abelworkflow 0.9.2 → 1.0.0-rc.1

package/lib/providers/pi.mjs

@@ -0,0 +1,362 @@
+import { spawnSync } from "node:child_process";
+import { join } from "node:path";
+import * as p from "@clack/prompts";
+import { piInsecureTlsHeader } from "../../extensions/pi-gpt-responses-compat/tls-fetch.mjs";
+import {
+  readJsonFileSafe,
+  readJsoncFileSafe,
+  updateLockedJson,
+  writeJsonFileWithBackup,
+  writeText
+} from "../config/store.mjs";
+import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
+
+const piProviderId = "gpt";
+const piDefaultApi = "openai-completions";
+const piDefaultBaseUrl = "https://api.openai.com/v1";
+const piDefaultModel = "gpt-5.5";
+const minimumPiVersion = [0, 80, 0];
+
+async function updatePiAuthFile(path, apiKey) {
+  return updateLockedJson(path, (auth) => {
+    if (!auth || typeof auth !== "object" || Array.isArray(auth)) {
+      throw new TypeError("Pi auth.json must contain a JSON object");
+    }
+    return buildPiAuthConfig(auth, apiKey);
+  }, {
+    sensitive: true,
+    retries: {
+      retries: 10,
+      factor: 2,
+      minTimeout: 100,
+      maxTimeout: 10000,
+      randomize: true
+    }
+  });
+}
+
+function parsePiVersion(value) {
+  const match = String(value || "").match(/(?:^|\D)v?(\d+)\.(\d+)\.(\d+)(?:\D|$)/u);
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function assertSupportedPiVersion(value) {
+  const version = parsePiVersion(value);
+  if (!version) {
+    throw new Error("无法检测 Pi 版本；配置自定义 Provider 需要 Pi 0.80.0 或更高版本。");
+  }
+  for (let index = 0; index < minimumPiVersion.length; index += 1) {
+    if (version[index] > minimumPiVersion[index]) return version;
+    if (version[index] < minimumPiVersion[index]) {
+      throw new Error(`当前 Pi ${version.join(".")} 不支持 auth-only 自定义 Provider；请升级到 Pi 0.80.0 或更高版本。`);
+    }
+  }
+  return version;
+}
+
+function detectPiVersion() {
+  const result = spawnSync("pi", ["--version"], {
+    encoding: "utf8",
+    shell: process.platform === "win32",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  return result.status === 0 ? `${result.stdout || ""} ${result.stderr || ""}`.trim() : undefined;
+}
+
+function parsePiModelIds(value) {
+  return [...new Set(String(value || "")
+    .split(/[\n,]+/u)
+    .map((item) => item.trim())
+    .filter(Boolean))];
+}
+
+function getOpenAiUrlPathname(value) {
+  const input = String(value || "").trim();
+  try {
+    return new URL(input).pathname.replace(/\/+$/u, "");
+  } catch {
+    return input.split(/[?#]/u)[0].replace(/\/+$/u, "");
+  }
+}
+
+function inferPiApiFromBaseUrl(value) {
+  const pathname = getOpenAiUrlPathname(value);
+  if (pathname.endsWith("/v1/chat/completions")) {
+    return "openai-completions";
+  }
+  if (pathname.endsWith("/v1/responses")) {
+    return "openai-responses";
+  }
+  return null;
+}
+
+function normalizeOpenAiBaseUrl(value) {
+  const input = String(value || "").trim();
+  try {
+    const url = new URL(input);
+    let pathname = url.pathname.replace(/\/+$/u, "")
+      .replace(/\/v1\/(?:chat\/completions|responses)$/u, "/v1");
+    if (!pathname.endsWith("/v1")) {
+      pathname = `${pathname}/v1`;
+    }
+    url.pathname = pathname;
+    return url.toString();
+  } catch {
+    const baseUrl = input.replace(/\/+$/u, "")
+      .replace(/\/v1\/(?:chat\/completions|responses)$/u, "/v1");
+    return baseUrl.endsWith("/v1") ? baseUrl : `${baseUrl}/v1`;
+  }
+}
+
+function getPiApiPromptOptions() {
+  return [
+    { value: "openai-completions", label: "OpenAI Chat Completions（推荐）" },
+    { value: "openai-responses", label: "OpenAI Responses API" }
+  ];
+}
+
+function resolveExistingPiApiConfig(modelsConfig = {}, settings = {}, auth = {}) {
+  const provider = modelsConfig.providers?.[piProviderId] && typeof modelsConfig.providers[piProviderId] === "object"
+    ? modelsConfig.providers[piProviderId]
+    : {};
+  const credential = auth[piProviderId] && typeof auth[piProviderId] === "object"
+    ? auth[piProviderId]
+    : {};
+  const authApiKey = credential.type === "api_key" && typeof credential.key === "string"
+    ? credential.key
+    : "";
