mixdog 0.9.22 → 0.9.24

package/scripts/explore-bench-tmp.mjs

@@ -0,0 +1,17 @@
+import { runExplore } from '../src/standalone/explore-tool.mjs';
+const queries = [
+  'standalone explore tool implementation entry point',
+  'V4A patch format parsing/conversion implementation',
+  'recall memory entries persistent store (sqlite) read/query implementation',
+  'output styles: how style definitions are loaded and applied at session runtime',
+  'Discord backend outbound message send implementation',
+  'shell command destructive/danger policy scan before execution',
+  'where does mixdog store per-user data and sessions on this machine (out of repo)',
+  'channel runtime crash logging write path',
+];
+const t0 = Date.now();
+const res = await runExplore({ query: queries, cwd: 'C:/Project/mixdog' }, { callerCwd: 'C:/Project/mixdog' });
+console.log('BATCH_ELAPSED_MS', Date.now() - t0);
+const txt = res.content?.[0]?.text || '';
+console.log('FAILED_COUNT', (txt.match(/EXPLORATION_FAILED/g) || []).length);
+process.exit(0);

package/scripts/find-fuzzy-hidden-test.mjs

@@ -0,0 +1,145 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fuzzyRank } from '../src/runtime/agent/orchestrator/tools/builtin/fuzzy-match.mjs';
+import { executeFuzzyFindTool } from '../src/runtime/agent/orchestrator/tools/builtin/list-tool.mjs';
+import { runRg } from '../src/runtime/agent/orchestrator/tools/builtin/rg-runner.mjs';
+
+// ── fuzzyRank score floor ────────────────────────────────────────────────
+
+test('fuzzyRank keeps an exact basename/substring hit and drops scattered noise', () => {
+    const items = [
+        { path: '.mixdog/data/tool-events.log' },
+        // subsequence-only junk: the query chars appear in order but scattered
+        // mid-word across dirs, no contiguity or word boundaries.
+        { path: 'pgadmin/xtx/oxoxl/exvxexnxtx/sxlxoxg/records.dat' },
+    ];
+    const ranked = fuzzyRank('tool-events.log', items);
+    assert.ok(ranked.length >= 1, 'the real file must survive the floor');
+    assert.equal(ranked[0].item.path, '.mixdog/data/tool-events.log');
+    assert.ok(
+        !ranked.some((r) => r.item.path.startsWith('pgadmin/')),
+        'scattered subsequence junk must be filtered out',
+    );
+});
+
+test('fuzzyRank floor drops a purely scattered subsequence but keeps a substring', () => {
+    const strong = { path: 'src/abcdef.txt' };
+    const junk = { path: 'xax/xbxcx/xdxexfx/z.bin' };
+    const ranked = fuzzyRank('abcdef', [strong, junk]);
+    assert.deepEqual(ranked.map((r) => r.item.path), ['src/abcdef.txt']);
+});
+
+// ── hidden-directory discovery via the find tool ─────────────────────────
+
+function makeRepo() {
+    const root = mkdtempSync(join(tmpdir(), 'mixdog-find-hidden-'));
+    mkdirSync(join(root, '.mixdog', 'data'), { recursive: true });
+    writeFileSync(join(root, '.mixdog', 'data', 'tool-events.log'), 'x\n');
+    mkdirSync(join(root, 'src'), { recursive: true });
+    writeFileSync(join(root, 'src', 'unrelated.txt'), 'x\n');
+    // .git noise must stay pruned even with hidden default true.
+    mkdirSync(join(root, '.git'), { recursive: true });
+    writeFileSync(join(root, '.git', 'tool-events.log'), 'x\n');
+    return root;
+}
+
+test('find surfaces a file under a dot-directory top-ranked (hidden default true)', async () => {
+    const root = makeRepo();
+    try {
+        const out = await executeFuzzyFindTool({ query: 'tool-events.log' }, root);
+        const lines = out.split('\n').filter(Boolean);
+        assert.ok(lines.length >= 1, `expected a hit, got: ${out}`);
+        assert.equal(lines[0], '.mixdog/data/tool-events.log');
+        assert.ok(!out.includes('.git/'), '.git must stay pruned as noise');
+    } finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+
+test('find hidden:false skips dot-directories', async () => {
+    const root = makeRepo();
+    try {
+        const out = await executeFuzzyFindTool({ query: 'tool-events.log', hidden: false }, root);
+        assert.ok(!out.includes('.mixdog'), `hidden:false must not descend dot-dirs: ${out}`);
+    } finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+
+// ── narrowed-pass merge / dedup backstop ─────────────────────────────────
+
+test('exact-name hit survives among many decoys and is not duplicated', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'mixdog-find-merge-'));
+    try {
+        // A deep exact-name target plus a pile of unrelated decoys. The target
+        // matches both the broad enumeration and the query-narrowed pass, so it
+        // exercises the merge+dedup path.
