@lovrozagar/grunt 0.3.5 → 0.3.7

package/.agents/agents/orchestrator.md

@@ -12,11 +12,14 @@ commandExecutionPolicy: eager
 inheritMcp: false
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -25,11 +28,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.agents/hooks.json

@@ -20,6 +20,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "Write|Edit|write|search_replace|Bash|run_terminal_command|Skill|skill|replace_file_content|run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.grok/hooks/orchestrate-parent.js\"",
+            "timeout": 5
+          }
+        ]
       }
     ],
     "Stop": [

package/.claude/agents/orchestrator.md

@@ -15,11 +15,14 @@ permissionMode: bypassPermissions
 effort: low
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -28,11 +31,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.claude/settings.json

@@ -29,6 +29,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "Write|Edit|write|search_replace|Bash|run_terminal_command|Skill|skill|replace_file_content|run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.grok/hooks/orchestrate-parent.js\"",
+            "timeout": 5
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [

package/.codex/agents/orchestrator.toml

@@ -6,11 +6,14 @@ sandbox_mode = "danger-full-access"
 approval_policy = "never"
 developer_instructions = '''
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -19,11 +22,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.codex/hooks.json

@@ -20,6 +20,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "Write|Edit|write|search_replace|Bash|run_terminal_command|Skill|skill|replace_file_content|run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.grok/hooks/orchestrate-parent.js\"",
+            "timeout": 5
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [

package/.grok/agents/orchestrator.md

@@ -8,11 +8,14 @@ mcpInheritance: none
 tools: spawn_subagent, read_file, grep, list_dir, write, todo_write, get_command_or_subagent_output, kill_command_or_subagent, run_terminal_command
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -21,11 +24,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.grok/hooks/orchestrate-parent.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/** Parent-orchestrator gate: spawn/peek/kill/todo + persistPlan/persistHandoff writes.
+/** PreToolUse parent-deny on Claude+Grok+Antigravity; Stop = first-non-empty-line recap; stop-block survives host banners; SubagentStop is single-registration intercept.
 Parent Read/Grep/Glob/Bash/Web denied unless parent-escape (fat-gate still).
 SubagentStop intercepts need: search|exec with grunt-job verdicts.
 Stop: first-non-empty-line [orchestrator]:/[grunt]:/[implementer]:/[thinker]:/[handoff]: recap
@@ -19,6 +19,7 @@ import {
   fatHookOutput,
   fileSizeBytes,
   isWorkspaceGruntJob,
+  isParentOrchestrator,
   processFatTools,
   resolveReadPath,
   rewriteGruntScratchPath,
@@ -30,20 +31,11 @@ import { parseNeed } from "../../scripts/parse-need.mjs";
 import { resolveJobCwd, runJob } from "../../scripts/grunt-job.mjs";
 import { logTelemetry, ORCHESTRATOR_LOGS_DIR } from "../../scripts/telemetry.mjs";
 
-const DENY_REASON = "parent is orchestrator; spawn grunt|implementer|thinker";
+export const DENY_REASON = "spawn implementer|grunt|thinker";
 export const STOP_REASONS = [
-  "Violation: Stop is not a recap-only wall. XOR one action now. DO NOT stop.\n" +
-    "⚠/validate/sim findings → spawn implementer with them; do not recap; spawn; no parent-edit.\n" +
-    "Else work remains → spawn grunt|implementer|thinker; do not glue done into the tag.\n" +
-    "Else all children returned and no findings → recap `[orchestrator]:` echo.",
-  "Second violation: still no exclusive next action. XOR one. DO NOT stop.\n" +
-    "⚠/validate/sim findings → spawn implementer with them; do not recap; spawn; no parent-edit.\n" +
-    "Else work remains → spawn grunt|implementer|thinker; do not glue done into the tag.\n" +
-    "Else all children returned and no findings → recap `[orchestrator]:` echo.",
-  "Third violation: last check before fail-open. XOR one action. DO NOT stop.\n" +
-    "⚠/validate/sim findings → spawn implementer with them; do not recap; spawn; no parent-edit.\n" +
-    "Else work remains → spawn grunt|implementer|thinker; do not glue done into the tag.\n" +
-    "Else all children returned and no findings → recap `[orchestrator]:` echo.",
+  "Spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else no spec → thinker. Else recap `[orchestrator]:` one-line.",
+  "Still spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else no spec → thinker. Else recap `[orchestrator]:` one-line.",
+  "Last spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else no spec → thinker. Else recap `[orchestrator]:` one-line.",
 ];
 const TRANSCRIPT_TAIL_BYTES = 512 * 1024;
 const PARENT_TOOLS = new Set([
@@ -59,7 +51,23 @@ const SPAWN_TOOLS = new Set([
   "agent",
   "spawnagent",
 ]);
-const WRITE_TOOLS = new Set(["write"]);
+const WRITE_TOOLS = new Set([
+  "write",
+  "edit",
+  "searchreplace",
+  "replacefilecontent",
+]);
+const BASH_TOOLS = new Set(["bash", "runterminalcommand", "runcommand"]);
+const SKILL_TOOLS = new Set(["skill"]);
+const PARENT_SKILLS = new Set([
+  "parent",
+  "explain",
+  "solo",
+  "cascade",
+  "handoff",
+  "write-plan",
+  "implement-plan",
+]);
 const READ_TOOLS = new Set(["readfile", "read"]);
 const INTERCEPT_JOBS = new Set(["search", "exec"]);
 const MAX_STOP = 3;
@@ -97,7 +105,7 @@ function preToolUse(data) {
   logPreTool(data, toolKey, toolInput);
 
