@synergenius/flow-weaver-pack-weaver 0.9.134 → 0.9.136

package/flowweaver.manifest.json

@@ -1,7 +1,7 @@
 {
   "manifestVersion": 2,
   "name": "@synergenius/flow-weaver-pack-weaver",
-  "version": "0.9.134",
+  "version": "0.9.136",
   "description": "AI bot for Flow Weaver. Execute tasks, run workflows, evolve autonomously.",
   "engineVersion": ">=0.22.10",
   "categories": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synergenius/flow-weaver-pack-weaver",
-  "version": "0.9.134",
+  "version": "0.9.136",
   "description": "AI bot for Flow Weaver. Execute tasks, run workflows, evolve autonomously.",
   "type": "module",
   "main": "./dist/index.js",
@@ -70,7 +70,7 @@
     "dev:install": "npm run dev && node -e \"const p=process.argv[1]; if(!p){console.error('Usage: npm run dev:install -- /path/to/project');process.exit(1)} require('child_process').execSync('npm install --no-save /tmp/synergenius-flow-weaver-pack-weaver-'+require('./package.json').version+'.tgz',{cwd:p,stdio:'inherit'}); require('child_process').execSync('find '+p+' -name fw-exec-\\* -type f -delete',{stdio:'pipe'}); console.log('✓ Installed in '+p+' (cache cleaned)')\" --"
   },
   "devDependencies": {
-    "@synergenius/flow-weaver": "^0.23.5",
+    "@synergenius/flow-weaver": "^0.24.0",
     "@types/node": "^25.3.5",
     "esbuild": "^0.27.4",
     "tsx": "^4.0.0",

package/src/bot/ai-client.ts

@@ -2,6 +2,7 @@ import { execSync, spawn } from 'node:child_process';
 import { trackChild } from './child-process-tracker.js';
 import type { ProviderInfo } from './types.js';
 import type { TriageResult, PromptSection } from './system-prompt.js';
+import type { CapabilityDefinition } from './capability-types.js';
 import { resolveModelTier } from './behavior-defaults.js';
 
 // Strip CLAUDECODE from child env so nested claude CLI invocations work.
@@ -490,3 +491,77 @@ export async function callTriage(
     return null;
   }
 }
+
+// ---------------------------------------------------------------------------
+// Capability-aware triage — selects capabilities by name
+// ---------------------------------------------------------------------------
+
+/**
+ * Build the triage system prompt dynamically from available capabilities.
+ */
+function buildCapabilityTriagePrompt(available: CapabilityDefinition[]): string {
+  const capList = available
+    .filter(c => c.name !== 'core') // core is always loaded, don't ask AI about it
+    .map(c => `- ${c.name}: ${c.description}`)
+    .join('\n');
+
+  return `You select capabilities for an AI workflow bot. Given a task instruction, determine which capabilities the bot needs from the available list.
+
+Return ONLY valid JSON: { "capabilities": ["cap-name-1", "cap-name-2"] }
+
+Available capabilities:
+${capList}
+
+Rules:
+- Select ONLY capabilities from the available list.
+- For file creation, modification, or code tasks, always include "file-ops".
+- For tasks involving shell commands, builds, or tests, include "shell".
+- Only select Flow Weaver capabilities (fw-*) when the task explicitly involves workflows, annotations, or validation.
+- Select the MINIMUM set needed — fewer capabilities = faster, cheaper execution.`;
+}
+
+/**
+ * Capability-aware triage: selects which capabilities a task needs from
+ * the profile's available pool. Uses the fast tier (Haiku).
+ *
+ * Always ensures 'core' is in the result.
+ * Returns null on any failure — caller should fall back to all capabilities.
+ */
+export async function callCapabilityTriage(
+  pInfo: Pick<ProviderInfo, 'type' | 'apiKey'>,
+  instruction: string,
+  available: CapabilityDefinition[],
+): Promise<string[] | null> {
+  try {
+    const triageModel = resolveModelTier('fast', 'anthropic');
+    const triagePInfo = { ...pInfo, model: triageModel, maxTokens: 256 };
+    const systemPrompt = buildCapabilityTriagePrompt(available);
+
+    const text = await callAI(triagePInfo, systemPrompt, instruction, 256);
+    const parsed = parseJsonResponse(text) as { capabilities?: string[] };
+
+    if (!parsed.capabilities || !Array.isArray(parsed.capabilities)) return null;
+
+    // Build set of available names for validation
+    const availableNames = new Set(available.map(c => c.name));
+
+    // Filter to only valid, available capabilities
+    const selected = parsed.capabilities.filter(
+      (name): name is string => typeof name === 'string' && availableNames.has(name),
+    );
+
+    // Safety: always include core
+    if (!selected.includes('core') && availableNames.has('core')) {
+      selected.unshift('core');
+    }
+
+    // Safety: if nothing selected (besides core), add file-ops as minimum
+    if (selected.length <= 1 && availableNames.has('file-ops')) {
+      selected.push('file-ops');
+    }
+
+    return selected;
+  } catch {
+    return null;
+  }
+}

