mixdog 0.9.47 → 0.9.49

package/scripts/verify-release-assets.mjs

@@ -0,0 +1,293 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { pathToFileURL } from 'node:url';
+
+export const PATCH_PLATFORMS = {
+  'darwin-arm64': 'mixdog-patch-darwin-arm64',
+  'darwin-x64': 'mixdog-patch-darwin-x64',
+  'linux-arm64': 'mixdog-patch-linux-arm64',
+  'linux-x64': 'mixdog-patch-linux-x64',
+  'win32-x64': 'mixdog-patch-win32-x64.exe',
+};
+
+export const GRAPH_PLATFORMS = {
+  'darwin-arm64': 'mixdog-graph-darwin-arm64',
+  'darwin-x64': 'mixdog-graph-darwin-x64',
+  'linux-arm64': 'mixdog-graph-linux-arm64',
+  'linux-x64': 'mixdog-graph-linux-x64',
+  'win32-x64': 'mixdog-graph-win32-x64.exe',
+};
+
+const RUNTIME_PLATFORMS = [
+  'linux-x64',
+  'linux-arm64',
+  'darwin-x64',
+  'darwin-arm64',
+  'win32-x64',
+];
+const STRICT_VERSION = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const SHA256 = /^[a-f0-9]{64}$/i;
+export const MAX_ASSET_BYTES = 256 * 1024 * 1024;
+export const MAX_DOWNLOAD_TIMEOUT_MS = 300_000;
+const PATCH_MANIFEST_PATH = 'src/runtime/agent/orchestrator/tools/patch-manifest.json';
+const PATCH_CARGO_PATH = 'native/mixdog-patch/Cargo.toml';
+const RUNTIME_MANIFEST_PATH = 'src/runtime/memory/data/runtime-manifest.json';
+const GRAPH_MANIFEST_PATH = 'src/runtime/agent/orchestrator/tools/graph-manifest.json';
+const PACKAGE_PATH = 'package.json';
+
+function assertPlainObject(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+}
+
+function assertExactKeys(value, expected, label) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+    throw new Error(`${label} keys must be exactly: ${wanted.join(', ')}`);
+  }
+}
+
+export function validatePatchManifest(manifest, cargoToml) {
+  assertPlainObject(manifest, 'Patch manifest');
+  assertExactKeys(manifest, ['version', '_comment', 'assets'], 'Patch manifest');
+  if (typeof manifest.version !== 'string' || !STRICT_VERSION.test(manifest.version)) {
+    throw new Error(`Patch manifest version is not strict MAJOR.MINOR.PATCH: ${manifest.version}`);
+  }
+  if (typeof manifest._comment !== 'string' || !manifest._comment) {
+    throw new Error('Patch manifest _comment must be a non-empty string');
+  }
+  assertPlainObject(manifest.assets, 'Patch manifest assets');
+  assertExactKeys(manifest.assets, Object.keys(PATCH_PLATFORMS), 'Patch manifest assets');
+
+  let inPackage = false;
+  let cargoVersion;
+  for (const line of String(cargoToml).split(/\r?\n/)) {
+    const section = line.match(/^\s*\[([^\]]+)\]\s*$/)?.[1];
+    if (section) {
+      inPackage = section === 'package';
+      continue;
+    }
+    if (inPackage) {
+      const version = line.match(/^\s*version\s*=\s*"([^"]+)"\s*$/)?.[1];
+      if (version) {
+        cargoVersion = version;
+        break;
+      }
+    }
+  }
+  if (!cargoVersion) throw new Error('Could not read [package] version from native/mixdog-patch/Cargo.toml');
+  if (cargoVersion !== manifest.version) {
+    throw new Error(`Patch Cargo version ${cargoVersion} does not match manifest version ${manifest.version}`);
+  }
+
+  for (const [platform, filename] of Object.entries(PATCH_PLATFORMS)) {
+    const asset = manifest.assets[platform];
+    assertPlainObject(asset, `Patch asset ${platform}`);
+    assertExactKeys(asset, ['url', 'sha256'], `Patch asset ${platform}`);
+    if (typeof asset.url !== 'string') throw new Error(`${platform}: patch asset URL must be a string`);
+    let url;
+    try {
+      url = new URL(asset.url);
+    } catch {
+      throw new Error(`${platform}: invalid patch asset URL`);
+    }
+    const expectedPath = `/tribgames/mixdog/releases/download/patch-v${manifest.version}/${filename}`;
+    if (
+      url.protocol !== 'https:'
+      || url.hostname !== 'github.com'
+      || url.port
+      || url.username
+      || url.password
+      || url.search
+      || url.hash
+      || url.pathname !== expectedPath
+    ) {
