@ionivetech/mugiwara 0.6.0 → 0.6.2

package/scripts/savepoint.sh

@@ -7,6 +7,14 @@ die() { echo "savepoint: $*" >&2; exit 1; }
 
 MUGIWARA_DIR="${MUGIWARA_DIR:-.mugiwara}"
 
+# --- git identity for actor attribution ---
+# Resolve once from repo git config; used when no actor is passed explicitly.
+# GIT_AUTHOR_NAME is an env var usually unset — falling through to $USER
+# attributes the savepoint to the OS user instead of the git identity.
+GIT_NAME="$(git config user.name 2>/dev/null || true)"
+GIT_EMAIL="$(git config user.email 2>/dev/null || true)"
+if [ -n "$GIT_NAME" ] && [ -n "$GIT_EMAIL" ]; then GIT_ID="$GIT_NAME <$GIT_EMAIL>"; else GIT_ID="$GIT_NAME"; fi
+
 # --- parse mission args ---
 # --branch flag must parse FIRST — it shifts positionals
 BRANCH_MODE=0
@@ -14,13 +22,13 @@ if [ "${1:-}" = "--branch" ]; then
   BRANCH_MODE=1
   shift
   MISSION="${1:-${STATE_MISSION:-}}"
-  ACTOR="${2:-${STATE_ACTOR:-${GIT_AUTHOR_NAME:-${USER:-}}}}"
+  ACTOR="${2:-${STATE_ACTOR:-${GIT_AUTHOR_NAME:-${GIT_ID:-${USER:-}}}}}"
   BRANCH="${3:-$(git branch --show-current 2>/dev/null || echo 'unknown')}"
   WAVE="${4:-${STATE_WAVE:-1}}"
   MODE="${5:-${STATE_MODE:-guided}}"
 else
   MISSION="${1:-${STATE_MISSION:-}}"
-  ACTOR="${2:-${STATE_ACTOR:-${GIT_AUTHOR_NAME:-${USER:-}}}}"
+  ACTOR="${2:-${STATE_ACTOR:-${GIT_AUTHOR_NAME:-${GIT_ID:-${USER:-}}}}}"
   BRANCH="${3:-$(git branch --show-current 2>/dev/null || echo 'unknown')}"
   WAVE="${4:-${STATE_WAVE:-1}}"
   MODE="${5:-${STATE_MODE:-guided}}"
@@ -31,6 +39,11 @@ fi
 case "$MISSION" in
   ""|*[!a-zA-Z0-9._-]*) die "invalid mission name \"$MISSION\" (allowlist: [a-zA-Z0-9._-])" ;;
 esac
+# dot-only names (".", "..", "...") pass the char allowlist but resolve upward
+# through join(...,"..") — reject them before any path is built from MISSION.
+if [[ "$MISSION" =~ ^\.+$ ]]; then
+  die "invalid mission name \"$MISSION\" (allowlist: [a-zA-Z0-9._-], not a dot-path)"
+fi
 
 # per-branch state file when --branch used
 BRANCH_SLUG=$(echo "$BRANCH" | tr '/' '-')
@@ -59,20 +72,35 @@ if [ "$BASE_SHA" != "unknown" ]; then
 fi
 [ -z "$LOC_DELTA" ] && LOC_DELTA=0
 
-SENSITIVE_PATTERNS="auth/|payment/|billing/|crypto/|secrets/|\.env|config/|migration/|\.sql$|schema\.|\.prisma$"
+SENSITIVE_PATTERNS="auth/|payment/|billing/|crypto/|secrets/|\.env$|config/.*key|migration/|\.sql$|schema\.|\.prisma$|\.terraform|\.tf$"
 SENSITIVE_PATHS=$(echo "$CHANGED_FILES" | grep -E "$SENSITIVE_PATTERNS" 2>/dev/null | tr '\n' ',' | sed 's/,$//' || true)
 
