mixdog 0.8.1 → 0.9.1

package/src/runtime/agent/orchestrator/tools/bash-session.mjs

@@ -41,14 +41,16 @@ import * as nodeUtil from 'node:util';
 import { existsSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { invalidateBuiltinResultCache, analyzeShellCommandEffects, preflightShellLargeFileProbe } from './builtin.mjs';
-import { markCodeGraphDirtyPaths, drainCodeGraphCache } from './code-graph.mjs';
+import { markCodeGraphDirtyPaths, drainCodeGraphCache } from './code-graph-state.mjs';
 import { maybeRewriteWmicProcessCommand } from './shell-policy.mjs';
 import { _maybeEncodePowerShellCommand } from './shell-command.mjs';
-import { _captureTrackedMtimes, _trackedDriftNoteAfter, _injectionBlockTargets, getDedupedDestructiveWarnings } from './builtin/bash-tool.mjs';
+import { _captureTrackedMtimes, _trackedDriftNoteAfter, getDedupedDestructiveWarnings } from './builtin/bash-tool.mjs';
 import { scrubLoaderVars, scrubProviderSecrets } from './env-scrub.mjs';
 import { checkExecPolicyMessage } from './bash-policy-scan.mjs';
 import { startChildGuardian } from '../../../shared/child-guardian.mjs';
 
+globalThis.__mixdogBashSessionRuntimeLoaded = true;
+
 // Default 600 s (10 min), max 1800 s. Aligned with the one-shot bash tool's
 // 600 s default (builtin/bash-tool.mjs); the persistent shell carries
 // longer-running pipelines (build/test/install) than one-shot calls, so a
@@ -171,15 +173,18 @@ function _startReaper() {
                 _killSession(id, 'idle-timeout');
             }
         }
-        if (_sessions.size === 0) {
-            clearInterval(_reaperTimer);
-            _reaperTimer = null;
-        }
+        _clearReaperIfIdle();
     }, 30_000);
     // Don't keep the event loop alive just for the reaper.
     if (typeof _reaperTimer.unref === 'function') _reaperTimer.unref();
 }
 
+function _clearReaperIfIdle() {
+    if (_sessions.size !== 0 || !_reaperTimer) return;
+    clearInterval(_reaperTimer);
+    _reaperTimer = null;
+}
+
 // Kill a spawned shell along with any child processes it forked. Posix path
 // signals the process group (pgid == pid because we spawn with detached:true),
 // so `sleep 1000 &` or a node server started inside the session is reaped
@@ -239,6 +244,17 @@ async function _killSession(id, _reason) {
     try { s.proc.stdin?.end(); } catch { /* ignore */ }
     _killProcessTree(s.proc);
     await Promise.race([exited, new Promise((r) => setTimeout(r, 3000))]);
+    _clearReaperIfIdle();
+}
+
+function _killSessionNow(id, _reason) {
+    const s = _sessions.get(id);
+    if (!s) return false;
+    _sessions.delete(id);
+    try { s.proc.stdin?.end(); } catch { /* ignore */ }
+    _killProcessTree(s.proc);
+    _clearReaperIfIdle();
+    return true;
 }
 
 function shellQuoteSingle(s) {
@@ -713,10 +729,21 @@ export function closeBashSession(sessionId, reason = 'external-close') {
     return true;
 }
 
+export async function shutdownBashSessions(reason = 'runtime-close') {
+    const ids = [..._sessions.keys()];
+    await Promise.allSettled(ids.map((id) => _killSession(id, reason)));
+    _clearReaperIfIdle();
+    return { closed: ids.length };
+}
+
 // Best-effort cleanup on process exit so orphan bash children don't linger
 // when the plugin host shuts down. Self-registered exit drain; bare 'exit' hook stays as idempotent backup.
-export function drainBashSessions() {
-    for (const id of [..._sessions.keys()]) _killSession(id, 'process-exit');
+export function drainBashSessions(reason = 'process-exit') {
+    let closed = 0;
+    for (const id of [..._sessions.keys()]) {
+        if (_killSessionNow(id, reason)) closed += 1;
+    }
+    return { closed };
 }
 if (typeof process?.on === 'function') {
     process.on('exit', drainBashSessions);

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -76,11 +76,6 @@ function isStringOrStringArray(v) {
     return true;
 }
 
