@causyne/agent 1.10.13 → 1.10.18

package/docs/ARCHITECTURE.md

@@ -31,18 +31,37 @@ are application policies and require adversarial review.
 | Concern | Source |
 | --- | --- |
 | Invocation and local session | `entrypoint.js`, `cliMode.js`, `tui/` |
-| Orchestration and budgets | `agentLoop.js`, `modelRouter.js`, `tokenTracker.js` |
+| Orchestration and budgets | `agentLoop.js`, `decisionPolicy.ts`, `implementationPlan.ts`, `agentProfiles.ts`, `subagentJournal.ts`, `modelRouter.js`, `tokenTracker.js` |
 | Host execution | `tools/registry.js`, `sandbox.js`, `execSafe.js` |
 | Models | `providers/`, `modelCatalogue.js` |
 | Context and memory | `memory.js`, `memoryManager.js`, `contextManager.js`, `cortex/` |
-| Recovery | `checkpoints.js`, `gitSnapshot.js`, `sessionStore.js` |
-| Extensions | `mcp/`, `plugins/`, `hooks.js`, `skillsManager.js`, `toolPacks.js` |
+| Recovery | `checkpoints.js`, `gitSnapshot.js`, `sessionJournal.ts`, `sessionStore.js` |
+| Extensions | `mcp/`, `plugins/`, `hooks.ts`, `skillsManager.js`, `toolPacks.js` |
 | Readable interpreter source | `src/tool-scripts/` |
 
-The current implementation remains JavaScript/ESM on Node.js 24+. The accepted
-language direction is incremental strict TypeScript. Runtime validation is
-still needed at model, filesystem, subprocess and extension boundaries.
-Rust is a possible narrow native worker later; no Rust rewrite is underway.
+The shipping runtime is ESM on Node.js 24+. Incremental strict TypeScript
+migration is active: `tsconfig.runtime.json` emits readable JavaScript beside
+strict TypeScript runtime modules, shared contracts live under `src/types/`,
+and retained JavaScript has a separately named migration ratchet. Session,
+plugin-skill, task-shape, delegated-agent, hook, approval-grant, plan-cache and
+MCP boundaries now compile from strict TypeScript.
+Runtime validation is still required at model, filesystem, subprocess and
+extension boundaries. Rust is reserved for a measured, narrow native worker;
+no Rust rewrite is underway.
+
+## Planning and durable decisions
+
+Complex implementation uses `update_plan` to maintain a validated checklist in
+session state. The TUI keeps the current steps visible beside the input surface;
+plans are not written into the user's project. A mutating tool call on a complex
+task is held until the model has created this plan.
+
+`request_decision` handles choices with durable product, architecture, data,
+security, or workflow consequences. It presents two to four concrete options
+and a custom-answer path. This checkpoint is distinct from a tool permission:
+selecting a design never grants filesystem or command access. The checkpoint
+runs in the provider-independent agent loop, so Mode C can remove routine
+approval friction without silently choosing an unresolved architecture.
 