 LANE="direct"
 LANE_REASON=""
-if [ "$FILES_TOUCHED" -ge 9 ] 2>/dev/null || [ -n "$SENSITIVE_PATHS" ]; then
+# Sensitive-path escalation is unconditional — it wins over any count-based
+# lane AND over the docs-only downgrade below (bug C9).
+if [ -n "$SENSITIVE_PATHS" ]; then
   LANE="full"
-  LANE_REASON="$( [ -n "$SENSITIVE_PATHS" ] && echo "sensitive paths: $SENSITIVE_PATHS" || echo "$FILES_TOUCHED files")"
+  LANE_REASON="sensitive paths: $SENSITIVE_PATHS"
+elif [ "$FILES_TOUCHED" -ge 9 ] 2>/dev/null; then
+  LANE="full"
+  LANE_REASON="$FILES_TOUCHED files"
 elif [ "$FILES_TOUCHED" -ge 3 ] 2>/dev/null; then
   LANE="standard"
   LANE_REASON="$FILES_TOUCHED files"
 elif [ "$FILES_TOUCHED" -ge 2 ] 2>/dev/null; then
   LANE="lean"
   LANE_REASON="$FILES_TOUCHED files"
+elif [ "$FILES_TOUCHED" -eq 1 ] 2>/dev/null; then
+  # 1-file rule mirrors lane.sh: >=20 added LOC -> lean, else direct
+  ADDED=$(git diff --numstat "$BASE_SHA"..HEAD 2>/dev/null | awk '{s+=$1} END {print s+0}')
+  if [ "${ADDED:-0}" -ge 20 ] 2>/dev/null; then
+    LANE="lean"
+    LANE_REASON="1 file, $ADDED LOC"
+  else
+    LANE="direct"
+    LANE_REASON="1 file, <20 LOC"
+  fi
 else
   LANE="direct"
   LANE_REASON="$FILES_TOUCHED file(s) under 20 LOC"
@@ -82,7 +110,7 @@ fi
 # surface never escalate to full from file count alone; sensitive-path
 # escalation above still wins.
 PRODUCT_PAT="^content/|^src/|^scripts/|^test/|^hooks/|^\.opencode/|^\.claude/|^evals/"
-if [ "$LANE" = "full" ] && [ -n "$CHANGED_FILES" ]; then
+if [ "$LANE" = "full" ] && [ -z "$SENSITIVE_PATHS" ] && [ -n "$CHANGED_FILES" ]; then
   CODE_COUNT=$(echo "$CHANGED_FILES" | grep -E "$PRODUCT_PAT" 2>/dev/null | grep -c . || true)
   if [ -z "$CODE_COUNT" ] || [ "$CODE_COUNT" -eq 0 ] 2>/dev/null; then
     PREV="$LANE"
@@ -91,20 +119,26 @@ if [ "$LANE" = "full" ] && [ -n "$CHANGED_FILES" ]; then
   fi
 fi
 
-# task counts from plan doc
-PLAN_FILE=$(ls "$MUGIWARA_DIR/plans/${MISSION}.md" 2>/dev/null || true)
+# task counts from plan doc — plan is written date-prefixed (plans/YYYY-MM-DD-<mission>.md)
+# or bare (plans/<mission>.md); glob both, first match wins.
+PLAN_FILE=$(ls "$MUGIWARA_DIR"/plans/${MISSION}.md "$MUGIWARA_DIR"/plans/*-${MISSION}.md 2>/dev/null | head -1 || true)
 TASKS_DONE=0
 TASKS_TOTAL=0
 if [ -n "$PLAN_FILE" ] && [ -f "$PLAN_FILE" ]; then
-  TASKS_TOTAL=$(grep -c '\[ \]' "$PLAN_FILE" 2>/dev/null || echo 0)
-  TASKS_DONE=$(grep -c '\[x\]' "$PLAN_FILE" 2>/dev/null || echo 0)
+  # total counts ALL task lines (checked + unchecked); done counts checked only.
+  # A fully-completed plan must read total=N done=N, never total=0 (the old
+  # unchecked-only grep degenerated a done plan to tasks.total=0).
+  TASKS_TOTAL=$(grep -cE '^\s*-\s*\[[ xX]\]' "$PLAN_FILE" 2>/dev/null || true)
+  TASKS_DONE=$(grep -c '\[x\]' "$PLAN_FILE" 2>/dev/null || true)
 fi
 
