@pheem49/mint 1.16.0 → 1.17.0

package/crates/mint-core/src/orchestration/workspace_helpers.rs

@@ -127,7 +127,7 @@ pub(super) async fn read_diagnostics(
         }
     };
     match command {
-        Some(command) => run_shell(root, config, chat_id, command).await,
+        Some(command) => run_shell(root, config, chat_id, command, "").await,
         None => Ok("No diagnostics command detected.".into()),
     }
 }
@@ -155,19 +155,46 @@ pub(super) fn view_image(path: &Path, config: &MintConfig) -> Result<String, Orc
     };
     let metadata = std::fs::metadata(&path)
         .map_err(|e| OrchestrationError::Agent(format!("cannot stat image: {e}")))?;
-    if metadata.len() > 2_000_000 {
-        return Ok(format!(
-            "Image exists but is too large to inline ({} bytes): {}",
-            metadata.len(),
-            path.display()
+    if metadata.len() > crate::media::tool_images::ORIGINAL_LIMIT as u64 {
+        return Err(OrchestrationError::Agent(
+            "Image exceeds 20 MiB; use a smaller capture.".into(),
         ));
     }
     let bytes = std::fs::read(&path)
         .map_err(|e| OrchestrationError::Agent(format!("cannot read image: {e}")))?;
-    Ok(format!(
-        "data:{mime};base64,{}",
-        BASE64_STANDARD.encode(bytes)
-    ))
+    crate::media::tool_images::prepare(&bytes, mime)
+        .map(|image| image.data_uri)
+        .map_err(OrchestrationError::Agent)
+}
+
+#[cfg(test)]
+mod image_size_regressions {
+    use super::*;
+    #[test]
+    fn a_large_valid_image_is_prepared_for_the_model_instead_of_discarded() {
+        let path =
+            std::env::temp_dir().join(format!("mint-large-image-{}.png", uuid::Uuid::new_v4()));
+        let mut seed = 123456789u32;
+        let image = image::RgbImage::from_fn(1400, 900, |_, _| {
+            let mut p = [0; 3];
+            for v in &mut p {
+                seed ^= seed << 13;
+                seed ^= seed >> 17;
+                seed ^= seed << 5;
+                *v = seed as u8;
+            }
+            image::Rgb(p)
+        });
+        image.save(&path).unwrap();
+        assert!(std::fs::metadata(&path).unwrap().len() > 2_000_000);
+        let mut config = MintConfig::default();
+        config.allowed_read_paths.push(std::env::temp_dir());
+        let result = view_image(&path, &config);
+        let _ = std::fs::remove_file(path);
+        let image = result.unwrap();
+        assert!(image.starts_with("data:image/"));
+        assert!(image.len() < 2_700_000);
+    }
 }
 
 // `async` and dispatched onto tokio's blocking-thread-pool via
@@ -188,17 +215,30 @@ pub(super) async fn run_shell(
     config: &MintConfig,
     chat_id: &str,
     command: &str,
+    retry_reason: &str,
 ) -> Result<String, OrchestrationError> {
     tools::shell::prevent_duplicate_browser_launch(command).await?;
+    run_control::check()?;
+    if let Err(reason) = reliability::before_shell(command, retry_reason) {
+        return Ok(format!("Skipped: {reason}"));
+    }
     let root = root.to_path_buf();
     let config = config.clone();
     let chat_id = chat_id.to_owned();
     let command = command.to_owned();
+    let cancellation = run_control::token();
     let output = {
         let command = command.clone();
         tokio::task::spawn_blocking(move || {
             crate::bg_shell::with_context(crate::bg_shell::chat_context(&root, &chat_id), || {
-                run_shell_command(&command, &root, true, &config, Some(&chat_id))
+                crate::shell::run_shell_command_cancellable(
+                    &command,
+                    &root,
+                    true,
+                    &config,
+                    Some(&chat_id),
+                    cancellation.as_ref(),
+                )
             })
         })
         .await
@@ -209,16 +249,7 @@ pub(super) async fn run_shell(
         .status
         .map_or_else(|| "unknown".into(), |status| status.to_string());
 
