@polymorphism-tech/morph-spec 8.38.0 → 8.41.0

package/src/lib/installers/memory-installer.js

@@ -1,5 +1,5 @@
 /**
- * Memory Installer — populates Claude Code persistent memory during morph-init.
+ * Memory Installer — populates Claude Code persistent memory during `morph-spec init`.
  *
  * Writes two memory files (project + reference) plus an entry in MEMORY.md
  * so future Claude Code sessions enter pre-contextualized about the
@@ -67,7 +67,6 @@ metadata:
 - When user mentions a feature, check \`.morph/features/\` first.
 - When user types \`/morph-proposal\`, invoke \`Skill(morph-proposal)\` directly.
 - In \`trust: "auto"\`, gates auto-pass; only AskUserQuestion on risk signals.
-- Prefer morph-* skills over superpowers:* equivalents in this project.
 `;
 }
 

package/src/lib/projects/registry.js

@@ -0,0 +1,154 @@
+/**
+ * Where the morph-spec projects on this machine are — the list the dashboard's
+ * portfolio reads. Nothing else records it: each project only knows its own
+ * `.morph/`.
+ *
+ * Three writers register a project as a side note of what they already do —
+ * `init`, `update` (never under `--dry-run`) and `dashboard` — and the
+ * dashboard adds and removes on request. Registering is fail-open: a registry
+ * that cannot be read or written never fails the command that tried.
+ *
+ * The file lives in the user's home (`~/.morph-spec/projects.json`, or
+ * `MORPH_PROJECTS_REGISTRY`), read through `os.homedir()` at call time so a
+ * suite that isolates the home also isolates this file. Paths under the
+ * system temp dir are never registered: the test suites run `init`/`update`
+ * there by the hundred, including through spawned CLIs that keep the real home.
+ */
+
+import { existsSync, readFileSync, readdirSync } from 'fs';
+import { homedir, tmpdir } from 'os';
+import { join, resolve, basename, dirname } from 'path';
+import { atomicWriteJson } from '../../core/state/state-manager.js';
+import { canonicalPath, isInside } from '../tasks/test-runner.js';
+import { WORKTREE_DIR_NAMES } from '../worktree/dirs.js';
+
+export const REGISTRY_VERSION = 1;
+
+export function registryPath() {
+  return process.env.MORPH_PROJECTS_REGISTRY || join(homedir(), '.morph-spec', 'projects.json');
+}
+
+/** One spelling per directory: canonical, forward slashes (the registry is read back on any OS). */
+export function projectKey(dir) {
+  return canonicalPath(resolve(dir)).replace(/\\/g, '/');
+}
+
+const sameDir = (a, b) => (process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b);
+
+/** A folder is a morph-spec project when morph-spec installed its config there. */
+export function isMorphProject(dir) {
+  return existsSync(join(dir, '.morph', 'config', 'config.json'));
+}
+
+/** A worktree checkout is part of its repo's project, never a project of its own. */
+function insideWorktreeContainer(dir) {
+  const parent = basename(dirname(dir));
+  return WORKTREE_DIR_NAMES.includes(parent);
+}
+
+function projectName(dir) {
+  try {
+    const config = JSON.parse(readFileSync(join(dir, '.morph', 'config', 'config.json'), 'utf8'));
+    const name = config?.project?.name;
+    // Some configs carry the project path as its name; the folder reads better.
+    return typeof name === 'string' && name.trim() && !/[\\/]/.test(name) ? name.trim() : basename(dir);
+  } catch {
+    return basename(dir);
+  }
+}
+
+/**
+ * The registered projects that still exist. A folder that was deleted or lost
