dsh-plugin-prompt-tool 0.4.2 → 0.5.0

package/upstream/dsh-anchored-standard/preset/context-gate.mjs

@@ -1,202 +0,0 @@
-/**
- * anchored-context-gate — reusable unified injection control for ANY preset.
- *
- * Mount this one plugin to keep a session's first model request free of
- * auto-injected context, whatever its source, and to have every injection
- * return on the second round. It intercepts the harness's two unified
- * injection paths — not a per-source denylist — so it covers sources that do
- * not exist yet:
- *
- *  a. RUNTIME CONTEXT (system-prompt/assemble): while the session is
- *     unpromoted, the assembly's `contexts` are blanked. That covers the
- *     WHOLE `SystemPrompt.context()` family — the sandbox and approval
- *     policy snapshots and any third-party context provider — without
- *     enumerating them. The loop's own snapshot projection then emits no
- *     message during the gate (no snapshot ever existed), and at the first
- *     promoted request it emits exactly ONE fresh snapshot: "minimal first
- *     round, inject on the second round" falls out of the projection's
- *     diffing, with no reinjection logic here.
- *
- *  b. STEP MESSAGES (agent/pre-step): the waterfall payload carries the
- *     CLAIMED message batch (the inbox messages this step owns). While
- *     unpromoted, the gate keeps exactly the claimed messages plus a small
- *     kind allowlist, and strips everything any listener appended — skill
- *     catalog, AGENTS.md digest, time/tmux context, hooks, unknown
- *     third-party plugins — by DEFAULT, regardless of source identity. The
- *     default allowlist is `['skill-invocation']`: a user-initiated skill
- *     gesture is not an automatic injection, and stripping it would lose the
- *     skill content once the gesture scrolls out of the per-step claim.
- *     Durable history (compaction summaries included) never passes through
- *     this gate: it enters the request via the session surface, not the
- *     pre-step waterfall.
- *
- * The phase is the same epoch-aware promotion machine the anchored presets
- * use (see compaction-epoch.mjs): a durable `tool/call` and/or
- * `assistant/message` (per `promoteOn`, default `either`) promotes, and a
- * `compaction/end` boundary demotes again — the first post-compaction request
- * is a "second first request" and is gated the same way. Derived from durable
- * events, so resume and reload preserve it.
- *
- * SUBAGENTS: by default subagents (delegationDepth > 0) skip the gate (their
- * first request already sees full context). `includeSubagents: true` gates
- * them too — their first request is clean and their own first reply or tool
- * call opens the gate — so a delegation cannot reintroduce an uncontrolled
- * first request. Keep this flag in sync with any companion phase plugin
- * (e.g. the tool-bootstrap row).
- *
- * CONFIG:
- *  - `promoteOn`: 'either' (default) | 'tool-call' | 'assistant-message'.
- *  - `includeSubagents`: boolean, default false.
- *  - `enabled`: boolean, default true. `false` disables both interception
- *    paths (A/B testing without touching the row set).
- *  - `allowKinds`: message `source.kind` names allowed beyond the claimed
- *    batch, default ['skill-invocation']. An explicitly empty array keeps
- *    ONLY the claimed batch.
- *
- * ROW ORDER: mount this row FIRST in the composition. Waterfall after-next
- * transforms apply in reverse registration order, so registering first (plus
- * the pre-step listener's `prepend: true`) makes the gate the outermost
- * transform — nothing registered later re-injects past it.
- *
- * Robustness: both filters degrade to "keep everything" on their own
- * failures — a gate bug must never eat the user's context — and invalid
- * config fails at apply time, i.e. at preset mount, where it is visible.
- */
-
-import { createEpochPromotion } from './compaction-epoch.mjs'
-
-/** Cordis plugin name used by loader diagnostics. */
-export const name = 'anchored-context-gate'
-
-/**
- * Deliberately NO inject list: the listeners only touch services at event
- * time, and applying without an inject lets this row register before the
- * context-injecting plugins (dsh-agent-instructions, dsh-tool-skill, host
- * plane policy projections) when it sits first in the composition.
- */
-export const inject = []
-
-/** Durable session event types that count as a promotion signal per mode. */
-const PROMOTE_EVENTS = {
-  'tool-call': ['tool/call'],
-  'assistant-message': ['assistant/message'],
-  either: ['tool/call', 'assistant/message'],
-}
-
-/** Every config key this plugin accepts — anything else is a typo. */
-const ALLOWED_KEYS = new Set(['promoteOn', 'includeSubagents', 'enabled', 'allowKinds'])
-
-/**
- * Message kinds allowed through the pre-step gate beyond the claimed batch.