 # blocker count
 BLOCKERS_FILE=$(ls "$MUGIWARA_DIR/issues/${MISSION}-blockers.md" 2>/dev/null || true)
 BLOCKERS_OPEN=0
 if [ -n "$BLOCKERS_FILE" ] && [ -f "$BLOCKERS_FILE" ]; then
-  BLOCKERS_OPEN=$(grep -c '|' "$BLOCKERS_FILE" 2>/dev/null || echo 0)
+  # data rows start with a wave number; header "| wave |" and separator
+  # "|---|" are excluded by the ^\| ?[0-9]+ \| pattern
+  BLOCKERS_OPEN=$(grep -cE '^\| ?[0-9]+ ?\|' "$BLOCKERS_FILE" 2>/dev/null || true)
 fi
 
 # heal cycle — count WAVE-8 banner occurrences in the trace, not the word
@@ -113,7 +147,7 @@ fi
 HEAL_CYCLE=1
 TRACE_FILE=$(ls "$MUGIWARA_DIR/results/${MISSION}/"*trace*.md 2>/dev/null | head -1 || true)
 if [ -n "$TRACE_FILE" ] && [ -f "$TRACE_FILE" ]; then
-  HEAL_COUNT=$(grep -ci '^.*Wave 8.*\|wave 8' "$TRACE_FILE" 2>/dev/null || echo 0)
+  HEAL_COUNT=$(grep -ci '^.*Wave 8.*\|wave 8' "$TRACE_FILE" 2>/dev/null || true)
   HEAL_CYCLE=$((HEAL_COUNT + 1))
 fi
 
@@ -132,8 +166,25 @@ if [ -f package.json ]; then
   [ -f "$PKG_JSON" ] && SKILL_VERSION=$(node -e "try{console.log(JSON.parse(require('fs').readFileSync(process.argv[1],'utf8')).version.split('.')[0])}catch(e){console.log('1')}" "$PKG_JSON" 2>/dev/null || echo "1")
 fi
 
-# tokens from env var (harness exports estimated tokens consumed)
-TOKENS_EST=${MUGIWARA_TOKENS:-0}
+# tokens proxy (F7): deterministic estimate when the harness does not report
+# real usage. Monotonic beats precise — LANE_BASE stands in for the skills
+# loaded this lane; loc_delta and written-artifact words scale with growth.
+# MUGIWARA_TOKENS overrides as the reported value.
+LANE_BASE=0
+case "$LANE" in
+  lean) LANE_BASE=1500 ;;
+  standard) LANE_BASE=4000 ;;
+  full) LANE_BASE=9000 ;;
+  spike) LANE_BASE=1000 ;;
+esac
+DOC_WORDS=$(cat "$MUGIWARA_DIR"/results/${MISSION}/*.md "$MUGIWARA_DIR"/plans/${MISSION}.md "$MUGIWARA_DIR"/plans/*-${MISSION}.md "$MUGIWARA_DIR"/spec/${MISSION}.md "$MUGIWARA_DIR"/spec/*-${MISSION}.md "$MUGIWARA_DIR"/logs/${MISSION}.md "$MUGIWARA_DIR"/logs/*-${MISSION}.md 2>/dev/null | wc -w | tr -d ' ')
+LOC_TOKENS=$(( LOC_DELTA > 0 ? LOC_DELTA * 12 : 0 ))
+TOKENS_SOURCE="computed"
+TOKENS_EST=$(( LANE_BASE + DOC_WORDS * 135 / 100 + LOC_TOKENS ))
+if [ -n "${MUGIWARA_TOKENS:-}" ]; then
+  TOKENS_EST="${MUGIWARA_TOKENS}"
+  TOKENS_SOURCE="reported"
+fi
 
