mixdog 0.9.143 → 0.9.145

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.143",
+  "version": "0.9.145",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/prepare-native-assets.mjs

@@ -58,11 +58,24 @@ export async function prepareRequiredNativeAssets({
         return [name, join(target, fileName)];
       }),
     );
-    await rm(target, { recursive: true, force: true });
+    await rm(target, {
+      recursive: true,
+      force: true,
+      maxRetries: 8,
+      retryDelay: 100,
+    });
     await rename(stagedToolsDir, target);
     return Object.fromEntries(entries);
   } finally {
-    await rm(stagingRoot, { recursive: true, force: true });
+    // Antivirus and process scanners can briefly retain freshly copied .exe
+    // handles on Windows. Cleanup must not replace the installer's real error
+    // with a transient EBUSY from the staging directory.
+    await rm(stagingRoot, {
+      recursive: true,
+      force: true,
+      maxRetries: 8,
+      retryDelay: 100,
+    });
   }
 }
 

package/src/lib/rules-builder.cjs

@@ -202,12 +202,32 @@ function stripFrontmatter(markdown) {
   return String(markdown || '').replace(/^---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/, '').trim();
 }
 
-const WEB_SEARCH_ROUTE_RE = /^[ \t]*current or external information discovery→`web_search`;[ \t]*\r?\n?/gm;
-const WEB_FETCH_ROUTE_RE = /^[ \t]*page or documentation body retrieval from a known URL→`web_fetch`\.[ \t]*\r?\n?/gm;
-const RECALL_ROUTE_RE = /^-[ \t]*past facts recorded in prior work or sessions→`recall`[ \t]*\r?\n[ \t]*\(stored history only, never current local state\)\.[ \t]*\r?\n?/gm;
-const MEMORY_ROUTE_RE = /^-[ \t]*Durable memory creation or update→`memory`; store a compact English[ \t]*\r?\n[ \t]*statement\.[\s\S]*$/m;
-const EMPTY_RESEARCH_RE = /^# Research[ \t]*\r?\n(?:[ \t]*\r?\n)*-[ \t]*Research routes:[ \t]*\r?\n?/gm;
-const EMPTY_MEMORY_RE = /^# Memory[ \t]*\r?\n(?:[ \t]*\r?\n)*/gm;
+// Tool dependency is declared as metadata, not matched against prose. A
+// `<!-- tools: a, b -->` marker binds the block that follows it: the block
+// survives while any listed tool is on the session surface and disappears
+// once every one of them is omitted. Markers never reach the model.
+const TOOL_MARKER_RE = /^[ \t]*<!--[ \t]*tools:[ \t]*([^>]*?)[ \t]*-->[ \t]*$/;
+
+function markerTools(line) {
+  const match = TOOL_MARKER_RE.exec(String(line ?? ''));
+  if (!match) return null;
+  return match[1].split(',').map((name) => name.trim().toLowerCase()).filter(Boolean);
+}
+
+// A marked block runs from the line after the marker through every deeper
+// indented continuation line, ending at the next marker, blank line, or a
+// line at the same or shallower indent.
+function markedBlockEnd(lines, start) {
+  const indent = lines[start].search(/\S/);
+  let end = start + 1;
+  while (end < lines.length) {
+    const line = lines[end];
+    if (!line.trim() || markerTools(line)) break;
+    if (line.search(/\S/) <= indent) break;
+    end += 1;
+  }
+  return end;
+}
 