-function hasBackslashPipe(value) {
-    if (typeof value === 'string') return false;
-    return false;
-}
-
 function hasUnsupportedRipgrepRegex(value) {
     const values = Array.isArray(value) ? value : [value];
     return values.some((item) => {
@@ -144,9 +139,6 @@ function guardGrep(a) {
         if (hasOwn(a, k) && !isStringOrStringArray(a[k])) {
             return `Error: grep arg "${k}" must be string or string[] (got ${describeType(a[k])})`;
         }
-        if (hasOwn(a, k) && hasBackslashPipe(a[k])) {
-            return `Error: grep arg "${k}" contains \\|. Use pattern:["a","b"] for OR terms, or unescaped | for regex alternation.`;
-        }
         if (hasOwn(a, k) && hasUnsupportedRipgrepRegex(a[k])) {
             return `Error: grep arg "${k}" uses regex syntax ripgrep does not support here (lookaround/backrefs). Use plain pattern arrays or simpler regex.`;
         }
@@ -311,6 +303,24 @@ function guardList(a) {
     return null;
 }
 
+function guardFind(a) {
+    if (!hasOwn(a, 'query') || typeof a.query !== 'string' || a.query.trim().length === 0) {
+        return `Error: find requires non-empty string "query" (got ${describeType(a.query)})`;
+    }
+    if (hasOwn(a, 'path') && !isString(a.path)) {
+        return `Error: find arg "path" must be a string (got ${describeType(a.path)})`;
+    }
+    if (hasOwn(a, 'head_limit') && a.head_limit !== undefined && a.head_limit !== null) {
+        if (!isFiniteInt(a.head_limit)) {
+            return `Error: find arg "head_limit" must be a finite integer (got ${describeType(a.head_limit)})`;
+        }
+        if (a.head_limit < 0) {
+            return `Error: find arg "head_limit" must be >= 0 (0 means no cap); got ${a.head_limit}`;
+        }
+    }
+    return null;
+}
+
 function guardGlob(a) {
     // path alias root; pattern aliases glob/name/file_pattern
     for (const k of ['path', 'root']) {
@@ -365,6 +375,7 @@ const GUARDS = {
     shell: guardShell,
     task: guardTask,
     list: guardList,
+    find: guardFind,
     glob: guardGlob,
     code_graph: guardCodeGraph,
 };

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -3,8 +3,8 @@ import { execShellCommand, stripAnsi } from '../shell-command.mjs';
 import { wrapCommandWithSnapshot } from '../shell-snapshot.mjs';
 import { getDestructiveCommandWarning } from '../destructive-warning.mjs';
 import { maybeRewriteWmicProcessCommand } from '../shell-policy.mjs';
-import { buildBashPolicyScanTargets, checkExecPolicyMessage, injectionBlockTargets } from '../bash-policy-scan.mjs';
-import { markCodeGraphDirtyPaths, drainCodeGraphCache } from '../code-graph.mjs';
+import { buildBashPolicyScanTargets, checkExecPolicyMessage } from '../bash-policy-scan.mjs';
+import { markCodeGraphDirtyPaths, drainCodeGraphCache } from '../code-graph-state.mjs';
 import {
     buildJobNotFoundMessage,
     startBackgroundShellJob,
@@ -27,7 +27,6 @@ import {
     cancelBackgroundTask,
     completeBackgroundTask,
     getBackgroundTask,
-    listBackgroundTasks,
     registerBackgroundTask,
     renderBackgroundTask,
     renderBackgroundTaskList,
@@ -48,7 +47,6 @@ import { scrubLoaderVars, scrubProviderSecrets } from '../env-scrub.mjs';
 // closing the "external write -> stale old_string -> code 8" gap when shell is
 // routed through this tool. Bounded to the tracked-read set (capped) so cost
 // stays off the whole-cwd path; emits nothing when no read file changed.
-const _DRIFT_SCAN_CAP = 256;
 export function _captureTrackedMtimes(_scope) {
     return new Map();
 }
@@ -60,7 +58,7 @@ export function _trackedDriftNoteAfter(_scope, _pre) {
 // AbortSignal (e.g. the MCP/request signal threaded through options.abortSignal).
 // Returns null when neither is present so existing session-only behavior is
 // preserved unchanged. Uses AbortSignal.any when available; falls back to a
-// manual controller + listener bridge otherwise. The returned signal aborts as
+// manual controller + listener path otherwise. The returned signal aborts as
 // soon as either input signal aborts, which propagates to execShellCommand /
 // executeBashSessionTool and triggers the same child-kill path the session
 // signal already drives.
@@ -86,53 +84,12 @@ function _combineAbortSignals(sessionSignal, externalSignal) {
     return ctl.signal;
 }
 