 # budget per lane
 BUDGET=0
@@ -191,6 +242,7 @@ const data = {
   blockers_open: parseInt(process.argv[15], 10),
   heal_cycle: parseInt(process.argv[16], 10),
   tokens_est: parseInt(process.argv[17], 10) || 0,
+  tokens_source: process.argv[26] || 'computed',
   budget: parseInt(process.argv[18], 10) || 0,
   budget_status: process.argv[19],
   skill_version: process.argv[20],
@@ -205,7 +257,7 @@ require('fs').writeFileSync(process.argv[23], JSON.stringify(data, null, 2) + '\
   "$BLOCKERS_OPEN" "$HEAL_CYCLE" "$TOKENS_EST" "$BUDGET" \
   "$STATUS" "$SKILL_VERSION" "$EVIDENCE" \
   "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-  "$STATE_FILE" "$LANE_PREV" "$LANE_ROSE"
+  "$STATE_FILE" "$LANE_PREV" "$LANE_ROSE" "$TOKENS_SOURCE"
 
 if [ "$LANE_ROSE" = true ]; then
   echo "⚠ LANE ROSE: $LANE_PREV → $LANE ($LANE_REASON) — escalate per check-in protocol"

package/scripts/validate-content.ts

@@ -27,6 +27,7 @@ function checkFile(file: string, wantName: string, kind: 'skill' | 'agent'): Rec
     if (bullets.length === 0) errors.push(`skill ${file}: "## Skip when" needs ≥1 bullet`);
     if (bullets.length > 4) errors.push(`skill ${file}: "## Skip when" block exceeds 4 bullets`);
   }
+  if (kind === 'skill' && !body.includes('## Red flags')) errors.push(`skill ${file}: missing required "## Red flags" block`);
   if (kind === 'skill') {
     const lines = body.split(/\r?\n/);
     const headingRe = /^## /;
@@ -145,6 +146,25 @@ for (const f of agentFiles) {
   if (scope === 'source' && !SOURCE_SCOPED.has(name)) errors.push(`agent ${f}: only zoro-execution and brook-healing may declare write-scope: source`);
 }
 
+// --- write-boundary gate (W1): the hub skill must carry the refusal rule ---
+const hubFile = join(root, 'skills', 'mugiwara-orchestration', 'SKILL.md');
+if (existsSync(hubFile) && !readFileSync(hubFile, 'utf8').includes('## Write boundary')) {
+  errors.push('skill mugiwara-orchestration: missing "## Write boundary" section (non-executors refuse source writes)');
+}
+
+// --- agent-count gate (F14): user-facing/internal split derivable from content/agents/ ---
+const internalAgents = agentFiles.filter(f => {
+  const parsed = parseFrontmatter(readFileSync(join(agentDir, f), 'utf8'));
+  return parsed.data.internal === 'true';
+});
+const canonicalCount = `${agentFiles.length - internalAgents.length} agents (+${internalAgents.length} internal)`;
+for (const doc of ['README.md', 'docs/index.md', 'docs/concepts/agents.md']) {
+  const p = join(import.meta.dirname, '..', doc);
+  if (existsSync(p) && !readFileSync(p, 'utf8').includes(canonicalCount)) {
+    errors.push(`${doc}: missing canonical agent count "${canonicalCount}"`);
+  }
+}
+
 // --- hub-rule gate (F3): every non-Luffy agent carries both hub sections ---
 for (const f of agentFiles) {
   const name = f.replace(/\.md$/, '');

package/src/cli.ts

@@ -7,15 +7,15 @@ import { fileURLToPath } from 'node:url';
 import { parseArgs, type FlagValue, type Args } from './args.ts';
 import { createRl, choose, multiChoose, confirm } from './prompt.ts';
 import { targets, TARGET_IDS } from './targets/index.ts';
-import { installTo, removeInstalled, VERSION } from './installer.ts';
+import { installTo, removeInstalled, VERSION, ensureProjectGitignore } from './installer.ts';
 import { manifestPath, readManifest, writeManifest, type Scope } from './manifest.ts';
-import { resetMission } from './mission.ts';
+import { resetMission, archiveMission } from './mission.ts';
 
