mixdog 0.9.23 → 0.9.24

package/scripts/mcp-grace-deferred-test.mjs

@@ -0,0 +1,149 @@
+// Regression tests for turn-time deferred-manifest construction (claude-code
+// style). An MCP server that finishes its handshake BETWEEN session-create and
+// the user's FIRST send is folded — on the first turn, synchronously, with no
+// boot await — into the INITIAL <available-deferred-tools> manifest (BP1) and
+// pre-marked announced, so the first-turn tool-catalog reconcile emits NO late
+// <system-reminder> for it. A server that connects AFTER the first turn keeps
+// the append-only late-reminder path. Unit-style: exercise the tool-catalog
+// exports directly (no runtime, no spawn) the way session-turn-api/runtime-core
+// wire them.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    applyDeferredToolSurface,
+    refreshInitialDeferredMcpSurface,
+    reconcileDeferredMcpToolCatalog,
+} from '../src/session-runtime/tool-catalog.mjs';
+
+function baseSession() {
+    return {
+        provider: 'legacy',
+        tools: [{ name: 'read', description: 'read a file' }, { name: 'grep', description: 'search' }],
+        messages: [{ role: 'system', content: 'BASE PROMPT' }],
+    };
+}
+
+// A freshly-created session: the create-time surface is baked WITHOUT any MCP
+// (server still mid-handshake at create). `shell` is a deferred (non-active)
+// standalone tool so BP1 carries a manifest block even before MCP arrives.
+function createdSession() {
+    const session = baseSession();
+    applyDeferredToolSurface(session, 'full', [{ name: 'shell', description: 'run a command' }], { provider: 'legacy' });
+    return session;
+}
+
+function systemContent(session) {
+    return session.messages.find((m) => m.role === 'system').content;
+}
+
+const mcpTool = { name: 'mcp__unity__get_scene', description: 'Return the active Unity scene graph.' };
+const mcpTool2 = { name: 'mcp__unity__run_tests', description: 'Run the Unity test runner.' };
+
+// Mirror the session-turn-api first-turn gate: refresh runs ONCE, only for a
+// session flagged fresh (deferredInitialRefreshPending) at create; a resumed
+// session (reloaded transcript, flag absent) takes the late-reconcile path and
+// its already-baked BP1 is never rebuilt or re-announced.
+function firstTurnGate(session, liveMcp) {
+    if (session.deferredInitialRefreshPending) {
+        session.deferredInitialRefreshPending = false;
+        return refreshInitialDeferredMcpSurface(session, liveMcp) ? 'refreshed' : 'refresh-noop';
+    }
+    return 'late';
+}
+
+test('MCP connecting between session-create and first send lands in the INITIAL manifest, not a late reminder', () => {
+    const session = createdSession();
+    assert.ok(!systemContent(session).includes('mcp__unity__get_scene'), 'MCP absent from create-time BP1');
+
+    // First-turn refresh: the live registry now includes the connected server.
+    const changed = refreshInitialDeferredMcpSurface(session, [mcpTool]);
+    assert.equal(changed, true, 'first-turn refresh folded the newly-connected MCP tool');
+
+    const sys = systemContent(session);
+    assert.ok(sys.includes('<available-deferred-tools>'), 'manifest block present');
+    assert.ok(sys.includes('mcp__unity__get_scene'), 'MCP tool in the INITIAL manifest');
+    assert.ok(session.deferredAnnouncedTools.includes('mcp__unity__get_scene'), 'MCP tool pre-marked announced');
+
+    let enqueued = null;
+    const result = reconcileDeferredMcpToolCatalog(session, [mcpTool], {
+        enqueue: (text) => { enqueued = text; return true; },
+    });
+    assert.equal(result, null, 'no late-tool announcement for a first-turn-folded tool');
+    assert.equal(enqueued, null, 'nothing enqueued for a first-turn-folded tool');
+});
+
+test('an MCP server connecting AFTER the first turn is still announced via the late reminder', () => {
+    const session = createdSession();
+    // First turn: no MCP connected yet — nothing to fold.
+    assert.equal(refreshInitialDeferredMcpSurface(session, []), false, 'no live MCP => first-turn no-op');
+    assert.ok(!(session.deferredAnnouncedTools || []).includes('mcp__unity__get_scene'), 'MCP not pre-announced');
+
+    // A later turn: the server has since connected → late path fires.
+    let enqueued = null;
+    const result = reconcileDeferredMcpToolCatalog(session, [mcpTool], {