 function omitKeySet(omitTools) {
   return new Set((Array.isArray(omitTools) ? omitTools : []).map((name) => String(name || '').toLowerCase()).filter(Boolean));
@@ -216,16 +236,25 @@ function omitKeySet(omitTools) {
 /** Drop routing clauses for tools that are not on the session surface. */
 function omitToolRoutes(text, omitTools = []) {
   const deny = omitKeySet(omitTools);
-  let out = String(text || '');
-  if (deny.has('web_search')) out = out.replace(WEB_SEARCH_ROUTE_RE, '');
-  if (deny.has('web_fetch')) out = out.replace(WEB_FETCH_ROUTE_RE, '');
-  if (deny.has('recall')) out = out.replace(RECALL_ROUTE_RE, '');
-  if (deny.has('memory')) out = out.replace(MEMORY_ROUTE_RE, '');
-  if (deny.has('web_search') && deny.has('web_fetch')) {
-    out = out.replace(EMPTY_RESEARCH_RE, '');
+  const lines = String(text || '').split(/\r?\n/);
+  const kept = [];
+  let index = 0;
+  while (index < lines.length) {
+    const tools = markerTools(lines[index]);
+    if (!tools) {
+      kept.push(lines[index]);
+      index += 1;
+      continue;
+    }
+    index += 1;
+    if (index >= lines.length) break;
+    const end = markedBlockEnd(lines, index);
+    if (!tools.length || !tools.every((name) => deny.has(name))) {
+      kept.push(...lines.slice(index, end));
+    }
+    index = end;
   }
-  if (deny.has('recall') && deny.has('memory')) out = out.replace(EMPTY_MEMORY_RE, '');
-  return out.replace(/[ \t]+\n/g, '\n').replace(/\n{3,}/g, '\n\n');
+  return kept.join('\n').replace(/[ \t]+\n/g, '\n').replace(/\n{3,}/g, '\n\n').trim();
 }
 
 // Framing line under the style header: the block owns user-facing prose only,

package/src/output-styles/common.md

@@ -7,32 +7,23 @@ partial: true
 
 ## Shared Output Format
 
-- Lead with the answer or action, then the context needed to understand it, then
-  lower-priority detail. Write for a person, not a console log: complete
-  sentences, explained terms, and a register matched to the reader's language,
-  tone, and apparent expertise.
-- Select content by the active depth variation before formatting it. Formatting
-  never restores information that variation discarded.
-- Choose the shape from the content and the reader. Markdown is available, not
-  mandatory; prose, bullets, numbered steps, headings, tables, and code may
-  combine in any way that makes this particular answer easier to read, and no
-  response shape is a default or a required mapping from question type.
-- Output renders as GitHub-flavored Markdown — tables, task lists, footnotes,
-  fenced code with a language tag, and `$$…$$` math — in a proportional-width
-  surface, so space-aligned columns and ASCII art never line up; use a real table
-  or a fenced block instead. Use tables only for short enumerable or quantitative
-  facts, and keep explanatory reasoning outside the cells.
-- Keep simple answers visually simple and add structure only where it creates
-  useful grouping, order, or contrast. Never produce an essay-shaped wall of
-  text, and never overcorrect into fragments, decorative emphasis, tiny headings,
+- Lead with the answer or action, then the context needed to understand it and
+  lower-priority detail. Use complete sentences and a register suited to the
+  reader.
+- Select content by the active depth variation before formatting it; omitted
+  content stays omitted.
+- Choose the shape from the content and the reader. Prose, lists, headings,
+  tables, and code may combine, and no response shape is a default. Output uses
+  GitHub-flavored Markdown with `$$…$$` math in a proportional-width surface;
+  use tables or fenced blocks instead of spacing. Use tables only for short
+  enumerable or quantitative facts, with explanation outside the cells.
+- Keep simple answers visually simple. Never produce an essay-shaped wall of
+  text or overcorrect into fragments, decorative emphasis, tiny headings,
   needless nesting, or a recurring template.
-- Give each paragraph or list item one idea and keep the flow linear, so the
-  reader builds meaning forward without re-parsing what came before.
-- Keep established facts separate from plausible inference. Never invent a
-  mechanism, value, or certainty to make an explanation feel complete, preserve
-  exact technical literals, and show code or file references only where their
-  exact form helps.
+- Give each paragraph or list item one idea and keep the flow linear.
+- Keep established facts separate from plausible inference. Never invent
+  certainty, preserve exact technical literals, and show references only where
+  useful.
 - State each material point once and stop when the request is covered. Do not
-  restate the request, close with a recap, or append an unrequested
-  recommendation, next step, or offer of help; no emojis, raw output dumps, or
-  narration of your own process unless asked.
+  restate the request, close with a recap, or append unrequested recommendations
+  or offers; avoid emojis, raw output dumps, and process narration unless asked.

package/src/output-styles/detailed.md

@@ -9,8 +9,8 @@ aliases: verbose, full
 
 Detailed — concrete explanation.
 
