mixdog 0.9.142 → 0.9.144

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.142",
+  "version": "0.9.144",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/agent-lead-e2e-probe.mjs

@@ -15,12 +15,7 @@ import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 const ROOT = mkdtempSync(join(tmpdir(), 'mixdog-lead-e2e-'));
-// MIXDOG_LEAD_E2E_LIVE_DAEMON=1: keep the inherited runtime root (live daemon
-// discovery) and opt into agent shard spread, so the spawned worker runs on
-// the INSTALLED daemon's shard pool — the deployed remote-completion path.
-const LIVE_DAEMON = process.env.MIXDOG_LEAD_E2E_LIVE_DAEMON === '1';
-if (LIVE_DAEMON) process.env.MIXDOG_AGENT_SHARD_SPREAD = '1';
-else process.env.MIXDOG_RUNTIME_ROOT = ROOT;
+process.env.MIXDOG_RUNTIME_ROOT = ROOT;
 process.env.MIXDOG_BOOT_CORE_MEMORY = '0';
 process.env.MIXDOG_DAEMON_SKIP_MEMORY = '1';
 process.env.MIXDOG_FEATURE_MEMORY = '0';

package/scripts/agent-turn-trace-probe.mjs

@@ -17,9 +17,7 @@ const ROOT = mkdtempSync(join(tmpdir(), 'mixdog-turn-trace-'));
 process.env.MIXDOG_RUNTIME_ROOT = ROOT;
 process.env.MIXDOG_DAEMON_SKIP_MEMORY = '1';
 process.env.MIXDOG_BOOT_CORE_MEMORY = '0';
-process.env.MIXDOG_AGENT_SHARD_SPREAD = '1';
-// The probe's whole point is the trace: explicit path (shared by daemon and
-// shard children via env inheritance) + timing rows.
+// The probe's whole point is the trace: explicit path plus timing rows.
 const TRACE_PATH = join(ROOT, 'agent-trace.jsonl');
 delete process.env.MIXDOG_AGENT_TRACE_DISABLE;
 process.env.MIXDOG_AGENT_TRACE_PATH = TRACE_PATH;
@@ -75,7 +73,7 @@ try {
       '2) read README.md (first 40 lines)',
       '3) run the shell command: node -v',
       '4) read apps/desktop/package.json',
-      '5) grep the string "createSessionRuntimePool" under src/standalone (files list only)',
+      '5) grep the string "createSessionRuntimeHost" under src/standalone (files list only)',
       'Then reply with one line: DONE <package name> <node version>. Do not edit anything.',
     ].join('\n'),
   }, { invocationSource: 'model-tool', cwd: REPO });
@@ -90,7 +88,7 @@ try {
   process.stdout.write(`wall=${((Date.now() - t0) / 1000).toFixed(1)}s\n--- result ---\n${last.slice(0, 400)}\n`);
   try { agent.closeAll('turn-trace probe end'); } catch { /* teardown */ }
 
-  // Shard children flush their local trace buffers on a short timer.
+  // The runtime worker flushes its local trace buffer on a short timer.
   await sleep(9_000);
   const rows = existsSync(TRACE_PATH)
     ? readFileSync(TRACE_PATH, 'utf8').split('\n').filter(Boolean).flatMap((line) => {

package/src/lib/rules-builder.cjs

@@ -202,12 +202,32 @@ function stripFrontmatter(markdown) {
   return String(markdown || '').replace(/^---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/, '').trim();
 }
 
