github-router 0.3.163 → 0.3.175

package/dist/main.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as buildOpenAIErrorEvent, $t as resolveModel, At as ArtifactClient, B as buildToolbeltAwareness, Bt as pickClaudeDefault, C as repoFingerprint, Ct as parseJsonOrDiagnose, D as trustRepo, Dt as extractTarGzMember, E as stopReviewStateDir, Et as provisionAndIndexColbert, Ft as DEFAULT_CODEX_MODEL_FALLBACKS, G as assetFor, Gt as setupGitHubToken, H as toolbeltSkipSet, Ht as withInstallLock, It as DEFAULT_PORT, J as ADVISOR_TOOL_INSTRUCTIONS, Jt as cacheModels, K as searchWeb, Kt as tryRefreshAndRetry, Lt as UPSTREAM_FETCH_TIMEOUT_MS, Mt as toolbeltPathOverride, Nt as DEFAULT_CLAUDE_MODEL_FALLBACKS, O as resolveSealedGate, Ot as extractZipMember, Pt as DEFAULT_CODEX_MODEL, Q as buildAnthropicErrorEvent, Qt as resolveCodexModel, Rt as UPSTREAM_INACTIVITY_TIMEOUT_MS, S as isSubagentContext, St as readResponseBodyCapped, T as stopGateEnabledForRepo, Tt as hasSupportedBrowserInstalled, U as vscodeRipgrepPath, Ut as setupCopilotToken, V as toolbeltEnabled, Vt as getPackageVersion, W as TOOLBELT_TOOLS, Wt as setupGitHubAgentToken, X as injectAdvisorTool, Xt as filterBetaHeader, Y as buildAdvisorStream, Yt as cacheVSCodeVersion, Z as isAdvisorRequested, Zt as isNullish, _ as stopReviewEnabled, _t as resolveMcpToolTimeoutMs, a as buildPeerAwarenessSnippet, an as GITHUB_API_BASE_URL, at as handleMcpPost, b as fileLastPromptStore, bt as createChatCompletions, c as buildSessionBindHookCommand, cn as githubHeaders, ct as browserToolsEnabled, d as decideStopHook, dt as standInToolEnabled, en as sleep, et as isControllerClosedError, f as fileBlockBudget, ft as workerToolsEnabled, g as stopGateId, gt as assembleResponsesPayload, h as stopGateDisabled, ht as getTokenCount, i as buildAgentPrompt, in as forwardError, it as handleMcpDelete, jt as collapsePathKeys, k as liveExec, kt as shouldUseInsecureTls, l as buildStopHookCommand, ln as state, lt as fleetToolsEnabled, m as launchBaselineKey, mt as createMessages, n as MCP_GROUPS, nn as fetchWithTransientRetry, nt as readIteratorWithTimeout, o as personasFor, on as copilotBaseUrl, ot as agentToolsEnabled, p as injectStopHookIntoSettingsFile, pt as countTokens, q as ADVISOR_INTERNAL_TOOL_NAME, qt as cacheCopilotVersion, r as assertMcpToolSurfaceConsistent, rn as HTTPError, rt as relayAnthropicStream, s as buildArtifactOpenHookCommand, sn as copilotHeaders, st as browseAgentEnabled, t as GROUP_META, tn as getModels, tt as logStreamError, u as captureLaunchBaseline, ut as implementerSubagentModel, v as fileBaselineStore, vt as pickEndpoint, w as repoRoot, wt as provisionBrowserAssets, x as fileReviewDebounce, xt as MAX_RESPONSE_BODY_BYTES, y as fileFindingsStore, yt as createResponses, z as availableToolCommands, zt as generateRandomPort } from "./peer-mcp-personas-Bfq3FPKc.js";
+import { $ as isAdvisorRequested, $t as cacheModels, A as liveExec, At as hasSupportedBrowserInstalled, Bt as DEFAULT_CODEX_MODEL_FALLBACKS, C as fileReviewDebounce, Ct as pickEndpoint, D as stopGateEnabledForRepo, Dt as readResponseBodyCapped, E as repoRoot, Et as MAX_RESPONSE_BODY_BYTES, Ft as ArtifactClient, G as vscodeRipgrepPath, Gt as pickClaudeDefault, H as buildToolbeltAwareness, Ht as UPSTREAM_FETCH_TIMEOUT_MS, It as collapsePathKeys, J as searchWeb, Jt as setupCopilotToken, K as TOOLBELT_TOOLS, Kt as getPackageVersion, Lt as toolbeltPathOverride, Mt as extractTarGzMember, Nt as extractZipMember, O as stopReviewStateDir, Ot as parseJsonOrDiagnose, Pt as shouldUseInsecureTls, Q as injectAdvisorTool, Qt as cacheCopilotVersion, Rt as DEFAULT_CLAUDE_MODEL_FALLBACKS, S as fileLastPromptStore, St as resolveMcpToolTimeoutMs, T as repoFingerprint, Tt as createChatCompletions, U as toolbeltEnabled, Ut as UPSTREAM_INACTIVITY_TIMEOUT_MS, V as availableToolCommands, Vt as DEFAULT_PORT, W as toolbeltSkipSet, Wt as generateRandomPort, X as ADVISOR_TOOL_INSTRUCTIONS, Xt as setupGitHubToken, Y as ADVISOR_INTERNAL_TOOL_NAME, Yt as setupGitHubAgentToken, Z as buildAdvisorStream, Zt as tryRefreshAndRetry, _ as stopGateId, _t as workerToolsEnabled, a as buildPeerAwarenessSnippet, an as sleep, at as relayAnthropicStream, b as fileBaselineStore, bt as getTokenCount, c as buildArtifactOpenHookCommand, cn as HTTPError, ct as agentToolsEnabled, d as captureLaunchBaseline, dn as copilotBaseUrl, dt as browserCompoundToolsEnabled, en as cacheVSCodeVersion, et as buildAnthropicErrorEvent, f as decideStopHook, fn as copilotHeaders, ft as browserToolsEnabled, g as stopGateDisabled, gt as standInToolEnabled, h as launchBaselineKey, ht as implementerSubagentModel, i as buildAgentPrompt, in as resolveModel, it as readIteratorWithTimeout, j as resolveSealedGate, jt as provisionAndIndexColbert, k as trustRepo, kt as provisionBrowserAssets, l as buildSessionBindHookCommand, ln as forwardError, lt as artifactToolsEnabled, m as injectStopHookIntoSettingsFile, mn as state, mt as geminiAvailable, n as MCP_GROUPS, nn as isNullish, nt as isControllerClosedError, o as buildPeerAwarenessSummary, on as getModels, ot as handleMcpDelete, p as fileBlockBudget, pn as githubHeaders, pt as fleetToolsEnabled, q as assetFor, qt as withInstallLock, r as assertMcpToolSurfaceConsistent, rn as resolveCodexModel, rt as logStreamError, s as personasFor, sn as fetchWithTransientRetry, st as handleMcpPost, t as GROUP_META, tn as filterBetaHeader, tt as buildOpenAIErrorEvent, u as buildStopHookCommand, un as GITHUB_API_BASE_URL, ut as browseAgentEnabled, v as stopGatePlanMode, vt as countTokens, w as isSubagentContext, wt as createResponses, x as fileFindingsStore, xt as assembleResponsesPayload, y as stopReviewEnabled, yt as createMessages, zt as DEFAULT_CODEX_MODEL } from "./peer-mcp-personas-BCGYWok0.js";
 import { a as removeOwnClaudeConfigMirror, i as isUnderClaudeConfigMirror, l as writeArtifactCredsToMirror, n as ensureClaudeConfigMirror, r as ensurePaths, t as PATHS, u as writeRuntimeFileSecure } from "./paths-CTlT1nTo.js";
 import { c as killManagedTree, d as runCommandCapture, f as runCommandVoid, l as parseBoolEnv, s as killChildProcessTree, u as resolveExecutable } from "./lifecycle-ChPBRt6K.js";
 import { a as sweepRegistry } from "./lifecycle-BUXxiltc.js";
@@ -16,11 +16,11 @@ import * as fs$2 from "node:fs";
 import fs$1, { existsSync, mkdirSync, promises, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { Agent, ProxyAgent, setGlobalDispatcher } from "undici";
 import { Writable } from "node:stream";
+import { clearTimeout as clearTimeout$1, setTimeout as setTimeout$1 } from "node:timers";
 import { serve } from "srvx";
 import { getProxyForUrl } from "proxy-from-env";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { clearTimeout as clearTimeout$1, setTimeout as setTimeout$1 } from "node:timers";
 import { Marked } from "marked";
 import clipboard from "clipboardy";
 
@@ -969,6 +969,9 @@ function dispatcherDescription(mode) {
 *  relay verbatim, do nothing else. */
 function dispatcherPrompt(mode, workersKey) {
 	const tool = workerToolName(workersKey, mode);
+	const briefField = mode === "browse" ? "task" : "prompt";
+	const briefDescription = mode === "browse" ? "the lead's browse task, copied verbatim" : "the lead's worker brief, copied verbatim";
+	const modeSpecificPassThrough = mode === "implement" || mode === "test" ? "\n  - `worktree` (optional): pass `true` if the lead asked for isolated-worktree execution" : mode === "browse" ? "\n  - `sessionId` (optional): pass through if the lead specified one" : "";
 	return [
 		`# Subagent: ${dispatcherAgentName(mode)}`,
 		"",
@@ -978,10 +981,10 @@ function dispatcherPrompt(mode, workersKey) {
 		"## Your only job",
 		"",
 		`Call the \`${tool}\` tool EXACTLY ONCE, passing through the fields from the lead's brief:`,
-		"  - `prompt`: the lead's worker brief, copied verbatim",
+		`  - \`${briefField}\`: ${briefDescription}`,
 		"  - `workspace` (optional): absolute path, if the lead specified one",
 		"  - `model` / `thinking` (optional): only if the lead specified them",
-		"  - `maxWallClockMs` (optional): per-call wall-clock budget in ms, if the lead specified one" + (mode === "implement" || mode === "test" ? "\n  - `worktree` (optional): pass `true` if the lead asked for isolated-worktree execution" : ""),
+		"  - `maxWallClockMs` (optional): per-call wall-clock budget in ms, if the lead specified one" + modeSpecificPassThrough,
 		"",
 		"When the tool returns, output its result VERBATIM as your final message. That final",
 		"message is what the lead receives in the completion notification — it IS the result.",
@@ -1001,7 +1004,7 @@ function dispatcherPrompt(mode, workersKey) {
 *  tool names, so this grants exactly the workers tools and NOTHING else — no
 *  Agent/Task (so it cannot spawn further agents → no recursion), no Read/Bash
 *  (so it cannot do extra work). The dispatcher's prompt narrows it to the one
-*  mode; the guard allows any dispatcher-named caller regardless. */
+*  mode; the guard allows only the exact dispatcher for that worker mode. */
 function dispatcherTools(_mode, workersKey) {
 	return [`mcp__${workersKey}__*`];
 }
@@ -1736,6 +1739,270 @@ function listModelsForEndpoint(path) {
 	}).map((m) => m.id);
 }
 
