@agentprojectcontext/apx 1.80.2 → 1.89.1

package/src/core/agent/tools/handlers/run-routine.js

@@ -0,0 +1,94 @@
+import { listRoutines, getRoutine } from "#core/stores/routines.js";
+import { summarizeToolTrace } from "#core/agent/tool-summary.js";
+import { resolveProject } from "../helpers.js";
+
+// Run a routine on demand and WAIT for its verdict.
+//
+// The alternative was `run_shell("apx routine run …")`, and that is how it was
+// being done: through the CLI, through the daemon, with the routine's whole
+// stdout landing in the turn — plus, for anything the CLI could not express,
+// python heredocs that rewrote routines.json by hand. One tool call replaces
+// all of it, and the model gets back a verdict instead of a transcript.
+//
+// Blocking is the point. A routine is a job with an end: the agent says "voy a
+// correr la rutina", stops, and speaks again when there is something to report.
+// Polling in a tool loop would spend an iteration and a slice of context per
+// check and still be slower.
+const REPLY_CAP = 1500;
+
+export default {
+  name: "run_routine",
+  schema: {
+    type: "function",
+    function: {
+      name: "run_routine",
+      description:
+        "Run one of a project's routines NOW and wait until it finishes. Returns " +
+        "its verdict (ok / error), what it reported, and which tools it used. " +
+        "Blocking: nothing else happens in this turn until the routine ends, so " +
+        "tell the user you are launching it before you call this. Use it to test " +
+        "a routine you just created or to trigger a scheduled job early. Use " +
+        "list_routines first if you are unsure of the name.",
+      parameters: {
+        type: "object",
+        properties: {
+          routine: { type: "string", description: "Routine name (exact, from list_routines)." },
+          project: { type: "string", description: "Project id, name or path. Omit for the default project." },
+        },
+        required: ["routine"],
+      },
+    },
+  },
+  makeHandler: ({ projects, plugins, registries, globalConfig, requirePermission }) =>
+    async ({ routine: name, project } = {}) => {
+      if (!name) return { error: "run_routine: routine is required" };
+      // A routine runs with permission_mode "total" by design (a cron has
+      // nobody to ask), so triggering one from chat is a real side effect.
+      await requirePermission("run_routine", { dangerous: true, args: { routine: name, project } });
+
+      const p = resolveProject(projects, project);
+      if (!p) return { error: `project not found: ${project}` };
+
+      const r = getRoutine(p.storagePath, name);
+      if (!r) {
+        return {
+          error: `routine "${name}" not found in project ${p.name || p.path}`,
+          available: listRoutines(p.storagePath).map((x) => x.name),
+        };
+      }
+
+      // Imported here, not at module scope: the runner imports the tool
+      // registry (a routine runs a tool loop) and the registry imports this
+      // handler, so a static import closes the cycle and one of the two ends
+      // up half-initialised. Deferring to call time breaks it.
+      const { runRoutineNow } = await import("#core/routines/runner.js");
+
+      let out;
+      try {
+        out = await runRoutineNow(
+          { project: p, projects, plugins, registries, globalConfig, trigger: "agent" },
+          r
+        );
+      } catch (e) {
+        return { routine: name, status: "error", error: e.message };
+      }
+
+      const reply = String(out?.reply || out?.text || "");
+      return {
+        routine: name,
+        project: p.name || p.path,
+        status: out?.status === "error" ? "error" : "ok",
+        ...(out?.skipped ? { skipped: true, note: out.note } : {}),
+        ...(out?.error ? { error: String(out.error).slice(0, 600) } : {}),
+        ...(out?.blocked_tools?.length ? { blocked_tools: out.blocked_tools } : {}),
+        // What it said, capped: the routine's own ledger and conversation hold
+        // the full text, and this is a status report, not a transcript.
+        reply: reply.length > REPLY_CAP ? reply.slice(0, REPLY_CAP) + "…(truncated)" : reply,
+        // Counts, not arguments — enough to tell "it worked" from "it narrated".
+        ...(summarizeToolTrace(out?.trace) ? { tools_used: summarizeToolTrace(out.trace) } : {}),
+        ...(out?.conversation_id ? { conversation_id: out.conversation_id } : {}),
+        last_run_at: out?.last_run_at,
+        next_run_at: out?.next_run_at,
+      };
+    },
+};

package/src/core/agent/tools/handlers/run-shell.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import { resolveProject, safePathJoin } from "../helpers.js";
 