+        mkdirSync(join(root, 'deep', 'nested', 'here'), { recursive: true });
+        writeFileSync(join(root, 'deep', 'nested', 'here', 'tool-events.log'), 'x\n');
+        mkdirSync(join(root, 'noise'), { recursive: true });
+        for (let i = 0; i < 200; i++) {
+            writeFileSync(join(root, 'noise', `decoy-${i}.bin`), 'x\n');
+        }
+        const out = await executeFuzzyFindTool({ query: 'tool-events.log' }, root);
+        const lines = out.split('\n').filter(Boolean);
+        assert.equal(lines[0], 'deep/nested/here/tool-events.log');
+        const hits = lines.filter((l) => l === 'deep/nested/here/tool-events.log');
+        assert.equal(hits.length, 1, `merge must dedup, got ${hits.length}: ${out}`);
+    } finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+
+// ── truncation warning surfaces when the broad pass reports .truncated ────
+
+test('truncated broad enumeration emits a visible warning, still ranks the exact hit, and is not cached', async () => {
+    const root = makeRepo();
+    try {
+        // Test-only seam: wrap the real runRg so the BROAD pass (the one without
+        // `--iglob`) reports truncation via the boxed-String contract the tool
+        // relies on (.truncated=true), while the narrowed pass is left intact.
+        // Production options never carry __runRg, so the real path is unchanged.
+        const truncatingRunRg = async (argsList, execOptions) => {
+            const out = await runRg(argsList, execOptions);
+            if (argsList.includes('--iglob')) return out; // narrowed backstop unchanged
+            const boxed = new String(String(out));
+            boxed.truncated = true;
+            return boxed;
+        };
+        const out = await executeFuzzyFindTool(
+            { query: 'tool-events.log' }, root, { __runRg: truncatingRunRg },
+        );
+        assert.ok(out.includes('[warning]'), `truncated broad pass must warn: ${out}`);
+        assert.ok(out.includes('truncated at 20MB cap'), `warning text must surface: ${out}`);
+        const lines = out.split('\n').filter(Boolean);
+        assert.equal(lines[0], '.mixdog/data/tool-events.log', 'exact hit must still rank first');
+        // Not cached: a normal follow-up run (no injected truncation) must NOT
+        // return the warning — proving the truncated result was never cached.
+        const out2 = await executeFuzzyFindTool({ query: 'tool-events.log' }, root);
+        assert.ok(!out2.includes('[warning]'), `truncated result must not be cached/served: ${out2}`);
+    } finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+
+// ── narrowed backstop treats the query as a literal (glob metachars) ──────
+
+test('a query with glob metachars still gets the narrowed backstop', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'mixdog-find-glob-'));
+    try {
+        // "[slug].tsx" contains a character-class metachar; a raw *[slug].tsx*
+        // iglob would match one of s/l/u/g, not the literal filename. The tool
+        // must escape it so the exact-name file is still surfaced.
+        mkdirSync(join(root, 'app'), { recursive: true });
+        writeFileSync(join(root, 'app', '[slug].tsx'), 'x\n');
+        writeFileSync(join(root, 'app', 'slug.tsx'), 'x\n'); // class-match decoy
+        const out = await executeFuzzyFindTool({ query: '[slug].tsx' }, root);
+        const lines = out.split('\n').filter(Boolean);
+        assert.ok(lines.includes('app/[slug].tsx'), `literal metachar hit must surface: ${out}`);
+    } finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/scripts/mcp-grace-deferred-test.mjs

@@ -0,0 +1,149 @@
+// Regression tests for turn-time deferred-manifest construction (claude-code
+// style). An MCP server that finishes its handshake BETWEEN session-create and
+// the user's FIRST send is folded — on the first turn, synchronously, with no
+// boot await — into the INITIAL <available-deferred-tools> manifest (BP1) and
+// pre-marked announced, so the first-turn tool-catalog reconcile emits NO late
+// <system-reminder> for it. A server that connects AFTER the first turn keeps
+// the append-only late-reminder path. Unit-style: exercise the tool-catalog
+// exports directly (no runtime, no spawn) the way session-turn-api/runtime-core
+// wire them.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    applyDeferredToolSurface,
+    refreshInitialDeferredMcpSurface,
+    reconcileDeferredMcpToolCatalog,
+} from '../src/session-runtime/tool-catalog.mjs';
+
+function baseSession() {
+    return {
+        provider: 'legacy',
+        tools: [{ name: 'read', description: 'read a file' }, { name: 'grep', description: 'search' }],
+        messages: [{ role: 'system', content: 'BASE PROMPT' }],
+    };
+}
+
+// A freshly-created session: the create-time surface is baked WITHOUT any MCP
+// (server still mid-handshake at create). `shell` is a deferred (non-active)
+// standalone tool so BP1 carries a manifest block even before MCP arrives.
