github-router 0.3.168 → 0.3.175

package/dist/main.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as buildAnthropicErrorEvent, $t as resolveCodexModel, A as liveExec, At as shouldUseInsecureTls, B as availableToolCommands, Bt as generateRandomPort, C as isSubagentContext, Ct as readResponseBodyCapped, D as stopReviewStateDir, Dt as provisionAndIndexColbert, E as stopGateEnabledForRepo, Et as hasSupportedBrowserInstalled, Ft as DEFAULT_CODEX_MODEL, G as TOOLBELT_TOOLS, Gt as setupGitHubAgentToken, H as toolbeltEnabled, Ht as getPackageVersion, It as DEFAULT_CODEX_MODEL_FALLBACKS, J as ADVISOR_INTERNAL_TOOL_NAME, Jt as cacheCopilotVersion, K as assetFor, Kt as setupGitHubToken, Lt as DEFAULT_PORT, Mt as collapsePathKeys, Nt as toolbeltPathOverride, O as trustRepo, Ot as extractTarGzMember, Pt as DEFAULT_CLAUDE_MODEL_FALLBACKS, Q as isAdvisorRequested, Qt as isNullish, Rt as UPSTREAM_FETCH_TIMEOUT_MS, S as fileReviewDebounce, St as MAX_RESPONSE_BODY_BYTES, T as repoRoot, Tt as provisionBrowserAssets, U as toolbeltSkipSet, Ut as withInstallLock, V as buildToolbeltAwareness, Vt as pickClaudeDefault, W as vscodeRipgrepPath, Wt as setupCopilotToken, X as buildAdvisorStream, Xt as cacheVSCodeVersion, Y as ADVISOR_TOOL_INSTRUCTIONS, Yt as cacheModels, Z as injectAdvisorTool, Zt as filterBetaHeader, _ as stopGatePlanMode, _t as assembleResponsesPayload, a as buildPeerAwarenessSnippet, an as forwardError, at as handleMcpDelete, b as fileFindingsStore, bt as createResponses, c as buildSessionBindHookCommand, cn as copilotHeaders, ct as browseAgentEnabled, d as decideStopHook, dt as implementerSubagentModel, en as resolveModel, et as buildOpenAIErrorEvent, f as fileBlockBudget, ft as standInToolEnabled, g as stopGateId, gt as getTokenCount, h as stopGateDisabled, ht as createMessages, i as buildAgentPrompt, in as HTTPError, it as relayAnthropicStream, jt as ArtifactClient, k as resolveSealedGate, kt as extractZipMember, l as buildStopHookCommand, ln as githubHeaders, lt as browserToolsEnabled, m as launchBaselineKey, mt as countTokens, n as MCP_GROUPS, nn as getModels, nt as logStreamError, o as personasFor, on as GITHUB_API_BASE_URL, ot as handleMcpPost, p as injectStopHookIntoSettingsFile, pt as workerToolsEnabled, q as searchWeb, qt as tryRefreshAndRetry, r as assertMcpToolSurfaceConsistent, rn as fetchWithTransientRetry, rt as readIteratorWithTimeout, s as buildArtifactOpenHookCommand, sn as copilotBaseUrl, st as agentToolsEnabled, t as GROUP_META, tn as sleep, tt as isControllerClosedError, u as captureLaunchBaseline, un as state, ut as fleetToolsEnabled, v as stopReviewEnabled, vt as resolveMcpToolTimeoutMs, w as repoFingerprint, wt as parseJsonOrDiagnose, x as fileLastPromptStore, xt as createChatCompletions, y as fileBaselineStore, yt as pickEndpoint, zt as UPSTREAM_INACTIVITY_TIMEOUT_MS } from "./peer-mcp-personas-D826LsJJ.js";
+import { $ as isAdvisorRequested, $t as cacheModels, A as liveExec, At as hasSupportedBrowserInstalled, Bt as DEFAULT_CODEX_MODEL_FALLBACKS, C as fileReviewDebounce, Ct as pickEndpoint, D as stopGateEnabledForRepo, Dt as readResponseBodyCapped, E as repoRoot, Et as MAX_RESPONSE_BODY_BYTES, Ft as ArtifactClient, G as vscodeRipgrepPath, Gt as pickClaudeDefault, H as buildToolbeltAwareness, Ht as UPSTREAM_FETCH_TIMEOUT_MS, It as collapsePathKeys, J as searchWeb, Jt as setupCopilotToken, K as TOOLBELT_TOOLS, Kt as getPackageVersion, Lt as toolbeltPathOverride, Mt as extractTarGzMember, Nt as extractZipMember, O as stopReviewStateDir, Ot as parseJsonOrDiagnose, Pt as shouldUseInsecureTls, Q as injectAdvisorTool, Qt as cacheCopilotVersion, Rt as DEFAULT_CLAUDE_MODEL_FALLBACKS, S as fileLastPromptStore, St as resolveMcpToolTimeoutMs, T as repoFingerprint, Tt as createChatCompletions, U as toolbeltEnabled, Ut as UPSTREAM_INACTIVITY_TIMEOUT_MS, V as availableToolCommands, Vt as DEFAULT_PORT, W as toolbeltSkipSet, Wt as generateRandomPort, X as ADVISOR_TOOL_INSTRUCTIONS, Xt as setupGitHubToken, Y as ADVISOR_INTERNAL_TOOL_NAME, Yt as setupGitHubAgentToken, Z as buildAdvisorStream, Zt as tryRefreshAndRetry, _ as stopGateId, _t as workerToolsEnabled, a as buildPeerAwarenessSnippet, an as sleep, at as relayAnthropicStream, b as fileBaselineStore, bt as getTokenCount, c as buildArtifactOpenHookCommand, cn as HTTPError, ct as agentToolsEnabled, d as captureLaunchBaseline, dn as copilotBaseUrl, dt as browserCompoundToolsEnabled, en as cacheVSCodeVersion, et as buildAnthropicErrorEvent, f as decideStopHook, fn as copilotHeaders, ft as browserToolsEnabled, g as stopGateDisabled, gt as standInToolEnabled, h as launchBaselineKey, ht as implementerSubagentModel, i as buildAgentPrompt, in as resolveModel, it as readIteratorWithTimeout, j as resolveSealedGate, jt as provisionAndIndexColbert, k as trustRepo, kt