@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/skills/skill-history.test.ts

@@ -0,0 +1,269 @@
+/**
+ * Tests for `skill-history.ts`, run against a REAL git repository rather than
+ * a mocked git.
+ *
+ * The behavior worth protecting is entirely about how git actually responds to
+ * a pathspec: that a commit touching 100 unrelated files still yields a diff
+ * scoped to one skill, that `:(exclude)` really drops the usage stamp, and
+ * that a commit whose only in-skill change was excluded disappears from the
+ * list. A stubbed git would let all three regress while the tests stayed
+ * green, so each test builds commits in a temp repo and reads them back.
+ */
+
+import { execFileSync } from "node:child_process";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+let repoDir = "";
+
+// The module resolves the workspace through `getWorkspaceDir()`; point it at
+// the temp repository. `getWorkspaceGitService` is left real so the git
+// invocations under test are the ones that ship.
+mock.module("../util/platform.js", () => ({
+  getWorkspaceDir: () => repoDir,
+}));
+
+import { getSkillHistory } from "./skill-history.js";
+
+function git(...args: string[]): string {
+  return execFileSync("git", args, {
+    cwd: repoDir,
+    encoding: "utf-8",
+    env: {
+      ...process.env,
+      GIT_AUTHOR_NAME: "Test",
+      GIT_AUTHOR_EMAIL: "test@example.com",
+      GIT_COMMITTER_NAME: "Test",
+      GIT_COMMITTER_EMAIL: "test@example.com",
+    },
+  });
+}
+
+/** Write a file under the repo, creating parents. */
+function write(relPath: string, content: string): void {
+  const full = join(repoDir, relPath);
+  mkdirSync(join(full, ".."), { recursive: true });
+  writeFileSync(full, content, "utf-8");
+}
+
+function commit(message: string): void {
+  git("add", "-A");
+  git("commit", "--no-verify", "-m", message);
+}
+
+beforeEach(() => {
+  repoDir = mkdtempSync(join(tmpdir(), "skill-history-"));
+  git("init", "-b", "main");
+});
+
+afterEach(() => {
+  rmSync(repoDir, { recursive: true, force: true });
+  repoDir = "";
+});
+
+describe("getSkillHistory", () => {
+  test("returns one entry per update, with the diff scoped to that skill", async () => {
+    write("skills/alpha/SKILL.md", "# Alpha\n\nStep one.\n");
+    write("skills/beta/SKILL.md", "# Beta\n\nUnrelated.\n");
+    commit("initial");
+
+    // A batched commit, the way the workspace heartbeat writes them: this
+    // skill, an unrelated skill, and a conversation file all at once.
+    write("skills/alpha/SKILL.md", "# Alpha\n\nStep one, corrected.\n");
+    write("skills/beta/SKILL.md", "# Beta\n\nAlso changed.\n");
+    write("conversations/whatever.jsonl", "{}\n");
+    commit("auto-commit: heartbeat safety net (3 files)");
+
+    const history = await getSkillHistory("alpha");
+
+    expect(history.skillId).toBe("alpha");
+    expect(history.revisions).toHaveLength(2);
+    // Newest first.
+    const [latest] = history.revisions;
+    expect(latest!.files).toEqual(["SKILL.md"]);
+    expect(latest!.diff).toContain("Step one, corrected.");
+    // The other skill and the conversation file are absent even though the
+    // same commit changed them.
+    expect(latest!.diff).not.toContain("Also changed.");
+    expect(latest!.diff).not.toContain("conversations/");
+  });
+
+  test("combines SKILL.md and companion changes from one update into a single entry", async () => {
+    write("skills/alpha/SKILL.md", "# Alpha\n");
+    commit("initial");
+
+    write("skills/alpha/SKILL.md", "# Alpha\n\nRun the script.\n");
+    write("skills/alpha/scripts/export.py", "print('v1')\n");
+    write("skills/alpha/references/gotchas.md", "Watch the rate limit.\n");
+    commit("auto-commit: heartbeat safety net (3 files)");
+
+    const history = await getSkillHistory("alpha");
+
+    // One update, not three per-file entries.
+    const [latest] = history.revisions;
+    expect(latest!.files.sort()).toEqual([
+      "SKILL.md",
+      "references/gotchas.md",
+      "scripts/export.py",
+    ]);
+    expect(latest!.diff).toContain("Run the script.");
+    expect(latest!.diff).toContain("print('v1')");
+    expect(latest!.diff).toContain("Watch the rate limit.");
+  });
+
+  test("a load-only commit does not appear as an update", async () => {
+    write("skills/alpha/SKILL.md", "# Alpha\n");
+    write(
+      "skills/alpha/install-meta.json",
+      JSON.stringify({ origin: "custom", lastUsedAt: "2026-08-04" }),
+    );
+    commit("initial");
+
+    // The skill was loaded, so only the usage stamp moved. Roughly half of a
+    // real skill's commits look like this.
+    write(
+      "skills/alpha/install-meta.json",
+      JSON.stringify({ origin: "custom", lastUsedAt: "2026-08-05" }),
+    );
+    commit("auto-commit: heartbeat safety net (1 file)");
+
+    const history = await getSkillHistory("alpha");
+
+    // Only the creating commit counts; the stamp bump is not an update.
