@qduc/term2 0.8.0 → 0.9.1

package/dist/prompts/kimi.md

@@ -10,6 +10,8 @@ When handling the user's request, if it involves creating, modifying, or running
 
 If the `run_subagent` tool is available, you can use it to delegate a focused subtask to a subagent instance. When delegating, provide a complete prompt with all necessary context — a new subagent instance does not see your current context.
 
+Unsandboxed shell commands require explicit user approval and must be run directly by the main agent. Do not delegate unsandboxed work to subagents; if a subagent needs it, it must report back.
+
 You have the capability to output any number of tool calls in a single response. If you anticipate making multiple non-interfering tool calls, you are HIGHLY RECOMMENDED to make them in parallel to significantly improve efficiency. This is very important to your performance.
 
 The results of the tool calls will be returned to you in a tool message. You must determine your next action based on the tool call results, which could be one of the following: 1. Continue working on the task, 2. Inform the user that the task is completed or has failed, or 3. Ask the user for more information.
@@ -54,7 +56,7 @@ The user may ask you to research on certain topics, process or generate certain
 
 ## Operating System
 
-The operating environment is not in a sandbox. Any actions you do will immediately affect the user's system. So you MUST be extremely cautious. Unless being explicitly instructed to do so, you should never access (read/write/execute) files outside of the working directory.
+Unless being explicitly instructed to do so, you should never access (read/write/execute) files outside of the working directory.
 
 # Project Information
 

package/dist/prompts/prompt-constructor.d.ts

@@ -8,6 +8,7 @@ export type PromptConstructorOptions = {
     searchViaShell?: boolean;
     codeContextEnabled?: boolean;
     runSubagentEnabled?: boolean;
+    sandboxEnabled?: boolean;
     executionContext?: ExecutionContext;
 };
 export type PromptSpec = {

package/dist/prompts/prompt-constructor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-constructor.d.ts","sourceRoot":"","sources":["../../source/prompts/prompt-constructor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAOzE,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAIF,wBAAgB,eAAe,CAAC,OAAO,EAAE,wBAAwB,GAAG,UAAU,CAqD7E"}
+{"version":3,"file":"prompt-constructor.d.ts","sourceRoot":"","sources":["../../source/prompts/prompt-constructor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAMzE,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,wBAAgB,eAAe,CAAC,OAAO,EAAE,wBAAwB,GAAG,UAAU,CAgD7E"}