 const str = (v: FlagValue): string | undefined => (typeof v === 'string' ? v : undefined);
 const flag = (v: FlagValue): boolean => v === true;
 
 export async function run(argv: string[]): Promise<void> {
-  const { command, flags } = parseArgs(argv);
+  const { command, flags, _ } = parseArgs(argv);
   if (flag(flags.help) || command === 'help') return help();
   if (flag(flags.version)) { console.log(`mugiwara ${VERSION}`); return; }
   switch (command) {
@@ -24,6 +24,7 @@ export async function run(argv: string[]): Promise<void> {
     case 'uninstall': return uninstall(flags);
     case 'list': return list(flags);
     case 'reset': return resetCmd(flags);
+    case 'archive': return archive(flags, _);
     default: throw new Error(`Unknown command: ${command}`);
   }
 }
@@ -41,6 +42,17 @@ function resetCmd(flags: Args['flags']): void {
   if (result.kept.length) console.log(`kept: ${result.kept.join(', ')}`);
 }
 
+function archive(flags: Args['flags'], positionals: string[]): void {
+  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const mission = positionals[1];
+  if (!mission) { console.error('usage: mugiwara archive <mission> [--project <dir>] [--dry-run]'); process.exit(1); }
+  const result = archiveMission(projectDir, mission, { dryRun: flag(flags.dryRun) });
+  if (result.report) console.log(`archive target: ${result.report}`);
+  if (result.removed.length) console.log(`${flag(flags.dryRun) ? 'would remove' : 'removed'}: ${result.removed.join(', ')}`);
+  if (result.kept.length) console.log(`kept: ${result.kept.join(', ')}`);
+  if (result.index) console.log(`index updated: ${result.index}`);
+}
+
 async function resolveOptions(flags: Args['flags']): Promise<{ scope: Scope; projectDir: string; targetIds: string[] }> {
   const interactive = !flag(flags.yes);
   if (interactive && !process.stdin.isTTY) {
@@ -95,6 +107,10 @@ async function install(flags: Args['flags']): Promise<void> {
     allFiles.push(...r.written);
     allNotes.push(...r.notes);
   }
+  if (scope === 'project') {
+    const gi = ensureProjectGitignore(projectDir, { dryRun: flag(flags.dryRun) });
+    allNotes.push(...gi.notes);
+  }
   if (flag(flags.dryRun)) { console.log('\nDry run — nothing written.'); return; }
   const file = manifestPath({ scope, projectDir, home });
   const prev = readManifest(file);
@@ -182,6 +198,7 @@ Usage:
   mugiwara list          show installations
   mugiwara list --check  health check: show installations + missing files
   mugiwara reset         wipe mission state (spec/plans/results/review/issues[/logs])
+  mugiwara archive <m>    fold a closed mission's evidence into its report, then remove loose files
   mugiwara --help        this help
   mugiwara --version     print version
 

package/src/installer.ts

@@ -1,5 +1,5 @@
 // src/installer.ts
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, copyFileSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, copyFileSync, rmSync, lstatSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -171,3 +171,39 @@ export function removeInstalled(manifest: { files: string[] }, { dryRun = false
   }
   return removed;
 }
+
+function assertNotSymlink(file: string): void {
+  if (!existsSync(file)) return;
+  try {
+    if (lstatSync(file).isSymbolicLink()) throw new Error(`refusing to follow symlink: ${file}`);
+  } catch (e) {
+    if ((e as { code?: string }).code === 'ENOENT') return;
+    throw e;
+  }
+}
+
+const GITIGNORE_MARKER = '# mugiwara';
+const GITIGNORE_BLOCK = `# mugiwara — audit trail is the product: commit reports/, results/, logs/, spec/, plans/.
+# Ignore session state and regenerated files.
+.mugiwara/state.json
+.mugiwara/state-*.json
+.mugiwara/config
+.mugiwara/continue.md
+.mugiwara/refs/
+`;
+
+export function ensureProjectGitignore(projectDir: string, opts: { dryRun?: boolean } = {}): { appended: boolean; notes: string[] } {
+  const { dryRun = false } = opts;
+  const path = join(projectDir, '.gitignore');
+  assertNotSymlink(path);
+  if (existsSync(path) && readFileSync(path, 'utf8').includes(GITIGNORE_MARKER)) {
+    return { appended: false, notes: [] };
+  }
+  const existing = existsSync(path) ? readFileSync(path, 'utf8') : '';
+  const separator = existing.length && !existing.endsWith('\n') ? '\n' : '';
+  if (!dryRun) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, existing + separator + GITIGNORE_BLOCK);
+  }
+  return { appended: true, notes: [`.gitignore ${dryRun ? 'would append' : 'appended'} mugiwara audit-trail block`] };
+}

