one-code-extension 0.1.4 → 0.3.0

package/extensions/web-fetch/index.ts

@@ -11,11 +11,13 @@
  * invisibly, so the fallback is loud, never silent.
  */
 
-import type { Api, Model } from "@earendil-works/pi-ai";
+import type { Api, Model, ThinkingLevel } from "@earendil-works/pi-ai";
 import { completeSimple } from "@earendil-works/pi-ai/compat";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { recordUsage } from "../lib/usage-bus.ts";
 import { Type } from "typebox";
 import { DEFER_CHANNEL } from "../lib/deferred.ts";
+import { withReasoningFallback } from "../lib/model-policy.ts";
 import { htmlToMarkdown, isSameHost, normalizeUrl, paginate } from "./extract.ts";
 import { pickReaderModel, READER_MAX_TOKENS, readerMessages } from "./summarize.ts";
 import { ccToolRenderers } from "../lib/tui-render.ts";
@@ -23,6 +25,12 @@ import { ccToolRenderers } from "../lib/tui-render.ts";
 const DEFAULT_MAX_CHARS = 30_000;
 const CACHE_TTL_MS = 15 * 60 * 1000;
 const FETCH_TIMEOUT_MS = 30_000;
+/** Same-host redirect hops followed before giving up (a redirect loop is otherwise unbounded recursion). */
+const MAX_REDIRECTS = 5;
+/** Response bytes read before the body is cut off — a multi-GB "page" must not be buffered whole. */
+const MAX_BODY_BYTES = 5_000_000;
+/** Cache entries kept; the oldest is evicted past this (the TTL alone never evicted). */
+const MAX_CACHE_ENTRIES = 50;
 /** Longer than the classifier's cap: the reader ingests whole pages. */
 const READER_TIMEOUT_MS = 60_000;
 const USER_AGENT = "one-code/0.1 (+https://github.com/IsuruMaduranga/one-code)";
@@ -60,6 +68,11 @@ async function answerFromPage(
 	entry: { markdown: string; title?: string },
 	url: string,
 	signal: AbortSignal | undefined,
+	/** Per-session memo of a reader model's required thinking level, so a reader that
+	 * cannot disable thinking pays the mandatory-thinking 400 once, not per fetch. */
+	learnedReasoning: Map<string, ThinkingLevel>,
+	/** Report the reader call's usage for the all-in footer cost. */
+	recordCall: (usage: unknown) => void,
 ): Promise<{ answer?: string; reader?: string; truncated?: boolean; error?: string }> {
 	const choice = pickReaderModel(ctx.modelRegistry.getAvailable(), ctx.model);
 	if (!choice) return { error: "no model available to read the page" };
@@ -71,20 +84,31 @@ async function answerFromPage(
 		const baseUrl = (auth as { baseUrl?: string }).baseUrl;
 
 		const messages = readerMessages({ prompt, markdown: entry.markdown, url, title: entry.title });
-		const timeout = AbortSignal.timeout(READER_TIMEOUT_MS);
-		const result = await completeSimple(
-			baseUrl ? ({ ...choice.model, baseUrl } as Model<Api>) : choice.model,
-			{
-				systemPrompt: messages.system,
-				messages: [{ role: "user", content: messages.user, timestamp: Date.now() }],
-			},
-			{
-				apiKey: auth.apiKey,
-				headers: auth.headers,
-				env: auth.env,
-				signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
-				maxTokens: READER_MAX_TOKENS,
+		// Thinking off unless the model cannot disable it; withReasoningFallback sends
+		// a level up front for catalog-marked models and retries on the 400 for the
+		// rest, memoizing the result so repeated fetches don't re-pay the failure.
+		const result = await withReasoningFallback(
+			choice.model,
+			(reasoning) => {
+				const timeout = AbortSignal.timeout(READER_TIMEOUT_MS);
+				return completeSimple(
+					baseUrl ? ({ ...choice.model, baseUrl } as Model<Api>) : choice.model,
+					{
+						systemPrompt: messages.system,
+						messages: [{ role: "user", content: messages.user, timestamp: Date.now() }],
+					},
+					{
+						apiKey: auth.apiKey,
+						headers: auth.headers,
+						env: auth.env,
+						signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
+						maxTokens: READER_MAX_TOKENS,
+						...(reasoning ? { reasoning } : {}),
+					},
+				);
 			},
+			learnedReasoning,
+			recordCall,
 		);
 		const answer = result.content
 			.filter((block): block is { type: "text"; text: string } => block.type === "text")
@@ -98,12 +122,35 @@ async function answerFromPage(
 	}
 }
 