+ * its `.morph/` drops out on read — the file is rewritten on the next write.
+ *
+ * @returns {{ version: number, projects: Array<{ dir: string, name: string, addedAt: string, lastSeenAt: string, source: string }> }}
+ */
+export function readRegistry() {
+  let data = null;
+  try {
+    const path = registryPath();
+    if (existsSync(path)) data = JSON.parse(readFileSync(path, 'utf8'));
+  } catch { /* unreadable registry reads as empty */ }
+  const projects = Array.isArray(data?.projects) ? data.projects : [];
+  return {
+    version: REGISTRY_VERSION,
+    projects: projects.filter((p) => typeof p?.dir === 'string' && isMorphProject(p.dir)),
+  };
+}
+
+function write(projects) {
+  atomicWriteJson(registryPath(), { version: REGISTRY_VERSION, projects });
+}
+
+/**
+ * Note that `dir` is a morph-spec project. Idempotent; refreshes `lastSeenAt`.
+ * Never throws.
+ *
+ * @param {string} dir
+ * @param {'init'|'update'|'dashboard'|'manual'} source
+ * @param {{ tempRoot?: string }} [opts] - test seam: the folder whose
+ *   projects are never registered (the system temp dir)
+ * @returns {boolean} true when the project is in the registry afterwards
+ */
+export function registerProject(dir, source, { tempRoot = tmpdir() } = {}) {
+  try {
+    const key = projectKey(dir);
+    if (isInside(canonicalPath(key), canonicalPath(tempRoot))) return false;
+    if (!isMorphProject(key) || insideWorktreeContainer(key)) return false;
+    const now = new Date().toISOString();
+    const { projects } = readRegistry();
+    const found = projects.find((p) => sameDir(p.dir, key));
+    if (found) {
+      found.lastSeenAt = now;
+      found.name = projectName(key);
+    } else {
+      projects.push({ dir: key, name: projectName(key), addedAt: now, lastSeenAt: now, source });
+    }
+    write(projects);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Take a project off the list. Its files are not touched. Never throws. */
+export function unregisterProject(dir) {
+  try {
+    const key = projectKey(dir);
+    const { projects } = readRegistry();
+    const kept = projects.filter((p) => !sameDir(p.dir, key));
+    if (kept.length !== projects.length) write(kept);
+    return kept.length !== projects.length;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * morph-spec projects directly under each root that are not registered yet —
+ * the portfolio offers them, the person decides. One level deep: a repos
+ * folder is the expected root, and a deeper walk would enter node_modules and
+ * worktrees for nothing.
+ *
+ * @param {string[]} roots
+ * @returns {Array<{ dir: string, name: string }>}
+ */
+export function discoverProjects(roots) {
+  const registered = readRegistry().projects.map((p) => p.dir);
+  const out = [];
+  const seen = new Set();
+  for (const root of roots) {
+    let entries = [];
+    try { entries = readdirSync(root, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      if (!e.isDirectory() || e.name.startsWith('.') || e.name === 'node_modules') continue;
+      const dir = join(root, e.name);
+      if (!isMorphProject(dir)) continue;
+      const key = projectKey(dir);
+      if (seen.has(key.toLowerCase()) || registered.some((r) => sameDir(r, key))) continue;
+      seen.add(key.toLowerCase());
+      out.push({ dir: key, name: projectName(key) });
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}

