mixdog 0.9.10 → 0.9.12

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -12,10 +12,20 @@ import { withAdvisoryLocks } from '../builtin/advisory-lock.mjs';
 import { wrapMutationRouteOutput } from '../mutation-planner.mjs';
 import { getPluginData } from '../../config.mjs';
 import { prepareInput, isV4APatchInput, hasUnifiedBareV4AHunk, canFallbackCountedUnified, parseV4APatch, isCompactedPlaceholderPatch } from './parsing.mjs';
-import { resolveBasePath, resolveV4AEntryPath, mergeDuplicateParsedModifyEntries, renderParsedUnifiedPatch, rewriteHeaderPaths, preValidateNativeBatch } from './paths.mjs';
+import {
+  resolveBasePath,
+  resolveV4AEntryPath,
+  parsedEntryResolvedPath,
+  isResolvedPathOutsideBase,
+  assertNoDuplicateParsedModifyTargets,
+  mergeDuplicateParsedModifyEntries,
+  renderParsedUnifiedPatch,
+  rewriteHeaderPaths,
+  preValidateNativeBatch,
+} from './paths.mjs';
 import { ensureNativePatchBinaryAvailable } from './native-server.mjs';
 import { assertPathReachable } from '../builtin/fs-reachability.mjs';
-import { dispatchNativePatch } from './dispatch.mjs';
+import { dispatchNativePatch, dispatchJsPatchEntries } from './dispatch.mjs';
 import {
   planV4ARenameSections,
   applyV4ARenameSections,
@@ -172,6 +182,11 @@ async function apply_patch(args, cwd, options = {}) {
     return 'Error: patch contained no file sections';
   }
   if (!v4aRenameOnly) {
+    try {
+      assertNoDuplicateParsedModifyTargets(parsed, basePath);
+    } catch (err) {
+      return `Error: ${err?.message || String(err)}`;
+    }
     const merged = mergeDuplicateParsedModifyEntries(parsed, basePath);
     if (merged.changed) {
       parsed = merged.parsed;
@@ -216,25 +231,50 @@ async function apply_patch(args, cwd, options = {}) {
       if (lines.length === 0) return 'Error: patch contained no applicable file sections';
       return wrapPatchMutationOutput(`${lines.join('\n')}\n`, mutationPlan, { backend: 'v4a-rename' });
     }
-    const nativePatchStr = rewriteHeaderPaths(normalizedPatchStr, headerRewrites);
-    const nativeResult = await dispatchNativePatch({
-      entries,
-      basePath,
-      nativePatchStr,
-      fuzz,
-      rejectPartial,
-      dryRun,
-      readStateScope,
-      signal: abortSignal,
-      parsed,
-    });
-    let combined = nativeResult;
+    const insideEntries = entries.filter((entry) => !isResolvedPathOutsideBase(entry.fullPath, basePath));
+    const outsideEntries = entries.filter((entry) => isResolvedPathOutsideBase(entry.fullPath, basePath));
+    const parsedInside = (parsed || []).filter(
+      (entry) => !isResolvedPathOutsideBase(parsedEntryResolvedPath(entry, basePath), basePath),
+    );
+    const resultParts = [];
+    if (outsideEntries.length > 0) {
+      const jsResult = await dispatchJsPatchEntries({
+        rows: outsideEntries,
+        parsed,
+        basePath,
+        dryRun,
+        fuzzy,
+        readStateScope,
+      });
+      if (isPatchErrorText(jsResult)) return wrapPatchMutationOutput(jsResult, mutationPlan, { backend: 'js-patch' });
+      resultParts.push(jsResult);
+    }
+    if (insideEntries.length > 0) {
+      const nativePatchStr = rewriteHeaderPaths(renderParsedUnifiedPatch(parsedInside), headerRewrites);
+      const nativeResult = await dispatchNativePatch({
+        entries: insideEntries,
+        basePath,
+        nativePatchStr,
+        fuzz,
+        rejectPartial,
+        dryRun,
+        readStateScope,
+        signal: abortSignal,
+        parsed: parsedInside,
+      });
+      if (isPatchErrorText(nativeResult)) {
+        if (resultParts.length > 0) return wrapPatchMutationOutput(nativeResult, mutationPlan, { backend: 'native-patch' });
+        return wrapPatchMutationOutput(nativeResult, mutationPlan, { backend: 'native-patch' });
+      }
+      resultParts.push(nativeResult);
+    }
+    let combined = resultParts.join('\n');
     const renameLines = formatV4ARenameSuccessLines(v4aRenameResults);
-    if (renameLines.length > 0 && !isPatchErrorText(nativeResult)) {
-      combined = `${renameLines.join('\n')}\n${nativeResult}`;
+    if (renameLines.length > 0 && !isPatchErrorText(combined)) {
+      combined = `${renameLines.join('\n')}\n${combined}`;
     }
     if (!isPatchErrorText(combined) && options?.toolCallId) {
-      registerApplyPatchUiDiff(options.toolCallId, nativePatchStr);
+      registerApplyPatchUiDiff(options.toolCallId, rewriteHeaderPaths(normalizedPatchStr, headerRewrites));
     }
     if (!isPatchErrorText(combined) && rejectedV4AHunks.length > 0) {
       const tail = [

