frizz 0.7.8 → 0.8.1

package/dist/frizz.js

@@ -12447,7 +12447,7 @@ var init_relay_protocol = __esm({
 function fallbackPort(base) {
   return base + 1e4;
 }
-var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketClientMsg, ProjectCard, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
+var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketClientMsg, ProjectCard, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
 var init_src = __esm({
   "packages/shared/src/index.ts"() {
     "use strict";
@@ -12703,7 +12703,7 @@ var init_src = __esm({
       questions: external_exports.array(AskQuestion)
     });
     AwaitingHint = external_exports.object({
-      kind: external_exports.enum(["shell", "agent", "timer", "pr", "for"]),
+      kind: external_exports.enum(["shell", "agent", "timer", "pr", "for", "title"]),
       value: external_exports.string()
     });
     RETIRED_AWAITING_KINDS = ["watch", "pr-watch", "human", "ci", "session", "shell", "agent", "timer", "pr", "reason"];
@@ -13280,6 +13280,14 @@ var init_src = __esm({
       // Default action for a vetted non-image local path in agent markdown. Image clicks always use the
       // OS default viewer so screenshots retain their expected behavior.
       localFileOpener: LocalFileOpener.optional(),
+      // The token count at which a NEW Claude worker auto-compacts its conversation. Frizz requests the
+      // 1M context window on every dispatch (resolveClaudeLaunchModel), so without this a worker grows
+      // toward 1M before it ever compacts — and every turn past 200K re-sends up to 5x the conversation a
+      // 200K TUI session would, which is the single largest reason a Frizz thread spends quota faster than
+      // the TUI (measured 2026-08-26). Reaches the worker as CLAUDE_CODE_AUTO_COMPACT_WINDOW, which Claude
+      // Code caps to the model's real window. Optional so an old blob parses; defaultSettings pins 500_000
+      // (maintainer 2026-08-26: "a default compaction window of 500k by default").
+      autoCompactWindow: external_exports.number().int().positive().optional(),
       // The GitHub batch-dispatch prompt template (the picker's per-item worker prompt). Optional: when
       // unset OR blank the server falls back to its exported DEFAULT_GITHUB_PROMPT. Substitution tokens
       // the server fills: {repo} {n} {title} {url} {labels} {body}. The leading `THREAD: <slug>` tag is
@@ -13545,9 +13553,11 @@ var init_src = __esm({
       backend: Backend,
       options: external_exports.array(ThreadProfileOption)
     });
+    ThreadSkillSource = external_exports.enum(["project", "user", "builtin", "plugin"]);
     ThreadSkill = external_exports.object({
       name: external_exports.string().min(1).max(512),
-      description: external_exports.string().max(1024)
+      description: external_exports.string().max(1024),
+      source: ThreadSkillSource.optional()
     }).strict();
     ThreadSkillsInput = external_exports.object({ slug: ThreadSlug }).strict();
     ThreadSkillsResult = external_exports.object({ skills: external_exports.array(ThreadSkill).max(1024) }).strict();
@@ -22797,6 +22807,7 @@ var b64url = (bytes) => {
   for (const byte of view) binary += String.fromCharCode(byte);
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 };
+var SETTLED_MS = 1e4;
 function defaultBackoff(attempt, random = Math.random) {
   const base = Math.min(3e4, 500 * 2 ** Math.min(attempt, 6));
   return Math.round(base / 2 + random() * (base / 2));
@@ -22846,8 +22857,11 @@ function connectRelay(options2) {
     const url = `${options2.relayOrigin.replace(/^http/, "ws").replace(/\/$/, "")}/_relay/connect?h=${encoded}`;
     const next = makeSocket(url);
     socket = next;
+    let settled;
     next.addEventListener("open", () => {
-      attempt = 0;
+      settled = setTimer(() => {
+        attempt = 0;
+      }, SETTLED_MS);
       options2.onStatus?.("connected");
     });
     next.addEventListener("message", (event) => {
@@ -22888,6 +22902,10 @@ function connectRelay(options2) {
     });
     const dropped = () => {
       if (socket !== next) return;
+      if (settled !== void 0) {
+        clearTimer(settled);
+        settled = void 0;
+      }
       socket = null;
       for (const session of nested.values()) session.close();
       nested.clear();
@@ -23343,6 +23361,7 @@ function createRemotePane(options2) {
         ...wrap(
           "Claims <name>.frizz.sh for your GitHub account. The board dials out to frizz.sh \u2014 no port, no DNS record, no tunnel binary. One name per account; a name nobody runs for 30 days is released."
         ),
+        ...options2.sandbox ? ["", ...wrap("This is a sandbox, but a claim is real: it binds this machine's one name to your account, and your real board keeps it. Only the setup saved here is thrown away.")] : [],
         "",
         gh
       ];
@@ -23881,8 +23900,8 @@ init_src();
 init_project_registry();
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { createServer as createServer2 } from "node:net";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync11, realpathSync as realpathSync5, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
+import { existsSync as existsSync5, mkdirSync as mkdirSync10, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync11, realpathSync as realpathSync5, rmSync as rmSync8, symlinkSync as symlinkSync2, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir10, tmpdir as tmpdir2 } from "node:os";
 import { basename as basename5, join as join13, resolve as resolve3 } from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
 var PORT_SCAN_COUNT = 100;
@@ -23946,6 +23965,7 @@ function parseCliArgs(argv) {
     "--stop",
     "--status",
     "--link",
+    "--sandbox",
     "--sessions",
     "--sign-out",
     "--help",
@@ -23973,6 +23993,12 @@ function parseCliArgs(argv) {
     throw new Error("--detach is no longer available; frizz-dev always runs in the foreground");
   if (args2.has("--app") && args2.has("--no-app"))
     throw new Error("choose either --app or --no-app");
+  if (args2.has("--sandbox")) {
+    for (const query of ["--stop", "--status", "--link", "--sessions", "--sign-out"]) {
+      if (args2.has(query) || argv.some((arg) => arg.startsWith(`${query}=`)))
+        throw new Error(`${query} asks the running board, and --sandbox starts a fresh disposable one \u2014 run ${query} without --sandbox`);
+    }
+  }
   return {
     noApp: args2.has("--no-app"),
     appMode: args2.has("--app"),
@@ -23980,6 +24006,7 @@ function parseCliArgs(argv) {
     foreground: true,
     stop: args2.has("--stop"),
     link: args2.has("--link"),
+    sandbox: args2.has("--sandbox"),
     sessions: args2.has("--sessions"),
     ...rawSignOut !== void 0 ? { signOut: rawSignOut } : {},
     status: args2.has("--status"),
@@ -23992,6 +24019,57 @@ function parseCliArgs(argv) {
 function boardAddress(url) {
   return url.includes("?") || url.endsWith("/") ? url : `${url}/`;
 }
+function prepareSandbox(env = process.env, realHome = homedir10()) {
+  const home = mkdtempSync(join13(tmpdir2(), "frizz-sandbox-"));
+  shareCredentials(realHome, home);
+  env.HOME = home;
+  env.USERPROFILE = home;
+  const project = join13(home, "sandbox");
+  mkdirSync10(project, { recursive: true });
+  writeFileSync10(join13(project, "README.md"), "# frizz sandbox\n\nA throwaway project; everything here is deleted when the sandbox exits.\n");
+  try {
+    execFileSync3("git", ["init", "-q"], { cwd: project, stdio: "ignore" });
+  } catch {
+    throw new Error("--sandbox mints a throwaway git repository and git is not available \u2014 install git, or play in a repo of your own with a temp HOME");
+  }
+  process.chdir(project);
+  return { home, project };
+}
+function shareCredentials(realHome, home) {
+  const link = (from, to) => {
+    try {
+      symlinkSync2(from, to);
+    } catch {
+    }
+  };
+  mkdirSync10(join13(realHome, ".frizz"), { recursive: true });
+  mkdirSync10(join13(home, ".frizz"), { recursive: true });
+  link(join13(realHome, ".frizz", "identity.key"), join13(home, ".frizz", "identity.key"));
+  if (existsSync5(join13(realHome, ".config", "gh"))) {
+    mkdirSync10(join13(home, ".config"), { recursive: true });
+    link(join13(realHome, ".config", "gh"), join13(home, ".config", "gh"));
+  }
+  const cloudflared = join13(realHome, ".cloudflared");
+  if (existsSync5(cloudflared)) {
+    mkdirSync10(join13(home, ".cloudflared"), { recursive: true });
+    for (const entry of readdirSync3(cloudflared)) {
+      if (entry === "cert.pem" || entry.endsWith(".json")) link(join13(cloudflared, entry), join13(home, ".cloudflared", entry));
+    }
+  }
+  for (const entry of [".claude", ".claude.json", ".codex"]) {
+    if (existsSync5(join13(realHome, entry))) link(join13(realHome, entry), join13(home, entry));
+  }
+  if (process.platform === "darwin" && existsSync5(join13(realHome, "Library", "Keychains"))) {
+    mkdirSync10(join13(home, "Library"), { recursive: true });
+    link(join13(realHome, "Library", "Keychains"), join13(home, "Library", "Keychains"));
+  }
+}
+function cleanupSandbox(home) {
+  try {
+    rmSync8(home, { recursive: true, force: true });
+  } catch {
+  }
+}
 function resolveLaunchIntent(cwd = process.cwd(), home = homedir10(), env = process.env) {
   const candidate = realpathSync5(discoverProjectRoot(cwd, home));
   const known = isExistingProjectRoot(candidate) || findByPath(candidate, home) !== void 0;
@@ -24246,7 +24324,7 @@ init_project_launch();
 init_project_launch();
 import { fork } from "node:child_process";
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync11, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync11, readFileSync as readFileSync12 } from "node:fs";
 import { createServer as createNetServer } from "node:net";
 import { basename as basename6, dirname as dirname10, extname as extname2, isAbsolute as isAbsolute3, relative, resolve as resolve4, sep as sep2 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -24583,7 +24661,7 @@ var Supervisor = class {
       await this.publicProxy.listen();
       if (this.watchEnabled) {
         const settled = await Promise.allSettled(
-          this.roots.filter(existsSync5).map((root) => this.watchSubscribe(root, (err, events) => this.onWatch(err, events), {
+          this.roots.filter(existsSync6).map((root) => this.watchSubscribe(root, (err, events) => this.onWatch(err, events), {
             ignore: DEV_WATCH_IGNORE
           }))
         );
@@ -25215,7 +25293,12 @@ for a source checkout.
 Options:
   --no-app               print the URL without opening a browser
   --port <port>          request a fixed port for a new workspace server
+  --sandbox              a disposable Frizz to try things in: throwaway home and project, its
+                         own port, deleted when this terminal closes; credentials (gh,
+                         cloudflared, Claude, Codex, the machine's frizz.sh key) are shared
   --link                 print a fresh single-use access link for the running board
+  --sessions             list the devices signed in to the running board
+  --sign-out <id|all>    sign one device out, or every one of them
   --debug                stream the full event feed to the terminal instead of the compact readout
   -h, --help             show this help
 