-const WEB_SEARCH_ROUTE_RE = /^[ \t]*current or external information discovery→`web_search`;[ \t]*\r?\n?/gm;
-const WEB_FETCH_ROUTE_RE = /^[ \t]*page or documentation body retrieval from a known URL→`web_fetch`\.[ \t]*\r?\n?/gm;
-const RECALL_ROUTE_RE = /^-[ \t]*past facts recorded in prior work or sessions→`recall`[ \t]*\r?\n[ \t]*\(stored history only, never current local state\)\.[ \t]*\r?\n?/gm;
-const MEMORY_ROUTE_RE = /^-[ \t]*Durable memory creation or update→`memory`; store a compact English[ \t]*\r?\n[ \t]*statement\.[\s\S]*$/m;
-const EMPTY_RESEARCH_RE = /^# Research[ \t]*\r?\n(?:[ \t]*\r?\n)*-[ \t]*Research routes:[ \t]*\r?\n?/gm;
-const EMPTY_MEMORY_RE = /^# Memory[ \t]*\r?\n(?:[ \t]*\r?\n)*/gm;
+// Tool dependency is declared as metadata, not matched against prose. A
+// `<!-- tools: a, b -->` marker binds the block that follows it: the block
+// survives while any listed tool is on the session surface and disappears
+// once every one of them is omitted. Markers never reach the model.
+const TOOL_MARKER_RE = /^[ \t]*<!--[ \t]*tools:[ \t]*([^>]*?)[ \t]*-->[ \t]*$/;
+
+function markerTools(line) {
+  const match = TOOL_MARKER_RE.exec(String(line ?? ''));
+  if (!match) return null;
+  return match[1].split(',').map((name) => name.trim().toLowerCase()).filter(Boolean);
+}
+
+// A marked block runs from the line after the marker through every deeper
+// indented continuation line, ending at the next marker, blank line, or a
+// line at the same or shallower indent.
+function markedBlockEnd(lines, start) {
+  const indent = lines[start].search(/\S/);
+  let end = start + 1;
+  while (end < lines.length) {
+    const line = lines[end];
+    if (!line.trim() || markerTools(line)) break;
+    if (line.search(/\S/) <= indent) break;
+    end += 1;
+  }
+  return end;
+}
 
 function omitKeySet(omitTools) {
   return new Set((Array.isArray(omitTools) ? omitTools : []).map((name) => String(name || '').toLowerCase()).filter(Boolean));
@@ -216,16 +236,25 @@ function omitKeySet(omitTools) {
 /** Drop routing clauses for tools that are not on the session surface. */
 function omitToolRoutes(text, omitTools = []) {
   const deny = omitKeySet(omitTools);
-  let out = String(text || '');
-  if (deny.has('web_search')) out = out.replace(WEB_SEARCH_ROUTE_RE, '');
-  if (deny.has('web_fetch')) out = out.replace(WEB_FETCH_ROUTE_RE, '');
-  if (deny.has('recall')) out = out.replace(RECALL_ROUTE_RE, '');
-  if (deny.has('memory')) out = out.replace(MEMORY_ROUTE_RE, '');
-  if (deny.has('web_search') && deny.has('web_fetch')) {
-    out = out.replace(EMPTY_RESEARCH_RE, '');
+  const lines = String(text || '').split(/\r?\n/);
+  const kept = [];
+  let index = 0;
+  while (index < lines.length) {
+    const tools = markerTools(lines[index]);
+    if (!tools) {
+      kept.push(lines[index]);
+      index += 1;
+      continue;
+    }
+    index += 1;
+    if (index >= lines.length) break;
+    const end = markedBlockEnd(lines, index);
+    if (!tools.length || !tools.every((name) => deny.has(name))) {
+      kept.push(...lines.slice(index, end));
+    }
+    index = end;
   }
-  if (deny.has('recall') && deny.has('memory')) out = out.replace(EMPTY_MEMORY_RE, '');
-  return out.replace(/[ \t]+\n/g, '\n').replace(/\n{3,}/g, '\n\n');
+  return kept.join('\n').replace(/[ \t]+\n/g, '\n').replace(/\n{3,}/g, '\n\n').trim();
 }
 
 // Framing line under the style header: the block owns user-facing prose only,

package/src/rules/lead/lead-brief.md

@@ -1,13 +1,12 @@
 # Lead Brief
 
-- Minimum chars, maximum info: one-line fragments. Every role's `Task:` is
-  mandatory and lossless — build it from the original request and the official
-  spec/test acceptance criteria, preserving intent, required and forbidden
-  outcomes, completion/stop boundary, user-supplied exact targets, and exact
-  replacements/outputs. Never infer exactness from task name, file count, or
-  difficulty.
-- Omit role-known rules, repeated context/facts, and padding; split scope
-  without discarding requirements.
+- Every role's `Task:` is mandatory and lossless — build it from the original
+  request and the official spec/test acceptance criteria, preserving intent,
+  required and forbidden outcomes, completion/stop boundary, user-supplied
+  exact targets, and exact replacements/outputs.
+- Never infer exactness from task name, file count, or difficulty.
+- Minimum chars, maximum info: one-line fragments, no role-known rules, no
+  repeated context or facts, no padding.
 - Other fields are task-specific deltas — `Anchors:` (`file:line` plus a
   one-line conclusion, never log/code bodies), `Allow/Forbid:`, `Deliver:`
   (sets handoff shape/size); omit empty fields. State outcomes, not methods,