+//#endregion
+//#region src/lib/orchestration/hook-mcp-client.ts
+/**
+* Read the proxy URL + nonce the launcher injected into the spawned child env
+* (`GH_ROUTER_HOOK_MCP_URL` / `GH_ROUTER_HOOK_NONCE`). Returns undefined when
+* either is absent — the hook then skips its LLM layer and falls back to its
+* deterministic / regex behavior.
+*/
+function hookMcpRuntimeFromEnv(env = process.env) {
+	const serverUrl = (env.GH_ROUTER_HOOK_MCP_URL ?? "").trim();
+	const nonce = (env.GH_ROUTER_HOOK_NONCE ?? "").trim();
+	if (serverUrl.length === 0 || nonce.length === 0) return void 0;
+	return {
+		serverUrl,
+		nonce
+	};
+}
+/**
+* POST a JSON-RPC `tools/call` and return the tool's text + isError. Throws on
+* any transport/HTTP/parse failure (caller fails open). A JSON-RPC `error`
+* envelope is mapped to `{ text: message, isError: true }` (a well-formed
+* negative result, not a transport failure).
+*/
+async function callMcpTool(opts) {
+	const body = await postJson(`${opts.runtime.serverUrl.replace(/\/+$/, "")}/mcp/${opts.group}`, {
+		jsonrpc: "2.0",
+		id: 1,
+		method: "tools/call",
+		params: {
+			name: opts.tool,
+			arguments: opts.args
+		}
+	}, {
+		timeoutMs: opts.timeoutMs,
+		signal: opts.signal,
+		headers: { Authorization: `Bearer ${opts.runtime.nonce}` }
+	});
+	const rpc = body && typeof body === "object" ? body : {};
+	if (rpc.error) return {
+		text: rpc.error.message ?? "MCP error",
+		isError: true
+	};
+	return {
+		text: (Array.isArray(rpc.result?.content) ? rpc.result.content : []).filter((p) => p && p.type === "text" && typeof p.text === "string").map((p) => p.text).join(""),
+		isError: rpc.result?.isError === true
+	};
+}
+/**
+* One non-streaming gpt-5.5 (or any model id) inference via `/v1/responses`.
+* Returns the assistant text (possibly empty). Throws on transport/HTTP/parse
+* failure. `effort` maps to the Responses `reasoning.effort` knob.
+*/
+async function callInference(opts) {
+	const body = await postJson(`${opts.serverUrl.replace(/\/+$/, "")}/v1/responses`, {
+		model: opts.model,
+		instructions: opts.instructions,
+		input: [{
+			role: "user",
+			content: [{
+				type: "input_text",
+				text: opts.input
+			}]
+		}],
+		stream: false,
+		reasoning: { effort: opts.effort }
+	}, {
+		timeoutMs: opts.timeoutMs,
+		signal: opts.signal
+	});
+	const out = [];
+	const items = Array.isArray(body?.output) ? body.output : [];
+	for (const item of items) {
+		if (item?.type !== "message" || item.role !== "assistant") continue;
+		const parts = Array.isArray(item.content) ? item.content : [];
+		for (const part of parts) if ((part?.type === "output_text" || part?.type === "text") && typeof part.text === "string") out.push(part.text);
+	}
+	return out.join("");
+}
+/**
+* POST `payload` as JSON with a hard timeout, returning the parsed JSON body.
+* Throws on non-2xx, network error, timeout (AbortController), or non-JSON body.
+* An external `signal` is honored alongside the internal timeout.
+*/
+async function postJson(url, payload, opts) {
+	const controller = new AbortController();
+	const timer = setTimeout$1(() => controller.abort(/* @__PURE__ */ new Error("hook MCP request timed out")), opts.timeoutMs);
+	const onExternalAbort = () => controller.abort(/* @__PURE__ */ new Error("hook MCP request aborted"));
+	if (opts.signal) if (opts.signal.aborted) onExternalAbort();
+	else opts.signal.addEventListener("abort", onExternalAbort, { once: true });
+	try {
+		const res = await fetch(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Accept: "application/json",
+				...opts.headers
+			},
+			body: JSON.stringify(payload),
+			signal: controller.signal
+		});
+		if (!res.ok) throw new Error(`hook MCP request failed: HTTP ${res.status}`);
+		return await res.json();
+	} finally {
+		clearTimeout$1(timer);
+		if (opts.signal) opts.signal.removeEventListener("abort", onExternalAbort);
+	}
+}
+
+//#endregion
+//#region src/lib/orchestration/plan-review-hook.ts
+/** Minimum finalized-plan size worth spending a model review on. */
+const PLAN_REVIEW_MIN_CHARS = 220;
+/** Hard wall-clock for the advisory plan critic. */
+const PLAN_REVIEW_TIMEOUT_MS = 25e3;
+/** Cap the plan embedded in the critic brief so a huge plan file cannot dominate. */
+const MAX_REVIEWED_PLAN_CHARS = 80 * 1024;
+/** Default-on advisory plan review. Opt out with GH_ROUTER_DISABLE_PLAN_REVIEW=1. */
+function planReviewEnabled(env = process.env) {
+	return parseBoolEnv(env.GH_ROUTER_DISABLE_PLAN_REVIEW) !== true;
+}
+/** File-backed per-session debounce for finalized plans, separate from Stop diff hashes. */
+function filePlanReviewDebounce(stateDir) {
+	const fileFor = (sid) => nodePath.join(stateDir, `plan-review-hash-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
+	const readLast = async (sid) => {
+		try {
+			return (await promises.readFile(fileFor(sid), "utf8")).trim();
+		} catch {
+			return "";
+		}
+	};
+	return {
+		async shouldReview(sid, planHash) {
+			if (planHash.length === 0) return false;
+			return await readLast(sid) !== planHash;
+		},
+		async markReviewed(sid, planHash) {
+			await promises.mkdir(stateDir, { recursive: true });
+			await promises.writeFile(fileFor(sid), planHash, { mode: 384 });
+		}
+	};
+}
+function parseObject(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	} catch {}
+}
+async function resolvePlanText(toolInput, readFile$1) {
+	if (!toolInput || typeof toolInput !== "object") return "";
+	const ti = toolInput;
+	const planFilePath = typeof ti.planFilePath === "string" && ti.planFilePath.trim().length > 0 ? ti.planFilePath.trim() : "";
+	if (planFilePath.length > 0) try {
+		const fromFile = await readFile$1(planFilePath);
+		if (fromFile.trim().length > 0) return fromFile;
+	} catch {}
+	return typeof ti.plan === "string" ? ti.plan : "";
+}
+/**
+* Decide whether the ExitPlanMode PostToolUse hook should spawn a detached review.
+* Pure aside from injected file reads + debounce store. Fail-open: any malformed
+* payload, missing runtime, subagent context, trivial/absent plan, or store error
+* returns a skip decision.
+*/
+async function decidePlanReviewHook(input) {
+	try {
+		if (!input.runtimeAvailable) return {
+			kind: "skip",
+			reason: "missing-runtime"
+		};
+		const payload = parseObject(input.stdin);
+		if (!payload) return {
+			kind: "skip",
+			reason: "bad-payload"
+		};
+		if (isSubagentContext(payload)) return {
+			kind: "skip",
+			reason: "subagent"
+		};
+		const sessionId = typeof payload.session_id === "string" && payload.session_id.length > 0 ? payload.session_id : "";
+		if (!sessionId) return {
+			kind: "skip",
+			reason: "missing-session"
+		};
+		const cwd = typeof payload.cwd === "string" && payload.cwd.length > 0 ? payload.cwd : input.fallbackCwd;
+		const trimmed = (await resolvePlanText(payload.tool_input, input.readFile ?? ((filePath) => promises.readFile(filePath, "utf8")))).trim();
+		if (trimmed.length < (input.minChars ?? PLAN_REVIEW_MIN_CHARS)) return {
+			kind: "skip",
+			reason: "trivial-plan"
+		};
+		const planHash = createHash("sha256").update(trimmed).digest("hex");
+		if (!await input.debounce.shouldReview(sessionId, planHash)) return {
+			kind: "skip",
+			reason: "debounced"
+		};
+		await input.debounce.markReviewed(sessionId, planHash);
+		return {
+			kind: "spawn",
+			sessionId,
+			cwd,
+			plan: trimmed,
+			planHash
+		};
+	} catch {
+		return {
+			kind: "skip",
+			reason: "error"
+		};
+	}
+}
+function reviewBrief(plan, cwd) {
+	const embeddedPlan = plan.length > MAX_REVIEWED_PLAN_CHARS ? `${plan.slice(0, MAX_REVIEWED_PLAN_CHARS)}\n\n[plan truncated at ${MAX_REVIEWED_PLAN_CHARS} characters]` : plan;
+	return `You are an independent plan reviewer. A coding agent has just finalized a plan with ExitPlanMode. Your job is to find load-bearing risks before implementation starts: unstated assumptions, missing failure modes, gaps in verification, dangerous sequencing, or places where the plan could satisfy the letter of the request while missing the user's likely intent.
+
+Be concise and skeptical. Do NOT rewrite the plan, do NOT praise it, and do NOT invent new product requirements. Report only material objections that would change what the agent should do next. Include file:line anchors when the plan names concrete files or when the risk depends on repo code. If the plan is sound, say exactly: "no material objection".
+
+Workspace: ${cwd}\n\nFINALIZED PLAN:
+` + embeddedPlan;
+}
+function hasMaterialFinding(text) {
+	const normalized = text.trim().toLowerCase().replace(/[.!]+$/g, "");
+	return normalized.length > 0 && normalized !== "no material objection" && normalized !== "no material objections";
+}
+function framePlanFindings(text) {
+	return "PLAN REVIEW: an independent cross-lab critic reviewed the finalized plan and found the following material concern(s).\n" + text.trim();
+}
+/** Run the bounded critic call and write material findings to the shared findings store. */
+async function runPlanReview(input) {
+	const timeoutMs = input.timeoutMs ?? PLAN_REVIEW_TIMEOUT_MS;
+	let timer;
+	const controller = new AbortController();
+	try {
+		const brief = reviewBrief(input.plan, input.cwd);
+		const review = (input.callReview ?? ((prompt, signal) => callMcpTool({
+			runtime: input.runtime,
+			group: "peers",
+			tool: "codex_critic",
+			args: {
+				prompt,
+				effort: "high"
+			},
+			timeoutMs,
+			signal
+		})))(brief, controller.signal);
+		review.catch(() => {});
+		const raced = await Promise.race([review, new Promise((resolve) => {
+			timer = setTimeout(() => resolve("timeout"), timeoutMs);
+		})]);
+		if (raced === "timeout" || raced.isError || !hasMaterialFinding(raced.text)) return;
+		const framed = framePlanFindings(raced.text);
+		const existing = await input.findingsStore.read(input.sessionId).catch(() => null);
+		const next = existing && existing.trim().length > 0 ? `${existing.trim()}\n\n${framed}` : framed;
+		await input.findingsStore.write(input.sessionId, next);
+	} catch {} finally {
+		if (timer) clearTimeout(timer);
+		controller.abort();
+	}
+}
+/** Build the command registered for PostToolUse(ExitPlanMode). */
+function buildPlanReviewHookCommand(execPath, scriptPath) {
+	const q = (s) => `"${s}"`;
+	if (scriptPath && scriptPath !== execPath) return `${q(execPath)} ${q(scriptPath)} internal-plan-review`;
+	return `${q(execPath)} internal-plan-review`;
+}
+
 //#endregion
 //#region src/lib/orchestration/harness-parse.ts
 /** The fast static checks that are always-on; `test` is opt-in (it runs project
@@ -2289,7 +2556,7 @@ async function discoverGateCommands(cwd, opts) {
 	if (files.length === 0) return null;
 	let result;
 	try {
-		const { runWorkerAgent } = await import("./engine-DHFa2_hK.js");
+		const { runWorkerAgent } = await import("./engine-cUomEg92.js");
 		result = await runWorkerAgent({
 			mode: "explore",
 			workspace: root,
@@ -2350,9 +2617,9 @@ function decidePromptSubmit(input) {
 	return decision;
 }
 /**
-* Static encouragement injected for a TRIVIAL prompt (no model call, no latency
-* tax): nudge parallel lexical+semantic search before concluding. Mirrors the v1
-* advisory tone — additive, never blocking.
+* Static encouragement injected only for a non-trivial prompt (no extra model
+* call, no latency tax): nudge parallel lexical+semantic search before
+* concluding. Mirrors the v1 advisory tone: additive, never blocking.
 */
 const PROMPT_SEARCH_TIP = "TIP (advisory): when this task needs code context, search lexical + semantic in parallel — one `mcp__search__code` call with mode:\"lexical\" and one with mode:\"semantic\", issued in the same turn — before concluding.";
 /** System prompt for the single gpt-5.5 scope/goal inference. Steers a SHORT,
@@ -2375,8 +2642,8 @@ function joinSections(sections) {
 *
 *   - subagent/teammate  -> empty (top-level only, like v1).
 *   - findings           -> always surfaced (+ cleared) regardless of triviality.
-*   - trivial prompt     -> static search tip only (no model call).
-*   - substantive prompt -> parallel lexical+semantic search -> ONE gpt-5.5 call
+*   - trivial prompt     -> findings only (no search tip, no model call).
+*   - substantive prompt -> static search tip + parallel lexical+semantic search -> ONE gpt-5.5 call
 *                           -> grounded scope/goal note. Fail-open to PROMPT_STEER_GOAL.
 *   - steerEnabled=false -> findings only (no goal/tip).
 */
@@ -2407,7 +2674,7 @@ async function decidePromptSubmitV2(input) {
 		return decision;
 	}
 	if (!isNonTrivialPrompt(prompt)) {
-		decision.inject = joinSections([PROMPT_SEARCH_TIP, findingsBlock]);
+		decision.inject = findingsBlock;
 		return decision;
 	}
 	const timeoutMs = input.io.timeoutMs ?? 22e3;
@@ -2429,7 +2696,11 @@ async function decidePromptSubmitV2(input) {
 		if (timer) clearTimeout(timer);
 		controller.abort();
 	}
-	decision.inject = joinSections([goal, findingsBlock]);
+	decision.inject = joinSections([
+		PROMPT_SEARCH_TIP,
+		goal,
+		findingsBlock
+	]);
 	return decision;
 }
 /**
@@ -2443,13 +2714,117 @@ function buildPromptSubmitHookCommand(execPath, scriptPath) {
 	return `${q(execPath)} internal-prompt-submit`;
 }
 
