@hizliemre/horse-code 0.1.1 → 0.2.0

package/dist/{chunk-3XVZXTB6.js → chunk-7JMWPTJ5.js}

@@ -3,14 +3,15 @@ import {
   checkpointMtime,
   isContinuePrompt,
   readCheckpoint
-} from "./chunk-FGVJFMK5.js";
+} from "./chunk-ZSQ24YDJ.js";
 import {
   planFor,
   runTraces
-} from "./chunk-NNTIACT4.js";
+} from "./chunk-MRZVA5JB.js";
 import {
-  defaultGitRunner
-} from "./chunk-IW2KBAVZ.js";
+  defaultGitRunner,
+  gitVerb
+} from "./chunk-LPQU436C.js";
 import {
   BATCH_TOOLS_NOTE,
   contextTools,
@@ -22,7 +23,7 @@ import {
   readFileTool,
   reinforceTouched,
   reinforceUsed
-} from "./chunk-TOPZL5SU.js";
+} from "./chunk-LLL7QWXB.js";
 import {
   ToolRegistry,
   handedOver,
@@ -30,7 +31,7 @@ import {
   runToCompletion,
   telemetry,
   truncateSafe
-} from "./chunk-YILDXPSI.js";
+} from "./chunk-AE36LLL2.js";
 import {
   loadTraceIndex,
   pruneTraces,
@@ -38,15 +39,454 @@ import {
   sharedDerived,
   traceRootRel,
   traceable
-} from "./chunk-FFYBY2NA.js";
+} from "./chunk-KAGKX2YT.js";
 import {
   buildProjectGraph,
   loadGraphSync,
   pruneAreaNames
-} from "./chunk-PGOYDOI4.js";
+} from "./chunk-XEGQT5EN.js";
 import {
   writableStateRoot
-} from "./chunk-SSDLHWSF.js";
+} from "./chunk-6W4UH2BQ.js";
+
+// src/agents/cli-auth.ts
+import { spawnSync } from "child_process";
+function profileEnv(kind, configDir) {
+  if (!configDir) return {};
+  return kind === "claude" ? { CLAUDE_CONFIG_DIR: configDir } : { CODEX_HOME: configDir };
+}
+function readAuthStatus(kind, out) {
+  if (kind === "codex") {
+    const m = /logged in(?: using (.+))?/i.exec(out);
+    if (!m || /not logged in/i.test(out)) return { loggedIn: false };
+    const plan = m[1]?.trim();
+    return { loggedIn: true, ...plan ? { plan } : {} };
+  }
+  try {
+    const j = JSON.parse(out);
+    if (!j.loggedIn) return { loggedIn: false };
+    return {
+      loggedIn: true,
+      ...j.email ? { email: j.email } : {},
+      ...j.subscriptionType ? { plan: j.subscriptionType } : {}
+    };
+  } catch {
+    return { loggedIn: false };
+  }
+}
+function statusArgs(kind) {
+  return kind === "claude" ? ["auth", "status"] : ["login", "status"];
+}
+function loginArgs(kind) {
+  return kind === "claude" ? ["auth", "login"] : ["login"];
+}
+function checkProfile(kind, configDir) {
+  const r = spawnSync(kind, statusArgs(kind), {
+    env: { ...process.env, ...profileEnv(kind, configDir) },
+    encoding: "utf8",
+    // A status check that hangs must not hang the startup summary with it.
+    timeout: 2e4
+  });
+  if (r.error) return { loggedIn: false };
+  return readAuthStatus(kind, `${r.stdout ?? ""}${r.stderr ?? ""}`);
+}
+function runLogin(kind, configDir) {
+  const r = spawnSync(kind, loginArgs(kind), {
+    env: { ...process.env, ...profileEnv(kind, configDir) },
+    stdio: "inherit"
+  });
+  if (r.error) {
+    const e = r.error;
+    return e.code === "ENOENT" ? { ok: false, error: `\`${kind}\` is not installed, or not on PATH` } : { ok: false, error: e.message };
+  }
+  return { ok: r.status === 0 };
+}
+
+// src/agents/cli-models.ts
+var CLAUDE_MODELS = ["fable", "opus", "sonnet", "haiku"];
+var CODEX_MODELS = ["gpt-5.6-terra", "gpt-5.6-sol", "gpt-5.6-luna"];
+var CODEX_DEFAULT = "gpt-5.6-terra";
+function cliCatalog() {
+  return [...CLAUDE_MODELS, ...CODEX_MODELS];
+}
+function cliFor(model) {
+  const m = model.toLowerCase().replace(/^no-think\//, "").replace(/^(cc|claude|cx|codex)\//, "");
+  if (/^(fable|opus|sonnet|haiku)\b/.test(m) || m.startsWith("claude")) return "claude";
+  if (/^(codex|gpt|o[0-9])\b/.test(m)) return "codex";
+  return void 0;
+}
+function cliInvocation(model) {
+  const bare = model.replace(/^no-think\//, "").replace(/^(cc|claude|cx|codex)\//, "");
+  const effort = /-(ultra|max|xhigh|high|medium|low|minimal)$/.exec(bare)?.[1];
+  const name = effort ? bare.slice(0, -(effort.length + 1)) : bare;
+  const resolved = name === "codex" ? CODEX_DEFAULT : name;
+  return {
+    ...resolved ? { model: resolved } : {},
+    ...effort ? { effort } : {}
+  };
+}
+
+// src/agents/cli-agent.ts
+import { spawn } from "child_process";
+function cliArgs(kind, prompt, extra = []) {
+  return kind === "claude" ? ["--output-format", "stream-json", "--verbose", ...extra, "-p", "--", prompt] : ["exec", "--json", "--skip-git-repo-check", ...extra, "--", prompt];
+}
+function decodeClaudeEvent(line) {
+  let e;
+  try {
+    e = JSON.parse(line);
+  } catch {
+    return void 0;
+  }
+  const type = e.type;
+  if (type === "rate_limit_event") {
+    const info = e.rate_limit_info ?? {};
+    const status = String(info.status ?? "unknown");
+    const raw = info.unifiedWindows ?? {};
+    const windows = {};
+    for (const [name, w] of Object.entries(raw)) windows[name] = w?.utilization ?? 0;
+    const quota = {
+      status,
+      windows,
+      ...typeof info.resetsAt === "number" ? { resetsAt: info.resetsAt } : {}
+    };
+    return status.startsWith("allowed") ? { quota } : {
+      quota,
+      /**
+       * The reset time rides along, as an ISO instant rather than prose.
+       *
+       * A spent five-hour window reopens; without saying when, the only safe bench is "the rest of the
+       * run", which on a ten-hour board writes off a subscription for hours after it recovered. The
+       * gateway's wordings said "reset after 4h" and nothing ever parsed them — see `quotaResetAt`.
+       */
+      rateLimited: `${status} \u2014 ${describeWindows(windows)}` + (quota.resetsAt ? ` (resets ${new Date(quota.resetsAt * 1e3).toISOString()})` : "")
+    };
+  }
+  if (type === "assistant") {
+    const msg = e.message;
+    const parts = Array.isArray(msg?.content) ? msg.content : [];
+    const text = parts.filter((b) => typeof b === "object" && b !== null && b.type === "text").map((b) => b.text).join("");
+    const tool = parts.find((b) => typeof b === "object" && b !== null && b.type === "tool_use");
+    return {
+      ...text ? { text } : {},
+      ...msg?.model ? { served: msg.model } : {},
+      ...tool ? { tool: { name: tool.name, ...targetOf(tool.input) ? { target: targetOf(tool.input) } : {} } } : {}
+    };
+  }
+  if (type === "user") {
+    const parts = e.message?.content;
+    const failed = (Array.isArray(parts) ? parts : []).find(
+      (b) => typeof b === "object" && b !== null && b.type === "tool_result" && b.is_error === true
+    );
+    return failed ? { tool: { name: "tool", ok: false } } : void 0;
+  }
+  if (type === "result") {
+    const u = e.usage ?? {};
+    const cost = e.total_cost_usd;
+    return {
+      usage: {
+        freshTokens: u.input_tokens ?? 0,
+        cachedTokens: u.cache_read_input_tokens ?? 0,
+        cacheWriteTokens: u.cache_creation_input_tokens ?? 0,
+        outputTokens: u.output_tokens ?? 0,
+        ...cost !== void 0 ? { costUsd: cost } : {}
+      },
+      ...e.subtype === "error_during_execution" ? { error: String(e.result ?? "the CLI reported an error") } : {}
+    };
+  }
+  return void 0;
+}
+function decodeCodexEvent(line) {
+  let e;
+  try {
+    e = JSON.parse(line);
+  } catch {
+    return void 0;
+  }
+  const type = String(e.type ?? "");
+  if (/rate.?limit/i.test(type)) return { rateLimited: String(e.message ?? "rate limited by the CLI") };
+  if (type === "item.completed") {
+    const item = e.item;
+    if (item?.type === "agent_message" && item.text) return { text: item.text };
+    if (item?.type && item.type !== "agent_message") {
+      const changes = item.changes;
+      const first = Array.isArray(changes) ? changes.find((c) => typeof c?.path === "string")?.path : void 0;
+      const more = Array.isArray(changes) && changes.length > 1 ? ` +${changes.length - 1}` : "";
+      return {
+        tool: {
+          name: item.name ?? item.type,
+          ...first ? { target: `${first}${more}` } : {}
+        }
+      };
+    }
+    return void 0;
+  }
+  if (type === "turn.completed") {
+    const u = e.usage ?? {};
+    return {
+      usage: {
+        freshTokens: u.input_tokens ?? 0,
+        cachedTokens: u.cached_input_tokens ?? 0,
+        cacheWriteTokens: u.cache_write_input_tokens ?? 0,
+        outputTokens: u.output_tokens ?? 0
+      }
+    };
+  }
+  if (type === "turn.failed" || type === "error") {
+    return { error: String(e.message ?? "codex reported an error") };
+  }
+  return void 0;
+}
+function describeWindows(windows) {
+  const parts = Object.entries(windows).map(([k, v]) => `${k} ${Math.round(v * 100)}%`);
+  return parts.length ? parts.join(", ") : "no window reported";
+}
+var SYNTHETIC = "<synthetic>";
+function targetOf(input) {
+  for (const k of ["file_path", "path", "filePath", "notebook_path"]) {
+    const v = input?.[k];
+    if (typeof v === "string" && v) return v;
+  }
+  return void 0;
+}
+function makeStreamReader(decode, onEvent) {
+  let pending = "";
+  const drain = (upToNewline) => {
+    const lines = pending.split("\n");
+    pending = upToNewline ? lines.pop() ?? "" : "";
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      const ev = decode(line);
+      if (ev) onEvent(ev);
+    }
+  };
+  return {
+    push(chunk) {
+      pending += chunk;
+      drain(true);
+    },
+    end() {
+      if (pending.trim()) drain(false);
+    }
+  };
+}
+async function runCliAgent(run) {
+  const decode = run.kind === "claude" ? decodeClaudeEvent : decodeCodexEvent;
+  const args = cliArgs(run.kind, run.prompt, run.args ?? []);
+  return new Promise((resolve6) => {
+    let child;
+    try {
+      child = spawn(run.kind, args, {
+        cwd: run.cwd,
+        signal: run.signal,
+        stdio: ["ignore", "pipe", "pipe"],
+        ...run.configDir ? { env: { ...process.env, ...profileEnv(run.kind, run.configDir) } } : {}
+      });
+    } catch (e) {
+      resolve6({ text: "", error: e instanceof Error ? e.message : String(e), exitCode: -1 });
+      return;
+    }
+    let text = "";
+    let usage;
+    let rateLimited;
+    let served;
+    let quota;
+    let error;
+    let stderr = "";
+    const reader = makeStreamReader(decode, (ev) => {
+      if (ev.text) text += ev.text;
+      if (ev.usage) usage = ev.usage;
+      if (ev.rateLimited) rateLimited = ev.rateLimited;
+      if (ev.served) served = ev.served;
+      if (ev.quota) quota = ev.quota;
+      if (ev.error) error = ev.error;
+      run.onEvent?.(ev);
+    });
+    child.stdout?.on("data", (d) => reader.push(d.toString()));
+    child.stderr?.on("data", (d) => {
+      stderr += d.toString();
+    });
+    child.on("error", (e) => resolve6({ text, ...usage ? { usage } : {}, error: e.message, exitCode: -1 }));
+    child.on("close", (code) => {
+      reader.end();
+      resolve6({
+        text,
+        ...usage ? { usage } : {},
+        ...rateLimited ? { rateLimited } : {},
+        ...quota ? { quota } : {},
+        ...served ? { served } : {},
+        // stderr only becomes the error when nothing better was said — a CLI that warns on stderr and
+        // succeeds must not be read as having failed.
+        ...error ?? (code !== 0 && stderr.trim()) ? { error: error ?? stderr.trim().slice(0, 500) } : {},
+        exitCode: code ?? -1
+      });
+    });
+  });
+}
+
+// src/agent/deadline.ts
+function withDeadline(work, signal, message) {
+  work.catch(() => {
+  });
+  return Promise.race([work, expired(signal, message)]);
+}
+function expired(signal, message) {
+  return new Promise((_, reject) => {
+    if (signal.aborted) {
+      reject(new Error(message));
+      return;
+    }
+    signal.addEventListener("abort", () => reject(new Error(message)), { once: true });
+  });
+}
+var SHORT_CALL_MS = 5 * 60 * 1e3;
+var LONG_CALL_MS = 15 * 60 * 1e3;
+function isCallerAbort(signal) {
+  return signal.aborted && signal.reason?.name !== "TimeoutError";
+}
+function isDeadline(signal) {
+  return signal.aborted && signal.reason?.name === "TimeoutError";
+}
+
+// src/agents/cli-provider.ts
+function promptFor(req) {
+  const parts = [];
+  for (const m of req.messages) {
+    if (m.role === "system") {
+      parts.push(m.content);
+      continue;
+    }
+    if (!m.content.trim()) continue;
+    parts.push(m.role === "assistant" ? `[your previous reply]
+${m.content}` : m.content);
+  }
+  const submit = req.tools?.find((t) => t.name === "submit");
+  if (submit) {
+    parts.push(
+      "Reply with ONE JSON object and nothing else \u2014 no prose before or after it, no code fence. It must satisfy this schema:\n" + JSON.stringify(submit.parameters ?? {}, null, 2)
+    );
+  }
+  return parts.join("\n\n");
+}
+function isLoggedOut(text) {
+  return /not logged in|please run \/login/i.test(text);
+}
+async function* streamWhileRunning(start) {
+  const queue = [];
+  let finished = false;
+  let wake = () => {
+  };
+  let waiter = new Promise((r) => {
+    wake = r;
+  });
+  const bump = () => {
+    const w = wake;
+    waiter = new Promise((r) => {
+      wake = r;
+    });
+    w();
+  };
+  const done = start((ev) => {
+    queue.push(ev);
+    bump();
+  });
+  let failure;
+  void done.then(() => {
+    finished = true;
+    bump();
+  }, (e) => {
+    failure = e;
+    finished = true;
+    bump();
+  });
+  for (; ; ) {
+    while (queue.length) yield queue.shift();
+    if (finished) break;
+    await waiter;
+  }
+  if (failure) throw failure;
+}
+var CliProvider = class {
+  fixed;
+  readOnly;
+  cwd;
+  accounts;
+  constructor(opts = {}) {
+    this.fixed = opts.kind;
+    this.readOnly = opts.readOnly ?? true;
+    this.cwd = opts.cwd;
+    this.accounts = opts.accounts;
+  }
+  async *chat(req, signal) {
+    const kind = this.fixed ?? cliFor(req.model);
+    if (!kind) {
+      yield { type: "error", message: `no CLI serves ${req.model} \u2014 it is not available in this catalog`, retryable: true };
+      return;
+    }
+    const args = [];
+    const { model, effort: named } = cliInvocation(req.model);
+    if (model) args.push("--model", model);
+    const effort = req.effort ?? named;
+    if (effort && kind === "claude") args.push("--effort", effort);
+    if (this.readOnly && kind === "claude") args.push("--disallowed-tools", "Write", "Edit", "NotebookEdit");
+    if (this.readOnly && kind === "codex") args.push("--sandbox", "read-only");
+    if (!this.readOnly && kind === "claude") args.push("--permission-mode", "acceptEdits");
+    if (!this.readOnly && kind === "codex") args.push("--sandbox", "workspace-write");
+    const account = this.accounts?.pick(kind);
+    let res;
+    yield* streamWhileRunning((push) => runCliAgent({
+      kind,
+      cwd: this.cwd ?? process.cwd(),
+      prompt: promptFor(req),
+      signal,
+      args,
+      ...account ? { configDir: account.configDir } : {},
+      onEvent: (ev) => {
+        if (ev.tool) push({ type: "activity", tool: ev.tool.name, ...ev.tool.target ? { target: ev.tool.target } : {}, ...ev.tool.ok === false ? { ok: false } : {} });
+        if (ev.text) push({ type: "text-delta", text: ev.text });
+        if (ev.quota && account) this.accounts?.record(kind, account.name, ev.quota.windows);
+      }
+    }).then((r) => {
+      res = r;
+    }));
+    if (res.rateLimited) {
+      yield { type: "error", message: `${kind} CLI: ${res.rateLimited}`, retryable: true };
+      return;
+    }
+    if (res.served === SYNTHETIC) {
+      const loggedOut = isLoggedOut(res.text);
+      yield {
+        type: "error",
+        retryable: true,
+        message: loggedOut ? `${kind} CLI is not logged in${account ? ` under profile "${account.name}"` : ""} \u2014 run \`hcode add-provider ${kind}\` to sign it in again` : `${kind} CLI did not recognise ${req.model} and answered without a model`
+      };
+      return;
+    }
+    if (isCallerAbort(signal)) {
+      yield { type: "error", message: "cancelled", retryable: false };
+      return;
+    }
+    if (isDeadline(signal)) {
+      yield { type: "error", message: `${kind} CLI: deadline expired`, retryable: true };
+      return;
+    }
+    if (res.error && !res.text.trim()) {
+      yield { type: "error", message: `${kind} CLI: ${res.error}`, retryable: res.exitCode !== 0 };
+      return;
+    }
+    if (res.usage) yield usageEvent(res.usage);
+    yield { type: "done", finishReason: "stop" };
+  }
+};
+function usageEvent(u) {
+  return {
+    type: "usage",
+    promptTokens: u.freshTokens,
+    completionTokens: u.outputTokens,
+    cachedTokens: u.cachedTokens,
+    cacheWriteTokens: u.cacheWriteTokens
+  };
+}
 
 // src/worktree/slug.ts
 var MAX_SLUG = 60;
@@ -262,6 +702,33 @@ function sessionName(now, taken) {
   }
   return `${day}_${Date.now()}`;
 }
+var FORBIDDEN_AT_ROOT = /* @__PURE__ */ new Set([
+  "merge",
+  "rebase",
+  "cherry-pick",
+  "revert",
+  "reset",
+  "checkout",
+  "switch",
+  "restore",
+  "commit",
+  "am",
+  "apply",
+  "stash",
+  "pull",
+  "clean"
+]);
+function guardRoot(run, repoRoot) {
+  return async (args, cwd) => {
+    const verb = gitVerb(args);
+    if (cwd === repoRoot && verb !== void 0 && FORBIDDEN_AT_ROOT.has(verb)) {
+      throw new Error(
+        `refusing to run \`git ${verb}\` in the project checkout (${repoRoot}). A session's work stays on its own branch and in its own worktree; bringing it in is the user's decision, taken in their own time.`
+      );
+    }
+    return run(args, cwd);
+  };
+}
 var WorktreeManager = class {
   repoRoot;
   /** The project checkout this manager was built for — where per-project settings and the remote live. */
@@ -281,12 +748,23 @@ var WorktreeManager = class {
    */
   worktreeHome;
   git;
+  /**
+   * The unguarded runner, for the one case that legitimately needs a forbidden verb: turning a directory
+   * that is not a repository into one.
+   *
+   * `git worktree add` needs a commit to branch from, and an empty repository has none — so a first commit
+   * is not delivery, it is the precondition for ever leaving the root alone again. It runs only when there
+   * is no HEAD, so there is no branch to disturb and no work to overwrite. Named rather than flagged, so
+   * grepping for it finds every use.
+   */
+  rawGit;
   /** Injectable clock: a session's NAME is the day it opened, so a test has to be able to say which day. */
   now;
   constructor(deps) {
     this.repoRoot = deps.repoRoot;
     this.worktreeHome = deps.worktreeHome ?? deps.repoRoot;
-    this.git = deps.runGit ?? defaultGitRunner;
+    this.rawGit = deps.runGit ?? defaultGitRunner;
+    this.git = guardRoot(this.rawGit, deps.repoRoot);
     this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
   }
   /** Runs git; nonzero exit → throws a clear error. Returns output (stdout). */
@@ -318,7 +796,8 @@ var WorktreeManager = class {
     await this.ensureRepo();
     const head = await this.git(["rev-parse", "--verify", "--quiet", "HEAD"], this.repoRoot);
     if (head.code === 0) return;
-    await this.run(["commit", "--allow-empty", "-m", "hc: initial commit"], this.repoRoot);
+    const r = await this.rawGit(["commit", "--allow-empty", "-m", "hc: initial commit"], this.repoRoot);
+    if (r.code !== 0) throw new Error(`git commit --allow-empty failed (${r.code}): ${(r.stderr || r.stdout).trim()}`);
   }
   /**
    * The ref to base the session's worktree on. Uses `fromBranch` when it resolves; otherwise falls back to
@@ -602,39 +1081,6 @@ ${out.slice(0, MAX_DIFF_CHARS)}`;
     if (check.code !== 0) return;
     await this.run(["push", remote, session.baseBranch], session.baseWorktree);
   }
-  /**
-   * Lands the finished work on the branch the job started from, in the main working copy.
-   *
-   * Without this, a project with no git remote gets nothing: `push` is a no-op and a pull request has
-   * nowhere to go, so every completed task sits on `hc/<job>/base` — invisible from the repository root.
-   * A user who watched thirty tasks succeed then finds an empty directory and cannot run the project.
-   *
-   * A pull request is delivery when there is a remote to open it against. When there is not, merging is.
-   *
-   * Refuses rather than forces. A dirty working copy or a checkout on some other branch means the user has
-   * something in progress, and overwriting that to deliver would be a worse failure than not delivering:
-   * the branch still exists and the caller reports how to merge it by hand.
-   */
-  async deliverLocally(session, targetBranch) {
-    const dirty = await this.git(["status", "--porcelain"], this.repoRoot);
-    if (dirty.code !== 0) return { ok: false, why: "the repository could not be read" };
-    if (dirty.stdout.split("\n").some((l) => l.trim() && !l.startsWith("??"))) {
-      return { ok: false, why: "the working copy has uncommitted changes" };
-    }
-    const head = await this.git(["symbolic-ref", "--short", "HEAD"], this.repoRoot);
-    const current = head.stdout.trim();
-    if (head.code !== 0 || !current) return { ok: false, why: "the repository is not on a branch" };
-    if (current !== targetBranch) return { ok: false, why: `the repository is on \`${current}\`, not \`${targetBranch}\`` };
-    const count = await this.git(["rev-list", "--count", `${targetBranch}..${session.baseBranch}`], this.repoRoot);
-    const commits = Number(count.stdout.trim()) || 0;
-    if (!commits) return { ok: true, commits: 0 };
-    const merged = await this.git(
-      ["merge", "--no-ff", "-m", `hc: ${session.jobSlug}`, session.baseBranch],
-      this.repoRoot
-    );
-    if (merged.code !== 0) return { ok: false, why: "the merge did not apply cleanly" };
-    return { ok: true, commits };
-  }
   async openPR(session, adapter, input) {
     const res = await adapter.createPR({
       branch: session.baseBranch,
@@ -646,62 +1092,496 @@ ${out.slice(0, MAX_DIFF_CHARS)}`;
   }
 };
 
