fix(agent): memoize toolSetDigest per tool-set identity

toolSetDigest re-hashed the full tool array on every call. Cache the
digest in a WeakMap keyed by array identity: the director owns stable
tool arrays and swaps them wholesale (constructor, updateToolDefinitions)
without in-place mutation, so the same reference always means the same
content and a new reference (tools changed) recomputes. A WeakMap also
avoids retaining arrays the director has dropped. Output is byte-identical
for the same tool set.

Add a spy test proving one sha256 per tool set across repeated digest
calls, using withMockedModule from testkit/mock-module.ts.

Author: TheGreatAxios

src/agent/director.ts

@@ -59,14 +59,26 @@ const logger = getLogger([LOG_NAMESPACE_ROOT, "agent", "director"]);
 // (mount, description edit, reorder) drops the next turn's cache hit. The
 // digest stays deterministic — it only moves when discovery grows the set.
 // Hashed: MCP descriptions are arbitrary server text, not log material.
+//
+// Memoized per array identity: the director owns stable tool arrays and swaps
+// them wholesale (constructor, updateToolDefinitions) without in-place
+// mutation, so the same reference always means the same content and a new
+// reference (tools changed) misses the WeakMap and recomputes. A WeakMap also
+// avoids retaining arrays the director has dropped.
+const toolSetDigestCache = new WeakMap<readonly ToolDefinition[], string>();
+
 export function toolSetDigest(tools: readonly ToolDefinition[]): string {
+  const cached = toolSetDigestCache.get(tools);
+  if (cached !== undefined) return cached;
   const shape = tools
     .map(
       (t) =>
         `${t.name}:${t.description ?? ""}:${JSON.stringify(t.inputSchema ?? null)}`,
     )
     .join("|");
-  return createHash("sha256").update(shape).digest("hex").slice(0, 12);
+  const digest = createHash("sha256").update(shape).digest("hex").slice(0, 12);
+  toolSetDigestCache.set(tools, digest);
+  return digest;
 }
 
 function isInternalRecoveryAbort(

src/agent/tool-set-digest.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, test } from "bun:test";
+import { withMockedModule } from "../../testkit/mock-module.js";
+
+// Spy on createHash to prove toolSetDigest memoizes: repeated digest calls
+// with the same tool array must run the sha256 exactly once, and a new array
+// (tools changed) must run it again. The mock delegates to the real
+// implementation (captured before mocking) so behavior is unchanged;
+// hashCalls only measures the delta around each assertion.
+let hashCalls = 0;
+await withMockedModule<typeof import("node:crypto")>(
+  import.meta.resolve("node:crypto"),
+  (real) => ({
+    ...real,
+    createHash: (algorithm: string) => {
+      hashCalls += 1;
+      return real.createHash(algorithm);
+    },
+  }),
+);
+
+// Dynamic import so director.ts resolves node:crypto through the mock above.
+const { toolSetDigest } = await import("./director.js");
+
+const base = {
+  name: "read_file",
+  description: "read a file",
+  inputSchema: { type: "object" },
+};
+
+describe("toolSetDigest memoization", () => {
+  test("hashes once per tool set across repeated digest calls", () => {
+    const tools = [{ ...base }];
+    hashCalls = 0;
+    const first = toolSetDigest(tools);
+    const second = toolSetDigest(tools);
+    const third = toolSetDigest(tools);
+    expect(second).toBe(first);
+    expect(third).toBe(first);
+    expect(hashCalls).toBe(1);
+  });
+
+  test("recomputes when a new tool set arrives", () => {
+    const tools = [{ ...base }];
+    const changed = [{ ...base, description: "changed" }];
+    hashCalls = 0;
+    const digest = toolSetDigest(tools);
+    expect(hashCalls).toBe(1);
+    const changedDigest = toolSetDigest(changed);
+    expect(hashCalls).toBe(2);
+    expect(changedDigest).not.toBe(toolSetDigest(tools));
+    expect(digest).toBe(toolSetDigest(tools));
+  });
+});