mixdog 0.9.1 → 0.9.3

package/src/runtime/agent/orchestrator/session/manager/rules-cache.mjs

@@ -0,0 +1,155 @@
+// Prompt-layer rules builders + mtime-invalidated caches, extracted verbatim
+// from manager.mjs. Behavior-preserving: same createRequire lookup, same cache
+// semantics, same error messages.
+import { createRequire } from 'module';
+import { join } from 'path';
+import { resolvePluginData, mixdogRoot } from '../../../../shared/plugin-paths.mjs';
+import { maxMtimeRecursive } from '../../cache-mtime.mjs';
+import { getAgentInstructionDir } from '../../internal-agents.mjs';
+
+// Phase B: Pool B Tier 2 content builder (common rules only).
+// Loaded once per process via createRequire so the CJS module reaches us.
+const _require = createRequire(import.meta.url);
+const _rulesBuilder = (() => {
+    const candidates = [
+        join(mixdogRoot(), 'lib', 'rules-builder.cjs'),
+    ].filter(Boolean);
+    for (const p of candidates) {
+        try { return _require(p); } catch { /* fall through */ }
+    }
+    // Fallback: walk up from this file's location to find lib/rules-builder.cjs.
+    try { return _require('../../../../../lib/rules-builder.cjs'); } catch { return null; }
+})();
+
+// BP1/BP2/BP3 prompt-layer caches — invalidated by source file mtime, not a
+// timer. Cheap: O(sentinel-count) stat calls on each session creation, no file
+// I/O when warm.
+let _sharedRulesCache = null;
+let _sharedRulesMtime = 0;
+const _agentRulesCacheByProfile = new Map();
+let _leadRulesCache = null;
+let _leadRulesMtime = 0;
+let _leadMetaCache = null;
+let _leadMetaMtime = 0;
+
+export function _buildSharedRules() {
+    if (!_rulesBuilder || typeof _rulesBuilder.buildSharedToolContent !== 'function') return '';
+    const PLUGIN_ROOT = mixdogRoot();
+    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
+    const mtime = maxMtimeRecursive([
+        join(RULES_DIR, 'shared'),
+    ]);
+    if (_sharedRulesCache !== null && mtime <= _sharedRulesMtime) {
+        return _sharedRulesCache;
+    }
+    try {
+        const built = _rulesBuilder.buildSharedToolContent({ PLUGIN_ROOT, DATA_DIR: resolvePluginData() });
+        _sharedRulesCache = built;
+        _sharedRulesMtime = mtime;
+        return built;
+    } catch (e) {
+        throw new Error(`[session] shared tool rules build failed: ${e.message}`);
+    }
+}
+
+export function _buildAgentRules(profile = 'full') {
+    if (!_rulesBuilder || typeof _rulesBuilder.buildAgentRoleContent !== 'function') return '';
+    const key = String(profile || 'full');
+    const PLUGIN_ROOT = mixdogRoot();
+    const DATA_DIR = resolvePluginData();
+    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
+    const mtime = maxMtimeRecursive([
+        join(RULES_DIR, 'agent'),
+        join(DATA_DIR, 'mixdog-config.json'),
+    ]);
+    const cached = _agentRulesCacheByProfile.get(key);
+    if (cached && mtime <= cached.mtime) {
+        return cached.value;
+    }
+    try {
+        const built = _rulesBuilder.buildAgentRoleContent({ PLUGIN_ROOT, DATA_DIR, profile: key });
+        _agentRulesCacheByProfile.set(key, { mtime, value: built });
+        return built;
+    } catch (e) {
+        throw new Error(`[session] agent role rules build failed: ${e.message}`);
+    }
+}
+
+export function _buildLeadRules() {
+    if (!_rulesBuilder || typeof _rulesBuilder.buildLeadRoleContent !== 'function') return '';
+    const PLUGIN_ROOT = mixdogRoot();
+    const DATA_DIR = resolvePluginData();
+    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
+    const mtime = maxMtimeRecursive([
+        join(RULES_DIR, 'lead'),
+        join(DATA_DIR, 'mixdog-config.json'),
+    ]);
+    if (_leadRulesCache !== null && mtime <= _leadRulesMtime) {
+        return _leadRulesCache;