+  const models = Array.isArray(provider.models) ? provider.models.filter((model) => model?.id) : [];
+  return {
+    baseUrl: provider.baseUrl || piDefaultBaseUrl,
+    api: provider.api || piDefaultApi,
+    apiKey: authApiKey || provider.apiKey || "",
+    modelIds: models.map((model) => model.id),
+    defaultModel: settings.defaultProvider === piProviderId && settings.defaultModel
+      ? settings.defaultModel
+      : models[0]?.id || piDefaultModel
+  };
+}
+
+function buildPiModelConfig(modelId, existingModel = {}) {
+  return {
+    ...existingModel,
+    id: modelId,
+    name: existingModel.name || modelId,
+    reasoning: existingModel.reasoning ?? true,
+    input: Array.isArray(existingModel.input) ? existingModel.input : ["text", "image"],
+    contextWindow: existingModel.contextWindow ?? 262144,
+    maxTokens: existingModel.maxTokens ?? 64000
+  };
+}
+
+function hasPiInsecureTlsSetting(modelsConfig = {}) {
+  const headers = modelsConfig.providers?.[piProviderId]?.headers;
+  return headers && typeof headers === "object"
+    ? Object.keys(headers).some((key) => key.toLowerCase() === piInsecureTlsHeader)
+    : false;
+}
+
+function buildPiModelsConfig(modelsConfig = {}, { baseUrl, api, modelIds, insecureTls = false }) {
+  const providers = modelsConfig.providers && typeof modelsConfig.providers === "object" ? modelsConfig.providers : {};
+  const currentProvider = providers[piProviderId] && typeof providers[piProviderId] === "object" ? providers[piProviderId] : {};
+  const headers = currentProvider.headers && typeof currentProvider.headers === "object"
+    ? { ...currentProvider.headers }
+    : {};
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === piInsecureTlsHeader) {
+      delete headers[key];
+    }
+  }
+  if (insecureTls) {
+    headers[piInsecureTlsHeader] = new URL(baseUrl).origin;
+  }
+  const existingModels = new Map(
+    (Array.isArray(currentProvider.models) ? currentProvider.models : [])
+      .filter((model) => model?.id)
+      .map((model) => [model.id, model])
+  );
+
+  const provider = {
+    ...currentProvider,
+    baseUrl,
+    api,
+    compat: {
+      ...(currentProvider.compat && typeof currentProvider.compat === "object" ? currentProvider.compat : {}),
+      supportsDeveloperRole: false
+    },
+    models: modelIds.map((modelId) => buildPiModelConfig(modelId, existingModels.get(modelId)))
+  };
+  delete provider.apiKey;
+  if (Object.keys(headers).length) {
+    provider.headers = headers;
+  } else {
+    delete provider.headers;
+  }
+
+  return {
+    ...modelsConfig,
+    providers: {
+      ...providers,
+      [piProviderId]: provider
+    }
+  };
+}
+
+function buildPiAuthConfig(auth = {}, apiKey) {
+  const credential = auth[piProviderId] && typeof auth[piProviderId] === "object" ? auth[piProviderId] : {};
+  return {
+    ...auth,
+    [piProviderId]: {
+      ...credential,
+      type: "api_key",
+      key: apiKey
+    }
+  };
+}
+
+function buildPiSettingsConfig(settings = {}, defaultModel) {
+  return {
+    ...settings,
+    defaultProvider: piProviderId,
+    defaultModel,
+    defaultThinkingLevel: settings.defaultThinkingLevel || "high",
+    enableSkillCommands: settings.enableSkillCommands ?? true
+  };
+}
+
+async function readExistingPiConfiguration(paths, operations = {}) {
+  const readAuth = operations.readAuth ?? ((path) => readJsonFileSafe(path, {}, { sensitive: true }));
+  const readModels = operations.readModels ?? ((path) => readJsoncFileSafe(path, {}, { sensitive: true }));
+  const readSettings = operations.readSettings ?? ((path) => readJsonFileSafe(path, {}));
+  const auth = await readAuth(paths.piAuthPath);
+  const models = await readModels(paths.piModelsPath);
+  const settings = await readSettings(paths.piSettingsPath);
+  return { auth, models, settings };
+}
+
+function buildPiConfiguration({ auth, models, settings }, {
+  apiKey,
+  baseUrl,
+  api,
+  modelIds,
+  insecureTls,
+  defaultModel
+}) {
+  return {
+    apiKey,
+    auth: buildPiAuthConfig(auth, apiKey),
+    models: buildPiModelsConfig(models, { baseUrl, api, modelIds, insecureTls }),