+//#endregion
+//#region src/lib/first-mate/operator-shaping.ts
+/** MCP prefixes denied to the main operator; these remain subagent-only. */
+const OPERATOR_DENIED_MCP_PREFIXES = ["mcp__workers__", "mcp__orchestrate__"];
+/**
+* Decide whether a tool call must be blocked for the main operator. Pure — used
+* both by the PreToolUse hook handler and by config-assertion tests. When
+* operator mode is off, nothing is blocked (normal sessions unaffected).
+*/
+function parseWorkerMode(toolName) {
+	if (!toolName.startsWith("mcp__workers__")) return null;
+	const mode = toolName.slice(14);
+	return ALL_WORKER_DISPATCH_MODES.includes(mode) ? mode : null;
+}
+function isMatchingWorkerDispatcher(toolName, input) {
+	const mode = parseWorkerMode(toolName);
+	if (mode === null) return false;
+	return input?.agent_type === dispatcherAgentName(mode);
+}
+function shouldDenyOperatorTool(toolName, operatorMode, input) {
+	if (!operatorMode) return false;
+	if (isMatchingWorkerDispatcher(toolName, input)) return false;
+	return OPERATOR_DENIED_MCP_PREFIXES.some((prefix) => toolName.startsWith(prefix));
+}
+/**
+* M4 — fail-CLOSED. If operator/`--agents` mode is active but the reduced
+* worker/orchestrate guard could NOT be installed (e.g. settings.json unwritable),
+* the operator session must NOT start with direct main-thread worker/orchestrate
+* MCP calls available. Non-agents sessions are never affected.
+*/
+function assertShapingInstalled(agentsMode, injectionSucceeded) {
+	if (agentsMode && !injectionSucceeded) throw new Error("cloud-agent operator mode requires the worker/orchestrate PreToolUse hook, but it could not be installed — refusing to start an unguarded operator session.");
+}
+/**
+* The PreToolUse hook decision for a given tool name in operator mode.
+*
+* Bash and file-authoring tools are always allowed. Only direct main-operator
+* calls to local worker/orchestrate MCP tools are blocked so those backends stay
+* reachable through the worker-* Agent subagents rather than the lead context.
+*/
+function operatorPreToolUse(toolName, operatorMode, input) {
+	if (!operatorMode) return { block: false };
+	if (shouldDenyOperatorTool(toolName, operatorMode, input)) return {
+		block: true,
+		reason: `${toolName} is subagent-only in cloud-agent operator mode — use the worker-* Agent subagents or delegate implementation to a GitHub cloud agent via the first-mate MCP instead of calling local worker/orchestrate MCP tools from the main operator.`
+	};
+	return { block: false };
+}
+
+//#endregion
+//#region src/internal-first-mate-guard.ts
+function readStdinSync() {
+	try {
+		return readFileSync(0, "utf8");
+	} catch {
+		return "";
+	}
+}
+const internalFirstMateGuard = defineCommand({
+	meta: {
+		name: "internal-first-mate-guard",
+		description: "PreToolUse guard enforcing cloud-agent operator capability shaping."
+	},
+	run() {
+		let toolName = "";
+		let hookInput;
+		let parsed = false;
+		try {
+			const payload = JSON.parse(readStdinSync());
+			if (typeof payload.tool_name === "string") toolName = payload.tool_name;
+			if (typeof payload.agent_type === "string") hookInput = { agent_type: payload.agent_type };
+			parsed = true;
+		} catch {
+			parsed = false;
+		}
+		if (toolName.length === 0) {
+			if (!parsed) {
+				process.stderr.write("operator guard: unparseable PreToolUse payload — blocking (fail-closed)");
+				process.exit(2);
+			}
+			process.exit(0);
+		}
+		const decision = operatorPreToolUse(toolName, true, hookInput);
+		if (decision.block) {
+			process.stderr.write(decision.reason ?? `${toolName} is disabled in operator mode`);
+			process.exit(2);
+		}
+		process.exit(0);
+	}
+});
+/** The regex matcher scoping the guard hook to exactly the denied tools. */
+const FIRST_MATE_GUARD_MATCHER = "mcp__workers__.*|mcp__orchestrate__.*";
+/** Build the hook command string that runs this subcommand. */
+function buildFirstMateGuardHookCommand(execPath, entry) {
+	return `${JSON.stringify(execPath)} ${JSON.stringify(entry)} internal-first-mate-guard`;
+}
+
+//#endregion
+//#region src/lib/injected-skills/first-mate-setup-skill.ts
+const FIRST_MATE_SETUP_SKILL = {
+	name: "gh-first-mate-scaffold",
+	md: "---\nname: gh-first-mate-scaffold\ndescription: Scaffolds a repo-geared agentic-dev foundation through first-mate: seeds guidance files, role agents, ADRs, changelog, learnings, PR template, test instructions, Copilot setup, and CI through a scaffold branch and PR. Use before the first build wave on an owned repository.\nuser-invocable: true\n---\n\n# gh-first-mate-scaffold\n\nInvoke the `scaffold_repo` MCP tool (`mcp__first-mate__scaffold_repo`) before the first build wave on an owned repository. The goal is not generic TODO stubs; it is a repo-geared foundation that GitHub agents, local agents, reviewers, and CI can read.\n\n## What it seeds\n\n- `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / `.github/copilot-instructions.md` — identical guidance with overview, detected stack, commands, hard DoD gate, primary OS, conventions, structure, decisions/memory, handoff, testing, and gotchas.\n- `.github/agents/{planner,implementer,reviewer,researcher,tester}.md` mirrored into `.claude/agents/` — role agents with frontmatter, cold-start contract, method, quality bar, output contract, and self-reminder.\n- `docs/adrs/0000-template.md` plus `docs/adr/0001-record-architecture-decisions.md` — Nygard-style decision record foundation.\n- `LEARNINGS.md`, `CHANGELOG.md`, `docs/history/0000-template.md`, `docs/plans/README.md`, and `docs/research/README.md` — durable memory, history, plans, and research conventions.\n- `.github/pull_request_template.md` — summary, type, failure-modes-considered-and-tested, and DoD checklist.\n- `.github/instructions/tests.instructions.md` — path-scoped test guidance filled from detected framework/dir/glob where possible.\n- `.github/workflows/copilot-setup-steps.yml` and starter `.github/workflows/ci.yml` — detected toolchain setup with stable quality-gate job names.\n\nIt does not seed factory-protocol or `docs/factory/` files. Orchestration remains outside the product repo in first-mate.\n\n## Usage\n\n```\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\" })\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\", mode: \"enhance\" })\nmcp__first-mate__scaffold_repo({\n  repo: \"owner/repo\",\n  mode: \"add-missing-only\",\n  detection_overrides: { primary_os: \"windows-latest\", test_command: \"npm test\" }\n})\n```\n\nModes:\n\n- `add-missing-only` (default): seed absent files and skip present files.\n- `enhance`: for guidance files, ADR index, changelog, and learnings, append only missing `##` sections; never rewrite existing prose. Other present files are skipped.\n- `overwrite-approved`: replace existing files only when explicitly approved.\n\nAlways inspect the returned per-file report and PR. A no-op result means the repo already has the foundation or has no missing enhanceable sections.\n"
+};
+
 //#endregion
 //#region src/lib/injected-skills/first-mate-skill.ts
 const FIRST_MATE_SKILL = {
 	name: "gh-first-mate",
 	md: `---
 name: gh-first-mate
-description: Thin operating protocol for the first-mate GitHub cloud-agent controller: start missions, wake the durable controller loop, answer model and human requests, keep context compact, and report from the board/ledger rather than rereading full diffs or logs.
+description: Thin operating protocol for the first-mate GitHub cloud-agent controller: starts missions, wakes the durable loop, answers model and human requests, keeps context compact, and reports from the board/ledger. Use when the user wants first-mate to drive GitHub cloud coding agents across one or more repositories with foundation-first scaffolding and scoped, testable work.
 user-invocable: true
 ---
 
@@ -2459,6 +2834,18 @@ Use this skill when the user wants first-mate to drive GitHub cloud coding agent
 The first-mate controller is the durable system of record: missions, units, decisions, handles, and controller state live in its registry and ledger.
 Your job is to run the thin protocol, not to hold the mission in context.
 