- * A user-initiated skill gesture is the only default entry: it is not an
- * automatic injection (see the header note).
- */
-const DEFAULT_ALLOW_KINDS = ['skill-invocation']
-
-function parsePromoteOn(value) {
-  if (value === undefined || value === 'either') return PROMOTE_EVENTS.either
-  if (value === 'tool-call' || value === 'assistant-message') return PROMOTE_EVENTS[value]
-  throw new TypeError(`${name}: promoteOn must be one of "tool-call", "assistant-message", "either"; got ${JSON.stringify(value)}`)
-}
-
-/**
- * Validate the kind allowlist. An explicitly empty array is meaningful: keep
- * ONLY the claimed batch, stripping even user skill gestures.
- */
-function allowKindList(value, field) {
-  if (value === undefined) return new Set(DEFAULT_ALLOW_KINDS)
-  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || item.length === 0)) {
-    throw new TypeError(`${name}: ${field} must be an array of non-empty strings`)
-  }
-  return new Set(value)
-}
-
-/** Validate an optional boolean flag with a default. */
-function booleanOption(value, field, fallback) {
-  if (value === undefined) return fallback
-  if (typeof value !== 'boolean') {
-    throw new TypeError(`${name}: ${field} must be a boolean`)
-  }
-  return value
-}
-
-/** Register the unified context gate. */
-export function apply(ctx, config) {
-  const source = config === undefined ? {} : config
-  if (typeof source !== 'object' || source === null || Array.isArray(source)) {
-    throw new TypeError(`${name}: config must be an object`)
-  }
-  const unknown = Object.keys(source).filter((key) => !ALLOWED_KEYS.has(key))
-  if (unknown.length > 0) {
-    throw new TypeError(
-      `${name}: unknown config key(s) ${unknown.join(', ')} — allowed keys: ${[...ALLOWED_KEYS].sort().join(', ')}`,
-    )
-  }
-  const promoteEvents = parsePromoteOn(source.promoteOn)
-  const includeSubagents = booleanOption(source.includeSubagents, 'includeSubagents', false)
-  const enabled = booleanOption(source.enabled, 'enabled', true)
-  const allowKinds = allowKindList(source.allowKinds, 'allowKinds')
-
-  const promotion = createEpochPromotion(promoteEvents, { includeSubagents })
-  ctx.on('session/event', (session, event) => promotion.observe(session, event))
-
-  let warned = false
-  const warnOnce = (message) => {
-    if (warned) return
-    warned = true
-    try {
-      ctx.logger.warn(message)
-    } catch {
-      // Logger unavailable — the guard exists only to avoid spamming.
-    }
-  }
-
-  // Path (a): blank the dynamic runtime-context contributions while the
-  // session is unpromoted. Covers the whole SystemPrompt.context() family
-  // without enumerating it; the loop's snapshot projection then stays silent
-  // and diffs exactly ONE fresh snapshot in at the first promoted request.
-  ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
-    // Downstream errors propagate untouched; only this filter's own logic is guarded.
-    const assembled = await next()
-    if (enabled === false) return assembled
-    try {
-      if (promotion.status(context.agent).promoted) return assembled
-      if (!Array.isArray(assembled.contexts) || assembled.contexts.length === 0) return assembled
-      return { ...assembled, contexts: [] }
-    } catch (error) {
-      // A gate bug must never break assembly: degrade to the assembled value.
-      warnOnce(`${name}: runtime-context suppression failed, keeping contexts: ${String((error && error.message) || error)}`)
-      return assembled
-    }
-  })
-
-  // Path (b): claimed-baseline deny on the pre-step waterfall. The payload's
-  // `messages` is the batch this step CLAIMED from the inbox — the baseline
-  // every injection appends to. Keep that baseline plus the kind allowlist,
-  // strip every appended message regardless of its source identity.
-  ctx.on('agent/pre-step', async ({ agent, messages: claimed }, next) => {
-    // Downstream errors propagate untouched; only this filter's own logic is guarded.