-// src/skills/apply.ts
-import { readFile } from "fs/promises";
-import { readdirSync as readdirSync2 } from "fs";
-import { resolve as resolve2, sep as sep3 } from "path";
-import { z } from "zod";
-function applySkills(basePrompt, mandatory, registry) {
-  const parts = [basePrompt];
-  if (mandatory.length) {
-    const sections = mandatory.map((name) => {
-      const skill = registry.get(name);
-      if (!skill) throw new Error(`applySkills: undefined skill: ${name}`);
-      const where = skill.dir ? `
-_Skill base directory: ${skill.dir}_
-` : "";
-      return `## ${skill.name}${where}
-${skill.content}`;
-    });
-    parts.push(`# Mandatory Skills
-${sections.join("\n\n")}`);
-  }
-  const mandatorySet = new Set(mandatory);
-  const available = registry.list().filter((s) => !mandatorySet.has(s.name));
-  if (available.length) {
-    const lines = available.map((s) => `- ${s.name}: ${s.description}`);
-    parts.push(`# Discoverable Skills (call the skill tool to fetch its content)
-${lines.join("\n")}`);
-  }
-  return parts.join("\n\n");
-}
-var skillParams = z.object({
-  name: z.string().describe("The skill's name, exactly as it is listed."),
+// src/prompts.ts
+var REQUIRED_ROLES = [
+  "refiner",
+  "coach",
+  "brainstormer",
+  "analyst",
+  "planner",
+  "judge",
+  "project-manager",
+  "team-lead",
+  "router",
+  "coder",
+  "designer",
+  "senior-coder",
+  "senior-designer",
+  "architect",
+  "code-reviewer",
+  "task-auditor",
+  "principal-coder",
+  "operational",
+  "memory-keeper",
+  "tracer",
+  "tester"
+];
+var DEFAULT_ROLE_SKILLS = {
+  brainstormer: ["brainstorming"],
+  // The roles that WRITE code get the test discipline inlined, rather than having the code-tests lens reject
+  // vacuous tests after the fact. Rejecting is more expensive than getting it right the first time.
+  coder: ["test-driven-development"],
+  "senior-coder": ["test-driven-development"],
+  // The task list is where a plan becomes something an implementer can actually execute. spec-kit's template
+  // supplies the SHAPE (phases, story grouping, [P] markers); it says almost nothing about what makes an
+  // individual task executable. That is what this skill adds.
+  "project-manager": ["writing-plans"],
+  // The UI roles get design direction inlined for the same reason the coders get TDD: the code-accessibility
+  // and code-maintainability lenses can reject a templated, default-looking interface, but they cannot teach
+  // one. This skill is self-contained (no sibling reference files), which is what makes it safe to inline.
+  designer: ["frontend-design"],
+  "senior-designer": ["frontend-design"]
+  // NB: systematic-debugging is shipped but attached to NO role — it is only needed when something is stuck,
+  // so it stays in the discoverable listing every role already receives and is fetched with the `skill` tool.
+};
+var DEFAULT_PROMPTS = {
+  tracer: "You write the reference note that every other agent reads before it touches a file it did not write. A wrong note is worse than none: an agent will act on it, so accuracy outranks fluency and admitting you cannot tell outranks a plausible guess. State only what the code and the given relationships show; if the business purpose is not evident from them, describe what the file does technically and say nothing about why. Never speculate about intent, history or requirements.",
   /**
-   * A supporting document inside the skill's own directory, e.g. "reference/critique.md".
+   * The role that exercises work already built and writes down what actually happened.
    *
-   * Described, because an undescribed optional string gets filled in. Measured: four consecutive calls sent
-   * `file: ""` and every one of them failed — the skill was there, its content was one branch away, and an
-   * empty string took the other branch.
+   * Every rule below is here because its absence produces the one output worse than no testing at all: a
+   * report that says PASSED about something nobody ran. Such a report is not merely empty — it manufactures
+   * confidence, and the next person spends it.
    */
-  file: z.string().optional().describe('Optional. A supporting document inside the skill, e.g. "reference/critique.md". Omit it to read the skill itself \u2014 do not pass an empty string.')
-});
-var DOCS_SHOWN = 12;
-function docsIn(dir) {
-  try {
-    return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.name !== "SKILL.md" && !e.name.startsWith(".")).map((e) => e.isDirectory() ? `${e.name}/` : e.name).sort().slice(0, DOCS_SHOWN);
-  } catch {
-    return [];
-  }
-}
-var MAX_SKILL_DOC_CHARS = 3e4;
-function noSuchSkill(name, available) {
-  const shape = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
-  const same = available.filter((s) => shape(s) === shape(name));
-  if (same.length === 1) {
-    return `skill not found: ${name} \u2014 did you mean \`${same[0]}\`? Call it with that exact name.`;
-  }
-  return available.length ? `skill not found: ${name}. Available: ${available.join(", ")}. Use one of these exactly, or carry on without a skill \u2014 do not guess another name.` : `skill not found: ${name}. This project has no skills installed, so carry on without one.`;
+  tester: "You verify software that already exists, by running its scenarios and recording what they actually did. You are not here to build, fix or improve anything: the code under test is finished, and changing it would mean the thing you verified is not the thing that shipped.\n\nEVIDENCE IS THE WHOLE JOB. A scenario's outcome is what you OBSERVED \u2014 a database row, a log line, an HTTP response, a screen the user confirmed. Record the evidence beside every result: the query you ran and what it returned, the log event id and its line, the response body. A result you cannot show is not a result.\n\nIF A STEP WRITES TO THE DATABASE, THE RESPONSE IS NOT THE EVIDENCE. A 201 or a 204 says the request was accepted; it does not say what was stored, and a screen showing the new state does not either \u2014 both can be right while the row is wrong. For every step that creates or changes a record: query the database for that row and put the query AND the rows it returned in the report, and query the logs for the event that step should have emitted and put the query AND the line it returned there too. Absence is evidence as well: when a step must NOT emit an event \u2014 a no-op, a rejected change \u2014 show the query returning nothing. Without both, the scenario is NOT EXECUTED, however convincing the response looked.\n\nNever mark a scenario PASSED that you did not execute and observe. If you could not run it \u2014 the data does not exist, the surface is unreachable, the case is destructive against a live system \u2014 label it NOT EXECUTED and say exactly why. FAILED means you ran it and the behaviour was wrong; say what you expected, what happened, and the evidence for both. Guessing from the source is not executing: where you reasoned from code alone, say so in those words.\n\nWrite each result into the report BEFORE moving on to the next scenario. The report is a living document, not something assembled at the end: a run that stops halfway must leave behind everything it learned up to that point.\n\n\u2026and say each verdict OUT LOUD as you reach it, in one or two sentences: which scenario, what it did, and the single piece of evidence that settled it \u2014 the row, the log line, the status code. The full evidence still goes in the report; this is so the person watching the run knows what you found without opening a file. Say the failures and the NOT EXECUTED ones the same way, and with the same brevity: a result nobody hears is one they have to go looking for.\n\nNever start or stop the development environment \u2014 application hosts, dev servers, containers, databases. Those are the developer's to run. When you need something up, say which command they should run and wait for them to confirm it is ready.\n\nYou do NOT write product code. When you find something wrong that is not the verdict of the scenario you are running \u2014 a missing label, prose rendered as raw markup, a wrong format, or something the developer points out in passing \u2014 call `report_finding`. Another role fixes it and you are told when it is done, so you can re-check what it affected. Do not fix it yourself: changing the product mid-verification means the thing you verified is not the thing that shipped. And do not fail a scenario over it \u2014 a scenario fails when the scenario itself does not pass, not because something else was noticed while running it.\n\nIf the project's own rules (its constitution) say more about how verification is done here, they govern over this description \u2014 read them and follow them.",
+  refiner: "Your #1 rule: `refinedPrompt` MUST ALWAYS be in ENGLISH. If the user wrote in another language (Turkish, German, Spanish, \u2026), TRANSLATE their intent into English \u2014 never echo their language back. This is non-negotiable: a Turkish input like 'bir todo app geli\u015Ftir, \xF6nce backend' MUST come out as English 'Build a todo app; implement the backend first.'\n\nRewrite the user's message down to the raw core intent the AI needs to act on \u2014 clear, direct, and structured. Strip all politeness, emotional, and filler words (please, thanks, kindly, 'could you', 'would you', 'I'd like', etc.) and anything that carries no instruction. Do NOT add words, qualifiers, or scope the user did not state (e.g. do not add 'always'). Keep the user's own perspective and form \u2014 a question stays a question, an instruction stays an instruction; do NOT describe the user in the third person and do NOT answer the request. Example: a polite request like 'would you please answer me in language X?' becomes just 'respond in language X' (drop 'please'; do not add 'always' or any scope the user didn't state). Also classify the intent: 'chat' (conversation/question), 'feature' (new feature/work), 'bugfix' (bug fix), 'govern' (establish or amend the project's OWN standing rules and principles \u2014 writing or revising the constitution, the coding conventions, the project's rules; work whose entire output is a governing document, with no source code changed). Judge by what the request PRODUCES, not by what it mentions: 'write the project constitution from CLAUDE.md' is govern, and so is 'update our commit-message rules'; 'make the code follow the constitution' changes source and is feature. Also 'verify' \u2014 the user wants work that ALREADY EXISTS exercised and its behaviour confirmed with evidence: running a pull request's test scenarios, doing a smoke test of a feature that is already built, producing a test report. Judge by what it PRODUCES: a record of what the software DID is verify; changing what it does is feature or bugfix. 'Run the smoke tests for PR 677 and mark them passed' is verify, and so is 'check that the wizard works end to end'. 'The wizard is broken, fix it' is bugfix. Finally 'undo' \u2014 the user is asking you to REVERSE what the previous turn did, not to do anything new: 'undo that', 'revert your changes', 'go back to the previous version', 'that was wrong, put it back'. Classify by whether the request refers to work already done: undoing is never a rewrite, and asking for a different result ('rewrite it shorter') is not an undo. Also detect the natural language the user wrote in and return its English name as `language` (e.g. 'Turkish', 'English', 'German') \u2014 this is separate from refinedPrompt, which stays English. Also produce `title`: what the work is ABOUT, as a 2-5 word English kebab-case noun phrase suitable for a git branch name \u2014 the SUBJECT, not the action. 'build a luxury todo app' is 'luxury-todo-app'; 'add a login page' is 'login-page'; 'fix the null crash on retry' is 'null-crash-on-retry'. Do not open with a verb (build/add/fix/implement/update): the tool is already doing it, so the verb says nothing and crowds out the words that identify the work. Lowercase, dash-joined, no punctuation. Return the result via submit as {refinedPrompt, intent, language, title}. Remember: refinedPrompt in English, always.",
+  brainstormer: "You run the BRAINSTORM stage: you turn a raw request into a decided design, before anything is specified.\n\nThe `brainstorming` skill above is the authority on HOW to do this \u2014 follow it. What follows is only how it binds to this pipeline, because the skill names conventions from a different habitat:\n\n- OUTPUT: write the design brief to the file named in your message (specs/NNN-slug/brainstorm.md). Ignore the skill's `docs/superpowers/specs/\u2026` path.\n- NEXT STAGE: the SPEC is written from your brief, by another agent, immediately after you. There is no `writing-plans` skill to invoke here \u2014 finishing the brief IS the terminal step.\n- QUESTIONS: ask through the `ask_user` tool. For a choice between approaches use its rich option form ({label, description, preview}) so the trade-offs sit beside the list; lead with your recommendation. The user may attach a note to their answer \u2014 treat it as binding.\n- NOT AVAILABLE: the visual companion (there is no browser) and the per-checklist task list. Skip both.\n\nWrite what was DECIDED, not a transcript: the chosen approach, why it beat the others, the rejected alternatives with their reason, the constraints the spec must honour, and what is out of scope. Keep it short \u2014 it is the brief the spec is written from, not the spec itself, and it carries no implementation detail beyond the architectural choice.\n\nScale to the request: a small, obvious change deserves a paragraph and no questions at all.",
+  coach: "You are horse-code, a terminal-based AI coding agent. Your product identity is always horse-code \u2014 never claim to be Claude Code, Gemini CLI, Antigravity, or any other product, even though the underlying language model powering you may be Claude, Gemini, or another model. Answer the user's technical questions about their repository and code. If needed, inspect the repository with read_file/grep/glob.\n\nWork out loud while you do it. Before a batch of tool calls, say in ONE line what you are looking for and why; when something you read changes your mind, say that too. This is not a summary at the end \u2014 the user is watching an empty screen while you search, and a run that reads thirty files in silence is indistinguishable from one that is stuck, and impossible to redirect before the tokens are spent. Keep each line short: a sentence, not a paragraph.\n\nBe concise, direct, and helpful.",
+  // analyst + planner are spec-kit-driven (their system prompt comes from the fetched spec-kit command
+  // prompts — see src/speckit/phases.ts); they carry no default prompt here, only a model (peekModel).
+  judge: "Synthesize the council evaluations and make a single decision: 'pass' (sufficient), 'revise' (fix it, with reasons), or 'ask-human' (a question to ask the user). Return {decision, feedback, question} via submit.",
+  "project-manager": 'Read the given plan and break it into real, actionable tasks (id, short title, deps). Each task should be a single, clear piece of work. Return {tasks} via submit.\n\nThe `writing-plans` skill above governs WHAT MAKES A TASK EXECUTABLE \u2014 take that from it and nothing else. Two bindings, because the skill describes a different habitat:\n- STRUCTURE comes from the spec-kit tasks template you are given (phases, story grouping, [P] markers), NOT from the skill\'s own document layout. Ignore its `docs/superpowers/plans/\u2026` path, its required-sub-skill header, and its execution-handoff section: this pipeline already owns worktrees, dispatch and review.\n- What you DO take: exact file paths per task, a real test cycle rather than a vague "add tests" step, no placeholders (no TBD/TODO/"similar to task N"), and interfaces named explicitly so a task whose implementer never sees the others still knows the signatures it must produce and consume.\n- SIZING is the third rebinding, and the one that costs most when it is missed. The skill says "bite-sized", "one action, 2-5 minutes", "the smallest unit worth a reviewer\'s gate" \u2014 sound advice where a gate is one reader glancing at a diff. Here a card is not a line in a document: it is its own worktree, its own implementer, a full review TEAM of lenses, a council when they disagree, an acceptance gate and a merge. That overhead is paid per CARD and barely varies with the card\'s size, so splitting work finer does not divide the cost, it multiplies it.\nSize a card to a coherent piece of BEHAVIOUR a reviewer can judge whole, not to a file. An entity, its configuration, its migration and its tests are one card, because nobody can review one without the others and nothing is deliverable until all of them exist. Split only for a reason that survives being said out loud: the parts can be reviewed and merged independently, or they must run in parallel in different worktrees. "They are different files" is not such a reason. Fold setup and scaffolding into the card whose deliverable needs them.',
+  "task-auditor": "You are the last check on a task breakdown before any of it is built. Every hour of implementation after you is spent executing this list, and a bad list does not fail \u2014 the tasks pass their reviews and the wrong work is delivered correctly. Its structure has already been checked mechanically; you are here for the part only a reader can answer: does the breakdown deliver what the plan requires, and would a task's acceptance criteria still hold for an implementation that missed the point? Do not propose better work than the plan asked for \u2014 scope you invent here becomes hours someone spends. Flag any task whose only deliverable is an answer \u2014 verifying, inspecting, confirming \u2014 because an implementer reads the code as part of doing the work, and a task that ends with the repository unchanged has spent a review round on nothing. Flag OVER-SPLITTING for the same reason, and it is the more expensive mistake: every card carries a full review team, a council and an acceptance gate whatever its size, so a breakdown that gives a class and its configuration separate cards pays that overhead twice for work no one can review apart. Say which cards should be one. A clean breakdown is the normal case; say so. Return {missing, weak} via submit.",
+  "team-lead": "You audit a task breakdown before any of it runs. The schedule itself is computed from the declared dependencies and is not yours to write; what nothing has checked is whether those dependencies are RIGHT. You are given the tasks with the files each one writes and what must be true when it is done, plus the groups that would run at the same time in separate worktrees. Find the task that cannot actually start yet because it needs a type, function, table or config key another task in its own group creates \u2014 and say which declared dependencies hold work back for no reason. Both answers are usually empty; say so rather than inventing an edge. Return {missing, spurious} via submit.",
+  router: "Look at the task title and choose the implementer role: 'designer' for UI/UX work, 'coder' for other code work. Return {role} via submit.",
+  coder: "Implement the given task in the worktree. If it is a new task, start from scratch; if it is a returning task, address the reviewer notes. Work with read/write/edit/grep/glob/shell and run the tests.\n\nThe `test-driven-development` skill above is how you write code here: the failing test comes first, and it must fail for the RIGHT reason before you make it pass. A test that asserts nothing is worse than no test \u2014 it reports success forever. Bindings for this pipeline: your worktree is already prepared (do not create one), every file you write is committed as you write it, and there is no separate agent to hand off to \u2014 you take the task to green yourself.",
+  designer: "Implement the UI/UX task in the worktree. Focus on the user interface and experience; work with read/write/edit.\n\nThe `frontend-design` skill above governs the LOOK: aesthetic direction, typography, and choices that do not read as templated defaults. Follow the project's existing visual language where there is one \u2014 a distinctive design that fights the surrounding product is worse than a plain one that fits it.",
+  "senior-coder": "Take over the task the coder got stuck on; implement it with a more careful approach. Take the reviewer notes and previous attempts into account.\n\nYou are here because a previous attempt failed, so start by understanding WHY rather than rewriting: the `systematic-debugging` skill is available (fetch it with the `skill` tool) and is the right tool when a test fails or behaviour is unexplained. The `test-driven-development` skill above still governs how you write the fix \u2014 reproduce the failure in a test first, then make it pass.",
+  "senior-designer": "Take over the UI/UX task the designer got stuck on; implement it more carefully.\n\nA previous attempt already failed, so establish WHY before redesigning \u2014 the `systematic-debugging` skill is available via the `skill` tool when the failure is behavioural rather than visual. The `frontend-design` skill above still governs the look.",
+  architect: "Analyze the root cause of a repeatedly failing task or a merge conflict, and produce a concrete solution plan. Return {rootCause, plan} via submit.\n\nFetch the `systematic-debugging` skill with the `skill` tool and follow it: your job is the ROOT CAUSE, and the failure mode to avoid is proposing a plausible fix for a cause you never established. Say what the evidence is, not what it might be.",
+  "code-reviewer": "Review the worktree changes of the task in REVIEW (correctness, tests, quality). Return {verdict: pass|fail, notes} via submit \u2014 your decision is final.",
+  "principal-coder": "Holistically review all changes in the PR (base worktree). If sufficient, approve; otherwise request-changes with concrete comments. In the final decision round, give accept or ask-human (a question to ask the user).",
+  "memory-keeper": "You are the ONLY writer into this project's long-term memory. Everything else \u2014 every review lens, the council, the judge \u2014 can merely PROPOSE; you decide.\n\nTreat every proposal as an UNVERIFIED CLAIM from a narrow, single-angle agent that saw one slice of one job, not as text to store. Most proposals are wrong in a specific way: they generalize a one-off into a rule, they restate the finding the agent was reviewing, or they record general programming advice any model already knows. Discard all of those. When a claim does survive, REWRITE it in your own words \u2014 never store an agent's sentence verbatim. Merge proposals that say the same thing into one memory.\n\nA memory qualifies ONLY if it is (a) durable \u2014 still true next month, (b) project-specific, and (c) actionable \u2014 it would change what an agent does. Write conventions, constraints, gotchas and root causes. A `lesson` must state what went wrong AND what to do instead. Set `audience` only when the memory is genuinely useful to specific roles and useless to the rest; leave it out otherwise.\n\nNEVER write transient run detail (task ids, attempt counts, what happened today), never restate the request, never duplicate a memory that already exists, and never include credentials, tokens, keys, or anything resembling a secret. Each memory is one self-contained sentence that makes sense with no other context.\n\nReturn at most 5 memories via submit as {memories}. Returning NONE is the most common correct answer \u2014 prefer an empty list over a weak memory, because a bad memory is injected into every future run.",
+  operational: "You handle version control for the project. Given a git diff of work just completed, write a single Conventional Commits message: `type(scope): subject`. Types: feat, fix, docs, refactor, test, chore, style, perf, build, ci. Choose the scope from the touched area (e.g. spec, plan, tasks, or a module name) or omit it. The subject is imperative, lowercase, \u226472 chars, no trailing period. Add a short body only if the change genuinely needs explanation. Commit messages are always in English. Return {message} via submit."
+};
+var SPEC_TEAM = [
+  { name: "spec-completeness", perspective: "coverage of the REQUESTED scope: capabilities the user asked for that are missing, or behavior left unspecified", models: [] },
+  { name: "spec-clarity", perspective: "ambiguity: requirements that can be read two ways, vague wording, unresolved NEEDS CLARIFICATION markers", models: [] },
+  { name: "spec-consistency", perspective: "internal contradictions between requirements, acceptance scenarios, and success criteria", models: [] },
+  { name: "spec-scope", perspective: "scope discipline: requirements the user never asked for, gold-plating, scope creep beyond the request", models: [] },
+  { name: "spec-abstraction-leak", perspective: "implementation detail that has leaked into the spec (languages, frameworks, APIs, storage mechanics, code structure) \u2014 a spec must stay technology-agnostic", models: [] },
+  { name: "spec-verifiability", perspective: "are success criteria measurable and technology-agnostic, and can each acceptance scenario be tested without knowing the implementation", models: [] },
+  { name: "spec-user-value", perspective: "do the user stories deliver the value the user actually asked for, and is the priority ordering sensible", models: [] },
+  { name: "spec-domain-model", perspective: "key entities, their attributes and relationships \u2014 coherent and complete at the domain level, with no implementation detail", models: [] },
+  { name: "spec-privacy", perspective: "requirement-level data handling: what data is stored, who may see it, what must never leak or be retained", models: [] }
+];
+var PLAN_TEAM = [
+  { name: "plan-spec-conformance", perspective: "traceability to the approved spec: every requirement covered by the plan, and nothing planned that the spec never asked for", models: [] },
+  { name: "plan-architecture", perspective: "layering, module boundaries, dependency direction, overall structural coherence", models: [] },
+  { name: "plan-data-model", perspective: "schema and entity design, relationships, migrations, integrity constraints", models: [] },
+  { name: "plan-api-contracts", perspective: "interface and contract design, naming, backward compatibility, ergonomics", models: [] },
+  { name: "plan-security", perspective: "threat model, authentication/authorization design, input validation, secret handling, injection surfaces", models: [] },
+  { name: "plan-concurrency", perspective: "race conditions, atomicity, ordering, multi-writer/multi-tab safety, shared-state design", models: [] },
+  { name: "plan-resilience", perspective: "failure modes, error propagation, recovery, retries, partial-failure behavior", models: [] },
+  { name: "plan-performance", perspective: "algorithmic complexity, hot paths, resource bounds, scalability of the chosen design", models: [] },
+  { name: "plan-test-strategy", perspective: "how the design will be proven: seams, dependency injection, contract/integration test layers, what each test actually establishes", models: [] },
+  { name: "plan-simplicity", perspective: "YAGNI: over-engineering, unnecessary abstraction, complexity the requested scope does not justify", models: [] },
+  { name: "plan-dependencies", perspective: "third-party choices, supply-chain risk, versioning, licensing", models: [] },
+  { name: "plan-observability", perspective: "logging, metrics, tracing, debuggability, actionable failure signals", models: [] },
+  { name: "plan-structure", perspective: "project structure: directory/file layout, build setup, adherence to existing repo conventions", models: [] },
+  { name: "plan-feasibility", perspective: "can this be built and maintained as described, in reasonable increments, with the effort the request warrants", models: [] }
+];
+var CODE_TEAM = [
+  { name: "code-plan-conformance", perspective: "does the code implement what the task required \u2014 nothing missing, and no extra scope beyond the task", models: [] },
+  { name: "code-correctness", perspective: "logical correctness, edge cases, off-by-one and boundary conditions, invariants", models: [] },
+  { name: "code-security", perspective: "injection, secret leakage, missing authorization checks, unsafe APIs, unvalidated input", models: [] },
+  { name: "code-error-handling", perspective: "swallowed errors, propagation, cleanup on failure, partial-failure behavior", models: [] },
+  { name: "code-concurrency", perspective: "race conditions, deadlocks, atomicity, shared mutable state", models: [] },
+  { name: "code-tests", perspective: "is the new behavior covered, and do the tests actually assert something meaningful (no vacuous tests)", models: [] },
+  { name: "code-data-integrity", perspective: "persistence correctness, transactions, validation at boundaries, migration safety", models: [] },
+  { name: "code-performance", perspective: "hot paths, unnecessary allocation/work, N+1 patterns, obvious inefficiency", models: [] },
+  { name: "code-maintainability", perspective: "naming, structure, complexity, readability, future tech-debt", models: [] },
+  { name: "code-simplicity", perspective: "dead code, duplication, unnecessary abstraction, complexity the task does not justify", models: [] },
+  { name: "code-api-surface", perspective: "public interface shape, backward compatibility, accidental API exposure", models: [] },
+  { name: "code-accessibility", perspective: "accessibility of UI code: keyboard operation, ARIA/semantics, contrast, i18n readiness", models: [] },
+  { name: "code-observability", perspective: "logging/metrics where a failure would otherwise be undiagnosable", models: [] },
+  { name: "code-dependencies", perspective: "newly introduced dependencies: justified, correctly versioned, no supply-chain or licensing problem", models: [] },
+  { name: "code-conventions", perspective: "consistency with the surrounding codebase's idioms, patterns, and style", models: [] }
+];
+var DEFAULT_COUNCIL = [
+  { name: "correctness-judge", perspective: "Is the work under review correct, coherent and internally consistent? Weigh the team's correctness/logic/data findings.", models: [] },
+  { name: "risk-judge", perspective: "What is the real blast radius of shipping this as-is? Weigh security, failure modes, concurrency, and data-integrity findings against likelihood and severity.", models: [] },
+  { name: "completeness-judge", perspective: "Is what was asked for fully and unambiguously covered? Weigh the team's completeness, gap, and contract findings.", models: [] },
+  { name: "user-value-judge", perspective: "Does this deliver the user's actual intent well? Weigh usability, accessibility, and whether the scope serves the request without gold-plating.", models: [] },
+  { name: "feasibility-judge", perspective: "Can this be built and maintained as described? Weigh architecture, simplicity, dependencies, and maintainability findings against effort.", models: [] }
+];
+function placedSkills() {
+  return [...new Set(Object.values(DEFAULT_ROLE_SKILLS).flat())];
+}
+
+// src/providers/anthropic.ts
+function isAnthropicModel(model) {
+  return /(^|\/)(claude|fable|mythos)/i.test(model) || /claude/i.test(model);
+}
+
+// src/tui/role-models.ts
+var WEAK_RE = /\b(flash|mini|nano|haiku|lite|small|turbo|fast|\d{1,2}b)\b/i;
+var FLAGSHIP_ROLES = ["judge", "principal-coder"];
+var COUNCIL_ROLES = DEFAULT_COUNCIL.map((c) => c.name);
+var SPEC_LENS_ROLES = SPEC_TEAM.map((c) => c.name);
+var PLAN_LENS_ROLES = PLAN_TEAM.map((c) => c.name);
+var CODE_LENS_ROLES = CODE_TEAM.map((c) => c.name);
+var STRONG_ROLES = [
+  "brainstormer",
+  "analyst",
+  "planner",
+  "architect",
+  "senior-coder",
+  "senior-designer",
+  ...COUNCIL_ROLES,
+  ...PLAN_LENS_ROLES,
+  ...CODE_LENS_ROLES
+];
+var MID_ROLES = ["coach", "coder", "designer", "code-reviewer", "operational", "memory-keeper", "task-auditor", ...SPEC_LENS_ROLES];
+var FAST_ROLES = ["refiner", "router", "project-manager", "team-lead"];
+var CAPABLE_ROLES = /* @__PURE__ */ new Set([...FLAGSHIP_ROLES, ...STRONG_ROLES, ...MID_ROLES]);
+var ROLE_PROFILES = {
+  tracer: "Writes the per-file reference note every other agent reads before changing unfamiliar code \u2014 high volume, but its output is a COMMITTED FILE, not a turn in a conversation: a shallow note is believed by every agent that opens that file, forever, and nothing later corrects it. Give it the MOST capable non-[flagship] model in the catalogue, not merely one that qualifies as [strong]. Volume is not a reason to go cheaper here.",
+  refiner: "Classifies intent and rewrites the prompt every turn \u2014 highest call volume, trivial task \u2192 a fast, cheap model.",
+  router: "Picks coder-vs-designer for a task \u2014 tiny and frequent \u2192 fast, cheap.",
+  "project-manager": "Turns a task list into board items \u2014 light and structured \u2192 fast, cheap.",
+  "task-auditor": "The only check on the task breakdown before hours of implementation are spent executing it \u2014 reads the plan against the task list and finds what was dropped. Low volume, and everything downstream depends on it \u2192 a capable model, never the cheapest.",
+  "team-lead": "Coordinates implementation waves \u2014 light orchestration \u2192 fast, cheap.",
+  coach: "Your main interactive assistant, used constantly all session (highest interaction volume) \u2192 a capable but EFFICIENT model, never the costly flagship.",
+  brainstormer: "Turns a raw request into a decided design before the spec: explores the repo, weighs 2-3 approaches, gets the user to choose. Low volume, sets the direction for everything downstream \u2192 a strong reasoning model.",
+  analyst: "Authors the spec and constitution \u2192 a strong reasoning model (Opus-tier).",
+  planner: "Designs the implementation plan \u2192 a strong reasoning model (Opus-tier).",
+  architect: "Diagnoses stuck tasks and produces recovery plans \u2014 serious design work \u2192 a strong model.",
+  judge: "Critiques specs/plans and makes the final review call \u2014 low volume, high stakes \u2192 the most capable flagship model.",
+  coder: "Writes the bulk of the implementation \u2014 very high work volume \u2192 a good high-throughput coding model (Sonnet-tier), NOT the flagship (wasteful at this volume).",
+  "senior-coder": "Reviews and revises above the coder \u2014 must be MORE capable than the coder (Opus-tier).",
+  "principal-coder": "Final code decision-maker \u2014 low volume, high stakes \u2192 the flagship is appropriate.",
+  designer: "Builds UI \u2014 high volume \u2192 a capable coding/design model, not the flagship.",
+  "senior-designer": "Senior UI reviewer \u2014 more capable than the designer.",
+  "code-reviewer": "Reviews diffs \u2014 moderate volume \u2192 a solid capable model.",
+  "memory-keeper": "Decides what a finished job taught the project and writes it to durable memory \u2014 low volume, but a bad memory poisons every later run \u2192 a capable, efficient model, never the cheapest.",
+  operational: "Handles version control: writes conventional commit messages and (later) drives merges/conflicts \u2014 high volume \u2192 a capable, efficient model."
+};
+for (const [stage, lenses, heft] of [
+  ["spec", SPEC_TEAM, "a capable, efficient model (a spec is a short business-level doc)"],
+  ["plan", PLAN_TEAM, "a strong model (technical design judgment)"],
+  ["code", CODE_TEAM, "a strong model (reads real implementations)"]
+]) {
+  for (const l of lenses) ROLE_PROFILES[l.name] = `${stage.toUpperCase()}-review lens \u2014 ${l.perspective}. Low volume, quality-critical \u2192 ${heft}.`;
+}
+for (const c of DEFAULT_COUNCIL) {
+  ROLE_PROFILES[c.name] = `Review COUNCIL decider \u2014 ${c.perspective} Casts the binding pass/revise vote on contested work \u2192 a strong model.`;
+}
+var ROLE_ADVICE = ROLE_PROFILES;
+function filterModelsForRole(role, all, exclude = []) {
+  const advice = ROLE_ADVICE[role];
+  const excluded2 = new Set(exclude);
+  const avail = all.filter((m) => !excluded2.has(m));
+  if (CAPABLE_ROLES.has(role)) {
+    const strong = avail.filter((m) => !WEAK_RE.test(m));
+    if (strong.length === 0) return { models: avail.length ? avail : all, note: advice ? `${advice} (No strong models detected \u2014 showing all.)` : void 0 };
+    return { models: strong, note: `${advice ?? ""} Showing ${strong.length} of ${avail.length} models (fast/weak models hidden for this role).`.trim() };
+  }
+  if (FAST_ROLES.includes(role)) {
+    const fast = avail.filter((m) => WEAK_RE.test(m));
+    if (fast.length === 0) return { models: avail.length ? avail : all, note: advice };
+    return { models: fast, note: `${advice ?? ""} Showing ${fast.length} of ${avail.length} fast/cheap models.`.trim() };
+  }
+  return { models: avail.length ? avail : all };
+}
+function effortFor(role, model) {
+  if (!isAnthropicModel(model)) return void 0;
+  if (FLAGSHIP_ROLES.includes(role)) return "max";
+  if (STRONG_ROLES.includes(role)) return "xhigh";
+  if (FAST_ROLES.includes(role)) return "low";
+  if (MID_ROLES.includes(role)) return "high";
+  return void 0;
+}
+var effortBump = (s) => /-(ultra|max|xhigh)/.test(s) ? 4 : /-high/.test(s) ? 3 : /-medium/.test(s) ? 2 : /-low/.test(s) ? 1 : 0;
+var versionBump = (s, family) => {
+  if (family) {
+    const m = s.match(new RegExp(`${family}[-_. ]?(\\d+)(?:[-.](\\d+))?`));
+    if (m) {
+      const major = Number(m[1]);
+      const minor = m[2] === void 0 ? 0 : Number(m[2]);
+      if (major < 100) return major + (minor < 10 ? minor / 10 : minor / 100);
+    }
+  }
+  const g = s.match(/(\d)[-.](\d)\b/);
+  return g ? Number(g[1]) + Number(g[2]) / 10 : 0;
+};
+var KNOWN_FAMILY_RE = /(fable|mythos|opus|sonnet|haiku|claude|codex|gpt-|\bo\d\b|gemini|deepseek|llama|qwen|kimi|glm|mistral|grok|nova|command-r|phi-\d)/i;
+var NON_TEXT_RE = /\b(image|imagen|vision|video|veo|tts|audio|speech|voice|embed|embedding|rerank|ocr|computer-use|realtime|moderation)\b/i;
+function isKnownModel(model) {
+  return KNOWN_FAMILY_RE.test(model) && !NON_TEXT_RE.test(model);
+}
+var UNRANKED_SCORE = 50;
+function capabilityScore(model) {
+  const s = model.toLowerCase();
+  if (WEAK_RE.test(s)) return 20 + effortBump(s);
+  if (/fable|mythos/.test(s)) return 100;
+  if (/opus/.test(s)) return 88 + versionBump(s, "opus");
+  if (/codex|gpt-5|\bo3\b/.test(s)) return 82 + effortBump(s) + versionBump(s, "gpt") / 100;
+  if (/sonnet/.test(s)) return 78 + versionBump(s, "sonnet");
+  if (/gemini/.test(s) && /pro/.test(s)) return 76 + versionBump(s, "gemini") + effortBump(s);
+  if (/gpt-4/.test(s)) return 65;
+  if (/deepseek/.test(s)) return 55;
+  return UNRANKED_SCORE;
+}
+function mostCapable(models) {
+  return [...models].sort((a, b) => capabilityScore(b) - capabilityScore(a))[0] ?? "";
+}
+function modelBand(model) {
+  if (WEAK_RE.test(model)) return "fast";
+  const s = capabilityScore(model);
+  if (s >= 95) return "flagship";
+  if (s >= 84) return "strong";
+  if (s <= UNRANKED_SCORE) return "fast";
+  return "mid";
+}
+function baseModel(model) {
+  const segs = model.toLowerCase().split("/");
+  let s = segs[segs.length - 1];
+  s = s.replace(/-(ultra|max|xhigh|high|medium|low|free|thinking|preview)\b/g, "");
+  s = s.replace(/-\d{6,8}\b/g, "");
+  return s.replace(/-+$/, "");
+}
+function modelFamily(model) {
+  return baseModel(model).replace(/[-.]v?\d+(?:[-.]\d+)*(?=[-.]|$)/g, "").replace(/[-.]{2,}/g, "-").replace(/^[-.]+|[-.]+$/g, "");
+}
+function latestFirst(models) {
+  const best = /* @__PURE__ */ new Map();
+  for (const m of models) {
+    const key2 = modelFamily(m);
+    const cur = best.get(key2);
+    if (!cur || capabilityScore(m) > capabilityScore(cur)) best.set(key2, m);
+  }
+  const isLatest = (m) => best.get(modelFamily(m)) === m;
+  return [...models.filter(isLatest), ...models.filter((m) => !isLatest(m))];
+}
+function versionlessId(model) {
+  const cut = model.lastIndexOf("/");
+  const prefix = cut >= 0 ? model.slice(0, cut + 1) : "";
+  const name = model.slice(cut + 1).toLowerCase().replace(/-\d{6,8}\b/g, "").replace(/[-.]v?\d+(?:[-.]\d+)*(?=[-.]|$)/g, "").replace(/[-.]{2,}/g, "-").replace(/^[-.]+|[-.]+$/g, "");
+  return prefix + name;
+}
+var DURABLE_ROLES = ["tracer"];
+function strongestPrimary(chain, pool) {
+  const head = chain[0];
+  if (!head) return chain;
+  let best = head;
+  for (const m of pool) {
+    if (modelBand(m) === "flagship" || !isKnownModel(m)) continue;
+    if (capabilityScore(m) > capabilityScore(best)) best = m;
+  }
+  if (best === head) return chain;
+  const at = chain.indexOf(best);
+  if (at > 0) {
+    const next = [...chain];
+    next[at] = head;
+    next[0] = best;
+    return next;
+  }
+  return [best, ...chain.slice(1)];
+}
+function newestPrimary(chain, pool) {
+  const head = chain[0];
+  if (!head) return chain;
+  const key2 = versionlessId(head);
+  let best = head;
+  for (const m of pool) {
+    if (versionlessId(m) !== key2) continue;
+    if (capabilityScore(m) > capabilityScore(best)) best = m;
+  }
+  if (best === head) return chain;
+  const at = chain.indexOf(best);
+  if (at > 0) {
+    const next = [...chain];
+    next[at] = head;
+    next[0] = best;
+    return next;
+  }
+  return [best, ...chain.slice(1)];
+}
+function dedupBest(models) {
+  const best = /* @__PURE__ */ new Map();
+  for (const m of models) {
+    const key2 = baseModel(m);
+    const cur = best.get(key2);
+    if (!cur || capabilityScore(m) > capabilityScore(cur)) best.set(key2, m);
+  }
+  return [...best.values()].sort((a, b) => capabilityScore(b) - capabilityScore(a));
+}
+function sourceOf(model) {
+  const s = model.toLowerCase().replace(/^no-think\//, "");
+  return cliFor(s) ?? s.split("/")[0];
+}
+function interleaveBySource(pool) {
+  const bySource = /* @__PURE__ */ new Map();
+  for (const m of pool) {
+    const s = sourceOf(m);
+    const q = bySource.get(s);
+    if (q) q.push(m);
+    else bySource.set(s, [m]);
+  }
+  const queues = [...bySource.values()];
+  const out = [];
+  for (let more = true; more; ) {
+    more = false;
+    for (const q of queues) {
+      const m = q.shift();
+      if (m !== void 0) {
+        out.push(m);
+        more = true;
+      }
+    }
+  }
+  return out;
+}
+var BAND_ORDER = { fast: 0, mid: 1, strong: 2, flagship: 3 };
+function bandDistance(primary, candidate) {
+  const p = BAND_ORDER[modelBand(primary)];
+  const c = BAND_ORDER[modelBand(candidate)];
+  return Math.abs(c - p) * 2 + (c < p ? 1 : 0);
+}
+function pickFallbacks(primary, pool, n) {
+  const chosen = [];
+  const usedModels = /* @__PURE__ */ new Set([baseModel(primary)]);
+  const usedSources = /* @__PURE__ */ new Set([sourceOf(primary)]);
+  const byHeft = pool.map((m, i) => ({ m, i })).sort((a, b) => bandDistance(primary, a.m) - bandDistance(primary, b.m) || a.i - b.i).map((x) => x.m);
+  for (const m of byHeft) {
+    if (chosen.length >= n) break;
+    if (usedModels.has(baseModel(m)) || usedSources.has(sourceOf(m))) continue;
+    chosen.push(m);
+    usedModels.add(baseModel(m));
+    usedSources.add(sourceOf(m));
+  }
+  for (const m of byHeft) {
+    if (chosen.length >= n) break;
+    if (usedModels.has(baseModel(m))) continue;
+    chosen.push(m);
+    usedModels.add(baseModel(m));
+  }
+  return chosen;
+}
+var FALLBACK_COUNT = 2;
+function adjustRoleModels(roles, models, unfit) {
+  if (models.length === 0) return [];
+  const recognised = models.filter(isKnownModel);
+  const pick = recognised.length ? recognised : models;
+  const capable = dedupBest(pick.filter((m) => !WEAK_RE.test(m)));
+  const fast = dedupBest(pick.filter((m) => WEAK_RE.test(m)));
+  const capablePool = capable.length ? capable : fast;
+  const fastPool = fast.length ? fast : capable;
+  const primaryPool = latestFirst(capablePool);
+  const primaryFast = latestFirst(fastPool);
+  const nonFlagship = primaryPool.filter((m) => modelBand(m) !== "flagship");
+  const strongPool = primaryPool.filter((m) => modelBand(m) === "strong");
+  const midPool = primaryPool.filter((m) => modelBand(m) === "mid");
+  const wanted = new Set(roles);
+  const forRole = (role, pool) => {
+    if (!unfit) return pool;
+    const fit = pool.filter((m) => !unfit(role, m));
+    return fit.length ? fit : pool;
+  };
+  const known = /* @__PURE__ */ new Set([...FLAGSHIP_ROLES, ...STRONG_ROLES, ...MID_ROLES, ...FAST_ROLES]);
+  const primary = /* @__PURE__ */ new Map();
+  const flagSrc = primaryPool;
+  FLAGSHIP_ROLES.filter((r) => wanted.has(r)).forEach((r, i) => {
+    const src = forRole(r, flagSrc);
+    primary.set(r, src[i % src.length]);
+  });
+  const strongSrc = interleaveBySource(strongPool.length ? strongPool : nonFlagship.length ? nonFlagship : primaryPool);
+  STRONG_ROLES.filter((r) => wanted.has(r)).concat(roles.filter((r) => !known.has(r))).forEach((r, i) => {
+    const src = forRole(r, strongSrc);
+    primary.set(r, src[i % src.length]);
+  });
+  const midSrc = interleaveBySource(midPool.length ? midPool : nonFlagship.length ? nonFlagship : primaryPool);
+  MID_ROLES.filter((r) => wanted.has(r)).forEach((r, i) => {
+    const src = forRole(r, midSrc);
+    primary.set(r, src[i % src.length]);
+  });
+  FAST_ROLES.filter((r) => wanted.has(r)).forEach((r, i) => {
+    const src = forRole(r, primaryFast);
+    primary.set(r, src[i % src.length]);
+  });
+  return roles.map((role) => {
+    const head = primary.get(role) ?? primaryPool[0];
+    const capForFb = MID_ROLES.includes(role) ? capablePool.filter((m) => modelBand(m) !== "flagship") : capablePool;
+    const pool = FAST_ROLES.includes(role) ? [...fastPool, ...capForFb] : [...capForFb, ...fastPool];
+    return { role, models: newestPrimary([head, ...pickFallbacks(head, forRole(role, pool), FALLBACK_COUNT)], models) };
+  });
+}
+
+// src/skills/apply.ts
+import { readFile } from "fs/promises";
+import { readdirSync as readdirSync2 } from "fs";
