mixdog 0.9.89 → 0.9.91

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.89",
+  "version": "0.9.91",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -100,6 +100,7 @@
     "test:route-scope": "node --test scripts/route-scope-isolation-test.mjs",
     "test:schedule-reload": "node --test scripts/schedule-reload-arm-test.mjs",
     "test:media": "node --test src/runtime/media/store.test.mjs src/runtime/media/renditions.test.mjs",
+    "test:shell-harness": "node --test scripts/shell-harness-regression-test.mjs",
     "failures": "node scripts/tool-failures.mjs",
     "trace:llm": "node scripts/llm-trace-summary.mjs",
     "diag:sessions": "node scripts/session-diag.mjs",
@@ -163,5 +164,8 @@
     "acorn": "^8.17.0",
     "esbuild": "^0.28.1",
     "eslint-scope": "^9.1.2"
+  },
+  "optionalDependencies": {
+    "@vscode/ripgrep": "^1.18.0"
   }
 }

package/src/output-styles/detailed.md

@@ -0,0 +1,27 @@
+---
+name: detailed
+title: Detailed
+description: Detailed engineering summaries
+aliases: verbose, full
+keep-coding-instructions: true
+---
+
+# Output Style
+
+Detailed — the fullest style, yet still summary-form, never essay-form.
+Depth comes from picking the right facts, not explaining more.
+
+- Lead with the outcome in one short sentence, then only the detail that
+  matters: what changed and the key facts (paths, commands, errors).
+  Conclusions, not reasoning; cite a symbol/path only as an anchor. Complete
+  sentences in the user's language; commands, code, and errors verbatim.
+- Say each point once. Size budget: roughly TWICE Simple — ~2 rendered lines
+  per point, whole report ~10–15 lines.
+- Short labels such as `Changes` or `Risks / next steps` in final reports
+  only; none on interim progress; collapse trivial tasks to a couple of
+  sentences. Never dump raw tool output.
+- Do not hide blockers or failures; one short clause each.
+- One bullet = one idea, at most 2 rendered lines, opened with a short
+  **bold key point**; blank line between multi-line items; nest one
+  sub-level at most.
+- Never name this style unless asked.

package/src/output-styles/extreme-minimal.md

@@ -11,12 +11,12 @@ keep-coding-instructions: true
 Extreme minimal — the most compressed style: exactly one sentence, under 100
 characters.
 
-- Reply with a SINGLE sentence, always under 100 characters. Never a second
-  sentence, clause pile-up, or run-on that smuggles in extra facts.
-- State only the net result. Drop file lists, how-it-was-done, verification
-  detail, and follow-ups unless one is the single most decisive fact.
-- No headings, bullets, numbered lists, labels, or sections — one plain sentence
-  only, even when the request says "report" or "summary".
+- A SINGLE sentence, always under 100 characters — never a second sentence or
+  a run-on that smuggles in extra facts.
+- Net result only: drop file lists, methods, and follow-ups unless one is
+  the single decisive fact.
+- No headings, bullets, labels, or sections — one plain sentence, even when
+  the request says "report".
 - Preferred pattern: `<target> changed.`
-- Preserve only the single decisive path, command, symbol, or error verbatim,
-  and only if it fits the limit.
+- Preserve one decisive path, command, symbol, or error verbatim, only if it
+  fits the limit.

package/src/output-styles/minimal.md

@@ -9,15 +9,12 @@ keep-coding-instructions: true
 
 Minimal — a very short summary: one or two sentences, nothing more.
 