package/src/bot/behavior-defaults.ts

@@ -133,6 +133,24 @@ const STRATEGY_PHASE_OVERRIDES: Record<CostStrategy, Record<string, Partial<Phas
   },
 };
 
+// ---------------------------------------------------------------------------
+// Default capabilities per strategy
+// ---------------------------------------------------------------------------
+
+/** Default capability pools per cost strategy. */
+export const STRATEGY_CAPABILITIES: Record<CostStrategy, string[]> = {
+  frugal: ['core', 'file-ops', 'shell', 'context'],
+  balanced: ['core', 'file-ops', 'shell', 'task-mgmt', 'fw-grammar', 'fw-validate', 'context'],
+  performance: ['core', 'file-ops', 'shell', 'task-mgmt', 'fw-grammar', 'fw-validate', 'fw-genesis', 'fw-cli', 'code-review', 'web', 'context'],
+};
+
+/** Default budget per strategy (USD per task). */
+export const STRATEGY_BUDGETS: Record<CostStrategy, number> = {
+  frugal: 0.10,
+  balanced: 0.50,
+  performance: 1.00,
+};
+
 /** Strategy-level escalation and exit protocol defaults. */
 const STRATEGY_DEFAULTS: Record<CostStrategy, { escalation: ProfileBehavior['escalation']; exitProtocol: ProfileBehavior['exitProtocol'] }> = {
   frugal: { escalation: { maxAttempts: 2, onExhausted: 'block' }, exitProtocol: { reportConcerns: false, requireEvidence: false } },
@@ -172,6 +190,8 @@ export function buildDefaultBehavior(
   }
 
   return {
+    capabilities: STRATEGY_CAPABILITIES[strategy],
+    budget: STRATEGY_BUDGETS[strategy],
     phases,
     ...STRATEGY_DEFAULTS[strategy],
   };

