cc-viewer 1.8.13 → 1.8.15

package/server/lib/task-state.js

@@ -34,6 +34,14 @@ function _touch(task) {
 export function applyTaskEvent(payload) {
   if (!payload || typeof payload !== 'object') return;
   const { hookEventName } = payload;
+  // New-prompt reset. MUST stay above the taskId guard (this event has no
+  // task_id) and MUST NOT move _sessionId — a foreign/malformed prompt event
+  // must not change the shouldResetTasks comparison base. resetTasks() nulls
+  // the tag anyway, so the next TaskCreated re-tags the session.
+  if (hookEventName === 'UserPromptSubmit') {
+    if (shouldResetTasksOnPrompt(payload, _sessionId)) resetTasks();
+    return;
+  }
   const taskId = payload.taskId != null ? String(payload.taskId) : null;
   // Validate BEFORE touching the session tag: a malformed/unknown event must
   // not move the shouldResetTasks comparison base.
@@ -139,6 +147,30 @@ export function shouldResetTasks(payload, currentSessionId) {
   return false;
 }
 
+/**
+ * New-prompt reset gate (pure, unit-tested). Claude Code fires
+ * UserPromptSubmit on every user prompt (queued-message drains included) with
+ * NO task_id; the previous turn's checklist is stale by definition, so the
+ * shared list resets and the model's next TaskUpdate rebuilds whatever it is
+ * still working on (stub semantics).
+ * Conservative guards: a teammate/subagent process inherits CCVIEWER_PORT and
+ * POSTs to the same /api/task-event, so only a prompt bearing the session we
+ * are already tracking may wipe the shared list. (agent_id is NOT reliably
+ * present on this event — the session check is the load-bearing one.)
+ * Known trade-off: while the tag is null (no main-agent task event seen yet,
+ * e.g. right after a reset — teammate TaskCreated carries agentId and does not
+ * re-tag), ANY prompt passes the gate. A teammate prompt in that window still
+ * clears the list; it self-heals on the next TaskUpdate. See task-state.test.js
+ * ("null-tag window") which locks this behavior deliberately.
+ */
+export function shouldResetTasksOnPrompt(payload, currentSessionId) {
+  const { agentId, sessionId } = payload || {};
+  if (agentId) return false;
+  if (!sessionId) return false;
+  if (currentSessionId && sessionId !== currentSessionId) return false;
+  return true;
+}
+
 /** Full-snapshot view for SSE broadcast; insertion order preserved. */
 export function getTaskSnapshot() {
   return { sessionId: _sessionId, tasks: [..._tasks.values()] };

package/server/lib/v2/identity.js

@@ -13,30 +13,9 @@
 // prefix (server/lib/interceptor-core.js TEAMMATE_PROMPT_PREFIX_LEN).
 export const SPAWN_PROMPT_PREFIX_LEN = 60;
 
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
-/**
- * Parse a raw metadata.user_id string into { sessionId, encoding } or null.
- * Encodings (spec §8):
- *  - 'json':      '{"device_id":…,"account_uuid":…,"session_id":"<uuid>"}'
- *  - 'delimited': 'user_<hash>_account_<acct?>_session_<uuid>'
- */
-export function parseUserId(userIdRaw) {
-  if (typeof userIdRaw !== 'string' || userIdRaw === '') return null;
-  try {
-    const obj = JSON.parse(userIdRaw);
-    if (obj && typeof obj.session_id === 'string' && obj.session_id !== '') {
-      return { sessionId: obj.session_id, encoding: 'json' };
-    }
-    return null; // valid JSON but no session_id — treat as unparseable
-  } catch { /* not JSON → try the delimited form */ }
-  const idx = userIdRaw.lastIndexOf('_session_');
-  if (idx >= 0) {
-    const tail = userIdRaw.slice(idx + '_session_'.length);
-    if (UUID_RE.test(tail)) return { sessionId: tail, encoding: 'delimited' };
-  }
-  return null;
-}
+// parseUserId lives in the shared leaf session-id.js (so lib/proxy can use it
+// without an R3 cross-subsystem edge); re-exported here for existing consumers.
+export { parseUserId } from '../session-id.js';
 
 const REMINDER_OPEN = '<system-reminder>';
 const REMINDER_CLOSE = '</system-reminder>';