+function createdSession() {
+    const session = baseSession();
+    applyDeferredToolSurface(session, 'full', [{ name: 'shell', description: 'run a command' }], { provider: 'legacy' });
+    return session;
+}
+
+function systemContent(session) {
+    return session.messages.find((m) => m.role === 'system').content;
+}
+
+const mcpTool = { name: 'mcp__unity__get_scene', description: 'Return the active Unity scene graph.' };
+const mcpTool2 = { name: 'mcp__unity__run_tests', description: 'Run the Unity test runner.' };
+
+// Mirror the session-turn-api first-turn gate: refresh runs ONCE, only for a
+// session flagged fresh (deferredInitialRefreshPending) at create; a resumed
+// session (reloaded transcript, flag absent) takes the late-reconcile path and
+// its already-baked BP1 is never rebuilt or re-announced.
+function firstTurnGate(session, liveMcp) {
+    if (session.deferredInitialRefreshPending) {
+        session.deferredInitialRefreshPending = false;
+        return refreshInitialDeferredMcpSurface(session, liveMcp) ? 'refreshed' : 'refresh-noop';
+    }
+    return 'late';
+}
+
+test('MCP connecting between session-create and first send lands in the INITIAL manifest, not a late reminder', () => {
+    const session = createdSession();
+    assert.ok(!systemContent(session).includes('mcp__unity__get_scene'), 'MCP absent from create-time BP1');
+
+    // First-turn refresh: the live registry now includes the connected server.
+    const changed = refreshInitialDeferredMcpSurface(session, [mcpTool]);
+    assert.equal(changed, true, 'first-turn refresh folded the newly-connected MCP tool');
+
+    const sys = systemContent(session);
+    assert.ok(sys.includes('<available-deferred-tools>'), 'manifest block present');
+    assert.ok(sys.includes('mcp__unity__get_scene'), 'MCP tool in the INITIAL manifest');
+    assert.ok(session.deferredAnnouncedTools.includes('mcp__unity__get_scene'), 'MCP tool pre-marked announced');
+
+    let enqueued = null;
+    const result = reconcileDeferredMcpToolCatalog(session, [mcpTool], {
+        enqueue: (text) => { enqueued = text; return true; },
+    });
+    assert.equal(result, null, 'no late-tool announcement for a first-turn-folded tool');
+    assert.equal(enqueued, null, 'nothing enqueued for a first-turn-folded tool');
+});
+
+test('an MCP server connecting AFTER the first turn is still announced via the late reminder', () => {
+    const session = createdSession();
+    // First turn: no MCP connected yet — nothing to fold.
+    assert.equal(refreshInitialDeferredMcpSurface(session, []), false, 'no live MCP => first-turn no-op');
+    assert.ok(!(session.deferredAnnouncedTools || []).includes('mcp__unity__get_scene'), 'MCP not pre-announced');
+
+    // A later turn: the server has since connected → late path fires.
+    let enqueued = null;
+    const result = reconcileDeferredMcpToolCatalog(session, [mcpTool], {
+        enqueue: (text) => { enqueued = text; return true; },
+    });
+    assert.deepEqual(result, ['mcp__unity__get_scene'], 'late tool announced');
+    assert.ok(enqueued && enqueued.includes('mcp__unity__get_scene'), 'late reminder enqueued');
+    assert.ok(enqueued.includes('connected after this session started'), 'reminder carries the late-tool sentinel');
+});
+
+test('recreated session (MCP already connected at create) seeds its manifest, no late re-announce', () => {
+    // Recreate/reset path: createCurrentSession folds the live MCP tools into the
+    // surface at create time, so a cwd-change recreate seeds its BP1 directly and
+    // never needs the first-turn refresh.