package/src/rules/shared/10-tool-workflow.md

@@ -1,20 +1,40 @@
 # Tool Workflow
 
-- Minimize tool turns through maximal useful parallelism: in each turn, issue
-  every necessary non-overlapping call whose inputs are already known.
-- Defer a call only when its inputs depend on an earlier result; never add
-  duplicate or irrelevant calls merely to increase fanout.
-- Apply one analysis to many targets as one parameterized call when supported,
-  not one call per target.
+- Investigate, build, and verify only what the requested outcome requires, at
+  the level it requires; trust internal and framework guarantees.
+- Minimize tool turns through maximal useful parallelism. Cost is counted in
+  rounds, not calls: a batch is one round, so a call-count saving never
+  justifies a worse-routed call. Plan the fewest evidence-complete dependent
+  rounds first, then the fewest calls within each round.
+- In each round, issue every necessary non-overlapping call whose inputs are
+  already known; defer a call only when its target or arguments require an
+  earlier result.
+- Route each remaining evidence facet once to its primary owner, preferring the
+  operation that directly returns the evidence needed for the next decision. A
+  summary, overview, or enumeration is not a prerequisite when that operation's
+  complete inputs are already known; if independently required, batch it with
+  the detailed operation.
+- Never duplicate a facet, widen retrieval speculatively, or cap fanout; apply
+  one analysis to many targets as one parameterized call when supported.
 1. Determine the required outcome and missing information; requirements are
    not evidence.
 2. If needed, gather only missing information through Research or Exploration;
    use Execution when the information can only be produced by running a program
-   or observing runtime state. Stop when it is already known or sufficiently
-   obtained.
+   or observing runtime state.
 3. Perform the required answer, edit, or execution in the fewest safe coherent
    calls.
 4. Verify only affected facets and essential invariants when required.
+- Known state — system guarantees, supplied facts, visible tool returns,
+  applied patches, and passed checks — is never re-found, re-derived, or
+  re-verified at any granularity: no re-query call, no confirmation subcommand
+  inside a shell command, no availability probe for what the operation itself
+  would report, no reopening a file to confirm an edit, no rerun of a passed
+  check.
+- Mine each returned result fully before opening the next round. A follow-up
+  is valid only for evidence a result omitted, invalidated, or newly made
+  necessary; an independently required call that no result created belonged in
+  the earlier batch.
+- Evidence that determines the answer, edit, or deliverable ends retrieval.
 - Treat failure as new evidence and repeat steps 1–4 only for affected facets.
   Report a blocker when no deterministic next action remains.
 - Use only named tools present in the current tool surface.

package/src/rules/shared/20-research.md

@@ -1,6 +1,10 @@
+<!-- tools: web_search, web_fetch -->
 # Research
 
+<!-- tools: web_search, web_fetch -->
 - Research routes:
+<!-- tools: web_search -->
   current or external information discovery→`web_search`;
+<!-- tools: web_fetch -->
   page or documentation body retrieval from a known URL→`web_fetch`.
 