+    }
+    try {
+        const built = _rulesBuilder.buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR });
+        _leadRulesCache = built;
+        _leadRulesMtime = mtime;
+        return built;
+    } catch (e) {
+        throw new Error(`[session] lead role rules build failed: ${e.message}`);
+    }
+}
+
+export function _buildLeadMetaContext() {
+    if (!_rulesBuilder || typeof _rulesBuilder.buildLeadMetaContent !== 'function') return '';
+    const PLUGIN_ROOT = mixdogRoot();
+    const DATA_DIR = resolvePluginData();
+    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
+    const mtime = maxMtimeRecursive([
+        join(RULES_DIR, 'lead'),
+        join(DATA_DIR, 'history'),
+        join(DATA_DIR, 'mixdog-config.json'),
+        join(DATA_DIR, 'user-workflow.md'),
+        join(PLUGIN_ROOT, 'output-styles'),
+        join(DATA_DIR, 'output-styles'),
+    ]);
+    if (_leadMetaCache !== null && mtime <= _leadMetaMtime) {
+        return _leadMetaCache;
+    }
+    try {
+        const built = _rulesBuilder.buildLeadMetaContent({ PLUGIN_ROOT, DATA_DIR });
+        _leadMetaCache = built;
+        _leadMetaMtime = mtime;
+        return built;
+    } catch (e) {
+        throw new Error(`[session] lead meta context build failed: ${e.message}`);
+    }
+}
+
+// BP4-adjacent agent-specific data cache — keyed by agent. webhook / schedule
+// agents each have their own scoped instruction set; other agents return ''.
+const _roleSpecificCache = new Map(); // agent → { value, mtime }
+export function _buildAgentSpecific(currentAgent) {
+    if (!_rulesBuilder || typeof _rulesBuilder.buildAgentRoleSpecificContent !== 'function') return '';
+    if (!currentAgent) return '';
+    const PLUGIN_ROOT = mixdogRoot();
+    const DATA_DIR = resolvePluginData();
+    const RULES_DIR = join(PLUGIN_ROOT, 'rules');
+    const roleInstructionDir = getAgentInstructionDir(currentAgent);
+    const mtime = maxMtimeRecursive([
+        join(RULES_DIR, 'shared'),
+        join(DATA_DIR, 'mixdog-config.json'),
+        join(DATA_DIR, 'webhooks'),
+        join(DATA_DIR, 'schedules'),
+        ...(roleInstructionDir ? [join(DATA_DIR, roleInstructionDir)] : []),
+        join(PLUGIN_ROOT, 'defaults', 'agents.json'),
+    ]);
+    const entry = _roleSpecificCache.get(currentAgent);
+    if (entry && mtime <= entry.mtime) {
+        return entry.value;
+    }
+    try {
+        const built = _rulesBuilder.buildAgentRoleSpecificContent({ PLUGIN_ROOT, DATA_DIR, currentAgent });
+        _roleSpecificCache.set(currentAgent, { mtime, value: built });
+        return built;
+    } catch (e) {
+        throw new Error(`[session] agent-specific rules build failed (agent: ${currentAgent}): ${e.message}`);
+    }
+}

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -0,0 +1,303 @@
+// Session tool schema resolution + permission narrowing, extracted verbatim
+// from manager.mjs. Behavior-preserving: same toolset ids, same ordering,
+// same dedup, same fail-closed permission intersection.
+import { getMcpTools } from '../../mcp/client.mjs';
+import { getInternalTools } from '../../internal-tools.mjs';
+import { BUILTIN_TOOLS } from '../../tools/builtin/builtin-tools.mjs';
+import { PATCH_TOOL_DEFS } from '../../tools/patch-tool-defs.mjs';
+import { CODE_GRAPH_TOOL_DEFS } from '../../tools/code-graph-tool-defs.mjs';
+import { buildSkillToolDefs } from '../../context/collect.mjs';
+import { getHiddenAgent, listHiddenAgentNames } from '../../internal-agents.mjs';
+
+// Merge externally-connected MCP tools with the plugin's in-process tools
+// (registered by agent's toolExecutor adapter). Internal tools are exposed
+// under their bare names — no mcp__ prefix, since the dispatcher in
+// server.mjs handles them directly without a transport.
