mixdog 0.9.18 → 0.9.20

package/scripts/tool-smoke.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { __applyStandaloneToolDefaultsForTest, __renderToolSearchForTest, compactToolSearchDescription, defaultDeferredToolNames, SKILL_TOOL, TOOL_SEARCH_TOOL } from '../src/mixdog-session-runtime.mjs';
+import { applyInitialDeferredToolManifestToBp1, buildDeferredToolManifest } from '../src/runtime/agent/orchestrator/context/collect.mjs';
 import { buildExplorerPrompt, EXPLORE_TOOL, MAX_FANOUT_QUERIES, normalizeExploreQueries } from '../src/standalone/explore-tool.mjs';
 import { AGENT_TOOL, createStandaloneAgent } from '../src/standalone/agent-tool.mjs';
 import { parseHeadlessRoleCommand } from '../src/app.mjs';
@@ -508,8 +509,8 @@ if (!/^read 2\b/m.test(String(readRegionBatchOut))
   || (String(readRegionBatchOut).match(/scripts\/smoke\.mjs \[full\] \[ok\]/g) || []).length < 2
   || !/1→import \{ spawnSync \}/.test(String(readRegionBatchOut))
   || !/3→import \{ fileURLToPath \}/.test(String(readRegionBatchOut))
-  || !/pass offset:2 to continue/.test(String(readRegionBatchOut))
-  || !/pass offset:4 to continue/.test(String(readRegionBatchOut))) {
+  || !/(pass offset:2 to continue|ONE window: offset:2, limit:\d+)/.test(String(readRegionBatchOut))
+  || !/(pass offset:4 to continue|ONE window: offset:4, limit:\d+)/.test(String(readRegionBatchOut))) {
   throw new Error(`read region batch must preserve both requested spans:\n${readRegionBatchOut}`);
 }
 
@@ -534,6 +535,46 @@ if (readStringifiedLineErr || readStringifiedLineArgs.path[0].offset !== 7 || re
   throw new Error(`read guard must losslessly convert legacy line/context inside stringified arrays to offset/limit: err=${readStringifiedLineErr} args=${JSON.stringify(readStringifiedLineArgs)}`);
 }
 
+// Absorb shape 1: region array + top-level offset/limit → top-level becomes
+// the default window for regions that lack their own; no hard error.
+const readRegionPlusTopLevelArgs = {
+  path: [{ path: 'scripts/smoke.mjs', offset: 3, limit: 4 }, { path: 'scripts/smoke.mjs' }],
+  offset: 0,
+  limit: 2,
+};
+const readRegionPlusTopLevelErr = validateBuiltinArgs('read', readRegionPlusTopLevelArgs);
+if (readRegionPlusTopLevelErr
+  || 'offset' in readRegionPlusTopLevelArgs || 'limit' in readRegionPlusTopLevelArgs
+  || readRegionPlusTopLevelArgs.path[0].offset !== 3 || readRegionPlusTopLevelArgs.path[0].limit !== 4
+  || readRegionPlusTopLevelArgs.path[1].offset !== 0 || readRegionPlusTopLevelArgs.path[1].limit !== 2) {
+  throw new Error(`read guard must absorb region-array + top-level offset/limit: err=${readRegionPlusTopLevelErr} args=${JSON.stringify(readRegionPlusTopLevelArgs)}`);
+}
+
+// Absorb shape 2: parallel offset/limit as JSON-stringified arrays with path[]
+// → zipped into per-file region objects (pairwise recovery), no int error.
+const readZipWindowArgs = {
+  path: ['scripts/smoke.mjs', 'scripts/smoke.mjs'],
+  offset: '[0, 5]',
+  limit: '[2, 3]',
+};
+const readZipWindowErr = validateBuiltinArgs('read', readZipWindowArgs);
+if (readZipWindowErr || !Array.isArray(readZipWindowArgs.path)
+  || readZipWindowArgs.path[0].offset !== 0 || readZipWindowArgs.path[0].limit !== 2
+  || readZipWindowArgs.path[1].offset !== 5 || readZipWindowArgs.path[1].limit !== 3
+  || 'offset' in readZipWindowArgs || 'limit' in readZipWindowArgs) {
+  throw new Error(`read guard must zip stringified offset/limit arrays onto path[]: err=${readZipWindowErr} args=${JSON.stringify(readZipWindowArgs)}`);
+}
+
+// Absorb shape 3: code_graph file/files as a JSON-stringified array → parsed to
+// a real array before lookup (dispatched into files[]).
+const cgStringifiedFileArgs = { mode: 'symbols', file: JSON.stringify(['a.mjs', 'b.mjs']) };
+const cgStringifiedFileErr = validateBuiltinArgs('code_graph', cgStringifiedFileArgs);
+if (cgStringifiedFileErr || 'file' in cgStringifiedFileArgs
+  || !Array.isArray(cgStringifiedFileArgs.files)
+  || cgStringifiedFileArgs.files[0] !== 'a.mjs' || cgStringifiedFileArgs.files[1] !== 'b.mjs') {
+  throw new Error(`code_graph guard must parse JSON-stringified file array: err=${cgStringifiedFileErr} args=${JSON.stringify(cgStringifiedFileArgs)}`);
+}
+
 const graphOut = await executeCodeGraphTool('code_graph', {
   mode: 'symbols',
   file: 'scripts/smoke.mjs',
@@ -549,6 +590,17 @@ if (!/# symbol_search executeBuiltinTool\b/.test(String(graphSymbolBatchOut)) ||
   throw new Error(`code_graph symbol_search symbols[] batch execution failed:\n${graphSymbolBatchOut}`);
 }
 
