@iowarp/clio-coder 0.3.9 → 0.4.1

package/src/domains/mux/yazi/session.ts

@@ -0,0 +1,251 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { namingCompatibilityEnvironment } from "../../../core/naming-compat.js";
+import { clioCacheDir } from "../../../core/xdg.js";
+import { findPinnedTool } from "../../toolchain/registry.js";
+import { describeResolution, resolveToolBinary, toolStatus } from "../../toolchain/resolve.js";
+import type { MuxContract } from "../contract.js";
+import type { MuxPaneRef } from "../types.js";
+import {
+	createYaziEventStream,
+	LEGACY_YAZI_PICK_EVENT,
+	YAZI_PICK_EVENT,
+	YAZI_STREAM_POLL_MS,
+	type YaziEvent,
+	type YaziEventStream,
+} from "./event-stream.js";
+import { ensureYaziProfile, type YaziProfile, yaziProfileDir } from "./profile.js";
+
+export type YaziSessionMode = "companion" | "chooser";
+export type YaziProfileMode = "managed" | "user";
+
+export interface YaziResolvedBinaries {
+	yaziPath: string | null;
+	yaPath: string | null;
+	missingYaziDetail: string;
+}
+
+export interface YaziChooserResult {
+	paths: ReadonlyArray<string>;
+	cwd: string;
+}
+
+export interface YaziSessionSnapshot {
+	mode: YaziSessionMode;
+	paneId: string;
+	paneCwd: string;
+	instanceId: string | null;
+	lastLineAt: number | null;
+	streamPath: string | null;
+	chooserPath: string | null;
+}
+
+export interface YaziSession {
+	readonly mode: YaziSessionMode;
+	readonly pane: Readonly<MuxPaneRef>;
+	readonly token: string | null;
+	readonly profile: Readonly<YaziProfile> | null;
+	snapshot(): Readonly<YaziSessionSnapshot>;
+	pushCwd(cwd: string): Promise<boolean>;
+	close(): Promise<void>;
+}
+
+export type YaziSessionOpenResult =
+	| { status: "opened"; session: YaziSession }
+	| { status: "missing-binary"; binary: "yazi" | "ya"; detail: string }
+	| { status: "profile-error"; reason: string }
+	| { status: "unavailable"; reason: string };
+
+export interface YaziSessionOptions {
+	mux: MuxContract;
+	mode: YaziSessionMode;
+	profileMode: YaziProfileMode;
+	cwd: string;
+	/**
+	 * Files-dock share of the height. Set by the interactive bridge from
+	 * `interface.panes.files.ratio`; absent it, the dock spec's default governs.
+	 */
+	dockShare?: number;
+	onEvent: (event: YaziEvent) => void;
+	onChooser: (result: YaziChooserResult) => void;
+	onStopped?: (reason: string) => void;
+	log?: (level: "debug" | "warning", message: string) => void;
+	cacheDir?: string;
+	sessionId?: string;
+	pickToken?: string;
+	pollMs?: number;
+	resolveBinaries?: () => YaziResolvedBinaries;
+	ensureProfile?: typeof ensureYaziProfile;
+	runYa?: (file: string, args: ReadonlyArray<string>, env: Readonly<NodeJS.ProcessEnv>) => Promise<boolean>;
+}
+
+export function resolveYaziBinaries(): YaziResolvedBinaries {
+	const entry = findPinnedTool("yazi");
+	const status = entry ? toolStatus(entry) : null;
+	return {
+		yaziPath: status?.resolution.binaryPath ?? null,
+		yaPath: resolveToolBinary("ya").binaryPath,
+		missingYaziDetail: status ? describeResolution(status) : "yazi is not in the pinned tool registry",
+	};
+}
+
+function runYa(file: string, args: ReadonlyArray<string>, env: Readonly<NodeJS.ProcessEnv>): Promise<boolean> {
+	return new Promise((resolve) => {
+		const child = spawn(file, args, { env: { ...env }, stdio: "ignore" });
+		child.once("error", () => resolve(false));
+		child.once("exit", (code) => resolve(code === 0));
+	});
+}
+
+function readOptional(path: string): string {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		return "";
+	}
+}
+
+/** Open one mux-hosted Yazi process and own its DDS or chooser-file transport. */
+export async function createYaziSession(options: YaziSessionOptions): Promise<YaziSessionOpenResult> {
+	const binaries = (options.resolveBinaries ?? resolveYaziBinaries)();
+	if (!binaries.yaziPath) {
+		return { status: "missing-binary", binary: "yazi", detail: binaries.missingYaziDetail };
+	}
+	if (options.profileMode === "managed" && !binaries.yaPath) {
+		return {
+			status: "missing-binary",
+			binary: "ya",
+			detail: "the Yazi helper `ya` is not available; install the complete pinned Yazi tool",
+		};
+	}
+
+	const cacheDir = options.cacheDir ?? clioCacheDir();
+	const sessionId = options.sessionId ?? randomUUID();
+	const sessionsDir = join(cacheDir, "yazi", "sessions");
+	mkdirSync(sessionsDir, { recursive: true });