package/src/mission.ts

@@ -1,6 +1,6 @@
 // src/mission.ts
 // Mission-state helpers for the mugiwara CLI (installer + reset only).
-import { existsSync, rmSync, readFileSync, readdirSync } from 'node:fs';
+import { existsSync, rmSync, readFileSync, readdirSync, mkdirSync, appendFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 function activeActor(projectDir: string): string | null {
@@ -48,3 +48,110 @@ export function resetMission(projectDir: string, keepLogs: boolean, force?: bool
   }
   return { removed, kept };
 }
+
+export function archiveMission(projectDir: string, mission: string, opts: { dryRun?: boolean } = {}): { report: string | null; removed: string[]; kept: string[]; index?: string } {
+  const { dryRun = false } = opts;
+  const root = join(projectDir, '.mugiwara');
+  // mission allowlist — same as savepoint.sh / mission-report.sh. Dot-only
+  // names (".", "..") would resolve upward through join(...,"..") and let
+  // rmSync reach state.json/config outside the mission dir.
+  if (!mission || /[^a-zA-Z0-9._-]/.test(mission) || /^\.+$/.test(mission)) throw new Error(`invalid mission name "${mission}" (allowlist: [a-zA-Z0-9._-], not a dot-path)`);
+  const removed: string[] = [];
+  const kept: string[] = [];
+
+  // A file belongs to this mission when stripping the optional YYYY-MM-DD-
+  // prefix leaves `<mission>.md` or `<mission>-<suffix>.md`. Covers both the
+  // bare names and the date-prefixed names the prose writes (audit-trail.md).
+  const belongs = (f: string): boolean => {
+    const base = f.replace(/^\d{4}-\d{2}-\d{2}-/, '');
+    return base === `${mission}.md` || base.startsWith(`${mission}-`);
+  };
+
+  // locate the report (the archive target that must survive). Reports are
+  // date-prefixed (`reports/YYYY-MM-DD-<mission>.md`); compare the stripped
+  // mission name so `bar-foo.md` is not mistaken for mission `foo`.
+  let report: string | null = null;
+  const reportsDir = join(root, 'reports');
+  if (existsSync(reportsDir)) {
+    const f = readdirSync(reportsDir).find(n => {
+      const m = n.match(/^(\d{4}-\d{2}-\d{2})-(.+)\.md$/);
+      return !!m && m[2] === mission;
+    });
+    if (f) report = join('reports', f);
+  }
+
+  // step results 01..05 + todos.md are evidence — kept; archive removes
+  // only spec/review/issues/logs/continue.md
+  const resultsDir = join(root, 'results', mission);
+  if (existsSync(resultsDir)) {
+    for (const f of readdirSync(resultsDir)) {
+      kept.push(join('results', mission, f));
+    }
+  }
+
+  // spec, review, issues, per-mission decision log — bare + date-prefixed
+  const specDir = join(root, 'spec');
+  if (existsSync(specDir)) {
+    for (const f of readdirSync(specDir)) {
+      if (!belongs(f)) continue;
+      const p = join(specDir, f);
+      if (!dryRun) rmSync(p);
+      removed.push(join('spec', f));
+    }
+  }
+
+  for (const dir of ['review', 'issues']) {
+    const d = join(root, dir);
+    if (!existsSync(d)) continue;
+    for (const f of readdirSync(d)) {
+      if (!belongs(f)) continue;
+      const p = join(d, f);
+      if (!dryRun) rmSync(p, { force: true });
+      removed.push(join(dir, f));
+    }
+  }
+
+  const logsDir = join(root, 'logs');
+  if (existsSync(logsDir)) {
+    for (const f of readdirSync(logsDir)) {
+      if (!belongs(f)) continue;
+      const p = join(logsDir, f);
+      if (!dryRun) rmSync(p);
+      removed.push(join('logs', f));
+    }
+  }
+
+  // continue.md is a session handoff — only remove it if it belongs to THIS
+  // mission (its content references the mission name); otherwise leave it.
+  const cont = join(root, 'continue.md');
+  if (existsSync(cont)) {
+    try {
+      if (readFileSync(cont, 'utf8').includes(mission)) {
+        if (!dryRun) rmSync(cont);
+        removed.push('continue.md');
+      }
+    } catch { /* unreadable — leave it */ }
+  }
+
+  // kept: report + the audit-trail survivors
+  if (report) kept.push(report);
+  for (const k of ['plans', 'config', 'state.json', join('logs', 'lessons.md')]) {
+    if (existsSync(join(root, k))) kept.push(k);
+  }
+
+  // summary index: append one line per archived mission (retention aid),
+  // idempotently — never duplicate a line for an already-indexed mission.
+  let index: string | undefined;
+  const indexFile = join(root, 'reports', 'index.md');
+  const line = `- ${mission} — ${new Date().toISOString().slice(0, 10)}${report ? ` → ${report}` : ''}\n`;
+  if (!dryRun) {
+    mkdirSync(join(root, 'reports'), { recursive: true });
+    const existing = existsSync(indexFile) ? readFileSync(indexFile, 'utf8') : '';
+    if (!existing.split(/\r?\n/).some(l => l.startsWith(`- ${mission} —`))) {
+      const header = existing ? '' : '# Mission index\n\n';
+      appendFileSync(indexFile, header + line);
+    }
+    index = join('reports', 'index.md');
+  }
+  return { report, removed, kept, index };
+}