-    const decision = await next()
-    if (decision.kind === 'reject') return decision
-    if (enabled === false) return decision
-    try {
-      if (promotion.status(agent).promoted) return decision
-      if (!Array.isArray(decision.messages)) return decision
-      if (!Array.isArray(claimed)) return decision
-      const baseline = new Set(claimed)
-      const baselineIds = new Set(claimed
-        .map((message) => message?.id)
-        .filter((id) => id !== undefined && id !== null))
-      const kept = decision.messages.filter((message) =>
-        baseline.has(message)
-        || (message?.id !== undefined && message?.id !== null && baselineIds.has(message.id))
-        || allowKinds.has(message?.source?.kind),
-      )
-      return kept.length === decision.messages.length ? decision : { ...decision, messages: kept }
-    } catch (error) {
-      // A gate bug must never eat context: degrade to keeping every message.
-      warnOnce(`${name}: pre-step gate failed, keeping injected context: ${String((error && error.message) || error)}`)
-      return decision
-    }
-  }, { prepend: true })
-}

package/upstream/dsh-anchored-standard/preset/custom-bash.mjs

@@ -1,219 +0,0 @@
-/**
- * custom-bash — a Windows-capable `bash` tool that registers under the SAME
- * name (`bash`) as the official persistent bash, with a Minimal-compatible
- * description, but executes through `ctx.subprocess.spawn` instead of a PTY.
- *
- * WHY: DeepSeek's first-request trajectory anchor keys on the tool SCHEMA
- * matching the RL training distribution (issue #11: persistent
- * bash + str_replace_editor anchored 5/5 at maxTokens=256000, pwsh/read
- * 8/8 standard-like). The official persistent bash uses a PTY, and DSH's PTY
- * backend is linux/darwin-only — `subprocess-local` throws "terminal
- * inspection is unsupported on platform win32". A custom tool that presents
- * the same name and a Minimal-like description but spawns Git Bash through
- * the ordinary (cross-platform) subprocess seam keeps the schema anchor
- * without the PTY dependency.
- *
- * Executable resolution (config `bashPath`, issue #24 — no hardcoded install
- * path): an explicit non-empty `bashPath` wins unconditionally. Unset, the
- * Git Bash executable is INFERRED, in probe order:
- *  1. the `git` executable on PATH — its install root carries `bin\bash.exe`
- *     one level up from `cmd\`, beside `bin\`, or two levels up from
- *     `mingw64\bin\` (the standard installer, choco, and winget all resolve
- *     here; a scoop SHIM does not — its directory is the shims root, not the
- *     app — which is what step 2 covers);
- *  2. the well-known Git-for-Windows roots derived from environment variables
- *     (`ProgramFiles`, `ProgramFiles(x86)`, per-user `LOCALAPPDATA\Programs
- *     \Git`, scoop's `~\scoop\apps\git\current` junction);
- *  3. plain `bash` through `ctx.subprocess.resolveExecutable` (PATH lookup —
- *     last resort, since on Windows that may pick the WSL shim; WSL bash is
- *     still true bash, only the filesystem paths shift to /mnt/…).
- *
- * If NOTHING resolves, the tool fails with an actionable error naming the
- * remedies — it does NOT silently execute under a different shell: the
- * schema above promises `bash -c` semantics, and pwsh/cmd are different
- * command languages. PowerShell stays available as its OWN tool (`pwsh`,
- * present in the promoted catalog on Windows, unlockable via
- * dev_tool_search).
- *
- * Semantics mirror the official bash tool: `bash -c <command>` in a fresh
- * process, bounded output, non-zero exit reported not thrown. No sandbox
- * confinement on Windows (the sandbox backend is linux-only); the tool
- * description says so. The bootstrap catalog pairs this with
- * `str_replace_editor` (Minimal's two tools).
- */
-
-import { access } from 'node:fs/promises'
-import { dirname, join } from 'node:path'
-
-/** Cordis plugin name used by loader diagnostics. */
-export const name = 'custom-bash'
-
-/** The subprocess and tools services must exist before this tool can register. */
-export const inject = ['subprocess', 'tools']
-
-const DEFAULT_TIMEOUT_MS = 120000
-const DEFAULT_MAX_OUTPUT_BYTES = 64000
-
-/**
- * Git Bash candidate paths, in probe order (see the header): the `git`
- * executable's install root first, then the well-known env-derived roots.
- * Exported for tests; pure — existence probing happens at the call site.
- */
-export function bashCandidates(env, gitExe) {
-  const candidates = []
-  // git at <root>\cmd\git.exe (installer/scoop) or <root>\bin\git.exe →
-  // <root>\bin\bash.exe; <root>\mingw64\bin\git.exe (portable) → two up.