-    let mut hint = "";
-    let cmd_lower = command.to_lowercase();
-    if output.success
-        && (cmd_lower.contains("open")
-            || cmd_lower.contains("launch")
-            || cmd_lower.contains("chrome")
-            || cmd_lower.contains("firefox"))
-    {
-        hint = "\nNote: Opening URLs, files, folders, or launching applications are background processes. Even if there are warnings or stdout/stderr outputs, since the command exited successfully with status 0, the operation has succeeded and you should now use the 'finish' action to inform the user.";
-    }
+    reliability::record_shell(&output);
 
     let warning_line = output
         .sandbox_warning
@@ -227,8 +258,8 @@ pub(super) async fn run_shell(
         .unwrap_or_default();
 
     Ok(format!(
-        "exit: {}\nmode: {}\nsandboxed: {}{}\nstdout:\n{}\nstderr:\n{}{}",
-        status_str, output.mode, output.sandboxed, warning_line, output.stdout, output.stderr, hint
+        "exit: {}\nmode: {}\nsandboxed: {}{}\nstdout:\n{}\nstderr:\n{}",
+        status_str, output.mode, output.sandboxed, warning_line, output.stdout, output.stderr
     ))
 }
 

package/crates/mint-core/src/prompts/agent.rs

@@ -1,31 +1,12 @@
 use super::persona;
 use crate::MintConfig;
 
-pub(crate) fn browser_endpoint_available(config: &MintConfig) -> bool {
-    use std::net::{TcpStream, ToSocketAddrs};
-    use std::time::Duration;
-    let endpoint = config
+pub(crate) fn browser_tools_enabled(config: &MintConfig) -> bool {
+    config
         .extra
-        .get("browserDebugUrl")
-        .and_then(serde_json::Value::as_str)
-        .unwrap_or("http://127.0.0.1:9222/json/list");
-    let Ok(url) = reqwest::Url::parse(endpoint) else {
-        return false;
-    };
-    let Some(host) = url.host_str() else {
-        return false;
-    };
-    let Some(port) = url.port_or_known_default() else {
-        return false;
-    };
-    (host, port)
-        .to_socket_addrs()
-        .ok()
-        .is_some_and(|mut addresses| {
-            addresses.any(|address| {
-                TcpStream::connect_timeout(&address, Duration::from_millis(50)).is_ok()
-            })
-        })
+        .get("browserAutomationEnabled")
+        .and_then(serde_json::Value::as_bool)
+        != Some(false)
 }
 
 pub(crate) const PLAN_MODE_ALLOWED_ACTIONS: &[&str] = &[
@@ -65,13 +46,6 @@ pub(crate) const PLAN_MODE_ALLOWED_ACTIONS: &[&str] = &[
     "video_waveform",
     "note_write",
     "mcp_list_tools",
-    "browser_open",
-    "browser_read",
-    "browser_observe",
-    "browser_wait",
-    "browser_scroll",
-    "browser_mouse_move",
-    "browser_screenshot",
     "run_shell",
     // Read-only poll of a background job's buffered output; the run_shell
     // call that started it is still gated to read-only commands above.
@@ -79,7 +53,8 @@ pub(crate) const PLAN_MODE_ALLOWED_ACTIONS: &[&str] = &[
     // Cosmetic/non-mutating — no reason to block it during read-only
     // plan-mode investigation.
     "avatar_signal",
-    "conversation_summary",
+    "dispatch_agents",
+    "dispatch_subagent",
 ];
 
 /// The full set of coding-agent actions before plan-mode/disabled-tools/browser
@@ -88,7 +63,6 @@ pub(crate) const PLAN_MODE_ALLOWED_ACTIONS: &[&str] = &[
 /// two paths can never drift on which actions exist.
 pub(crate) fn base_allowed_actions() -> Vec<&'static str> {
     vec![
-        "conversation_summary",
         "list_files",
         "read_file",
         "search_code",
@@ -172,7 +146,7 @@ pub fn build_system_prompt(
 ) -> String {
     let mut allowed_actions = base_allowed_actions();
 
-    if browser_endpoint_available(config) {
+    if browser_tools_enabled(config) {
         allowed_actions.extend_from_slice(crate::browser::BROWSER_TOOLS);
     }
 
@@ -180,6 +154,11 @@ pub fn build_system_prompt(
         allowed_actions.push("avatar_signal");
     }
 