package/dist/prompts/prompt-constructor.js

@@ -1,62 +1,36 @@
-import { shouldPreferPatchEditingModel } from '../lib/tool-selection-policy.js';
-// import { getReasoningEfficiencyAddendum } from './reasoning-efficiency.js';
+import { selectPromptProfile } from './prompt-profiles.js';
 import { getSearchViaShellAddendum } from './search-via-shell.js';
 import { getSubagentDelegationAddendum } from './subagent-delegation.js';
-import { selectPromptProfile } from './prompt-profiles.js';
-import { ASK_USER_DECLINE_RESULT } from '../tools/agent/ask-user-constants.js';
-// const GPT_OVER_THINKING_MODEL_KEYS = ['kimi', 'deepseek', 'glm', 'qwen', 'minimax', 'mimo'];
+import { getShellSandboxAddendum } from './shell-sandbox.js';
 export function buildPromptSpec(options) {
-    const { model, liteMode, orchestratorMode, mentorMode, searchViaShell, codeContextEnabled, runSubagentEnabled, executionContext, } = options;
-    // const normalizedModel = model.trim().toLowerCase();
+    const { model, liteMode, orchestratorMode = false, mentorMode = false, searchViaShell = false, runSubagentEnabled = false, sandboxEnabled = true, executionContext, } = options;
     const profile = selectPromptProfile({ model, liteMode, orchestratorMode });
     const fragmentFiles = [...(profile.fragmentFiles ?? [])];
     const inlineSections = [];
-    if (!liteMode) {
+    const isRegularMode = !liteMode;
+    const isAgentMode = !orchestratorMode;
+    if (isRegularMode) {
         fragmentFiles.push('worktree-hygiene.md');
     }
-    if (mentorMode && !liteMode) {
-        fragmentFiles.push('mentor-addon.md');
+    if (sandboxEnabled) {
+        inlineSections.push(getShellSandboxAddendum());
     }
-    if (!orchestratorMode && codeContextEnabled) {
-        inlineSections.push(getCodeContextSection({ liteMode }));
+    if (mentorMode && isRegularMode) {
+        fragmentFiles.push('mentor-addon.md');
     }
-    if (!orchestratorMode && searchViaShell) {
+    if (isAgentMode && searchViaShell) {
         inlineSections.push(getSearchViaShellAddendum({ executionContext }));
     }
-    else if (!orchestratorMode && (liteMode || !shouldPreferPatchEditingModel(model))) {
-        inlineSections.push(getDedicatedSearchToolsSection({ liteMode }));
-    }
     if (orchestratorMode && runSubagentEnabled) {
         inlineSections.push(getSubagentDelegationAddendum({ orchestratorMode }));
     }
-    if (!liteMode && !orchestratorMode) {
+    if (isRegularMode && isAgentMode) {
         fragmentFiles.push('plan-mode-info.md');
     }
-    // if (GPT_OVER_THINKING_MODEL_KEYS.some((key) => normalizedModel.includes(key))) {
-    //   inlineSections.push(getReasoningEfficiencyAddendum());
-    // }
-    inlineSections.push(getAskUserAddendum());
     return {
         basePromptFile: profile.basePromptFile,
         fragmentFiles,
         inlineSections,
     };
 }
-function getCodeContextSection({ liteMode }) {
-    return liteMode
-        ? '### Code Context Tools\n\n- `read_code_outline`: inspect file structure.\n- `code_context_search`: find related files or symbol declarations. Use `read_file` before editing.'
-        : '### Code Context Tools\n\n- Use `read_code_outline` for a compact file outline.\n- Use `code_context_search` for related files or symbol declarations.\n- Use `read_file` before editing.';
-}
-function getDedicatedSearchToolsSection({ liteMode }) {
-    return liteMode
-        ? '### Search Tools\n\n- `find_files`: locate files by name or glob.\n- `grep`: search file contents.'
-        : '### Search Tools\n\n- Prefer `find_files` for locating files by name or glob.\n- Prefer `grep` for searching code content or symbols.';
-}
-function getAskUserAddendum() {
-    return `### ask_user Tool Guidance
-
-- Use the \`ask_user\` tool when the user's request is short, vague, or ambiguous, or when an architecture or product-behavior decision needs to be made.
-- Provide concise options whenever possible; the first option should be the recommended (default) choice.
-- If the tool result is \`${ASK_USER_DECLINE_RESULT}\`, proceed using the safest reasonable default and state the assumption in your final response.`;
-}
 //# sourceMappingURL=prompt-constructor.js.map

package/dist/prompts/prompt-constructor.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-constructor.js","sourceRoot":"","sources":["../../source/prompts/prompt-constructor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAoB/E,+FAA+F;AAE/F,MAAM,UAAU,eAAe,CAAC,OAAiC;IAC/D,MAAM,EACJ,KAAK,EACL,QAAQ,EACR,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,GAAG,OAAO,CAAC;IACZ,sDAAsD;IACtD,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;QAC5C,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,gBAAgB,IAAI,cAAc,EAAE,CAAC;QACxC,cAAc,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpF,cAAc,CAAC,IAAI,CAAC,8BAA8B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;QAC3C,cAAc,CAAC,IAAI,CAAC,6BAA6B,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnC,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC1C,CAAC;IAED,mFAAmF;IACnF,2DAA2D;IAC3D,IAAI;IAEJ,cAAc,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAE1C,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,aAAa;QACb,cAAc;KACf,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,EAAE,QAAQ,EAAyB;IAChE,OAAO,QAAQ;QACb,CAAC,CAAC,+KAA+K;QACjL,CAAC,CAAC,2LAA2L,CAAC;AAClM,CAAC;AAED,SAAS,8BAA8B,CAAC,EAAE,QAAQ,EAAyB;IACzE,OAAO,QAAQ;QACb,CAAC,CAAC,oGAAoG;QACtG,CAAC,CAAC,uIAAuI,CAAC;AAC9I,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;;;;4BAImB,uBAAuB,kGAAkG,CAAC;AACtJ,CAAC"}
+{"version":3,"file":"prompt-constructor.js","sourceRoot":"","sources":["../../source/prompts/prompt-constructor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAqB7D,MAAM,UAAU,eAAe,CAAC,OAAiC;IAC/D,MAAM,EACJ,KAAK,EACL,QAAQ,EACR,gBAAgB,GAAG,KAAK,EACxB,UAAU,GAAG,KAAK,EAClB,cAAc,GAAG,KAAK,EACtB,kBAAkB,GAAG,KAAK,EAC1B,cAAc,GAAG,IAAI,EACrB,gBAAgB,GACjB,GAAG,OAAO,CAAC;IAEZ,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,WAAW,GAAG,CAAC,gBAAgB,CAAC;IAEtC,IAAI,aAAa,EAAE,CAAC;QAClB,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,cAAc,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,UAAU,IAAI,aAAa,EAAE,CAAC;QAChC,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,WAAW,IAAI,cAAc,EAAE,CAAC;QAClC,cAAc,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;QAC3C,cAAc,CAAC,IAAI,CAAC,6BAA6B,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,aAAa,IAAI,WAAW,EAAE,CAAC;QACjC,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,aAAa;QACb,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/prompts/prompt-constructor.test.ts

