mixdog 0.9.50 → 0.9.52

package/src/session-runtime/runtime-core.mjs

@@ -331,12 +331,39 @@ export function shouldMirrorCompletionToPendingQueue({
   return shouldPersistModelVisibleToolCompletion(text, meta);
 }
 
+export async function dispatchSearchRuntimeTool(name, args, callerCtx = {}, {
+  getSearchModule,
+  getCurrentCwd,
+  getSession,
+  notifyFnForSession,
+  runNativeWebSearch,
+} = {}) {
+  const currentSession = typeof getSession === 'function' ? getSession() : null;
+  const callerCwd = callerCtx?.callerCwd || (typeof getCurrentCwd === 'function' ? getCurrentCwd() : process.cwd());
+  const callerSessionId = callerCtx?.callerSessionId || currentSession?.id || null;
+  const callerSignal = callerCtx?.signal || currentSession?.controller?.signal;
+  const searchMod = await getSearchModule();
+  if (!searchMod?.handleToolCall) throw new Error('search runtime is not available');
+  return await searchMod.handleToolCall(name, args || {}, {
+    callerCwd,
+    callerSessionId,
+    routingSessionId: callerSessionId,
+    clientHostPid: callerCtx?.clientHostPid || currentSession?.clientHostPid || process.pid,
+    notifyFn: notifyFnForSession(callerSessionId),
+    signal: callerSignal,
+    nativeSearch: name === 'search'
+      ? async (searchArgs) => runNativeWebSearch(searchArgs, { signal: callerSignal })
+      : undefined,
+  });
+}
+
 export async function createMixdogSessionRuntime({
   provider,
   model,
   cwd = process.cwd(),
   toolMode = 'full',
   remote = false,
+  desktopSession = null,
 } = {}) {
   bootProfile('session-runtime:start', { provider, model, toolMode, cwd });
   let remoteEnabled = remote === true;
@@ -1049,13 +1076,15 @@ export async function createMixdogSessionRuntime({
   });
   bootProfile('channels:worker-ready', { ms: (performance.now() - channelsStartedAt).toFixed(1) });
   const toolsStartedAt = performance.now();
+  const searchRuntimeTools = (searchToolDefs?.TOOL_DEFS || [])
+    .filter((tool) => ['search', 'web_fetch', 'local_fetch', 'image_fetch'].includes(tool?.name));
   const standaloneTools = [
     TOOL_SEARCH_TOOL,
     ...(envFlag('MIXDOG_DISABLE_SKILLS') ? [] : [SKILL_TOOL]),
     CWD_TOOL,
     SESSION_MANAGE_TOOL,
     EXPLORE_TOOL,
-    ...(searchToolDefs?.TOOL_DEFS || []).filter((tool) => tool?.name === 'search' || tool?.name === 'web_fetch'),
+    ...searchRuntimeTools.filter((tool) => tool?.public !== false),
     ...(memoryToolDefs?.TOOL_DEFS || []).filter((tool) => tool?.name === 'recall' || tool?.name === 'memory'),
     ...(channelToolDefs?.TOOL_DEFS || []).filter((tool) => channels.isChannelTool(tool?.name)),
     ...(codeGraphToolDefs?.CODE_GRAPH_TOOL_DEFS || []).filter((tool) => tool?.name === 'code_graph'),
@@ -1102,22 +1131,16 @@ export async function createMixdogSessionRuntime({
     if (replay.length) selectDeferredTools(session, replay, deferredSurfaceModeForLead(mode));
   }
   internalTools.setInternalToolsProvider({
-    tools: standaloneTools,
+    tools: [...standaloneTools, ...searchRuntimeTools.filter((tool) => tool?.public === false)],
     executor: async (name, args, callerCtx = {}) => {
       const callerCwd = callerCtx?.callerCwd || currentCwd;
-      if (name === 'search' || name === 'web_fetch') {
-        const callerSessionId = callerCtx?.callerSessionId || session?.id || null;
-        const searchMod = await getSearchModule();
-        if (!searchMod?.handleToolCall) throw new Error('search runtime is not available');
-        return await searchMod.handleToolCall(name, args || {}, {
-          callerCwd,
-          callerSessionId,
-          routingSessionId: callerSessionId,
-          clientHostPid: callerCtx?.clientHostPid || session?.clientHostPid || process.pid,
-          notifyFn: notifyFnForSession(callerSessionId),
-          nativeSearch: name === 'search'
-            ? async (searchArgs) => runNativeWebSearch(searchArgs, { signal: callerCtx?.signal || session?.controller?.signal })
-            : undefined,
+      if (name === 'search' || name === 'web_fetch' || name === 'local_fetch' || name === 'image_fetch') {
+        return dispatchSearchRuntimeTool(name, args, callerCtx, {
+          getSearchModule,
+          getCurrentCwd: () => currentCwd,
+          getSession: () => session,
+          notifyFnForSession,
+          runNativeWebSearch,
         });
       }
       if (name === 'recall' || name === 'memory' || name === 'search_memories') {
@@ -1533,6 +1556,7 @@ export async function createMixdogSessionRuntime({
         clientHostPid: process.pid,
         disallowedTools: LEAD_DISALLOWED_TOOLS,
         cwd: currentCwd,
+        ...(desktopSession && typeof desktopSession === 'object' ? { desktopSession } : {}),
         coreMemoryContext,
         workflow,
         workflowContext,
@@ -1547,11 +1571,11 @@ export async function createMixdogSessionRuntime({
       session = mgr.createSession(sessionOpts);
       sessionNeedsCwdRefresh = false;
       attachSessionHooks(session, { hooks, hookCommonPayload, getCwd: () => currentCwd });
-      // Every-create MCP fold (NO blocking): seed the INITIAL deferred surface +
-      // BP1 manifest from whatever MCP servers are ALREADY connected at create
+      // Every-create MCP fold (NO blocking): seed the INITIAL provider-visible
+      // surface (and native BP1 manifest) from MCP servers connected at create
       // time. There is no await — a boot connect still mid-handshake is caught on
       // the first user turn by refreshInitialDeferredMcpSurface (session-turn-api),
-      // which re-folds the live registry into the initial manifest before the
+      // which re-folds the live registry into the first-turn surface before the
       // prompt renders. This fold keeps recreate paths (cwd change with MCP
       // already connected) seeding their manifest instead of re-announcing late.
       let connectedMcpTools = [];
@@ -2133,6 +2157,7 @@ export async function createMixdogSessionRuntime({
     resolveRoute,
     applyDeferredToolSurface,
     standaloneTools,
+    desktopSession,
   });
   const resourceApi = createResourceApi({
     getConfig: () => config,