+    const session = baseSession();
+    applyDeferredToolSurface(session, 'full', [{ name: 'shell', description: 'run a command' }, mcpTool], { provider: 'legacy' });
+    assert.ok(systemContent(session).includes('mcp__unity__get_scene'), 'MCP in recreated BP1');
+    assert.ok(session.deferredAnnouncedTools.includes('mcp__unity__get_scene'), 'recreated MCP pre-marked announced');
+
+    let enqueued = null;
+    const result = reconcileDeferredMcpToolCatalog(session, [mcpTool], {
+        enqueue: (text) => { enqueued = text; return true; },
+    });
+    assert.equal(result, null, 'no late announcement on recreate');
+    assert.equal(enqueued, null, 'nothing enqueued on recreate');
+});
+
+test('first-turn refresh is idempotent: a re-render with no new MCP is a no-op and keeps ONE manifest block', () => {
+    const session = createdSession();
+    assert.equal(refreshInitialDeferredMcpSurface(session, [mcpTool]), true, 'first fold applies');
+    const once = systemContent(session);
+    assert.equal(refreshInitialDeferredMcpSurface(session, [mcpTool]), false, 'no genuinely-new MCP => no-op');
+    const twice = systemContent(session);
+    assert.equal(once, twice, 'BP1 byte-identical on re-render');
+    assert.equal((twice.match(/<available-deferred-tools>/g) || []).length, 1, 'exactly one manifest block (no duplicate)');
+});
+
+test('a second newly-connected MCP tool re-renders BP1 in place (both listed, still one block)', () => {
+    const session = createdSession();
+    refreshInitialDeferredMcpSurface(session, [mcpTool]);
+    assert.equal(refreshInitialDeferredMcpSurface(session, [mcpTool, mcpTool2]), true, 're-fold applies the new tool');
+    const sys = systemContent(session);
+    assert.ok(sys.includes('mcp__unity__get_scene') && sys.includes('mcp__unity__run_tests'), 'both MCP tools listed');
+    assert.equal((sys.match(/<available-deferred-tools>/g) || []).length, 1, 'still exactly one block (rebuilt in place)');
+    assert.ok(session.deferredAnnouncedTools.includes('mcp__unity__run_tests'), 'the new tool is pre-announced too');
+});
+
+test('a resumed session (no fresh flag, prior baked BP1) is NOT refreshed on its next turn', () => {
+    // A prior run baked BP1 with the MCP tool; resume reloads that transcript.
+    const session = baseSession();
+    applyDeferredToolSurface(session, 'full', [{ name: 'shell', description: 'run a command' }, mcpTool], { provider: 'legacy' });
+    const before = systemContent(session);
+    const announcedBefore = [...session.deferredAnnouncedTools];
+    // Resume path never sets the per-session fresh flag.
+    assert.equal(session.deferredInitialRefreshPending, undefined, 'resumed session carries no fresh flag');
+    const route = firstTurnGate(session, [mcpTool, mcpTool2]);
+    assert.equal(route, 'late', 'resumed session takes the late-reconcile path, not the initial refresh');
+    assert.equal(systemContent(session), before, 'BP1 untouched on resume (no rebuild)');
+    assert.deepEqual([...session.deferredAnnouncedTools], announcedBefore, 'announced set unchanged on resume');
+});
+
+test('a fresh session (flagged) is refreshed exactly once, then falls to the late path', () => {
+    const session = createdSession();
+    session.deferredInitialRefreshPending = true;
+    assert.equal(firstTurnGate(session, [mcpTool]), 'refreshed', 'fresh session refreshes on its first turn');
+    assert.equal(session.deferredInitialRefreshPending, false, 'fresh flag consumed (one-shot)');
+    assert.ok(session.deferredAnnouncedTools.includes('mcp__unity__get_scene'), 'first-turn MCP pre-announced');
+    assert.equal(firstTurnGate(session, [mcpTool2]), 'late', 'second turn no longer refreshes');
+});

package/scripts/statusline-quota-hysteresis-test.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { acceptQuotaSnapshot } from '../src/ui/statusline.mjs';
+
+// Monotonic hysteresis for the 5H/7D usage segment: once a value has rendered,
+// an OLDER shared-cache snapshot (written by another mixdog instance) must not
+// displace it, but a NEWER one — or confirmed own-instance live data — must.
+test('older shared-cache snapshot is rejected, newer is accepted', () => {
+  const displayedOwnLive = { segments: ['5H 12%'], asOf: 2000, owned: true };
+
+  // Another instance overwrites the shared cache with an OLDER snapshot →
+  // metricsMatch flips false, source alternates to that unowned older snapshot.
+  assert.equal(
+    acceptQuotaSnapshot(displayedOwnLive, { asOf: 1000, owned: false }),
+    false,
+    'older unowned snapshot must not displace displayed own-live value',
+  );
+
+  // A strictly newer shared snapshot is allowed to advance the value.
+  assert.equal(
+    acceptQuotaSnapshot(displayedOwnLive, { asOf: 3000, owned: false }),
+    true,
+    'newer snapshot must replace the displayed value',
+  );
+});
+
+test('own-instance live data always wins; empty timestamps preserve prior behavior', () => {
+  const displayedShared = { segments: ['5H 12%'], asOf: 5000, owned: false };
+  // Own-instance live data replaces even an apparently newer shared snapshot.
+  assert.equal(acceptQuotaSnapshot(displayedShared, { asOf: 1, owned: true }), true);
+  // Nothing displayed yet → accept.
+  assert.equal(acceptQuotaSnapshot(undefined, { asOf: 1000, owned: false }), true);
+  // No comparable timestamps → accept (byte-for-byte prior behavior).
+  assert.equal(acceptQuotaSnapshot({ asOf: 0, owned: true }, { asOf: 0, owned: false }), true);
+  // Shared→shared same asOf → accept (idempotent refresh).
