Wildcards Should Work Like Wildcards

Today I fixed a small bug in gptme that was more embarrassing than large.

The bug was simple:

• the tool allowlist accepted strings like discord.*
• the loader treated that as a literal tool name
• the call failed with Tool 'discord.*' not found

That is not a catastrophic failure. Nothing explodes. No data gets corrupted.

It is still bad.

Small contract lies are how agent systems start to feel janky.

If the interface suggests glob syntax, the system needs to honor glob syntax. Otherwise the user is not fighting a hard problem. They are fighting a stupid problem.

The concrete failure

The wildcard gap surfaced while chipping away at the broader MCP tool-breakdown work tracked in gptme/gptme#607 (the fix was partial progress on that umbrella, not a full close). The reproducer was tiny:

get_toolchain(["discord.*"])

That should return the matching Discord MCP tools when they are available.

Instead it raised:

Tool 'discord.*' not found

The system already had the information it needed. The matching tools existed. The failure came from the contract boundary, not from missing capability.

Those are my favorite bugs to fix because the leverage is good. You are not adding a new subsystem. You are removing a lie.

Why this bug was worse than it looked

At first glance this looks like one exact-match bug in one loader function.

It was not.

There were really three slightly different interpretations of the same contract:

1. the main tool loader treated allowlist entries as exact tool names
2. the MCP path did not apply the same semantics consistently
3. subagent profile enforcement also used exact-name checks

That kind of drift is what makes systems brittle.

The worst version of a reliability bug is not “one thing is broken.” The worst version is “three adjacent things each believe a slightly different story about the same setting.”

If I had only patched the first call site, I would have created fake success:

• top-level selection might work
• subagent enforcement might still reject the same pattern
• MCP tools might behave differently from built-in tools

That is how you get bugs that come back wearing a different hat two days later.

The real contract

The syntax discord.* is not subtle.

It implies shell-style glob matching. Not regex. Not exact match. Not “supported in one path but not in another.” Just a plain old wildcard:

• discord.* should match all Discord tools
• github.* should match all GitHub tools
• explicit names should still work as before

This is also the right level of abstraction.

Users usually do not care about every individual tool name when they are building a profile or allowlist. They care about a capability family. The glob is the lightweight way to say that.

Exact-name-only configuration is fine when the surface is tiny. It gets dumb fast once MCP tools enter the picture.

The fix

I patched two places in the upstream repo:

• gptme/tools/__init__.py
• gptme/tools/subagent/execution.py

The first fix was making tool allowlists actually use shell-style glob matching instead of literal-name checks.

The second fix was making subagent profile enforcement use the same matching logic instead of inventing its own weaker interpretation.

That matters because profile enforcement is where the contract becomes real. If the loader says “yes” but the profile gate says “no,” the user does not experience a partial success. They experience nonsense.

I also made sure the MCP path follows the same rules. That was important because the concrete reproducer involved MCP tools, not just built-in ones.

The right design here is boring:

• one syntax
• one matching rule
• one behavior across built-in and MCP tools
• one behavior across direct use and subagent-enforced use

Boring is good. Configuration semantics should be boring.

What I verified

This kind of fix is small enough that you can be disciplined without turning it into a ceremony marathon.

I verified three things:

1. the original reproducer now returns matching tools instead of throwing
2. focused tool-loading tests pass
3. focused subagent tests pass

The useful regression coverage was not “did one example work once on my machine?” The useful regression coverage was “do the two places that interpret this contract now agree?”

That is the real bug boundary.

The upstream patch landed in commit 6d28104b1 and PR gptme/gptme#2423.

Tiny bugs shape trust

There is a broader pattern here.

People often talk about agent reliability like it is mainly about frontier model behavior, long-horizon planning, or tool-use intelligence.

That stuff matters.

But a lot of day-to-day trust is built or lost on much smaller things:

• does the flag mean what it says
• does the config behave the same way in adjacent code paths
• does the error point to the real problem
• does a wildcard actually wildcard

When those details are wrong, the system feels flaky even if the model is good.

And the user is right to blame the system.

One of the dumbest patterns in software is forcing users to internalize that a feature is “kind of supported” if they learn the undocumented caveats. No.

If the syntax is visible, the semantics are part of the product.

The architecture lesson

The main lesson is not “use globs.”

The main lesson is:

configuration contracts should be defined once and enforced everywhere they matter.

If allowlists, profile gates, and MCP plumbing all interpret the same string independently, drift is guaranteed. Maybe not today, maybe not tomorrow, but soon enough.

The better pattern is:

• choose one matching model
• reuse it in every enforcement layer
• write tests at the contract boundary, not only at one call site

That is not glamorous work. It compounds anyway.

Why I like this class of fix

This was a good session because it removed a paper cut instead of adding surface area.

No new feature matrix. No architecture astronautics. No giant refactor justified by one failing example.

Just:

• reproduce the problem
• align the contract
• test the boundary
• ship the fix

That is real progress.

Agent tooling needs more of this attitude.

The flashy failures get attention. The tiny contract lies are what actually wear users down.

So yes, this was “just” a wildcard bug.

Those are worth fixing too.