-  // A bare relative name means `git` did not actually resolve to a path.
-  if (typeof gitExe === 'string' && /[/\\]/.test(gitExe)) {
-    const dir = dirname(gitExe)
-    const root = dirname(dir)
-    candidates.push(
-      join(root, 'bin', 'bash.exe'),
-      join(dir, 'bash.exe'),
-      join(dirname(root), 'bin', 'bash.exe'),
-    )
-  }
-  if (env.ProgramFiles) candidates.push(join(env.ProgramFiles, 'Git', 'bin', 'bash.exe'))
-  if (env['ProgramFiles(x86)']) candidates.push(join(env['ProgramFiles(x86)'], 'Git', 'bin', 'bash.exe'))
-  if (env.LOCALAPPDATA) candidates.push(join(env.LOCALAPPDATA, 'Programs', 'Git', 'bin', 'bash.exe'))
-  if (env.USERPROFILE) candidates.push(join(env.USERPROFILE, 'scoop', 'apps', 'git', 'current', 'bin', 'bash.exe'))
-  // Layouts overlap (a `bin` git.exe derives the same bash twice) — probe
-  // order survives the dedupe, insertion order is preserved.
-  return [...new Set(candidates)]
-}
-
-/** Tool parameter schema for the model-facing command. */
-const commandSchema = {
-  type: 'object',
-  properties: {
-    command: {
-      type: 'string',
-      description: 'The bash command to execute (`bash -c` string domain).',
-    },
-    workdir: {
-      type: 'string',
-      description: 'Optional working directory; defaults to the session cwd.',
-    },
-  },
-  required: ['command'],
-  additionalProperties: false,
-}
-
-/** Register the model-facing `bash` tool. */
-export function apply(ctx, config) {
-  const explicitBashPath = typeof config?.bashPath === 'string' && config.bashPath.length > 0 ? config.bashPath : undefined
-  const timeoutMs = Number.isSafeInteger(config?.timeoutMs) && config.timeoutMs > 0 ? config.timeoutMs : DEFAULT_TIMEOUT_MS
-  const maxOutputBytes = Number.isSafeInteger(config?.maxOutputBytes) && config.maxOutputBytes > 0 ? config.maxOutputBytes : DEFAULT_MAX_OUTPUT_BYTES
-
-  // The inferred executable is memoized per plugin instance: candidate probing
-  // walks the filesystem, and the answer cannot change within a mount. A
-  // failed inference is NOT memoized — the plain `bash` fallback resolves
-  // fresh on every execute until some probe succeeds.
-  let inferredShell
-  const exists = (path) => access(path).then(() => true, () => false)
-  const resolveShell = async (signal) => {
-    if (explicitBashPath !== undefined) {
-      // A misconfigured explicit path must fail as itself, not as a
-      // discovery miss — the raw resolution error says which path failed.
-      return ctx.subprocess.resolveExecutable(explicitBashPath, undefined, signal)
-    }
-    if (inferredShell !== undefined) {
-      return ctx.subprocess.resolveExecutable(inferredShell, undefined, signal)
-    }
-    let gitExe
-    try {
-      gitExe = await ctx.subprocess.resolveExecutable('git', undefined, signal)
-    } catch {
-      // git unresolvable → the env-derived candidates below still apply
-    }
-    for (const candidate of bashCandidates(process.env, gitExe)) {
-      if (!(await exists(candidate))) continue
-      try {
-        inferredShell = await ctx.subprocess.resolveExecutable(candidate, undefined, signal)
-        return inferredShell
-      } catch {
-        // Exists but unresolvable (EPERM, a broken scoop junction): keep
-        // probing — one bad root must not block the rest of the chain, and
-        // nothing is memoized so later executes can still find a good one.
-        continue
-      }
-    }
-    try {
-      return await ctx.subprocess.resolveExecutable('bash', undefined, signal)
-    } catch (error) {
-      // Total discovery failure (no Git Bash root, no env root, no bash on
-      // PATH): name the remedies instead of leaking a raw ENOENT. Never
-      // fall back to pwsh/cmd here — the schema promises `bash -c`
-      // semantics; a different shell would silently break every command.