 ## Tool and extension boundaries
 
@@ -54,11 +73,82 @@ the task shape or `tool_search` makes them relevant.
 Local plugins use a static `plugin.json` manifest. Creating a plugin leaves it
 disabled. Enabling it pins a digest of every file the plugin process may read;
 any later manifest, source, helper or asset change revokes trust. Discovery
-validates static manifests and hashes bytes without importing JavaScript, so code cannot run
-during pre-trust initialization. A plugin tool runs in a separate Node process
-with the permission model enabled and only its declared workspace, network, or
-subprocess capabilities. Plugin calls still pass through Causyne's sandbox and
-approval gates.
+validates static manifests and hashes bytes without importing JavaScript, so
+code cannot run during pre-trust initialization. Reviewed plugins may contribute
+namespaced, progressively disclosed Markdown skills; these remain inert data
+and disappear from the catalogue if the digest changes. A plugin tool runs in a
+separate Node process with the permission model enabled and only its declared
+workspace, network, or subprocess capabilities. Plugin calls still pass through
+Causyne's sandbox and approval gates.
+
+MCP uses the official Model Context Protocol client packages rather than a
+project-specific JSON-RPC implementation. It supports local stdio servers and
+remote Streamable HTTP servers, with legacy SSE fallback when configured for
+automatic negotiation. The SDK owns initialization, capability negotiation,
+protocol framing, request cancellation, and transport shutdown. Causyne adds
+connection timeouts, bounded output, current-workspace roots, concurrent
+discovery, `tools/list_changed` refresh, structured content handling, and
+namespaced access to server resources and prompts.
+
+Each MCP grant is bound to a SHA-256 digest of the complete server definition.
+Changing a command, URL, environment, header, working directory, timeout,
+protocol mode, or tool filter invalidates the old grant. Disconnect and revoke
+also invalidate an in-flight handshake so a stale connection cannot become
+active afterward. Per-server include and exclude patterns limit which
+capabilities enter the model's catalogue. Connection state distinguishes
+disabled, connecting, connected, failed, and authentication-required servers;
+one failing server does not prevent native tools or other MCP servers from
+loading. Static bearer or custom headers may be configured locally. Interactive
+browser OAuth is not implemented yet; an HTTP 401 is surfaced as
+`needs_auth` instead of being reported as a generic transport failure.
+
+## Agent browser boundary
+
+Causyne's web foundation has two layers. Lightweight TypeScript search and
+fetch clients work without a browser runtime. Rendered navigation uses a
+dedicated in-process Causyne Browser adapter built from a locally reviewed
+upstream browser engine. Required upstream names and licenses remain in the
+third-party notices. The adapter is deliberately smaller than the reference
+service:
+it does not import an HTTP server, inbound port, cloud deployment layer, VNC,
+telemetry, remote WebSocket control, or OpenClaw integration.
+
+The browser engine and Playwright are exact-pinned optional capability packages
+installed into the user's private Causyne capability directory only after an
+explicit browser capability grant. Causyne does not download a browser binary. Advanced
+rendered browsing requires a separately installed supported browser runtime
+selected by `CAUSYNE_BROWSER_EXECUTABLE` or discovered from a standard system
+location.
+The main npm package therefore stays small and web search remains useful when
+the optional rendered browser is absent.
+
+The browser runs headless by default with WebRTC blocked and a Causyne-owned
+profile. It provides tabs, navigation, accessibility snapshots with bounded
+pagination, stable element references, form interaction, bounded extraction,
+and atomic downloads restricted to the selected workspace. Search first uses
+bounded DuckDuckGo HTML and Bing RSS providers, then uses rendered provider
+pages when the optional browser is available. Failures remain visible after
+every provider is exhausted instead of being replaced with fabricated results.
+
+Every top-level navigation and browser subresource passes through the public
+URL policy. The policy accepts only HTTP(S), rejects embedded credentials,
+resolves hostnames before access, and blocks loopback, private, link-local,
+multicast, reserved, local, internal, and metadata addresses. Redirects in the
+non-browser fetch path are revalidated one at a time. Responses and extracted
+text are bounded, and network downloads require the existing approval gate.
+These controls reduce SSRF and unbounded-output risk while preserving normal
+public-web use from the user's selected workspace.
+
+User-defined subagent profiles are static JSON manifests under the local Causyne
+state directory. A profile supplies bounded instructions, an allowlist of tools,
+and hard step/token ceilings. It cannot widen its own scope, cannot recursively
+delegate, and does not load executable project code. Calls may narrow a
+profile's tool scope or budgets, but cannot exceed them.
+
+Completed delegated runs write a separate append-only JSONL sidechain under the
+local Causyne state directory. The parent receives only the worker's final
+result, while the bounded sidechain retains its messages and outcome for local
+inspection. A torn final append preserves earlier complete events.
 
 Hooks are user-owned argv arrays stored in the local Causyne configuration.
 They never pass through a shell and project repositories are not searched for
@@ -66,10 +156,19 @@ startup hooks. `PreToolUse` runs after the built-in sandbox and before an
 approval prompt; exit code 2 denies, and any other failure fails closed.
 `PostToolUse` can annotate a result or reject it without rewriting history.
 