package/server/lib/v2/session-select.js

@@ -142,8 +142,10 @@ export function sessionHasMainTurn(dir) {
  * COMPLETED_TURN_SCAN_BUDGET — wide enough that a heavy multi-agent first turn
  * whose done lands megabytes past the head is still found. Stronger than
  * `sessionHasMainTurn`: a session with only an in-flight first main request (req
- * written, response still streaming) returns false, so cold-load keeps showing
- * the previous conversation until the current one has renderable content.
+ * written, response still streaming) returns false. This no longer decides the
+ * cold-load source on its own — getLiveLogSource ORs `sessionHasMainTurn` onto
+ * it to also accept an in-flight first main req on the v3 wire, whose conv
+ * prefix is renderable at request initiation (2026-09-13 refresh-blank fix).
  * @param {string} dir - absolute session dir
  * @returns {boolean}
  */
@@ -243,11 +245,12 @@ export function isDiscardableSession(dir, meta) {
  * the identity UUID (meta.sessionId) alongside the dir so a `-c` continuation
  * can adopt this session's folder while preserving its identity.
  *
- * `excludeDir` skips one absolute session dir entirely: getLiveLogSource passes
- * its current in-flight session here, because this picker's weaker
- * has-a-main-req gate would otherwise re-select exactly the dir the caller's
- * completed-turn gate just rejected (it IS the newest once its first main req
- * is written), nullifying the fallback.
+ * `excludeDir` skips one absolute session dir entirely. getLiveLogSource passes
+ * its current dir: the caller's activated gate and this picker now share the
+ * same has-a-main-req predicate, so exclusion is no longer selection logic —
+ * it closes the TOCTOU race where a main req line lands between the caller's
+ * gate check and this picker's scan (the dir would otherwise be re-selected
+ * as the newest, nullifying the fallback).
  *
  * `skipForeignLive` (multi-window isolation, 2026-07-17) drops candidates
  * whose `owner.lock` is held by ANOTHER live process — a parallel ccv window's
@@ -294,7 +297,7 @@ export function latestMainSession(projectDir, { excludeDir = '', skipForeignLive
  * Absolute dir of the newest readable, non-teammate session that HAS a main
  * turn, or '' if there is none. Thin wrapper over {@link latestMainSession}.
  * @param {string} projectDir - absolute LOG_DIR/<project>
- * @param {{excludeDir?: string}} [opts] - see {@link latestMainSession}
+ * @param {{excludeDir?: string, skipForeignLive?: boolean}} [opts] - see {@link latestMainSession}
  * @returns {string} absolute session dir, or ''
  */
 export function latestMainSessionDir(projectDir, opts) {

package/server/lib/v2/v2-writer.js

@@ -437,17 +437,25 @@ export class V2Writer {
       // count_tokens/heartbeat probes wear main-agent shapes but aren't the user's
       // turn (same gate as the resume-switch above); adopted (-c) sessions skip —
       // their pendings are resumeExpected, reserved for the SessionStart-hook bind.
-      // First-main-only via the per-session flag: probes may create the session state
-      // before the real turn arrives. The live-sessions-dir gate keeps the offline
-      // converter (staging dirs) from consuming LIVE pendings. Fully caught: a lost
-      // bind degrades to the no-record resume path, never to a dropped log entry.
+      // The latch only locks on a SUCCESSFUL consume: a session's first main-shaped
+      // request can be a small-model side call (title/compression) whose system text
+      // the live layer already rewrote to that model's persona (interceptor.js:1124-
+      // 1151 rewrites requestEntry.body BEFORE this ingest) — it matches no pending,
+      // and latching there would permanently deny the real main-model turns that
+      // follow (observed: a session whose 8 later PRO-persona requests never rebound,
+      // leaving every later `-c` on the F2 no-record path). Unmatched requests retry;
+      // a genuinely injection-less session still consumes its EMPTY pending on some
+      // later request (the fallback just records "no injection", so deferring it is
+      // harmless). The live-sessions-dir gate keeps the offline converter (staging
+      // dirs) from consuming LIVE pendings. Fully caught: a lost bind degrades to
+      // the no-record resume path, never to a dropped log entry.
       if (!adoptTarget && entry.mainAgent && !entry.isCountTokens && !entry.isHeartbeat
         && this._sessionsDirName === 'sessions'
         && s && !s.sysPromptBindDone) {
-        s.sysPromptBindDone = true;
         try {
           const pend = consumePendingForWireByKey(project, systemTextOfBody(entry.body), this._logDir);
           if (pend) {
+            s.sysPromptBindDone = true;
             writeSnapshotByKey(project, sid, { entries: pend.entries, model: pend.model, boundVia: 'wire' }, { logDir: this._logDir });
           }
         } catch (err) { reportSwallowed('v2-write.sys-prompt-bind', err); }

