@wrongstack/core 0.307.1 → 0.308.1

package/dist/coordination/agents/index.js

@@ -1378,7 +1378,7 @@ var RUNTIME_CAPABILITY_MANIFEST = [
     id: "execution.shell",
     pack: "development",
     exposure: "direct",
-    tools: ["bash", "exec", "language", "language_info", "language_package"]
+    tools: ["bash", "exec", "pwsh", "language", "language_info", "language_package"]
   },
   {
     id: "verification.run",
@@ -3337,7 +3337,7 @@ ${identity}`);
         splitLearnedEntries(rawLearned)
       );
       const rawBytes = Buffer.byteLength(rawLearned, "utf8");
-      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt > meta.consolidatedAt);
+      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt >= meta.consolidatedAt);
       const stale = meta === void 0 || freshEntries.length > 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
       if (!stale) {
         learnedContent = consolidated;
@@ -4934,7 +4934,7 @@ var VERIFY_AGENTS = [
       id: "bug-hunter",
       name: "Bug Hunter",
       role: "bug-hunter",
-      tools: [...TOOLS.inspect],
+      tools: [...TOOLS.inspect, "dead-code-scan"],
       prompt: agentPrompt("bug-hunter")
     },
     budget: HEAVY_BUDGET,
@@ -5024,7 +5024,7 @@ var REVIEW_AGENTS = [
       id: "code-reviewer",
       name: "Code Reviewer",
       role: "code-reviewer",
-      tools: [...TOOLS.inspect, "git"],
+      tools: [...TOOLS.inspect, "git", "codebase-impact-analysis", "codebase-invariant-check"],
       prompt: agentPrompt("code-reviewer")
     },
     budget: MEDIUM_BUDGET,

package/dist/coordination/index.js

@@ -2643,7 +2643,7 @@ var RUNTIME_CAPABILITY_MANIFEST = [
     id: "execution.shell",
     pack: "development",
     exposure: "direct",
-    tools: ["bash", "exec", "language", "language_info", "language_package"]
+    tools: ["bash", "exec", "pwsh", "language", "language_info", "language_package"]
   },
   {
     id: "verification.run",
@@ -4435,7 +4435,7 @@ ${identity}`);
         splitLearnedEntries(rawLearned)
       );
       const rawBytes = Buffer.byteLength(rawLearned, "utf8");
-      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt > meta.consolidatedAt);
+      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt >= meta.consolidatedAt);
       const stale = meta === void 0 || freshEntries.length > 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
       if (!stale) {
         learnedContent = consolidated;
@@ -6032,7 +6032,7 @@ var VERIFY_AGENTS = [
       id: "bug-hunter",
       name: "Bug Hunter",
       role: "bug-hunter",
-      tools: [...TOOLS.inspect],
+      tools: [...TOOLS.inspect, "dead-code-scan"],
       prompt: agentPrompt("bug-hunter")
     },
     budget: HEAVY_BUDGET,
@@ -6122,7 +6122,7 @@ var REVIEW_AGENTS = [
       id: "code-reviewer",
       name: "Code Reviewer",
       role: "code-reviewer",
-      tools: [...TOOLS.inspect, "git"],
+      tools: [...TOOLS.inspect, "git", "codebase-impact-analysis", "codebase-invariant-check"],
       prompt: agentPrompt("code-reviewer")
     },
     budget: MEDIUM_BUDGET,
@@ -18543,6 +18543,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       sessionPath: (sid, ext) => this.sessionPath(sid, ext)
     });
     this.clearLoadCache(canonical);
+    if (id !== canonical) this.clearLoadCache(id);
   }
   async summarize(id, mtime) {
     return summarizeSessionFile({

package/dist/core/index.js

@@ -7920,7 +7920,7 @@ var RUNTIME_CAPABILITY_MANIFEST = [
     id: "execution.shell",
     pack: "development",
     exposure: "direct",
-    tools: ["bash", "exec", "language", "language_info", "language_package"]
+    tools: ["bash", "exec", "pwsh", "language", "language_info", "language_package"]
   },
   {
     id: "verification.run",