+## Foundation-first mandate
+
+Before the first build wave on an owned repository, run \`mcp__first-mate__scaffold_repo\` and verify the PR landed or is already present. The scaffold must seed a repo-geared foundation that GitHub agents and CI can read: guidance, role agents, ADRs, changelog, learnings, PR template, test instructions, Copilot setup, and CI. Do not seed factory-protocol files into product repos; first-mate is the external orchestrator.
+
+Use \`mode: "add-missing-only"\` for new repos, \`mode: "enhance"\` when a repo has existing guidance that should keep its prose while appending missing \`##\` sections, and \`mode: "overwrite-approved"\` only with explicit approval.
+
+## Scoped-work discipline
+
+Well-scoped, testable work items succeed; vague meta-work fails. Discovery/decompose must emit concrete units with acceptance criteria, expected evidence, and dependencies. Keep one active build unit per concern. Parallelism is for read-only producers (research, review, planning) and independent units only, not for racing broad implementation waves.
+
+Judgment and merge policy: merge remains human-gated, evidence-gated, and head/base-bound. Use the best available model tier for plan review, judgment, and merge decisions; never cheap out on plan/judge/merge calls.
+
 ## Start a mission
 
 For a new goal, call mcp__first-mate__start_mission with:
@@ -2469,7 +2856,7 @@ For a new goal, call mcp__first-mate__start_mission with:
 - priority and house_rules only when the user supplied them or they are necessary constraints.
 
 If acceptance criteria are missing or ambiguous, ask the user before starting.
-Do not decompose the mission yourself at start time; v1 mission registration is intentionally simple and later controller wakes/model requests drive decomposition and steering.
+Do not decompose the mission yourself at start time; mission registration is intentionally simple and later controller wakes/model requests drive decomposition and steering. If the user explicitly asks to append scoped work to an existing active mission, use mcp__first-mate__add_units with concrete unit titles.
 
 Invariant (closes the stranding hole): work only ever becomes active inside a turn — start_mission is a tool call, nothing activates a mission server-side. So immediately after start_mission, run one loop turn (advance, then arm the heartbeat) in the SAME turn, before you yield. Never register a mission and stop without arming; otherwise nothing will wake to drive it.
 
@@ -2496,6 +2883,7 @@ Keep verdicts small and typed to the request kind.
 
 Use the request's kind and payload as the contract:
 
+- decompose: split a unit-less active mission into dispatchable units. Return { units: [{ title, repo?, agent?, dependsOn?, model? }] }. \`dependsOn\` entries are 0-based indices into the same units list. Emit once per unit-less active mission; the controller creates durable unit ids and will not ask again after units exist.
 - review_plan: review the plan against the mission goal, acceptance criteria, and house rules. Return { decision: "approve" } when the plan is good enough to implement, or { decision: "refine", instruction: "..." } with a short actionable refinement.
 - answer_agent_question: answer only from the acceptance criteria and supplied context. Return { answer: "..." }. If the answer is not derivable, do not invent policy; escalate by leaving a short answer that says what the human must decide.
 - author_fix: author a concise fix instruction for the cloud agent. Return { instruction: "..." } with the failure, expected behavior, and any bounded check to run.
@@ -2507,6 +2895,8 @@ Delegate heavy reading to workers:
 - Use the worker-review subagent (Agent tool) for compact review of a specific plan, PR summary, or suspicious change.
 - Use the worker-test subagent (Agent tool) when a missing executable check is the blocker.
 
+Operator / --agents mode constraint: delegate product implementation to GitHub cloud agents. Direct \`mcp__workers__*\` / \`mcp__orchestrate__*\` calls are subagent-only for the main operator; use the worker-* Agent subagents when local worker help is genuinely needed. Local tools (Edit/Write/Bash, \`gh\`, \`git\`) remain available, but prefer authoring fix instructions for the cloud agent rather than pulling large diffs or CI logs into the lead context.
+
 Do not read a full diff, full CI log, or full transcript in the lead context. Ask workers for narrow facts and compact excerpts. The ledger is durable memory; context is not.
 
 ## Human requests
@@ -2540,6 +2930,8 @@ Responsiveness (optional): the buckets above already tighten cadence to ~2 min f
 
 Guardrails: never leave more than one [fm-heartbeat] job; never busy-loop advance; if no scheduler tool is available, tell the user the next wake is in nextWakeSeconds seconds and stop.
 
+MCP unavailable: if the first-mate MCP server is not present (this is not a \`--agents\` session and \`mcp__first-mate__advance\` would return a tool-not-found error), do NOT attempt to advance. CronList then CronDelete every [fm-heartbeat] job (same as Disarm above), and report "first-mate paused — re-run under \`github-router claude --agents\` to resume." Stop without further action.
+
 ## Board reports
 
 Use mcp__first-mate__board or mcp__first-mate__mission_status for read-only status checks.
@@ -2549,6 +2941,9 @@ Report compactly:
 - repositories
 - phase counts
 - blocked count and why, when available
+- per-unit handles for non-terminal units: unitId, issue/PR, phase, provider, validation, model, and blockedReason when present
+- resolved cloud-agent model per unit (surfaced on the board — verify model choice before approving plans)
+- terminal work only as summary counts; use include_all only when the user asks for completed/abandoned history
 - next wake time or the next requested action
 
 Never reconstruct status by rereading raw logs when the controller board already has the handles.
@@ -2580,7 +2975,7 @@ const FLOOR_KEEPER_SKILL = {
 	name: "gh-floor-keeper",
 	md: `---
 name: gh-floor-keeper
-description: Done-checkpoint verification for non-trivial changes: run the executable gate, send the diff to OpenAI and Google reviewers, consult the advisor, reconcile findings by severity, author missing tests through a different lab when bounded and appropriate, and return an honest go/no-go before declaring work complete.
+description: Done-checkpoint verification for non-trivial changes: runs the executable gate, sends the diff to OpenAI and Google reviewers, consults the advisor, reconciles findings by severity, authors missing tests through a different lab when bounded and appropriate, and returns an honest go/no-go. Use before declaring non-trivial work complete.
 user-invocable: true
 ---
 
@@ -2731,7 +3126,7 @@ const ORCHESTRATE_SKILL = {
 	name: "gh-orchestrate",
 	md: `---
 name: gh-orchestrate
-description: Right-sized blind-spot-elimination for non-trivial implementation asks: capture user-blessed acceptance criteria, delegate bounded research, decompose and plan, compose a native Workflow with explicit deterministic/advisory annotations, verify the workflow, checkpoint residual risks and cost, then run only when the pipeline actually raises the floor.
+description: Right-sized blind-spot-elimination for non-trivial implementation asks: captures user-blessed acceptance criteria, delegates bounded research, decomposes and plans, composes a native Workflow with explicit deterministic/advisory annotations, verifies the workflow, checkpoints residual risks and cost, then runs only when the pipeline actually raises the floor. Use when a non-trivial implementation ask benefits from workflow-level blind-spot reduction.
 user-invocable: true
 ---
 
@@ -2870,7 +3265,7 @@ const RESEARCH_SKILL = {
 	name: "gh-research",
 	md: `---
 name: gh-research
-description: Bounded saturation research for non-trivial GitHub Router asks: enumerate unknowns, gather in parallel through code search, web search, and explore workers, adversarially verify load-bearing claims, persist a freshness-stamped brief, and return a compact confidence-tagged root-cause summary when you need grounded context before planning or changing code.
+description: Bounded saturation research for non-trivial GitHub Router asks: enumerates unknowns, gathers in parallel through code search, web search, and explore workers, adversarially verifies load-bearing claims, persists a freshness-stamped brief, and returns a compact confidence-tagged root-cause summary. Use when grounded context is needed before planning or changing code.
 user-invocable: true
 ---
 
@@ -2989,7 +3384,7 @@ const WORKER_SKILL = {
 	name: "gh-worker",
 	md: `---
 name: gh-worker
-description: How to run github-router workers without blocking your turn. Workers (explore/implement/review/plan/test) can run up to 6 hours; dispatch the matching worker-* background subagent so you get a completion notification instead of waiting. Use whenever you would reach for a worker.
+description: Runs github-router workers without blocking the turn: dispatches the matching worker-* background subagent (explore/implement/review/plan/test, up to 6 hours each) for a completion notification instead of a blocking wait. Use when a task would benefit from a background worker for investigation, planning, review, implementation, or test authoring.
 user-invocable: true
 ---
 
@@ -3043,7 +3438,7 @@ const ARTIFACT_REVIEW_SKILL = {
 	name: "gh-artifact-review",
 	md: `---
 name: gh-artifact-review
-description: Review plans and artifacts in the ai-or-die panel. Default to authoring a self-contained HTML artifact (rich, annotatable, optionally interactive) and opening THAT for the human, then drain feedback with artifact_await, revise, and end the loop. Use when running inside an ai-or-die tab and you have a plan, comparison, diagram, table, diff, or report the user should see before proceeding.
+description: Reviews plans and artifacts in the ai-or-die panel. Defaults to authoring a self-contained HTML artifact (rich, annotatable, optionally interactive) and opening THAT for the human, then drains feedback with artifact_await, revises, and ends the loop. Use when running inside an ai-or-die tab and there is a plan, comparison, diagram, table, diff, or report the user should see before proceeding.
 user-invocable: true
 ---
 