package/src/runtime/agent/orchestrator/tools/patch/paths.mjs

@@ -39,11 +39,17 @@ export function resolveV4AEntryPath(basePath, rawName) {
 }
 
 export function resolveBasePath(cwd, basePath) {
-  if (!basePath) return cwd;
+  if (basePath == null || basePath === '') return cwd;
   const norm = normalizeInputPath(basePath);
   return isAbsolute(norm) ? pathResolve(norm) : resolveAgainstCwd(norm, cwd);
 }
 
+export function isResolvedPathOutsideBase(fullPath, basePath) {
+  const rel = pathRelative(pathResolve(basePath), pathResolve(fullPath)).replace(/\\/g, '/');
+  if (!rel || isAbsolute(rel)) return true;
+  return rel.split(/[\\/]+/).some((part) => part === '..');
+}
+
 // Categorise the per-file entry. A unified diff can describe:
 //   - modify   : both files named, oldFileName exists on disk
 //   - create   : oldFileName === /dev/null (or file doesn't exist + hunks start at 0)
@@ -56,6 +62,13 @@ export function classifyEntry(entry) {
   return 'modify';
 }
 
+
+export function parsedEntryResolvedPath(entry, basePath) {
+  const kind = classifyEntry(entry);
+  const headerName = kind === 'create' ? entry.newFileName : entry.oldFileName;
+  return resolveEntryPath(basePath, headerName);
+}
+
 function parsedEntryTargetKey(entry, basePath) {
   if (classifyEntry(entry) !== 'modify') return '';
   const headerName = entry.oldFileName || entry.newFileName;
@@ -86,6 +99,28 @@ export function mergeDuplicateParsedModifyEntries(parsed, basePath) {
   return { parsed: out, changed };
 }
 
+
+export function assertNoDuplicateParsedModifyTargets(parsed, basePath) {
+  const seenPaths = new Set();
+  for (const entry of parsed || []) {
+    if (classifyEntry(entry) !== 'modify') continue;
+    const key = parsedEntryTargetKey(entry, basePath);
+    if (!key) continue;
+    if (seenPaths.has(key)) {
+      const headerName = entry.oldFileName || entry.newFileName;
+      const display = normalizeOutputPath(stripDiffPrefix(headerName));
+      throw new Error(`apply_patch: duplicate target ${display} — patch lists the same path twice.`);
+    }
+    seenPaths.add(key);
+  }
+}
+
+function headerRelFromBase(basePath, absNorm) {
+  const rel = pathRelative(pathResolve(basePath), pathResolve(absNorm)).replace(/\\/g, '/');
+  if (!rel || isAbsolute(rel)) return null;
+  return rel;
+}
+
 function unifiedRange(start, lines) {
   const s = Math.max(0, Number(start) || 0);
   const n = Math.max(0, Number(lines) || 0);
@@ -120,36 +155,13 @@ export function countHunkChanges(hunks) {
   return { added, removed };
 }
 
