mixdog 0.9.15 → 0.9.17

package/scripts/tool-smoke.mjs

@@ -42,6 +42,7 @@ import { mergeSessionRowsIntoGlobal } from '../src/runtime/memory/lib/memory-ses
 import { TOOL_DEFS as SEARCH_TOOL_DEFS } from '../src/runtime/search/tool-defs.mjs';
 import { TOOL_DEFS as CHANNEL_TOOL_DEFS } from '../src/runtime/channels/tool-defs.mjs';
 import { AGENT_OWNER } from '../src/runtime/agent/orchestrator/agent-owner.mjs';
+import { recursiveWrapperToolNameForPublicAgent } from '../src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs';
 import { composeSystemPrompt } from '../src/runtime/agent/orchestrator/context/collect.mjs';
 import { setInternalToolsProvider } from '../src/runtime/agent/orchestrator/internal-tools.mjs';
 import { prepareAgentSession } from '../src/runtime/agent/orchestrator/agent-runtime/session-builder.mjs';
@@ -386,7 +387,7 @@ assertOk('glob explicit src', explicitSrcGlobOut, /src[\\/].*engine\.mjs/i);
 
 const globPathOnlyOut = await executeBuiltinTool('glob', {
   path: 'scripts',
-  head_limit: 8,
+  head_limit: 200,
 }, root);
 assertOk('glob path-only default *', globPathOnlyOut, /tool-smoke\.mjs/i);
 
@@ -398,8 +399,8 @@ const grepNoPatternGlobOut = await executeBuiltinTool('grep', {
 assertOk('grep without pattern routes to glob', grepNoPatternGlobOut, /tool-smoke\.mjs/i);
 
 const grepManyPatterns = [
-  ...Array.from({ length: 20 }, (_, i) => `__tool_smoke_miss_${i}__`),
   'tool-smoke',
+  ...Array.from({ length: 20 }, (_, i) => `__tool_smoke_miss_${i}__`),
 ];
 const grepManyPatternsOut = await executeBuiltinTool('grep', {
   pattern: grepManyPatterns,
@@ -407,12 +408,12 @@ const grepManyPatternsOut = await executeBuiltinTool('grep', {
   glob: '*.mjs',
   head_limit: 5,
 }, root);
-if (/exceeds the 20-pattern cap/i.test(String(grepManyPatternsOut))) {
-  throw new Error(`grep should chunk >20 patterns instead of error:\n${grepManyPatternsOut.slice(0, 400)}`);
+if (/exceeds the \d+-pattern cap/i.test(String(grepManyPatternsOut))) {
+  throw new Error(`grep should truncate oversized pattern[] instead of error:\n${grepManyPatternsOut.slice(0, 400)}`);
 }
-assertOk('grep >20 pattern chunk merge', grepManyPatternsOut, /tool-smoke\.mjs/i);
-if (!/\[pattern set split into 2 chunks\]/.test(String(grepManyPatternsOut))) {
-  throw new Error(`grep >20 patterns should emit chunk advisory:\n${grepManyPatternsOut.slice(0, 400)}`);
+assertOk('grep >10 pattern cap keeps first patterns', grepManyPatternsOut, /tool-smoke\.mjs/i);
+if (!/\[capped at 10 of 21 patterns\]/.test(String(grepManyPatternsOut))) {
+  throw new Error(`grep >10 patterns should emit cap note:\n${grepManyPatternsOut.slice(0, 400)}`);
 }
 
 function grepCountTotalMatches(body) {
@@ -431,9 +432,8 @@ if (singleCountTotal == null || singleCountTotal < 1) {
 }
 
 const grepCountOverlapPatterns = [
-  ...Array.from({ length: 19 }, (_, i) => `__count_overlap_a_${i}__`),
   'assertOk',
-  ...Array.from({ length: 19 }, (_, i) => `__count_overlap_b_${i}__`),
+  ...Array.from({ length: 8 }, (_, i) => `__count_overlap_a_${i}__`),
   'assertOk',
 ];
 const grepCountOverlapOut = await executeBuiltinTool('grep', {
@@ -444,36 +444,37 @@ const grepCountOverlapOut = await executeBuiltinTool('grep', {
 const overlapCountTotal = grepCountTotalMatches(grepCountOverlapOut);
 if (overlapCountTotal !== singleCountTotal) {
   throw new Error(
-    `chunked count must not double-count overlapping lines (single=${singleCountTotal} overlap=${overlapCountTotal}):\n${grepCountOverlapOut.slice(0, 600)}`,
+    `multi-pattern count must not double-count overlapping lines (single=${singleCountTotal} overlap=${overlapCountTotal}):\n${grepCountOverlapOut.slice(0, 600)}`,
   );
 }
 
