@automagik/genie 4.260409.2 → 4.260409.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/genie",
-  "version": "4.260409.2",
+  "version": "4.260409.4",
   "description": "Collaborative terminal toolkit for human + AI workflows",
   "type": "module",
   "bin": {

package/plugins/genie/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "genie",
-  "version": "4.260409.2",
+  "version": "4.260409.4",
   "description": "Human-AI partnership for Claude Code. Share a terminal, orchestrate workers, evolve together. Brainstorm ideas, turn them into wishes, execute with /work, validate with /review, and ship as one team.",
   "author": {
     "name": "Namastex Labs"

package/plugins/genie/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genie-plugin",
-  "version": "4.260409.2",
+  "version": "4.260409.4",
   "private": true,
   "description": "Runtime dependencies for genie bundled CLIs",
   "type": "module",

package/src/lib/agent-directory.ts

@@ -45,8 +45,15 @@ export interface DirectoryEntry {
   permissions?: {
     preset?: string;
     allow?: string[];
+    deny?: string[];
     bashAllowPatterns?: string[];
   };
+  /** Tools the agent is NOT allowed to use (Claude Code --disallowedTools). */
+  disallowedTools?: string[];
+  /** Omni API scopes the agent is restricted to (e.g., 'say', 'react'). */
+  omniScopes?: string[];
+  /** Claude Code hooks configuration. */
+  hooks?: Record<string, unknown>;
   /** Full SDK Options configuration for claude-sdk provider sessions. */
   sdk?: SdkDirectoryConfig;
 }
@@ -283,6 +290,9 @@ export async function edit(
       | 'color'
       | 'provider'
       | 'permissions'
+      | 'disallowedTools'
+      | 'omniScopes'
+      | 'hooks'
       | 'sdk'
     >
   >,
@@ -384,6 +394,9 @@ function roleToEntry(role: string, team?: string, metadata?: Record<string, unkn
     color: metadata?.color as string | undefined,
     provider: metadata?.provider as string | undefined,
     permissions: metadata?.permissions as DirectoryEntry['permissions'],
+    disallowedTools: metadata?.disallowedTools as string[] | undefined,
+    omniScopes: metadata?.omniScopes as string[] | undefined,
+    hooks: metadata?.hooks as Record<string, unknown> | undefined,
     sdk: metadata?.sdk as SdkDirectoryConfig | undefined,
     ...(metadata?.repo ? { repo: metadata.repo as string } : team ? { repo: team } : {}),
   };
@@ -400,6 +413,9 @@ function buildMetadata(entry: DirectoryEntry): Record<string, unknown> {
   if (entry.color) meta.color = entry.color;
   if (entry.provider) meta.provider = entry.provider;
   if (entry.permissions) meta.permissions = entry.permissions;
+  if (entry.disallowedTools) meta.disallowedTools = entry.disallowedTools;
+  if (entry.omniScopes) meta.omniScopes = entry.omniScopes;
+  if (entry.hooks) meta.hooks = entry.hooks;
   if (entry.sdk) meta.sdk = entry.sdk;
   return meta;
 }

package/src/lib/agent-sync.ts

@@ -378,6 +378,10 @@ async function syncSingleAgent(agent: AgentInfo, result: SyncResult, workspaceRo
 
   // Cast fm.sdk to the directory config type for passthrough storage
   const sdkConfig = fm.sdk as Record<string, unknown> | undefined;
+  const permissions = fm.permissions as { allow?: string[]; deny?: string[] } | undefined;
+  const disallowedTools = fm.disallowedTools as string[] | undefined;
+  const omniScopes = fm.omniScopes as string[] | undefined;
+  const hooks = fm.hooks as Record<string, unknown> | undefined;
 
   if (!existing) {
     await directory.add({
@@ -389,6 +393,10 @@ async function syncSingleAgent(agent: AgentInfo, result: SyncResult, workspaceRo
       description: fm.description,
       color: fm.color,
       provider: fm.provider,
+      permissions,
+      disallowedTools,
+      omniScopes,
+      hooks,
       sdk: sdkConfig,
     });
     result.registered.push(agent.name);
@@ -404,13 +412,25 @@ async function syncSingleAgent(agent: AgentInfo, result: SyncResult, workspaceRo
     description: fm.description,
     color: fm.color,
     provider: fm.provider,
+    permissions,
+    disallowedTools,
+    omniScopes,
+    hooks,
     sdk: sdkConfig,
   };
 