-// Header-shape pre-validator (lexical only): a missing header, a
-// `..` segment, or an absolute path that does not resolve inside the
-// basePath returns false. Caller wraps the negative result into a clean
-// throw so unsupported headers surface as a clean error instead of
-// silently degrading to a JS fallback.
-function nativeHeaderSupported(entry, basePath) {
+// Header-shape pre-validator: missing or /dev/null target path only.
+// Lexical `..` and out-of-base absolutes resolve via resolveEntryPath;
+// write permission is enforced at the hook layer, not here.
+function nativeHeaderSupported(entry) {
   const kind = classifyEntry(entry);
   const headerName = kind === 'create' ? entry.newFileName : entry.oldFileName;
-  if (!headerName || DEV_NULL.test(headerName)) return false;
-  // Reject any `..` segment on EITHER oldFileName or newFileName (every
-  // non-/dev/null header) — a modify whose newFileName traverses out of
-  // base must still be refused even when the resolved path lands inside.
-  for (const which of ['oldFileName', 'newFileName']) {
-    const raw = entry[which];
-    if (!raw || DEV_NULL.test(raw)) continue;
-    const segs = normalizeInputPath(stripDiffPrefix(raw)).split(/[\\/]+/);
-    if (segs.some((part) => part === '..')) return false;
-  }
-  const stripped = stripDiffPrefix(headerName);
-  const norm = normalizeInputPath(stripped);
-  if (isAbsolute(norm) || /^[A-Za-z]:[\\/]/.test(norm)) {
-    if (!basePath) return false;
-    const absHeader = pathResolve(norm);
-    const absBase = pathResolve(basePath);
-    const rel = pathRelative(absBase, absHeader);
-    if (!rel || rel.startsWith('..') || isAbsolute(rel)) return false;
-    if (rel.split(/[\\/]+/).some((part) => part === '..')) return false;
-    return true;
-  }
-  return true;
+  return !!(headerName && !DEV_NULL.test(headerName));
 }
 