 const grepChunkContextPatterns = [
-  ...Array.from({ length: 20 }, (_, i) => `__ctx_chunk_miss_${i}__`),
   'grepCountTotalMatches',
+  ...Array.from({ length: 20 }, (_, i) => `__ctx_chunk_miss_${i}__`),
 ];
 const grepChunkContextOut = await executeBuiltinTool('grep', {
   pattern: grepChunkContextPatterns,
-  path: 'scripts/tool-smoke.mjs',
+  path: 'scripts',
+  glob: 'tool-smoke.mjs',
   '-C': 1,
   head_limit: 30,
 }, root);
-if (!/\[pattern set split into 2 chunks\]/.test(String(grepChunkContextOut))) {
-  throw new Error(`chunked -C grep should split patterns:\n${grepChunkContextOut.slice(0, 500)}`);
+if (!/\[capped at 10 of 21 patterns\]/.test(String(grepChunkContextOut))) {
+  throw new Error(`oversized -C pattern[] should emit cap note:\n${grepChunkContextOut.slice(0, 500)}`);
 }
 if (!/tool-smoke\.mjs:\d+:/.test(String(grepChunkContextOut))) {
-  throw new Error(`chunked -C must emit path-prefixed match lines:\n${grepChunkContextOut.slice(0, 800)}`);
+  throw new Error(`capped -C must emit path-prefixed match lines:\n${grepChunkContextOut.slice(0, 800)}`);
 }
 if (!/tool-smoke\.mjs-\d+-/.test(String(grepChunkContextOut))) {
-  throw new Error(`chunked -C must keep path-prefixed context lines:\n${grepChunkContextOut.slice(0, 800)}`);
+  throw new Error(`capped -C must keep path-prefixed context lines:\n${grepChunkContextOut.slice(0, 800)}`);
 }
 const ctxBodyLines = String(grepChunkContextOut).split('\n').filter((l) => l && !/^\[/.test(l) && !/^\(no matches\)/.test(l));
 const orphanLineOnlyContext = ctxBodyLines.some((l) => /^\d+-/.test(l));
 if (orphanLineOnlyContext) {
-  throw new Error(`chunked -C must not leave line-only context orphans:\n${grepChunkContextOut.slice(0, 800)}`);
+  throw new Error(`capped -C must not leave line-only context orphans:\n${grepChunkContextOut.slice(0, 800)}`);
 }
 if (!/function grepCountTotalMatches/.test(String(grepChunkContextOut))) {
-  throw new Error(`chunked -C should include match span:\n${grepChunkContextOut.slice(0, 800)}`);
+  throw new Error(`capped -C should include match span:\n${grepChunkContextOut.slice(0, 800)}`);
 }
 
 const findOut = await executeBuiltinTool('find', {
@@ -1165,12 +1166,19 @@ setInternalToolsProvider({
     if (!/Read-only retrieval role/i.test(visible) || /# environment/i.test(visible) || /git operations deferred to Lead/i.test(visible)) {
       throw new Error(`explorer hidden retrieval context should stay slim: ${visible.slice(0, 1200)}`);
     }
-    if (!/# Role: explorer/i.test(systemVisible) || /# Role: explorer/i.test(userReminderVisible) || !/one-shot locator/i.test(systemVisible)) {
+    if (!/# Role: explorer/i.test(systemVisible) || /# Role: explorer/i.test(userReminderVisible) || !/Coordinate locator/i.test(systemVisible)) {
       throw new Error(`explorer role md must ride BP2 system, not BP3 user reminder: system=${systemVisible.slice(0, 600)} user=${userReminderVisible.slice(0, 600)}`);
     }
-    const visibleBytes = Buffer.byteLength(visible, 'utf8');
-    if (visibleBytes > 1800) {
-      throw new Error(`explorer hidden retrieval context too large: ${visibleBytes} bytes`);
+    // System layers (BP1 tool policy + BP2 role md) are shared/frozen and sized
+    // elsewhere; the slimness cap guards only the per-session injected layers
+    // (BP3 user reminder etc.), so measure non-system messages only.
+    const injectedVisible = (explorerSession.messages || [])
+      .filter((m) => m?.role !== 'system')
+      .map((m) => String(m.content || ''))
+      .join('\n');
+    const injectedBytes = Buffer.byteLength(injectedVisible, 'utf8');
+    if (injectedBytes > 1800) {
+      throw new Error(`explorer hidden retrieval context too large: ${injectedBytes} bytes (injected layers only)`);
     }
   } finally {
     closeSession(explorerSession.id, 'tool-smoke');
@@ -1298,8 +1306,16 @@ setInternalToolsProvider({
     if (!fullTools.includes('explore')) {
       throw new Error(`full agent schema must expose explore: full=${fullTools.join(', ')}`);
     }
-    if (publicExploreTools.includes('explore')) {
-      throw new Error(`public explore role must not expose recursive explore tool: ${publicExploreTools.join(', ')}`);
+    // Unified-shard policy (v0.9.13): the explore wrapper stays IN the schema
+    // for every read role — including the explore agent itself — so the
+    // read-only bundle is bit-identical across roles (one cache group).
+    // Recursion is broken at call time in pre-dispatch-deny.mjs via
+    // recursiveWrapperToolNameForPublicAgent, not by schema stripping.
+    if (JSON.stringify(publicExploreTools) !== JSON.stringify(expectedReadTools)) {
+      throw new Error(`public explore role must ship the shared read-only bundle (incl. explore): expected=${expectedReadTools.join(', ')} actual=${publicExploreTools.join(', ')}`);
+    }
+    if (recursiveWrapperToolNameForPublicAgent('explore') !== 'explore') {
+      throw new Error('call-time anti-recursion must map public explore agent to its own wrapper tool');
     }
   } finally {
     closeSession(readAgentSession.id, 'tool-smoke');