as provisionBrowserAssets, l as buildSessionBindHookCommand, ln as forwardError, lt as artifactToolsEnabled, m as injectStopHookIntoSettingsFile, mn as state, mt as geminiAvailable, n as MCP_GROUPS, nn as isNullish, nt as isControllerClosedError, o as buildPeerAwarenessSummary, on as getModels, ot as handleMcpDelete, p as fileBlockBudget, pn as githubHeaders, pt as fleetToolsEnabled, q as assetFor, qt as withInstallLock, r as assertMcpToolSurfaceConsistent, rn as resolveCodexModel, rt as logStreamError, s as personasFor, sn as fetchWithTransientRetry, st as handleMcpPost, t as GROUP_META, tn as filterBetaHeader, tt as buildOpenAIErrorEvent, u as buildStopHookCommand, un as GITHUB_API_BASE_URL, ut as browseAgentEnabled, v as stopGatePlanMode, vt as countTokens, w as isSubagentContext, wt as createResponses, x as fileFindingsStore, xt as assembleResponsesPayload, y as stopReviewEnabled, yt as createMessages, zt as DEFAULT_CODEX_MODEL } from "./peer-mcp-personas-BCGYWok0.js";
 import { a as removeOwnClaudeConfigMirror, i as isUnderClaudeConfigMirror, l as writeArtifactCredsToMirror, n as ensureClaudeConfigMirror, r as ensurePaths, t as PATHS, u as writeRuntimeFileSecure } from "./paths-CTlT1nTo.js";
 import { c as killManagedTree, d as runCommandCapture, f as runCommandVoid, l as parseBoolEnv, s as killChildProcessTree, u as resolveExecutable } from "./lifecycle-ChPBRt6K.js";
 import { a as sweepRegistry } from "./lifecycle-BUXxiltc.js";
@@ -16,11 +16,11 @@ import * as fs$2 from "node:fs";
 import fs$1, { existsSync, mkdirSync, promises, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { Agent, ProxyAgent, setGlobalDispatcher } from "undici";
 import { Writable } from "node:stream";
+import { clearTimeout as clearTimeout$1, setTimeout as setTimeout$1 } from "node:timers";
 import { serve } from "srvx";
 import { getProxyForUrl } from "proxy-from-env";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { clearTimeout as clearTimeout$1, setTimeout as setTimeout$1 } from "node:timers";
 import { Marked } from "marked";
 import clipboard from "clipboardy";
 
@@ -969,6 +969,9 @@ function dispatcherDescription(mode) {
 *  relay verbatim, do nothing else. */
 function dispatcherPrompt(mode, workersKey) {
 	const tool = workerToolName(workersKey, mode);
+	const briefField = mode === "browse" ? "task" : "prompt";
+	const briefDescription = mode === "browse" ? "the lead's browse task, copied verbatim" : "the lead's worker brief, copied verbatim";
+	const modeSpecificPassThrough = mode === "implement" || mode === "test" ? "\n  - `worktree` (optional): pass `true` if the lead asked for isolated-worktree execution" : mode === "browse" ? "\n  - `sessionId` (optional): pass through if the lead specified one" : "";
 	return [
 		`# Subagent: ${dispatcherAgentName(mode)}`,
 		"",
@@ -978,10 +981,10 @@ function dispatcherPrompt(mode, workersKey) {
 		"## Your only job",
 		"",
 		`Call the \`${tool}\` tool EXACTLY ONCE, passing through the fields from the lead's brief:`,
-		"  - `prompt`: the lead's worker brief, copied verbatim",
+		`  - \`${briefField}\`: ${briefDescription}`,
 		"  - `workspace` (optional): absolute path, if the lead specified one",
 		"  - `model` / `thinking` (optional): only if the lead specified them",
-		"  - `maxWallClockMs` (optional): per-call wall-clock budget in ms, if the lead specified one" + (mode === "implement" || mode === "test" ? "\n  - `worktree` (optional): pass `true` if the lead asked for isolated-worktree execution" : ""),
+		"  - `maxWallClockMs` (optional): per-call wall-clock budget in ms, if the lead specified one" + modeSpecificPassThrough,
 		"",
 		"When the tool returns, output its result VERBATIM as your final message. That final",
 		"message is what the lead receives in the completion notification — it IS the result.",
@@ -1001,7 +1004,7 @@ function dispatcherPrompt(mode, workersKey) {
 *  tool names, so this grants exactly the workers tools and NOTHING else — no
 *  Agent/Task (so it cannot spawn further agents → no recursion), no Read/Bash
 *  (so it cannot do extra work). The dispatcher's prompt narrows it to the one
-*  mode; the guard allows any dispatcher-named caller regardless. */
+*  mode; the guard allows only the exact dispatcher for that worker mode. */
 function dispatcherTools(_mode, workersKey) {
 	return [`mcp__${workersKey}__*`];
 }
@@ -1736,6 +1739,270 @@ function listModelsForEndpoint(path) {
 	}).map((m) => m.id);
 }
 
+//#endregion
+//#region src/lib/orchestration/hook-mcp-client.ts
+/**
+* Read the proxy URL + nonce the launcher injected into the spawned child env
+* (`GH_ROUTER_HOOK_MCP_URL` / `GH_ROUTER_HOOK_NONCE`). Returns undefined when
+* either is absent — the hook then skips its LLM layer and falls back to its
+* deterministic / regex behavior.