+    settings: buildPiSettingsConfig(settings, defaultModel)
+  };
+}
+
+async function persistPiConfiguration(paths, configuration, operations = {}) {
+  const updateAuth = operations.updateAuth ?? updatePiAuthFile;
+  const writeModels = operations.writeModels ?? ((path, value) => writeText(
+    path,
+    `${JSON.stringify(value, null, 2)}\n`,
+    { sensitive: true }
+  ));
+  const writeSettings = operations.writeSettings ?? ((path, value) => writeJsonFileWithBackup(path, value));
+  await updateAuth(paths.piAuthPath, configuration.apiKey);
+  await writeModels(paths.piModelsPath, configuration.models);
+  await writeSettings(paths.piSettingsPath, configuration.settings);
+}
+
+async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = async () => {}, promptApi, runtime = {}) {
+  const {
+    assertNotCancelled,
+    confirmOrCancel,
+    required,
+    requiredUnlessExisting,
+    resolvePasswordValue,
+    selectOrCancel
+  } = promptApi;
+  assertSupportedPiVersion(await (runtime.getPiVersion ?? detectPiVersion)());
+  const {
+    auth,
+    models: modelsConfig,
+    settings
+  } = await readExistingPiConfiguration(paths);
+  const existing = resolveExistingPiApiConfig(modelsConfig, settings, auth);
+
+  const baseUrlInput = await p.text({
+    message: "Pi gpt Base URL",
+    defaultValue: existing.baseUrl,
+    validate: required()
+  });
+  assertNotCancelled(baseUrlInput);
+  const inferredApi = inferPiApiFromBaseUrl(baseUrlInput);
+  const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
+
+  const insecureTls = await confirmOrCancel({
+    message: "是否仅为 Pi gpt 中转请求跳过 TLS 证书校验？仅证书无法修复时启用",
+    initialValue: hasPiInsecureTlsSetting(modelsConfig)
+  });
+
+  const piApiOptions = getPiApiPromptOptions();
+  const api = inferredApi || await selectOrCancel({
+    message: "Pi gpt API 类型",
+    options: piApiOptions,
+    initialValue: piApiOptions.some((option) => option.value === existing.api) ? existing.api : piDefaultApi
+  });
+
+  const apiKey = await p.password({
+    message: "Pi gpt API Key（输入 - 清除）",
+    mask: "*",
+    defaultValue: existing.apiKey || undefined,
+    validate: requiredUnlessExisting(existing.apiKey, "API Key 不能为空")
+  });
+  assertNotCancelled(apiKey);
+  const finalApiKey = resolvePasswordValue(apiKey, existing.apiKey);
+
+  const modelIdsText = await p.text({
+    message: "Pi gpt 模型 ID（多个用逗号分隔）",
+    defaultValue: (existing.modelIds.length ? existing.modelIds : [existing.defaultModel]).join(","),
+    validate: (value) => parsePiModelIds(value).length ? undefined : "至少需要一个模型 ID"
+  });
+  assertNotCancelled(modelIdsText);
+  const modelIds = parsePiModelIds(modelIdsText);
+
+  const defaultModel = await p.text({
+    message: "Pi 默认模型",
+    defaultValue: modelIds.includes(existing.defaultModel) ? existing.defaultModel : modelIds[0],
+    validate: (value) => modelIds.includes(String(value || "").trim()) ? undefined : "默认模型必须在模型 ID 列表中"
+  });
+  assertNotCancelled(defaultModel);
+
+  const finalDefaultModel = String(defaultModel).trim();
+  const configuration = buildPiConfiguration({ auth, models: modelsConfig, settings }, {
+    apiKey: finalApiKey,
+    baseUrl,
+    api,
+    modelIds,
+    insecureTls,
+    defaultModel: finalDefaultModel
+  });
+  await ensurePiResourcesLinked(paths);
+  await persistPiConfiguration(paths, configuration);
+
+  p.log.step(`已更新 ${pathToLabel(paths.piModelsPath, paths.homeDir)} (${piProviderId}, ${baseUrl})`);
+  p.log.step(`已更新 ${pathToLabel(paths.piSettingsPath, paths.homeDir)} (默认模型: ${finalDefaultModel})`);
+  p.log.step(`已更新 ${pathToLabel(paths.piAuthPath, paths.homeDir)} (${maskSecret(finalApiKey)})`);
+  p.log.step(`已链接 Pi 扩展到 ${pathToLabel(join(paths.piAgentDir, "extensions"), paths.homeDir)}`);
+}
+
+export {
+  assertSupportedPiVersion,
+  buildPiAuthConfig,
+  buildPiConfiguration,
+  buildPiModelsConfig,
+  buildPiSettingsConfig,
+  configurePiApi,
+  getPiApiPromptOptions,
+  hasPiInsecureTlsSetting,
+  inferPiApiFromBaseUrl,
+  normalizeOpenAiBaseUrl,
+  parsePiModelIds,
+  persistPiConfiguration,
+  readExistingPiConfiguration,
+  resolveExistingPiApiConfig,
+  updatePiAuthFile
+};