package/server/proxy.js

@@ -9,6 +9,8 @@ import { extractApiErrorMessage, formatProxyRequestError } from './lib/proxy/pro
 import { getProxyDispatcher } from './lib/proxy/proxy-env.js';
 import { getClaudeConfigDir } from '../findcc.js';
 import { isAnthropicApiPath, classifyProxyRole } from './lib/interceptor-core.js';
+import { parseAgentId, findHeader } from './lib/v2/agent-id.js';
+import { liveSystemPromptEnabled } from './lib/system-prompt-live.js';
 import { executeRequest, extractModel } from './lib/proxy/proxy-retry.js';
 import { buildRecord, appendRecord, dailyFilePath, todayStr, emitProxyStatsUpdate } from './lib/proxy/proxy-stats.js';
 import { reportSwallowed } from '@ccv/core/error-report';
@@ -134,13 +136,29 @@ export function startProxy() {
         const _reqPath = (() => { try { return new URL(req.url || '/', 'http://x').pathname; } catch { return req.url || ''; } })();
         const _isUtility = /\/messages\/count_tokens$/.test(_reqPath) || /^\/api\/eval\/sdk-/.test(_reqPath);
         let roleProfile;
-        if (body.length > 0 && isAnthropicApiPath(_reqPath) && !_isUtility && interceptor.hasExplicitRoleAssignments()) {
+        let _role; // live system 改写的 role 门（仅 main 生效）；未分类 → undefined → main 语义
+        const _needClassify = body.length > 0 && isAnthropicApiPath(_reqPath) && !_isUtility;
+        // 角色分类在两种情况下都必须做：显式角色分配（选路）或 live system 已启用
+        // （否则默认配置下 subagent/teammate 会以 role=undefined 穿过 proxy 侧门被注入主 system）。
+        if (_needClassify && (interceptor.hasExplicitRoleAssignments() || liveSystemPromptEnabled())) {
           let parsedBody = null;
           try { parsedBody = JSON.parse(body.toString('utf8')); } catch { /* 非 JSON body → 保持 main 语义 */ }
           if (parsedBody && typeof parsedBody === 'object') {
             try {
-              const role = classifyProxyRole(parsedBody, {});
-              roleProfile = interceptor.getEffectiveRoleProfile(role);
+              // Header 硬判据优先（与 interceptor fetch hook 同构，review P0）：
+              // x-claude-code-agent-id 是 SDK 命名队友（name@…）/ 匿名子代理（hex）
+              // 的判别信号，不依赖 system 文本 —— body 正则对「SDK 身份行 + 无
+              // billing 标记」的形态失效，会把 header-only 子代理误判 'main' 而注入
+              // 主 persona。named→teammate、anon→subagent，覆盖 body 分类。
+              // Header hard-signal first (mirrors the interceptor fetch hook): the
+              // agent-id header marks sub-agent streams without relying on body markers.
+              const _agent = parseAgentId(findHeader(req.headers, 'x-claude-code-agent-id'));
+              _role = _agent
+                ? (_agent.named ? 'teammate' : 'subagent')
+                : classifyProxyRole(parsedBody, {});
+              if (interceptor.hasExplicitRoleAssignments()) {
+                roleProfile = interceptor.getEffectiveRoleProfile(_role);
+              }
             } catch (err) { reportSwallowed('proxy.role-classify', err); }
           }
         }
@@ -166,7 +184,7 @@ export function startProxy() {
         // 模型替换由重试引擎用 resolveProfileModel 纯函数完成（interceptor 对 trace 请求会再跑一次，幂等 no-op）。
         // 非大模型 API 请求走原逻辑（同样用 x-cc-viewer-trace 让 interceptor 记录，但不经重试引擎）。
         if (isAnthropicApiPath(fullUrl)) {
-          await handleLlmApiRequest(req, res, fullUrl, fetchOptions, body, proxyDispatcher, roleProfile);
+          await handleLlmApiRequest(req, res, fullUrl, fetchOptions, body, proxyDispatcher, roleProfile, { role: _role, isUtility: _isUtility });
           return;
         }
 
@@ -256,7 +274,7 @@ export function startProxy() {
 // 每请求取最新值，UI 改 retry-config.json 后下一个请求即生效，无需重启。
 const _retryConfigGetter = () => interceptor._retryConfigState;
 
