /
 // recall / agent / task / cwd / load_tool are exploration/meta plumbing.
 // (tool_search kept as legacy alias for old transcripts.)
-const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', 'session', 'load_tool', 'tool_search']);
+const NON_PROGRESS_TOOLS = new Set([
+  'Skill',
+  'recall',
+  'agent',
+  'task',
+  'cwd',
+  'session',
+  'load_tool',
+  'tool_search',
+  'todo',
+]);
 
 // True when a successfully-executed tool represents real edit/progress. A tool
 // counts as progress only if its def lacks readOnlyHint (not eager) AND it is

package/src/runtime/agent/orchestrator/session/loop/context-overflow.mjs

@@ -55,7 +55,7 @@ const tokens = (value) => `${Number(value || 0).toLocaleString('en-US')} tokens`
 // for any history, so compacting the history cannot help and is not tried.
 // The wording avoids provider context-overflow phrasing on purpose: this is
 // not a "conversation too long" refusal and must not be routed as one.
-export class ToolSurfaceExceedsContextError extends Error {
+class ToolSurfaceExceedsContextError extends Error {
   constructor({ sessionId, provider, model, overhead }) {
     const target = [provider, model].filter(Boolean).join('/') || 'this model';
     const reserve = overhead.kind === 'configured_reserve';

package/src/runtime/agent/orchestrator/session/loop/loop-state.mjs

@@ -129,6 +129,8 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     opts,
     sessionId,
     onSkillPrompt: (content, message) => state.pendingSkillPrompts.push({ content, message }),
+    // Input taken into the turn at any boundary is new work to answer.
+    onInjected: () => state.noToolTurn.noteNewInput(),
   });
   // Bounded recovery for provider turns that returned no client tool calls
   // (max-output ladder, refusal retry, provider continuation, empty-turn
@@ -143,6 +145,8 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     escalateMaxTokens: () => state.provider?.escalatedMaxTokens?.(state.model, state.opts, state.lastSendTools) ?? null,
     // Characters the latest send put on screen through the live text stream.
     streamedChars: () => state.lastStreamedChars,
+    // A capped turn was told to reply; it may end without the todo check.
+    turnLimited: () => state.turnLimitNoticed === true,
   });
   return state;
 }
@@ -155,6 +159,9 @@ export function finishLoop(state) {
   // A reaction-only turn is a successful completion, never an empty finish.
   const terminationReason = classifyTerminationReason(response, { sessionAgent: state.sessionAgent });
   const reactionCompleted = terminationReason === 'empty' && state.noToolTurn.reactionCompleted;
+  // So is an empty end after a kept answer only todo bookkeeping followed:
+  // that answer is the turn's report (no-tool-turn.mjs).
+  const reportCompleted = terminationReason === 'empty' && state.noToolTurn.reportStands;
   return {
     ...response,
     usage: state.lastUsage || response.usage,
@@ -165,7 +172,7 @@ export function finishLoop(state) {
     toolCallsTotal: state.toolCallsTotal,
     providerState: state.providerState,
     providerStateUpdated: state.providerStateUpdated,
-    terminationReason: reactionCompleted ? undefined : terminationReason,
+    terminationReason: reactionCompleted || reportCompleted ? undefined : terminationReason,
     ...(reactionCompleted ? { reactionCompleted: true } : {}),
     providerContinuations: state.noToolTurn.providerContinuations,
     ...(state.routeUsageHops?.length

