@kolisachint/hoocode-agent 0.5.52 → 0.5.54

package/docs/extensions.md

@@ -1823,7 +1823,7 @@ pi.registerTool({
 
 ### Overriding Built-in Tools
 
-Extensions can override built-in tools (`read`, `bash`, `edit`, `write`, `search`) by registering a tool with the same name. Interactive mode displays a warning when this happens.
+Extensions can override built-in tools (`read`, `bash`, `edit`, `write`, `SearchCodebase`) by registering a tool with the same name. Interactive mode displays a warning when this happens.
 
 ```bash
 # Extension's read tool replaces built-in read

package/docs/modes.md

@@ -1,10 +1,12 @@
 # Modes
 
 A mode swaps the system prompt hoocode runs under, so the same session can be
-steered between answering questions, designing a change, and making it. Modes
-change *instructions*, not permissions: the tool policy in
-[Settings](settings.md) is what actually blocks a write. A read-only mode tells
-the model not to edit; it does not stop a tool call on its own.
+steered between answering questions, designing a change, and making it.
+
+A mode prompt is instructions; what actually blocks a tool call is the mode's
+entry in `hoo-config.json`. The two are meant to agree, and the shipped defaults
+below make them agree for the read-only modes — but if you write a custom mode
+prompt that forbids something, add the matching policy or nothing enforces it.
 
 The active mode is `build` unless configured otherwise.
 
@@ -25,11 +27,35 @@ back to `build` clears the key rather than writing the default.
 
 | Mode | For | Tells the model to |
 |------|-----|--------------------|
-| `ask` | Questions about a codebase | Read, search, trace, and explain, citing paths and line numbers; decline edits and suggest `/mode build` |
-| `plan` | Designing a change before making it | Explore, ask clarifying questions, then write a plan with Goal / Files to modify / New files / Tests / Verification |
-| `build` | Implementing | One tool per turn, read before editing, show diffs, confirm destructive operations, run tests after each unit of work |
+| `ask` | Questions about a codebase | Read, SearchCodebase, trace, and explain, citing paths and line numbers; decline edits and suggest `/mode build` |
+| `plan` | Designing a change before making it | Explore, ask blocking questions with `ask_options`, then write a plan with Goal / Files to modify / New files / Tests / Verification |
+| `build` | Implementing | Read before editing, one verified change at a time, name what an irreversible operation destroys before running it, never commit or push unasked, run tests after each unit of work |
 | `debug` | Finding a root cause | Gather evidence, reproduce, trace the call path, state the root cause in one sentence, describe the fix without applying it |
 
+## What each mode actually permits
+
+The mode prompts above say what the model should do; these are the shipped
+defaults in `hoo-config.json` that decide what it *can* do. Edit them per mode,
+globally in `~/.hoocode/hoo-config.json` or per project in
+`./.hoocode/hoo-config.json`.
+
+| Mode | `auto_allow` (runs without a prompt) | Hard policy |
+|------|--------------------------------------|-------------|
+| `ask` | `read` | `denied_tools: [edit, write]` |
+| `plan` | `read`, `write` | `allowed_write_paths: [.hoocode/plans/*, .hoocode/plan.md]` |
+| `build` | `read` | none — every `bash`/`edit`/`write` is gated |
+| `debug` | `read`, `bash` | `denied_tools: [edit, write]` |
+
+- `denied_tools` is hard enforcement: it applies with or without a UI, so it
+  holds in `--print` runs too.
+- `allowed_write_paths` covers both `edit` and `write`, and is checked *before*
+  `auto_allow` — which is what confines plan mode to its plan file even though
+  `write` is auto-allowed there. It is currently only applied in interactive
+  sessions.
+- `bash` is not restricted by tool policy in any shipped mode. In `ask` and
+  `debug` the prompt is what keeps it read-only; if you need that enforced, set
+  `allowed_bash_commands` (a hard-enforced regex allowlist) for the mode.
+
 ## The planning workflow
 
 Plan mode writes to `.hoocode/plans/<session-id>.md`. Each session gets its own

package/docs/quickstart.md

@@ -59,7 +59,7 @@ By default, hoocode gives the model four tools:
 - `edit` - patch files
 - `bash` - run shell commands
 
-The built-in read-only `search` tool is available through tool options. HooCode runs in your current working directory and can modify files there. Use git or another checkpointing workflow if you want easy rollback.
+The built-in read-only `SearchCodebase` tool is available through tool options. HooCode runs in your current working directory and can modify files there. Use git or another checkpointing workflow if you want easy rollback.
 
 ## Give hoocode project instructions
 

package/docs/sdk.md

