mixdog 0.7.18 → 0.8.1

package/rules/shared/01-tool.md

@@ -1,138 +0,0 @@
-# Tool Routing
-
-Native tools and shell are NEVER used for IO — search, inspect, read, mutate
-files, or web access. Use the Mixdog equivalent. `bash` is the single shell
-entry point (PowerShell on Windows); native `Bash`/`PowerShell` are not used.
-
-| Native (forbidden for IO) | → Mixdog |
-|---|---|
-| `Read` | `read` |
-| `Grep` | `grep` |
-| `Glob` | `glob` |
-| `LS` / dir listing | `list` |
-| `Edit` / `NotebookEdit` | `apply_patch` (default editor) or `edit` (small exact substitution) |
-| `Write` | `write` (or `apply_patch`) |
-| Delete / remove a file | `apply_patch` (`*** Delete File: <path>`) — no native `rm`/unlink |
-| `WebSearch` | `search` |
-| `WebFetch` | `web_fetch` |
-| `Bash`/`PowerShell` (file IO) | ✗ — use the rows above; never `bash mkdir` to prep a path (`write`/`apply_patch` auto-create parent dirs), nor `touch`/`cat` (use `write`/`read`) |
-| `Bash`/`PowerShell` (git/build/test/run) | `bash` |
-| native `Agent` sub-agent to search / inspect / fetch | ✗ — call Mixdog tools directly; real sub-work goes through `bridge` |
-
-No native equivalent (use as-is): `code_graph`
-(`find_symbol`/`search`/`references`/`callers`/`imports`/`dependents`),
-`ToolSearch`. Lead progress tracking via `TaskCreate`/`TaskUpdate`/
-`TaskList` is allowed.
-
-## Decision order — pick the FIRST that matches the task
-
-1. **External / web / current docs** → `search` → `web_fetch` for bodies.
-2. **Past memory / prior decisions / session history** → `recall`.
-   Reach for it BEFORE re-deriving or re-asking — the trigger list (user
-   references earlier work, resuming a paused task, proposing a decision
-   that may already exist) is on the tool description. The SessionStart
-   inject is a thin excerpt, not the store — anything not visible there is
-   one read-only, cheap recall away.
-3. **Read the code, scope unknown / open-ended / tree-wide** → `explore`.
-   The entry point for "read the code and tell me X" and any sweep that would
-   otherwise be a long `grep`/`code_graph` storm — ONE call offloads it to a
-   sub-agent and keeps your context clean. Never a `worker`/`bridge` for
-   read-only exploration; never grep-loop it yourself.
-   explore LOCATES and DESCRIBES code — NOT an audit/review tool: its
-   bug/quality/risk claims are unverified leads; verify them (reviewer role
-   or direct reads) before acting on or reporting them. Shape every query as
-   a LOCATION/INVENTORY question ("where/which/what implements X"), never a
-   verdict question ("is X correct/missing", "are there gaps/bugs") —
-   judgment stays with the Lead or a reviewer, applied to the coordinates
-   explore returns.
-4. **Known symbol / identifier** → `code_graph` (`find_symbol` when exact;
-   `mode:search` with a keyword when you don't know the exact name — file-less,
-   lists matching symbols + locations, use INSTEAD of grepping for a symbol).
-5. **Find files by name / type / size / date** → `glob` (glob pattern, exact)
-   or `list mode:find` (name-substring / type / size / date filter).
-6. **Free-text / non-symbol content** (string literals, log lines, config keys,
-   comments) → `grep`.
-7. **Read a specific known region** → `read` (`offset`/`limit` or
-   `line`/`context`; `symbol=NAME` for a whole definition; `max_lines`/`budget`/
-   `mode` for a whole-file glance).
-8. **Edit** → `apply_patch` (default editor; large/structural, multi-hunk, or
-   multi-file) · `edit` (small exact substitution in a known spot; batch several) ·
-   `write` (new file or a full rewrite of one already read — never `write` over an
-   unread file). Batch dependent edits into ONE multi-hunk apply_patch; by default
-   keep each hunk's context minimal — the target line(s) plus only enough for a
-   unique match — so nothing surrounding is left to go stale.
