@ctrl-spc/cs 0.7.11 → 0.7.13

package/dist/codebases.js

@@ -101,6 +101,32 @@ export async function removeCodebase(client, codebaseId) {
     if (error)
         throw new Error(error.message);
 }
+/** Saved work-item scope is shared by the reader and the dispatch guard. */
+export async function listWorkItemCodebaseTargets(client, workItemId) {
+    const { data, error } = await client.from('cliv2_task_codebase_targets')
+        .select('git_remote_url').eq('task_id', workItemId).order('git_remote_url');
+    if (error)
+        throw new Error(`Could not read the saved work-item codebase targets: ${error.message}`);
+    return (data ?? []).map(row => row.git_remote_url);
+}
+/** The existing database transaction owns membership and final-target guards. */
+export async function editWorkItemCodebaseTarget(client, workItemId, projectId, codebaseId, add) {
+    const codebases = await client.from('cliv2_codebases').select('git_remote_url')
+        .eq('id', codebaseId).eq('project_id', projectId);
+    if (codebases.error)
+        throw new Error(`Could not read the project codebase: ${codebases.error.message}`);
+    if (codebases.data?.length !== 1)
+        throw new Error("Could not read a codebase belonging to this work item's project.");
+    const { data, error } = await client.rpc('cliv2_edit_task_codebase_target', {
+        p_task_id: workItemId, p_git_remote_url: codebases.data[0].git_remote_url, p_add: add,
+    });
+    if (error)
+        throw new Error(`Could not edit the saved work-item codebase targets: ${error.message}`);
+    if (!Array.isArray(data) || !data.every(target => typeof target === 'string')) {
+        throw new Error('The saved work-item codebase targets could not be read back after editing.');
+    }
+    return data;
+}
 /**
  * Record that THIS machine has a codebase's folder checked out — Phase 2
  * per-machine availability. Upserts one path-free row into the owner-scoped