+    if native {
+        allowed_actions.push("dispatch_agents");
+        allowed_actions.push("dispatch_subagent");
+    }
+
     allowed_actions.retain(|action| !config.disabled_tools.contains(&action.to_string()));
     if plan_mode {
         allowed_actions.retain(|action| PLAN_MODE_ALLOWED_ACTIONS.contains(action));
@@ -283,7 +262,7 @@ pub fn build_system_prompt(
         input_formats.push("- browser_key_press: {\"key\":\"Enter\"} (keys: Enter,Tab,Escape,Backspace,Delete,ArrowUp,ArrowDown,ArrowLeft,ArrowRight,F1-F12,Space)");
     }
     if allowed_actions.contains(&"browser_screenshot") {
-        input_formats.push("- browser_screenshot: {}");
+        input_formats.push("- browser_screenshot: {mode?:viewport|fullPage|element,selector?:string,elementRef?:string}");
     }
     if allowed_actions.contains(&"memory_recall") {
         input_formats.push("- memory_recall: {\"query\":\"what did user say about X\"}");
@@ -314,7 +293,7 @@ pub fn build_system_prompt(
         input_formats.push("- request_user_approval: {\"title\":\"short title\",\"summary\":\"what needs approval\"}");
     }
     if allowed_actions.contains(&"ask_user") {
-        input_formats.push("- ask_user: {\"query\":\"short question\",\"header\":\"optional short tag\",\"multiSelect\":false,\"options\":[{\"label\":\"choice 1\",\"description\":\"optional detail\"},{\"label\":\"choice 2\"}]} (header, multiSelect, and options are all optional; options is max 3 choices, each with an optional one-line description; set multiSelect true to let the user pick more than one; omit options entirely for a free-text question — the user can always type a custom answer instead of picking a choice. Use this only when you're blocked on a decision that is genuinely the user's to make — one you can't resolve from the request, the code, or a sensible default. Don't use it to ask for permission to proceed or to confirm something you can just go do.)");
+        input_formats.push("- ask_user: {\"query\":\"short question\",\"header\":\"optional short tag\",\"multiSelect\":false,\"options\":[{\"label\":\"choice 1\",\"description\":\"optional detail\"},{\"label\":\"choice 2\"}]} (header, multiSelect, and options are all optional; options is max 3 choices, each with an optional one-line description; set multiSelect true to let the user pick more than one; omit options entirely for a free-text question — the user can always type a custom answer instead of picking a choice. Use this tool when you need the user's direction, or after proposing a plan/recommendation to ask how they want to proceed before mutating code. Avoid using it for trivial micro-steps that the user already explicitly authorized.)");
     }
     if allowed_actions.contains(&"detect_project") {
         input_formats.push("- detect_project: {\"path\":\".\"}");
@@ -480,6 +459,11 @@ pub fn build_system_prompt(
             "0. For casual conversation or questions that need no local tool, use finish immediately.",
         );
     }
+    if allowed_actions.contains(&"ask_user") {
+        rules.push(
+            "0q. When proposing plans, architectural options, or recommendations, do not treat casual affirmations (such as 'OK', 'ดีมาก', 'เข้าใจแล้ว') as immediate orders to modify code. Instead, call ask_user with clear options (Option 1 with '(Recommended)', alternative options, and allowing custom input) to confirm whether the user wants to execute the plan or merely review it.",
+        );
+    }
     if allowed_actions.contains(&"list_files") || allowed_actions.contains(&"read_file") {
         rules.push("1. Inspect the workspace before editing.");
         rules.push("1a. For user folders such as Downloads, Documents, Desktop, Pictures, Music, or Videos, use list_files with that folder name or ~/folder before using shell.");
@@ -505,6 +489,7 @@ pub fn build_system_prompt(
         rules.push("4. Shell commands and file edits require user approval. Mint handles approval after you request the tool.");
         rules.push("4a. SKILL CHANGES: Create or edit reusable skills only when the user asks for that work. Otherwise complete the current task and suggest the skill in your summary. Use write_file or apply_patch for skill files so Mint can show the concrete diff and request approval for each change. A general file or session permission does not authorize changing persistent skill instructions. After approval, report the saved skill path and what changed.");
     }
+    rules.push("Execution evidence: distinguish succeeded, failed, running, cancelled and unknown. Inspect background jobs with shell_output before claiming completion. Retry a command after relevant changes or with retryReason, but observe ambiguous side effects before repeating them. finish.completionStatus must be verified, unverified, blocked or failed; a verification explanation cannot override failed or pending checks. When checks cannot run, finish honestly with unverified/blocked and the reason. Opening a browser or starting a process completes only that step, not the user's entire task.");