@@ -469,7 +469,7 @@ const { session } = await createAgentSession({ resourceLoader: loader });
 ```typescript
 import {
   codingTools,   // read, bash, edit, write (default)
-  readOnlyTools, // read, search
+  readOnlyTools, // read, SearchCodebase
   readTool, bashTool, editTool, writeTool,
   searchTool,
 } from "@kolisachint/hoocode-agent";
@@ -492,7 +492,7 @@ const { session } = await createAgentSession({
 ```typescript
 import {
   createCodingTools,    // Creates [read, bash, edit, write] for specific cwd
-  createReadOnlyTools,  // Creates [read, search] for specific cwd
+  createReadOnlyTools,  // Creates [read, SearchCodebase] for specific cwd
   createReadTool,
   createBashTool,
   createEditTool,

package/docs/settings.md

@@ -324,9 +324,9 @@ there.
 
 | Binary | Adds | Without it |
 |---|---|---|
-| `rg` | Fast path for the lexical half of `search`. Fetched at startup. | A pure-JS scanner with identical output, slower on large trees. |
+| `rg` | Fast path for the lexical half of `SearchCodebase`. Fetched at startup. | A pure-JS scanner with identical output, slower on large trees. |
 | `fd` | Fast path for `find`. Fetched at startup. | A JS directory walker, slower, with approximated glob/ignore handling. |
-| `embsearch` | Semantic hits fused into `search`, and meaning-ranked capability/MCP lookup. Fetched on first use. Must be the ONNX build. | `search` runs lexical-only. Nothing errors; intent-phrased queries rank worse. |
+| `embsearch` | Semantic hits fused into `SearchCodebase`, and meaning-ranked capability/MCP lookup. Fetched on first use. Must be the ONNX build. | `SearchCodebase` runs lexical-only. Nothing errors; intent-phrased queries rank worse. |
 | `webtools` | The `webfetch` and `websearch` tools. Fetched on first use. | Both tools error when called. |
 | `voicetools` | Push-to-talk voice input in the TUI. Fetched on first use. | Voice capture reports an error and never starts. |
 
@@ -335,7 +335,7 @@ there.
 | `enableWebTools` | boolean | `false` | Enable `webfetch` + `websearch` (network access). Needs the `webtools` binary. |
 | `webtools.timeoutSecs` | number | `15` | Per-request timeout in seconds, clamped 1–120. Wins over `HOOCODE_WEBTOOLS_TIMEOUT`. |
 | `webtools.search` | object | — | Search backend and credentials, read by the `webtools` binary itself. See [Web search providers](#web-search-providers). |
-| `enableEmbsearchTools` | boolean | `true` | Build and fuse the semantic index into `search`. Set false to run `search` lexical-only. |
+| `enableSemanticIndex` | boolean | `true` | Build and fuse the semantic index into `SearchCodebase`. Set false to run it lexical-only. |
 | `embsearchBinaryPath` | string | — | Explicit path to the `embsearch` binary. Default: resolve from `PATH`. |
 | `embsearchThresholdBytes` | number | `0` | Minimum indexable source bytes before a repo is embedded. `0` indexes every repo. |
 | `voice.silenceMs` | number | `800` | Trailing silence before voice capture auto-stops, clamped 300–10000. `VOICETOOLS_SILENCE_MS` overrides this. |

package/docs/usage.md

@@ -311,7 +311,7 @@ cat README.md | hoocode -p "Summarize this text"
 | `--no-builtin-tools`, `-nbt` | Disable built-in tools but keep extension/custom tools enabled |
 | `--no-tools`, `-nt` | Disable all tools |
 
-Built-in tools: `read`, `bash`, `edit`, `write`, `search`.
+Built-in tools: `read`, `bash`, `edit`, `write`, `SearchCodebase`.
 
 #### Optional tool bundles
 
@@ -321,7 +321,7 @@ Off by default unless noted; each adds a capability rather than a single tool.
 |--------|---------|
 | `--enable-todowrite` | The TodoWrite tool — a live todo list in the task panel |
 | `--enable-webtools` | `webfetch` and `websearch` (network access) |
-| `--enable-search-tool` | The semantic index behind the `search` tool (on by default). Legacy alias: `--enable-embsearchtools` |
+| `--enable-semantic-index` | The semantic index fused into `SearchCodebase` (on by default). The tool itself is always registered and cannot be disabled |
 | `--enable-plugintools` | The autonomous plugin system — see [Plugins](plugins.md) |
 
 #### Subagents
@@ -376,7 +376,7 @@ trims the session to the smallest useful fixed per-turn surface, for small or
 local models that waste context on harness boilerplate:
 
 - Only `read`, `write`, `edit`, and `bash`, with short descriptions and stripped
-  parameter schemas. `bash` subsumes `search` — discovery happens via the shell.
+  parameter schemas. `bash` subsumes `SearchCodebase` — discovery happens via the shell.
 - A terse replacement system prompt.
 - No subagents, TodoWrite, skills, context files, mode appendix, or the
   self-documentation section.
@@ -418,7 +418,7 @@ hoocode --model sonnet:high "Solve this complex problem"
 hoocode --models "claude-*,gpt-4o"
 
 # Read-only mode
-hoocode --tools read,search -p "Review the code"
+hoocode --tools read,SearchCodebase -p "Review the code"
 ```
 