package/src/bot/capability-registry.ts

@@ -0,0 +1,230 @@
+/**
+ * Capability registry — manages built-in and custom capability definitions.
+ *
+ * Built-in capabilities decompose the monolithic 13k system prompt into
+ * composable knowledge modules. Triage selects which capabilities a task
+ * needs, and only those get loaded into the prompt.
+ */
+
+import type { CapabilityDefinition } from './capability-types.js';
+import {
+  OP_WRITE_FILE, OP_READ_FILE, OP_PATCH_FILE, OP_LIST_FILES,
+  OP_RUN_SHELL, OP_VALIDATE, OP_TSC_CHECK, OP_RUN_TESTS,
+  OP_TASK_CREATE,
+} from './operations.js';
+
+// ---------------------------------------------------------------------------
+// Built-in capabilities
+// ---------------------------------------------------------------------------
+
+const CAP_CORE: CapabilityDefinition = {
+  name: 'core',
+  description: 'Bot identity, structured plan output format, and safety rules. Always loaded.',
+  prompt: `You are Weaver, an expert AI companion for Flow Weaver workflows.
+
+## Plan Format
+Your plans MUST be structured JSON with concrete steps.
+Each step has: operation (tool name), description (what it does), args (complete arguments).
+Do NOT describe what you would do — actually do it by calling tools.
+
+## Safety Rules
+- Writes that shrink a file by >50% or write empty content are automatically BLOCKED.
+- Blocked shell commands: rm -rf, git push, npm publish, sudo, curl|sh.
+- Always validate BEFORE and AFTER patching.
+- Always read a file before patching it (you need exact strings for find/replace).
+- Use patch_file for modifications, write_file only for new files.
+- Be concise — let tool results speak.`,
+};
+
+const CAP_FILE_OPS: CapabilityDefinition = {
+  name: 'file-ops',
+  description: 'File read/write/patch operations and best practices for file manipulation.',
+  tools: [OP_READ_FILE, OP_WRITE_FILE, OP_PATCH_FILE, OP_LIST_FILES],
+  prompt: `## File Operations
+- read_file: Read a file and return its content. args: { file }
+- write_file: Write a file. args: { file, content }. Content must be the COMPLETE file.
+- patch_file: Surgical find-and-replace edits. args: { file, patches: [{ find: "old text", replace: "new text" }] }. PREFERRED for modifying existing files.
+- list_files: List files in a directory. args: { directory, pattern? } (pattern is regex)
+
+## Best Practices
+PREFER patch_file over write_file for modifying existing files (surgical edits, no truncation risk).
+Use read_file to understand a file before modifying it.
+Use list_files to discover project structure.
+Writes that shrink a file by >50% or write empty content are automatically BLOCKED.`,
+};
+
+const CAP_SHELL: CapabilityDefinition = {
+  name: 'shell',
+  description: 'Shell command execution for running tests, builds, and inspecting output.',
+  tools: [OP_RUN_SHELL, OP_VALIDATE, OP_TSC_CHECK, OP_RUN_TESTS],
+  prompt: `## Shell Commands
+- run_shell: Execute a shell command and return output. args: { command }
+  Use for: npx vitest, git status, grep, find, etc.
+  Examples: { "command": "npx vitest run --reporter verbose" }, { "command": "npx flow-weaver validate src/workflow.ts --json" }
+  Blocked: rm -rf, git push, npm publish, sudo, curl|sh (safety policy).
+Use run_shell for running tests (npx vitest), validation (flow-weaver validate), and inspecting output.`,
+};
+
+const CAP_TASK_MGMT: CapabilityDefinition = {
+  name: 'task-mgmt',
+  description: 'Create and manage swarm subtasks for parallel execution.',
+  tools: [OP_TASK_CREATE],
+  prompt: `## Task Management
+- task_create: Create swarm subtasks for parallel execution. args: { title, description, complexity, subtasks[] }
+- task_list, task_get, task_update: Query and update existing tasks
+
+Use task_create to decompose complex work into smaller, independent subtasks that other bots can execute in parallel.`,
+};
+
+const CAP_FW_GRAMMAR: CapabilityDefinition = {
+  name: 'fw-grammar',
+  description: 'Flow Weaver annotation syntax, node types, workflows, patterns, and data flow.',
+  prompt: `## Core Mental Model
+
+The code IS the workflow. Flow Weaver workflows are plain TypeScript files with JSDoc annotations above functions. The compiler reads annotations and generates deterministic execution code between @flow-weaver-body-start/end markers. Compiled code is standalone with no runtime dependency on flow-weaver.
+
+Three block types:
+- @flowWeaver nodeType: A reusable function (node) with typed inputs/outputs
+- @flowWeaver workflow: A DAG orchestration that wires node instances together
+- @flowWeaver pattern: A reusable fragment with boundary ports (IN/OUT instead of Start/Exit)
+
+## Node Execution Model
+
+Expression nodes (@expression):
+- No execute/onSuccess/onFailure params. Just inputs and return value.
+- throw = failure path, return = success path
+- Synchronous. Use execSync for shell commands.
+- Preferred for deterministic operations.
+
+Standard nodes:
+- execute: boolean param gates execution
