[Bug] Continuing web session loses 25 native tools and matching prompt sections between turns

[poojanajani-strique]

Bug report: standard web session loses 25 native tools and matching prompt sections between turns; background job cannot be stopped

Summary

A captured two-turn web session started a managed background shell job successfully. On the next user request, close the background task, the recorded request catalog had lost 25 native tools, including bash, job_list, job_output, and job_kill. Corresponding system-prompt sections also disappeared. All 225 MCP tools remained, and every retained tool schema was identical.

The capability loss is confirmed in the session export. Its initiating lifecycle/configuration event is not known. This report does not claim a proven core race or a deterministic clean-install reproduction.

Environment and qualification

• Incident: 2026-09-10, macOS, browser UI, top-level session with preset standard.
• Recorded provider/model: zai / glm-5.3-flash, reasoning effort high. Logged provider/model configuration did not change between the two headers.
• Source checkout inspected afterward: local commit ee55cf07920a021a6a609b23fcfd0c9cafcf9297, based on 0.1.5-alpha.1; the relevant core files match upstream commit 5dda764ed3aa172535a7967b06ff95d9cbfe536a.
• This is a customized deployment, including local skills-related changes, installed third-party/local plugins and MCP integrations. These have not been eliminated as contributing factors. The ZIP does not record an exact runtime commit or full resolved plugin composition.
• Capture: one session.v3.jsonl, 354 JSON records, including 353 contiguous events (seq 0 through 352), 2 turns, 54 tool calls with corresponding results. Private paths, account data, credentials and correlation identifiers are omitted below.

Observed sequence

1. During turn 1, native shell/filesystem tools worked and the agent built a small web application.
2. At seq 224 / JSONL line 226 it called bash with run_in_background: true; seq 225 returned started background job bash-1. A later shell call verified HTTP 200 from the dev server.
3. Turn 1 ended at 12:59:41 Asia/Kolkata. At 14:41:02 the user requested close the background task.
4. Before generating the shutdown response, the second logged request header already lacked the shell and job tools. The corresponding system prompt lacked their instruction sections as well.
5. No bash or job_kill call was emitted during turn 2. The agent instead entered an unrelated MCP-call loop and eventually supplied manual shutdown instructions. The capture contains no successful agent-issued shutdown.

These are steps observed in this incident, not a claim that waiting this long deterministically reproduces the loss. No preset switch, unmount or reconstruction event explaining the change appears in this export; absence from this log does not prove none occurred at the host level.

Request-catalog evidence

Recorded header	Turn 1	Turn 2
Event sequence	12	242
JSONL line, metadata included	14	244
Local time, Asia/Kolkata	12:43:55	14:41:02
Total tools	257	232
MCP tools	225	225
Other tools	32	7
Shell and job-control tools	present	absent

Exactly these names were removed; no new tool was added:

ask_user_question, bash, create_goal, edit, exit_plan_mode, get_goal,
glob, grep, interrupt_agent, job_kill, job_list, job_output, list_agents,
ralph, read, read_image, send_message, skill, subagent_fork, todo_write,
update_goal, web_fetch, web_search, workflow, write

The remaining non-MCP tools were:

learning_evidence, learning_propose, memory_mutate, memory_read,
memory_search, memory_stats, subagent

The later system-prompt event is seq 240 / JSONL line 242. Its filesystem, shell, job-control, goal and workflow sections are absent. This is a change in Harness's recorded request context, not merely the model overlooking a tool which was still listed.

Expected behavior

A continuing standard-preset session should retain its native capabilities unless configuration or policy deliberately changes them. If capabilities are intentionally removed, that transition should be observable, and loss of job-control access should be explained to the agent/user.

Relevant source and limits of attribution

• Standard preset composition includes shell, filesystem and job-control contributions.
• Preset scope binding and unjoined-agent diagnostics explain how preset tools and prompt sections depend on the agent joining its standing scope.
• ToolRuntime scope-derived view combines global and scope-chain contributions.
• Request construction records the request header.

The simultaneous disappearance of tools and prompt sections is consistent with composition, registration lifetime or scope visibility changing. This remains an inference. Host lifecycle logs and a reproduction are needed to distinguish those mechanisms. Ordinary preset-file generation changes preserve existing standing generations in the inspected implementation, so this report does not attribute the failure to normal file refresh.

Existing preset mount/invariant tests were run against the checkout: 57 passed across 2 files. They do not reproduce or fix this incident.

