@bastani/atomic 0.9.19-alpha.5 → 0.9.19-alpha.7

package/docs/workflows/reliable-design.md

@@ -100,14 +100,14 @@ Workflow-authored `ctx.ui` gates remain supported. `workflow answer` relays an a
 
 ### Stage model and thinking-level assignment
 
-Before launching an authored workflow, assign every model stage a **role**, **failure cost**, **primary model**, **thinking level**, and **fallback policy**. Read [Model Selection](/models/model-selection) for the role defaults and [Evals](/models/evals) for the measured per-evaluation scores — its task-type picker maps each stage type (terminal debugging, knowledge-work planning, tool-calling loops, document research, code-reading review) to the eval that measures it and the models that lead it — but treat thinking levels in benchmark rows as measurement configurations, not production defaults. Reserve `max` for high-cost-of-error roles or an explicit user request; use `high` for demanding mapping, lifecycle analysis, compatibility, planning, synthesis, triage, and repair; use `medium` for user-impact review and final reporting; and keep deterministic checks as tool nodes with no model call.
+Before launching an authored workflow, assign every model stage a **role**, **failure cost**, **primary model**, **thinking level**, and **fallback policy**. Read [Model Selection](/models/model-selection) for the role defaults and [Evals](/models/evals) for the measured per-evaluation scores — its task-type picker maps each stage type (terminal debugging, knowledge-work planning, tool-calling loops, document research, code-reading review) to the eval that measures it and the models that lead it — but treat thinking levels in benchmark rows as measurement configurations, not production defaults. Use `low` or `medium` for implementation and routine fixes, and `high` or `xhigh` for code review, test design, failure analysis, and approval decisions when supported. Use `high` for demanding mapping, lifecycle analysis, compatibility, planning, synthesis, and triage, and `medium` for user-impact review and final reporting. `max` is an exception justified by task-specific evidence or an explicit user request, not a role default. Keep deterministic checks as tool nodes with no model call.
 
 Print this compact assignment before launch, with a short cost/quality rationale for each model stage:
 
 ```text
 Stage | Model | Thinking | Role
 map | <catalog fullId> | high | codebase mapping
-approve | <catalog fullId> | max | final approval
+approve | <catalog fullId> | high | final approval
 report | <catalog fullId> | medium | final reporting
 tests | — | — | deterministic check (tool node)
 ```
@@ -410,7 +410,7 @@ Humans can steer the shape directly:
 - **State the loop.** "Iterate until tests pass" or "review and fix until approved" defines a hard workflow stop condition.
 - **State the evidence.** A QA video, test output, generated artifact, or reviewer sign-off tells the graph which gates it needs.
 - **State the boundary.** "Work in a separate worktree", "do not create a PR", or "stop after implementation" separates implementation from final actions.
-- **State the queue policy.** Say how to split, order, isolate, and bound queued items; otherwise Atomic runs the [dependency-triage and bounded-dispatch playbook](#task-queues-and-software-factories) before implementation. Ordinary list order and per-item "create a PR after" wording do not create a cross-item dependency.
+- **State the queue policy.** Say how to split, order, isolate, and bound queued items; otherwise Atomic runs the [dependency-triage and bounded-dispatch playbook](/workflows/reliable-design#task-queues-and-software-factories) before implementation. Ordinary list order and per-item "create a PR after" wording do not create a cross-item dependency.
 
 Absent these controls, Atomic applies the self-prompt and rubric above; a prompt that names none of them delegates the shape decision rather than avoiding it.
 
@@ -1348,6 +1348,8 @@ A failed test becomes the next objective.
 Validation failed on `[command]`. Treat that as the source of truth. Fix the root cause only, rerun the failing check, then report the result.
 ```
 
+<a id="8-interrupt-stale-or-wrong-work" />
+
 #### 8. Pause stale or wrong work
 
 If a run is solving the wrong problem, based on outdated assumptions, or duplicating another run, stop it. Continuing usually creates more cleanup.