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn/todo-check.mjs

@@ -0,0 +1,196 @@
+// End-of-turn completion check for the session's todo list.
+//
+// A turn that ends without a tool call while pending/in-progress items remain
+// gets one hidden reminder naming them, and the loop sends again. Bounded:
+// at most MAX_TODO_REMINDERS per user cycle (reset only by a genuine user
+// prompt, never by an automatic continuation), and silent after a reminder
+// that produced no progress (no tool batch since). Skipped while the turn is
+// genuinely waiting: on the user (an approval denied or a question left
+// unanswered this turn), on an agent, or on a background shell started this
+// user cycle (background-wait.mjs).
+// Cancelled, failed and usage-limited turns never reach this point.
+//
+// With an active Goal whose items are all closed, the same check asks once
+// per cycle for the completion audit: complete the Goal or append the rest.
+import { resolvePluginData } from '../../../../../shared/plugin-paths.mjs';
+import { awaitingBackgroundWork, beginUserCycle } from '../../../../../shared/background-wait.mjs';
+import { readStoredGoalSnapshot } from '../../../runtime-core/goal-storage.mjs';
+import {
+  clearTodo,
+  openTodoItems,
+  todoAllClosed,
+  todoPhases,
+  unfinishedTodoItems,
+} from '../../../runtime-core/todo-list.mjs';
+import { TODO_TOOL } from '../../../runtime-core/todo-tool-defs.mjs';
+import { HIDDEN_AGENT_NAMES } from '../hidden-agents.mjs';
+import { _isMutationTool, _isShellTool } from '../tool-classify.mjs';
+
+const MAX_TODO_REMINDERS = 3;
+
+// Sessions whose current turn waits on the user's decision (in memory: the
+// turn itself is in memory, and a new turn clears it).
+const userWaits = new Set();
+
+/** The current turn now waits on the user (approval denied, question dismissed). */
+export function noteTodoUserWait(sessionId) {
+  if (sessionId) userWaits.add(String(sessionId));
+}
+
+function checkState(session) {
+  const current = session.todoCheck;
+  if (current && typeof current === 'object') return current;
+  session.todoCheck = { reminders: 0, awaitingProgress: false, auditAsked: false };
+  return session.todoCheck;
+}
+
+/** A turn starts: `genuine` (a real user prompt) opens a new reminder cycle. */
+export function beginTodoTurn(session, { genuine = false } = {}) {
+  if (!session || typeof session !== 'object') return;
+  if (session.id) userWaits.delete(String(session.id));
+  if (genuine) {
+    session.todoCheck = { reminders: 0, awaitingProgress: false, auditAsked: false };
+    beginUserCycle(session.id);
+    // A finished list stays on screen until the user moves on, then goes the
+    // way a finished Goal does. An active Goal keeps it for its audit.
+    if (todoAllClosed(session) && !activeGoal(session.id)) clearTodo(session);
+  }
+}
+
+/**
+ * A delegated agent received a new brief or follow-up (a genuine prompt) with
+ * no open list: the hidden reminder trailing that prompt, once per prompt, or
+ * null. The tool description alone was read past on short multi-ask briefs.
+ */
+export function todoStartReminder(session) {
+  if (!session || typeof session !== 'object' || session.owner !== 'agent') return null;
+  if (HIDDEN_AGENT_NAMES.has(session.agent)) return null;
+  if (!session.tools?.some((tool) => tool?.name === TODO_TOOL.name)) return null;
+  if (openTodoItems(session).length) return null;
+  // `init` refuses while any item is unfinished (blocked included), so such a
+  // list is reconciled or appended to, never re-initialized.
+  if (unfinishedTodoItems(session).length) {
+    return [
+      '<system-reminder>',
+      'The todo list still has blocked items. If this brief adds asks, append them; first done, drop or unblock each blocked item that this brief settles. Do not init over them. Do not mention this reminder.',
+      '</system-reminder>',
+    ].join('\n');
+  }
+  return [
+    '<system-reminder>',
+    'If this brief has three or more steps or several asks, init the todo list with every ask as its own item in the same response as your first tool call; each item the brief lists is its own todo item, never folded into one. A single step or a plain answer needs none. Do not mention this reminder.',
+    '</system-reminder>',
+  ].join('\n');
+}
+
+/** A tool batch ran: the last reminder produced progress. */
+export function noteTodoProgress(session) {
+  if (session?.todoCheck?.awaitingProgress) session.todoCheck.awaitingProgress = false;
+}
+
+// Mid-turn nudge: a long turn can finish items without ever touching the list,
+// leaving the progress shown to the user stale. After this many successful
+// mutating tool calls with no todo call (and no earlier nudge), one hidden
+// reminder is appended. Counted per call, not per batch, so a turn of parallel