-   `write`/`apply_patch` auto-create missing parent directories — never
-   `bash mkdir` to prepare an output path.
-   To delete a file, use `apply_patch` with `*** Delete File: <path>` — there is
-   no `rm` tool and `bash rm` is forbidden.
-9. **Shell** (git/build/test/run only) → `bash`.
-
-Retrieval (1–3) picks the SOURCE family first; never default to a `bridge`
-worker for a read-only lookup. Retrieval is ONE-SHOT (never reused) but fans
-out: `recall`/`search` take a query array (built-in parallelism); `explore`
-spawns one per independent area in a single batch. All read-only, so concurrent
-is safe (no worktree conflict). How to shape `explore.query` — one-line
-per-topic sub-questions, never one broad brief, no anchors/context dump — is the
-SSOT in the `explore` tool's `query` parameter description; follow it.
-
-## Broad to narrow — once scope is known
-
-`explore` (unknown scope) → `code_graph` (known identifier) → `glob`/`list` →
-`grep` (free-text / non-symbol only) → `read`. Anchor to the named file/symbol.
-A bounded / known-anchor lookup skips straight to `code_graph`/`grep` — but
-"the brief names a repo path" is NOT an anchor; anchor = a named file or symbol
-to start from. A tree-wide enumeration with no such anchor is step 3, not grep.
-
-Read what you need in ONE turn — batch a file's windows/`symbol=`s in the same
-turn, don't re-open it across later turns.
-
-## Shortest route — collapse a multi-hop search into ONE call
-
-When the shape is known, do not chain `grep` → `read`:
-- keyword / partial-or-unknown symbol name → `code_graph mode:search` (one call,
-  file-less) instead of grepping for it.
-  Seed it with a SINGLE token, not a prose phrase — multi-word phrases miss and
-  waste a call.
-- a named symbol → `code_graph find_symbol` with `body:true` (location + body +
-  callees in one call).
-- several symbols' bodies / a call chain → ONE `code_graph find_symbol
-  symbols:[...]` instead of N reads.
-- all call sites of a symbol → `callers`/`references` UNSCOPED (omit `file:`; add
-  `file:` only to narrow a too-large result).
-- an upstream/downstream call chain across several symbols → ONE
-  `callers`/`references` `symbols:[...]` (batches per chain LEVEL, not per symbol).
-- a whole function/definition → `read symbol=NAME`.
-- the lines around a hit → `grep -C`.
-- several free-text patterns at once → ONE `grep` with an array `pattern:[...]`
-  (OR-matched ripgrep regexes, ≤20; ≤5 with `multiline`) instead of repeated
-  single-pattern greps (`glob` takes an array too; for named/partial symbols use
-  `code_graph`, not `grep`).
-
-Reach for the one-shot form before adding a follow-up `read`.
-
-## Modifiers — rules that ride on top of the ladder
-
-- **Exploration budget.** Stop as soon as you can answer the task correctly —
-  don't keep searching to confirm a found answer, gather extra examples, or
-  polish phrasing. Match depth to the brief's stated thoroughness, not a default
-  of exhaustive.
-- **Concurrency.** Any calls that don't depend on each other's output go in ONE
-  message = one round-trip — read-only probes (`read`/`grep`/`glob`/`code_graph`)
-  and non-overlapping `apply_patch` edits alike. Only a true dependency chain
-  (grep → read the hit) stays serial; never run independent calls one-at-a-time.
-- **Lead-only async.** `explore` defaults to `background:true` (handle returns
-  now; the merged answer arrives via `dispatch_result`) — LEAD ONLY. Bridge
-  workers run `explore` sync (no channel for the async push) but still use it
-  over a grep storm. `explore` fans out to read-only hidden `explorer` sub-agents
-  (full worker tool schema + worker BP2 for cache parity); `recall`/`search` are
-  plain MCP tools.
-- **No waiting calls.** Never issue shell calls whose only purpose is waiting,
-  spacing, or liveness probing; report delayed/cancelled output instead.
-- **Failure circuit-breaker.** The same call failing TWICE with the same error
-  ends variant-retrying: stop, diagnose the root cause (read the error's
-  expected-vs-actual detail, inspect the target), then switch tool or
-  strategy. Blind third attempts with tweaked arguments are wasted calls —
-  the success path is one-shot; keep the failure path bounded too.