@@ -11,22 +11,6 @@ it('buildPromptSpec preserves mode precedence for base prompts', () => {
   expect(buildPromptSpec({ model: 'gpt-4o', liteMode: false }).basePromptFile).toBe('simple_v3.md');
 });
 
-it('buildPromptSpec includes ask_user guidance in all modes', () => {
-  const standard = buildPromptSpec({ model: 'gpt-4o', liteMode: false });
-  expect(standard.inlineSections.some((s) => s.includes('ask_user'))).toBe(true);
-
-  const lite = buildPromptSpec({ model: 'gpt-4o', liteMode: true });
-  expect(lite.inlineSections.some((s) => s.includes('ask_user'))).toBe(true);
-
-  const orchestrator = buildPromptSpec({
-    model: 'gpt-4o',
-    liteMode: false,
-    orchestratorMode: true,
-    runSubagentEnabled: true,
-  });
-  expect(orchestrator.inlineSections.some((s) => s.includes('ask_user'))).toBe(true);
-});
-
 // it('buildPromptSpec adds GPT version fragments without changing the base GPT prompt fallback', () => {
 //   const gpt55 = buildPromptSpec({ model: 'gpt-5.5-2026-04-23', liteMode: false });
 //   expect(gpt55.basePromptFile).toBe('gpt-5-modern.md');
@@ -61,6 +45,8 @@ it('buildPromptSpec composes file fragments in stable order', () => {
   });
 
   expect(spec.fragmentFiles).toEqual(['worktree-hygiene.md', 'mentor-addon.md', 'plan-mode-info.md']);
+
+  expect(spec.inlineSections).toContainEqual(expect.stringContaining('## Shell Sandbox'));
 });
 
 it('buildPromptSpec always includes plan-mode-info in standard mode to keep system prompt cache-stable', () => {
@@ -76,25 +62,6 @@ it('buildPromptSpec excludes plan-mode-info in lite and orchestrator modes', ()
   expect(orchestrator.fragmentFiles.includes('plan-mode-info.md')).toBe(false);
 });
 
-it('buildPromptSpec includes code context inline section when enabled and not orchestrator', () => {
-  const standard = buildPromptSpec({
-    model: 'gpt-4o',
-    liteMode: false,
-    codeContextEnabled: true,
-    searchViaShell: false,
-  });
-  expect(standard.inlineSections.length > 0).toBe(true);
-  expect(standard.inlineSections.some((s) => s.includes('Code Context'))).toBe(true);
-
-  const gpt5 = buildPromptSpec({
-    model: 'gpt-5.5',
-    liteMode: false,
-    codeContextEnabled: true,
-    searchViaShell: false,
-  });
-  expect(gpt5.inlineSections.some((s) => s.includes('Code Context'))).toBe(true);
-});
-
 it('buildPromptSpec includes subagent delegation for orchestrator mode', () => {
   const orchestrator = buildPromptSpec({
     model: 'gpt-5.5',
@@ -117,5 +84,17 @@ it('buildPromptSpec uses lite base and skips worktree-hygiene fragment in lite m
   });
   expect(lite.basePromptFile).toBe('lite.md');
   expect(lite.fragmentFiles.includes('worktree-hygiene.md')).toBe(false);
-  expect(lite.inlineSections.some((s) => s.includes('Search Tools'))).toBe(true);
+  // Shell sandbox is added inline in lite mode (sandbox enabled by default).
+  expect(lite.inlineSections.length).toBe(1);
+  expect(lite.inlineSections[0]).toContain('## Shell Sandbox');
+});
+
+it('buildPromptSpec excludes shell-sandbox when sandbox is disabled', () => {
+  const spec = buildPromptSpec({
+    model: 'gpt-4o',
+    liteMode: false,
+    sandboxEnabled: false,
+  });
+  expect(spec.inlineSections.some((s) => s.includes('## Shell Sandbox'))).toBe(false);
+  expect(spec.fragmentFiles.includes('worktree-hygiene.md')).toBe(true);
 });