@@ -3134,7 +3529,12 @@ const TOOLBELT_MARKER_OPEN = "<!-- gh-router toolbelt awareness — auto-injecte
 const TOOLBELT_MARKER_CLOSE = "<!-- /gh-router toolbelt awareness -->";
 const ARTIFACT_MARKER_OPEN = "<!-- gh-router artifact-panel directive — auto-injected when in an ai-or-die tab -->";
 const ARTIFACT_MARKER_CLOSE = "<!-- /gh-router artifact-panel directive -->";
-const ARTIFACT_PANEL_DIRECTIVE = "## Review in the artifact panel (HTML by default)\n\nYou are running inside an ai-or-die tab, so the `mcp__peers__artifact_*` tools drive a live human-review panel. Default to an HTML artifact for anything the user should review before you proceed, not just plans but also design proposals, comparisons / trade-offs, decisions that need their input, diagrams, tables, code diffs, and reports. Author a self-contained `.html` (inline CSS, no external deps, readable typography) and open it with `mcp__peers__artifact_open` (pass `mode:\"interactive\"` if it carries `data-aod-*` action controls); tell the user to review, then drain their feedback with `mcp__peers__artifact_await` (pass back the returned `cursor` each call), revise, `mcp__peers__artifact_reply`, and `mcp__peers__artifact_end` when done. `artifact_await` returns typed events: `comment` (free-text anchored by selector/text/sourceLine) and `action` (the human clicked a control you emitted). Use `mcp__peers__artifact_update`/`artifact_refresh` to change the shown content and `mcp__peers__artifact_dismiss` to hide the panel while keeping the review alive. `mcp__peers__artifact_poll` is a frozen legacy alias (comments only). Plan-mode plans are auto-rendered to HTML and auto-opened for you; raw markdown is only a fallback. Skip the panel only for trivial one-line answers.\n\nMake the HTML good: match the subject project's design system (its Tailwind / theme / tokens) when the artifact represents a specific app, otherwise clean readable defaults. Per-type cheatsheet. plan: goal, current state, proposed approach, risks / open questions. comparison: options as columns with trade-off rows and a recommendation. table: scannable rows with a sticky header. diagram: boxes + arrows (SVG/CSS or Mermaid). code / diff: `<pre>` with before/after. To let the user act (not just comment), emit declarative controls (no JS): `data-aod-action` (verb) + `data-aod-id` (stable) [+ `data-aod-value`] — a choose-one option fires on click, a multi-select is checkboxes sharing `data-aod-group` plus a submit button with that group. The `gh-artifact-review` skill carries the fuller playbook.";
+function ARTIFACT_PANEL_DIRECTIVE(peersKey = "peers") {
+	const toolPrefix = `mcp__${peersKey}__artifact_`;
+	return `## Review in the artifact panel (HTML by default)
+
+You are running inside an ai-or-die tab, so the \`${toolPrefix}*\` tools drive a live human-review panel. Default to opening a self-contained HTML artifact for anything the user should review before you proceed: plans, design proposals, comparisons / trade-offs, decisions that need their input, diagrams, tables, code diffs, and reports. Plan-mode plans are auto-rendered to HTML and opened for you; skip the panel only for trivial one-line answers. Run the \`gh-artifact-review\` skill for the full playbook: HTML + design conventions, the \`${toolPrefix}open\` / \`${toolPrefix}await\` (pass back the \`cursor\`) / \`${toolPrefix}reply\` / \`${toolPrefix}end\` loop, and the \`data-aod-*\` interactive controls.`;
+}
 /**
 * Writing / communication style directive injected at the TOP of the
 * mirrored CLAUDE.md so every spawned agent (main, Agent-tool subagent,
@@ -3145,27 +3545,45 @@ const ARTIFACT_PANEL_DIRECTIVE = "## Review in the artifact panel (HTML by defau
 */
 const STYLE_DIRECTIVE = "Write concisely without losing detail. Use a natural human voice. Avoid em dashes. Do not attribute work to Claude, AI, LLM, or Anthropic anywhere (commits, PRs, issues, code, comments, docs).";
 /**
-* Operating-defaults directive injected at the TOP of the mirrored CLAUDE.md
-* AND into the main agent's system prompt (`--append-system-prompt`), so it is
-* the highest-salience behavioral default. Two defaults, both explicitly
-* overridden by the user's own direction and the domain's standards:
+* Operating-defaults directive injected at the TOP of the mirrored CLAUDE.md.
+* The main agent's system prompt (`--append-system-prompt`) gets
+* OPERATING_DEFAULTS_DIGEST instead, with this full statement available through
+* CLAUDE.md. Three defaults, each explicitly overridden by the user's own
+* direction and the domain's standards:
 *
 *   1. Orchestrate (strong default): delegate the heavy / parallel /
 *      context-heavy work to the right subagent / worker / model, keeping the
 *      main context free to reason and collaborate with the user, while still
 *      doing trivial / surgical / last-mile work directly (delegating that
 *      would only add relay-fidelity loss + latency).
-*   2. Excellence lens (HYBRID per the peer review): the reliable control
-*      signal is the PRINCIPLE stated plainly; the well-known names appear only
-*      as a "bar to clear" calibration, NOT as "channel X", with an explicit
-*      no-impersonation / no-theatrics guardrail (cross-lab critics: a named
-*      entity is a dense, high-variance vector that pulls in noise + persona
-*      mannerisms at top salience, so the principle leads and the name calibrates).
+*   2. Excellence lens: the principles stated plainly and concretely (radical
+*      simplicity + real-user focus; whole-system first-principles thinking that
+*      anticipates scale; work back from the customer outcome). Named exemplars
+*      were dropped per the injected-surface review: a named entity is a dense,
+*      high-variance vector that pulls in persona mannerisms at top salience, and
+*      the guidance favors specific functional framing over comparison, so
+*      specificity carries the vividness instead.
+*   3. Engineering excellence: quality / robustness / maintainability over
+*      development cost; reproduce a bug end-to-end (as a real user hits it)
+*      before fixing so the fix targets the real cause; a pixel-perfect UI bar;
+*      and fix any lint error / test failure / flake on sight, whoever caused it,
+*      folded into the current work rather than derailing the user's task (the
+*      scope guardrail keeps proactive quality from becoming yak-shaving). The
+*      digest carries a one-line form; the full statement lives here so it does
+*      not cost the context window every turn.
 *
 * Self-referentially compliant with the style directive: no em dashes, no
 * Claude / Anthropic attribution.
 */
-const OPERATING_DEFAULTS_DIRECTIVE = "## Operating defaults (apply when the user has not specified otherwise; the user's explicit direction and the domain's own standards always override)\n\nOrchestrate. Delegate research, implementation, review, and large reads to the right subagent, worker, or model (worker-* agents for background non-blocking runs, Task subagents for parallel work, peer critics for review) so your own context stays free to reason and collaborate with the user. Prefer parallel delegation for independent work. Do trivial, surgical, and last-mile work directly; delegate the rest rather than doing it yourself and filling your own context.\n\nAim high. Default to radical simplicity and relentless focus on the user's real experience (the Jobs and Ive bar for design), whole-systems first-principles thinking that anticipates scale and the long arc (the Gates bar for architecture and tech), and customer obsession that works backwards from the outcome (the Bezos bar for product and business). Question every assumption and prefer what you can derive, reproduce, or test. Adopt the principles, not a persona: no impersonation, name-dropping, or theatrics.";
+const OPERATING_DEFAULTS_DIRECTIVE = "## Operating defaults (apply when the user has not specified otherwise; the user's explicit direction and the domain's own standards always override)\n\nOrchestrate. Delegate research, implementation, review, and large reads to the right subagent, worker, or model (worker-* agents for background non-blocking runs, Task subagents for parallel work, peer critics for review) so your own context stays free to reason and collaborate with the user. Prefer parallel delegation for independent work. Do trivial, surgical, and last-mile work directly; delegate the rest rather than doing it yourself and filling your own context.\n\nAim high. Default to radical simplicity and a relentless focus on the user's real experience: design for the person and the job to be done, not the demo. Reason about the whole system from first principles, anticipating scale and the long arc rather than patching the surface. Work backwards from the outcome the user actually needs. Question every assumption and prefer what you can derive, reproduce, or test.\n\nEngineering excellence. When making technical decisions, give little weight to development cost; prefer quality, simplicity, robustness, scalability, and long-term maintainability. Fix a bug by first reproducing it end to end, as close to how a real user hits it as you can, so you solve the real problem and not a symptom. When testing a product end to end, be picky about the UI and obsessed with pixel perfection: if something clearly looks off, even when it is unrelated to your task, get it fixed along the way. Hold that same bar for the codebase itself: a lint error, a failing test, or a flaky test is worth fixing the moment you see it, whoever introduced it. Fold it into your current work rather than letting it derail the task the user actually asked for.";
+/**
+* Condensed digest of OPERATING_DEFAULTS_DIRECTIVE for the spawned session's
+* system prompt (--append-system-prompt). The FULL directive is prepended to
+* the mirrored CLAUDE.md (read by the main agent and descendants); this digest
+* keeps both behavioral directives at top salience without duplicating the full
+* ~310-token block in the context window every turn. Points to the full copy.
+*/
+const OPERATING_DEFAULTS_DIGEST = "## Operating defaults (the user's explicit direction and the domain's standards always override)\n\nOrchestrate: delegate research, implementation, review, and large reads to the right subagent, worker, or model, preferring parallel delegation for independent work, so your own context stays free to reason and collaborate with the user; do trivial, surgical, and last-mile work directly. Aim high: default to radical simplicity and the user's real experience, whole-system first-principles thinking that anticipates scale and the long arc, and working backwards from the outcome the user actually needs; question every assumption and prefer what you can derive, reproduce, or test. Engineering excellence: prefer quality and long-term maintainability over dev cost; reproduce bugs end to end before fixing; keep a pixel-perfect UI bar; fix any lint, test failure, or flake on sight without letting it derail the task at hand. The full statement of these defaults is in your CLAUDE.md project instructions.";
 /**
 * Skip the helper if the user's `~/.claude/CLAUDE.md` (or, equivalently,
 * the would-be post-write file) has grown past this size.
@@ -3506,10 +3924,11 @@ async function prependStyleDirectiveToMirroredClaudeMd(directive = STYLE_DIRECTI
 /**
 * Prepend the operating-defaults directive (orchestrator posture + hybrid
 * excellence lens; `OPERATING_DEFAULTS_DIRECTIVE` above) to the TOP of the
-* mirrored CLAUDE.md so descendant agents (Agent subagents, agent-teams
-* teammates) inherit it. The main agent gets the same text at higher salience
-* via `--append-system-prompt`. Separate marker fence from the style / peer
-* blocks so all coexist; best-effort (warn-and-continue) like its siblings.
+* mirrored CLAUDE.md so the main agent and descendant agents (Agent subagents,
+* agent-teams teammates) inherit the full statement. The main agent also gets
+* OPERATING_DEFAULTS_DIGEST at higher salience via `--append-system-prompt`.
+* Separate marker fence from the style / peer blocks so all coexist;
+* best-effort (warn-and-continue) like its siblings.
 */
 async function prependOperatingDefaultsToMirroredClaudeMd(directive = OPERATING_DEFAULTS_DIRECTIVE) {
 	await injectMarkerBlock({
@@ -3523,8 +3942,9 @@ async function prependOperatingDefaultsToMirroredClaudeMd(directive = OPERATING_
 /**
 * Append the toolbelt awareness one-liner (which CLI tools are on PATH)
 * to the bottom of the mirrored CLAUDE.md so descendant agents (Agent
-* subagents, agent-teams teammates) learn about the provisioned tools.
-* The main agent gets the same line via `--append-system-prompt`.
+* subagents, agent-teams teammates) and the main agent learn about the
+* provisioned tools via the mirrored CLAUDE.md. This line is not sent via
+* `--append-system-prompt`.
 * Separate marker fence from the peer-awareness / style blocks.
 */
 async function appendToolbeltAwarenessToMirroredClaudeMd(snippet) {
@@ -3542,9 +3962,9 @@ async function appendToolbeltAwarenessToMirroredClaudeMd(snippet) {
 * Gated by the caller on AIORDIE_SESSION_ID (only useful inside a tab). Separate
 * marker fence; best-effort like the style/peer blocks.
 */
-async function prependArtifactPanelDirectiveToMirroredClaudeMd(directive = ARTIFACT_PANEL_DIRECTIVE) {
+async function prependArtifactPanelDirectiveToMirroredClaudeMd(peersKey = "peers") {
 	await injectMarkerBlock({
-		snippet: directive,
+		snippet: ARTIFACT_PANEL_DIRECTIVE(peersKey),
 		markerOpen: ARTIFACT_MARKER_OPEN,
 		markerClose: ARTIFACT_MARKER_CLOSE,
 		position: "top",
@@ -3613,9 +4033,75 @@ const INJECTED_SKILLS = [
 	ORCHESTRATE_SKILL,
 	FLOOR_KEEPER_SKILL,
 	WORKER_SKILL,
-	FIRST_MATE_SKILL
+	FIRST_MATE_SKILL,
+	FIRST_MATE_SETUP_SKILL
 ];
 