package/src/rules/shared/30-exploration.md

@@ -2,43 +2,31 @@
 
 - Use read-only means for inspection; never mutate to clear an obstacle or
   unexpected state. Preserve evidence before a required mutation can destroy it.
-- Local Project exploration routes:
-  unknown file/directory location, paths only needed→`find`;
-  wildcard/recursive paths→`glob` (including known-root unknown descendants);
+- Ownership is exclusive: each evidence type has one owner, another tool's
+  ability to reach the same target is never an alternative route, and a
+  successful owner result closes that facet — only a different evidence type
+  routes elsewhere.
+- Route the missing evidence to its primary owner:
+  repository state, history, or diff→`git`;
+  exact symbol declaration, body, usage, or relation→`code_graph`;
+  literal, regex, or text location→`grep`;
+  known-file content, range, or image→`read`;
+  wildcard or recursive file paths→`glob`;
   known directory's immediate entries→`list`;
-  exact symbol, body, or relation→`code_graph`
-  (identifier declarations/usages→`code_graph`; literal values/strings→`grep`);
-  literal/regex pattern search within file contents→`grep`;
-  content or an anchored line range from a known file when pattern search is
-  insufficient or unnecessary→`read`.
-- Read-only tools — `find`, `glob`, `list`, `grep`, `code_graph`, `read` —
-  always batch safely in parallel.
-- Paths reachable by expanding an environment variable or the home directory
-  are resolved locations, not unknowns.
-- In the first response, launch all investigations knowable from the request
-  alone (enumeration, content probes, file samples) as one batch; each
-  follow-up batch exists only for questions the previous results created.
-- Batching never licenses a guessed `glob.path`
-  (unknown location → `find` first; omit path for the current Project).
+  unknown file or directory location→`find`.
+- Use a path locator only when the owner's required target is unknown. Paths
+  reachable by expanding an environment variable or the home directory are
+  resolved locations, not unknowns.
 - Enumerate sibling directories or same-kind files with one wildcard call
   (`glob`, or `read` with a glob for content sampling), never a
   directory-by-directory `list` walk or one `read` per file.
-- Before choosing an implementation, inspect only the nearest relevant code,
-  configuration, and established pattern needed to verify local conventions or
-  dependency availability.
-
-- Requirements define what must be true; evidence establishes what is true.
-  Never use one as the other. Treat supplied target locations as resolved;
-  access them directly without locator searches. Before deciding how to parse,
-  count, transform, or summarize files whose format has not been inspected,
-  inspect the original content itself. Within the current project, pass project-relative
-  paths and omit optional scopes equal to its root; explicit paths may be
-  outside cwd only for targets outside the project.
-- Do not re-read content already returned by any tool or reopen a successfully
-  edited file solely to confirm the edit. Read only missing context or content
-  invalidated by a reported failure, partial operation, or external change.
-- `code_graph references` supplies the declaration and scoped usages and ends
-  that facet; values/locations end at the context `grep` returns; `read` covers
-  only omitted lines or missing anchored ranges. Any visible returned span can
-  supply exact source context; do not fetch it again.
+- Treat supplied target locations as resolved; access them directly without
+  locator searches. Within the current project, pass project-relative paths and
+  omit optional scopes equal to its root; explicit paths may be outside cwd
+  only for targets outside the project.
+- Before deciding how to parse, count, transform, or summarize files whose
+  format has not been inspected, inspect the original content itself.
+- Returned declarations, bodies, usages, relations, and contextual spans from
+  any tool — not only `read` — are source context; `read` covers only omitted
+  lines or missing anchored ranges.
 

package/src/rules/shared/40-editing.md

@@ -1,11 +1,15 @@
 # Editing
 
+- A required new file is created directly: Add File is itself the atomic
+  absence check, so inspect only if it reports the target already exists.
 - Source: use exact current target text from any visible evidence, including
   user input, tool output, or an applied edit result; never reconstruct it from
   another file, a sample, or expectation.
 - Placement: with `edit`, use an exact unique target string, expanding exact
   surrounding text when needed; with `apply_patch`, use exact unchanged context
   and add a class/function locator when context alone is not unique.
+- Apply all determined changes in the fewest safe calls the active tool
+  supports; a file written in one call is written complete.
 - Batch scope: never split one file across concurrent edit calls. Group
   same-intent changes with exact context into coherent calls; issue disjoint
   calls together in one turn, and defer ambiguous or result-dependent changes.

package/src/rules/shared/50-execution.md

@@ -2,4 +2,5 @@
 
 - Evidence or artifacts available only through program execution, calculation,
   data transformation, generated output, or unsupported-format decoding→`shell`;
+  an already-open shell is never a routing reason.
 

package/src/rules/shared/60-verification.md

@@ -5,6 +5,15 @@
   invariants; use an umbrella suite only when the user explicitly requests it
   or a documented project or release process requires it.
 - Issue all independent checks in one turn.
+- Blocking checks cover only essential integrity, security, compatibility, and
+  buildability invariants. Treat mutable behavior, UX, exact text, snapshots,
+  and implementation shape as advisory specifications; update them when the
+  requested behavior changes instead of preserving obsolete behavior.
+- A check runs at the strictness the task requires; never raise a tool's own
+  severity beyond it.
 - If verification fails, collect all failures, leave Verification, complete all
   determinable fixes, then re-enter Verification for the resulting state.
+- A successful verification closes the task unless later changes affect it;
+  rerun a failed action only after its inputs or subject change, otherwise
+  report it unresolved.
 