-async function handleLlmApiRequest(req, res, fullUrl, fetchOptions, body, proxyDispatcher, roleProfile) {
+async function handleLlmApiRequest(req, res, fullUrl, fetchOptions, body, proxyDispatcher, roleProfile, liveCtx = {}) {
   const statsEnabled = process.env.CCV_PROXY_STATS !== 'off';
   const retryConfig = _retryConfigGetter(); // live binding：每请求取最新重试配置
   // 角色解析后的有效 profile（上游/模型替换/统计归属）。undefined = 未分类 → 沿用 main 活跃 profile。
@@ -299,7 +317,15 @@ async function handleLlmApiRequest(req, res, fullUrl, fetchOptions, body, proxyD
     url: fullUrl,
     fetchOptions: retryFetchOptions,
     retryConfig,
-    ctx: { dispatcher: proxyDispatcher, profile, signal: clientAbort.signal },
+    ctx: {
+      dispatcher: proxyDispatcher,
+      profile,
+      signal: clientAbort.signal,
+      // live system 改写上下文（system-prompt-live.js）：role 门 + 项目键。
+      role: liveCtx.role,
+      isUtility: liveCtx.isUtility === true,
+      projectKey: interceptor._projectName || '',
+    },
   });
 
   const { response, attempts, retryCodes, durationMs, finalStatus, succeeded, upstreamStatus } = result;

package/server/routes/events.js

@@ -6,7 +6,7 @@ import { LOG_DIR } from '../../findcc.js';
 import { streamRawEntriesAsync } from '../lib/log-stream.js';
 import { migrationStatus } from '../lib/v2/migrate-prompt.js';
 import { reportSwallowed } from '@ccv/core/error-report';
-import { sseHead, sseWrite, needsDrain, wireEnd, awaitWireDrain } from '../lib/wire-compress.js';
+import { sseHead, sseWrite, needsDrain, wireEnd, awaitWireDrain, isWireV3Enabled } from '../lib/wire-compress.js';
 import { readV2ColdBundle } from '../lib/v2/meta-rows.js';
 import { readV2SingleEntry } from '../lib/v2/adapter.js';
 import { enrichRawIfNeeded } from '../lib/enrich-plan-input.js';
@@ -248,7 +248,11 @@ async function events(req, res, parsedUrl, isLocal, deps) {
 
   // S6b: the cold-load source is the current v2 session dir when the v2
   // writer is active (adapter stream), else the v1 file.
-  const coldLoadResult = v3Cold ? null : await streamRawEntriesAsync(getLiveLogSource(), async (raw) => {
+  // serveInFlight follows the wire: the legacy entry stream ships the
+  // in-flight placeholder, which the client batch gate still blocks — the
+  // previous conversation is the better cold load there (interceptor.js
+  // getLiveLogSource header comment).
+  const coldLoadResult = v3Cold ? null : await streamRawEntriesAsync(getLiveLogSource({ serveInFlight: !!deps.wireV3 }), async (raw) => {
     // 直接发送原始 JSON 字符串，不做 parse/reconstruct/stringify
     // ExitPlanMode V2 空 input 的条目按需补全 plan / planFilePath，其它原样透传
     if (res.destroyed || !res.writable) return;
@@ -438,7 +442,9 @@ async function requests(req, res) {
   try {
     sseWrite(res, '[');
     let first = true;
-    await streamRawEntriesAsync(getLiveLogSource(), (raw) => {
+    // No deps bag on this route — read the wire flag from the same env source
+    // server.js uses (isWireV3Enabled), keeping serveInFlight wire-consistent.
+    await streamRawEntriesAsync(getLiveLogSource({ serveInFlight: isWireV3Enabled(process.env.CCV_WIRE_V3) }), (raw) => {
       if (!first) sseWrite(res, ',');
       sseWrite(res, enrichRawIfNeeded(raw));
       first = false;

