mixdog 0.9.10 → 0.9.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/agent-tag-reuse-smoke.mjs

@@ -5,6 +5,7 @@
 //   1) live + idle  -> spawn reuses the existing session (reused:true, send path)
 //   2) live + busy  -> spawn queues the prompt instead of throwing
 //   3) lingering terminal trace (no live session) -> spawn/send error, no respawn
+//   3) lingering terminal trace -> spawn reaps tag; dead-tag send auto-respawns
 //   4) genuinely new tag -> a fresh spawn (no reused/respawned flag)
 //
 // No network: a fake askSession drives status transitions. Uses the REAL
@@ -150,19 +151,22 @@ async function main() {
   holdBusy = false;
   await waitJob(busyStart, /ack: stay busy please/, 'busy worker finish');
 
-  // --- tier 3: terminal trace only -> coldRespawn keeps the tag ---
-  // --- tier 3: lingering trace without live session must not cold-respawn ---
+  // --- tier 3: terminal trace -> reap and reuse tag (spawn) or auto-respawn (send) ---
   closeSession(sid, 'smoke-session-closed-trace');
   const traceSpawnOut = await agent.execute({
-    type: 'spawn', agent: 'reviewer', tag: 'reviewerA', prompt: 'must not respawn', cwd: root,
+    type: 'spawn', agent: 'reviewer', tag: 'reviewerA', prompt: 'trace reap respawn', cwd: root,
   }, ctx);
-  assert(/^Error:/.test(traceSpawnOut), `terminal-trace spawn must error, got: ${traceSpawnOut}`);
-  assert(/finished or closed worker/i.test(traceSpawnOut), `spawn error should mention trace: ${traceSpawnOut}`);
+  assert(!/^Error:/.test(traceSpawnOut), `terminal-trace spawn must reap and reuse tag: ${traceSpawnOut}`);
+  await waitJob(traceSpawnOut, /ack: trace reap respawn/, 'trace reap spawn');
+  const traceLive = await waitSessionForTag('reviewerA', 'trace reap spawn live');
+  closeSession(traceLive.id, 'smoke-kill-for-send-respawn');
   const traceSendOut = await agent.execute({
-    type: 'send', tag: 'reviewerA', message: 'must not cold-respawn', cwd: root,
+    type: 'send', tag: 'reviewerA', message: 'auto-respawn follow-up', cwd: root,
   }, ctx);
-  assert(/^Error:/.test(traceSendOut), `terminal-trace send must error, got: ${traceSendOut}`);
-  assert(/not found|closed/i.test(traceSendOut), `send should surface prepareSend failure: ${traceSendOut}`);
+  assert(!/^Error:/.test(traceSendOut), `dead-tag send must auto-respawn: ${traceSendOut}`);
+  assert(/respawned: true/.test(traceSendOut), `send auto-respawn must flag respawned: ${traceSendOut}`);
+  assert(!/reused: true/.test(traceSendOut), `dead-tag send must not be a live reuse: ${traceSendOut}`);
+  await waitJob(traceSendOut, /ack: auto-respawn follow-up/, 'trace send respawn');
 
   // agent close clears the trace; same tag can spawn fresh again
   await agent.execute({ type: 'close', tag: 'reviewerA' }, ctx);

package/scripts/bench/cache-probe-tasks.json

@@ -0,0 +1,8 @@
+[
+  {
+    "id": "cache-probe-multiturn",
+    "agent": "worker",
+    "cwd": "C:/Project/mixdog",
+    "prompt": "Investigation only, no edits. Step by step, one file per turn: 1) read README.md 2) read package.json 3) read scripts/smoke.mjs first 40 lines 4) read src/cli.mjs first 40 lines 5) read scripts/build-tui.mjs first 40 lines 6) read scripts/boot-smoke.mjs first 40 lines. After each read, state one sentence about the file. Finally give a 3-line synthesis. Use exactly one read tool call per step, sequentially."
+  }
+]

package/scripts/tool-smoke.mjs

@@ -345,6 +345,23 @@ const grepOut = await executeBuiltinTool('grep', {
 }, root);
 assertOk('grep', grepOut, /smoke\.mjs/);
 