+*/
+function hookMcpRuntimeFromEnv(env = process.env) {
+	const serverUrl = (env.GH_ROUTER_HOOK_MCP_URL ?? "").trim();
+	const nonce = (env.GH_ROUTER_HOOK_NONCE ?? "").trim();
+	if (serverUrl.length === 0 || nonce.length === 0) return void 0;
+	return {
+		serverUrl,
+		nonce
+	};
+}
+/**
+* POST a JSON-RPC `tools/call` and return the tool's text + isError. Throws on
+* any transport/HTTP/parse failure (caller fails open). A JSON-RPC `error`
+* envelope is mapped to `{ text: message, isError: true }` (a well-formed
+* negative result, not a transport failure).
+*/
+async function callMcpTool(opts) {
+	const body = await postJson(`${opts.runtime.serverUrl.replace(/\/+$/, "")}/mcp/${opts.group}`, {
+		jsonrpc: "2.0",
+		id: 1,
+		method: "tools/call",
+		params: {
+			name: opts.tool,
+			arguments: opts.args
+		}
+	}, {
+		timeoutMs: opts.timeoutMs,
+		signal: opts.signal,
+		headers: { Authorization: `Bearer ${opts.runtime.nonce}` }
+	});
+	const rpc = body && typeof body === "object" ? body : {};
+	if (rpc.error) return {
+		text: rpc.error.message ?? "MCP error",
+		isError: true
+	};
+	return {
+		text: (Array.isArray(rpc.result?.content) ? rpc.result.content : []).filter((p) => p && p.type === "text" && typeof p.text === "string").map((p) => p.text).join(""),
+		isError: rpc.result?.isError === true
+	};
+}
+/**
+* One non-streaming gpt-5.5 (or any model id) inference via `/v1/responses`.
+* Returns the assistant text (possibly empty). Throws on transport/HTTP/parse
+* failure. `effort` maps to the Responses `reasoning.effort` knob.
+*/
+async function callInference(opts) {
+	const body = await postJson(`${opts.serverUrl.replace(/\/+$/, "")}/v1/responses`, {
+		model: opts.model,
+		instructions: opts.instructions,
+		input: [{
+			role: "user",
+			content: [{
+				type: "input_text",
+				text: opts.input
+			}]
+		}],
+		stream: false,
+		reasoning: { effort: opts.effort }
+	}, {
+		timeoutMs: opts.timeoutMs,
+		signal: opts.signal
+	});
+	const out = [];
+	const items = Array.isArray(body?.output) ? body.output : [];
+	for (const item of items) {
+		if (item?.type !== "message" || item.role !== "assistant") continue;
+		const parts = Array.isArray(item.content) ? item.content : [];
+		for (const part of parts) if ((part?.type === "output_text" || part?.type === "text") && typeof part.text === "string") out.push(part.text);
+	}
+	return out.join("");
+}
+/**
+* POST `payload` as JSON with a hard timeout, returning the parsed JSON body.
+* Throws on non-2xx, network error, timeout (AbortController), or non-JSON body.
+* An external `signal` is honored alongside the internal timeout.
+*/
+async function postJson(url, payload, opts) {
+	const controller = new AbortController();
+	const timer = setTimeout$1(() => controller.abort(/* @__PURE__ */ new Error("hook MCP request timed out")), opts.timeoutMs);
+	const onExternalAbort = () => controller.abort(/* @__PURE__ */ new Error("hook MCP request aborted"));
+	if (opts.signal) if (opts.signal.aborted) onExternalAbort();
+	else opts.signal.addEventListener("abort", onExternalAbort, { once: true });
+	try {
+		const res = await fetch(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Accept: "application/json",
+				...opts.headers
+			},
+			body: JSON.stringify(payload),
+			signal: controller.signal
+		});
+		if (!res.ok) throw new Error(`hook MCP request failed: HTTP ${res.status}`);
+		return await res.json();
+	} finally {
+		clearTimeout$1(timer);
+		if (opts.signal) opts.signal.removeEventListener("abort", onExternalAbort);
+	}
+}
+
+//#endregion
+//#region src/lib/orchestration/plan-review-hook.ts
+/** Minimum finalized-plan size worth spending a model review on. */
+const PLAN_REVIEW_MIN_CHARS = 220;
+/** Hard wall-clock for the advisory plan critic. */
+const PLAN_REVIEW_TIMEOUT_MS = 25e3;
+/** Cap the plan embedded in the critic brief so a huge plan file cannot dominate. */
+const MAX_REVIEWED_PLAN_CHARS = 80 * 1024;
+/** Default-on advisory plan review. Opt out with GH_ROUTER_DISABLE_PLAN_REVIEW=1. */
+function planReviewEnabled(env = process.env) {
+	return parseBoolEnv(env.GH_ROUTER_DISABLE_PLAN_REVIEW) !== true;
+}
+/** File-backed per-session debounce for finalized plans, separate from Stop diff hashes. */
+function filePlanReviewDebounce(stateDir) {
+	const fileFor = (sid) => nodePath.join(stateDir, `plan-review-hash-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
+	const readLast = async (sid) => {
+		try {
+			return (await promises.readFile(fileFor(sid), "utf8")).trim();
+		} catch {
+			return "";
+		}
+	};
+	return {
+		async shouldReview(sid, planHash) {
+			if (planHash.length === 0) return false;
+			return await readLast(sid) !== planHash;
+		},
+		async markReviewed(sid, planHash) {
+			await promises.mkdir(stateDir, { recursive: true });
+			await promises.writeFile(fileFor(sid), planHash, { mode: 384 });
+		}
+	};
+}
+function parseObject(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	} catch {}
+}
+async function resolvePlanText(toolInput, readFile$1) {
+	if (!toolInput || typeof toolInput !== "object") return "";
+	const ti = toolInput;
+	const planFilePath = typeof ti.planFilePath === "string" && ti.planFilePath.trim().length > 0 ? ti.planFilePath.trim() : "";
+	if (planFilePath.length > 0) try {
+		const fromFile = await readFile$1(planFilePath);
+		if (fromFile.trim().length > 0) return fromFile;
+	} catch {}
+	return typeof ti.plan === "string" ? ti.plan : "";
+}
+/**
+* Decide whether the ExitPlanMode PostToolUse hook should spawn a detached review.