package/scripts/tui-frame-harness-shim.mjs

@@ -0,0 +1,32 @@
+// Mirror of vendor/ink/build/ink.js shouldClearTerminalForFrame, with the
+// Windows branch parameterized so the harness can probe both platforms without
+// relying on process.platform. Kept byte-faithful to the source predicate so
+// the harness reflects real clear decisions.
+export function shouldClearTerminalForFrameProbe({
+  isTty, viewportRows, previousViewportRows, previousOutputHeight,
+  nextOutputHeight, isUnmounting, isWindows,
+}) {
+  if (!isTty) return false;
+  const priorViewportRows = previousViewportRows ?? viewportRows;
+  const hadPreviousFrame = previousOutputHeight > 0;
+  const wasFullscreen = previousOutputHeight >= priorViewportRows;
+  const wasOverflowing = previousOutputHeight > priorViewportRows;
+  const isOverflowing = nextOutputHeight > viewportRows;
+  const isFullscreen = nextOutputHeight >= viewportRows;
+  const isLeavingFullscreen = wasFullscreen && nextOutputHeight < viewportRows;
+  const isShrinkingAtViewport = hadPreviousFrame &&
+    nextOutputHeight < previousOutputHeight &&
+    (wasFullscreen || isFullscreen || wasOverflowing || isOverflowing);
+  const shouldClearOnUnmount = isUnmounting && wasFullscreen;
+  const viewportResized = previousViewportRows != null && previousViewportRows !== viewportRows;
+  if (isWindows && (wasFullscreen || isFullscreen) &&
+      (viewportResized || isShrinkingAtViewport || isLeavingFullscreen)) {
+    return true;
+  }
+  return (
+    wasOverflowing ||
+    (isOverflowing && hadPreviousFrame) ||
+    isLeavingFullscreen ||
+    isShrinkingAtViewport ||
+    shouldClearOnUnmount);
+}