package/src/session-runtime/session-turn-api.mjs

@@ -92,10 +92,11 @@ export function createSessionTurnApi(deps) {
           // FIRST TURN of a FRESH session (session-local gate, NOT the
           // process-wide firstTurnCompleted): an MCP server may have finished its
           // handshake BETWEEN session-create and this first send. Re-fold the
-          // LIVE registry into the INITIAL deferred surface + BP1
-          // <available-deferred-tools> manifest (sync, in-place, idempotent) and
-          // pre-mark those names announced, so they ship in the initial manifest
-          // instead of a late-tool <system-reminder>. One-shot: cleared before
+          // LIVE registry into the INITIAL provider-visible surface (sync,
+          // in-place, idempotent). Native providers rebuild BP1 and pre-mark the
+          // names announced; canonical providers extend their fixed active tool
+          // snapshot without introducing manifest/reminder semantics. One-shot:
+          // cleared before
           // the fold so a throw still never re-runs it, and a resumed session
           // (flag unset) skips straight to the late path below.
           session0.deferredInitialRefreshPending = false;

package/src/session-runtime/tool-catalog.mjs

@@ -3,12 +3,20 @@
 // application/selection logic. Pure module (session objects passed in).
 import { clean, LATE_TOOL_ANNOUNCEMENT_SENTINEL } from './session-text.mjs';
 import { estimateToolSchemaTokens, toolSchemaSignature } from '../runtime/agent/orchestrator/session/context-utils.mjs';
-import { applyInitialDeferredToolManifestToBp1, buildDeferredToolManifest } from '../runtime/agent/orchestrator/context/collect.mjs';
+import {
+  applyInitialDeferredToolManifestToBp1,
+  buildDeferredToolManifest,
+  stripDeferredToolManifestBlock,
+} from '../runtime/agent/orchestrator/context/collect.mjs';
 import { getMcpServerInstructionsMap } from '../runtime/agent/orchestrator/mcp/client.mjs';
 import {
   isResponsesFreeformTool,
   toResponsesCustomTool,
 } from '../runtime/agent/orchestrator/providers/custom-tool-wire.mjs';
+import {
+  finalizeProviderRequestTools,
+  providerNativeToolPrefixCount,
+} from './provider-request-tools.mjs';
 