+	const managedProfile =
+		options.profileMode === "managed"
+			? (options.ensureProfile ?? ensureYaziProfile)({
+					yaPath: binaries.yaPath as string,
+					yaziPath: binaries.yaziPath,
+					profileDir: yaziProfileDir(cacheDir),
+				})
+			: null;
+	if (options.profileMode === "managed" && !managedProfile) {
+		return { status: "profile-error", reason: "Clio could not generate a valid managed Yazi profile" };
+	}
+
+	const streamPath = join(sessionsDir, `${sessionId}.stream`);
+	const chooserPath = join(sessionsDir, `${sessionId}.chooser`);
+	const cwdPath = join(sessionsDir, `${sessionId}.cwd`);
+	const token = options.mode === "companion" ? (options.pickToken ?? randomUUID()) : null;
+	const env: Record<string, string> = {
+		...(managedProfile ? { YAZI_CONFIG_HOME: managedProfile.dir } : {}),
+		...(token ? namingCompatibilityEnvironment("CLIO_CODER_YAZI_PICK_TOKEN", "CLIO_YAZI_PICK_TOKEN", token) : {}),
+	};
+	let argv: ReadonlyArray<string>;
+	let stdoutPath: string | undefined;
+	if (options.mode === "companion") {
+		writeFileSync(streamPath, "");
+		argv = [
+			binaries.yaziPath,
+			"--local-events",
+			`cd,${YAZI_PICK_EVENT},${LEGACY_YAZI_PICK_EVENT}`,
+			"--remote-events",
+			`${YAZI_PICK_EVENT},${LEGACY_YAZI_PICK_EVENT}`,
+		];
+		stdoutPath = streamPath;
+	} else {
+		writeFileSync(chooserPath, "");
+		writeFileSync(cwdPath, "");
+		argv = [binaries.yaziPath, options.cwd, "--chooser-file", chooserPath, "--cwd-file", cwdPath];
+	}
+
+	const pane = await options.mux.openUtilityPane({
+		argv,
+		cwd: options.cwd,
+		label: "yazi",
+		// The files dock: split down from the anchor at the configured share.
+		// Degrades to a plain split inside the contract when the layout tier is
+		// absent.
+		dock: { slot: "files", ...(options.dockShare === undefined ? {} : { share: options.dockShare }) },
+		...(Object.keys(env).length > 0 ? { env } : {}),
+		...(stdoutPath ? { stdoutPath } : {}),
+	});
+	if (!pane) return { status: "unavailable", reason: "pane host refused to open yazi" };
+
+	let paneCwd = options.cwd;
+	let instanceId: string | null = null;
+	let stream: YaziEventStream | null = null;
+	let chooserTimer: NodeJS.Timeout | null = null;
+	let stopped = false;
+	const alive = (): boolean => options.mux.list().some((record) => record.ref.paneId === pane.paneId);
+	const stop = (reason: string): void => {
+		if (stopped) return;
+		stopped = true;
+		if (chooserTimer) clearInterval(chooserTimer);
+		chooserTimer = null;
+		options.onStopped?.(reason);
+	};
+
+	if (options.mode === "companion") {
+		stream = createYaziEventStream({
+			path: streamPath,
+			isAlive: alive,
+			...(options.pollMs !== undefined ? { pollMs: options.pollMs } : {}),
+			...(options.log ? { log: options.log } : {}),
+			onEvent: (event) => {
+				if (event.kind === "cd") {
+					paneCwd = event.cwd;
+					instanceId = event.sender;
+				}
+				options.onEvent(event);
+			},
+		});
+		void stream.done.then((reason) => stop(reason));
+	} else {
+		const pollChooser = (): void => {
+			if (stopped || alive()) return;
+			const raw = readOptional(chooserPath);
+			const cwd = readOptional(cwdPath).trim() || paneCwd;
+			paneCwd = cwd;
+			const paths = raw.length === 0 ? [] : raw.split("\n").filter((path) => path.length > 0);
+			options.onChooser({ paths, cwd });
+			stop("pane-gone");
+		};
+		chooserTimer = setInterval(pollChooser, options.pollMs ?? YAZI_STREAM_POLL_MS);
+		chooserTimer.unref();
+	}
+
+	const session: YaziSession = {
+		mode: options.mode,
+		pane,
+		token,
+		profile: managedProfile,
+		snapshot: () => ({
+			mode: options.mode,
+			paneId: pane.paneId,
+			paneCwd,
+			instanceId,
+			lastLineAt: stream?.stats().lastLineAt ?? null,
+			streamPath: options.mode === "companion" ? streamPath : null,
+			chooserPath: options.mode === "chooser" ? chooserPath : null,
+		}),
+		async pushCwd(cwd: string): Promise<boolean> {
+			if (!instanceId || !binaries.yaPath) return false;
+			const pushed = await (options.runYa ?? runYa)(binaries.yaPath, ["emit-to", instanceId, "cd", cwd], {
+				...process.env,
+				...(managedProfile ? { YAZI_CONFIG_HOME: managedProfile.dir } : {}),
+			});
+			return pushed;
+		},
+		async close(): Promise<void> {
+			stream?.stop();
+			stop("stopped");
+			await options.mux.closePane(pane.paneId);
+		},
+	};
+	return { status: "opened", session };
+}