+      throw new Error(`${platform}: patch asset URL must be https://github.com${expectedPath}`);
+    }
+    if (typeof asset.sha256 !== 'string' || !SHA256.test(asset.sha256)) {
+      throw new Error(`${platform}: invalid patch asset sha256`);
+    }
+  }
+  return manifest;
+}
+
+export function validateRuntimeManifest(manifest) {
+  assertPlainObject(manifest, 'Runtime manifest');
+  if (!manifest.release_tag || !manifest.assets || typeof manifest.assets !== 'object') {
+    throw new Error(`${RUNTIME_MANIFEST_PATH} is missing release_tag or assets`);
+  }
+  assertPlainObject(manifest.assets, 'Runtime manifest assets');
+  assertExactKeys(manifest.assets, RUNTIME_PLATFORMS, 'Runtime manifest assets');
+  for (const [platform, asset] of Object.entries(manifest.assets)) {
+    if (typeof asset?.url !== 'string' || new URL(asset.url).protocol !== 'https:') {
+      throw new Error(`${platform}: invalid HTTPS asset URL`);
+    }
+    if (typeof asset.sha256 !== 'string' || !SHA256.test(asset.sha256)) {
+      throw new Error(`${platform}: invalid sha256`);
+    }
+    if (!Number.isSafeInteger(asset.size) || asset.size <= 0 || asset.size > MAX_ASSET_BYTES) {
+      throw new Error(`${platform}: invalid size`);
+    }
+  }
+  return manifest;
+}
+
+export function validateGraphManifest(manifest, packageJson) {
+  assertPlainObject(manifest, 'Graph manifest');
+  assertExactKeys(manifest, ['version', '_comment', 'assets'], 'Graph manifest');
+  if (typeof manifest.version !== 'string' || !STRICT_VERSION.test(manifest.version)) {
+    throw new Error(`Graph manifest version is not strict MAJOR.MINOR.PATCH: ${manifest.version}`);
+  }
+  if (typeof manifest._comment !== 'string' || !manifest._comment) {
+    throw new Error('Graph manifest _comment must be a non-empty string');
+  }
+  assertPlainObject(packageJson, 'package.json');
+  if (typeof packageJson.version !== 'string' || !STRICT_VERSION.test(packageJson.version)) {
+    throw new Error(`package.json version is not strict MAJOR.MINOR.PATCH: ${packageJson.version}`);
+  }
+  assertPlainObject(manifest.assets, 'Graph manifest assets');
+  assertExactKeys(manifest.assets, Object.keys(GRAPH_PLATFORMS), 'Graph manifest assets');
+
+  for (const [platform, filename] of Object.entries(GRAPH_PLATFORMS)) {
+    const asset = manifest.assets[platform];
+    assertPlainObject(asset, `Graph asset ${platform}`);
+    assertExactKeys(asset, ['url', 'sha256'], `Graph asset ${platform}`);
+    if (typeof asset.url !== 'string') throw new Error(`${platform}: graph asset URL must be a string`);
+    let url;
+    try {
+      url = new URL(asset.url);
+    } catch {
+      throw new Error(`${platform}: invalid graph asset URL`);
+    }
+    const expectedPath = `/tribgames/mixdog/releases/download/graph-v${manifest.version}/${filename}`;
+    if (
+      url.protocol !== 'https:'
+      || url.hostname !== 'github.com'
+      || url.port
+      || url.username
+      || url.password
+      || url.search
+      || url.hash
+      || url.pathname !== expectedPath
+    ) {
+      throw new Error(`${platform}: graph asset URL must be https://github.com${expectedPath}`);
+    }
+    if (typeof asset.sha256 !== 'string' || !SHA256.test(asset.sha256)) {
+      throw new Error(`${platform}: invalid graph asset sha256`);
+    }
+  }
+  return manifest;
+}
+
+async function downloadAndVerify(label, asset, fetchImpl, timeoutMs, maxAssetBytes) {
+  console.log(`Downloading and verifying ${label}`);
+  const controller = new AbortController();
+  const response = await fetchImpl(asset.url, {
+    redirect: 'follow',
+    headers: { 'User-Agent': 'mixdog-release-asset-guard' },
+    signal: AbortSignal.any([controller.signal, AbortSignal.timeout(timeoutMs)]),
+  });
+  if (!response.ok || !response.body) {
+    await response.body?.cancel();
+    throw new Error(`download failed with HTTP ${response.status}`);
+  }
+  const hash = createHash('sha256');