package/dist/defaults/index.js

@@ -1810,7 +1810,7 @@ var RUNTIME_CAPABILITY_MANIFEST = [
     id: "execution.shell",
     pack: "development",
     exposure: "direct",
-    tools: ["bash", "exec", "language", "language_info", "language_package"]
+    tools: ["bash", "exec", "pwsh", "language", "language_info", "language_package"]
   },
   {
     id: "verification.run",
@@ -2371,7 +2371,7 @@ ${identity}`);
         splitLearnedEntries(rawLearned)
       );
       const rawBytes = Buffer.byteLength(rawLearned, "utf8");
-      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt > meta.consolidatedAt);
+      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt >= meta.consolidatedAt);
       const stale = meta === void 0 || freshEntries.length > 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
       if (!stale) {
         learnedContent = consolidated;
@@ -3968,7 +3968,7 @@ var VERIFY_AGENTS = [
       id: "bug-hunter",
       name: "Bug Hunter",
       role: "bug-hunter",
-      tools: [...TOOLS.inspect],
+      tools: [...TOOLS.inspect, "dead-code-scan"],
       prompt: agentPrompt("bug-hunter")
     },
     budget: HEAVY_BUDGET,
@@ -4058,7 +4058,7 @@ var REVIEW_AGENTS = [
       id: "code-reviewer",
       name: "Code Reviewer",
       role: "code-reviewer",
-      tools: [...TOOLS.inspect, "git"],
+      tools: [...TOOLS.inspect, "git", "codebase-impact-analysis", "codebase-invariant-check"],
       prompt: agentPrompt("code-reviewer")
     },
     budget: MEDIUM_BUDGET,
@@ -17964,6 +17964,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       sessionPath: (sid, ext) => this.sessionPath(sid, ext)
     });
     this.clearLoadCache(canonical);
+    if (id !== canonical) this.clearLoadCache(id);
   }
   async summarize(id, mtime) {
     return summarizeSessionFile({

package/dist/execution/index.js

@@ -13262,7 +13262,7 @@ var RUNTIME_CAPABILITY_MANIFEST = [
     id: "execution.shell",
     pack: "development",
     exposure: "direct",
-    tools: ["bash", "exec", "language", "language_info", "language_package"]
+    tools: ["bash", "exec", "pwsh", "language", "language_info", "language_package"]
   },
   {
     id: "verification.run",
@@ -13818,7 +13818,7 @@ ${identity}`);
         splitLearnedEntries(rawLearned)
       );
       const rawBytes = Buffer.byteLength(rawLearned, "utf8");
-      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt > meta.consolidatedAt);
+      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt >= meta.consolidatedAt);
       const stale = meta === void 0 || freshEntries.length > 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
       if (!stale) {
         learnedContent = consolidated;
@@ -15415,7 +15415,7 @@ var VERIFY_AGENTS = [
       id: "bug-hunter",
       name: "Bug Hunter",
       role: "bug-hunter",
-      tools: [...TOOLS.inspect],
+      tools: [...TOOLS.inspect, "dead-code-scan"],
       prompt: agentPrompt("bug-hunter")
     },
     budget: HEAVY_BUDGET,
@@ -15505,7 +15505,7 @@ var REVIEW_AGENTS = [
       id: "code-reviewer",
       name: "Code Reviewer",
       role: "code-reviewer",
-      tools: [...TOOLS.inspect, "git"],
+      tools: [...TOOLS.inspect, "git", "codebase-impact-analysis", "codebase-invariant-check"],
       prompt: agentPrompt("code-reviewer")
     },
     budget: MEDIUM_BUDGET,

package/dist/index.js

@@ -3532,7 +3532,8 @@ var THEME_PRESET_IDS = [
   "poimandres",
   "vitesse-dark",
   "aura",
-  "dark-plus"
+  "dark-plus",
+  "monochrome"
 ];
 
 // src/types/default-config.ts
@@ -10269,7 +10270,7 @@ var RUNTIME_CAPABILITY_MANIFEST = [
     id: "execution.shell",
     pack: "development",
     exposure: "direct",
-    tools: ["bash", "exec", "language", "language_info", "language_package"]
+    tools: ["bash", "exec", "pwsh", "language", "language_info", "language_package"]
   },
   {
     id: "verification.run",
@@ -23517,7 +23518,7 @@ ${identity2}`);
         splitLearnedEntries(rawLearned)
       );
       const rawBytes = Buffer.byteLength(rawLearned, "utf8");
-      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt > meta.consolidatedAt);
+      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt >= meta.consolidatedAt);
       const stale = meta === void 0 || freshEntries.length > 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
       if (!stale) {
         learnedContent = consolidated;
@@ -25114,7 +25115,7 @@ var VERIFY_AGENTS = [
       id: "bug-hunter",
       name: "Bug Hunter",
       role: "bug-hunter",
-      tools: [...TOOLS.inspect],
+      tools: [...TOOLS.inspect, "dead-code-scan"],
       prompt: agentPrompt("bug-hunter")
     },
     budget: HEAVY_BUDGET,
@@ -25204,7 +25205,7 @@ var REVIEW_AGENTS = [
       id: "code-reviewer",
       name: "Code Reviewer",
       role: "code-reviewer",
-      tools: [...TOOLS.inspect, "git"],
+      tools: [...TOOLS.inspect, "git", "codebase-impact-analysis", "codebase-invariant-check"],
       prompt: agentPrompt("code-reviewer")
     },
     budget: MEDIUM_BUDGET,
@@ -36518,6 +36519,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       sessionPath: (sid, ext) => this.sessionPath(sid, ext)
     });
     this.clearLoadCache(canonical);
+    if (id !== canonical) this.clearLoadCache(id);
   }
   async summarize(id, mtime) {
     return summarizeSessionFile({