-function run(command, { cwd, timeoutMs }) {
+function run(command, { cwd, timeoutMs, abortSignal }) {
   return new Promise((resolve) => {
     const child = spawn("sh", ["-lc", command], { cwd, env: process.env });
     let stdout = "";
@@ -12,10 +12,19 @@ function run(command, { cwd, timeoutMs }) {
       child.kill("SIGTERM");
     }, timeoutMs);
 
+    const onAbort = () => {
+      child.kill("SIGTERM");
+    };
+    if (abortSignal) {
+      if (abortSignal.aborted) onAbort();
+      else abortSignal.addEventListener("abort", onAbort, { once: true });
+    }
+
     child.stdout.on("data", (d) => { stdout += d.toString(); });
     child.stderr.on("data", (d) => { stderr += d.toString(); });
     child.on("close", (code, signal) => {
       clearTimeout(timer);
+      abortSignal?.removeEventListener("abort", onAbort);
       resolve({ code, signal, timedOut, stdout, stderr });
     });
   });
@@ -43,6 +52,25 @@ function isSafeShellCommand(command) {
   });
 }
 
+// Commands that stop or restart the daemon this tool is running INSIDE.
+// Killing your own host mid-turn is not a dangerous-but-valid action, it is a
+// guaranteed loss: the process dies, every in-flight turn dies with it, the
+// stream to the user is cut, and the work of the turn is gone with no report.
+// Seen in production — an agent that had just edited a handler ran `apx restart`
+// "to load the new code" and executed itself two steps from finishing.
+//
+// Checked per command SEGMENT, so `cd x && apx restart` and
+// `sleep 1; apx daemon stop` are both caught, while a segment that merely
+// mentions the command — `echo "run apx restart when I'm done"` — is not.
+const SELF_KILL_RE =
+  /^(?:apx\s+(?:restart\b|daemon\s+(?:restart|stop|kill)\b)|(?:pkill|killall)\b.*\bapx[-\s]?daemon\b)/i;
+
+export function killsOwnDaemon(command) {
+  return String(command || "")
+    .split(/\s*(?:;|\||&&|\|\|)\s*/)
+    .some((segment) => SELF_KILL_RE.test(segment.trim()));
+}
+
 export default {
   name: "run_shell",
   schema: {
@@ -62,15 +90,29 @@ export default {
       },
     },
   },
-  makeHandler: ({ projects, requirePermission }) => async ({ project, cwd = ".", command, timeout_s = 60, confirmed = false }) => {
+  makeHandler: (ctx) => async ({ project, cwd = ".", command, timeout_s = 60, confirmed = false }) => {
+    const { projects, requirePermission, abortSignal } = ctx;
     await requirePermission("run_shell", { dangerous: !isSafeShellCommand(command), confirmed, args: { command } });
     if (!command) throw new Error("run_shell: command required");
+    if (killsOwnDaemon(command)) {
+      // An error, not a confirmation prompt: there is no answer that makes this
+      // succeed. Say why, and say what to do instead — code the agent just wrote
+      // is loaded by a restart the USER runs, after the turn has reported back.
+      return {
+        error:
+          "refused: that command restarts or stops the APX daemon you are running inside. " +
+          "It would kill this turn before you could report anything. Finish the work and tell " +
+          "the user to run it — a daemon restart is theirs to make, not something to do mid-turn.",
+        command,
+      };
+    }
 
     const p = resolveProject(projects, project);
     const workingDir = safePathJoin(p.path, cwd);
     const result = await run(command, {
       cwd: workingDir,
       timeoutMs: Math.max(1, Math.min(timeout_s, 600)) * 1000,
+      abortSignal,
     });
     return {
       exit_code: result.code,

package/src/core/agent/tools/handlers/send-telegram.js

@@ -2,26 +2,48 @@ import { canNudge, recordNudge, nudgeFeedbackKeyboard } from "#core/nudge/index.
 import { CHANNELS } from "#core/constants/channels.js";
 