 // Resolve `absPath` via fs.realpathSync, walking up to the nearest existing
@@ -172,9 +184,7 @@ export function realpathNearestExistingAncestor(absPath) {
 // Pre-validator (throws): walks every parsed entry and enforces
 //   - native engine is enabled
 //   - native binary exists on disk
-//   - each header is shape-supported (no `..`, no out-of-base absolute)
-//   - realpath of each non-/dev/null header stays inside the real basePath
-//     (catches symlink/junction escapes that lexical checks miss)
+//   - each header has a usable target path (shape only)
 //   - no duplicate target paths in the patch (case-insensitive on win32)
 // Returns the list of normalized entry rows the dispatcher uses to format
 // output, plus the header-rewrite map for absolute-path normalization.
@@ -199,61 +209,25 @@ export async function preValidateNativeBatch(parsed, basePath) {
     }
   }
   await assertPathsReachable(reachabilityPaths);
-  let realBase;
-  try {
-    realBase = realpathSync(pathResolve(basePath));
-  } catch (err) {
-    throw new Error(`apply_patch: base_path unreadable (${err?.code || err?.message || String(err)}): ${basePath}`);
-  }
   const entries = [];
   const seenPaths = new Set();
   const headerRewrites = [];
   for (const entry of parsed) {
     const kind = classifyEntry(entry);
     const headerName = kind === 'create' ? entry.newFileName : entry.oldFileName;
-    if (!nativeHeaderSupported(entry, basePath)) {
-      // Two distinct failure modes share nativeHeaderSupported()===false:
-      //   (a) no usable target path could be parsed from the section header
-      //       (oldFileName/newFileName empty or /dev/null) — a SHAPE problem,
-      //   (b) a parsed path that escapes base_path (`..` segment / out-of-base
-      //       absolute) — a SECURITY refusal.
-      // Collapsing both into the "path escapes base_path or contains `..`"
-      // message mislabels (a) as (b): the model sees a nonsensical reason for a
-      // patch that uses no `..`, cannot self-correct, and re-submits the same
-      // patch until the iteration cap. Emit a shape-specific, actionable hint
-      // for (a) so the loop breaks on the first failure.
-      const hasUsableHeader = headerName && !DEV_NULL.test(headerName);
-      if (!hasUsableHeader) {
-        throw new Error(
-          'apply_patch: a file section header could not be parsed (no target path). '
-          + 'Each section must start with a valid header: `*** Update File: <path>` / '
-          + '`*** Add File: <path>` / `*** Delete File: <path>` (V4A), or a '
-          + '`--- a/<path>` + `+++ b/<path>` pair (unified). Wrap multi-hunk V4A '
-          + 'edits in a `*** Begin Patch` / `*** End Patch` envelope and pass format:"v4a".',
-        );
-      }
-      const display = normalizeOutputPath(stripDiffPrefix(headerName));
-      throw new Error(`apply_patch: header ${display} is unsupported (path escapes base_path or contains \`..\`).`);
+    if (!nativeHeaderSupported(entry)) {
+      throw new Error(
+        'apply_patch: a file section header could not be parsed (no target path). '
+        + 'Each section must start with a valid header: `*** Update File: <path>` / '
+        + '`*** Add File: <path>` / `*** Delete File: <path>` (V4A), or a '
+        + '`--- a/<path>` + `+++ b/<path>` pair (unified). Wrap multi-hunk V4A '
+        + 'edits in a `*** Begin Patch` / `*** End Patch` envelope and pass format:"v4a".',
+      );
     }
     if (kind !== 'delete' && !(entry.hunks?.length > 0)) {
       const display = headerName ? normalizeOutputPath(stripDiffPrefix(headerName)) : '(unknown)';
       throw new Error(`apply_patch: entry ${display} has no hunks — patch header malformed (use \`@@ -A,B +C,D @@\` per hunk).`);
     }
-    // Realpath each non-/dev/null header; nearest-existing-ancestor handles
-    // create-mode leaves that do not yet exist. A symlink/junction whose
-    // target escapes basePath fails here even when the lexical check above
-    // looked safe.
-    for (const which of ['oldFileName', 'newFileName']) {
-      const checkName = entry[which];
-      if (!checkName || DEV_NULL.test(checkName)) continue;
-      const checkFull = resolveEntryPath(basePath, checkName);
-      const checkReal = realpathNearestExistingAncestor(checkFull);
-      const checkRel = pathRelative(realBase, checkReal);
-      if (checkRel.split(/[\\/]+/).some((part) => part === '..') || isAbsolute(checkRel)) {
-        const display = normalizeOutputPath(stripDiffPrefix(checkName));
-        throw new Error(`apply_patch: ${display} resolves outside base_path via symlink/junction; refusing to apply.`);
-      }
-    }
     const fullPath = resolveEntryPath(basePath, headerName);
     const pathKey = process.platform === 'win32' ? fullPath.toLowerCase() : fullPath;
     if (seenPaths.has(pathKey)) {
@@ -272,19 +246,18 @@ export async function preValidateNativeBatch(parsed, basePath) {
       hunks: entry.hunks?.length || 0,
       linesChanged: added + removed,
     });
-    // Absolute-form headers must be rewritten to repo-relative before the
-    // native server, which joins headers to basePath, sees them.
+    // Absolute-form headers must be rewritten to paths relative to basePath
+    // (including `..` segments for out-of-base targets) before the native
+    // server, which joins headers to basePath, sees them.
     for (const which of ['oldFileName', 'newFileName']) {
       const raw = entry[which];
       if (!raw || DEV_NULL.test(raw)) continue;
       const stripped = stripDiffPrefix(raw);
       const norm = normalizeInputPath(stripped);
       if (!isAbsolute(norm) && !/^[A-Za-z]:[\\/]/.test(norm)) continue;
-      const rel = pathRelative(pathResolve(basePath), pathResolve(norm)).replace(/\\/g, '/');
-      if (!rel || rel.startsWith('..') || isAbsolute(rel)) {
-        const display = normalizeOutputPath(stripDiffPrefix(raw));
-        throw new Error(`apply_patch: absolute header ${display} does not resolve inside base_path.`);
-      }
+      if (isResolvedPathOutsideBase(pathResolve(norm), basePath)) continue;
+      const rel = headerRelFromBase(basePath, norm);
+      if (!rel || rel.startsWith('..')) continue;
       headerRewrites.push({ from: raw, to: rel });
     }
   }

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -2,11 +2,10 @@
 // conversion. Moved verbatim from patch.mjs; anchor/context matching, EOF
 // handling, rename atomicity, and conversion output are all unchanged.
 