+- Return { onSuccess: boolean, onFailure: boolean, ...outputs }
+- Can be async for I/O operations
+
+Async agent nodes:
+- Use (globalThis as any).__fw_agent_channel__ to pause workflow
+- Call channel.request({ agentId, context, prompt }) which returns a Promise
+- Workflow suspends until agent responds
+- NOT @expression (must be async)
+
+Pass-through pattern:
+- FW auto-connects ports by matching names on adjacent nodes
+- To forward data through intermediate nodes, declare it as both @input and @output with the same name
+- For non-adjacent wiring, use @connect sourceNode.port -> targetNode.port
+
+Data flow:
+- @path A -> B -> C: Linear execution path (sugar for multiple @connect)
+- @autoConnect: Auto-wire all nodes in declaration order
+- @connect: Explicit port-to-port wiring
+- Merge strategies for fan-in: FIRST, LAST, COLLECT, MERGE, CONCAT`,
+};
+
+const CAP_FW_VALIDATE: CapabilityDefinition = {
+  name: 'fw-validate',
+  description: 'Flow Weaver validation error codes and common fix patterns.',
+  prompt: `## Validation Errors
+
+When you encounter validation errors, suggest the specific fix. Common resolutions:
+- UNKNOWN_NODE_TYPE: Ensure the referenced function has @flowWeaver nodeType annotation
+- MISSING_REQUIRED_INPUT: Add a @connect from a source port or make the input optional with [brackets]
+- UNKNOWN_SOURCE_PORT / UNKNOWN_TARGET_PORT: Check port name spelling in @connect
+- CYCLE_DETECTED: Break the cycle; use scoped iteration (@scope, @map) instead of circular dependencies`,
+};
+
+const CAP_FW_GENESIS: CapabilityDefinition = {
+  name: 'fw-genesis',
+  description: 'Flow Weaver genesis protocol for self-evolving workflows.',
+  prompt: `## Genesis Protocol
+
+Genesis is a 17-step self-evolving workflow engine:
+1. Load config 2. Observe project 3. Load task workflow 4. Diff fingerprint
+5. Check stabilize mode 6. Wait for agent 7. Propose evolution 8. Validate proposal
+9. Snapshot for rollback 10. Apply changes 11. Compile and validate
+12. Diff workflow 13. Check approval threshold 14. Wait for approval
+15. Commit or rollback 16. Update history 17. Report summary
+
+When stabilize mode is active, only fix-up operations are allowed.`,
+};
+
+const CAP_FW_CLI: CapabilityDefinition = {
+  name: 'fw-cli',
+  description: 'Flow Weaver CLI command reference for compile, validate, diagram, and other operations.',
+  prompt: `## CLI Commands
+
+Note: compile, validate, modify, diff, diagram, and describe operations are available as direct plan steps (no CLI needed).`,
+};
+
+const CAP_CODE_REVIEW: CapabilityDefinition = {
+  name: 'code-review',
+  description: 'Code review guidelines, quality checklist, and security review patterns.',
+  prompt: `## Code Review
+
+When reviewing code, check for:
+1. Correctness: Does the code do what the task asked?
+2. Security: No hardcoded secrets, no injection vulnerabilities, no exposed APIs
+3. Style: Consistent with project conventions, proper naming, no dead code
+4. Testing: Are there tests? Do they cover edge cases?
+5. Performance: No unnecessary loops, no blocking calls in async code
+
+Report concerns with specific file:line references and suggested fixes.`,
+};
+
+const CAP_WEB: CapabilityDefinition = {
+  name: 'web',
+  description: 'Web fetch capability for fetching URLs and external resources.',
+  tools: ['web_fetch'],
+  prompt: `## Web
+- web_fetch(url): Fetch a URL and return its content. Use for API docs, examples, etc.`,
+};
+
+const CAP_CONTEXT: CapabilityDefinition = {
+  name: 'context',
+  description: 'Project file listings, directory structure, and workspace context.',
+  prompt: `## Project Context
+
+Use list_files to understand the project structure before making changes.
+The context bundle (when available) provides a snapshot of the workspace.`,
+};
+
+// ---------------------------------------------------------------------------
+// Registry
+// ---------------------------------------------------------------------------
+
+/** All built-in capability definitions. */
+export const BUILT_IN_CAPABILITIES: readonly CapabilityDefinition[] = [
+  CAP_CORE,
+  CAP_FILE_OPS,
+  CAP_SHELL,
+  CAP_TASK_MGMT,
+  CAP_FW_GRAMMAR,
+  CAP_FW_VALIDATE,
+  CAP_FW_GENESIS,
+  CAP_FW_CLI,
+  CAP_CODE_REVIEW,
+  CAP_WEB,
+  CAP_CONTEXT,
+];
+
+const capabilityMap = new Map<string, CapabilityDefinition>(
+  BUILT_IN_CAPABILITIES.map(c => [c.name, c]),
+);
+
+/** Get a single capability by name. */
+export function getCapability(name: string): CapabilityDefinition | undefined {
+  return capabilityMap.get(name);
+}
+
+/** List all available capabilities. */
+export function listCapabilities(): CapabilityDefinition[] {
+  return [...BUILT_IN_CAPABILITIES];
+}
+
+/**
+ * Get multiple capabilities by name, preserving input order.
+ * Unknown names are silently skipped.
+ */
+export function getCapabilitiesByNames(names: string[]): CapabilityDefinition[] {
+  return names
+    .map(n => capabilityMap.get(n))
+    .filter((c): c is CapabilityDefinition => c !== undefined);
+}