-- Summarize only the net result in one short sentence; add a second short
-  sentence only for a fact (verification, blocker) that genuinely needs it —
-  never a run-on that crams extra facts in.
-- Size budget: roughly HALF the Simple style — 1–2 plain, complete sentences
-  (~2–3 rendered lines) however large the task was, concept-level only.
-- Summarize, never itemize: no headings, bullets, labels, or sections and no
-  file-by-file detail — state only what the change accomplishes, even when
-  the request says "report" or "summary".
-- Preferred pattern: `<target> changed. <verification> passed.` If
-  verification was not run, say so.
+- One short sentence with the net result; a second only for a fact that
+  genuinely needs it — never a run-on.
+- Roughly HALF Simple: 1–2 plain sentences (~2–3 rendered lines) however
+  large the task, concept-level only.
+- Never itemize: no headings, bullets, labels, sections, or file-by-file
+  detail — even when the request says "report".
+- Preferred pattern: `<target> changed.`
 - Preserve only the single decisive path, command, symbol, API name, code, or
   error verbatim.

package/src/output-styles/simple.md

@@ -2,32 +2,24 @@
 name: simple
 title: Simple
 description: Outcome-first concise handoffs for coding work
-aliases: concise, handoff
+aliases: concise, handoff, default
 keep-coding-instructions: true
 ---
 
 # Output Style
 
-Practical concise — outcome-first handoffs for coding work: summarize the
-result, do not narrate or explain the change.
+Practical concise — outcome-first handoffs: summarize the result, do not
+narrate the work.
 
 - Open with the outcome in one sentence: done, blocked, or awaiting a decision.
-- Summarize at the concept level — what the change accomplishes, not a
-  per-file changelog or code path; cite a path (`file_path:line_number`) only
-  as a navigation anchor, never as the explanation.
-- Compress by cutting content (filler, acknowledgments, hedging, restated
-  facts), not grammar: natural, complete sentences in the user's language;
-  paths, commands, symbols, code, and exact errors stay verbatim.
-- Controlled detail: 1–3 short bullets or 2–3 sentences; state each point
-  once. Size budget: roughly HALF the Default style and TWICE Minimal —
-  whole reply ~5–7 lines.
-- Layout: one idea per bullet, ONE line each, led with a short bold key
-  phrase; blank line between multi-line list items — never a dense wall of
-  text.
-- Final handoffs may use labels like `Changes`, `Verification`, and
-  `Risks / next steps`; do not label interim progress.
-- Synthesize agent or retrieval results; never forward raw reports, long file
-  lists, tool traces, or session metadata.
-- Do not hide blockers, failed verification, or required follow-up — state
-  them in one short clause; if verification was not run, say so once.
+- Concept-level summary of what changed, not a per-file changelog; cite a
+  path (`file:line`) only as an anchor. Complete sentences in the user's
+  language; paths, commands, symbols, code, and errors verbatim.
+- 1–3 short bullets or 2–3 sentences, each point once; whole reply ~5–7
+  lines (HALF Detailed, TWICE Minimal).
+- One idea per bullet, ONE line each, led by a short bold key phrase; blank
+  line between multi-line items.
+- Final handoffs may use short labels like `Changes` or `Risks / next
+  steps`; none on interim progress. Never dump raw tool output.
+- Do not hide blockers or failures; one short clause each.
 - Never name this style unless asked.

package/src/rules/lead/01-general.md

@@ -4,7 +4,15 @@
   multi-provider agent workflows. Never identify as generic OpenAI/ChatGPT.
 - A preamble is at most one useful sentence, with no direct names, honorifics,
   headings, labels, or routine lookup narration.
-- Destructive/hard-to-reverse action needs explicit confirmation.
+- Destructive/hard-to-reverse action needs explicit confirmation and explicit
+  validated target paths — never `~`, a root, or unresolved variables/globs;
+  report material deletions with recoverability.
 - Act proactively; ask only for decisions.
+- Mid-task input: a replacement supersedes current work, an addition folds
+  into it, a status question gets a brief answer while work continues; after
+  context compaction continue from the summary — never restart or redo
+  finished work.
+- When blocked, exhaust safe in-scope checks once and report the blocker;
+  never spend turns without a tool call or new evidence.
 - Your final message ends the turn: answer only when the work is done. After a
   failed tool call, fix and re-run it, or state plainly that it is unresolved.