+/** Read a response body as text, stopping after `cap` bytes (the stream is cancelled, not drained). */
+async function readBodyCapped(response: Response, cap: number): Promise<{ text: string; truncated: boolean }> {
+	const reader = response.body?.getReader();
+	if (!reader) return { text: await response.text(), truncated: false };
+	const decoder = new TextDecoder();
+	let text = "";
+	let bytes = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		bytes += value.byteLength;
+		if (bytes > cap) {
+			text += decoder.decode(value.subarray(0, Math.max(0, value.byteLength - (bytes - cap))), { stream: true });
+			await reader.cancel().catch(() => {});
+			return { text: text + decoder.decode(), truncated: true };
+		}
+		text += decoder.decode(value, { stream: true });
+	}
+	return { text: text + decoder.decode(), truncated: false };
+}
+
 export default function webFetchExtension(pi: ExtensionAPI) {
 	// Same 15-minute window Claude Code documents, so repeated reads of one page
 	// during a task don't re-download it.
 	const cache = new Map<string, CacheEntry>();
+	// Per-session: a reader model's learned required thinking level (see answerFromPage).
+	const learnedReasoning = new Map<string, ThinkingLevel>();
 
-	const load = async (url: string, signal: AbortSignal | undefined): Promise<CacheEntry> => {
+	const load = async (url: string, signal: AbortSignal | undefined, redirects = 0): Promise<CacheEntry> => {
 		const cached = cache.get(url);
 		if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) return cached;
 
@@ -127,7 +174,8 @@ export default function webFetchExtension(pi: ExtensionAPI) {
 				if (location) {
 					const target = new URL(location, url).toString();
 					if (isSameHost(target, url)) {
-						return await load(target, signal);
+						if (redirects >= MAX_REDIRECTS) throw new Error(`Too many redirects (${MAX_REDIRECTS}); last target ${target}`);
+						return await load(target, signal, redirects + 1);
 					}
 					throw new Error(`Redirects to a different host: ${target}\nCall web_fetch again with that URL if you want it.`);
 				}
@@ -138,7 +186,7 @@ export default function webFetchExtension(pi: ExtensionAPI) {
 			}
 
 			const contentType = response.headers.get("content-type") ?? "";
-			const body = await response.text();
+			const { text: body, truncated } = await readBodyCapped(response, MAX_BODY_BYTES);
 
 			let entry: CacheEntry;
 			if (contentType.includes("html")) {
@@ -155,7 +203,13 @@ export default function webFetchExtension(pi: ExtensionAPI) {
 				entry = { markdown: body.trim(), fetchedAt: Date.now() };
 			}
 
+			if (truncated) entry.note = [entry.note, `The response was cut at ${MAX_BODY_BYTES / 1_000_000} MB.`].filter(Boolean).join(" ");
 			cache.set(url, entry);
+			while (cache.size > MAX_CACHE_ENTRIES) {
+				const oldest = cache.keys().next().value;
+				if (oldest === undefined) break;
+				cache.delete(oldest);
+			}
 			return entry;
 		} finally {
 			clearTimeout(timer);
@@ -206,7 +260,9 @@ export default function webFetchExtension(pi: ExtensionAPI) {
 				// readerNote, never silently.
 				let readerNote: string | undefined;
 				if (params.prompt) {
-					const answered = await answerFromPage(ctx, params.prompt, entry, target, signal);
+					const answered = await answerFromPage(ctx, params.prompt, entry, target, signal, learnedReasoning, (usage) =>
+						recordUsage(pi, "reader", usage),
+					);
 					if (answered.answer !== undefined) {
 						const header = [
 							entry.title ? `# ${entry.title}` : undefined,

package/extensions/web-fetch/summarize.ts

@@ -14,7 +14,7 @@
  */
 
 import type { Api, Model } from "@earendil-works/pi-ai";
-import { type EconomicalModelChoice, pickEconomicalContainedModel } from "../lib/model-policy.ts";
+import { type EconomicalModelChoice, pickEconomicalContainedModel } from "../lib/model-tier.ts";
 