-Host execution remains the default because Causyne must work in the directory
-the user selected. Optional container isolation can be added as an execution
-profile later, but it must remain explicit: mounting a workspace into Docker is
-a different trust boundary and cannot silently replace native desktop access.
+Host execution remains the current architecture because Causyne must operate in
+the directory and desktop environment the user selected. Container work is
+deferred and is not part of the present implementation plan.
+
+## Durable sessions
+
+Each workspace-scoped conversation is stored as an append-only JSONL event
+journal. Reads project `session.created`, `messages.appended`,
+`messages.windowed`, and explicit replacement events into the current session.
+A torn final append preserves prior complete events, while complete corruption
+fails safely. Legacy per-session JSON and global history files migrate on read.
+The compatibility `sessionStore.js` entry keeps existing callers stable while
+the strict TypeScript journal emits the JavaScript used at runtime.
 
 ## Plan cache and context pressure
 
@@ -77,7 +176,9 @@ Completed multi-step runs teach argument-free plan templates. Lookup tries an
 indexed exact signature first, then bounded lexical similarity only for a task
 shape with enough confidence. Latency, hit type and recent hit rate are recorded;
 lookup temporarily cools down when a populated cache repeatedly misses while
-new successful plans may continue warming it. `/plans import` accepts sanitized
+new successful plans may continue warming it. Persisted plans and metrics are
+validated before entering the typed runtime; malformed entries are ignored.
+`/plans import` accepts sanitized
 offline samples for known workloads, and `/plans` exposes the measurements.
 `npm run benchmark:plan-cache` measures exact lookup, fuzzy lookup, misses and
 prewarming at bounded cache sizes in an isolated temporary state directory. It

package/docs/SECURITY_REVIEW.md

@@ -1,6 +1,6 @@
 # Security review and migration status
 
-Review date: 2026-10-19. This is a scoped source and package review, not a
+Review date: 2026-10-21. This is a scoped source and package review, not a
 claim that Causyne Agent is free from vulnerabilities.
 
 ## OpenSSF records
@@ -65,6 +65,18 @@ The active source takes a different architecture and distribution path:
 - `web_fetch` downloads and curated game-asset downloads require the highest
   approval class. Curated assets are size-limited, constrained to catalog URLs,
   protected from output path traversal, and are not automatically extracted.
+- Web search uses bounded HTTP providers without requiring a browser binary.
+  Interactive rendered browsing uses an outbound, in-process Causyne Browser adapter.
+  Causyne does not run an inbound browser-control server, inbound port, remote control,
+  VNC, telemetry, cloud deployment, or OpenClaw integration. Optional launcher
+  packages require an explicit capability grant. Causyne never downloads the
+  browser runtime; an existing external installation must be selected
+  through `CAUSYNE_BROWSER_EXECUTABLE` or a standard system location.
+- Browser navigation and subresources accept only public HTTP(S) destinations.
+  Hostnames are resolved and checked against private, loopback, link-local,
+  multicast, reserved, local, internal, and metadata ranges. Non-browser
+  redirects are checked at every hop. Downloads are bounded, atomic, restricted
+  to the selected workspace, and remain in the highest approval class.
 - The package allowlist excludes the legacy archive, Android source, private
   operating documents, credentials, installers, bytecode, and generated
   tarballs.

package/docs/THIRD_PARTY_NOTICES.md

@@ -1,6 +1,6 @@
 # Third-party software review
 
-Review date: 2026-10-19.
+Review date: 2026-10-21.
 
 Causyne Agent's npm package declares third-party packages as dependencies; it
 does not bundle their source into the project tarball. Each dependency remains
@@ -9,22 +9,58 @@ license identifiers:
 
 | License expression | Lockfile package entries |
 | --- | ---: |
-| Apache-2.0 | 21 |
-| MIT | 9 |
+| Apache-2.0 | 25 |
+| MIT | 20 |
+| ISC | 2 |
 
-The lockfile contained 30 dependency entries in total. Three are production
-entries; development and platform-specific optional entries account for the
-rest. npm's audit metadata reported 12 installed packages.
+The lockfile contained 47 dependency entries in total. Development and
+platform-specific optional entries account for most of the graph.
 
-The direct runtime dependencies are `acorn-walk` and `commander`. Direct
-development dependencies are `@babel/parser`, `@types/node`, `acorn`, and
-`typescript`. Exact versions and integrity hashes are recorded in
-`package-lock.json`.
+The direct runtime dependencies are `@modelcontextprotocol/client`,
+`acorn-walk`, and `commander`. Direct development dependencies are
+`@babel/parser`, `@modelcontextprotocol/node`, `@modelcontextprotocol/server`,
+`@types/node`, `acorn`, `typescript`, and `zod`. The three direct MCP packages
+are licensed under Apache-2.0. Exact versions, transitive dependencies, license
+identifiers, and integrity hashes are recorded in `package-lock.json`.
 