package/src/rules/lead/lead-brief.md

@@ -1,18 +1,19 @@
 # Lead Brief
 
-- Use one-line fragments. `Task:` is mandatory and lossless: preserve intent,
-  required and forbidden outcomes, completion/stop boundary, user-supplied
-  exact targets, and exact replacements/outputs. Never infer exactness from
-  task name, file count, or difficulty.
-- Each role constructs its own `Task:` from the original request and official
-  spec/test acceptance criteria, preserving every requirement and boundary.
+- Minimum chars, maximum info: one-line fragments. `Task:` is mandatory and
+  lossless: each role
+  constructs it from the original request and official spec/test acceptance
+  criteria, preserving intent, required and forbidden outcomes,
+  completion/stop boundary, user-supplied exact targets, and exact
+  replacements/outputs. Never infer exactness from task name, file count, or
+  difficulty.
 - Omit role-known rules, repeated context/facts, and padding; split scope
   without discarding requirements.
-- Other fields are task-specific deltas: `Anchors:`, `Allow/Forbid:`,
-  `Deliver:`. Omit empty fields. Anchors are `file:line` plus a one-line
-  conclusion, never log/code bodies. State outcomes, not methods, unless the
-  method is required. `Deliver:` sets handoff shape/size.
-- Send a full brief only for a fresh spawn or `respawned: true`; live follow-ups
-  contain only the delta. A dead-tag send is cold and must re-supply anchors.
-- Never `send` mid-run; batch one follow-up after completion; interrupt only to
-  cancel. Agent communication is English.
+- Other fields are task-specific deltas — `Anchors:` (`file:line` plus a
+  one-line conclusion, never log/code bodies), `Allow/Forbid:`, `Deliver:`
+  (sets handoff shape/size); omit empty fields. State outcomes, not methods,
+  unless the method is required.
+- Full brief only for a fresh spawn or `respawned: true`; live follow-ups
+  carry only the delta; a dead-tag send is cold and must re-supply anchors.
+- Never `send` mid-run; batch one follow-up after completion; interrupt only
+  to cancel. Agent communication is English.