+//#endregion
+//#region src/lib/attribution-settings.ts
+/**
+* Deterministic backstop for the injected "no attribution" style directive.
+*
+* github-router injects a CLAUDE.md style directive telling the agent not to
+* attribute work to Claude / AI / Anthropic. That directive is ADVISORY (prose
+* the model may or may not follow). Claude Code also exposes a HARNESS-ENFORCED
+* control that suppresses attribution at the source: the `attribution`
+* settings.json key (Claude Code v2.0.62+; string `commit` / `pr` sub-fields),
+* which supersedes the deprecated boolean `includeCoAuthoredBy`. Setting both
+* sub-fields to the empty string removes the "Generated with Claude Code"
+* commit footer and the "Co-Authored-By: Claude" byline from commits and PRs.
+* Because the harness reads and applies this itself, it holds even when the
+* model ignores the prose directive — a deterministic backstop, not a second
+* suggestion.
+*
+* PRESENCE-GUARDED. If the mirrored settings already carry `attribution` OR
+* `includeCoAuthoredBy`, the user expressed a deliberate preference in their
+* real config (which the one-way mirror snapshotted); we DO NOT override it.
+* Only a user who has expressed no preference receives github-router's
+* no-attribution default. This keeps faith with "the user's explicit direction
+* always overrides".
+*
+* The mirror is a per-launch snapshot of the user's real `~/.claude` config, so
+* this write never propagates back to the user's own settings.json. A
+* project-scope `<repo>/.claude/settings.json` still overrides the mirror
+* (global scope) at runtime, so the default remains overridable per-repo.
+*
+* Failure model matches the sibling settings writers: a transient read error
+* or a non-object settings.json throws (never clobber a file we don't
+* understand); the caller wraps this in warn-and-continue so a settings-write
+* hiccup never blocks launch.
+*/
+async function injectAttributionSuppressionIntoSettingsFile(settingsPath) {
+	let existing = {};
+	let raw;
+	try {
+		raw = await fs.readFile(settingsPath, "utf8");
+	} catch (err) {
+		if (err.code !== "ENOENT") throw err;
+		raw = void 0;
+	}
+	if (raw !== void 0) {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) existing = parsed;
+		else throw new Error(`settings.json at ${settingsPath} is not a JSON object; refusing to overwrite`);
+	}
+	if ("attribution" in existing || "includeCoAuthoredBy" in existing) return {
+		written: false,
+		reason: "user-set"
+	};
+	const merged = {
+		...existing,
+		attribution: {
+			commit: "",
+			pr: ""
+		}
+	};
+	const tmp = `${settingsPath}.${process.pid}.attr.tmp`;
+	await fs.writeFile(tmp, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+	await fs.rename(tmp, settingsPath);
+	return { written: true };
+}
+
 //#endregion
 //#region src/lib/toolbelt/provision.ts
 /** Per-download cap (bytes) — these binaries are a few MB at most. */
@@ -4046,6 +4532,141 @@ async function stopKeepAwake() {
 	releaseSync();
 }
 
+//#endregion
+//#region src/lib/first-mate/scheduler/autospawn.ts
+/**
+* Opt-in auto-spawn of the first-mate scheduler daemon as a SEPARATE process
+* (a hung tick must not starve the proxy event loop).
+*
+* DEFAULT OFF — gated by GH_ROUTER_FM_DAEMON === "1" (explicit opt-in). The
+* durable [fm-heartbeat] cron is the DEFAULT driver and the proven path; the
+* daemon is experimental and NOT yet safe as the default because two hardening
+* items remain (a verifier-stall wall-clock escalation, and an atomic-claim
+* lock in durable-store) — flip the default only once those land.
+*
+* Requirements + honest boundaries:
+*  - The daemon entry is `scripts/first-mate-daemon.ts` (a TS source file run via
+*    `bun`); it is NOT in the published dist tarball, so auto-spawn only fires
+*    from a source checkout with `bun` available. If the script is absent we
+*    no-op (never a false "spawned" log).
+*  - Spawn failures NEVER crash the proxy: an async ENOENT (`bun` not on PATH)
+*    arrives as an `'error'` EVENT, not a sync throw, so we attach an `'error'`
+*    listener (without it the emitter re-throws → uncaughtException → exit(1)).
+*  - The returned handle MUST be killed by the caller on shutdown (no `detached`);
+*    an orphaned drive-primary daemon would keep merging PRs after the proxy is
+*    gone. The parent ALSO holds the child's stdin write end (`stdio[0]==="pipe"`)
+*    so it can EOF the child for a GRACEFUL stop (lease + pidfile released
+*    immediately, not by expiry) — the cross-platform teardown trigger, since an
+*    external SIGTERM on Windows is a hard kill the child can't observe. `kill()`
+*    stays the hard backstop so a wedged child is never orphaned (see
+*    `wireDaemonTeardown`).
+*  - It owns the deterministic drive loop only; live judgments still wake the
+*    lead via the heartbeat (no server->lead push).
+*/
+function shouldAutoSpawnDaemon(env, agentsEnabled) {
+	if (!agentsEnabled) return false;
+	return env.GH_ROUTER_FM_DAEMON === "1";
+}
+/**
+* The real (non-injected) spawner: node:child_process (not the Bun runtime's spawn) so the
+* bundled dist/main.js stays node-loadable. No `detached` — the caller kills
+* this on shutdown. stdin is "pipe" (parent holds the write end for a graceful
+* EOF stop); stdout/stderr stay "ignore".
+*/
+function nodeDaemonSpawn(cmd, spawnOpts, spawnImpl = spawn) {
+	const proc = spawnImpl(cmd[0], cmd.slice(1), {
+		env: spawnOpts.env,
+		stdio: spawnOpts.stdio
+	});
+	proc.on("error", (err) => consola.debug("first-mate daemon spawn error (ignored):", err));
+	return {
+		pid: proc.pid,
+		kill: () => void proc.kill("SIGKILL"),
+		endStdin: () => {
+			try {
+				proc.stdin?.end();
+			} catch {}
+		}
+	};
+}
+/**
+* Spawn the daemon child if the opt-in gate passes AND the daemon script is
+* present; else return undefined. Never throws, and never lets an async spawn
+* error crash bootstrap.
+*/
+function maybeSpawnDaemon(opts) {
+	const env = opts.env ?? process.env;
+	if (!shouldAutoSpawnDaemon(env, opts.agentsEnabled)) return void 0;
+	const script = nodePath.join(opts.repoRoot ?? process.cwd(), "scripts/first-mate-daemon.ts");
+	if (opts.spawn === void 0 && !existsSync(script)) {
+		consola.debug(`first-mate daemon entry not found (${script}); auto-spawn skipped.`);
+		return;
+	}
+	try {
+		const child = (opts.spawn ?? ((cmd, spawnOpts) => nodeDaemonSpawn(cmd, spawnOpts)))(["bun", script], {
+			env,
+			stdio: [
+				"pipe",
+				"ignore",
+				"ignore"
+			]
+		});
+		return {
+			pid: child.pid,
+			kill: child.kill,
+			endStdin: child.endStdin ?? (() => {})
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Wire the proxy's teardown to shut the daemon child down GRACEFULLY, then hard
+* kill as a backstop. Ordering (per teardown path):
+*  1. `endStdin()` — EOF the child so it releases its lease/pidfile cleanly (the
+*     cross-platform trigger; on Windows an external SIGTERM would never run the
+*     child's handler, so this EOF is the ONLY graceful path there).
+*  2. `kill()` — hard backstop so a wedged child is never orphaned (a prior
+*     review blocker: an orphaned drive-primary daemon keeps merging PRs).
+*
+* On SIGINT/SIGTERM the kill is deferred by a short, NON-BLOCKING, unref'd grace
+* window (proxy exit is never delayed for it). On `'exit'` — where timers cannot
+* run — we EOF then kill synchronously as a last resort. All steps are
+* once-guarded and non-throwing.
+*/
+function wireDaemonTeardown(handle, opts = {}) {
+	const proc = opts.proc ?? process;
+	const graceMs = opts.graceMs ?? 300;
+	const setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+	let killed = false;
+	const kill = () => {
+		if (killed) return;
+		killed = true;
+		try {
+			handle.kill();
+		} catch {}
+	};
+	let ended = false;
+	const endStdin = () => {
+		if (ended) return;
+		ended = true;
+		try {
+			handle.endStdin();
+		} catch {}
+	};
+	const onSignal = () => {
+		endStdin();
+		const t = setTimer(kill, graceMs);
+		if (t && typeof t.unref === "function") t.unref();
+	};
+	proc.once("SIGINT", onSignal);
+	proc.once("SIGTERM", onSignal);
+	proc.once("exit", () => {
+		endStdin();
+		kill();
+	});
+}
+
 //#endregion
 //#region src/lib/proxy.ts
 function initProxyFromEnv() {
@@ -4095,7 +4716,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version$1 = "0.3.163";
+var version$1 = "0.3.175";
 