package/src/lib/risk-detector.js

@@ -27,6 +27,8 @@
  *     section?, uncovered? } derivado do 1-design/mockups.md. No uiux, checklist
  *     de tela incompleto pausa; no ship, item decidido sem a conferência do
  *     avaliador pausa. Mockup legado é isento nos dois, com a razão listada
+ *   - oversizedTasks + gate: array    — tasks acima de MAX_TASK_OUTPUTS outputs;
+ *     pausa SÓ no plano (gate 'plan'): a task tem de caber num dispatch
  *   - evalScore: number               — morph-eval score (pause if < 9)
  *   - taskCount: number               — total tasks (pause if > 20)
  */
@@ -425,6 +427,14 @@ export function shouldPauseGate(config, signals) {
     };
   }
 
+  if (signals.gate === 'plan' && Array.isArray(signals.oversizedTasks) && signals.oversizedTasks.length > 0) {
+    const list = signals.oversizedTasks.map((t) => `${t.id} (${t.outputs})`).join(', ');
+    return {
+      pause: true,
+      reason: `task grande demais para um dispatch: ${list} outputs — fatie por pós-condição`,
+    };
+  }
+
   if (typeof signals.evalScore === 'number' && signals.evalScore < MIN_EVAL_SCORE) {
     return {
       pause: true,
@@ -498,6 +508,9 @@ export function getRiskSignals(signals) {
       out.push(`prompt/modelo tocado (${touched.length}) com eval ${signals.evalsStatus ?? 'não declarado'}`);
     }
   }
+  if (signals.gate === 'plan' && Array.isArray(signals.oversizedTasks) && signals.oversizedTasks.length > 0) {
+    out.push(`tasks grandes demais: ${signals.oversizedTasks.map((t) => t.id).join(', ')}`);
+  }
   if (typeof signals.evalScore === 'number' && signals.evalScore < MIN_EVAL_SCORE) {
     out.push(`eval score ${signals.evalScore}/10`);
   }

package/src/lib/tasks/tasks-json-parser.js

@@ -193,6 +193,27 @@ export function parseTasksJsonSync(filePath) {
   return data;
 }
 
+/**
+ * Teto de `outputs` por task: a task inteira tem de caber num dispatch. Medido
+ * em campo (chat-demo-simulacao): tasks de 12 a 30 outputs levaram 6 de 10
+ * sub-agents ao teto de turnos, e cada retomada custou um contexto frio.
+ */
+export const MAX_TASK_OUTPUTS = 8;
+
+/**
+ * A régua única de "task grande demais", lida pelo `dag` e pelo `gate-check`.
+ * Fora de `validateTasksJson` de propósito: `outputs` segue mutável depois do
+ * Gate 2, e o teto num write de status travaria feature em voo.
+ *
+ * @returns {{ id: string, outputs: number }[]}
+ */
+export function oversizedTasks(data) {
+  const tasks = Array.isArray(data?.tasks) ? data.tasks : [];
+  return tasks
+    .filter(t => Array.isArray(t?.outputs) && t.outputs.length > MAX_TASK_OUTPUTS)
+    .map(t => ({ id: t.id, outputs: t.outputs.length }));
+}
+
 /**
  * @returns {object[]} tasks with status === 'pending'
  */

package/src/lib/validators/code-budget/code-budget-validator.js

@@ -5,7 +5,9 @@
  *   (a) linhas de comentário que citam processo (task, UC, ADR, Gate...), que o
  *       standard `architecture-code-comments` manda para o commit;
  *   (b) linhas de teste ÷ linhas de produção, contra o orçamento por task do
- *       `morph-plan` (um teste por pós-condição + um de regressão por bug).
+ *       `morph-plan` (um teste por pós-condição + um de regressão por bug);
+ *   (c) linhas de comentário ÷ linhas de código, porque o padrão do standard é
+ *       nenhum comentário. Doc-comment (`///`, JSDoc) conta como qualquer outro.
  *
  * Sempre `warning`: é medida de volume, e o excesso pode estar justificado na
  * task. Um aviso por medida, não por linha, porque cada aviso custa 1 ponto no
@@ -28,6 +30,12 @@ export const MAX_TEST_RATIO = 1.5;
 /** Abaixo disto a razão não é julgada: a regressão de um bug de 2 linhas cabe aqui. */
 export const MIN_TEST_LINES = 40;
 
+/** Mais de uma linha de comentário a cada dez de código: os nomes não estão fazendo o trabalho. */
+export const MAX_COMMENT_RATIO = 0.1;
+
+/** Abaixo disto a densidade não é julgada: um comentário legítimo num arquivo pequeno já passaria da razão. */
+export const MIN_CODE_LINES = 40;
+
 /** Quantos locais citar no aviso de comentário antes de resumir com "(+N)". */
 const MAX_CITED = 4;
 