+* Pure aside from injected file reads + debounce store. Fail-open: any malformed
+* payload, missing runtime, subagent context, trivial/absent plan, or store error
+* returns a skip decision.
+*/
+async function decidePlanReviewHook(input) {
+	try {
+		if (!input.runtimeAvailable) return {
+			kind: "skip",
+			reason: "missing-runtime"
+		};
+		const payload = parseObject(input.stdin);
+		if (!payload) return {
+			kind: "skip",
+			reason: "bad-payload"
+		};
+		if (isSubagentContext(payload)) return {
+			kind: "skip",
+			reason: "subagent"
+		};
+		const sessionId = typeof payload.session_id === "string" && payload.session_id.length > 0 ? payload.session_id : "";
+		if (!sessionId) return {
+			kind: "skip",
+			reason: "missing-session"
+		};
+		const cwd = typeof payload.cwd === "string" && payload.cwd.length > 0 ? payload.cwd : input.fallbackCwd;
+		const trimmed = (await resolvePlanText(payload.tool_input, input.readFile ?? ((filePath) => promises.readFile(filePath, "utf8")))).trim();
+		if (trimmed.length < (input.minChars ?? PLAN_REVIEW_MIN_CHARS)) return {
+			kind: "skip",
+			reason: "trivial-plan"
+		};
+		const planHash = createHash("sha256").update(trimmed).digest("hex");
+		if (!await input.debounce.shouldReview(sessionId, planHash)) return {
+			kind: "skip",
+			reason: "debounced"
+		};
+		await input.debounce.markReviewed(sessionId, planHash);
+		return {
+			kind: "spawn",
+			sessionId,
+			cwd,
+			plan: trimmed,
+			planHash
+		};
+	} catch {
+		return {
+			kind: "skip",
+			reason: "error"
+		};
+	}
+}
+function reviewBrief(plan, cwd) {
+	const embeddedPlan = plan.length > MAX_REVIEWED_PLAN_CHARS ? `${plan.slice(0, MAX_REVIEWED_PLAN_CHARS)}\n\n[plan truncated at ${MAX_REVIEWED_PLAN_CHARS} characters]` : plan;
+	return `You are an independent plan reviewer. A coding agent has just finalized a plan with ExitPlanMode. Your job is to find load-bearing risks before implementation starts: unstated assumptions, missing failure modes, gaps in verification, dangerous sequencing, or places where the plan could satisfy the letter of the request while missing the user's likely intent.
+
+Be concise and skeptical. Do NOT rewrite the plan, do NOT praise it, and do NOT invent new product requirements. Report only material objections that would change what the agent should do next. Include file:line anchors when the plan names concrete files or when the risk depends on repo code. If the plan is sound, say exactly: "no material objection".