package/src/rules/shared/01-tool.md

@@ -1,40 +1,34 @@
 # Tool Use
 
-- Before the first call, gather every known facet in one tool message; for
-  each facet choose exactly one shortest locator route:
-  broad/uncertain→`explore` (roles without it: `find`); partial path/name→
-  `find`; verified root+wildcard→
-  `glob`; quoted/non-identifier literal or regex→`grep`; exact code
-  identifier/relation→`code_graph` before grep; known file/span→`read`
-  directly without `grep`; verified directory→`list`; known edit→
-  `apply_patch` directly, with no preparatory `read`;
-  program/state change→`shell`; web/current external info→`search`.
-- Shortest total calls, maximum batching — every turn. Combine variants,
-  symbols, scopes, paths, and queries into one call; put all independent
-  calls (probes, reads, hypotheses, commands) in one message — concurrent
-  regardless of tool, shell included. Sequential singles only for a
-  genuinely dependent next step. Distinct facets, not alternative routes.
-  Only apply_patch executes in order.
-- Batch compatible reads — same-file regions as real `{path,offset,limit}`
-  arrays covering the whole logical unit — in one `path[]` call, and graph
-  targets in arrays. Don't reread returned spans. Put all new edits in one
-  patch.
+- Before the first call, gather every known facet in one tool message; one
+  shortest route per facet: broad/uncertain→`explore` (roles without it:
+  `find`); partial path/name→`find`; verified root+wildcard→`glob`;
+  quoted/non-identifier literal or regex→`grep`; exact code identifier/
+  relation→`code_graph` before grep; known file/span→`read` directly without
+  `grep`; verified directory→`list`; known edit→`apply_patch` (span already
+  seen; else `read`/`grep` first); program/state change→`shell`; web/current
+  external info→`search`.
+- Shortest total calls, maximum batching — every turn: all independent calls
+  in one concurrent message (shell included); combine variants/symbols/
+  scopes/paths/queries per call; same-file regions as one real
+  `{path,offset,limit}` array; graph targets as arrays; `explore` facets in
+  one `query[]` (max 8, no rephrased duplicates); all new edits in one patch.
+  Distinct facets, not alternative routes; sequential singles only for a
+  genuinely dependent step (unconditional follow-ups are not dependent —
+  batch them); only apply_patch executes in order.
 - Verified paths: project root, session cwd, user-provided, tool-returned.
-  `find` first for guessed path/name fragments (same turn as other probes);
-  on ENOENT, find the basename.
-- At task start, batch all `explore` facets in one `query[]` call, maximum 8,
-  without rephrased duplicates. Retry `EXPLORATION_FAILED` once with changed
-  tokens.
-- Stop when evidence covers the deliverable; don't re-locate or re-verify a
-  sufficient anchor. A returned `path:line` freezes the location; inspecting
-  its content with read/code_graph is valid.
-- A nonzero `content_with_context` result resolves that concept — act on it;
-  only zero/error results justify changed tokens or scope.
-- `apply_patch` is the primary edit tool: send the patch as soon as the target
-  path and new content are known. `read` is for discovery or for recovery
-  after a patch failed on insufficient context.
-- A shell placed after `apply_patch` in the same turn runs after the patch
-  lands — batch edits and their verification freely.
-- A command promoted to background is a decision point: continue only if
-  observed progress fits the budget, otherwise switch routes. Waiting is an
-  explicit choice.
+  `find` first for guessed path/name fragments; on ENOENT, find the basename.
+  Retry `EXPLORATION_FAILED` once with changed tokens.
+- Stop when evidence covers the deliverable: a returned `path:line` or
+  nonzero `content_with_context` result is final — act on it (inspecting it
+  via read/code_graph is valid); only zero/error results justify changed
+  tokens or scope. Don't re-locate, re-verify, or reread returned spans.
+- `apply_patch` is the primary edit tool: send the patch as soon as target
+  path and new content are known. Hunk context comes verbatim from the newest
+  tool output of that span (`read`/`grep`/your own patch — post-patch content
+  after edits), never retyped from memory; one look-up beats a failed patch.
+  A same-turn shell after `apply_patch` runs once the patch lands.
+- After starting or receiving a background task, end the turn — its
+  completion notification resumes the work. Never poll, sleep-loop, or block;
+  explicit wait only for a result the current turn cannot proceed without.
+  Long commands whose output the next step does not need go async.

package/src/runtime/agent/orchestrator/agent-runtime/commit-message-completion.mjs

