@lovrozagar/grunt 0.3.4 → 0.3.5

package/.agents/agents/implementer.md

@@ -17,6 +17,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.agents/agents/orchestrator.md

@@ -29,7 +29,7 @@ Always-do:
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.agents/agents/thinker.md

@@ -3,7 +3,6 @@ name: thinker
 description: Plan/deep reason. Edge cases/pitfalls. Read-only. Never spawn. No bash.
 tools:
   - view_file
-  - grep_search
 mainAgent: false
 subagent: true
 model: pro
@@ -13,7 +12,7 @@ inheritMcp: false
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/.claude/agents/implementer.md

@@ -20,6 +20,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.claude/agents/orchestrator.md

@@ -32,7 +32,7 @@ Always-do:
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.claude/agents/thinker.md

@@ -4,20 +4,20 @@ description: Plan/deep reason. Edge cases/pitfalls. Read-only. Never spawn. No b
 model: opus
 tools:
   - Read
-  - Grep
-  - Glob
 disallowedTools:
   - Agent
   - Write
   - Edit
   - Bash
+  - Grep
+  - Glob
 permissionMode: bypassPermissions
 effort: high
 ---
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/.codex/agents/implementer.toml

@@ -10,6 +10,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.codex/agents/orchestrator.toml

@@ -23,7 +23,7 @@ Always-do:
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.codex/agents/thinker.toml

@@ -8,7 +8,7 @@ developer_instructions = '''
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/.grok/agents/implementer.md

@@ -12,6 +12,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.grok/agents/orchestrator.md

@@ -25,7 +25,7 @@ Always-do:
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.grok/agents/thinker.md

@@ -5,12 +5,12 @@ model: grok-4.6
 agents_md: false
 mcpInheritance: none
 permission_mode: bypassPermissions
-tools: read_file, grep, list_dir
+tools: read_file
 ---
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/.grok/hooks/orchestrate-parent.js

@@ -35,18 +35,15 @@ export const STOP_REASONS = [
   "Violation: Stop is not a recap-only wall. XOR one action now. DO NOT stop.\n" +
     "⚠/validate/sim findings → spawn implementer with them; do not recap; spawn; no parent-edit.\n" +
     "Else work remains → spawn grunt|implementer|thinker; do not glue done into the tag.\n" +
-    "Else all children returned and no findings → recap `[orchestrator]:` echo.\n" +
-    "Illegal: `[grunt done]` `[[agent] done]`.",
+    "Else all children returned and no findings → recap `[orchestrator]:` echo.",
   "Second violation: still no exclusive next action. XOR one. DO NOT stop.\n" +
     "⚠/validate/sim findings → spawn implementer with them; do not recap; spawn; no parent-edit.\n" +
     "Else work remains → spawn grunt|implementer|thinker; do not glue done into the tag.\n" +
-    "Else all children returned and no findings → recap `[orchestrator]:` echo.\n" +
-    "Illegal: `[grunt done]` `[[agent] done]`.",
+    "Else all children returned and no findings → recap `[orchestrator]:` echo.",
   "Third violation: last check before fail-open. XOR one action. DO NOT stop.\n" +
     "⚠/validate/sim findings → spawn implementer with them; do not recap; spawn; no parent-edit.\n" +
     "Else work remains → spawn grunt|implementer|thinker; do not glue done into the tag.\n" +
-    "Else all children returned and no findings → recap `[orchestrator]:` echo.\n" +
-    "Illegal: `[grunt done]` `[[agent] done]`.",
+    "Else all children returned and no findings → recap `[orchestrator]:` echo.",
 ];
 const TRANSCRIPT_TAIL_BYTES = 512 * 1024;
 const PARENT_TOOLS = new Set([

package/.grok/hooks/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/.grok/skills/implement-plan/SKILL.md

@@ -55,6 +55,7 @@ You are implementer subagent. Do not spawn.
 Read {abs}/.grok/skills/shared/plan-format.md and the plan at {abs_plan_path}.
 