+        enqueue: (text) => { enqueued = text; return true; },
+    });
+    assert.deepEqual(result, ['mcp__unity__get_scene'], 'late tool announced');
+    assert.ok(enqueued && enqueued.includes('mcp__unity__get_scene'), 'late reminder enqueued');
+    assert.ok(enqueued.includes('connected after this session started'), 'reminder carries the late-tool sentinel');
+});
+
+test('recreated session (MCP already connected at create) seeds its manifest, no late re-announce', () => {
+    // Recreate/reset path: createCurrentSession folds the live MCP tools into the
+    // surface at create time, so a cwd-change recreate seeds its BP1 directly and
+    // never needs the first-turn refresh.
+    const session = baseSession();
+    applyDeferredToolSurface(session, 'full', [{ name: 'shell', description: 'run a command' }, mcpTool], { provider: 'legacy' });
+    assert.ok(systemContent(session).includes('mcp__unity__get_scene'), 'MCP in recreated BP1');
+    assert.ok(session.deferredAnnouncedTools.includes('mcp__unity__get_scene'), 'recreated MCP pre-marked announced');
+
+    let enqueued = null;
+    const result = reconcileDeferredMcpToolCatalog(session, [mcpTool], {
+        enqueue: (text) => { enqueued = text; return true; },
+    });
+    assert.equal(result, null, 'no late announcement on recreate');
+    assert.equal(enqueued, null, 'nothing enqueued on recreate');
+});
+
+test('first-turn refresh is idempotent: a re-render with no new MCP is a no-op and keeps ONE manifest block', () => {
+    const session = createdSession();
+    assert.equal(refreshInitialDeferredMcpSurface(session, [mcpTool]), true, 'first fold applies');
+    const once = systemContent(session);
+    assert.equal(refreshInitialDeferredMcpSurface(session, [mcpTool]), false, 'no genuinely-new MCP => no-op');
+    const twice = systemContent(session);
+    assert.equal(once, twice, 'BP1 byte-identical on re-render');
+    assert.equal((twice.match(/<available-deferred-tools>/g) || []).length, 1, 'exactly one manifest block (no duplicate)');
+});
+
+test('a second newly-connected MCP tool re-renders BP1 in place (both listed, still one block)', () => {
+    const session = createdSession();
+    refreshInitialDeferredMcpSurface(session, [mcpTool]);
+    assert.equal(refreshInitialDeferredMcpSurface(session, [mcpTool, mcpTool2]), true, 're-fold applies the new tool');
+    const sys = systemContent(session);
+    assert.ok(sys.includes('mcp__unity__get_scene') && sys.includes('mcp__unity__run_tests'), 'both MCP tools listed');
+    assert.equal((sys.match(/<available-deferred-tools>/g) || []).length, 1, 'still exactly one block (rebuilt in place)');
+    assert.ok(session.deferredAnnouncedTools.includes('mcp__unity__run_tests'), 'the new tool is pre-announced too');
+});
+
+test('a resumed session (no fresh flag, prior baked BP1) is NOT refreshed on its next turn', () => {
+    // A prior run baked BP1 with the MCP tool; resume reloads that transcript.
+    const session = baseSession();
+    applyDeferredToolSurface(session, 'full', [{ name: 'shell', description: 'run a command' }, mcpTool], { provider: 'legacy' });
+    const before = systemContent(session);
+    const announcedBefore = [...session.deferredAnnouncedTools];
+    // Resume path never sets the per-session fresh flag.
+    assert.equal(session.deferredInitialRefreshPending, undefined, 'resumed session carries no fresh flag');
+    const route = firstTurnGate(session, [mcpTool, mcpTool2]);
+    assert.equal(route, 'late', 'resumed session takes the late-reconcile path, not the initial refresh');
+    assert.equal(systemContent(session), before, 'BP1 untouched on resume (no rebuild)');
+    assert.deepEqual([...session.deferredAnnouncedTools], announcedBefore, 'announced set unchanged on resume');
+});
+
+test('a fresh session (flagged) is refreshed exactly once, then falls to the late path', () => {
+    const session = createdSession();
+    session.deferredInitialRefreshPending = true;
+    assert.equal(firstTurnGate(session, [mcpTool]), 'refreshed', 'fresh session refreshes on its first turn');
+    assert.equal(session.deferredInitialRefreshPending, false, 'fresh flag consumed (one-shot)');
+    assert.ok(session.deferredAnnouncedTools.includes('mcp__unity__get_scene'), 'first-turn MCP pre-announced');
+    assert.equal(firstTurnGate(session, [mcpTool2]), 'late', 'second turn no longer refreshes');
+});