+// Absorb shape 3 (real dispatch): file as a JSON-stringified array batches per
+// file instead of hitting "file not found: [...]".
+const graphStringifiedFileOut = await executeCodeGraphTool('code_graph', {
+  mode: 'symbols',
+  file: JSON.stringify(['scripts/smoke.mjs']),
+}, root);
+if (/file not found/.test(String(graphStringifiedFileOut))
+  || !/binding|spawnSync|symbol/i.test(String(graphStringifiedFileOut))) {
+  throw new Error(`code_graph must parse JSON-stringified file array before lookup:\n${graphStringifiedFileOut}`);
+}
+
 const graphMissingFileOut = await executeCodeGraphTool('code_graph', {
   mode: 'symbols',
   file: 'src/runtime/loop.mjs',
@@ -593,6 +645,72 @@ if (!/^Error[\s:[]/.test(String(stalePatchOut)) || !/apply_patch/i.test(String(s
   throw new Error(`apply_patch stale context must return an Error result, not throw or pass:\n${stalePatchOut}`);
 }
 
+// Malformed-but-unambiguous patch openings must be absorbed (dry-run, so no
+// write). Each targets the same known-good smoke.mjs line the cases above use.
+const smokeBody = `@@
+-process.stdout.write('smoke passed ✓\\n');
++process.stdout.write('smoke passed ok\\n');
+*** End Patch
+`;
+const absorbCases = [
+  ['leading blank lines', `\n\n*** Begin Patch\n*** Update File: scripts/smoke.mjs\n${smokeBody}`],
+  ['decorated begin header', `*** Begin Patch (V4A) ***\n*** Update File: scripts/smoke.mjs\n${smokeBody}`],
+  ['bare file path opening', `*** Begin Patch\nscripts/smoke.mjs\n${smokeBody}`],
+  ['File: prefixed opening', `*** Begin Patch\nFile: scripts/smoke.mjs\n${smokeBody}`],
+  ['unified body in envelope', `*** Begin Patch\n--- scripts/smoke.mjs\n+++ scripts/smoke.mjs\n${smokeBody}`],
+];
+for (const [label, patch] of absorbCases) {
+  const out = await executePatchTool('apply_patch', { base_path: root, dry_run: true, fuzzy: false, patch }, root);
+  assertOk(`apply_patch absorbs ${label}`, out, /checked|validated|dry|OK/i);
+}
+
+const ambiguousPatchOut = await executePatchTool('apply_patch', {
+  base_path: root,
+  dry_run: true,
+  fuzzy: false,
+  patch: `*** Begin Patch\nthis line is not a valid opening\n${smokeBody}`,
+}, root);
+if (!/^Error[\s:[]/.test(String(ambiguousPatchOut)) || !/before a file header|V4A/i.test(String(ambiguousPatchOut))) {
+  throw new Error(`apply_patch must keep erroring on genuinely ambiguous openings:\n${ambiguousPatchOut}`);
+}
+
+// Unified-looking first body line but real V4A file sections appear later: the
+// envelope must NOT be stripped to unified — it stays ambiguous and errors.
+const mixedPatchOut = await executePatchTool('apply_patch', {
+  base_path: root,
+  dry_run: true,
+  fuzzy: false,
+  patch: `*** Begin Patch\n--- scripts/smoke.mjs\n*** Update File: scripts/smoke.mjs\n${smokeBody}`,
+}, root);
+if (!/^Error[\s:[]/.test(String(mixedPatchOut)) || !/before a file header|V4A/i.test(String(mixedPatchOut))) {
+  throw new Error(`apply_patch must keep erroring on mixed unified/V4A openings:\n${mixedPatchOut}`);
+}
+
+// Compacted-history placeholder guard: EVERY [mixdog compacted …] variant must
+// be rejected with the corrective message BEFORE format dispatch/salvage, both
+// as the first line and standalone mid-body (after a *** Begin Patch header).
+const compactedGuardCases = [
+  ['legacy key: prefix', '[mixdog compacted patch: 4096 chars, sha256:deadbeefdeadbeef]\n*** Begin Patch\n*** Update File: a.txt\n+x\n*** End Patch\n'],
+  ['variant key form', '[mixdog compacted patch v4a, sha256:deadbeefdeadbeef]\n*** Begin Patch\n*** Update File: a.txt\n+x\n*** End Patch\n'],
+  ['no chars/sha detail', '[mixdog compacted old_string]\n'],
+  ['mid-body standalone', '*** Begin Patch\n*** Update File: a.txt\n[mixdog compacted patch v4a, sha256:deadbeefdeadbeef]\n*** End Patch\n'],
+];
+for (const [label, patch] of compactedGuardCases) {
+  const out = await executePatchTool('apply_patch', { base_path: root, dry_run: true, fuzzy: false, patch }, root);
+  if (!/^Error[\s:[]/.test(String(out)) || !/compacted-history placeholder/i.test(String(out))) {
+    throw new Error(`apply_patch must reject compacted placeholder (${label}):\n${out}`);
+  }
+}
+// A legit unified edit whose body content mentions the literal text on a diff
+// line (+/-/space) must still parse — the guard only trips on non-diff lines.
+const compactedFalsePositiveOut = await executePatchTool('apply_patch', {
+  base_path: root,
+  dry_run: true,
+  fuzzy: false,
+  patch: `*** Begin Patch\n*** Add File: compacted-note.txt\n+[mixdog compacted patch: 10 chars, sha256:abc]\n*** End Patch\n`,
+}, root);
+assertOk('apply_patch keeps diff-line placeholder text', compactedFalsePositiveOut, /checked|validated|dry|OK/i);
+
 const shellOutPromise = executeBuiltinTool('shell', {
   command: 'node --version',
   cwd: root,
@@ -634,6 +752,33 @@ if (!/^Error[\s:[]/.test(String(shellTimeoutOut)) || !/\[timeout: 500ms\b/.test(
   throw new Error(`bash timeout must be milliseconds and classified as Error:\n${shellTimeoutOut}`);
 }
 