-- **No self-verification of output.** When the deliverable is code/text returned
-  in your answer, emit it directly; never `write` a scratch file or `bash` it to
-  compile/run/test your own output.

package/scripts/bootstrap.mjs

@@ -1,130 +0,0 @@
-#!/usr/bin/env node
-/**
- * bootstrap.mjs — node-only bun bootstrap for mixdog.
- *
- * Ensures bun is available (system PATH or plugin-local node_modules/.bin/bun),
- * installs it via npm if missing, then exec-proxies into scripts/run-mcp.mjs.
- *
- * Deps: node built-ins only (node:child_process, node:fs, node:path, node:url, node:os).
- */
-import { spawnSync, spawn } from 'node:child_process';
-import { readFileSync, writeFileSync, renameSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { prepShim } from './prep-shim.mjs';
-import { prepPatch } from './prep-patch.mjs';
-import { resolveBun, installBunViaNpm } from './resolve-bun.mjs';
-
-const scriptDir  = dirname(fileURLToPath(import.meta.url));
-const pluginRoot = dirname(scriptDir);
-const isWin      = process.platform === 'win32';
-
-// ---------------------------------------------------------------------------
-// Main
-// ---------------------------------------------------------------------------
-let bunPath = resolveBun(pluginRoot);
-
-if (!bunPath) {
-  installBunViaNpm(pluginRoot);
-  bunPath = resolveBun(pluginRoot);
-  if (!bunPath) {
-    process.stderr.write(
-      '[bootstrap] bun still not found after npm install.\n' +
-      '[bootstrap] Please install bun manually: https://bun.sh\n'
-    );
-    process.exit(1);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Stage the prebuilt shim into target/release and normalize hooks.json for
-// the current OS. Best-effort: failure leaves shim absent and hooks fail-open.
-// ---------------------------------------------------------------------------
-try { prepShim(pluginRoot); } catch (err) {
-  process.stderr.write(`[bootstrap] prep-shim skipped: ${err?.message || err}\n`);
-}
-// Fire-and-forget: warms the patch binary cache so the first apply_patch
-// dispatch hits a ready file instead of paying the 2-10s download latency
-// (sync fast-path in patch.mjs would otherwise throw before the dispatch
-// async path's fetch runs).
-try { prepPatch(pluginRoot); } catch (err) {
-  process.stderr.write(`[bootstrap] prep-patch skipped: ${err?.message || err}\n`);
-}
-
-function positivePid(value) {
-  const pid = Number(value);
-  return Number.isFinite(pid) && pid > 0 ? pid : null;
-}
-
-function detectOwnerHostPid() {
-  if (isWin) {
-    try {
-      const ps = [
-        '$procs = Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name;',
-        '$map = @{};',
-        'foreach ($p in $procs) { $map[[int]$p.ProcessId] = $p }',
-        `$cur = ${Number(process.pid)};`,
-        'for ($i = 0; $i -lt 16; $i++) {',
-        '  $p = $map[$cur]; if ($null -eq $p) { break }',
-        "  if ($p.Name -ieq 'claude.exe' -or $p.Name -ieq 'claude') { [Console]::Write($p.ProcessId); exit 0 }",
-        '  $cur = [int]$p.ParentProcessId',
-        '}',
-      ].join(' ');
-      const r = spawnSync('powershell.exe', ['-NoProfile', '-Command', ps], {
-        encoding: 'utf8',
-        timeout: 1500,
-        windowsHide: true,
-      });
-      const pid = positivePid(String(r.stdout || '').trim());
-      if (pid) return String(pid);
-    } catch {}
-  }
-  return String(positivePid(process.ppid) || positivePid(process.env.MIXDOG_OWNER_HOST_PID) || '');
-}
-
-const ownerHostPid = detectOwnerHostPid();
-
-// ---------------------------------------------------------------------------
-// Proxy into run-mcp.mjs via the resolved bun binary.