 export const MEASURED_TOOL_USAGE = Object.freeze({
   read: 710,
@@ -31,6 +39,7 @@ const toolSchemaBreakdownMemo = new WeakMap();
 
 function sameToolSchemaEntries(cached, tools) {
   if (!cached || cached.entries.length !== tools.length) return false;
+  const nativePrefixCount = providerNativeToolPrefixCount(tools);
   for (let index = 0; index < tools.length; index += 1) {
     const entry = cached.entries[index];
     const tool = tools[index];
@@ -45,12 +54,17 @@ function sameToolSchemaEntries(cached, tools) {
       || entry.defer_loading !== tool?.defer_loading
       || entry.annotationsMixdogKind !== tool?.annotations?.mixdogKind
       || entry.annotationsAgentHidden !== tool?.annotations?.agentHidden
-      || entry.wireSignature !== toolSchemaSignature([tool])) return false;
+      || entry.native !== (index < nativePrefixCount)
+      || entry.wireSignature !== toolSchemaSignature(toolMeteringList(tool, index < nativePrefixCount))) return false;
   }
   return true;
 }
 
-function toolSchemaEntry(tool) {
+function toolMeteringList(tool, native) {
+  return native ? finalizeProviderRequestTools([tool], 1) : [tool];
+}
+
+function toolSchemaEntry(tool, native = false) {
   return {
     tool,
     name: tool?.name,
@@ -63,7 +77,8 @@ function toolSchemaEntry(tool) {
     defer_loading: tool?.defer_loading,
     annotationsMixdogKind: tool?.annotations?.mixdogKind,
     annotationsAgentHidden: tool?.annotations?.agentHidden,
-    wireSignature: toolSchemaSignature([tool]),
+    native,
+    wireSignature: toolSchemaSignature(toolMeteringList(tool, native)),
   };
 }
 export const DEFERRED_DEFAULT_FULL_TOOLS = Object.freeze([
@@ -170,14 +185,22 @@ export function estimateToolSchemaBreakdown(tools) {
     if (sameToolSchemaEntries(cached, tools)) return cached.value;
   }
   const out = {};
-  for (const tool of Array.isArray(tools) ? tools : []) {
+  const list = Array.isArray(tools) ? tools : [];
+  const nativePrefixCount = providerNativeToolPrefixCount(list);
+  for (let index = 0; index < list.length; index += 1) {
+    const tool = list[index];
     const bucket = toolSchemaBucket(tool);
     const row = out[bucket] || { count: 0, tokens: 0 };
     row.count += 1;
-    row.tokens += estimateToolSchemaTokens([tool]);
+    row.tokens += estimateToolSchemaTokens(toolMeteringList(tool, index < nativePrefixCount));
     out[bucket] = row;
   }
-  if (Array.isArray(tools)) toolSchemaBreakdownMemo.set(tools, { entries: tools.map(toolSchemaEntry), value: out });
+  if (Array.isArray(tools)) {
+    toolSchemaBreakdownMemo.set(tools, {
+      entries: tools.map((tool, index) => toolSchemaEntry(tool, index < nativePrefixCount)),
+      value: out,
+    });
+  }
   return out;
 }
 