@@ -0,0 +1,67 @@
+import { loadConfig } from '../config.mjs';
+import { getProvider, initProviders } from '../providers/registry.mjs';
+import { resolveMaintenanceRoute } from './maintenance-route.mjs';
+
+export const COMMIT_MESSAGE_SYSTEM_PROMPT = 'You are generating one git commit message from the provided diff. First line: imperative mood, at most 72 characters, no trailing period. Optionally add a blank line and a short body (wrapped at 72 characters) explaining WHY. Output ONLY the commit message - no preamble, no code fences, no quotes.';
+
+export function commitMessageSystemPrompt(style = '') {
+    const hint = String(style || '').trim();
+    return hint ? `${COMMIT_MESSAGE_SYSTEM_PROMPT}\n${hint}` : COMMIT_MESSAGE_SYSTEM_PROMPT;
+}
+
+function resultText(result) {
+    if (typeof result === 'string') return result;
+    if (typeof result?.content === 'string') return result.content;
+    if (Array.isArray(result?.content)) {
+        return result.content
+            .map((part) => part?.type === 'text' ? String(part.text || '') : '')
+            .filter(Boolean)
+            .join('\n');
+    }
+    return '';
+}
+
+export function createCommitMessageCompletion(deps = {}) {
+    const load = deps.loadConfig || loadConfig;
+    const resolveRoute = deps.resolveMaintenanceRoute || resolveMaintenanceRoute;
+    const initialize = deps.initProviders || initProviders;
+    const providerFor = deps.getProvider || getProvider;
+
+    return async function generateCommitMessage(source, options = {}) {
+        const text = String(source || '').trim();
+        if (!text) return '';
+        const signal = options.signal || null;
+        const config = load();
+        // Commit messages are maintenance-class work: they ride the same
+        // route as session titles instead of the main conversation model.
+        const route = resolveRoute({
+            agent: 'title-agent',
+            config,
+        });
+        if (!route || typeof route !== 'object') {
+            throw new Error('Commit message maintenance route is unresolved.');
+        }
+        const providerName = String(route.provider || '').trim();
+        const model = String(route.model || '').trim();
+        if (!providerName || !model) {
+            throw new Error('Commit message maintenance route requires provider and model.');
+        }
+        await initialize(config.providers || {}, { signal });
+        const provider = providerFor(providerName);
+        if (!provider || typeof provider.send !== 'function') {
+            throw new Error(`Commit message provider is unavailable: ${providerName}`);
+        }
+        const response = await provider.send([
+            { role: 'system', content: commitMessageSystemPrompt(options.style) },
+            { role: 'user', content: text },
+        ], model, undefined, {
+            signal,
+            effort: String(route.effort || '').trim() || 'low',
+            fast: route.fast === true,
+            maxOutputTokens: 400,
+        });
+        return resultText(response).trim();
+    };
+}
+
+export const generateCommitMessage = createCommitMessageCompletion();

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -128,6 +128,12 @@ export {
 // this catches tight deterministic-failure loops (e.g. a command that errors
 // the same way every time) far earlier than 100 iterations.
 const REPEAT_FAIL_LIMIT = 3;
+// Structured provider continuations (endTurn=false / pause_turn) are honored,
+// but must not sustain an unbounded text-only loop: a lead session was
+// observed burning a 30-minute agent budget (26K output tokens, zero tool
+// calls) on back-to-back continuations. After this many continuations with no
+// intervening tool batch, the current text is accepted as the final answer.
+const PROVIDER_CONTINUATION_NO_TOOL_LIMIT = Math.max(1, Number(process.env.MIXDOG_PROVIDER_CONTINUATION_NO_TOOL_LIMIT) || 8);
 // A provider max-output stop is not a completed assistant turn, even when it
 // contains useful text. Preserve each partial in the provider transcript and
 // grant at most three direct continuations before surfacing a hard truncation.
@@ -384,6 +390,12 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     // hard iteration cap remains the sole bound on how long a provider may
     // keep declaring "not done" inside one user turn.
     let _providerContinuationCount = 0;
+    // Continuations since the last executed tool batch — bounds the text-only
+    // continuation runaway (see PROVIDER_CONTINUATION_NO_TOOL_LIMIT).
+    let _continuationsSinceToolBatch = 0;
+    // Loop-level transport replays consumed this ask (see send-with-recovery
+    // TRANSPORT_RETRY_MAX): bounded per turn, reset only with a fresh ask.
+    let _transportRetriesUsed = 0;
     // Claude Code parity: queued prompt/task notifications are attached after a
     // tool batch, before the continuation provider send. Normal batches drain
     // up to 'next'; a Sleep-like tool grants a 'later' flush.
@@ -627,6 +639,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             () => sendWithRecovery({
                 provider, messages, model, sendTools, tools: sendTools, opts,
                 sessionId, sessionRef, nextIteration, contextOverflowRetryUsed,
+                transportRetriesUsed: _transportRetriesUsed, signal,
             }),
         );
         if (_sendResult.action === 'retry') {
@@ -635,6 +648,11 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             reactiveOverflowRetryPending = true;
             continue;
         }
+        if (_sendResult.action === 'retry_transport') {
+            _transportRetriesUsed += 1;
+            delete opts.cacheBreakIntent;
+            continue;
+        }
         response = _sendResult.response;
         opts.onToolCall = undefined;
         delete opts.cacheBreakIntent;
@@ -821,11 +839,26 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             const continuationSignal = !isOutputLimitStop && stopReason !== 'refusal'
                 ? providerContinuationSignal(response)
                 : null;
-            if (continuationSignal && pushIntermediateAssistantResponse(response)) {
+            if (continuationSignal && _continuationsSinceToolBatch >= PROVIDER_CONTINUATION_NO_TOOL_LIMIT) {
+                // Text-only continuation runaway: stop honoring the signal and
+                // fall through to the terminal handling below, which accepts
+                // the current content as the final answer (or ends the loop).
+                process.stderr.write(`[loop] provider continuation cap ${PROVIDER_CONTINUATION_NO_TOOL_LIMIT} reached without tool calls (sess=${sessionId || 'unknown'}); accepting current text as final.\n`);
+                try {
+                    appendAgentTrace({
+                        sessionId,
+                        iteration: iterations,
+                        kind: 'steer',
+                        payload: { tag: 'provider_continuation_no_tool_cap', count: _continuationsSinceToolBatch },
+                        agent: sessionAgent || null,
+                    });
+                } catch { /* best-effort */ }
+            } else if (continuationSignal && pushIntermediateAssistantResponse(response)) {
                 if (hasContent && !suppressMidTurnText) {
                     try { opts.onAssistantText?.(response.content); } catch { /* best-effort */ }
                 }
                 _providerContinuationCount += 1;
+                _continuationsSinceToolBatch += 1;
                 _emptyNudgeStreak = 0;
                 try {
                     appendAgentTrace({
@@ -1018,6 +1051,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         // Settle the stop hook on the batch that actually executed.
         _toolFailureStopHook.endBatch(_callsToExecute);
         _toolBatchJustCompleted = true;
+        _continuationsSinceToolBatch = 0;
         _lastToolBatchHadSleep = _callsToExecute.some(isSleepLikeToolCall);
     }
     // Classify WHY the loop ended so agent-tool can promote an empty/abnormal