-// ---------------------------------------------------------------------------
-const child = spawn(bunPath, [join(pluginRoot, 'scripts', 'run-mcp.mjs')], {
-  stdio: 'inherit',
-  windowsHide: true,
-  env: {
-    ...process.env,
-    BUN_EXEC_PATH: bunPath,
-    MIXDOG_OWNER_HOST_PID: ownerHostPid,
-  },
-});
-
-child.on('error', (err) => {
-  process.stderr.write(`[bootstrap] failed to start run-mcp.mjs: ${err.message}\n`);
-  process.exit(1);
-});
-
-child.on('exit', (code) => {
-  process.exit(code ?? 0);
-});
-
-function forward(sig) {
-  try { child.kill(sig); } catch { /* child already gone */ }
-}
-process.on('SIGTERM', () => forward('SIGTERM'));
-process.on('SIGINT',  () => forward('SIGINT'));
-
-// stdin EOF / close = Claude Code (parent) disconnected its end of stdio.
-// run-mcp.mjs handles this in its own layer, but if a race leaves the bun
-// child unable to fire `exit` (sudden stdio break, abnormal bun termination),
-// bootstrap.mjs would otherwise wait forever, accumulating wrapper-layer
-// zombies across reconnects. Force teardown: SIGTERM child, give it 2s,
-// then SIGKILL + self-exit. Mirrors run-mcp.mjs stdin EOF invariant
-// (commit 754ab7d) at the bootstrap layer.
-process.stdin.on('close', () => {
-  try { child.kill('SIGTERM'); } catch {}
-  setTimeout(() => {
-    try { child.kill('SIGKILL'); } catch {}
-    process.exit(0);
-  }, 2000).unref();
-});
-process.stdin.on('error', () => process.exit(0));

package/scripts/bridge-unify-smoke.mjs

@@ -1,308 +0,0 @@
-#!/usr/bin/env node
-// bridge-unify-smoke.mjs — arg-routing checks for the unified `bridge` tool.
-//
-// Exercises the type-discriminator routing and tag-registry guard rails on the
-// fast-fail branches (no provider/model needed): list on an empty store,
-// send/close against an unknown tag, spawn missing role, and the type-less
-// (default spawn) backward-compat path. Does NOT spin a real worker.
-
-import { tmpdir } from 'os';
-import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
-import { mkdirSync, writeFileSync, rmSync } from 'fs';
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
-process.env.CLAUDE_PLUGIN_ROOT ||= ROOT;
-// MUST be unconditional (`=`, not `||=`): when the smoke runs inside a real
-// mixdog environment CLAUDE_PLUGIN_DATA already points at the LIVE plugin data
-// dir, so `||=` would write the synthetic `sess_<pid>_<scenario>_<ts>` fixtures
-// straight into the production session store. Those fixtures (provider/model
-// `none`, closed:false, no `owner`) slip past both sweeps and linger forever in
-// `bridge list` / the statusline. Force an isolated per-pid temp dir, always.
-const _SMOKE_DATA_DIR = join(tmpdir(), `mixdog-bridge-unify-smoke-${process.pid}`);
-process.env.CLAUDE_PLUGIN_DATA = _SMOKE_DATA_DIR;
-process.env.MIXDOG_SKIP_USER_DATA_BACKUP = '1';
-
-const { handleToolCall } = await import('../src/agent/index.mjs');
-// updateSessionStage drives the in-memory runtime stage the send busy-guard
-// consults when session.status is still unset — exercised by the startup-window
-// race case (#1) below.
-const { updateSessionStage, drainPendingMessages } = await import('../src/agent/orchestrator/session/manager.mjs');
-// initProviders lets the cold-tag respawn case register a network-free dummy
-// provider so the spawn path passes its synchronous provider check and returns
-// a detached jobId (the real API call is deferred to the IIFE, never reached).
-const { initProviders } = await import('../src/agent/orchestrator/providers/registry.mjs');
-
-// Write a minimal on-disk session fixture so the unified `bridge type=send`
-// path (which resolves a raw sess_ id via getSession/loadSession) can be
-// exercised without spinning a real provider-backed worker. The send handler's
-// busy-guard reads session.status BEFORE calling askSession, so a fixture is
-// enough to assert the resumability guard rails (bugs #1/#2).