-  // Check if any field actually changed (deep compare sdk via JSON serialization)
+  // Check if any field actually changed (deep compare via JSON serialization)
   const sdkChanged = JSON.stringify(existing.sdk) !== JSON.stringify(sdkConfig);
+  const permissionsChanged = JSON.stringify(existing.permissions) !== JSON.stringify(permissions);
+  const disallowedToolsChanged = JSON.stringify(existing.disallowedTools) !== JSON.stringify(disallowedTools);
+  const omniScopesChanged = JSON.stringify(existing.omniScopes) !== JSON.stringify(omniScopes);
+  const hooksChanged = JSON.stringify(existing.hooks) !== JSON.stringify(hooks);
   const needsUpdate =
     sdkChanged ||
+    permissionsChanged ||
+    disallowedToolsChanged ||
+    omniScopesChanged ||
+    hooksChanged ||
     existing.repo !== repoPath ||
     existing.dir !== agent.dir ||
     existing.promptMode !== (fm.promptMode ?? 'append') ||

package/src/lib/frontmatter.test.ts

@@ -402,3 +402,123 @@ model: opus
     expect(result.sdk).toBeUndefined();
   });
 });
+
+// ============================================================================
+// Permissions, disallowedTools, omniScopes, hooks frontmatter
+// ============================================================================
+
+describe('parseFrontmatter — permissions and sandbox fields', () => {
+  test('parses permissions with allow and deny lists', () => {
+    const content = `---
+name: sandboxed-agent
+permissions:
+  allow:
+    - Read
+    - Grep
+    - "Bash(omni say *)"
+    - "Bash(git *)"
+  deny:
+    - Write
+    - Edit
+---
+`;
+    const result = parseFrontmatter(content);
+    expect(result.permissions).toBeDefined();
+    expect(result.permissions!.allow).toEqual(['Read', 'Grep', 'Bash(omni say *)', 'Bash(git *)']);
+    expect(result.permissions!.deny).toEqual(['Write', 'Edit']);
+  });
+
+  test('parses disallowedTools array', () => {
+    const content = `---
+name: restricted
+disallowedTools:
+  - Agent
+  - NotebookEdit
+---
+`;
+    const result = parseFrontmatter(content);
+    expect(result.disallowedTools).toEqual(['Agent', 'NotebookEdit']);
+  });
+
+  test('parses omniScopes array', () => {
+    const content = `---
+name: omni-agent
+omniScopes:
+  - say
+  - react
+  - history
+---
+`;
+    const result = parseFrontmatter(content);
+    expect(result.omniScopes).toEqual(['say', 'react', 'history']);
+  });
+
+  test('parses hooks as permissive record', () => {
+    const content = `---
+name: hooked
+hooks:
+  PreToolUse:
+    - matcher: "*"
+      hooks:
+        - type: command
+          command: echo test
+---
+`;
+    const result = parseFrontmatter(content);
+    expect(result.hooks).toBeDefined();
+    expect(result.hooks!.PreToolUse).toBeDefined();
+  });
+
+  test('missing sandbox fields result in undefined', () => {
+    const content = `---
+name: basic
+---
+`;
+    const result = parseFrontmatter(content);
+    expect(result.permissions).toBeUndefined();
+    expect(result.disallowedTools).toBeUndefined();
+    expect(result.omniScopes).toBeUndefined();
+    expect(result.hooks).toBeUndefined();
+  });
+
+  test('permissions with only allow (no deny) is valid', () => {
+    const content = `---
+permissions:
+  allow:
+    - Read
+    - Glob
+---
+`;
+    const result = parseFrontmatter(content);
+    expect(result.permissions).toBeDefined();
+    expect(result.permissions!.allow).toEqual(['Read', 'Glob']);
+    expect(result.permissions!.deny).toBeUndefined();
+  });
+
+  test('all sandbox fields together parse correctly', () => {
+    const content = `---
+name: full-sandbox
+provider: claude-sdk
+permissionMode: dontAsk
+disallowedTools:
+  - Agent
+permissions:
+  allow:
+    - Read
+    - "Bash(omni *)"
+omniScopes:
+  - say
+hooks:
+  PreToolUse:
+    - matcher: Bash
+---
+`;
+    const result = parseFrontmatter(content);
+    expect(result.name).toBe('full-sandbox');
+    expect(result.provider).toBe('claude-sdk');
+    expect(result.disallowedTools).toEqual(['Agent']);
+    expect(result.permissions!.allow).toEqual(['Read', 'Bash(omni *)']);
+    expect(result.omniScopes).toEqual(['say']);
+    expect(result.hooks).toBeDefined();
+  });
+});