+  assert.equal(acceptQuotaSnapshot({ asOf: 2000, owned: false }, { asOf: 2000, owned: false }), true);
+});

package/scripts/tool-smoke.mjs

@@ -906,7 +906,7 @@ const fullDefaults = defaultDeferredToolNames(smokeCatalog, 'full');
 if (fullDefaults.size !== 10) {
   throw new Error(`full default surface should stay 10 tools, got ${fullDefaults.size}: ${[...fullDefaults].join(', ')}`);
 }
-for (const name of ['read', 'code_graph', 'grep', 'find', 'glob', 'list', 'apply_patch', 'explore', 'Skill', 'tool_search']) {
+for (const name of ['read', 'code_graph', 'grep', 'find', 'glob', 'list', 'apply_patch', 'explore', 'Skill', 'load_tool']) {
   assertHas(fullDefaults, name);
 }
 for (const name of ['shell', 'task', 'agent', 'recall', 'search', 'web_fetch', 'cwd']) {
@@ -917,7 +917,7 @@ const leadDefaults = defaultDeferredToolNames(smokeCatalog, 'lead');
 if (leadDefaults.size !== 16) {
   throw new Error(`lead default surface should stay 16 tools for this static catalog, got ${leadDefaults.size}: ${[...leadDefaults].join(', ')}`);
 }
-for (const name of ['read', 'code_graph', 'grep', 'find', 'glob', 'list', 'shell', 'task', 'apply_patch', 'explore', 'agent', 'recall', 'search', 'web_fetch', 'Skill', 'tool_search']) {
+for (const name of ['read', 'code_graph', 'grep', 'find', 'glob', 'list', 'shell', 'task', 'apply_patch', 'explore', 'agent', 'recall', 'search', 'web_fetch', 'Skill', 'load_tool']) {
   assertHas(leadDefaults, name);
 }
 if (TOOL_SEARCH_TOOL.annotations?.agentHidden !== true) {
@@ -943,7 +943,7 @@ for (const [name, cap] of [
   ['recall', 2400],
   ['search', 3200],
   ['web_fetch', 900],
-  ['tool_search', 900],
+  ['load_tool', 900],
 ]) {
   const tool = smokeCatalog.find((item) => item?.name === name);
   const size = toolSchemaSize(tool);
@@ -954,7 +954,7 @@ const readonlyDefaults = defaultDeferredToolNames(smokeCatalog, 'readonly');
 if (readonlyDefaults.size !== 9) {
   throw new Error(`readonly default surface should stay 9 tools, got ${readonlyDefaults.size}: ${[...readonlyDefaults].join(', ')}`);
 }
-for (const name of ['read', 'code_graph', 'grep', 'find', 'glob', 'list', 'explore', 'Skill', 'tool_search']) {
+for (const name of ['read', 'code_graph', 'grep', 'find', 'glob', 'list', 'explore', 'Skill', 'load_tool']) {
   assertHas(readonlyDefaults, name);
 }
 for (const name of ['apply_patch', 'agent', 'shell']) {
@@ -1050,32 +1050,28 @@ const prevChannelSingleton = process.env.MIXDOG_CHANNEL_SINGLETON;
 const prevChannelWorkerProcess = process.env.MIXDOG_CHANNEL_WORKER_PROCESS;
 const prevRuntimeRoot = process.env.MIXDOG_RUNTIME_ROOT;
 const prevEnvOut = process.env.SMOKE_CHANNEL_ENV_OUT;
+const prevDaemonEntry = process.env.MIXDOG_CHANNEL_DAEMON_ENTRY;
 try {
-  const entry = join(channelWorkerTmp, 'entry.mjs');
+  // Daemon-mode worker env coverage: start() spawn-or-attaches the machine
+  // -global daemon (the stub daemon entry — no Discord token) instead of
+  // forking `entry`, so assert the flags on the SPAWNED DAEMON's env (the stub
+  // dumps them to SMOKE_CHANNEL_ENV_OUT). The old fork-path env assertion died
+  // with the fork path itself; full flip/attach coverage lives in
+  // scripts/channel-daemon-smoke.mjs.