 /**
- * Is the person we are about to message the same person who is talking to us
- * right now?
+ * Is this message a REACTION to something that arrived, or the agent deciding
+ * on its own to speak?
  *
- * PUSH PATH 3 OF 4, and the only one whose solicited-ness is not fixed. When
- * the turn came in over Telegram and the text is going back to that same chat,
- * the user is on the other end waiting — that is a reply, not an interruption,
- * and spending their daily budget on it would be wrong. Every other case (a
- * routine, a web turn pushing to the phone, a cron) is APX choosing to speak.
+ * PUSH PATH 3 OF 4, and the only one whose solicited-ness is not fixed. The
+ * budget exists to stop APX inventing reasons to interrupt; it was never meant
+ * to swallow an answer to a message somebody actually sent.
+ *
+ * A turn on a conversation channel EXISTS because something came in — a
+ * WhatsApp from a contact, a web prompt, an A2A relay. Reporting that to the
+ * owner is the point of the bridge, not an interruption the agent thought up,
+ * so it does not spend the allowance. Only a self-started turn does: a routine
+ * or a cron, which arrive on CHANNELS.ROUTINE and keep paying.
+ *
+ * Recipient still matters, or "someone messaged me" becomes a licence to push
+ * anywhere. Telegram keeps its stricter rule (back to the originating chat
+ * only); every other channel may reach the DEFAULT chat — the owner's — and
+ * naming an explicit chat_id makes it a push again.
+ *
+ * NOTE: reactive means unbounded by design. A third party who messages the
+ * WhatsApp line controls how often the owner is pinged. That is the trade the
+ * owner asked for; the ledger still records every send.
  */
-function isReplyToTheLiveChat(ctx, chatId) {
-  if (ctx?.channel !== CHANNELS.TELEGRAM) return false;
-  // buildTelegramMeta (channels/telegram/helpers.js:59) spells it `chatId`.
-  // Reading `chat_id` here would have silently made every reply look
-  // unsolicited and started charging the user's budget for their own answers.
-  const origin = ctx?.channelMeta?.chatId ?? ctx?.channelMeta?.chat_id;
-  if (!origin) return false;
-  // No chat_id given means "the channel default", which for a Telegram turn is
-  // the chat it arrived on.
-  if (chatId == null || chatId === "") return true;
-  return String(chatId) === String(origin);
+function isReactiveReply(ctx, chatId) {
+  // No channel at all, or a routine/cron turn: the agent chose to speak.
+  if (!ctx?.channel) return false;
+  if (ctx.channel === CHANNELS.ROUTINE) return false;
+
+  if (ctx.channel === CHANNELS.TELEGRAM) {
+    // buildTelegramMeta (channels/telegram/helpers.js:59) spells it `chatId`.
+    // Reading `chat_id` here would have silently made every reply look
+    // unsolicited and started charging the user's budget for their own answers.
+    const origin = ctx?.channelMeta?.chatId ?? ctx?.channelMeta?.chat_id;
+    if (!origin) return false;
+    // No chat_id given means "the channel default", which for a Telegram turn
+    // is the chat it arrived on.
+    if (chatId == null || chatId === "") return true;
+    return String(chatId) === String(origin);
+  }
+
+  // WhatsApp, web, desktop, api, a2a…: no Telegram chat of their own, so the
+  // default chat is the owner's and that is the only one they get for free.
+  return chatId == null || chatId === "";
 }
 
 function decodeBase64(b64) {
@@ -126,7 +148,7 @@ export default {
       );
     }
 