+    expect(history.revisions).toHaveLength(1);
+    expect(history.revisions[0]!.files).toEqual(["SKILL.md"]);
+  });
+
+  test("a real edit alongside a stamp bump keeps the edit and drops the stamp", async () => {
+    write("skills/alpha/SKILL.md", "# Alpha\n");
+    write(
+      "skills/alpha/install-meta.json",
+      JSON.stringify({ lastUsedAt: "1" }),
+    );
+    commit("initial");
+
+    write("skills/alpha/SKILL.md", "# Alpha\n\nRefined.\n");
+    write(
+      "skills/alpha/install-meta.json",
+      JSON.stringify({ lastUsedAt: "2" }),
+    );
+    commit("auto-commit: heartbeat safety net (2 files)");
+
+    const history = await getSkillHistory("alpha");
+
+    const [latest] = history.revisions;
+    expect(latest!.files).toEqual(["SKILL.md"]);
+    expect(latest!.diff).toContain("Refined.");
+    expect(latest!.diff).not.toContain("lastUsedAt");
+  });
+
+  test("respects the limit after filtering, not before", async () => {
+    write("skills/alpha/SKILL.md", "v0\n");
+    commit("initial");
+    // Interleave real edits with load-only commits, so a naive
+    // `--max-count=limit` would return mostly stamps.
+    for (let i = 1; i <= 4; i++) {
+      write(
+        "skills/alpha/install-meta.json",
+        JSON.stringify({ lastUsedAt: `stamp-${i}` }),
+      );
+      commit(`stamp ${i}`);
+      write("skills/alpha/SKILL.md", `v${i}\n`);
+      commit(`edit ${i}`);
+    }
+
+    const history = await getSkillHistory("alpha", { limit: 3 });
+
+    expect(history.revisions).toHaveLength(3);
+    // Every returned entry is a real edit.
+    for (const revision of history.revisions) {
+      expect(revision.files).toEqual(["SKILL.md"]);
+    }
+  });
+
+  test("reports when older history was squashed away", async () => {
+    write("skills/alpha/SKILL.md", "# Alpha\n");
+    commit("Compacted workspace history (14667 commits squashed)");
+    write("skills/alpha/SKILL.md", "# Alpha\n\nMore.\n");
+    commit("auto-commit: heartbeat safety net (1 file)");
+
+    const history = await getSkillHistory("alpha");
+
+    // The caller needs this to avoid presenting the oldest entry as creation.
+    expect(history.truncatedByCompaction).toBe(true);
+  });
+
+  test("an untracked skill has empty history rather than an error", async () => {
+    write("skills/alpha/SKILL.md", "# Alpha\n");
+    commit("initial");
+
+    const history = await getSkillHistory("never-committed");
+
+    expect(history.revisions).toEqual([]);
+    expect(history.skillId).toBe("never-committed");
+  });
+
+  test("a repository-controlled textconv driver is never executed", async () => {
+    // `.gitattributes` selects a diff driver and git config names the program
+    // for it. Both are writable through ordinary workspace paths, so rendering
+    // a patch must not hand control to them (ATL-1238).
+    write("skills/alpha/SKILL.md", "# Alpha\n");
+    write(".gitattributes", "*.md diff=evil\n");
+    commit("initial");
+    write("skills/alpha/SKILL.md", "# Alpha\n\nEdited.\n");
+    commit("auto-commit: heartbeat safety net (1 file)");
+
+    const sentinel = join(repoDir, "textconv-executed");
+    git("config", "diff.evil.textconv", `sh -c "touch ${sentinel}; cat"`);
+
+    const history = await getSkillHistory("alpha");
+
+    // The driver stays unrun...
+    expect(existsSync(sentinel)).toBe(false);
+    // ...and the diff still renders, so the hardening did not cost the feature.
+    expect(history.revisions[0]!.diff).toContain("Edited.");
+  });
+
+  // `--no-ext-diff` guards the sibling vector, `diff.<driver>.command`, but has
+  // no test here: an external diff driver does not fire in this environment
+  // even without the flag, so an assertion about it would pass whether or not
+  // the guard were present.
+
+  test("a traversal-shaped id is rejected before it reaches a pathspec", async () => {
+    write("skills/alpha/SKILL.md", "# Alpha\n");
+    commit("initial");
+
+    await expect(getSkillHistory("../../etc")).rejects.toThrow(
+      /Invalid skill id/,
+    );
+  });
+
+  test("a workspace that is not a repository yields empty history, and stays not a repository", async () => {
+    const bare = mkdtempSync(join(tmpdir(), "skill-history-norepo-"));
+    const previous = repoDir;
+    repoDir = bare;
+    try {
+      const history = await getSkillHistory("alpha");
+
+      expect(history.revisions).toEqual([]);
+      // The empty result is not enough on its own: reading through
+      // `runReadOnlyGit` would ALSO return empty here, having quietly created
+      // the repository first. This route is a GET, so the absence of the
+      // write is the actual invariant.
+      expect(existsSync(join(bare, ".git"))).toBe(false);
+      expect(readdirSync(bare)).toEqual([]);
+    } finally {
+      repoDir = previous;
+      rmSync(bare, { recursive: true, force: true });
+    }
+  });
+});