+  const stubEntry = join(root, 'scripts', 'channel-daemon-stub.mjs');
   const dataDir = join(channelWorkerTmp, 'data');
   const runtimeDir = join(channelWorkerTmp, 'runtime');
   const envOut = join(channelWorkerTmp, 'env.json');
   mkdirSync(dataDir, { recursive: true });
   mkdirSync(runtimeDir, { recursive: true });
-  writeFileSync(entry, `
-import { writeFileSync } from 'node:fs';
-writeFileSync(process.env.SMOKE_CHANNEL_ENV_OUT, JSON.stringify({
-  cliOwned: process.env.MIXDOG_CLI_OWNED,
-  daemon: process.env.MIXDOG_CHANNEL_DAEMON,
-}));
-process.send?.({ type: 'ready' });
-process.on('message', (msg) => {
-  if (msg?.type === 'shutdown') process.exit(0);
-});
-setInterval(() => {}, 10000);
-`);
   process.env.MIXDOG_CHANNEL_DAEMON = '1';
   process.env.MIXDOG_CHANNEL_SINGLETON = '1';
   process.env.MIXDOG_CHANNEL_WORKER_PROCESS = '1';
   process.env.MIXDOG_RUNTIME_ROOT = runtimeDir;
   process.env.SMOKE_CHANNEL_ENV_OUT = envOut;
+  process.env.MIXDOG_CHANNEL_DAEMON_ENTRY = stubEntry;
   channelEnvWorker = createStandaloneChannelWorker({
-    entry,
+    entry: stubEntry,
     rootDir: root,
     dataDir,
     cwd: root,
@@ -1100,6 +1096,11 @@ setInterval(() => {}, 10000);
   else process.env.MIXDOG_RUNTIME_ROOT = prevRuntimeRoot;
   if (prevEnvOut == null) delete process.env.SMOKE_CHANNEL_ENV_OUT;
   else process.env.SMOKE_CHANNEL_ENV_OUT = prevEnvOut;
+  if (prevDaemonEntry == null) delete process.env.MIXDOG_CHANNEL_DAEMON_ENTRY;
+  else process.env.MIXDOG_CHANNEL_DAEMON_ENTRY = prevDaemonEntry;
+  // Detach only ends OUR attachment; the stub daemon self-shuts after its
+  // client-grace window. Give it that window before deleting its tmp root.
+  await new Promise((resolveWait) => setTimeout(resolveWait, 700));
   rmSync(channelWorkerTmp, { recursive: true, force: true });
 }
 
@@ -1191,10 +1192,10 @@ if (EXPLORE_TOOL.annotations?.agentHidden === true) {
   }
 }
 const exploreProps = EXPLORE_TOOL.inputSchema?.properties || {};
-if (!/Repo anchor locator/i.test(EXPLORE_TOOL.description || '') || !/broad\/uncertain/i.test(EXPLORE_TOOL.description || '') || !/independent targets/i.test(EXPLORE_TOOL.description || '') || (EXPLORE_TOOL.description || '').length > 90) {
-  throw new Error('explore description must stay compact and anchor-oriented');
+if (!/broad\/uncertain/i.test(EXPLORE_TOOL.description || '') || !/machine-wide/i.test(EXPLORE_TOOL.description || '') || !/independent targets/i.test(EXPLORE_TOOL.description || '') || (EXPLORE_TOOL.description || '').length > 600) {
+  throw new Error('explore description must keep the locator + facet fan-out contract');
 }
-if (!/Narrow locator query/i.test(exploreProps.query?.description || '') || !/independent targets/i.test(exploreProps.query?.description || '') || !/Project\/root/i.test(exploreProps.cwd?.description || '')) {
+if (!/Narrow locator query/i.test(exploreProps.query?.description || '') || !/independent facets/i.test(exploreProps.query?.description || '') || !/Project\/root/i.test(exploreProps.cwd?.description || '')) {
   throw new Error('explore schema must stay compact and preserve query/cwd shape');
 }
 const normalizedExplore = normalizeExploreQueries('["where is model selection?","  ","which file owns agent async?"]');
@@ -1359,8 +1360,8 @@ setInternalToolsProvider({
       throw new Error(`agent context must not inject environment reminder: ${visible.slice(0, 1200)}`);
     }
     const workerToolNames = (workerSession.tools || []).map((tool) => tool?.name).filter(Boolean);
-    if (workerToolNames.includes('tool_search')) {
-      throw new Error(`agent session schema must not expose deferred tool_search: ${workerToolNames.join(', ')}`);
+    if (workerToolNames.includes('load_tool')) {
+      throw new Error(`agent session schema must not expose deferred load_tool: ${workerToolNames.join(', ')}`);
     }
     for (const name of ['shell', 'task']) {
       if (!workerToolNames.includes(name)) {
@@ -1412,7 +1413,11 @@ setInternalToolsProvider({
     const writeTools = (writeAgentSession.tools || []).map((tool) => tool?.name).filter(Boolean);
     const fullTools = (fullAgentSession.tools || []).map((tool) => tool?.name).filter(Boolean);
     const publicExploreTools = (publicExploreSession.tools || []).map((tool) => tool?.name).filter(Boolean);
-    const expectedReadTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'explore', 'search', 'web_fetch', 'Skill'];
+    // Read-role AGENT sessions carry shell/task so review/debug agents can run
+    // their own verification (build/test); the plain readonly preset (public
+    // explore role) still omits them.