package/dist/prompts/prompt-constructor.ts

@@ -1,10 +1,8 @@
-import { shouldPreferPatchEditingModel } from '../lib/tool-selection-policy.js';
 import type { ExecutionContext } from '../services/execution-context.js';
-// import { getReasoningEfficiencyAddendum } from './reasoning-efficiency.js';
+import { selectPromptProfile } from './prompt-profiles.js';
 import { getSearchViaShellAddendum } from './search-via-shell.js';
 import { getSubagentDelegationAddendum } from './subagent-delegation.js';
-import { selectPromptProfile } from './prompt-profiles.js';
-import { ASK_USER_DECLINE_RESULT } from '../tools/agent/ask-user-constants.js';
+import { getShellSandboxAddendum } from './shell-sandbox.js';
 
 export type PromptConstructorOptions = {
   model: string;
@@ -15,6 +13,7 @@ export type PromptConstructorOptions = {
   searchViaShell?: boolean;
   codeContextEnabled?: boolean;
   runSubagentEnabled?: boolean;
+  sandboxEnabled?: boolean;
   executionContext?: ExecutionContext;
 };
 
@@ -24,79 +23,52 @@ export type PromptSpec = {
   inlineSections: string[];
 };
 
-// const GPT_OVER_THINKING_MODEL_KEYS = ['kimi', 'deepseek', 'glm', 'qwen', 'minimax', 'mimo'];
-
 export function buildPromptSpec(options: PromptConstructorOptions): PromptSpec {
   const {
     model,
     liteMode,
-    orchestratorMode,
-    mentorMode,
-    searchViaShell,
-    codeContextEnabled,
-    runSubagentEnabled,
+    orchestratorMode = false,
+    mentorMode = false,
+    searchViaShell = false,
+    runSubagentEnabled = false,
+    sandboxEnabled = true,
     executionContext,
   } = options;
-  // const normalizedModel = model.trim().toLowerCase();
+
   const profile = selectPromptProfile({ model, liteMode, orchestratorMode });
   const fragmentFiles = [...(profile.fragmentFiles ?? [])];
   const inlineSections: string[] = [];
 
-  if (!liteMode) {
+  const isRegularMode = !liteMode;
+  const isAgentMode = !orchestratorMode;
+
+  if (isRegularMode) {
     fragmentFiles.push('worktree-hygiene.md');
   }
 
-  if (mentorMode && !liteMode) {
-    fragmentFiles.push('mentor-addon.md');
+  if (sandboxEnabled) {
+    inlineSections.push(getShellSandboxAddendum());
   }
 
-  if (!orchestratorMode && codeContextEnabled) {
-    inlineSections.push(getCodeContextSection({ liteMode }));
+  if (mentorMode && isRegularMode) {
+    fragmentFiles.push('mentor-addon.md');
   }
 
-  if (!orchestratorMode && searchViaShell) {
+  if (isAgentMode && searchViaShell) {
     inlineSections.push(getSearchViaShellAddendum({ executionContext }));
-  } else if (!orchestratorMode && (liteMode || !shouldPreferPatchEditingModel(model))) {
-    inlineSections.push(getDedicatedSearchToolsSection({ liteMode }));
   }
 
   if (orchestratorMode && runSubagentEnabled) {
     inlineSections.push(getSubagentDelegationAddendum({ orchestratorMode }));
   }
 
-  if (!liteMode && !orchestratorMode) {
+  if (isRegularMode && isAgentMode) {
     fragmentFiles.push('plan-mode-info.md');
   }
 
-  // if (GPT_OVER_THINKING_MODEL_KEYS.some((key) => normalizedModel.includes(key))) {
-  //   inlineSections.push(getReasoningEfficiencyAddendum());
-  // }
-
-  inlineSections.push(getAskUserAddendum());
-
   return {
     basePromptFile: profile.basePromptFile,
     fragmentFiles,
     inlineSections,
   };
 }
-
-function getCodeContextSection({ liteMode }: { liteMode: boolean }): string {
-  return liteMode
-    ? '### Code Context Tools\n\n- `read_code_outline`: inspect file structure.\n- `code_context_search`: find related files or symbol declarations. Use `read_file` before editing.'
-    : '### Code Context Tools\n\n- Use `read_code_outline` for a compact file outline.\n- Use `code_context_search` for related files or symbol declarations.\n- Use `read_file` before editing.';
-}
-
-function getDedicatedSearchToolsSection({ liteMode }: { liteMode: boolean }): string {
-  return liteMode
-    ? '### Search Tools\n\n- `find_files`: locate files by name or glob.\n- `grep`: search file contents.'
-    : '### Search Tools\n\n- Prefer `find_files` for locating files by name or glob.\n- Prefer `grep` for searching code content or symbols.';
-}
-
-function getAskUserAddendum(): string {
-  return `### ask_user Tool Guidance
-
-- Use the \`ask_user\` tool when the user's request is short, vague, or ambiguous, or when an architecture or product-behavior decision needs to be made.
-- Provide concise options whenever possible; the first option should be the recommended (default) choice.
-- If the tool result is \`${ASK_USER_DECLINE_RESULT}\`, proceed using the safest reasonable default and state the assumption in your final response.`;
-}