package/scripts/recall-usecase-cases.json

@@ -15,4 +15,4 @@
   { "id": "uc5-yesterday", "label": "UC5 calendar yesterday", "args": { "period": "yesterday", "limit": 10 }, "expect": "browse" },
   { "id": "uc5-thisweek", "label": "UC5 calendar this_week", "args": { "period": "this_week", "limit": 10 }, "expect": "browse" },
   { "id": "uc6-category", "label": "UC6 category decision 7d", "args": { "period": "7d", "category": "decision", "limit": 10 }, "expect": "browse" }
-]
+]

package/scripts/smoke-runtime-negative.ps1

@@ -1,106 +1,106 @@
-# smoke-runtime-negative.ps1 — Negative-path tests against released win32-x64
-# runtime tarball. Validates: download, sha256, corrupt-tarball, fresh-extract
-# boot, double-init refusal, hostile-env survival.
-#
-# Env: TAG / OS / ARCH / RUNTIME_RELEASE_REPOSITORY (default tribgames/mixdog)
-
-$ErrorActionPreference = 'Stop'
-
-$Tag         = if ($env:TAG)                { $env:TAG }  else { 'runtime-v0.4.0' }
-$Os          = if ($env:OS)                 { $env:OS }   else { 'win32' }
-$Arch        = if ($env:ARCH)               { $env:ARCH } else { 'x64' }
-$ReleaseRepo = if ($env:RUNTIME_RELEASE_REPOSITORY) { $env:RUNTIME_RELEASE_REPOSITORY } else { 'tribgames/mixdog' }
-$PgVer       = '16.4'
-$PgvectorVer = '0.8.2'
-
-$Asset = "mixdog-runtime-${Os}-${Arch}-pg${PgVer}-pgvector${PgvectorVer}.tar.gz"
-$Url   = "https://github.com/${ReleaseRepo}/releases/download/${Tag}/${Asset}"
-
-$Work = New-Item -ItemType Directory -Force -Path "$env:TEMP\smoke-$([guid]::NewGuid().ToString('N'))" | Select-Object -ExpandProperty FullName
-
-try {
-    Write-Host "==> Negative-path smoke for ${Os}-${Arch} from $Url"
-
-    Write-Host "==> Test 1: HEAD reaches release asset"
-    $resp = Invoke-WebRequest -Uri $Url -Method Head -UseBasicParsing -ErrorAction Stop
-    Write-Host "  HTTP $($resp.StatusCode)"
-
-    Write-Host "==> Test 2: full download + sha256"
-    $TarPath = Join-Path $Work $Asset
-    Invoke-WebRequest -Uri $Url -OutFile $TarPath -UseBasicParsing
-    $sha = (Get-FileHash -Algorithm SHA256 $TarPath).Hash.ToLower()
-    Write-Host "  sha256=$sha"
-
-    Write-Host "==> Test 3: corrupt tarball — flip a byte and ensure tar errors"
-    $CorruptPath = "$Work\corrupt.tar.gz"
-    Copy-Item $TarPath $CorruptPath
-    $bytes = [byte[]]::new(1); $rand = [System.Random]::new(); $rand.NextBytes($bytes)
-    $stream = [System.IO.File]::OpenWrite($CorruptPath)
-    $stream.Position = 102400
-    $stream.Write($bytes, 0, 1)
-    $stream.Close()
-    $CorruptDir = "$Work\corrupt"
-    New-Item -ItemType Directory -Force -Path $CorruptDir | Out-Null
-    $TarProc = Start-Process -FilePath tar -ArgumentList @('-xzf', $CorruptPath, '-C', $CorruptDir.Replace('\','/')) -Wait:$false -PassThru -WindowStyle Hidden
-    if (-not $TarProc.WaitForExit(15000)) {
-        Stop-Process -Id $TarProc.Id -Force -ErrorAction SilentlyContinue
-        Write-Host "  PASS: corrupted tarball extraction timed out and was stopped"
-    } elseif ($TarProc.ExitCode -eq 0) {
-        Write-Host "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
-    } else {
-        Write-Host "  PASS: corrupted tarball rejected by tar (exit $($TarProc.ExitCode))"
-    }
-
-    Write-Host "==> Test 4: fresh-extract boot (extension load + distance query)"
-    $FreshDir = "$Work\fresh"
-    New-Item -ItemType Directory -Force -Path $FreshDir | Out-Null
-    & tar -xzf $TarPath -C ($FreshDir.Replace('\','/'))