 Implement remaining `[ ]` leaves in numeric order. Skip `[x]`.
+Write-allowlist = paths listed in this plan only. Do not add README/docs/examples unless listed in the plan. Missing path → blocker/`need:`; do not invent.
 After each leaf: flip that line to `[x]` in the plan file (only the box).
 When a phase's children are all `[x]`, mark the phase `[x]`.
 Frontmatter status: in-progress at start; done when all boxes `[x]`; blocked if you cannot finish.

package/.grok/skills/write-plan/SKILL.md

@@ -39,6 +39,8 @@ Prompt:
 ```
 You are thinker subagent. Read-only. Do not write files. Do not spawn.
 
+Named-file Read of listed abs paths only; investigate/search/trees → `need:` (parent prefetch still allowed).
+
 Read {abs}/.grok/skills/shared/plan-format.md. Produce a plan that matches it.
 
 Task:

package/.rulesync/reference/cascade.md

@@ -14,14 +14,14 @@ Child prompt first sentence only: `You are {agent} subagent.` Then task + abs pa
 
 Always spawn + prompt. First token = spawn. No try-then-spawn. No parent probe. No tiny-read/grep/list_dir/bash/grunt-job for the user. No skip-spawn. `/parent` is the only parent-tool escape.
 
-1. Tools (facts / search / exec / git / web / test / low-reason mechanical write) → grunt.
+1. Tools (facts / search / exec / git / web / test / low-reason mechanical write) → grunt. Facts/search → grunt, never thinker.
 2. Write defined solution → implementer.
 3. Plan / deep reason (edge cases / pitfalls) → thinker.
 4. Fresh/world facts → grunt `job: web`. Never answer from memory.
 
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked.
 
-Implementer/thinker may tiny-Read/Grep/list_dir themselves. Fat dumps via `need:` JSON.
+Implementer may tiny-Read/Grep/list_dir. Thinker named-file Read of prompt SSOT only; investigate/search/trees → `need:` grunt. Fat dumps via `need:` JSON.
 
 Long parent sessions rely on two-pass compaction; prefer a new parent session per task rather than unbounded resume chains. `[features] two_pass_compaction = true` must live in `~/.grok/config.toml` (from `.grok/global-settings.toml` via `npm run sync:globals` dry-run / `npm run sync:globals:apply`). Project `.grok/config.toml` cannot set `[features]`. Do not add a SessionStart hook.
 
@@ -34,7 +34,7 @@ Classify `done` | `alive` | `stuck` vs prior peek: **done** (completed/failed),
 Loop until done. No auto-kill. Kill only if the user asks and the host has a kill tool.
 Then print recap as `[orchestrator]: …` (or the child role tag) with real child output. Do not redo the child's work.
 
-Parent Stop (`MAX_STOP=3`): do not waive fenced/impl finals for `tools-used` stamp. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Illegal: `[grunt done]` `[[agent] done]` wait-prose. Siblings still run → role tag + echo, not `[grunt done]`. Or consume `parent-escape-{sid}` once. Else block. No `isCheap` / trivia / long definitions.
+Parent Stop (`MAX_STOP=3`): do not waive fenced/impl finals for `tools-used` stamp. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Siblings still run → role tag + echo. In-flight wait recap is `[orchestrator]: wait grunt` only. Or consume `parent-escape-{sid}` once. Else block. No `isCheap` / trivia / long definitions.
 `/handoff` is the other in-parent turn: context large + work unfinished → parent writes one `.tmp/grunt/handoffs/` file from its own transcript (no child sees the session), recaps `[handoff]: serial=… path=…`, tells the user to continue in a new session. No spawn, one write, not a mode.
 `/solo` is the session mode (not one-turn): `beforeSubmitPrompt` writes `.tmp/orchestrator-logs/grunt-off-{sid}`, every gate short-circuits while it exists, `/cascade` unlinks it. Everything above resumes next turn. Antigravity: skill-only, no stamp create (see hooks.md). `/parent` is one-turn (not a mode): UserPromptSubmit writes `.tmp/orchestrator-logs/parent-escape-{sid}`; Stop consumes+unlinks once. Next Stop resumes spawn/recap rules. Skills point here; do not paste this file.
 