 ### Environment Variables

package/examples/agents/fork-reviewer.md

@@ -9,7 +9,7 @@ description: |
   DO NOT use for:
   - Self-contained work that does not need the conversation history (use a normal
     subagent — it is cheaper and isolated)
-tools: read, search
+tools: read, SearchCodebase
 fork: true
 model: inherit
 ---

package/examples/agents/orchestrator.md

@@ -9,7 +9,7 @@ description: |
   DO NOT use for:
   - A single focused change (use general-purpose directly)
   - Read-only exploration of one area (use explore directly)
-tools: read, search
+tools: read, SearchCodebase
 delegate: true
 model: sonnet
 ---

package/examples/extensions/custom-provider-anthropic/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@kolisachint/hoocode-extension-custom-provider-anthropic",
 	"private": true,
-	"version": "0.3.52",
+	"version": "0.3.54",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.0.0"

package/examples/extensions/custom-provider-gitlab-duo/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@kolisachint/hoocode-extension-custom-provider-gitlab-duo",
 	"private": true,
-	"version": "0.3.52",
+	"version": "0.3.54",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.0.0"

package/examples/extensions/plan-mode/index.ts

@@ -19,7 +19,7 @@ import { Key } from "@kolisachint/hoocode-tui";
 import { extractTodoItems, isSafeCommand, markCompletedSteps, type TodoItem } from "./utils.js";
 
 // Tools
-const PLAN_MODE_TOOLS = ["read", "bash", "search", "questionnaire"];
+const PLAN_MODE_TOOLS = ["read", "bash", "SearchCodebase", "questionnaire"];
 const NORMAL_MODE_TOOLS = ["read", "bash", "edit", "write"];
 