 /**
  * How much of the page the reader sees. Far past the 30k-char window the main

package/extensions/workflow/agent-session.ts

@@ -1,34 +1,39 @@
 /**
  * In-process subagent execution — the one place the workflow extension
- * touches pi's SDK. Each agent() call becomes a real `createAgentSession()`
- * with an in-memory session; the run shares a single ModelRuntime and
- * DefaultResourceLoader across all its agents (building either per agent is
- * expensive and, for the loader, re-runs every extension factory).
+ * touches pi's SDK. Each agent() call becomes a real agent session with an
+ * in-memory session file; the run shares a single ModelRuntime across all its
+ * agents (building one per agent is expensive). The resource loader is NOT
+ * shared: disposing one session on a loader invalidates the loader's runtime
+ * for every other session built on it (lib/agent-loader.ts, LIFECYCLE-REVIEW
+ * H3), so each agent() call opens its own through `openChildSession`, which
+ * also emits the `session_start` pi's SDK never sends (H2).
  *
- * The shared loader uses `noExtensions: true`, which structurally blocks
- * recursive orchestration (no workflow tool inside subagents) — and would
- * also drop One Code's permission gate, so `permissionGateFactory` is passed
- * via `extensionFactories`, which DefaultResourceLoader always loads.
+ * Each loader uses `noExtensions: true`, which structurally blocks recursive
+ * orchestration (no workflow tool inside subagents) — and would also drop One
+ * Code's permission gate, so `permissionGateFactory` is passed via
+ * `extensionFactories`, which DefaultResourceLoader always loads.
  */
 
 import os from "node:os";
-import { join } from "node:path";
-import {
-	createAgentSession,
-	DefaultResourceLoader,
-	getAgentDir,
-	ModelRuntime,
-	SessionManager,
-	type ToolDefinition,
-} from "@earendil-works/pi-coding-agent";
+import { getAgentDir, type ModelRuntime, SessionManager, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
 import type { Api, Model } from "@earendil-works/pi-ai";
 import { Type } from "typebox";
+import { whenAborted } from "../lib/abort.ts";
+import { createSharedModelRuntime, finalAssistantText, openChildSession } from "../lib/agent-loader.ts";
+import { modelSpec as modelSpecOf } from "../lib/model-policy.ts";
+import { isModelUnavailableError } from "../auto-mode/model-select.ts";
+import { agentPromptIdentity, PrefixWarmGate, prefixWarmKey } from "../lib/prefix-warm-gate.ts";
+import type { PermissionBridge } from "../permissions/subagent-gate.ts";
+import { localGateMode, MODE_ENV } from "../lib/permission-gate.ts";
+import type { HookBridge } from "../hooks/subagent-bridge.ts";
+import { summarizeArgs } from "../lib/tui-render.ts";
 import { agentDirs, type AgentDefinition, discoverAgents } from "../subagents/agents.ts";
+import type { SubagentDefault } from "../subagents/default-model.ts";
 import { expensiveModelGate, resolveSubagentModel, subagentModelMenu } from "../subagents/model-select.ts";
+import { withoutUnusable } from "../lib/model-unusable.ts";
 import { cleanupWorktree, createWorktree, isGitRepo, type Worktree } from "../subagents/worktree.ts";
-import { permissionGateFactory } from "./permission-gate.ts";
-import type { AgentCallOptions, AgentCallResult, AgentEffort } from "./types.ts";
+import type { AgentCallOptions, AgentCallResult, AgentEffort, AgentRunUpdate } from "./types.ts";
 import { WorkflowScriptError } from "./types.ts";
 