package/server/routes/preferences.js

@@ -11,6 +11,7 @@ import { reportSwallowed } from '@ccv/core/error-report';
 import { setLang } from '../i18n.js';
 import { reconcileVoicePackPrefs as vpReconcile } from '../lib/voice-pack-manager.js';
 import { readClaudeProjectModel } from '../lib/context-watcher.js';
+import { inspectShellHook } from '../lib/shell-hook-inspect.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
 import { listPlatforms } from '../lib/im/im-config.js';
 import { mutatePrefs, applyPrefsPatch, readPrefsRaw } from '../lib/prefs-store.js';
@@ -274,7 +275,11 @@ function claudeSettingsGet(req, res, parsedUrl, isLocal, deps) {
   // 错显 200K，详见 src/utils/helpers.js resolveCalibrationTokens）。
   const projectCwd = process.env.CCV_PROJECT_DIR || process.cwd();
   const claudeSettings = deps.claudeSettings;
-  res.end(JSON.stringify({ env, model: claudeSettings.model || null, showThinkingSummaries: claudeSettings.showThinkingSummaries || false, claudeAvailable: process.env.CCV_CLAUDE_MISSING !== '1', claudeProjectModel: readClaudeProjectModel(projectCwd) }));
+  // L1: shell hook 状态(只读;不传模板构造器 → stale 恒 false,stale 精确判定由 cli.js
+  // 侧 refreshShellHookState 负责,这里回答「装没装」足够面板提示用)。失败退化 null。
+  let shellHook = null;
+  try { shellHook = inspectShellHook(null); } catch (err) { reportSwallowed('prefs.shellHook', err); }
+  res.end(JSON.stringify({ env, model: claudeSettings.model || null, showThinkingSummaries: claudeSettings.showThinkingSummaries || false, claudeAvailable: process.env.CCV_CLAUDE_MISSING !== '1', claudeProjectModel: readClaudeProjectModel(projectCwd), shellHook }));
 }
 
 function claudeSettingsPost(req, res, parsedUrl, isLocal, deps) {

package/server/routes/workspaces.js

@@ -99,8 +99,9 @@ function workspacesLaunch(req, res, parsedUrl, isLocal, deps) {
       // 流式分段广播以刷新会话区域，避免全量加载 OOM
       // S6b: the live source is the v2 session dir when the v2 writer is
       // active (a fresh workspace has no session yet → empty stream, the live
-      // feed picks up from the first request).
-      const wsReloadSource = getLiveLogSource();
+      // feed picks up from the first request). Legacy-shaped reload frames —
+      // serveInFlight follows the wire flag, same as /events.
+      const wsReloadSource = getLiveLogSource({ serveInFlight: !!deps.wireV3 });
       const wsReloadTotal = await countLogEntries(wsReloadSource);
       deps.clients.forEach(client => {
         try { sseWrite(client, `event: load_start\ndata: ${JSON.stringify({ total: wsReloadTotal, incremental: false })}\n\n`); } catch {}

package/server/server.js

@@ -66,18 +66,32 @@ function execWithStdin(cmd, args, input, options) {
     const child = spawn(cmd, args, { ...options, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
     let stdout = '';
     let stderr = '';
+    let settled = false;
+    const settle = (fn, val) => { if (!settled) { settled = true; fn(val); } };
     child.stdout.on('data', d => { stdout += d; });
     child.stderr.on('data', d => { stderr += d; });
-    child.on('error', reject);
+    child.on('error', (err) => settle(reject, err));
     child.on('close', code => {
       // git check-ignore exits 1 when no files are ignored — treat as success
-      resolve(stdout);
+      settle(resolve, stdout);
     });
+    // A child that exits before consuming its stdin (git check-ignore outside a
+    // repo, a killed-on-timeout child, a missing binary) closes the read end of
+    // the stdin pipe; a subsequent write then throws `write EPIPE`. Without an
+    // 'error' listener on child.stdin that EPIPE escapes as an uncaughtException
+    // (the recurring server.test.js teardown flake) — swallow it into the
+    // promise's settle path instead.
+    child.stdin.on('error', () => settle(resolve, stdout));
     if (options?.timeout) {
-      setTimeout(() => { try { child.kill(); } catch {} reject(new Error('timeout')); }, options.timeout);
+      setTimeout(() => { try { child.kill(); } catch {} settle(reject, new Error('timeout')); }, options.timeout);
+    }
+    try {
+      child.stdin.write(input);
+      child.stdin.end();
+    } catch {
+      // Synchronous EPIPE/ERR_STREAM_DESTROYED when the child already exited.
+      settle(resolve, stdout);
     }
-    child.stdin.write(input);
-    child.stdin.end();
   });
 }
 import { _initPromise, _projectName, _logDir, _v2Writer, streamingState, resetStreamingState, PROFILE_PATH, RETRY_CONFIG_PATH, _retryConfigState, setLivePort, getImLiveText, resetImLiveText, markSessionStart } from './interceptor.js';
@@ -602,6 +616,8 @@ const deps = {
   onSessionStartNotify: markSessionStart,
   // Task checklist (task-bridge.js → /api/task-event): apply to the shared
   // in-memory reducer, then debounce-broadcast a full snapshot over SSE.
+  // UserPromptSubmit events reset the list inside the reducer, so the same
+  // path broadcasts the empty snapshot — no separate reset route/hook.
   onTaskEvent: (payload) => {
     try {
       applyTaskEvent(payload);
@@ -1237,6 +1253,20 @@ export async function startViewer() {
             try { await imCore.stopAll(); } catch { /* no in-process instances */ }
             imProcMgr.reconcileImProcesses().catch((e) => console.error('[CC Viewer] IM reconcile failed:', e?.message || e));
           }
+          // L2: 裸续接检测(transcript 在写但请求未经 ccv → 提示注入丢失)。仅 CLI 模式
+          // (面板场景);检测失败只退化为不提示,绝不影响启动。
+          if (isCliMode) {
+            try {
+              const { startResumeWatchdog } = await import('./lib/resume-watchdog.js');
+              startResumeWatchdog({
+                cwd: process.env.CCV_PROJECT_DIR || process.cwd(),
+                onHit: (hit) => {
+                  try { sendEventToClients(clients, 'resume_bypassed', { uuid: hit.uuid, ts: Date.now() }); }
+                  catch (e) { reportSwallowed('resume-watchdog.notify', e); }
+                },
+              });
+            } catch (e) { reportSwallowed('resume-watchdog.start', e); }
+          }
           resolve(server);
           } catch (err) {
             console.error('[CC Viewer] server start callback error:', err?.message || err);