+
+Workspace: ${cwd}\n\nFINALIZED PLAN:
+` + embeddedPlan;
+}
+function hasMaterialFinding(text) {
+	const normalized = text.trim().toLowerCase().replace(/[.!]+$/g, "");
+	return normalized.length > 0 && normalized !== "no material objection" && normalized !== "no material objections";
+}
+function framePlanFindings(text) {
+	return "PLAN REVIEW: an independent cross-lab critic reviewed the finalized plan and found the following material concern(s).\n" + text.trim();
+}
+/** Run the bounded critic call and write material findings to the shared findings store. */
+async function runPlanReview(input) {
+	const timeoutMs = input.timeoutMs ?? PLAN_REVIEW_TIMEOUT_MS;
+	let timer;
+	const controller = new AbortController();
+	try {
+		const brief = reviewBrief(input.plan, input.cwd);
+		const review = (input.callReview ?? ((prompt, signal) => callMcpTool({
+			runtime: input.runtime,
+			group: "peers",
+			tool: "codex_critic",
+			args: {
+				prompt,
+				effort: "high"
+			},
+			timeoutMs,
+			signal
+		})))(brief, controller.signal);
+		review.catch(() => {});
+		const raced = await Promise.race([review, new Promise((resolve) => {
+			timer = setTimeout(() => resolve("timeout"), timeoutMs);
+		})]);
+		if (raced === "timeout" || raced.isError || !hasMaterialFinding(raced.text)) return;
+		const framed = framePlanFindings(raced.text);
+		const existing = await input.findingsStore.read(input.sessionId).catch(() => null);
+		const next = existing && existing.trim().length > 0 ? `${existing.trim()}\n\n${framed}` : framed;
+		await input.findingsStore.write(input.sessionId, next);
+	} catch {} finally {
+		if (timer) clearTimeout(timer);
+		controller.abort();
+	}
+}
+/** Build the command registered for PostToolUse(ExitPlanMode). */
+function buildPlanReviewHookCommand(execPath, scriptPath) {
+	const q = (s) => `"${s}"`;
+	if (scriptPath && scriptPath !== execPath) return `${q(execPath)} ${q(scriptPath)} internal-plan-review`;
+	return `${q(execPath)} internal-plan-review`;
+}
+
 //#endregion
 //#region src/lib/orchestration/harness-parse.ts
 /** The fast static checks that are always-on; `test` is opt-in (it runs project
@@ -2289,7 +2556,7 @@ async function discoverGateCommands(cwd, opts) {
 	if (files.length === 0) return null;
 	let result;
 	try {
-		const { runWorkerAgent } = await import("./engine-RA1Orodr.js");
+		const { runWorkerAgent } = await import("./engine-cUomEg92.js");
 		result = await runWorkerAgent({
 			mode: "explore",
 			workspace: root,
@@ -2350,9 +2617,9 @@ function decidePromptSubmit(input) {
 	return decision;
 }
 /**
-* Static encouragement injected for a TRIVIAL prompt (no model call, no latency
-* tax): nudge parallel lexical+semantic search before concluding. Mirrors the v1
-* advisory tone — additive, never blocking.
+* Static encouragement injected only for a non-trivial prompt (no extra model
+* call, no latency tax): nudge parallel lexical+semantic search before
+* concluding. Mirrors the v1 advisory tone: additive, never blocking.
 */
 const PROMPT_SEARCH_TIP = "TIP (advisory): when this task needs code context, search lexical + semantic in parallel — one `mcp__search__code` call with mode:\"lexical\" and one with mode:\"semantic\", issued in the same turn — before concluding.";
 /** System prompt for the single gpt-5.5 scope/goal inference. Steers a SHORT,
@@ -2375,8 +2642,8 @@ function joinSections(sections) {
 *
 *   - subagent/teammate  -> empty (top-level only, like v1).
 *   - findings           -> always surfaced (+ cleared) regardless of triviality.
-*   - trivial prompt     -> static search tip only (no model call).
-*   - substantive prompt -> parallel lexical+semantic search -> ONE gpt-5.5 call
+*   - trivial prompt     -> findings only (no search tip, no model call).
+*   - substantive prompt -> static search tip + parallel lexical+semantic search -> ONE gpt-5.5 call
 *                           -> grounded scope/goal note. Fail-open to PROMPT_STEER_GOAL.
 *   - steerEnabled=false -> findings only (no goal/tip).
 */
@@ -2407,7 +2674,7 @@ async function decidePromptSubmitV2(input) {
 		return decision;
 	}
 	if (!isNonTrivialPrompt(prompt)) {
-		decision.inject = joinSections([PROMPT_SEARCH_TIP, findingsBlock]);
+		decision.inject = findingsBlock;
 		return decision;
 	}
 	const timeoutMs = input.io.timeoutMs ?? 22e3;
@@ -2429,7 +2696,11 @@ async function decidePromptSubmitV2(input) {
 		if (timer) clearTimeout(timer);
 		controller.abort();
 	}
-	decision.inject = joinSections([goal, findingsBlock]);
+	decision.inject = joinSections([
+		PROMPT_SEARCH_TIP,
+		goal,
+		findingsBlock
+	]);
 	return decision;
 }
 /**
@@ -2452,8 +2723,19 @@ const OPERATOR_DENIED_MCP_PREFIXES = ["mcp__workers__", "mcp__orchestrate__"];
 * both by the PreToolUse hook handler and by config-assertion tests. When
 * operator mode is off, nothing is blocked (normal sessions unaffected).
 */
-function shouldDenyOperatorTool(toolName, operatorMode) {
+function parseWorkerMode(toolName) {
+	if (!toolName.startsWith("mcp__workers__")) return null;
+	const mode = toolName.slice(14);
+	return ALL_WORKER_DISPATCH_MODES.includes(mode) ? mode : null;
+}
+function isMatchingWorkerDispatcher(toolName, input) {
+	const mode = parseWorkerMode(toolName);
+	if (mode === null) return false;
+	return input?.agent_type === dispatcherAgentName(mode);
+}
+function shouldDenyOperatorTool(toolName, operatorMode, input) {
 	if (!operatorMode) return false;
+	if (isMatchingWorkerDispatcher(toolName, input)) return false;
 	return OPERATOR_DENIED_MCP_PREFIXES.some((prefix) => toolName.startsWith(prefix));
 }
 /**
@@ -2472,9 +2754,9 @@ function assertShapingInstalled(agentsMode, injectionSucceeded) {
 * calls to local worker/orchestrate MCP tools are blocked so those backends stay
 * reachable through the worker-* Agent subagents rather than the lead context.