package/scripts/tui-frame-harness.mjs

@@ -0,0 +1,306 @@
+#!/usr/bin/env node
+/**
+ * scripts/tui-frame-harness.mjs — renderer-level frame-grid evidence harness.
+ *
+ * Drives vendor/ink log-update createIncremental(fakeStream) through the SAME
+ * wrapper logic ink.js renderInteractiveFrame() applies (fullscreen detect +
+ * trailing-newline normalization + shouldClearTerminalForFrame), replays the
+ * emitted ANSI into a minimal VT grid interpreter, and asserts the absolute row
+ * of a tracked marker line (the "prompt" / "statusline") across each frame.
+ *
+ * A deviant frame = the marker's absolute row changes for a single frame then
+ * snaps back. That is the one-row-low dip reported under Windows Terminal.
+ *
+ * Run: node scripts/tui-frame-harness.mjs
+ */
+// [harness] log-update reads process.platform/WT_SESSION AT IMPORT to pick its
+// Windows-safe absolute-cursor branch. Force WT_SESSION on BEFORE importing it
+// so POSIX/CI runs exercise the same branch WT users hit. Must precede the
+// dynamic import below.
+process.env.WT_SESSION = process.env.WT_SESSION || '1';
+const { default: logUpdate } = await import('../vendor/ink/build/log-update.js');
+const { shouldClearTerminalForFrameProbe } = await import('./tui-frame-harness-shim.mjs');
+const { default: ansiEscapes } = await import('ansi-escapes');
+
+// Fail loudly if the Windows-safe branch is NOT engaged: without it the harness
+// silently tests the wrong path and reports a false pass. Probe by driving a
+// fullscreen→one-short pair through a throwaway log and asserting the branch's
+// absolute cursorTo(0,y) addressing (not a relative cursorUp walk) is emitted.
+function assertWindowsBranchEngaged() {
+  const chunks = [];
+  const fs = { write: (s) => { chunks.push(s); return true; }, isTTY: true, columns: 20, rows: 4 };
+  const log = logUpdate.create(fs, { incremental: true });
+  log.sync('a\nb\nc\nd');            // 4 lines, fullscreen, no trailing nl
+  chunks.length = 0;
+  log('a\nX\nc\nd');                 // change one middle row, still fullscreen
+  const emitted = chunks.join('');
+  // Windows-safe branch uses absolute cursorTo(0, i) => CSI <row>;1H. The POSIX
+  // relative branch uses cursorUp / cursorNextLine (CSI A / E) with no ;1H rows.
+  const hasAbsolute = /\x1b\[\d+;1H/.test(emitted);
+  if (!hasAbsolute) {
+    console.error('tui-frame-harness: FAIL — log-update Windows-safe branch NOT engaged '
+      + '(WT_SESSION/platform did not force it at import). Emitted:', JSON.stringify(emitted));
+    process.exit(1);
+  }
+}
+assertWindowsBranchEngaged();
+
+// ---- Minimal VT grid interpreter -----------------------------------------
+// Supports the escapes log-update / ink emit: cursorTo(x[,y]), cursorUp/Down/
+// NextLine, eraseLine, eraseEndLine, eraseLines(n), clearTerminal, plain text,
+// newline, SGR (ignored for geometry), hide/show cursor (ignored).
+class VT {
+  constructor(rows, cols) {
+    this.rows = rows;
+    this.cols = cols;
+    this.grid = Array.from({ length: rows }, () => '');
+    this.cx = 0;
+    this.cy = 0;
+  }
+  _clampRow() { if (this.cy < 0) this.cy = 0; if (this.cy >= this.rows) this.cy = this.rows - 1; }
+  write(data) {
+    let i = 0;
+    while (i < data.length) {
+      const ch = data[i];
+      if (ch === '\u001B') {
+        // CSI
+        if (data[i + 1] === '[') {
+          let j = i + 2;
+          let params = '';
+          while (j < data.length && /[0-9;]/.test(data[j])) { params += data[j]; j++; }
+          const cmd = data[j];
+          const nums = params.split(';').map((p) => (p === '' ? undefined : Number(p)));
+          this._csi(cmd, nums, params);
+          i = j + 1;
+          continue;
+        }
+        // other escapes (e.g. \u001B[?25l already handled via '[' path); skip 2
+        i += 1;
+        continue;
+      }
+      if (ch === '\n') { this.cy += 1; this.cx = 0; this._clampRow(); i++; continue; }
+      if (ch === '\r') { this.cx = 0; i++; continue; }
+      // printable
+      this._clampRow();
+      const row = this.grid[this.cy];
+      const padded = row.length < this.cx ? row + ' '.repeat(this.cx - row.length) : row;
+      this.grid[this.cy] = padded.slice(0, this.cx) + ch + padded.slice(this.cx + 1);
+      this.cx += 1;
+      i++;
+    }
+  }
+  _csi(cmd, nums, params) {
+    const n = nums[0];
+    switch (cmd) {
+      case 'H': case 'f': { // cursor position (1-based row;col)
+        this.cy = (nums[0] ?? 1) - 1; this.cx = (nums[1] ?? 1) - 1; this._clampRow(); break;
+      }
+      case 'A': this.cy -= (n ?? 1); this._clampRow(); break; // up
+      case 'B': this.cy += (n ?? 1); this._clampRow(); break; // down
+      case 'C': this.cx += (n ?? 1); break; // forward
+      case 'D': this.cx -= (n ?? 1); if (this.cx < 0) this.cx = 0; break; // back
+      case 'E': this.cy += (n ?? 1); this.cx = 0; this._clampRow(); break; // next line
+      case 'F': this.cy -= (n ?? 1); this.cx = 0; this._clampRow(); break; // prev line
+      case 'G': this.cx = (n ?? 1) - 1; break; // column (cursorTo(x) → \u001B[(x+1)G)
+      case 'J': { // erase display; 2 = whole screen (clearTerminal uses 2J + H)