package/dist/daemon.js

@@ -1,11 +1,5 @@
 import { ensureAutostart } from './autostart.js';
-import { claimDaemonLock, releaseDaemonLock } from './daemon-lock.js';
 import { liveClient, startPresence, stopPresence } from './presence.js';
-/* ═══ THE ONE IMPORT ANYTHING OUTSIDE `panel3/` MAKES INTO IT. ═══ Named in
-   `.implementations/19-agent-panel-v3/conventions.md` and enforced by
-   `test/panel3-isolation.contract.test.mjs`, whose MOUNTS map allows this file
-   exactly this specifier. A second one fails the suite. See `startPanel`. */
-import { startPanel } from './panel3/run.js';
 /**
  * The terminal presence daemon (`cs start`). Comes online and heartbeats until
  * the process is signalled. Under launchd/KeepAlive (autostart) a hard crash is
@@ -22,89 +16,12 @@ import { startPanel } from './panel3/run.js';
  * clients in one process is two refresh loops on one rotating refresh token,
  * both writing `session.json`.
  *
- * ═══ THE COMPANION DELIBERATELY DOES NOT DO THIS. ═══ Two panel loops on one
- * machine id and one harness contend on a single `panel3_machines` row and each
- * would sweep the other's live runs. `cs start` is the launch the ruling names,
- * and `ensureAutostart` below installs exactly it, so an existing login item
- * starts doing the right thing with nothing else typed.
+ * Companion and the terminal daemon both use the same presence lifecycle,
+ * which owns the card worker, session and per-machine lock.
  */
 export async function runDaemon() {
-    /* One daemon per config dir. See daemon-lock.ts for the flicker this stops.
-       Exits rather than replacing the holder: under launchd's KeepAlive a
-       replacement would be restarted and would then replace the replacer. */
-    const lock = claimDaemonLock();
-    if (lock.held) {
-        console.error(`cs start is already running on this computer (pid ${lock.pid}). Stop it first to start another.`);
-        process.exitCode = 1;
-        return;
-    }
-    ensureAutostart(); // default-on: install the login item unless the user opted out
     const { machineName, agents } = await startPresence();
-    /* ═══ THE PANEL READS PRESENCE'S CLIENT, IT IS NOT HANDED A COPY OF IT. ═══
-       `startPresence` used to return the client it had just built and this line
-       passed that value to `startPanel`, which held it for the process's life. The
-       heartbeat's catch block REBUILDS that client when `session.json` comes to
-       hold a different refresh token, and since the rebuild guard landed a
-       successful rebuild is the normal path rather than a throw. The value handed
-       over here was therefore a client the database refuses and nobody watches,
-       while the panel's two-second poll went on writing `panel3_machines` with it.
-       That table took 37,051 writes in the incident window, the largest single
-       share of it.
-       `liveClient` is presence's own accessor, so the panel asks the module that
-       owns the presence lifecycle rather than being told once. It cannot answer
-       null here: `startPresence` has returned, so presence is running. */
-    /* ═══ AND THE LAST CLIENT IT SAW IS KEPT, FOR THE ONE READ THAT HAPPENS AFTER
-       PRESENCE HAS ALREADY STOPPED. ═══ `startPanel` returns `stop: () =>
-       stopListening(current(), ...)`, and `current()` is evaluated in the arrow,
-       BEFORE `stopListening` is entered, so `stopListening`'s own best-effort
-       try/catch cannot cover it. On `SIGNED_OUT` both watchers are bound to this
-       same client and auth-js runs them in registration order: presence's fires
-       first and `stopPresence` sets its module singleton to null synchronously,
-       so by the time the daemon's watcher reaches `shutdown` -> `panel.stop()`
-       the getter below has nothing live to answer with. Throwing there is a throw
-       inside `shutdown` before its first await, which `void shutdown(1)` does not
-       contain: `panel3_machines.stopped_at` never gets written, the card goes on
-       saying an agent is working, `Promise.all` rejects, `process.exit` is never
-       reached, and the panel's `for(;;)` spins on a caught-and-logged failure
-       every two seconds forever. launchd's `KeepAlive` cannot help a process that
-       never exits. `shutdown()` must reach `process.exit` on every path.
-  
-       THE FALLBACK IS THE LAST CLIENT PRESENCE ITSELF HELD, not the one it built
-       at startup: a rebuild replaces `p.client`, and a goodbye written with the
-       pre-rebuild snapshot is the same refused write this branch exists to stop.
-       Recording it on every successful read is what keeps it current without a
-       second subscription to the presence lifecycle.
-  
-       THE THROW IS NOT WEAKENED FOR THE POLL, and that is the point of ordering
-       the two lines this way. A poll only reaches the fallback once presence has
-       stopped, which in this process means a shutdown is already in flight and
-       the exit is milliseconds away; every other poll, for the whole life of the
-       daemon, reads a live client or fails loudly exactly as before. What the
