Summary

• Fix case-sensitive protected tools check that could incorrectly deduplicate protected tools (e.g., Task vs task)
• Scope fetch wrapper deduplication to current request only, preventing cross-session contamination
• Add bounded cache (500 entries) for toolParameters to prevent unbounded memory growth

Changes

Bug Fix: Case-sensitive protected tools check (lib/deduplicator.ts)

The protectedTools array contains lowercase names (['task', 'todowrite', 'todoread', 'prune']), but tool names from providers can be mixed case (e.g., "Task"). The case-sensitive includes() check caused protected tools to be incorrectly deduplicated.

Fix: Normalize both sides to lowercase before comparison.

Bug Fix: Cross-session deduplication (lib/fetch-wrapper/)

The fetch wrapper was using ALL tool IDs from the global state.toolParameters cache for deduplication, which could cross-contaminate sessions if multiple sessions ran concurrently.

Fix:

• Modified cacheToolParametersFromMessages and cacheToolParametersFromInput to return the IDs they cached
• Added cachedToolIds to FetchHandlerResult type
• Changed deduplication to only consider tool IDs from the current request

Bug Fix: Unbounded memory growth (lib/tool-cache.ts)

The state.toolParameters cache was never cleared, causing memory to grow indefinitely over long-running sessions.

Fix: Added trimToolParametersCache() that limits cache to 500 entries with FIFO eviction.