@@ -246,6 +269,324 @@ function nativeProviderFamily(provider) {
   return '';
 }
 
+const ANTHROPIC_NATIVE_PROVIDERS = new Set(['anthropic', 'anthropic-oauth']);
+
+// Pure projection of the tool definitions that the next provider request will
+// serialize. Anthropic's native deferred surface sends the base active tools
+// plus only definitions that have actually been discovered through the
+// session/native tool-search history. Every other provider already receives
+// its canonical/native surface in `tools`, so preserve that array verbatim.
+export function resolveProviderRequestTools({
+  provider,
+  tools,
+  messages,
+  session,
+} = {}) {
+  const activeTools = Array.isArray(tools) ? tools : [];
+  const normalizedProvider = clean(provider || session?.provider).toLowerCase();
+  if (!ANTHROPIC_NATIVE_PROVIDERS.has(normalizedProvider)
+    || session?.deferredNativeTools !== true
+    || activeTools.length === 0) {
+    return activeTools;
+  }
+  const discovered = new Set(
+    parseToolSelection(session?.deferredDiscoveredTools),
+  );
+  for (const message of Array.isArray(messages) ? messages : []) {
+    const native = message?.nativeToolSearch;
+    const source = clean(native?.provider).toLowerCase();
+    if (source && source !== normalizedProvider
+      && !(ANTHROPIC_NATIVE_PROVIDERS.has(source)
+        && ANTHROPIC_NATIVE_PROVIDERS.has(normalizedProvider))) continue;
+    for (const name of parseToolSelection(native?.toolReferences)) discovered.add(name);
+  }
+  if (discovered.size === 0) return activeTools;
+  const activeNames = new Set(activeTools.map((tool) => clean(tool?.name)).filter(Boolean));
+  const catalog = Array.isArray(session?.deferredToolCatalog) ? session.deferredToolCatalog : [];
+  const deferredTools = catalog
+    .filter((tool) => {
+      const name = clean(tool?.name);
+      return name && discovered.has(name) && !activeNames.has(name);
+    })
+    .map((tool) => ({ ...tool, deferLoading: true }));
+  return deferredTools.length ? [...activeTools, ...deferredTools] : activeTools;
+}
+
+const OMIT_REQUEST_TOOL_VALUE = Symbol('omit-request-tool-value');
+const MAX_PROVIDER_SNAPSHOT_ARRAY_LENGTH = 1_000_000;
+
+function defineEnumerableDataProperty(target, key, value) {
+  Object.defineProperty(target, key, {
+    value,
+    enumerable: true,
+    configurable: false,
+    writable: false,
+  });
+}
+
+function boxedJsonPrimitive(value) {
+  try { return { matched: true, value: Number.prototype.valueOf.call(value) }; } catch {}
+  try { return { matched: true, value: String.prototype.valueOf.call(value) }; } catch {}
+  try { return { matched: true, value: Boolean.prototype.valueOf.call(value) }; } catch {}
+  try { return { matched: true, value: BigInt.prototype.valueOf.call(value) }; } catch {}
+  return { matched: false, value: null };
+}
+
+function providerSnapshotLengthPrimitive(value) {
+  if ((typeof value !== 'object' || value === null) && typeof value !== 'function') return value;
+  const exotic = value[Symbol.toPrimitive];
+  if (exotic !== undefined && exotic !== null) {
+    if (typeof exotic !== 'function') throw new TypeError('invalid length primitive');
+    const primitive = exotic.call(value, 'number');
+    if ((typeof primitive === 'object' && primitive !== null) || typeof primitive === 'function') {
+      throw new TypeError('invalid length primitive');
+    }
+    return primitive;
+  }
+  for (const methodName of ['valueOf', 'toString']) {
+    const method = value[methodName];
+    if (typeof method !== 'function') continue;
+    const primitive = method.call(value);
+    if ((typeof primitive !== 'object' || primitive === null) && typeof primitive !== 'function') {
+      return primitive;
+    }
+  }
+  throw new TypeError('invalid length primitive');
+}
+
+function providerSnapshotArrayLength(rawLength) {
+  let primitive;
+  let numeric;
+  try {
+    primitive = providerSnapshotLengthPrimitive(rawLength);
+    if (typeof primitive === 'bigint' || typeof primitive === 'symbol') {
+      throw new TypeError('invalid length primitive');
+    }
+    numeric = Number(primitive);
+  } catch {
+    throw new TypeError('provider tool snapshot: invalid array length');
+  }
+  if (Number.isNaN(numeric) || numeric <= 0) return 0;
+  if (!Number.isFinite(numeric)) {
+    throw new RangeError(
+      `provider tool snapshot: array length exceeds safe limit ${MAX_PROVIDER_SNAPSHOT_ARRAY_LENGTH}`,
+    );
+  }
+  const effectiveLength = Math.floor(numeric);
+  if (effectiveLength > MAX_PROVIDER_SNAPSHOT_ARRAY_LENGTH) {
+    throw new RangeError(
+      `provider tool snapshot: array length exceeds safe limit ${MAX_PROVIDER_SNAPSHOT_ARRAY_LENGTH}`,
+    );
+  }
+  return effectiveLength;
+}
+
+function normalizeRequestToolJson(value, state, {
+  arrayEntry = false,
+  key = '',
+  applyToJSON = true,
+  seededProperties = null,
+} = {}) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;
+  if (typeof value === 'number') return Number.isFinite(value) ? value : null;
+  if (typeof value === 'bigint') {
+    throw new TypeError('provider tool snapshot: BigInt is not JSON-serializable');
+  }
+  if (value === undefined || typeof value === 'function' || typeof value === 'symbol') {
+    return arrayEntry ? null : OMIT_REQUEST_TOOL_VALUE;
+  }
+  if (typeof value !== 'object') {
+    throw new TypeError(`provider tool snapshot: unsupported JSON value type ${typeof value}`);
+  }
+  if (state.active.has(value)) {
+    throw new TypeError('provider tool snapshot: cyclic value is not JSON-serializable');
+  }
+  if (state.memo.has(value)) return state.memo.get(value);
+
+  let capturedProperties = seededProperties;
+  if (applyToJSON) {
+    // JSON reads `toJSON` once before serializing an object. Preserve that
+    // single observation for an own-enumerable non-function (and for a
+    // callable that returns `this`) so property traversal cannot invoke a
+    // stateful accessor a second time.
+    const toJSONDescriptor = Object.getOwnPropertyDescriptor(value, 'toJSON');
+    const toJSON = value.toJSON;
+    if (typeof toJSON === 'function') {
+      // Keep the source guarded through both hook execution and replacement
+      // normalization. A hook returning itself, or any replacement graph that
+      // points back to its source, is a JSON cycle rather than another hook
+      // invocation.
+      state.active.add(value);
+      try {
+        const replacement = toJSON.call(value, key);
+        const normalized = normalizeRequestToolJson(replacement, state, {
+          arrayEntry,
+          key,
+          applyToJSON: false,
+          seededProperties: null,
+        });
+        state.memo.set(value, normalized);
+        return normalized;
+      } finally {
+        state.active.delete(value);
+      }
+    }
+    if (toJSONDescriptor?.enumerable) {
+      capturedProperties = { ...(seededProperties || {}), toJSON };
+    }
+  }
+  const boxed = boxedJsonPrimitive(value);
+  if (boxed.matched) {
+    return normalizeRequestToolJson(boxed.value, state, { arrayEntry, key });