package/server/system-prompt-templates/presets/GLM-5.2.md

@@ -20,6 +20,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
  - When an approach fails, diagnose the error before trying something else; don't repeat the same failing action.
  - Avoid security vulnerabilities (injection, XSS, path traversal, and the OWASP top 10); fix any insecure code you write.
  - Validate changes by running the relevant tests or code path before reporting completion.
+ - Write code that reads like the surrounding code: match its comment density, naming, and idiom.
 
 # Using tools
  - Prefer the dedicated tool for reading files, editing files, searching contents, and running commands over ad-hoc shell commands.
@@ -34,6 +35,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
 
 # Executing actions with care
 Weigh reversibility and blast radius. Local, reversible actions like editing files or running tests are fine. Confirm with the user before hard-to-reverse or shared-system actions: deleting files or branches, force-pushing, resetting, sending messages, or posting to external services. Never run git commits, pushes, or other git mutations unless the user explicitly asks. Investigate unexpected state before overwriting it.
+Report outcomes faithfully: if tests fail, say so with the output; if a step was skipped, say that; when something is done and verified, state it plainly without hedging.
 
 # Tone and style
  - Keep output brief and direct; lead with the answer or action. No filler, and no emojis unless the user asks.

package/server/system-prompt-templates/presets/GLM-5.3.md

@@ -22,6 +22,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
  - When an approach fails, diagnose the error before trying something else; don't repeat the same failing action.
  - Avoid security vulnerabilities (injection, XSS, path traversal, and the OWASP top 10); fix any insecure code you write.
  - Validate changes by running the relevant tests or code path before reporting completion.
+ - Write code that reads like the surrounding code: match its comment density, naming, and idiom.
 
 # Using tools
  - Prefer the dedicated tool for reading files, editing files, searching contents, and running commands over ad-hoc shell commands.
@@ -36,6 +37,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
 
 # Executing actions with care
 Weigh reversibility and blast radius. Local, reversible actions like editing files or running tests are fine. Confirm with the user before hard-to-reverse or shared-system actions: deleting files or branches, force-pushing, resetting, sending messages, or posting to external services. Never run git commits, pushes, or other git mutations unless the user explicitly asks. Investigate unexpected state before overwriting it.
+Report outcomes faithfully: if tests fail, say so with the output; if a step was skipped, say that; when something is done and verified, state it plainly without hedging.
 
 # Tone and style
  - Keep output brief and direct; lead with the answer or action. No filler, and no emojis unless the user asks.

package/server/system-prompt-templates/presets/{Qwen-3.7-Max.md → Qwen-3.md}

@@ -1,5 +1,5 @@
 <!--
-Preset: Qwen-3.7-Max  (category: Global)
+Preset: Qwen-3  (category: Global)
 Self-contained template: a tuned preamble plus its own dynamic sections
 (a boundary marker, an OS-only # Environment, and a verbatim # Memory; no Git).
 Edit this file directly.
@@ -20,6 +20,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
  - Do not give up too early: when blocked, try alternative approaches before asking the user for help.
  - Guard against security vulnerabilities (injection, XSS, SSRF, path traversal, and the rest of the OWASP top 10); fix insecure code immediately.
  - Confirm changes work by running the relevant tests, type checks, or the affected path before declaring completion.
+ - Write code that reads like the surrounding code: match its comment density, naming, and idiom.
 