+import { resolve as resolve2, sep as sep3 } from "path";
+import { z } from "zod";
+function applySkills(basePrompt, mandatory, registry) {
+  const parts = [basePrompt];
+  if (mandatory.length) {
+    const sections = mandatory.map((name) => {
+      const skill = registry.get(name);
+      if (!skill) throw new Error(`applySkills: undefined skill: ${name}`);
+      const where = skill.dir ? `
+_Skill base directory: ${skill.dir}_
+` : "";
+      return `## ${skill.name}${where}
+${skill.content}`;
+    });
+    parts.push(`# Mandatory Skills
+${sections.join("\n\n")}`);
+  }
+  const mandatorySet = new Set(mandatory);
+  const available = registry.list().filter((s) => !mandatorySet.has(s.name));
+  if (available.length) {
+    const lines = available.map((s) => `- ${s.name}: ${s.description}`);
+    parts.push(`# Discoverable Skills (call the skill tool to fetch its content)
+${lines.join("\n")}`);
+  }
+  return parts.join("\n\n");
+}
+var skillParams = z.object({
+  name: z.string().describe("The skill's name, exactly as it is listed."),
+  /**
+   * A supporting document inside the skill's own directory, e.g. "reference/critique.md".
+   *
+   * Described, because an undescribed optional string gets filled in. Measured: four consecutive calls sent
+   * `file: ""` and every one of them failed — the skill was there, its content was one branch away, and an
+   * empty string took the other branch.
+   */
+  file: z.string().optional().describe('Optional. A supporting document inside the skill, e.g. "reference/critique.md". Omit it to read the skill itself \u2014 do not pass an empty string.')
+});
+var DOCS_SHOWN = 12;
+function docsIn(dir) {
+  try {
+    return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.name !== "SKILL.md" && !e.name.startsWith(".")).map((e) => e.isDirectory() ? `${e.name}/` : e.name).sort().slice(0, DOCS_SHOWN);
+  } catch {
+    return [];
+  }
+}
+var MAX_SKILL_DOC_CHARS = 3e4;
+var MAX_SKILLS_LISTED = 12;
+function noSuchSkill(name, available) {
+  const shape = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+  const same = available.filter((s) => shape(s) === shape(name));
+  if (same.length === 1) {
+    return `skill not found: ${name} \u2014 did you mean \`${same[0]}\`? Call it with that exact name.`;
+  }
+  if (!available.length) return `skill not found: ${name}. This project has no skills installed, so carry on without one.`;
+  const near = available.filter((s) => shape(s).includes(shape(name)) || shape(name).includes(shape(s)));
+  if (near.length && near.length <= MAX_SKILLS_LISTED) {
+    return `skill not found: ${name}. Closest by name: ${near.map((s) => `\`${s}\``).join(", ")}. Call one of those exactly if it is what you meant, or carry on without a skill.`;
+  }
+  const shown = available.slice(0, MAX_SKILLS_LISTED);
+  const rest = available.length - shown.length;
+  return `skill not found: ${name}. Available: ${shown.join(", ")}${rest > 0 ? `, and ${rest} more \u2014 the full list is in your system prompt` : ""}. Use one of these exactly, or carry on without a skill \u2014 do not guess another name.`;
 }
 function buildSkillTool(registry) {
   return {
@@ -826,6 +1706,14 @@ var READ_ONLY = /* @__PURE__ */ new Set([
   "show-ref",
   "for-each-ref",
   "ls-remote",
+  /**
+   * `git grep` searches tracked content and has no writing form at all — the same standing as `log`.
+   *
+   * Left out, it was refused twice in one 36-minute run while agents fell back to `find | xargs grep`
+   * through the shell, which is slower on a repository this size and searches build output and
+   * `node_modules` unless every caller remembers to prune them. git already knows what is tracked.
+   */
+  "grep",
   /**
    * `check-ignore` asks whether a path is ignored — it reads `.gitignore` and answers, and changes nothing.
    *
@@ -837,18 +1725,34 @@ var READ_ONLY = /* @__PURE__ */ new Set([
 ]);
 var READ_ONLY_PAIRS = /* @__PURE__ */ new Set([
   "worktree list",
-  "branch --list",
-  "branch -l",
-  "branch -a",
-  "branch -v",
-  "branch -r",
   "tag --list",
   "tag -l",
   "stash list",
   "remote -v",
   "remote show",
   "config --get",
-  "config --list"
+  "config --list",
+  /**
+   * The long forms of what is already allowed, and the queries that only ask.
+   *
+   * `branch -a` was allowed and `branch --all` was not — the same command spelled the way git's own
+   * documentation spells it. Measured in one run: an agent asked for `branch --all` and then `branch
+   * --show-current`, and paid a refused turn for each while `-a` sat in this list. A short flag admitted and
+   * its long twin refused is not a security boundary, it is a typo in one.
+   *
+   * These are the closure of what this set already permits, not new ground: every one of them prints
+   * information about branches or tags and none of them can create, move or delete a ref. The forms that
+   * write — `-d`, `-D`, `-m`, `-M`, `-c`, `-C`, `--delete`, `--move`, `--copy`, `--set-upstream-to`,
+   * `--edit-description` — are still absent, and a first argument that is not a flag never reaches here.
+   */
+  "tag --contains",
+  "tag --no-contains",
+  "tag --merged",
+  "tag --points-at",
+  "tag -n",
+  "remote --verbose",
+  "remote get-url",
+  "stash show"
 ]);
 var REFUSED_ARG = /^(--output|-c$|--config-env|--exec-path|-C$|--git-dir|--work-tree|--upload-pack|--receive-pack)/;
 var params = z2.object({
@@ -859,21 +1763,130 @@ var params = z2.object({
 var MAX_GIT_OUTPUT = 6e4;
 var GIT_TIMEOUT_MS = 3e4;
 var GIT_PUSH_TIMEOUT_MS = 12e4;
-var ANSWERS_WITH_ONE = /* @__PURE__ */ new Set(["diff", "diff-index", "diff-tree", "diff-files", "merge-base", "check-ignore"]);
+var ANSWERS_WITH_ONE = /* @__PURE__ */ new Set([
+  "diff",
+  "diff-index",
+  "diff-tree",
+  "diff-files",
+  "merge-base",
+  "check-ignore",
+  /**
+   * `grep` says "no match" with exit 1, exactly as the others say their own no.
+   *
+   * Admitted to the read-only set earlier tonight and left out of this one, so a search that found nothing
+   * came back as `git failed with no output.` — a fault where there was an answer. Measured live within
+   * minutes: `git grep -n -i ExportReportService.cs` twice, both reported as failures, for a file that
+   * simply is not in the repository.
+   */
+  "grep"
+]);
 function answeredWithOne(args, code) {
   return code === 1 && ANSWERS_WITH_ONE.has(args[0] ?? "");
 }
+function howToNarrow(args) {
+  const verb = gitVerb(args) ?? "";
+  if (verb === "diff" || verb === "show") {
+    return "narrow the range, or put `--stat` directly after the subcommand (git " + verb + " --stat <rest>), which git requires";
+  }
+  if (verb === "log") return "ask for fewer commits (-n 20) or just their subjects (--oneline)";
+  if (verb === "ls-files" || verb === "ls-tree") return "narrow the pathspec to one directory at a time";
+  if (verb === "blame") return "limit it to a range of lines (-L 40,120)";
+  return "ask for a narrower part of it";
+}
 function answerOfOne(args) {
   const verb = args[0] ?? "";
   if (verb === "check-ignore") {
     return "No \u2014 that path is not ignored by this repository's rules. (git exit code 1, which is the answer here.)";
   }
+  if (verb === "grep") {
+    return "No match \u2014 nothing in the tracked files matches that pattern. (git exit code 1, which is the answer here.)";
+  }
   if (verb === "merge-base") {
     return args.includes("--is-ancestor") ? "No \u2014 the first commit is not an ancestor of the second. (git exit code 1, which is the answer here.)" : "No merge base: these commits share no common ancestor. (git exit code 1, which is the answer here.)";
   }
   return "There ARE differences \u2014 the comparison is not empty. Nothing failed; `--quiet`/`--exit-code` reports this as exit code 1. Re-run without it to see them.";
 }
+function packedArgument(a) {
+  if (!/\s/.test(a)) return void 0;
+  if (/^--?[\w-]+[=:]/.test(a)) return void 0;
+  const parts = a.trim().split(/\s+/).filter(Boolean);
+  if (parts.length < 2) return void 0;
+  if (parts[0] === "--") return parts;
+  return parts.slice(1).some((p) => p === "--" || p.startsWith("-") || p.includes("/")) ? parts : void 0;
+}
+var GLUED_PATHSPEC = /^--[^\s=]*\/[^\s=]*$/;
+var BRANCH_TAKES_VALUE = /* @__PURE__ */ new Set([
+  "--contains",
+  "--no-contains",
+  "--merged",
+  "--no-merged",
+  "--points-at",
+  "--format",
+  "--sort",
+  "--color",
+  "--abbrev",
+  "-u",
+  "--set-upstream-to",
+  "-t",
+  "--track"
+]);
+var BRANCH_WRITERS = /* @__PURE__ */ new Set([
+  "-d",
+  "-D",
+  "--delete",
+  "-m",
+  "-M",
+  "--move",
+  "-c",
+  "-C",
+  "--copy",
+  "--edit-description",
+  "--set-upstream",
+  "--set-upstream-to",
+  "--unset-upstream",
+  "-u",
+  "-t",
+  "--track",
+  "--no-track",
+  "-f",
+  "--force"
+]);
+function branchWrites(rest) {
+  const listing = rest.some((a) => a === "--list" || a === "-l");
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === void 0) continue;
+    if (a === "--") return "`git branch` with a pathspec is not a thing this tool needs to run.";
+    if (a.startsWith("--")) {
+      const name = a.split("=")[0];
+      if (BRANCH_WRITERS.has(name)) return `\`git branch ${name}\` changes a branch. Only listing is allowed.`;
+      if (BRANCH_TAKES_VALUE.has(name) && !a.includes("=")) i++;
+      continue;
+    }
+    if (a.startsWith("-")) {
+      const bad = [...a.slice(1)].find((c) => BRANCH_WRITERS.has(`-${c}`));
+      if (bad) return `\`git branch -${bad}\` changes a branch. Only listing is allowed.`;
+      if (BRANCH_TAKES_VALUE.has(a)) i++;
+      continue;
+    }
+    if (listing) continue;
+    if (/[*?\[]/.test(a)) {
+      return `\`git branch ${a}\` would create a branch with that literal name. To search for branches, put the pattern after --list: \`git branch --list ${a}\`.`;
+    }
+    return `\`git branch ${a}\` creates a branch. Only listing is allowed \u2014 git_write owns the rest.`;
+  }
+  return void 0;
+}
 function refuse(args) {
+  const packed = args.find((a) => packedArgument(a) !== void 0 || GLUED_PATHSPEC.test(a));
+  if (packed !== void 0) {
+    const split = packedArgument(packed) ?? ["--", packed.slice(2)];
+    if (split[0] !== "--") {
+      return `each item in the list is ONE argument \u2014 this one holds several: ${JSON.stringify([packed]).slice(0, 90)}. Send ${JSON.stringify(split).slice(0, 130)} instead.`;
+    }
+    const parts = split.slice(1);
+    return `\`--\` is the separator and must be its own element of the list \u2014 it is never part of a path. You sent ${JSON.stringify([packed]).slice(0, 90)}; send ${JSON.stringify(["--", ...parts]).slice(0, 130)} instead (however many paths follow, they are separate elements too).`;
+  }
   const bad = args.find((a) => REFUSED_ARG.test(a));
   if (bad) {
     return `\`${bad}\` is not allowed: it can write a file, run a program through git's configuration, or point git at another repository.`;
@@ -881,6 +1894,16 @@ function refuse(args) {
   const [sub, second] = args;
   if (!sub || sub.startsWith("-")) return "The first argument must be a git subcommand, e.g. `status`.";
   if (READ_ONLY.has(sub)) return void 0;
+  if (sub === "branch") return branchWrites(args.slice(1));
+  if (sub === "reflog") {
+    return second === "expire" || second === "delete" ? `\`git reflog ${second}\` rewrites the reflog. Only reading it is allowed.` : void 0;
+  }
+  if (sub === "config") {
+    if (second !== void 0 && !second.startsWith("-") && args.length === 2) return void 0;
+    if (args.length > 2 && !args.some((a) => a.startsWith("--get") || a === "--list")) {
+      return "`git config <key> <value>` writes configuration. Read one with `git config <key>`.";
+    }
+  }
   if (second && READ_ONLY_PAIRS.has(`${sub} ${second}`)) return void 0;
   return `\`git ${sub}\` is not available here \u2014 this tool reads history and state, it never changes them. Available: ${[...READ_ONLY].sort().join(", ")}; also ${[...READ_ONLY_PAIRS].sort().join(", ")}.`;
 }
@@ -922,7 +1945,7 @@ var gitTool = {
       return { content: out.code === 0 ? "(no output)" : "git failed with no output.", isError: failed };
     }
     const clipped = out.text.length > MAX_GIT_OUTPUT ? `${truncateSafe(out.text, MAX_GIT_OUTPUT)}
-\u2026[truncated \u2014 narrow the range, or put \`--stat\` directly after the subcommand (git diff --stat <rest>), which git requires]` : out.text;
+\u2026[truncated \u2014 ${howToNarrow(args)}]` : out.text;
     return { content: clipped, isError: failed };
   }
 };
@@ -970,184 +1993,57 @@ var gitWriteTool = {
     if (!parsed.success) {
       return { content: `git_write: invalid args: ${parsed.error.issues.map((i) => i.message).join("; ")}`, isError: true };
     }
-    const args = parsed.data.args;
-    const why = refuseWrite(args);
-    if (why) return { content: why, isError: true, settled: true };
-    const out = await new Promise((resolve6) => {
-      const child = execFile("git", args, {
-        cwd: ctx.cwd,
-        // A push talks to a server: the read tool's 30s is a reasonable ceiling for a local query and a
-        // pessimistic one for a repository with anything in it.
-        timeout: args[0] === "push" ? GIT_PUSH_TIMEOUT_MS : GIT_TIMEOUT_MS,
-        maxBuffer: MAX_GIT_OUTPUT * 4,
-        // GIT_TERMINAL_PROMPT=0: a push that needs credentials fails with a message instead of blocking on a
-        // prompt no one can see — the TUI owns the terminal, so the agent would simply hang.
-        env: { ...process.env, GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0" }
-      }, (err, stdout, stderr) => {
-        resolve6({ code: err ? 1 : 0, text: `${stdout}${stderr}`.trim() });
-      });
-      ctx.signal?.addEventListener("abort", () => child.kill("SIGKILL"), { once: true });
-    });
-    if (!out.text) return { content: out.code === 0 ? "(done)" : "git failed with no output.", isError: out.code !== 0 };
-    const clipped = out.text.length > MAX_GIT_OUTPUT ? `${truncateSafe(out.text, MAX_GIT_OUTPUT)}
-\u2026[truncated]` : out.text;
-    return { content: clipped, isError: out.code !== 0 };
-  }
-};
-
-// src/tools/remember.ts
-import { z as z3 } from "zod";
-var params2 = z3.object({
-  fact: z3.string().describe(
-    "One short sentence, durable and project-specific: where something lives, which command builds it, a convention this codebase follows, a schema detail that cost you a search. Not what you did, not what is true of the language in general \u2014 something the next agent would otherwise have to rediscover."
-  )
-});
-function buildRememberTool(sink) {
-  return {
-    name: "remember_fact",
-    description: "Save a short, durable fact worth recalling in future sessions \u2014 a project convention, where something lives, a schema detail, a command that works. It is written straight away, so a session that stops early still leaves it behind. Use it the moment you learn something you would not want to work out twice; skip anything transient or specific to the task in hand.",
-    permissionLevel: "safe",
-    parameters: params2,
-    async run(rawArgs, ctx) {
-      const parsed = params2.safeParse(rawArgs);
-      if (!parsed.success) return { content: "remember_fact: invalid args (expected { fact })", isError: true };
-      const fact = parsed.data.fact.trim();
-      if (!fact) return { content: "remember_fact: empty fact", isError: true };
-      const write = sink ?? ctx.remember;
-      if (!write) return { content: "remember_fact: memory is not available in this context", isError: true };
-      write(fact);
-      return { content: `Remembered: ${fact}`, isError: false };
-    }
-  };
-}
-var rememberFactTool = buildRememberTool();
-
-// src/prompts.ts
-var REQUIRED_ROLES = [
-  "refiner",
-  "coach",
-  "brainstormer",
-  "analyst",
-  "planner",
-  "judge",
-  "project-manager",
-  "team-lead",
-  "router",
-  "coder",
-  "designer",
-  "senior-coder",
-  "senior-designer",
-  "architect",
-  "code-reviewer",
-  "task-auditor",
-  "principal-coder",
-  "operational",
-  "memory-keeper",
-  "tracer",
-  "tester"
-];
-var DEFAULT_ROLE_SKILLS = {
-  brainstormer: ["brainstorming"],
-  // The roles that WRITE code get the test discipline inlined, rather than having the code-tests lens reject
-  // vacuous tests after the fact. Rejecting is more expensive than getting it right the first time.
-  coder: ["test-driven-development"],
-  "senior-coder": ["test-driven-development"],
-  // The task list is where a plan becomes something an implementer can actually execute. spec-kit's template
-  // supplies the SHAPE (phases, story grouping, [P] markers); it says almost nothing about what makes an
-  // individual task executable. That is what this skill adds.
-  "project-manager": ["writing-plans"],
-  // The UI roles get design direction inlined for the same reason the coders get TDD: the code-accessibility
-  // and code-maintainability lenses can reject a templated, default-looking interface, but they cannot teach
-  // one. This skill is self-contained (no sibling reference files), which is what makes it safe to inline.
-  designer: ["frontend-design"],
-  "senior-designer": ["frontend-design"]
-  // NB: systematic-debugging is shipped but attached to NO role — it is only needed when something is stuck,
-  // so it stays in the discoverable listing every role already receives and is fetched with the `skill` tool.
-};
-var DEFAULT_PROMPTS = {
-  tracer: "You write the reference note that every other agent reads before it touches a file it did not write. A wrong note is worse than none: an agent will act on it, so accuracy outranks fluency and admitting you cannot tell outranks a plausible guess. State only what the code and the given relationships show; if the business purpose is not evident from them, describe what the file does technically and say nothing about why. Never speculate about intent, history or requirements.",
-  /**
-   * The role that exercises work already built and writes down what actually happened.
-   *
-   * Every rule below is here because its absence produces the one output worse than no testing at all: a
-   * report that says PASSED about something nobody ran. Such a report is not merely empty — it manufactures
-   * confidence, and the next person spends it.
-   */
-  tester: "You verify software that already exists, by running its scenarios and recording what they actually did. You are not here to build, fix or improve anything: the code under test is finished, and changing it would mean the thing you verified is not the thing that shipped.\n\nEVIDENCE IS THE WHOLE JOB. A scenario's outcome is what you OBSERVED \u2014 a database row, a log line, an HTTP response, a screen the user confirmed. Record the evidence beside every result: the query you ran and what it returned, the log event id and its line, the response body. A result you cannot show is not a result.\n\nIF A STEP WRITES TO THE DATABASE, THE RESPONSE IS NOT THE EVIDENCE. A 201 or a 204 says the request was accepted; it does not say what was stored, and a screen showing the new state does not either \u2014 both can be right while the row is wrong. For every step that creates or changes a record: query the database for that row and put the query AND the rows it returned in the report, and query the logs for the event that step should have emitted and put the query AND the line it returned there too. Absence is evidence as well: when a step must NOT emit an event \u2014 a no-op, a rejected change \u2014 show the query returning nothing. Without both, the scenario is NOT EXECUTED, however convincing the response looked.\n\nNever mark a scenario PASSED that you did not execute and observe. If you could not run it \u2014 the data does not exist, the surface is unreachable, the case is destructive against a live system \u2014 label it NOT EXECUTED and say exactly why. FAILED means you ran it and the behaviour was wrong; say what you expected, what happened, and the evidence for both. Guessing from the source is not executing: where you reasoned from code alone, say so in those words.\n\nWrite each result into the report BEFORE moving on to the next scenario. The report is a living document, not something assembled at the end: a run that stops halfway must leave behind everything it learned up to that point.\n\n\u2026and say each verdict OUT LOUD as you reach it, in one or two sentences: which scenario, what it did, and the single piece of evidence that settled it \u2014 the row, the log line, the status code. The full evidence still goes in the report; this is so the person watching the run knows what you found without opening a file. Say the failures and the NOT EXECUTED ones the same way, and with the same brevity: a result nobody hears is one they have to go looking for.\n\nNever start or stop the development environment \u2014 application hosts, dev servers, containers, databases. Those are the developer's to run. When you need something up, say which command they should run and wait for them to confirm it is ready.\n\nYou do NOT write product code. When you find something wrong that is not the verdict of the scenario you are running \u2014 a missing label, prose rendered as raw markup, a wrong format, or something the developer points out in passing \u2014 call `report_finding`. Another role fixes it and you are told when it is done, so you can re-check what it affected. Do not fix it yourself: changing the product mid-verification means the thing you verified is not the thing that shipped. And do not fail a scenario over it \u2014 a scenario fails when the scenario itself does not pass, not because something else was noticed while running it.\n\nIf the project's own rules (its constitution) say more about how verification is done here, they govern over this description \u2014 read them and follow them.",
-  refiner: "Your #1 rule: `refinedPrompt` MUST ALWAYS be in ENGLISH. If the user wrote in another language (Turkish, German, Spanish, \u2026), TRANSLATE their intent into English \u2014 never echo their language back. This is non-negotiable: a Turkish input like 'bir todo app geli\u015Ftir, \xF6nce backend' MUST come out as English 'Build a todo app; implement the backend first.'\n\nRewrite the user's message down to the raw core intent the AI needs to act on \u2014 clear, direct, and structured. Strip all politeness, emotional, and filler words (please, thanks, kindly, 'could you', 'would you', 'I'd like', etc.) and anything that carries no instruction. Do NOT add words, qualifiers, or scope the user did not state (e.g. do not add 'always'). Keep the user's own perspective and form \u2014 a question stays a question, an instruction stays an instruction; do NOT describe the user in the third person and do NOT answer the request. Example: a polite request like 'would you please answer me in language X?' becomes just 'respond in language X' (drop 'please'; do not add 'always' or any scope the user didn't state). Also classify the intent: 'chat' (conversation/question), 'feature' (new feature/work), 'bugfix' (bug fix), 'govern' (establish or amend the project's OWN standing rules and principles \u2014 writing or revising the constitution, the coding conventions, the project's rules; work whose entire output is a governing document, with no source code changed). Judge by what the request PRODUCES, not by what it mentions: 'write the project constitution from CLAUDE.md' is govern, and so is 'update our commit-message rules'; 'make the code follow the constitution' changes source and is feature. Also 'verify' \u2014 the user wants work that ALREADY EXISTS exercised and its behaviour confirmed with evidence: running a pull request's test scenarios, doing a smoke test of a feature that is already built, producing a test report. Judge by what it PRODUCES: a record of what the software DID is verify; changing what it does is feature or bugfix. 'Run the smoke tests for PR 677 and mark them passed' is verify, and so is 'check that the wizard works end to end'. 'The wizard is broken, fix it' is bugfix. Finally 'undo' \u2014 the user is asking you to REVERSE what the previous turn did, not to do anything new: 'undo that', 'revert your changes', 'go back to the previous version', 'that was wrong, put it back'. Classify by whether the request refers to work already done: undoing is never a rewrite, and asking for a different result ('rewrite it shorter') is not an undo. Also detect the natural language the user wrote in and return its English name as `language` (e.g. 'Turkish', 'English', 'German') \u2014 this is separate from refinedPrompt, which stays English. Also produce `title`: what the work is ABOUT, as a 2-5 word English kebab-case noun phrase suitable for a git branch name \u2014 the SUBJECT, not the action. 'build a luxury todo app' is 'luxury-todo-app'; 'add a login page' is 'login-page'; 'fix the null crash on retry' is 'null-crash-on-retry'. Do not open with a verb (build/add/fix/implement/update): the tool is already doing it, so the verb says nothing and crowds out the words that identify the work. Lowercase, dash-joined, no punctuation. Return the result via submit as {refinedPrompt, intent, language, title}. Remember: refinedPrompt in English, always.",
-  brainstormer: "You run the BRAINSTORM stage: you turn a raw request into a decided design, before anything is specified.\n\nThe `brainstorming` skill above is the authority on HOW to do this \u2014 follow it. What follows is only how it binds to this pipeline, because the skill names conventions from a different habitat:\n\n- OUTPUT: write the design brief to the file named in your message (specs/NNN-slug/brainstorm.md). Ignore the skill's `docs/superpowers/specs/\u2026` path.\n- NEXT STAGE: the SPEC is written from your brief, by another agent, immediately after you. There is no `writing-plans` skill to invoke here \u2014 finishing the brief IS the terminal step.\n- QUESTIONS: ask through the `ask_user` tool. For a choice between approaches use its rich option form ({label, description, preview}) so the trade-offs sit beside the list; lead with your recommendation. The user may attach a note to their answer \u2014 treat it as binding.\n- NOT AVAILABLE: the visual companion (there is no browser) and the per-checklist task list. Skip both.\n\nWrite what was DECIDED, not a transcript: the chosen approach, why it beat the others, the rejected alternatives with their reason, the constraints the spec must honour, and what is out of scope. Keep it short \u2014 it is the brief the spec is written from, not the spec itself, and it carries no implementation detail beyond the architectural choice.\n\nScale to the request: a small, obvious change deserves a paragraph and no questions at all.",
-  coach: "You are horse-code, a terminal-based AI coding agent. Your product identity is always horse-code \u2014 never claim to be Claude Code, Gemini CLI, Antigravity, or any other product, even though the underlying language model powering you may be Claude, Gemini, or another model. Answer the user's technical questions about their repository and code. If needed, inspect the repository with read_file/grep/glob.\n\nWork out loud while you do it. Before a batch of tool calls, say in ONE line what you are looking for and why; when something you read changes your mind, say that too. This is not a summary at the end \u2014 the user is watching an empty screen while you search, and a run that reads thirty files in silence is indistinguishable from one that is stuck, and impossible to redirect before the tokens are spent. Keep each line short: a sentence, not a paragraph.\n\nBe concise, direct, and helpful.",
-  // analyst + planner are spec-kit-driven (their system prompt comes from the fetched spec-kit command
-  // prompts — see src/speckit/phases.ts); they carry no default prompt here, only a model (peekModel).
-  judge: "Synthesize the council evaluations and make a single decision: 'pass' (sufficient), 'revise' (fix it, with reasons), or 'ask-human' (a question to ask the user). Return {decision, feedback, question} via submit.",
-  "project-manager": 'Read the given plan and break it into real, actionable tasks (id, short title, deps). Each task should be a single, clear piece of work. Return {tasks} via submit.\n\nThe `writing-plans` skill above governs WHAT MAKES A TASK EXECUTABLE \u2014 take that from it and nothing else. Two bindings, because the skill describes a different habitat:\n- STRUCTURE comes from the spec-kit tasks template you are given (phases, story grouping, [P] markers), NOT from the skill\'s own document layout. Ignore its `docs/superpowers/plans/\u2026` path, its required-sub-skill header, and its execution-handoff section: this pipeline already owns worktrees, dispatch and review.\n- What you DO take: exact file paths per task, a real test cycle rather than a vague "add tests" step, no placeholders (no TBD/TODO/"similar to task N"), and interfaces named explicitly so a task whose implementer never sees the others still knows the signatures it must produce and consume.\nRight-size the same way the skill does: a task is the smallest unit worth its own test cycle and its own review. Fold setup and scaffolding into the task whose deliverable needs them.',
-  "task-auditor": "You are the last check on a task breakdown before any of it is built. Every hour of implementation after you is spent executing this list, and a bad list does not fail \u2014 the tasks pass their reviews and the wrong work is delivered correctly. Its structure has already been checked mechanically; you are here for the part only a reader can answer: does the breakdown deliver what the plan requires, and would a task's acceptance criteria still hold for an implementation that missed the point? Do not propose better work than the plan asked for \u2014 scope you invent here becomes hours someone spends. Flag any task whose only deliverable is an answer \u2014 verifying, inspecting, confirming \u2014 because an implementer reads the code as part of doing the work, and a task that ends with the repository unchanged has spent a review round on nothing. A clean breakdown is the normal case; say so. Return {missing, weak} via submit.",
-  "team-lead": "You audit a task breakdown before any of it runs. The schedule itself is computed from the declared dependencies and is not yours to write; what nothing has checked is whether those dependencies are RIGHT. You are given the tasks with the files each one writes and what must be true when it is done, plus the groups that would run at the same time in separate worktrees. Find the task that cannot actually start yet because it needs a type, function, table or config key another task in its own group creates \u2014 and say which declared dependencies hold work back for no reason. Both answers are usually empty; say so rather than inventing an edge. Return {missing, spurious} via submit.",
-  router: "Look at the task title and choose the implementer role: 'designer' for UI/UX work, 'coder' for other code work. Return {role} via submit.",
-  coder: "Implement the given task in the worktree. If it is a new task, start from scratch; if it is a returning task, address the reviewer notes. Work with read/write/edit/grep/glob/shell and run the tests.\n\nThe `test-driven-development` skill above is how you write code here: the failing test comes first, and it must fail for the RIGHT reason before you make it pass. A test that asserts nothing is worse than no test \u2014 it reports success forever. Bindings for this pipeline: your worktree is already prepared (do not create one), every file you write is committed as you write it, and there is no separate agent to hand off to \u2014 you take the task to green yourself.",
-  designer: "Implement the UI/UX task in the worktree. Focus on the user interface and experience; work with read/write/edit.\n\nThe `frontend-design` skill above governs the LOOK: aesthetic direction, typography, and choices that do not read as templated defaults. Follow the project's existing visual language where there is one \u2014 a distinctive design that fights the surrounding product is worse than a plain one that fits it.",
-  "senior-coder": "Take over the task the coder got stuck on; implement it with a more careful approach. Take the reviewer notes and previous attempts into account.\n\nYou are here because a previous attempt failed, so start by understanding WHY rather than rewriting: the `systematic-debugging` skill is available (fetch it with the `skill` tool) and is the right tool when a test fails or behaviour is unexplained. The `test-driven-development` skill above still governs how you write the fix \u2014 reproduce the failure in a test first, then make it pass.",
-  "senior-designer": "Take over the UI/UX task the designer got stuck on; implement it more carefully.\n\nA previous attempt already failed, so establish WHY before redesigning \u2014 the `systematic-debugging` skill is available via the `skill` tool when the failure is behavioural rather than visual. The `frontend-design` skill above still governs the look.",
-  architect: "Analyze the root cause of a repeatedly failing task or a merge conflict, and produce a concrete solution plan. Return {rootCause, plan} via submit.\n\nFetch the `systematic-debugging` skill with the `skill` tool and follow it: your job is the ROOT CAUSE, and the failure mode to avoid is proposing a plausible fix for a cause you never established. Say what the evidence is, not what it might be.",
-  "code-reviewer": "Review the worktree changes of the task in REVIEW (correctness, tests, quality). Return {verdict: pass|fail, notes} via submit \u2014 your decision is final.",
-  "principal-coder": "Holistically review all changes in the PR (base worktree). If sufficient, approve; otherwise request-changes with concrete comments. In the final decision round, give accept or ask-human (a question to ask the user).",
-  "memory-keeper": "You are the ONLY writer into this project's long-term memory. Everything else \u2014 every review lens, the council, the judge \u2014 can merely PROPOSE; you decide.\n\nTreat every proposal as an UNVERIFIED CLAIM from a narrow, single-angle agent that saw one slice of one job, not as text to store. Most proposals are wrong in a specific way: they generalize a one-off into a rule, they restate the finding the agent was reviewing, or they record general programming advice any model already knows. Discard all of those. When a claim does survive, REWRITE it in your own words \u2014 never store an agent's sentence verbatim. Merge proposals that say the same thing into one memory.\n\nA memory qualifies ONLY if it is (a) durable \u2014 still true next month, (b) project-specific, and (c) actionable \u2014 it would change what an agent does. Write conventions, constraints, gotchas and root causes. A `lesson` must state what went wrong AND what to do instead. Set `audience` only when the memory is genuinely useful to specific roles and useless to the rest; leave it out otherwise.\n\nNEVER write transient run detail (task ids, attempt counts, what happened today), never restate the request, never duplicate a memory that already exists, and never include credentials, tokens, keys, or anything resembling a secret. Each memory is one self-contained sentence that makes sense with no other context.\n\nReturn at most 5 memories via submit as {memories}. Returning NONE is the most common correct answer \u2014 prefer an empty list over a weak memory, because a bad memory is injected into every future run.",
-  operational: "You handle version control for the project. Given a git diff of work just completed, write a single Conventional Commits message: `type(scope): subject`. Types: feat, fix, docs, refactor, test, chore, style, perf, build, ci. Choose the scope from the touched area (e.g. spec, plan, tasks, or a module name) or omit it. The subject is imperative, lowercase, \u226472 chars, no trailing period. Add a short body only if the change genuinely needs explanation. Commit messages are always in English. Return {message} via submit."
-};
-var SPEC_TEAM = [
-  { name: "spec-completeness", perspective: "coverage of the REQUESTED scope: capabilities the user asked for that are missing, or behavior left unspecified", models: [] },
-  { name: "spec-clarity", perspective: "ambiguity: requirements that can be read two ways, vague wording, unresolved NEEDS CLARIFICATION markers", models: [] },
-  { name: "spec-consistency", perspective: "internal contradictions between requirements, acceptance scenarios, and success criteria", models: [] },
-  { name: "spec-scope", perspective: "scope discipline: requirements the user never asked for, gold-plating, scope creep beyond the request", models: [] },
-  { name: "spec-abstraction-leak", perspective: "implementation detail that has leaked into the spec (languages, frameworks, APIs, storage mechanics, code structure) \u2014 a spec must stay technology-agnostic", models: [] },
-  { name: "spec-verifiability", perspective: "are success criteria measurable and technology-agnostic, and can each acceptance scenario be tested without knowing the implementation", models: [] },
-  { name: "spec-user-value", perspective: "do the user stories deliver the value the user actually asked for, and is the priority ordering sensible", models: [] },
-  { name: "spec-domain-model", perspective: "key entities, their attributes and relationships \u2014 coherent and complete at the domain level, with no implementation detail", models: [] },
-  { name: "spec-privacy", perspective: "requirement-level data handling: what data is stored, who may see it, what must never leak or be retained", models: [] }
-];
-var PLAN_TEAM = [
-  { name: "plan-spec-conformance", perspective: "traceability to the approved spec: every requirement covered by the plan, and nothing planned that the spec never asked for", models: [] },
-  { name: "plan-architecture", perspective: "layering, module boundaries, dependency direction, overall structural coherence", models: [] },
-  { name: "plan-data-model", perspective: "schema and entity design, relationships, migrations, integrity constraints", models: [] },
-  { name: "plan-api-contracts", perspective: "interface and contract design, naming, backward compatibility, ergonomics", models: [] },
-  { name: "plan-security", perspective: "threat model, authentication/authorization design, input validation, secret handling, injection surfaces", models: [] },
-  { name: "plan-concurrency", perspective: "race conditions, atomicity, ordering, multi-writer/multi-tab safety, shared-state design", models: [] },
-  { name: "plan-resilience", perspective: "failure modes, error propagation, recovery, retries, partial-failure behavior", models: [] },
-  { name: "plan-performance", perspective: "algorithmic complexity, hot paths, resource bounds, scalability of the chosen design", models: [] },
-  { name: "plan-test-strategy", perspective: "how the design will be proven: seams, dependency injection, contract/integration test layers, what each test actually establishes", models: [] },
-  { name: "plan-simplicity", perspective: "YAGNI: over-engineering, unnecessary abstraction, complexity the requested scope does not justify", models: [] },
-  { name: "plan-dependencies", perspective: "third-party choices, supply-chain risk, versioning, licensing", models: [] },
-  { name: "plan-observability", perspective: "logging, metrics, tracing, debuggability, actionable failure signals", models: [] },
-  { name: "plan-structure", perspective: "project structure: directory/file layout, build setup, adherence to existing repo conventions", models: [] },
-  { name: "plan-feasibility", perspective: "can this be built and maintained as described, in reasonable increments, with the effort the request warrants", models: [] }
-];
-var CODE_TEAM = [
-  { name: "code-plan-conformance", perspective: "does the code implement what the task required \u2014 nothing missing, and no extra scope beyond the task", models: [] },
-  { name: "code-correctness", perspective: "logical correctness, edge cases, off-by-one and boundary conditions, invariants", models: [] },
-  { name: "code-security", perspective: "injection, secret leakage, missing authorization checks, unsafe APIs, unvalidated input", models: [] },
-  { name: "code-error-handling", perspective: "swallowed errors, propagation, cleanup on failure, partial-failure behavior", models: [] },
-  { name: "code-concurrency", perspective: "race conditions, deadlocks, atomicity, shared mutable state", models: [] },
-  { name: "code-tests", perspective: "is the new behavior covered, and do the tests actually assert something meaningful (no vacuous tests)", models: [] },
-  { name: "code-data-integrity", perspective: "persistence correctness, transactions, validation at boundaries, migration safety", models: [] },
-  { name: "code-performance", perspective: "hot paths, unnecessary allocation/work, N+1 patterns, obvious inefficiency", models: [] },
-  { name: "code-maintainability", perspective: "naming, structure, complexity, readability, future tech-debt", models: [] },
-  { name: "code-simplicity", perspective: "dead code, duplication, unnecessary abstraction, complexity the task does not justify", models: [] },
-  { name: "code-api-surface", perspective: "public interface shape, backward compatibility, accidental API exposure", models: [] },
-  { name: "code-accessibility", perspective: "accessibility of UI code: keyboard operation, ARIA/semantics, contrast, i18n readiness", models: [] },
-  { name: "code-observability", perspective: "logging/metrics where a failure would otherwise be undiagnosable", models: [] },
-  { name: "code-dependencies", perspective: "newly introduced dependencies: justified, correctly versioned, no supply-chain or licensing problem", models: [] },
-  { name: "code-conventions", perspective: "consistency with the surrounding codebase's idioms, patterns, and style", models: [] }
-];
-var DEFAULT_COUNCIL = [
-  { name: "correctness-judge", perspective: "Is the work under review correct, coherent and internally consistent? Weigh the team's correctness/logic/data findings.", models: [] },
-  { name: "risk-judge", perspective: "What is the real blast radius of shipping this as-is? Weigh security, failure modes, concurrency, and data-integrity findings against likelihood and severity.", models: [] },
-  { name: "completeness-judge", perspective: "Is what was asked for fully and unambiguously covered? Weigh the team's completeness, gap, and contract findings.", models: [] },
-  { name: "user-value-judge", perspective: "Does this deliver the user's actual intent well? Weigh usability, accessibility, and whether the scope serves the request without gold-plating.", models: [] },
-  { name: "feasibility-judge", perspective: "Can this be built and maintained as described? Weigh architecture, simplicity, dependencies, and maintainability findings against effort.", models: [] }
-];
-function placedSkills() {
-  return [...new Set(Object.values(DEFAULT_ROLE_SKILLS).flat())];
+    const args = parsed.data.args;
+    const why = refuseWrite(args);
+    if (why) return { content: why, isError: true, settled: true };
+    const out = await new Promise((resolve6) => {
+      const child = execFile("git", args, {
+        cwd: ctx.cwd,
+        // A push talks to a server: the read tool's 30s is a reasonable ceiling for a local query and a
+        // pessimistic one for a repository with anything in it.
+        timeout: args[0] === "push" ? GIT_PUSH_TIMEOUT_MS : GIT_TIMEOUT_MS,
+        maxBuffer: MAX_GIT_OUTPUT * 4,
+        // GIT_TERMINAL_PROMPT=0: a push that needs credentials fails with a message instead of blocking on a
+        // prompt no one can see — the TUI owns the terminal, so the agent would simply hang.
+        env: { ...process.env, GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0" }
+      }, (err, stdout, stderr) => {
+        resolve6({ code: err ? 1 : 0, text: `${stdout}${stderr}`.trim() });
+      });
+      ctx.signal?.addEventListener("abort", () => child.kill("SIGKILL"), { once: true });
+    });
+    if (!out.text) return { content: out.code === 0 ? "(done)" : "git failed with no output.", isError: out.code !== 0 };
+    const clipped = out.text.length > MAX_GIT_OUTPUT ? `${truncateSafe(out.text, MAX_GIT_OUTPUT)}
+\u2026[truncated]` : out.text;
+    return { content: clipped, isError: out.code !== 0 };
+  }
+};
+
+// src/tools/remember.ts
+import { z as z3 } from "zod";
+var params2 = z3.object({
+  fact: z3.string().describe(
+    "One short sentence, durable and project-specific: where something lives, which command builds it, a convention this codebase follows, a schema detail that cost you a search. Not what you did, not what is true of the language in general \u2014 something the next agent would otherwise have to rediscover."
+  )
+});
+function buildRememberTool(sink) {
+  return {
+    name: "remember_fact",
+    description: "Save a short, durable fact worth recalling in future sessions \u2014 a project convention, where something lives, a schema detail, a command that works. It is written straight away, so a session that stops early still leaves it behind. Use it the moment you learn something you would not want to work out twice; skip anything transient or specific to the task in hand.",
+    permissionLevel: "safe",
+    parameters: params2,
+    async run(rawArgs, ctx) {
+      const parsed = params2.safeParse(rawArgs);
+      if (!parsed.success) return { content: "remember_fact: invalid args (expected { fact })", isError: true };
+      const fact = parsed.data.fact.trim();
+      if (!fact) return { content: "remember_fact: empty fact", isError: true };
+      const write = sink ?? ctx.remember;
+      if (!write) return { content: "remember_fact: memory is not available in this context", isError: true };
+      write(fact);
+      return { content: `Remembered: ${fact}`, isError: false };
+    }
+  };
 }
+var rememberFactTool = buildRememberTool();
 