-import { readFileSync, realpathSync, statSync, mkdirSync } from 'node:fs';
+import { readFileSync, lstatSync, mkdirSync } from 'node:fs';
 import { unlink } from 'node:fs/promises';
-import { resolve as pathResolve, relative as pathRelative, isAbsolute, dirname as pathDirname } from 'node:path';
+import { dirname as pathDirname } from 'node:path';
 import {
-  normalizeInputPath,
   normalizeOutputPath,
   invalidateBuiltinResultCache,
   clearReadSnapshotForPath,
@@ -18,7 +17,8 @@ import {
 import { atomicWrite } from '../builtin/atomic-write.mjs';
 import { assertPathReachable, assertPathsReachable } from '../builtin/fs-reachability.mjs';
 import { markCodeGraphDirtyPaths } from '../code-graph-state.mjs';
-import { resolveV4AEntryPath, realpathNearestExistingAncestor } from './paths.mjs';
+import { isSpecialFileStat } from '../builtin/device-paths.mjs';
+import { resolveV4AEntryPath } from './paths.mjs';
 import {
   isV4AEndOfFileMarker,
   parseUnifiedBareV4APatch,
@@ -219,7 +219,7 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
   };
 }
 
-function applyV4AHunksToLines(sourceLines, hunks, options = {}) {
+export function applyV4AHunksToLines(sourceLines, hunks, options = {}) {
   const lines = cloneTextLinesForPatch(sourceLines);
   const orderedHunks = orderV4AHunksByFilePosition(lines, hunks, options.fuzzy !== false);
   let nextSearchLine = 0;
@@ -304,28 +304,21 @@ function v4aRenamePathKey(absPath) {
   return process.platform === 'win32' ? String(absPath || '').toLowerCase() : String(absPath || '');
 }
 
-function v4aRenamePathInsideRealBase(absPath, realBase) {
-  const checkReal = realpathNearestExistingAncestor(absPath);
-  const checkRel = pathRelative(realBase, checkReal);
-  if (!checkRel || checkRel.startsWith('..') || isAbsolute(checkRel)) return false;
-  return !checkRel.split(/[\\/]+/).some((part) => part === '..');
+function v4aSpecialFileStatMessage(displayPath) {
+  return `apply_patch: cannot patch special file (FIFO / character / block device / socket): ${normalizeOutputPath(displayPath)}`;
 }
 