+  }
+
+  const isArray = Array.isArray(value);
+  const normalized = isArray ? [] : {};
+  state.active.add(value);
+  try {
+    if (isArray) {
+      // JSON.stringify captures array length once. Accessors may mutate the
+      // source array, but they cannot extend or shorten this iteration bound.
+      const rawLength = value.length;
+      const length = providerSnapshotArrayLength(rawLength);
+      for (let index = 0; index < length; index += 1) {
+        const entry = value[index];
+        normalized.push(normalizeRequestToolJson(entry, state, {
+          arrayEntry: true,
+          key: String(index),
+        }));
+      }
+    } else {
+      // JSON-compatible request schemas are own-enumerable data. Normalize class
+      // instances/accessors to a plain record, ignore inherited mutable fields,
+      // and define keys explicitly so an own "__proto__" remains ordinary data.
+      for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== 'string') continue;
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor?.enumerable) continue;
+        // Deferred catalog selection captures `name` once before touching the
+        // candidate schema. Seed that captured value here so a stateful/throwing
+        // getter is never observed a second time during JSON normalization.
+        const entry = capturedProperties && Object.hasOwn(capturedProperties, key)
+          ? capturedProperties[key]
+          : value[key];
+        const child = normalizeRequestToolJson(entry, state, { key });
+        if (child !== OMIT_REQUEST_TOOL_VALUE) defineEnumerableDataProperty(normalized, key, child);
+      }
+    }
+  } finally {
+    state.active.delete(value);
+  }
+  Object.freeze(normalized);
+  state.memo.set(value, normalized);
+  return normalized;
+}
+
+// Establish one immutable request-attempt snapshot. Nested schema records are
+// cloned before freezing, so a catalog refresh or in-place schema mutation
+// after this boundary cannot change either provider bytes or their signature.
+export function snapshotProviderRequestTools(options = {}) {
+  const {
+    provider,
+    tools,
+    nativeTools,
+    messages,
+    session,
+  } = options;
+  const activeTools = Array.isArray(tools) ? tools : [];
+  const state = { active: new WeakSet(), memo: new WeakMap() };
+  const snapshots = [];
+  const names = new Set();
+  const activeCandidateRefs = new WeakSet();
+  // Anthropic native definitions are already provider-wire objects. Preserve
+  // their prior prepend order and duplicate behavior, but freeze the exact
+  // bytes into the same request snapshot used for accounting and retries.
+  if (ANTHROPIC_NATIVE_PROVIDERS.has(clean(provider || session?.provider).toLowerCase())) {
+    for (const nativeTool of Array.isArray(nativeTools) ? nativeTools : []) {
+      if (!nativeTool || typeof nativeTool !== 'object') continue;
+      const normalized = normalizeRequestToolJson(nativeTool, state);
+      if (normalized && typeof normalized === 'object' && !Array.isArray(normalized)) {
+        snapshots.push(normalized);
+      }
+    }
+  }
+  const nativePrefixCount = snapshots.length;
+  const finish = () => finalizeProviderRequestTools(snapshots, nativePrefixCount);
+  const appendSnapshot = (candidate, selectedName = null, deferred = false) => {
+    const normalized = normalizeRequestToolJson(candidate, state, {
+      seededProperties: selectedName === null ? null : { name: selectedName },
+    });
+    if (deferred && (
+      !normalized
+      || typeof normalized !== 'object'
+      || Array.isArray(normalized)
+      || typeof normalized.name !== 'string'
+      || !clean(normalized.name)
+      || normalized.name !== selectedName
+    )) {
+      throw new TypeError(`provider tool snapshot: selected tool identity mismatch for ${JSON.stringify(selectedName)}`);
+    }
+    if (!normalized || typeof normalized !== 'object' || Array.isArray(normalized)) return;
+    const name = clean(normalized.name);
+    if (!name || names.has(name)) return;
+    names.add(name);
+    if (!deferred) {
+      snapshots.push(normalized);
+      return;
+    }
+    const deferredSnapshot = {};
+    for (const key of Object.keys(normalized)) {
+      if (key === 'deferLoading' || key === 'defer_loading') continue;
+      defineEnumerableDataProperty(deferredSnapshot, key, normalized[key]);
+    }
+    defineEnumerableDataProperty(deferredSnapshot, 'deferLoading', true);
+    snapshots.push(Object.freeze(deferredSnapshot));
+  };
+
+  // Active candidates are provider-visible by definition: normalize each once,
+  // then perform all validation/dedupe from the plain snapshot only.
+  for (const tool of activeTools) {
+    if (tool && typeof tool === 'object') activeCandidateRefs.add(tool);
+    appendSnapshot(tool);
+  }
+
+  const normalizedProvider = clean(provider || session?.provider).toLowerCase();
+  if (!ANTHROPIC_NATIVE_PROVIDERS.has(normalizedProvider)
+    || session?.deferredNativeTools !== true
+    // Native definitions preserve their historical prepend behavior, but they
+    // do not make an otherwise all-deferred catalog eligible for expansion.
+    || names.size === 0) {
+    return finish();
+  }
+  const discovered = new Set(parseToolSelection(session?.deferredDiscoveredTools));
+  for (const message of Array.isArray(messages) ? messages : []) {
+    const native = message?.nativeToolSearch;
+    const source = clean(native?.provider).toLowerCase();
+    if (source && source !== normalizedProvider
+      && !(ANTHROPIC_NATIVE_PROVIDERS.has(source)
+        && ANTHROPIC_NATIVE_PROVIDERS.has(normalizedProvider))) continue;
+    for (const name of parseToolSelection(native?.toolReferences)) discovered.add(name);
+  }
+  if (discovered.size === 0) return finish();
+
+  // Catalog arrays have no separate key map, so `name` is their explicit
+  // selection key contract: capture it once, skip undiscovered/duplicate
+  // entries without touching schemas, and seed selected normalization with the
+  // captured value to avoid a second getter evaluation.
+  const seenCatalogRefs = new WeakSet();
+  for (const tool of Array.isArray(session?.deferredToolCatalog) ? session.deferredToolCatalog : []) {
+    if (tool && typeof tool === 'object') {
+      if (activeCandidateRefs.has(tool) || seenCatalogRefs.has(tool)) continue;
+      seenCatalogRefs.add(tool);
+    }
+    const capturedName = tool?.name;
+    const selectionName = typeof capturedName === 'string' ? clean(capturedName) : '';
+    if (!selectionName || !discovered.has(selectionName) || names.has(selectionName)) continue;
+    appendSnapshot(tool, capturedName, true);
+  }
+  return finish();
+}
+
 export function filterDisallowedTools(tools, disallowed = []) {
   if (!Array.isArray(disallowed) || disallowed.length === 0) return tools;
   const deny = new Set(disallowed.map((name) => clean(name)).filter(Boolean));
@@ -510,6 +851,7 @@ export function applyDeferredToolSurface(session, mode, extraTools = [], options
 