@@ -42,10 +50,10 @@ const decimal = (n) => n.toFixed(1).replace('.', ',');
  * @param {Array<{path: string, content: string, added: number[]|null}>} files -
  *   `added` são as linhas adicionadas; `null` é o arquivo inteiro (novo)
  * @returns {{commentLines: number, processLines: Array<{file: string, line: number, text: string}>,
- *   testLines: number, productionLines: number}}
+ *   testLines: number, productionLines: number, commentsByFile: Record<string, number>}}
  */
 export function measureCodeBudget(files) {
-  const measured = { commentLines: 0, processLines: [], testLines: 0, productionLines: 0 };
+  const measured = { commentLines: 0, processLines: [], testLines: 0, productionLines: 0, commentsByFile: {} };
 
   for (const { path, content, added } of files) {
     if (!isProjectSource(path) || GENERATED.test(path)) continue;
@@ -60,6 +68,7 @@ export function measureCodeBudget(files) {
     for (const [line, text] of commentLines(content, path)) {
       if (!isAdded(line)) continue;
       measured.commentLines++;
+      measured.commentsByFile[path] = (measured.commentsByFile[path] ?? 0) + 1;
       if (citesProcess(text)) measured.processLines.push({ file: path, line, text });
     }
   }
@@ -73,7 +82,7 @@ export function measureCodeBudget(files) {
  */
 export function budgetIssues(measured) {
   const issues = [];
-  const { commentLines: comments, processLines, testLines, productionLines } = measured;
+  const { commentLines: comments, processLines, testLines, productionLines, commentsByFile = {} } = measured;
 
   if (processLines.length > 0) {
     const shown = processLines.slice(0, MAX_CITED).map((p) => `${p.file}:${p.line}`);
@@ -104,6 +113,25 @@ export function budgetIssues(measured) {
     });
   }
 
+  const codeLines = testLines + productionLines - comments;
+  if (codeLines >= MIN_CODE_LINES && comments > MAX_COMMENT_RATIO * codeLines) {
+    const ranked = Object.entries(commentsByFile).sort(([, a], [, b]) => b - a);
+    const shown = ranked.slice(0, MAX_CITED).map(([file, n]) => `${file} (${n})`);
+    const more = ranked.length - shown.length;
+    issues.push({
+      level: 'warning',
+      message:
+        `${comments} linhas de comentário para ${codeLines} de código adicionadas ` +
+        `(${decimal((comments / codeLines) * 10)} a cada 10, o teto é ${decimal(MAX_COMMENT_RATIO * 10)}): ` +
+        `${shown.join(', ')}${more > 0 ? ` (+${more})` : ''}`,
+      file: ranked[0]?.[0],
+      solution:
+        'O padrão é nenhum comentário: renomeie, extraia função ou constante, expresse no tipo ou ' +
+        'escreva um teste. Fica só o porquê que o código não mostra, sem doc-comment que repete a ' +
+        'assinatura (standard architecture-code-comments).',
+    });
+  }
+
   return issues;
 }
 

package/src/lib/worktree/env-allocator.js

@@ -191,16 +191,22 @@ export function portLayout(block, { stack = '', feature = '' } = {}) {
  * feature, and exactly the `portLayout()` pairs — nothing else, so the file
  * cannot drift from what compose receives.
  *
- * @param {string} feature
+ * `morphFeature` is for a task tree born from `morph/<f>`: `MORPH_FEATURE`
+ * names the feature it works for, while the block and `COMPOSE_PROJECT_NAME`
+ * stay keyed by `feature` (`task/<n>`) — keying them by `<f>` would hand the
+ * sub-agent the feature's own ports and compose project.
+ *
+ * @param {string} feature - the env-registry key: `<feature>` or `task/<name>`
  * @param {{ base: number, range: [number, number] }} block
  * @param {string} [stack] - config.json `project.stack` (e.g. "nextjs+dotnet")
+ * @param {{ morphFeature?: string|null }} [opts]
  * @returns {string}
  */
-export function buildEnvFileContent(feature, block, stack = '') {
+export function buildEnvFileContent(feature, block, stack = '', { morphFeature = null } = {}) {
   const lines = [
     `# Managed by morph-spec — ambiente dedicado desta worktree (feature: ${feature}).`,
     '# Derivado, git-invisível, regenerado por `worktree setup|link`; nunca editar nem commitar.',
-    `MORPH_FEATURE=${feature}`,
+    `MORPH_FEATURE=${morphFeature || feature}`,
     ...Object.entries(portLayout(block, { stack, feature })).map(([k, v]) => `${k}=${v}`),
   ];
   return `${lines.join('\n')}\n`;

package/src/scripts/install-plugin.js

@@ -100,7 +100,7 @@ async function downloadPluginFiles(pluginName, sha, destDir) {
 