-function validateV4ARenameSection(section, basePath, seenDestKeys, realBase) {
-  const escapeErr = v4aSectionPathEscapeError(section, basePath);
-  if (escapeErr) return escapeErr;
-  const escapeDest = v4aSectionPathEscapeError({ path: section.movePath }, basePath);
-  if (escapeDest) return escapeDest;
+function lstatV4APatchTarget(fullPath, displayPath) {
+  const st = lstatSync(fullPath);
+  if (isSpecialFileStat(st)) {
+    throw new Error(v4aSpecialFileStatMessage(displayPath));
+  }
+  return st;
+}
+
+function validateV4ARenameSection(section, basePath, seenDestKeys) {
   const srcFull = resolveV4AEntryPath(basePath, section.path);
   const destFull = resolveV4AEntryPath(basePath, section.movePath);
-  if (realBase) {
-    if (!v4aRenamePathInsideRealBase(srcFull, realBase)) {
-      return `apply_patch: ${normalizeOutputPath(section.path)} resolves outside base_path via symlink/junction; refusing V4A rename.`;
-    }
-    if (!v4aRenamePathInsideRealBase(destFull, realBase)) {
-      return `apply_patch: ${normalizeOutputPath(section.movePath)} resolves outside base_path via symlink/junction; refusing V4A rename.`;
-    }
-  }
   if (v4aRenamePathKey(srcFull) === v4aRenamePathKey(destFull)) {
     return `apply_patch: V4A rename source and destination are the same path (${normalizeOutputPath(section.path)})`;
   }
@@ -335,7 +328,10 @@ function validateV4ARenameSection(section, basePath, seenDestKeys, realBase) {
   }
   seenDestKeys.add(destKey);
   try {
-    const st = statSync(srcFull);
+    const st = lstatSync(srcFull);
+    if (isSpecialFileStat(st)) {
+      return v4aSpecialFileStatMessage(section.path);
+    }
     if (!st.isFile()) {
       return `apply_patch: V4A rename source is not a regular file: ${normalizeOutputPath(section.path)}`;
     }
@@ -343,7 +339,10 @@ function validateV4ARenameSection(section, basePath, seenDestKeys, realBase) {
     return `apply_patch: V4A rename source missing or unreadable: ${normalizeOutputPath(section.path)} (${err?.code || err?.message || String(err)})`;
   }
   try {
-    const destSt = statSync(destFull);
+    const destSt = lstatSync(destFull);
+    if (isSpecialFileStat(destSt)) {
+      return v4aSpecialFileStatMessage(section.movePath);
+    }
     if (destSt.isDirectory()) {
       return `apply_patch: V4A rename destination is a directory: ${normalizeOutputPath(section.movePath)}`;
     }
@@ -451,15 +450,9 @@ export async function planV4ARenameSections(sections, basePath) {
     resolveV4AEntryPath(basePath, section.movePath),
   ]);
   await assertPathsReachable(renameReachPaths);
-  let realBase;
-  try {
-    realBase = realpathSync(pathResolve(basePath));
-  } catch (err) {
-    throw new Error(`apply_patch: base_path unreadable (${err?.code || err?.message || String(err)}): ${basePath}`);
-  }
   const seenDestKeys = new Set();
   for (const section of renameSections) {
-    const errText = validateV4ARenameSection(section, basePath, seenDestKeys, realBase);
+    const errText = validateV4ARenameSection(section, basePath, seenDestKeys);
     if (errText) throw new Error(errText);
   }
   return {
@@ -485,29 +478,8 @@ export function convertUnifiedCountedToUnifiedPatchViaV4A(patchStr, basePath, op
   return convertV4ASectionsToUnifiedPatch(parseUnifiedCountedAsV4APatch(patchStr), basePath, options);
 }
 
-// Lexical path-escape guard for V4A section paths.
-function v4aSectionPathEscapeError(section, basePath) {
-  const raw = section?.path;
-  if (!raw) return null;
-  const norm = normalizeInputPath(raw);
-  const segs = norm.split(/[\\/]+/);
-  if (segs.some((part) => part === '..')) {
-    return `apply_patch: header ${normalizeOutputPath(raw)} is unsupported (path escapes base_path or contains \`..\`).`;
-  }
-  if (isAbsolute(norm) || /^[A-Za-z]:[\\/]/.test(norm)) {
-    if (!basePath) return `apply_patch: header ${normalizeOutputPath(raw)} is unsupported (path escapes base_path or contains \`..\`).`;
-    const absHeader = pathResolve(norm);
-    const absBase = pathResolve(basePath);
-    const rel = pathRelative(absBase, absHeader);
-    if (!rel || rel.startsWith('..') || isAbsolute(rel) || rel.split(/[\\/]+/).some((part) => part === '..')) {
-      return `apply_patch: header ${normalizeOutputPath(raw)} is unsupported (path escapes base_path or contains \`..\`).`;
-    }
-  }
-  return null;
-}
-
 function readRawBufForV4AConversion(fullPath) {
-  const st = statSync(fullPath);
+  const st = lstatV4APatchTarget(fullPath, fullPath);
   const cached = rawContentCacheGet(fullPath, st);
   if (cached) return cached;
   const rawBuf = readFileSync(fullPath);
@@ -543,8 +515,6 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
   const out = [];
   const v4aLinesCache = new Map();
   for (const section of sections) {
-    const escapeErr = v4aSectionPathEscapeError(section, basePath);
-    if (escapeErr) throw new Error(escapeErr);
     const displayPath = section.path.replace(/\\/g, '/');
     if (section.kind === 'add') {
       out.push('--- /dev/null');