package/src/bot/capability-types.ts

@@ -0,0 +1,23 @@
+/**
+ * Capability definitions for the bot system.
+ *
+ * A Capability is a composable unit of knowledge + tools + constraints.
+ * Profiles declare which capabilities their bots may use.
+ * Triage selects which capabilities a specific task needs.
+ */
+
+/**
+ * A capability definition — bundles knowledge, tools, and constraints.
+ * Built-in capabilities ship with the pack. Custom capabilities can be
+ * added per-workspace via .weaver/capabilities/.
+ */
+export interface CapabilityDefinition {
+  /** Unique identifier (e.g. 'typescript', 'fw-grammar'). */
+  name: string;
+  /** Short description — fed to triage for relevance scoring. */
+  description: string;
+  /** Knowledge content injected into the system prompt (markdown). */
+  prompt: string;
+  /** Tool operation names this capability grants (e.g. ['write_file', 'patch_file']). */
+  tools?: string[];
+}

package/src/bot/estimate-tokens.ts

@@ -0,0 +1,16 @@
+/**
+ * Estimate token count for a text string without a tokenizer library.
+ *
+ * Uses the average of two heuristics:
+ *   - chars / 3.5  — better for code and mixed content
+ *   - words × 1.33 — more stable across content types
+ *
+ * Accuracy: within ~15% for English prose + code. For precise counts
+ * use Anthropic's count_tokens API or @anthropic-ai/tokenizer.
+ */
+export function estimateTokens(text: string): number {
+  if (!text) return 0;
+  const byChars = text.length / 3.5;
+  const byWords = text.split(/\s+/).filter(Boolean).length * 1.33;
+  return Math.ceil((byChars + byWords) / 2);
+}

package/src/bot/profile-types.ts

@@ -93,6 +93,10 @@ export interface PhaseDescriptor {
  * bot might have analyze/report/suggest instead of plan/execute/review).
  */
 export interface ProfileBehavior {
+  /** Capability names this profile can use (e.g. ['core', 'file-ops', 'shell']). */
+  capabilities?: string[];
+  /** Per-task budget limit in USD. */
+  budget?: number;
   /** Per-phase toggles, model overrides, and token budgets. Keys match workflow phase gates. */
   phases: Record<string, PhaseBehavior>;
   /** Retry/escalation policy. */

package/src/bot/system-prompt.ts

@@ -4,6 +4,7 @@
  */
 
 import { FILE_OPERATIONS, OP_TASK_CREATE, OP_PATCH_FILE, OP_WRITE_FILE } from './operations.js';
+import type { CapabilityDefinition } from './capability-types.js';
 