 // src/speckit/layout.ts
 import { existsSync as existsSync4, mkdirSync, readdirSync as readdirSync4 } from "fs";
@@ -1748,6 +2644,7 @@ function isNonImplementing(description) {
   return /\bread[- ]only\b/i.test(description) || /\bdoes\s+not\s+(implement|apply|execute|write)\b/i.test(description);
 }
 var MATCH_BAR = 3;
+var MIN_DENSITY = 0.1;
 var MAX_ROUTED = 3;
 var MAX_ROUTED_CHARS = 24e3;
 function scoreSkill(task, description) {
@@ -1769,7 +2666,7 @@ function routeSkills(task, registry, already = [], opts = {}) {
   const paths = (opts.files ?? []).join(" ");
   const base = [opts.role ?? "", routingSubject(task), paths].filter(Boolean).join(" ");
   const subject = [base, expandExtensions(opts.files ?? []), expandAbbreviations(base)].filter(Boolean).join(" ");
-  return registry.list().filter((s) => !have.has(s.name)).filter((s) => !placed.has(s.name)).filter((s) => !isExplicitOnly(s.description)).filter((s) => !(opts.implementing && isNonImplementing(s.description))).map((s) => ({ name: s.name, ...scoreSkill(subject, s.description) })).filter((m) => m.score >= bar).sort((a, b) => b.score - a.score || b.density - a.density || a.name.localeCompare(b.name)).slice(0, opts.max ?? MAX_ROUTED).filter((m) => {
+  return registry.list().filter((s) => !have.has(s.name)).filter((s) => !placed.has(s.name)).filter((s) => !isExplicitOnly(s.description)).filter((s) => !(opts.implementing && isNonImplementing(s.description))).map((s) => ({ name: s.name, ...scoreSkill(subject, s.description) })).filter((m) => m.score >= bar).sort((a, b) => b.score - a.score || b.density - a.density || a.name.localeCompare(b.name)).filter((m, i) => i === 0 || m.density >= MIN_DENSITY).slice(0, opts.max ?? MAX_ROUTED).filter((m) => {
     const len = registry.get(m.name)?.content.length ?? 0;
     if (spent + len > MAX_ROUTED_CHARS) return false;
     spent += len;
@@ -1858,7 +2755,7 @@ async function diffSince(cwd, sinceRef, git = defaultGitRunner) {
 