@@ -1395,6 +1397,8 @@ Constructive quorum relies on existing Intercom mechanics: every workflow invoca
 
 #### Pattern diagrams
 
+<a id="1-classify-and-act"></a>
+
 ##### 1. Classify-and-act
 
 Builtin definition and contracts: [Six composable pattern builtins](/workflows/builtins#six-composable-pattern-builtins).
@@ -1420,6 +1424,8 @@ Best practices:
 - Keep each action branch isolated with the minimum tools and context it needs.
 - Add a fallback or human-input branch for low-confidence classifications.
 
+<a id="2-fan-out-and-synthesize"></a>
+
 ##### 2. Fan-out-and-synthesize
 
 Builtin definition and contracts: [Six composable pattern builtins](/workflows/builtins#six-composable-pattern-builtins).
@@ -1448,6 +1454,8 @@ Best practices:
 - Save each branch to a separate artifact and pass paths with `reads` instead of inlining all branch output.
 - Treat synthesis as a barrier: it waits for every branch, deduplicates, resolves conflicts, and cites evidence.
 
+<a id="3-adversarial-verification" />
+
 ##### 3. Adversarial verification
 
 Builtin definition and contracts: [Six composable pattern builtins](/workflows/builtins#six-composable-pattern-builtins).
@@ -1486,6 +1494,8 @@ Best practices:
 - Invalid criterion reports are written as invalid artifacts and re-asked in bounded waves up to `reask_limit`; an invalid or missing report is counted in `invalidCount` only and is never converted into a fail vote or included in the mean. If the required quorum is still missing after the re-asks, the round is `indeterminate` rather than silently narrowing the decision.
 - `score_table_path` names the durable `verification-summary-<round>.json` for the final round. Its object contains `scores` (`criterion_id`, integer `score`, `evidence`, and `findings` with `finding` plus `severity`), `mean`, `invalidCount`, the `decision` (`accept`, `repair`, or `indeterminate` with its corresponding mean/findings or missing count), and folded `usage`; `review_report_path` carries repair guidance or quorum evidence.
 
+<a id="4-generate-and-filter"></a>
+
 ##### 4. Generate-and-filter
 
 Builtin definition and contracts: [Six composable pattern builtins](/workflows/builtins#six-composable-pattern-builtins).
@@ -1514,6 +1524,8 @@ Best practices:
 - When the filter ranks candidates rather than applying a threshold, use the same judge guidance as Tournament: graded per-criterion integer scores rather than binary keep/drop, a Bradley–Terry preference from the score gap so near-ties stay near-ties, and K repeats with candidates swapped between the A and B slots. See [Verification scaling](#verification-scaling).
 - For a custom ranking filter, reuse the shared `verification-criteria` module and its `criteria.md` parser rather than inventing a binary keep/drop rubric; stable criterion ids let the judge select the same criteria in each comparison. See [Adversarial verification](#3-adversarial-verification) for the accepted shapes and score decision.
 
+<a id="5-tournament" />
+
 ##### 5. Tournament
 
 Builtin definition and contracts: [Six composable pattern builtins](/workflows/builtins#six-composable-pattern-builtins).
@@ -1547,6 +1559,8 @@ Best practices:
 - The shipped tournament inputs use `num_attempts=4` and `max_concurrency=4`; `n_evaluations=2` repeats each criterion/directed pair, `pivots=1` selects the second comparison phase's pivot candidates, and `seed=0` drives the deterministic schedule. `criteria` is optional and accepts a markdown rubric, a string-to-description record, a string list, or a `CriterionInput` list; omission uses the shipped three-criterion Correctness, Completeness, and Evidence and task fit rubric. Optional ordered `models` ids are assigned round-robin to attempt slots.
 - `comparisons_path` points to `comparisons.json`, whose ledger records the task and seed, `params` (`n`, `pivots`, `n_evaluations`, and normalized `criteria`), per-job `comparisons` rows (`a`, `b`, phase, criterion id, repeat, slot-swap flag, scores or an `invalid` marker, preference, and judge artifact path), aggregate `pairs`, weights/counts, the complete `ranking`, and optional model assignment. Its `budget` records planned versus executed judge stages, including re-asks; invalid reports remain auditable rows and an all-invalid pair remains marked invalid rather than becoming a score.