 interface AnnotationDoc {
   name: string;
@@ -323,3 +324,35 @@ Be concise in your text responses — let tool results speak.`;
 
   return prompt;
 }
+
+// ---------------------------------------------------------------------------
+// Capability-based prompt assembly
+// ---------------------------------------------------------------------------
+
+/**
+ * Build a system prompt by concatenating the prompts of selected capabilities.
+ * This replaces the section-based buildPromptFromMetadata for capability-aware tasks.
+ */
+export function buildPromptFromCapabilities(capabilities: CapabilityDefinition[]): string {
+  if (capabilities.length === 0) return '';
+  return capabilities.map(c => c.prompt).join('\n\n');
+}
+
+/**
+ * Collect all tool operation names granted by the selected capabilities.
+ * Returns a deduplicated array.
+ */
+export function collectToolsFromCapabilities(capabilities: CapabilityDefinition[]): string[] {
+  const seen = new Set<string>();
+  const tools: string[] = [];
+  for (const cap of capabilities) {
+    if (!cap.tools) continue;
+    for (const t of cap.tools) {
+      if (!seen.has(t)) {
+        seen.add(t);
+        tools.push(t);
+      }
+    }
+  }
+  return tools;
+}

package/src/bot/types.ts

@@ -622,6 +622,7 @@ export interface WeaverContext {
   runId?: string;
   targetPath?: string;
   taskJson?: string;
+  behaviorJson?: string;
   hasTask?: boolean;
   contextBundle?: string;
   planJson?: string;

package/src/node-types/plan-task.ts

@@ -1,45 +1,49 @@
 import type { WeaverContext } from '../bot/types.js';
-import { callAI, callAIWithTools, callTriage, parseJsonResponse, normalizePlan } from '../bot/ai-client.js';
+import { callAIWithTools, callCapabilityTriage, parseJsonResponse, normalizePlan } from '../bot/ai-client.js';
 import type { AiTool } from '../bot/ai-client.js';
 import { auditEmit } from '../bot/audit-logger.js';
-import type { PromptSection } from '../bot/system-prompt.js';
 import { PLAN_OPERATIONS } from '../bot/operations.js';
+import { getCapabilitiesByNames, BUILT_IN_CAPABILITIES } from '../bot/capability-registry.js';
 
 // ---------------------------------------------------------------------------
 // Plan tool definition — passed via native tool_use so the AI returns
 // structured JSON arguments instead of prose. Works across Anthropic and OpenAI.
 // ---------------------------------------------------------------------------
 
-const PLAN_TOOL: AiTool = {
-  name: 'create_plan',
-  description: 'Create a structured execution plan for this task. Call this tool with the plan steps and summary.',
-  parameters: {
-    type: 'object',
-    properties: {
-      summary: { type: 'string', description: 'One-line summary of what the plan does' },
-      steps: {
-        type: 'array',
-        description: 'Ordered list of operations to execute',
-        items: {
-          type: 'object',
-          properties: {
-            operation: {
-              type: 'string',
-              description: `Tool to invoke: ${PLAN_OPERATIONS.join(', ')}`,
-            },
-            description: { type: 'string', description: 'What this step does' },
-            args: {
-              type: 'object',
-              description: 'Arguments for the operation (e.g. {file, content} for write_file, {file, find, replace} for patch_file)',
+/** Build the create_plan tool definition with dynamic operation list. */
+function buildPlanTool(operations: string[]): AiTool {
+  const ops = operations.length > 0 ? operations : PLAN_OPERATIONS as unknown as string[];
+  return {
+    name: 'create_plan',
+    description: 'Create a structured execution plan for this task. Call this tool with the plan steps and summary.',
+    parameters: {
+      type: 'object',
+      properties: {
+        summary: { type: 'string', description: 'One-line summary of what the plan does' },
+        steps: {
+          type: 'array',
+          description: 'Ordered list of operations to execute',
+          items: {
+            type: 'object',
+            properties: {
+              operation: {
+                type: 'string',
+                description: `Tool to invoke: ${ops.join(', ')}`,
+              },
+              description: { type: 'string', description: 'What this step does' },
+              args: {
+                type: 'object',
+                description: 'Arguments for the operation (e.g. {file, content} for write_file, {file, find, replace} for patch_file)',
+              },
             },
+            required: ['operation', 'description', 'args'],
           },
-          required: ['operation', 'description', 'args'],
         },
       },
+      required: ['summary', 'steps'],
     },
-    required: ['summary', 'steps'],
-  },
-};
+  };
+}
 