 // src/engine/reviewer.ts
 var CODE_REVIEW_MAX_TURNS = 25;
-var CODE_REVIEW_TIMEOUT_MS = 5 * 60 * 1e3;
+var CODE_REVIEW_TIMEOUT_MS = 10 * 60 * 1e3;
 var VerdictSchema = z8.object({
   verdict: z8.enum(["pass", "fail"]).describe(
     "`fail` only if the code does not do what the task required, or does it wrongly. Style you would have written differently is a note on a `pass` \u2014 a fail sends the task back around the whole cycle."
@@ -1992,6 +2889,7 @@ var params7 = z10.object({
   replaceAll: z10.boolean().optional()
 });
 var NEAR_MISS_CHARS = 600;
+var MAX_MATCH_LINES = 5;
 var norm = (t) => t.replace(/[ \t]+/g, " ").replace(/[ \t]+$/gm, "").trim();
 function shortPath(path, cwd) {
   const abs = resolve4(cwd, path);
@@ -2058,8 +2956,14 @@ var editFileTool = {
       };
     }
     if (count > 1 && !a.replaceAll) {
+      const lines = content.split("\n");
+      const at = [];
+      for (let i = 0; i < lines.length && at.length <= MAX_MATCH_LINES; i++) {
+        if (lines[i]?.includes(a.oldString.split("\n")[0] ?? "")) at.push(i + 1);
+      }
+      const where = at.length ? ` First seen at line${at.length > 1 ? "s" : ""} ${at.slice(0, MAX_MATCH_LINES).join(", ")}${at.length > MAX_MATCH_LINES ? ", \u2026" : ""}.` : "";
       return {
-        content: `edit_file: oldString is not unique (${count} matches) \u2014 replaceAll required`,
+        content: `edit_file: oldString matches ${count} places in ${shortPath(a.path, cwdResolved)}.${where} Add surrounding lines to oldString so it names the one you mean \u2014 or pass replaceAll: true if every occurrence should change.`,
         isError: true
       };
     }
@@ -2084,7 +2988,7 @@ var editFileTool = {
 };
 