@@ -25228,6 +25311,8 @@ shows a single-use sign-in link as a QR; press L for a fresh one, or run --link
   process.exit(0);
 }
 if (options.dev || rawArgs.includes("--prod")) fail("--dev and --prod are not available from the registry launcher");
+var sandbox = options.sandbox ? prepareSandbox() : null;
+if (sandbox) process.on("exit", () => cleanupSandbox(sandbox.home));
 var remote = null;
 var paneHost = null;
 var accessPane = null;
@@ -25362,6 +25447,7 @@ async function openOrPrint(port, reused, path = "") {
   }
   const publicOrigin = reused ? void 0 : remote?.origin();
   const warnings = [];
+  if (sandbox) warnings.push(`Sandbox: everything here is throwaway (${sandbox.home}) and is deleted when this terminal closes.`);
   if (!readout) {
     console.log(`${reused ? "reusing" : "started"} Frizz ${PACKAGE_VERSION} for ${workspace.root}`);
     console.log(url);
@@ -25490,7 +25576,8 @@ async function runSupervisor(port, token) {
     claim: (name) => establishCloudConfig(name, port),
     issueLink: () => supervisor.issueAccessLink(),
     probes: { github: probeGithub, cloudflared: probeCloudflared, tailscale: probeTailscale },
-    onChanged: (config) => logger.info("remote", config ? `reached at https://${config.hostname}` : "loopback only")
+    onChanged: (config) => logger.info("remote", config ? `reached at https://${config.hostname}` : "loopback only"),
+    sandbox: sandbox !== null
   });
   paneHost = installPaneHost({ bindings: { l: accessPane, L: accessPane, r: remotePane, R: remotePane } });
   const stop = createSupervisorShutdownHandler({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "version": "0.7.8",
+  "version": "0.8.1",
   "private": false,
   "description": "A local web UI for running many coding agents at once",
   "keywords": [