-// Decode ANSI-C $'…' and locale $"…" escapes so the blocklist scan sees the
-// literal command (e.g. $'\x72m' → "rm"). Defensive against quoting bypass.
-function _decodeAnsiCQuotes(s) {
-    if (typeof s !== 'string') return '';
-    if (s.indexOf('$') === -1) return s;
-    return s.replace(/\$(['"])((?:\\.|[^\\])*?)\1/g, (_full, _q, body) =>
-        body
-            .replace(/\\x([0-9a-fA-F]{1,2})/g, (_m, h) => String.fromCharCode(parseInt(h, 16)))
-            .replace(/\\u([0-9a-fA-F]{1,4})/g, (_m, h) => String.fromCharCode(parseInt(h, 16)))
-            .replace(/\\0([0-7]{1,3})/g, (_m, o) => String.fromCharCode(parseInt(o, 8)))
-            .replace(/\\([0-7]{1,3})/g, (_m, o) => String.fromCharCode(parseInt(o, 8)))
-            .replace(/\\n/g, '\n').replace(/\\t/g, '\t').replace(/\\r/g, '\r')
-            .replace(/\\\\/g, '\\').replace(/\\(['"])/g, '$1'),
-    );
-}
-
-// Extract $(…) and `…` command-substitution bodies so each is re-scanned by
-// isBlockedCommand (e.g. eval $(printf 'rm -rf ~')).
-function _extractSubstitutionBodies(s) {
-    if (typeof s !== 'string') return [];
-    const out = [];
-    const re = /\$\(([^()]*(?:\([^()]*\)[^()]*)*)\)|`([^`]*)`/g;
-    let m;
-    while ((m = re.exec(s)) !== null) {
-        const body = m[1] != null ? m[1] : m[2];
-        if (body && body.trim()) out.push(body);
-    }
-    return out;
-}
-
-// Combined injection-aware block targets: decoded form + substitution bodies
-// (and their decoded forms). Used on BOTH the persistent and stateless paths.
-export function _injectionBlockTargets(cmd) {
-    return injectionBlockTargets(cmd);
-}
-
 function _prefixPowerShellUtf8(command) {
     const prefix = '[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $OutputEncoding=[System.Text.Encoding]::UTF8;';
     const text = String(command || '');
     return text.trimStart().startsWith(prefix) ? text : `${prefix}\n${text}`;
 }
 
-const _unquoteSpansForPolicy = (s) => s.replace(/"([^"\\]|\\.)*"|'([^'\\]|\\.)*'/g, (m) => m.slice(1, -1));
-
-// Same normalized + decoded target set as hard-block (strip/unquote/shell -c/PS).
-export { buildBashPolicyScanTargets } from '../bash-policy-scan.mjs';
-
 export function getDedupedDestructiveWarnings(command) {
     const seenMsg = new Set();
     const warnings = [];
@@ -343,7 +300,7 @@ export async function executeBashTool(args, workDir, options = {}) {
             // the background task finished (no polling tool is auto-driven). The
             // notify ctx is threaded down from the MCP dispatch frame
             // (server-main agentContext / _dispatchByModule) the same way the
-            // bridge/explore-style tools receive notifyFn/routingSessionId/clientHostPid.
+            // agent/explore-style tools receive notifyFn/routingSessionId/clientHostPid.
             // Missing notifyFn (e.g. a non-MCP caller) degrades to a stderr
             // diagnostic inside watchBackgroundShellJob — never fails the spawn.
             try {
@@ -548,12 +505,12 @@ export async function executeTaskTool(args, options = {}) {
 
     const taskId = typeof args.task_id === 'string' ? args.task_id.trim() : '';
     if (!taskId) return 'Error: task_id is required';
-    // bridge_* / sess_* are bridge-worker / orchestrator session ids, not
-    // background shell jobs. task only resolves `shell mode=async`
-    // jobs, so surface a self-correcting hint instead of the bare
-    // "job not found" that otherwise invites a wrong-tool retry loop.
-    if (/^(?:bridge_|sess_)/.test(taskId)) {
-        return `Error: "${taskId}" is a bridge/session id, not a background task_id. Bridge agents deliver completion notifications; use bridge list/read only for manual recovery.`;
+    // sess_* values are agent/orchestrator session ids, not background shell
+    // tasks. task only resolves `shell mode=async` tasks, so surface a
+    // self-correcting hint instead of the bare "task not found" that otherwise
+    // invites a wrong-tool retry loop.
+    if (/^sess_/.test(taskId)) {
+        return `Error: "${taskId}" is an agent/session id, not a background task_id. Agent tasks deliver completion notifications; use agent list/read only for manual recovery.`;
     }
 
     const task = getBackgroundTask(taskId, { context: options });