 // src/tools/shell.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { resolve as resolve5, sep as sep6 } from "path";
 import { z as z11 } from "zod";
 var params8 = z11.object({
@@ -2148,7 +3052,7 @@ function destroysWork(command) {
   for (const seg of command.split(/&&|\|\||;|\|/)) {
     const m = /^\s*git\s+(.*)$/.exec(seg.trim());
     if (!m) continue;
-    const rest = (m[1] ?? "").replace(/^(?:-\S+\s+)*/, "").trim();
+    const rest = (m[1] ?? "").replace(/^(?:(?:-[cC]|--(?:git-dir|work-tree|namespace|exec-path|config-env))\s+\S+|-\S+)\s+/g, "").trim();
     const hit = DESTROYS_WORK.find((d) => d.re.test(rest));
     if (hit) return hit.what;
   }
@@ -2201,7 +3105,7 @@ var shellTool = {
     return new Promise((resolvePromise) => {
       let child;
       try {
-        child = spawn(a.command, {
+        child = spawn2(a.command, {
           cwd: ctx.cwd,
           shell: true,
           signal: ctx.signal,
@@ -2388,6 +3292,188 @@ async function commitRefreshed(git, baseWorktree, traceRootRel2) {
   return r.code === 0;
 }
 
+// src/engine/writer-registry.ts
+import { z as z14 } from "zod";
+
+// src/engine/normalize-question.ts
+import { z as z13 } from "zod";
+var NormalizedQuestionSchema = z13.object({
+  question: z13.string().describe("The core question, concise, WITHOUT the embedded options table/list."),
+  options: z13.array(z13.string()).describe("Each selectable choice as a SHORT label; the recommended one first, suffixed ' (recommended)'. Empty when the question is genuinely open-ended."),
+  multiSelect: z13.boolean().describe("true only if the user may pick more than one.")
+});
+var PROMPT = "You reformat an agent's question for a terminal UI that renders selectable options (arrow keys + Enter). Given the raw question text \u2014 which may embed choices as a markdown table, an A/B/C/D list, or a 'recommended' suggestion \u2014 extract exactly:\n- `question`: the core question, concise, WITHOUT the embedded options table/list.\n- `options`: each selectable choice as a SHORT label. If one choice is recommended, list it FIRST and append ' (recommended)'. Do NOT add an 'other' / free-text / 'answer in your own words' option \u2014 the UI already provides that.\n- `multiSelect`: true only if the user may pick several.\nIf the text is genuinely open-ended (no discrete choices), return options: []. Preserve the user's language. Return the result via submit.";
+function looksLikeChoices(text) {
+  return /\|[^\n]*\|[^\n]*\|/.test(text) || /(^|\n)\s*[A-Ea-e][).\-:]\s/.test(text) || /(^|\n)\s*[-*]\s+\S.*(\n\s*[-*]\s+\S.*){1,}/.test(text) || /\b(option|seçenek|choice|önerilen|recommended)\b/i.test(text);
+}
+async function normalizeQuestion(deps, raw) {
+  const { role: agentRole, model, fallbacks, onExhausted, onFallback } = deps.roleRegistry.fallbackOpts("refiner");
+  return runStructuredRole({
+    provider: deps.provider,
+    role: agentRole,
+    model,
+    fallbacks,
+    onExhausted,
+    onFallback,
+    // This shapes the question the USER reads; a rule like "always ask in Turkish" belongs here.
+    systemPrompt: PROMPT + deps.roleRegistry.ruleSuffix(),
+    tools: new ToolRegistry(),
+    messages: [{ role: "user", content: raw }],
+    permission: deps.permission,
+    approve: deps.approve,
+    cwd: ".",
+    signal: deps.signal
+  }, NormalizedQuestionSchema);
+}
+function extractChoicesFrom(text) {
+  const lines = text.split("\n");
+  const rows = lines.map((l) => l.trim()).filter((l) => l.startsWith("|") && l.endsWith("|") && !/^\|[\s|:-]+\|$/.test(l)).map((l) => l.slice(1, -1).split("|").map((c) => c.trim()));
+  const body = rows.filter((cells) => cells.length >= 2 && cells[0] && cells[1]).filter((cells, i) => !(i === 0 && /^(option|seçenek|choice|alternatif)$/i.test(cells[0])));
+  if (body.length >= 2) {
+    const question = lines.filter((l) => !/^\s*\|.*\|\s*$/.test(l)).join("\n").replace(/\n{3,}/g, "\n\n").trim();
+    return { choices: body.map((cells) => ({ label: cells[0], description: cells.slice(1).join(" \u2014 ") })), question };
+  }
+  const isLettered = (l) => /^\s*([A-Ea-e])[).\-:]\s+(\S.*)$/.exec(l.trim());
+  const lettered = lines.map(isLettered).filter((m) => !!m).map((m) => ({ label: `${m[1].toUpperCase()} \u2014 ${m[2]}` }));
+  if (lettered.length >= 2) {
+    const question = lines.filter((l) => !isLettered(l)).join("\n").replace(/\n{3,}/g, "\n\n").trim();
+    return { choices: lettered, question };
+  }
+  const MARKER = /\(([A-Ea-e])\)\s*/g;
+  const marks = [...text.matchAll(MARKER)];
+  const inOrder = marks.length >= 2 && marks.every((m, i) => m[1].toUpperCase() === String.fromCharCode(65 + i));
+  if (inOrder) {
+    const first = marks[0].index ?? 0;
+    const parts = marks.map((m, i) => {
+      const start = (m.index ?? 0) + m[0].length;
+      const end = i + 1 < marks.length ? marks[i + 1].index ?? text.length : text.length;
+      return { letter: m[1].toUpperCase(), body: text.slice(start, end).trim().replace(/\s+/g, " ") };
+    }).filter((p) => p.body);
+    if (parts.length >= 2) {
+      const question = text.slice(0, first).replace(/\s*(Se\u00e7enekler|Options|Choices)\s*:?\s*$/i, "").trim();
+      return {
+        choices: parts.map((p) => ({ label: `${p.letter} \u2014 ${clipLabel(p.body)}`, description: p.body })),
+        question: question || text
+      };
+    }
+  }
+  return { choices: [], question: text };
+}
+var clipLabel = (body) => {
+  const cut = body.replace(/^\[[^\]]*\]\s*/, "");
+  const stop = cut.search(/[—–.;:]\s/);
+  const head = stop > 12 ? cut.slice(0, stop) : cut;
+  return head.length > 72 ? `${head.slice(0, 71)}\u2026` : head;
+};
+
+// src/engine/writer-registry.ts
+var askUserParams = z14.object({
+  question: z14.string(),
+  // For a multiple-choice question, list the choices here → the UI shows a selectable checkbox/radio list
+  // (arrow keys + Enter) instead of a free-text box. Omit for an open-ended question.
+  //
+  // A choice may be a plain string, or an object carrying what the label alone cannot say: a one-line
+  // `description`, and a `preview` rendered in a panel beside the list while that option is focused. Use the
+  // rich form when the decision turns on the trade-offs rather than the name (e.g. "which approach?").
+  options: z14.array(z14.union([
+    z14.string(),
+    z14.object({ label: z14.string(), description: z14.string().optional(), preview: z14.string().optional() })
+  ])).optional().describe(
+    "The choices, when the question has discrete answers \u2014 the UI renders a selectable list instead of a free-text box. Omit for an open-ended question. A choice may be a plain string, or an object with a one-line `description` and a `preview` shown beside the list; use the rich form when the decision turns on trade-offs rather than on the name."
+  ),
+  multiSelect: z14.boolean().optional().describe(
+    "True when the user may pick more than one (checkboxes); omitted means pick exactly one (radio)."
+  ),
+  /**
+   * What the user has to DO before they can answer — one action per entry.
+   *
+   * Present ⇒ this is a hand-off, not a question: the run has stopped because only a person can carry the
+   * next step, and the UI says so rather than showing a bare "? Question".
+   */
+  steps: z14.array(z14.string()).optional().describe(
+    'What the user has to DO before they can answer \u2014 one action per entry. Supplying this makes it a HAND-OFF rather than a question: the run has stopped because only a person can carry the next step, and the UI says so instead of showing a bare "? Question". Use it whenever you are asking someone to go and perform something and report back; leave it out when you only want an answer.'
+  )
+});
+var POINTS_ELSEWHERE = /\b(above|below|earlier|previously|as listed|as described)\b|yukarı|aşağı|altında|önceki|birazdan|listelenen/i;
+var ITEM_REFERENCE = /(?:^|[^\w])(?:q|soru|question|madde|item)\s*\.?\s*(\d{1,2})\b/gi;
+var ITEM_STATED = /^[\s>*\-–—#]*(?:q|soru|question|madde|item)\s*\.?\s*\d{1,2}\s*[:).]/gim;
+function danglingItems(question) {
+  const referenced = new Set([...question.matchAll(ITEM_REFERENCE)].map((m) => Number(m[1])));
+  if (referenced.size < 2) return [];
+  const stated = question.match(ITEM_STATED)?.length ?? 0;
+  return stated >= referenced.size ? [] : [...referenced].sort((a, b) => a - b);
+}
+var ENUMERATOR = /(?:^|[^\w])\(?(\d{1,2})[).:]/g;
+function packedQuestions(question) {
+  if ((question.match(/\?/g)?.length ?? 0) < 2) return 0;
+  const numbered = new Set([...question.matchAll(ENUMERATOR)].map((m) => Number(m[1])));
+  return numbered.size;
+}
+var ONE_AT_A_TIME = "This tool asks ONE question and takes ONE answer. Ask the first one on its own, with its own `options`, and call this tool again for the next once you have the answer \u2014 the answer to one of these usually changes what the next one should be.";
+function buildAskUserTool(askUser, normalize) {
+  return {
+    name: "ask_user",
+    description: 'Ask the user ONE question and get their answer. Several decisions are several calls: ask the first, read the answer, then ask the next \u2014 the user has one answer field, so four questions in one box means four decisions they must hold in their head and answer in prose. For a multiple-choice question, pass `options` (the choices) \u2014 the UI shows a selectable list the user checks off; set `multiSelect: true` when they may pick several. Omit `options` for an open-ended (free-text) question. An option may be a plain string, or {label, description, preview} when the decision turns on trade-offs the label cannot carry \u2014 the preview is shown beside the list as the user moves the cursor. A `label` is a SHORT single line (a few words, no line breaks): it is a name for the choice, not the argument for it. Put the reasoning in `description` (one sentence) and the detail in `preview`. If you have findings to report, WRITE THEM as your message before calling this \u2014 a question that says "the evaluation is above" when you never wrote one leaves the user choosing between options whose basis they cannot see. The user may attach a free-text note to their choice, which arrives appended to the answer.\n\nWhen you need the user to DO something first \u2014 click through a screen, run a scenario, look at a network response \u2014 put each action in `steps`, one per entry, and ask in `question` for what they should report back. The user reads THIS BOX and the chat; a file you wrote is not on their screen, so "the steps above" points at nothing they can see. With `steps` the UI shows a hand-off \u2014 the numbered actions and then the question \u2014 instead of a bare question.',
+    permissionLevel: "safe",
+    parameters: askUserParams,
+    run: async (rawArgs, ctx) => {
+      const parsed = askUserParams.safeParse(rawArgs);
+      if (!parsed.success) {
+        return { content: `ask_user: invalid args: ${parsed.error.issues.map((i) => i.message).join("; ")}`, isError: true };
+      }
+      const { question, options, multiSelect, steps } = parsed.data;
+      const asker = ctx.role || ctx.model ? { asker: { ...ctx.role ? { role: ctx.role } : {}, ...ctx.model ? { model: ctx.model } : {} } } : {};
+      if (POINTS_ELSEWHERE.test(question) && !steps?.length && !ctx.said?.trim()) {
+        return {
+          content: "ask_user: this question refers to something the user cannot see. You wrote no message this turn, so there is nothing above it \u2014 and a file you wrote is not on their screen. Put what they must do in `steps` (one action per entry), or write it out in `question`, and ask again.",
+          isError: true
+        };
+      }
+      const dangling = danglingItems(question);
+      if (dangling.length && !steps?.length && !ctx.said?.trim()) {
+        return {
+          content: `ask_user: this asks the user to answer ${dangling.map((n) => `Q${n}`).join(", ")}, and none of them is on their screen \u2014 you did not write them this turn, and a file you wrote is not something they are looking at. ${ONE_AT_A_TIME}`,
+          isError: true
+        };
+      }
+      const packed = packedQuestions(question);
+      if (packed >= 2 && !steps?.length && !options?.length) {
+        return {
+          content: `ask_user: this is ${packed} questions in one box, and the user has one answer field for all of them. ${ONE_AT_A_TIME}`,
+          isError: true
+        };
+      }
+      if ((!options || options.length === 0) && !steps?.length && looksLikeChoices(question)) {
+        const found = extractChoicesFrom(question);
+        if (found.choices.length >= 2) {
+          return { content: await askUser(found.question, { options: found.choices, ...asker }), isError: false };
+        }
+        if (normalize) {
+          try {
+            const n = await normalize(question);
+            if (n.options.length > 0) {
+              return { content: await askUser(n.question, { options: n.options, multiSelect: n.multiSelect, ...asker }), isError: false };
+            }
+          } catch {
+          }
+        }
+      }
+      return { content: await askUser(question, { options, multiSelect, steps, ...asker }), isError: false };
+    }
+  };
+}
+function writerRegistry(skillRegistry, extra = []) {
+  const r = new ToolRegistry();
+  r.register(readFileTool);
+  r.register(writeFileTool);
+  r.register(editFileTool);
+  r.register(grepTool);
+  r.register(globTool);
+  r.register(buildSkillTool(skillRegistry));
+  for (const t of extra) r.register(t);
+  return r;
+}
+
 // src/engine/role-fitness.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
 import { dirname as dirname4 } from "path";
@@ -2503,7 +3589,7 @@ var RoleFitness = class {
 };
 