     if allowed_actions.contains(&"run_shell") {
         rules.push("5. Shell commands are classified as readOnly, test, network, or mutating. Only policy-allowed modes may run after approval. Never request destructive commands such as rm -rf, git reset --hard, git checkout --, or git clean -f.");
     }
@@ -532,8 +517,11 @@ pub fn build_system_prompt(
     if allowed_actions.contains(&"avatar_signal") {
         rules.push("7v. A Project Avatar is connected. Call avatar_signal when your reply carries an emotional beat the automatic tool-based reactions can't express — greeting, joking, apologizing, thinking something over. Don't call it for routine tool-driven turns (shell, browser, image/video generation); those already react on their own.");
     }
+    if allowed_actions.contains(&"run_shell") && !allowed_actions.contains(&"browser_open") {
+        rules.push("7a. For browsing, viewing, or capturing websites/webpages: use run_shell to run headless browser commands directly (e.g. google-chrome --headless=new --screenshot=screenshot.png <url>). ALWAYS call view_image with the generated image path (e.g. view_image(path: \"screenshot.png\")) immediately after capturing a screenshot so you and the user can inspect the visual result. Do NOT write ad-hoc Python scraping scripts (urllib, requests) or raw curl to scrape modern web pages when browser tools or headless chrome commands are available.");
+    }
     if allowed_actions.contains(&"browser_open") {
-        rules.push("7a. Use browser_open to open websites in the automation browser. Inspect the returned page observation, then use browser_observe/browser_read to read the page or browser_screenshot for visual inspection; verify the requested URL/content with browser_wait before finishing. A successful browser_open already opens the website for the user: do not also launch it through run_shell, xdg-open, open, Start-Process, or another browser. Keep website navigation and interaction in the automation browser. If the user explicitly requests an external browser, use that route instead of first opening the website in automation. If automation is unavailable or blocked, report that and ask the user before switching browsers.");
+        rules.push("7a. Use browser_open to open websites; Mint starts an isolated browser session automatically (headless by default). Inspect the returned page observation, then use browser_observe/browser_read to read the page or browser_screenshot for visual inspection; verify the requested URL/content with browser_wait before finishing. A successful browser_open already opens the website for the user: do not also launch it through run_shell, xdg-open, open, Start-Process, or another browser. Keep website navigation and interaction in the automation browser. If the user explicitly requests an external browser, use that route instead of first opening the website in automation. If automation is unavailable or blocked, report that and ask the user before switching browsers. For a predefined command-line workflow, write a JSON steps file and run mint browser run --file <file> through run_shell; --headed explicitly shows its window. Use the shared engine rather than hand-written browser scripts. Web scraping restriction: NEVER write ad-hoc Python scripts (e.g., using urllib, requests, BeautifulSoup) or raw curl commands to scrape or inspect web pages. Modern websites require JavaScript rendering via the browser engine. Always prioritize browser_open when given a web URL.");
     }
     if allowed_actions.contains(&"browser_click") {
         rules.push("7b. Use browser_click to click elements. Selector can be: CSS selector (button.class, #id, [attr=val]), text=ExactText to find by visible text, contains=PartialText for partial match, or xpath=//expr for XPath. Prefer text= or contains= when the element has visible text but no unique CSS class.");
@@ -556,10 +544,10 @@ pub fn build_system_prompt(
         rules.push("7g. Use browser_key_press to press a keyboard key (e.g. Enter, Tab, Escape, ArrowDown). Use after browser_type or browser_mouse_click to interact with focused elements.");
     }
     if allowed_actions.contains(&"browser_screenshot") {
-        rules.push("7h. Use browser_screenshot to capture the current page as a PNG image (base64). Use it to inspect the visual state of the page before deciding where to click.");
+        rules.push("7h. Use browser_screenshot to capture the page as a durable image artifact, shown in chat and attached to the model. Use it to inspect the visual state of the page before deciding where to click, and to capture visual verification of page content for the user.");
     }
     if allowed_actions.contains(&"browser_observe") {