package/src/rules/shared/70-delivery.md

@@ -2,5 +2,4 @@
 
 - Commit, push, release, and deployment happen only on the user's explicit
   request.
-- Repository state or history explicitly asked about, and every repository
-  mutation→`git`; never part of exploration batching.
+- Every repository mutation→`git`.

package/src/rules/shared/80-memory.md

@@ -1,11 +1,15 @@
+<!-- tools: recall, memory -->
 # Memory
 
+<!-- tools: recall -->
 - past facts recorded in prior work or sessions→`recall`
   (stored history only, never current local state).
+<!-- tools: memory -->
 - Durable memory creation or update→`memory`; store a compact English
   statement.
+<!-- tools: memory -->
 - Use judgment to decide whether a durable memory should be stored, whether
   user confirmation is needed, and which scope best fits the context.
+<!-- tools: memory -->
 - Omit `project_id` for the current Project, use `"common"` for shared memory,
-  or provide an explicit Project slug for another named Project. `*` is
-  read-only.
+  or an explicit Project slug for another named Project; `*` is read-only.

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs

@@ -334,45 +334,6 @@ export function makeAgentDispatch(opts = {}) {
         // pooled or resumed. Cache prefix matching happens at the provider
         // layer (account-level), not the session level.
         const finalPrompt = prompt;
-        // Agent shard spread: inside a shard child the ephemeral hidden-role
-        // session runs on a peer shard through the daemon session protocol —
-        // the same single spawn path the agent tool uses. ONE path per mode:
-        // a remote failure fails the dispatch (no in-process fallback).
-        const spreadMod = await import('../../../../standalone/agent-tool/shard-spread.mjs')
-            .catch(() => null);
-        if (spreadMod?.agentShardSpreadEnabled?.()) {
-            const raw = await spreadMod.dispatchHiddenAgentRemote({
-                spec: {
-                    agent,
-                    presetName,
-                    preset,
-                    runtimeSpec,
-                    permission,
-                    cwd,
-                    sourceType: opts.sourceType,
-                    sourceName: sourceNameArg || opts.sourceName,
-                    parentSessionId: opts.parentSessionId || null,
-                    ownerSessionId: opts.ownerSessionId === undefined ? (opts.parentSessionId || null) : opts.ownerSessionId,
-                    clientHostPid: opts.clientHostPid,
-                    skipRoleReminder: isPoolC,
-                    schemaAllowedTools: resolveHiddenRoleSchemaAllowedTools(hidden),
-                    taskType: opts.taskType,
-                    maxLoopIterations: opts.maxLoopIterations,
-                },
-                provider: preset.provider,
-                model: preset.model,
-                cwd,
-                prompt: finalPrompt,
-                parentSignals: [opts.parentSignal, callParentSignal],
-                watchdogPolicy: resolveAgentWatchdogPolicy(agent, {
-                    idleTimeoutMs: Number.isFinite(callIdleTimeoutMs)
-                        ? callIdleTimeoutMs
-                        : opts.idleTimeoutMs,
-                    firstResponseTimeoutMs: opts.firstResponseTimeoutMs,
-                }),
-            });
-            return opts.brief === false ? raw : applyBriefCap(raw);
-        }
         const { session } = prepareAgentSession({
             agent,
             presetName,

package/src/runtime/agent/orchestrator/providers/admission-scheduler.mjs

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { resourceAdmission } from '../../../shared/resource-admission.mjs';
 