-       fallback buys is the goodbye write, which `stopListening` documents as
-       best-effort precisely because it is the last thing this process does.
-  
-       THE ONE THING THAT WINDOW COSTS, NAMED RATHER THAN LEFT TO BE REDISCOVERED:
-       a poll landing in it used to throw at the getter and be swallowed by the
-       per-poll catch, so it could not write at all. Now it takes the fallback and
-       reaches `sayListening`, whose upsert deliberately sends `stopped_at: null`
-       on every poll, since that is what lets a restarted daemon come back on a row
-       stamped as gone. If such a poll's write lands AFTER `stopListening`'s stamp,
-       it erases the goodbye and the row reads listening again. That is bounded and
-       self-healing: `LISTENING_WINDOW_MS` is 15s, so the freshness check calls the
-       machine gone 15 seconds later whatever the column says, and the process is
-       already exiting. Not worth a second seam to close, and worth knowing about
-       if a machine is ever seen lingering for a few seconds after `cs start` ends. */
-    let lastKnownClient = liveClient();
-    const panel = startPanel(() => {
-        const live = liveClient();
-        if (live) {
-            lastKnownClient = live;
-            return live;
-        }
-        if (!lastKnownClient)
-            throw new Error('the presence loop is not running, so there is no session to work through');
-        return lastKnownClient;
-    });
+    ensureAutostart(); // default-on: install the login item unless the user opted out
     console.log(`CTRL+SPC — this computer: ${machineName}`);
     console.log(`Agents detected: ${agents.length ? agents.join(', ') : 'none'}`);
     console.log('Online. Heartbeating presence and answering cards. Ctrl-C to stop.');
@@ -113,46 +30,13 @@ export async function runDaemon() {
         if (stopping)
             return;
         stopping = true;
-        /* ═══ ONE HANDLER, BOTH WRITES, AND THEN ONE EXIT. ═══ A machine that has
-           gone has to read gone in both places: `cliv2_agents` for the title bar's
-           machines chip, and `panel3_machines.stopped_at` for the card that would
-           otherwise go on saying an agent is working. Two handlers each calling
-           `process.exit` would let whichever finished first kill the other's write,
-           so the panel's own signal handling stands down when it is started from
-           here (see `run()`). Both are best-effort and neither throws, which is why
-           they can settle together. */
-        await Promise.all([panel.stop(), stopPresence()]);
-        releaseDaemonLock();
+        // Shared presence stops the card worker and both readiness records.
+        await stopPresence();
         process.exit(code);
     }
     process.on('SIGINT', () => void shutdown());
     process.on('SIGTERM', () => void shutdown());
-    /* ═══ AND THE PANEL GOES DOWN WITH THE SESSION TOO. ═══ presence.ts stops its
-       own three loops on `SIGNED_OUT`, which leaves this process holding a panel
-       that would go on upserting `panel3_machines` every few seconds with a token
-       the database refuses. It shares this client, so it hears the same event: one
-       shutdown, both halves, and the exit says the daemon needs a person rather
-       than pretending it is still online. Non-zero because this is a failure, not
-       a Ctrl-C. The login item's `KeepAlive` restarts either way, and that is the
-       point: a restart refuses at `getClient` after one refresh attempt and exits
-       again, so an unattended machine retries on launchd's throttle instead of
-       polling four times a second forever. */
-    /* ═══ BOUND TO WHATEVER CLIENT IS LIVE AT THIS INSTANT, WHICH IS WHY IT IS
-       READ AND NOT CAPTURED. ═══ This used to bind to the client `startPresence`
-       returned. A rebuild replaces that client, and presence re-binds its OWN
-       watcher to the replacement (`bindSignedOutWatcher`) while this one would
-       stay on the discarded client, where `SIGNED_OUT` can never fire again. That
-       leaves the daemon's half of the shutdown deaf for the rest of the process.
-       Reading it here binds to the current one; a client rebuilt LATER is
-       presence's watcher to carry, and that one calls `stopPresence`, which clears
-       the intervals this process depends on. This is not a second terminal stop,
-       it is the same one bound to a client that exists.
-  
-       THE NULL IS THROWN ON RATHER THAN SKIPPED, matching the getter above. `?.`
-       would read as though no client were an expected state, and it is not:
-       `startPresence` has returned, so presence is running. Worse, it would
-       silently drop half the shutdown in exactly the state it claims to guard
-       against, leaving a daemon that answers a dead session by doing nothing. */
+    // Presence owns sign-out cleanup; the terminal entry also exits.
     const live = liveClient();
     if (!live)
         throw new Error('the presence loop is not running, so there is no session to watch');