 // Type guard for assistant messages

package/examples/extensions/preset.ts

@@ -16,7 +16,7 @@
  *     "provider": "openai-codex",
  *     "model": "gpt-5.2-codex",
  *     "thinkingLevel": "high",
- *     "tools": ["read", "search"],
+ *     "tools": ["read", "SearchCodebase"],
  *     "instructions": "You are in PLANNING MODE. Your job is to deeply understand the problem and create a detailed implementation plan.\n\nRules:\n- DO NOT make any changes. You cannot edit or write files.\n- Read files IN FULL (no offset/limit) to get complete context. Partial reads miss critical details.\n- Explore thoroughly: search for related code, find similar patterns, understand the architecture.\n- Ask clarifying questions if requirements are ambiguous. Do not assume.\n- Identify risks, edge cases, and dependencies before proposing solutions.\n\nOutput:\n- Create a structured plan with numbered steps.\n- For each step: what to change, why, and potential risks.\n- List files that will be modified.\n- Note any tests that should be added or updated.\n\nWhen done, ask the user if they want you to:\n1. Write the plan to a markdown file (e.g., PLAN.md)\n2. Create a GitHub issue with the plan\n3. Proceed to implementation (they should switch to 'implement' preset)"
  *   },
  *   "implement": {

package/examples/extensions/sandbox/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@kolisachint/hoocode-extension-sandbox",
 	"private": true,
-	"version": "0.3.52",
+	"version": "0.3.54",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.0.0"

package/examples/extensions/truncated-tool.ts

@@ -11,7 +11,7 @@
  * 4. Custom rendering of tool calls and results
  *
  * The `rg` tool here wraps ripgrep with proper truncation. Compare this to the
- * built-in `search` tool in src/core/tools/search.ts for a more complete implementation.
+ * built-in `SearchCodebase` tool in src/core/tools/search.ts for a more complete implementation.
  */
 
 import { mkdtemp, writeFile } from "node:fs/promises";

package/examples/extensions/with-deps/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@kolisachint/hoocode-extension-with-deps",
 	"private": true,
-	"version": "0.3.52",
+	"version": "0.3.54",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.0.0"

package/examples/sdk/05-tools.ts

@@ -14,14 +14,14 @@ import { createAgentSession, SessionManager } from "@kolisachint/hoocode-agent";
 
 // Read-only mode (no edit/write)
 await createAgentSession({
-	tools: ["read", "search"],
+	tools: ["read", "SearchCodebase"],
 	sessionManager: SessionManager.inMemory(),
 });
 console.log("Read-only session created");
 
 // Custom tool selection
 await createAgentSession({
-	tools: ["read", "bash", "search"],
+	tools: ["read", "bash", "SearchCodebase"],
 	sessionManager: SessionManager.inMemory(),
 });
 console.log("Custom tools session created");
@@ -38,7 +38,7 @@ console.log("Custom cwd session created");
 // Or pick specific tools for custom cwd
 await createAgentSession({
 	cwd: customCwd,
-	tools: ["read", "bash", "search"],
+	tools: ["read", "bash", "SearchCodebase"],
 	sessionManager: SessionManager.inMemory(customCwd),
 });
 console.log("Specific tools with custom cwd session created");

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@kolisachint/hoocode-agent",
-	"version": "0.5.52",
+	"version": "0.5.54",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"hoocodeConfig": {
@@ -50,9 +50,9 @@
 		"prepublishOnly": "npm run clean && npm run build"
 	},
 	"dependencies": {
-		"@kolisachint/hoocode-agent-core": "^0.5.52",
-		"@kolisachint/hoocode-ai": "^0.5.52",
-		"@kolisachint/hoocode-tui": "^0.5.52",
+		"@kolisachint/hoocode-agent-core": "^0.5.54",
+		"@kolisachint/hoocode-ai": "^0.5.54",
+		"@kolisachint/hoocode-tui": "^0.5.54",
 		"@silvia-odwyer/photon-node": "^0.3.4",
 		"chalk": "^5.5.0",
 		"cli-highlight": "^2.1.11",

package/templates/agents/code-review.md

@@ -13,7 +13,7 @@ description: |
   Output: Ranked findings, each with path:line, the defect, and how it fails.
   Cost: Medium (reads the full diff and surrounding code)
   Isolation: Read-only; can run in parallel with other review tasks
-tools: read, bash, search
+tools: read, bash, SearchCodebase
 model: capable
 background: true
 ---

package/templates/agents/explore.md

@@ -15,7 +15,7 @@ description: |
   Output: Concise summary, file list, or plan. No code changes.
   Cost: Low (read-only)
   Isolation: Can run in parallel with other explore tasks
-tools: read, search
+tools: read, SearchCodebase
 model: fast
 background: true
 ---
@@ -23,7 +23,7 @@ You are an explore-only agent running inside hoocode. You read code and produce
 
 Scope:
 - Do not modify, create, or delete files, and do not run commands.
-- Use read and search to locate and understand code.
+- Use read and SearchCodebase to locate and understand code.
 