package/src/targets/claude.ts

@@ -6,9 +6,19 @@ import { stringifyFrontmatter, type FrontmatterData } from '../frontmatter.ts';
 import type { Target } from '../installer.ts';
 
 const here = dirname(fileURLToPath(import.meta.url));
-const HOOK_SRC = join(here, '..', '..', 'hooks', 'session-start.ts');
+const HOOKS_SRC = join(here, '..', '..', 'hooks');
 const COMMANDS_SRC = join(here, '..', '..', '.claude', 'commands');
 
+// Claude Code has no path-scoped permission. write-scope maps to a partial
+// `tools:` list — applied to internal subagent-only agents only: artifacts
+// agents lose Edit (cannot modify existing source) but keep Write (must create
+// .mugiwara/**). User-facing crew run inline in the main thread and keep the
+// default toolset (incl. Edit); discipline is enforced by rules, not tools.
+function toolsFromScope(scope?: string): string | undefined {
+  if (scope === 'artifacts') return 'Read, Grep, Glob, Write, Bash, WebFetch, WebSearch';
+  return undefined;
+}
+
 export const target: Target = {
   id: 'claude',
   label: 'Claude Code',
@@ -27,6 +37,10 @@ export const target: Target = {
   transformAgent(data: FrontmatterData, body: string) {
     const fm: FrontmatterData = { name: data.name, description: data.description };
     if (data.tools) fm.tools = data.tools;
+    else if (data['internal-agent'] === 'true') {
+      const generated = toolsFromScope(data['write-scope']);
+      if (generated) fm.tools = generated;
+    }
     return { relPath: `${data.name}.md`, text: stringifyFrontmatter(fm, body) };
   },
   refsDir({ scope, projectDir, home }, skillName: string) {
@@ -34,17 +48,24 @@ export const target: Target = {
     return join(root, 'skills', skillName, 'references');
   },
   postInstall({ scope, projectDir, home, dryRun }) {
-    // Wire the SessionStart hook (inline doctrine) into the installed .claude dir.
+    // Wire hook scripts (SessionStart + UserPromptSubmit) into the installed .claude dir.
     const root = scope === 'global' ? join(home, '.claude') : join(projectDir, '.claude');
-    const hookFile = join(root, 'hooks', 'session-start.ts');
     const written: string[] = [];
     const notes: string[] = [];
     if (dryRun) return { written: [], notes: [] };
-    if (existsSync(HOOK_SRC) && !existsSync(hookFile)) {
-      mkdirSync(dirname(hookFile), { recursive: true });
-      copyFileSync(HOOK_SRC, hookFile);
-      chmodSync(hookFile, 0o755);
-      written.push(hookFile);
+    if (existsSync(HOOKS_SRC)) {
+      for (const f of readdirSync(HOOKS_SRC)) {
+        if (!f.endsWith('.ts')) continue;
+        const dst = join(root, 'hooks', f);
+        if (!existsSync(dst)) {
+          mkdirSync(dirname(dst), { recursive: true });
+          copyFileSync(join(HOOKS_SRC, f), dst);
+          // /bin/sh executes hooks via shebang — a non-executable copy is a
+          // "Permission denied" at first user prompt. chmod every hook file.
+          chmodSync(dst, 0o755);
+          written.push(dst);
+        }
+      }
     }
     // Port the /mugiwara commands into the installed .claude dir.
     if (existsSync(COMMANDS_SRC)) {