package/src/lib/frontmatter.ts

@@ -35,6 +35,19 @@ export const AgentFrontmatterSchema = z.object({
   provider: z.enum(providerValues).optional(),
   tools: z.array(z.string()).optional(),
   permissionMode: z.string().optional(),
+  /** Tools the agent is NOT allowed to use (Claude Code --disallowedTools). */
+  disallowedTools: z.array(z.string()).optional(),
+  /** Claude Code permission rules — allow/deny lists with Bash() patterns. */
+  permissions: z
+    .object({
+      allow: z.array(z.string()).optional(),
+      deny: z.array(z.string()).optional(),
+    })
+    .optional(),
+  /** Omni API scopes the agent is restricted to (e.g., 'say', 'react'). */
+  omniScopes: z.array(z.string()).optional(),
+  /** Claude Code hooks configuration — permissive record for forward compatibility. */
+  hooks: z.record(z.unknown()).optional(),
   /** SDK configuration block — permissive record so new SDK options don't require parser updates. */
   sdk: z.record(z.unknown()).optional(),
 });

package/src/lib/provider-adapters.ts

@@ -83,6 +83,10 @@ export interface SpawnParams {
   initialPrompt?: string;
   /** Display name for the CC session (emits --name). Used in /resume and terminal title. */
   name?: string;
+  /** Claude Code permissions (allow/deny lists with Bash() patterns). Merged into --settings. */
+  permissions?: { allow?: string[]; deny?: string[] };
+  /** Tools the agent is NOT allowed to use (emits --disallowedTools). */
+  disallowedTools?: string[];
   /** OTel receiver port to inject as OTEL_EXPORTER_OTLP_ENDPOINT. Undefined = skip injection. */
   otelPort?: number;
   /** Whether to log user prompts via OTel (default: true). */
@@ -349,18 +353,32 @@ export function buildClaudeCommand(params: SpawnParams): LaunchCommand {
 
   appendSystemPromptFlags(parts, params);
 