package/src/domains/mux/yazi/theme.ts

@@ -0,0 +1,30 @@
+import { tokenHex } from "../../../core/theme-token-hex.js";
+
+/** Render the deliberately small Clio overlay on Yazi's pinned preset theme. */
+export function renderYaziTheme(): string {
+	return `# Generated by Clio Coder. Changes are replaced when the managed profile regenerates.
+
+[mgr]
+cwd = { fg = "${tokenHex("accent")}" }
+find_keyword = { fg = "${tokenHex("warning")}" }
+marker_selected = { fg = "${tokenHex("success")}", bg = "${tokenHex("success")}" }
+marker_copied = { fg = "${tokenHex("accent")}", bg = "${tokenHex("accent")}" }
+marker_cut = { fg = "${tokenHex("error")}", bg = "${tokenHex("error")}" }
+border_style = { fg = "${tokenHex("frame")}" }
+
+[mode]
+normal_main = { bg = "${tokenHex("accent")}" }
+normal_alt = { fg = "${tokenHex("accent")}" }
+select_main = { bg = "${tokenHex("action")}" }
+select_alt = { fg = "${tokenHex("action")}" }
+unset_main = { bg = "${tokenHex("error")}" }
+unset_alt = { fg = "${tokenHex("error")}" }
+
+[tabs]
+active = { bg = "${tokenHex("accent")}" }
+inactive = { fg = "${tokenHex("accent")}" }
+
+[status]
+perm_sep = { fg = "${tokenHex("dim")}" }
+`;
+}

package/src/domains/observability/cost.ts

@@ -101,6 +101,27 @@ export function costAggregateForAmount(usd: number, provenance: CostProvenance |
 	return aggregateCostAmounts([{ usd, provenance: normalizeCostProvenance(provenance) }]);
 }
 