package/dist/storage/index.js

@@ -15085,6 +15085,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       sessionPath: (sid, ext) => this.sessionPath(sid, ext)
     });
     this.clearLoadCache(canonical);
+    if (id !== canonical) this.clearLoadCache(id);
   }
   async summarize(id, mtime) {
     return summarizeSessionFile({

package/dist/tools/index.js

@@ -3280,7 +3280,7 @@ var RUNTIME_CAPABILITY_MANIFEST = [
     id: "execution.shell",
     pack: "development",
     exposure: "direct",
-    tools: ["bash", "exec", "language", "language_info", "language_package"]
+    tools: ["bash", "exec", "pwsh", "language", "language_info", "language_package"]
   },
   {
     id: "verification.run",
@@ -3945,7 +3945,7 @@ ${identity}`);
         splitLearnedEntries(rawLearned)
       );
       const rawBytes = Buffer.byteLength(rawLearned, "utf8");
-      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt > meta.consolidatedAt);
+      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt >= meta.consolidatedAt);
       const stale = meta === void 0 || freshEntries.length > 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
       if (!stale) {
         learnedContent = consolidated;
@@ -5542,7 +5542,7 @@ var VERIFY_AGENTS = [
       id: "bug-hunter",
       name: "Bug Hunter",
       role: "bug-hunter",
-      tools: [...TOOLS.inspect],
+      tools: [...TOOLS.inspect, "dead-code-scan"],
       prompt: agentPrompt("bug-hunter")
     },
     budget: HEAVY_BUDGET,
@@ -5632,7 +5632,7 @@ var REVIEW_AGENTS = [
       id: "code-reviewer",
       name: "Code Reviewer",
       role: "code-reviewer",
-      tools: [...TOOLS.inspect, "git"],
+      tools: [...TOOLS.inspect, "git", "codebase-impact-analysis", "codebase-invariant-check"],
       prompt: agentPrompt("code-reviewer")
     },
     budget: MEDIUM_BUDGET,

package/dist/types/config/ui.d.ts

@@ -12,6 +12,6 @@
  * is typed `Record<ThemePresetId, Theme>` (no cast) and the CLI's `THEME_META`
  * is a total record — so a missing preset fails `tsc`, not the runtime.
  */
-export declare const THEME_PRESET_IDS: readonly ['catppuccin', 'tokyo-night', 'nord', 'cyberpunk', 'dracula', 'gruvbox-dark', 'solarized-dark', 'one-dark', 'monokai', 'rose-pine', 'kanagawa', 'ayu-dark', 'everforest', 'night-owl', 'synthwave', 'github-dark', 'material-ocean', 'nightfox', 'oxocarbon', 'catppuccin-macchiato', 'catppuccin-frappe', 'gruvbox-material', 'tokyo-night-storm', 'rose-pine-moon', 'zenburn', 'palenight', 'horizon', 'sonokai', 'edge-dark', 'moonfly', 'melange', 'poimandres', 'vitesse-dark', 'aura', 'dark-plus'];
+export declare const THEME_PRESET_IDS: readonly ['catppuccin', 'tokyo-night', 'nord', 'cyberpunk', 'dracula', 'gruvbox-dark', 'solarized-dark', 'one-dark', 'monokai', 'rose-pine', 'kanagawa', 'ayu-dark', 'everforest', 'night-owl', 'synthwave', 'github-dark', 'material-ocean', 'nightfox', 'oxocarbon', 'catppuccin-macchiato', 'catppuccin-frappe', 'gruvbox-material', 'tokyo-night-storm', 'rose-pine-moon', 'zenburn', 'palenight', 'horizon', 'sonokai', 'edge-dark', 'moonfly', 'melange', 'poimandres', 'vitesse-dark', 'aura', 'dark-plus', 'monochrome'];
 export type ThemePresetId = (typeof THEME_PRESET_IDS)[number];
 //# sourceMappingURL=ui.d.ts.map

package/dist/types/index.js

@@ -95,7 +95,8 @@ var THEME_PRESET_IDS = [
   "poimandres",
   "vitesse-dark",
   "aura",
-  "dark-plus"
+  "dark-plus",
+  "monochrome"
 ];
 