 const MAX_SCHEMA_RETRIES = 2;
@@ -38,11 +43,69 @@ export interface AgentRunnerOptions {
 	cwd: string;
 	/** Session model, retained as the final fallback. */
 	defaultModel: unknown;
-	/** `/subagent` user/managed default; automatic role selection follows it. */
-	configuredDefaultModel?: string;
+	/** `/subagent` user/managed default (with its staleness stamp); automatic role selection follows it. */
+	configuredDefault?: SubagentDefault;
 	defaultEffort?: AgentEffort | string;
 	/** Surface model-resolution notices (fallbacks, provider crossings) in the run log. */
 	onNotice?: (message: string) => void;
+	/** Models this account cannot run (`provider/id`), learned this session — dropped from the catalog before resolving (lib/model-unusable.ts). */
+	unusableModels?: () => ReadonlySet<string>;
+	/** An agent's provider refused its model as not usable on this account (`isModelUnavailableError`): report it so every picker skips it. */
+	onModelUnusable?: (model: string, reason: string) => void;
+	/**
+	 * The parent permissions extension's decision closure (same bridge the
+	 * subagent runner uses): when present, a workflow agent's tool calls route
+	 * through the parent's real permission pipeline — mode inheritance, the
+	 * auto-mode classifier, prompts bubbled to the user. Without it the child
+	 * gate falls back to fail-closed local rules, which deny every bash call
+	 * that would normally ask — unusable outside auto/bypass modes.
+	 */
+	getPermissionBridge?: () => PermissionBridge | undefined;
+	/** The parent hooks extension's bridge, so the user's tool hooks run for workflow agents too. */
+	getHookBridge?: () => HookBridge | undefined;
+	/** Each finished agent's dollar cost (review S13: workflow agents never reached the footer). */
+	onUsage?: (cost: number) => void;
+}
+
+/**
+ * Judge one `agent()` prompt as a delegation before the child starts — the
+ * same `Agent` check the main conversation's spawns and a subagent's nested
+ * spawns go through (matcher DELEGATION_TOOLS; subagents/index.ts). The one
+ * `workflow` call was classified when the script was submitted, but every
+ * prompt is computed inside the vm afterwards, often from an earlier agent's
+ * output, and until 2026-09-05 none of them was judged
+ * (PERMISSIONS-REVIEW-2026-09-05 L4). Outside auto mode the bridge allows at
+ * once (Agent is auto-allowed there unless a deny rule names it). Without a
+ * bridge — no publishing parent — the run is allowed unless the live mode is
+ * auto, whose classifier is only reachable through the parent; then it fails
+ * closed. A refusal is thrown as a plain Error, i.e. an agent failure (the
+ * call resolves null, CC semantics), not a WorkflowScriptError: the script's
+ * other agents still run.
+ */
+export async function judgeWorkflowDelegation(input: {
+	bridge: PermissionBridge | undefined;
+	liveMode: string;
+	prompt: string;
+	agentType?: string;
+	label?: string;
+	cwd: string;
+	signal?: AbortSignal;
+}): Promise<void> {
+	if (!input.bridge) {
+		if (input.liveMode === "auto") {
+			throw new Error(
+				"agent() refused: auto mode's classifier is only reachable through the parent session, which this run has no link to",
+			);
+		}
+		return;
+	}
+	const verdict = await input.bridge({
+		toolName: "Agent",
+		input: { subagent_type: input.agentType, prompt: input.prompt, description: input.label },
+		cwd: input.cwd,
+		signal: input.signal,
+	});
+	if (verdict?.block) throw new Error(`agent() refused by the permission gate: ${verdict.reason}`);
 }
 