+// Auto-promotion: a sync foreground command still running past the (soft)
+// promotion budget is detached into a tracked background task and returns the
+// same task_id envelope as explicit async — the caller never pre-chose async.
+// Shrink the budget via MIXDOG_SHELL_AUTO_BACKGROUND_MS so the smoke stays fast.
+const _priorAutoBgBudget = process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS;
+process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS = '800';
+let shellAutoPromoteOut;
+try {
+  shellAutoPromoteOut = await executeBuiltinTool('shell', {
+    command: 'Start-Sleep -Seconds 6; Write-Output tool-smoke-autopromote-done',
+    cwd: root,
+    timeout: 30_000,
+    shell: 'powershell',
+  }, root);
+} finally {
+  if (_priorAutoBgBudget === undefined) delete process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS;
+  else process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS = _priorAutoBgBudget;
+}
+if (!/auto-backgrounded/i.test(String(shellAutoPromoteOut)) || !/task_id:\s*\S+/i.test(String(shellAutoPromoteOut))) {
+  throw new Error(`shell auto-promotion must return a background task envelope (task_id + auto-backgrounded):\n${shellAutoPromoteOut}`);
+}
+// Clean up the promoted job so it doesn't outlive the smoke as an orphan.
+const _autoPromoteTaskId = (/task_id:\s*(\S+)/i.exec(String(shellAutoPromoteOut)) || [])[1];
+if (_autoPromoteTaskId) {
+  try { await executeBuiltinTool('task', { action: 'cancel', task_id: _autoPromoteTaskId }, root); } catch {}
+}
+
 const legacyEscapedAlternationErr = validateBuiltinArgs('grep', { pattern: 'state\\.items\\.map\\|items\\.map', path: root });
 if (legacyEscapedAlternationErr) {
   throw new Error(`grep legacy \\| alternation should be accepted: ${legacyEscapedAlternationErr}`);
@@ -1217,8 +1362,10 @@ setInternalToolsProvider({
     if (workerToolNames.includes('tool_search')) {
       throw new Error(`agent session schema must not expose deferred tool_search: ${workerToolNames.join(', ')}`);
     }
-    if (workerToolNames.includes('shell')) {
-      throw new Error(`read-write agent session schema must not expose shell: ${workerToolNames.join(', ')}`);
+    for (const name of ['shell', 'task']) {
+      if (!workerToolNames.includes(name)) {
+        throw new Error(`read-write agent session schema must expose ${name} for self-verification: ${workerToolNames.join(', ')}`);
+      }
     }
     for (const name of ['skills_list', 'skill_view', 'skill_execute']) {
       if (workerToolNames.includes(name)) {
@@ -1266,7 +1413,7 @@ setInternalToolsProvider({
     const fullTools = (fullAgentSession.tools || []).map((tool) => tool?.name).filter(Boolean);
     const publicExploreTools = (publicExploreSession.tools || []).map((tool) => tool?.name).filter(Boolean);
     const expectedReadTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'explore', 'search', 'web_fetch', 'Skill'];
-    const expectedWriteTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'apply_patch', 'explore', 'search', 'web_fetch', 'Skill'];
+    const expectedWriteTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'apply_patch', 'shell', 'task', 'explore', 'search', 'web_fetch', 'Skill'];
     if (JSON.stringify(readTools) !== JSON.stringify(expectedReadTools)) {
       throw new Error(`read agent schema must be fixed allow-list: expected=${expectedReadTools.join(', ')} actual=${readTools.join(', ')}`);
     }
@@ -1276,20 +1423,17 @@ setInternalToolsProvider({
     if (readTools.includes('tool_search') || writeTools.includes('tool_search')) {
       throw new Error(`agent session fixed schemas must omit tool_search: read=${readTools.join(', ')} write=${writeTools.join(', ')}`);
     }
-    if (readTools.includes('shell') || writeTools.includes('shell')) {
-      throw new Error(`read/read-write agent schemas must omit shell: read=${readTools.join(', ')} write=${writeTools.join(', ')}`);
+    if (readTools.includes('shell')) {
+      throw new Error(`read agent schema must omit shell: read=${readTools.join(', ')}`);
     }
     for (const name of ['shell', 'apply_patch', 'task']) {
       if (readTools.includes(name)) {
         throw new Error(`read agent schema must omit non-read tool ${name}: read=${readTools.join(', ')}`);
       }
     }
-    for (const name of ['apply_patch', 'task']) {
-      if (name === 'apply_patch' && !writeTools.includes(name)) {
-        throw new Error(`read-write agent schema must preserve apply_patch: write=${writeTools.join(', ')}`);
-      }
-      if (name !== 'apply_patch' && writeTools.includes(name)) {