package/dist/folders.js

@@ -1,7 +1,7 @@
 import { execFile } from 'node:child_process';
-/** Native folder chooser per OS. Same commands the v1 companion uses. */
-function pickerCommand() {
-    if (process.platform === 'darwin') {
+/** Native folder chooser per OS. */
+export function pickerCommand(platform = process.platform) {
+    if (platform === 'darwin') {
         return {
             command: 'osascript',
             args: [
@@ -13,13 +13,101 @@ function pickerCommand() {
             ],
         };
     }
-    if (process.platform === 'win32') {
+    if (platform === 'win32') {
+        const source = String.raw `
+using System;
+using System.Runtime.InteropServices;
+
+[ComImport]
+[Guid("DC1C5A9C-E88A-4DDE-A5A1-60F82A20AEF7")]
+internal class FileOpenDialog { }
+
+[ComImport]
+[Guid("43826D1E-E718-42EE-BC55-A1E261C37BFE")]
+[InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+internal interface IShellItem
+{
+    void BindToHandler(IntPtr pbc, ref Guid bhid, ref Guid riid, out IntPtr ppv);
+    void GetParent(out IShellItem parent);
+    void GetDisplayName(uint sigdnName, out IntPtr name);
+    void GetAttributes(uint mask, out uint attributes);
+    void Compare(IShellItem other, uint hint, out int order);
+}
+
+[ComImport]
+[Guid("D57C7288-D4AD-4768-BE02-9D969532D960")]
+[InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+internal interface IFileOpenDialog
+{
+    [PreserveSig] int Show(IntPtr owner);
+    void SetFileTypes(uint count, IntPtr filters);
+    void SetFileTypeIndex(uint index);
+    void GetFileTypeIndex(out uint index);
+    void Advise(IntPtr events, out uint cookie);
+    void Unadvise(uint cookie);
+    void SetOptions(uint options);
+    void GetOptions(out uint options);
+    void SetDefaultFolder(IShellItem folder);
+    void SetFolder(IShellItem folder);
+    void GetFolder(out IShellItem folder);
+    void GetCurrentSelection(out IShellItem item);
+    void SetFileName([MarshalAs(UnmanagedType.LPWStr)] string name);
+    void GetFileName([MarshalAs(UnmanagedType.LPWStr)] out string name);
+    void SetTitle([MarshalAs(UnmanagedType.LPWStr)] string title);
+    void SetOkButtonLabel([MarshalAs(UnmanagedType.LPWStr)] string text);
+    void SetFileNameLabel([MarshalAs(UnmanagedType.LPWStr)] string label);
+    void GetResult(out IShellItem item);
+    void AddPlace(IShellItem item, uint alignment);
+    void SetDefaultExtension([MarshalAs(UnmanagedType.LPWStr)] string extension);
+    void Close(int result);
+    void SetClientGuid(ref Guid guid);
+    void ClearClientData();
+    void SetFilter(IntPtr filter);
+    void GetResults(out IntPtr items);
+    void GetSelectedItems(out IntPtr items);
+}
+
+public static class CtrlSpcFolderPicker
+{
+    private const uint PickFolders = 0x20;
+    private const uint ForceFileSystem = 0x40;
+    private const uint PathMustExist = 0x800;
+    private const uint FileSystemPath = 0x80058000;
+    private const int Cancelled = unchecked((int)0x800704C7);
+
+    [DllImport("user32.dll")]
+    private static extern IntPtr GetForegroundWindow();
+
+    public static string Choose()
+    {
+        IFileOpenDialog dialog = (IFileOpenDialog)new FileOpenDialog();
+        IShellItem item = null;
+        IntPtr name = IntPtr.Zero;
+        try
+        {
+            uint options;
+            dialog.GetOptions(out options);
+            dialog.SetOptions(options | PickFolders | ForceFileSystem | PathMustExist);
+            dialog.SetTitle("Choose a project folder for CTRL+SPC");
+            int result = dialog.Show(GetForegroundWindow());
+            if (result == Cancelled) return null;
+            Marshal.ThrowExceptionForHR(result);
+            dialog.GetResult(out item);
+            item.GetDisplayName(FileSystemPath, out name);
+            return Marshal.PtrToStringUni(name);
+        }
+        finally
+        {
+            if (name != IntPtr.Zero) Marshal.FreeCoTaskMem(name);
+            if (item != null) Marshal.FinalReleaseComObject(item);
+            Marshal.FinalReleaseComObject(dialog);
+        }
+    }
+}`;
         const script = [
-            'Add-Type -AssemblyName System.Windows.Forms',
-            '$dialog = New-Object System.Windows.Forms.FolderBrowserDialog',
-            '$dialog.Description = "Choose a project folder for CTRL+SPC"',
-            'if ($dialog.ShowDialog() -eq "OK") { $dialog.SelectedPath }',
-        ].join('; ');
+            `Add-Type -TypeDefinition @'\n${source}\n'@`,
+            '[CtrlSpcFolderPicker]::Choose()',
+        ].join('\n');
         return { command: 'powershell.exe', args: ['-NoProfile', '-STA', '-Command', script] };
     }
     return {