package/lib/providers/skills.mjs

@@ -0,0 +1,164 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import * as p from "@clack/prompts";
+import { readDotenvFile, updateDotenvFile } from "../config/store.mjs";
+import { pathToLabel } from "../paths.mjs";
+
+const grokDefaults = Object.freeze(JSON.parse(readFileSync(
+  new URL("../../skills/grok-search/defaults.json", import.meta.url),
+  "utf8"
+)));
+
+function readSkillEnvFile(path) {
+  return readDotenvFile(path, { sensitive: true });
+}
+
+async function updateSkillEnvFile(path, updates) {
+  return updateDotenvFile(path, updates, { sensitive: true });
+}
+
+async function configureGrokSearchEnv(paths, ensureWorkflowPresent = async () => {}, promptApi) {
+  const { assertNotCancelled, confirmOrCancel, required, requiredUnlessExisting, resolvePasswordValue } = promptApi;
+  await ensureWorkflowPresent(paths);
+  const envPath = join(paths.agentsDir, "skills", "grok-search", ".env");
+  const existing = await readSkillEnvFile(envPath);
+  const baseUrl = await p.text({
+    message: "Grok API URL",
+    defaultValue: existing.GROK_API_URL || "https://api.x.ai/v1",
+    validate: required()
+  });
+  assertNotCancelled(baseUrl);
+
+  const apiKey = await p.password({
+    message: "Grok API Key（输入 - 清除）",
+    mask: "*",
+    defaultValue: existing.GROK_API_KEY || undefined,
+    validate: requiredUnlessExisting(existing.GROK_API_KEY, "Grok API Key 不能为空")
+  });
+  assertNotCancelled(apiKey);
+  const finalApiKey = resolvePasswordValue(apiKey, existing.GROK_API_KEY);
+
+  const model = await p.text({
+    message: "Grok 默认模型",
+    defaultValue: existing.GROK_MODEL || grokDefaults.model,
+    validate: required()
+  });
+  assertNotCancelled(model);
+
+  const useTavily = await confirmOrCancel({
+    message: "是否同时配置 Tavily 作为额外搜索源？",
+    initialValue: Boolean(existing.TAVILY_API_KEY)
+  });
+
+  const tavilyKey = useTavily
+    ? await p.password({
+        message: "Tavily API Key（输入 - 清除）",
+        mask: "*",
+        defaultValue: existing.TAVILY_API_KEY || undefined,
+        validate: requiredUnlessExisting(existing.TAVILY_API_KEY, "Tavily API Key 不能为空")
+      })
+    : "";
+  if (useTavily) assertNotCancelled(tavilyKey);
+  const finalTavilyKey = useTavily ? resolvePasswordValue(tavilyKey, existing.TAVILY_API_KEY) : null;
+
+  await updateSkillEnvFile(envPath, {
+    GROK_API_URL: baseUrl,
+    GROK_API_KEY: finalApiKey,
+    GROK_MODEL: model,
+    TAVILY_API_KEY: finalTavilyKey,
+    TAVILY_ENABLED: useTavily ? "true" : null
+  });
+
+  p.log.step(`已写入 ${pathToLabel(envPath)}`);
+}
+
+async function configureContext7Env(paths, ensureWorkflowPresent = async () => {}, promptApi) {
+  const { assertNotCancelled, resolvePasswordValue } = promptApi;
+  await ensureWorkflowPresent(paths);
+  const envPath = join(paths.agentsDir, "skills", "context7-auto-research", ".env");