+// Sorted deterministically by name — protects BP_1 hash stability from
+// listTools() ordering churn. Anthropic / OpenAI / Gemini all hash the
+// tools array verbatim, so any reorder rewrites the prefix.
+// No cache: getMcpTools() and getInternalTools() are O(n) in-memory reads;
+// the sort overhead on ~30 tools is negligible.
+function _getMcpTools() {
+    const mcp = getMcpTools() || [];
+    const internalRaw = getInternalTools() || [];
+    const internal = internalRaw.map(t => ({
+        name: t.name,
+        description: typeof t.description === 'string' ? t.description : '',
+        inputSchema: t.inputSchema || { type: 'object', properties: {} },
+        // Keep annotations so the permission filter / role invariants can
+        // tell read-only from write-capable internal tools, and so
+        // agentHidden can be read during deny filtering.
+        annotations: t.annotations || {},
+    }));
+    return [...mcp, ...internal].sort((a, b) => {
+        const an = a?.name || '';
+        const bn = b?.name || '';
+        return an < bn ? -1 : an > bn ? 1 : 0;
+    });
+}
+
+const SESSION_ROUTE_TOOL_ORDER = [
+    'code_graph',
+    'find',
+    'glob',
+    'list',
+    'grep',
+    'read',
+    'apply_patch',
+    'shell',
+    'task',
+];
+const SESSION_ROUTE_TOOL_RANK = new Map(SESSION_ROUTE_TOOL_ORDER.map((name, index) => [name, index]));
+const FILESYSTEM_TOOL_NAMES = new Set([
+    'code_graph',
+    'find',
+    'glob',
+    'list',
+    'grep',
+    'read',
+    'apply_patch',
+]);
+const READONLY_TOOL_NAMES = new Set([
+    'code_graph',
+    'find',
+    'glob',
+    'list',
+    'grep',
+    'read',
+]);
+
+const AGENT_STRING_PERMISSION_READ_ALLOW = Object.freeze([
+    'code_graph',
+    'find',
+    'glob',
+    'list',
+    'grep',
+    'read',
+    'explore',
+    'search',
+    'web_fetch',
+    'Skill',
+]);
+
+function stringToolPermissionAllowList(toolPermission) {
+    if (toolPermission === 'read') return AGENT_STRING_PERMISSION_READ_ALLOW;
+    if (toolPermission === 'read-write') return AGENT_STRING_PERMISSION_READ_WRITE_ALLOW;
+    if (toolPermission === 'none') return [];
+    return null;
+}
+
+const AGENT_STRING_PERMISSION_READ_WRITE_ALLOW = Object.freeze([
+    'code_graph',
+    'find',
+    'glob',
+    'list',
+    'grep',
+    'read',
+    'apply_patch',
+    'explore',
+    'search',
+    'web_fetch',
+    'Skill',
+]);
+
+export function applyToolPermissionNarrowing(tools, toolPermission, warnRole = null) {
+    if (toolPermission === 'none') return [];
+    const allowList = stringToolPermissionAllowList(toolPermission);
+    if (allowList) {
+        const allowSet = new Set(allowList.map((n) => String(n).toLowerCase()));
+        return tools.filter((t) => allowSet.has(String(t?.name || '').toLowerCase()));
+    }
+    if (toolPermission && typeof toolPermission === 'object') {
+        const allowSet = Array.isArray(toolPermission.allow) && toolPermission.allow.length > 0
+            ? new Set(toolPermission.allow.map(n => String(n).toLowerCase()))
+            : null;
+        const denySet = Array.isArray(toolPermission.deny) && toolPermission.deny.length > 0
+            ? new Set(toolPermission.deny.map(n => String(n).toLowerCase()))
+            : null;
+        if (allowSet || denySet) {
+            const filtered = tools.filter(t => {
+                const name = String(t?.name || '').toLowerCase();
+                if (denySet && denySet.has(name)) return false;
+                if (allowSet && !allowSet.has(name)) return false;
+                return true;
+            });
+            if (filtered.length === 0) {