-  // Inject hook dispatch via --settings (deep-merges with existing settings)
+  // Inject hook dispatch + permissions via --settings (deep-merges with existing settings)
   const dispatchCmd = buildDispatchCommand();
   const hookEntry = { type: 'command', command: dispatchCmd, timeout: 15 };
-  const hooksSettings = JSON.stringify({
+  const settingsObj: Record<string, unknown> = {
     hooks: {
       PreToolUse: [{ matcher: '*', hooks: [hookEntry] }],
       PostToolUse: [{ matcher: '*', hooks: [hookEntry] }],
       UserPromptSubmit: [{ hooks: [hookEntry] }],
       Stop: [{ hooks: [hookEntry] }],
     },
-  });
-  parts.push('--settings', escapeShellArg(hooksSettings));
+  };
+  // Merge permissions into settings when provided
+  if (params.permissions) {
+    const perms: Record<string, string[]> = {};
+    if (params.permissions.allow?.length) perms.allow = params.permissions.allow;
+    if (params.permissions.deny?.length) perms.deny = params.permissions.deny;
+    if (Object.keys(perms).length > 0) settingsObj.permissions = perms;
+  }
+  parts.push('--settings', escapeShellArg(JSON.stringify(settingsObj)));
+
+  // Emit --disallowedTools when the agent declares tool restrictions
+  if (params.disallowedTools?.length) {
+    for (const tool of params.disallowedTools) {
+      parts.push('--disallowedTools', escapeShellArg(tool));
+    }
+  }
 
   if (params.extraArgs) {
     for (const arg of params.extraArgs) parts.push(escapeShellArg(arg));

package/src/lib/providers/__tests__/claude-sdk-permissions.test.ts

@@ -1,15 +1,35 @@
 import { describe, expect, it } from 'bun:test';
-import type { PreToolUseHookInput, SyncHookJSONOutput } from '@anthropic-ai/claude-agent-sdk';
 import {
   PRESET_CHAT_ONLY,
   PRESET_FULL,
   PRESET_READ_ONLY,
   createPermissionGate,
+  resolvePermissionConfig,
   resolvePreset,
+  translateClaudeCodePermissions,
 } from '../claude-sdk-permissions.js';
 
+// NOTE: We intentionally avoid `import type` from @anthropic-ai/claude-agent-sdk here.
+// Bun's test runner may resolve the real module even for type-only imports, poisoning the
+// process-global mock.module cache used by claude-sdk.test.ts and claude-sdk-resume.test.ts.
+// Instead we use inline structural types that match the SDK's shapes.
+
+type HookInput = {
+  hook_event_name: string;
+  tool_name: string;
+  tool_input: Record<string, unknown>;
+  tool_use_id: string;
+  session_id: string;
+  transcript_path: string;
+  cwd: string;
+};
+
+type HookOutput = {
+  hookSpecificOutput?: Record<string, unknown>;
+};
+
 /** Build a minimal PreToolUseHookInput for testing. */
-function hookInput(toolName: string, toolInput: Record<string, unknown> = {}): PreToolUseHookInput {
+function hookInput(toolName: string, toolInput: Record<string, unknown> = {}): HookInput {
   return {
     hook_event_name: 'PreToolUse',
     tool_name: toolName,
@@ -18,7 +38,7 @@ function hookInput(toolName: string, toolInput: Record<string, unknown> = {}): P
     session_id: 'test',
     transcript_path: '',
     cwd: '',
-  } as PreToolUseHookInput;
+  };
 }
 
 /** Call the gate with standard test args and return the result. */
@@ -26,19 +46,19 @@ async function callGate(
   gate: ReturnType<typeof createPermissionGate>,
   toolName: string,
   toolInput: Record<string, unknown> = {},
-): Promise<SyncHookJSONOutput> {
-  return gate(hookInput(toolName, toolInput), 'test', {
+): Promise<HookOutput> {
+  return gate(hookInput(toolName, toolInput) as any, 'test', {
     signal: new AbortController().signal,
-  }) as Promise<SyncHookJSONOutput>;
+  }) as Promise<HookOutput>;
 }
 
 /** Extract permissionDecision from gate result. */
-function decision(result: SyncHookJSONOutput): string {
+function decision(result: HookOutput): string {
   return (result.hookSpecificOutput as any).permissionDecision;
 }
 
 /** Extract permissionDecisionReason from gate result. */
-function reason(result: SyncHookJSONOutput): string | undefined {
+function reason(result: HookOutput): string | undefined {
   return (result.hookSpecificOutput as any).permissionDecisionReason;
 }
 