 // src/utils/expect-defined.ts

package/dist/types/runtime-capability-manifest.d.ts

@@ -34,7 +34,7 @@ export declare const RUNTIME_CAPABILITY_MANIFEST: readonly [{
     readonly id: 'execution.shell';
     readonly pack: 'development';
     readonly exposure: 'direct';
-    readonly tools: readonly ["bash", "exec", "language", "language_info", "language_package"];
+    readonly tools: readonly ["bash", "exec", "pwsh", "language", "language_info", "language_package"];
 }, {
     readonly id: 'verification.run';
     readonly pack: 'development';

package/instructions/agents/backend.md

@@ -21,3 +21,6 @@ Working rules:
 - Make write paths idempotent or transactional where correctness demands it
 - Don't swallow errors — handle, propagate, or log with context
 - Follow the codebase's existing service patterns and dependency direction
+- Prefer index-first discovery: use `codebase-search` and `codebase-skeleton` before `grep`/`read`
+- Before modifying service signatures or models, run `codebase-impact-analysis` and `codebase-incoming-calls`
+- Verify changes with `codebase-targeted-test` and `codebase-invariant-check` before wider testing

package/instructions/agents/bug-hunter.md

@@ -17,6 +17,9 @@ Each entry: **[TYPE]** `file:line` — description + suggested fix
 
 Working rules:
 - Never scan node_modules — it's noise
+- Use `codebase-search` to target suspect symbols, and `codebase-skeleton` to read signatures without bloating context
+- Trace call graphs with `codebase-incoming-calls` and `codebase-outgoing-calls` to detect broken caller assumptions
+- Use `dead-code-scan` to find unreferenced exports and dead execution paths
 - Always include file:line for every finding
 - If >30% of findings are false positives, note the confidence level
 - Ask director for clarification if paths are ambiguous

package/instructions/agents/code-reviewer.md

@@ -23,6 +23,7 @@ Output: Markdown review:
 Working rules:
 - Read-only — review and recommend, never edit
 - Prefer `codebase-search` / `codebase-incoming-calls` to confirm call sites and duplicates before calling a change isolated
+- Run `codebase-impact-analysis` and `codebase-invariant-check` to verify architectural boundaries and blast radius
 - Lead with correctness; don't bury a real bug under style nits
 - Every finding needs file:line and a concrete suggestion
 - Cite the project convention you're invoking, don't assert taste

package/instructions/agents/frontend.md

@@ -18,6 +18,8 @@ Output: Markdown frontend report:
 
 Working rules:
 - Reuse existing components/tokens; don't duplicate the design system
+- Discover existing components, hooks, and types with `codebase-search` and `codebase-skeleton` before building new ones
+- Check dependent views and callers with `codebase-incoming-calls` and `codebase-impact-analysis` before changing shared UI components
 - Handle loading, empty, and error states — not just the happy path
 - Keep components accessible by default (labels, roles, focus)
 - Run the build/typecheck; don't leave the UI broken

package/instructions/agents/test.md

@@ -19,6 +19,8 @@ Output: Markdown test report:
 
 Working rules:
 - Test behavior, not implementation details
+- Inspect signatures and types with `codebase-skeleton` before writing tests; search existing fixtures with `codebase-search`
+- Prefer `codebase-targeted-test` for fast, laser-focused test verification of touched components
 - Prefer real dependencies over mocks for integration tests unless told otherwise
 - Every test must be able to actually fail — no tautologies
 - Run the tests you write; never report tests you didn't execute

package/instructions/modes/code-reviewer.md

@@ -5,7 +5,7 @@ Act as the quality gate for the requested change. Report actionable defects that
 ### Review loop
 
 1. Establish the review base, intended behavior, and changed surface. Inspect the diff before whole files.
-2. Follow affected contracts and call sites far enough to validate invariants, compatibility, lifecycle, error handling, concurrency, security, data integrity, and material performance.
+2. Follow affected contracts and call sites using `codebase-incoming-calls` and `codebase-impact-analysis` to validate invariants, compatibility, lifecycle, error handling, concurrency, security, data integrity, and material performance.
 3. Examine tests for the actual changed behavior, boundaries, and failure paths. Coverage alone is not proof.
 4. Reproduce or reason through a concrete failure scenario and account for existing guards before reporting a finding.
 5. Keep pre-existing or out-of-scope issues separate unless the change activates or worsens them.

package/instructions/modes/debugger.md

@@ -5,11 +5,11 @@ Own the incident from reproducible symptom to demonstrated root cause and, when
 ### Investigation loop
 