-        throw new Error(`read-write agent schema must omit non-edit tool ${name}: write=${writeTools.join(', ')}`);
+    for (const name of ['apply_patch', 'shell', 'task']) {
+      if (!writeTools.includes(name)) {
+        throw new Error(`read-write agent schema must preserve ${name}: write=${writeTools.join(', ')}`);
       }
     }
     for (const name of ['memory', 'recall', 'reply']) {
@@ -1334,7 +1478,7 @@ setInternalToolsProvider({
   try {
     const resumed = await resumeSession(resumeAgentSession.id, 'full');
     const resumedTools = (resumed?.tools || []).map((tool) => tool?.name).filter(Boolean);
-    const expectedWriteTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'apply_patch', 'explore', 'search', 'web_fetch', 'Skill'];
+    const expectedWriteTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'apply_patch', 'shell', 'task', 'explore', 'search', 'web_fetch', 'Skill'];
     if (JSON.stringify(resumedTools) !== JSON.stringify(expectedWriteTools)) {
       throw new Error(`resumed read-write agent schema must keep fixed allow-list: expected=${expectedWriteTools.join(', ')} actual=${resumedTools.join(', ')}`);
     }
@@ -1408,7 +1552,10 @@ setInternalToolsProvider({
       const resumed = await resumeSession(session.id, 'full');
       const resumedTools = (resumed?.tools || []).map((tool) => tool?.name).filter(Boolean);
       const expected = expectedForHiddenAgent(permission, schemaAllowedTools);
-      if (expected && (JSON.stringify(tools) !== JSON.stringify(expected) || JSON.stringify(resumedTools) !== JSON.stringify(expected))) {
+      // Order-insensitive: the session tool surface follows catalog order, while
+      // schemaAllowedTools declares an allow-set; only set equality is contractual.
+      const asSet = (list) => JSON.stringify(list.slice().sort());
+      if (expected && (asSet(tools) !== asSet(expected) || asSet(resumedTools) !== asSet(expected))) {
         throw new Error(`hidden agent ${agent} schema mismatch: expected=${expected.join(', ')} tools=${tools.join(', ')} resumed=${resumedTools.join(', ')}`);
       }
       const leaked = tools.filter((name) => hiddenBadTools.has(name) && !(expected || []).includes(name));
@@ -1522,7 +1669,7 @@ const readPathDescription = readPathSchema.description || '';
 if (!/File path/i.test(readPathDescription) || !/\{path,offset,limit\}\[\]/i.test(readPathDescription) || !/Pass arrays directly/i.test(readPathDescription) || !/legacy recovery only/i.test(readPathDescription)) {
   throw new Error('read schema must keep directory-vs-file guidance');
 }
-if (!/Dirs use list/i.test((BUILTIN_TOOLS.find((tool) => tool.name === 'read')?.description) || '')) {
+if (!/Not for directory listing/i.test((BUILTIN_TOOLS.find((tool) => tool.name === 'read')?.description) || '')) {
   throw new Error('read description must keep directory-vs-file guidance');
 }
 const readTool = BUILTIN_TOOLS.find((tool) => tool.name === 'read');
@@ -1533,7 +1680,7 @@ const readArrayItemAnyOf = readArraySchema?.items?.anyOf || [];
 if (!readArrayItemAnyOf.some((entry) => entry?.type === 'object' && entry?.properties?.offset && entry?.properties?.limit)) {
   throw new Error('read schema must expose array-of-region objects for batched spans');
 }
-if (/line\+context/i.test(readDescription) || !/numeric offset\+limit/i.test(readDescription) || !/Batch paths\/regions as real arrays/i.test(readDescription) || !/grep content_with_context or code_graph anchors/i.test(readDescription)) {
+if (/line\+context/i.test(readDescription) || !/numeric offset\+limit/i.test(readDescription) || !/Batch paths\/regions as real arrays/i.test(readDescription)) {
   throw new Error('read description must expose offset/limit as the single window form');
 }
 if (readProps.line || readProps.context) {
@@ -1567,15 +1714,25 @@ if (/line\/context/i.test(JSON.stringify(readTool?.inputSchema || {}))) {
   // session's provider/model in place, or a mid-conversation model/provider
   // switch silently forces a full prompt-cache rewrite (seen as a
   // promptΔ spike + cache_ratio=0% turn in session-bench).
-  const runtimeSrc = readFileSync(resolve(root, 'src/mixdog-session-runtime.mjs'), 'utf8');
+  // God-file splits move implementation into module dirs; scan facade + all
+  // split modules so these source-text guards survive refactors.
+  const readMjsSources = (rel) => {
+    const abs = resolve(root, rel);
+    if (rel.endsWith('.mjs')) return readFileSync(abs, 'utf8');
+    return readdirSync(abs, { recursive: true })
+      .filter((f) => String(f).endsWith('.mjs'))
+      .map((f) => readFileSync(resolve(abs, String(f)), 'utf8'))