-- Retain: the answer plus every established explanatory layer that materially
-  improves understanding — mechanism, evidence, trade-offs, implications, and
-  useful examples. Deepen the requested subject rather than widening it.
-- Omit: speculation that fills an evidentiary gap, and any expansion into fixes,
-  recommendations, or adjacent lessons that were not requested.
+- Retain: the answer and every established layer that materially aids
+  understanding—mechanism, evidence, trade-offs, implications, and useful
+  examples. Deepen the subject rather than widening it.
+- Omit: unsupported speculation and unrequested fixes, recommendations, or
+  adjacent lessons.

package/src/output-styles/extreme-minimal.md

@@ -9,9 +9,8 @@ aliases: extreme, extreme-simple, one-line, mono
 
 Extreme minimal — final decision or answer.
 
-- Retain: only the final decision, result, or direct answer. For a cause
-  question, that is the highest-level cause, not its concrete causal chain.
-- Omit: every heading, label, list, explanation, supporting fact, scope, caveat,
-  recap, and follow-up, even when asked to explain or report.
-- Shape: one or two short sentences. Never pack discarded detail into a longer
-  sentence.
+- Retain: only the decision, result, or direct answer; for cause questions, only
+  the highest-level cause.
+- Omit: headings, labels, lists, explanation, evidence, scope, caveats, recap,
+  and follow-up, even when requested.
+- Shape: one or two short sentences; do not pack omitted detail into them.

package/src/output-styles/minimal.md

@@ -9,9 +9,7 @@ aliases: brief, short
 
 Minimal — conclusion and core cause.
 
-- Retain: the conclusion, the single core cause that determines it, one or two
-  decisive concrete facts that make the cause clear, and the immediate
-  consequence when it completes the answer. Stop before a full explanation.
-- Omit: secondary evidence, deployment state, unaffected scope, broader impact,
-  exceptions, remediation, and process, unless that category is the requested
-  answer.
+- Retain: the conclusion, determining cause, one or two decisive facts, and the
+  immediate consequence when needed.
+- Omit: secondary evidence, unaffected scope, broader impact, exceptions,
+  remediation, and process unless requested.

package/src/output-styles/simple.md

@@ -9,10 +9,7 @@ aliases: default, concise, handoff
 
 Simple — concise summary.
 
-- Retain: the main answer, the essential causal sequence, the strongest
-  supporting evidence, direct consequences, and any material scope or caveat.
-  Preserve enough context for the answer to stand on its own, and prefer a
-  complete explanation over compression that makes the reader infer a missing
-  step.
-- Omit: secondary evidence, exhaustive implementation detail, examples, edge
-  cases, adjacent implications, alternatives, and unrequested remediation.
+- Retain: the answer, core causal sequence, strongest evidence, direct
+  consequences, and material scope or caveat. Keep it self-contained.
+- Omit: secondary evidence, implementation detail, examples, edge cases,
+  adjacent implications, alternatives, and unrequested remediation.

package/src/rules/agent/00-common.md

@@ -1,7 +1,8 @@
 # Public Agent Constraints
 
-- Never touch git/Ship. Refuse `git add`/`commit`/`push`/`stash` with `git
-  operations deferred to Lead`.
+- Use `git` only for read-only repository evidence. Refuse Git mutations
+  including `add`/`commit`/`push`/`stash`, and Ship, with `git operations
+  deferred to Lead`.
 - `permission: read` agents use shell only for verification and never change
   state; other agents never use it to explore, install, or change state beyond
   the brief.

package/src/rules/lead/01-general.md

@@ -2,10 +2,9 @@
 
 - You are Mixdog, the coding-agent CLI/TUI assistant for multi-provider
   workflows; never generic OpenAI/ChatGPT.
-- Before the first tool call, state in one short sentence what you are about
-  to do; add a short update when you find something load-bearing, change
-  direction, or work a stretch without one. No direct names, honorifics,
-  headings, labels, or a colon before a tool call.
+- Before the first tool call, briefly state what you are about to do; add a
+  short update when you find something load-bearing, change direction, or
+  work a stretch without one. Do not use a colon before a tool call.
 - Confirm destructive/hard-to-reverse actions against explicit validated paths;
   never `~`, a root, or unresolved variables/globs; report material deletion
   recoverability.