 /**
@@ -54,7 +117,7 @@ const THINKING_SUFFIX = /^(off|minimal|low|medium|high|xhigh|max)$/i;
 export interface WorkflowModelInput {
 	opts: AgentCallOptions;
 	agentModel?: string;
-	configuredDefaultModel?: string;
+	configuredDefault?: SubagentDefault;
 	sessionModel?: Model<Api>;
 	available: Model<Api>[];
 	defaultEffort?: string;
@@ -79,13 +142,13 @@ export function resolveWorkflowAgentModel(input: WorkflowModelInput): {
 	const resolution = resolveSubagentModel({
 		requested,
 		agentModel: input.agentModel,
-		configuredDefault: input.configuredDefaultModel,
+		configuredDefault: input.configuredDefault,
 		sessionModel: input.sessionModel,
 		available: input.available,
 	});
 	if (resolution.unresolved) {
 		const fallback = resolveSubagentModel({
-			configuredDefault: input.configuredDefaultModel,
+			configuredDefault: input.configuredDefault,
 			sessionModel: input.sessionModel,
 			available: input.available,
 		});
@@ -115,43 +178,28 @@ export function resolveWorkflowAgentModel(input: WorkflowModelInput): {
 export class AgentRunner {
 	private readonly options: AgentRunnerOptions;
 	private readonly modelRuntime: ModelRuntime;
-	private readonly loader: DefaultResourceLoader;
 	private readonly agentCatalog: AgentDefinition[];
 	private readonly availableModels: Model<Api>[];
-	/** Per-agentType loader cache — building one re-runs every extension factory, so each
-	 * agentType's loader is built once (lazily, on first use) and reused for the rest of the run. */
-	private readonly loadersByAgentType = new Map<string, Promise<DefaultResourceLoader>>();
+	/**
+	 * `parallel()` children of one agent type share a request prefix; the first
+	 * starts streaming before the rest go, so the fan-out writes the prefix once
+	 * and reads it N-1 times (lib/prefix-warm-gate.ts).
+	 */
+	private readonly warmGate = new PrefixWarmGate();
 
-	private constructor(
-		options: AgentRunnerOptions,
-		modelRuntime: ModelRuntime,
-		loader: DefaultResourceLoader,
-		agentCatalog: AgentDefinition[],
-		availableModels: Model<Api>[],
-	) {
+	private constructor(options: AgentRunnerOptions, modelRuntime: ModelRuntime, agentCatalog: AgentDefinition[], availableModels: Model<Api>[]) {
 		this.options = options;
 		this.modelRuntime = modelRuntime;
-		this.loader = loader;
 		this.agentCatalog = agentCatalog;
 		this.availableModels = availableModels;
 	}
 
 	static async create(options: AgentRunnerOptions): Promise<AgentRunner> {
 		const agentDir = getAgentDir();
-		const modelRuntime = await ModelRuntime.create({
-			authPath: join(agentDir, "auth.json"),
-			modelsPath: join(agentDir, "models.json"),
-		});
-		const loader = new DefaultResourceLoader({
-			cwd: options.cwd,
-			agentDir,
-			noExtensions: true,
-			extensionFactories: [permissionGateFactory(options.cwd, os.homedir())],
-		});
-		await loader.reload();
+		const modelRuntime = await createSharedModelRuntime(agentDir);
 		const agentCatalog = discoverAgents(agentDirs(options.cwd, os.homedir()));
 		const availableModels = [...(await modelRuntime.getAvailable())];
-		return new AgentRunner(options, modelRuntime, loader, agentCatalog, availableModels);
+		return new AgentRunner(options, modelRuntime, agentCatalog, availableModels);
 	}
 
 	/**
@@ -165,16 +213,21 @@ export class AgentRunner {
 		const resolution = resolveWorkflowAgentModel({
 			opts,
 			agentModel,
-			configuredDefaultModel: this.options.configuredDefaultModel,
+			configuredDefault: this.options.configuredDefault,
 			sessionModel: this.options.defaultModel as Model<Api> | undefined,
-			available: this.availableModels,
+			available: withoutUnusable(this.availableModels, this.options.unusableModels?.() ?? new Set()),
 			defaultEffort: this.options.defaultEffort as string | undefined,
 		});
 		for (const notice of resolution.notices) this.options.onNotice?.(notice);
 		return { model: resolution.model ?? this.options.defaultModel, thinkingLevel: resolution.thinkingLevel };
 	}
 