package/runtime/cc-worker/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "description": "Worker-side frizz plugin for frizz-spawned sessions. Each session is a WORKER driving ONE effort (slug via env FRIZZ_THREAD): it SIGNALS through its final message (done, human/timer awaiting, question), keeps automatable waits active with Claude wait tools, and keeps its own free-form scratch directory (.frizz/threads/<session-id>/). Supplies the frizz:<model>-<effort> sub-agent profiles (dispatch as frizz:opus-high, frizz:sonnet-medium, frizz:haiku, …), the on-demand frizz:gh skill, and hooks that seed the worker contract, enforce background/name-stripped sub-agent dispatch, and deny the interactive question/plan prompts (deny-ask, deny-plan) that would hang a dashboard worker. Hooks are inert unless FRIZZ_THREAD is set.",
+  "description": "Worker-side frizz plugin for frizz-spawned sessions. Each session is a WORKER driving ONE effort (slug via env FRIZZ_THREAD): it SIGNALS through its final message (done, human/timer awaiting, question), keeps automatable waits active with Claude wait tools, and keeps its own free-form scratch directory (.frizz/threads/<session-id>/). Supplies the effort-only frizz:<effort> sub-agent profiles (frizz:low … frizz:max; the model rides the Agent tool's own parameter), the on-demand frizz:gh skill, and hooks that seed the worker contract, enforce background/name-stripped sub-agent dispatch, and deny the interactive question/plan prompts (deny-ask, deny-plan) that would hang a dashboard worker. Hooks are inert unless FRIZZ_THREAD is set.",
   "version": "0.1.10",
   "author": { "name": "Colin McDonnell" },
   "homepage": "https://github.com/colinhacks/frizz",

package/runtime/cc-worker/DECISIONS.md

@@ -1032,7 +1032,7 @@ Maintainer's call, verbatim: *"This is obviously something that should not be a
 
 Three removals, one theme — Frizz's shipped worker contract states frizz MECHANICS, and everything else belongs to the repo or to the dispatch that starts the thread.
 
-- **`runtimeGate` (setting) + `RUNTIME_GATE` (prompt module) — gone.** The browser-QA loop (drive it in Chrome, screenshot into the handoff, escalate to an adversarial reviewer) was frizz's own engineering norm shipped to every worker Frizz dispatches anywhere. That is what `FRIZZ.md` / `CLAUDE.md` are for: `frizzConfigBlock` already injects a repo's own conventions into every spawn/adopt/resume, and this repo keeps its full browser-QA section there. What remains in the shipped contract is the repo-agnostic line that was already in the Quality bar — *"Verify behavior end-to-end before calling anything done."* `VISUAL_EVIDENCE` **stays**: it documents Frizz's guarded local-image proxy, a platform capability, not a QA policy. `chrome-devtools` also stays always-mounted — giving a worker a browser is a capability, not an opinion about when to use it.
+- **`runtimeGate` (setting) + `RUNTIME_GATE` (prompt module) — gone.** The browser-QA loop (drive it in Chrome, screenshot into the handoff, escalate to an adversarial reviewer) was frizz's own engineering norm shipped to every worker Frizz dispatches anywhere. That is what `FRIZZ.md` / `CLAUDE.md` are for: `frizzConfigBlock` already injects a repo's own conventions into every spawn/adopt/resume, and this repo keeps its full browser-QA section there. What remains in the shipped contract is the repo-agnostic line that was already in the Quality bar — *"Verify behavior end-to-end before calling anything done."* `VISUAL_EVIDENCE` **stays**: it documents Frizz's guarded local-image proxy, a platform capability, not a QA policy. `chrome-devtools` also stays always-mounted — giving a worker a browser is a capability, not an opinion about when to use it. **(Reversed 2026-08-26 — see the entry at the end of this file. The reasoning above survives one step further than it should have: mounting a browser is itself an opinion, and it was billed to every worker in tokens.)**
 - **Model + Effort — removed from the settings drawer.** They are chosen per dispatch in the prompt box (`DispatchPreferences`, one profile per runtime); a second global copy only made it ambiguous which one applied. `Settings.model` / `Settings.effort` survive on the wire: `dispatch-preferences.ts` still seeds the composer's first-run profile from them and `dispatch.ts` still falls back to them for GitHub batch dispatch.
 - **`autoResumeOnLimit` — gone; auto-resume is unconditional.** A thread cut off mid-turn by an exhausted subscription window always gets its own "continue" when the window rolls. `ThreadView.limitPause.autoResume` survives on the wire but is now purely a STALENESS verdict (`resolveLimitPause`): a fault old enough that the wake will never arrive stops promising one.
 
@@ -1112,3 +1112,31 @@ Maintainer: *"Changing the model and effort in a prompt box. That should be reme
 - **The web cache treats `["dispatchPreferencesGet"]` as machine-wide** (`lib/queryKeyScope.ts`), so the composer's optimistic write on one project is what a client-side switch paints on the next, rather than that project's last-seen copy for the beat before a refetch.
 