-    const solicited = isReplyToTheLiveChat(ctx, chat_id);
+    const solicited = isReactiveReply(ctx, chat_id);
     const gate = canNudge(
       {
         kind: ctx?.channelMeta?.routineName ? `routine:${ctx.channelMeta.routineName}` : "agent_message",

package/src/core/agent/tools/handlers/set-agent-prompt.js

@@ -0,0 +1,44 @@
+import { setAgentPrompt } from "#core/apc/agent-write.js";
+import { projectMeta, resolveProject } from "../helpers.js";
+
+// Replace an existing agent's system prompt (the body of its `.md`), keeping
+// every frontmatter field. The native counterpart of `apx agent set --prompt`
+// and the MCP `agent_set_prompt`, so the super-agent can rewrite an agent's
+// instructions without shelling out or hand-editing the file.
+export default {
+  name: "set_agent_prompt",
+  schema: {
+    type: "function",
+    function: {
+      name: "set_agent_prompt",
+      description:
+        "Replace an existing project agent's system prompt (its instructions), keeping its name/role/skills/model. Use this to fix or rewrite what an agent does — not run_shell, not write_file on the .md. `system` is required and non-empty.",
+      parameters: {
+        type: "object",
+        required: ["agent", "system"],
+        properties: {
+          project: { type: "string", description: "Project id, name or path. Omit or 'default' for ~/.apx/projects/default." },
+          agent:   { type: "string", description: "Slug of the existing agent (from list_agents)." },
+          system:  { type: "string", description: "The new full system prompt. REQUIRED, non-empty." },
+        },
+      },
+    },
+  },
+  makeHandler: ({ projects, requirePermission }) => async ({ project, agent, system } = {}) => {
+    await requirePermission("set_agent_prompt", { dangerous: true, args: { agent, project } });
+    if (!agent) return { error: "agent required" };
+    let p;
+    try {
+      p = resolveProject(projects, project || "default");
+    } catch (e) {
+      return { error: e.message };
+    }
+    try {
+      setAgentPrompt(p, agent, system);
+      projects.rebuild(p.id);
+      return { ok: true, agent, project: projectMeta(projects, p) };
+    } catch (e) {
+      return { error: e.message };
+    }
+  },
+};

package/src/core/agent/tools/handlers/view-media.js

@@ -0,0 +1,69 @@
+// view_media — load one of a skill's images INTO the agent's own context so it
+// can reason about it (a swing position, a grip, a course diagram). The image
+// manifest (id → caption) rides in the prompt for ~nothing; the pixels are
+// pulled only when the agent asks, on the turn it asks — the same
+// pay-as-you-go rule as read_skill for text.
+//
+// The bytes come back as base64 in an `images` field. run-agent.js lifts that
+// off the JSON result and onto the tool message so a vision engine (Gemini)
+// renders it as an inlineData part; text engines simply ignore it and see the
+// caption. Nothing base64 ever lands in the transcript text.
+import fs from "node:fs";
+
+// A guard so a huge asset can't blow the turn's token budget. ~5 MB of base64
+// is already a lot for one image; above that, tell the model to pick another.
+const MAX_BYTES = 5 * 1024 * 1024;
+
+export default {
+  name: "view_media",
+  schema: {
+    type: "function",
+    function: {
+      name: "view_media",
+      description:
+        "Load one of your skill's images into your own context so you can see and reason about it (a position, a grip, a diagram). Pass the image id from the skill manifest. Only call this when you actually need to look — to attach an image to your reply, use attach_media instead.",
+      parameters: {
+        type: "object",
+        properties: {
+          id: { type: "string", description: "image id from the skill manifest" },
+          skill: { type: "string", description: "optional skill slug to disambiguate a shared id" },
+        },
+        required: ["id"],
+      },
+    },
+  },
+  makeHandler: (ctx = {}) => ({ id, skill } = {}) => {
+    if (!id) throw new Error("view_media: id required");
+    const pool = Array.isArray(ctx.attachableMedia) ? ctx.attachableMedia : [];
+    if (!pool.length) return { error: "no images available for this agent's skills." };
+
+    const want = String(id).trim();
+    const matches = pool.filter((m) => m.id === want && (!skill || m.skill === skill));
+    if (!matches.length) {
+      return {
+        error: `no image "${want}"${skill ? ` in skill ${skill}` : ""}.`,
+        available: pool.map((m) => ({ id: m.id, skill: m.skill, caption: m.caption })),
+      };
+    }
+    const item = matches[0];
+    let buf;
+    try {
+      buf = fs.readFileSync(item.path);
+    } catch (e) {
+      return { error: `could not read image "${want}": ${e?.message || e}` };
+    }
+    if (buf.length > MAX_BYTES) {
+      return {
+        error: `image "${want}" is ${(buf.length / 1048576).toFixed(1)} MB, over the ${(MAX_BYTES / 1048576).toFixed(0)} MB view limit.`,
+      };
+    }
+    return {
+      ok: true,
+      id: item.id,
+      skill: item.skill,
+      caption: item.caption || "",
+      note: `Loaded image "${item.id}" — described in the caption and shown to you now.`,
+      images: [{ data: buf.toString("base64"), mime: item.mime || "image/jpeg" }],
+    };
+  },
+};