+const grepBracketPathOut = await executeBuiltinTool('grep', {
+  pattern: 'tool-smoke',
+  path: '[]',
+  glob: '*.mjs',
+  head_limit: 5,
+}, root);
+assertOk('grep path [] coerces to cwd', grepBracketPathOut, /tool-smoke\.mjs/);
+
+const grepRedirectOut = await executeBuiltinTool('grep', {
+  pattern: 'assertOk',
+  path: 'bogus/wrong/prefix/scripts/tool-smoke.mjs',
+  head_limit: 3,
+}, root);
+if (!/^\[redirected from/.test(grepRedirectOut) || !/assertOk/.test(grepRedirectOut)) {
+  throw new Error(`grep ENOENT should auto-redirect on unique suffix hit:\n${grepRedirectOut.slice(0, 800)}`);
+}
+
 const redundantAllFilesGlobGrepOut = await executeBuiltinTool('grep', {
   pattern: 'standalone mixdog CLI/TUI coding agent',
   glob: '**/*',
@@ -367,6 +384,98 @@ const explicitSrcGlobOut = await executeBuiltinTool('glob', {
 }, root);
 assertOk('glob explicit src', explicitSrcGlobOut, /src[\\/].*engine\.mjs/i);
 
+const globPathOnlyOut = await executeBuiltinTool('glob', {
+  path: 'scripts',
+  head_limit: 8,
+}, root);
+assertOk('glob path-only default *', globPathOnlyOut, /tool-smoke\.mjs/i);
+
+const grepNoPatternGlobOut = await executeBuiltinTool('grep', {
+  path: 'scripts',
+  glob: 'tool-smoke.mjs',
+  head_limit: 5,
+}, root);
+assertOk('grep without pattern routes to glob', grepNoPatternGlobOut, /tool-smoke\.mjs/i);
+
+const grepManyPatterns = [
+  ...Array.from({ length: 20 }, (_, i) => `__tool_smoke_miss_${i}__`),
+  'tool-smoke',
+];
+const grepManyPatternsOut = await executeBuiltinTool('grep', {
+  pattern: grepManyPatterns,
+  path: 'scripts',
+  glob: '*.mjs',
+  head_limit: 5,
+}, root);
+if (/exceeds the 20-pattern cap/i.test(String(grepManyPatternsOut))) {
+  throw new Error(`grep should chunk >20 patterns instead of error:\n${grepManyPatternsOut.slice(0, 400)}`);
+}
+assertOk('grep >20 pattern chunk merge', grepManyPatternsOut, /tool-smoke\.mjs/i);
+if (!/\[pattern set split into 2 chunks\]/.test(String(grepManyPatternsOut))) {
+  throw new Error(`grep >20 patterns should emit chunk advisory:\n${grepManyPatternsOut.slice(0, 400)}`);
+}
+
+function grepCountTotalMatches(body) {
+  const m = String(body).match(/\[total (\d+) match/i);
+  return m ? Number(m[1]) : null;
+}
+
+const grepCountSingleOut = await executeBuiltinTool('grep', {
+  pattern: 'assertOk',
+  path: 'scripts/tool-smoke.mjs',
+  output_mode: 'count',
+}, root);