Related reports

• #4946 reports missing bash after a QQbot disposal/reconstruction path. Similar symptom, but this case is a top-level web session, explicitly records catalog and prompt shrinkage, and has no corresponding lifecycle transition in its export. A common cause is not established.
• #4921 concerns child-agent inherited capabilities, a different path.
• The downstream wrong-tool repetition overlaps #3819; the repeated-call evidence is being added there separately.

Useful next diagnostic

Capture agent scope ancestry, standing-generation identity, registration disposal and resolved tool/prompt contributions before and after a continuing web session becomes idle or its plugins reload. Compare the runtime registry with the exact assembled model request. The regression should assert preservation of the shell/job tool set, not just that a second response completes.

Redacted evidence and verifier

The following allowlisted summary is derived from the export. It is not a full raw session or provider-wire trace. The accompanying verifier checks catalog changes, call/result correspondence, normalized assistant-to-dispatch identity, approval counts and stop-message ordering without executing any archived command.

Redacted event summary (JSON)

{
  "kind": "allowlisted_summary_of_captured_events_not_raw_provider_wire",
  "records": 354,
  "events": 353,
  "catalogs": [
    {
      "seq": 12,
      "jsonl_line": 14,
      "total": 257,
      "mcp": 225,
      "other": 32
    },
    {
      "seq": 242,
      "jsonl_line": 244,
      "total": 232,
      "mcp": 225,
      "other": 7
    }
  ],
  "removed_tools": [
    "ask_user_question",
    "bash",
    "create_goal",
    "edit",
    "exit_plan_mode",
    "get_goal",
    "glob",
    "grep",
    "interrupt_agent",
    "job_kill",
    "job_list",
    "job_output",
    "list_agents",
    "ralph",
    "read",
    "read_image",
    "send_message",
    "skill",
    "subagent_fork",
    "todo_write",
    "update_goal",
    "web_fetch",
    "web_search",
    "workflow",
    "write"
  ],
  "retained_schemas_identical": true,
  "retained_non_mcp": [
    "learning_evidence",
    "learning_propose",
    "memory_mutate",
    "memory_read",
    "memory_search",
    "memory_stats",
    "subagent"
  ],
  "all_54_assistant_calls_match_dispatch_and_have_results": true,
  "turn_2_repeated_call": {
    "name": "mcp__meta_ads__ads_get_ad_accounts",
    "arguments": {
      "advertiser_request": "close the background task",
      "client_conversation_id": "<REDACTED>"
    },
    "calls": [
      {
        "seq": 244,
        "step": 1
      },
      {
        "seq": 251,
        "step": 2
      },
      {
        "seq": 255,
        "step": 2
      },
      {
        "seq": 265,
        "step": 3
      },
      {
        "seq": 272,
        "step": 4
      },
      {
        "seq": 282,
        "step": 5
      },
      {
        "seq": 289,
        "step": 6
      },
      {
        "seq": 299,
        "step": 7
      },
      {
        "seq": 310,
        "step": 8
      },
      {
        "seq": 317,
        "step": 9
      },
      {
        "seq": 324,
        "step": 10
      },
      {
        "seq": 334,
        "step": 11
      },
      {
        "seq": 341,
        "step": 12
      }
    ],
    "approval_decisions": [
      {
        "seq": 246,
        "outcome": "allowed-once"
      },
      {
        "seq": 253,
        "outcome": "allowed-once"
      },
      {
        "seq": 257,
        "outcome": "allowed-once"
      },
      {
        "seq": 267,
        "outcome": "allowed-once"
      },
      {
        "seq": 274,
        "outcome": "rejected"
      },
      {
        "seq": 284,
        "outcome": "rejected"
      },
      {
        "seq": 291,
        "outcome": "rejected"
      },
      {
        "seq": 301,
        "outcome": "rejected"
      },
      {
        "seq": 312,
        "outcome": "rejected"
      },
      {
        "seq": 319,
        "outcome": "rejected"
      },
      {
        "seq": 326,
        "outcome": "rejected"
      },
      {
        "seq": 336,
        "outcome": "rejected"
      },
      {
        "seq": 343,
        "outcome": "rejected"
      }
    ],
    "outcome_counts": {
      "allowed-once": 4,
      "rejected": 9
    }
  },
  "stop_message": {
    "seq": 307,
    "text": "stop calling meta ads tools"
  },
  "calls_after_stop_admitted": 5,
  "repeat_reminder_seqs": [
    263,
    280,
    308,
    332,
    349
  ],
  "shutdown_tool_calls_in_turn_2": 0
}

Standalone capture verifier (Python 3)

Run locally against the original export using python3 extract-public-evidence.py /path/to/session.v3.jsonl. The private export is intentionally not attached. This is an audit of historical evidence, not a reproduction of the initiating lifecycle change.