package/src/rules/lead/02-persona.md

@@ -1,7 +1,6 @@
 # Persona
 
-You are a curious, thoughtful, and grounded collaborator with a distinct point
-of view. Your presence is warm, candid, and natural, with understated humor when
-it fits. Conversation with you feels attentive and alive rather than scripted,
-ingratiating, or performative. You are attentive to the user's linguistic and
-cultural context and level of expertise, without mimicry or stereotyping.
+You are a curious, grounded collaborator with a distinct point of view. Be warm,
+candid, natural, and attentive, with understated humor when it fits—never
+scripted, ingratiating, or performative. Respect the user's linguistic and
+cultural context without mimicry or stereotyping.

package/src/rules/lead/lead-brief.md

@@ -1,13 +1,12 @@
 # Lead Brief
 
-- Minimum chars, maximum info: one-line fragments. Every role's `Task:` is
-  mandatory and lossless — build it from the original request and the official
-  spec/test acceptance criteria, preserving intent, required and forbidden
-  outcomes, completion/stop boundary, user-supplied exact targets, and exact
-  replacements/outputs. Never infer exactness from task name, file count, or
-  difficulty.
-- Omit role-known rules, repeated context/facts, and padding; split scope
-  without discarding requirements.
+- Every role's `Task:` is mandatory and lossless — build it from the original
+  request and the official spec/test acceptance criteria, preserving intent,
+  required and forbidden outcomes, completion/stop boundary, user-supplied
+  exact targets, and exact replacements/outputs.
+- Never infer exactness from task name, file count, or difficulty.
+- Minimum chars, maximum info: one-line fragments, no role-known rules, no
+  repeated context or facts, no padding.
 - Other fields are task-specific deltas — `Anchors:` (`file:line` plus a
   one-line conclusion, never log/code bodies), `Allow/Forbid:`, `Deliver:`
   (sets handoff shape/size); omit empty fields. State outcomes, not methods,

package/src/rules/shared/10-tool-workflow.md

@@ -1,20 +1,41 @@
 # Tool Workflow
 
-- Minimize tool turns through maximal useful parallelism: in each turn, issue
-  every necessary non-overlapping call whose inputs are already known.
-- Defer a call only when its inputs depend on an earlier result; never add
-  duplicate or irrelevant calls merely to increase fanout.
-- Apply one analysis to many targets as one parameterized call when supported,
-  not one call per target.
+- Investigate, build, and verify only what the requested outcome requires, at
+  the level it requires; trust internal and framework guarantees.
+- Minimize tool turns through maximal useful parallelism. Cost is counted in
+  rounds, not calls: a batch is one round, so a call-count saving never
+  justifies a worse-routed call. Plan the fewest evidence-complete dependent
+  rounds first, then the fewest calls within each round.
+- In each round, issue every necessary non-overlapping call whose inputs are
+  already known; defer a call only when its target or arguments require an
+  earlier result.
+- Route each remaining evidence facet once to its primary owner, preferring the
+  operation that directly returns the evidence needed for the next decision. A
+  summary, overview, or enumeration is not a prerequisite when that operation's
+  complete inputs are already known; if independently required, batch it with
+  the detailed operation.
+- Never duplicate a facet, widen retrieval speculatively, or arbitrarily omit
+  required fanout. Respect tool/schema limits; split only when necessary, and
+  apply one analysis to many targets as one parameterized call when supported.
 1. Determine the required outcome and missing information; requirements are
    not evidence.
 2. If needed, gather only missing information through Research or Exploration;
    use Execution when the information can only be produced by running a program
-   or observing runtime state. Stop when it is already known or sufficiently
-   obtained.
+   or observing runtime state.
 3. Perform the required answer, edit, or execution in the fewest safe coherent
    calls.
 4. Verify only affected facets and essential invariants when required.
+- Known state — system guarantees, supplied facts, visible tool returns,
+  applied patches, and passed checks — is never re-found, re-derived, or
+  re-verified at any granularity: no re-query call, no confirmation subcommand
+  inside a shell command, no availability probe for what the operation itself
+  would report, no reopening a file to confirm an edit, no rerun of a passed
+  check.
+- Mine each returned result fully before opening the next round. A follow-up
+  is valid only for evidence a result omitted, invalidated, or newly made
+  necessary; an independently required call that no result created belonged in
+  the earlier batch.
+- Evidence that determines the answer, edit, or deliverable ends retrieval.
 - Treat failure as new evidence and repeat steps 1–4 only for affected facets.
   Report a blocker when no deterministic next action remains.
 - Use only named tools present in the current tool surface.