+const singleCountTotal = grepCountTotalMatches(grepCountSingleOut);
+if (singleCountTotal == null || singleCountTotal < 1) {
+  throw new Error(`grep count baseline failed:\n${grepCountSingleOut.slice(0, 400)}`);
+}
+
+const grepCountOverlapPatterns = [
+  ...Array.from({ length: 19 }, (_, i) => `__count_overlap_a_${i}__`),
+  'assertOk',
+  ...Array.from({ length: 19 }, (_, i) => `__count_overlap_b_${i}__`),
+  'assertOk',
+];
+const grepCountOverlapOut = await executeBuiltinTool('grep', {
+  pattern: grepCountOverlapPatterns,
+  path: 'scripts/tool-smoke.mjs',
+  output_mode: 'count',
+}, root);
+const overlapCountTotal = grepCountTotalMatches(grepCountOverlapOut);
+if (overlapCountTotal !== singleCountTotal) {
+  throw new Error(
+    `chunked count must not double-count overlapping lines (single=${singleCountTotal} overlap=${overlapCountTotal}):\n${grepCountOverlapOut.slice(0, 600)}`,
+  );
+}
+
+const grepChunkContextPatterns = [
+  ...Array.from({ length: 20 }, (_, i) => `__ctx_chunk_miss_${i}__`),
+  'grepCountTotalMatches',
+];
+const grepChunkContextOut = await executeBuiltinTool('grep', {
+  pattern: grepChunkContextPatterns,
+  path: 'scripts/tool-smoke.mjs',
+  '-C': 1,
+  head_limit: 30,
+}, root);
+if (!/\[pattern set split into 2 chunks\]/.test(String(grepChunkContextOut))) {
+  throw new Error(`chunked -C grep should split patterns:\n${grepChunkContextOut.slice(0, 500)}`);
+}
+if (!/tool-smoke\.mjs:\d+:/.test(String(grepChunkContextOut))) {
+  throw new Error(`chunked -C must emit path-prefixed match lines:\n${grepChunkContextOut.slice(0, 800)}`);
+}
+if (!/tool-smoke\.mjs-\d+-/.test(String(grepChunkContextOut))) {
+  throw new Error(`chunked -C must keep path-prefixed context lines:\n${grepChunkContextOut.slice(0, 800)}`);
+}
+const ctxBodyLines = String(grepChunkContextOut).split('\n').filter((l) => l && !/^\[/.test(l) && !/^\(no matches\)/.test(l));
+const orphanLineOnlyContext = ctxBodyLines.some((l) => /^\d+-/.test(l));
+if (orphanLineOnlyContext) {
+  throw new Error(`chunked -C must not leave line-only context orphans:\n${grepChunkContextOut.slice(0, 800)}`);
+}
+if (!/function grepCountTotalMatches/.test(String(grepChunkContextOut))) {
+  throw new Error(`chunked -C should include match span:\n${grepChunkContextOut.slice(0, 800)}`);
+}
+
 const findOut = await executeBuiltinTool('find', {
   query: 'tool smoke',
   path: '.',