-const _sessionsDir = join(process.env.CLAUDE_PLUGIN_DATA, 'sessions');
-function writeSessionFixture(id, status) {
-  mkdirSync(_sessionsDir, { recursive: true });
-  const now = Date.now();
-  const session = {
-    id,
-    status,
-    closed: false,
-    generation: 0,
-    provider: 'none',          // unknown provider → askSession fails fast (no hang)
-    model: 'none',
-    messages: [],
-    tools: [],
-    createdAt: now,
-    updatedAt: now,
-  };
-  writeFileSync(join(_sessionsDir, `${id}.json`), JSON.stringify(session));
-  return id;
-}
-
-let passed = 0;
-let failed = 0;
-function check(name, fn) {
-  return Promise.resolve()
-    .then(fn)
-    .then(() => { passed++; console.log(`  PASS  ${name}`); })
-    .catch((e) => { failed++; console.log(`  FAIL  ${name}\n        ${e?.message || e}`); });
-}
-
-// Tool results are MCP content blocks: { content: [{ type:'text', text }], isError? }.
-function textOf(res) {
-  if (res && Array.isArray(res.content)) {
-    return res.content.map((c) => (c && typeof c.text === 'string' ? c.text : '')).join('');
-  }
-  return typeof res === 'string' ? res : JSON.stringify(res);
-}
-function assert(cond, msg) { if (!cond) throw new Error(msg || 'assertion failed'); }
-
-await check('type=list on empty store → "No active sessions."', async () => {
-  const res = await handleToolCall('bridge', { type: 'list' }, {});
-  const t = textOf(res);
-  assert(/No active sessions/.test(t), `unexpected: ${t}`);
-});
-
-await check('type=send with unknown tag → clear error', async () => {
-  const res = await handleToolCall('bridge', { type: 'send', tag: 'nope1', message: 'hi' }, {});
-  const t = textOf(res);
-  assert(res.isError === true, 'expected isError');
-  assert(/not found \(may have been reaped after 5min\) — include a role to respawn fresh/.test(t), `unexpected: ${t}`);
-});
-
-await check('type=send unknown tag WITH role → respawns fresh (jobId)', async () => {
-  // Register a network-free dummy provider so the spawn path passes its
-  // synchronous provider check. The bench escape hatch (provider+model) builds
-  // an ad-hoc preset so no user-workflow.json role mapping is needed. spawn
-  // returns the jobId synchronously; the real API call (which would fail on the
-  // dummy key) is deferred to the detached IIFE and never asserted here.
-  await initProviders({ anthropic: { enabled: true, apiKey: 'dummy-smoke-key' } });
-  const res = await handleToolCall('bridge', { type: 'send', tag: 'respawn1', role: 'worker', provider: 'anthropic', model: 'claude-3-haiku', message: 'hi' }, {});
-  const t = textOf(res);
-  assert(res.isError !== true, `expected success, got: ${t}`);
-  assert(/"jobId"\s*:\s*"bridge_/.test(t), `expected a jobId, got: ${t}`);
-});
-
-await check('type=send missing message → error', async () => {
-  const res = await handleToolCall('bridge', { type: 'send', tag: 'x' }, {});
-  assert(res.isError === true, 'expected isError');
-});
-
-await check('type=close with unknown tag → error', async () => {
-  const res = await handleToolCall('bridge', { type: 'close', tag: 'nope2' }, {});
-  const t = textOf(res);
-  assert(res.isError === true, 'expected isError');
-  assert(/does not map to a live session/.test(t), `unexpected: ${t}`);
-});
-
-await check('type=close missing tag → error', async () => {
-  const res = await handleToolCall('bridge', { type: 'close' }, {});
-  assert(res.isError === true, 'expected isError');
-});
-
-await check('unknown type → error', async () => {
-  const res = await handleToolCall('bridge', { type: 'bogus', role: 'worker' }, {});
-  const t = textOf(res);
-  assert(res.isError === true, 'expected isError');
-  assert(/unknown type/.test(t), `unexpected: ${t}`);
-});
-
-await check('default (no type) + no role → spawn path "role is required"', async () => {
-  const res = await handleToolCall('bridge', {}, {});
-  const t = textOf(res);
-  assert(res.isError === true, 'expected isError');
-  assert(/role is required/.test(t), `unexpected: ${t}`);
-});
-
-await check('type=spawn + role but no prompt/message → prompt resolution error', async () => {
-  const res = await handleToolCall('bridge', { type: 'spawn', role: 'nonexistent-role-xyz' }, {});
-  const t = textOf(res);
-  assert(res.isError === true, 'expected isError');
-  // Either prompt-missing or role-not-found surfaces — both prove routing into spawn.