 No dependency in the reviewed main lockfile was marked with an install script.
 Optional capability dependencies are installed only after approval into a
 separate local environment and are not covered by the main lockfile review.
 
+The product-facing browser capability is **Causyne Browser**. Upstream names
+below are used only for required attribution and exact dependency identifiers.
+
+The optional browser capability installs `camoufox-js` 0.11.5 under MPL-2.0
+and `playwright-core` 1.58.0 under Apache-2.0. They remain separate packages in
+the user's local capability directory and are not copied into Causyne Agent's
+npm tarball. Causyne does not download or bundle the Camoufox browser runtime.
+
+The snapshot windowing and external executable bridge in `src/browser/` are
+adapted from the MIT-licensed Camofox Browser project at source commit
+`2c0036a8b18bf9cd983376751ff4d52dfd9add0f`. Its required notice is:
+
+> MIT License
+>
+> Copyright (c) 2025 Jo, Inc
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+
 Repository scanning found no third-party copyright header or license marker in
 the project-authored source and skill files. That negative scan alone cannot
 establish authorship or permission. On 2026-10-19, the licensor confirmed that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@causyne/agent",
-  "version": "1.10.13",
+  "version": "1.10.18",
   "description": "Agentic AI for software, tools, and computer workflows",
   "main": "bin/causyne.js",
   "type": "module",
@@ -23,13 +23,15 @@
   "scripts": {
     "start": "node ./bin/causyne.js",
     "test": "node --test --import ./tests/helpers/isolateState.js \"tests/**/*.test.js\"",
-    "build": "node scripts/compile_skills.js",
+    "build": "node scripts/compile_skills.js && tsc -p tsconfig.runtime.json",
     "benchmark:plan-cache": "node src/benchmarks/planCache.js",
     "check:release": "node scripts/check_release.js",
     "check:public": "npm run check:release && node scripts/check_public_release.js",
     "prepublishOnly": "npm run check:public && npm test && npm run typecheck:strict",
     "typecheck": "tsc -p tsconfig.json",
-    "typecheck:strict": "tsc -p tsconfig.strict.json"
+    "typecheck:ts": "tsc -p tsconfig.strict.json",
+    "typecheck:js-ratchet": "tsc -p tsconfig.js-ratchet.json",
+    "typecheck:strict": "npm run typecheck:ts && npm run typecheck:js-ratchet"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -51,14 +53,18 @@
     "url": "https://github.com/ikbal-causyne/causyne-agent/issues"
   },
   "dependencies": {
+    "@modelcontextprotocol/client": "2.3.1",
     "acorn-walk": "^8.3.5",
     "commander": "^11.1.0"
   },
   "devDependencies": {
     "@babel/parser": "^8.0.7",
+    "@modelcontextprotocol/node": "2.1.1",
+    "@modelcontextprotocol/server": "2.3.1",
     "@types/node": "^22.20.2",
     "acorn": "^8.18.0",
-    "typescript": "^7.0.2"
+    "typescript": "^7.0.2",
+    "zod": "4.6.7"
   },
   "private": false
 }

package/src/agentLoop.js

@@ -20,6 +20,7 @@ import { analyzeTask, buildTaskBrief, packsFromShape } from './taskShape.js';
 import { lookupPlan, recordPlan, recordMiss, renderPlanHint, toStep } from './planCache.js';
 import { routedConfig } from './modelRouter.js';
 import { assessStep, isThrashing } from './uncertainty.js';
+import { assessDecisionRequirement, isMutatingToolCall, requiresImplementationPlan } from './decisionPolicy.js';
 import { VFETracker } from './vfeTracker.js';
 import {
   routePacks,
@@ -75,11 +76,15 @@ Specifically, you excel at:
 - **No Chitchat**: Tools are for actions, text output is *only* for communication. Do not add explanatory comments within tool calls or code blocks.
 - **File Paths**: ALWAYS output the absolute path of any file you create, modify, or generate so the user knows exactly where it is.
 