 */
-function operatorPreToolUse(toolName, operatorMode, _input) {
+function operatorPreToolUse(toolName, operatorMode, input) {
 	if (!operatorMode) return { block: false };
-	if (shouldDenyOperatorTool(toolName, operatorMode)) return {
+	if (shouldDenyOperatorTool(toolName, operatorMode, input)) return {
 		block: true,
 		reason: `${toolName} is subagent-only in cloud-agent operator mode — use the worker-* Agent subagents or delegate implementation to a GitHub cloud agent via the first-mate MCP instead of calling local worker/orchestrate MCP tools from the main operator.`
 	};
@@ -2497,12 +2779,12 @@ const internalFirstMateGuard = defineCommand({
 	},
 	run() {
 		let toolName = "";
-		let toolInput;
+		let hookInput;
 		let parsed = false;
 		try {
 			const payload = JSON.parse(readStdinSync());
 			if (typeof payload.tool_name === "string") toolName = payload.tool_name;
-			if (typeof payload.tool_input === "object" && payload.tool_input !== null) toolInput = payload.tool_input;
+			if (typeof payload.agent_type === "string") hookInput = { agent_type: payload.agent_type };
 			parsed = true;
 		} catch {
 			parsed = false;
@@ -2514,7 +2796,7 @@ const internalFirstMateGuard = defineCommand({
 			}
 			process.exit(0);
 		}
-		const decision = operatorPreToolUse(toolName, true, toolInput);
+		const decision = operatorPreToolUse(toolName, true, hookInput);
 		if (decision.block) {
 			process.stderr.write(decision.reason ?? `${toolName} is disabled in operator mode`);
 			process.exit(2);
@@ -2533,7 +2815,7 @@ function buildFirstMateGuardHookCommand(execPath, entry) {
 //#region src/lib/injected-skills/first-mate-setup-skill.ts
 const FIRST_MATE_SETUP_SKILL = {
 	name: "gh-first-mate-scaffold",
-	md: "---\nname: gh-first-mate-scaffold\ndescription: Seed a world-class repo-geared agentic-dev foundation through first-mate.\nuser-invocable: true\n---\n\n# gh-first-mate-scaffold\n\nInvoke the `scaffold_repo` MCP tool (`mcp__first-mate__scaffold_repo`) before the first build wave on an owned repository. The goal is not generic TODO stubs; it is a repo-geared foundation that GitHub agents, local agents, reviewers, and CI can read.\n\n## What it seeds\n\n- `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / `.github/copilot-instructions.md` — identical guidance with overview, detected stack, commands, hard DoD gate, primary OS, conventions, structure, decisions/memory, handoff, testing, and gotchas.\n- `.github/agents/{planner,implementer,reviewer,researcher,tester}.md` mirrored into `.claude/agents/` — role agents with frontmatter, cold-start contract, method, quality bar, output contract, and self-reminder.\n- `docs/adrs/0000-template.md` plus `docs/adr/0001-record-architecture-decisions.md` — Nygard-style decision record foundation.\n- `LEARNINGS.md`, `CHANGELOG.md`, `docs/history/0000-template.md`, `docs/plans/README.md`, and `docs/research/README.md` — durable memory, history, plans, and research conventions.\n- `.github/pull_request_template.md` — summary, type, failure-modes-considered-and-tested, and DoD checklist.\n- `.github/instructions/tests.instructions.md` — path-scoped test guidance filled from detected framework/dir/glob where possible.\n- `.github/workflows/copilot-setup-steps.yml` and starter `.github/workflows/ci.yml` — detected toolchain setup with stable quality-gate job names.\n\nIt does not seed factory-protocol or `docs/factory/` files. Orchestration remains outside the product repo in first-mate.\n\n## Usage\n\n```\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\" })\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\", mode: \"enhance\" })\nmcp__first-mate__scaffold_repo({\n  repo: \"owner/repo\",\n  mode: \"add-missing-only\",\n  detection_overrides: { primary_os: \"windows-latest\", test_command: \"npm test\" }\n})\n```\n\nModes:\n\n- `add-missing-only` (default): seed absent files and skip present files.\n- `enhance`: for guidance files, ADR index, changelog, and learnings, append only missing `##` sections; never rewrite existing prose. Other present files are skipped.\n- `overwrite-approved`: replace existing files only when explicitly approved.\n\nAlways inspect the returned per-file report and PR. A no-op result means the repo already has the foundation or has no missing enhanceable sections.\n"
+	md: "---\nname: gh-first-mate-scaffold\ndescription: Scaffolds a repo-geared agentic-dev foundation through first-mate: seeds guidance files, role agents, ADRs, changelog, learnings, PR template, test instructions, Copilot setup, and CI through a scaffold branch and PR. Use before the first build wave on an owned repository.\nuser-invocable: true\n---\n\n# gh-first-mate-scaffold\n\nInvoke the `scaffold_repo` MCP tool (`mcp__first-mate__scaffold_repo`) before the first build wave on an owned repository. The goal is not generic TODO stubs; it is a repo-geared foundation that GitHub agents, local agents, reviewers, and CI can read.\n\n## What it seeds\n\n- `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / `.github/copilot-instructions.md` — identical guidance with overview, detected stack, commands, hard DoD gate, primary OS, conventions, structure, decisions/memory, handoff, testing, and gotchas.\n- `.github/agents/{planner,implementer,reviewer,researcher,tester}.md` mirrored into `.claude/agents/` — role agents with frontmatter, cold-start contract, method, quality bar, output contract, and self-reminder.