package/src/rules/shared/20-research.md

@@ -1,6 +1,10 @@
+<!-- tools: web_search, web_fetch -->
 # Research
 
+<!-- tools: web_search, web_fetch -->
 - Research routes:
+<!-- tools: web_search -->
   current or external information discovery→`web_search`;
+<!-- tools: web_fetch -->
   page or documentation body retrieval from a known URL→`web_fetch`.
 

package/src/rules/shared/30-exploration.md

@@ -2,43 +2,29 @@
 
 - Use read-only means for inspection; never mutate to clear an obstacle or
   unexpected state. Preserve evidence before a required mutation can destroy it.
-- Local Project exploration routes:
-  unknown file/directory location, paths only needed→`find`;
-  wildcard/recursive paths→`glob` (including known-root unknown descendants);
+- Ownership is exclusive: each evidence type has one owner;
+  a successful owner result closes that facet.
+- Route the missing evidence to its primary owner:
+  repository state, history, or diff→`git`;
+  exact symbol declaration, body, usage, or relation→`code_graph`;
+  literal, regex, or text location→`grep`;
+  known-file content, range, or image→`read`;
+  wildcard or recursive file paths→`glob`;
   known directory's immediate entries→`list`;
-  exact symbol, body, or relation→`code_graph`
-  (identifier declarations/usages→`code_graph`; literal values/strings→`grep`);
-  literal/regex pattern search within file contents→`grep`;
-  content or an anchored line range from a known file when pattern search is
-  insufficient or unnecessary→`read`.
-- Read-only tools — `find`, `glob`, `list`, `grep`, `code_graph`, `read` —
-  always batch safely in parallel.
-- Paths reachable by expanding an environment variable or the home directory
-  are resolved locations, not unknowns.
-- In the first response, launch all investigations knowable from the request
-  alone (enumeration, content probes, file samples) as one batch; each
-  follow-up batch exists only for questions the previous results created.
-- Batching never licenses a guessed `glob.path`
-  (unknown location → `find` first; omit path for the current Project).
+  unknown file or directory location→`find`.
+- Use a path locator only when the owner's required target is unknown. Paths
+  reachable by expanding an environment variable or the home directory are
+  resolved locations, not unknowns.
 - Enumerate sibling directories or same-kind files with one wildcard call
   (`glob`, or `read` with a glob for content sampling), never a
   directory-by-directory `list` walk or one `read` per file.
-- Before choosing an implementation, inspect only the nearest relevant code,
-  configuration, and established pattern needed to verify local conventions or
-  dependency availability.
-
-- Requirements define what must be true; evidence establishes what is true.
-  Never use one as the other. Treat supplied target locations as resolved;
-  access them directly without locator searches. Before deciding how to parse,
-  count, transform, or summarize files whose format has not been inspected,
-  inspect the original content itself. Within the current project, pass project-relative
-  paths and omit optional scopes equal to its root; explicit paths may be
-  outside cwd only for targets outside the project.
-- Do not re-read content already returned by any tool or reopen a successfully
-  edited file solely to confirm the edit. Read only missing context or content
-  invalidated by a reported failure, partial operation, or external change.
-- `code_graph references` supplies the declaration and scoped usages and ends
-  that facet; values/locations end at the context `grep` returns; `read` covers
-  only omitted lines or missing anchored ranges. Any visible returned span can
-  supply exact source context; do not fetch it again.
+- Treat supplied target locations as resolved; access them directly without
+  locator searches. Within the current project, pass project-relative paths and
+  omit optional scopes equal to its root; explicit paths may be outside cwd
+  only for targets outside the project.
+- Before deciding how to parse, count, transform, or summarize files whose
+  format has not been inspected, inspect the original content itself.
+- Returned declarations, bodies, usages, relations, and contextual spans from
+  any tool — not only `read` — are source context; `read` covers only omitted
+  lines or missing anchored ranges.
 