-# Task Management & Planning (TodoWrite)
-- ALWAYS use the TodoWrite tool to track and manage tasks before starting implementation. Create atomic, verb-led, clear outcome items.
+# Task Management & Planning
+- Use update_plan to create a visible implementation checklist before complex implementation. Create atomic, verb-led, verifiable steps and keep exactly one step in progress.
 - Check off completed TODOs immediately before reporting progress. Do not batch up multiple task completions.
 - Reconcile and close the todo list when all goal tasks are done. If the user asks you to implement, do not output a separate text-based plan. Just build and display the todo list.
 
+# Durable Decisions
+- Use request_decision when multiple materially different architecture, product, data, security, or workflow directions are valid. Give 2-4 concrete options with consequences; the UI adds a custom-answer choice.
+- A decision is separate from permission. Do not ask for routine implementation details that can be resolved from the repository. Even in Mode C, pause for an unresolved durable architecture decision before changing the system.
+
 # Maximize Parallel Tool Calls (Speed is Key)
 - CRITICAL INSTRUCTION: For maximum efficiency, whenever you perform multiple operations, invoke all relevant tools concurrently (in parallel) rather than sequentially. 
 - Searching for different patterns (imports, usage, definitions) MUST happen in parallel. Reading multiple files MUST happen in parallel. 
@@ -344,6 +349,17 @@ export class AgentLoop {
     this.circuitBreakerUnlocked = false;
     this.stopRequested = false;
     this.pendingApprovals = new Map(); // Maps toolCallId -> resolve function
+    this.waitForDecision = async () => null;
+    this._decisionAnswers = new Map();
+    this._decisionRequirement = { required: false, kind: 'architecture', reason: '' };
+    this._decisionResolved = true;
+    this._implementationPlan = [];
+    this._implementationPlanRequired = false;
+    // A delegated subagent can tighten these two ceilings. They are applied
+    // after every config refresh so run() cannot accidentally replace a
+    // worker's declared bounds with the parent tier defaults.
+    this.maxStepsCeiling = null;
+    this.taskTokenLimit = null;
     
     // Limits based on tier/budget & emulator fast bypass
     this.updateTierLimits();
@@ -695,6 +711,58 @@ export class AgentLoop {
     }
   }
 
+  updateImplementationPlan(update) {
+    this._implementationPlan = update.plan.map(item => ({ ...item }));
+    this.emitEvent({
+      type: 'agent_plan',
+      explanation: update.explanation || '',
+      plan: this._implementationPlan.map(item => ({ status: item.status, text: item.step, id: item.id }))
+    });
+    auditLog.log({
+      event: 'implementation_plan_updated', taskId: this.taskId,
+      steps: this._implementationPlan.length,
+      completed: this._implementationPlan.filter(item => item.status === 'completed').length
+    });
+  }
+
+  async requestDecision(request) {
+    const fingerprint = createHash('sha256')
+      .update(JSON.stringify({ kind: request.kind, question: request.question, options: request.options.map(option => option.id) }))
+      .digest('hex');
+    const remembered = this._decisionAnswers.get(fingerprint);
+    if (remembered) return remembered;
+
+    this.emitEvent({ type: 'decision_request', request });
+    auditLog.log({ event: 'decision_requested', taskId: this.taskId, kind: request.kind, optionCount: request.options.length });
+    const answer = await this.waitForDecision(request);
+    if (!answer || typeof answer.label !== 'string' || !answer.label.trim()) {
+      this.emitEvent({ type: 'decision_result', request, answer: null });
+      return null;
+    }
+    const normalized = {
+      requestId: request.id,
+      optionId: typeof answer.optionId === 'string' ? answer.optionId : null,
+      label: answer.label.trim(),
+      custom: answer.custom === true
+    };
+    this._decisionAnswers.set(fingerprint, normalized);
+    if (request.kind === 'architecture') this._decisionResolved = true;
+    this.emitEvent({ type: 'decision_result', request, answer: normalized });
+    auditLog.log({ event: 'decision_answered', taskId: this.taskId, kind: request.kind, custom: normalized.custom });
+    return normalized;
+  }
+
+  mutationCheckpoint(functionName, args = {}) {
+    if (!isMutatingToolCall(functionName, args)) return null;
+    if (this._decisionRequirement.required && !this._decisionResolved) {
+      return 'ARCHITECTURE_DECISION_REQUIRED: Before changing the system, call request_decision with kind "architecture", 2-4 concrete options, their consequences, and a clear reason. Do not ask about routine details; this checkpoint exists because the current request crosses a durable architecture boundary.';
+    }
+    if (this._implementationPlanRequired && this._implementationPlan.length === 0) {
+      return 'IMPLEMENTATION_PLAN_REQUIRED: Call update_plan with atomic, verifiable steps and exactly one in_progress step before mutating this complex task.';
+    }
+    return null;
+  }
+
   updateTierLimits() {
     this.config = loadConfig();
     if (typeof this.initializeProvider === 'function') {
@@ -719,6 +787,17 @@ export class AgentLoop {
     } else {
       this.maxSteps = 300;
     }
+    if (Number.isInteger(this.maxStepsCeiling) && this.maxStepsCeiling > 0) {
+      this.maxSteps = Math.min(this.maxSteps, this.maxStepsCeiling);
+    }
+    if (Number.isInteger(this.taskTokenLimit) && this.taskTokenLimit > 0 && this.tokenTracker) {
+      this.tokenTracker.budget = {
+        ...this.tokenTracker.budget,
+        enabled: true,
+        hardStop: true,
+        maxTokensPerTask: this.taskTokenLimit
+      };
+    }
     this.maxCircuitBreaker = this.maxSteps;
   }
 