+// edits ages the list faster than a turn of reads; a batch of three edits is
+// three. What mutates is the work the list tracks: file edits, command
+// execution (shell, as a bash tool is) and mutating git/github requests.
+const STALE_TODO_MUTATIONS = 10;
+
+function mutatingCall(call, results) {
+  const name = call?.name ?? call?.function?.name;
+  const args = call?.arguments ?? call?.function?.arguments;
+  if (!_isMutationTool(name, args) && !_isShellTool(name)) return false;
+  const result = results.find((message) => message?.toolCallId === call.id);
+  // A call that failed or was skipped (a dependency guard after a failed edit) changed nothing.
+  return result?.toolKind !== 'error' && result?.toolKind !== 'skipped';
+}
+
+/**
+ * A tool batch ran with `calls` (and their result messages): the hidden
+ * stale-list reminder to append to the transcript, or null. Calls are read in
+ * order: a todo call restarts the count, a successful mutating call adds one.
+ * Outside the end-of-turn budget (`todoCheck.reminders`) and its progress gate.
+ */
+export function staleTodoReminder(session, calls = [], results = [], { sessionAgent = null } = {}) {
+  if (!session || typeof session !== 'object' || HIDDEN_AGENT_NAMES.has(sessionAgent)) return null;
+  const check = checkState(session);
+  for (const call of calls) {
+    if ((call?.name ?? call?.function?.name) === TODO_TOOL.name) check.staleMutations = 0;
+    else if (mutatingCall(call, results)) check.staleMutations = (check.staleMutations || 0) + 1;
+  }
+  const phases = todoPhases(session);
+  // A finished list needs nothing more; no list at all is nudged once per
+  // user cycle (long runs that never made one), an open list repeatedly.
+  if (phases.length && !openTodoItems(session).length) {
+    check.staleMutations = 0;
+    return null;
+  }
+  if (!phases.length && check.createNudged) return null;
+  if ((check.staleMutations || 0) < STALE_TODO_MUTATIONS) return null;
+  check.staleMutations = 0;
+  if (!phases.length) {
+    check.createNudged = true;
+    return [
+      '<system-reminder>',
+      'No todo list exists for this work yet. If it has three or more steps, init one now with the steps left and keep it current; if it is a single step, ignore this. Keep working; do not mention this reminder.',
+      '</system-reminder>',
+    ].join('\n');
+  }
+  return [
+    '<system-reminder>',
+    'The todo tool has not been used for a while. Mark finished items done now (one call each, never batched at the end) so the in-progress pointer is on what you are doing. Keep working; do not mention this reminder.',
+    ...phases.flatMap((phase) => phase.tasks.map((task) => `- [${task.status}] ${task.content}`)),
+    '</system-reminder>',
+  ].join('\n');
+}
+
+function activeGoal(sessionId) {
+  try {
+    const goal = readStoredGoalSnapshot({ dataDir: resolvePluginData(), sessionId });
+    return goal?.status === 'active' ? goal : null;
+  } catch {
+    return null;
+  }
+}
+
+function openItemsReminder(open, count) {
+  return [
+    '<system-reminder>',
+    `You ended the turn with ${open.length} open todo item(s):`,
+    ...open.map((task) => `- ${task.content}`),
+    'Continue them, or close each with the todo tool (done, drop, or block with its reason).',
+    `(Reminder ${count}/${MAX_TODO_REMINDERS})`,
+    '</system-reminder>',
+  ].join('\n');
+}
+
+const GOAL_AUDIT_REMINDER = [
+  '<system-reminder>',
+  'Every todo item is closed but the Goal is still active. Audit each user condition of the Goal objective against current evidence: when all are proven met, call goal with action complete; otherwise append the remaining work to todo and continue.',
+  '</system-reminder>',
+].join('\n');
+
+/** The reminder to send before the turn may end, or null to let it end. */
+export function todoCompletionReminder(session, { sessionId = null, sessionAgent = null, turnLimited = false } = {}) {
+  if (!session || typeof session !== 'object' || turnLimited) return null;
+  if (HIDDEN_AGENT_NAMES.has(sessionAgent)) return null;
+  const id = String(sessionId || session.id || '');
+  const phases = todoPhases(session);
+  if (!phases.length) return null;
+  const check = checkState(session);
+  if (check.awaitingProgress || userWaits.has(id)) return null;
+  const open = openTodoItems(session);
+  if (open.length) {
+    if (check.reminders >= MAX_TODO_REMINDERS) return null;
+    if (awaitingBackgroundWork({ sessionId: id })) return null;
+    check.reminders += 1;
+    check.awaitingProgress = true;
+    return openItemsReminder(open, check.reminders);
+  }
+  if (check.auditAsked || !id || !activeGoal(id)) return null;
+  if (awaitingBackgroundWork({ sessionId: id })) return null;
+  check.auditAsked = true;
+  check.awaitingProgress = true;
+  return GOAL_AUDIT_REMINDER;
+}