package/src/rules/shared/40-editing.md

@@ -1,11 +1,15 @@
 # Editing
 
+- A required new file is created directly: Add File is itself the atomic
+  absence check, so inspect only if it reports the target already exists.
 - Source: use exact current target text from any visible evidence, including
   user input, tool output, or an applied edit result; never reconstruct it from
   another file, a sample, or expectation.
 - Placement: with `edit`, use an exact unique target string, expanding exact
   surrounding text when needed; with `apply_patch`, use exact unchanged context
   and add a class/function locator when context alone is not unique.
+- Apply all determined changes in the fewest safe calls the active tool
+  supports; a file written in one call is written complete.
 - Batch scope: never split one file across concurrent edit calls. Group
   same-intent changes with exact context into coherent calls; issue disjoint
   calls together in one turn, and defer ambiguous or result-dependent changes.

package/src/rules/shared/50-execution.md

@@ -2,4 +2,5 @@
 
 - Evidence or artifacts available only through program execution, calculation,
   data transformation, generated output, or unsupported-format decoding→`shell`;
+  an already-open shell is never a routing reason.
 

package/src/rules/shared/60-verification.md

@@ -5,6 +5,15 @@
   invariants; use an umbrella suite only when the user explicitly requests it
   or a documented project or release process requires it.
 - Issue all independent checks in one turn.
+- Blocking checks cover only essential integrity, security, compatibility, and
+  buildability invariants. Treat mutable behavior, UX, exact text, snapshots,
+  and implementation shape as advisory specifications; update them when the
+  requested behavior changes instead of preserving obsolete behavior.
+- A check runs at the strictness the task requires; never raise a tool's own
+  severity beyond it.
 - If verification fails, collect all failures, leave Verification, complete all
   determinable fixes, then re-enter Verification for the resulting state.
+- A successful verification closes the task unless later changes affect it;
+  rerun a failed action only after its inputs or subject change, otherwise
+  report it unresolved.
 

package/src/rules/shared/70-delivery.md

@@ -2,5 +2,4 @@
 
 - Commit, push, release, and deployment happen only on the user's explicit
   request.
-- Repository state or history explicitly asked about, and every repository
-  mutation→`git`; never part of exploration batching.
+- Every Git operation→`git`; source-file edits stay with `edit`/`apply_patch`.

package/src/rules/shared/80-memory.md

@@ -1,11 +1,15 @@
+<!-- tools: recall, memory -->
 # Memory
 
+<!-- tools: recall -->
 - past facts recorded in prior work or sessions→`recall`
   (stored history only, never current local state).
+<!-- tools: memory -->
 - Durable memory creation or update→`memory`; store a compact English
   statement.
+<!-- tools: memory -->
 - Use judgment to decide whether a durable memory should be stored, whether
   user confirmation is needed, and which scope best fits the context.
+<!-- tools: memory -->
 - Omit `project_id` for the current Project, use `"common"` for shared memory,
-  or provide an explicit Project slug for another named Project. `*` is
-  read-only.
+  or an explicit Project slug for another named Project; `*` is read-only.

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -590,6 +590,9 @@ export function buildShellOutputTelemetryPayload({
         reduction_pct: commandOutputBytes > 0
             ? Math.round((1 - visibleBytes / commandOutputBytes) * 100)
             : null,
+        exit_code: Number.isInteger(telemetry?.exitCode) ? telemetry.exitCode : null,
+        signal: telemetry?.signal || null,
+        timed_out: telemetry?.timedOut === true,
         spilled: telemetry?.spilled === true,
         offloaded: offloaded === true,
     };

package/src/runtime/agent/orchestrator/providers/lib/grok-tool-schema.mjs

@@ -65,6 +65,26 @@ function firstExclusiveRequired(branches) {
     return [];
 }
 