@@ -800,10 +879,26 @@ export class AgentLoop {
     this._lessonSimilarity = 0;
     this._lastToolResult = null;
     this._paradigmShiftPending = false;
+    this._implementationPlan = [];
+    this._decisionAnswers = new Map();
+    this._decisionRequirement = assessDecisionRequirement(this.userPrompt || '');
+    this._decisionResolved = !this._decisionRequirement.required;
+    this._implementationPlanRequired = false;
     if (this.vfeTracker) this.vfeTracker.reset();
 
     if (this.userPrompt) {
       this.taskShape = analyzeTask(this.userPrompt, this.workspaceContext);
+      this._implementationPlanRequired = requiresImplementationPlan(
+        this.userPrompt,
+        this.taskShape?.archetype || '',
+        this.taskShape?.confidence || ''
+      );
+      // request_decision is comparatively large and most tasks never need it.
+      // On providers without server-side schema deferral, expose it from the
+      // first model call only when the deterministic task policy found an
+      // unresolved durable choice. This keeps the resident prompt within its
+      // measured budget without making the checkpoint undiscoverable.
+      if (this._decisionRequirement.required) this.unlockedTools.add('request_decision');
 
       // Scored routing, with the regex router as a safety net so a pack can
       // never be missed just because it scored below threshold.
@@ -1061,9 +1156,8 @@ export class AgentLoop {
         // `tool_search_tool_regex`) keep the whole core in context for free —
         // the API holds the schemas server-side and expands them on demand,
         // with no discovery round trip. Every OTHER provider was serialising
-        // all 24 core schemas into every request: 3,341 tokens to advertise
-        // tools a typical turn never calls. There, ship the resident 8 (1,059
-        // tokens) and let `tool_search` — the same mechanism that already
+        // all 24 core schemas into every request. There, ship the small resident
+        // set and let `tool_search` — the same mechanism that already
         // unlocks packs — fetch the rest.
         const residentOnly = this.llm.supportsToolSearch?.() !== true;
         let dynamicTools = await getDynamicTools(this.config.autonomyMode, this.llm.supportsVision, {
@@ -1392,18 +1486,6 @@ export class AgentLoop {
         this.messages.push(assistantMsg);
         
         if (response.content) {
-          // V5: Parse TodoWrite checklist for visual plan display
-          const planRegex = /-\s*\[([ xX\/])\]\s*(.*)/g;
-          const planMatch = [...response.content.matchAll(planRegex)];
-          if (planMatch.length > 0) {
-            const planTasks = planMatch.map(m => {
-              const marker = m[1].toLowerCase();
-              const status = marker === 'x' ? 'completed' : (marker === '/' ? 'in_progress' : 'pending');
-              return { status, text: m[2].trim() };
-            });
-            this.emitEvent({ type: 'agent_plan', plan: planTasks });
-          }
-          
           this.emitEvent({ type: 'agent_message', content: response.content });
         }
 