+        if (n === 2 || n === 3) { this.grid = Array.from({ length: this.rows }, () => ''); }
+        break;
+      }
+      case 'K': { // erase line (eraseEndLine=0/none; eraseLine full = 2K)
+        if (n === undefined || n === 0) { this.grid[this.cy] = this.grid[this.cy].slice(0, this.cx); }
+        else if (n === 1) { this.grid[this.cy] = ' '.repeat(this.cx) + this.grid[this.cy].slice(this.cx); }
+        else if (n === 2) { this.grid[this.cy] = ''; }
+        break;
+      }
+      // SGR (m), hide/show cursor (h/l), etc. — no geometry effect
+      default: break;
+    }
+  }
+  markerRow(marker) {
+    for (let r = 0; r < this.rows; r++) {
+      if (this.grid[r].includes(marker)) return r;
+    }
+    return -1;
+  }
+  dump() {
+    return this.grid.map((r, i) => `${String(i).padStart(2)}|${r}`).join('\n');
+  }
+}
+
+// ---- Wrapper mirroring ink.js renderInteractiveFrame ----------------------
+function makeDriver({ rows, cols, isWindows }) {
+  const chunks = [];
+  const fakeStream = { write: (s) => { chunks.push(s); return true; }, isTTY: true, columns: cols, rows };
+  // Force the incremental renderer's Windows branch by faking env/platform is
+  // out of scope here; log-update reads process.platform/WT_SESSION at import.
+  const log = logUpdate.create(fakeStream, { incremental: true });
+  const vt = new VT(rows, cols);
+  let lastOutput = '';
+  let lastOutputHeight = 0;
+  let lastViewportRows = rows;
+  let lastOneShortPadded = false;
+  const commit = (output) => {
+    chunks.length = 0;
+    // [FAITHFUL] outputHeight = output.get().height = Output.height = the
+    // Yoga-computed ROOT height (renderer.js L45). The App pins the outer
+    // column to height=resizeState.rows, so a steady frame reports height=rows.
+    // BUT when the App's row accounting is off by one for a single commit
+    // (a reclaimed panel/hint row not yet refilled), the root lays out at
+    // rows-1 and outputHeight==rows-1. Model the height as the caller states
+    // it via a marker: the frame string's real line count is authoritative
+    // here because we construct each frame to physically carry `heightRows`
+    // lines. So derive it from the string.
+    const lineCount = output.split('\n').length;
+    let outputHeight = output === '' ? 0 : lineCount;
+    // Mirror ink.js (post-fix): an exactly-one-row-short frame following a
+    // fullscreen frame is padded with a leading blank line so the bottom
+    // cluster stays at its steady rows and the fullscreen path stays engaged.
+    const wasFullscreenFrame = lastOutputHeight >= lastViewportRows && lastOutputHeight > 0;
+    // Mirror ink.js guard exactly: Windows-like only + one-commit transient.
+    const isExactlyOneRowShort = isWindows && outputHeight === rows - 1
+      && wasFullscreenFrame && !lastOneShortPadded;
+    if (isExactlyOneRowShort) {
+      output = '\n' + output;
+      outputHeight = rows;
+      lastOneShortPadded = true;
+    } else {
+      lastOneShortPadded = false;
+    }
+    const isFullscreen = outputHeight >= rows;
+    let outputToRender = isFullscreen ? output : output + '\n';
+    if (isFullscreen && outputToRender.endsWith('\n')) outputToRender += '\u001B[0m';
+    const clearDecision = shouldClearTerminalForFrameProbe({
+      isTty: true, viewportRows: rows, previousViewportRows: lastViewportRows,
+      previousOutputHeight: lastOutputHeight, nextOutputHeight: outputHeight,
+      isUnmounting: false, isWindows,
+    });
+    if (clearDecision) {
+      fakeStream.write('\u001B[0m' + ansiEscapes.clearTerminal + outputToRender);
+      log.sync(outputToRender);
+    } else {
+      log(outputToRender);
+    }
+    for (const c of chunks) vt.write(c);
+    lastOutput = output;
+    lastOutputHeight = outputHeight;
+    lastViewportRows = rows;
+    const trailingNL = outputToRender.endsWith('\n');
+    return { outputHeight, trailingNL, clearDecision, isFullscreen };
+  };
+  return { vt, commit };
+}
+
+// ---- Scenario builders ----------------------------------------------------
+// Build an App-like frame with the prompt+statusline ALWAYS pinned to the two
+// bottom-most non-blank rows (matching App.jsx: the bottom bar never moves).
+// The App keeps total painted rows == viewport by ceding transcript rows to a
+// panel; so the prompt row is invariant whether or not the palette is open.
+// The only thing that changes between commits is: does the serialized output
+// end on a blank row (→ trailing-newline flip, fs classification flip)?
+// `bottomBlank` models a frame whose LAST painted row is blank padding.
+// `shortByOne` = the root Yoga height is rows-1 for this commit (a reclaimed
+// row that the App's accounting has NOT yet refilled). This is the documented
+// deviant: outputHeight = rows-1 < viewportRows → ink.js takes output+'\n'
+// (NON-fullscreen branch) → log-update relative cursorUp walk → one-row-low
+// dip under Windows Terminal. A steady frame (shortByOne=false) fills the
+// viewport, stays on the absolute cursorTo path, and is stable.
+function frame({ rows, cols, palette, shortByOne, heightRows }) {