+/**
+ * What a fixed-width surface renders for an already-folded aggregate: the cost
+ * claim when one exists, {@link COST_NOT_MEASURED} when none does. Named here
+ * because the fallback is part of the derivation, not a caller's choice, and a
+ * surface that spells the `?? COST_NOT_MEASURED` out by hand is one edit away
+ * from spelling `$0.00` instead.
+ */
+export function renderCostAggregate(cost: CostAggregate | null | undefined): string {
+	return formatCostAggregate(cost) ?? COST_NOT_MEASURED;
+}
+
+/**
+ * The same render for a single sealed amount, which is the shape a receipt or a
+ * ledger row hands over. A caller that reaches for `usd.toFixed(4)` here drops
+ * the provenance on the floor and turns unpriced work into a measured `$0.0000`,
+ * which is a claim nobody made.
+ */
+export function renderCostAmount(usd: number, provenance: CostProvenance | undefined): string {
+	return renderCostAggregate(costAggregateForAmount(usd, provenance));
+}
+
 export interface UsageBreakdown {
 	input: number;
 	output: number;

package/src/domains/observability/extension.ts

@@ -96,7 +96,7 @@ async function buildAndIndexEvidence(
 		});
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
-		process.stderr.write(`[clio:evidence] auto-build failed for run ${runId}: ${message}\n`);
+		process.stderr.write(`[clio-coder:evidence] auto-build failed for run ${runId}: ${message}\n`);
 		hooks.onFailed(runId, message);
 	}
 }

package/src/domains/observability/index.ts

@@ -42,6 +42,8 @@ export {
 	costWasMeasured,
 	emptyCostAggregate,
 	formatCostAggregate,
+	renderCostAggregate,
+	renderCostAmount,
 	type UsageBreakdown,
 } from "./cost.js";
 export type { EvidenceIndexRow } from "./evidence-index.js";

package/src/domains/observability/out-of-turn-usage.ts

@@ -130,7 +130,7 @@ export function appendOutOfTurnUsageRow(stateDir: string, row: OutOfTurnUsageRow
 			closeSync(fd);
 		}
 	} catch (error) {
-		process.stderr.write(`[clio:usage] out-of-turn usage row not written: ${messageOf(error)}\n`);
+		process.stderr.write(`[clio-coder:usage] out-of-turn usage row not written: ${messageOf(error)}\n`);
 		return;
 	}
 	appendsSinceBoundCheck += 1;
@@ -139,7 +139,7 @@ export function appendOutOfTurnUsageRow(stateDir: string, row: OutOfTurnUsageRow
 	try {
 		boundOutOfTurnUsageFile(path);
 	} catch (error) {
-		process.stderr.write(`[clio:usage] out-of-turn usage ring not bounded: ${messageOf(error)}\n`);
+		process.stderr.write(`[clio-coder:usage] out-of-turn usage ring not bounded: ${messageOf(error)}\n`);
 	}
 }
 

package/src/domains/observability/projection.ts

@@ -167,7 +167,7 @@ export function createObservabilityProjection(bus: SafeEventBus, deps: Projectio
 				listener(snapshot);
 			} catch (error) {
 				const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
-				console.error(`[clio:observability] projection listener crashed: ${message}`);
+				console.error(`[clio-coder:observability] projection listener crashed: ${message}`);
 			}
 		}
 	}

package/src/domains/observability/trace-store.ts

@@ -19,6 +19,7 @@ import type {
 	DispatchProgressPayload,
 	DispatchStartedPayload,
 } from "../../core/bus-events.js";
+import { normalizeClioCoderEventType } from "../../core/naming-events.js";
 import { processAlive, processBirthToken } from "../../core/process-identity.js";
 import { createRedactionTally, redactSecretsText } from "../evidence/redact.js";
 