 /**
  * Install a Claude Code plugin from GitHub.
- * @param {string} pluginName - e.g. "superpowers"
+ * @param {string} pluginName - e.g. "context7"
  * @returns {{ installed: boolean, version: string, alreadyInstalled: boolean }}
  */
 export async function installPlugin(pluginName) {

package/src/scripts/setup-infra.js

@@ -2,9 +2,8 @@
  * setup-infra.js
  *
  * Headless infrastructure setup for MORPH-SPEC.
- * Extracted from init.js (steps 1-10) so it can be called by the
- * /morph-init Claude Code skill via `morph-spec setup-infra` without
- * interactive prompts or stack detection.
+ * Extracted from init.js (steps 1-10) so it can run as
+ * `morph-spec setup-infra` without interactive prompts or stack detection.
  *
  * Usage:
  *   import { setupInfra } from './setup-infra.js';
@@ -38,7 +37,6 @@ import { realEffects } from '../lib/installers/effects.js';
 const FRAMEWORK_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'framework');
 
 const REQUIRED_PLUGINS = [
-  'superpowers@claude-plugins-official',
   'context7@claude-plugins-official',
 ];
 

package/src/utils/agents-installer.js

@@ -102,6 +102,35 @@ export function resolveMaxTurns(agent) {
   return agent.maxTurns ?? DEFAULT_MAX_TURNS;
 }
 
+/** Values Claude Code accepts in a subagent's `effort` frontmatter. */
+export const VALID_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max'];
+
+/**
+ * The ONE rule for a valid `effort` — same four readers as `maxTurnsProblem`.
+ * Absent means the frontmatter carries no `effort:` line and the sub-agent
+ * inherits the session's effort, byte-for-byte what the generator emitted
+ * before the field existed.
+ *
+ * @param {unknown} value - the raw agents.json value
+ * @returns {string|null} what was expected, or null when valid
+ */
+export function effortProblem(value) {
+  if (value === undefined) return null;
+  return VALID_EFFORTS.includes(value) ? null : `esperado um de ${VALID_EFFORTS.join('|')}`;
+}
+
+/**
+ * @param {string} id - persona id (agents.json key)
+ * @param {unknown} value - the raw agents.json value
+ * @returns {string|null} null when valid
+ */
+export function effortError(id, value) {
+  const problem = effortProblem(value);
+  if (!problem) return null;
+  return `agents.json: persona "${id}" tem effort inválido (${JSON.stringify(value)}) — ${problem}. ` +
+    'Remova o campo para herdar o effort da sessão.';
+}
+
 /** A surface id is the key the mockup checklist names (`Superfície: admin-app`). */
 const SURFACE_ID_RE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 
@@ -192,23 +221,69 @@ export function personaStandardIds(persona) {
 
 /** The first validity error of a persona entry, or null — what drift reports as `invalid`. */
 function personaError(agent) {
-  return maxTurnsError(agent.id, agent.maxTurns) ?? surfacesError(agent.id, agent.surfaces, agent.standards);
+  return maxTurnsError(agent.id, agent.maxTurns)
+    ?? surfacesError(agent.id, agent.surfaces, agent.standards)
+    ?? effortError(agent.id, agent.effort);
+}
+
+/**
+ * Tools every persona gets on top of its scope. A `tools:` line is a strict
+ * allowlist: without `Skill` the sub-agent cannot invoke a single skill, and
+ * without `ToolSearch` it cannot load an MCP tool the session defers.
+ */
+export const PLATFORM_TOOLS = ['Skill', 'ToolSearch'];
+
+/**
+ * The server names an MCP registry entry is granted under. Claude Code names a
+ * server's tools after WHERE it is configured — `mcp__context7__*` from
+ * `.mcp.json`, `mcp__plugin_context7_context7__*` from the plugin — and a grant
+ * only matches its own spelling (measured 2026-09-24: `mcp__context7` gave a
+ * plugin-installed context7 nothing). So every spelling becomes a grant; one
+ * the project does not configure is inert.
+ *
+ * @param {string} id - registry key
+ * @param {object} entry - registry entry
+ * @returns {string[]}
+ */
+export function mcpServerNames(id, entry) {
+  // A malformed list falls back to the id instead of breaking the render:
+  // installAgents and checkAgentsDrift both go through here (fail-open).
+  return serverNamesProblem(id, entry?.serverNames) === null ? entry?.serverNames ?? [id] : [id];
 }
 