 
+<a id="6-loop-until-done" />
+
 ##### 6. Loop until done
 
 Builtin definition and contracts: [Six composable pattern builtins](/workflows/builtins#six-composable-pattern-builtins).
@@ -1577,6 +1591,8 @@ Best practices:
 - Progress scores use the anchored 1–20 scale and average valid repeat scores per checkpoint. `classify_trend` uses `window=3`, `riseDelta=1.5`, and `fallDelta=-1.5`; it compares equal leading/trailing halves of the trailing two windows, drops an odd middle sample, and classifies inclusive threshold crossings as `rising`, `flat`, or `regressing`. A short series is `flat` evidence.
 - The trend is monitoring and escalation evidence only: it never kills, terminates, or approves a loop, and the explicit evaluator stop condition remains authoritative. `progress_curve`, `final_trend`, and `progress_disclaimer` are advisory outputs, not alternate closure signals.
 
+<a id="7-constructive-quorum"></a>
+
 ##### 7. Constructive quorum
 
 This prompt-level reviewer pattern is used by the `goal` and `ralph` builtins; it does not add a reducer or quorum mechanism.
@@ -1608,6 +1624,8 @@ Best practices:
 - Change a verdict only through evidence, never deference. Each reviewer emits its own final structured verdict and records whether deliberation changed it and which evidence caused the change.
 - Let the existing deterministic reducer count the final votes; deliberation shapes votes but does not replace quorum counts or the `stop_review_loop` contract.
 
+<a id="stacked-implementation-slices-starter-pattern" />
+
 ##### Stacked implementation slices starter pattern
 
 Use this authoring pattern when one implementation objective should land as a stack of small, independently verified changes. It is not a queue dispatcher: the slices belong to one dependency chain, so slice N+1 starts only after slice N is verified.

package/docs/workflows/verification.md

@@ -4,6 +4,8 @@ Verify the behavior that changed, then give the reviewer enough evidence to unde
 
 For tool installation, automation techniques, platform permissions, and general work in applications, read [Computer use](/computer-use). That guide covers Herdr for terminals, playwright-cli for browsers, and PyAutoGUI with uv for desktop CUA on macOS, Linux, and Windows. It also covers native accessibility and application tools when they are easier or more reliable.
 
+<a id="select-the-verification-environment" />
+
 ## Choose checks that answer the question
 
 Start with the project's existing tests, build, typecheck, and lint commands. Add an interactive scenario when the change affects what a user sees or does. Do not replace required checks with a recording, or create a UI solely to demonstrate a non-UI change.
@@ -54,6 +56,8 @@ playwright-cli -s=pr-check video-stop
 
 Open the saved artifact and confirm it includes the final state. Keep recordings short and focused. Inspect traces, authentication state, and network output for secrets before sharing. See [browser setup and best practices](/computer-use#browser-automation-with-playwright-cli).
 
+<a id="terminal-contracts" />
+
 ### Terminal changes
 
 Use Herdr to send real interactive input and inspect the resulting pane, or use tmux/psmux when Herdr cannot be used. Keep the terminal dimensions and shell relevant to the change. Test narrow layouts or modified keys when those are affected.
@@ -62,6 +66,10 @@ Retain screen captures or transcripts that show the input and result. For cursor
 
 See [terminal setup and capture commands](/computer-use#terminal-automation-with-herdr). A browser rendering of terminal text is not proof that the real TUI accepted input. WSL tmux does not establish native Windows terminal coverage.
 
+<a id="reproduce-stage-skill-terminal-evidence" />
+
+<a id="desktop-safety" />
+
 ### Desktop, simulator, and emulator changes
 
 Run PyAutoGUI through uv in a dedicated graphical session, using [the desktop guide](/computer-use#desktop-automation-with-pyautogui-and-uv). Native accessibility tools or application APIs can give more reliable assertions than pixel matching. For example, check a saved document through the app API after exercising the visible Save flow.

package/examples/extensions/gondolin/index.ts

@@ -1,14 +1,16 @@
 /**
  * Gondolin Tool Routing Example
  *
- * Runs Atomic's built-in tools inside a local Gondolin micro-VM. The host working
- * directory is mounted at /workspace in the guest. File changes under
- * /workspace write through to the host; other guest filesystem changes are
- * isolated to the VM.