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -17,14 +17,23 @@ export const BUILTIN_TOOLS = [
         name: 'read',
         title: 'Mixdog Read',
         annotations: { title: 'Mixdog Read', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: false },
-        description: 'Read a specific file window or symbol body after narrowing the target. Do not reread content already shown by code_graph or grep.',
+        description: 'Read known file path(s). Use line+context for small windows. Batch paths.',
         inputSchema: {
             type: 'object',
             properties: {
-                path: { type: 'string', description: 'File path only; dirs use list.' },
-                line: { type: 'number', minimum: 1, description: 'Anchor line. Do not combine with offset/limit.' },
-                context: { type: 'number', minimum: 0, maximum: 200, description: 'Lines around line. Use only with line; max 200.' },
-                symbol: { type: 'string', description: 'Symbol body via code graph.' },
+                path: {
+                    anyOf: [
+                        { type: 'string' },
+                        {
+                            type: 'array',
+                            items: { type: 'string' },
+                            minItems: 1,
+                        },
+                    ],
+                    description: 'File path or array. Dirs use list.',
+                },
+                line: { type: 'number', minimum: 1, description: 'Anchor line.' },
+                context: { type: 'number', minimum: 0, maximum: 200, description: 'Lines around line; max 200.' },
             },
         },
     },
@@ -32,11 +41,11 @@ export const BUILTIN_TOOLS = [
         name: 'diagnostics',
         title: 'Mixdog Diagnostics',
         annotations: { title: 'Mixdog Diagnostics', readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true, compressible: true },
-        description: 'Run the matching type/lint checker under a file or directory (tsc/eslint/ruff/etc.). Default cwd; no LSP.',
+        description: 'Run matching type/lint checker. Default cwd; no LSP.',
         inputSchema: {
             type: 'object',
             properties: {
-                path: { type: 'string', description: 'File or directory to diagnose. Defaults to cwd.' },
+                path: { type: 'string', description: 'File/dir. Default cwd.' },
             },
             required: [],
         },
@@ -45,29 +54,29 @@ export const BUILTIN_TOOLS = [
         name: 'open_config',
         title: 'Open Config UI',
         annotations: { title: 'Open Config UI', readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-        description: 'Open the mixdog settings UI (Providers + Presets) in the browser. Starts the resident config server if needed and returns the UI URL. No params.',
+        description: 'Open settings UI; returns URL. No params.',
         inputSchema: { type: 'object', properties: {}, additionalProperties: false },
     },
     {
         name: 'shell',
         title: 'Mixdog Shell',
         annotations: { title: 'Mixdog Shell', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, compressible: true },
-        description: `Run an OS shell command for git/build/test/run only. Do NOT use shell grep/cat/head for source; use code_graph/grep/read/list/glob. Set shell explicitly: 'powershell' for PowerShell or 'bash' for Git Bash/POSIX. Use cwd; omit empty workdir. Windows native shell does not support persistent/session_id. mode=async uses the shared background task system and returns task_id. ${TOOL_ASYNC_EXECUTION_CONTRACT}`,
+        description: `Run shell for git/build/test/run. Not for source browsing; use code_graph/grep/read/list/glob. Set shell: powershell or bash. ${TOOL_ASYNC_EXECUTION_CONTRACT}`,
         inputSchema: {
             type: 'object',
             properties: {
-                command: { type: 'string', description: 'Shell command to run.' },
-                cwd: { type: 'string', description: 'Working directory for the command; omit when using current cwd.' },
+                command: { type: 'string', description: 'Command.' },
+                cwd: { type: 'string', description: 'Working directory.' },
                 workdir: { type: 'string', description: 'Alias for cwd; omit if empty.' },
-                timeout: { type: 'number', description: 'Timeout in milliseconds.' },