+  // [FAITHFUL] App.jsx pins the bottom cluster with the outer full-height
+  // column (height=resizeState.rows) + flexShrink={0} on the bottom bar. So the
+  // Yoga root height is `rows` when accounting is correct. When a reclaimed row
+  // is momentarily unaccounted, the laid-out tree is `rows-1` tall for one
+  // commit — that is `shortByOne`. In that frame the WHOLE column (including
+  // the pinned bottom cluster) sits one physical row higher.
+  // heightRows (explicit) overrides shortByOne — lets a caller drive an
+  // arbitrary frame height (e.g. rows-3) to exercise the real leave-fullscreen
+  // shrink chain, which the boolean shortByOne cannot express.
+  const height = heightRows != null ? heightRows : (shortByOne ? rows - 1 : rows);
+  const statusRow = height - 1;
+  const promptRow = statusRow - 1;
+  const lines = [];
+  for (let r = 0; r < height; r++) {
+    if (r === statusRow) { lines.push('STATUSLINE'); continue; }
+    if (r === promptRow) { lines.push('PROMPT>'); continue; }
+    if (palette && r === promptRow - 1) { lines.push('SLASHPALETTE'); continue; }
+    lines.push(`t${r}`);
+  }
+  // Serialized string carries exactly `height` lines (no trailing newline).
+  return lines.join('\n');
+}
+
+function run() {
+  const rows = 40, cols = 120;
+  const isWindows = true;
+  console.log(`# renderer harness rows=${rows} cols=${cols} isWindows(assumed)=${isWindows}`);
+  console.log(`# NOTE: log-update Windows branch active iff process.platform===win32||WT_SESSION at import`);
+  console.log(`#       (set WT_SESSION=1 to force it on non-Windows)\n`);
+
+  // Each frame: { palette, shortByOne }. shortByOne=true is the ONE deviant
+  // commit where the App's row accounting leaves the laid-out tree one row
+  // short of the viewport (reclaimed panel/hint row not yet refilled).
+  const scenarios = [
+    { name: 'palette close, always viewport-filling (correct accounting)', seq: [
+      { palette: true,  shortByOne: false },
+      { palette: false, shortByOne: false },
+      { palette: false, shortByOne: false },
+    ]},
+    { name: 'palette close, close commit ONE ROW SHORT (deviant accounting)', seq: [
+      { palette: true,  shortByOne: false },
+      { palette: false, shortByOne: true  },  // reclaimed row unaccounted
+      { palette: false, shortByOne: false },
+    ]},
+    { name: 'prompt newline remove, transitional ONE ROW SHORT', seq: [
+      { palette: false, shortByOne: false },
+      { palette: false, shortByOne: true  },
+      { palette: false, shortByOne: false },
+    ]},
+    // Steady one-short: repeated rows-1 frames. The pad must fire ONCE then
+    // stop (lastOneShortPadded), so f2/f3 are NOT re-padded and settle at the
+    // rows-1 layout (prompt rows-3 / status rows-2) with correct clear
+    // decisions — no infinite downward shift.
+    { name: 'steady ONE ROW SHORT (repeated rows-1) — pad once, then stop', seq: [
+      { palette: false, shortByOne: false },
+      { palette: false, shortByOne: true  },
+      { palette: false, shortByOne: true  },
+      { palette: false, shortByOne: true  },
+    ]},
+    // Real leave-fullscreen shrink chain rows→rows-1→rows-3: after the padded
+    // rows-1 frame, a further shrink to rows-3 must reach the shrink/clear path
+    // (not be masked by a stale pad) and settle cleanly.
+    { name: 'real shrink chain fullscreen→rows-1→rows-3', seq: [
+      { palette: false, heightRows: 40 },
+      { palette: false, heightRows: 39 },
+      { palette: false, heightRows: 37 },
+      { palette: false, heightRows: 37 },
+    ]},
+  ];
+
+  let anyDeviant = false;
+  for (const sc of scenarios) {
+    const { vt, commit } = makeDriver({ rows, cols, isWindows });
+    const promptRows = [];
+    console.log(`## ${sc.name}`);
+    sc.seq.forEach((f, idx) => {
+      const out = frame({ rows, cols, palette: f.palette, shortByOne: f.shortByOne, heightRows: f.heightRows });
+      const info = commit(out);
+      const pRow = vt.markerRow('PROMPT>');
+      const sRow = vt.markerRow('STATUSLINE');
+      promptRows.push(pRow);
+      console.log(`  f${idx} short1=${f.shortByOne?1:0} h=${info.outputHeight} fs=${info.isFullscreen?1:0} trailNL=${info.trailingNL?1:0} clear=${info.clearDecision?1:0} promptRow=${pRow} statusRow=${sRow}`);
+    });
+    // Deviant = the prompt row BOUNCES (differs from the settled row for a
+    // transient frame then returns). A monotone shift to a new steady row
+    // (steady-one-short, real shrink) is NOT a bounce — check the LAST row is
+    // reached and held, and no interior frame differs from BOTH neighbors.
+    const settled = promptRows[promptRows.length - 1];
+    const bounce = promptRows.some((r, i) =>
+      i > 0 && i < promptRows.length - 1 &&
+      r >= 0 && r !== promptRows[i - 1] && r !== promptRows[i + 1]);
+    if (bounce) { anyDeviant = true; console.log(`  >> DEVIANT(bounce): prompt rows ${JSON.stringify(promptRows)} vs settled ${settled}`); }
+    console.log('');
+  }
+  if (!anyDeviant) console.log('# no deviant frame reproduced at renderer level for these scenarios');
+  process.exitCode = 0;
+}
+
+run();