 # Using tools
  - Use the dedicated tool for each operation — reading, editing, searching, running commands — instead of improvised shell commands, so your work stays reviewable.
@@ -34,6 +35,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
 
 # Executing actions with care
 Consider each action's reversibility and blast radius. Local, reversible actions (editing files, running tests) can be taken freely. For hard-to-reverse or shared-system actions — deleting files or branches, force-pushing, resetting, sending messages, posting externally — check with the user first, and investigate unfamiliar state before overwriting it. Never run git mutations (commit, push, reset, rebase) unless the user explicitly asks.
+Report outcomes faithfully: if tests fail, say so with the output; if a step was skipped, say that; when something is done and verified, state it plainly without hedging.
 
 # Tone and style
  - Keep text output brief and direct; lead with the answer or action and skip filler. No emojis unless the user requests them.

package/server/system-prompt-templates/presets/deepseek-v4-flash.md

@@ -19,10 +19,12 @@ IMPORTANT: Do not guess URLs; use ones the user provides or ones found in local
  - If something fails, read the error and fix the real cause instead of retrying blindly.
  - Don't write insecure code (injection, XSS, path traversal, etc.); fix it if you do.
  - Confirm before irreversible or shared-system actions (deleting, force-push, sending, posting); never commit unless explicitly asked. Local edits and tests are fine to run freely.
+ - Report outcomes faithfully: if tests fail, say so with the output; if a step was skipped, say that; when something is done and verified, state it plainly.
 
 # Tools
  - Use the dedicated tool for reading, editing, searching, and running commands rather than ad-hoc shell.
  - Batch independent tool calls together.
+ - Tool results and user messages may include <system-reminder> tags. They carry information from the system, not from the user.
 
 # Working with teammates
  - Teammates sometimes finish without reporting back — never wait passively.

package/server/system-prompt-templates/presets/deepseek-v4-pro.md

@@ -21,6 +21,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
  - Be careful not to introduce security vulnerabilities (injection, XSS, SSRF, path traversal, and the rest of the OWASP top 10). If you notice insecure code you wrote, fix it immediately.
  - Verify your work: run the project's tests, type checks, or the affected code path before claiming a change is complete.
  - Persist until the task is handled end to end: do not stop at analysis or a partial fix; carry the change through implementation and verification before reporting back.
+ - Write code that reads like the surrounding code: match its comment density, naming, and idiom.
 
 # Using tools
  - Prefer the dedicated tool for each job (reading files, editing files, searching contents, running commands) over ad-hoc shell equivalents, so the user can follow your work.
@@ -35,6 +36,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
 
 # Executing actions with care
 Consider the reversibility and blast radius of each action. Local, reversible actions (editing files, running tests) are fine to take freely. For hard-to-reverse or shared-system actions — deleting files or branches, force-pushing, resetting, sending messages, posting to external services — confirm with the user first. Never commit or push unless the user explicitly asks. Never revert or overwrite changes you did not make — the worktree may contain the user's concurrent edits. Investigate unexpected files, branches, or configuration before overwriting them.
+Report outcomes faithfully: if tests fail, say so with the output; if a step was skipped, say that; when something is done and verified, state it plainly without hedging.
 
 # Tone and style
  - Keep text output brief and direct. Lead with the answer or action, not the reasoning. Skip filler and preamble.