package/src/defaults/mixdog-config.template.json

@@ -1,5 +1,6 @@
 {
   "outputStyle": "default",
+  "mcpServers": {},
   "channels": {
     "promptInjection": {
       "mode": "hook",

package/src/mixdog-session-runtime.mjs

@@ -216,6 +216,7 @@ import {
   TOOL_SEARCH_TOOL,
   CWD_TOOL,
   SKILL_TOOL,
+  SESSION_MANAGE_TOOL,
   LEAD_DISALLOWED_TOOLS,
   applyStandaloneToolDefaults,
 } from './session-runtime/tool-defs.mjs';
@@ -480,6 +481,9 @@ export async function createMixdogSessionRuntime({
   let sessionCreatePromise = null;
   let currentCwd = cwd;
   let sessionNeedsCwdRefresh = false;
+  // session_manage tool: reset request scheduled by the model mid-turn,
+  // consumed by the TUI engine at turn end ('clear' | 'compact_clear').
+  let pendingSessionReset = null;
   let closeRequested = false;
   const warmupTimers = {
     providerSetupWarmupTimer: null,
@@ -818,6 +822,10 @@ export async function createMixdogSessionRuntime({
   }
 
   function skillToolContent(name) {
+    if (typeof contextMod.isSkillDisabled === 'function' && contextMod.isSkillDisabled(name)) {
+      const label = String(name || '').trim() || 'skill';
+      return `Error: skill "${label}" is disabled`;
+    }
     const skill = skillContent(name);
     // Return the general tool envelope so the main/Lead session behaves the
     // same as agent-loop sessions: the model-visible tool_result is the short
@@ -918,6 +926,7 @@ export async function createMixdogSessionRuntime({
     TOOL_SEARCH_TOOL,
     SKILL_TOOL,
     CWD_TOOL,
+    SESSION_MANAGE_TOOL,
     EXPLORE_TOOL,
     ...(searchToolDefs?.TOOL_DEFS || []).filter((tool) => tool?.name === 'search' || tool?.name === 'web_fetch'),
     ...(memoryToolDefs?.TOOL_DEFS || []).filter((tool) => tool?.name === 'recall' || tool?.name === 'memory'),
@@ -1014,6 +1023,29 @@ export async function createMixdogSessionRuntime({
         }
         return JSON.stringify({ cwd: currentCwd, sessionId: session?.id || null }, null, 2);
       }
+      if (name === 'session_manage') {
+        // Lead/owner sessions only: an agent worker resetting its own
+        // transcript mid-task would corrupt the delegation contract, and it
+        // must never reach the owner conversation either.
+        const callerSessionId = callerCtx?.callerSessionId || null;
+        if (callerSessionId && session?.id && callerSessionId !== session.id) {
+          throw new Error('session_manage: only the lead session may reset the conversation');
+        }
+        if (!session?.id) throw new Error('session_manage: no active session');
+        const action = clean(args?.action).toLowerCase();
+        if (action !== 'clear' && action !== 'compact_clear') {
+          throw new Error(`session_manage: unknown action "${action}" (use clear | compact_clear)`);
+        }
+        // Never clear mid-turn — the loop is still reading the transcript.
+        // Schedule and let the TUI engine consume it at turn end (same
+        // boundary the idle auto-clear uses).
+        // Pin to the current session id so a resume/new-session between
+        // scheduling and consumption can never clear the wrong conversation.
+        pendingSessionReset = { action, sessionId: session.id };
+        return action === 'clear'
+          ? 'Session reset scheduled: full clear will run when this turn ends. All prior context will be gone.'
+          : 'Session reset scheduled: the conversation will be summarized (compact) and cleared when this turn ends; key context carries forward in the summary.';
+      }
       if (name === 'Skill') {
         return skillToolContent(args?.name);
       }
@@ -1596,6 +1628,9 @@ export async function createMixdogSessionRuntime({
   // Channels are opt-in: only boot the worker when this session started in (or
   // was toggled into) remote mode. Non-remote sessions never contend for the
   // channel; see startRemote()/stopRemote() and the `/remote` toggle.
+  // `remote.autoStart` in mixdog-config.json makes every session claim remote
+  // at boot (same force-takeover semantics as `mixdog --remote` / `/remote`).
+  if (!remoteEnabled && config?.remote?.autoStart === true) remoteEnabled = true;
   if (remoteEnabled) startRemote();
 
   function contextStatusCacheKeyFor({ messages, tools }) {
@@ -1657,6 +1692,7 @@ export async function createMixdogSessionRuntime({
     getRoute: () => route,
     getSession: () => session,
     getRemoteEnabled: () => remoteEnabled,
+    adoptConfig,
     saveConfigAndAdopt,
     scheduleBackendSave,
     cfgMod,
@@ -2510,6 +2546,16 @@ export async function createMixdogSessionRuntime({
       invalidateContextStatusCache();
       return true;
     },
+    // session_manage tool handoff: the engine polls this at turn end and, if
+    // set, runs the same clear path the idle auto-clear uses. One-shot read.
+    consumePendingSessionReset() {
+      const pending = pendingSessionReset;
+      pendingSessionReset = null;
+      if (!pending) return null;
+      // Session changed since scheduling (resume / new session) — drop it.
+      if (!session?.id || pending.sessionId !== session.id) return null;
+      return pending.action;
+    },
     async compact(options = {}) {
       if (!session?.id) return null;
       if (activeTurnCount > 0) {

package/src/runtime/agent/orchestrator/config.mjs

@@ -81,6 +81,16 @@ export function normalizeProfileConfig(value = {}) {
     return { title, language };
 }
 