 //#endregion
 //#region src/lib/approval.ts
@@ -7283,6 +7904,15 @@ async function setupAndServe(options) {
 	const url = srvxServer.url;
 	if (!url) throw new Error("Server started but URL is not available");
 	const serverUrl = url.replace(/\/$/, "");
+	try {
+		const handle = maybeSpawnDaemon({ agentsEnabled: agentToolsEnabled() });
+		if (handle) {
+			wireDaemonTeardown(handle);
+			consola.debug(`first-mate daemon spawn attempted (pid ${handle.pid ?? "?"}).`);
+		}
+	} catch (err) {
+		consola.debug("first-mate daemon auto-spawn skipped:", err);
+	}
 	return {
 		server: srvxServer,
 		serverUrl
@@ -7639,6 +8269,9 @@ function getCodexEnvVars(serverUrl) {
 
 //#endregion
 //#region src/claude.ts
+function isFirstMateSkillName(name$1) {
+	return name$1 === "gh-first-mate" || name$1 === "gh-first-mate-scaffold";
+}
 const claudeArgs = {
 	...sharedServerArgs,
 	model: {
@@ -7836,14 +8469,15 @@ const claude = defineCommand({
 		};
 		let onShutdown = baseShutdown;
 		let peerAwarenessSnippet;
+		let peerAwarenessSummary;
 		if (args["codex-mcp"] !== false) try {
 			const requestedCli = args["codex-cli"] ?? false;
 			const backend = resolveCodexCliBackend({
 				requested: requestedCli,
 				codexInfo: requestedCli ? getCodexVersion() : null
 			});
-			const geminiAvailable = state.models?.data.some((m) => /^gemini-3\..*pro/i.test(m.id)) ?? false;
-			if (!geminiAvailable) consola.info("gemini-3.1-pro-preview not found in your Copilot model catalog; gemini-critic persona will not be registered.");
+			const geminiModelsAvailable = geminiAvailable();
+			if (!geminiModelsAvailable) consola.info("gemini-3.1-pro-preview not found in your Copilot model catalog; gemini-critic persona will not be registered.");
 			const enabledGroups = [
 				"peers",
 				"search",
@@ -7857,7 +8491,7 @@ const claude = defineCommand({
 			const { keys: groupKeys, skipped: skippedGroups } = await resolveGroupKeysFromMirror(enabledGroups);
 			const runtime = await writePeerMcpRuntimeFiles(serverUrl, {
 				codexCli: backend === "cli",
-				geminiAvailable,
+				geminiAvailable: geminiModelsAvailable,
 				groupKeys,
 				workerToolsAvailable: workerToolsEnabled(),
 				browseAvailable: browseAgentEnabled(),
@@ -7872,7 +8506,7 @@ const claude = defineCommand({
 			};
 			const injected = await injectPeerMcpIntoMirror(serverUrl, {
 				codexCli: backend === "cli",
-				geminiAvailable,
+				geminiAvailable: geminiModelsAvailable,
 				groupKeys,
 				nonce: runtime.nonce
 			});
@@ -7886,7 +8520,7 @@ const claude = defineCommand({
 			process$1.stderr.write(`Peer MCP wired (backend=${backend}, personas=[${personaNames}], subagent .md files=${runtime.agentMdPaths.length}, ${subagentVisibility}).${skippedNote}\n`);
 			const sessionCwd = process$1.cwd();
 			if (workerToolsEnabled()) {
-				const skillsToWrite = INJECTED_SKILLS.filter((s) => s.name !== "gh-first-mate" || agentToolsEnabled());
+				const skillsToWrite = INJECTED_SKILLS.filter((s) => !isFirstMateSkillName(s.name) || agentToolsEnabled());
 				let skillsWritten = 0;
 				for (const s of skillsToWrite) if ((await writeInjectedSkill(s.name, s.md).catch(() => ({ written: false }))).written) skillsWritten++;
 				try {
@@ -7909,6 +8543,16 @@ const claude = defineCommand({
 					process$1.stderr.write(`Injected skills (${skillsWritten}/${skillsToWrite.length}): ${skillNames}.\n`);
 				}
 			}
+			if (agentToolsEnabled()) {
+				let shapingInstalled = false;
+				try {
+					await injectStopHookIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), buildFirstMateGuardHookCommand(process$1.execPath, process$1.argv[1]), "PreToolUse", void 0, FIRST_MATE_GUARD_MATCHER);
+					shapingInstalled = true;
+				} catch (err) {
+					consola.error(`Could not register the operator worker/orchestrate guard hook: ${String(err)}`);
+				}
+				assertShapingInstalled(true, shapingInstalled);
+			}
 			const aiordieSidecar = (process$1.env.AIORDIE_CLAUDE_BIND ?? "").trim();
 			if (aiordieSidecar.length > 0 && !aiordieSidecar.includes("\"")) try {
 				const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
@@ -7918,10 +8562,10 @@ const claude = defineCommand({
 			} catch (err) {
 				consola.warn(`Could not register the ai-or-die session-bind hook: ${String(err)}`);
 			}
-			if ((process$1.env.AIORDIE_SESSION_ID ?? "").trim().length > 0) {
+			if (artifactToolsEnabled()) {
 				await writeInjectedSkill(ARTIFACT_REVIEW_SKILL.name, ARTIFACT_REVIEW_SKILL.md).catch(() => ({ written: false }));
 				try {
-					await prependArtifactPanelDirectiveToMirroredClaudeMd();
+					await prependArtifactPanelDirectiveToMirroredClaudeMd(groupKeys.peers);
 				} catch (err) {
 					consola.warn(`Artifact-panel directive prepend failed: ${String(err)}`);
 				}
@@ -7932,6 +8576,11 @@ const claude = defineCommand({
 					consola.warn(`Could not register the artifact auto-open hook: ${String(err)}`);
 				}
 			}
+			if (hookMcpRuntimeFromEnv(envVars) && planReviewEnabled()) try {
+				await injectStopHookIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), buildPlanReviewHookCommand(process$1.execPath, process$1.argv[1]), "PostToolUse", void 0, "ExitPlanMode");
+			} catch (err) {
+				consola.warn(`Could not register the advisory plan-review hook: ${String(err)}`);
+			}
 			if (args["trust-gate"] === true) try {
 				const root = await trustRepo(sessionCwd);
 				process$1.stderr.write(`Structural gate trusted for this repo (${root}); it will run on launch here from now on.\n`);
@@ -8035,19 +8684,30 @@ const claude = defineCommand({
 			} else if (!gateDisabled && !descriptor && !discovering) process$1.stderr.write("Structural Stop-gate not enabled: no checks found in this repo (looked at package.json scripts / CI workflows / Makefile / Cargo.toml / go.mod / pyproject). Force a sealed gate with GH_ROUTER_ENABLE_STOP_GATE=1" + (workerToolsEnabled() ? ", or let a model discover them with GH_ROUTER_ENABLE_GATE_DISCOVERY=1" : "") + ".\n");
 			const peerSnippet = buildPeerAwarenessSnippet({
 				codexCli: backend === "cli",
-				geminiAvailable,
+				geminiAvailable: geminiModelsAvailable,
 				workerToolsAvailable: workerToolsEnabled(),
 				standInAvailable: standInToolEnabled(),
-				browseAvailable: state.browseEnabled,
+				browseAvailable: browserToolsEnabled(),
+				compoundBrowseAvailable: browserCompoundToolsEnabled(),
 				powerBrowseAvailable: state.powerBrowseEnabled,
+				fleetAvailable: fleetToolsEnabled(),
 				agentToolsAvailable: agentToolsEnabled(),
+				implementerAvailable: implementerSubagentModel() != null,
 				groupKeys
 			});
 			peerAwarenessSnippet = peerSnippet;
+			peerAwarenessSummary = buildPeerAwarenessSummary({
+				workerToolsAvailable: workerToolsEnabled(),
+				standInAvailable: standInToolEnabled(),
+				browseAvailable: browserToolsEnabled(),
+				fleetAvailable: fleetToolsEnabled(),
+				agentToolsAvailable: agentToolsEnabled(),
+				groupKeys
+			});
 			try {
 				await appendPeerAwarenessToMirroredClaudeMd(peerSnippet);
 			} catch (err) {
-				consola.warn(`Peer-awareness CLAUDE.md append failed (main agent still covered via --append-system-prompt): ${err instanceof Error ? err.message : String(err)}`);
+				consola.warn(`Peer-awareness CLAUDE.md append failed (agent keeps tool descriptions via tools/list, loses the inventory overview): ${err instanceof Error ? err.message : String(err)}`);
 			}
 			try {
 				await prependStyleDirectiveToMirroredClaudeMd();
@@ -8057,12 +8717,17 @@ const claude = defineCommand({
 		} catch (err) {
 			consola.warn(`Peer MCP wiring failed (claude will launch without it): ${err instanceof Error ? err.message : String(err)}`);
 		}
-		extraArgs.push("--append-system-prompt", peerAwarenessSnippet ? `${OPERATING_DEFAULTS_DIRECTIVE}\n\n${peerAwarenessSnippet}` : OPERATING_DEFAULTS_DIRECTIVE);
+		extraArgs.push("--append-system-prompt", peerAwarenessSnippet && peerAwarenessSummary ? `${OPERATING_DEFAULTS_DIGEST}\n\n${peerAwarenessSummary}` : OPERATING_DEFAULTS_DIGEST);
 		try {
 			await prependOperatingDefaultsToMirroredClaudeMd();
 		} catch (err) {
 			consola.warn(`Operating-defaults CLAUDE.md prepend failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		if (process$1.env.GH_ROUTER_DISABLE_NO_ATTRIBUTION !== "1") try {
+			await injectAttributionSuppressionIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"));
+		} catch (err) {
+			consola.warn(`No-attribution settings backstop skipped: ${err instanceof Error ? err.message : String(err)}`);
+		}
 		launchChild({
 			kind: "claude-code",
 			envVars,
@@ -8221,114 +8886,6 @@ const debug = defineCommand({
 	}
 });
 