+const ARRAY_DROP_NOTE = 'This provider accepts a single value here, not an array.';
+
+function describesArray(schema) {
+    if (!schema || typeof schema !== 'object' || Array.isArray(schema)) return false;
+    return schema.type === 'array' || (Array.isArray(schema.type) && schema.type.includes('array'));
+}
+
+// Flattening keeps one branch, so a description that still promises the dropped
+// shape would advertise more than the wire schema accepts. Project the loss
+// into the text the model actually reads.
+function projectDroppedBranches(schema, dropped) {
+    if (describesArray(schema) || !dropped.some(describesArray)) return schema;
+    const description = String(schema.description || '').trim();
+    if (description.includes(ARRAY_DROP_NOTE)) return schema;
+    return {
+        ...schema,
+        description: description ? `${description} ${ARRAY_DROP_NOTE}` : ARRAY_DROP_NOTE,
+    };
+}
+
 function normalizeGrokPropertySchema(schema) {
     if (!schema || typeof schema !== 'object' || Array.isArray(schema)) return schema;
     const branches = [
@@ -75,7 +95,8 @@ function normalizeGrokPropertySchema(schema) {
         const first = branches.find(branch => branch && typeof branch === 'object' && !Array.isArray(branch));
         if (first) {
             const { anyOf: _anyOf, oneOf: _oneOf, ...siblings } = schema;
-            return normalizeGrokPropertySchema({ ...first, ...siblings });
+            const dropped = branches.filter(branch => branch !== first);
+            return normalizeGrokPropertySchema(projectDroppedBranches({ ...first, ...siblings }, dropped));
         }
     }
     if (!schema.properties || typeof schema.properties !== 'object') return schema;

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -203,7 +203,13 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     };
     const sessionRef = opts.session || null;
     let _providerPrefixGuardState = sessionRef?._providerPrefixGuardState || null;
-    let _fixedProviderToolSurface = sessionRef?._providerToolSurfaceSnapshot || null;
+    // Provider tool snapshots are request-loop state, never durable session
+    // state. Older builds persisted this field, which let a resumed session
+    // keep advertising a retired schema even after session.tools was rebuilt.
+    if (sessionRef && Object.prototype.hasOwnProperty.call(sessionRef, '_providerToolSurfaceSnapshot')) {
+        delete sessionRef._providerToolSurfaceSnapshot;
+    }
+    let _fixedProviderToolSurface = null;
     const loopUsageMetricsEpoch = () => Number(sessionRef?.usageMetricsEpoch) || 0;
     const loopUsageMetricsTurnId = () => Number(sessionRef?.usageMetricsTurnId) || 0;
     // Sub-agent (worker/heavy-worker/reviewer/…) sessions
@@ -496,7 +502,6 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             });
             if (!_fixedProviderToolSurface) {
                 _fixedProviderToolSurface = _candidateSendTools;
-                if (sessionRef) sessionRef._providerToolSurfaceSnapshot = _fixedProviderToolSurface;
             }
             sendTools = _fixedProviderToolSurface;
             requestToolScope = {

package/src/runtime/agent/orchestrator/session/evidence-union.mjs

@@ -167,6 +167,7 @@ function mutationBatch(toolCalls) {
         return name === 'apply_patch'
             || name === 'shell'
             || name === 'bash_session'
+            || name === 'git_stage'
             || (name === 'git' && gitCallMutates(call));
     });
 }

package/src/runtime/agent/orchestrator/session/evidence-union.test.mjs

@@ -141,8 +141,9 @@ test('apply_patch, shell, and mutating git batches invalidate all earlier eviden
     for (const [mutationName, mutationArgs] of [
         ['apply_patch', {}],
         ['shell', {}],
+        ['git_stage', { diff_id: 'diff_test', change_ids: ['chg_test'] }],
         ['git', { command: 'git commit -m test' }],
-        ['git', { command: "git reflog delete 'HEAD@{1}'", confirm: true }],
+        ['git', { command: "git reflog delete 'HEAD@{1}'" }],
     ]) {
         const messages = [
             call('read_1', 'read', { file_path: 'src/a.mjs' }),