-      throw new Error(`bash executable not found — install Git for Windows, expose a bash on PATH, or set the custom-bash \`bashPath\` config (${String((error && error.message) || error)})`)
-    }
-  }
-
-  ctx.tools.register({
-    name: 'bash',
-    description: [
-      'Run commands in a bash shell (Git Bash on Windows)',
-      '* When invoking this tool, the contents of the "command" parameter does NOT need to be XML-escaped.',
-      "* You don't have access to the internet via this tool.",
-      '* You do have access to a mirror of common linux and python packages via apt and pip.',
-      '* State does NOT persist across command calls: each call runs in a fresh shell.',
-      "* To inspect a particular line range of a file, e.g. lines 10-25, try 'sed -n 10,25p /path/to/the/file'.",
-      '* Please avoid commands that may produce a very large amount of output.',
-      '* NOTE: runs without OS sandbox confinement on Windows (no landlock); treat output as untrusted.',
-    ].join('\n'),
-    parameters: commandSchema,
-    output: {
-      schema: {
-        type: 'object',
-        additionalProperties: false,
-        properties: {
-          text: { type: 'string' },
-        },
-        required: ['text'],
-      },
-      render: (_args, value) => [{ type: 'text', text: value.text }],
-    },
-    async execute(args, exec) {
-      const shell = await resolveShell(exec?.signal)
-      const workdir = typeof args.workdir === 'string' && args.workdir.length > 0
-        ? args.workdir
-        : exec?.agent?.session?.header?.cwd
-      const signal = exec?.signal
-      const handle = ctx.subprocess.spawn({
-        argv: [shell, '-c', args.command],
-        ...workdir !== undefined ? { cwd: workdir } : {},
-        stdio: {
-          stdin: 'ignore',
-          stdout: { maxBytes: maxOutputBytes },
-          stderr: { maxBytes: maxOutputBytes },
-        },
-        ...signal !== undefined ? { signal } : {},
-        graceMs: 3000,
-      })
-      let outcome
-      try {
-        outcome = await handle.done
-      } catch (error) {
-        // A spawn-level failure (bad executable, EPERM) surfaces as a throw,
-        // which the runtime turns into an isError result.
-        throw new Error(`bash spawn failed: ${String(error)}`)
-      }
-      let stdout = ''
-      let stderr = ''
-      try {
-        stdout = handle.collected.stdout.readFrom(0).text
-        stderr = handle.collected.stderr.readFrom(0).text
-      } catch {
-        // Collected readers may be unavailable on some backends; tolerate.
-      }
-      const text = [stdout, stderr].filter((part) => part.length > 0).join('\n')
-      const tail = text.length > 0 ? text : `exit code: ${outcome.exitCode} (no output)`
-      if (outcome.exitCode !== 0) {
-        // Non-zero exit is a reported failure, not a throw: the model sees the
-        // command output plus the exit code.
-        throw new Error(tail)
-      }
-      return { text: tail }
-    },
-  })
-}

package/upstream/dsh-anchored-standard/preset/dev-tool-search.mjs

@@ -1,131 +0,0 @@
-/**
- * dev-tool-search — on-demand tool discovery and unlock, the tool-search
- * pattern for the anchored preset.
- *
- * The promoted phase keeps only a minimal resident set (shell +
- * str_replace_editor + the discovery tools) instead of dumping the whole
- * Standard catalog at once. This plugin registers ONE small tool:
- *
- *  - `dev_tool_search` — search the FULL assembled catalog by keyword and
- *    return matching tool names with short descriptions; optionally unlock
- *    tools by exact name (array `toolNames`). Unlocked names are recorded as
- *    durable `tool/call` arguments, and tool-bootstrap.mjs's assemble filter
- *    exposes them from the next request on (resume-safe).
- *
- * The tool description is deliberately an INDEX of what the minimal resident
- * set cannot do: the model should reach for dev_tool_search the moment a task
- * needs internet, delegation, workflows, goals, images, background jobs, or
- * multi-agent coordination — not try to work around them with bash.
- */
-
-/** Cordis plugin name used by loader diagnostics. */
-export const name = 'dev-tool-search'
-
-/** The tools registry must exist before this tool can register. */
-export const inject = ['tools']
-
-const MAX_RESULTS = 25
-
-/** Minimal JSON schema compiler for tool parameters (zero dependencies). */
-function toJsonSchema(spec) {
-  const properties = {}
-  const required = []
-  for (const [key, meta] of Object.entries(spec || {})) {
-    const prop = { type: meta.type }
-    if (meta.description) prop.description = meta.description
-    properties[key] = prop
-    if (meta.required) required.push(key)
-  }
-  return { type: 'object', properties, required, additionalProperties: false }
-}
-
-/**
- * The capability index: resident minimal tools (bash / str_replace_editor /
- * skill_search / skill_load) cannot cover these, so the model must search
- * and unlock them on demand. Kept in the description so the model KNOWS what
- * exists without a full catalog dump.