-                merge_stderr: { type: 'boolean', description: 'Merge stderr into stdout in the returned output.' },
+                timeout: { type: 'number', description: 'Timeout ms.' },
+                merge_stderr: { type: 'boolean', description: 'Merge stderr.' },
                 mode: { type: 'string', enum: ['sync', 'async'], description: executionModeSchemaDescription('sync') },
                 run_in_background: { type: 'boolean', description: `Legacy alias for mode=async. ${TOOL_ASYNC_EXECUTION_CONTRACT}` },
-                persistent: { type: 'boolean', description: 'Persistent shell mode; unsupported on Windows native shell.' },
-                session_id: { type: 'string', description: 'Persistent shell id; omit on Windows native shell.' },
-                create: { type: 'boolean', description: 'Allow creating a new persistent session for an explicit session_id.' },
-                close: { type: 'boolean', description: 'Close the persistent session after this command when supported.' },
-                shell: { type: 'string', enum: ['bash', 'powershell'], description: "Force the shell. On Windows: 'bash' runs the command through Git Bash (POSIX syntax), 'powershell' forces PowerShell. On POSIX: 'powershell' resolves pwsh if installed (errors if absent); 'bash' is /bin/sh (already the default). Always set this explicitly; omitting uses the OS default (PowerShell on Windows), where POSIX syntax fails to parse." },
+                persistent: { type: 'boolean', description: 'Persistent shell mode.' },
+                session_id: { type: 'string', description: 'Persistent shell id.' },
+                create: { type: 'boolean', description: 'Create session_id if missing.' },
+                close: { type: 'boolean', description: 'Close persistent session.' },
+                shell: { type: 'string', enum: ['bash', 'powershell'], description: 'Force shell. Windows default is PowerShell; bash means Git Bash/POSIX.' },
             },
             required: ['command'],
         },
@@ -76,14 +85,14 @@ export const BUILTIN_TOOLS = [
         name: 'task',
         title: 'Background Task Control',
         annotations: { title: 'Background Task Control', readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
-        description: `Manual control for an async background task by task_id. action: list | status | read | wait | cancel. ${TOOL_MANUAL_CONTROL_CONTRACT} Not for bridge_*/sess_* ids.`,
+        description: `Manual control for shell async task_id. actions: list/status/read/wait/cancel. ${TOOL_MANUAL_CONTROL_CONTRACT} Not sess_* or agent ids.`,
         inputSchema: {
             type: 'object',
             properties: {
-                task_id: { type: 'string', description: 'task_id from shell mode=async. Use only for manual control; normal completion arrives as a notification.' },
-                action: { type: 'string', enum: ['list', 'status', 'read', 'wait', 'cancel'], description: 'Manual control only: list all visible tasks; status is non-blocking; read includes available result/output; wait blocks inside this one call until done/timeout; cancel terminates when the task supports it. Do not call repeatedly as a polling loop.' },
-                timeout_ms: { type: 'number', description: 'Maximum time for a single manual wait call. Prefer the completion notification instead of repeated waits.' },
-                poll_ms: { type: 'number', description: 'Internal polling interval used only inside one manual wait call.' },
+                task_id: { type: 'string', description: 'shell async task_id.' },
+                action: { type: 'string', enum: ['list', 'status', 'read', 'wait', 'cancel'], description: 'Manual action. Avoid polling loops.' },
+                timeout_ms: { type: 'number', description: 'Wait timeout ms.' },
+                poll_ms: { type: 'number', description: 'Wait poll ms.' },
             },
             required: [],
         },
@@ -92,7 +101,7 @@ export const BUILTIN_TOOLS = [
         name: 'grep',
         title: 'Mixdog Grep',
         annotations: { title: 'Mixdog Grep', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'Search text or regex within a known file or directory.',
+        description: 'Search text/logs/regex.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -101,19 +110,19 @@ export const BUILTIN_TOOLS = [
                         { type: 'string' },