\n- `docs/adrs/0000-template.md` plus `docs/adr/0001-record-architecture-decisions.md` — Nygard-style decision record foundation.\n- `LEARNINGS.md`, `CHANGELOG.md`, `docs/history/0000-template.md`, `docs/plans/README.md`, and `docs/research/README.md` — durable memory, history, plans, and research conventions.\n- `.github/pull_request_template.md` — summary, type, failure-modes-considered-and-tested, and DoD checklist.\n- `.github/instructions/tests.instructions.md` — path-scoped test guidance filled from detected framework/dir/glob where possible.\n- `.github/workflows/copilot-setup-steps.yml` and starter `.github/workflows/ci.yml` — detected toolchain setup with stable quality-gate job names.\n\nIt does not seed factory-protocol or `docs/factory/` files. Orchestration remains outside the product repo in first-mate.\n\n## Usage\n\n```\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\" })\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\", mode: \"enhance\" })\nmcp__first-mate__scaffold_repo({\n  repo: \"owner/repo\",\n  mode: \"add-missing-only\",\n  detection_overrides: { primary_os: \"windows-latest\", test_command: \"npm test\" }\n})\n```\n\nModes:\n\n- `add-missing-only` (default): seed absent files and skip present files.\n- `enhance`: for guidance files, ADR index, changelog, and learnings, append only missing `##` sections; never rewrite existing prose. Other present files are skipped.\n- `overwrite-approved`: replace existing files only when explicitly approved.\n\nAlways inspect the returned per-file report and PR. A no-op result means the repo already has the foundation or has no missing enhanceable sections.\n"
 };
 
 //#endregion
@@ -2542,7 +2824,7 @@ const FIRST_MATE_SKILL = {
 	name: "gh-first-mate",
 	md: `---
 name: gh-first-mate
-description: Thin operating protocol for the first-mate GitHub cloud-agent controller: start missions, wake the durable controller loop, answer model and human requests, keep context compact, and report from the board/ledger rather than rereading full diffs or logs.
+description: Thin operating protocol for the first-mate GitHub cloud-agent controller: starts missions, wakes the durable loop, answers model and human requests, keeps context compact, and reports from the board/ledger. Use when the user wants first-mate to drive GitHub cloud coding agents across one or more repositories with foundation-first scaffolding and scoped, testable work.
 user-invocable: true
 ---
 
@@ -2693,7 +2975,7 @@ const FLOOR_KEEPER_SKILL = {
 	name: "gh-floor-keeper",
 	md: `---
 name: gh-floor-keeper
-description: Done-checkpoint verification for non-trivial changes: run the executable gate, send the diff to OpenAI and Google reviewers, consult the advisor, reconcile findings by severity, author missing tests through a different lab when bounded and appropriate, and return an honest go/no-go before declaring work complete.
+description: Done-checkpoint verification for non-trivial changes: runs the executable gate, sends the diff to OpenAI and Google reviewers, consults the advisor, reconciles findings by severity, authors missing tests through a different lab when bounded and appropriate, and returns an honest go/no-go. Use before declaring non-trivial work complete.
 user-invocable: true
 ---
 
@@ -2844,7 +3126,7 @@ const ORCHESTRATE_SKILL = {
 	name: "gh-orchestrate",
 	md: `---
 name: gh-orchestrate
-description: Right-sized blind-spot-elimination for non-trivial implementation asks: capture user-blessed acceptance criteria, delegate bounded research, decompose and plan, compose a native Workflow with explicit deterministic/advisory annotations, verify the workflow, checkpoint residual risks and cost, then run only when the pipeline actually raises the floor.
+description: Right-sized blind-spot-elimination for non-trivial implementation asks: captures user-blessed acceptance criteria, delegates bounded research, decomposes and plans, composes a native Workflow with explicit deterministic/advisory annotations, verifies the workflow, checkpoints residual risks and cost, then runs only when the pipeline actually raises the floor. Use when a non-trivial implementation ask benefits from workflow-level blind-spot reduction.
 user-invocable: true
 ---
 
@@ -2983,7 +3265,7 @@ const RESEARCH_SKILL = {
 	name: "gh-research",
 	md: `---
 name: gh-research
-description: Bounded saturation research for non-trivial GitHub Router asks: enumerate unknowns, gather in parallel through code search, web search, and explore workers, adversarially verify load-bearing claims, persist a freshness-stamped brief, and return a compact confidence-tagged root-cause summary when you need grounded context before planning or changing code.
+description: Bounded saturation research for non-trivial GitHub Router asks: enumerates unknowns, gathers in parallel through code search, web search, and explore workers, adversarially verifies load-bearing claims, persists a freshness-stamped brief, and returns a compact confidence-tagged root-cause summary. Use when grounded context is needed before planning or changing code.
 user-invocable: true
 ---
 
@@ -3102,7 +3384,7 @@ const WORKER_SKILL = {
 	name: "gh-worker",
 	md: `---
 name: gh-worker
-description: How to run github-router workers without blocking your turn. Workers (explore/implement/review/plan/test) can run up to 6 hours; dispatch the matching worker-* background subagent so you get a completion notification instead of waiting. Use whenever you would reach for a worker.