package/dist/panel3/checkout.js

@@ -407,35 +407,10 @@ settings = {}) {
             + `${branch}. Check that ${codebase.name} is a git repository on ${machineName}.`);
     }
 }
-/**
- * ═══ THE CARD IS OVER: COMMIT WHAT IS THERE, THEN TAKE THE COPY AWAY. ═══
- *
- * The commit comes first and is unconditional on there being something to
- * commit, so removing the copy cannot lose work. The BRANCH is never touched:
- * work that never landed survives until a person deals with it.
- *
- * It takes the folder alone, and that is deliberate: a worktree knows its own
- * repository, so the sweep needs neither the located checkout nor the codebase
- * row to clean one up.
- */
-/**
- * ═══ EVERYTHING IN A CARD'S COPY, ON ITS BRANCH. ═══
- *
- * `settleCardWorktree`'s own first three lines, extracted rather than rewritten,
- * because the landing needs the commit BEFORE the merge and the sweep needs it
- * before the removal. Committing in two places with two messages is how one card
- * comes to have two ideas of what its work is.
- *
- * ═══ ITS FAILURE IS COMPOSED, WHICH THE SWEEP NEVER NEEDED. ═══ The sweep
- * writes to stderr, so git's own text was harmless there. On the landing path a
- * failure reaches a person through an agent, and `execFileSync`'s message begins
- * `Command failed: git -C <absolute path>`. So this wraps in `worktreeForCard`'s
- * shape: what was composed here passes through, anything else is replaced.
- */
+/** Commit only for an explicitly selected landing action. Cleanup never commits.
+ * Failures are path-free because the landing result reaches the hosted panel. */
 export function commitCardWork(folder, 
-/* WHAT THE COPY IS, IN WORDS AND NEVER AS A PATH. The sweep has only the
-   folder and says so; the landing has the codebase and the branch and names
-   both, which is what a person reading the failure needs. */
+// Name the codebase and branch in failures, without exposing a local path.
 describe) {
     try {
         git(folder, ['add', '-A']);
@@ -491,11 +466,13 @@ export function mergeIntoBase(source, branch, base, codebaseName) {
     }
 }
 export function settleCardWorktree(folder) {
-    commitCardWork(folder, 'this card\'s working copy');
-    /* FORCE, AFTER THE COMMIT. Everything tracked is now committed on the branch,
-       so what `--force` overrides is only ignored files: an installed
-       `node_modules`, a build output, which the next copy makes again. */
+    // Completion is not permission to commit. Preserve unfinished Git work,
+    // including staged and untracked files, for the person to review or resume.
+    if (git(folder, ['status', '--porcelain']).length > 0)
+        return false;
+    // Only ignored build/dependency files can remain in a clean copy.
     removeWorktree(folder);
+    return true;
 }
 /**
  * Every card copy this machine currently holds, as `<codebase id>/<folder>`