-        rules.push("7i. Browser workflow: browser_observe -> action -> inspect the returned observation -> verify the expected result with browser_wait. Each run starts in its own tab. Use browser_tabs to list/open/select/close tabs; select new popup tabs explicitly. Prefer elementRef from the most recent observation over guessing selectors. Old refs expire after observation refresh, navigation, removed nodes, or tab selection. browser_fill replaces text; browser_type appends. browser_select handles native dropdowns; browser_scroll scrolls the viewport or a target. browser_wait accepts condition url/text/visible/hidden, value or target, and timeoutMs (default 10000, maximum 30000). Observations support textOffset and elementOffset pagination. Coordinate actions require a screenshot of the selected tab within 30 seconds. Never retry an ambiguous click or submission automatically; observe and check the result first. input_dispatched is not task completion. Cite observed URL/text/field evidence in finish.verification, or say the task is unverified/blocked. If blocked by login, CAPTCHA, or repeated lack of progress, ask_user for manual takeover; only after user confirmation call browser_observe with takeoverComplete=true.");
+        rules.push("7i. Browser workflow: browser_observe -> action -> inspect the returned observation -> verify the expected result with browser_wait. Each run starts in its own tab. Use browser_tabs to list/open/select/close tabs; select new popup tabs explicitly. Prefer elementRef from the most recent observation over guessing selectors. Old refs expire after observation refresh, navigation, removed nodes, or tab selection. browser_fill replaces text; browser_type appends. browser_select handles native dropdowns; browser_scroll scrolls the viewport or a target. browser_wait accepts condition url/text/visible/hidden, value or target, and timeoutMs (default 10000, maximum 30000). Observations support textOffset and elementOffset pagination. Coordinate actions require a screenshot of the selected tab within 30 seconds. Never retry an ambiguous click or submission automatically; observe and check the result first. input_dispatched is not task completion. Cite observed URL/text/field evidence in finish.verification, or say the task is unverified/blocked. Age Gate & Cookie Consent Handling: If an age gate (18+ confirmation), cookie banner, or disclaimer modal blocks page content, locate standard confirmation buttons (e.g. \"I am 18 or older\", \"Enter Site\", \"Yes\", \"Agree\", \"Accept\") and dismiss it using browser_click. If the overlay presents sensitive warnings requiring explicit user discretion or consent, capture a browser_screenshot and use ask_user to confirm before proceeding. If blocked by login, CAPTCHA, or repeated lack of progress, ask_user for manual takeover; only after user confirmation call browser_observe with takeoverComplete=true.");
     }
     if allowed_actions.contains(&"memory_recall") {
         rules.push("8. Use memory_recall to search past interactions before asking the user to repeat context.");
@@ -568,7 +556,10 @@ pub fn build_system_prompt(
         rules.push("8a. Use git_status and git_diff before summarizing local code changes.");
     }
     if allowed_actions.contains(&"create_plan") || allowed_actions.contains(&"update_plan") {
-        rules.push("8b. When the user asks to plan, structure, or inspect a workflow ('วางแผน', 'plan', 'structure', 'audit'), call `create_plan` FIRST with your step checklist before doing deep execution. Keep investigation focused and concise: NEVER recursively read dozens of source files when a directory listing, symbols, search_code, or architectural overview is sufficient.");
+        rules.push("8b. Plan Mode & Pre-Planning Reconnaissance: When in plan mode or when the user asks to plan, structure, or inspect a workflow ('วางแผน', 'plan', 'structure', 'audit'), call `create_plan` FIRST with your step checklist before doing deep execution. When investigating, gathering facts across multiple files, tracing workflows, or verifying architecture, ALWAYS delegate broad exploration to parallel read-only subagents (`dispatch_agents` with base 'explorer') rather than sequentially reading dozens of files in the main turn. Subagents explore concurrently in isolated sandboxes and return concise dossiers, keeping your planning context clean and fast. Formulate your structured step checklist (`create_plan`) and final plan based on their synthesized findings.");
+    }
+    if allowed_actions.contains(&"dispatch_agents") {
+        rules.push("8c. Subagent Swarm Delegation (`dispatch_agents`): Delegate independent, broad, or exploratory tasks to parallel subagents to keep the main conversation context clean. Provide `tasks: [{ role, base, instruction }]`. In plan mode, all subagents run strictly read-only ('explorer') to gather reconnaissance without side-effects. Outside plan mode, read-only subagents run concurrently up to the parallel limit while write tasks serialize in a single lane. Subagents return capped structured dossiers directly back into your context — you synthesize their findings and present the final answer to the user.");
     }
     if allowed_actions.contains(&"note_write") {
         rules.push("9. Use note_write to save information to ~/.config/mint/notes/ when asked to remember something.");