package/src/skills/skill-history.ts

@@ -0,0 +1,250 @@
+// ---------------------------------------------------------------------------
+// Skill revision history, read from the workspace git repository.
+// ---------------------------------------------------------------------------
+//
+// The workspace is a git repo with an auto-committing heartbeat, and `skills/`
+// is tracked, so every managed-skill write already has its prior content
+// retained. This module reads that history rather than storing a second copy:
+// `createManagedSkill` writes through an atomic rename and keeps no version of
+// its own, but the commit underneath it does.
+//
+// A revision here is ONE UPDATE TO THE WHOLE SKILL, not a per-file log. A
+// single commit is diffed against the skill's directory, so `SKILL.md`,
+// `scripts/`, and `references/` changes made together appear as one entry with
+// one combined diff, which is what "what changed the last time this skill was
+// updated" means. The commit itself usually touches many unrelated files (the
+// heartbeat batches by count and age), so the pathspec is what makes the diff
+// legible.
+//
+// Two properties of that history shape the output, and both are load-bearing:
+//
+//   - `install-meta.json` is EXCLUDED. It carries a `lastUsedAt` stamp
+//     refreshed every time a skill is loaded, so roughly half of a skill's
+//     commits touch nothing else. Including it would report a skill as
+//     "updated" on days nobody edited it, which is worse than showing no
+//     history at all. Revisions left empty by the exclusion are dropped.
+//   - History is BOUNDED. The workspace periodically squashes
+//     ("Compacted workspace history"), so the oldest revision available is not
+//     necessarily the skill's creation. Callers should present the list as
+//     "recent changes", never as a complete record.
+//
+// Commit subjects are deliberately not surfaced: they read
+// `auto-commit: heartbeat safety net (164 files, changes older than 900s)`,
+// which describes the batch rather than the skill and would actively mislead.
+//
+// Every git call goes through `runReadOnlyGitWithoutInit`, NOT
+// `runReadOnlyGit`. The latter awaits `ensureInitialized()`, which creates the
+// repository, writes `.gitignore` and the hooks directory, makes an initial
+// commit, and schedules a history compaction when the workspace is not yet a
+// repo. This module is reached from an HTTP GET, which `src/runtime/AGENTS.md`
+// requires to be side-effect-free, so observing history must never be the
+// thing that brings a repository into existence.
+
+import { getLogger } from "../util/logger.js";
+import { getWorkspaceDir } from "../util/platform.js";
+import { getWorkspaceGitService } from "../workspace/git-service.js";
+import { validateManagedSkillId } from "./managed-store.js";
+
+const log = getLogger("skill-history");
+
+/** How many revisions to return when the caller does not specify. */
+export const DEFAULT_SKILL_HISTORY_LIMIT = 20;
+
+/** Hard ceiling, so one request cannot walk an entire repository. */
+export const MAX_SKILL_HISTORY_LIMIT = 100;
+
+/** One update to a skill: a commit, diffed to that skill's directory. */
+export interface SkillRevision {
+  /** Abbreviated commit hash. Opaque to callers; useful for support. */
+  id: string;
+  /** ISO-8601 commit timestamp. */
+  changedAt: string;
+  /** Paths changed inside the skill, relative to the skill directory. */
+  files: string[];
+  /** Unified diff of this commit, restricted to the skill's directory. */
+  diff: string;
+}
+
+export interface SkillHistory {
+  skillId: string;
+  revisions: SkillRevision[];
+  /**
+   * Whether history may be incomplete because the workspace squashed older
+   * commits. When true the oldest revision listed is a floor, not the
+   * skill's creation.
+   */
+  truncatedByCompaction: boolean;
+}
+
+/**
+ * Field separator for the `git log` format: an ASCII unit separator, written
+ * as an escape so the source stays copy-paste safe. It cannot occur in a
+ * commit hash or an ISO timestamp.
+ */
+const FIELD = "\u001f";
+
+/**
+ * Diff options that must accompany EVERY git read here.
+ *
+ * `git show` and `git diff` honour repository-controlled helpers by default:
+ * a `.gitattributes` entry can select a diff driver, and a `diff.<driver>.
+ * textconv` or `diff.<driver>.command` setting names a program git then
+ * EXECUTES while rendering the patch. Workspace files and git metadata are
+ * writable by model and tool paths, so without these flags merely viewing a
+ * skill's history would run whatever the workspace asked for, inside the
+ * daemon, on behalf of any caller holding `settings.read` (ATL-1238).
+ *
+ * Applied through `readGit` rather than at each call site, so a future reader
+ * cannot add a git invocation that quietly omits them.