package/dist/panel3/codex-models.js

@@ -0,0 +1,96 @@
+import { spawn } from 'node:child_process';
+import { z } from 'zod';
+import { agentPath } from '../agents.js';
+import { killTree, windowsSafeSpawn } from '../win-shell.js';
+const modelPage = z.object({
+    data: z.array(z.object({
+        model: z.string().min(1),
+        displayName: z.string(),
+        description: z.string(),
+        defaultReasoningEffort: z.string(),
+        supportedReasoningEfforts: z.array(z.object({ reasoningEffort: z.string(), description: z.string() })),
+        isDefault: z.boolean(),
+    })),
+    nextCursor: z.string().nullable(),
+});
+/** Read the installed harness's catalog under its own account/config. No turn,
+ * session, product catalog, or generation is created. Keep provider IDs intact. */
+export async function listCodexModels() {
+    const bin = agentPath('codex');
+    if (!bin)
+        throw new Error('Codex is not installed on this machine.');
+    const { args, shell } = windowsSafeSpawn(bin, ['app-server']);
+    return new Promise((resolve, reject) => {
+        const child = spawn(bin, args, { shell, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
+        const models = [];
+        const cursors = new Set();
+        let buffer = '';
+        let received = 0;
+        let settled = false;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            killTree(child);
+            if (error)
+                reject(error);
+            else
+                resolve(models);
+        };
+        const timer = setTimeout(() => finish(new Error('Codex model discovery timed out.')), 15_000);
+        const send = (message) => child.stdin.write(`${JSON.stringify(message)}\n`);
+        child.on('error', (error) => finish(error));
+        child.stdin.on('error', (error) => finish(error));
+        child.on('close', () => finish(new Error('Codex exited before returning its available models.')));
+        // Diagnostics can contain local configuration; never return them as catalog data.
+        child.stderr.resume();
+        child.stdout.setEncoding('utf8').on('data', (chunk) => {
+            if (settled)
+                return;
+            received += chunk.length;
+            if (received > 1_000_000)
+                return finish(new Error('Codex model discovery response was too large.'));
+            buffer += chunk;
+            let newline;
+            while (!settled && (newline = buffer.indexOf('\n')) >= 0) {
+                const line = buffer.slice(0, newline);
+                buffer = buffer.slice(newline + 1);
+                if (!line.trim())
+                    continue;
+                try {
+                    const response = JSON.parse(line);
+                    if (response.id !== 1 && response.id !== 2)
+                        continue;
+                    if (response.error)
+                        throw new Error('Codex rejected model discovery. Use the installed default or an explicit user choice.');
+                    if (response.id === 1) {
+                        send({ method: 'initialized' });
+                        send({ id: 2, method: 'model/list', params: { limit: 100, includeHidden: false } });
+                    }
+                    else {
+                        const page = modelPage.parse(response.result);
+                        models.push(...page.data);
+                        if (page.nextCursor !== null) {
+                            if (cursors.has(page.nextCursor))
+                                throw new Error('Codex model discovery repeated a page.');
+                            cursors.add(page.nextCursor);
+                            send({ id: 2, method: 'model/list', params: { limit: 100, includeHidden: false, cursor: page.nextCursor } });
+                        }
+                        else if (models.length === 0) {
+                            finish(new Error('Codex returned no available models.'));
+                        }
+                        else
+                            finish();
+                    }
+                }
+                catch (error) {
+                    finish(error instanceof SyntaxError || error instanceof z.ZodError
+                        ? new Error('Codex returned an invalid available-model list. Use the installed default or an explicit user choice.')
+                        : error instanceof Error ? error : new Error('Codex model discovery failed.'));
+                }
+            }
+        });
+        send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'ctrl_spc_models', version: '1' } } });
+    });
+}

package/dist/panel3/coordinator.js

@@ -1,4 +1,6 @@
 import { returned } from './client.js';
+import { agentPath } from '../agents.js';
+import { harness } from './spawn.js';
 /**
  * Read the designation. `cliv2_orchestrator_preference` carries `unique
  * (user_id)`, so RLS alone (`auth.uid() = user_id`) can never return more than
@@ -14,5 +16,18 @@ import { returned } from './client.js';
 export async function designatedCoordinator(client) {
     const rows = await returned(client.from('cliv2_orchestrator_preference').select('machine_id, agent'), 'read', 'which machine and harness are designated to coordinate');
     const row = rows[0];
+    if (row && (typeof row.machine_id !== 'string' || !['claude', 'codex'].includes(row.agent))) {
+        throw new Error('The saved primary agent is invalid; select Claude Code or Codex again.');
+    }
     return row ? { machineId: row.machine_id, agent: row.agent } : null;
 }
+/** New work follows the shared choice. Existing runs keep their recorded harness. */
+export async function selectedHarness(client, machineId) {
+    const designation = await designatedCoordinator(client);
+    const selected = designation?.machineId === machineId
+        ? designation.agent
+        : harness();
+    if (!agentPath(selected))
+        throw new Error(`${selected} is selected but is not installed on this machine`);
+    return selected;
+}

package/dist/panel3/presence.js

@@ -86,6 +86,13 @@ export async function sayListening(client, machineId, name, harness) {
     if (error)
         throw new Error(`could not say this machine is listening: ${error.message}`);
 }
+/** Only a path-free category leaves the machine. The full error stays in its log. */
+export async function sayPollingProblem(client, machineId, harness, problem) {
+    const { error } = await client.from('panel3_machines').update({ problem })
+        .eq('machine_id', machineId).eq('harness', harness);
+    if (error)
+        throw new Error(`could not report worker health: ${error.message}`);
+}
 /**
  * Stop saying it, because this daemon is going away.
  *