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn.mjs

@@ -18,9 +18,12 @@ import { resetOutputLimitRecovery, resolveOutputLimit } from './no-tool-turn/out
 import { resolveRefusal } from './no-tool-turn/refusal.mjs';
 import { resumeContinuation } from './no-tool-turn/continuation.mjs';
 import { nudgeEmptyTurn } from './no-tool-turn/empty-nudge.mjs';
+import { noteTodoProgress, staleTodoReminder, todoCompletionReminder } from './no-tool-turn/todo-check.mjs';
 import { isReactionSuccess, reactionCallIds, takeReactionTarget } from '../../runtime-core/reaction-tool-defs.mjs';
 import { messageIdOf } from '../message-ids.mjs';
 import { isReactableMessage } from '../message-reactions.mjs';
+import { joinReports, withEarlierReport } from './turn-report.mjs';
+import { TODO_TOOL } from '../../runtime-core/todo-tool-defs.mjs';
 
 // `escalateMaxTokens()` asks the live provider for a higher one-shot max_tokens
 // (number) or reports none (null/undefined) — the loop stays provider-agnostic.
@@ -32,6 +35,7 @@ export function createNoToolTurnResolver({
   drainSteering,
   escalateMaxTokens = () => null,
   streamedChars = () => 0,
+  turnLimited = () => false,
 }) {
   const segments = createTurnSegments({ messages, opts });
   // Per-turn recovery counters shared by the ladders.
@@ -51,6 +55,14 @@ export function createNoToolTurnResolver({
     // Continuations since the last executed tool batch — bounds the text-only
     // continuation runaway (see PROVIDER_CONTINUATION_NO_TOOL_LIMIT).
     continuationsSinceToolBatch: 0,
+    // Answers the turn went on past (keepEndedAnswer): those still in the
+    // segments (parts before endedPartsEnd), and those a tool batch cleared
+    // from them.
+    endedPartsEnd: 0,
+    carriedAnswers: [],
+    // The newest kept answer was followed by nothing but todo bookkeeping:
+    // it is the turn's answer, and an empty end after it is no failure.
+    reportStands: false,
   };
   // The stable id (message-ids.mjs, kept across compaction) of the newest
   // real user input; runtime reminders and notices are not reactable.
@@ -112,60 +124,108 @@ export function createNoToolTurnResolver({
     };
   };
 