+    const expectedReadTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'shell', 'task', 'explore', 'search', 'web_fetch', 'Skill'];
+    const expectedPublicReadTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'explore', 'search', 'web_fetch', 'Skill'];
     const expectedWriteTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'apply_patch', 'shell', 'task', 'explore', 'search', 'web_fetch', 'Skill'];
     if (JSON.stringify(readTools) !== JSON.stringify(expectedReadTools)) {
       throw new Error(`read agent schema must be fixed allow-list: expected=${expectedReadTools.join(', ')} actual=${readTools.join(', ')}`);
@@ -1420,15 +1425,18 @@ setInternalToolsProvider({
     if (JSON.stringify(writeTools) !== JSON.stringify(expectedWriteTools)) {
       throw new Error(`read-write agent schema must be fixed allow-list: expected=${expectedWriteTools.join(', ')} actual=${writeTools.join(', ')}`);
     }
-    if (readTools.includes('tool_search') || writeTools.includes('tool_search')) {
-      throw new Error(`agent session fixed schemas must omit tool_search: read=${readTools.join(', ')} write=${writeTools.join(', ')}`);
+    if (readTools.includes('load_tool') || writeTools.includes('load_tool')) {
+      throw new Error(`agent session fixed schemas must omit load_tool: read=${readTools.join(', ')} write=${writeTools.join(', ')}`);
     }
-    if (readTools.includes('shell')) {
-      throw new Error(`read agent schema must omit shell: read=${readTools.join(', ')}`);
+    if (readTools.includes('apply_patch')) {
+      throw new Error(`read agent schema must omit apply_patch: read=${readTools.join(', ')}`);
     }
-    for (const name of ['shell', 'apply_patch', 'task']) {
-      if (readTools.includes(name)) {
-        throw new Error(`read agent schema must omit non-read tool ${name}: read=${readTools.join(', ')}`);
+    for (const name of ['shell', 'task']) {
+      if (!readTools.includes(name)) {
+        throw new Error(`read agent schema must carry verification tool ${name}: read=${readTools.join(', ')}`);
+      }
+      if (publicExploreTools.includes(name)) {
+        throw new Error(`public explore role must omit ${name}: explore=${publicExploreTools.join(', ')}`);
       }
     }
     for (const name of ['apply_patch', 'shell', 'task']) {
@@ -1450,13 +1458,13 @@ setInternalToolsProvider({
     if (!fullTools.includes('explore')) {
       throw new Error(`full agent schema must expose explore: full=${fullTools.join(', ')}`);
     }
-    // Unified-shard policy (v0.9.13): the explore wrapper stays IN the schema
-    // for every read role — including the explore agent itself — so the
-    // read-only bundle is bit-identical across roles (one cache group).
-    // Recursion is broken at call time in pre-dispatch-deny.mjs via
-    // recursiveWrapperToolNameForPublicAgent, not by schema stripping.
-    if (JSON.stringify(publicExploreTools) !== JSON.stringify(expectedReadTools)) {
-      throw new Error(`public explore role must ship the shared read-only bundle (incl. explore): expected=${expectedReadTools.join(', ')} actual=${publicExploreTools.join(', ')}`);
+    // The explore wrapper stays IN the schema for every read role — including
+    // the explore agent itself. Recursion is broken at call time in
+    // pre-dispatch-deny.mjs via recursiveWrapperToolNameForPublicAgent, not by
+    // schema stripping. (Read AGENT sessions add shell/task on top, so the
+    // public explore bundle is its own cache group now.)
+    if (JSON.stringify(publicExploreTools) !== JSON.stringify(expectedPublicReadTools)) {
+      throw new Error(`public explore role must ship the readonly bundle (incl. explore): expected=${expectedPublicReadTools.join(', ')} actual=${publicExploreTools.join(', ')}`);
     }
     if (recursiveWrapperToolNameForPublicAgent('explore') !== 'explore') {
       throw new Error('call-time anti-recursion must map public explore agent to its own wrapper tool');
@@ -1846,25 +1854,38 @@ if (!/Use after search/i.test(webFetchTool?.description || '') || !webFetchProps
 if (!/offset/i.test(webFetchProps.startIndex?.description || '') || !/Maximum characters/i.test(webFetchProps.maxLength?.description || '')) {
   throw new Error('web_fetch schema must describe paging window fields');
 }
-if (!/deferred tools/i.test(TOOL_SEARCH_TOOL.description || '') || !TOOL_SEARCH_TOOL.inputSchema?.properties?.select) {
-  throw new Error('tool_search schema must preserve selection guidance and select field');
+if (!/deferred tools/i.test(TOOL_SEARCH_TOOL.description || '')
+  || !TOOL_SEARCH_TOOL.inputSchema?.properties?.names
+  || !TOOL_SEARCH_TOOL.inputSchema?.properties?.select) {
+  throw new Error('load_tool schema must preserve loader guidance plus names + legacy select fields');
 }
 const toolSearchSession = {
   tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
   deferredToolCatalog: smokeCatalog.slice(),
   deferredSelectedTools: [...fullDefaults],
 };
-// A plain query is a case-insensitive substring filter over name+description.