-	async run(prompt: string, opts: AgentCallOptions, signal: AbortSignal): Promise<AgentCallResult> {
+	async run(
+		prompt: string,
+		opts: AgentCallOptions,
+		signal: AbortSignal,
+		onUpdate?: (update: AgentRunUpdate) => void,
+	): Promise<AgentCallResult> {
 		let agentDef: AgentDefinition | undefined;
 		if (opts.agentType) {
 			agentDef = this.agentCatalog.find((a) => a.name === opts.agentType);
@@ -185,6 +238,10 @@ export class AgentRunner {
 		}
 
 		const modelSpec = this.resolveModel(opts, agentDef?.model);
+		const resolvedModel = modelSpec.model as Model<Api> | undefined;
+		if (resolvedModel?.id) onUpdate?.({ model: resolvedModel.id });
+
+		await this.judgeDelegation(prompt, opts, agentDef, signal);
 
 		let worktree: Worktree | undefined;
 		let cwd = this.options.cwd;
@@ -199,22 +256,58 @@ export class AgentRunner {
 		const capture: { called: boolean; value: unknown } = { called: false, value: undefined };
 		const customTools: ToolDefinition[] = opts.schema ? [buildStructuredOutputTool(opts.schema, capture)] : [];
 
-		const loader = agentDef ? await this.loaderForAgentType(agentDef) : this.loader;
-
-		const { session } = await createAgentSession({
-			cwd,
-			agentDir: getAgentDir(),
-			modelRuntime: this.modelRuntime,
-			model: modelSpec.model as never,
-			thinkingLevel: modelSpec.thinkingLevel as never,
-			tools: agentDef?.tools,
-			customTools,
-			resourceLoader: loader,
-			sessionManager: SessionManager.inMemory(cwd),
+		const session = await openChildSession({
+			loader: {
+				cwd: this.options.cwd,
+				agentDir: getAgentDir(),
+				systemPrompt: agentDef?.systemPrompt,
+				getPermissionBridge: this.options.getPermissionBridge,
+				getHookBridge: this.options.getHookBridge,
+			},
+			session: {
+				cwd,
+				agentDir: getAgentDir(),
+				modelRuntime: this.modelRuntime,
+				model: modelSpec.model as never,
+				thinkingLevel: modelSpec.thinkingLevel as never,
+				tools: agentDef?.tools,
+				customTools,
+				sessionManager: SessionManager.inMemory(cwd),
+			},
+			onError: (error) => this.options.onNotice?.(`${opts.label ?? "agent"}: extension error in ${error.event}: ${error.error}`),
 		});
 
-		const onAbort = () => void session.abort();
-		signal.addEventListener("abort", onAbort, { once: true });
+		const unhookAbort = whenAborted(signal, () => void session.abort());
+		// Forward tool calls for the viewer's Activity pane, and report a provider
+		// refusing the agent's model (the same check the subagent runner makes, so
+		// the refusal reaches every automatic picker — lib/model-unusable.ts).
+		// Never let a bad event shape kill the agent.
+		const unsubscribe = session.subscribe((event) => {
+			try {
+				if (event.type === "message_end") {
+					const reply = (event as { message?: { role?: string; stopReason?: string; errorMessage?: string; provider?: string; model?: string } }).message;
+					if (reply?.role === "assistant" && reply.stopReason === "error" && reply.errorMessage && reply.provider && reply.model && isModelUnavailableError(reply.errorMessage)) {
+						this.options.onModelUnusable?.(modelSpecOf({ provider: reply.provider, id: reply.model }), reply.errorMessage);
+					}
+					return;
+				}
+				if (event.type !== "tool_execution_start" || !onUpdate) return;
+				try {
+					const argsSummary = summarizeArgs((event as { args?: unknown }).args);
+					onUpdate({ tool: { name: event.toolName, argsSummary } });
+				} catch {
+					onUpdate({ tool: { name: event.toolName } });
+				}
+			} catch {
+				// observer only
+			}
+		});
+		// Same prompt identity + cwd + model = same request prefix (see warmGate).
+		const model = session.model;
+		const releasePrefix = await this.warmGate.admitOnFirstToken(
+			prefixWarmKey(agentPromptIdentity(agentDef?.name), cwd, model ? modelSpecOf(model) : undefined),
+			session,
+		);
 		try {
 			await session.prompt(this.buildPrompt(prompt, Boolean(opts.schema)));
 			if (signal.aborted) throw new WorkflowScriptError("aborted");
@@ -245,12 +338,31 @@ export class AgentRunner {
 				worktreePath,
 			};
 		} finally {
-			signal.removeEventListener("abort", onAbort);
+			// Whatever the outcome — success, failure, or an abort (a user stop, or
+			// the run finishing with this agent un-awaited) — the provider was
+			// billed for what ran, so the footer's all-in cost sees it.
+			const cost = session.getSessionStats().cost;
+			if (cost > 0) this.options.onUsage?.(cost);
+			releasePrefix(false);
+			unsubscribe?.();
+			unhookAbort();
 			session.dispose();
 			if (worktree) await cleanupWorktree(this.options.cwd, worktree);
 		}
 	}
 