 Method:
 1. Break the task into concrete questions.

package/templates/agents/general-purpose.md

@@ -12,14 +12,14 @@ description: |
   Output: The completed result plus a summary of what was done and where.
   Cost: Variable (read + write + run)
   Isolation: Should not run concurrently with other write tasks on the same files
-tools: read, bash, edit, write, search
+tools: read, bash, edit, write, SearchCodebase
 model: standard
 delegate: true
 ---
 You are a general-purpose subagent running inside hoocode. You handle multi-step and open-ended tasks end to end. You run in an isolated context and cannot see the parent conversation.
 
 Scope:
-- You may read, search, edit, and write files, and run commands needed to complete the task.
+- You may read, SearchCodebase, edit, and write files, and run commands needed to complete the task.
 - Stay within the requested task. Do not refactor or change unrelated code.
 
 Method:

package/templates/agents/plan.md

@@ -14,7 +14,7 @@ description: |
   Output: A concrete plan — the approach, the files to change, and the steps.
   Cost: Low–medium (read-only)
   Isolation: Can run in parallel with explore tasks
-tools: read, search
+tools: read, SearchCodebase
 model: standard
 background: true
 ---
@@ -24,7 +24,7 @@ isolated context and cannot see the parent conversation.
 
 Scope:
 - Do not create, modify, or delete files, and do not run commands.
-- Use read and search to understand the code and its structure.
+- Use read and SearchCodebase to understand the code and its structure.
 
 Method:
 1. Restate the goal and identify what you need to learn to plan it.

package/templates/agents/security-review.md

@@ -14,7 +14,7 @@ description: |
   fix.
   Cost: Medium (reads the diff and traces untrusted input)
   Isolation: Read-only; can run in parallel with other review tasks
-tools: read, bash, search
+tools: read, bash, SearchCodebase
 model: capable
 background: true
 ---

package/templates/default-config.json

@@ -9,9 +9,12 @@
     }
   },
   "modes": {
-    "ask": { "auto_allow": ["read"] },
-    "plan": { "auto_allow": ["read", "write"] },
+    "ask": { "auto_allow": ["read"], "denied_tools": ["edit", "write"] },
+    "plan": {
+      "auto_allow": ["read", "write"],
+      "allowed_write_paths": [".hoocode/plans/*", ".hoocode/plan.md"]
+    },
     "build": { "auto_allow": ["read"] },
-    "debug": { "auto_allow": ["read", "bash"] }
+    "debug": { "auto_allow": ["read", "bash"], "denied_tools": ["edit", "write"] }
   }
 }

package/templates/modes/ask/system.md

@@ -1,10 +1,7 @@
 You are in **ask mode** — read-only Q&A.
 
-Permitted: read files, search the codebase, explain code, trace logic, compare approaches, debug conceptually.
-Forbidden: edit files, write files, run commands that modify state.
+Forbidden: edit or write any file; any command that changes state. Read-only shell (`git log`, `git diff`, `ls`, `rg`) is fine.
 
-When answering:
-- Cite file paths and line numbers.
-- Prefer precise over verbose.
-- If a question requires a code change to answer properly, describe the change; do not apply it.
-- If the user asks you to edit something, decline and suggest switching to build mode with `/mode build`.
+- Cite path:line.
+- Describe a needed change exactly; never apply it. To apply, `/mode build`.
+- If you do not know, say so and name what you would read to find out.

package/templates/modes/build/system.md

@@ -1,9 +1,7 @@
-You are in **build mode** — implement carefully, one step at a time.
+You are in **build mode** — implement and verify, one change at a time.
 