                         { type: 'array', items: { type: 'string' }, minItems: 1 },
                     ],
-                    description: 'Literal/substring or ripgrep regex. Array = OR terms. Legacy `\\|` in a single string is accepted as OR.',
+                    description: 'Text/regex. Array = OR.',
                 },
-                path: { type: 'string', description: 'One file or directory only; for many paths use common parent + glob.' },
+                path: { type: 'string', description: 'File or directory.' },
                 glob: {
                     anyOf: [
                         { type: 'string' },
                         { type: 'array', items: { type: 'string' }, minItems: 1 },
                     ],
-                    description: 'Glob filter(s).',
+                    description: 'Optional narrowing glob(s).',
                 },
-                output_mode: { type: 'string', enum: ['files_with_matches', 'content', 'count'], description: 'Default content.' },
-                head_limit: { type: 'number', description: 'Max result lines.' },
-                offset: { type: 'number', description: 'Skip N result lines for paging.' },
+                output_mode: { type: 'string', enum: ['files_with_matches', 'content', 'count'], description: 'Output mode.' },
+                head_limit: { type: 'number', description: 'Max lines.' },
+                offset: { type: 'number', description: 'Skip lines.' },
             },
             required: [],
         },
@@ -122,7 +131,7 @@ export const BUILTIN_TOOLS = [
         name: 'glob',
         title: 'Mixdog Glob',
         annotations: { title: 'Mixdog Glob', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'Find files by glob pattern. Use for broad file-space narrowing.',
+        description: 'Find files by glob.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -131,33 +140,47 @@ export const BUILTIN_TOOLS = [
                         { type: 'string' },
                         { type: 'array', items: { type: 'string' }, minItems: 1 },
                     ],
-                    description: 'Glob pattern, or array of patterns.',
+                    description: 'Glob pattern(s).',
                 },
                 path: {
                     anyOf: [
                         { type: 'string' },
                         { type: 'array', items: { type: 'string' }, minItems: 1 },
                     ],
-                    description: 'Base directory, or array of base directories.',
+                    description: 'Base directory/directories.',
                 },
                 head_limit: { type: 'number', description: 'Max entries.' },
-                offset: { type: 'number', description: 'Skip N entries for paging.' },
+                offset: { type: 'number', description: 'Skip entries.' },
             },
             required: ['pattern'],
         },
     },
+    {
+        name: 'find',
+        title: 'Mixdog Find Files',
+        annotations: { title: 'Mixdog Find Files', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
+        description: 'Fuzzy-find files by partial path/name. Returns paths.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                query: { type: 'string', description: 'Partial path/name words.' },
+                path: { type: 'string', description: 'Base directory.' },
+                head_limit: { type: 'number', description: 'Max paths.' },
+            },
+            required: ['query'],
+        },
+    },
     {
         name: 'list',
         title: 'Mixdog List Directory',
         annotations: { title: 'Mixdog List Directory', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'List directory entries or fuzzy-rank filenames. Use for broad directory/file discovery.',
+        description: 'List known directory entries. Use glob for broad discovery.',
         inputSchema: {
             type: 'object',
             properties: {
-                path: { type: 'string', description: 'Directory to list; omit for current cwd.' },
+                path: { type: 'string', description: 'Directory.' },
                 head_limit: { type: 'number', description: 'Max entries.' },
                 offset: { type: 'number', description: 'Skip N entries for paging.' },
-                fuzzy: { type: 'string', description: 'Rank files by partial name.' },
             },
             required: [],
         },