- */
-const UNLOCKABLE_INDEX = [
-  'web_search — internet search and web retrieval',
-  'subagent / subagent_fork — delegate work to sub-agents',
-  'workflow — run multi-agent workflow scripts',
-  'ralph — fresh-agent iterative loop',
-  'create_goal / get_goal / update_goal — long-running goals',
-  'read_image — read image files',
-  'job_list / job_output / job_kill — background jobs',
-  'interrupt_agent / send_message / list_agents — multi-agent control',
-  'todo_write — task tracking',
-  'ask_user_question — ask the user',
-]
-
-/** Register the model-facing `dev_tool_search` tool. */
-export function apply(ctx) {
-  ctx.tools.register({
-    name: 'dev_tool_search',
-    description: [
-      'Discover and unlock tools that are NOT currently available.',
-      '',
-      'This session starts with a minimal resident set: bash, str_replace_editor, skill_search, skill_load. Everything else is unlocked on demand through this tool.',
-      '',
-      'If the current task needs any of the following, call dev_tool_search FIRST — do not try to work around them with bash:',
-      ...UNLOCKABLE_INDEX.map((line) => `- ${line}`),
-      '',
-      'Usage: pass `query` to search the catalog (returns matching tool names + descriptions), then pass `toolNames` with exact names to unlock them. Unlocked tools appear from the next request on and stay unlocked for the session.',
-    ].join('\n'),
-    parameters: toJsonSchema({
-      query: { type: 'string', required: false, description: 'search keywords (e.g. "web", "subagent")' },
-      toolNames: { type: 'array', required: false, description: 'exact tool names to unlock', items: { type: 'string' } },
-    }),
-    output: {
-      schema: { type: 'object', additionalProperties: false, properties: { text: { type: 'string' } }, required: ['text'] },
-      render: (_a, v) => [{ type: 'text', text: v.text }],
-    },
-    async execute(args, exec) {
-      const query = typeof args.query === 'string' ? args.query.trim() : ''
-      const unlock = Array.isArray(args.toolNames) ? args.toolNames.filter((name) => typeof name === 'string' && name.length > 0) : []
-
-      const lines = []
-      if (unlock.length > 0) {
-        lines.push(`Unlocked for the next request: ${unlock.join(', ')}`)
-      }
-      if (query.length === 0 && unlock.length === 0) {
-        lines.push('Provide `query` to search the catalog, or `toolNames` to unlock tools.')
-        return { text: lines.join('\n') }
-      }
-      if (query.length === 0) {
-        return { text: lines.join('\n') || 'Nothing to do.' }
-      }
-
-      try {
-        // The executing agent IS the viewing scope: preset tools register into
-        // the agent-scope layer of the tools registry, and schemas() with no
-        // scope only sees the global layer — every preset-provided tool would
-        // be invisible to keyword search (issue #24). Same pattern as the
-        // harness's own code mode (`registry.schemas(exec.agent)`).
-        const schemas = ctx.tools.schemas(exec?.agent)
-        const wanted = query.toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean)
-        const all = schemas.filter((schema) => {
-          const haystack = `${schema.name} ${schema.description ?? ''}`.toLowerCase()
-          return wanted.every((token) => haystack.includes(token))
-        })
-        const matches = all.slice(0, MAX_RESULTS)
-        if (all.length === 0) {
-          lines.push(`No tools match "${query}".`)
-        } else {
-          lines.push(`Matching tools (${matches.length}${all.length > MAX_RESULTS ? ` of ${all.length}` : ''}):`)
-          for (const schema of matches) {
-            const desc = (schema.description || '').split('\n')[0].slice(0, 90)
-            lines.push(`- ${schema.name}: ${desc}`)
-          }
-          if (all.length > MAX_RESULTS) {
-            lines.push(`(truncated at ${MAX_RESULTS} — add tokens to narrow the query, e.g. "mcp browser" or "mcp tavily")`)
-          }
-          lines.push('Unlock with dev_tool_search({"toolNames": ["<exact name>"]}).')
-        }
-      } catch (error) {
-        lines.push(`catalog search unavailable: ${String((error && error.message) || error)}`)
-      }
-      return { text: lines.join('\n') }
-    },
-  })
-}