"""Audit the supplied capture and emit only explicitly selected public evidence.

Usage: python3 extract-public-evidence.py /path/to/session.v3.jsonl
This checks a historical capture. It does not reproduce a runtime lifecycle bug.
No archived command is executed. No network request is made.
"""
import collections
import json
import sys
from pathlib import Path

rows = [json.loads(line) for line in Path(sys.argv[1]).read_text().splitlines()]
events = rows[1:]
assert [r['seq'] for r in events] == list(range(len(events)))
headers = [r for r in events if r['type'] == 'request/header']
assert len(headers) == 2
before, after = [{t['name']: t for t in r['data']['header']['tools']} for r in headers]
removed = sorted(before.keys() - after.keys())
assert len(removed) == 25 and not after.keys() - before.keys()
assert all(before[k] == after[k] for k in after)
assert {'bash', 'job_list', 'job_output', 'job_kill'} <= set(removed)
calls = [r for r in events if r['type'] == 'tool/call']
assert len(calls) == 54
results = [r for r in events if r['type'] == 'tool/result']
assert collections.Counter(r['data']['callId'] for r in calls) == collections.Counter(
    r['data']['message']['source']['callId'] for r in results)
emitted = {b['id']: b for r in events if r['type'] == 'assistant/message'
           for b in r['data']['message']['content'] if b['type'] == 'tool-call'}
for r in calls:
    d = r['data']; b = emitted[d['callId']]
    assert (b['name'], b['arguments']) == (d['name'], d['arguments'])
loop = [r for r in calls if r['data']['turn'] == 2]
assert len(loop) == 13
assert {r['data']['name'] for r in loop} == {'mcp__meta_ads__ads_get_ad_accounts'}
assert len({r['data']['arguments'] for r in loop}) == 1
assert json.loads(loop[0]['data']['arguments'])['advertiser_request'] == 'close the background task'
decisions = [r for r in events if r['type'] == 'approval/decided' and r['seq'] > headers[1]['seq']]
outcomes = collections.Counter(r['data']['outcome'] for r in decisions)
assert outcomes == {'allowed-once': 4, 'rejected': 9}
stop = next(r for r in events if r['type'] == 'user/message' and any(
    b.get('text') == 'stop calling meta ads tools' for b in r['data']['content']))
after_stop = [r for r in loop if r['seq'] > stop['seq']]
assert len(after_stop) == 5
reminders = [r for r in events if r['type'] == 'user/message'
             and r['data'].get('source', {}).get('plugin') == 'repeat-tool-reminder']
assert len(reminders) == 5

def catalog(r):
    names = [t['name'] for t in r['data']['header']['tools']]
    return {'seq': r['seq'], 'jsonl_line': r['seq'] + 2,
            'total': len(names), 'mcp': sum(n.startswith('mcp__') for n in names),
            'other': sum(not n.startswith('mcp__') for n in names)}

# No tool results, full schemas, system prompts, identifiers, private paths,
# account data, free-form provider config or credentials are copied to output.
print(json.dumps({
    'kind': 'allowlisted_summary_of_captured_events_not_raw_provider_wire',
    'records': len(rows), 'events': len(events),
    'catalogs': [catalog(r) for r in headers], 'removed_tools': removed,
    'retained_schemas_identical': True,
    'retained_non_mcp': sorted(n for n in after if not n.startswith('mcp__')),
    'all_54_assistant_calls_match_dispatch_and_have_results': len(calls) == 54,
    'turn_2_repeated_call': {
        'name': loop[0]['data']['name'],
        'arguments': {'advertiser_request': 'close the background task',
                      'client_conversation_id': '<REDACTED>'},
        'calls': [{'seq': r['seq'], 'step': r['data']['step']} for r in loop],
        'approval_decisions': [{'seq': r['seq'], 'outcome': r['data']['outcome']} for r in decisions],
        'outcome_counts': dict(outcomes)},
    'stop_message': {'seq': stop['seq'], 'text': 'stop calling meta ads tools'},
    'calls_after_stop_admitted': len(after_stop),
    'repeat_reminder_seqs': [r['seq'] for r in reminders],
    'shutdown_tool_calls_in_turn_2': 0,
}, indent=2))

Local inspection-plugin follow-up

A separate local skills-manager Context viewer defect was reproduced and fixed in that private plugin version 0.3.1: it duplicated historical catalogs per request until exceeding its 4 MiB response limit, and its failure response omitted the required details object. After repair, the original chat opens and refreshes successfully, preserving all 50 requests and both catalogs. This read-only inspection repair does not restore or explain the native capabilities missing from the recorded model request. It is not being reported here as an upstream defect.