+  // An answer the turn goes on past (queued input or a todo reminder arrived
+  // after it) is committed like any segment and also kept as part of the
+  // turn's report: a tool batch clears the segments, and the caller (an
+  // agent's owner) must still receive that answer, not only the short reply
+  // that follows it. The answer is every part since the previous one or the
+  // last tool batch (an output-limit cut and its resumption included).
+  const keepEndedAnswer = (response, hasContent) => {
+    if (!segments.commitIntermediate(response) || !hasContent) return false;
+    segments.record(response.content, { committed: true });
+    state.endedPartsEnd = segments.parts.length;
+    return true;
+  };
+  const endedReport = () =>
+    joinReports([...state.carriedAnswers, segments.parts.slice(0, state.endedPartsEnd).join('')]);
+  // Answers still in the segments are in the response's own aggregate.
+  const finalize = (response) =>
+    state.carriedAnswers.length === 0 ? response : withEarlierReport(response, joinReports(state.carriedAnswers));
+
+  async function resolveTurn(response, iteration) {
+    const hasContent = typeof response.content === 'string' && response.content.trim().length > 0;
+    const stopReason = response.stopReason ?? response.stop_reason ?? null;
+    const isOutputLimitStop = isOutputLimitStopReason(stopReason);
+    if (isOutputLimitStop || (hasContent && response.streamCut === true)) {
+      return resolveOutputLimit(response, ladder);
+    }
+    if (stopReason === 'refusal') return resolveRefusal(response, hasContent, ladder);
+    // Output-limit stops keep the bounded max-output ladder above and
+    // refusals (already returned) keep the bounded refusal retry; both
+    // own their own continuation semantics. No lexical/progress-text
+    // heuristic is consulted.
+    const continuationSignal = isOutputLimitStop ? null : providerContinuationSignal(response);
+    if (
+      continuationSignal &&
+      resumeContinuation(response, { iteration, signal: continuationSignal, hasContent, stopReason }, ladder)
+    ) {
+      return { action: 'continue', response };
+    }
+    // Hidden roles are exempt from the empty-turn nudge: their own role
+    // rules define a different output contract (pipe-separated chunker
+    // output, …) and a text-only terminal turn is the correct shape —
+    // nudging them produces a contradictory user message that traps the
+    // model in a tool-call-blocked vs contract-required oscillation.
+    // A turn that left a reaction on the user's message may end with no
+    // text: the reaction is its answer (react tool), never an empty turn.
+    // Nor does a turn whose kept answer only todo bookkeeping followed: that
+    // answer is its reply.
+    if (!hasContent && !HIDDEN_AGENT_NAMES.has(sessionAgent) && !reactionAnswersLatest() && !state.reportStands) {
+      return nudgeEmptyTurn(
+        response,
+        { stopReason, isIncompleteStop: stopReason && INCOMPLETE_STOP_REASONS.has(stopReason) },
+        ladder
+      );
+    }
+    // Pending-input rule: queued user input is folded into
+    // needs_follow_up before terminal completion. Commit the terminal
+    // text first (beforeAppend), then resume.
+    if (
+      drainSteering('terminal', {
+        maxPriority: 'next',
+        beforeAppend: () => keepEndedAnswer(response, hasContent),
+      })
+    ) {
+      state.emptyNudgeStreak = 0;
+      resetOutputLimitRecovery(state);
+      return { action: 'continue', response };
+    }
+    const reminder = todoCompletionReminder(opts.session, {
+      sessionId,
+      sessionAgent,
+      turnLimited: turnLimited(),
+    });
+    if (reminder) {
+      if (keepEndedAnswer(response, hasContent)) state.reportStands = true;
+      messages.push({ role: 'user', content: reminder });
+      return { action: 'continue', response };
+    }
+    return finishTurn(response);
+  }
+
   return {
     // { action: 'continue' | 'break', response }. 'continue' means the
     // recovery appended to the transcript and the loop must re-send;
-    // 'break' returns the (possibly aggregated) terminal response.
+    // 'break' returns the (possibly aggregated) terminal response, with the
+    // ended answers a tool batch cleared from it as its report.
     async resolve(response, iteration) {
-      const hasContent = typeof response.content === 'string' && response.content.trim().length > 0;
-      const stopReason = response.stopReason ?? response.stop_reason ?? null;
-      const isOutputLimitStop = isOutputLimitStopReason(stopReason);
-      if (isOutputLimitStop || (hasContent && response.streamCut === true)) {
-        return resolveOutputLimit(response, ladder);
-      }
-      if (stopReason === 'refusal') return resolveRefusal(response, hasContent, ladder);
-      // Output-limit stops keep the bounded max-output ladder above and
-      // refusals (already returned) keep the bounded refusal retry; both
-      // own their own continuation semantics. No lexical/progress-text
-      // heuristic is consulted.
-      const continuationSignal = isOutputLimitStop ? null : providerContinuationSignal(response);
-      if (
-        continuationSignal &&
-        resumeContinuation(response, { iteration, signal: continuationSignal, hasContent, stopReason }, ladder)
-      ) {
-        return { action: 'continue', response };
-      }
-      // Hidden roles are exempt from the empty-turn nudge: their own role
-      // rules define a different output contract (pipe-separated chunker
-      // output, …) and a text-only terminal turn is the correct shape —
-      // nudging them produces a contradictory user message that traps the
-      // model in a tool-call-blocked vs contract-required oscillation.
-      // A turn that left a reaction on the user's message may end with no
-      // text: the reaction is its answer (react tool), never an empty turn.
-      if (!hasContent && !HIDDEN_AGENT_NAMES.has(sessionAgent) && !reactionAnswersLatest()) {
-        return nudgeEmptyTurn(
-          response,
-          { stopReason, isIncompleteStop: stopReason && INCOMPLETE_STOP_REASONS.has(stopReason) },
-          ladder
-        );
-      }
-      // Pending-input rule: queued user input is folded into
-      // needs_follow_up before terminal completion. Commit the terminal
-      // text first (beforeAppend), then resume.
-      if (
-        drainSteering('terminal', {
-          maxPriority: 'next',
-          beforeAppend: () => {
-            if (segments.commitIntermediate(response) && hasContent)
-              segments.record(response.content, { committed: true });
-          },
-        })
-      ) {
-        state.emptyNudgeStreak = 0;
-        resetOutputLimitRecovery(state);
-        return { action: 'continue', response };
-      }
-      return finishTurn(response);
+      const outcome = await resolveTurn(response, iteration);
+      if (outcome.action !== 'break') return outcome;
+      return { ...outcome, response: finalize(outcome.response) };
+    },
+    // The terminal response of a turn that ended any other way (a capped
+    // turn's overrun) gets the same report.
+    finalize,
+    // Every answer the turn went on past, for a turn that fails after them.
+    endedReport,
+    // Input the turn took in (steering at any boundary) is new work: its
+    // outcome is the turn's, not the kept answer's.
+    noteNewInput() {
+      state.reportStands = false;
+    },
+    // An empty end after the kept answer is that answer's turn ending.
+    get reportStands() {
+      return state.reportStands;
     },
     // A turn that produced tool calls is never an empty contract violation,
     // and it is real progress: a later output-limit cut starts a fresh ladder.
@@ -177,6 +237,12 @@ export function createNoToolTurnResolver({
     // succeeded marks the turn as having reacted.
     noteToolBatchCompleted(calls = [], results = []) {
       state.continuationsSinceToolBatch = 0;
+      noteTodoProgress(opts.session);
+      const stale = staleTodoReminder(opts.session, calls, results, { sessionAgent });
+      if (stale) messages.push({ role: 'user', content: stale, meta: 'hook' });
+      if (state.endedPartsEnd > 0) state.carriedAnswers.push(segments.parts.slice(0, state.endedPartsEnd).join(''));
+      state.endedPartsEnd = 0;
+      if (calls.some((call) => (call?.name ?? call?.function?.name) !== TODO_TOOL.name)) state.reportStands = false;
       segments.clear();
       state.reactions.push(...batchReactions(calls, results));
     },