package/src/core/agent/tools/handlers/write-agent-memory.js

@@ -0,0 +1,52 @@
+import { appendAgentMemory, writeAgentMemory } from "#core/agent/memory.js";
+import { readAgents } from "#core/apc/parser.js";
+import { projectMeta, resolveProject } from "../helpers.js";
+
+// Write ANOTHER agent's memory (~/.apx/projects/<id>/agents/<slug>/memory.md).
+// Distinct from `remember`, which writes the super-agent's OWN notebook: this
+// seeds or updates a project agent's memory so it can track progress across
+// runs (e.g. a coach recording which topics it has already taught). Append is
+// the default; `mode: "replace"` overwrites the whole file.
+export default {
+  name: "write_agent_memory",
+  schema: {
+    type: "function",
+    function: {
+      name: "write_agent_memory",
+      description:
+        "Write a note into a PROJECT AGENT's own memory.md (not your own notebook — that's `remember`). Use it to seed or update what another agent knows across runs. Default mode appends a dated line under '## Recent context'; mode 'replace' overwrites the whole file. Give the agent slug (from list_agents).",
+      parameters: {
+        type: "object",
+        required: ["agent", "content"],
+        properties: {
+          project: { type: "string", description: "Project id, name or path. Omit or 'default' for ~/.apx/projects/default." },
+          agent:   { type: "string", description: "Slug of the agent whose memory to write (from list_agents)." },
+          content: { type: "string", description: "The note (append mode) or the full memory body (replace mode)." },
+          mode:    { type: "string", enum: ["append", "replace"], description: "append (default) adds a dated line under Recent context; replace overwrites." },
+        },
+      },
+    },
+  },
+  makeHandler: ({ projects, requirePermission }) => async ({ project, agent, content, mode = "append" } = {}) => {
+    await requirePermission("write_agent_memory", { dangerous: true, args: { agent, project } });
+    if (!agent) return { error: "agent required" };
+    if (!content || !String(content).trim()) return { error: "content required" };
+    let p;
+    try {
+      p = resolveProject(projects, project || "default");
+    } catch (e) {
+      return { error: e.message };
+    }
+    if (!readAgents(p.path).some((a) => a.slug === agent)) {
+      return { error: `agent ${agent} not found in ${projectMeta(projects, p).name}` };
+    }
+    try {
+      const path = mode === "replace"
+        ? writeAgentMemory(p, agent, String(content))
+        : appendAgentMemory(p, agent, String(content));
+      return { ok: true, agent, mode, project: projectMeta(projects, p), path };
+    } catch (e) {
+      return { error: e.message };
+    }
+  },
+};