@@ -110,7 +111,7 @@ function requireSqlite(): DatabaseSyncConstructor {
  * Exported for the contract test, which drives it with a load that emits both
  * warnings; production has exactly one caller.
  */
-export function loadWithSqliteWarningSuppressed<T>(load: () => T): T {
+function loadWithSqliteWarningSuppressed<T>(load: () => T): T {
 	if (warningTracingRequested()) return load();
 	const emitWarning = process.emitWarning;
 	const forward = emitWarning.bind(process) as (...args: unknown[]) => void;
@@ -1201,7 +1202,7 @@ export class TraceReader {
 	}
 
 	events(runId: string, afterRowid = 0, limit = TRACE_EVENT_POLL_LIMIT): TraceEventRow[] {
-		return this.db
+		const rows = this.db
 			.prepare(`SELECT rowid, event_id, run_id, phase_id, parent_id, type, name, payload_json,
         tokens, started_at, ended_at FROM events
         WHERE run_id = ? AND rowid > ? ORDER BY rowid LIMIT ?`)
@@ -1210,6 +1211,57 @@ export class TraceReader {
 				Math.max(0, Math.trunc(afterRowid)),
 				clampInt(limit, 1, TRACE_EVENT_POLL_LIMIT),
 			) as unknown as TraceEventRow[];
+		return rows.map((row) => ({ ...row, type: normalizeClioCoderEventType(row.type) }));
+	}
+
+	/**
+	 * Per-kind event tallies for one run.
+	 *
+	 * Aggregated in SQL rather than by reading rows, so `payload_json` and the
+	 * free-form event name are never loaded at all. That is the point: a caller
+	 * that only ever wants shapes should not be holding the payloads in memory
+	 * on the way to counting them.
+	 */
+	eventKindCounts(runId: string): Array<{ type: string; count: number }> {
+		const rows = this.db
+			.prepare("SELECT type, COUNT(*) AS count FROM events WHERE run_id=? GROUP BY type ORDER BY count DESC, type")
+			.all(runId) as unknown as Array<{ type: string; count: number }>;
+		const counts = new Map<string, number>();
+		for (const row of rows) {
+			const type = normalizeClioCoderEventType(row.type);
+			counts.set(type, (counts.get(type) ?? 0) + row.count);
+		}
+		return [...counts]
+			.map(([type, count]) => ({ type, count }))
+			.sort((left, right) => right.count - left.count || left.type.localeCompare(right.type));
+	}
+
+	/** Total events and the wall span they cover, without reading one of them. */
+	eventSpan(runId: string): { total: number; firstAt: string | null; lastAt: string | null } {
+		const row = this.db
+			.prepare(
+				`SELECT COUNT(*) AS total, MIN(started_at) AS firstAt,
+					MAX(COALESCE(ended_at, started_at)) AS lastAt FROM events WHERE run_id=?`,
+			)
+			.get(runId) as unknown as { total: number; firstAt: string | null; lastAt: string | null } | undefined;
+		return row ?? { total: 0, firstAt: null, lastAt: null };
+	}
+
+	/**
+	 * Per-kind process tallies for one run.
+	 *
+	 * Same reason as {@link eventKindCounts}, and more sharply: a process row
+	 * carries the command line, the pid, and the host, none of which a shape
+	 * count needs.
+	 */
+	processKindCounts(runId: string): Array<{ kind: string; total: number; running: number }> {
+		return this.db
+			.prepare(
+				`SELECT kind, COUNT(*) AS total,
+					SUM(CASE WHEN ended_at IS NULL THEN 1 ELSE 0 END) AS running
+				 FROM processes WHERE run_id=? GROUP BY kind ORDER BY total DESC, kind`,
+			)
+			.all(runId) as unknown as Array<{ kind: string; total: number; running: number }>;
 	}
 
 	processes(runId: string): TraceProcessRow[] {
@@ -1231,7 +1283,7 @@ export class TraceReader {
 	}
 