+/** Persisted `skills.disabled` name list (deduped, trimmed, sorted). */
+export function normalizeSkillsConfig(value = {}) {
+    const raw = value && typeof value === 'object' ? value : {};
+    const disabled = Array.isArray(raw.disabled)
+        ? [...new Set(raw.disabled.map((n) => String(n).trim()).filter(Boolean))]
+        : [];
+    disabled.sort((a, b) => a.localeCompare(b));
+    return { disabled };
+}
+
 // Look up the catalog entry for a stored language id (defaults to 'system').
 export function profileLanguageEntry(languageId) {
     const id = String(languageId || 'system');
@@ -435,6 +445,7 @@ export function loadConfig(options = {}) {
                 workflow: raw.workflow && typeof raw.workflow === 'object' ? { active: String(raw.workflow.active || 'default') } : { active: 'default' },
                 agentMaintenance: { enabled: true, interval: '1h', ...raw.agentMaintenance },
                 profile: normalizeProfileConfig(raw.profile),
+                skills: normalizeSkillsConfig(raw.skills),
                 // No idleMs default here: absent idleMs means "provider default"
                 // (config-helpers normalizeAutoClearConfig custom:false path).
                 // Injecting a fixed 1h would mark every config custom:true and
@@ -467,6 +478,7 @@ export function loadConfig(options = {}) {
         workflow: { active: 'default' },
         agentMaintenance: { enabled: true, interval: '1h' },
         profile: normalizeProfileConfig(null),
+        skills: normalizeSkillsConfig(null),
                 autoClear: { enabled: true },
         compaction: {},
         trajectory: { enabled: true },
@@ -493,6 +505,23 @@ export function loadConfig(options = {}) {
  * via persistAgentConfig((current) => ({ ...current, <field> })) so a
  * concurrent instance's edits are not reverted.
  */
+/** In-lock patch of `skills.disabled` only (avoids whole-config lost-update). */
+export function patchSkillsDisabled(disabledNames) {
+    const names = disabledNames instanceof Set
+        ? [...disabledNames]
+        : (Array.isArray(disabledNames) ? disabledNames : []);
+    const nextSkills = normalizeSkillsConfig({ disabled: names });
+    persistAgentConfig((current) => {
+        const cur = { ...current };
+        const target = (cur.agent && cur.agent.providers)
+            ? (cur.agent = { ...cur.agent })
+            : cur;
+        target.skills = nextSkills;
+        return cur;
+    });
+    return nextSkills;
+}
+
 export function saveConfig(config) {
     // Strip ephemeral defaults from providers but preserve any unknown
     // per-provider subkey so future schema additions round-trip through the
@@ -544,6 +573,7 @@ export function saveConfig(config) {
         workflow: config.workflow || { active: 'default' },
         agentMaintenance: config.agentMaintenance || {},
         profile: normalizeProfileConfig(config.profile),
+        skills: normalizeSkillsConfig(config.skills),
         autoClear: config.autoClear || {},
         compaction: config.compaction || {},
         trajectory: config.trajectory || {},

package/src/runtime/agent/orchestrator/context/collect.mjs

@@ -7,6 +7,7 @@ import {
     parseMarkdownFrontmatter,
     readMarkdownDocument,
 } from '../../../shared/markdown-frontmatter.mjs';
+import { loadConfig, normalizeSkillsConfig } from '../config.mjs';
 
 // --- mixdog asset roots (standalone CLI owns its own paths; never .claude) ---
 // Project-local:  <cwd>/.mixdog/<kind>
@@ -123,6 +124,37 @@ export function collectSkills(cwd) {
     }
     return skills;
 }
+
+function normalizeSkillNameKey(name) {
+    return String(name || '').trim().toLowerCase();
+}
+
+export function getDisabledSkillNameSet(config = null) {
+    const cfg = config || loadConfig({ secrets: false });
+    const keys = normalizeSkillsConfig(cfg.skills).disabled
+        .map((n) => normalizeSkillNameKey(n))
+        .filter(Boolean);
+    return new Set(keys);
+}
+
+export function isSkillDisabled(name, config = null) {
+    const n = normalizeSkillNameKey(name);
+    if (!n) return false;
+    return getDisabledSkillNameSet(config).has(n);
+}
+
+export function filterSkillsExcludingDisabled(skills, config = null) {
+    const disabled = getDisabledSkillNameSet(config);
+    if (!disabled.size) return Array.isArray(skills) ? skills : [];
+    return (Array.isArray(skills) ? skills : []).filter((s) => {
+        const key = normalizeSkillNameKey(s?.name);
+        return key && !disabled.has(key);
+    });
+}
+
+export function collectPromptSkillsCached(cwd, config = null) {
+    return filterSkillsExcludingDisabled(collectSkillsCached(cwd), config);
+}
 // --- Skill cache (mtime-based, keyed by cwd) ---
 const _skillsCache = new Map();
 const _mtimeCache = new Map();
@@ -267,6 +299,130 @@ export function buildSkillManifest(skills, { limit = 80 } = {}) {
     return lines.join('\n');
 }
 