 /**
  * Sends task + context to the AI provider and gets back a structured
@@ -81,28 +85,24 @@ export async function weaverPlanTask(
   }
   const task = JSON.parse(context.taskJson);
 
-  // Triage: cheap fast-model call to classify what the task needs.
-  // Scopes the system prompt to only include relevant sections.
-  let sections: Set<PromptSection> | undefined;
-  const triageResult = await callTriage(pInfo, task.instruction);
+  // Resolve available capabilities from behavior config or defaults
+  const behavior = context.behaviorJson ? JSON.parse(context.behaviorJson) : undefined;
+  const availableCapNames: string[] = behavior?.capabilities ?? BUILT_IN_CAPABILITIES.map(c => c.name);
+  const availableCaps = getCapabilitiesByNames(availableCapNames);
+
+  // Capability triage: cheap Haiku call selects which capabilities this task needs
+  let selectedCaps = availableCaps; // fallback: all available
+  const triageResult = await callCapabilityTriage(pInfo, task.instruction, availableCaps);
   if (triageResult) {
-    sections = new Set<PromptSection>();
-    for (const [key, needed] of Object.entries(triageResult.needs)) {
-      if (needed) sections.add(key as PromptSection);
-    }
+    selectedCaps = getCapabilitiesByNames(triageResult);
   }
-  // If triage failed, sections is undefined → full prompt (no degradation)
+  // If triage failed, selectedCaps = all available (no degradation)
 
   let systemPrompt: string;
   try {
     const mod = await import('../bot/system-prompt.js');
-    const basePrompt = await mod.buildSystemPrompt(sections);
-    let cliCommands: { name: string; description: string; group?: string; botCompatible?: boolean; options?: { flags: string; arg?: string; description: string }[] }[] = [];
-    try {
-      const docMeta = await import('@synergenius/flow-weaver/doc-metadata');
-      cliCommands = docMeta.CLI_COMMANDS ?? [];
-    } catch { /* older flow-weaver version */ }
-    const botPrompt = mod.buildBotSystemPrompt(context.contextBundle!, cliCommands, undefined, sections);
+    const basePrompt = mod.buildPromptFromCapabilities(selectedCaps);
+    const botPrompt = mod.buildBotSystemPrompt(context.contextBundle!, undefined, context.env?.projectDir);
     systemPrompt = basePrompt + '\n\n' + botPrompt;
   } catch (err) {
     if (process.env.WEAVER_VERBOSE) console.error('[plan-task] system prompt build failed:', err);
@@ -119,9 +119,16 @@ Rules:
 4. Do NOT plan patch_file unless you know the exact find/replace strings.`;
 
   try {
+    // Build plan tool with operations scoped to selected capabilities
+    const mod2 = await import('../bot/system-prompt.js');
+    const grantedTools = mod2.collectToolsFromCapabilities(selectedCaps);
+    // Always include respond in the available operations
+    const planOps = grantedTools.length > 0 ? [...grantedTools, 'respond'] : PLAN_OPERATIONS as unknown as string[];
+    const planTool = buildPlanTool(planOps);
+
     // Use native tool_use when available (Anthropic, OpenAI).
     // The AI calls create_plan with structured args instead of returning prose.
-    const result = await callAIWithTools(pInfo, systemPrompt, userPrompt, [PLAN_TOOL], 8192);
+    const result = await callAIWithTools(pInfo, systemPrompt, userPrompt, [planTool], 8192);
 
     let plan: { steps: Array<{ id: string; operation: string; description: string; args: Record<string, unknown> }>; summary: string };