 	select(sql: string): Record<string, SQLInputValue>[] {
-		assertSelectOnly(sql);
+		assertTraceSelectOnly(sql);
 		return this.db.prepare(sql).all() as Record<string, SQLInputValue>[];
 	}
 }
@@ -1259,7 +1311,7 @@ export function createDispatchTraceMirror(
 	path: string,
 	options: { warn?: (message: string) => void; now?: () => string } = {},
 ): DispatchTraceMirror {
-	const warn = options.warn ?? ((message: string) => process.stderr.write(`[clio:trace] ${message}\n`));
+	const warn = options.warn ?? ((message: string) => process.stderr.write(`[clio-coder:trace] ${message}\n`));
 	const now = options.now ?? (() => new Date().toISOString());
 	let store: TraceStore | null = null;
 	let chain: Promise<void> = Promise.resolve();
@@ -1366,7 +1418,7 @@ function recordProgress(
 ): void {
 	if (!isRecord(payload.event)) return;
 	const event = payload.event;
-	const type = typeof event.type === "string" ? event.type : "progress";
+	const type = typeof event.type === "string" ? normalizeClioCoderEventType(event.type) : "progress";
 	const toolCallId = stringValue(event.toolCallId) ?? stringValue(event.tool_call_id);
 	if (
 		type === "message_end" &&
@@ -1400,7 +1452,7 @@ function recordProgress(
 			});
 		}
 	}
-	if ((type === "tool_execution_start" || type === "clio_tool_start") && toolCallId !== null) {
+	if ((type === "tool_execution_start" || type === "clio_coder_tool_start") && toolCallId !== null) {
 		starts.set(`${payload.runId}:${toolCallId}`, {
 			toolCallId,
 			tool: stringValue(event.toolName) ?? stringValue(event.tool) ?? "tool",
@@ -1409,7 +1461,7 @@ function recordProgress(
 		});
 		return;
 	}
-	if ((type === "tool_execution_end" || type === "clio_tool_finish") && toolCallId !== null) {
+	if ((type === "tool_execution_end" || type === "clio_coder_tool_finish") && toolCallId !== null) {
 		const key = `${payload.runId}:${toolCallId}`;
 		const start = starts.get(key);
 		// One clock frame per row. The worker measures `durationMs` on its own
@@ -1495,12 +1547,12 @@ function recordFailure(store: TraceStore, input: DispatchFailedPayload, at: stri
 function isCriticalTraceEvent(channel: string, raw: unknown): boolean {
 	if (channel !== "dispatch.progress") return true;
 	if (!isRecord(raw) || !isRecord(raw.event)) return false;
-	const type = raw.event.type;
+	const type = typeof raw.event.type === "string" ? normalizeClioCoderEventType(raw.event.type) : raw.event.type;
 	return (
 		type === "tool_execution_start" ||
 		type === "tool_execution_end" ||
-		type === "clio_tool_start" ||
-		type === "clio_tool_finish" ||
+		type === "clio_coder_tool_start" ||
+		type === "clio_coder_tool_finish" ||
 		type === "message_end" ||
 		type === "attempt_start"
 	);
@@ -1617,7 +1669,7 @@ function sha256(value: string): string {
 	return createHash("sha256").update(value, "utf8").digest("hex");
 }
 
-function assertSelectOnly(sql: string): void {
+export function assertTraceSelectOnly(sql: string): void {
 	const trimmed = sql.trim();
 	if (!/^(SELECT|WITH)\b/i.test(trimmed)) throw new Error("trace sql accepts SELECT or read-only WITH queries only");
 	if (trimmed.includes(";")) throw new Error("trace sql accepts exactly one statement");

package/src/domains/prompts/compiler.ts

@@ -180,7 +180,7 @@ function lookupFragment(table: FragmentTable, id: string, role: string): LoadedF
  * section and the dispatch worker safety-posture message must describe the
  * same enforced behavior, so neither side duplicates this switch.
  */
-export function safetyOneLiner(level: string): string {
+function safetyOneLiner(level: string): string {
 	switch (level) {
 		case "read-only":
 			return "inspect and answer; mutating calls are auto-denied, so propose changes instead.";
@@ -653,7 +653,7 @@ export function compileWorker(table: FragmentTable, inputs: WorkerPromptInputs):
 	if (inputs.hasBoundSkills && !inputs.hasCanonicalContext) {
 		throw new Error("prompts/compiler: bound skills require canonical context in the final attached tool surface");
 	}
-	const identity = lookupFragment(table, "identity.clio-worker", "worker identity");
+	const identity = lookupFragment(table, "identity.clio-coder-worker", "worker identity");
 	const operatingContract = lookupFragment(table, "operating.contract", "operating contract");
 	const workerContract = lookupFragment(table, "operating.worker", "worker contract");
 	const safety = lookupFragment(table, `safety.${inputs.autonomy}`, "safety");

package/src/domains/prompts/extension.ts

@@ -62,7 +62,7 @@ export function createPromptsBundle(
 			table = loadFragments();
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
-			process.stderr.write(`[clio:prompts] reload failed: ${msg}\n`);
+			process.stderr.write(`[clio-coder:prompts] reload failed: ${msg}\n`);
 		}
 	}
 