+const DEFERRED_TOOLS_BLOCK_RE = /(\n\n---\n*)?<available-deferred-tools>[\s\S]*?<\/available-deferred-tools>\s*/gi;
+const MCP_INSTRUCTIONS_BLOCK_RE = /(\n\n---\n*)?<mcp-instructions>[\s\S]*?<\/mcp-instructions>\s*/gi;
+const DEFERRED_TOOL_NAME_SAFE_RE = /^[A-Za-z0-9_.:-]+$/;
+const MCP_SERVER_NAME_SAFE_RE = /^[A-Za-z0-9_.:-]+$/;
+const MCP_INSTRUCTION_MAX_CHARS = 600;
+
+function sanitizeDeferredToolManifestName(name) {
+    const text = String(name || '').trim();
+    if (!text || text.includes('<') || text.includes('>')) return '';
+    if (!DEFERRED_TOOL_NAME_SAFE_RE.test(text)) return '';
+    return text;
+}
+
+export function bp1HasDeferredToolManifestBlock(text) {
+    const raw = String(text || '');
+    return /<available-deferred-tools>[\s\S]*?<\/available-deferred-tools>/i.test(raw)
+        || /<mcp-instructions>[\s\S]*?<\/mcp-instructions>/i.test(raw);
+}
+
+/**
+ * Names-only manifest for tools in the deferred pool (catalog minus active wire tools).
+ * Empty pool → '' (caller omits the block).
+ */
+export function buildDeferredToolManifest(names) {
+    const list = [...new Set((Array.isArray(names) ? names : [])
+        .map((name) => sanitizeDeferredToolManifestName(name))
+        .filter(Boolean))]
+        .sort((a, b) => a.localeCompare(b));
+    if (!list.length) return '';
+    return ['<available-deferred-tools>', ...list, '</available-deferred-tools>'].join('\n');
+}
+
+function sanitizeMcpManifestServerName(name) {
+    const text = String(name || '').trim();
+    if (!text || text.includes('<') || text.includes('>')) return '';
+    if (!MCP_SERVER_NAME_SAFE_RE.test(text)) return '';
+    return text;
+}
+
+function sanitizeMcpInstructionText(text, max = MCP_INSTRUCTION_MAX_CHARS) {
+    const stripped = String(text || '').replace(/[<>]/g, '').trim();
+    if (!stripped) return '';
+    const cap = Math.max(1, Number(max) || MCP_INSTRUCTION_MAX_CHARS);
+    return stripped.length > cap ? `${stripped.slice(0, Math.max(1, cap - 3))}...` : stripped;
+}
+
+/**
+ * Per-server MCP initialize instructions for deferred-pool tools only.
+ * Empty when no instructions or no matching deferred MCP tools → omit block.
+ */
+export function buildMcpInstructionsManifest(mcpServerInstructions, poolNames) {
+    const map = mcpServerInstructions && typeof mcpServerInstructions === 'object'
+        ? mcpServerInstructions
+        : {};
+    const pool = [...new Set((Array.isArray(poolNames) ? poolNames : [])
+        .map((name) => sanitizeDeferredToolManifestName(name))
+        .filter(Boolean))];
+    const toolsByServer = new Map();
+    for (const name of pool) {
+        const match = name.match(/^mcp__(.+?)__(.+)$/);
+        if (!match) continue;
+        const server = match[1];
+        if (!toolsByServer.has(server)) toolsByServer.set(server, []);
+        toolsByServer.get(server).push(name);
+    }
+    const servers = [...toolsByServer.keys()]
+        .filter((server) => sanitizeMcpManifestServerName(server)
+            && sanitizeMcpInstructionText(map[server])