package/crates/mint-core/src/prompts/tool_catalog.rs

@@ -12,7 +12,7 @@ use std::path::Path;
 
 use serde_json::{Value, json};
 
-use super::agent::{PLAN_MODE_ALLOWED_ACTIONS, base_allowed_actions, browser_endpoint_available};
+use super::agent::{PLAN_MODE_ALLOWED_ACTIONS, base_allowed_actions, browser_tools_enabled};
 use crate::MintConfig;
 use crate::chat::ToolSpec;
 use crate::subagents::list_subagents;
@@ -34,15 +34,14 @@ fn tool(name: &str, description: &str, parameters: Value) -> ToolSpec {
 }
 
 /// Builds the native tool-calling catalog for the current request: the set of
-/// actions available given `config.disabled_tools`, whether the automation
-/// browser is reachable on port 9222, and whether plan mode is active (which
+/// actions available given `config.disabled_tools`, whether browser automation is enabled, and whether plan mode is active (which
 /// restricts to investigation-only actions plus `exit_plan_mode`).
 ///
 /// Mirrors the exact filtering `build_system_prompt` applies to
 /// `base_allowed_actions`, so the two code paths can never offer a different
 /// set of tools for the same request.
 ///
-/// `dispatch_subagent` is deliberately **not** part of `base_allowed_actions`
+/// `dispatch_agents` is deliberately **not** part of `base_allowed_actions`
 /// (which also drives the legacy JSON-prompt path) — it's native-tool-calling
 /// only, same scoping as context compaction. `allow_subagent_dispatch` should
 /// be `false` when building the catalog for a subagent's own nested loop, so
@@ -55,7 +54,7 @@ pub fn tool_catalog(
     allow_subagent_dispatch: bool,
 ) -> Vec<ToolSpec> {
     let mut allowed = base_allowed_actions();
-    if browser_endpoint_available(config) {
+    if browser_tools_enabled(config) {
         allowed.extend_from_slice(crate::browser::BROWSER_TOOLS);
     }
     if !config.avatar_token.is_empty() && !config.avatar_signal_disabled {
@@ -79,37 +78,86 @@ pub fn tool_catalog(
     // and can be streamed as the final answer.
     tools.push(finish_tool());
 
-    if allow_subagent_dispatch && !plan_mode {
+    if allow_subagent_dispatch {
         let subagents = list_subagents(Some(root));
-        if !subagents.is_empty() {
-            tools.push(dispatch_subagent_tool(&subagents));
+        let available_subagents: Vec<_> = if plan_mode {
+            subagents
+                .into_iter()
+                .filter(|s| {
+                    let perms = crate::swarm::AgentPermissions::from_tools(s.tools.as_deref());
+                    !perms.is_write_capable()
+                })
+                .collect()
+        } else {
+            subagents
+        };
+        if !available_subagents.is_empty() {
+            tools.push(dispatch_agents_tool(&available_subagents, plan_mode));
         }
     }
 
+    if let Some(permissions) = crate::swarm::current_permissions() {
+        tools.retain(|t| permissions.allows(&t.name));
+    }
+
     tools
 }
 