-Rules:
-- **One tool per turn.** Plan the action, call the tool, wait for the result before proceeding.
-- **Read before editing.** Never write to a file you have not read in this session.
-- **Show diffs** before applying non-trivial edits; wait for implicit acceptance.
-- **Dangerous ops** (delete, force-push, drop table, rm -rf): state what you are about to do and wait for explicit confirmation.
-- **Match existing style** — indentation, naming, import order.
-- **Run tests** after every logical unit of change. Fix failures before continuing.
+- **Read before editing.** Never write a file you have not read this session.
+- **Sequential edits.** Finish and verify one logical change before the next. Reads and searches still batch into one message.
+- **Irreversible ops** (delete, force-push, drop table, `rm -rf`, history rewrite): say what it destroys before you call it. The gate shows the command, not the blast radius.
+- **Never commit or push unless asked.**
+- **Run tests** after each logical unit. Fix failures; report ones you cannot.

package/templates/modes/debug/system.md

@@ -1,10 +1,9 @@
-You are in **debug mode** — root-cause analysis only, no file modifications.
+You are in **debug mode** — root-cause only.
 
-Process:
-1. **Gather evidence** — read logs, error traces, and relevant source. Run safe diagnostic commands (search, read, non-mutating shell commands).
-2. **Reproduce** — identify the minimal condition that triggers the bug.
-3. **Trace** — follow the full call path from entry point to failure site, citing file and line at each step.
-4. **State the root cause** in one clear sentence.
-5. **Describe the fix** — files, lines, and what to change — but do not apply it.
+Forbidden: edit or write any file; any command that changes state. To apply a fix, `/mode build`.
 
-Forbidden: edit or write any file. To apply a fix, switch to build mode with `/mode build`.
+1. **Evidence** — read logs, traces, and source. Read-only shell only.
+2. **Reproduce** — the minimal trigger. If you cannot, say so and reason from what you have.
+3. **Trace** — entry point to failure site, path:line at each step.
+4. **Root cause** — one sentence, plus the evidence proving it. Two candidates beat one invented. "Not found" is a valid answer.
+5. **Fix** — files, lines, what to change. Do not apply it.

package/templates/modes/plan/system.md

@@ -1,18 +1,12 @@
-You are in **plan mode** — explore and design, no source edits.
+You are in **plan mode** — explore and design.
 
-Your job: produce a complete, actionable implementation plan.
+Forbidden: create, edit, or delete any file except `{{PLAN_PATH}}`.
 
-Steps:
-1. Read relevant files and ask clarifying questions before drafting.
-2. Write the finished plan to `{{PLAN_PATH}}` with these sections:
+1. Read the relevant files. If a different reading of the request would change the plan, ask via `ask_options` — 2-4 questions, once. Settle the rest yourself.
+2. Write `{{PLAN_PATH}}`:
    - **Goal** — one sentence.
-   - **Files to modify** — path, line range, what changes.
+   - **Files to modify** — path, line range, change.
    - **New files** — path, purpose.
    - **Tests** — what to add or update.
-   - **Verification** — commands to confirm correctness.
-3. After writing the plan, tell the user: "Plan written to `{{PLAN_PATH}}`. Run
-   `/grill` to stress-test it, then `/approve` to execute it step by step or
-   `/goal` to work toward it autonomously." Recommend `/grill` first whenever the
-   plan carries real risk — it surfaces weak assumptions before any code changes.
-
-Forbidden: edit any source file. Only `{{PLAN_PATH}}` may be written.
+   - **Verification** — commands that prove the goal is met, not that the code runs.
+3. Tell the user the path, and that `/grill` stress-tests it, `/approve` executes it step by step, `/goal` runs it autonomously. Recommend `/grill` when the plan carries risk.

package/templates/prompts/task-main.md

@@ -1,19 +1,12 @@
 You have access to the **Task** tool. Use it to delegate self-contained tasks to specialized subagents that run in their own isolated context and return only their final answer. Pick an agent by name from the <available_agents> list in this prompt and pass it as `subagent_type`.
 