-// It lists matches only — it never auto-loads or ranks.
+// load_tool is a pure loader: a free-text query is NOT a search. It loads
+// nothing, returns an error steering to names[], and never activates tools.
 const listQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'shell' }, toolSearchSession, 'full'));
-if (listQueryResult.selected) {
-  throw new Error(`tool_search plain query must not auto-load: ${JSON.stringify(listQueryResult.selected)}`);
+if (listQueryResult.selected || (Array.isArray(listQueryResult.loaded) && listQueryResult.loaded.length)) {
+  throw new Error(`load_tool free-text query must not load: ${JSON.stringify(listQueryResult)}`);
 }
-if (!listQueryResult.matches.some((row) => row.name === 'shell')) {
-  throw new Error(`tool_search plain query should list substring matches: ${JSON.stringify(listQueryResult.matches)}`);
+if (!listQueryResult.error || !/names/i.test(listQueryResult.error)) {
+  throw new Error(`load_tool free-text query must steer to names[]: ${JSON.stringify(listQueryResult)}`);
 }
 if (listQueryResult.activeTools.includes('shell') || (Array.isArray(listQueryResult.discoveredTools) && listQueryResult.discoveredTools.includes('shell'))) {
-  throw new Error(`tool_search plain query must not activate/discover tools: ${JSON.stringify(listQueryResult)}`);
+  throw new Error(`load_tool free-text query must not activate/discover tools: ${JSON.stringify(listQueryResult)}`);
+}
+// names[] is the primary loader input (aliases expand, tools activate).
+const namesLoadResult = JSON.parse(__renderToolSearchForTest({ names: ['shell', 'recall'] }, {
+  tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
+  deferredToolCatalog: smokeCatalog.slice(),
+  deferredSelectedTools: [...fullDefaults],
+}, 'full'));
+for (const name of ['shell', 'recall']) {
+  if (!namesLoadResult.activeTools.includes(name) || !namesLoadResult.loaded.includes(name)) {
+    throw new Error(`load_tool names[] must load ${name}: ${JSON.stringify(namesLoadResult)}`);
+  }
 }
 // query "select:a,b" is the explicit query-side loader (aliases expand).
 const bulkSelectResult = JSON.parse(__renderToolSearchForTest({ query: 'select:shell,recall' }, toolSearchSession, 'full'));

package/src/rules/agent/30-explorer.md

@@ -22,6 +22,12 @@ synonyms, library/domain names), plus `find` with name fragments, plus `code_gra
 symbol_search when the query names an identifier. A single-pattern,
 single-tool first turn is a defect.
 
+A turn-1 broad grep MUST set `output_mode:"files_with_matches"` — an
+unscoped `content`/`content_with_context` scan reads every match body and is
+a defect (a full-content scan across the tree costs seconds). Use
+`content_with_context` ONLY against a `path` that appeared in an earlier
+result THIS session, and always with `head_limit`.
+
 Search tokens are CODE tokens: first translate natural-language or
 non-English queries into probable English identifiers (e.g. "최대 루프 반복
 횟수" → maxLoop, loop-policy, iterations). Grep non-ASCII text only when

package/src/rules/shared/01-tool.md

@@ -4,12 +4,19 @@
   prior result. Merge equivalent variants/scopes into ONE call wherever the
   schema accepts arrays (`pattern[]`, `path[]`, `symbols[]`, `query[]`).
 - Route by what is already known: known symbol/relation → `code_graph`;
-  exact text in a known scope → `grep`; unknown location or concept-level
-  question → `explore`; name fragment → `find`; exact name pattern → `glob`;
-  known directory → `list`; known file/region → `read`.
+  exact text in a known scope → `grep`; unknown location, machine-wide/
+  out-of-repo whereabouts, or concept-level question → `explore` (which uses
+  the hardened `find` internally); name fragment → `find`; exact name pattern
+  → `glob`; known directory → `list`; known file/region → `read`.
+- `explore` fan-out: at task start, decompose what the task needs to know
+  into independent facets (implementation site, config/load path, tests,
+  error origin, ...) and send them as ONE `query[]` call — facets run in
+  parallel. Never fan out rephrasings of the same target; on
+  EXPLORATION_FAILED, retry once with changed tokens.
 - Valid anchors come from user input or tool output in this session; locate
   anything else with `find` before `grep`/`read`. On ENOENT the next call is
-  `find` on the basename — never a retried guess.
+  `find` on the basename — never a retried guess; and never guess an absolute
+  path outside the project — `find` from a verified broad root instead.
 - Retrieval stops when evidence covers the deliverable: single-answer tasks
   end at the first sufficient anchor; enumeration tasks (review, audit) end
   when the stated scope is covered. Never re-verify a hit already on screen;