package/src/core/agent/tools/helpers.js

@@ -3,11 +3,39 @@
 // core/apc/projects-helpers.js and is re-exported here for back-compat.
 import path from "node:path";
 import { agentSkills, buildAgentSystem as buildCoreAgentSystem } from "#core/agent/build-agent-system.js";
+import { agentForcedModel } from "#core/agent/agent-model.js";
 import { buildConfirmDescription } from "#core/confirmation/index.js";
 import { PERMISSION_MODES, DEFAULT_PERMISSION_MODE } from "#core/constants/permissions.js";
 
 export { projectMeta, resolveProject } from "#core/apc/projects-helpers.js";
 
+/**
+ * A missing-argument error that names what the tool actually takes.
+ *
+ * "task required" is true and useless. The model that triggered it had passed
+ * `id` — the key list_tasks hands back — so the error confirmed something was
+ * missing without saying what would satisfy it. It retried the identical call,
+ * gave up, and left the task open. Naming the accepted keys and echoing the
+ * ones that arrived ends that in one step instead of three.
+ *
+ * @param {string} tool      tool name, for the message
+ * @param {string} missing   the parameter that was not supplied
+ * @param {{required?: string[], optional?: string[]}} accepts
+ * @param {object} got       the args the model actually sent
+ */
+export function missingArg(tool, missing, accepts = {}, got = {}) {
+  const required = accepts.required || [];
+  const optional = accepts.optional || [];
+  const sent = Object.keys(got || {});
+  return {
+    error:
+      `${missing} required. ${tool} takes ${required.join(", ") || "(none required)"}` +
+      `${optional.length ? ` (optional: ${optional.join(", ")})` : ""}` +
+      `${sent.length ? `; you sent ${sent.join(", ")}` : "; you sent nothing"}.`,
+    expects: { required, optional },
+  };
+}
+
 export function safePathJoin(root, sub = ".") {
   const target = path.resolve(root, sub || ".");
   const rootResolved = path.resolve(root);
@@ -24,10 +52,14 @@ export function skillsFromFields(fields = {}) {
 export function agentRow(agent) {
   return {
     slug: agent.slug,
-    role: agent.fields.Role || null,
-    model: agent.fields.Model || null,
-    language: agent.fields.Language || null,
-    description: agent.fields.Description || null,
+    name: agent.name || agent.fields?.Name || agent.slug,
+    type: agent.fields?.Type || null,
+    role: agent.fields?.Role || null,
+    // Only a real override is worth telling the model about — `inherit` says
+    // nothing it can act on.
+    model: agentForcedModel(agent) || null,
+    language: agent.fields?.Language || null,
+    description: agent.fields?.Description || null,
     skills: skillsFromFields(agent.fields),
   };
 }

package/src/core/agent/tools/names.js

@@ -13,7 +13,14 @@ export const TOOLS = Object.freeze({
   LIST_AGENTS:         "list_agents",
   LIST_VAULT_AGENTS:   "list_vault_agents",
   IMPORT_AGENT:        "import_agent",
+  CREATE_AGENT:        "create_agent",
+  SET_AGENT_PROMPT:    "set_agent_prompt",
+  WRITE_AGENT_MEMORY:  "write_agent_memory",
+  CONFIGURE_AGENT:     "configure_agent",
+  REMOVE_AGENT:        "remove_agent",
   LIST_MCPS:           "list_mcps",
+  LIST_MCP_TOOLS:      "list_mcp_tools",
+  ADD_MCP:             "add_mcp",
 
   // Memory
   READ_AGENT_MEMORY:   "read_agent_memory",
@@ -36,13 +43,23 @@ export const TOOLS = Object.freeze({
   // Skills + dynamic tool surface
   LIST_SKILLS:         "list_skills",
   LOAD_SKILL:          "load_skill",
+  READ_SKILL:          "read_skill",
+  ATTACH_MEDIA:        "attach_media",
+  VIEW_MEDIA:          "view_media",
   DISCOVER_TOOLS:      "discover_tools",
 