+      .join('\n');
+  };
+  const runtimeSrc = [readMjsSources('src/mixdog-session-runtime.mjs'), readMjsSources('src/session-runtime')].join('\n');
   const setRouteBlock = runtimeSrc.match(/async setRoute\(next, options = \{\}\) \{[\s\S]*?\n    \},\n/)?.[0] || '';
   if (!/applyToCurrentSession = options\?\.applyToCurrentSession === true/.test(setRouteBlock)) {
     throw new Error('setRoute must default applyToCurrentSession to false (model changes apply to the next session only)');
   }
-  if (!/if \(!applyToCurrentSession\)/.test(setRouteBlock) || !/return route;/.test(setRouteBlock)) {
+  if (!/if \(!applyToCurrentSession\)/.test(setRouteBlock) || !/return (?:route|getRoute\(\));/.test(setRouteBlock)) {
     throw new Error('setRoute must early-return before touching the live session when applyToCurrentSession is false');
   }
-  const engineSrc = readFileSync(resolve(root, 'src/tui/engine.mjs'), 'utf8');
+  const engineSrc = [readMjsSources('src/tui/engine.mjs'), readMjsSources('src/tui/engine')].join('\n');
   if (/setRoute\(\{ model: m \}, \{ applyToCurrentSession: true \}\)/.test(engineSrc)) {
     throw new Error('TUI setModel must not force applyToCurrentSession:true (model changes must apply to the next session only)');
   }
@@ -1596,9 +1753,6 @@ if (codeGraphSymbolSearchErr) {
 if (!/code structure\/flow/i.test(codeGraphDescription) || !/symbols\/references\/calls\/deps/i.test(codeGraphDescription)) {
   throw new Error('code_graph description must stay structure-oriented and name its symbol modes');
 }
-if (!/before text grep/i.test(codeGraphDescription)) {
-  throw new Error('code_graph description must steer symbol/caller lookups to structure lookup before grep');
-}
 if (!/repo-local/i.test(codeGraphDescription) || !/NOT web search|not web/i.test(codeGraphDescription)) {
   throw new Error('code_graph description must mark itself repo-local (not web search)');
 }
@@ -1700,16 +1854,23 @@ const toolSearchSession = {
   deferredToolCatalog: smokeCatalog.slice(),
   deferredSelectedTools: [...fullDefaults],
 };
-const searchOnlyResult = JSON.parse(__renderToolSearchForTest({ query: 'shell' }, toolSearchSession, 'full'));
-for (const name of ['shell', 'task']) {
-  if (!searchOnlyResult.selected?.tools?.added?.includes(name)) {
-    throw new Error(`tool_search high-confidence query should auto-load ${name}: ${JSON.stringify(searchOnlyResult.selected)}`);
-  }
+// A plain query is a case-insensitive substring filter over name+description.
+// It lists matches only — it never auto-loads or ranks.
+const listQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'shell' }, toolSearchSession, 'full'));
+if (listQueryResult.selected) {
+  throw new Error(`tool_search plain query must not auto-load: ${JSON.stringify(listQueryResult.selected)}`);
 }
-if (!searchOnlyResult.activeTools.includes('shell') || !searchOnlyResult.activeTools.includes('task')) {
-  throw new Error(`tool_search query should activate legacy selected tools: ${searchOnlyResult.activeTools.join(',')}`);
+if (!listQueryResult.matches.some((row) => row.name === 'shell')) {
+  throw new Error(`tool_search plain query should list substring matches: ${JSON.stringify(listQueryResult.matches)}`);
 }
+if (listQueryResult.activeTools.includes('shell') || (Array.isArray(listQueryResult.discoveredTools) && listQueryResult.discoveredTools.includes('shell'))) {
+  throw new Error(`tool_search plain query must not activate/discover tools: ${JSON.stringify(listQueryResult)}`);
+}
+// query "select:a,b" is the explicit query-side loader (aliases expand).
 const bulkSelectResult = JSON.parse(__renderToolSearchForTest({ query: 'select:shell,recall' }, toolSearchSession, 'full'));
+if (bulkSelectResult.selected?.mode !== 'select') {
+  throw new Error(`tool_search query-select must report select mode: ${JSON.stringify(bulkSelectResult.selected)}`);
+}
 for (const name of ['shell', 'task', 'recall']) {
   if (!bulkSelectResult.activeTools.includes(name)) {
     throw new Error(`tool_search bulk select missing ${name}: ${JSON.stringify(bulkSelectResult)}`);
@@ -1784,7 +1945,8 @@ if (nativeGrokPatchTool?.type !== 'function' || nativeGrokPatchTool?.format || n
 if (nativeGrokPatchTool.parameters?.properties?.patch?.type !== 'string') {
   throw new Error(`Grok native tool_search apply_patch must preserve patch JSON schema: ${JSON.stringify(nativeGrokPatchTool)}`);
 }
-const nativeRunQuerySession = {
+// Native query-select discovers (without mutating active schemas); aliases expand.
+const nativeSelectQuerySession = {
   tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
   deferredToolCatalog: smokeCatalog.slice(),
   deferredSelectedTools: [...fullDefaults],
@@ -1792,16 +1954,20 @@ const nativeRunQuerySession = {
   deferredProviderMode: 'native',
   deferredNativeTools: true,
 };
-const nativeRunQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'run tests' }, nativeRunQuerySession, 'full'));
-for (const name of ['shell', 'task']) {
-  if (!nativeRunQueryResult.discoveredTools.includes(name)) {
-    throw new Error(`native tool_search run/tests query should discover ${name}: ${JSON.stringify(nativeRunQueryResult)}`);
+const nativeSelectQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'select:search' }, nativeSelectQuerySession, 'full'));
+for (const name of ['search', 'web_fetch']) {
+  if (!nativeSelectQueryResult.discoveredTools.includes(name)) {
+    throw new Error(`native tool_search query-select should discover ${name}: ${JSON.stringify(nativeSelectQueryResult)}`);
   }
 }
-if (nativeRunQueryResult.activeTools.includes('shell') || nativeRunQueryResult.activeTools.includes('task')) {
-  throw new Error(`native tool_search query must not mutate active schemas: ${JSON.stringify(nativeRunQueryResult)}`);
+if (nativeSelectQueryResult.activeTools.includes('search') || nativeSelectQueryResult.activeTools.includes('web_fetch')) {
+  throw new Error(`native tool_search must not mutate active schemas: ${JSON.stringify(nativeSelectQueryResult)}`);
+}
+if (!nativeSelectQueryResult.nativeToolSearch?.toolReferences?.includes('search')) {
+  throw new Error(`native query-select must return nativeToolSearch payload: ${JSON.stringify(nativeSelectQueryResult.nativeToolSearch)}`);
 }
-const nativeWebQuerySession = {
+// A plain query never auto-loads/discovers, even on native providers.
+const nativePlainQuerySession = {
   tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
   deferredToolCatalog: smokeCatalog.slice(),
   deferredSelectedTools: [...fullDefaults],
@@ -1809,35 +1975,48 @@ const nativeWebQuerySession = {
   deferredProviderMode: 'native',
   deferredNativeTools: true,
 };
-const nativeWebQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'web docs' }, nativeWebQuerySession, 'full'));
-for (const name of ['search', 'web_fetch']) {
-  if (!nativeWebQueryResult.discoveredTools.includes(name)) {
-    throw new Error(`native tool_search web/docs query should discover ${name}: ${JSON.stringify(nativeWebQueryResult)}`);
+for (const q of ['run tests', 'web docs', 'memory previous', 'status']) {
+  const r = JSON.parse(__renderToolSearchForTest({ query: q }, nativePlainQuerySession, 'full'));
+  if (r.selected || r.discoveredTools.length) {
+    throw new Error(`native tool_search plain query "${q}" must not auto-load/discover: ${JSON.stringify(r)}`);
   }
 }
-const nativeRecallQuerySession = {
-  tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
-  deferredToolCatalog: smokeCatalog.slice(),
-  deferredSelectedTools: [...fullDefaults],
-  deferredDiscoveredTools: [],
-  deferredProviderMode: 'native',
-  deferredNativeTools: true,
+// Skill-style deferred manifest: `- name: description` lines, `<`/`>` sanitized,
+// bare names allowed, header instructs direct calls, empty pool → ''.
+const manifestText = buildDeferredToolManifest([
+  { name: 'shell', description: 'Run commands.' },
+  { name: 'search', description: 'Web <search> now.' },
+  'recall',
+]);
+if (!/<available-deferred-tools>/.test(manifestText) || !/- shell: Run commands\./.test(manifestText)) {
+  throw new Error(`deferred manifest must render "- name: description" lines: ${manifestText}`);
+}
+if (!/call any tool listed below directly/i.test(manifestText)) {
+  throw new Error(`deferred manifest must tell the model it can call listed tools directly: ${manifestText}`);
+}
+if (!/^- recall$/m.test(manifestText)) {
+  throw new Error(`deferred manifest must allow bare names without descriptions: ${manifestText}`);
+}
+if (/[<>]/.test(manifestText.replace(/<\/?available-deferred-tools>/g, ''))) {
+  throw new Error(`deferred manifest must sanitize angle brackets in descriptions: ${manifestText}`);
+}
+if (buildDeferredToolManifest([]) !== '') {
+  throw new Error('empty deferred pool must yield an empty manifest');
+}
+const bp1ManifestSession = {
+  messages: [{ role: 'system', content: 'BASE PROMPT' }],
+  deferredToolCatalog: [
+    { name: 'shell', description: 'Run commands.' },
+    { name: 'recall', description: 'Recall prior work.' },
+  ],
 };
-const nativeRecallQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'memory previous' }, nativeRecallQuerySession, 'full'));