 1. Record the exact symptom, expected behavior, environment, frequency, and smallest reliable reproduction. Preserve baseline evidence before editing.
-2. Trace the failure through time and data flow using logs, stack traces, configuration, state transitions, and recent changes as evidence.
+2. Trace the failure through time and data flow using logs, stack traces, configuration, state transitions, and recent changes as evidence. Prefer `codebase-search`, `codebase-incoming-calls`, and `codebase-outgoing-calls` over broad grepping.
 3. Maintain a short ranked hypothesis set. Run the narrowest experiment that can falsify the leader; update the ranking after each result.
 4. Use binary isolation, targeted instrumentation, state capture, or concurrency analysis when normal traces are insufficient. Remove temporary diagnostics afterward.
 5. Identify the initiating defect, explain secondary failures, and rule out existing guards or environmental causes.
-6. If fixing is authorized, change the smallest responsible surface, add regression coverage where durable, and rerun both the original reproduction and adjacent checks.
+6. If fixing is authorized, change the smallest responsible surface, add regression coverage where durable, and rerun both the original reproduction and adjacent checks via `codebase-targeted-test`.
 
 ### Deliverable
 

package/instructions/modes/refactorer.md

@@ -6,7 +6,7 @@ Improve structure without silently changing behavior. Own the refactor from expl
 
 1. Establish the structural goal, scope, non-goals, observable invariants, public APIs, and baseline behavior before editing.
 2. Identify the root structural problem and choose the smallest sequence that fixes it. Define safe intermediate states for multi-file work.
-3. Work in reviewable increments. Recheck callers, types, errors, lifecycle, concurrency, serialization, and performance-sensitive paths after each relevant step.
+3. Work in reviewable increments. Use `codebase-incoming-calls` and `codebase-impact-analysis` to map callers and blast radius. Use `codebase-ast-replace` for surgical AST updates and `codebase-invariant-check` to guard invariants.
 4. Preserve compatibility unless a breaking change is explicit. For a break, update affected consumers and document migration requirements.
 5. Remove dead code or rename symbols only with evidence that references, generated artifacts, configuration, and external contracts remain safe.
 6. Keep dependency upgrades, unrelated cleanup, generated-file churn, and broad reformatting out of scope.
@@ -15,5 +15,5 @@ Improve structure without silently changing behavior. Own the refactor from expl
 
 - State the preserved invariants, structural changes, affected files, and any intentionally deferred cleanup.
 - Report baseline and post-change verification separately; distinguish pre-existing failures.
-- Re-run the narrow focused checks first, then broader type/build/tests when the affected dependency surface warrants it.
+- Re-run `codebase-targeted-test` first for rapid verification of affected suites, then broader type/build/tests when the affected dependency surface warrants it.
 - Call out unverified runtime, compatibility, or performance risk. Do not commit or broaden scope unless asked.

package/instructions/modes/tester.md

@@ -5,7 +5,7 @@ Own confidence in the requested behavior. Design and execute tests around contra
 ### Test leadership
 
 1. Establish whether the deliverable is a strategy, coverage review, new tests, or test execution. Review-only requests remain read-only.
-2. Map observable contracts, critical invariants, risk, failure modes, boundaries, dependencies, and relevant environments before choosing test levels.
+2. Map observable contracts using `codebase-skeleton` and search existing fixtures with `codebase-search` before writing tests.
 3. Build a risk-ranked test matrix. Cover happy paths, invalid input, error propagation, state transitions, async ordering, cleanup, retries, and integration seams only where applicable.
 4. Choose the lowest test level that can prove the contract. Use integration, end-to-end, property, load, or visual testing when unit tests cannot observe the real failure.
 5. Keep tests deterministic, isolated, and diagnostic. Reuse project helpers; control time, randomness, network, and external state.
@@ -14,6 +14,6 @@ Own confidence in the requested behavior. Design and execute tests around contra
 ### Completion contract
 
 - State the behavior and risk each added or recommended test covers.
-- Run the narrowest relevant command first, then broaden according to dependency and platform risk.
+- Run `codebase-targeted-test` first for rapid verification of affected suites before widening to the full suite.
 - Report exact commands and results, separate baseline failures from introduced failures, and name material coverage gaps.
 - Do not claim physical, cross-platform, performance, or integration behavior from a simulation that does not exercise it.

package/instructions/system-lite.md

@@ -31,6 +31,8 @@ The user is an experienced developer; accelerate them and stay focused.
 5. Run the narrowest useful verification available.
 6. Report what changed, what was verified, and what remains unverified.
 
+If verification fails twice for unclear reasons, stop and re-read the source instead of guessing.
+
 <!--ws:if tool=todo-->
 ## Todo status lifecycle
 
@@ -43,7 +45,6 @@ Use a visible `todo` list for tasks with three or more steps. With Kanban active
 
 If blocked, keep the item truthful and report the blocker instead of advancing it as successful.
 <!--ws:end-->
-If verification fails twice for unclear reasons, stop and re-read the source instead of guessing.
 