   const sub = subagentTypeOf(data);
-  if (sub) {
+  if (sub || !isParentOrchestrator(data)) {
     const code = emitFat(data);
     return code == null ? 0 : code;
   }
@@ -130,6 +138,14 @@ function preToolUse(data) {
     emit({ decision: "allow" });
     return 0;
   }
+  if (BASH_TOOLS.has(toolKey) && isAllowedParentGruntJob(bashCommandOf(toolInput), workspaceRootOf(data))) {
+    emit({ decision: "allow" });
+    return 0;
+  }
+  if (SKILL_TOOLS.has(toolKey) && isAllowedParentSkill(toolInput)) {
+    emit({ decision: "allow" });
+    return 0;
+  }
   if (hasParentEscape(data)) {
     const fatCode = emitFat(data);
     if (fatCode !== null) return fatCode;
@@ -219,6 +235,40 @@ export function isAllowedParentGruntJob(command, workspaceRoot) {
   return isWorkspaceGruntJob(command, workspaceRoot, ["search", "exec"]);
 }
 
+function bashCommandOf(toolInput) {
+  if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
+    return "";
+  }
+  return String(toolInput.command ?? toolInput.cmd ?? "");
+}
+
+function skillNameOf(toolInput) {
+  if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
+    return "";
+  }
+  const raw =
+    toolInput.skill ??
+    toolInput.skill_name ??
+    toolInput.skillName ??
+    toolInput.name ??
+    "";
+  const s = String(raw).trim().toLowerCase().replace(/\\/g, "/");
+  const base = s.split("/").pop() || "";
+  return base.replace(/\.md$/, "").replace(/_/g, "-");
+}
+
+export function isAllowedParentSkill(toolInput) {
+  return PARENT_SKILLS.has(skillNameOf(toolInput));
+}
+
+function isHostStopBanner(prompt) {
+  const p = String(prompt || "");
+  if (/^\s*Stop hook feedback:/.test(p)) return true;
+  if (/Blocked by stop hook/.test(p)) return true;
+  if (/task[-_ ]?notification/i.test(p)) return true;
+  return false;
+}
+
 function parentWrite(data, toolInput) {
   if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
     emit({ decision: "deny", reason: DENY_REASON });
@@ -235,6 +285,10 @@ function parentWrite(data, toolInput) {
   if (rewritten) rawPath = rewritten;
   const handoff = isUnderHandoffs(rawPath, ws);
   if (!handoff && !isUnderPlans(rawPath, ws)) {
+    if (hasParentEscape(data)) {
+      emit({ decision: "allow" });
+      return 0;
+    }
     emit({ decision: "deny", reason: DENY_REASON });
     return 0;
   }
@@ -298,7 +352,7 @@ function isParentEscapePrompt(prompt) {
 function userPromptSubmit(data) {
   unlinkQuiet(stampPath(data, "tools-used"));
   const prompt = userPromptOf(data);
-  if (!/^\s*Stop hook feedback:/.test(prompt)) {
+  if (!isHostStopBanner(prompt)) {
     unlinkQuiet(stampPath(data, "stop-block"));
   }
   // Sticky: only /solo and /cascade move it. Every other prompt leaves it alone.