+                process.stderr.write(`[session] WARN: role permission intersection produced 0 tools — failing closed (role=${warnRole || 'unknown'})\n`);
+            }
+            return filtered;
+        }
+    }
+    return tools;
+}
+
+function recursiveWrapperToolNameForPublicAgent(agent) {
+    if (!agent) return null;
+    const key = String(agent).trim();
+    if (key === 'explore') return 'explore';
+    for (const hiddenName of listHiddenAgentNames()) {
+        const def = getHiddenAgent(hiddenName);
+        const invokedBy = typeof def?.invokedBy === 'string' ? def.invokedBy.trim() : '';
+        if (hiddenName === key && invokedBy) return invokedBy;
+        if (invokedBy && invokedBy === key) return invokedBy;
+    }
+    return null;
+}
+
+export function finalizeSessionToolList(tools, {
+    schemaAllowedTools = null,
+    disallowedTools = null,
+    ownerIsAgent = false,
+    resolvedAgent = null,
+} = {}) {
+    let out = Array.isArray(tools) ? tools : [];
+    const hasCallerAllow = Array.isArray(schemaAllowedTools);
+    if (hasCallerAllow) {
+        const allowSet = new Set(schemaAllowedTools.map(n => String(n).toLowerCase()));
+        out = out.filter(t => allowSet.has(String(t?.name || '').toLowerCase()));
+    }
+    const callerDeny = Array.isArray(disallowedTools) ? disallowedTools.map(n => String(n)) : [];
+    if (callerDeny.length) {
+        const denySet = new Set(callerDeny.map(n => n.toLowerCase()));
+        out = out.filter(t => !denySet.has(String(t?.name || '').toLowerCase()));
+    }
+    const recursiveDeny = ownerIsAgent ? recursiveWrapperToolNameForPublicAgent(resolvedAgent) : null;
+    if (recursiveDeny) {
+        const deny = recursiveDeny.toLowerCase();
+        out = out.filter(t => String(t?.name || '').toLowerCase() !== deny);
+    }
+    if (ownerIsAgent) {
+        out = out.filter(t => !t?.annotations?.agentHidden);
+        out = orderSessionTools(out);
+    }
+    return out;
+}
+
+function orderSessionTools(tools) {
+    return tools.map((tool, index) => ({ tool, index }))
+        .sort((a, b) => {
+            const ar = SESSION_ROUTE_TOOL_RANK.get(a.tool?.name) ?? 10_000;
+            const br = SESSION_ROUTE_TOOL_RANK.get(b.tool?.name) ?? 10_000;
+            if (ar !== br) return ar - br;
+            return a.index - b.index;
+        })
+        .map((entry) => entry.tool);
+}
+
+const ALL_BUILTIN_SESSION_TOOLS = orderSessionTools(_dedupByName([
+    ...BUILTIN_TOOLS,
+    ...PATCH_TOOL_DEFS,
+    ...CODE_GRAPH_TOOL_DEFS,
+]));
+
+export function resolveSessionTools(toolSpec, skills, { ownerIsAgentSession = false } = {}) {
+    const mcp = _getMcpTools();
+    // Agent sessions freeze the skill meta-tool into the schema
+    // unconditionally — concrete skill resolution is cwd-scoped at tool-call
+    // time (loop.mjs), so the schema bytes stay bit-identical across roles /
+    // cwds and the provider cache shard does not fragment.
+    const skillTools = buildSkillToolDefs(skills, { ownerIsAgentSession });
+    return _computeBaseTools(toolSpec, mcp, skillTools);
+}
+
+export function previewSessionTools(toolSpec, skills = [], options = {}) {
+    return resolveSessionTools(toolSpec, skills, options);
+}
+
+// Dedup by name, first occurrence wins. BUILTIN_TOOLS is passed in ahead
+// of the MCP-registered internal tools so plugin-side definitions take
+// precedence when both surfaces declare the same name (e.g. read / grep / glob).
+// Without this merge, Anthropic rejected the request with
+// "tools: Tool names must be unique" and the orchestrator burned up to
+// 20 iterations retrying before the final answer landed.