+  const existing = await readSkillEnvFile(envPath);
+  const apiKey = await p.password({
+    message: "Context7 API Key (可选，输入 - 清除)",
+    mask: "*",
+    defaultValue: existing.CONTEXT7_API_KEY || undefined
+  });
+  assertNotCancelled(apiKey);
+  const finalApiKey = resolvePasswordValue(apiKey, existing.CONTEXT7_API_KEY);
+
+  await updateSkillEnvFile(envPath, {
+    CONTEXT7_API_KEY: finalApiKey
+  });
+
+  p.log.step(`已写入 ${pathToLabel(envPath)}`);
+}
+
+function hasPromptEnhancerApiConfig(config) {
+  return [config.PE_API_URL, config.PE_API_KEY, config.PE_MODEL]
+    .every((value) => typeof value === "string" && value.trim() !== "");
+}
+
+function resolvePromptEnhancerMode(existing) {
+  return hasPromptEnhancerApiConfig(existing) ? "openai-compatible" : "agent";
+}
+
+function buildPromptEnhancerEnvUpdates(apiUrl = null, apiKey = null, model = null) {
+  return { PE_API_URL: apiUrl, PE_API_KEY: apiKey, PE_MODEL: model };
+}
+
+async function configurePromptEnhancerEnv(paths, ensureWorkflowPresent = async () => {}, promptApi) {
+  const { assertNotCancelled, required, requiredUnlessExisting, resolvePasswordValue, selectOrCancel } = promptApi;
+  await ensureWorkflowPresent(paths);
+  const envPath = join(paths.agentsDir, "skills", "prompt-enhancer", ".env");
+  const existing = await readSkillEnvFile(envPath);
+  const mode = await selectOrCancel({
+    message: "请选择 prompt-enhancer 的运行方式",
+    options: [
+      { value: "openai-compatible", label: "第三方 OpenAI 兼容接口" },
+      { value: "agent", label: "直接使用当前 Agent" }
+    ],
+    initialValue: resolvePromptEnhancerMode(existing)
+  });
+
+  if (mode === "openai-compatible") {
+    const apiUrl = await p.text({
+      message: "PE_API_URL",
+      defaultValue: existing.PE_API_URL || undefined,
+      validate: required()
+    });
+    assertNotCancelled(apiUrl);
+
+    const apiKey = await p.password({
+      message: "PE_API_KEY（输入 - 清除）",
+      mask: "*",
+      defaultValue: existing.PE_API_KEY || undefined,
+      validate: requiredUnlessExisting(existing.PE_API_KEY, "PE_API_KEY 不能为空")
+    });
+    assertNotCancelled(apiKey);
+    const finalApiKey = resolvePasswordValue(apiKey, existing.PE_API_KEY);
+
+    const model = await p.text({
+      message: "PE_MODEL",
+      defaultValue: existing.PE_MODEL || undefined,
+      validate: required()
+    });
+    assertNotCancelled(model);
+
+    await updateSkillEnvFile(envPath, buildPromptEnhancerEnvUpdates(apiUrl, finalApiKey, model));
+  } else {
+    await updateSkillEnvFile(envPath, buildPromptEnhancerEnvUpdates());
+  }
+
+  p.log.step(`已写入 ${pathToLabel(envPath)}`);
+}
+
+export {
+  buildPromptEnhancerEnvUpdates,
+  configureContext7Env,
+  configureGrokSearchEnv,
+  configurePromptEnhancerEnv,
+  grokDefaults,
+  hasPromptEnhancerApiConfig,
+  readSkillEnvFile,
+  resolvePromptEnhancerMode,
+  updateSkillEnvFile
+};