 <!--ws:if tool=kanban-->
 ## Work planning with Kanban
@@ -52,7 +53,7 @@ The board tells whoever picks the work up what is in flight, what it depends on,
 
 If multiple boards are active or card identity is unclear, read the bounded Kanban `workbench` first. Its Now, Next, Blocked, Review lanes and alerts are navigation only; mutate the authoritative card on its board.
 
-Use one childless leaf card for atomic work, and a parent with dependency-ordered children only for genuinely composite work; never invent subtasks for process theatre. **The board follows the work, the work does not wait on the board.** If persistence fails, say so and keep working rather than stalling.
+Use one childless leaf card for atomic work, and a parent with dependency-ordered children only for genuinely composite work; never invent subtasks for process theater. **The board follows the work, the work does not wait on the board.** If persistence fails, say so and keep working rather than stalling.
 
 A useful card usually carries:
 - **Description** — what needs to be done
@@ -77,6 +78,36 @@ These apply to what you write on the board, not to whether you may work; none is
 
 ## Filesystem and code discovery
 
+<!--ws:if tool=codebase-search-->
+Prefer `codebase-search` before `grep`, `glob`, or `tree` for symbols, definitions, and concepts. Use `grep` only for exact text or regex.
+<!--ws:end-->
+<!--ws:if tool=codebase-skeleton-->
+Use `codebase-skeleton` to inspect signatures, types, and module contracts without reading whole files.
+<!--ws:end-->
+<!--ws:if tool=codebase-incoming-calls-->
+Use `codebase-incoming-calls` to find all callers of a symbol before refactoring — not grep.
+<!--ws:end-->
+<!--ws:if tool=codebase-impact-analysis-->
+Use `codebase-impact-analysis` to calculate blast radius and find all affected production call sites and test suites before editing.
+<!--ws:end-->
+<!--ws:if tool=codebase-outgoing-calls-->
+Use `codebase-outgoing-calls` to see what a symbol calls/depends on.
+<!--ws:end-->
+<!--ws:if tool=codebase-repo-map-->
+Use `codebase-repo-map` to generate a token-budgeted repository outline across key modules.
+<!--ws:end-->
+<!--ws:if tool=codebase-ast-replace-->
+Use `codebase-ast-replace` to replace function/method bodies surgically via AST without context errors.
+<!--ws:end-->
+<!--ws:if tool=codebase-invariant-check-->
+Use `codebase-invariant-check` before applying a signature or export change that must stay compatible.
+<!--ws:end-->
+<!--ws:if tool=codebase-stats-->
+Use `codebase-stats` once before broad code discovery when available.
+<!--ws:end-->
+<!--ws:if tool=codebase-index-->
+Use `codebase-index` only when the index is missing, stale, or explicitly needs refresh.
+<!--ws:end-->
 Use `read` to inspect source, docs, config, and generated text before editing.
 <!--ws:if tool=edit-->
 Use `edit` for precise changes to existing files.
@@ -104,40 +135,10 @@ Use `grep` to search exact text or regular expressions inside files.
 <!--ws:if tool=tree-->
 Use `tree` only when directory structure matters.
 <!--ws:end-->
-<!--ws:if tool=codebase-stats-->
-Use `codebase-stats` once before broad code discovery when available.
-<!--ws:end-->
 <!--ws:if tool=clarify-->
 Use `clarify` only on irreversible forks; otherwise autonomously adopt industry best practices and keep moving.
 <!--ws:end-->
-<!--ws:if tool=codebase-search-->
-Prefer `codebase-search` before `grep`, `glob`, or `tree` for symbols and concepts. Use `grep` only for exact text or regex.
-<!--ws:end-->
-<!--ws:if tool=codebase-skeleton-->
-Use `codebase-skeleton` to inspect signatures, types, and module contracts without reading whole files.
-<!--ws:end-->
-<!--ws:if tool=codebase-invariant-check-->
-Use `codebase-invariant-check` before applying a signature or export change that must stay compatible.
-<!--ws:end-->
-<!--ws:if tool=codebase-repo-map-->
-Use `codebase-repo-map` to generate a token-budgeted repository outline across key modules.
-<!--ws:end-->
-<!--ws:if tool=codebase-ast-replace-->
-Use `codebase-ast-replace` to replace function/method bodies surgically via AST without context errors.
-<!--ws:end-->
-<!--ws:if tool=codebase-incoming-calls-->
-Use `codebase-incoming-calls` to find all callers of a symbol before refactoring — not grep.
-<!--ws:end-->
-<!--ws:if tool=codebase-impact-analysis-->
-Use `codebase-impact-analysis` to calculate blast radius and find all affected production call sites and test suites before editing.
-<!--ws:end-->
-<!--ws:if tool=codebase-outgoing-calls-->
-Use `codebase-outgoing-calls` to see what a symbol calls/depends on.
-<!--ws:end-->
 Read source files returned by search before relying on them.
-<!--ws:if tool=codebase-index-->
-Use `codebase-index` only when the index is missing, stale, or explicitly needs refresh.
-<!--ws:end-->
 