 // src/engine/routing.ts
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 
 // src/engine/route-role.ts
 var STYLE_EXT = [".css", ".scss", ".sass", ".less", ".styl"];
@@ -2569,27 +3655,9 @@ function routeByEvidence(card) {
   return { why: hasComponent && !hasStyle && !hasMarkup ? "component files could be either" : "the evidence points both ways" };
 }
 
-// src/agent/deadline.ts
-function withDeadline(work, signal, message) {
-  work.catch(() => {
-  });
-  return Promise.race([work, expired(signal, message)]);
-}
-function expired(signal, message) {
-  return new Promise((_, reject) => {
-    if (signal.aborted) {
-      reject(new Error(message));
-      return;
-    }
-    signal.addEventListener("abort", () => reject(new Error(message)), { once: true });
-  });
-}
-var SHORT_CALL_MS = 3 * 60 * 1e3;
-var LONG_CALL_MS = 15 * 60 * 1e3;
-
 // src/engine/routing.ts
-var RouteSchema = z13.object({
-  role: z13.enum(["coder", "designer"]).describe(
+var RouteSchema = z15.object({
+  role: z15.enum(["coder", "designer"]).describe(
     "Who should implement this. `designer` when the work IS how the thing looks or behaves to a person \u2014 layout, spacing, colour, copy, interaction. `coder` for everything else. Judge by what the work is, not by the file type: a component file holding a data hook is code work; a component file whose whole job is appearance is design work."
   )
 });
@@ -2651,9 +3719,9 @@ function createDefaultRegistry() {
 }
 
 // src/engine/operational.ts
-import { z as z14 } from "zod";
-var CommitSchema = z14.object({
-  message: z14.string().describe("A Conventional Commits message: `type(scope): subject`, English, imperative.")
+import { z as z16 } from "zod";
+var CommitSchema = z16.object({
+  message: z16.string().describe("A Conventional Commits message: `type(scope): subject`, English, imperative.")
 });
 var MAX_DIFF = 12e3;
 var OPERATIONAL_MAX_TURNS = 3;
@@ -2750,6 +3818,39 @@ async function squashTask(deps, worktree, baseRef, title, git = defaultGitRunner
   return message;
 }
 
+// src/engine/touched.ts
+async function changedPaths(cwd, git = defaultGitRunner) {
+  const res = await git(["status", "--porcelain", "-uall"], cwd);
+  if (res.code !== 0) return [];
+  const out = [];
+  for (const line of res.stdout.split("\n")) {
+    if (!line.trim()) continue;
+    const path = line.slice(3).trim();
+    const arrow = path.lastIndexOf(" -> ");
+    const p = arrow >= 0 ? path.slice(arrow + 4) : path;
+    out.push(p.startsWith('"') && p.endsWith('"') ? p.slice(1, -1) : p);
+  }
+  return out;
+}
+async function reconcileTouched(deps, cwd, touched, git = defaultGitRunner) {
+  let changed;
+  try {
+    changed = await changedPaths(cwd, git);
+  } catch {
+    return [];
+  }
+  const known = new Set(touched);
+  const extra = changed.filter((p) => !known.has(p));
+  for (const p of extra) {
+    touched.push(p);
+    try {
+      await commitFile(deps, cwd, p, git);
+    } catch {
+    }
+  }
+  return extra;
+}
+
 // src/skills/adjudicate.ts
 async function adjudicateSkills(opts) {
   const { confident, borderline } = partitionByConfidence(opts.matches, opts.bar, opts.margin);
@@ -2804,6 +3905,42 @@ function parseKeep(text) {
   }
 }
 
+// src/engine/group-notes.ts
+function subjectOf(note) {
+  const path = /\b((?:[\w.-]+\/)+[\w.-]+\.(?:cs|ts|tsx|json|sql|md))\b/.exec(note)?.[1];
+  if (path) return path.split("/").pop().replace(/\.\w+$/, "");
+  return /\b([A-Z][a-z]+(?:[A-Z][a-z0-9]+){1,})\b/.exec(note)?.[1];
+}
+function groupNotes(notes) {
+  const order = [];
+  const bySubject = /* @__PURE__ */ new Map();
+  const loose = [];
+  for (const note of notes) {
+    const s = subjectOf(note);
+    if (!s) {
+      loose.push(note);
+      continue;
+    }
+    if (!bySubject.has(s)) {
+      bySubject.set(s, []);
+      order.push(s);
+    }
+    bySubject.get(s).push(note);
+  }
+  const blocks = [];
+  for (const s of order) {
+    const group = bySubject.get(s);
+    if (group.length === 1) {
+      loose.push(group[0]);
+      continue;
+    }
+    blocks.push(`${s} \u2014 ${group.length} notes, one subject:
+${group.map((n) => `  - ${n}`).join("\n")}`);
+  }
+  if (loose.length) blocks.push(loose.map((n) => `- ${n}`).join("\n"));
+  return blocks.join("\n\n");
+}
+
 // src/engine/implementer.ts
 var IMPLEMENTER_MAX_TURNS = 200;
 var WHAT_IT_COST = "Before you stop: did anything here cost you more than one attempt \u2014 a command that had to be invoked a particular way, a file that was not where it should have been, a trap you fell into? If you have not already recorded it with `remember_fact`, do that now. The next agent pays for it again otherwise.";
@@ -2854,6 +3991,7 @@ async function runImplementer(deps, role, task, cwd, slot = 0) {
   tools.register(buildSkillTool(deps.skillRegistry));
   for (const t of contextTools(deps)) tools.register(t);
   tools.register(buildRememberTool(deps.rememberFact));
+  if (deps.askUser) tools.register(buildAskUserTool(deps.askUser));
   const returning = task.reviewNotes.length > 0;
   const brief = [
     task.acceptance.length ? `It is done when ALL of these are true \u2014 they are exactly what the review will check:
@@ -2869,7 +4007,7 @@ ${WHAT_IT_COST}
 
 Staging, committing and branches are this tool's business, never the developer's: do not end by asking them to \`git add\`, commit, or tidy the tree. Ask them only for what nobody else can do \u2014 look at a screen, start an environment, decide something. If a file you wrote is not in git yet, that is a fault to report, not an errand to hand over.`;
   const content = (returning ? `This is a RETURNING task: "${task.title}". Address the reviewer notes:
-${task.reviewNotes.map((n) => `- ${n}`).join("\n")}` : `This is a NEW task: "${task.title}". Implement it.`) + (brief ? `
+${groupNotes(task.reviewNotes)}` : `This is a NEW task: "${task.title}". Implement it.`) + (brief ? `
 
 ${brief}` : "") + `
 
@@ -2879,7 +4017,7 @@ ${handOver}`;
   const hints = memoryHints(deps, `${task.title} ${task.reviewNotes.join(" ")}`, { role, operations: true });
   const touched = [];
   const attached = deps.roleRegistry.skillsFor(role);
-  const subject = `${task.title} ${task.acceptance.join(" ")} ${task.reviewNotes.join(" ")}`;
+  const subject = `${task.title} ${task.acceptance.join(" ")}`;
   const routed = routeSkills(subject, deps.skillRegistry, attached, {
     role,
     implementing: true,
@@ -2928,7 +4066,8 @@ ${handOver}`;
     cwd,
     { role, files: task.files, title: task.title }
   ) : "";
-  const systemPrompt = withSkills + law + projectToolsNote(tools.list(), !!loadGraphSync(cwd)) + BATCH_TOOLS_NOTE;
+  const delegate = deps.delegateTo ? cliFor(chain[0] ?? "") ?? deps.delegateTo : void 0;
+  const systemPrompt = withSkills + law + (delegate ? "" : projectToolsNote(tools.list(), !!loadGraphSync(cwd))) + BATCH_TOOLS_NOTE;
   const budgetMs = attemptBudget(task, deps.implementerTimeoutMs ?? IMPLEMENTER_TIMEOUT_MS);
   const budget = AbortSignal.timeout(budgetMs);
   let warned = false;
@@ -2940,7 +4079,12 @@ ${handOver}`;
     return note;
   };
   const opts = {
-    provider: deps.provider,
+    /**
+     * A delegated implementer gets a provider bound to its worktree and allowed to write; every other role
+     * keeps the one the composition root built. Per call rather than shared, because the worktree differs
+     * per task and a provider shared across parallel implementers could only hold one of them.
+     */
+    provider: delegate ? new CliProvider({ kind: delegate, readOnly: false, cwd, ...deps.accounts ? { accounts: deps.accounts } : {} }) : deps.provider,
     ...resolved,
     systemPrompt,
     ...chain.length ? { model: chain[0], fallbacks: chain.slice(1) } : {},
@@ -3013,6 +4157,10 @@ ${handOver}`;
     if (deps.signal.aborted || !budget.aborted) throw e;
     throw new Error(overran);
   } finally {
+    const alsoChanged = await reconcileTouched(deps, cwd, touched);
+    if (alsoChanged.length) {
+      deps.note?.(`\u{1F4DD} ${alsoChanged.length} file(s) changed outside a write tool \u2014 checkpointed and credited.`);
+    }
     reinforceTouched(deps, hints.ids, touched, role);
     reinforceUsed(deps, hints.ids, await writtenText(cwd, touched), role);
   }
@@ -3021,7 +4169,7 @@ ${handOver}`;
 // src/engine/review.ts
 import { existsSync as existsSync8 } from "fs";
 import { isAbsolute, join as join8 } from "path";
-import { z as z15 } from "zod";
+import { z as z17 } from "zod";
 
 // src/agent/roles.ts
 function isTransientFailure(reason) {
@@ -3029,6 +4177,45 @@ function isTransientFailure(reason) {
   if (/\b(429|rate.?limit|quota|exhaust|insufficient|billing|credit)\b/.test(r)) return false;
   return /overload|529|50[0234]|timeout|timed out|deadline|econnreset|epipe|socket hang up|stream ended|temporar|unavailable|try again/.test(r);
 }
+function isSourceCapacity(reason) {
+  return /capacity is (?:temporarily unavailable|busy)/i.test(reason);
+}
+function sourcePrefix(model) {
+  const s = model.replace(/^no-think\//, "");
+  const cli = cliFor(s);
+  if (cli) return cli;
+  const i = s.indexOf("/");
+  return i > 0 ? s.slice(0, i) : void 0;
+}
+function weightedCycle(sources, weights) {
+  const queues = sources.map((s) => Array(Math.max(1, weights[s] ?? 1)).fill(s));
+  const out = [];
+  for (let more = true; more; ) {
+    more = false;
+    for (const q of queues) {
+      const m = q.shift();
+      if (m !== void 0) {
+        out.push(m);
+        more = true;
+      }
+    }
+  }
+  return out;
+}
+function canonicalSource(name) {
+  const s = name.toLowerCase().replace(/^no-think\//, "");
+  if (s === "cc" || s === "claude") return "claude";
+  if (s === "cx") return "codex";
+  return sourcePrefix(s) ?? s;
+}
+function providerOutage(reason) {
+  return /no active credentials for provider:?\s*([\w.-]+)/i.exec(reason)?.[1] ?? /provider\s+'?([\w.-]+)'?\s+is not configured/i.exec(reason)?.[1] ?? /all\s+([\w.-]+)\s+accounts have exhausted their quota/i.exec(reason)?.[1] ?? /shared egress ip quota exhausted\s*\(([\w.-]+)\)/i.exec(reason)?.[1] ?? /^\s*(claude|codex)\s+CLI:\s*rejected\b/i.exec(reason)?.[1]?.toLowerCase();
+}
+function quotaResetAt(reason) {
+  const iso = /\(resets\s+([0-9T:.\-]+Z)\)/i.exec(reason)?.[1];
+  const t = iso ? Date.parse(iso) : NaN;
+  return Number.isFinite(t) ? t : void 0;
+}
 var RoleRegistry = class _RoleRegistry {
   // durable behavioral rules → appended to EVERY role's prompt
   constructor(roles, defaultPrompts = {}, skillRegistry) {
@@ -3120,6 +4307,27 @@ ${rules.map((r) => `- ${r}`).join("\n")}` : "";
     this.quarantine.set(model, { at: now, reason, ...ends !== void 0 && { until: ends } });
     this.onQuarantine?.(model, reason, ends);
   }
+  /** Every model any role's chain names — the pool this registry can actually reach for. */
+  knownModels() {
+    return [...new Set(Object.values(this.roles).flatMap((r) => r.models ?? []))];
+  }
+  /**
+   * Benches every model of one provider, for a failure that is about the provider itself.
+   *
+   * Returns what it took out, so the caller can say so once instead of six times. Falls back to benching the
+   * single model when the pool names none of that provider — an unknown provider is still a real failure.
+   */
+  markProviderExhausted(provider, model, reason, now = Date.now()) {
+    const want = canonicalSource(provider);
+    const hit = this.knownModels().filter((m) => sourcePrefix(m) === want);
+    const until = quotaResetAt(reason);
+    for (const m of hit) this.markExhausted(m, reason, now, until);
+    if (!hit.length) {
+      this.markExhausted(model, reason, now);
+      return [model];
+    }
+    return hit;
+  }
   /**
    * How long a BEHAVIOURAL bench lasts before the model is tried again.
    *
@@ -3250,9 +4458,28 @@ ${rules.map((r) => `- ${r}`).join("\n")}` : "";
    */
   chainFor(roleName, slot = 0) {
     const c = this.chain(roleName);
-    const k = c.length ? (slot % c.length + c.length) % c.length : 0;
+    if (c.length < 2) return c;
+    const order = [];
+    for (const m of c) {
+      const s = sourceOf(m);
+      if (!order.includes(s)) order.push(s);
+    }
+    const cycle = weightedCycle(order, this.sourceWeights?.() ?? {});
+    if (cycle.length) {
+      const want = cycle[(slot % cycle.length + cycle.length) % cycle.length];
+      const i = c.findIndex((m) => sourceOf(m) === want);
+      if (i > 0) return [c[i], ...c.filter((_, j) => j !== i)];
+      if (i === 0) return c;
+    }
+    const k = (slot % c.length + c.length) % c.length;
     return k === 0 ? c : [...c.slice(k), ...c.slice(0, k)];
   }
+  /** How many accounts each source has connected — set at the composition root; equal weights without it. */
+  sourceWeights;
+  /** Wire the account weights (called once the pool exists). */
+  setSourceWeights(fn) {
+    this.sourceWeights = fn;
+  }
   /** The model a role would use next (chain head), for UI display only. */
   peekModel(roleName) {
     return this.chain(roleName)[0] ?? "";
@@ -3280,7 +4507,12 @@ ${rules.map((r) => `- ${r}`).join("\n")}` : "";
       role: roleName,
       model: chain[0] ?? "",
       fallbacks: chain.slice(1),
-      onExhausted: (m, reason) => this.markExhausted(m, reason ?? "unavailable"),
+      onExhausted: (m, reason) => {
+        const why = reason ?? "unavailable";
+        const source = providerOutage(why) ?? (isSourceCapacity(why) ? sourcePrefix(m) : void 0);
+        if (source) this.markProviderExhausted(source, m, why);
+        else this.markExhausted(m, why);
+      },
       onStructuralFailure: (m, reason) => this.markStructuralFailure(m, reason, roleName),
       onFallback: notify ? (from, to, reason) => notify(`\u2935 \`${from}\` \u2192 \`${to}\` \u2014 ${reason}`) : void 0
     };
@@ -3314,14 +4546,14 @@ ${rules.map((r) => `- ${r}`).join("\n")}` : "";
 function asChoice(o) {
   return typeof o === "string" ? { label: o } : o;
 }
-var AssessmentSchema = z15.object({
-  findings: z15.array(z15.object({
-    severity: z15.enum(["critical", "medium", "low"]).describe(
+var AssessmentSchema = z17.object({
+  findings: z17.array(z17.object({
+    severity: z17.enum(["critical", "medium", "low"]).describe(
       "`critical`: shipping it this way causes real harm \u2014 wrong behaviour, data loss, a security hole. `medium`: it should be fixed but nothing breaks if it ships. `low`: a preference or a tidy-up."
     ),
-    note: z15.string()
+    note: z17.string()
   })).default([]),
-  recommendation: z15.enum(["approve", "revise"]).describe(
+  recommendation: z17.enum(["approve", "revise"]).describe(
     "`revise` only if at least one finding must be addressed before this can ship; otherwise `approve` and leave the findings as notes. Findings you would not block on do not make it a revise."
   )
 });
@@ -3362,18 +4594,18 @@ function coverage(assessments) {
   const verified = assessments.length - unverified;
   return { verified, unverified, enough: !assessments.length || verified / assessments.length >= TEAM_MIN_COVERAGE };
 }
-var CouncilVoteSchema = z15.object({
-  vote: z15.enum(["pass", "revise"]).describe(
+var CouncilVoteSchema = z17.object({
+  vote: z17.enum(["pass", "revise"]).describe(
     "`revise` only if something must change before this can ship. A concern you would not block on is a `pass` with the concern in the rationale."
   ),
-  rationale: z15.string()
+  rationale: z17.string()
 });
-var JudgeSchema = z15.object({
-  decision: z15.enum(["pass", "revise", "ask-human"]).describe(
+var JudgeSchema = z17.object({
+  decision: z17.enum(["pass", "revise", "ask-human"]).describe(
     "`pass`: it can ship. `revise`: it can be fixed from the feedback below, without anyone being asked. `ask-human` ONLY when the decision is genuinely not yours \u2014 the reviewers disagree on something a person owns, or the answer depends on intent nobody wrote down. It stops the run and costs someone their attention; do not use it for a call you can make."
   ),
-  feedback: z15.array(z15.string()),
-  question: z15.string()
+  feedback: z17.array(z17.string()),
+  question: z17.string()
 });
 var STAGE_FRAMING = {
   spec: `You are reviewing a SPECIFICATION: it states WHAT the product must do and WHY, written for business stakeholders. By design it MUST NOT contain implementation detail (languages, frameworks, APIs, storage mechanics, code structure) \u2014 those decisions belong to the LATER plan stage.
@@ -3385,7 +4617,7 @@ OUT OF SCOPE here: re-litigating the approved spec or plan, and demanding refact
 SEVERITY: "critical" = breaks correctness, security or data integrity, or the task's requirement is not actually implemented. "medium" = a real defect or risk worth fixing now. "low" = style/polish.`
 };
 var REVIEW_MAX_TURNS = 15;
-var REVIEW_TIMEOUT_MS = 3 * 60 * 1e3;
+var REVIEW_TIMEOUT_MS = 10 * 60 * 1e3;
 function isDeadlineFailure(e) {
   return /within its deadline|timed? ?out/i.test(e instanceof Error ? e.message : String(e));
 }
@@ -3692,6 +4924,17 @@ ${ask}` };
   return d;
 }
 var TEAM_CONSENSUS = 0.7;
+var CORROBORATION_FLOOR = 5;
+function corroboratedCriticals(assessments) {
+  const criticals = assessments.flatMap((a) => a.findings.filter((f) => f.severity === "critical").map((f) => ({ lens: a.name, note: f.note })));
+  if (assessments.length < CORROBORATION_FLOOR) return criticals.length;
+  const bySubject = /* @__PURE__ */ new Map();
+  for (const c of criticals) {
+    const key2 = subjectOf(c.note) ?? `${c.lens}:${c.note.slice(0, 40)}`;
+    (bySubject.get(key2) ?? bySubject.set(key2, /* @__PURE__ */ new Set()).get(key2)).add(c.lens);
+  }
+  return [...bySubject.values()].filter((lenses) => lenses.size > 1).length;
+}
 var REVIEW_SIGNATURES_LOGGED = 8;
 var SIGNATURE_CHARS = 120;
 var COUNCIL_SUPERMAJORITY = 0.8;
@@ -3870,10 +5113,20 @@ async function changeUnderReview(deps, workdir) {
   return workingTreeDiff(workdir);
 }
 async function runCodeReview(deps, workdir, taskTitle, request, emit = () => {
-}, attempt = 0) {
+}, attempt = 0, cleared = []) {
   const diff = await changeUnderReview(deps, workdir);
-  const team = lensesFor(deps.teams.code, diff);
+  const scoped = lensesFor(deps.teams.code, diff);
+  const remaining = cleared.length ? scoped.filter((c) => !cleared.includes(c.name)) : scoped;
+  const named = scoped.filter((c) => CORE_CODE_LENSES.includes(c.name));
+  const core = named.length ? named : scoped.slice(0, CORE_CODE_LENSES.length);
+  const team = remaining.length ? remaining : core;
   const scaled = team.length < deps.teams.code.length;
+  if (!remaining.length) {
+    emit({ kind: "note", text: `\u{1F465} **Team** \u2014 every lens had approved; re-running the ${team.length} core lens(es) on the new code.` });
+  }
+  if (cleared.length) {
+    emit({ kind: "note", text: `\u{1F465} **Team** \u2014 ${team.length} lens(es) to re-run; ${cleared.length} approved on an earlier attempt.` });
+  }
   telemetry().event("decision.review_scale", {
     "hc.decision": "review_scale",
     "hc.changed_lines": changedLines(diff),
@@ -3887,22 +5140,30 @@ async function runCodeReview(deps, workdir, taskTitle, request, emit = () => {
   const approve = assessments.filter((a) => a.recommendation === "approve").length;
   const crit = severityTotal(assessments, "critical");
   const med = severityTotal(assessments, "medium");
+  const approvedLenses = [
+    ...cleared,
+    ...assessments.filter((a) => !a.unverified && !a.findings.some((f) => f.severity === "critical")).map((a) => a.name)
+  ];
   const cover = coverage(assessments);
   if (!cover.enough) {
     const why = `${cover.unverified} of ${assessments.length} lens(es) never returned a verdict \u2014 too little of the review ran to judge this change. Re-run it; if it keeps happening the lens's model chain is the fault.`;
     emit({ kind: "note", text: `\u26A0\uFE0F **Code review** \u2014 ${why}` });
     return { verdict: "fail", notes: [why] };
   }
-  if (crit === 0) {
-    const deferred = nonBlockingNotes(assessments, "code");
+  const corroborated = corroboratedCriticals(assessments);
+  if (crit > 0 && corroborated === 0) {
+    emit({ kind: "note", text: `\u2705 **Team** \u2014 ${crit} critical finding(s), none corroborated by a second lens \u2192 deferred to the revision pass.` });
+  }
+  if (corroborated === 0) {
+    const deferred = [...findingNotes(assessments, "code", ["critical"]), ...nonBlockingNotes(assessments, "code")];
     if (!deferred.length) {
       if (attempt > 0 || !assessments.length || approve / assessments.length >= TEAM_CONSENSUS) {
         emit({ kind: "note", text: `\u2705 **Team** \u2014 nothing to fix \u2192 the code passed.` });
-        return { verdict: "pass", notes: [] };
+        return { verdict: "pass", notes: [], approvedLenses };
       }
     }
-    emit({ kind: "note", text: `\u2705 **Team** \u2014 no critical findings; ${deferred.length} medium/low note(s) deferred to the revision pass.` });
-    return { verdict: "pass", notes: [], deferred };
+    emit({ kind: "note", text: `\u2705 **Team** \u2014 nothing corroborated; ${deferred.length} note(s) deferred to the revision pass.` });
+    return { verdict: "pass", notes: [], deferred, approvedLenses };
   }
   const reason = crit || med ? `surfaced ${crit} critical / ${med} medium finding(s)` : `is split (${approve}/${assessments.length} approve)`;
   emit({ kind: "note", text: `\u{1F465} **Team** ${reason} \u2192 handed the decision to the **council** (${deps.council.length} members vote).` });
@@ -3912,25 +5173,122 @@ async function runCodeReview(deps, workdir, taskTitle, request, emit = () => {
   const blocking = assessments.flatMap((a) => a.findings.filter((f) => f.severity !== "low").map((f) => `[${f.severity}] ${a.name}: ${f.note}`));
   if (tally === "pass") {
     emit({ kind: "note", text: `\u2705 **Council** voted to approve (${passVotes}/${votes.length} pass) \u2192 the code passed.` });
-    return { verdict: "pass", notes: [] };
+    return { verdict: "pass", notes: [], approvedLenses };
   }
   if (tally === "revise") {
     emit({ kind: "note", text: `\u{1F504} **Council** voted to revise (${votes.length - passVotes}/${votes.length}) \u2192 sending the code back.` });
-    return { verdict: "fail", notes: blocking.length ? blocking : votes.filter((v) => v.vote === "revise").map((v) => v.rationale) };
+    return {
+      verdict: "fail",
+      approvedLenses,
+      notes: blocking.length ? blocking : votes.filter((v) => v.vote === "revise").map((v) => v.rationale)
+    };
   }
   emit({ kind: "note", text: `\u{1F528} **Council** was split (${passVotes}/${votes.length} pass) \u2192 deferred the final decision to the **judge**.` });
   const d = await runJudge(deps, "code", workdir, taskTitle, assessments, votes, request, emit);
-  if (d.decision === "pass") return { verdict: "pass", notes: [] };
-  return { verdict: "fail", notes: d.feedback.length ? d.feedback : blocking };
+  if (d.decision === "pass") return { verdict: "pass", notes: [], approvedLenses };
+  return { verdict: "fail", approvedLenses, notes: d.feedback.length ? d.feedback : blocking };
 }
 