 /**
- * Load the ids of MCP servers known to the framework registry
- * (framework/mcp/registry.json). Used to validate agents.json `mcp` entries:
- * only registry-known servers become tool grants (fail-open on any error).
+ * The ONE rule for a registry entry's `serverNames` (validate-framework Check 8
+ * reads it). Absent is valid (`[id]`). Present: non-empty, only the characters
+ * Claude Code keeps in a tool name, and it must include the id itself — that is
+ * the name the MCP installer writes into `.mcp.json`.
+ *
+ * @param {string} id - registry key
+ * @param {unknown} value - the raw `serverNames`
+ * @returns {string|null} what was expected, or null when valid
+ */
+export function serverNamesProblem(id, value) {
+  if (value === undefined) return null;
+  if (!Array.isArray(value) || value.length === 0) return 'esperado array não vazio';
+  const bad = value.find(n => typeof n !== 'string' || !/^[A-Za-z0-9_-]+$/.test(n));
+  if (bad !== undefined) return `nome inválido ${JSON.stringify(bad)} (só [A-Za-z0-9_-])`;
+  return value.includes(id) ? null : `precisa incluir o próprio id "${id}"`;
+}
+
+/**
+ * Load the MCP servers known to the framework registry
+ * (framework/mcp/registry.json) with the server names each is granted under.
+ * Only registry-known ids in agents.json `mcp` become tool grants (fail-open
+ * on any error).
  *
  * @param {string} frameworkDir
- * @returns {Set<string>|null} null = no registry found (accept nothing)
+ * @returns {Map<string, string[]>|null} id → server names; null = no registry found (accept nothing)
  */
 export function loadKnownMcpIds(frameworkDir) {
   try {
     const registryPath = join(frameworkDir, 'mcp', 'registry.json');
     if (!existsSync(registryPath)) return null;
     const registry = JSON.parse(readFileSync(registryPath, 'utf-8'));
-    return new Set(Object.keys(registry.mcps ?? {}));
+    return new Map(Object.entries(registry.mcps ?? {}).map(([id, entry]) => [id, mcpServerNames(id, entry)]));
   } catch {
     return null;
   }
@@ -321,8 +396,8 @@ export async function installAgents(projectDir, frameworkDir = 'framework', opti
  * stale file differs byte-for-byte from this output).
  *
  * @param {object} agent - agents.json entry with `id` merged in
- * @param {Set<string>|null} [knownMcpIds] - registry-known MCP ids; agents.json
- *   `mcp` entries outside this set are ignored (null = ignore all)
+ * @param {Map<string, string[]>|null} [knownMcpIds] - registry-known MCP ids and
+ *   their server names; agents.json `mcp` entries outside it are ignored (null = ignore all)
  * @returns {string} complete file content
  */
 export function renderAgentMd(agent, knownMcpIds = null) {
@@ -332,20 +407,23 @@ export function renderAgentMd(agent, knownMcpIds = null) {
   const maxTurns = resolveMaxTurns(agent);
   const surfaces = surfacesError(agent.id, agent.surfaces, agent.standards);
   if (surfaces) throw new Error(surfaces);
+  const effort = effortError(agent.id, agent.effort);
+  if (effort) throw new Error(effort);
   const frontmatter = buildFrontmatter(agent, description, knownMcpIds, maxTurns);
   const body = buildBody(agent, maxTurns);
   return `---\n${frontmatter}---\n\n${MANAGED_HEADER}\n\n${body}\n`;
 }
 