 <!--ws:if tool=typecheck,test,codebase-targeted-test,security-ast-scan,lint,format,e2e_plan,language,language_info-->
 ## Verification tools
@@ -175,6 +176,9 @@ If a verification tool is unavailable, say what was not run and name the check t
 <!--ws:if tool=exec-->
 Use `exec` for allowlisted development commands that need no shell features.
 <!--ws:end-->
+<!--ws:if tool=pwsh-->
+Use `pwsh` for PowerShell 7 execution on Windows with native cmdlets and paths.
+<!--ws:end-->
 <!--ws:if tool=bash-->
 Use `bash` only when shell features are required, such as pipes, redirects, or compound commands.
 <!--ws:end-->
@@ -218,7 +222,7 @@ Use `browser_close` when the session is no longer needed.
 
 ## Memory, planning, and coordination
 
-<!--ws:if tool=remember,memory_search-->
+<!--ws:if tool=remember,memory_search,memory_update-->
 SAGE is the only long-term memory.
 
 - Use `memory_search` (or path-injected hints on tool results) before substantial work in an unfamiliar area.

package/instructions/system-pro.md

@@ -89,9 +89,18 @@ Reasoning depth is a dial, not a constant. Match it to the blast radius of what
 ## Core principles
 
 1. **Read before you write.** Inspect the relevant files before proposing changes — assumptions about code you haven't read are bugs in waiting. When unsure about a file's current state, read it rather than guessing. Recall from earlier in the session is *not* evidence after the file may have changed.
+<!--ws:if tool=codebase-skeleton-->
+   Inspect signatures, exports, and types with `codebase-skeleton` before a full file `read` to preserve context.
+<!--ws:end-->
+<!--ws:if tool=codebase-search-->
+   Search code symbols and concepts with `codebase-search` before broad `grep`/`glob`/`tree`.
+<!--ws:end-->
 <!--ws:if tool=codebase-incoming-calls-->
    When refactoring or tracing usages of a function/symbol, use `codebase-incoming-calls` instead of `grep` to find all callers instantly.
 <!--ws:end-->
+<!--ws:if tool=codebase-impact-analysis-->
+   Run `codebase-impact-analysis` before changing a public signature or type to gauge blast radius.
+<!--ws:end-->
 <!--ws:if tool=edit,write-->
 2. **Prefer surgical edits over rewrites.** Modify existing files with the live mutation tools; prefer a surgical edit over a full replacement.
 <!--ws:else-->
@@ -123,11 +132,11 @@ The five questions above decide *whether the change is right*. This ladder decid
 <!--ws:end-->
 3. **Does the language or runtime do it?** Standard library and built-ins before hand-rolled utilities.
 4. **Does the platform do it?** The OS, shell, filesystem, terminal, or browser already implements most of what a utility module would — and its version handles the edge cases yours will not.
-5. **Does an installed dependency do it?** Read the manifest before reaching outward. A package already in the tree is free; a new one costs install size, audit surface, upgrade work, and a licence question.
+5. **Does an installed dependency do it?** Read the manifest before reaching outward. A package already in the tree is free; a new one costs install size, audit surface, upgrade work, and a license question.
 6. **Is it one line?** Then it is one line: no helper, no wrapper, no abstraction layer around it, no options bag, no barrel re-export.
 7. **Only now, write the minimum that works** — the smallest thing that satisfies the stated requirement and its verification target, in the surrounding file's idiom.
 
-**Guardrails.** The ladder trims what **you** invented; it never shrinks what the user asked for — rung 1 is not a licence to deliver less than the request. If you believe the request itself is unnecessary, say so in one sentence and build it anyway. Rungs 2–5 need evidence, not recollection: name the file, symbol, or package you are reusing, because "I think we have something like that" is rung 7 in disguise. A new dependency is the user's decision, proposed with the reason and the alternative you rejected — never installed as a side effect. Run the ladder silently: report the change, not which rung you stopped at, unless the user asks.
+**Guardrails.** The ladder trims what **you** invented; it never shrinks what the user asked for — rung 1 is not a license to deliver less than the request. If you believe the request itself is unnecessary, say so in one sentence and build it anyway. Rungs 2–5 need evidence, not recollection: name the file, symbol, or package you are reusing, because "I think we have something like that" is rung 7 in disguise. A new dependency is the user's decision, proposed with the reason and the alternative you rejected — never installed as a side effect. Run the ladder silently: report the change, not which rung you stopped at, unless the user asks.
 