+function _dedupByName(tools) {
+    const seen = new Map();
+    for (const t of tools) {
+        const n = t?.name;
+        if (!n || seen.has(n)) continue;
+        seen.set(n, t);
+    }
+    return [...seen.values()];
+}
+
+// Agent visibility is declared per-tool via annotations.agentHidden.
+// Tools with agentHidden:true are stripped from agent sessions at schema
+// build time (see deny filtering below). No code-level name list needed.
+
+function _computeBaseTools(toolSpec, mcp, skillTools) {
+    if (Array.isArray(toolSpec)) {
+        if (toolSpec.length === 0) {
+            // Explicit "no tools" — skill meta tools still travel so the model
+            // can at least discover and invoke skills if that is the one
+            // dynamic surface the profile retains.
+            return _dedupByName([...skillTools]);
+        }
+        if (toolSpec.includes('full')) {
+            return _dedupByName([...ALL_BUILTIN_SESSION_TOOLS, ...mcp, ...skillTools]);
+        }
+        const byName = new Map();
+        const add = (tool) => { if (tool?.name && !byName.has(tool.name)) byName.set(tool.name, tool); };
+        const addMany = (arr) => { for (const t of arr) add(t); };
+        for (const tagRaw of toolSpec) {
+            const tag = String(tagRaw || '').trim();
+            switch (tag) {
+                case 'tools:filesystem':
+                    addMany(ALL_BUILTIN_SESSION_TOOLS.filter(t => FILESYSTEM_TOOL_NAMES.has(t.name)));
+                    break;
+                case 'tools:readonly':
+                    addMany(ALL_BUILTIN_SESSION_TOOLS.filter(t => READONLY_TOOL_NAMES.has(t.name)));
+                    break;
+                case 'tools:shell':
+                case 'tools:git':
+                case 'tools:analysis':
+                    // Shell-class toolset. `tools:git` / `tools:analysis` exist so
+                    // profile authors can name the intent (git workflows / data
+                    // analysis) without inventing new toolset ids.
+                    addMany(ALL_BUILTIN_SESSION_TOOLS.filter(t => t.name === 'shell' || t.name === 'task'));
+                    break;
+                case 'tools:mcp':
+                    addMany(mcp);
+                    break;
+                case 'tools:search':
+                    // Name-pattern match: picks up `search` and any future tool
+                    // whose name contains `search`. `recall` and `explore` deliberately do NOT match
+                    // — they need `tools:mcp` (full mcp surface) or their own
+                    // toolset id if a role wants targeted retrieval. Public agent
+                    // roles never reach the wrapper bodies regardless: see the
+                    // isBlockedPublicWrapperCall guard in session/loop.mjs.
+                    addMany(mcp.filter(t => /search/i.test(t?.name || '')));
+                    break;
+                default:
+                    process.stderr.write(`[session] unknown toolset id "${tag}" (profile.tools); skipping\n`);
+            }
+        }
+        return _dedupByName([...byName.values(), ...skillTools]);
+    }
+
+    switch (toolSpec) {
+        case 'mcp':
+            return _dedupByName([...mcp, ...skillTools]);
+        case 'readonly': {
+            const readTools = ALL_BUILTIN_SESSION_TOOLS.filter(t => READONLY_TOOL_NAMES.has(t.name));
+            return _dedupByName([...readTools, ...mcp, ...skillTools]);
+        }
+        case 'full':
+        default:
+            return _dedupByName([...ALL_BUILTIN_SESSION_TOOLS, ...mcp, ...skillTools]);
+    }
+}
+
+export function permissionFromToolSpec(toolSpec) {
+    if (toolSpec === 'readonly') return 'read';
+    if (toolSpec === 'mcp') return 'mcp';
+    if (Array.isArray(toolSpec)) {
+        const tags = new Set(toolSpec.map(t => String(t || '').trim()));
+        const hasWriteOrShell = tags.has('full')
+            || tags.has('tools:filesystem')
+            || tags.has('tools:shell')
+            || tags.has('tools:git')
+            || tags.has('tools:analysis');
+        if (tags.has('tools:readonly') && !hasWriteOrShell) return 'read';
+    }
+    return null;
+}