+	private judgeDelegation(prompt: string, opts: AgentCallOptions, agentDef: AgentDefinition | undefined, signal: AbortSignal): Promise<void> {
+		return judgeWorkflowDelegation({
+			bridge: this.options.getPermissionBridge?.(),
+			liveMode: localGateMode(process.env[MODE_ENV], undefined),
+			prompt,
+			agentType: agentDef?.name,
+			label: opts.label,
+			cwd: this.options.cwd,
+			signal,
+		});
+	}
+
 	private buildPrompt(prompt: string, structured: boolean): string {
 		if (!structured) {
 			return `${prompt}\n\nYour final message is returned verbatim to an orchestration script, not shown to a human — reply with the requested data/report only.`;
@@ -275,35 +387,10 @@ export class AgentRunner {
 		throw new Error("subagent never produced structured output");
 	}
 
-	/** Builds (once) and reuses the loader for this agentType, keyed by agent name. */
-	private loaderForAgentType(agentDef: AgentDefinition): Promise<DefaultResourceLoader> {
-		let pending = this.loadersByAgentType.get(agentDef.name);
-		if (!pending) {
-			pending = this.buildLoaderWithSystemPrompt(agentDef.systemPrompt);
-			// A failed build must not poison the cache — let the next call retry.
-			pending.catch(() => this.loadersByAgentType.delete(agentDef.name));
-			this.loadersByAgentType.set(agentDef.name, pending);
-		}
-		return pending;
-	}
-
-	private async buildLoaderWithSystemPrompt(systemPrompt: string): Promise<DefaultResourceLoader> {
-		const loader = new DefaultResourceLoader({
-			cwd: this.options.cwd,
-			agentDir: getAgentDir(),
-			noExtensions: true,
-			extensionFactories: [permissionGateFactory(this.options.cwd, os.homedir())],
-			systemPrompt,
-		});
-		await loader.reload();
-		return loader;
-	}
-
 	dispose(): void {
-		// ModelRuntime/loader(s) hold no OS resources that need explicit teardown today;
-		// this hook exists so run-manager can stay correct if that changes. The
-		// per-agentType cache is dropped alongside the base loader.
-		this.loadersByAgentType.clear();
+		// The ModelRuntime holds no OS resources that need explicit teardown today
+		// (each agent()'s loader dies with its session); this hook exists so
+		// run-manager can stay correct if that changes.
 	}
 }
 
@@ -329,25 +416,8 @@ function buildStructuredOutputTool(schema: Record<string, unknown>, capture: { c
 	} as ToolDefinition;
 }
 
-export function finalAssistantText(messages: AgentMessage[]): string {
-	for (let i = messages.length - 1; i >= 0; i--) {
-		const message = messages[i];
-		if (message.role !== "assistant") continue;
-		const content = (message as { content: unknown }).content;
-		if (typeof content === "string") return content;
-		if (Array.isArray(content)) {
-			const text = content
-				.filter((b): b is { type: "text"; text: string } => (b as { type?: string }).type === "text")
-				.map((b) => b.text)
-				.join("");
-			if (text.trim()) return text;
-		}
-	}
-	return "";
-}
-
 /** Pull the first parseable JSON object/array out of free text (```json fences first). */
-export function extractJsonObject(text: string): unknown {
+function extractJsonObject(text: string): unknown {
 	const fenced = text.match(/```(?:json)?\s*\n([\s\S]*?)\n```/);
 	const braceIndex = text.indexOf("{");
 	const bracketIndex = text.indexOf("[");