 // Normal provider traffic is not concurrency-gated. Independent sessions and
 // accounts start immediately; a finite limit exists only when an operator
@@ -577,28 +578,33 @@ export function wrapProviderAdmission(provider, providerName, scheduler = provid
         const opts = sendOpts || {};
         const signal = opts.signal || null;
         const key = providerAdmissionKey(providerName, this);
-        return scheduler.run(key, (admissionSignal) => {
-            // Admission is the common request-clock boundary for WS/SSE/HTTP.
-            // Queue wait therefore cannot consume first-byte or agent-watchdog
-            // time. Provider-local retry remains the sole retry owner.
-            try { opts.onStageChange?.('requesting'); } catch {}
-            return originalSend.call(this, messages, model, tools, {
-                ...opts,
-                signal: admissionSignal,
-            });
-        }, {
-            signal,
-            ownerKey: opts.admissionOwner || opts.sessionId || null,
-            priority: opts.admissionPriority || 'user-visible',
-            onCooldownWait: (waitMs) => {
-                // Display-only: the TUI/desktop 'reconnecting' stage already
-                // renders a custom verb, so no new stage vocabulary is needed.
-                const secs = Math.max(1, Math.ceil(waitMs / 1000));
-                try {
-                    opts.onStageChange?.('reconnecting', { message: `Rate-limited — waiting ~${secs}s for the provider window` });
-                } catch { /* display-only */ }
-            },
-        });
+        // Provider queueing and network wait consume no local CPU slot. The
+        // resource controller reacquires the agent lease before model output
+        // continues through local context/tool processing.
+        return resourceAdmission.runYielded(() =>
+            scheduler.run(key, (admissionSignal) => {
+                // Admission is the common request-clock boundary for WS/SSE/HTTP.
+                // Queue wait therefore cannot consume first-byte or agent-watchdog
+                // time. Provider-local retry remains the sole retry owner.
+                try { opts.onStageChange?.('requesting'); } catch {}
+                return originalSend.call(this, messages, model, tools, {
+                    ...opts,
+                    signal: admissionSignal,
+                });
+            }, {
+                signal,
+                ownerKey: opts.admissionOwner || opts.sessionId || null,
+                priority: opts.admissionPriority || 'user-visible',
+                onCooldownWait: (waitMs) => {
+                    // Display-only: the TUI/desktop 'reconnecting' stage already
+                    // renders a custom verb, so no new stage vocabulary is needed.
+                    const secs = Math.max(1, Math.ceil(waitMs / 1000));
+                    try {
+                        opts.onStageChange?.('reconnecting', { message: `Rate-limited — waiting ~${secs}s for the provider window` });
+                    } catch { /* display-only */ }
+                },
+            })
+        );
     };
     return provider;
 }

package/src/runtime/agent/orchestrator/providers/lib/grok-tool-schema.mjs

@@ -65,6 +65,26 @@ function firstExclusiveRequired(branches) {
     return [];
 }
 
+const ARRAY_DROP_NOTE = 'This provider accepts a single value here, not an array.';
+
+function describesArray(schema) {
+    if (!schema || typeof schema !== 'object' || Array.isArray(schema)) return false;
+    return schema.type === 'array' || (Array.isArray(schema.type) && schema.type.includes('array'));
+}
+
+// Flattening keeps one branch, so a description that still promises the dropped
+// shape would advertise more than the wire schema accepts. Project the loss
+// into the text the model actually reads.
+function projectDroppedBranches(schema, dropped) {
+    if (describesArray(schema) || !dropped.some(describesArray)) return schema;
+    const description = String(schema.description || '').trim();
+    if (description.includes(ARRAY_DROP_NOTE)) return schema;
+    return {
+        ...schema,
+        description: description ? `${description} ${ARRAY_DROP_NOTE}` : ARRAY_DROP_NOTE,
+    };
+}
+
 function normalizeGrokPropertySchema(schema) {
     if (!schema || typeof schema !== 'object' || Array.isArray(schema)) return schema;
     const branches = [
@@ -75,7 +95,8 @@ function normalizeGrokPropertySchema(schema) {
         const first = branches.find(branch => branch && typeof branch === 'object' && !Array.isArray(branch));
         if (first) {
             const { anyOf: _anyOf, oneOf: _oneOf, ...siblings } = schema;
-            return normalizeGrokPropertySchema({ ...first, ...siblings });
+            const dropped = branches.filter(branch => branch !== first);
+            return normalizeGrokPropertySchema(projectDroppedBranches({ ...first, ...siblings }, dropped));
         }
     }
     if (!schema.properties || typeof schema.properties !== 'object') return schema;