package/.rulesync/hooks.jsonc

@@ -12,15 +12,18 @@
       },
       {
         // Fat Read/Grep/Glob/Bash + Write/Edit scratch rewrite (never deny writes).
-        // Parent-deny stays Grok-only (orchestrate-parent.js).
         "matcher": "Read|read_file|Grep|grep|Glob|list_dir|Bash|run_terminal_command|Write|Edit|write|search_replace",
         "type": "command",
         "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/scripts/gate-fat-tools.mjs\"",
         "timeout": 5
+      },
+      {
+        "matcher": "Write|Edit|write|search_replace|Bash|run_terminal_command|Skill|skill|replace_file_content|run_command",
+        "type": "command",
+        "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.grok/hooks/orchestrate-parent.js\"",
+        "timeout": 5
       }
     ],
-    // Parent Stop + /parent stamp. PreToolUse parent-deny stays Grok-only
-    // (child subagentType/agent_type unverified on these hosts).
     "beforeSubmitPrompt": [
       {
         "type": "command",

package/.rulesync/reference/cascade.md

@@ -13,6 +13,7 @@ Always-do lives in orchestrator/overview (do not open this file first). Peek/kil
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 
 Always spawn + prompt. First token = spawn. No try-then-spawn. No parent probe. No tiny-read/grep/list_dir/bash/grunt-job for the user. No skip-spawn. `/parent` is the only parent-tool escape.
+Create/change product files → first token spawn implementer (thinker then implementer if no spec). Never parent Write/Edit/Bash/Skill-that-writes. Child returned is not terminal if writes remain or spawn count is 0 on a file-change turn. plan/spec ready + writes remain → persist plan if needed; spawn implementer; do not recap-stop. plan-only `/write-plan` → recap + `next: /implement-plan`.
 
 1. Tools (facts / search / exec / git / web / test / low-reason mechanical write) → grunt. Facts/search → grunt, never thinker.
 2. Write defined solution → implementer.
@@ -34,7 +35,7 @@ Classify `done` | `alive` | `stuck` vs prior peek: **done** (completed/failed),
 Loop until done. No auto-kill. Kill only if the user asks and the host has a kill tool.
 Then print recap as `[orchestrator]: …` (or the child role tag) with real child output. Do not redo the child's work.
 
-Parent Stop (`MAX_STOP=3`): do not waive fenced/impl finals for `tools-used` stamp. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Siblings still run → role tag + echo. In-flight wait recap is `[orchestrator]: wait grunt` only. Or consume `parent-escape-{sid}` once. Else block. No `isCheap` / trivia / long definitions.
+Parent Stop (`MAX_STOP=3`): do not waive fenced/impl finals for `tools-used` stamp. Parent `end_turn` is tagged+one-line or `[orchestrator]: wait grunt`. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Siblings still run → role tag + one-line echo. In-flight wait recap is `[orchestrator]: wait grunt` only. Or consume `parent-escape-{sid}` once. Else block. No `isCheap` / trivia / long definitions.
 `/handoff` is the other in-parent turn: context large + work unfinished → parent writes one `.tmp/grunt/handoffs/` file from its own transcript (no child sees the session), recaps `[handoff]: serial=… path=…`, tells the user to continue in a new session. No spawn, one write, not a mode.
 `/solo` is the session mode (not one-turn): `beforeSubmitPrompt` writes `.tmp/orchestrator-logs/grunt-off-{sid}`, every gate short-circuits while it exists, `/cascade` unlinks it. Everything above resumes next turn. Antigravity: skill-only, no stamp create (see hooks.md). `/parent` is one-turn (not a mode): UserPromptSubmit writes `.tmp/orchestrator-logs/parent-escape-{sid}`; Stop consumes+unlinks once. Next Stop resumes spawn/recap rules. Skills point here; do not paste this file.
 

package/.rulesync/reference/hooks.md

@@ -10,9 +10,11 @@ Grok PostToolUse / UserPromptSubmit / SessionStart are observe-only — do not a
 
 Claude / Codex / Antigravity PreToolUse still run `scripts/scrub-spawn-prompt.mjs` and `scripts/gate-fat-tools.mjs`. Grok does not — spawn/fat rewrite is `orchestrate-parent.js` only. RTK stays `rtk.json`.
 