+  let downloaded = 0;
+  const byteCeiling = Math.min(asset.size ?? Number.POSITIVE_INFINITY, maxAssetBytes);
+  const reader = response.body.getReader();
+  try {
+    while (true) {
+      const { done, value: chunk } = await reader.read();
+      if (done) break;
+      if (downloaded + chunk.byteLength > byteCeiling) {
+        const error = new Error(`byte ceiling exceeded (${byteCeiling} bytes)`);
+        controller.abort(error);
+        await reader.cancel(error).catch(() => {});
+        throw error;
+      }
+      hash.update(chunk);
+      downloaded += chunk.byteLength;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const digest = hash.digest('hex');
+  if (asset.size !== undefined && downloaded !== asset.size) {
+    throw new Error(`size mismatch (manifest ${asset.size}, downloaded ${downloaded})`);
+  }
+  if (digest.toLowerCase() !== asset.sha256.toLowerCase()) {
+    throw new Error(`sha256 mismatch (manifest ${asset.sha256}, downloaded ${digest})`);
+  }
+}
+
+export async function verifyAssetDownloads(
+  assets,
+  {
+    fetchImpl = globalThis.fetch,
+    attempts = 3,
+    timeoutMs = 300_000,
+    maxAssetBytes = MAX_ASSET_BYTES,
+    retryDelay = (attempt) => (
+    new Promise((resolve) => setTimeout(resolve, attempt === 1 ? 2_000 : 6_000))
+    ),
+  } = {},
+) {
+  if (!Number.isSafeInteger(attempts) || attempts < 1 || attempts > 5) {
+    throw new Error(`Download attempts must be between 1 and 5, got ${attempts}`);
+  }
+  if (!Number.isSafeInteger(maxAssetBytes) || maxAssetBytes < 1 || maxAssetBytes > MAX_ASSET_BYTES) {
+    throw new Error(`Asset byte ceiling must be between 1 and ${MAX_ASSET_BYTES}, got ${maxAssetBytes}`);
+  }
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_DOWNLOAD_TIMEOUT_MS) {
+    throw new Error(`Download timeout must be between 1 and ${MAX_DOWNLOAD_TIMEOUT_MS}, got ${timeoutMs}`);
+  }
+  for (const [label, asset] of Object.entries(assets)) {
+    let lastError;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+      try {
+        await downloadAndVerify(label, asset, fetchImpl, timeoutMs, maxAssetBytes);
+        lastError = undefined;
+        break;
+      } catch (error) {
+        lastError = error;
+        console.warn(`${label}: attempt ${attempt}/${attempts} failed: ${error.message}`);
+        if (attempt < attempts) await retryDelay(attempt);
+      }
+    }
+    if (lastError) {
+      throw new Error(`${label}: verification failed after ${attempts} attempts: ${lastError.message}`);
+    }
+  }
+}
+
+export async function verifyReleaseAssets({
+  patchManifestPath = PATCH_MANIFEST_PATH,
+  cargoPath = PATCH_CARGO_PATH,
+  runtimeManifestPath = RUNTIME_MANIFEST_PATH,
+  graphManifestPath = GRAPH_MANIFEST_PATH,
+  packagePath = PACKAGE_PATH,
+  downloadOptions,
+} = {}) {
+  const [patchSource, cargoToml, runtimeSource, graphSource, packageSource] = await Promise.all([
+    readFile(patchManifestPath, 'utf8'),
+    readFile(cargoPath, 'utf8'),
+    readFile(runtimeManifestPath, 'utf8'),
+    readFile(graphManifestPath, 'utf8'),
+    readFile(packagePath, 'utf8'),
+  ]);
+  const patchManifest = validatePatchManifest(JSON.parse(patchSource), cargoToml);
+  const runtimeManifest = validateRuntimeManifest(JSON.parse(runtimeSource));
+  const graphManifest = validateGraphManifest(JSON.parse(graphSource), JSON.parse(packageSource));
+  await verifyAssetDownloads(patchManifest.assets, downloadOptions);
+  console.log(`Verified all bundled patch assets for patch-v${patchManifest.version}.`);
+  await verifyAssetDownloads(runtimeManifest.assets, downloadOptions);
+  console.log(`Verified all bundled runtime assets for ${runtimeManifest.release_tag}.`);
+  await verifyAssetDownloads(graphManifest.assets, downloadOptions);
+  console.log(`Verified all bundled graph assets for graph-v${graphManifest.version}.`);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await verifyReleaseAssets();
+}