package/src/runtime/agent/orchestrator/session/loop/stored-tool-args.mjs

@@ -28,6 +28,30 @@ const STORED_TOOL_ARG_LIMIT = 10_000;
 const STORED_TOOL_ARG_PREVIEW_HEAD = 360;
 const STORED_TOOL_ARG_PREVIEW_TAIL = 160;
 
+// File paths a compacted patch touched, so the marker itself tells the model
+// WHICH files to re-read instead of replaying the marker as patch input
+// (measured: the compacted-placeholder resubmission was 39% of apply_patch
+// failures). Marker contract: the returned text may not contain ']' or a
+// newline, so bracket characters are stripped from paths.
+function _compactedPatchTargets(value) {
+    const seen = new Set();
+    const add = (raw) => {
+        const p = String(raw || '').trim().replace(/[\[\]\r\n]/g, '');
+        if (p && p !== '/dev/null' && !seen.has(p)) seen.add(p);
+    };
+    const v4a = /^\*\*\*\s*(?:Update|Add|Delete) File:\s*(.+)$/gim;
+    for (let m; seen.size < 12 && (m = v4a.exec(value));) add(m[1]);
+    if (!seen.size) {
+        const uni = /^(?:\+\+\+|---)\s+(?:[ab]\/)?(\S+)/gm;
+        for (let m; seen.size < 12 && (m = uni.exec(value));) add(m[1]);
+    }
+    const all = [...seen];
+    const shown = all.slice(0, 4).map((p) => (p.length > 70 ? `…${p.slice(-70)}` : p));
+    if (!shown.length) return '';
+    const more = all.length > shown.length ? ` +${all.length - shown.length} more` : '';
+    return `${shown.join(', ')}${more}`;
+}
+
 function compactStoredToolArgString(value, key = '', opts = {}) {
     if (typeof value !== 'string') return value;
     const isBody = STORED_TOOL_ARG_BODY_KEY_RE.test(key);
@@ -39,8 +63,11 @@ function compactStoredToolArgString(value, key = '', opts = {}) {
     // Body markers carry the recovery instruction inline: the compaction
     // detectors only require the `[mixdog compacted ...]` shape (no ']' or
     // newline inside), so the longer text stays fully compatible.
+    const targets = /^patch$/i.test(key) ? _compactedPatchTargets(value) : '';
     const marker = isBody
-        ? `[mixdog compacted ${key}: ${value.length} chars, sha256:${hash}; already applied - do not copy; re-read the file and write a fresh patch]`
+        ? (targets
+            ? `[mixdog compacted ${key}: ${value.length} chars, sha256:${hash}; already applied to ${targets} - do not copy; re-read those files and write a fresh patch]`
+            : `[mixdog compacted ${key}: ${value.length} chars, sha256:${hash}; already applied - do not copy; re-read the file and write a fresh patch]`)
         : `[mixdog compacted ${key || 'string'}: ${value.length} chars, sha256:${hash}; do not copy]`;
     // Body args (patch / old_string / new_string / content / rewrite) are
     // apply_patch / edit inputs. Keeping a head/tail preview leaves real patch