 Verified on a real two-project stack (launcher + tenant on one server): a profile chosen through the tenant's RPC is what the launcher reads, and back; a per-project `settingsSet` on the launcher stayed invisible to the tenant, which is the control that the two prefixes reach different projects.
+## 2026-08-26: Frizz mounts NO browser — a `chrome-devtools` server is the project's to bring
+
+Maintainer: *"Is the Chrome DevTool stuff something that frizz automatically injects? Why not just let the user bring that themselves? That's very confusing to me. I feel like there's a level of opinionation here that we don't really want."*
+
+This reverses the 2026-08-03 line above (*"`chrome-devtools` also stays always-mounted — giving a worker a browser is a capability, not an opinion"*). The capability argument stopped holding once the bill was measured: the server's 29 tool schemas sat in the prefix of **every** worker session at **~6,400 tokens**, and most workers never open a page. A capability nobody asked for, charged per turn, is an opinion.
+
+- **Both backends stopped injecting it.** Claude's inline `--mcp-config` (`claudeMcpConfig`, `dispatch.ts`) and codex's `-c mcp_servers.chrome-devtools=…` app-server override (`codex-mcp.ts`) now mount the unified `frizz` server and nothing else. Parity was the point of the original pairing and it is the point of the removal.
+- **The lazy proxy went with it.** `cc-worker/bin/browser-mcp.mjs` and its committed schema snapshot `browser-mcp-tools.json` existed only to make the always-on mount affordable in MEMORY (159 MB → ~17 MB per worker, 2026-08-19). With no mount there is nothing to proxy, so they are deleted along with `chromeDevtoolsMcpSpec` / `chromeDevtoolsMcpMount` / `resolveBrowserMcpScript` / `CHROME_DEVTOOLS_MCP`, `scripts/harvest-browser-mcp-tools.mjs`, and the worker-plugin closure entries that required them. The memory win it bought is now the token win.
+- **Nothing about a browser is banned — it is just not Frizz's to decide.** A project adds a `.mcp.json` (plus `enabledMcpjsonServers` in `.claude/settings.json`, so a headless worker is never blocked on the approval prompt); an operator runs `claude mcp add --scope user`. Frizz's `--mcp-config` ADDS to whatever the CLI discovered rather than replacing it (frizz never passes `--strict-mcp-config`), so both paths reach a dispatched worker untouched.
+- **This repo does exactly that, and that is the whole demonstration.** Frizz's own skills drive Chrome headless, so the repo root carries the `.mcp.json` that used to be injected — pinned `chrome-devtools-mcp@1.7.0 --experimentalPageIdRouting --headless --isolated --no-usage-statistics`, the same argv the deleted spec rendered. Verified end-to-end on a disposable stack: a worker dispatched in a scratch project with no config reported `frizz` tools and no browser; a worker dispatched in this repo reported the full `mcp__chrome-devtools__*` set with no permission prompt.
+- **What deliberately stayed.** The orphan reaper still reaps `chrome-devtools-mcp` processes by name (a browser the USER brought leaks exactly the same way), and the transcript still renders a `take_screenshot` image result. Neither depends on who mounted the server.
+
+## 2026-08-26: Sub-agent profiles are effort-only, and the dispatch epilogue carries mechanics, not a handoff format
+
+Follow-on to the browser decision above, from the same audit of what Frizz registers into a worker that the worker did not ask for. The maintainer's frame — *"a level of opinionation here that we don't really want"* — applied to two more registrations, and the frizz Goal had this thread decide them itself.
+
+- **16 `frizz:<model>-<effort>` profiles → 5 `frizz:<effort>` ones.** The model×effort grid existed because the Agent tool once had no way to pin either; today its own `model` parameter overrides a profile's model, so the only knob a profile still has to carry is `effort`. The grid cost ~1,340 tokens of agent descriptions on every session, and those descriptions doubled as a routing doctrine ("Opus matches Fable and costs less", "Haiku for scripted harvest only") that no project asked for. `low` … `max` carry no model and inherit the worker's; Haiku, which takes no effort setting, is dispatched with `model: "haiku"` and no profile. The worker contract's Sub-agents section now states the two knobs and nothing about which tier deserves which task.
+- **The dispatch-hook epilogue kept only what a helper cannot discover.** Its first paragraph prescribed the shape of a helper's final message (status, files, SHA, evidence, caveats, next action); that is a handoff format, and it is gone — one sentence remains saying the final message is what the dispatcher reads. The rest stayed because each line is a mechanic learned from a real failure: the `SendMessage({to: "main"})` upward channel, the own-file rule for the scratch directory, no fan-out of its own unless asked, and the symlinked-`.output` wait-loop trap.
+- **Verified** by the live harness (`_live_broker_workerenv.mts`, now dispatching `frizz:low`): a real broker worker through the real server dispatched the profile and it ran.
+
+## 2026-08-26: three more worker registrations deleted — the waits skill, the pre-compaction brief, and the toon nudge
+
+Third pass of the same audit that removed the browser mount and the model×effort profile grid above, and the same test: does Frizz register this into every worker because the worker needs it, or because Frizz has an opinion?
+
+- **`skills/waits` is DELETED.** Maintainer: *"I feel like the waits skill is being replaced now. I don't think we need that. We have our own system now for registering watchers and whatnot as tools."* The skill's whole job was teaching a worker how to hold a wait open without falling out of the board's Active band, and the durable half of that is now TOOLS — `mcp__frizz__watch_pr`, `mcp__frizz__timer`, `mcp__frizz__recurring_prompt` — which carry their own descriptions and need no playbook. What remains (a sub-agent owns the wait, `run_in_background` does not hold a rest, never fake a wait with a foreground sleep) is already stated once in the system-prompt contract, which is where a mechanical rule belongs.
+- **The portable monitors STAYED.** `skills/gh/scripts/{ci-watch,github-watch,review-watch}.mjs` are generated byte-for-byte from `monitors/` and are load-bearing for two other readers: the codex worker prompt names their absolute directory (`monitorScriptsDir()`, `dispatch.ts`, pinned by `dispatch.test.ts`), and `skills/gh` documents them as its declared-tooling fallback. Only the skill went.
+- **`hooks/precompact-instructions.mjs` is DELETED**, with both its `PreCompact` registrations. Maintainer: *"the pre-compaction instructions are probably too opinionated, entirely too opinionated."* It handed the summarizer an editorial brief about WHAT to preserve — plan, alternatives rejected, rationale, at high fidelity — which is a prescription about how someone else's work should be remembered. `scratchpad.mjs --mode=precompact` keeps both matchers: it only says the worker's scratch files exist and names their paths, which is mechanics.
+- **The `toon` bullet is gone from the seed's `⟦gh available⟧` block and from `skills/gh`.** Maintainer: *"It seems pretty opinionated to tell it to pipe through toon, given that toon is probably not installed on most machines. That might be over the line."* The original reasoning (`plans/github-integration.md` §9: worker-side yes, server-side no) was measured against THIS machine's toolchain; a `command -v toon` guard makes the advice safe but not less opinionated, and it spent prompt tokens on every authed session to describe a binary almost no repo has. The one raw-API recipe that piped through it now uses `--jq`, which ships with `gh`.