package/scripts/windows-hide-spawn-options-test.mjs

@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+
+const root = fileURLToPath(new URL('..', import.meta.url));
+
+function source(relativePath) {
+  return readFileSync(join(root, relativePath), 'utf8');
+}
+
+test('Windows-sensitive Node re-execs keep their windows hidden', () => {
+  const cli = source('src/cli.mjs');
+  const jitRebuild = source('src/tui/dev/jit-rebuild.mjs');
+
+  assert.match(cli, /spawnSync\(process\.execPath, \[fileURLToPath\(import\.meta\.url\), \.\.\.argv\], \{\r?\n\s*stdio: 'inherit',\r?\n\s*env: \{ \.\.\.process\.env, MIXDOG_SWAP_REEXEC: '1' \},\r?\n\s*windowsHide: true,\r?\n\s*\}\)/);
+  assert.match(jitRebuild, /spawnSync\(process\.execPath, \[script\], \{\r?\n\s*stdio: process\.env\.MIXDOG_TUI_DEV_VERBOSE \? 'inherit' : 'ignore',\r?\n\s*windowsHide: true,\r?\n\s*\}\)/);
+});

package/src/cli.mjs

@@ -35,6 +35,7 @@ async function main() {
       const r = spawnSync(process.execPath, [fileURLToPath(import.meta.url), ...argv], {
         stdio: 'inherit',
         env: { ...process.env, MIXDOG_SWAP_REEXEC: '1' },
+        windowsHide: true,
       });
       if (!r.error) return Number.isInteger(r.status) ? r.status : 0;
     } catch { /* fall through to in-place run */ }

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -245,15 +245,26 @@ export function parseGrepCoverage(resultText, toolName, toolArgs, resultKind) {
 }
 
 function classifyToolFailure(resultText, toolName) {
-    const text = String(resultText ?? '').toLowerCase();
-    if (/\[shell-tool-failed\]/i.test(String(resultText ?? ''))) return 'tool-call/failure';
-    if (/\[shell-run-failed\]/i.test(String(resultText ?? ''))) {
-        if (/timeout|timed out|aborted|interrupted/.test(text)) return 'timeout/abort';
+    const raw = String(resultText ?? '');
+    const text = raw.toLowerCase();
+    // Shell renderers put the machine-readable status on the leading line.
+    // Only inspect that marker: command text and stderr frequently contain
+    // words such as "timeout" or "aborted" and must not rewrite a real exit
+    // code into a runtime failure category.
+    const leading = raw.split(/\r?\n/)
+        .map((line) => line.trim())
+        .find((line) => line && !line.startsWith('⚠️ '))
+        ?.replace(/^Error:\s*/i, '') || '';
+    if (/^\[shell-tool-failed\](?:\s|$)/i.test(leading)) return 'tool-call/failure';
+    if (/^\[shell-run-failed\](?:\s|$)/i.test(leading)) {
+        if (/\[timeout:|cause:\s*(?:timeout|cancellation)\b/i.test(leading)) return 'timeout/abort';
+        if (/cause:\s*(?:output-limit|output-capture-error|background-adoption-failed)\b/i.test(leading)) return 'runtime/failure';
+        if (/\[signal:\s*[^\]]+/i.test(leading)) return 'process/signal';
         return 'command-exit';
     }
     if (/requires either|invalid arguments|unknown parameter|must be|schema|expected|required|old_string is .*>=/.test(text)) return 'schema/args';
     if (/not in allow-list|not allowed/.test(text)) return 'permission';
-    if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(String(resultText ?? ''))) return 'command-exit';
+    if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(raw)) return 'command-exit';
     if (/enoent|cannot find|not found at this path|path does not exist|no such file|file not found in graph|unreadable/.test(text)) return 'path/enoent';
     if (/timed out|timeout|interrupted|aborted/.test(text)) return 'timeout/abort';
     if (/hunk rejected|patch failed|context mismatch|expected first old\/context|context not found/.test(text)) return 'patch/context';