+            && toolsByServer.get(server).length)
+        .sort((a, b) => a.localeCompare(b));
+    if (!servers.length) return '';
+    const lines = ['<mcp-instructions>'];
+    for (const server of servers) {
+        const safeServer = sanitizeMcpManifestServerName(server);
+        const body = sanitizeMcpInstructionText(map[server]);
+        const tools = [...toolsByServer.get(server)].sort((a, b) => a.localeCompare(b));
+        lines.push(`## ${safeServer}`, body, ...tools.map((tool) => `- ${tool}`));
+    }
+    lines.push('</mcp-instructions>');
+    return lines.join('\n');
+}
+
+export function stripDeferredToolManifestBlock(text) {
+    return String(text || '')
+        .replace(DEFERRED_TOOLS_BLOCK_RE, '')
+        .replace(MCP_INSTRUCTIONS_BLOCK_RE, '')
+        .replace(/\n\n---\n*$/,'')
+        .trimEnd();
+}
+
+/** Inject names-only deferred pool into BP1 once at session start; never rewrite BP1 after. */
+export function applyInitialDeferredToolManifestToBp1(session, poolNames) {
+    if (!session || !Array.isArray(session.messages) || session.deferredToolBp1Applied) return false;
+    const pool = Array.isArray(poolNames) ? poolNames : [];
+    const parts = [];
+    const deferredManifest = buildDeferredToolManifest(pool);
+    if (deferredManifest) parts.push(deferredManifest);
+    const mcpManifest = buildMcpInstructionsManifest(session.mcpServerInstructions, pool);
+    if (mcpManifest) parts.push(mcpManifest);
+    const manifest = parts.join('\n\n');
+    let idx = -1;
+    for (let i = 0; i < session.messages.length; i++) {
+        if (session.messages[i]?.role === 'system') {
+            idx = i;
+            break;
+        }
+    }
+    if (idx === -1) return false;
+    const raw = typeof session.messages[idx].content === 'string' ? session.messages[idx].content : '';
+    if (bp1HasDeferredToolManifestBlock(raw)) {
+        session.deferredToolBp1Applied = true;
+        return true;
+    }
+    if (manifest) {
+        const base = stripDeferredToolManifestBlock(raw);
+        session.messages[idx].content = base
+            ? `${base}\n\n---\n\n${manifest}`
+            : manifest;
+    }
+    session.deferredToolBp1Applied = true;
+    session.updatedAt = Date.now();
+    return true;
+}
+
 /**
  * Build the fixed skill loader meta-tool.
  * A tiny stable schema keeps provider cache keys steady; concrete skill
@@ -558,6 +714,10 @@ export function composeSystemPrompt(opts) {
     if (!_skip.skills && opts.skillManifest && typeof opts.skillManifest === 'string' && opts.skillManifest.trim()) {
         baseParts.push(opts.skillManifest.trim());
     }
+    // deferredToolManifest: optional BP1 slice; production path is applyInitialDeferredToolManifestToBp1 once after applyDeferredToolSurface.
+    if (opts.deferredToolManifest && typeof opts.deferredToolManifest === 'string' && opts.deferredToolManifest.trim()) {
+        baseParts.push(opts.deferredToolManifest.trim());
+    }
     const baseRules = baseParts.join('\n\n---\n\n');
 