package/runtime/cc-worker/agents/high.md

@@ -0,0 +1,7 @@
+---
+name: high
+description: Effort high. The model is the Agent tool's `model` parameter (omitted, it inherits the worker's).
+effort: high
+---
+
+Execute the self-contained task in your dispatch prompt.

package/runtime/cc-worker/agents/low.md

@@ -0,0 +1,7 @@
+---
+name: low
+description: Effort low. The model is the Agent tool's `model` parameter (omitted, it inherits the worker's).
+effort: low
+---
+
+Execute the self-contained task in your dispatch prompt.

package/runtime/cc-worker/agents/max.md

@@ -0,0 +1,7 @@
+---
+name: max
+description: Effort max. The model is the Agent tool's `model` parameter (omitted, it inherits the worker's).
+effort: max
+---
+
+Execute the self-contained task in your dispatch prompt.

package/runtime/cc-worker/agents/medium.md

@@ -0,0 +1,7 @@
+---
+name: medium
+description: Effort medium. The model is the Agent tool's `model` parameter (omitted, it inherits the worker's).
+effort: medium
+---
+
+Execute the self-contained task in your dispatch prompt.

package/runtime/cc-worker/agents/xhigh.md

@@ -0,0 +1,7 @@
+---
+name: xhigh
+description: Effort xhigh. The model is the Agent tool's `model` parameter (omitted, it inherits the worker's).
+effort: xhigh
+---
+
+Execute the self-contained task in your dispatch prompt.

package/runtime/cc-worker/hooks/agent-dispatch.mjs

@@ -6,10 +6,11 @@
 //      foreground agent blocks the worker's turn; a human interjection orphans it).
 //   2) STRIP `name`/`team_name` — setting either strands a nested dispatch (its result routes
 //      wrong and never returns cleanly), so scrub both silently.
-//   3) AUTO-APPEND a repo-neutral ORCHESTRATION EPILOGUE so helpers return a useful handoff,
-//      know how to reach their dispatcher mid-flight, do NOT fan out a layer of their own unless
-//      their prompt asked for it, and collect a helper correctly when it did — without imposing
-//      build, test, git, compilation, or process-lifecycle policy on arbitrary repos.
+//   3) AUTO-APPEND a short ORCHESTRATION EPILOGUE carrying only what a helper cannot discover on
+//      its own: that its final message is the return value, the `SendMessage({to: "main"})` upward
+//      channel, the own-file rule for the scratch directory, no fan-out of its own unless asked, and
+//      how a helper it DID dispatch is collected. It carries no handoff format and no build, test,
+//      git or process policy — the maintainer had the handoff-format doctrine cut on 2026-08-26.
 //
 // WHY NESTING IS DEFAULT-OFF (2026-08-04, maintainer's call): the epilogue used to speak about a
 // helper's own helper only in the conditional ("if you dispatch a helper of your own…"), which reads
@@ -45,11 +46,11 @@ import { readFileSync } from 'node:fs';
 const EPILOGUE = `
 
 ---
-[ORCHESTRATION EPILOGUE — auto-appended by the frizz worker dispatch hook] You are a helper sub-agent for a frizz worker. Your final message is the handoff: report your outcome/status; what you did; changed files, artifacts, and commit SHA when applicable; verification or evidence and its result; caveats or unresolved work; and the next action when one remains. A bare "done" or progress-only message is not a complete handoff.
-The worker has a scratch directory (it will name the path if it wants your notes on disk). Write your OWN file there — never edit or delete a file another agent wrote, and never treat one shared document as yours to rewrite. Writing your own file there is Frizz coordination state, not a project deliverable or source edit, so it remains allowed when a delegated task limits your deliverable paths with phrases such as "write only <path>" or "do not modify the repo"; never classify it as unauthorized or roll it back. Other project files, including repository-root files, remain governed by your delegated authority; their location alone neither permits nor forbids editing. Do not edit other \`.frizz/\` state unless your prompt explicitly asks you to.
-You have an upward channel while you work: \`SendMessage({to: "main", summary: "<5-10 words>", message: "…"})\` delivers to your dispatcher. Use it when the dispatcher acting before you finish could change the outcome—for example, when you hit an unresolved blocker, complete a milestone another task needs, or discover that your instructions should change. Do not use it for routine progress updates.
-Do the work yourself: do NOT dispatch sub-agents of your own unless your dispatch prompt explicitly tells you to. You are already one prong of someone else's fan-out, and another layer below you buys little — it splits the context you were handed, buries the real work one level further from whoever reads the tree, and leaves you collecting a handoff instead of doing the task. A slice that feels large is still yours to work through in your own turn.
-If your prompt DOES ask you to dispatch a helper, its completion is delivered to you automatically. Never hand-roll a wait loop over a helper's transcript or \`.output\` path to decide whether it finished: that path is a SYMLINK, so \`stat\` without \`-L\` reports the link's own size (the length of its target path, ~150 bytes) and its frozen creation mtime, and the \`"type":"result"\` record is not reliably written — so a helper that is working hard reads as tiny, stale, and dead, and you will discard live work and redo it. Judge a helper only by its completion notification or the text it returns. Give it a \`description\` naming its narrower slice rather than restating your own, so the dispatch tree stays readable.`;
+[ORCHESTRATION EPILOGUE — auto-appended by the frizz worker dispatch hook] You are a helper sub-agent for a frizz worker. Your final message is the handoff your dispatcher reads: what you did, what you verified, what remains.
+If the worker names its scratch directory: Write your OWN file there — never edit or delete a file another agent wrote. That file is Frizz coordination state, not a project deliverable or source edit, so it stays allowed under limits such as "write only <path>" or "do not modify the repo"; never classify it as unauthorized or roll it back. Every other file is governed by your delegated authority; its location alone neither permits nor forbids editing. Do not edit other \`.frizz/\` state unless your prompt asks.
+Upward channel: \`SendMessage({to: "main", summary: "<5-10 words>", message: "…"})\` reaches your dispatcher while you work (load it first with ToolSearch \`select:SendMessage\` if it is deferred). Use it only when the dispatcher acting before you finish would change the outcome — a blocker, a milestone another task needs, instructions that should change — not for progress updates.
+Do the work yourself: do NOT dispatch sub-agents of your own unless your dispatch prompt explicitly tells you to. You are already one prong of someone else's fan-out; a slice that feels large is still yours to work through in your own turn.
+If your prompt DOES ask you to dispatch a helper, its completion is delivered to you automatically. Never hand-roll a wait loop over a helper's transcript or \`.output\` path: that path is a SYMLINK (\`stat\` without \`-L\` reports the link's own ~150-byte size and frozen mtime) and the \`"type":"result"\` record is not reliably written, so a helper working hard reads as tiny, stale and dead, and you will discard live work and redo it. Judge a helper only by its completion notification or the text it returns, and give it a \`description\` naming its narrower slice.`;
 