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -14,7 +14,11 @@
 import { isAgentOwner } from '../../agent-owner.mjs';
 import { isOffReadonlySurface } from './deferred-call-through.mjs';
 import { BRIDGE_CALL_TOOL_NAME, bridgeErrorText, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
-import { sessionAllowlistExcludes, sessionDisallows } from '../../runtime-core/deferred-tool-availability.mjs';
+import {
+  sessionAllowlistExcludes,
+  sessionDisallows,
+  sessionFeatureDenies,
+} from '../../runtime-core/deferred-tool-availability.mjs';
 import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
 import { workflowOverlayDenial } from '../manager/workflow-switch-notice.mjs';
 import { agentMcpToolPermission, connectorPolicyAgentOf, projectMcpToolDisabled } from '../../mcp/agent-connectors.mjs';
@@ -125,6 +129,9 @@ export function preDispatchDenyForSession(sessionRef, call) {
   const workflowDenial = workflowOverlayDenial(sessionRef, schemaName);
   if (workflowDenial) return workflowDenial;
   if (sessionDisallows(sessionRef, schemaName)) {
+    if (sessionFeatureDenies(sessionRef, schemaName)) {
+      return `Error: tool "${schemaName}" is disabled in settings by the user. Do not retry unless the user turns it back on.`;
+    }
     return `Error: tool "${name}" is not available in this session.`;
   }
   // An agent's connectors: a tool of a server it does not mount, or one set