+ * Routes read, write, edit, bash, find, ls and user ! commands into a local
+ * Gondolin micro-VM. The host working directory is mounted at /workspace;
+ * changes there write through to the host. Other guest changes stay in the VM.
+ * Search and other unoverridden tools still run on the host. For guest-only
+ * content searches use the routed shell; this is not whole-session isolation.
  *
  * Setup:
  *   cd packages/coding-agent/examples/extensions/gondolin
- *   npm install --ignore-scripts
+ *   npm ci --ignore-scripts
+ *   npm run check  # from this repository: full Gondolin + SSH adapter typecheck
  *
  * Usage:
  *   cd /path/to/project
@@ -24,33 +26,22 @@ import type { ExtensionAPI, ExtensionContext } from "@bastani/atomic";
 import {
 	type BashOperations,
 	createBashTool,
+	createCodingTools,
 	createEditTool,
 	createFindTool,
-	createGrepTool,
 	createLsTool,
 	createReadTool,
 	createWriteTool,
-	DEFAULT_MAX_BYTES,
 	type EditOperations,
 	type FindOperations,
-	formatSize,
-	type GrepToolDetails,
-	type GrepToolInput,
 	type LsOperations,
 	type ReadOperations,
-	truncateHead,
-	truncateLine,
 	type WriteOperations,
 } from "@bastani/atomic";
 import { RealFSProvider, VM } from "@earendil-works/gondolin";
 
 const GUEST_WORKSPACE = "/workspace";
-const DEFAULT_GREP_LIMIT = 100;
-
-type TextToolResult<TDetails> = {
-	content: Array<{ type: "text"; text: string }>;
-	details: TDetails | undefined;
-};
+const GUEST_FUSE_MOUNT = "/data";
 
 function stripAtPrefix(value: string): string {
 	return value.startsWith("@") ? value.slice(1) : value;
@@ -98,20 +89,99 @@ function createGondolinReadOps(vm: VM, localCwd: string): ReadOperations {
 	};
 }
 
-function createGondolinWriteOps(vm: VM, localCwd: string): WriteOperations {
+function createGondolinWriteOps(vm: VM, localCwd: string, workspace: RealFSProvider): WriteOperations {
+	const workspaceRelativePath = (target: string) => {
+		for (const mount of [GUEST_WORKSPACE, `${GUEST_FUSE_MOUNT}${GUEST_WORKSPACE}`]) {
+			if (target === mount || target.startsWith(`${mount}/`)) return target.slice(mount.length) || "/";
+		}
+		return undefined;
+	};
 	return {
-		writeFile: async (filePath, content) => {
-			await vm.fs.writeFile(toGuestPath(localCwd, filePath), content, { encoding: "utf8" });
+		writeFile: async (filePath, content, options) => {
+			const target = toGuestPath(localCwd, filePath);
+			if (!options?.exclusive) {
+				await vm.fs.writeFile(target, content, { encoding: "utf8" });
+				return;
+			}
+			// Both fs.writeFile and the 0.12.0 FUSE bridge discard exclusive flags.
+			// Open through the exact provider mounted at /workspace, not unrelated host IO.
+			let relativePath = workspaceRelativePath(target);
+			if (relativePath === undefined) {
+				// A guest symlink can route an otherwise native-looking parent onto FUSE.
+				const parent = await vm.exec(["/bin/sh", "-c", 'cd "$1" && pwd -P', "sh", path.posix.dirname(target)]);
+				if (parent.exitCode !== 0) throw new Error(parent.stderr);
+				relativePath = workspaceRelativePath(
+					path.posix.join(parent.stdout.replace(/\n$/, ""), path.posix.basename(target)),
+				);
+			}
+			if (relativePath !== undefined) {
+				const mountedPath = relativePath;
+				const handle = await workspace.open(mountedPath, "wx").catch(async (error: NodeJS.ErrnoException) => {
+					// The provider resolves links before open: a dangling collision becomes ENOENT.
+					// Check occupancy in that same mounted namespace, without following the link.