 function buildToolsLine(agent, knownMcpIds) {
-  const base = agent.tools ?? DEFAULT_AGENT_TOOLS;
+  const base = String(agent.tools ?? DEFAULT_AGENT_TOOLS).split(',').map(t => t.trim()).filter(Boolean);
+  const platform = PLATFORM_TOOLS.filter(t => !base.includes(t));
   // Domain-relevant MCP servers (agents.json `mcp: [ids]`) become server-level
-  // grants (`mcp__{id}`). Only registry-known ids are emitted; in projects
-  // without that server configured the grant is inert.
+  // grants, one per server name (`mcp__{name}`). Only registry-known ids are
+  // emitted; in projects without that server configured the grant is inert.
   const mcpGrants = (agent.mcp ?? [])
     .filter(id => knownMcpIds?.has(id))
-    .map(id => `mcp__${id}`);
-  return [base, ...mcpGrants].join(', ');
+    .flatMap(id => knownMcpIds.get(id).map(name => `mcp__${name}`));
+  return [...base, ...platform, ...mcpGrants].join(', ');
 }
 
 function buildFrontmatter(agent, description, knownMcpIds, maxTurns) {
@@ -364,6 +442,7 @@ function buildFrontmatter(agent, description, knownMcpIds, maxTurns) {
     // exactly what the hardcoded `maxTurns: 20` rendered.
     `maxTurns: ${maxTurns}`,
   ];
+  if (agent.effort) lines.push(`effort: ${agent.effort}`);
   if (agent.color) lines.push(`color: ${agent.color}`);
   lines.push(`memory: project`, '');
   return lines.join('\n');
@@ -430,6 +509,22 @@ function buildBody(agent, maxTurns) {
       '`PARCIAL` on line 1, done, remaining, files, no score (final report only) — then continue or stop, your call; the final report replaces it.',
   );
 
+  // The dispatch template is paraphrased by the orchestrator in the field; this
+  // body is the only text every implementer dispatch is guaranteed to carry.
+  // Gated on `effort` so a persona without it renders byte-for-byte as before.
+  if (agent.effort && isImplementer(agent)) {
+    lines.push(
+      '',
+      '## Working fast',
+      '',
+      'Independent tool calls go in the SAME response: read every listed file at once, fire the Greps together. ' +
+        'Use Read/Grep/Glob, never grep/sed/cat/find via Bash. Check a library API in the `context7` MCP before guessing ' +
+        '(load a deferred `mcp__` tool with ToolSearch). Write the tests the budget asks for, then run only your own ' +
+        'filter ONCE before the report — no red→green cycles, no `morph-spec verify` (the orchestrator proves it). ' +
+        'Never alter, revert or move production code to watch a test fail: mutation proof belongs to the Gate 3 evaluator.',
+    );
+  }
+
   return lines.join('\n');
 }
 

package/src/utils/banner.js

@@ -117,7 +117,7 @@ export function printInstallBanner({ version, nodeVersion, results = [] }) {
       sep("Next · new project"),
       `  ${chalk.cyan("1.")} ${DIM("cd")} ${chalk.white("your-project")} ${DIM("(git repo)")}`,
       `  ${chalk.cyan("2.")} Run ${chalk.bold.white("morph-spec init")}`,
-      `  ${chalk.cyan("3.")} Open it in Claude Code and run ${chalk.bold.white("/morph-init")}`,
+      `  ${chalk.cyan("3.")} Open it in Claude Code and run ${chalk.bold.white("/morph-proposal <feature>")}`,
       "",
       sep("Next · project already on morph-spec"),
       `  ${chalk.cyan("1.")} Run ${chalk.bold.white("morph-spec update")} ${DIM("— after a CLI upgrade or a project.stack change: full stack-aware resync")}`,

package/src/commands/index.js

@@ -1,13 +0,0 @@
-/**
- * All Commands - Category Exports
- *
- * Commands organized by functional category.
- */
-
-export * from './state/index.js';
-export * from './validation/index.js';
-export * from './templates/index.js';
-export * from './project/index.js';
-export * from './tasks/index.js';
-export * from './agents/index.js';
-export * from './utils/index.js';