package/src/runtime/channels/lib/webhook/deliveries.mjs

@@ -114,7 +114,10 @@ function _mergeDeliveryRows(prior, entry) {
   return prior ? { ...prior, ...entry } : entry;
 }
 function _isBlockingDeliveryStatus(status) {
-  return status === "received" || status === "processing" || status === "done";
+  // "pending" is a non-terminal claim too: between the pending row write and
+  // the terminal done/failed row (eventPipeline enqueue, delegate dispatch) a
+  // concurrent retry of the same delivery id must dedup, not double-dispatch.
+  return status === "received" || status === "pending" || status === "processing" || status === "done";
 }
 function _deliveryIndexFor(name) {
   let map = _deliveryIndexByEndpoint.get(name);

package/src/session-runtime/settings-api.mjs

@@ -13,6 +13,7 @@ export function createSettingsApi({
   getSession,
   getRemoteEnabled,
   // config-lifecycle
+  adoptConfig,
   saveConfigAndAdopt,
   scheduleBackendSave,
   // normalizers / helpers
@@ -129,6 +130,18 @@ export function createSettingsApi({
     // setProfile patches title and/or language and persists. Unknown language
     // ids normalize back to 'system'. Prompt-side injection is wired separately
     // (composeSystemPrompt) — this only owns the stored value.
+    getDisabledSkills() {
+      const config = getConfig();
+      return cfgMod.normalizeSkillsConfig(config.skills);
+    },
+    setDisabledSkills(disabled) {
+      const names = disabled instanceof Set
+        ? [...disabled]
+        : (Array.isArray(disabled) ? disabled : []);
+      const nextSkills = cfgMod.patchSkillsDisabled(names);
+      adoptConfig({ ...getConfig(), skills: nextSkills });
+      return this.getDisabledSkills();
+    },
     setProfile(input = {}) {
       const config = getConfig();
       const current = cfgMod.normalizeProfileConfig(config.profile);

package/src/session-runtime/tool-catalog.mjs

@@ -3,6 +3,8 @@
 // application/selection logic. Pure module (session objects passed in).
 import { clean } from './session-text.mjs';
 import { estimateToolSchemaTokens } from '../runtime/agent/orchestrator/session/context-utils.mjs';
+import { applyInitialDeferredToolManifestToBp1 } from '../runtime/agent/orchestrator/context/collect.mjs';
+import { getMcpServerInstructionsMap } from '../runtime/agent/orchestrator/mcp/client.mjs';
 import {
   isResponsesFreeformTool,
   toResponsesCustomTool,
@@ -64,6 +66,7 @@ export const DEFERRED_DEFAULT_LEAD_TOOLS = Object.freeze([
   'search',
   'web_fetch',
   'cwd',
+    'session_manage',
   'Skill',
   'tool_search',
 ]);
@@ -553,7 +556,21 @@ function setDeferredToolState(session, names) {
   return selected;
 }
 
-function isReadonlySelectable(tool) {
+export function deferredPoolToolNames(session) {
+  if (!session || session.deferredProviderMode === 'full') return [];
+  const catalog = Array.isArray(session.deferredToolCatalog)
+    ? session.deferredToolCatalog
+    : [];
+  const active = new Set((session.tools || []).map((tool) => clean(tool?.name)).filter(Boolean));
+  const out = [];
+  for (const tool of catalog) {
+    const name = clean(tool?.name);
+    if (name && !active.has(name)) out.push(name);
+  }
+  return sortedNamesByMeasuredUsage(out);
+}
+
+export function isReadonlySelectable(tool) {
   const name = clean(tool?.name);
   if (READONLY_TOOL_NAMES.has(name)) return true;
   const annotations = tool?.annotations || {};
@@ -602,16 +619,24 @@ export function applyDeferredToolSurface(session, mode, extraTools = [], options
   } else {
     setDeferredToolState(session, active);
   }
+  if (!session.deferredToolBp1Applied && session.messages?.some((m) => m?.role === 'system')) {
+    if (!session.mcpServerInstructions || typeof session.mcpServerInstructions !== 'object') {
+      session.mcpServerInstructions = getMcpServerInstructionsMap();
+    }
+    applyInitialDeferredToolManifestToBp1(session, deferredPoolToolNames(session));
+  }
   return session;
 }
 