-  assert(/prompt|role|provide exactly one/.test(t), `unexpected: ${t}`);
-});
-
-// --- Resumability guard rails (bugs #1/#2) ---------------------------------
-// These drive the unified `bridge type=send` path against an on-disk session
-// fixture addressed by raw sess_ id (the tag→sessionId registry is module
-// private; raw-id passthrough exercises the same handler code).
-
-await check('type=send while worker running → queued (not rejected)', async () => {
-  // pendingMessages pattern: a send during the in-flight turn must NOT become
-  // the first user message and must NOT be rejected — it enqueues and drains
-  // after the current turn. A non-terminal status trips the queue branch
-  // before askSession.
-  const sid = writeSessionFixture(`sess_${process.pid}_running_${Date.now()}`, 'running');
-  const res = await handleToolCall('bridge', { type: 'send', sessionId: sid, message: 'race' }, {});
-  const t = textOf(res);
-  assert(res.isError !== true, `expected success (queued), got: ${t}`);
-  assert(/"queued"\s*:\s*true/.test(t), `expected queued:true, got: ${t}`);
-  assert(!/still starting|retry shortly/.test(t), `must not reject a busy send anymore: ${t}`);
-  // The message must actually be parked on the pending queue.
-  const drained = drainPendingMessages(sid);
-  assert(drained.length === 1 && drained[0] === 'race', `expected ['race'] queued, got: ${JSON.stringify(drained)}`);
-});
-
-await check('type=send to non-terminal (connecting) status → queued', async () => {
-  // Same branch, mid-startup stage label — queues instead of rejecting. Since
-  // queuing preserves order, the connecting/startup window can queue safely:
-  // the queued send runs after the worker's first turn.
-  const sid = writeSessionFixture(`sess_${process.pid}_connecting_${Date.now()}`, 'connecting');
-  const res = await handleToolCall('bridge', { type: 'send', sessionId: sid, message: 'race' }, {});
-  const t = textOf(res);
-  assert(res.isError !== true, `expected success (queued), got: ${t}`);
-  assert(/"queued"\s*:\s*true/.test(t), `expected queued:true, got: ${t}`);
-  assert(!/still starting|retry shortly/.test(t), `must not reject a connecting send anymore: ${t}`);
-});
-
-await check('type=send to idle session → returns a jobId synchronously (detached, no inline response)', async () => {
-  // Bug #1 + async detach: once the initial turn has settled to a terminal
-  // status the send must NOT be rejected by the busy-guard — it passes the
-  // guard, cancels the pending 120s reap, and (now) returns IMMEDIATELY with a
-  // detached jobId instead of blocking on askSession. The provider failure on
-  // the dummy session now surfaces asynchronously via notifyFn, NOT in this
-  // synchronous return value.
-  const sid = writeSessionFixture(`sess_${process.pid}_idle_${Date.now()}`, 'idle');
-  const res = await handleToolCall('bridge', { type: 'send', sessionId: sid, message: 'resume' }, {});
-  const t = textOf(res);
-  assert(res.isError !== true, `expected a synchronous jobId return (not an error), got: ${t}`);
-  // Must be the immediate detached return, NOT the busy-guard.
-  assert(!/still starting|retry shortly/.test(t), `guard wrongly rejected an idle resume: ${t}`);
-  assert(/bridge_\d+_/.test(t), `expected a detached jobId in the sync return, got: ${t}`);
-  assert(/"detached":\s*true/.test(t), `expected detached:true in the sync return, got: ${t}`);
-  // The resume reply is delivered later via dispatch_result/notifyFn — the
-  // synchronous return must NOT carry an inline response/usage payload.
-  assert(!/"response"/.test(t), `send must not return an inline response now: ${t}`);
-});
-
-await check('type=send during startup window (tag bound, status not yet running) → queued', async () => {
-  // Bug #1 (round 2): spawn binds the tag and retry rebinds it BEFORE the
-  // session status is written 'running' / the runtime entry reaches askSession.