package/src/runtime/agent/orchestrator/session/loop/provider-tool-exclusions.mjs

@@ -43,7 +43,7 @@ export function beginProviderToolExclusions(sessionRef) {
   if (isSessionRef(sessionRef)) sessions.get(sessionRef)?.current.clear();
 }
 
-export function excludedToolNoticeText({ name, pointer, reason }) {
+function excludedToolNoticeText({ name, pointer, reason }) {
   return `Tool "${name}" was excluded from this session's requests: its input schema is invalid at ${pointer || '/'} (${reason}). Fix the tool's schema or disable the tool.`;
 }
 

package/src/runtime/agent/orchestrator/session/loop/route-fallback.mjs

@@ -38,7 +38,7 @@ const HOP_REASONS = {
 const routeLabel = (route) => displayModelName(route.model, route.provider) || `${route.provider}/${route.model}`;
 
 /** The muted transcript line for a hop: `<from> <reason> — switched to <to>.` */
-export function routeFallbackNoticeText(from, to, error) {
+function routeFallbackNoticeText(from, to, error) {
   const reason = HOP_REASONS[providerErrorKind(error).kind] || 'unavailable';
   return `${routeLabel(from)} ${reason} — switched to ${routeLabel(to)}.`;
 }

package/src/runtime/agent/orchestrator/session/loop/steering.mjs

@@ -198,7 +198,8 @@ function injectSteeringEntry(merged, { messages, opts, stage, onSkillPrompt }) {
 // The drain is synchronous (terminal guards depend on that) and returns whether
 // anything was injected. `onSkillPrompt` receives each typed entry so the loop
 // can run its policy-checked skill selection before the next provider snapshot.
-export function createSteeringDrain({ messages, opts, sessionId, onSkillPrompt }) {
+// `onInjected` learns of every drain that added input, whatever its stage.
+export function createSteeringDrain({ messages, opts, sessionId, onSkillPrompt, onInjected = () => {} }) {
   return function drainSteeringIntoMessages(stage = 'mid-turn', options = {}) {
     if (typeof opts.drainSteering !== 'function') return false;
     let steerMsgs = [];
@@ -232,6 +233,7 @@ export function createSteeringDrain({ messages, opts, sessionId, onSkillPrompt }
       totalTextLen += injected.textLength;
       maxQueueWaitMs = Math.max(maxQueueWaitMs, injected.queueWaitMs);
     }
+    onInjected(stage);
     if (sessionId) {
       try {
         process.stderr.write(

package/src/runtime/agent/orchestrator/session/loop/stored-tool-args.mjs

@@ -6,12 +6,11 @@
 // copy `[mixdog compacted …]` back as literal patch input.
 //
 // Mutation bodies (patch / old_string / new_string / content / rewrite) are
-// never collapsed after the fact. The sweep that used to do it (deferBodies
-// plus a settled-body pass on the next push) rewrote a prefix the provider had
-// already cached, and every rewrite re-billed that whole request at the
-// uncached rate. Measured over one 89-task run: $1.20 lost to recover $0.16,
-// because the collapsed tokens only come back at the cached rate over the
-// REMAINING turns, and a task rarely has enough of them left. Bodies now stay
+// never collapsed after the fact. A later sweep would rewrite a prefix the
+// provider has already cached, and every rewrite re-bills that whole request at
+// the uncached rate. Measured over one 89-task run: $1.20 lost to recover
+// $0.16, because the collapsed tokens only come back at the cached rate over
+// the REMAINING turns, and a task rarely has enough of them left. Bodies stay
 // verbatim in history, so the prefix — and its cache — survives the session.
 import { createHash } from 'node:crypto';
 