+ */
+const DIFF_HARDENING = ["--no-textconv", "--no-ext-diff"];
+
+/**
+ * Run one hardened, non-initializing git read. The subcommand is passed
+ * separately because the hardening flags have to follow it.
+ */
+async function readGit(
+  git: ReturnType<typeof getWorkspaceGitService>,
+  subcommand: "log" | "show",
+  args: string[],
+): Promise<{ stdout: string; stderr: string }> {
+  return git.runReadOnlyGitWithoutInit([
+    subcommand,
+    ...DIFF_HARDENING,
+    ...args,
+  ]);
+}
+
+/**
+ * Read a skill's recent revisions from workspace git.
+ *
+ * Returns an empty history rather than throwing when git is unavailable, the
+ * workspace is not a repository, or the skill has no tracked changes: history
+ * is a read-only enrichment and must never be the reason a caller fails.
+ * An invalid skill id DOES throw, because it means the caller passed
+ * unvalidated input into a pathspec.
+ */
+export async function getSkillHistory(
+  skillId: string,
+  options: { limit?: number } = {},
+): Promise<SkillHistory> {
+  const invalid = validateManagedSkillId(skillId);
+  if (invalid) {
+    throw new Error(`Invalid skill id: ${invalid}`);
+  }
+  const limit = Math.min(
+    Math.max(1, options.limit ?? DEFAULT_SKILL_HISTORY_LIMIT),
+    MAX_SKILL_HISTORY_LIMIT,
+  );
+
+  const empty: SkillHistory = {
+    skillId,
+    revisions: [],
+    truncatedByCompaction: false,
+  };
+
+  let git: ReturnType<typeof getWorkspaceGitService>;
+  try {
+    git = getWorkspaceGitService(getWorkspaceDir());
+  } catch (err) {
+    log.warn({ err, skillId }, "workspace git unavailable; no skill history");
+    return empty;
+  }
+
+  const skillPath = `skills/${skillId}/`;
+  // Exclude the usage stamp so a skill that was merely LOADED does not read as
+  // edited. `:(exclude)` is git pathspec magic, applied to both the log and
+  // the per-commit diff so the two can never disagree about what counts.
+  const pathspec = [skillPath, `:(exclude)${skillPath}install-meta.json`];
+
+  let shas: Array<{ sha: string; changedAt: string }>;
+  try {
+    const { stdout } = await readGit(git, "log", [
+      // Committer date, not author date. `git log` orders by commit date, so
+      // reporting the author date could label the list newest-first while its
+      // displayed dates disagree with that order.
+      `--format=%h${FIELD}%cI`,
+      // Ask for more than `limit`: commits whose only in-skill change is
+      // excluded by the pathspec still appear here, so the list is filtered
+      // down afterwards and would otherwise come up short.
+      `--max-count=${limit * 4}`,
+      "--",
+      ...pathspec,
+    ]);
+    shas = stdout
+      .split("\n")
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0)
+      .map((line) => {
+        const [sha, changedAt] = line.split(FIELD);
+        return { sha: sha ?? "", changedAt: changedAt ?? "" };
+      })
+      .filter((entry) => entry.sha.length > 0);
+  } catch (err) {
+    log.warn({ err, skillId }, "git log failed; no skill history");
+    return empty;
+  }
+
+  const revisions: SkillRevision[] = [];
+  for (const { sha, changedAt } of shas) {
+    if (revisions.length >= limit) {
+      break;
+    }
+    let diff: string;
+    let files: string[];
+    try {
+      const [diffResult, nameResult] = await Promise.all([
+        readGit(git, "show", ["--format=", sha, "--", ...pathspec]),
+        readGit(git, "show", [
+          "--format=",
+          "--name-only",
+          sha,
+          "--",
+          ...pathspec,
+        ]),
+      ]);
+      diff = diffResult.stdout.trim();
+      files = nameResult.stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(skillPath))
+        .map((line) => line.slice(skillPath.length))
+        .filter((line) => line.length > 0);
+    } catch (err) {
+      log.warn({ err, skillId, sha }, "git show failed; skipping revision");
+      continue;
+    }
+    // Nothing left once the usage stamp is excluded: the skill was loaded,
+    // not changed.
+    if (diff.length === 0 || files.length === 0) {
+      continue;
+    }
+    revisions.push({ id: sha, changedAt, files, diff });
+  }
+
+  return {
+    skillId,
+    revisions,
+    truncatedByCompaction: await hasCompactedHistory(git),
+  };
+}
+
+/**
+ * Whether the workspace has squashed older commits, which caps how far back
+ * any skill's history can reach. Best-effort: an error here only means the
+ * caller loses the caveat, never the history.
+ */
+async function hasCompactedHistory(
+  git: ReturnType<typeof getWorkspaceGitService>,
+): Promise<boolean> {
+  try {
+    const { stdout } = await readGit(git, "log", [
+      "--format=%s",
+      "--max-count=1",
+      "--grep=Compacted workspace history",
+    ]);
+    return stdout.trim().length > 0;
+  } catch {
+    return false;
+  }
+}