-  // A send landing in that gap must NOT slip through as the first user turn.
-  // The runtime stage is marked 'connecting' at the moment the tag is bound, so
-  // the queue branch's active-status set catches the window even though
-  // session.status is still unwritten — the send is QUEUED and drained after
-  // the worker's first turn, preserving order. Simulate by writing a fixture
-  // with NO status, then setting the runtime stage to 'connecting' the way the
-  // spawn/retry bind now does.
-  const sid = writeSessionFixture(`sess_${process.pid}_startwin_${Date.now()}`, undefined);
-  updateSessionStage(sid, 'connecting');
-  const res = await handleToolCall('bridge', { type: 'send', sessionId: sid, message: 'race' }, {});
-  const t = textOf(res);
-  assert(res.isError !== true, `expected success (queued), got: ${t}`);
-  assert(/"queued"\s*:\s*true/.test(t), `expected queued:true, got: ${t}`);
-  assert(!/still starting|retry shortly/.test(t), `startup-window send must queue, not reject: ${t}`);
-});
-
-await check('failed resume re-arms reap → session stays usable for a follow-up send', async () => {
-  // Bug #2 (round 2): send cancels the pending reap before resuming, but the
-  // reap was previously re-armed only on the success path — a failed resumed
-  // turn left the reap canceled, so the idle/error session was never terminally
-  // reaped. The fix re-arms _scheduleBridgeReap in a finally (idempotent). The
-  // reap timer is module-private, so assert the observable consequence: after a
-  // FIRST resume that fails on the dummy provider, a SECOND send to the same
-  // session still passes the busy-guard and reaches askSession (the failed
-  // resume left the session addressable + the reap re-armed, not orphaned).
-  const sid = writeSessionFixture(`sess_${process.pid}_failresume_${Date.now()}`, 'idle');
-  const first = await handleToolCall('bridge', { type: 'send', sessionId: sid, message: 'resume-1' }, {});
-  const t1 = textOf(first);
-  assert(first.isError !== true, `expected first resume to detach (jobId), got: ${t1}`);
-  assert(!/still starting|retry shortly/.test(t1), `first resume wrongly guard-rejected: ${t1}`);
-  assert(/bridge_\d+_/.test(t1), `expected first resume jobId, got: ${t1}`);
-  // The detached resume fails on the dummy provider in the background and
-  // re-arms the reap in its finally. Yield so that async tail can settle.
-  await new Promise((r) => setTimeout(r, 50));
-  // Re-mark idle (real path: failed turn flips status to 'idle'/'error'; the
-  // fixture write here restores a terminal status so the second send is guarded
-  // the same way) and re-send.
-  writeSessionFixture(sid, 'idle');
-  const second = await handleToolCall('bridge', { type: 'send', sessionId: sid, message: 'resume-2' }, {});
-  const t2 = textOf(second);
-  assert(second.isError !== true, `expected second resume to detach (jobId), got: ${t2}`);
-  assert(!/still starting|retry shortly/.test(t2), `second resume wrongly guard-rejected (session orphaned by failed resume?): ${t2}`);
-  assert(/bridge_\d+_/.test(t2), `expected second resume jobId (session addressable + reap re-armed, not orphaned), got: ${t2}`);
-});
-
-await check('type=send in post-askSession/pre-idle gap (persisted running, runtime done) → NOT stranded', async () => {
-  // Bug #2: spawn keeps persisted status 'running' until AFTER the completion
-  // emit (updateSessionStatus(idle) runs OUTSIDE askSession, past the drain
-  // point). A send landing after askSession returned but before status flips
-  // to 'idle' used to see persisted 'running' and ENQUEUE — but askSession had
-  // already drained and returned, so nothing consumed it: stranded + out of
-  // order. The busy-guard now prefers the RUNTIME terminal stage over the
-  // stale persisted 'running', so the send does a fresh detached resume
-  // instead of queuing into the void. Simulate: persisted status 'running'
-  // (not yet flipped), runtime stage 'done' (markSessionDone ran before the
-  // turn-loop drain).