@@ -249,3 +269,99 @@ describe('createPermissionGate', () => {
     });
   });
 });
+
+describe('translateClaudeCodePermissions', () => {
+  it('extracts Bash() patterns into bashAllowPatterns as regex', () => {
+    const result = translateClaudeCodePermissions({
+      allow: ['Read', 'Grep', 'Bash(omni say *)'],
+    });
+    expect(result.allow).toContain('Read');
+    expect(result.allow).toContain('Grep');
+    expect(result.allow).toContain('Bash');
+    expect(result.bashAllowPatterns).toBeDefined();
+    expect(result.bashAllowPatterns!.length).toBe(1);
+    // Should match "omni say hello"
+    expect('omni say hello').toMatch(new RegExp(result.bashAllowPatterns![0]));
+    // Should not match "rm -rf /"
+    expect('rm -rf /').not.toMatch(new RegExp(result.bashAllowPatterns![0]));
+  });
+
+  it('handles multiple Bash() patterns', () => {
+    const result = translateClaudeCodePermissions({
+      allow: ['Bash(git *)', 'Bash(omni *)'],
+    });
+    expect(result.allow).toEqual(['Bash']);
+    expect(result.bashAllowPatterns!.length).toBe(2);
+    expect('git status').toMatch(new RegExp(result.bashAllowPatterns![0]));
+    expect('omni send hi').toMatch(new RegExp(result.bashAllowPatterns![1]));
+  });
+
+  it('handles bare tool names without Bash() patterns', () => {
+    const result = translateClaudeCodePermissions({
+      allow: ['Read', 'Glob', 'Grep'],
+    });
+    expect(result.allow).toEqual(['Read', 'Glob', 'Grep']);
+    expect(result.bashAllowPatterns).toBeUndefined();
+  });
+
+  it('handles bare Bash (no parentheses) as unrestricted', () => {
+    const result = translateClaudeCodePermissions({
+      allow: ['Read', 'Bash'],
+    });
+    expect(result.allow).toEqual(['Read', 'Bash']);
+    expect(result.bashAllowPatterns).toBeUndefined();
+  });
+
+  it('defaults to wildcard allow when allow list is empty', () => {
+    const result = translateClaudeCodePermissions({ allow: [] });
+    expect(result.allow).toEqual(['*']);
+  });
+
+  it('defaults to wildcard allow when no allow provided', () => {
+    const result = translateClaudeCodePermissions({});
+    expect(result.allow).toEqual(['*']);
+  });
+});
+
+describe('resolvePermissionConfig — Claude Code format detection', () => {
+  it('detects Claude Code format with Bash() patterns and translates', () => {
+    const result = resolvePermissionConfig({
+      allow: ['Read', 'Bash(omni say *)'],
+    });
+    expect(result.allow).toContain('Read');
+    expect(result.allow).toContain('Bash');
+    expect(result.bashAllowPatterns).toBeDefined();
+  });
+
+  it('passes through legacy SDK format (with bashAllowPatterns) unchanged', () => {
+    const result = resolvePermissionConfig({
+      allow: ['Read', 'Bash'],
+      bashAllowPatterns: ['^git\\s'],
+    });
+    expect(result.allow).toEqual(['Read', 'Bash']);
+    expect(result.bashAllowPatterns).toEqual(['^git\\s']);
+  });
+
+  it('resolves preset even when other fields present', () => {
+    const result = resolvePermissionConfig({
+      preset: 'read-only',
+      allow: ['Bash'],
+    });
+    expect(result).toBe(PRESET_READ_ONLY);
+  });
+
+  it('falls back to PRESET_FULL when no permissions', () => {
+    expect(resolvePermissionConfig()).toBe(PRESET_FULL);
+    expect(resolvePermissionConfig(undefined)).toBe(PRESET_FULL);
+  });
+
+  it('detects Claude Code format with deny field', () => {
+    const result = resolvePermissionConfig({
+      allow: ['Read', 'Glob'],
+      deny: ['Write'],
+    });
+    // deny triggers CC format detection → translateClaudeCodePermissions
+    expect(result.allow).toContain('Read');
+    expect(result.allow).toContain('Glob');
+  });
+});

package/src/lib/providers/claude-sdk-permissions.ts

@@ -51,22 +51,75 @@ export function resolvePreset(name: string): PermissionConfig {
   return preset;
 }
 