+Parent Write|Edit|Bash|Skill-that-writes is deny on Claude+Grok+Antigravity unless `/parent`. `.tmp/plans/` and `.tmp/grunt/handoffs/` Write still persist. Parent Bash still allowed for workspace `grunt-job.mjs` `--job search|exec`. Children with a type skip parent-deny (fat-only). Skill allowlist without escape: `parent|explain|solo|cascade|handoff|write-plan|implement-plan`. Deny reason: `spawn implementer|grunt|thinker`. Parent `end_turn` is tagged+one-line or `[orchestrator]: wait grunt`.
+
 Parent `run_terminal_command` is deny-by-default except `node` (optional leading `rtk`) invoking `{workspace}/scripts/grunt-job.mjs` with `--job search|exec` and `--query`. Optional `--path` `--glob` (repeatable) `--cwd`. Not `web|test`, not other scripts. META strips `--query` value first so `|` inside query is allowed; pipes/`&&` outside query still deny. Never `cd &&`. Exec shell-meta in query is grunt-job FALLBACK (exit 2), not a parent-bash allow. Unknown flags → FALLBACK.
 
-SubagentStop (and child Stop with `subagentType`) intercepts a parseable `need:` whose jobs are all `search|exec` (cap 4): runs grunt-job in-hook and continues the child with concatenated `verdict:` blobs. Mixed/web/test, parse fail, FALLBACK, `stopHookActive`, or more than 3 intercepts per child session → empty stdout (allow stop; parent LLM path). Parent `write` is deny-by-default except `.tmp/plans/` (`persist-plan.mjs`) and `.tmp/grunt/handoffs/` (`persist-handoff.mjs`); both validate + rewrite path/content, invalid body denies. Parent Stop (`MAX_STOP=3`): do not waive impl finals for `tools-used`. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Claude Agent launch ≠ done; in-flight host Stop → wait recap `[orchestrator]: wait grunt` only; no SendMessage. Or consume `parent-escape-{sid}` once (`/parent`). No `isCheap` / trivia. Stamps: `tools-used` / `stop-block` / `need-intercept` / `parent-escape`. Skills point to cascade; do not paste protocol here.
+SubagentStop (and child Stop with `subagentType`) intercepts a parseable `need:` whose jobs are all `search|exec` (cap 4): runs grunt-job in-hook and continues the child with concatenated `verdict:` blobs. Mixed/web/test, parse fail, FALLBACK, `stopHookActive`, or more than 3 intercepts per child session → empty stdout (allow stop; parent LLM path). Parent `write` is deny-by-default except `.tmp/plans/` (`persist-plan.mjs`) and `.tmp/grunt/handoffs/` (`persist-handoff.mjs`); both validate + rewrite path/content, invalid body denies. Parent Stop (`MAX_STOP=3`): do not waive impl finals for `tools-used`. Parent `end_turn` is tagged+one-line or `[orchestrator]: wait grunt`. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Claude Agent launch ≠ done; in-flight host Stop → wait recap `[orchestrator]: wait grunt` only; no SendMessage. Or consume `parent-escape-{sid}` once (`/parent`). No `isCheap` / trivia. Stamps: `tools-used` / `stop-block` / `need-intercept` / `parent-escape`. Skills point to cascade; do not paste protocol here.
 
 `/solo` writes `grunt-off-{sid}`; `/cascade` unlinks it (`beforeSubmitPrompt`, exact-match only). While set: PreToolUse allows parent tools (fat gate still runs) and skips the `defaultGrunt` spawn rewrite; Stop returns 0 **before** the `parent-escape` consume, so solo never burns the one-turn stamp. Session-scoped, fail-closed.
 

package/.rulesync/reference/output.md

@@ -4,4 +4,4 @@ tags: [output]
 
 # Output
 
-en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only

package/.rulesync/rules/CLAUDE.md

@@ -4,12 +4,15 @@ targets:
   - claudecode
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 All output exclude AI attribution, Co-Authored-By, trailers, generated markers.
 Protocol: `.rulesync/reference/cascade.md`. Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -18,13 +21,14 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
 Parent = this file not `.claude/agents/orchestrator.md`. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + one-line echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/.rulesync/rules/overview.md

@@ -9,12 +9,15 @@ globs:
   - "**/*"
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 All output exclude AI attribution, Co-Authored-By, trailers, generated markers.
 Protocol: `.rulesync/reference/cascade.md`. Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -23,13 +26,14 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
 Parent = orchestrator. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + one-line echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/.rulesync/subagents/orchestrator.md

@@ -34,11 +34,14 @@ geminicli:
   model: gemini-2.5-flash
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -47,11 +50,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/AGENTS.md

@@ -1,10 +1,13 @@
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 All output exclude AI attribution, Co-Authored-By, trailers, generated markers.
 Protocol: `.rulesync/reference/cascade.md`. Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -13,13 +16,14 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
 Parent = orchestrator. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + one-line echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/CLAUDE.md