package/src/skills/skillssh-registry.ts

@@ -480,7 +480,7 @@ export async function installExternalSkill(
       contentHash: computeSkillHash(stagedDir) ?? undefined,
     });
 
-    installSkillDependenciesIfPresent(stagedDir);
+    await installSkillDependenciesIfPresent(stagedDir);
     commitStagedSkillInstall(skillSlug, stagedDir);
   } catch (err) {
     rmSync(stagedDir, { recursive: true, force: true });

package/src/stt/daemon-batch-transcriber.ts

@@ -214,6 +214,8 @@ class VellumManagedBatchTranscriber implements BatchTranscriber {
   readonly providerId = "vellum" as const;
   readonly boundaryId = "daemon-batch" as const;
 
+  constructor(private readonly language: string | undefined) {}
+
   async transcribe(
     request: SttTranscribeRequest,
   ): Promise<SttTranscribeResult> {
@@ -223,6 +225,7 @@ class VellumManagedBatchTranscriber implements BatchTranscriber {
       request.audio,
       request.mimeType,
       request.signal,
+      this.language,
     );
   }
 }
@@ -237,12 +240,11 @@ class VellumManagedBatchTranscriber implements BatchTranscriber {
  * is unavailable.
  *
  * `language` is the spoken language, forwarded to providers whose batch API
- * accepts one: Deepgram (where `"multi"` also pins nova-3) and xAI (where
+ * accepts one: Deepgram (where `"multi"` also pins nova-3), xAI (where
  * `"multi"` is dropped because it is a Deepgram-specific value, not a
- * language code). Whisper and Gemini auto-detect natively and take no
- * language parameter, so it is silently ignored for them, as is the vellum
- * managed path (the platform speech proxy accepts no language parameter;
- * see the deferral note in `resolveBatchTranscriber`).
+ * language code), and the vellum managed path, whose platform proxy passes
+ * it to Deepgram server-side. Whisper and Gemini auto-detect natively and
+ * take no language parameter, so it is silently ignored for them.
  */
 export function createDaemonBatchTranscriber(
   apiKey: string | null | undefined,
@@ -251,7 +253,7 @@ export function createDaemonBatchTranscriber(
 ): BatchTranscriber | null {
   // vellum authenticates via the platform connection, not an API key.
   if (providerId === "vellum") {
-    return new VellumManagedBatchTranscriber();
+    return new VellumManagedBatchTranscriber(language);
   }
   if (!apiKey) {
     return null;