-fn dispatch_subagent_tool(subagents: &[crate::subagents::SubagentDefinition]) -> ToolSpec {
+fn dispatch_agents_tool(
+    subagents: &[crate::subagents::SubagentDefinition],
+    plan_mode: bool,
+) -> ToolSpec {
     let names: Vec<String> = subagents.iter().map(|s| s.name.clone()).collect();
     let catalog_text = subagents
         .iter()
         .map(|s| format!("- {}: {}", s.name, s.description))
         .collect::<Vec<_>>()
         .join("\n");
+    let description = if plan_mode {
+        format!(
+            "Delegate exploratory reconnaissance tasks to isolated, read-only sub-agents running \
+             concurrently in their own contexts to investigate across files, trace flows, or verify \
+             system facts before creating the plan. In plan mode, all subagents run strictly read-only.\n\
+             Available read-only base profiles (defaults to 'explorer'):\n{catalog_text}"
+        )
+    } else {
+        format!(
+            "Delegate one or more focused tasks to isolated sub-agents that run concurrently in \
+             their own contexts and return capped dossiers — use this to investigate across files, \
+             trace flows, or check hypotheses without polluting your main context.\n\
+             Base profiles decide the permissions of each agent (defaults to 'explorer'):\n{catalog_text}"
+        )
+    };
     tool(
-        "dispatch_subagent",
-        &format!(
-            "Delegate a focused sub-task to a specialized subagent that runs in its own \
-             isolated context and returns only its final result — use this to investigate \
-             something without filling up your own context with the intermediate steps. \
-             Available subagents:\n{catalog_text}"
-        ),
+        "dispatch_agents",
+        &description,
         schema(
             json!({
-                "name": { "type": "string", "enum": names, "description": "Which subagent to dispatch." },
-                "instruction": { "type": "string", "description": "The task/question to give the subagent." }
+                "tasks": {
+                    "type": "array",
+                    "description": "List of tasks to run concurrently in isolated sub-agents.",
+                    "items": {
+                        "type": "object",
+                        "properties": {
+                            "role": {
+                                "type": "string",
+                                "description": "Display label and focus for this agent (e.g. 'stripe-webhook-tracer')."
+                            },
+                            "base": {
+                                "type": "string",
+                                "enum": names,
+                                "description": "Profile deciding permissions. Defaults to 'explorer' (read-only)."
+                            },
+                            "instruction": {
+                                "type": "string",
+                                "description": "The task, research question, or command to execute."
+                            }
+                        },
+                        "required": ["instruction"]
+                    }
+                }
             }),
-            &["name", "instruction"],
+            &["tasks"],
         ),
     )
 }
@@ -126,7 +174,11 @@ fn finish_tool() -> ToolSpec {
                 },
                 "verification": {
                     "type": "string",
-                    "description": "Verification performed after file changes and its result; otherwise omit."
+                    "description": "Observed check results, or the reason completion is limited. Prose cannot override actual execution evidence."
+                },
+                "completionStatus": {
+                    "type": "string", "enum": ["verified", "unverified", "blocked", "failed"],
+                    "description": "Use verified only with actual evidence. Use unverified/blocked/failed and explain limitations in verification."
                 }
             }),
             &["summary"],
@@ -162,16 +214,6 @@ fn all_tools() -> Vec<ToolSpec> {
                 &["arguments"],
             ),
         ),
-        tool(
-            "conversation_summary",
-            "Internal tool representing a compacted conversation history summary from previous steps.",
-            schema(
-                json!({
-                    "summary": { "type": "string", "description": "Compacted summary text." }
-                }),
-                &[],
-            ),
-        ),
         tool(
             "list_files",
             "List files and directories under a workspace path, ~/path, or an allowed user folder (Downloads, Documents, Desktop, Pictures, Music, Videos).",
@@ -424,7 +466,10 @@ fn all_tools() -> Vec<ToolSpec> {
         tool(
             "browser_screenshot",
             "Capture the current automation browser page as an image.",
-            schema(json!({}), &[]),
+            schema(
+                json!({"mode":{"type":"string","enum":["viewport","fullPage","element"]},"selector":{"type":"string"},"elementRef":{"type":"string"}}),
+                &[],
+            ),
         ),
         tool(
             "memory_recall",
@@ -560,7 +605,7 @@ fn all_tools() -> Vec<ToolSpec> {
         ),
         tool(
             "ask_user",
-            "Ask the user a short question, optionally with up to 3 pick-a-choice options (each with an optional description), optionally allowing multiple selections, and optionally tagged with a short header label. The user can still answer freely. Use this tool only when you're blocked on a decision that is genuinely the user's to make — one you can't resolve from the request, the code, or a sensible default. Don't use it to ask for permission to proceed or to confirm something you can just go do.",
+            "Ask the user a short question, optionally with up to 3 pick-a-choice options (each with an optional description), optionally allowing multiple selections, and optionally tagged with a short header label. The user can still answer freely. Use this tool when you need the user's direction, or after proposing a plan/recommendation to ask how they want to proceed before mutating code. Avoid using it for trivial micro-steps that the user already explicitly authorized.",
             schema(
                 json!({
                     "query": { "type": "string" },
@@ -605,8 +650,11 @@ fn all_tools() -> Vec<ToolSpec> {
         ),
         tool(
             "view_image",
-            "View an image file from the workspace.",
-            schema(json!({ "path": { "type": "string" } }), &["path"]),
+            "View an image from the workspace using path, or reopen an image artifact from this conversation using artifactId.",
+            schema(
+                json!({ "path": { "type": "string" }, "artifactId":{"type":"string"} }),
+                &[],
+            ),
         ),
         tool(
             "search_docs",
@@ -687,6 +735,7 @@ fn all_tools() -> Vec<ToolSpec> {
             schema(
                 json!({
                     "command": { "type": "string" },
+                    "retryReason": { "type": "string", "description": "Reason for retrying a previous command. Inspect running/unknown results before repeating side effects." },
                     "background": {
                         "type": "boolean",
                         "description": "Run detached and return immediately with a job_id instead of waiting for the command to exit. Defaults to false."
@@ -1048,6 +1097,49 @@ fn all_tools() -> Vec<ToolSpec> {
     ]
 }
 