-if (!nativeRecallQueryResult.discoveredTools.includes('recall') || nativeRecallQueryResult.discoveredTools.includes('memory')) {
-  throw new Error(`native tool_search memory previous should discover recall only: ${JSON.stringify(nativeRecallQueryResult)}`);
+applyInitialDeferredToolManifestToBp1(bp1ManifestSession, ['shell', 'recall']);
+const bp1ManifestText = bp1ManifestSession.messages[0].content;
+if (!/- shell: Run commands\./.test(bp1ManifestText) || !/- recall: Recall prior work\./.test(bp1ManifestText)) {
+  throw new Error(`BP1 deferred manifest must carry catalog descriptions: ${bp1ManifestText}`);
 }
-const ambiguousStatusSession = {
-  tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
-  deferredToolCatalog: smokeCatalog.slice(),
-  deferredSelectedTools: [...fullDefaults],
-  deferredDiscoveredTools: [],
-  deferredProviderMode: 'native',
-  deferredNativeTools: true,
-};
-const ambiguousStatusResult = JSON.parse(__renderToolSearchForTest({ query: 'status' }, ambiguousStatusSession, 'full'));
-if (ambiguousStatusResult.selected || ambiguousStatusResult.discoveredTools.length) {
-  throw new Error(`tool_search ambiguous status query must not auto-load: ${JSON.stringify(ambiguousStatusResult)}`);
+if (bp1ManifestSession.deferredToolBp1Applied !== true) {
+  throw new Error('BP1 deferred manifest injection must mark deferredToolBp1Applied');
 }
 const replyTool = CHANNEL_TOOL_DEFS.find((tool) => tool.name === 'reply');
 if (!/configured channel/i.test(replyTool?.description || '') || !/local .*paths/i.test(replyTool?.inputSchema?.properties?.files?.description || '')) {
@@ -1853,23 +2032,23 @@ const grepPathDescription = grepTool?.inputSchema?.properties?.path?.description
 const grepGlobDescription = grepTool?.inputSchema?.properties?.glob?.description || '';
 const grepOutputModeDescription = grepTool?.inputSchema?.properties?.output_mode?.description || '';
 const grepHeadLimitDescription = grepTool?.inputSchema?.properties?.head_limit?.description || '';
-if (!/synonyms in pattern\[\]/i.test(grepPatternDescription) || !/OR in ONE grep/i.test(grepPatternDescription) || !/serial rewording/i.test(grepPatternDescription) || !/equivalent repeats/i.test(grepPatternDescription) || !/Narrowest file\/dir/i.test(grepPathDescription) || !/broad scopes return paths first/i.test(grepPathDescription) || !/refine from returned paths/i.test(grepPathDescription)) {
+if (!/Array = variants in one call/i.test(grepPatternDescription) || !/Known file or dir/i.test(grepPathDescription)) {
   throw new Error('grep schema must keep compact pattern/path guidance');
 }
-if (!/same grep/i.test(grepGlobDescription) || !/no follow-up grep/i.test(grepGlobDescription) || !/equivalent scope changes/i.test(grepGlobDescription)) {
-  throw new Error('grep glob schema must steer narrowing into the same grep call');
+if (!/narrow scope/i.test(grepGlobDescription)) {
+  throw new Error('grep glob schema must describe scope narrowing');
 }
-if (!/Broad scope: files_with_matches\/count/i.test(grepOutputModeDescription) || !/Narrow scope: content_with_context/i.test(grepOutputModeDescription) || !/answer from/i.test(grepOutputModeDescription) || !/skip read/i.test(grepOutputModeDescription) || !/span is not shown/i.test(grepOutputModeDescription)) {
-  throw new Error('grep output_mode schema must steer content_with_context away from follow-up reads');
+if (!/files_with_matches\/count/i.test(grepOutputModeDescription) || !/content_with_context/i.test(grepOutputModeDescription)) {
+  throw new Error('grep output_mode schema must name its output shapes');
 }
-if (grepTool?.inputSchema?.properties?.head_limit?.minimum !== 0 || !/keep small/i.test(grepHeadLimitDescription)) {
+if (grepTool?.inputSchema?.properties?.head_limit?.minimum !== 0 || !/Max results/i.test(grepHeadLimitDescription)) {
   throw new Error('grep head_limit schema must keep locator caps explicit');
 }
 if (grepTool?.inputSchema?.properties?.type) {
   throw new Error('grep type schema must stay hidden; prefer glob for extension narrowing');
 }
-if (!/code flow before text search/i.test(codeGraphProps.mode?.description || '') || !/one anchor is enough/i.test(codeGraphProps.symbols?.description || '') || !/one call/i.test(codeGraphProps.symbols?.description || '')) {
-  throw new Error('code_graph schema fields must steer away from repeated lookup loops');
+if (!/Repo-local/i.test(codeGraphProps.mode?.description || '') || !/one call/i.test(codeGraphProps.symbols?.description || '')) {
+  throw new Error('code_graph schema fields must stay compact and repo-local');
 }
 