package/src/runtime/agent/orchestrator/tools/builtin/cache-layers.mjs

@@ -5,6 +5,7 @@ import { deleteReadRangeIndexForPath } from './read-range-index.mjs';
 import { resolveAgainstCwd } from './path-utils.mjs';
 
 const RESULT_CACHE = new Map(); // key → { ts, value, paths, scopes, readSnapshotMeta, contentPrefixHash, bytes }
+const RESULT_CACHE_INFLIGHT = new Map(); // key → Promise<value>
 const RESULT_CACHE_TTL_MS = 30_000;
 const RESULT_CACHE_MAX_ENTRIES = 200;
 const RESULT_CACHE_MAX_BYTES = (() => {
@@ -140,6 +141,22 @@ export function cacheSet(key, value, meta = {}) {
     }
 }
 
+export async function runResultCacheInFlight(key, compute) {
+    const cached = cacheGet(key);
+    if (cached !== null) return cached;
+    const existing = RESULT_CACHE_INFLIGHT.get(key);
+    if (existing) return await existing;
+    const promise = Promise.resolve()
+        .then(() => compute())
+        .finally(() => {
+            if (RESULT_CACHE_INFLIGHT.get(key) === promise) {
+                RESULT_CACHE_INFLIGHT.delete(key);
+            }
+        });
+    RESULT_CACHE_INFLIGHT.set(key, promise);
+    return await promise;
+}
+
 function rawContentCacheDelete(key) {
     const entry = RAW_CONTENT_CACHE.get(key);
     if (entry?.rawBuf) RAW_CONTENT_CACHE_BYTES = Math.max(0, RAW_CONTENT_CACHE_BYTES - entry.rawBuf.length);
@@ -230,7 +247,7 @@ export async function statPathsForMtime(paths, workDir, concurrency = 64, opts =
     // Hard per-stat deadline (0 = disabled, legacy behaviour). A hung stat
     // (dead mount / unresponsive network path) must not pin a worker forever;
     // on expiry the entry resolves to null (stat-failed) so glob's post-rg stat
-    // phase is bounded instead of running to the 600s bridge watchdog.
+    // phase is bounded instead of running to the 600s agent watchdog.
     const deadlineMs = Number(opts.deadlineMs) > 0 ? Number(opts.deadlineMs) : 0;
     // Injectable stat impl for testing hung-FS behaviour deterministically.
     const statImpl = typeof opts._statImpl === 'function' ? opts._statImpl : fsPromises.stat;
@@ -293,7 +310,7 @@ export async function lstatPathsForMtime(paths, workDir, concurrency = 64, opts
     // Hard per-lstat deadline (0 = disabled, legacy behaviour). A hung lstat
     // (dead mount / unresponsive network path) must not pin a worker forever;
     // on expiry the entry resolves to null (stat-failed) so list's stat phase
-    // is bounded instead of running to the 600s bridge watchdog.
+    // is bounded instead of running to the 600s agent watchdog.
     const deadlineMs = Number(opts.deadlineMs) > 0 ? Number(opts.deadlineMs) : 0;
     // Injectable lstat impl for testing hung-FS behaviour deterministically.
     const lstatImpl = typeof opts._lstatImpl === 'function' ? opts._lstatImpl : fsPromises.lstat;
@@ -342,6 +359,7 @@ export async function lstatPathsForMtime(paths, workDir, concurrency = 64, opts
 
 function cacheInvalidateAll() {
     RESULT_CACHE.clear();
+    RESULT_CACHE_INFLIGHT.clear();
     RESULT_CACHE_BYTES = 0;
     STAT_CACHE.clear();
     RAW_CONTENT_CACHE.clear();
@@ -356,6 +374,7 @@ function cacheInvalidatePaths(paths) {
         cacheInvalidateAll();
         return;
     }
+    RESULT_CACHE_INFLIGHT.clear();
     for (const [key, entry] of RESULT_CACHE) {
         if (cacheEntryOverlapsPaths(entry, affectedPaths)) {
             resultCacheDelete(key);

package/src/runtime/agent/orchestrator/tools/builtin/device-paths.mjs

@@ -1,4 +1,4 @@
-// G6: device path block list (Claude Code parity). Reading these paths
+// G6: device path block list (reference parity). Reading these paths
 // would either hang (waiting for stdin / tty) or produce infinite output
 // (/dev/zero, /dev/random). The device block list catches pseudo-files on
 // POSIX hosts that a user-allowed path can still hit.

package/src/runtime/agent/orchestrator/tools/builtin/diagnostics-tool.mjs

@@ -282,11 +282,4 @@ async function _executeDiagnosticsImpl(args, workDir) {
     }
 }
 
-function _isDir(p, workDir) {
-    try {
-        const abs = isAbsolute(p) ? p : pathResolve(workDir, p);
-        return statSync(abs).isDirectory();
-    } catch { return false; }
-}
-
 export default executeDiagnosticsTool;

package/src/runtime/agent/orchestrator/tools/builtin/glob-walk.mjs

@@ -118,12 +118,10 @@ export function compileSimpleGlob(pattern) {
 // simpler and matches the noise patterns developers actually create.
 export const NOISE_DIR_NAMES = new Set([
     'node_modules', '.git',
-    'dist', 'build', 'out', 'target',
     '.next', '.nuxt', '.svelte-kit',
     '.cache', '.parcel-cache', '.turbo',
     'venv', '.venv', '__pycache__', '.pytest_cache',
-    '.gradle', 'coverage',
-    'refs',
+    '.gradle',
 ]);
 
 export const MAX_WALK_ENTRIES = 200_000;