-    if ($LASTEXITCODE -ne 0) { throw "fresh extract failed" }
-
-    $PgBin   = "$FreshDir\bin"
-    $Data    = "$FreshDir\pgdata"
-    $Log     = "$FreshDir\pg.log"
-    $Port    = 55897
-
-    # Hostile env: minimal PATH (System32 only), no PGROOT/PGDATA
-    $SavedPath = $env:PATH
-    $SavedPgRoot = $env:PGROOT
-    $env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
-    $env:PGROOT = $null
-    $env:PGDATA = $null
-
-    try {
-        & "$PgBin\postgres.exe" --version
-        if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version" }
-        & "$PgBin\initdb.exe" -D $Data --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
-        if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb" }
-        & "$PgBin\pg_ctl.exe" -D $Data -o "-p $Port -h 127.0.0.1" -l $Log -w start
-        if ($LASTEXITCODE -ne 0) { Get-Content $Log | Select-Object -Last 30; throw "FAIL: pg_ctl start" }
-
-        try {
-            & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
-            if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION" }
-            $ExtV = & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
-            if ($ExtV.Trim() -ne $PgvectorVer) { throw "FAIL: extversion='$ExtV' expected='$PgvectorVer'" }
-            Write-Host "  PASS: fresh-extract boot + vector extension"
-        } finally {
-            & "$PgBin\pg_ctl.exe" -D $Data -m fast stop 2>$null | Out-Null
-        }
-
-        Write-Host "==> Test 5: second initdb on initialized dir refused"
-        $rc = (Start-Process -FilePath "$PgBin\initdb.exe" -ArgumentList "-D",$Data,"-U","postgres" -Wait -PassThru -NoNewWindow).ExitCode
-        if ($rc -eq 0) {
-            Write-Host "  WARN: second initdb succeeded (unexpected)"
-        } else {
-            Write-Host "  PASS: second initdb refused (exit $rc)"
-        }
-    } finally {
-        $env:PATH   = $SavedPath
-        $env:PGROOT = $SavedPgRoot
-    }
-
-    Write-Host "==> All negative-path smokes: PASS"
-}
-finally {
-    Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
-}
+# smoke-runtime-negative.ps1 — Negative-path tests against released win32-x64
+# runtime tarball. Validates: download, sha256, corrupt-tarball, fresh-extract
+# boot, double-init refusal, hostile-env survival.
+#
+# Env: TAG / OS / ARCH / RUNTIME_RELEASE_REPOSITORY (default tribgames/mixdog)
+
+$ErrorActionPreference = 'Stop'
+
+$Tag         = if ($env:TAG)                { $env:TAG }  else { 'runtime-v0.4.0' }
+$Os          = if ($env:OS)                 { $env:OS }   else { 'win32' }
+$Arch        = if ($env:ARCH)               { $env:ARCH } else { 'x64' }
+$ReleaseRepo = if ($env:RUNTIME_RELEASE_REPOSITORY) { $env:RUNTIME_RELEASE_REPOSITORY } else { 'tribgames/mixdog' }
+$PgVer       = '16.4'
+$PgvectorVer = '0.8.2'
+
+$Asset = "mixdog-runtime-${Os}-${Arch}-pg${PgVer}-pgvector${PgvectorVer}.tar.gz"
+$Url   = "https://github.com/${ReleaseRepo}/releases/download/${Tag}/${Asset}"
+
+$Work = New-Item -ItemType Directory -Force -Path "$env:TEMP\smoke-$([guid]::NewGuid().ToString('N'))" | Select-Object -ExpandProperty FullName
+
+try {
+    Write-Host "==> Negative-path smoke for ${Os}-${Arch} from $Url"
+
+    Write-Host "==> Test 1: HEAD reaches release asset"
+    $resp = Invoke-WebRequest -Uri $Url -Method Head -UseBasicParsing -ErrorAction Stop
+    Write-Host "  HTTP $($resp.StatusCode)"
+
+    Write-Host "==> Test 2: full download + sha256"
+    $TarPath = Join-Path $Work $Asset