package/server/system-prompt-templates/presets/index.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Hand-editable manifest of built-in system-prompt presets. Each preset file (presets/<id>.md) is a self-contained template (its own boundary + OS-only Environment + verbatim Memory; no Git). `match` is a case-insensitive model-id substring used to auto-select a preset when adding a model in the Edit System Prompt modal. `defaultMode` seeds the tab's override/append toggle.",
+  "$comment": "Hand-editable manifest of built-in system-prompt presets. Each preset file (presets/<id>.md) is a self-contained template (its own boundary + OS-only Environment + verbatim Memory; no Git). `match` is a case-insensitive model-id substring with THREE effects: (1) auto-select a preset when adding a model in the Edit System Prompt modal, (2) pick the built-in prompt injected at spawn when the resolved model matches (see builtin-model-prompts.js), and (3) the preset's tombstone identity — the normalized-uppercase match is the key recorded in .builtin-disabled.json, so renaming `match` silently voids existing disables unless a TOMBSTONE_RENAMES mapping is added. `defaultMode` seeds the tab's override/append toggle.",
   "categories": {
     "Global": [
       {
@@ -30,16 +30,16 @@
         "id": "GLM-5.3",
         "title": "GLM-5.3",
         "file": "GLM-5.3.md",
-        "description": "Forked from the GLM-5.2 preset for GLM-5.3: action-default, changes through tools, parallel tool calls, no-wait teammate rules.",
+        "description": "Forked from the GLM-5.2 preset for GLM-5.3: action-default, changes through tools, parallel tool calls.",
         "match": "glm-5.3",
         "defaultMode": "override"
       },
       {
-        "id": "Qwen-3.7-Max",
-        "title": "Qwen 3.7 Max",
-        "file": "Qwen-3.7-Max.md",
-        "description": "Thorough coding agent prompt tuned for Qwen 3.7 Max: minimal-change discipline and persistence.",
-        "match": "qwen-3.7-max",
+        "id": "Qwen-3",
+        "title": "Qwen 3",
+        "file": "Qwen-3.md",
+        "description": "Thorough coding agent prompt for the Qwen 3 family (3.5/3.7/3.8 Max and siblings): minimal-change discipline and persistence.",
+        "match": "qwen-3",
         "defaultMode": "override"
       },
       {

package/server/system-prompt-templates/presets/kimi-k2.7-code.md

@@ -23,10 +23,12 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
  - Do not introduce security vulnerabilities (injection, XSS, path traversal, and the rest of the OWASP top 10); fix insecure code you write immediately.
  - Iterate to green: run the relevant tests or code path, read the failure, fix the cause, and run again.
  - When an approach is blocked, try a different one before handing the problem back to the user.
+ - Write code that reads like the surrounding code: match its comment density, naming, and idiom.
 
 # Using tools
  - A change shown only in your reply does not exist on disk — create and edit files with tools, never by pasting code into the conversation.
  - Do not narrate tool calls; the calls themselves show the user what you are doing.
+ - Prefer the dedicated tool for reading, editing, searching, and running commands over ad-hoc shell equivalents.
  - Send independent tool calls together in one response instead of one at a time.
  - Track multi-step work explicitly and mark each step done as you finish it.
  - Every ten tool calls, write one line saying what you have confirmed and what is still missing; if you cannot, stop calling tools and report what you have.
@@ -39,6 +41,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
 
 # Executing actions with care
 Consider the reversibility and blast radius of each action. Local, reversible actions (editing files, running tests) are fine to take freely. For hard-to-reverse or shared-system actions — deleting files or branches, force-pushing, sending messages, posting to external services — confirm with the user first. Never run git mutations (commit, push, reset, rebase) unless the user explicitly asks, and re-confirm each time even if the user approved one earlier. Investigate unexpected state before overwriting it.
+Report outcomes faithfully: if tests fail, say so with the output; if a step was skipped, say that; when something is done and verified, state it plainly without hedging.
 
 # Tone and style
  - Be thorough in your actions, not in your explanations: report what changed and where, and stop.

package/server/system-prompt-templates/presets/kimi-k3.md

@@ -23,6 +23,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
  - Do not introduce security vulnerabilities (injection, XSS, path traversal, and the rest of the OWASP top 10); fix insecure code you write immediately.
  - Iterate to green: run the relevant tests or code path, read the failure, fix the cause, and run again.
  - When an approach is blocked, try a different one before handing the problem back to the user.
+ - Write code that reads like the surrounding code: match its comment density, naming, and idiom.
 
 # Using tools
  - A change shown only in your reply does not exist on disk — create and edit files with tools, never by pasting code into the conversation.
@@ -39,6 +40,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
 
 # Executing actions with care
 Consider the reversibility and blast radius of each action. Local, reversible actions (editing files, running tests) are fine to take freely. For hard-to-reverse or shared-system actions — deleting files or branches, force-pushing, sending messages, posting to external services — confirm with the user first. Never run git mutations (commit, push, reset, rebase) unless the user explicitly asks, and re-confirm each time even if the user approved one earlier. Investigate unexpected state before overwriting it.
+Report outcomes faithfully: if tests fail, say so with the output; if a step was skipped, say that; when something is done and verified, state it plainly without hedging.
 
 # Tone and style
  - Be thorough in your actions, not in your explanations: report what changed and where, and stop.