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -203,7 +203,13 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     };
     const sessionRef = opts.session || null;
     let _providerPrefixGuardState = sessionRef?._providerPrefixGuardState || null;
-    let _fixedProviderToolSurface = sessionRef?._providerToolSurfaceSnapshot || null;
+    // Provider tool snapshots are request-loop state, never durable session
+    // state. Older builds persisted this field, which let a resumed session
+    // keep advertising a retired schema even after session.tools was rebuilt.
+    if (sessionRef && Object.prototype.hasOwnProperty.call(sessionRef, '_providerToolSurfaceSnapshot')) {
+        delete sessionRef._providerToolSurfaceSnapshot;
+    }
+    let _fixedProviderToolSurface = null;
     const loopUsageMetricsEpoch = () => Number(sessionRef?.usageMetricsEpoch) || 0;
     const loopUsageMetricsTurnId = () => Number(sessionRef?.usageMetricsTurnId) || 0;
     // Sub-agent (worker/heavy-worker/reviewer/…) sessions
@@ -496,7 +502,6 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             });
             if (!_fixedProviderToolSurface) {
                 _fixedProviderToolSurface = _candidateSendTools;
-                if (sessionRef) sessionRef._providerToolSurfaceSnapshot = _fixedProviderToolSurface;
             }
             sendTools = _fixedProviderToolSurface;
             requestToolScope = {

package/src/runtime/agent/orchestrator/session/evidence-union.test.mjs

@@ -142,7 +142,7 @@ test('apply_patch, shell, and mutating git batches invalidate all earlier eviden
         ['apply_patch', {}],
         ['shell', {}],
         ['git', { command: 'git commit -m test' }],
-        ['git', { command: "git reflog delete 'HEAD@{1}'", confirm: true }],
+        ['git', { command: "git reflog delete 'HEAD@{1}'" }],
     ]) {
         const messages = [
             call('read_1', 'read', { file_path: 'src/a.mjs' }),

package/src/runtime/agent/orchestrator/session/image-strip-recovery.test.mjs

@@ -164,6 +164,67 @@ test('agent loop heals one rejected tail image and the next turn stays usable',
     assert.equal(nextCalls, 1);
 });
 
+test('agent loop keeps provider tool snapshots turn-local', async () => {
+    const oldTool = {
+        name: 'shell',
+        description: 'old schema',
+        inputSchema: { type: 'object', properties: { retired: { type: 'boolean' } } },
+    };
+    const currentTool = {
+        name: 'shell',
+        description: 'current schema',
+        inputSchema: { type: 'object', properties: { command: { type: 'string' } } },
+    };
+    const nextTool = {
+        name: 'shell',
+        description: 'next schema',
+        inputSchema: { type: 'object', properties: { command: { type: 'string' }, timeout_ms: { type: 'number' } } },
+    };
+    const sentToolDescriptions = [];
+    const provider = {
+        async send(_messages, _model, tools) {
+            sentToolDescriptions.push(tools?.[0]?.description);
+            return { content: 'done', toolCalls: [], stopReason: 'end_turn' };
+        },
+    };
+    const session = {
+        id: 'provider-tool-snapshot-lifetime-test',
+        owner: 'cli',
+        contextWindow: 200_000,
+        rawContextWindow: 200_000,
+        compaction: { auto: false },
+        _providerToolSurfaceSnapshot: [oldTool],
+    };
+    const messages = [
+        { role: 'system', content: 'system' },
+        { role: 'user', content: 'first turn' },
+    ];
+
+    await agentLoop(
+        provider,
+        messages,
+        'fake-model',
+        [currentTool],
+        null,
+        process.cwd(),
+        { session, sessionId: session.id },
+    );
+    assert.equal(Object.hasOwn(session, '_providerToolSurfaceSnapshot'), false);
+
+    messages.push({ role: 'user', content: 'next turn' });
+    await agentLoop(
+        provider,
+        messages,
+        'fake-model',
+        [nextTool],
+        null,
+        process.cwd(),
+        { session, sessionId: session.id },
+    );
+
+    assert.deepEqual(sentToolDescriptions, ['current schema', 'next schema']);
+});
+
 test('mid-stream xAI generation crash is retryable even as invalid_request_error', () => {
     const err = new Error('xAI Responses stream error: Internal error during token generation');
     err.providerWireError = true;