 export function rebuildDeferredToolSurfaceForProvider(session, provider) {
   if (!session || !Array.isArray(session.tools)) return session;
+  const previousMode = session.deferredProviderMode;
   const previousFamily = nativeProviderFamily(session.provider);
   const nextFamily = nativeProviderFamily(provider);
   const preserveNativeState = previousFamily && previousFamily === nextFamily;
@@ -532,21 +874,36 @@ export function rebuildDeferredToolSurfaceForProvider(session, provider) {
     ]));
     session.deferredSelectedTools = session.deferredCallableTools.slice();
   }
+  if (previousMode && previousMode !== session.deferredProviderMode) {
+    if (session.deferredProviderMode === 'native') {
+      session.mcpServerInstructions = getMcpServerInstructionsMap();
+      applyInitialDeferredToolManifestToBp1(session, deferredPoolToolNames(session), { rebuild: true });
+      const rendered = session.messages?.find((message) => message?.role === 'system')?.content;
+      session.deferredAnnouncedTools = deferredPoolToolNames(session)
+        .filter((name) => typeof rendered === 'string' && rendered.includes(name));
+    } else if (previousMode === 'native') {
+      const system = session.messages?.find((message) => message?.role === 'system');
+      if (system && typeof system.content === 'string') {
+        system.content = stripDeferredToolManifestBlock(system.content);
+      }
+      session.deferredAnnouncedTools = [];
+      session.deferredToolBp1Applied = true;
+    }
+  }
   return session;
 }
 