@@ -81,7 +81,7 @@ export function createPromptsBundle(
 			}
 			const configContract = config();
 			const settings: Readonly<ClioSettings> | undefined = configContract?.get();
-			const safety = input.autonomy ?? settings?.autonomy ?? "auto-edit";
+			const safety = input.autonomy ?? settings?.safety.autonomy ?? "auto-edit";
 			const cwd = input.cwd ?? process.cwd();
 			let contextFiles = "";
 			let projectPreload: ProjectPreloadClass | null = null;
@@ -147,7 +147,7 @@ export function createPromptsBundle(
 				table = loadFragments();
 			} catch (err) {
 				const msg = err instanceof Error ? err.message : String(err);
-				process.stderr.write(`[clio:prompts] initial load failed: ${msg}\n`);
+				process.stderr.write(`[clio-coder:prompts] initial load failed: ${msg}\n`);
 				table = { byId: new Map(), rootDir: "" };
 			}
 			unsubscribeHotReload = context.bus.on(BusChannels.ConfigHotReload, (payload: unknown) => {

package/src/domains/prompts/fragments/identity/clio-worker.md

@@ -1,5 +1,5 @@
 ---
-id: identity.clio-worker
+id: identity.clio-coder-worker
 version: 1
 description: Identity for a bounded Clio fleet worker
 ---

package/src/domains/prompts/fragments/operating/skills.md

@@ -1,26 +1,33 @@
 ---
 id: operating.skills
 version: 1
-budgetTokens: 260
+budgetTokens: 340
 description: Coordinator skill suggestion discipline; rendered only when context is on the surface
 ---
 
 # Skills
 
-Skills package proven workflows. Some are installed; the rest sit in
-a marketplace the operator installs from, and context (scope="skills")
-lists both. Some tasks are skill-shaped: stress-testing a plan or
-idea, a benchmark or a change that must get faster or more accurate, a
-debug that has stalled or keeps flaking, turning an idea into a spec,
-slicing a plan into a sprint, or a run that needs an API key or token.
-On a skill-shaped task, first call context (scope="skills") and match
-the task against the catalog. Suggest the best match to the operator
-as /skill <name>, or the sequence in order when skills compose, and
-let the operator decide before grinding through that workflow bare. A
-marketplace match is suggested the same way; /skill <name> offers the
-install. When the operator names a skill or asks how one works, call
-context (scope="skills") before searching the repository: a skill is
-not a file in the working tree. Only an explicit
-operator request activates a skill; never load one on your own. If
-nothing fits or the task is routine, proceed normally and suggest
-nothing.
+Skills package proven workflows. Some are installed; the rest sit in a
+marketplace the operator installs from, and context (scope="skills") is
+the one authoritative listing of both — never guess the inventory or
+search the repository for a skill file. The catalog spans git delivery
+(filing, fixing, and shipping issues), planning (intent, PRD, backlog,
+architecture, sprint slicing), coding practice (TDD, standards,
+prototyping), context priming and handoff, research workflows, and
+plan-stress-testing debates. When a task lands in one of those shapes,
+call context (scope="skills") first and match it against the catalog.
+Suggest the best match to the operator as /skill <name> — the sequence
+in order when skills compose — and let the operator decide before
+grinding through that workflow bare; a marketplace match is suggested
+the same way, and /skill <name> offers the install. When the operator
+names a skill or asks how one works, answer from that same listing.
+When a [Marketplace] reminder names an uninstalled skill for the
+current request, first check the installed side with context
+(scope="skills"); only if nothing installed serves and the named skill
+truly fits, put the install question to the operator with ask_user
+using exactly the four options the reminder states, then continue the
+task in the same turn. The harness performs any consented install;
+never install a skill yourself, and never offer one no reminder named.
+Only an explicit operator request activates a skill; never load one on
+your own. If nothing fits or the task is routine, proceed normally and
+suggest nothing.