+/**
+ * Translate Claude Code format permissions (Bash() patterns) to SDK PermissionConfig.
+ *
+ * Claude Code format uses `allow: ["Read", "Bash(git *)"]` where `Bash(...)` patterns
+ * define allowed bash commands. The SDK uses separate `allow` (tool names) and
+ * `bashAllowPatterns` (regex) fields.
+ *
+ * Translation rules:
+ * - `Bash(pattern)` → extract pattern, convert glob-style `*` to regex `.*`, add to bashAllowPatterns
+ * - `Bash` (bare) → add "Bash" to allow list (unrestricted bash)
+ * - Other strings → add to allow list as tool names
+ */
+export function translateClaudeCodePermissions(ccPerms: {
+  allow?: string[];
+  deny?: string[];
+}): PermissionConfig {
+  const toolAllow: string[] = [];
+  const bashPatterns: string[] = [];
+
+  for (const entry of ccPerms.allow ?? []) {
+    const bashMatch = entry.match(/^Bash\((.+)\)$/);
+    if (bashMatch) {
+      // Bash(pattern) → convert to regex: escape regex chars except *, then replace * with .*
+      const glob = bashMatch[1];
+      const regex = `^${glob.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*')}$`;
+      bashPatterns.push(regex);
+      // Ensure Bash is in the allow list so the gate checks patterns
+      if (!toolAllow.includes('Bash')) toolAllow.push('Bash');
+    } else {
+      toolAllow.push(entry);
+    }
+  }
+
+  return {
+    allow: toolAllow.length > 0 ? toolAllow : ['*'],
+    bashAllowPatterns: bashPatterns.length > 0 ? bashPatterns : undefined,
+  };
+}
+
+/** Detect whether a permissions object uses Claude Code format (has Bash() patterns in allow). */
+function isClaudeCodeFormat(permissions: Record<string, unknown>): boolean {
+  if (Array.isArray(permissions.allow)) {
+    return permissions.allow.some((entry: unknown) => typeof entry === 'string' && /^Bash\(.+\)$/.test(entry));
+  }
+  // Claude Code format also uses deny (not present in legacy SDK format)
+  return 'deny' in permissions && !('preset' in permissions) && !('bashAllowPatterns' in permissions);
+}
+
 /**
  * Resolve a PermissionConfig from an agent entry's optional permissions field.
  *
  * Resolution order:
  * 1. If a preset name is specified, resolve it.
- * 2. If an explicit allow list is given, use it (with optional bashAllowPatterns).
- * 3. Fall back to PRESET_FULL (allow everything).
+ * 2. If Claude Code format (has Bash() patterns or deny), translate to SDK format.
+ * 3. If an explicit allow list is given, use it (with optional bashAllowPatterns).
+ * 4. Fall back to PRESET_FULL (allow everything).
  */
 export function resolvePermissionConfig(permissions?: {
   preset?: string;
   allow?: string[];
+  deny?: string[];
   bashAllowPatterns?: string[];
 }): PermissionConfig {
   if (permissions?.preset) {
     return resolvePreset(permissions.preset);
   }
+  if (permissions && isClaudeCodeFormat(permissions)) {
+    return translateClaudeCodePermissions(permissions);
+  }
   if (permissions?.allow) {
     return {
       allow: permissions.allow,

package/src/services/executor.ts

@@ -43,7 +43,12 @@ export type NatsPublishFn = (topic: string, payload: string) => void;
 