 /** @param {unknown} obj @returns {never} */
 function emit(obj) {

package/runtime/cc-worker/hooks/hooks.json

@@ -58,14 +58,12 @@
       {
         "matcher": "auto",
         "hooks": [
-          { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/precompact-instructions.mjs\"" },
           { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scratchpad.mjs\" --mode=precompact" }
         ]
       },
       {
         "matcher": "manual",
         "hooks": [
-          { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/precompact-instructions.mjs\"" },
           { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scratchpad.mjs\" --mode=precompact" }
         ]
       }

package/runtime/cc-worker/hooks/scratchpad.mjs

@@ -280,9 +280,11 @@ if (mode === 'session-start') {
 }
 
 // ── mode: precompact ─────────────────────────────────────────────────────────────────────────────
-// PLAIN STDOUT — joined with the other PreCompact hooks' stdout into the summarizer's
-// `Additional Instructions:`. Worded as an ordinary editorial note: precompact-instructions.mjs
-// records that a summarizer REFUSES instructions that read like prompt-hijacking.
+// PLAIN STDOUT — handed to the summarizer as its `Additional Instructions:`. cc's usual
+// `hookSpecificOutput` JSON would be read as literal instructions instead. Worded as an ordinary
+// editorial note: a summarizer REFUSES instructions that read like prompt-hijacking (DECISIONS.md).
+// This is the ONLY PreCompact hook the plugin registers — `precompact-instructions.mjs`, which also
+// steered the summarizer, was deleted on 2026-08-26 as too opinionated.
 if (mode === 'precompact') {
   const files = listScratch();
   if (files.length === 0) process.exit(0);

package/runtime/cc-worker/hooks/session-seed.mjs

@@ -8,10 +8,9 @@
 // frontmatter, no status field — a worker SIGNALS through its final message (fences), and anything that
 // must outlive its context window is an arrangement it makes for itself. This hook injects, on every
 // session start (startup/resume/clear/compact):
-//   1. `core` — a runtime re-grounding + pointer, NOT a second copy of the contract: the full worker
-//      contract lives ONCE in the system prompt (workerPrompt.ts) the server injects at spawn. This
-//      carries only what a static system prompt can't: the runtime scratch-directory PATH + an essential
-//      signal-at-rest anchor + a pointer to the system-prompt contract.
+//   1. `core` — a runtime POINTER, not a copy of the contract: the full worker contract lives ONCE in
+//      the system prompt (workerPrompt.ts) the server injects at spawn. This carries only what a
+//      static system prompt can't: the runtime scratch-directory PATH, and a one-line pointer.
 //   2. the SCRATCH DIRECTORY — `.frizz/threads/<session_id>/`, a folder the worker may use as it likes.
 //   3. on `compact` — a short re-grounding (compaction drops the deep model + this orientation).
 //
@@ -57,21 +56,23 @@ const scratch = sid
   ? '.frizz/threads/' + sid + '/'
   : '.frizz/threads/<session-id>/';
 