package/src/subagent/__tests__/consult-prompt.test.ts

@@ -20,6 +20,31 @@ describe("buildAdvisorSystem", () => {
     expect(prompt).not.toContain("<agent_system_prompt>");
   });
 
+  test("tells the advisor it has read-only tools for verifying decisive facts", () => {
+    const prompt = buildAdvisorSystem(null);
+    expect(prompt).toContain("read-only tools");
+    expect(prompt).toContain("read files");
+    expect(prompt).toContain("verification, not exploration");
+    expect(prompt).toContain("You cannot change anything");
+  });
+
+  test("does not offer the advisor a memory or conversation search", () => {
+    // The advisor's read tools stop at the workspace. Naming `recall` here
+    // would advertise a search the role allowlist does not grant, and would
+    // contradict the scope the consult framing promises the user.
+    const prompt = buildAdvisorSystem(null);
+    expect(prompt).not.toContain("recall");
+    expect(prompt).toContain("you cannot see other conversations");
+  });
+
+  test("does not claim the advisor is tool-less", () => {
+    // The advisor can open a file to check a fact; a prompt that says otherwise
+    // suppresses the read it was given tools for.
+    const prompt = buildAdvisorSystem(null);
+    expect(prompt).not.toContain("You have no tools");
+    expect(prompt).not.toContain("cannot search, read files, or run commands");
+  });
+
   test("keeps the situational context pack out of the system prompt", () => {
     // System Prompt Minimalism: the pack rides in the request turn instead.
     expect(buildAdvisorSystem("parent")).not.toContain("<agent_environment>");

package/src/subagent/consult-prompt.ts

@@ -30,11 +30,13 @@ Evaluate the work along these dimensions, and lead with whatever matters most ri
 - Verification: If the agent has no clear way to confirm its work is correct, tell it how it will know.
 
 How to advise:
-- Be specific and grounded. Cite what you actually see in the transcript — a particular result, a line of reasoning, a command that failed. Never invent details that aren't there; if a decisive fact is missing, say what the agent should go find out.
+- Be specific and grounded. Cite what you actually see in the transcript: a particular result, a line of reasoning, a command that failed. Never invent details that aren't there; if a decisive fact is missing, either check it yourself with your read tools or say what the agent should go find out.
 - Be decisive. Give a clear recommendation, not a menu of equally weighted options. When genuinely uncertain, say so and state what would resolve it.
 - Prioritize ruthlessly. Lead with the highest-leverage point. Don't restate at length what the agent already did well, and don't pad the response with minor nitpicks — a focused, well-reasoned critique beats an exhaustive one.
 - Stay in your lane. Advise the agent; do not role-play as it, write its final deliverable, or take its next action for it. If the agent is already on the right track, confirm it and sharpen the plan rather than manufacturing objections.
 
+You have read-only tools: you may read files, list them, and search code to check a decisive fact before you advise. Use them with restraint. Answer from the inherited conversation whenever it already tells you what you need, and read only when a specific fact would change your advice: reading is for verification, not exploration. You cannot change anything and you cannot see other conversations, and the agent is waiting on you, so every call you make delays the guidance it gets.
+
 Write as much as the guidance genuinely needs, and no more.`;
   let prompt = base;
   if (originalSystemPrompt) {

package/src/subagent/consult-transcript.ts

@@ -1,6 +1,6 @@
 /**
  * Sanitize an inherited parent transcript before it is injected into a
- * tool-less advisor consult subagent.
+ * advisor consult subagent.
  *
  * `Conversation.injectInheritedContext` injects the parent's messages VERBATIM
  * with no sanitization, so the advisor path must run this over the parent