package/lib/templates/codex/agents/default.toml

@@ -21,6 +21,13 @@ You are the general-purpose fallback sub-agent. Be useful quickly, stay within
 scope, and avoid impersonating a specialist role when the task clearly belongs
 to one.
 
+## Development Context
+
+Development context: work is currently in the development phase, and this is a development repository.
+Do not retain runtime user state in the repository or shipped artifacts, and do not preserve compatibility layers for unreleased behavior.
+Prefer deleting obsolete code paths; keep code and prompts concise and avoid over-engineering.
+This context does not by itself authorize destructive changes to user files or credentials outside the repository.
+
 ## Priorities (in order)
 
 1. Role fit — identify whether the request truly belongs to default

package/lib/templates/codex/agents/explorer.toml

@@ -20,6 +20,13 @@ developer_instructions = """
 Your only job is to map. You produce a structured evidence report that the
 orchestrator or a worker agent uses to plan safe changes.
 
+## Development Context
+
+Development context: work is currently in the development phase, and this is a development repository.
+Do not retain runtime user state in the repository or shipped artifacts, and do not preserve compatibility layers for unreleased behavior.
+Prefer deleting obsolete code paths; keep code and prompts concise and avoid over-engineering.
+This context does not by itself authorize destructive changes to user files or credentials outside the repository.
+
 ## Rules
 
 - Do not edit any file, ever.

package/lib/templates/codex/agents/planner.toml

@@ -25,6 +25,13 @@ safely, not like someone writing a design essay.
 Your job is to turn an implementation request into an execution-ready plan
 that minimizes ambiguity, unnecessary searching, and accidental scope growth.
 
+## Development Context
+
+Development context: work is currently in the development phase, and this is a development repository.
+Do not retain runtime user state in the repository or shipped artifacts, and do not preserve compatibility layers for unreleased behavior.
+Prefer deleting obsolete code paths; keep code and prompts concise and avoid over-engineering.
+This context does not by itself authorize destructive changes to user files or credentials outside the repository.
+
 ## Priorities (in order)
 
 1. Scope clarity — what is actually being changed and what is not

package/lib/templates/codex/agents/reviewer.toml

@@ -20,6 +20,13 @@ developer_instructions = """
 Review code like an owner who will be on-call for what ships.
 Your job is to find real problems, not to demonstrate thoroughness.
 
+## Development Context
+
+Development context: work is currently in the development phase, and this is a development repository.
+Do not retain runtime user state in the repository or shipped artifacts, and do not preserve compatibility layers for unreleased behavior.
+Prefer deleting obsolete code paths; keep code and prompts concise and avoid over-engineering.
+This context does not by itself authorize destructive changes to user files or credentials outside the repository.
+
 
 ## Priorities (in order)
 

package/lib/templates/codex/agents/worker.toml

@@ -18,6 +18,13 @@ developer_instructions = """
 You are a local implementation sub-agent. Execute bounded tasks with
 precision and minimal footprint. You are not alone in the codebase.
 