-//#endregion
-//#region src/lib/orchestration/hook-mcp-client.ts
-/**
-* Read the proxy URL + nonce the launcher injected into the spawned child env
-* (`GH_ROUTER_HOOK_MCP_URL` / `GH_ROUTER_HOOK_NONCE`). Returns undefined when
-* either is absent — the hook then skips its LLM layer and falls back to its
-* deterministic / regex behavior.
-*/
-function hookMcpRuntimeFromEnv(env = process.env) {
-	const serverUrl = (env.GH_ROUTER_HOOK_MCP_URL ?? "").trim();
-	const nonce = (env.GH_ROUTER_HOOK_NONCE ?? "").trim();
-	if (serverUrl.length === 0 || nonce.length === 0) return void 0;
-	return {
-		serverUrl,
-		nonce
-	};
-}
-/**
-* POST a JSON-RPC `tools/call` and return the tool's text + isError. Throws on
-* any transport/HTTP/parse failure (caller fails open). A JSON-RPC `error`
-* envelope is mapped to `{ text: message, isError: true }` (a well-formed
-* negative result, not a transport failure).
-*/
-async function callMcpTool(opts) {
-	const body = await postJson(`${opts.runtime.serverUrl.replace(/\/+$/, "")}/mcp/${opts.group}`, {
-		jsonrpc: "2.0",
-		id: 1,
-		method: "tools/call",
-		params: {
-			name: opts.tool,
-			arguments: opts.args
-		}
-	}, {
-		timeoutMs: opts.timeoutMs,
-		signal: opts.signal,
-		headers: { Authorization: `Bearer ${opts.runtime.nonce}` }
-	});
-	const rpc = body && typeof body === "object" ? body : {};
-	if (rpc.error) return {
-		text: rpc.error.message ?? "MCP error",
-		isError: true
-	};
-	return {
-		text: (Array.isArray(rpc.result?.content) ? rpc.result.content : []).filter((p) => p && p.type === "text" && typeof p.text === "string").map((p) => p.text).join(""),
-		isError: rpc.result?.isError === true
-	};
-}
-/**
-* One non-streaming gpt-5.5 (or any model id) inference via `/v1/responses`.
-* Returns the assistant text (possibly empty). Throws on transport/HTTP/parse
-* failure. `effort` maps to the Responses `reasoning.effort` knob.
-*/
-async function callInference(opts) {
-	const body = await postJson(`${opts.serverUrl.replace(/\/+$/, "")}/v1/responses`, {
-		model: opts.model,
-		instructions: opts.instructions,
-		input: [{
-			role: "user",
-			content: [{
-				type: "input_text",
-				text: opts.input
-			}]
-		}],
-		stream: false,
-		reasoning: { effort: opts.effort }
-	}, {
-		timeoutMs: opts.timeoutMs,
-		signal: opts.signal
-	});
-	const out = [];
-	const items = Array.isArray(body?.output) ? body.output : [];
-	for (const item of items) {
-		if (item?.type !== "message" || item.role !== "assistant") continue;
-		const parts = Array.isArray(item.content) ? item.content : [];
-		for (const part of parts) if ((part?.type === "output_text" || part?.type === "text") && typeof part.text === "string") out.push(part.text);
-	}
-	return out.join("");
-}
-/**
-* POST `payload` as JSON with a hard timeout, returning the parsed JSON body.
-* Throws on non-2xx, network error, timeout (AbortController), or non-JSON body.
-* An external `signal` is honored alongside the internal timeout.
-*/
-async function postJson(url, payload, opts) {
-	const controller = new AbortController();
-	const timer = setTimeout$1(() => controller.abort(/* @__PURE__ */ new Error("hook MCP request timed out")), opts.timeoutMs);
-	const onExternalAbort = () => controller.abort(/* @__PURE__ */ new Error("hook MCP request aborted"));
-	if (opts.signal) if (opts.signal.aborted) onExternalAbort();
-	else opts.signal.addEventListener("abort", onExternalAbort, { once: true });
-	try {
-		const res = await fetch(url, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				Accept: "application/json",
-				...opts.headers
-			},
-			body: JSON.stringify(payload),
-			signal: controller.signal
-		});
-		if (!res.ok) throw new Error(`hook MCP request failed: HTTP ${res.status}`);
-		return await res.json();
-	} finally {
-		clearTimeout$1(timer);
-		if (opts.signal) opts.signal.removeEventListener("abort", onExternalAbort);
-	}
-}
-
 //#endregion
 //#region src/internal-prompt-submit.ts
 /**
@@ -8338,7 +8895,7 @@ async function postJson(url, payload, opts) {
 * no such handle. Hooks always receive piped/redirected stdin, so this never
 * blocks (guarded against an interactive TTY, and any error -> "").
 */
-function readStdin$4() {
+function readStdin$5() {
 	try {
 		if (process.stdin.isTTY) return "";
 		return readFileSync(0, "utf8");
@@ -8369,7 +8926,7 @@ const internalPromptSubmit = defineCommand({
 	},
 	async run() {
 		try {
-			const stdin = readStdin$4();
+			const stdin = readStdin$5();
 			const steerEnabled = parseBoolEnv(process.env.GH_ROUTER_DISABLE_PROMPT_STEER) !== true;
 			const runtime = hookMcpRuntimeFromEnv();
 			let decision;
@@ -8421,6 +8978,99 @@ const internalPromptSubmit = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/internal-plan-review.ts
+function readStdin$4() {
+	try {
+		if (process.stdin.isTTY) return "";
+		return readFileSync(0, "utf8");
+	} catch {
+		return "";
+	}
+}
+async function readDetachedPayload() {
+	const payloadPath = (process.env.GH_ROUTER_PLAN_REVIEW_PAYLOAD ?? "").trim();
+	if (payloadPath.length === 0) return void 0;
+	try {
+		const raw = await promises.readFile(payloadPath, "utf8");
+		await promises.unlink(payloadPath).catch(() => {});
+		const parsed = JSON.parse(raw);
+		if (!parsed || typeof parsed !== "object") return void 0;
+		const p = parsed;
+		if (!p.sessionId || !p.cwd || !p.plan || !p.planHash) return void 0;
+		return {
+			sessionId: p.sessionId,
+			cwd: p.cwd,
+			plan: p.plan,
+			planHash: p.planHash
+		};
+	} catch {
+		await promises.unlink(payloadPath).catch(() => {});
+		return;
+	}
+}
+function spawnDetachedPlanReview(ctx) {
+	let payloadPath;
+	try {
+		const dir = stopReviewStateDir();
+		mkdirSync(dir, { recursive: true });
+		payloadPath = nodePath.join(dir, `plan-review-${process.pid}-${randomBytes(4).toString("hex")}.json`);
+		writeFileSync(payloadPath, JSON.stringify(ctx), { mode: 384 });
+		const scriptArgs = process.argv[1] && process.argv[1] !== process.execPath ? [process.argv[1]] : [];
+		const child = spawn(process.execPath, [...scriptArgs, "internal-plan-review"], {
+			detached: true,
+			windowsHide: true,
+			stdio: "ignore",
+			env: {
+				...process.env,
+				GH_ROUTER_PLAN_REVIEW_PAYLOAD: payloadPath
+			}
+		});
+		const orphan = payloadPath;
+		child.on("error", () => {
+			if (orphan) try {
+				unlinkSync(orphan);
+			} catch {}
+		});
+		child.unref();
+	} catch {
+		if (payloadPath) try {
+			unlinkSync(payloadPath);
+		} catch {}
+	}
+}
+const internalPlanReview = defineCommand({
+	meta: {
+		name: "internal-plan-review",
+		description: "Internal: advisory ExitPlanMode plan reviewer. Spawns a bounded detached critic review for substantive plans and writes findings for the next prompt. Always exit 0."
+	},
+	async run() {
+		try {
+			const runtime = hookMcpRuntimeFromEnv();
+			if (!runtime) return;
+			const detached = await readDetachedPayload();
+			if (detached) {
+				await runPlanReview({
+					runtime,
+					sessionId: detached.sessionId,
+					cwd: detached.cwd,
+					plan: detached.plan,
+					findingsStore: fileFindingsStore(stopReviewStateDir())
+				});
+				return;
+			}
+			const decision = await decidePlanReviewHook({
+				stdin: readStdin$4(),
+				runtimeAvailable: true,
+				debounce: filePlanReviewDebounce(stopReviewStateDir()),
+				fallbackCwd: process.cwd()
+			});
+			if (decision.kind === "spawn") spawnDetachedPlanReview(decision);
+		} catch {}
+		process.exitCode = 0;
+	}
+});
+
 //#endregion
 //#region src/internal-session-bind.ts
 /**
@@ -8823,17 +9473,20 @@ function readStdin$1() {
 const MAX_DIFF_BYTES = 2 * 1024 * 1024;
 /** Capture the working-tree diff WITHOUT mutating the user's index (no
 *  `git add -N`): `git diff HEAD` covers modified tracked files, which is where
-*  gate-weakening edits live. Best-effort: any git failure yields an empty diff
-*  (the weakening scan is then a no-op; the executable gate still runs). Capped. */
+*  gate-weakening edits live. A git failure rejects, so the decision layer can run
+*  checks with an empty weakening scan instead of treating an unknown diff as a
+*  genuine no-diff turn. Capped. */
 async function captureDiff(cwd) {
-	const out = (await runCommandCapture([
+	const r = await runCommandCapture([
 		"git",
 		"diff",
 		"HEAD"
 	], {
 		cwd,
 		timeoutMs: 5e3
-	}).catch(() => void 0))?.stdout ?? "";
+	});
+	if (r.code !== 0) throw new Error(`git diff failed with exit ${r.code}`);
+	const out = r.stdout;
 	return out.length > MAX_DIFF_BYTES ? out.slice(0, MAX_DIFF_BYTES) : out;
 }
 /** Flush a message to stderr before exiting (process.exit can drop an unflushed
@@ -8965,6 +9618,7 @@ const internalStopHook = defineCommand({
 				isEnabledForRepo: (cwd) => stopGateEnabledForRepo(cwd),
 				resolveChecks: mode ? buildResolveChecks(mode) : void 0,
 				timeoutMs: Number.isFinite(timeoutEnv) && timeoutEnv > 0 ? timeoutEnv : void 0,
+				planMode: stopGatePlanMode(),
 				reviewDebounce: reviewEnabled ? fileReviewDebounce(stopReviewStateDir()) : void 0,
 				spawnReview: reviewEnabled ? (ctx) => spawnStopReview(ctx, {
 					prompt: userPrompt,
@@ -9410,7 +10064,7 @@ process.on("uncaughtException", (error) => {
 const version = getPackageVersion();
 const argv = process.argv.slice(2);
 const isVersionFlag = argv.includes("--version");
-const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-session-bind" || argv[0] === "internal-artifact-open" || argv[0] === "internal-worker-guard";
+const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-plan-review" || argv[0] === "internal-session-bind" || argv[0] === "internal-artifact-open" || argv[0] === "internal-first-mate-guard" || argv[0] === "internal-worker-guard";
 if (!isVersionFlag && !isInternalHook) consola.info(`github-router v${version}`);
 await runMain(defineCommand({
 	meta: {
@@ -9429,8 +10083,10 @@ await runMain(defineCommand({
 		"internal-stop-hook": internalStopHook,
 		"internal-prompt-submit": internalPromptSubmit,
 		"internal-stop-review": internalStopReview,
+		"internal-plan-review": internalPlanReview,
 		"internal-session-bind": internalSessionBind,
 		"internal-artifact-open": internalArtifactOpen,
+		"internal-first-mate-guard": internalFirstMateGuard,
 		"internal-worker-guard": internalWorkerGuard
 	}
 }));