@@ -43,7 +43,7 @@ Host mapping (in-tree only; do not invent peek/kill APIs). GAP rows: no fake pee
 | Host | Spawn | Peek | Kill |
 | --- | --- | --- | --- |
 | Grok | `spawn_subagent` `background:true` → `task_id` | `get_command_or_subagent_output` + `timeout_ms=60000` | `kill_command_or_subagent` (user-ask only) |
-| Claude Code | `Agent` if the parent session exposes it | GAP unless an in-tree schema names a status/output tool on that id (do not invent `TaskOutput`); else block on Agent return and classify `done`. Agent launch ≠ child done; in-flight host Stop → only `[orchestrator]: wait grunt` (or role echo); no SendMessage | GAP unless in-tree; no auto-kill |
+| Claude Code | `Agent` if the parent session exposes it | GAP unless an in-tree schema names a status/output tool on that id (do not invent `TaskOutput`); else block on Agent return and classify `done`. Agent launch ≠ child done; in-flight host Stop → only `[orchestrator]: wait grunt`; no SendMessage | GAP unless in-tree; no auto-kill |
 | Codex | host agent/call | GAP; block on host agent/call return; classify `done` | GAP; no auto-kill |
 | Antigravity | main-session parent | GAP peek/kill; main-session parent | GAP; no auto-kill |
 | Gemini | not emitted; tracked gap | GAP; no fake peeks | GAP; no auto-kill |

package/.rulesync/reference/hooks.md

@@ -12,7 +12,7 @@ Claude / Codex / Antigravity PreToolUse still run `scripts/scrub-spawn-prompt.mj
 
 Parent `run_terminal_command` is deny-by-default except `node` (optional leading `rtk`) invoking `{workspace}/scripts/grunt-job.mjs` with `--job search|exec` and `--query`. Optional `--path` `--glob` (repeatable) `--cwd`. Not `web|test`, not other scripts. META strips `--query` value first so `|` inside query is allowed; pipes/`&&` outside query still deny. Never `cd &&`. Exec shell-meta in query is grunt-job FALLBACK (exit 2), not a parent-bash allow. Unknown flags → FALLBACK.
 
-SubagentStop (and child Stop with `subagentType`) intercepts a parseable `need:` whose jobs are all `search|exec` (cap 4): runs grunt-job in-hook and continues the child with concatenated `verdict:` blobs. Mixed/web/test, parse fail, FALLBACK, `stopHookActive`, or more than 3 intercepts per child session → empty stdout (allow stop; parent LLM path). Parent `write` is deny-by-default except `.tmp/plans/` (`persist-plan.mjs`) and `.tmp/grunt/handoffs/` (`persist-handoff.mjs`); both validate + rewrite path/content, invalid body denies. Parent Stop (`MAX_STOP=3`): do not waive impl finals for `tools-used`. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Illegal: `[grunt done]` `[[agent] done]` wait-prose. Claude Agent launch ≠ done; in-flight host Stop → wait recap only (`[orchestrator]: wait grunt` or role echo); no SendMessage. Or consume `parent-escape-{sid}` once (`/parent`). No `isCheap` / trivia. Stamps: `tools-used` / `stop-block` / `need-intercept` / `parent-escape`. Skills point to cascade; do not paste protocol here.
+SubagentStop (and child Stop with `subagentType`) intercepts a parseable `need:` whose jobs are all `search|exec` (cap 4): runs grunt-job in-hook and continues the child with concatenated `verdict:` blobs. Mixed/web/test, parse fail, FALLBACK, `stopHookActive`, or more than 3 intercepts per child session → empty stdout (allow stop; parent LLM path). Parent `write` is deny-by-default except `.tmp/plans/` (`persist-plan.mjs`) and `.tmp/grunt/handoffs/` (`persist-handoff.mjs`); both validate + rewrite path/content, invalid body denies. Parent Stop (`MAX_STOP=3`): do not waive impl finals for `tools-used`. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Claude Agent launch ≠ done; in-flight host Stop → wait recap `[orchestrator]: wait grunt` only; no SendMessage. Or consume `parent-escape-{sid}` once (`/parent`). No `isCheap` / trivia. Stamps: `tools-used` / `stop-block` / `need-intercept` / `parent-escape`. Skills point to cascade; do not paste protocol here.
 