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -318,7 +318,11 @@ export function createSession(opts) {
     const hasCallerAllow = Array.isArray(opts.schemaAllowedTools);
     const tools = finalizeSessionToolList(toolsForRouting, {
         schemaAllowedTools: hasCallerAllow ? opts.schemaAllowedTools : null,
-        disallowedTools: hiddenAgent ? [...(Array.isArray(opts.disallowedTools) ? opts.disallowedTools : []), 'Skill'] : opts.disallowedTools,
+        disallowedTools: [
+            ...(Array.isArray(opts.disallowedTools) ? opts.disallowedTools : []),
+            ...(hiddenAgent ? ['Skill'] : []),
+            ...(!ownerIsAgent && workflowDisallowsAgentTool(opts.workflow) ? ['agent'] : []),
+        ],
         ownerIsAgent,
         resolvedAgent,
     });
@@ -499,6 +503,17 @@ const ACTIVE_OWNER_HB_FRESH_MS = 2 * 60 * 1000; // heartbeat freshness window
 const PREPARED_RESUME_LIMIT = 8;
 const _preparedResumes = new Map();
 
+// A workflow that delegates to NOBODY (agents: declared empty — e.g. Solo)
+// must not put the `agent` tool in the session tool list: policy rejects
+// every call, so a schema-visible tool is a guaranteed error turn plus dead
+// schema weight. Field source: workflowSummary() carries agentsConfigured /
+// agents; older persisted sessions lack them and keep the tool (safe).
+function workflowDisallowsAgentTool(workflow) {
+    return Boolean(workflow && typeof workflow === 'object'
+        && workflow.agentsConfigured === true
+        && Array.isArray(workflow.agents) && workflow.agents.length === 0);
+}
+
 function _prepareResumeTools(session, preset) {
     const ownerIsAgent = isAgentOwner(session);
     const skills = ownerIsAgent ? [] : collectPromptSkillsCached(session.cwd);
@@ -521,7 +536,10 @@ function _prepareResumeTools(session, preset) {
         ownerIsAgent,
         tools: finalizeSessionToolList(toolsForRouting, {
             schemaAllowedTools: Array.isArray(session.schemaAllowedTools) ? session.schemaAllowedTools : null,
-            disallowedTools: getHiddenAgent(session.agent || null) ? ['Skill'] : null,
+            disallowedTools: [
+                ...(getHiddenAgent(session.agent || null) ? ['Skill'] : []),
+                ...(!isAgentOwner(session) && workflowDisallowsAgentTool(session.workflow) ? ['agent'] : []),
+            ],
             ownerIsAgent,
             resolvedAgent: session.agent || null,
         }),