   // Tasks
   LIST_TASKS:          "list_tasks",
   CREATE_TASK:         "create_task",
+  COMPLETE_TASK:       "complete_task",
+  COMMENT_TASK:        "comment_task",
   RECORD_COMMITMENT:   "record_commitment",
+  MARK_COMMITMENT:     "mark_commitment",
   REMEMBER_ROUTINE:    "remember_routine",
+
+  // Routines
+  LIST_ROUTINES:       "list_routines",
+  RUN_ROUTINE:         "run_routine",
   LIST_COMMITMENTS:    "list_commitments",
 
   // Interaction
@@ -68,6 +85,12 @@ export const TOOLS = Object.freeze({
   GITHUB_LIST_REPOS:   "github_list_repos",
   GITHUB_CREATE_ISSUE: "github_create_issue",
 
+  // Integrations — Google Calendar plugin (see core/integrations/plugins/calendar.js)
+  CALENDAR_LIST_EVENTS:  "calendar_list_events",
+  CALENDAR_FIND_SLOT:    "calendar_find_slot",
+  CALENDAR_CREATE_EVENT: "calendar_create_event",
+  CALENDAR_UPDATE_EVENT: "calendar_update_event",
+
   // Integrations — Obsidian plugin (see core/integrations/plugins/obsidian.js)
   OBSIDIAN_SEARCH_NOTES: "obsidian_search_notes",
   OBSIDIAN_READ_NOTE:    "obsidian_read_note",
@@ -104,8 +127,18 @@ export const NATIVE_TOOL_NAMES = new Set([
   TOOLS.LIST_AGENTS,
   TOOLS.LIST_VAULT_AGENTS,
   TOOLS.IMPORT_AGENT,
+  TOOLS.CREATE_AGENT,
+  TOOLS.SET_AGENT_PROMPT,
+  TOOLS.WRITE_AGENT_MEMORY,
+  TOOLS.CONFIGURE_AGENT,
+  TOOLS.REMOVE_AGENT,
+  TOOLS.ADD_MCP,
+  TOOLS.COMPLETE_TASK,
+  TOOLS.COMMENT_TASK,
+  TOOLS.MARK_COMMITMENT,
   TOOLS.ADD_PROJECT,
   TOOLS.LIST_MCPS,
+  TOOLS.LIST_MCP_TOOLS,
   TOOLS.READ_AGENT_MEMORY,
   TOOLS.LIST_FILES,
   TOOLS.READ_FILE,
@@ -129,6 +162,10 @@ export const NATIVE_TOOL_NAMES = new Set([
   TOOLS.OBSIDIAN_READ_NOTE,
   TOOLS.OBSIDIAN_WRITE_NOTE,
   TOOLS.OBSIDIAN_LIST_NOTES,
+  TOOLS.CALENDAR_LIST_EVENTS,
+  TOOLS.CALENDAR_FIND_SLOT,
+  TOOLS.CALENDAR_CREATE_EVENT,
+  TOOLS.CALENDAR_UPDATE_EVENT,
   TOOLS.SEND_TELEGRAM,
   TOOLS.SET_IDENTITY,
   TOOLS.SET_PERMISSION_MODE,
@@ -136,11 +173,16 @@ export const NATIVE_TOOL_NAMES = new Set([
   TOOLS.REMEMBER,
   TOOLS.LIST_SKILLS,
   TOOLS.LOAD_SKILL,
+  TOOLS.READ_SKILL,
+  TOOLS.ATTACH_MEDIA,
+  TOOLS.VIEW_MEDIA,
   TOOLS.LIST_TASKS,
   TOOLS.CREATE_TASK,
   TOOLS.RECORD_COMMITMENT,
   TOOLS.LIST_COMMITMENTS,
   TOOLS.REMEMBER_ROUTINE,
+  TOOLS.LIST_ROUTINES,
+  TOOLS.RUN_ROUTINE,
   TOOLS.ASK_QUESTIONS,
   TOOLS.SEARCH_SESSIONS,
   TOOLS.TRANSCRIBE_AUDIO,
@@ -187,6 +229,7 @@ export const CODE_PLAN_TOOLS = Object.freeze([
   TOOLS.TAIL_MESSAGES,
   TOOLS.LIST_SKILLS,
   TOOLS.LOAD_SKILL,
+  TOOLS.READ_SKILL,
   TOOLS.LIST_TASKS,
   TOOLS.LIST_COMMITMENTS,
   TOOLS.ASK_QUESTIONS,
@@ -236,6 +279,15 @@ export const SIDE_EFFECT_TOOLS = new Set([
   TOOLS.RUN_SHELL,
   TOOLS.CALL_RUNTIME,
   TOOLS.ADD_PROJECT,
+  TOOLS.CREATE_AGENT,
+  TOOLS.SET_AGENT_PROMPT,
+  TOOLS.WRITE_AGENT_MEMORY,
+  TOOLS.CONFIGURE_AGENT,
+  TOOLS.REMOVE_AGENT,
+  TOOLS.ADD_MCP,
+  TOOLS.COMPLETE_TASK,
+  TOOLS.COMMENT_TASK,
+  TOOLS.MARK_COMMITMENT,
   TOOLS.SET_IDENTITY,
 ]);
 