-When to delegate:
-1. The work is self-contained and you only need the final result, not intermediate steps.
-2. You want to investigate or edit something in parallel without losing your current context or reasoning chain.
-3. The task is a discrete unit (explore one module, run one test file, review one PR, fix one isolated bug).
-4. You need to run a long command or test suite and wait for its output without blocking your own reasoning.
+Delegate when you need only the final result: a discrete unit (explore one module, run one test file, review one PR, fix one isolated bug), an investigation you want running in parallel without spending your own context, or a long command or test suite you would block on. Use `explore` for read-only scouting, `plan` for research before changes. Dispatch independent subtasks in the same turn. Keep inline only trivial single-step edits, work needing tight back-and-forth, and edits to files you are actively reasoning about.
 
-Model tier (optional `complexity`): set `fast` for quick reads/lookups, `standard` for multi-file edits, `capable` for deep architecture work. It maps to a model from `settings.modelCategories`. Omit it to use the agent's default; an agent that pins its own model ignores `complexity`.
+Model tier (optional `complexity`): `fast` for quick reads/lookups, `standard` for multi-file edits, `capable` for deep architecture. Omit to use the agent's default; an agent pinning its own model ignores it.
 
 Guidelines:
 - Choose the agent whose description best matches the task.
-- Make every task specific and self-contained. The subagent cannot see this conversation; pass all necessary context (files, constraints, prior findings) in `prompt`.
-- Do NOT delegate tasks that require tight back-and-forth with your current reasoning, or edits to files you are actively reasoning about.
-- The subagent returns ONLY its final answer. Its intermediate reasoning, tool calls, and output are hidden from you.
-- Delegate proactively when work is self-contained or parallelizable: multi-step investigation, read-only exploration (use `explore`), research before changes (use `plan`), drafting a standalone file/section, or running a long command/test suite. Dispatch independent subtasks in the same turn. Handle only trivial single-step edits or tightly interactive back-and-forth inline.
+- The subagent cannot see this conversation and returns ONLY its final answer — pass all context (files, constraints, prior findings) in `prompt`.
 {{BACKGROUND_GUIDANCE}}
-- When working through a TodoWrite plan, mark the plan item in_progress BEFORE dispatching subagents for it: each dispatch is attributed to the current in_progress item in the user's task panel, so dispatching first (or with several items in_progress) leaves the run unattributed.
-- To continue a previous subagent (for example one that returned partial results), call Task again with `resume_task_id` set to its task_id; it resumes with its full prior transcript and `prompt` is your follow-up.
+- When working a TodoWrite plan, mark the item in_progress BEFORE dispatching: each dispatch is attributed to the current in_progress item in the task panel.
+- To continue a previous subagent, call Task with `resume_task_id` set to its task_id; it resumes with its full transcript and `prompt` is your follow-up.

package/templates/skills/artifact-design/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: artifact-design
 description: Build a self-contained HTML visual written to disk — page, report, dashboard, mockup, diagram, or poster. Load before the first line of markup or CSS whenever something has to look right, or a redesign is asked for. Not for app code the project's own design system already governs.
-allowed-tools: read, write, edit, search
+allowed-tools: read, write, edit, SearchCodebase
 ---
 
 # Designing a visual

package/templates/skills/canvas-design/SKILL.md

@@ -2,7 +2,7 @@
 name: canvas-design
 description: How to make a canvas extension's page good — layout, styling, live state, and the dependency and token constraints the surface imposes. Read when building or editing a canvas; the /new-canvas brief points here.
 disable-model-invocation: true
-allowed-tools: read, write, edit, search
+allowed-tools: read, write, edit, SearchCodebase
 ---
 
 # Designing a canvas

package/templates/skills/plugin-authoring/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: plugin-authoring
 description: How to author a portable, reusable hoocode plugin — when a capability is worth extracting, how to name and describe it so it triggers again, and what makes content portable across repos and machines. Use before calling ProposePlugin or UpdatePlugin, or when deciding whether a recipe you just completed is worth keeping.
-allowed-tools: read, write, edit, search
+allowed-tools: read, write, edit, SearchCodebase
 ---
 
 # Authoring a plugin