@@ -1521,18 +1603,24 @@ export class AgentLoop {
             // if it was declined, fall through to the path that needs nothing.
             let visionReady = false;
             let visionDeclined = false;
+            let browserReady = false;
+            let browserDeclined = false;
             try {
               const { groupStatus, isGroupDeclined } = await import('./provisioning/capabilityProvisioner.js');
               visionReady = groupStatus('vision').state === 'ready';
               visionDeclined = isGroupDeclined('vision');
+              browserReady = groupStatus('browser').state === 'ready';
+              browserDeclined = isGroupDeclined('browser');
             } catch (e) { /* treat as not ready */ }
             let webGuardMsg = '';
 
-            if (hasVision && !visionReady && !visionDeclined) {
-              webGuardMsg = `[ANTI-SLOP CHECK: You are building a Web/UI project and must look at it before finishing, but the browser and screen-capture capability is not enabled yet. Call \`manage_local_dependencies\` with action "grant_capability" and group "vision" to request it from the user. If the user declines, read the final compiled HTML/CSS instead and verify it that way. This check fires once.]`;
+            if (!browserReady && !browserDeclined) {
+              webGuardMsg = `[ANTI-SLOP CHECK: You are building a Web/UI project and must inspect it before finishing, but the dedicated browser capability is not enabled yet. Call \`manage_local_dependencies\` with action "grant_capability" and group "browser" to request the Causyne Browser runtime. If the user declines, read the final compiled HTML/CSS instead. This check fires once.]`;
+            } else if (hasVision && !visionReady && !visionDeclined) {
+              webGuardMsg = `[ANTI-SLOP CHECK: The browser is available, but desktop screen capture is not enabled. Call \`manage_local_dependencies\` with action "grant_capability" and group "vision" to request it, or use \`browser_act\` snapshots and its workspace-scoped screenshot action. This check fires once.]`;
             } else if (hasVision && visionReady && !this.webVerificationState.screenshotTaken) {
               webGuardMsg = `[ANTI-SLOP CHECK: You are building a Web/UI project but attempted to finish without VISUALLY verifying your work. Use \`screenshot\` or \`vision_inspect_ui\` to look at the UI in a browser. A human looks at their work to avoid slop. This check fires once — if there is genuinely nothing visual to inspect, say so plainly and finish.]`;
-            } else if ((!hasVision || visionDeclined) && !this.webVerificationState.browserActUsed && !this.webVerificationState.screenshotTaken) {
+            } else if ((!hasVision || visionDeclined) && browserReady && !this.webVerificationState.browserActUsed && !this.webVerificationState.screenshotTaken) {
               webGuardMsg = `[TRANSCENDENCE CHECK: You are building a Web/UI project. As a vision-disabled model you cannot screenshot, but you MUST use \`browser_act\` to inspect the DOM, or read the final compiled HTML/CSS, to verify semantic correctness before finishing. This check fires once.]`;
             }
 
@@ -1781,6 +1869,20 @@ export class AgentLoop {
             continue;
           }
 
+          const checkpointError = this.mutationCheckpoint(functionName, args);
+          if (checkpointError) {
+            this.messages.push({
+              role: 'tool',
+              tool_call_id: toolCall.id,
+              name: functionName,
+              content: JSON.stringify({
+                success: false,
+                error: checkpointError
+              })
+            });
+            continue;
+          }
+
           // A policy hook runs after the built-in sandbox but before any user
           // approval prompt, so a deterministic denial never asks the user to
           // approve work that will be rejected anyway.
@@ -2244,7 +2346,7 @@ export class AgentLoop {
             //
             // Only payloads worth the trade are folded. A small `{"success":true}`
             // ack costs less than the pointer that would replace it, and every
-            // TodoWrite would otherwise collide with every other TodoWrite.
+            // Plan updates would otherwise collide with unrelated plan updates.
             const OBSERVATION_FOLD_FLOOR = 600;
             if (resultString.length >= OBSERVATION_FOLD_FLOOR) {
               const digest = createHash('sha256').update(resultString).digest('hex');