+    Invoke-WebRequest -Uri $Url -OutFile $TarPath -UseBasicParsing
+    $sha = (Get-FileHash -Algorithm SHA256 $TarPath).Hash.ToLower()
+    Write-Host "  sha256=$sha"
+
+    Write-Host "==> Test 3: corrupt tarball — flip a byte and ensure tar errors"
+    $CorruptPath = "$Work\corrupt.tar.gz"
+    Copy-Item $TarPath $CorruptPath
+    $bytes = [byte[]]::new(1); $rand = [System.Random]::new(); $rand.NextBytes($bytes)
+    $stream = [System.IO.File]::OpenWrite($CorruptPath)
+    $stream.Position = 102400
+    $stream.Write($bytes, 0, 1)
+    $stream.Close()
+    $CorruptDir = "$Work\corrupt"
+    New-Item -ItemType Directory -Force -Path $CorruptDir | Out-Null
+    $TarProc = Start-Process -FilePath tar -ArgumentList @('-xzf', $CorruptPath, '-C', $CorruptDir.Replace('\','/')) -Wait:$false -PassThru -WindowStyle Hidden
+    if (-not $TarProc.WaitForExit(15000)) {
+        Stop-Process -Id $TarProc.Id -Force -ErrorAction SilentlyContinue
+        Write-Host "  PASS: corrupted tarball extraction timed out and was stopped"
+    } elseif ($TarProc.ExitCode -eq 0) {
+        Write-Host "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
+    } else {
+        Write-Host "  PASS: corrupted tarball rejected by tar (exit $($TarProc.ExitCode))"
+    }
+
+    Write-Host "==> Test 4: fresh-extract boot (extension load + distance query)"
+    $FreshDir = "$Work\fresh"
+    New-Item -ItemType Directory -Force -Path $FreshDir | Out-Null
+    & tar -xzf $TarPath -C ($FreshDir.Replace('\','/'))
+    if ($LASTEXITCODE -ne 0) { throw "fresh extract failed" }
+
+    $PgBin   = "$FreshDir\bin"
+    $Data    = "$FreshDir\pgdata"
+    $Log     = "$FreshDir\pg.log"
+    $Port    = 55897
+
+    # Hostile env: minimal PATH (System32 only), no PGROOT/PGDATA
+    $SavedPath = $env:PATH
+    $SavedPgRoot = $env:PGROOT
+    $env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
+    $env:PGROOT = $null
+    $env:PGDATA = $null
+
+    try {
+        & "$PgBin\postgres.exe" --version
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version" }
+        & "$PgBin\initdb.exe" -D $Data --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb" }
+        & "$PgBin\pg_ctl.exe" -D $Data -o "-p $Port -h 127.0.0.1" -l $Log -w start
+        if ($LASTEXITCODE -ne 0) { Get-Content $Log | Select-Object -Last 30; throw "FAIL: pg_ctl start" }
+
+        try {
+            & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
+            if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION" }
+            $ExtV = & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
+            if ($ExtV.Trim() -ne $PgvectorVer) { throw "FAIL: extversion='$ExtV' expected='$PgvectorVer'" }
+            Write-Host "  PASS: fresh-extract boot + vector extension"
+        } finally {
+            & "$PgBin\pg_ctl.exe" -D $Data -m fast stop 2>$null | Out-Null
+        }
+
+        Write-Host "==> Test 5: second initdb on initialized dir refused"
+        $rc = (Start-Process -FilePath "$PgBin\initdb.exe" -ArgumentList "-D",$Data,"-U","postgres" -Wait -PassThru -NoNewWindow).ExitCode
+        if ($rc -eq 0) {
+            Write-Host "  WARN: second initdb succeeded (unexpected)"
+        } else {
+            Write-Host "  PASS: second initdb refused (exit $rc)"
+        }
+    } finally {
+        $env:PATH   = $SavedPath
+        $env:PGROOT = $SavedPgRoot
+    }
+
+    Write-Host "==> All negative-path smokes: PASS"
+}
+finally {
+    Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
+}