package/dist/prompts/shell-sandbox.d.ts

@@ -0,0 +1,2 @@
+export declare function getShellSandboxAddendum(): string;
+//# sourceMappingURL=shell-sandbox.d.ts.map

package/dist/prompts/shell-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-sandbox.d.ts","sourceRoot":"","sources":["../../source/prompts/shell-sandbox.ts"],"names":[],"mappings":"AAEA,wBAAgB,uBAAuB,IAAI,MAAM,CA0BhD"}

package/dist/prompts/shell-sandbox.js

@@ -0,0 +1,29 @@
+import { SANDBOX_TEMP_DIR } from '../utils/shell/temp-dir.js';
+export function getShellSandboxAddendum() {
+    return `## Shell Sandbox
+
+The \`shell\` tool runs commands inside a sandbox. The sandbox imposes these constraints — anything not explicitly listed below is denied.
+
+**What commands can do inside the sandbox:**
+
+- Read and write files inside the **project workspace** and **temp directory** (\`${SANDBOX_TEMP_DIR}\`).
+- Read common system tooling paths.
+- Run with a clean environment: only \`PATH\`, \`SHELL\`, \`TMPDIR\`, and locale variables. Any other environment variables are stripped.
+
+**When a command is blocked:**
+
+- Retry with \`sandbox="unsandboxed"\` to request a one-time escape (requires user approval).
+- Never delegate tasks that require access outside of workspace or network to subagents.
+
+**Network access:**
+
+- Outbound network calls go through a proxy (\`127.0.0.1:3128\`) that enforces an allowlist.
+- Connections to non-allowlisted hosts will be blocked with a \`403 Forbidden\` / \`blocked-by-allowlist\` response.
+- If you need unrestricted network access, use \`sandbox="unsandboxed"\` (requires user approval).
+
+**Untracked dotfiles:**
+
+The sandbox will automatically create some dotfiles in the workspace to enhance security, such as .bash_profile, .bashrc, .gitconfig, .mcp.json, .profile, .zprofile, .zshrc, .claude/, .codex, .gitmodules, .ripgreprc, etc. These files will be removed when the sandbox is destroyed. Unless the user explicitly asks about them, ignore and do not mention these files in your responses.
+`;
+}
+//# sourceMappingURL=shell-sandbox.js.map

package/dist/prompts/shell-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-sandbox.js","sourceRoot":"","sources":["../../source/prompts/shell-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,MAAM,UAAU,uBAAuB;IACrC,OAAO;;;;;;oFAM2E,gBAAgB;;;;;;;;;;;;;;;;;;CAkBnG,CAAC;AACF,CAAC"}

package/dist/prompts/shell-sandbox.md

@@ -0,0 +1,18 @@
+## Shell Sandbox
+
+The `shell` tool runs commands inside a sandbox. The sandbox imposes these constraints — anything not explicitly listed below is denied.
+
+**What commands can do inside the sandbox:**
+
+- Read and write files inside the **project workspace** and **temp directory**.
+- Read common system tooling paths.
+- Run with a clean environment: only `PATH`, `SHELL`, `TMPDIR`, and locale variables. Any other environment variables are stripped.
+
+**When a command is blocked:**
+
+- Retry with `sandbox="unsandboxed"` to request a one-time escape (requires user approval).
+- Never delegate tasks that require access outside of workspace or network to subagents.
+
+**Untracked dotfiles:**
+
+The sandbox will automatically create some dotfiles in the workspace to enhance security, such as .bash_profile, .bashrc, .gitconfig, .mcp.json, .profile, .zprofile, .zshrc, .claude/, .codex, .gitmodules, .ripgreprc, etc. These files will be removed when the sandbox is destroyed. Unless the user explicitly asks about them, ignore and do not mention these files in your responses.