     // ── BP2: role/system layer ─────────────────────────────────────────

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -147,6 +147,16 @@ export function getMcpServerStatus() {
         })(),
     }));
 }
+
+/** Snapshot of MCP initialize `instructions` per connected server (handshake time). */
+export function getMcpServerInstructionsMap() {
+    const out = {};
+    for (const server of servers.values()) {
+        const text = typeof server.instructions === 'string' ? server.instructions.trim() : '';
+        if (text) out[server.name] = text;
+    }
+    return out;
+}
 /**
  * Execute an MCP tool call.
  * Name format: `mcp__{serverName}__{toolName}`
@@ -290,6 +300,16 @@ function capMcpOutput(content) {
 export function isMcpTool(name) {
     return name.startsWith('mcp__');
 }
+/** True when the prefixed name exists on a connected MCP server. */
+export function isRegisteredMcpTool(name) {
+    if (!isMcpTool(name)) return false;
+    const match = name.match(/^mcp__(.+?)__(.+)$/);
+    if (!match) return false;
+    const [, serverName] = match;
+    const server = servers.get(serverName);
+    if (!server || !Array.isArray(server.tools)) return false;
+    return server.tools.some((t) => t?.name === name);
+}
 /**
  * Check whether the inputSchema for an MCP tool declares the given top-level
  * property. Used to decide if the orchestrator should auto-inject context
@@ -416,6 +436,10 @@ async function connectServer(name, cfg) {
         throw new Error(`Invalid config for "${name}": need autoDetect, type (stdio/http/sse/ws), url (http), or command (stdio)`);
     }
     await client.connect(transport);
+    const instructionsRaw = typeof client.getInstructions === 'function'
+        ? client.getInstructions()
+        : undefined;
+    const instructions = typeof instructionsRaw === 'string' ? instructionsRaw.trim() : '';
     const toolsResult = await client.listTools();
     if (!toolsResult || !Array.isArray(toolsResult.tools)) {
         throw new Error(`[mcp-client] ListTools returned invalid shape for "${name}": missing or non-array tools field`);
@@ -427,7 +451,7 @@ async function connectServer(name, cfg) {
         ...(t.annotations && typeof t.annotations === 'object' ? { annotations: t.annotations } : {}),
     }));
     const toolNames = tools.map(t => t.name);
-    servers.set(name, { name, client, transport, tools, cfg });
+    servers.set(name, { name, client, transport, tools, cfg, instructions });
     _invalidateMcpToolFieldMemo();
     mcpLog(`[mcp] connected: ${tools.length} tools — ${toolNames.join(', ')}\n`);
 }

package/src/runtime/agent/orchestrator/providers/gemini-stream.mjs

@@ -425,6 +425,7 @@ export async function consumeGeminiSdkStream(streamResult, { signal, onStreamDel
     try {
         armFirstByteTimer();
         resetIdleTimer();
+        var collectedChunks = [];
         while (true) {
             if (idleTimedOut) {
                 throw geminiTimeoutError(`${label} SSE idle`, PROVIDER_SSE_IDLE_TIMEOUT_MS);
@@ -463,6 +464,7 @@ export async function consumeGeminiSdkStream(streamResult, { signal, onStreamDel
                 clearFirstByteTimer();
             }
             resetIdleTimer();
+            if (step.value) collectedChunks.push(step.value);
             try { onStreamDelta?.(); } catch {}
             if (onTextDelta || textLeakGuard) {
                 const t = geminiChunkText(step.value);
@@ -488,17 +490,30 @@ export async function consumeGeminiSdkStream(streamResult, { signal, onStreamDel
         try { textLeakGuard?.finalize(); } catch {}
     }
 
-    let response;
-    try {
-        response = await streamResult.response;
-    } catch (err) {
-        if (signal?.aborted) {
-            const reason = signal.reason;
-            throw reason instanceof Error ? reason : new Error(`${label} aborted`);
+    // Aggregate the raw wire chunks locally instead of awaiting the SDK's
+    // streamResult.response: @google/generative-ai 0.24.1 aggregateResponses()
+    // predates Gemini 3 thinking and silently drops part.thoughtSignature.
+    // Losing the signature breaks the mandatory echo-back on the next turn
+    // (400 "Function call is missing a thought_signature in functionCall
+    // parts"). aggregateGeminiStreamChunks() preserves it (see part copy
+    // above). Fall back to the SDK aggregate only if we somehow collected no
+    // usable chunks.
+    let raw;
+    if (collectedChunks.length > 0) {
+        raw = aggregateGeminiStreamChunks(collectedChunks);
+    } else {
+        let response;
+        try {
+            response = await streamResult.response;
+        } catch (err) {
+            if (signal?.aborted) {
+                const reason = signal.reason;
+                throw reason instanceof Error ? reason : new Error(`${label} aborted`);
+            }
+            throw err;
         }
-        throw err;
+        raw = response?.candidates ? response : (response?.response || response);
     }
-    const raw = response?.candidates ? response : (response?.response || response);
     const finishReason = raw?.candidates?.[0]?.finishReason || null;
     assertGeminiStreamCompleted({ sawStreamChunk, finishReason, label });
     return raw;