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -246,7 +246,7 @@ function _sanitizeInputSchema(schema, toolName) {
     // None of the branches' required lists are hoisted — callers that relied
     // on discriminated-union semantics will still function; the model simply
     // receives a union of the property surface with no hard-required constraint.
-    const mergedProps = {};
+    const mergedProps = { ...(schema.properties && typeof schema.properties === 'object' ? schema.properties : {}) };
     const branchDescs = [];
     for (const branch of Array.isArray(compound) ? compound : []) {
         if (branch && typeof branch === 'object' && branch.properties) {
@@ -317,7 +317,26 @@ function nativeAnthropicTools(opts) {
 function toAnthropicToolChoice(toolChoice) {
     return toolChoice === 'none' ? { type: 'none' } : undefined;
 }
-function deferredAnthropicTools(activeTools, opts) {
+function discoveredAnthropicToolNames(messages, opts, provider) {
+    const anthropicNative = new Set(['anthropic', 'anthropic-oauth']);
+    const discovered = new Set(
+        Array.isArray(opts?.session?.deferredDiscoveredTools)
+            ? opts.session.deferredDiscoveredTools.map((name) => String(name || '').trim()).filter(Boolean)
+            : [],
+    );
+    for (const message of Array.isArray(messages) ? messages : []) {
+        const native = message?.nativeToolSearch;
+        const source = String(native?.provider || '').toLowerCase();
+        if (source && source !== provider
+            && !(anthropicNative.has(source) && anthropicNative.has(provider))) continue;
+        for (const name of Array.isArray(native?.toolReferences) ? native.toolReferences : []) {
+            const key = String(name || '').trim();
+            if (key) discovered.add(key);
+        }
+    }
+    return discovered;
+}
+function deferredAnthropicTools(activeTools, messages, opts) {
     if (opts?.session?.deferredNativeTools !== true) return [];
     // A request whose ONLY tools are deferred is rejected by the API with
     // `400: At least one tool must have defer_loading=false` — happens on the
@@ -325,9 +344,10 @@ function deferredAnthropicTools(activeTools, opts) {
     // No active tools ⇒ send no deferred catalog either.
     if (!Array.isArray(activeTools) || activeTools.length === 0) return [];
     const active = new Set((activeTools || []).map((tool) => String(tool?.name || '').trim()).filter(Boolean));
+    const discovered = discoveredAnthropicToolNames(messages, opts, 'anthropic-oauth');
     const catalog = Array.isArray(opts.session.deferredToolCatalog) ? opts.session.deferredToolCatalog : [];
     return catalog
-        .filter((tool) => tool?.name && !active.has(String(tool.name)))
+        .filter((tool) => tool?.name && discovered.has(String(tool.name)) && !active.has(String(tool.name)))
         .map((tool) => ({ ...tool, deferLoading: true }));
 }
 
@@ -374,15 +394,19 @@ function toAnthropicMessages(messages) {
 
         if (m.role === 'tool') {
             const last = result[result.length - 1];
-            // Do not replay native deferred-loader `tool_reference` blocks from
-            // prior turns. They are tied to the exact Anthropic deferred-tool
-            // request that produced them; after /model or provider switches the
-            // new request may not carry the matching deferred tool surface and
-            // Anthropic rejects the history as a request validation error.
+            const native = m.nativeToolSearch;
+            const nativeProvider = String(native?.provider || '').toLowerCase();
+            const anthropicNative = new Set(['anthropic', 'anthropic-oauth']);
+            const references = (!nativeProvider || anthropicNative.has(nativeProvider))
+                && Array.isArray(native?.toolReferences)
+                ? native.toolReferences.map((name) => String(name || '').trim()).filter(Boolean)
+                : [];
             const block = {
                 type: 'tool_result',
                 tool_use_id: m.toolCallId || '',
-                content: normalizeContentForAnthropic(m.content),
+                content: references.length
+                    ? references.map((tool_name) => ({ type: 'tool_reference', tool_name }))
+                    : normalizeContentForAnthropic(m.content),
             };
             if (last?.role === 'user' && Array.isArray(last.content)) {
                 last.content.push(block);
@@ -627,7 +651,7 @@ function buildRequestBody(messages, model, tools, sendOpts) {
     if (systemBlocks.length) body.system = systemBlocks;
 