 // src/engine/acceptance.ts
-import { z as z16 } from "zod";
+import { z as z18 } from "zod";
+
+// src/engine/criterion-commands.ts
+import { spawn as spawn3 } from "child_process";
+var RUNNABLE_COMMANDS = [
+  "dotnet",
+  "npm",
+  "npx",
+  "pnpm",
+  "yarn",
+  "nx",
+  "prettier",
+  "eslint",
+  "tsc",
+  "cargo",
+  "go",
+  "make",
+  "mvn",
+  "gradle"
+];
+var SHELL_SYNTAX = /[;&|><$(){}\n]|`/;
+var CRITERION_TIMEOUT_MS = 10 * 60 * 1e3;
+var MAX_OUTPUT = 2e3;
+function commandsIn(criterion) {
+  const out = [];
+  for (const m of criterion.matchAll(/`([^`\n]+)`/g)) {
+    const span = m[1].trim();
+    if (!span || SHELL_SYNTAX.test(span)) continue;
+    const argv = span.split(/\s+/);
+    if (!RUNNABLE_COMMANDS.includes(argv[0])) continue;
+    out.push(argv);
+  }
+  return out;
+}
+async function runCommand(cwd, argv, timeoutMs = CRITERION_TIMEOUT_MS) {
+  const [bin, ...args] = argv;
+  return new Promise((resolve6) => {
+    let child;
+    try {
+      child = spawn3(bin, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, CI: "1" } });
+    } catch (e) {
+      resolve6({ argv, passed: false, exitCode: null, timedOut: false, output: e instanceof Error ? e.message : String(e) });
+      return;
+    }
+    let out = "";
+    const take = (d) => {
+      out += d.toString();
+      if (out.length > MAX_OUTPUT * 4) out = out.slice(-MAX_OUTPUT * 2);
+    };
+    child.stdout.on("data", take);
+    child.stderr.on("data", take);
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, timeoutMs);
+    child.on("error", (e) => {
+      clearTimeout(timer);
+      resolve6({ argv, passed: false, exitCode: null, timedOut: false, output: e.message });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve6({ argv, passed: !timedOut && code === 0, exitCode: code, timedOut, output: out.slice(-MAX_OUTPUT) });
+    });
+  });
+}
+async function runCriterionCommands(cwd, criteria, timeoutMs = CRITERION_TIMEOUT_MS) {
+  const seen = /* @__PURE__ */ new Set();
+  const argvs = [];
+  for (const c of criteria) {
+    for (const argv of commandsIn(c)) {
+      const key2 = argv.join(" ");
+      if (seen.has(key2)) continue;
+      seen.add(key2);
+      argvs.push(argv);
+    }
+  }
+  const runs = [];
+  for (const argv of argvs) runs.push(await runCommand(cwd, argv, timeoutMs));
+  return runs;
+}
+function describeCommandRuns(runs) {
+  if (!runs.length) return "";
+  const lines = runs.map((r) => {
+    const cmd = `\`${r.argv.join(" ")}\``;
+    if (r.timedOut) return `- ${cmd} \u2014 TIMED OUT after ${Math.round(CRITERION_TIMEOUT_MS / 6e4)} minutes.`;
+    if (r.passed) return `- ${cmd} \u2014 SUCCEEDED (exit 0).`;
+    return `- ${cmd} \u2014 FAILED (exit ${r.exitCode ?? "none"}):
+\`\`\`
+${r.output.slice(-800)}
+\`\`\``;
+  });
+  return "The harness has already RUN the commands these criteria name, to completion, and this is what happened. Use this as the evidence for any criterion about one of them \u2014 do not run it again, and do not report a criterion unmet because you could not wait for it:\n" + lines.join("\n");
+}
 
 // src/engine/test-runner.ts
 import { readFile as readFile3 } from "fs/promises";
 import { existsSync as existsSync9 } from "fs";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { join as join9 } from "path";
 var TEST_TIMEOUT_MS = 6e5;
 var MAX_TEST_OUTPUT = 12e3;
@@ -3962,7 +5320,7 @@ async function runProjectTests(cwd, cmd) {
   if (!command) return { skipped: true, passed: true, output: "", timedOut: false };
   const [bin, ...args] = command.argv;
   return new Promise((resolve6) => {
-    const child = spawn2(bin, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, CI: "1" } });
+    const child = spawn4(bin, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, CI: "1" } });
     let out = "";
     const take = (d) => {
       out += d.toString();
@@ -4016,20 +5374,28 @@ ${run.output}`;
 }
 
 // src/engine/acceptance.ts
-var AcceptanceSchema = z16.object({
-  checks: z16.array(z16.object({
-    criterion: z16.string(),
-    met: z16.boolean(),
-    evidence: z16.string().describe(
+function normalizeCriterion(s) {
+  return s.toLowerCase().replace(/[`*_]/g, "").replace(/\s+/g, " ").trim().replace(/[.,;:!?…]+$/, "");
+}
+var AcceptanceSchema = z18.object({
+  checks: z18.array(z18.object({
+    criterion: z18.string().describe(
+      "Copy the criterion VERBATIM from the numbered list you were given, including any backticks and punctuation. Do not paraphrase, renumber or reformat it \u2014 it is matched back to the task by text."
+    ),
+    met: z18.boolean(),
+    evidence: z18.string().describe(
       'Where you SAW it: a file path and what it contains, a symbol, a test name. "It looks fine" is not evidence.'
     )
   }))
 });
-var PROMPT = `You are the acceptance gate for one implementation task. You are given the task's acceptance criteria and read-only access to the worktree. For EACH criterion decide whether it is ACTUALLY satisfied by the code that is present, and cite the concrete evidence you saw (file path, symbol, test name, config key).
+var PROMPT2 = `You are the acceptance gate for one implementation task. You are given the task's acceptance criteria and the worktree. For EACH criterion decide whether it is ACTUALLY satisfied by the code that is present, and cite the concrete evidence you saw (file path, symbol, test name, config key).
 Rules:
 - Verify by LOOKING. If you did not open the file, the criterion is not met.
+- A criterion about a COMMAND is settled by the run reported to you above, not by looking and not by running it yourself. If that report says the command succeeded, the criterion is met; if it failed, quote the error. Never mark such a criterion unmet for want of waiting.
 - "met" means observably true right now \u2014 not "planned", "close enough" or "the implementer says so".
 - Judge ONLY the listed criteria. Code quality, style and scope opinions belong to the code review, not here.
+- Report EVERY criterion you were given \u2014 one check each, none dropped.
+- Copy each criterion into the "criterion" field VERBATIM from the numbered list, including any backticks and punctuation. It is matched back to the task by text; a paraphrase loses the pairing.
 - Write the evidence in ENGLISH (it is a technical record).`;
 async function verifyAcceptance(deps, card, cwd, emit = () => {
 }) {
@@ -4059,6 +5425,14 @@ ${tests.output.slice(-4e3)}`,
   if (!card.acceptance.length) return { passed: true, unmet: [], tests: testEvidence };
   const diff = deps.baseRef ? await taskDiff(cwd, deps.baseRef) : deps.inPlaceBase ? await diffSince(cwd, deps.inPlaceBase) : "";
   const resolved = deps.roleRegistry.resolve("code-reviewer");
+  const commandRuns = await telemetry().span(
+    "stage.criterion_commands",
+    { "hc.stage": "criterion commands" },
+    () => runCriterionCommands(cwd, card.acceptance)
+  );
+  for (const r of commandRuns) {
+    emit({ kind: "note", text: r.passed ? `\u2705 \`${r.argv.join(" ")}\` \u2014 exit 0` : `\u274C \`${r.argv.join(" ")}\` \u2014 ${r.timedOut ? "timed out" : `exit ${r.exitCode ?? "none"}`}` });
+  }
   const hints = memoryHints(deps, `${card.title} ${card.acceptance.join(" ")}`, { role: "code-reviewer" });
   const ask = { role: "user", content: `Task: "${card.title}".
 
@@ -4069,11 +5443,13 @@ Check each one against the worktree and report met/unmet with the evidence you s
 
 ${describeTestRun(tests)}
 
+${describeCommandRuns(commandRuns)}
+
 ${describeDiff(diff)}` };
   const opts = {
     provider: deps.provider,
     ...resolved,
-    systemPrompt: `${PROMPT}${deps.roleRegistry.ruleSuffix()}`,
+    systemPrompt: `${PROMPT2}${deps.roleRegistry.ruleSuffix()}`,
     tools: readOnlyRegistry(deps),
     messages: hints.message ? [{ role: "user", content: hints.message }, ask] : [ask],
     permission: deps.permission,
@@ -4095,10 +5471,25 @@ ${describeDiff(diff)}` };
       tests: testEvidence
     };
   }
-  const byCriterion = new Map(checks.map((c) => [c.criterion.trim().toLowerCase(), c]));
+  const byCriterion = new Map(checks.map((c) => [normalizeCriterion(c.criterion), c]));
+  const paired = /* @__PURE__ */ new Map();
+  const usedChecks = /* @__PURE__ */ new Set();
+  const unpairedCriteria = [];
+  for (const c of card.acceptance) {
+    const key2 = normalizeCriterion(c);
+    const hit = byCriterion.get(key2) ?? checks.find((x) => normalizeCriterion(x.criterion).includes(key2.slice(0, 40)));
+    if (hit) {
+      paired.set(c, hit);
+      usedChecks.add(hit);
+    } else unpairedCriteria.push(c);
+  }
+  const unusedChecks = checks.filter((x) => !usedChecks.has(x));
+  if (unpairedCriteria.length === 1 && unusedChecks.length === 1) {
+    paired.set(unpairedCriteria[0], unusedChecks[0]);
+  }
   const unmet = [];
   for (const c of card.acceptance) {
-    const hit = byCriterion.get(c.trim().toLowerCase()) ?? checks.find((x) => x.criterion.toLowerCase().includes(c.trim().toLowerCase().slice(0, 40)));
+    const hit = paired.get(c);
     if (!hit) unmet.push(`${c} (not reported by the acceptance gate)`);
     else if (!hit.met) unmet.push(`${c} \u2014 ${hit.evidence}`);
   }
@@ -4161,9 +5552,18 @@ async function runCycleWithRole(deps, board, taskId, cwd, role, git = defaultGit
   deps.fitness?.ok(role, deps.roleRegistry.chainFor(role, rotation)[0] ?? "");
   board.move(taskId, "REVIEW", role);
   const card = board.get(taskId);
-  const review = () => runCodeReview(rdeps, cwd, card.title, void 0, (ev) => {
-    if (ev.kind === "note") deps.note?.(ev.text);
-  }, card.attempts);
+  const review = () => runCodeReview(
+    rdeps,
+    cwd,
+    card.title,
+    void 0,
+    (ev) => {
+      if (ev.kind === "note") deps.note?.(ev.text);
+    },
+    card.attempts,
+    // Only what objected last time is asked again — see `runCodeReview`'s `cleared`.
+    card.clearedLenses ?? []
+  );
   let v;
   try {
     v = await telemetry().span(
@@ -4186,6 +5586,8 @@ async function runCycleWithRole(deps, board, taskId, cwd, role, git = defaultGit
     board.appendStage(taskId, { role: "code-reviewer", action: "reviewed:cancelled", note });
     return { verdict: "fail", notes: [note] };
   }
+  const approved = v.approvedLenses ?? [];
+  if (approved.length) board.markLensesCleared(taskId, approved);
   if (v.verdict === "pass") {
     const check = () => verifyAcceptance(rdeps, board.get(taskId), cwd, (ev) => {
       if (ev.kind === "note") deps.note?.(ev.text);
@@ -4229,28 +5631,31 @@ async function runTaskCycle(deps, board, taskId, worktreePath, slot = 0) {
 }
 
 // src/board/board.ts
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 var MAX_STAGE_EVENTS = 200;
-var stageEventSchema = z17.object({
-  role: z17.string(),
-  action: z17.string(),
-  note: z17.string().optional()
+var stageEventSchema = z19.object({
+  role: z19.string(),
+  action: z19.string(),
+  note: z19.string().optional()
 });
-var cardSchema = z17.object({
-  id: z17.string(),
-  title: z17.string(),
-  column: z17.enum(["TODO", "IN-PROGRESS", "REVIEW", "DONE", "MERGED", "PARKED", "ABANDONED"]),
-  worktree: z17.string().optional(),
-  deps: z17.array(z17.string()),
-  acceptance: z17.array(z17.string()).default([]),
+var cardSchema = z19.object({
+  id: z19.string(),
+  title: z19.string(),
+  column: z19.enum(["TODO", "IN-PROGRESS", "REVIEW", "DONE", "MERGED", "PARKED", "ABANDONED"]),
+  worktree: z19.string().optional(),
+  deps: z19.array(z19.string()),
+  acceptance: z19.array(z19.string()).default([]),
   // default: boards persisted before the gate existed still load
-  files: z17.array(z17.string()).default([]),
+  files: z19.array(z19.string()).default([]),
   // ditto — a board written before file lists existed still loads
-  reviewNotes: z17.array(z17.string()),
-  attempts: z17.number(),
-  stageHistory: z17.array(stageEventSchema)
+  reviewNotes: z19.array(z19.string()),
+  // Optional rather than defaulted: a board written before this existed must round-trip unchanged, and an
+  // empty list is the same statement as no list at all.
+  clearedLenses: z19.array(z19.string()).optional(),
+  attempts: z19.number(),
+  stageHistory: z19.array(stageEventSchema)
 });
-var boardDataSchema = z17.object({ version: z17.literal(1), cards: z17.array(cardSchema) });
+var boardDataSchema = z19.object({ version: z19.literal(1), cards: z19.array(cardSchema) });
 function migrateDelivered(c) {
   if (c.column !== "DONE") return c;
   return c.stageHistory.some((e) => e.action === "merged") ? { ...c, column: "MERGED" } : c;
@@ -4262,6 +5667,7 @@ function cloneCard(c) {
     acceptance: [...c.acceptance],
     files: [...c.files],
     reviewNotes: [...c.reviewNotes],
+    ...c.clearedLenses?.length ? { clearedLenses: [...c.clearedLenses] } : {},
     stageHistory: c.stageHistory.map((e) => ({ ...e }))
   };
 }
@@ -4377,6 +5783,12 @@ var Board = class _Board {
     this.require(id).reviewNotes = [];
     this.onChange?.();
   }
+  /** Remember which lenses approved, so the next attempt does not ask them again. */
+  markLensesCleared(id, lenses) {
+    const c = this.require(id);
+    c.clearedLenses = [.../* @__PURE__ */ new Set([...c.clearedLenses ?? [], ...lenses])];
+    this.onChange?.();
+  }
   /**
    * Starts the escalation ladder over for one card, keeping its history.
    *
@@ -4411,19 +5823,17 @@ var Board = class _Board {
 };
 
 export {
+  checkProfile,
+  runLogin,
+  SHORT_CALL_MS,
+  LONG_CALL_MS,
+  cliCatalog,
+  CliProvider,
   describeInherited,
   describeTopUp,
   toSlug,
   mainWorktreeRoot,
   WorktreeManager,
-  applySkills,
-  buildSkillTool,
-  RoleRegistry,
-  unfinishedSessions,
-  describeUnfinished,
-  gitTool,
-  buildRememberTool,
-  routeSkills,
   REQUIRED_ROLES,
   DEFAULT_ROLE_SKILLS,
   DEFAULT_PROMPTS,
@@ -4432,6 +5842,26 @@ export {
   CODE_TEAM,
   DEFAULT_COUNCIL,
   placedSkills,
+  ROLE_PROFILES,
+  filterModelsForRole,
+  effortFor,
+  isKnownModel,
+  capabilityScore,
+  mostCapable,
+  modelBand,
+  DURABLE_ROLES,
+  strongestPrimary,
+  newestPrimary,
+  sourceOf,
+  adjustRoleModels,
+  applySkills,
+  buildSkillTool,
+  RoleRegistry,
+  unfinishedSessions,
+  describeUnfinished,
+  gitTool,
+  buildRememberTool,
+  routeSkills,
   specsDir,
   constitutionPath,
   verifyPaths,
@@ -4442,6 +5872,7 @@ export {
   readOnlyRegistry,
   deferMcp,
   runReviewer,
+  subjectOf,
   asChoice,
   buildTeamRegistry,
   buildCouncilRegistry,
@@ -4453,8 +5884,11 @@ export {
   createDefaultRegistry,
   changedByMerge,
   refreshAfterChange,
-  LONG_CALL_MS,
   routeTask,
+  normalizeQuestion,
+  extractChoicesFrom,
+  buildAskUserTool,
+  writerRegistry,
   commitFile,
   commitStep,
   squashTask,