package/src/runtime/agent/orchestrator/tools/builtin/list-tool.mjs

@@ -60,7 +60,7 @@ function listGuardPath(p) {
 
 export async function executeListTool(args, workDir, options = {}) {
     if (typeof args.fuzzy === 'string' && args.fuzzy.length > 0) {
-        return executeFuzzyFind(args, workDir);
+        return executeFuzzyFindTool({ ...args, query: args.fuzzy }, workDir, options);
     }
     if (args.mode === 'tree') return executeTreeTool(args, workDir, options);
     if (args.mode === 'find') return executeFindFilesTool(args, workDir, options);
@@ -296,12 +296,13 @@ export async function executeTreeTool(args, workDir, options = {}) {
     return out;
 }
 
-// Fuzzy filename search (codex file-search / nucleo style): collect the file
-// list via `rg --files`, then rank by subsequence score. Lets a partial name
-// like "edeng" surface matching files in one call instead of guessing an exact
-// glob pattern. Honors path/hidden/include_noise/depth/head_limit.
-async function executeFuzzyFind(args, workDir) {
-    const query = String(args.fuzzy);
+ // Fuzzy filename search (nucleo-style): collect the file
+// list via `rg --files`, then rank by subsequence score. `list.fuzzy` still
+// routes here for hidden backward compatibility, but the model-facing tool is
+// `find`.
+export async function executeFuzzyFindTool(args, workDir, options = {}) {
+    const query = String(args.query ?? args.fuzzy ?? '').trim();
+    if (!query) return 'Error: find requires query.';
     const inputPath = normalizeInputPath(args.path) || '.';
     const guard = listGuardPath(inputPath);
     if (guard) return guard;
@@ -310,10 +311,25 @@ async function executeFuzzyFind(args, workDir) {
     if (guardFull) return guardFull;
     const hidden = Boolean(args.hidden);
     const includeNoise = Boolean(args.include_noise);
-    // head_limit:0 means "no cap" per list semantics — keep 0 distinct from default.
-    const headLimit = normalizeListHeadLimit(args.head_limit, 40);
+    // head_limit:0 means "no cap" per list semantics; default is intentionally
+    // compact so ambiguous discovery does not dump a huge candidate list.
+    const headLimit = normalizeListHeadLimit(args.head_limit, 25);
     const depth = args.depth != null ? Math.max(parseInt(args.depth, 10) || 1, 1) : null;
-    const rgArgs = ['--files', '--no-ignore'];
+    const cacheKey = buildListCacheKey({
+        mode: 'fuzzy_find',
+        inputPath: normalizeOutputPath(fullPath),
+        depth: depth ?? '',
+        hidden,
+        sort: 'score',
+        typeFilter: 'file',
+        headLimit,
+        offset: '',
+        namePattern: query,
+        includeNoise,
+    });
+    const cached = cacheGet(cacheKey);
+    if (cached !== null) return cached;
+    const rgArgs = ['--files'];
     if (hidden) rgArgs.push('--hidden');
     if (depth != null) rgArgs.push('--max-depth', String(depth));
     if (!includeNoise) {
@@ -333,12 +349,20 @@ async function executeFuzzyFind(args, workDir) {
         .map((p) => (p.endsWith('\r') ? p.slice(0, -1) : p))
         .filter((p) => p.length > 0)
         .map((p) => ({ path: normalizeOutputPath(p.replace(/^\.[/\\]/, '')) }));
-    const ranked = fuzzyRank(query, items, headLimit);
+    const rankLimit = headLimit > 0 ? headLimit + 1 : headLimit;
+    const rankedRaw = fuzzyRank(query, items, rankLimit);
+    const hasMore = headLimit > 0 && rankedRaw.length > headLimit;
+    const ranked = hasMore ? rankedRaw.slice(0, headLimit) : rankedRaw;
     if (ranked.length === 0) return `(no fuzzy match for "${query}")`;
     const out = ranked.map((r) => r.item.path).join('\n');
-    return headLimit > 0 && ranked.length >= headLimit
+    const result = hasMore
         ? `${out}\n... (top ${headLimit}; raise head_limit for more)`
         : out;
+    cacheSet(cacheKey, result, { scopes: [fullPath] });
+    if (typeof options?.onProgress === 'function') {
+        try { options.onProgress(`${ranked.length} candidates`); } catch { /* best-effort */ }
+    }
+    return result;
 }
 
 export async function executeFindFilesTool(args, workDir, options = {}) {