     const nativeTools = nativeAnthropicTools(opts);
-    const deferredTools = deferredAnthropicTools(tools || [], opts);
+    const deferredTools = deferredAnthropicTools(tools || [], chatMsgs, opts);
     if (tools?.length || nativeTools.length || deferredTools.length) {
         // No cache_control on tools — the systemBase BP already covers the
         // tools prefix via Anthropic's prompt cache prefix semantics (order:
@@ -1329,4 +1353,4 @@ export { parseSSEStream, _classifyMidstreamError, ANTHROPIC_MAX_MIDSTREAM_RETRIE
 
 // Test-only escape hatch for scripts/tool-smoke.mjs to verify the
 // catalog-driven max-tokens resolution without duplicating its logic.
-export const _test = { resolveMaxTokens };
+export const _test = { resolveMaxTokens, deferredAnthropicTools, sanitizeInputSchema: _sanitizeInputSchema };

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -231,7 +231,7 @@ function resolveMaxTokens(model) {
 }
 
 // Test-only escape hatch for scripts/anthropic-maxtokens-test.mjs.
-export const _test = { resolveMaxTokens };
+export const _test = { resolveMaxTokens, deferredAnthropicTools, sanitizeInputSchema: _sanitizeInputSchema };
 
 const MIN_THINKING_BUDGET = 1024;
 const THINKING_OUTPUT_RESERVE = 1024;
@@ -252,7 +252,7 @@ function _sanitizeInputSchema(schema, toolName) {
     }
     const compound = schema.oneOf || schema.anyOf || schema.allOf;
     if (!compound) return structuredClone(schema);
-    const mergedProps = {};
+    const mergedProps = { ...(schema.properties && typeof schema.properties === 'object' ? schema.properties : {}) };
     const branchDescs = [];
     for (const branch of Array.isArray(compound) ? compound : []) {
         if (branch && typeof branch === 'object' && branch.properties) {
@@ -324,16 +324,36 @@ function nativeAnthropicTools(opts) {
 function toAnthropicToolChoice(toolChoice) {
     return toolChoice === 'none' ? { type: 'none' } : undefined;
 }
-function deferredAnthropicTools(activeTools, opts) {
+function discoveredAnthropicToolNames(messages, opts, provider) {
+    const anthropicNative = new Set(['anthropic', 'anthropic-oauth']);
+    const discovered = new Set(
+        Array.isArray(opts?.session?.deferredDiscoveredTools)
+            ? opts.session.deferredDiscoveredTools.map((name) => String(name || '').trim()).filter(Boolean)
+            : [],
+    );
+    for (const message of Array.isArray(messages) ? messages : []) {
+        const native = message?.nativeToolSearch;
+        const source = String(native?.provider || '').toLowerCase();
+        if (source && source !== provider
+            && !(anthropicNative.has(source) && anthropicNative.has(provider))) continue;
+        for (const name of Array.isArray(native?.toolReferences) ? native.toolReferences : []) {
+            const key = String(name || '').trim();
+            if (key) discovered.add(key);
+        }
+    }
+    return discovered;
+}
+function deferredAnthropicTools(activeTools, messages, opts) {
     if (opts?.session?.deferredNativeTools !== true) return [];
     // Guard against an all-deferred tools array — the API rejects it with
     // `400: At least one tool must have defer_loading=false` (iteration-cap
     // final turn sends tools: []). See anthropic-oauth.mjs counterpart.
     if (!Array.isArray(activeTools) || activeTools.length === 0) return [];
     const active = new Set((activeTools || []).map((tool) => String(tool?.name || '').trim()).filter(Boolean));
+    const discovered = discoveredAnthropicToolNames(messages, opts, 'anthropic');
     const catalog = Array.isArray(opts.session.deferredToolCatalog) ? opts.session.deferredToolCatalog : [];
     return catalog
-        .filter((tool) => tool?.name && !active.has(String(tool.name)))
+        .filter((tool) => tool?.name && discovered.has(String(tool.name)) && !active.has(String(tool.name)))
         .map((tool) => ({ ...tool, deferLoading: true }));
 }
 function toAnthropicMessages(messages) {
@@ -376,15 +396,19 @@ function toAnthropicMessages(messages) {
         }
         if (m.role === 'tool') {
             const last = result[result.length - 1];
-            // Do not replay native deferred-loader `tool_reference` blocks from
-            // prior turns. They are tied to the exact Anthropic deferred-tool
-            // request that produced them; after /model or provider switches the
-            // new request may not carry the matching deferred tool surface and
-            // Anthropic rejects the history as a request validation error.
+            const native = m.nativeToolSearch;
+            const nativeProvider = String(native?.provider || '').toLowerCase();
+            const anthropicNative = new Set(['anthropic', 'anthropic-oauth']);
+            const references = (!nativeProvider || anthropicNative.has(nativeProvider))
+                && Array.isArray(native?.toolReferences)
+                ? native.toolReferences.map((name) => String(name || '').trim()).filter(Boolean)
+                : [];
             const block = {
                 type: 'tool_result',
                 tool_use_id: m.toolCallId || '',
-                content: normalizeContentForAnthropic(m.content),
+                content: references.length
+                    ? references.map((tool_name) => ({ type: 'tool_reference', tool_name }))
+                    : normalizeContentForAnthropic(m.content),
             };
             if (last?.role === 'user' && Array.isArray(last.content)) {
                 last.content.push(block);
@@ -620,7 +644,7 @@ export class AnthropicProvider {
         if (tools?.length || nativeTools.length) {
             // No cache_control on tools — the system BP covers tools via
             // Anthropic prefix semantics (order: tools → system → messages).
-            params.tools = [...nativeTools, ...toAnthropicTools([...(tools || []), ...deferredAnthropicTools(tools || [], opts)])];
+            params.tools = [...nativeTools, ...toAnthropicTools([...(tools || []), ...deferredAnthropicTools(tools || [], chatMsgs, opts)])];
         }
         // tool_choice only when tools are actually present (Anthropic rejects
         // tool_choice without tools). 'none' rides the hard-cap final turn to