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -16,6 +16,7 @@ import {
 } from '../../human-gate/gate.mjs';
 import { applyEditedArgs } from '../../human-gate/requests.mjs';
 import { effectiveToolCwd } from '../../../tools/builtin/bash-tool/shell-cwd.mjs';
+import { noteTodoUserWait } from '../no-tool-turn/todo-check.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
@@ -56,7 +57,11 @@ async function askApproval(
   }
   const approval = askOutcome.approval;
   await recordHumanDecision(gate, approval);
-  if (askOutcome.denial) return { denial: askOutcome.denial };
+  if (askOutcome.denial) {
+    // The user said no: this turn may end waiting on them (todo-check.mjs).
+    noteTodoUserWait(callerSessionId);
+    return { denial: askOutcome.denial };
+  }
   if (approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
   // The card's edited text replaces the model's before the call runs.
   if (request?.kind === 'outbound' && approval?.editedArgs) {

package/src/runtime/agent/orchestrator/session/loop/tool-exec/dispatch.mjs

@@ -19,7 +19,9 @@ import {
 } from '../../../tools/builtin.mjs';
 import { executePatchTool } from '../../../tools/patch.mjs';
 import { executeInternalTool, isInternalTool } from '../../../internal-tools.mjs';
+import { settingDisabledTool } from '../../../runtime-core/tool-availability.mjs';
 import { buildSkillsListResponse, viewSkill } from '../tool-helpers.mjs';
+import { executeTodoTool } from '../../../runtime-core/todo-list.mjs';
 import { isOnDeferredToolSurface } from '../deferred-call-through.mjs';
 import { _executeCodeGraphToolLazy } from '../../manager/runtime-loaders.mjs';
 import { requiresReadBody } from '../tool-classify.mjs';
@@ -57,8 +59,8 @@ function dispatchMcp(name, args, { cwd, callerSessionId, sessionRef, executeOpts
     return formatUnknownBuiltinToolMessage(name, args, 'tool');
   }
   // 24h trace data shows ~24% of external MCP calls are cwd-sensitive
-  // (bash / grep / read / list / glob etc.) but the worker session's
-  // cwd was previously dropped here. Inject cwd only when the tool's
+  // (bash / grep / read / list / glob etc.), so the worker session's
+  // cwd must reach them. Inject cwd only when the tool's
   // inputSchema declares the field — schemas without it would reject
   // an unknown argument.
   const needsCwdInjection = cwd && mcpToolHasField(name, 'cwd', mcpScopeId) && (args == null || args.cwd == null);
@@ -120,8 +122,20 @@ function dispatchInternal(
  */
 export function dispatchToolCall({ name, args }, ctx) {
   const { cwd, callerSessionId, sessionRef, executeOpts, toolOpts, completionToolOpts } = ctx;
+  const disabled = settingDisabledTool(name, sessionRef?.mcpScopeId);
+  if (disabled) {
+    return `Error: tool "${disabled}" is disabled in settings by the user; do not retry unless the user turns it back on`;
+  }
   if (name === 'Skill' || name === 'skill_view') return viewSkill(cwd, args?.name, sessionRef);
   if (name === 'skills_list') return buildSkillsListResponse(cwd);
+  // The step list belongs to the calling session itself (Lead or agent).
+  if (name === 'todo') {
+    try {
+      return executeTodoTool(sessionRef, args || {});
+    } catch (error) {
+      return `Error: ${error?.message || String(error)}`;
+    }
+  }
   if (isMcpTool(name)) return dispatchMcp(name, args, ctx);
   if (name === 'code_graph') {
     // cwd chain: args.cwd (caller-explicit) → session cwd → undefined (handler throws)