+					if (
+						error.code === "ENOENT" &&
+						(await workspace.lstat(mountedPath).catch(() => undefined))?.isSymbolicLink()
+					) {
+						throw Object.assign(new Error(`EEXIST: file already exists, open '${target}'`), { code: "EEXIST" });
+					}
+					throw error;
+				});
+				try {
+					await handle.writeFile(content, { encoding: "utf8" });
+				} finally {
+					await handle.close();
+				}
+				return;
+			}
+			// Native guest paths do not cross FUSE. Noclobber is enforced by the guest OS.
+			const result = await vm.exec(
+				[
+					"/bin/sh",
+					"-c",
+					'(set -C; cat > "$1") || { if [ -e "$1" ] || [ -L "$1" ]; then exit 17; else exit 1; fi; }',
+					"sh",
+					target,
+				],
+				{ stdin: content },
+			);
+			if (result.exitCode !== 0) {
+				const error = new Error(`Failed to create guest file '${target}': ${result.stderr}`);
+				if (result.exitCode === 17) throw Object.assign(error, { code: "EEXIST" });
+				throw error;
+			}
 		},
 		mkdir: async (dirPath) => {
 			await vm.fs.mkdir(toGuestPath(localCwd, dirPath), { recursive: true });
 		},
+		// Reads inside the guest, so the checks `write` runs before overwriting see the same
+		// filesystem the write lands on rather than the host's. Absence is `undefined`; a path
+		// that exists but cannot be read keeps throwing, since it is not a free path.
+		readFile: async (filePath) => {
+			const target = toGuestPath(localCwd, filePath);
+			try {
+				return await vm.fs.readFile(target, { encoding: "utf8" });
+			} catch (error) {
+				// Gondolin 0.12.0 wraps filesystem errors without preserving errno. Probe
+				// the guest namespace rather than parsing localized error messages.
+				const probe = await vm.exec([
+					"/bin/sh",
+					"-c",
+					'(cd "$2") && { if [ -e "$1" ] || [ -L "$1" ]; then exit 0; else exit 44; fi; }',
+					"sh",
+					target,
+					path.posix.dirname(target),
+				]);
+				if (probe.exitCode === 44) return undefined;
+				throw error;
+			}
+		},
 	};
 }
 
-function createGondolinEditOps(vm: VM, localCwd: string): EditOperations {
+function createGondolinEditOps(vm: VM, localCwd: string, workspace: RealFSProvider): EditOperations {
 	const readOps = createGondolinReadOps(vm, localCwd);
-	const writeOps = createGondolinWriteOps(vm, localCwd);
+	const writeOps = createGondolinWriteOps(vm, localCwd, workspace);
 	return {
 		readFile: readOps.readFile,
 		writeFile: writeOps.writeFile,
@@ -203,110 +273,6 @@ function createGondolinFindOps(vm: VM, localCwd: string): FindOperations {
 	};
 }
 
-function createLineMatcher(pattern: string, literal: boolean | undefined, ignoreCase: boolean | undefined) {
-	if (literal) {
-		const needle = ignoreCase ? pattern.toLowerCase() : pattern;
-		return (line: string) => (ignoreCase ? line.toLowerCase() : line).includes(needle);
-	}
-	const regex = new RegExp(pattern, ignoreCase ? "i" : undefined);
-	return (line: string) => regex.test(line);
-}
-
-function appendGrepBlock(params: {
-	outputLines: string[];
-	lines: string[];
-	relativePath: string;
-	lineIndex: number;
-	contextLines: number;
-}): boolean {
-	let linesTruncated = false;
-	const start = params.contextLines > 0 ? Math.max(0, params.lineIndex - params.contextLines) : params.lineIndex;
-	const end =
-		params.contextLines > 0
-			? Math.min(params.lines.length - 1, params.lineIndex + params.contextLines)
-			: params.lineIndex;
-
-	for (let index = start; index <= end; index++) {
-		const rawLine = params.lines[index] ?? "";
-		const { text, wasTruncated } = truncateLine(rawLine.replace(/\r/g, ""));