 // FIRST-TURN deferred-surface refresh (claude-code turn-time deferred manifest).
 // An MCP server may finish its handshake BETWEEN session-create and the first
 // user send. Fold those LIVE MCP tools into the boot deferred catalog + the
-// initial BP1 <available-deferred-tools> manifest (rebuilt IN PLACE — strip +
-// reappend, never duplicated) and pre-mark them announced, so they appear in the
-// INITIAL manifest instead of arriving as a late-tool <system-reminder>. Fully
-// sync (registry read is sync, no await) and idempotent: no genuinely-new MCP
-// name => no-op / no mutation. Skipped in 'full' provider mode (all tools ship
-// active — there is no deferred manifest to refresh).
+// provider-visible first-turn surface. Native providers rebuild the initial BP1
+// <available-deferred-tools> manifest IN PLACE and pre-mark names announced.
+// Manifest/canonical providers update their active fixed surface directly; the
+// canonical path never emits a deferred manifest or late reminder. Fully sync
+// and idempotent: no genuinely-new MCP name => no-op / no mutation.
 export function refreshInitialDeferredMcpSurface(session, liveMcpTools) {
   if (!session || !Array.isArray(session.messages)) return false;
-  if (session.deferredProviderMode === 'full' || session.deferredProviderMode === 'canonical') return false;
+  if (session.deferredProviderMode === 'full') return false;
   const isMcp = (name) => typeof name === 'string' && name.startsWith('mcp__');
   const byName = new Map();
   for (const tool of Array.isArray(session.deferredToolCatalog) ? session.deferredToolCatalog : []) {
@@ -562,12 +919,15 @@ export function refreshInitialDeferredMcpSurface(session, liveMcpTools) {
   }
   if (!added) return false;
   session.deferredToolCatalog = sortedCatalogByMeasuredUsage([...byName.values()]);
-  if (session.deferredProviderMode === 'manifest') {
+  if (session.deferredProviderMode === 'manifest' || session.deferredProviderMode === 'canonical') {
     const next = session.deferredToolCatalog.filter((tool) => (
       session.deferredSurfaceMode !== 'readonly' || isReadonlySelectable(tool)
     ));
     session.tools.splice(0, session.tools.length, ...next);
     session.deferredCallableTools = next.map((tool) => clean(tool?.name)).filter(Boolean);
+    if (session.deferredProviderMode === 'canonical') {
+      setDeferredToolState(session, session.deferredCallableTools);
+    }
     session.updatedAt = Date.now();
     return true;
   }