-// A RUNTIME re-grounding + pointer, NOT a second copy of the contract. The full worker contract
-// (signal fences, scratch-directory rules, sub-agent rules, the question handback) lives
-// ONCE in the system prompt frizz injects at spawn (workerPrompt.ts / loadWorkerPrompt) — which is
-// re-applied on every resume and survives compaction. This hook adds only what a static system prompt
-// CANNOT carry: the runtime-derived scratch-directory PATH, an essential signal-at-rest anchor, and (below)
-// the compaction re-read nudge, gh guidance, and the defensive cc-orchestrator off-sentinel.
+// A RUNTIME pointer, NOT a copy of the contract. The full worker contract (signal fences,
+// scratch-directory rules, sub-agent rules, the question handback, the stop criterion) lives ONCE in
+// the system prompt frizz injects at spawn (workerPrompt.ts / loadWorkerPrompt) — re-applied on every
+// resume, and it survives compaction. This hook adds only what a static system prompt CANNOT carry:
+// the runtime-derived scratch-directory PATH, plus (below) the compaction re-read nudge and the
+// auth-gated gh guidance.
+//
+// It used to restate the fence protocol, the stop criterion and the autonomy rule in full — ~4.4 KB
+// (~1,100 tokens) on every startup, resume, clear AND compact, all of it already in the 42 KB system
+// prompt. Trimmed 2026-08-26 (maintainer: "Definitely trim the session seed hook if it's fully
+// repetitive") as part of cutting the per-session token overhead Frizz adds over a plain TUI session.
 const core =
-  '⟦frizz worker contract⟧ You are a frizz WORKER driving EXACTLY ONE effort. Your FULL operating contract — the end-of-turn signal fences, scratch-directory rules, sub-agent rules, and the question handback — lives in your SYSTEM PROMPT; follow it there (this is a runtime re-grounding, not a second copy). The human + the frizz app are the ORCHESTRATOR; you drive ONE effort and never scan the board or touch other efforts. There is no orchestrator mode and no fleet to run: doing the work yourself is the default, and you dispatch a sub-agent only when the work genuinely decomposes into independent prongs.\n' +
-  'SCRATCH DIRECTORY (OPTIONAL): `' + scratch + '` — a folder kept FOR YOU: any files you like, no format expected, nothing in it read automatically, and never a substitute for doing the work. A single direct task usually needs nothing. On a long effort write the doc you would want if you lost your context — the approach, what you rejected, the human\'s decisions — AS YOU GO, mid-work, then KEEP WORKING, and arm mcp__frizz__recurring_prompt with post_compaction: true and a prompt LINKING that file, because the arming is what brings it back. Give each sub-agent its OWN file rather than a shared one.\n' +
-  'DO NOT REST WHILE THE INSTRUCTION HAS PARTS LEFT — finish them in THIS turn; a milestone, a green test run and a long turn are none of them stopping points, and announcing the next step or writing it into a scratch file is not doing it.\n' +
-  'ALWAYS SIGN OFF WITH A FENCE, per the fence rules in your system prompt. A rest with NO fence is not a handoff — it is an item nobody can triage, and frizz will tell you so. ```done only when the effort\'s real work is COMPLETE (code LANDED on the mainline — an open PR is NOT done, park it on ```awaiting until it MERGES) and is a DISMISSAL (its card files the thread away where nobody looks again), so if the thread points at future work AT ALL — a pre-fix investigation, a live code-change discussion, follow-up work you DISCOVERED even when someone else will do it — ask a ```question instead, and uncertain is not done; a verdict that ends in something the HUMAN must now do (post this comment, merge or decline, pick one of these) is a ```question carrying your recommendation as option A, never a done card, because a draft you wrote but did not send is filed away with the thread; when your OWN mandate is complete and what is left is a separable effort, DO it first — dispatch a sub-agent, whose result comes BACK to you, so it lands on YOUR card — and ASK second; mcp__frizz__spawn_thread is the LAST resort, for work that genuinely cannot ride on your card, because a spawned thread reports only to the human and nothing it learns returns to you or its siblings; the ONE exception is a planning session whose plan file is fully written and persisted, because that artifact outlives the thread; ```awaiting parks your OWN background work — a shell, a sub-agent, an armed timer, a registered PR watcher — never CI/releases/merge progression (those stay ACTIVE), and never a person: waiting on a person is a ```question; ```question is the operator ask. Waiting on your own background shell? Your shells and sub-agents are watched AUTOMATICALLY — frizz wakes you when one finishes, fence or no fence. NAME it in the fence\'s YAML frontmatter anyway — plural keys taking lists (`shells: [<id>]`, `agents:`, `timers:`, `prs:`) plus a required `for:` duration, then `---` and your prose — and rest: that is what lets you stop without frizz asking you for a handoff, and what shows the human what you are waiting for. Frizz checks every name against what you actually have running. Keep the write-up SHORT: 1-3 sentences, then bullets starting with a **bolded verb phrase**. The fence and the prose above it are TWO SURFACES, not one message written twice — the card is the ledger of what shipped, the prose is only what a ledger cannot hold, and a sentence that would read the same in either belongs in exactly one. And a done message says what HAPPENED: delete every dangling "one thing to carry forward" or "a follow-up could" — do it, spawn it onto its own card, ask about it, or DROP it, and if it is not worth a card it is not worth a sentence.\n' +
-  'DECIDE rather than ask: anything derivable from the code, the conventions, or ordinary engineering judgment is YOURS to settle — asking permission to do the work you were dispatched to do is not a question, it is the job. Reserve the operator for the irreversible and the genuinely human-owned.';
+  '⟦frizz worker contract⟧ You are a frizz WORKER driving EXACTLY ONE effort. Your FULL operating contract — the end-of-turn signal fences (```done / ```awaiting / ```question), the scratch-directory rules, the sub-agent rules, the question handback and the stop criterion — lives in your SYSTEM PROMPT; follow it there. Always sign off with a fence.\n' +
+  'SCRATCH DIRECTORY (OPTIONAL): `' + scratch + '` — a folder kept FOR YOU, nothing in it read automatically, never a substitute for doing the work. Give each sub-agent its OWN file rather than a shared one.';
 
 const grounding =
-  '⟦frizz worker re-grounding (post-compaction)⟧ Context was just compacted. You are still the frizz worker for effort `' + thread + '` — read whatever you left yourself in `' + scratch + '` NOW to recover your working state and to-do list before asserting anything, and re-read any code before claiming how it is structured. Signal at rest through your FINAL MESSAGE, always with a fence — a fenceless rest is an item nobody can triage: ```done queues a checked completion until Archive and is a DISMISSAL — completed work only, and never when the thread still points at future work (a pre-fix investigation, a live code-change discussion); use a question or bare rest; ```awaiting parks only your own background work, an armed timer, or a registered PR watcher (which wakes on any new review/comment, bot or human) — named in YAML frontmatter with plural list keys (`shells:`/`agents:`/`timers:`/`prs:`) plus a `for:` duration; waiting on a person is a ```question; ```question is the explicit higher-priority operator ask. CI/releases/merge progression stay active through Monitor/background Bash.';
+  '⟦frizz worker re-grounding (post-compaction)⟧ Context was just compacted. You are still the frizz worker for effort `' + thread + '` — read whatever you left yourself in `' + scratch + '` NOW to recover your working state and to-do list before asserting anything, and re-read any code before claiming how it is structured. Your system prompt still carries the full contract; sign off with a fence as it says.';
 