-		if (wasTruncated) linesTruncated = true;
-		const separator = index === params.lineIndex ? ":" : "-";
-		params.outputLines.push(`${params.relativePath}${separator}${index + 1}${separator} ${text}`);
-	}
-	return linesTruncated;
-}
-
-async function executeGondolinGrep(
-	vm: VM,
-	localCwd: string,
-	params: GrepToolInput,
-	signal?: AbortSignal,
-): Promise<TextToolResult<GrepToolDetails>> {
-	const root = toGuestPath(localCwd, params.path ?? ".");
-	const rootStat = await vm.fs.stat(root, { signal });
-	const rootIsDirectory = rootStat.isDirectory();
-	const matcher = createLineMatcher(params.pattern, params.literal, params.ignoreCase);
-	const contextLines = params.context && params.context > 0 ? params.context : 0;
-	const effectiveLimit = Math.max(1, params.limit ?? DEFAULT_GREP_LIMIT);
-	const outputLines: string[] = [];
-	const details: GrepToolDetails = {};
-	let matchCount = 0;
-	let matchLimitReached = false;
-	let linesTruncated = false;
-
-	await walkGuestFiles(
-		vm,
-		root,
-		async (guestPath, relativePath) => {
-			if (matchCount >= effectiveLimit) return false;
-			if (params.glob && !matchesToolGlob(relativePath, params.glob)) return true;
-			let content: string;
-			try {
-				content = await vm.fs.readFile(guestPath, { encoding: "utf8", signal });
-			} catch {
-				return true;
-			}
-			const lines = content.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
-			const displayPath = rootIsDirectory ? relativePath : path.posix.basename(guestPath);
-			for (let index = 0; index < lines.length; index++) {
-				if (signal?.aborted) throw new Error("Operation aborted");
-				if (!matcher(lines[index] ?? "")) continue;
-				matchCount++;
-				if (appendGrepBlock({ outputLines, lines, relativePath: displayPath, lineIndex: index, contextLines })) {
-					linesTruncated = true;
-				}
-				if (matchCount >= effectiveLimit) {
-					matchLimitReached = true;
-					return false;
-				}
-			}
-			return true;
-		},
-		signal,
-	);
-	if (matchCount === 0) return { content: [{ type: "text", text: "No matches found" }], details: undefined };
-	const rawOutput = outputLines.join("\n");
-	const truncation = truncateHead(rawOutput, { maxLines: Number.MAX_SAFE_INTEGER });
-	const notices: string[] = [];
-	let output = truncation.content;
-	if (matchLimitReached) {
-		details.matchLimitReached = effectiveLimit;
-		notices.push(`${effectiveLimit} matches limit reached`);
-	}
-	if (linesTruncated) {
-		details.linesTruncated = true;
-		notices.push("long lines truncated");
-	}
-	if (truncation.truncated) {
-		details.truncation = truncation;
-		notices.push(`${formatSize(DEFAULT_MAX_BYTES)} limit reached`);
-	}
-	if (notices.length > 0) output += `\n\n[${notices.join(". ")}]`;
-	return {
-		content: [{ type: "text", text: output }],
-		details: Object.keys(details).length > 0 ? details : undefined,
-	};
-}
 function createGondolinBashOps(vm: VM, localCwd: string, shellPath: string): BashOperations {
 	return {
 		exec: async (command, cwd, { onData, signal, timeout }) => {
@@ -348,23 +314,33 @@ function createGondolinBashOps(vm: VM, localCwd: string, shellPath: string): Bas
 }
 export default function (pi: ExtensionAPI) {
 	const localCwd = process.cwd();
+	const workspace = new RealFSProvider(localCwd);
 	const localRead = createReadTool(localCwd);
 	const localWrite = createWriteTool(localCwd);
 	const localEdit = createEditTool(localCwd);
 	const localBash = createBashTool(localCwd);
-	const localGrep = createGrepTool(localCwd);
 	const localFind = createFindTool(localCwd);