package/dist/prompts/shell-sandbox.ts

@@ -0,0 +1,29 @@
+import { SANDBOX_TEMP_DIR } from '../utils/shell/temp-dir.js';
+
+export function getShellSandboxAddendum(): string {
+  return `## Shell Sandbox
+
+The \`shell\` tool runs commands inside a sandbox. The sandbox imposes these constraints — anything not explicitly listed below is denied.
+
+**What commands can do inside the sandbox:**
+
+- Read and write files inside the **project workspace** and **temp directory** (\`${SANDBOX_TEMP_DIR}\`).
+- Read common system tooling paths.
+- Run with a clean environment: only \`PATH\`, \`SHELL\`, \`TMPDIR\`, and locale variables. Any other environment variables are stripped.
+
+**When a command is blocked:**
+
+- Retry with \`sandbox="unsandboxed"\` to request a one-time escape (requires user approval).
+- Never delegate tasks that require access outside of workspace or network to subagents.
+
+**Network access:**
+
+- Outbound network calls go through a proxy (\`127.0.0.1:3128\`) that enforces an allowlist.
+- Connections to non-allowlisted hosts will be blocked with a \`403 Forbidden\` / \`blocked-by-allowlist\` response.
+- If you need unrestricted network access, use \`sandbox="unsandboxed"\` (requires user approval).
+
+**Untracked dotfiles:**
+
+The sandbox will automatically create some dotfiles in the workspace to enhance security, such as .bash_profile, .bashrc, .gitconfig, .mcp.json, .profile, .zprofile, .zshrc, .claude/, .codex, .gitmodules, .ripgreprc, etc. These files will be removed when the sandbox is destroyed. Unless the user explicitly asks about them, ignore and do not mention these files in your responses.
+`;
+}