 `/solo` writes `grunt-off-{sid}`; `/cascade` unlinks it (`beforeSubmitPrompt`, exact-match only). While set: PreToolUse allows parent tools (fat gate still runs) and skips the `defaultGrunt` spawn rewrite; Stop returns 0 **before** the `parent-escape` consume, so solo never burns the one-turn stamp. Session-scoped, fail-closed.
 

package/.rulesync/rules/CLAUDE.md

@@ -24,7 +24,7 @@ Always-do:
 
 Parent = this file not `.claude/agents/orchestrator.md`. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/.rulesync/rules/overview.md

@@ -29,7 +29,7 @@ Always-do:
 
 Parent = orchestrator. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/.rulesync/subagents/implementer.md

@@ -34,6 +34,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.rulesync/subagents/orchestrator.md

@@ -51,7 +51,7 @@ Always-do:
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.rulesync/subagents/thinker.md

@@ -6,14 +6,14 @@ claudecode:
   model: opus
   effort: high
   permissionMode: bypassPermissions
-  tools: [Read, Grep, Glob]
-  disallowedTools: [Agent, Write, Edit, Bash]
+  tools: [Read]
+  disallowedTools: [Agent, Write, Edit, Bash, Grep, Glob]
 grokcli:
   model: grok-4.6
   agents_md: false
   mcpInheritance: none
   permission_mode: bypassPermissions
-  tools: read_file, grep, list_dir
+  tools: read_file
 codexcli:
   model: gpt-5.4
   model_reasoning_effort: high
@@ -25,14 +25,14 @@ antigravity-cli:
   mainAgent: false
   inheritMcp: false
   commandExecutionPolicy: eager
-  tools: [view_file, grep_search]
+  tools: [view_file]
 geminicli:
   model: gemini-2.5-pro
 ---
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/AGENTS.md

@@ -19,7 +19,7 @@ Always-do:
 
 Parent = orchestrator. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/CLAUDE.md

@@ -19,7 +19,7 @@ Always-do:
 
 Parent = this file not `.claude/agents/orchestrator.md`. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovrozagar/grunt",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Multi-agent orchestrator SoT — deep-merge rulesync trees, product scripts, and generate pipeline into a consumer repo",
   "keywords": [
     "agents",

package/scripts/gate-fat-tools.mjs

@@ -8,7 +8,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 export const DEFAULT_GREP_HEAD_LIMIT = 50;
 /** Parent Read line limit when the model omits one. */
 export const DEFAULT_READ_LIMIT = 200;
-/** Implementer/thinker (and unknown non-grunt) Grep head_limit when omitted. */
+/** Implementer (and unknown non-grunt) Grep head_limit when omitted. */
 export const CHILD_GREP_HEAD_LIMIT = 150;
 /** Implementer/thinker (and unknown non-grunt) Read line limit when omitted. */
 export const CHILD_READ_LIMIT = 400;
@@ -37,6 +37,8 @@ export const REASON_HEAD_LIMIT =
 export const REASON_FILE_SIZE = "spawn grunt job:search; file >200KB";
 export const REASON_IMPLEMENTER_BASH =
   "need: grunt job:exec|test query:…";
+export const REASON_THINKER_TOOLS = "need: grunt job:search query:…";
+export const REASON_IMPLEMENTER_WRITE = "need: path not in spec/plan";
 
 const READ_TOOLS = new Set(["read", "readfile"]);
 const GREP_TOOLS = new Set(["grep", "grepsearch"]);
@@ -175,8 +177,8 @@ export function rewriteGruntScratchPath(filePath, workspaceRoot) {
 
 export function workspaceRootOf(data) {
   return (
-    process.env.GROK_WORKSPACE_ROOT ||
     (data && (data.workspaceRoot || data.workspace_root || data.cwd)) ||
+    process.env.GROK_WORKSPACE_ROOT ||
     process.cwd()
   );
 }
@@ -378,6 +380,110 @@ export function implementerBashReason(command, workspaceRoot) {
   return null;
 }
 
+function resolveWriteAbs(filePath, workspaceRoot) {
+  if (!filePath || typeof filePath !== "string") return null;