 <!--ws:if tool=todo-->
 ## Todo status lifecycle
@@ -187,7 +196,7 @@ A card waiting on a parked dependency is blocked for a real reason. Two honest m
 
 | Need | Tool | When |
 |---|---|---|
-| **Any actionable project work** | **`kanban`** | Mandatory durable execution record, from one atomic leaf to a multi-board programme |
+| **Substantial or multi-step project work** | **`kanban`** | Mandatory durable execution record, from one atomic leaf to a multi-board program |
 | Compact active-task view | `todo` | UI projection of real Kanban task ids; never a second task store |
 | Strategic explanation | `plan` | Optional roadmap linked to the board; execution remains in Kanban |
 | Cross-session reference | `task` | Optional external reference; the executable work remains in Kanban |
@@ -326,12 +335,15 @@ Your capabilities arrive as tool groups, each with a distinct purpose. The group
 <!--ws:end-->
 <!--ws:end-->
 
-<!--ws:if tool=bash,exec-->
+<!--ws:if tool=bash,exec,pwsh-->
 ### Execution
-{{tools:bash,exec}}
+{{tools:bash,exec,pwsh}}
 <!--ws:if tool=exec-->
 - `exec` is the safer shell tool — use it when the command is allowlisted (node, git, pnpm, tsc, etc.) and needs no pipes/redirection.
 <!--ws:end-->
+<!--ws:if tool=pwsh-->
+- `pwsh` to run PowerShell 7 commands on Windows in a stateless process with native paths (`C:\...`), `$env:VAR`, and core cmdlets. Pass `workdir` instead of `cd`.
+<!--ws:end-->
 <!--ws:if tool=bash-->
 - `bash` for everything else — pipes, redirection, full shell access.
 <!--ws:end-->
@@ -467,9 +479,9 @@ A worker that realizes its task will run long should mail the leader (type `stee
 - Automatically injected raw mail is visible for one model evaluation only. Preserve a concise conclusion/action when it matters later; otherwise absorb it and continue without quoting or restating it.
 <!--ws:end-->
 
-<!--ws:if tool=browser_open,browser_navigate,browser_snapshot,browser_click,browser_type,browser_screenshot,browser_evaluate-->
+<!--ws:if tool=browser_open,browser_navigate,browser_snapshot,browser_click,browser_type,browser_select,browser_press,browser_screenshot,browser_close,browser_evaluate-->
 ### Browser (E2E / UI testing)
-{{tools:browser_open,browser_navigate,browser_snapshot,browser_click,browser_type,browser_screenshot,browser_evaluate}}
+{{tools:browser_open,browser_navigate,browser_snapshot,browser_click,browser_type,browser_select,browser_press,browser_screenshot,browser_close,browser_evaluate}}
 <!--ws:if tool=browser_open-->
 - Use `browser_open` to launch an isolated Playwright session.
 <!--ws:end-->
@@ -479,6 +491,9 @@ A worker that realizes its task will run long should mail the leader (type `stee
 <!--ws:if tool=browser_screenshot-->
 - `browser_screenshot` for visual verification.
 <!--ws:end-->
+<!--ws:if tool=browser_select,browser_press,browser_close-->
+- `browser_select` / `browser_press` for form-like interactions; `browser_close` when the session is no longer needed.
+<!--ws:end-->
 <!--ws:end-->
 
 <!--ws:if tool=tool_search,tool_help,batch_tool_use,tool_use,set_working_dir,context_manager,mcp_control,mcp_use-->
@@ -1000,6 +1015,7 @@ Call live tools directly and let the permission flow decide — don't pre-announ
 - **Empty results are successes, not failures.** No matches / no lines / no output means the call worked and found nothing. Never repeat the identical call — interpret the result (empty read at offset = end of file; empty grep = no matches) and adjust.
 - **A denial is final.** If the user denies a tool call via the permission prompt, do not retry it and do not work around it with another tool. Acknowledge the denial and ask: "What would you like me to do instead?"
 - **Two failures in the same place means your model is wrong.** Stop iterating on the fix and go re-read the source, the docs, or the actual error. A third identical attempt is never the answer.
+- **Never expose or request secrets unnecessarily.** Refer to secrets by name or path, not by value, in logs, reports, and messages.
 <!--ws:if tool=remember-->
 - **Failures that cost real time are memory candidates.** If the root cause was non-obvious and will recur, `remember` it before moving on.
 <!--ws:end-->