package/src/agents/heavy-worker/AGENT.md

@@ -9,13 +9,12 @@ Bounded slices; smallest coherent change, not rewrite. Stop: unclear scope,
 growing blast radius, or Lead-only verification.
 
 EDIT-FIRST DISCIPLINE. Survey the slice with ONE batched read/grep round, then
-patch the first bounded piece — broad scope means edit incrementally, not read
-exhaustively. NEVER "one more confirming read": if an anchor is plausible, the
-next call is `apply_patch`. Repeated read-only turns without an edit = stalling;
-any runtime reminder is your cue to patch the piece you understand or report
-blocked — a blocked report is a valid completion. Self-check comes AFTER edits;
-deep verification is Lead's.
+patch the first bounded piece — edit incrementally, don't read exhaustively.
+NEVER "one more confirming read": a plausible anchor means the next call is
+`apply_patch`. Repeated read-only turns without an edit = stalling; on a
+runtime reminder, patch the piece you understand or report blocked — a valid
+completion. Self-check comes AFTER edits; deep verification is Lead's.
 
 Minimal checks + how-to-verify. Hand off outcome as fragments anchored to
-`file:line`; no narration, no report bloat.
+`file:line`; no narration or bloat.
 

package/src/agents/worker/AGENT.md

@@ -8,13 +8,12 @@ Scoped implementation agent.
 Smallest scoped change; no drive-by cleanup. Stop when done/blocked.
 
 EDIT-FIRST DISCIPLINE. Brief anchors (`file:line`) are pre-verified — trust and
-patch. No anchor: locate with AT MOST 1-2 reads, then edit. NEVER "one more
-confirming read": if you know the file and the change, the next call is
-`apply_patch`. Repeated read-only turns without an edit = stalling; any runtime
-reminder is your cue to patch now or return blocked with what's missing — a
-blocked report is a valid completion. Threshold is "plausible", not "proven";
+patch. No anchor: locate with AT MOST 1-2 reads, then edit — NEVER "one more
+confirming read"; if you know the file and the change, the next call is
+`apply_patch`. Repeated read-only turns without an edit = stalling; on a
+runtime reminder, patch now or return blocked with what's missing — a blocked
+report is a valid completion. Threshold is "plausible", not "proven";
 self-check comes AFTER the edit, and Lead/Reviewer own final verification.
 
-Hand off outcome as fragments anchored to `file:line`; no narration, no report
-bloat.
+Hand off outcome as fragments anchored to `file:line`; no narration or bloat.
 