package/src/runtime/agent/orchestrator/providers/custom-tool-wire.mjs

@@ -47,3 +47,31 @@ export function customToolCallFromResponseItem(item) {
 export function isCustomToolCallRecord(call) {
   return call?.nativeType === 'custom_tool_call';
 }
+
+export function nativeToolSearchCallInput(call) {
+  if (call?.nativeType !== 'tool_search_call') return null;
+  return {
+    type: 'tool_search_call',
+    call_id: call.id || '',
+    execution: 'client',
+    arguments: call.arguments && typeof call.arguments === 'object' ? call.arguments : {},
+  };
+}
+
+export function nativeToolSearchOutputInput(message, provider) {
+  const native = message?.nativeToolSearch;
+  const source = String(native?.provider || '').toLowerCase();
+  const target = String(provider || '').toLowerCase();
+  const openaiNative = new Set(['openai', 'openai-oauth']);
+  const sameNativeFamily = source === target
+    || (openaiNative.has(source) && openaiNative.has(target));
+  if (!native || (source && !sameNativeFamily)) return null;
+  if (!Array.isArray(native.openaiTools)) return null;
+  return {
+    type: 'tool_search_output',
+    call_id: message.toolCallId || '',
+    status: 'completed',
+    execution: 'client',
+    tools: native.openaiTools,
+  };
+}

package/src/runtime/agent/orchestrator/providers/openai-compat-wire.mjs

@@ -117,7 +117,7 @@ function functionToolFromSessionTool(t, name = t?.name) {
 export function toResponsesTools(tools, options = {}) {
     const provider = String(options?.provider || '').toLowerCase();
     const allowNativeToolSearch = options?.nativeToolSearch === true
-        || (options?.nativeToolSearch !== false && provider !== 'xai');
+        || (options?.nativeToolSearch !== false && (provider === 'openai' || provider === 'openai-oauth'));
     return tools.map((t) => {
         // load_tool advertises as the OpenAI-native `tool_search` wire type
         // (legacy 'tool_search' name still accepted for back-compat). xAI/Grok