+  return path.isAbsolute(filePath)
+    ? path.resolve(filePath)
+    : path.resolve(workspaceRoot, filePath);
+}
+
+function isUnderPlansDir(abs, workspaceRoot) {
+  if (!abs || !workspaceRoot) return false;
+  const dir = path.resolve(workspaceRoot, ".tmp", "plans");
+  if (abs === dir) return true;
+  const rel = path.relative(dir, abs);
+  return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+
+function isUnsolicitedDocPath(abs) {
+  if (!abs) return false;
+  if (path.basename(abs) === "README.md") return true;
+  const segs = abs.replace(/\\/g, "/").split("/");
+  return segs.includes("docs") || segs.includes("examples");
+}
+
+function addPlanPath(set, raw, workspaceRoot) {
+  let s = String(raw || "").trim();
+  if (!s) return;
+  if (/^https?:\/\//i.test(s)) return;
+  s = s.replace(/[.,;:]+$/, "");
+  if (!s || /^https?:\/\//i.test(s)) return;
+  if (/^\/[A-Za-z][\w-]*$/.test(s)) return;
+  if (!s.includes("/") && !s.includes("\\") && !s.includes(".")) return;
+  const abs = resolveWriteAbs(s, workspaceRoot);
+  if (abs) set.add(abs);
+}
+
+function extractPlanPaths(text, workspaceRoot) {
+  const set = new Set();
+  const body = String(text || "");
+  for (const m of body.matchAll(/`([^`\n]+)`/g)) {
+    addPlanPath(set, m[1], workspaceRoot);
+  }
+  for (const m of body.matchAll(
+    /(^|[\s("'[=])(\/(?:[A-Za-z0-9._@+-]+\/)+[A-Za-z0-9._@+-]+)/g,
+  )) {
+    addPlanPath(set, m[2], workspaceRoot);
+  }
+  return set;
+}
+
+function inProgressStatus(text) {
+  const s = String(text || "");
+  if (!s.startsWith("---\n")) return false;
+  const end = s.indexOf("\n---\n", 4);
+  if (end === -1) return false;
+  return /^status:\s*in-progress\s*$/m.test(s.slice(4, end));
+}
+
+function loadInProgressPlans(workspaceRoot) {
+  const dir = path.resolve(workspaceRoot, ".tmp", "plans");
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of names) {
+    if (!name.endsWith(".md")) continue;
+    const abs = path.resolve(dir, name);
+    let text;
+    try {
+      text = fs.readFileSync(abs, "utf8");
+    } catch {
+      continue;
+    }
+    if (!inProgressStatus(text)) continue;
+    out.push({ abs, text });
+  }
+  return out;
+}
+
+function implementerWriteDeny(input, workspaceRoot) {
+  const ws = path.resolve(workspaceRoot);
+  const plans = loadInProgressPlans(ws);
+  const allow = new Set();
+  for (const p of plans) {
+    allow.add(p.abs);
+    for (const extracted of extractPlanPaths(p.text, ws)) {
+      allow.add(extracted);
+    }
+  }
+  const hasInProgress = plans.length > 0;
+  for (const key of WRITE_PATH_FIELDS) {
+    if (typeof input[key] !== "string" || !input[key]) continue;
+    const abs = resolveWriteAbs(input[key], ws);
+    if (!abs) continue;
+    if (isUnderPlansDir(abs, ws)) continue;
+    if (allow.has(abs)) continue;
+    if (isUnsolicitedDocPath(abs) || hasInProgress) {
+      return { type: "deny", reason: REASON_IMPLEMENTER_WRITE };
+    }
+  }
+  return null;
+}
+
 /**
  * @returns {null | { type: "deny", reason: string } | { type: "rewrite", updatedInput: object }}
  */
@@ -399,6 +505,10 @@ export function processFatTools(data) {
         changed = true;
       }
     }
+    if (subagentTypeOf(data) === "implementer") {
+      const denied = implementerWriteDeny(next, ws);
+      if (denied) return denied;
+    }
     return changed ? { type: "rewrite", updatedInput: next } : null;
   }
   const sub = subagentTypeOf(data);
@@ -410,6 +520,10 @@ export function processFatTools(data) {
   const isGlob = GLOB_TOOLS.has(toolKey);
   const isBash = BASH_TOOLS.has(toolKey);
 
+  if (sub === "thinker" && (isGrep || isGlob || isBash)) {
+    return { type: "deny", reason: REASON_THINKER_TOOLS };
+  }
+
   if (isRead || isGrep || isGlob) {
     for (const v of collectPathValues(input)) {
       if (pathIsDenied(v)) return { type: "deny", reason: REASON_DENYLIST };