+#[cfg(test)]
+mod browser_startup_tests {
+    use super::*;
+    #[test]
+    fn browser_tools_are_discoverable_when_browser_automation_enabled() {
+        let mut config = MintConfig::default();
+        let default_tools = tool_catalog(&config, false, Path::new("."), false);
+        // By default, browser tools are enabled out of the box for real web browsing.
+        assert!(default_tools.iter().any(|tool| tool.name == "browser_open"));
+
+        // Explicitly disabling browser automation removes browser tools.
+        config
+            .extra
+            .insert("browserAutomationEnabled".into(), json!(false));
+        let disabled_tools = tool_catalog(&config, false, Path::new("."), false);
+        assert!(
+            !disabled_tools
+                .iter()
+                .any(|tool| tool.name == "browser_open")
+        );
+
+        config
+            .extra
+            .insert("browserAutomationEnabled".into(), json!(true));
+        config.extra.insert(
+            "browserDebugUrl".into(),
+            json!("http://127.0.0.1:1/json/list"),
+        );
+        let tools = tool_catalog(&config, false, Path::new("."), false);
+        assert!(tools.iter().any(|tool| tool.name == "browser_open"));
+        assert!(
+            crate::prompts::agent::build_system_prompt(&config, false, false, None, None)
+                .contains("browser_open")
+        );
+        config.disabled_tools.push("browser_open".into());
+        assert!(
+            !tool_catalog(&config, false, Path::new("."), false)
+                .iter()
+                .any(|tool| tool.name == "browser_open")
+        );
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1130,7 +1222,7 @@ mod tests {
     }
 
     #[test]
-    fn dispatch_subagent_offered_only_when_allowed_and_subagents_exist() {
+    fn dispatch_agents_offered_only_when_allowed_and_subagents_exist() {
         let root = std::env::temp_dir().join("mint-tool-catalog-subagents");
         let _ = std::fs::remove_dir_all(&root);
         write_subagent(
@@ -1147,20 +1239,22 @@ mod tests {
         let _ = std::fs::remove_dir_all(&empty_root);
         std::fs::create_dir_all(&empty_root).unwrap();
         let tools = tool_catalog(&config, false, &empty_root, true);
-        assert!(tools.iter().any(|t| t.name == "dispatch_subagent"));
+        assert!(tools.iter().any(|t| t.name == "dispatch_agents"));
 
         // Subagents exist + allowed -> offered.
         let tools = tool_catalog(&config, false, &root, true);
-        assert!(tools.iter().any(|t| t.name == "dispatch_subagent"));
+        assert!(tools.iter().any(|t| t.name == "dispatch_agents"));
 
         // Subagents exist but not allowed (this is itself a nested subagent
         // call) -> the depth-limit enforcement, never offered.
         let tools = tool_catalog(&config, false, &root, false);
-        assert!(!tools.iter().any(|t| t.name == "dispatch_subagent"));
+        assert!(!tools.iter().any(|t| t.name == "dispatch_agents"));
 
-        // Subagents exist but plan mode is active -> never offered either.
+        // Subagents exist and plan mode is active -> offered with read-only profiles only!
         let tools = tool_catalog(&config, true, &root, true);
-        assert!(!tools.iter().any(|t| t.name == "dispatch_subagent"));
+        let plan_dispatch = tools.iter().find(|t| t.name == "dispatch_agents");
+        assert!(plan_dispatch.is_some());
+        assert!(plan_dispatch.unwrap().description.contains("read-only"));
 
         let _ = std::fs::remove_dir_all(&root);
         let _ = std::fs::remove_dir_all(&empty_root);