@@ -245,6 +297,18 @@ export const SIDE_EFFECT_TOOLS = new Set([
  */
 export const ACK_ONLY_TOOLS = new Set([TOOLS.SEND_TELEGRAM]);
 
+/**
+ * Tools that put words in front of a PERSON.
+ *
+ * Deduping these needs more than the exact (name + args) match every other
+ * side effect gets: a model asked to relay something re-words it each time it
+ * tries, so three sends with the same content and three different openers all
+ * looked distinct and all three arrived. Measured on 2026-08-30 — one WhatsApp
+ * from a contact produced three near-identical Telegram messages to the owner.
+ * See loop/side-effects.js for the comparison itself.
+ */
+export const MESSAGE_TOOLS = new Set([TOOLS.SEND_TELEGRAM]);
+
 /**
  * Tools whose semantics REQUIRE handing control back to a human. The loop
  * breaks after these even under a completion contract, because the task

package/src/core/agent/tools/registry-bridge.js

@@ -64,12 +64,35 @@ function buildSchema(entry) {
   };
 }
 
+/**
+ * A bridged tool runs in the DAEMON's process, which stands in the apx checkout
+ * — so a relative path it is handed resolves against that checkout instead of
+ * against the project whose agent asked. `grep {path: "work/marketing/…"}` from
+ * Magui in Appsi came back "path does not exist:
+ * /…/agentprojectcontext/apx/work/marketing/…". A native tool has the registry
+ * to ask (see scopeProjects); a bridged one crosses HTTP and arrives with no
+ * project at all, so the caller's directory has to travel WITH the request.
+ *
+ * Only for the file tools, and only when the caller did not name one: `cwd` is
+ * a default for relative paths, never an override of an absolute one.
+ */
+function bridgeCwd(entry, args, ctx) {
+  if (entry.category !== "file") return null;
+  if (args.cwd) return null;
+  const scoped = ctx?.projects?.current?.();
+  return scoped?.path || null;
+}
+
 function buildHandler(entry) {
-  return ({ globalConfig }) => async (args = {}) => {
+  return (ctx = {}) => async (args = {}) => {
+    const { globalConfig } = ctx;
     const port = globalConfig?.port || process.env.APX_PORT || 7430;
     const method = String(entry.endpoint?.method || "POST").toUpperCase();
     let url = `http://127.0.0.1:${port}${entry.endpoint?.path || ""}`;
 
+    const cwd = bridgeCwd(entry, args, ctx);
+    if (cwd) args = { ...args, cwd };
+
     const token = daemonToken();
     const opts = {
       method,