package/scripts/tool-efficiency-diag.mjs

@@ -88,4 +88,4 @@ for (const target of ['heavy-worker', 'worker']) {
   console.log(`  single-call batches: ${batch1}/${batchTot} (${pct(batch1, batchTot)}%)`);
   console.log(`  content greps with -C/-A/-B: ${grepContentWithCtx}/${grepContent} (${pct(grepContentWithCtx, grepContent)}%)  grep->read follow-ups: ${grepThenRead}`);
   console.log(`  same-path re-reads >=3x: ${rereads}`);
-}
+}

package/scripts/tool-smoke.mjs

@@ -1050,32 +1050,28 @@ const prevChannelSingleton = process.env.MIXDOG_CHANNEL_SINGLETON;
 const prevChannelWorkerProcess = process.env.MIXDOG_CHANNEL_WORKER_PROCESS;
 const prevRuntimeRoot = process.env.MIXDOG_RUNTIME_ROOT;
 const prevEnvOut = process.env.SMOKE_CHANNEL_ENV_OUT;
+const prevDaemonEntry = process.env.MIXDOG_CHANNEL_DAEMON_ENTRY;
 try {
-  const entry = join(channelWorkerTmp, 'entry.mjs');
+  // Daemon-mode worker env coverage: start() spawn-or-attaches the machine
+  // -global daemon (the stub daemon entry — no Discord token) instead of
+  // forking `entry`, so assert the flags on the SPAWNED DAEMON's env (the stub
+  // dumps them to SMOKE_CHANNEL_ENV_OUT). The old fork-path env assertion died
+  // with the fork path itself; full flip/attach coverage lives in
+  // scripts/channel-daemon-smoke.mjs.
+  const stubEntry = join(root, 'scripts', 'channel-daemon-stub.mjs');
   const dataDir = join(channelWorkerTmp, 'data');
   const runtimeDir = join(channelWorkerTmp, 'runtime');
   const envOut = join(channelWorkerTmp, 'env.json');
   mkdirSync(dataDir, { recursive: true });
   mkdirSync(runtimeDir, { recursive: true });
-  writeFileSync(entry, `
-import { writeFileSync } from 'node:fs';
-writeFileSync(process.env.SMOKE_CHANNEL_ENV_OUT, JSON.stringify({
-  cliOwned: process.env.MIXDOG_CLI_OWNED,
-  daemon: process.env.MIXDOG_CHANNEL_DAEMON,
-}));
-process.send?.({ type: 'ready' });
-process.on('message', (msg) => {
-  if (msg?.type === 'shutdown') process.exit(0);
-});
-setInterval(() => {}, 10000);
-`);
   process.env.MIXDOG_CHANNEL_DAEMON = '1';
   process.env.MIXDOG_CHANNEL_SINGLETON = '1';
   process.env.MIXDOG_CHANNEL_WORKER_PROCESS = '1';
   process.env.MIXDOG_RUNTIME_ROOT = runtimeDir;
   process.env.SMOKE_CHANNEL_ENV_OUT = envOut;
+  process.env.MIXDOG_CHANNEL_DAEMON_ENTRY = stubEntry;
   channelEnvWorker = createStandaloneChannelWorker({
-    entry,
+    entry: stubEntry,
     rootDir: root,
     dataDir,
     cwd: root,
@@ -1100,6 +1096,11 @@ setInterval(() => {}, 10000);
   else process.env.MIXDOG_RUNTIME_ROOT = prevRuntimeRoot;
   if (prevEnvOut == null) delete process.env.SMOKE_CHANNEL_ENV_OUT;
   else process.env.SMOKE_CHANNEL_ENV_OUT = prevEnvOut;
+  if (prevDaemonEntry == null) delete process.env.MIXDOG_CHANNEL_DAEMON_ENTRY;
+  else process.env.MIXDOG_CHANNEL_DAEMON_ENTRY = prevDaemonEntry;
+  // Detach only ends OUR attachment; the stub daemon self-shuts after its
+  // client-grace window. Give it that window before deleting its tmp root.
+  await new Promise((resolveWait) => setTimeout(resolveWait, 700));
   rmSync(channelWorkerTmp, { recursive: true, force: true });
 }
 