-export function selectDeferredTools(session, names, mode) {
+export function selectDeferredTools(session, names, mode, options = {}) {
+  const promoteToActive = options?.promoteToActive === true;
   const catalog = Array.isArray(session?.deferredToolCatalog)
     ? session.deferredToolCatalog
     : (Array.isArray(session?.tools) ? session.tools : []);
   const active = new Set((session?.tools || []).map((tool) => clean(tool?.name)).filter(Boolean));
   const native = session?.deferredProviderMode === 'native' || session?.deferredNativeTools === true;
   const discovered = new Set(Array.isArray(session?.deferredDiscoveredTools) ? session.deferredDiscoveredTools : []);
+  const activateOnSurface = !native || promoteToActive;
   const byName = new Map();
   for (const tool of catalog) {
     const name = clean(tool?.name);
@@ -635,20 +660,23 @@ export function selectDeferredTools(session, names, mode) {
       blocked.push({ name, reason: 'readonly mode' });
       continue;
     }
-    if (active.has(name) || discovered.has(name)) {
+    if (active.has(name) || (!activateOnSurface && discovered.has(name))) {
       already.push(name);
       continue;
     }
-    if (native) {
-      discovered.add(name);
-    } else {
+    if (activateOnSurface) {
       session.tools.push(tool);
       active.add(name);
+      discovered.delete(name);
+    } else {
+      discovered.add(name);
     }
     added.push(name);
   }
   if (native) {
-    session.deferredDiscoveredTools = sortedNamesByMeasuredUsage(discovered);
+    session.deferredDiscoveredTools = sortedNamesByMeasuredUsage(
+      [...discovered].filter((toolName) => !active.has(toolName)),
+    );
     session.deferredSelectedTools = sortedNamesByMeasuredUsage(active);
   } else {
     setDeferredToolState(session, active);

package/src/session-runtime/tool-defs.mjs

@@ -69,6 +69,34 @@ export const SKILL_TOOL = {
   },
 };
 
+// Owner-directed session reset tool. `clear` mirrors /clear (full wipe);
+// `compact_clear` mirrors the auto-clear path (summarize via the configured
+// compactType, then reset — context carries forward in the summary). The
+// reset is SCHEDULED: it runs when the current turn ends, never mid-turn,
+// because the live transcript is still feeding the loop. Lead-session only;
+// the runtime executor rejects agent-worker callers.
+export const SESSION_MANAGE_TOOL = {
+  name: 'session_manage',
+  title: 'Session Manage',
+  annotations: {
+    title: 'Session Manage',
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: false,
+    agentHidden: true,
+  },
+  description: 'Reset this conversation on explicit user request. action=clear wipes all context (like /clear); action=compact_clear summarizes first and carries context forward (auto-clear style). Applies when the current turn ends.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      action: { type: 'string', enum: ['clear', 'compact_clear'], description: 'clear = full wipe; compact_clear = summarize then reset.' },
+    },
+    required: ['action'],
+    additionalProperties: false,
+  },
+};
+
 export const LEAD_DISALLOWED_TOOLS = Object.freeze([]);
 export const AGENT_HIDDEN_WRAPPER_TOOLS = new Set([]);
 

package/src/standalone/agent-tool/render.mjs

@@ -82,6 +82,8 @@ export function renderResult(value) {
       lines.push(`status: ${value.status}`);
       if (value.type) lines.push(`type: ${value.type}`);
       if (value.reused) lines.push('reused: true');
+      if (value.respawned) lines.push('respawned: true');
+      if (value.note) lines.push(`note: ${value.note}`);
       if (value.tag || value.sessionId) lines.push(`target: ${value.tag || '-'} ${value.sessionId || ''}`.trim());
       if (value.agent) lines.push(`agent: ${value.agent}`);
       if (value.provider && value.model) lines.push(`model: ${value.provider}/${value.model}`);