package/src/targets/opencode.ts

@@ -32,23 +32,27 @@ const CREW: Record<string, CrewConfig> = {
   'memory-keeper': { color: '#d946ef', temperature: 0.2, steps: 8 },
 };
 
-// write-scope is the single source of truth (content/agents/*.md frontmatter).
-// The path boundary (artifacts vs source) IS expressible in opencode:
-// permission.edit accepts glob/pattern -> action, last match wins. Artifacts
-// agents get deny-all-edit except .mugiwara/**; source agents (zoro, brook)
-// get full edit allow. Derived at install time from the frontmatter field.
+// write-scope is the single source of truth (content/agents/*.md frontmatter),
+// but it is a RULE for user-facing crew agents: they run inline in the main
+// thread, so a runtime permission bound to the active-agent identity would
+// force tab-switching per wave and break auto mode + resume. Runtime
+// enforcement stays for internal subagent-only agents (internal: true) — the
+// path boundary IS expressible in opencode: permission.edit accepts
+// glob/pattern -> action, last match wins. Artifacts internal agents get
+// deny-all-edit except .mugiwara/**; source internal agents get full edit
+// allow. Derived at install time from the frontmatter field.
 function permissionFromScope(scope: string | undefined): Record<string, string | Record<string, string>> | undefined {
   if (scope === 'source') return { edit: 'allow' };
   if (scope === 'artifacts') return { edit: { '*': 'deny', '.mugiwara/**': 'allow' } };
   return undefined;
 }
 
-function agentFrontmatter(name: string, description: string, writeScope?: string) {
+function agentFrontmatter(name: string, description: string, internal: boolean, writeScope?: string) {
   const crew = CREW[name];
   const lines = [`description: ${description}`, `mode: all`];
   if (crew) {
     lines.push(`color: '${crew.color}'`, `temperature: ${crew.temperature}`, `steps: ${crew.steps}`);
-    const perm = permissionFromScope(writeScope);
+    const perm = internal ? permissionFromScope(writeScope) : undefined;
     if (perm) {
       lines.push('permission:');
       for (const [k, v] of Object.entries(perm)) {
@@ -81,7 +85,7 @@ export const target: Target = {
   },
   transformAgent(data: FrontmatterData, body: string) {
     const desc = data['internal-agent'] === 'true' ? `[INTERNAL] ${data.description}` : data.description;
-    const fm = agentFrontmatter(data.name, desc, data['write-scope']);
+    const fm = agentFrontmatter(data.name, desc, data['internal-agent'] === 'true', data['write-scope']);
     return { relPath: `${data.name}.md`, text: `---\n${fm}\n---\n${body}` };
   },
   refsDir({ scope, projectDir, home }, skillName: string) {