@@ -1191,10 +1192,10 @@ if (EXPLORE_TOOL.annotations?.agentHidden === true) {
   }
 }
 const exploreProps = EXPLORE_TOOL.inputSchema?.properties || {};
-if (!/Repo anchor locator/i.test(EXPLORE_TOOL.description || '') || !/broad\/uncertain/i.test(EXPLORE_TOOL.description || '') || !/independent targets/i.test(EXPLORE_TOOL.description || '') || (EXPLORE_TOOL.description || '').length > 90) {
-  throw new Error('explore description must stay compact and anchor-oriented');
+if (!/broad\/uncertain/i.test(EXPLORE_TOOL.description || '') || !/machine-wide/i.test(EXPLORE_TOOL.description || '') || !/independent targets/i.test(EXPLORE_TOOL.description || '') || (EXPLORE_TOOL.description || '').length > 600) {
+  throw new Error('explore description must keep the locator + facet fan-out contract');
 }
-if (!/Narrow locator query/i.test(exploreProps.query?.description || '') || !/independent targets/i.test(exploreProps.query?.description || '') || !/Project\/root/i.test(exploreProps.cwd?.description || '')) {
+if (!/Narrow locator query/i.test(exploreProps.query?.description || '') || !/independent facets/i.test(exploreProps.query?.description || '') || !/Project\/root/i.test(exploreProps.cwd?.description || '')) {
   throw new Error('explore schema must stay compact and preserve query/cwd shape');
 }
 const normalizedExplore = normalizeExploreQueries('["where is model selection?","  ","which file owns agent async?"]');
@@ -1412,7 +1413,11 @@ setInternalToolsProvider({
     const writeTools = (writeAgentSession.tools || []).map((tool) => tool?.name).filter(Boolean);
     const fullTools = (fullAgentSession.tools || []).map((tool) => tool?.name).filter(Boolean);
     const publicExploreTools = (publicExploreSession.tools || []).map((tool) => tool?.name).filter(Boolean);
-    const expectedReadTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'explore', 'search', 'web_fetch', 'Skill'];
+    // Read-role AGENT sessions carry shell/task so review/debug agents can run
+    // their own verification (build/test); the plain readonly preset (public
+    // explore role) still omits them.
+    const expectedReadTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'shell', 'task', 'explore', 'search', 'web_fetch', 'Skill'];
+    const expectedPublicReadTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'explore', 'search', 'web_fetch', 'Skill'];
     const expectedWriteTools = ['code_graph', 'find', 'glob', 'list', 'grep', 'read', 'apply_patch', 'shell', 'task', 'explore', 'search', 'web_fetch', 'Skill'];
     if (JSON.stringify(readTools) !== JSON.stringify(expectedReadTools)) {
       throw new Error(`read agent schema must be fixed allow-list: expected=${expectedReadTools.join(', ')} actual=${readTools.join(', ')}`);
@@ -1423,12 +1428,15 @@ setInternalToolsProvider({
     if (readTools.includes('load_tool') || writeTools.includes('load_tool')) {
       throw new Error(`agent session fixed schemas must omit load_tool: read=${readTools.join(', ')} write=${writeTools.join(', ')}`);
     }
-    if (readTools.includes('shell')) {
-      throw new Error(`read agent schema must omit shell: read=${readTools.join(', ')}`);
+    if (readTools.includes('apply_patch')) {
+      throw new Error(`read agent schema must omit apply_patch: read=${readTools.join(', ')}`);
     }
-    for (const name of ['shell', 'apply_patch', 'task']) {
-      if (readTools.includes(name)) {
-        throw new Error(`read agent schema must omit non-read tool ${name}: read=${readTools.join(', ')}`);
+    for (const name of ['shell', 'task']) {
+      if (!readTools.includes(name)) {
+        throw new Error(`read agent schema must carry verification tool ${name}: read=${readTools.join(', ')}`);
+      }
+      if (publicExploreTools.includes(name)) {
+        throw new Error(`public explore role must omit ${name}: explore=${publicExploreTools.join(', ')}`);
       }
     }
     for (const name of ['apply_patch', 'shell', 'task']) {
@@ -1450,13 +1458,13 @@ setInternalToolsProvider({
     if (!fullTools.includes('explore')) {
       throw new Error(`full agent schema must expose explore: full=${fullTools.join(', ')}`);
     }
-    // Unified-shard policy (v0.9.13): the explore wrapper stays IN the schema
-    // for every read role — including the explore agent itself — so the
-    // read-only bundle is bit-identical across roles (one cache group).
-    // Recursion is broken at call time in pre-dispatch-deny.mjs via
-    // recursiveWrapperToolNameForPublicAgent, not by schema stripping.
-    if (JSON.stringify(publicExploreTools) !== JSON.stringify(expectedReadTools)) {
-      throw new Error(`public explore role must ship the shared read-only bundle (incl. explore): expected=${expectedReadTools.join(', ')} actual=${publicExploreTools.join(', ')}`);
+    // The explore wrapper stays IN the schema for every read role — including
+    // the explore agent itself. Recursion is broken at call time in
+    // pre-dispatch-deny.mjs via recursiveWrapperToolNameForPublicAgent, not by
+    // schema stripping. (Read AGENT sessions add shell/task on top, so the
+    // public explore bundle is its own cache group now.)
+    if (JSON.stringify(publicExploreTools) !== JSON.stringify(expectedPublicReadTools)) {
+      throw new Error(`public explore role must ship the readonly bundle (incl. explore): expected=${expectedPublicReadTools.join(', ')} actual=${publicExploreTools.join(', ')}`);
     }
     if (recursiveWrapperToolNameForPublicAgent('explore') !== 'explore') {
       throw new Error('call-time anti-recursion must map public explore agent to its own wrapper tool');