package/dist/panel3/prompt.js

@@ -327,14 +327,17 @@ export const whatWasAttached = (attachments) => {
            second place for it to drift. */
         'A `workflow` is the process this work follows: stages, in an order it gives. The owner of this',
         'conversation is the one who reads it, with `get_workflow`.',
+        'An `artifact` is a document on a work item. Read it with `get_artifact`, and revise it with',
+        '`update_artifact`.',
     ];
     return [
         ...(codebases.length === 0 ? [] : [
             '',
             'THE CODEBASES THIS CARD TOUCHES',
             ...codebases,
-            'For a dispatched piece, its one codebase is named separately below. The other selected',
-            'codebases are separate work, not missing folders, so do not look for or report on them.',
+            'Each worker stays in its separately assigned codebase. The conversation owner remains',
+            'responsible for the whole request across every required codebase, including work delegated',
+            'to other workers. A card attachment or launch brief is not a saved work-item target read.',
         ]),
         ...personAttachmentLines,
     ];
@@ -371,7 +374,9 @@ const LANDING_LINES = {
     ],
     main: [
         'Finished work in this codebase lands on the main branch, and the person is asked first.',
-        'When the card\'s work is done, call `offer_ending` with one sentence saying what was done.',
+        'When the whole assignment is done, first write_report with work_complete=true and its verified',
+        'results, then call `offer_ending` with one sentence saying what was done. Never offer an',
+        'ending while you are planning, waiting for workers, or still owe work in another codebase.',
         'The product writes the question and both answers, and it performs the merge itself if they',
         'choose to put the work back. Landing is the product\'s job and never yours: never merge and',
         'never push.',
@@ -416,9 +421,10 @@ const projectCodebases = (codebases) => {
             : [
                 ...codebases.map((codebase) => (`${codebase.name} — id ${codebase.id} — ${codebase.identity} — `
                     + (codebase.located ? 'located on this machine' : 'not located on this machine'))),
-                'Choose the codebase that contains the work and include its id when you send somebody.',
-                'If several codebases are needed, send one person per codebase. If the request does not make',
-                'the choice clear, call `ask_question` once with `answer_mode` set to `multi_select`, put the',
+                'For an attached work item, read its saved targets; this project list is not its selection.',
+                'Launch one owner for the whole assignment. For several targets, that owner sends a scoped',
+                'worker to each codebase. If the saved record and request do not make the choice clear,',
+                'call `ask_question` once with `answer_mode` set to `multi_select`, put the',
                 'plausible codebase names in `options`, and stop. Do not write a question as your reply.',
             ]),
     ];
@@ -479,6 +485,10 @@ export function levelOnePrompt(cardTitle, messages, produced, attachments = [],
         'Launch one owner for the conversation. Give it the complete responsibility and boundary. If',
         'the request belongs to a registered codebase, name it. If it is record-only work, launch it',
         'without a codebase. The owner talks to the person and may send workers of its own.',
+        'For work on a saved Work Item, read get_work_item for its current saved codebase targets.',
+        'Use those targets, not the project-wide choices or a remembered selection. Do not ask the',
+        'person to repeat a saved selection. If several targets are required, give the ONE owner the',
+        'whole assignment and every required target; it can dispatch a worker in each codebase.',
         'Your only question is a destination or codebase you truly cannot choose. NEVER ask the person',
         'to make a work or product decision. When one registered codebase clearly fits, launch its owner',
         'even if the work itself needs the person to choose between options; the owner asks that question.',
@@ -559,6 +569,9 @@ export const OWNER_COMPLETION_RULES = [
     'without declaring completion, the product starts you again to carry on.',
     'Only when the latest user assignment is fulfilled, call write_report with work_complete=true',
     'and a report explaining what fulfilled it. Check all required steps and verification first.',
+    'Only offer_ending after every requested codebase has its required work verified. Owning',
+    'one working copy does not narrow a multi-codebase request to that copy. Dispatch the remaining',
+    'codebase work and read its results before offering completion.',
     'Then give the final answer and exit. Do not declare completion for an interim status answer.',
     'A failed or skipped required step is unfinished work, even if all workers have returned.',
     'Resolve it or ask for the real required intervention; never convert it into a completion caveat.',