@@ -1,10 +1,13 @@
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 All output exclude AI attribution, Co-Authored-By, trailers, generated markers.
 Protocol: `.rulesync/reference/cascade.md`. Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -13,13 +16,14 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
 Parent = this file not `.claude/agents/orchestrator.md`. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + one-line echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovrozagar/grunt",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Multi-agent orchestrator SoT — deep-merge rulesync trees, product scripts, and generate pipeline into a consumer repo",
   "keywords": [
     "agents",

package/scripts/gate-fat-tools.mjs

@@ -79,19 +79,69 @@ export function eventKey(s) {
     .replace(/[^a-z0-9]/g, "");
 }
 
+const CHILD_TYPE_KEYS = [
+  "subagentType",
+  "subagent_type",
+  "agentType",
+  "agent_type",
+  "agentName",
+  "agent_name",
+];
+const CHILD_ID_KEYS = ["agentId", "agent_id", "spawnedBy", "spawned_by"];
+
+function nonEmptyChildId(raw) {
+  if (raw == null) return false;
+  return String(raw).trim() !== "";
+}
+
+/** True when PreToolUse names a child session (UUID ok). Not a fat-gate type. */
+export function hasChildAgentMarker(data) {
+  if (!data || typeof data !== "object") return false;
+  for (const k of CHILD_ID_KEYS) {
+    if (nonEmptyChildId(data[k])) return true;
+  }
+  if (data.agent && typeof data.agent === "object" && !Array.isArray(data.agent)) {
+    for (const k of [...CHILD_ID_KEYS, "id"]) {
+      if (nonEmptyChildId(data.agent[k])) return true;
+    }
+  }
+  return false;
+}
+
+function coerceChildType(raw) {
+  if (raw == null) return "";
+  const s = String(raw).trim().toLowerCase();
+  if (!s) return "";
+  if (
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s)
+  ) {
+    return "";
+  }
+  if (/^[0-9]+$/.test(s)) return "";
+  if (s.length > 64 || /[\/\\]/.test(s)) return "";
+  return s;
+}
+
 export function subagentTypeOf(data) {
   if (!data || typeof data !== "object") return "";
-  const raw =
-    data.subagentType ??
-    data.subagent_type ??
-    data.agentType ??
-    data.agent_type ??
-    "";
-  return String(raw).trim().toLowerCase();
+  for (const k of [...CHILD_TYPE_KEYS, ...CHILD_ID_KEYS]) {
+    const t = coerceChildType(data[k]);
+    if (t) return t;
+  }
+  if (data.agent && typeof data.agent === "object" && !Array.isArray(data.agent)) {
+    for (const k of ["subagentType", "subagent_type", "type", "name", "agentType"]) {
+      const t = coerceChildType(data.agent[k]);
+      if (t) return t;
+    }
+  } else if (typeof data.agent === "string") {
+    const t = coerceChildType(data.agent);
+    if (t) return t;
+  }
+  return "";
 }
 
 export function isParentOrchestrator(data) {
-  return !subagentTypeOf(data);
+  return !subagentTypeOf(data) && !hasChildAgentMarker(data);
 }
 
 export function toolInputOf(data) {

package/scripts/hooks-union.mjs

@@ -8,8 +8,8 @@
  * Grok SessionStart stays empty on orchestrate-parent.json.
  *
  * Consumer extras (if those scripts exist): SessionStart, check-behind,
- * validate+sim, platform/** deny. Gemini: SessionStart + AfterTool only;
- * check-behind / path deny stay caveats.
+ * validate+sim. Path deny from consumer `.rulesync/permissions.json`.
+ * Gemini: SessionStart + AfterTool only; check-behind / path deny stay caveats.
  *
  *   node scripts/hooks-union.mjs           apply then check
  *   node scripts/hooks-union.mjs --check   keep-list only
@@ -40,7 +40,6 @@ export const AUTORUN_NEEDLES = [
   "sim.mjs",
 ];
 export const GRUNT_NEEDLES = ["scrub-spawn-prompt.mjs", "gate-fat-tools.mjs"];
-export const PLATFORM_DENY = ["Write(platform/**)", "Edit(platform/**)"];
 export const GIT_HOOKS = [
   "scripts/git-hooks/pre-commit",
   "scripts/git-hooks/pre-commit.mjs",
@@ -52,7 +51,7 @@ export const POST_WRITE_MATCHER = "Write|Edit|write|search_replace";
 const CAVEAT_BEHIND =
   "NOT ported: PreToolUse check-behind.mjs. Gemini has no confirmed before-tool deny event.";
 const CAVEAT_PERMS =
-  "NOT ported: Write/Edit(platform/**). Gemini tool controls are name-scoped, not path-scoped.";
+  "path-scoped permissions.deny not ported; Gemini is name-scoped";
 