 // AUTH-GATED gh guidance — teach the worker to use `gh` well, but ONLY when signed in.
 // Shell `gh auth status --active`: exit 0 = an active gh account is authenticated. The whole gate is
@@ -84,7 +85,6 @@ const ghBlock =
   '• READ freely: `gh issue view N -R OWNER/REPO --comments`, `gh pr view N`, `gh pr diff N`, `gh pr checks N`, `gh run list`/`gh run view`, `gh api repos/OWNER/REPO/…`. Prefer `--json <fields>` over scraping human text.\n' +
   '• SEARCH across the repo (and GitHub) with `gh search issues`/`gh search prs` when hunting related work, duplicates, or prior art.\n' +
   '• READ-ONLY BOUNDARY: never comment, label, assign, close, review, approve, or merge — no mutation of any kind — UNLESS the human explicitly asks in this session. Default to producing your findings/review as your final message, not as a GitHub post.\n' +
-  '• TOON: pipe LARGE, FLAT `gh … --json` output through `toon` when `command -v toon` finds it. Skip it when unavailable, for tiny payloads, or for deeply-nested output — the savings are noise and nesting defeats tabularization.\n' +
   'Load the `frizz:gh` skill for the full playbook (recipes + explicit project-local monitor selection + native Monitor/background-Bash CI/PR watches).';
 
 let ghAuthed = false;

package/runtime/cc-worker/skills/gh/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gh
-description: The gh-CLI playbook for a frizz worker signed into GitHub (invoke as frizz:gh). Load this whenever your effort touches GitHub — reading or triaging an issue or PR, reviewing a diff, checking CI/release status, or searching issues/PRs — to use `gh` eagerly and correctly: the read-vs-write boundary (never comment/label/close/merge unless the human asks), optional toon use for large JSON, concrete read recipes, and active Monitor/background-Bash CI/PR watches. Only meaningful when you are signed in (`gh auth status --active` exit 0); the session-seed hook injects a pointer here when you are.
-version: 0.1.1
+description: The gh-CLI playbook for a frizz worker signed into GitHub (invoke as frizz:gh). Load this whenever your effort touches GitHub — reading or triaging an issue or PR, reviewing a diff, checking CI/release status, or searching issues/PRs — to use `gh` eagerly and correctly: the read-vs-write boundary (never comment/label/close/merge unless the human asks), concrete read recipes, and active Monitor/background-Bash CI/PR watches. Only meaningful when you are signed in (`gh auth status --active` exit 0); the session-seed hook injects a pointer here when you are.
+version: 0.1.2
 metadata:
   internal: true
 ---
@@ -10,7 +10,7 @@ metadata:
 
 You are a **frizz worker** and you are **signed into the `gh` CLI in a GitHub repo** (the session-seed hook confirmed `gh auth status --active` before pointing you here). `gh` is the fastest path to issue / PR / CI / release context — reach for it before guessing, and prefer it over scraping the web UI or reasoning from memory.
 
-This skill is the full playbook the injected `⟦gh available⟧` block summarizes: the **read-vs-write boundary**, optional **toon** use for large JSON, concrete **read recipes**, and how to keep a **CI/PR watch** active until the next actionable event.
+This skill is the full playbook the injected `⟦gh available⟧` block summarizes: the **read-vs-write boundary**, concrete **read recipes**, and how to keep a **CI/PR watch** active until the next actionable event.
 
 ## The one hard rule — READ freely, WRITE only when asked
 
@@ -23,20 +23,6 @@ This skill is the full playbook the injected `⟦gh available⟧` block summariz
 
 There is no server-side enforcement of this; the boundary is yours to hold.
 
-## toon — pipe LARGE, FLAT gh JSON through the shim
-
-`toon` (Token-Oriented Object Notation) losslessly re-encodes JSON ~30–40% smaller for LLM context. Use it only when a `gh … --json` result you're reading into YOUR context is **large and flat** (a list page: `gh issue list`, `gh pr list`, `gh search`, `gh api` list endpoints) and `command -v toon` succeeds. It is optional: do not install it or assume a home-directory-specific location.
-
-```bash
-if command -v toon >/dev/null 2>&1; then
-  gh issue list -R OWNER/REPO --json number,title,url,updatedAt --limit 50 | toon
-else
-  gh issue list -R OWNER/REPO --json number,title,url,updatedAt --limit 50
-fi
-```
-
-**Skip toon** for tiny payloads (a handful of fields, one item) and for **deeply-nested** JSON (`reactionGroups`, review threads, nested files) — nesting defeats tabularization, so the savings collapse to noise and you add a parse tax for yourself. A single `gh pr view N --json …` is small — read it raw.
-
 ## Read recipes
 
 Always scope with `-R OWNER/REPO` so a command is dir-independent, and prefer `--json <fields>` (+ `-q <jq>`) so you pull exactly what you need.
@@ -52,7 +38,7 @@ gh issue list -R OWNER/REPO --search "sort:reactions-desc is:open" --json number
 **PRs + diffs**
 ```bash
 gh pr view N -R OWNER/REPO --json title,body,state,labels,files,additions,deletions,url
-gh pr diff N -R OWNER/REPO                # the unified diff — pipe through toon only if HUGE and you just need shape
+gh pr diff N -R OWNER/REPO                # the unified diff
 gh pr checks N -R OWNER/REPO              # CI check rollup for the PR
 gh pr view N -R OWNER/REPO --comments     # review threads + conversation
 ```
@@ -97,7 +83,7 @@ Use search to find duplicates, related work, and prior art before you conclude s
 **Raw API** for anything the porcelain doesn't cover:
 ```bash
 gh api repos/OWNER/REPO/commits/SHA/check-runs --jq '.check_runs[] | {name, conclusion}'
-gh api "repos/OWNER/REPO/issues?state=open&labels=bug&per_page=50" | { command -v toon >/dev/null 2>&1 && toon || cat; }
+gh api "repos/OWNER/REPO/issues?state=open&labels=bug&per_page=50" --jq '.[] | {number, title, html_url}'
 ```
 
 ## Keep GitHub automation active