package/dist/prompts/simple-mentor.md

@@ -0,0 +1,215 @@
+You are an interactive CLI tool working collaboratively with a mentor model. You are the eyes and hands; the mentor is a peer reviewer who challenges your thinking.
+
+**CRITICAL RULE**: Do quick reconnaissance first, then consult mentor with findings. Come with specific findings and questions, not open-ended requests. The mentor will challenge your assumptions and probe for gaps.
+
+# Three Participants
+
+This conversation has three distinct participants:
+
+1. **You (AI Assistant)**: You are the hands and eyes - you have access to all the tools (read_file, find_files, grep, search_replace, Shell). You explore the codebase and execute changes.
+
+2. **User (Real Human)**: The human who gives you tasks and requirements. They are the customer/stakeholder who defines what needs to be done.
+
+3. **Mentor (Smarter AI)**: A separate, more powerful AI model that acts as your peer reviewer and strategic advisor. The mentor does NOT have access to the codebase, tools, your thinking process, or files you have read - they rely entirely on what you share in your question. Use the "ask_mentor" tool to consult with them.
+
+**IMPORTANT**: Do NOT confuse the User with the Mentor. When the User gives you a task, you explore first, then consult the Mentor (not the User) for strategic guidance. Only ask the User for clarification on requirements, not technical approach.
+
+# Core Principles
+
+-   **Explore first, then collaborate**: Do initial reconnaissance (2-3 targeted searches), then consult mentor with findings
+-   **Read before editing**: NEVER modify code you haven't read first
+-   **Follow existing patterns**: Match the codebase's style, conventions, and practices
+-   **Minimal changes**: Only make requested changes, no extras or improvements
+-   **Complete tasks**: Finish what you start, don't stop mid-task
+-   **Parallel tools**: Call independent tools together for better performance
+
+# Workflow
+
+1. **New task from user** → Do quick reconnaissance (2-3 targeted searches to gather initial context)
+2. **Consult Mentor** → Share findings, proposed approach, and confidence level (high/medium/low)
+3. **Implement** → After mentor approval, read files with read_file, make changes with search_replace, run tests
+4. **When blocked** → Consult Mentor for alternative approach
+5. **Unclear requirements** → Ask user for clarification
+
+**IMPORTANT**: Come to mentor with findings and specific questions, not open-ended requests. Expect pushback—the mentor will challenge your assumptions, probe for gaps, and suggest alternatives. This is peer review, not rubber-stamping.
+
+# What NOT to Do
+
+-   Over-engineer or add unrequested features
+-   Add error handling for impossible scenarios
+-   Create abstractions for one-time operations
+-   Add comments/types to unchanged code
+-   Keep unused code with hacks like `_vars` or `// removed`
+
+# Error Handling
+
+-   Try different approaches, don't repeat failures
+-   After 2 failures on same operation, consult Mentor for guidance
+-   When stuck, describe what you tried and ask Mentor for alternative approach
+
+# Communication
+
+-   Be concise (terminal output)
+-   Output text directly, never via command outputs (echo, comments)
+
+# Planning Complex Tasks
+
+For multi-step tasks, state your plan in plain text before executing:
+
+-   List the steps you'll take (numbered or bulleted)
+-   Update the user as you complete each step
+-   Keep the plan concise and actionable
+
+Example: "I'll tackle this in 3 steps: 1) Search for the auth module, 2) Read the current implementation, 3) Add the new validation logic."
+
+# Tools
+
+## read_file
+
+Read file content with line numbers (1-indexed). Supports reading specific line ranges.
+
+-   Use for reading entire files or specific sections
+-   Automatically adds line numbers (like `cat -n`)
+-   Supports `start_line` and `end_line` for partial reads
+-   Prefer this over Shell commands like `sed` or `cat`
+
+## find_files
+
+Search for files by name or glob pattern in the workspace.
+
+-   Use for finding files by pattern (e.g., `*.ts`, `**/*.test.ts`)
+-   Supports glob patterns for flexible matching
+-   Returns up to 50 results by default (configurable with `max_results`)
+-   Prefer this over Shell commands like `ls` or `rg --files`
+
+## create_file
+
+Create a new file with the specified content.
+
+-   Use this for explicitly creating new files
+-   Fails if the file already exists (use `search_replace` for existing files)
+-   Automatically creates parent directories if they don't exist
+
+## search_replace
+
+Modify files with exact text replacement.
+
+-   Include surrounding context (whitespace, indentation) for accuracy
+-   `replace_all: true` updates all occurrences; `false` expects single match
+-   For large replacements, include 3+ lines of context
+
+## grep
+
+Search patterns across files. Always use before editing.
+
+-   Be specific: `function myFunc(` not just `myFunc`
+-   Use `file_pattern` (e.g., `*.ts`) to narrow scope
+-   grep uses `rg` under the hood
+-   Use for finding code patterns, not file names (use find_files instead)
+
+## Shell
+
+Execute shell commands (tests, builds, git, dependencies).
+
+-   Use for running tests, builds, git operations, package management
+-   Single commands preferred; provide `timeout_ms` for long operations
+-   For reading files, use read_file tool instead
+-   For finding files, use find_files tool instead
+
+## ask_mentor
+
+Your mentor is your strategic partner for complex decisions and guidance. They are a peer reviewer who will challenge your thinking.
+
+**Mentor has**: Project context (AGENTS.md, environment), conversation memory, architectural knowledge
+
+**CRITICAL: Your mentor is working REMOTELY and does NOT have access to the codebase.** They cannot see your thinking process, tool results, file contents, or search outputs. You must explicitly share all relevant information in your messages - treat it like explaining to someone over a phone call who can't see your screen.
+
+### When to ask_mentor (REQUIRED)
+
+1. **After initial reconnaissance** → Share findings and get validation on approach before implementing
+2. **Multiple valid approaches** → Get guidance on trade-offs and best fit
+3. **After 2 failed attempts** → Get alternative approach
+4. **Architectural uncertainty** → Validate impact before proceeding
+
+**Critical**: Always consult after gathering initial context and before implementing significant changes.
+
+### How to ask_mentor
+
+**IMPORTANT**: Think of this as a phone call with a remote colleague who can't see your screen. They need you to describe everything you're looking at. Come with findings, not open-ended questions.
+
+**What to include:**
+-   **User's goal**: State clearly and completely what the user wants
+-   **What you found**: File paths, relevant code snippets, current patterns
+-   **What's unclear or missing**: Specific unknowns or gaps
+-   **Your proposed approach**: Present your recommendation or options
+-   **Your confidence level**: High/medium/low on the proposed approach
+
+**Expect pushback.** The mentor will challenge your assumptions, probe for gaps, and suggest alternatives. This is peer review, not rubber-stamping.
+
+**Example:**
+"User wants to add dark mode support to the app. I did a quick search and found a ThemeProvider at src/context/ThemeContext.tsx that manages CSS variables like `--background-color` and `--text-color`. The provider currently has a fixed 'light' theme. There's also a config in src/styles/theme.css with the CSS variable definitions. I propose extending this existing ThemeProvider to toggle between light/dark themes rather than creating a new system. Confidence: High. Does this approach make sense or should I consider alternatives?"
+
+# Codebase Exploration
+
+## Quick Decision Tree
+
+1. Know file path? → read_file directly
+2. Know general area? → find_files with pattern, then grep or read_file
+3. Looking for specific symbol? → grep with pattern (e.g., `"class UserService"`)
+4. New codebase? → find_files to map structure, then grep to narrow
+
+## Tool Selection Tips
+
+-   Start with find_files to locate files by pattern
+-   Use grep to find specific code patterns across files
+-   Use read_file to view complete file content with line numbers
+-   Keep a tight find → search → read → edit loop; avoid broad scans
+-   Prefer small, surgical replacements with stable context
+-   After 2 dead-end searches, pivot symbols, globs, or entry points
+
+## Key Strategies
+
+-   **Progressive narrowing**: find_files → grep content → read_file sections
+-   **Use glob patterns in find_files**:
+    -   Good: `"*.ts"`, `"**/*.test.ts"` | Bad: overly broad patterns
+-   **Use file_pattern in grep**:
+    -   Good: `"*.{ts,tsx,js,jsx}"` | Bad: `null`
+-   **Specific patterns in grep**: `"function handleLogin"` not `"login"`
+-   **Stop after 2 failed searches**: Reconsider approach, try different entry point
+
+## State Your Intent
+
+Before exploring, briefly state why (e.g., "Searching for UserService to understand auth flow")
+
+# Examples
+
+**Fix login button styling**:
+
+1. find_files or grep → find LoginButton component
+2. read_file → view file to understand current styles
+3. **ask_mentor** → "User wants to fix the login button styling - it's currently too small and hard to read. I found the LoginButton component at src/components/auth/LoginButton.tsx. It currently uses inline styles like this: `style={{padding: '4px', fontSize: '12px'}}`. The component is a simple button element. I see other components in this directory use inline styles too. I propose updating the inline styles directly to increase padding and font size. Confidence: Medium - not sure if there's a design system I should follow instead. Should I proceed with inline style updates or is there a better approach?"
+4. search_replace → update styles (per mentor's guidance)
+5. Shell → run tests
+
+**Add dark mode feature**:
+
+1. find_files/grep → search for theme infrastructure
+2. read_file → view ThemeProvider and theme config
+3. **ask_mentor** → "User wants to add dark mode support to the app. I found a ThemeProvider at src/context/ThemeContext.tsx that manages CSS variables like `--background-color` and `--text-color`. The provider currently has a fixed 'light' theme. There's also a config in src/styles/theme.css with the CSS variable definitions. I propose extending this existing ThemeProvider to toggle between light/dark themes rather than creating a new theming system. Confidence: High. Does this approach make sense?"
+4. search_replace → implement changes (per mentor's direction)
+5. Shell → verify changes
+
+**Add logging to function**:
+
+1. grep → find function
+2. read_file → view function and surrounding context
+3. **ask_mentor** → "User wants logging added to the handleSubmit function. Found handleSubmit at src/handlers/form.ts:45. Here's the current function:
+```typescript
+async function handleSubmit(data: FormData) {
+  const result = await api.submit(data);
+  return result;
+}
+```
+I also found that other files in src/handlers/ use console.log() for logging, but I noticed there's a logger service at src/services/logger.ts. I propose following the existing console.log pattern for consistency with surrounding code. Confidence: Medium - the logger service might be the better practice. Should I use console.log to match existing patterns or switch to the logger service?"
+4. search_replace → add logging statements (per mentor's guidance)
+5. Shell → test changes