 /** Pluggable executor backend for the Omni bridge. TODO: merge into ExecutorProvider. */
 export interface IExecutor {
-  spawn(agentName: string, chatId: string, env: Record<string, string>): Promise<ExecutorSession>;
+  spawn(
+    agentName: string,
+    chatId: string,
+    env: Record<string, string>,
+    initialMessage?: string,
+  ): Promise<ExecutorSession>;
   deliver(session: ExecutorSession, message: OmniMessage): Promise<void>;
   shutdown(session: ExecutorSession): Promise<void>;
   isAlive(session: ExecutorSession): Promise<boolean>;

package/src/services/executors/__tests__/claude-sdk.test.ts

@@ -448,7 +448,7 @@ describe('ClaudeSdkOmniExecutor', () => {
       resetAllMocks();
     });
 
-    it('includes turn-based instructions in system prompt when OMNI_INSTANCE is set', async () => {
+    it('injects turn-based instructions into user message (not system prompt) when OMNI_INSTANCE is set', async () => {
       const env = { OMNI_INSTANCE: 'inst-wb', OMNI_CHAT: 'chat-wb', OMNI_AGENT: 'bot' };
       const session = await executor.spawn('test-agent', 'chat-wb', env);
 
@@ -462,15 +462,22 @@ describe('ClaudeSdkOmniExecutor', () => {
       await executor.waitForDeliveries(session.id);
 
       expect(queryMock).toHaveBeenCalledTimes(1);
-      const callArgs = (queryMock.mock.calls[0] as unknown as [{ options?: { systemPrompt?: string } }])[0];
+      const callArgs = (
+        queryMock.mock.calls[0] as unknown as [{ prompt?: string; options?: { systemPrompt?: string } }]
+      )[0];
+      const userPrompt = callArgs.prompt ?? '';
       const systemPrompt = callArgs.options?.systemPrompt ?? '';
 
-      // Verify turn-based prompt content
-      expect(systemPrompt).toContain('WhatsApp');
-      expect(systemPrompt).toContain('Alice');
-      expect(systemPrompt).toContain('SendMessage');
-      expect(systemPrompt).toContain('omni done');
-      expect(systemPrompt).toContain('inst-wb');
+      // Turn context goes in the user message, NOT the system prompt
+      expect(userPrompt).toContain('WhatsApp Turn');
+      expect(userPrompt).toContain('Alice');
+      expect(userPrompt).toContain('omni say');
+      expect(userPrompt).toContain('omni done');
+      expect(userPrompt).toContain('inst-wb');
+      expect(userPrompt).toContain('Hello from WhatsApp');
+      // System prompt should NOT contain turn instructions
+      expect(systemPrompt).not.toContain('WhatsApp Turn');
+      expect(systemPrompt).not.toContain('omni done');
     });
 
     it('does NOT include turn-based instructions when OMNI_INSTANCE is absent', async () => {
@@ -486,11 +493,13 @@ describe('ClaudeSdkOmniExecutor', () => {
       await executor.waitForDeliveries(session.id);
 
       expect(queryMock).toHaveBeenCalledTimes(1);
-      const callArgs = (queryMock.mock.calls[0] as unknown as [{ options?: { systemPrompt?: string } }])[0];
-      const systemPrompt = callArgs.options?.systemPrompt ?? '';
+      const callArgs = (queryMock.mock.calls[0] as unknown as [{ prompt?: string }])[0];
+      const userPrompt = callArgs.prompt ?? '';
 
-      expect(systemPrompt).not.toContain('WhatsApp');
-      expect(systemPrompt).not.toContain('SendMessage');
+      expect(userPrompt).not.toContain('WhatsApp Turn');
+      expect(userPrompt).not.toContain('omni say');
+      // User message is passed through as-is
+      expect(userPrompt).toBe('Hello from CLI');
     });
   });