 const longToolSearchText = compactToolSearchDescription(`${patchDescription}\n${patchDescription}`);

package/src/agents/debugger/AGENT.md

@@ -8,7 +8,7 @@ Root-cause analysis agent.
 
 Smallest confirmed cause chain before fixes. Return likely cause, evidence
 (`file:line`), smallest next check/fix. Mark confirmed facts vs inferences;
-avoid broad speculation. Fragments only; no narration, no report bloat.
+avoid broad speculation.
 
-Converge, don't sweep: when new reads stop adding evidence, report the best
-cause chain so far — a partial/blocked report is a valid completion.
+Converge, don't sweep: when new evidence stops accruing, report the best
+cause chain so far.

package/src/agents/heavy-worker/AGENT.md

@@ -5,16 +5,13 @@ permission: read-write
 # Heavy Worker
 Broad implementation agent.
 
-Bounded slices; smallest coherent change, not rewrite. Stop: unclear scope,
-growing blast radius, or Lead-only verification.
+Bounded slices; smallest coherent change, not rewrite. Stop when scope is
+unclear or the blast radius grows.
 
-EDIT-FIRST DISCIPLINE. Survey the slice with ONE batched read/grep round, then
-patch the first bounded piece — edit incrementally, don't read exhaustively.
-NEVER "one more confirming read": a plausible anchor means the next call is
-`apply_patch`. Repeated read-only turns without an edit = stalling; on a
-runtime reminder, patch the piece you understand or report blocked — a valid
-completion. Self-check comes AFTER edits; deep verification is Lead's.
+EDIT-FIRST DISCIPLINE. Survey the slice with one batched retrieval round,
+then patch the first bounded piece — edit incrementally, don't read
+exhaustively. Repeated read-only turns without an edit = stalling; on a
+runtime reminder, patch the piece you understand or report blocked.
 
-Minimal checks + how-to-verify. Hand off outcome as fragments anchored to
-`file:line`; no narration or bloat.
+Self-verify edits with shell (targeted test/build).
 

package/src/agents/maintainer/AGENT.md

@@ -7,5 +7,4 @@ permission: read-write
 Maintenance and cleanup agent.
 
 Smallest coherent change; no scope growth. Repeated read-only turns without
-an edit = stalling; patch or return blocked — a blocked report is a valid
-completion. Hand off as fragments (`file:line`); no narration.
+an edit = stalling; patch or return blocked.

package/src/agents/reviewer/AGENT.md

@@ -8,5 +8,4 @@ Regression/risk review agent.
 
 Find actionable correctness/regression/security/verification risks. Findings
 first, severity-ordered, one line with `file:line`; skip non-risky nits. If
-clean, one line + only material residual risk. Fragments only; no narration,
-no report bloat.
+clean, one line + only material residual risk.

package/src/agents/worker/AGENT.md

@@ -7,13 +7,10 @@ Scoped implementation agent.
 
 Smallest scoped change; no drive-by cleanup. Stop when done/blocked.
 
-EDIT-FIRST DISCIPLINE. Brief anchors (`file:line`) are pre-verified — trust and
-patch. No anchor: locate with AT MOST 1-2 reads, then edit — NEVER "one more
-confirming read"; if you know the file and the change, the next call is
-`apply_patch`. Repeated read-only turns without an edit = stalling; on a
-runtime reminder, patch now or return blocked with what's missing — a blocked
-report is a valid completion. Threshold is "plausible", not "proven";
-self-check comes AFTER the edit, and Lead/Reviewer own final verification.
+EDIT-FIRST DISCIPLINE. Brief anchors (`file:line`) are pre-verified — trust
+and patch. No anchor: one locating batch, then `apply_patch`. Repeated
+read-only turns without an edit = stalling; on a runtime reminder, patch now
+or return blocked. Threshold is "plausible", not "proven".
 
-Hand off outcome as fragments anchored to `file:line`; no narration or bloat.
+Self-verify edits with shell (node --check/test).
 

package/src/defaults/agents.json

@@ -7,6 +7,7 @@
       "description": "Filesystem navigation agent invoked by the `explore` MCP tool",
       "invokedBy": "explore",
       "toolSchemaProfile": "read",
+      "schemaAllowedTools": ["grep", "find", "glob", "code_graph"],
       "kind": "retrieval",
       "permission": "read",
       "stallCap": { "idleSeconds": 240, "toolRunningSeconds": 180 }
@@ -54,6 +55,7 @@
       "description": "Scheduled-task executor invoked by scheduler tick",
       "invokedBy": "scheduler",
       "toolSchemaProfile": "read-write-search",
+      "schemaAllowedTools": ["code_graph", "find", "glob", "list", "grep", "read", "apply_patch", "search", "web_fetch"],
       "kind": "maintenance",
       "permission": "read-write",
       "inboundEvent": true,
@@ -67,6 +69,7 @@
       "description": "Webhook payload handler invoked by inbound webhook events",
       "invokedBy": "webhook",
       "toolSchemaProfile": "read-write-search",
+      "schemaAllowedTools": ["code_graph", "find", "glob", "list", "grep", "read", "apply_patch", "search", "web_fetch"],
       "kind": "maintenance",
       "permission": "read-write",
       "inboundEvent": true,

package/src/help.mjs

@@ -1,6 +1,6 @@
 import { stdout } from 'node:process';
 
-/** Help text shared by `--help` and the `/help` slash command. */
+/** Help text printed by `--help`. */
 export const HELP_LINES = [
   'mixdog — standalone mixdog CLI/TUI coding agent.',
   '',
@@ -11,16 +11,13 @@ export const HELP_LINES = [
   '  mixdog --help',
   '',
   'Slash commands (inside mixdog):',
-  '  /help              show this help',
   '  /clear             reset the conversation and clear the screen',
   '  /compact           compact older conversation context',
   '  /model <name>      switch model/preset for subsequent turns',
   '  /OutputStyle [name] show or switch Lead output style',
   '  /providers         manage provider auth and local endpoints',
   '  /agents            show available workflow agents',
-  '  /agent             manage active agents and async tasks',
-  '  /mode <name>       switch tool surface: full | readonly',
-  '  /exit              quit',
+  '  /quit              quit (aliases: /exit, /q)',
   '',
   'History: use ↑ / ↓ to recall previous inputs.',
 ];