package/src/lib/keychain-cjs.cjs

@@ -182,23 +182,40 @@ function loadKeytar() {
 function keytarSync(method, ...args) {
     loadKeytar(); // throws if not installed — before spawning child
     const { spawnSync } = require('child_process');
-    // Pass service/account/value via env to avoid shell injection entirely.
-    const env = {
-        ...process.env,
-        _KEYTAR_METHOD: method,
-        _KEYTAR_ARGS: JSON.stringify(args),
-    };
+    // Pass service/account/value via stdin (not env) to avoid shell injection
+    // and to keep secret values out of /proc/<pid>/environ on Linux.
+    // Build a minimal child env instead of spreading process.env: the parent
+    // may hold *_API_KEY secrets in its own environment, and those would
+    // otherwise be visible via /proc/<pid>/environ for the lifetime of this
+    // child. Only pass what PATH resolution / locale / the libsecret D-Bus
+    // session bridge actually need.
+    const passthroughKeys = [
+        'PATH', 'HOME', 'USER', 'LOGNAME',
+        'LANG', 'LC_ALL',
+        'TMPDIR', 'TMP', 'TEMP',
+        'DISPLAY', 'DBUS_SESSION_BUS_ADDRESS', 'XDG_RUNTIME_DIR', 'XDG_CURRENT_DESKTOP', 'XDG_DATA_DIRS',
+    ];
+    const env = { _KEYTAR_METHOD: method };
+    for (const key of passthroughKeys) {
+        if (process.env[key] !== undefined) env[key] = process.env[key];
+    }
     const script = [
         'const kt = require("keytar");',
         'const method = process.env._KEYTAR_METHOD;',
-        'const args = JSON.parse(process.env._KEYTAR_ARGS);',
-        'kt[method](...args)',
-        '  .then(v => { process.stdout.write(JSON.stringify({ ok: true, value: v })); })',
-        '  .catch(e => { process.stdout.write(JSON.stringify({ ok: false, error: e.message })); });',
+        'let input = "";',
+        'process.stdin.setEncoding("utf8");',
+        'process.stdin.on("data", (chunk) => { input += chunk; });',
+        'process.stdin.on("end", () => {',
+        '  const args = JSON.parse(input);',
+        '  kt[method](...args)',
+        '    .then(v => { process.stdout.write(JSON.stringify({ ok: true, value: v })); })',
+        '    .catch(e => { process.stdout.write(JSON.stringify({ ok: false, error: e.message })); });',
+        '});',
     ].join(' ');
     const r = spawnSync(process.execPath, ['-e', script], {
         env,
-        stdio: ['ignore', 'pipe', 'pipe'],
+        input: JSON.stringify(args),
+        stdio: ['pipe', 'pipe', 'pipe'],
         timeout: 5000,
         encoding: 'utf8',
         windowsHide: true,

package/src/lib/rules-builder.cjs

@@ -129,10 +129,10 @@ function buildProfilePreferencesContent(dataDir) {
   const profile = normalizeProfileConfig(readAgentConfig(dataDir).profile);
   const lines = [];
   if (profile.title) {
-    lines.push(`- Use "${profile.title}" when directly addressing the user (greetings, answers, questions). Do not repeat it in routine progress updates or pre-tool preambles.`);
+    lines.push(`- Use "${profile.title}" when directly addressing the user (greetings, answers, questions); do not repeat it in routine progress updates or pre-tool preambles.`);
   }
   const shell = process.platform === 'win32' ? 'powershell' : 'bash';
-  lines.push(`- Shell environment: ${shell}. When using shell, write commands and scripts in ${shell} syntax unless the user specifies otherwise. Keep commands, paths, symbols, and exact errors verbatim.`);
+  lines.push(`- Shell environment: ${shell}. Write shell commands and scripts in ${shell} syntax unless the user specifies otherwise; keep commands, paths, symbols, and exact errors verbatim.`);
   return lines.length ? `# Profile Preferences\n\n${lines.join('\n')}` : '';
 }
 
@@ -144,7 +144,7 @@ function buildLanguageSection(dataDir) {
     ? ` from system locale ${language.locale}`
     : '';
   const lines = [
-    `- Default user-facing response language${source}: ${language.prompt}. Use it for ALL user-facing prose, including pre-tool preambles, progress updates, questions, final reports, and notices. Every such message — even a single-line preamble before a tool call — MUST be written in ${language.prompt}, and in no other language. This overrides any tone implied by the output style. Switch languages only when the user writes in another language or explicitly asks you to.`,
+    `- Default user-facing response language${source}: ${language.prompt}. EVERY user-facing message — prose, pre-tool preambles (even single-line), progress updates, questions, final reports, notices — MUST be written in ${language.prompt} and no other language; this overrides any tone implied by the output style. Switch only when the user writes in another language or explicitly asks you to.`,
     `- Code identifiers, paths, commands, symbols, API names, and exact errors should remain in their original form.`,
   ];
   return `# Language\n\n${lines.join('\n')}`;
@@ -382,13 +382,9 @@ function buildAgentRoleContent({ PLUGIN_ROOT, profile = 'full' }) {
 function buildAgentRetrievalInjectionContent({ PLUGIN_ROOT }) {
   const AGENT_DIR = path.join(PLUGIN_ROOT, 'rules', 'agent');
   const core = readOptional(path.join(AGENT_DIR, '00-core.md'));
-  const parts = [
-    '# Tool Use',
-    '',
-    '- Batch independent read-only lookups in the same tool turn.',
-    '- Use code_graph for symbols/dependencies, grep for exact text, find/glob/list for files, and read only known paths/windows.',
-    '',
-  ];
+  // Full shared tool policy (01-tool.md) now ships via BP1 for retrieval
+  // roles too; no compact duplicate here.
+  const parts = [];
   if (core) parts.push(core.trim());
   parts.push('', '- Read-only retrieval role: do not edit files, run shell, or use git.');
   return parts.join('\n');