 	const localLs = createLsTool(localCwd);
 	let vm: VM | undefined;
 	let vmStarting: Promise<VM> | undefined;
 	let shellPath = "/bin/sh";
+	let fileTools: ReturnType<typeof createCodingTools> | undefined;
+	function getFileTools(activeVm: VM) {
+		fileTools ??= createCodingTools(GUEST_WORKSPACE, {
+			read: { operations: createGondolinReadOps(activeVm, localCwd) },
+			write: { operations: createGondolinWriteOps(activeVm, localCwd, workspace) },
+			edit: { operations: createGondolinEditOps(activeVm, localCwd, workspace) },
+		});
+		return fileTools;
+	}
 	async function startVm(ctx?: ExtensionContext): Promise<VM> {
 		ctx?.ui.setStatus("gondolin", ctx.ui.theme.fg("accent", `Gondolin: starting ${GUEST_WORKSPACE}`));
 		const created = await VM.create({
 			sessionLabel: `atomic ${path.basename(localCwd)}`,
 			vfs: {
+				fuseMount: GUEST_FUSE_MOUNT,
 				mounts: {
-					[GUEST_WORKSPACE]: new RealFSProvider(localCwd),
+					[GUEST_WORKSPACE]: workspace,
 				},
 			},
 		});
@@ -388,9 +364,11 @@ export default function (pi: ExtensionAPI) {
 		return vmStarting;
 	}
 	pi.on("session_start", async (_event, ctx) => {
+		fileTools = undefined;
 		await ensureVm(ctx);
 	});
 	pi.on("session_shutdown", async (_event, ctx) => {
+		fileTools = undefined;
 		const activeVm = vm;
 		vm = undefined;
 		vmStarting = undefined;
@@ -421,30 +399,27 @@ export default function (pi: ExtensionAPI) {
 		...localRead,
 		async execute(id, params, signal, onUpdate, ctx) {
 			const activeVm = await ensureVm(ctx);
-			const tool = createReadTool(GUEST_WORKSPACE, {
-				operations: createGondolinReadOps(activeVm, localCwd),
-			});
-			return tool.execute(id, params, signal, onUpdate);
+			return getFileTools(activeVm)
+				.find((tool) => tool.name === "read")!
+				.execute(id, params, signal, onUpdate);
 		},
 	});
 	pi.registerTool({
 		...localWrite,
 		async execute(id, params, signal, onUpdate, ctx) {
 			const activeVm = await ensureVm(ctx);
-			const tool = createWriteTool(GUEST_WORKSPACE, {
-				operations: createGondolinWriteOps(activeVm, localCwd),
-			});
-			return tool.execute(id, params, signal, onUpdate);
+			return getFileTools(activeVm)
+				.find((tool) => tool.name === "write")!
+				.execute(id, params, signal, onUpdate);
 		},
 	});
 	pi.registerTool({
 		...localEdit,
 		async execute(id, params, signal, onUpdate, ctx) {
 			const activeVm = await ensureVm(ctx);
-			const tool = createEditTool(GUEST_WORKSPACE, {
-				operations: createGondolinEditOps(activeVm, localCwd),
-			});
-			return tool.execute(id, params, signal, onUpdate);
+			return getFileTools(activeVm)
+				.find((tool) => tool.name === "edit")!
+				.execute(id, params, signal, onUpdate);
 		},
 	});
 	pi.registerTool({
@@ -477,13 +452,6 @@ export default function (pi: ExtensionAPI) {
 			return tool.execute(id, params, signal, onUpdate);
 		},
 	});
-	pi.registerTool({
-		...localGrep,
-		async execute(_id, params, signal, _onUpdate, ctx) {
-			const activeVm = await ensureVm(ctx);
-			return executeGondolinGrep(activeVm, localCwd, params, signal);
-		},
-	});
 	pi.on("user_bash", async (_event, ctx) => {
 		const activeVm = await ensureVm(ctx);
 		return { operations: createGondolinBashOps(activeVm, localCwd, shellPath) };

package/examples/extensions/gondolin/package.json

@@ -6,7 +6,7 @@
 	"scripts": {
 		"clean": "echo 'nothing to clean'",
 		"build": "echo 'nothing to build'",
-		"check": "echo 'nothing to check'"
+		"check": "tsgo -p ../../../test/tsconfig.remote-examples.json"
 	},
 	"dependencies": {
 		"@earendil-works/gondolin": "0.12.0"