package/src/rules/agent/30-explorer.md

@@ -22,6 +22,12 @@ synonyms, library/domain names), plus `find` with name fragments, plus `code_gra
 symbol_search when the query names an identifier. A single-pattern,
 single-tool first turn is a defect.
 
+A turn-1 broad grep MUST set `output_mode:"files_with_matches"` — an
+unscoped `content`/`content_with_context` scan reads every match body and is
+a defect (a full-content scan across the tree costs seconds). Use
+`content_with_context` ONLY against a `path` that appeared in an earlier
+result THIS session, and always with `head_limit`.
+
 Search tokens are CODE tokens: first translate natural-language or
 non-English queries into probable English identifiers (e.g. "최대 루프 반복
 횟수" → maxLoop, loop-policy, iterations). Grep non-ASCII text only when

package/src/rules/lead/02-channels.md

@@ -1,3 +1,3 @@
-# Channels
-
-- Channel features are handled by the runtime.
+# Channels
+
+- Channel features are handled by the runtime.

package/src/rules/shared/01-tool.md

@@ -4,12 +4,19 @@
   prior result. Merge equivalent variants/scopes into ONE call wherever the
   schema accepts arrays (`pattern[]`, `path[]`, `symbols[]`, `query[]`).
 - Route by what is already known: known symbol/relation → `code_graph`;
-  exact text in a known scope → `grep`; unknown location or concept-level
-  question → `explore`; name fragment → `find`; exact name pattern → `glob`;
-  known directory → `list`; known file/region → `read`.
+  exact text in a known scope → `grep`; unknown location, machine-wide/
+  out-of-repo whereabouts, or concept-level question → `explore` (which uses
+  the hardened `find` internally); name fragment → `find`; exact name pattern
+  → `glob`; known directory → `list`; known file/region → `read`.
+- `explore` fan-out: at task start, decompose what the task needs to know
+  into independent facets (implementation site, config/load path, tests,
+  error origin, ...) and send them as ONE `query[]` call — facets run in
+  parallel. Never fan out rephrasings of the same target; on
+  EXPLORATION_FAILED, retry once with changed tokens.
 - Valid anchors come from user input or tool output in this session; locate
   anything else with `find` before `grep`/`read`. On ENOENT the next call is
-  `find` on the basename — never a retried guess.
+  `find` on the basename — never a retried guess; and never guess an absolute
+  path outside the project — `find` from a verified broad root instead.
 - Retrieval stops when evidence covers the deliverable: single-answer tasks
   end at the first sufficient anchor; enumeration tasks (review, audit) end
   when the stated scope is covered. Never re-verify a hit already on screen;