@@ -602,6 +615,9 @@ export function workBrief(level, responsibility, boundary, workItemId, attachmen
                 'When asked to create a workflow, use create_workflow to save it; do not execute the workflow.',
                 'Ask clarifying questions with ask_question only when the missing answer changes its behavior.',
                 'Write the requested tool mentions and per-use permissions in the stage bodies using the tool schema instructions.',
+                'Plain-prose requests must stay plain: do not add unrequested tool permissions or approval templates.',
+                'For edits, read get_workflow first, reword retained stages with reword_stage, and keep their numbered references in edit_workflow. Do not replace retained stages or bypass a protected-body refusal.',
+                'Only you can call get_workflow. If a child is assigned a workflow review, read it yourself first and put the complete relevant workflow content in its brief; do not assign it an unavailable tool call. Authoring and review do not authorize executing the workflow or its stages.',
                 'The saved workflow appears as a reviewable card in this conversation. Do not substitute a plan artifact or a prose-only reply.',
                 '',
                 'TRACEABILITY BEFORE A CODEBASE FILE CHANGES',
@@ -661,7 +677,10 @@ export function workBrief(level, responsibility, boundary, workItemId, attachmen
                 'before you send anybody is a minute they watch a line with no answer coming.',
                 '',
                 'IF YOU SPLIT IT',
-                'Everybody you send works in the SAME copy of the codebase as everybody else, at the same',
+                'Everybody you send to the SAME codebase shares its copy; different codebases have separate',
+                'copies. Read the Work Item\'s current saved targets before file work or dispatch, and use',
+                'only those targets. Preserve the person\'s no-commit, no-merge and no-push instructions in',
+                'every worker boundary and at completion. People in the same copy work at the same',
                 'time. Nothing keeps them out of each other\'s way, so anybody CHANGING files needs a piece',
                 'that touches nobody else\'s files, or has to be sent on their own.',
                 /* ═══ AND A WORKFLOW OVERRIDES THAT DEFAULT, INSIDE THE BLOCK THAT SETS
@@ -1170,9 +1189,12 @@ export function modelChoiceRules(harness) {
     return [
         'MODEL AND EFFORT FOR EACH DISPATCH',
         `You run under ${harness}. Your dispatched children use the same harness.`,
+        'Claude and Codex name harnesses, not model identifiers. A request to use Codex gpt-5.5 means model gpt-5.5 under Codex; do not concatenate a harness label into the model argument. A harness-only request does not specify a model. If you do not know a supported model for the task, omit model to use the installed default rather than inventing an identifier.',
         'The dispatch tool accepts optional model and effort strings. Honor the user\'s exact stated model and effort for the work they apply to, including downstream workers. Copy each requested value byte-for-byte into the dispatch argument: do not expand aliases, normalize spelling or case, or replace it with a canonical provider identifier. Carry those wishes and their scope verbatim in every applicable responsibility and boundary.',
         'When the user requests separate workers or assigns choices to separate parts, call dispatch for those parts. Doing their work yourself does not satisfy that request. If product tools are deferred, discover dispatch before starting; use the product ask_question and write_report tools for questions and completion.',
-        'When the user has not specified a value, choose for this child\'s task using your knowledge of this harness. Pass your choice in the tool arguments; a sentence alone does not select it. Different workers may use different choices.',
+        harness === 'codex'
+            ? 'When the user has not specified a model, call list_codex_models before choosing for this child. Choose a model ID from that live result and an effort it supports, according to the task. If discovery fails, omit autonomous model and effort choices and use installed defaults; do not guess from memory. The list does not override explicit user IDs or aliases. Different workers may use different choices. Pass choices in dispatch arguments; prose alone does not select them.'
+            : 'When the user has not specified a value, choose for this child\'s task using supported Claude aliases such as sonnet or opus. Do not invent version-suffixed aliases such as sonnet-5 or haiku-4.5. If uncertain, omit model to use the installed default. Pass your choice in the tool arguments; a sentence alone does not select it. Different workers may use different choices.',
         'Omitting a value chooses the harness default (or the machine-local model default), never the parent\'s model or effort. No product model catalog exists. Pass provider values unchanged; do not silently substitute after a rejection.',
     ].join('\n');
 }