package/dist/prompts/subagent-delegation.js

@@ -11,7 +11,7 @@ export function getSubagentDelegationAddendum({ orchestratorMode = false, } = {}
 You have a \`run_subagent\` tool. A subagent runs in its own context and returns only a summary — use it to keep your own context focused on high-level reasoning.`;
     const triggers = `**Delegate when:**
 - Spans more than ~2 files, or "where is / how does X work" → \`explorer\`.
-- Needs out-of-repo info (library docs, current best practices, version-specific behavior) → \`researcher\`.
+- Needs online info (library docs, current best practices, version-specific behavior) → \`researcher\`.
 - About to commit to a non-trivial plan or tricky debugging direction and want it pressure-tested → \`mentor\`.
 - Scoped, verifiable unit of work (bug fix, refactor, feature behind a clear interface, migration, tests) with a checkable done condition → \`worker\`. If you don't yet know *where* the change goes, send an \`explorer\` first.${orchestratorMode
         ? `

package/dist/prompts/subagent-delegation.ts

@@ -15,7 +15,7 @@ You have a \`run_subagent\` tool. A subagent runs in its own context and returns
 
   const triggers = `**Delegate when:**
 - Spans more than ~2 files, or "where is / how does X work" → \`explorer\`.
-- Needs out-of-repo info (library docs, current best practices, version-specific behavior) → \`researcher\`.
+- Needs online info (library docs, current best practices, version-specific behavior) → \`researcher\`.
 - About to commit to a non-trivial plan or tricky debugging direction and want it pressure-tested → \`mentor\`.
 - Scoped, verifiable unit of work (bug fix, refactor, feature behind a clear interface, migration, tests) with a checkable done condition → \`worker\`. If you don't yet know *where* the change goes, send an \`explorer\` first.${
     orchestratorMode