 export function parseArgv(argv) {
   const args = Array.isArray(argv) ? argv : [];
@@ -83,8 +82,13 @@ function hasScript(root, name) {
   return fs.existsSync(path.join(root, "scripts", name));
 }
 
-function hasPlatform(root) {
-  return fs.existsSync(path.join(root, "platform"));
+function withoutWritePath(arr) {
+  return arr.filter((x) => typeof x === "string" && !x.startsWith("Write("));
+}
+
+function loadConsumerDeny(root) {
+  const data = loadJson(path.join(root, ".rulesync/permissions.json"));
+  return Array.isArray(data.deny) ? withoutWritePath(data.deny) : [];
 }
 
 function presentAutorun(root) {
@@ -229,8 +233,11 @@ function applyClaude(root) {
   const post = desiredPost(root);
   if (post) hooks.PostToolUse = upsertGroups(hooks.PostToolUse, post);
   const permissions = isPlainObject(live.permissions) ? { ...live.permissions } : {};
-  const deny = Array.isArray(permissions.deny) ? [...permissions.deny] : [];
-  permissions.deny = hasPlatform(root) ? uniq([...deny, ...PLATFORM_DENY]) : deny;
+  const liveDeny = Array.isArray(permissions.deny) ? permissions.deny : [];
+  permissions.deny = uniq([
+    ...liveDeny.filter((x) => typeof x !== "string" || !x.startsWith("Write(")),
+    ...loadConsumerDeny(root),
+  ]);
   const next = { ...live, permissions, hooks };
   saveJson(abs, next);
 }
@@ -313,11 +320,7 @@ export function checkUnion(opts = {}) {
     {
       id: "claude",
       path: ".claude/settings.json",
-      needles: [
-        ...GRUNT_NEEDLES,
-        ...autorun,
-        ...(hasPlatform(root) ? PLATFORM_DENY : []),
-      ],
+      needles: [...GRUNT_NEEDLES, ...autorun, ...loadConsumerDeny(root)],
     },
     {
       id: "codex",

package/scripts/scrub-spawn-prompt.mjs

@@ -123,6 +123,28 @@ export function capSpawnPrompt(prompt) {
   return (again.body + verdictPart).trim();
 }
 
+const SPAWN_TYPE_KEYS = ["subagent_type", "subagentType", "name", "type", "agent"];
+const FORBIDDEN_SPAWN_TYPES = new Set([
+  "explore",
+  "plan",
+  "general-purpose",
+  "orchestrator",
+]);
+
+function spawnTypeCandidate(toolInput) {
+  for (const k of SPAWN_TYPE_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(toolInput, k)) continue;
+    if (toolInput[k] == null) continue;
+    const v = String(toolInput[k]).trim();
+    if (!v) continue;
+    const key = v.toLowerCase();
+    if (ALLOWED_TYPES.has(key)) return key;
+    if (FORBIDDEN_SPAWN_TYPES.has(key)) return "";
+    return "";
+  }
+  return "";
+}
+
 export function rewriteSpawnToolInput(toolInput, { defaultGrunt = false } = {}) {
   if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
     return defaultGrunt ? { subagent_type: "grunt" } : null;
@@ -132,13 +154,13 @@ export function rewriteSpawnToolInput(toolInput, { defaultGrunt = false } = {})
   let changed = false;
 
   if (defaultGrunt) {
-    const cur =
-      toolInput.subagent_type != null
-        ? String(toolInput.subagent_type).trim()
-        : toolInput.subagentType != null
-          ? String(toolInput.subagentType).trim()
-          : "";
-    if (!ALLOWED_TYPES.has(cur)) {
+    const cur = spawnTypeCandidate(toolInput);
+    if (ALLOWED_TYPES.has(cur)) {
+      if (String(next.subagent_type || "") !== cur) {
+        next.subagent_type = cur;
+        changed = true;
+      }
+    } else {
       next.subagent_type = "grunt";
       if (Object.prototype.hasOwnProperty.call(toolInput, "subagentType")) {
         next.subagentType = "grunt";