+## Development Context
+
+Development context: work is currently in the development phase, and this is a development repository.
+Do not retain runtime user state in the repository or shipped artifacts, and do not preserve compatibility layers for unreleased behavior.
+Prefer deleting obsolete code paths; keep code and prompts concise and avoid over-engineering.
+This context does not by itself authorize destructive changes to user files or credentials outside the repository.
+
 ## Boundaries
 
 - Work only within the file set and module boundary authorized by the

package/lib/templates/codex/config-base.toml

@@ -12,10 +12,17 @@ developer_instructions = """
 Act as the default orchestrator for specialized subagents.
 
 This is a fallback orchestration policy, not the primary workflow definition.
-If an active custom command or workflow prompt is present (for example `/oc:*`),
+If an active custom command or workflow prompt is present (for example `/abel-*`),
 its phase rules, guardrails, write scope, tool requirements, and stop/go gates
 take precedence over the default routing below.
 
+## Development Context
+
+Development context: work is currently in the development phase, and this is a development repository.
+Do not retain runtime user state in the repository or shipped artifacts, and do not preserve compatibility layers for unreleased behavior.
+Prefer deleting obsolete code paths; keep code and prompts concise and avoid over-engineering.
+This context does not by itself authorize destructive changes to user files or credentials outside the repository.
+
 ## Global Precedence
 
 - Active workflow or command instructions override default orchestration
@@ -42,8 +49,8 @@ take precedence over the default routing below.
 - During research or discovery phases, do not dispatch implementation workers.
 - During planning phases, do not generate or apply code changes.
 - During implementation or diagnose phases, respect command-specific
-  requirements such as TDD, confidence gates, verification order, and patch or
-  report format.
+  requirements such as TDD, root-cause verification, verification order, and
+  patch or report format.
 - Respect command-specific write boundaries and required tools.
 - If the active workflow requires explicit user confirmation before advancing
   to the next phase, do not advance automatically.
@@ -55,6 +62,7 @@ take precedence over the default routing below.
 - Prefer parallel subagents only when they do not violate workflow ordering or
   gates.
 - Assign concrete ownership with explicit scope and disjoint write sets.
+- Copy this development context into every subagent task.
 - Do not duplicate work across agents. Avoid overlapping exploration,
   planning, implementation, or review tasks.
 - Do not hand off blocked or underspecified work without enough context for

package/{AGENTS.md → lib/templates/workflow/AGENTS.md}

@@ -11,6 +11,13 @@
 - Minimal comments/docs (only when necessary)
 - Targeted changes only; never touch unrelated functionality
 
+## Development Context
+
+Development context: work is currently in the development phase, and this is a development repository.
+Do not retain runtime user state in the repository or shipped artifacts, and do not preserve compatibility layers for unreleased behavior.
+Prefer deleting obsolete code paths; keep code and prompts concise and avoid over-engineering.
+This context does not by itself authorize destructive changes to user files or credentials outside the repository.
+
 ## Context Rules
 
 - {{CODEBASE_RETRIEVAL_POLICY}}
@@ -27,17 +34,15 @@
 ## Universal Constraints
 
 1. Use `unified diff patch` format for proposed/applied changes
-2. Require confidence ≥90% before applying changes
+2. Before applying changes, state assumptions and unknowns explicitly; stop and ask the user on any critical unknown
 
 ## Stage Skill Matrix
 
 | Skill | Research | Plan | Implement | Diagnose | Capability & Triggers |
 | --- | :---: | :---: | :---: | :---: | --- |
-| /sequential-think | ✅ | ✅ | ❌ | ✅ | Multi-step reasoning, hypothesis testing. Trigger: 3+ interconnected components |
 | /grok-search | ✅ | ○ | ❌ | ✅ | Deep research, concept understanding. Trigger: architectural patterns, best practices |
 | /context7-auto-research | ✅ | ✅ | ✅ | ✅ | Official docs retrieval. Trigger: framework/library usage, APIs |
 | /dev-browser | ○ | ○ | ✅ | ✅ | Browser automation. Trigger: E2E testing, UI verification |
-| /confidence-check | ❌ | ✅ | ✅ | ✅ | Readiness verification. Trigger: before implementation/fix (≥90%) |
 | /time | ○ | ✅ | ✅ | ○ | Time/timezone operations. Trigger: scheduling logic |
 
 Legend: ✅ Primary, ○ Optional, ❌ Forbidden