-  const sid = writeSessionFixture(`sess_${process.pid}_gap_${Date.now()}`, 'running');
-  updateSessionStage(sid, 'done');
-  const res = await handleToolCall('bridge', { type: 'send', sessionId: sid, message: 'gap' }, {});
-  const t = textOf(res);
-  assert(res.isError !== true, `expected a detached resume, got: ${t}`);
-  assert(!/"queued"\s*:\s*true/.test(t), `must NOT enqueue in the post-askSession/pre-idle gap (would strand): ${t}`);
-  assert(/bridge_\d+_/.test(t), `expected a detached jobId (fresh resume), got: ${t}`);
-  // Nothing parked on the queue — proves the message was not stranded.
-  assert(drainPendingMessages(sid).length === 0, 'queue must be empty (message not stranded)');
-});
-
-await check('type=send raw MISSING sess_ id WITH role → respawns fresh (jobId), not a dead-session resume', async () => {
-  // Bug #5: a raw `sess_...` id that does NOT resolve to a LIVE session must
-  // fall into the reaped/unknown branch — with a role present, that means a
-  // fresh respawn (spawn path), NOT an async askSession launched against a
-  // missing/closed session. The id below is never written to disk, so
-  // _isLiveSession() rejects it and the precheck flips bridgeType→spawn.
-  await initProviders({ anthropic: { enabled: true, apiKey: 'dummy-smoke-key' } });
-  const missing = `sess_${process.pid}_ghost_${Date.now()}`;
-  const res = await handleToolCall('bridge', { type: 'send', sessionId: missing, role: 'worker', provider: 'anthropic', model: 'claude-3-haiku', message: 'hi' }, {});
-  const t = textOf(res);
-  assert(res.isError !== true, `expected a fresh respawn, got: ${t}`);
-  assert(/"jobId"\s*:\s*"bridge_/.test(t), `expected a jobId (fresh spawn), got: ${t}`);
-  // A fresh spawn allocates a NEW session id — it must not echo the dead id.
-  assert(!t.includes(missing), `respawn must not resume the missing/dead session id: ${t}`);
-});
-
-await check('multiple sends to a running worker → queued FIFO, drained in order', async () => {
-  // Order preservation: two sends landing during the same in-flight turn must
-  // queue in arrival order and drain in that order (the askSession turn loop
-  // shifts them off the front as follow-up turns). queueDepth reflects the
-  // growing queue.
-  const sid = writeSessionFixture(`sess_${process.pid}_fifo_${Date.now()}`, 'running');
-  const r1 = await handleToolCall('bridge', { type: 'send', sessionId: sid, message: 'first' }, {});
-  const r2 = await handleToolCall('bridge', { type: 'send', sessionId: sid, message: 'second' }, {});
-  const t1 = textOf(r1); const t2 = textOf(r2);
-  assert(/"queued"\s*:\s*true/.test(t1) && /"queued"\s*:\s*true/.test(t2), `both sends must queue, got: ${t1} | ${t2}`);
-  assert(/"queueDepth"\s*:\s*1/.test(t1), `first queued send should report queueDepth 1, got: ${t1}`);
-  assert(/"queueDepth"\s*:\s*2/.test(t2), `second queued send should report queueDepth 2, got: ${t2}`);
-  // Drain mirrors what askSession does after each turn — FIFO order.
-  const drained = drainPendingMessages(sid);
-  assert(drained.length === 2 && drained[0] === 'first' && drained[1] === 'second',
-    `expected ['first','second'] in order, got: ${JSON.stringify(drained)}`);
-  // Queue is emptied after drain.
-  assert(drainPendingMessages(sid).length === 0, 'queue must be empty after drain');
-});
-
-console.log(`\nbridge-unify-smoke: ${passed} passed, ${failed} failed`);
-// Remove the isolated data dir so no fixture survives the run. Belt-and-braces
-// with the unconditional CLAUDE_PLUGIN_DATA override above: even the isolated
-// temp store should not accumulate per-pid dirs across repeated smoke runs.
-try { rmSync(_SMOKE_DATA_DIR, { recursive: true, force: true }); } catch { /* best-effort */ }
-process.exit(failed === 0 ? 0 : 1);