+description: Runs github-router workers without blocking the turn: dispatches the matching worker-* background subagent (explore/implement/review/plan/test, up to 6 hours each) for a completion notification instead of a blocking wait. Use when a task would benefit from a background worker for investigation, planning, review, implementation, or test authoring.
 user-invocable: true
 ---
 
@@ -3156,7 +3438,7 @@ const ARTIFACT_REVIEW_SKILL = {
 	name: "gh-artifact-review",
 	md: `---
 name: gh-artifact-review
-description: Review plans and artifacts in the ai-or-die panel. Default to authoring a self-contained HTML artifact (rich, annotatable, optionally interactive) and opening THAT for the human, then drain feedback with artifact_await, revise, and end the loop. Use when running inside an ai-or-die tab and you have a plan, comparison, diagram, table, diff, or report the user should see before proceeding.
+description: Reviews plans and artifacts in the ai-or-die panel. Defaults to authoring a self-contained HTML artifact (rich, annotatable, optionally interactive) and opening THAT for the human, then drains feedback with artifact_await, revises, and ends the loop. Use when running inside an ai-or-die tab and there is a plan, comparison, diagram, table, diff, or report the user should see before proceeding.
 user-invocable: true
 ---
 
@@ -3247,7 +3529,12 @@ const TOOLBELT_MARKER_OPEN = "<!-- gh-router toolbelt awareness — auto-injecte
 const TOOLBELT_MARKER_CLOSE = "<!-- /gh-router toolbelt awareness -->";
 const ARTIFACT_MARKER_OPEN = "<!-- gh-router artifact-panel directive — auto-injected when in an ai-or-die tab -->";
 const ARTIFACT_MARKER_CLOSE = "<!-- /gh-router artifact-panel directive -->";
-const ARTIFACT_PANEL_DIRECTIVE = "## Review in the artifact panel (HTML by default)\n\nYou are running inside an ai-or-die tab, so the `mcp__peers__artifact_*` tools drive a live human-review panel. Default to an HTML artifact for anything the user should review before you proceed, not just plans but also design proposals, comparisons / trade-offs, decisions that need their input, diagrams, tables, code diffs, and reports. Author a self-contained `.html` (inline CSS, no external deps, readable typography) and open it with `mcp__peers__artifact_open` (pass `mode:\"interactive\"` if it carries `data-aod-*` action controls); tell the user to review, then drain their feedback with `mcp__peers__artifact_await` (pass back the returned `cursor` each call), revise, `mcp__peers__artifact_reply`, and `mcp__peers__artifact_end` when done. `artifact_await` returns typed events: `comment` (free-text anchored by selector/text/sourceLine) and `action` (the human clicked a control you emitted). Use `mcp__peers__artifact_update`/`artifact_refresh` to change the shown content and `mcp__peers__artifact_dismiss` to hide the panel while keeping the review alive. `mcp__peers__artifact_poll` is a frozen legacy alias (comments only). Plan-mode plans are auto-rendered to HTML and auto-opened for you; raw markdown is only a fallback. Skip the panel only for trivial one-line answers.\n\nMake the HTML good: match the subject project's design system (its Tailwind / theme / tokens) when the artifact represents a specific app, otherwise clean readable defaults. Per-type cheatsheet. plan: goal, current state, proposed approach, risks / open questions. comparison: options as columns with trade-off rows and a recommendation. table: scannable rows with a sticky header. diagram: boxes + arrows (SVG/CSS or Mermaid). code / diff: `<pre>` with before/after. To let the user act (not just comment), emit declarative controls (no JS): `data-aod-action` (verb) + `data-aod-id` (stable) [+ `data-aod-value`] — a choose-one option fires on click, a multi-select is checkboxes sharing `data-aod-group` plus a submit button with that group. The `gh-artifact-review` skill carries the fuller playbook.";
+function ARTIFACT_PANEL_DIRECTIVE(peersKey = "peers") {
+	const toolPrefix = `mcp__${peersKey}__artifact_`;
+	return `## Review in the artifact panel (HTML by default)
+
+You are running inside an ai-or-die tab, so the \`${toolPrefix}*\` tools drive a live human-review panel. Default to opening a self-contained HTML artifact for anything the user should review before you proceed: plans, design proposals, comparisons / trade-offs, decisions that need their input, diagrams, tables, code diffs, and reports. Plan-mode plans are auto-rendered to HTML and opened for you; skip the panel only for trivial one-line answers. Run the \`gh-artifact-review\` skill for the full playbook: HTML + design conventions, the \`${toolPrefix}open\` / \`${toolPrefix}await\` (pass back the \`cursor\`) / \`${toolPrefix}reply\` / \`${toolPrefix}end\` loop, and the \`data-aod-*\` interactive controls.`;
+}
 /**
 * Writing / communication style directive injected at the TOP of the
 * mirrored CLAUDE.md so every spawned agent (main, Agent-tool subagent,
@@ -3258,27 +3545,45 @@ const ARTIFACT_PANEL_DIRECTIVE = "## Review in the artifact panel (HTML by defau
 */
 const STYLE_DIRECTIVE = "Write concisely without losing detail. Use a natural human voice. Avoid em dashes. Do not attribute work to Claude, AI, LLM, or Anthropic anywhere (commits, PRs, issues, code, comments, docs).";
 /**
-* Operating-defaults directive injected at the TOP of the mirrored CLAUDE.md
-* AND into the main agent's system prompt (`--append-system-prompt`), so it is
-* the highest-salience behavioral default. Two defaults, both explicitly
-* overridden by the user's own direction and the domain's standards:
+* Operating-defaults directive injected at the TOP of the mirrored CLAUDE.md.
+* The main agent's system prompt (`--append-system-prompt`) gets
+* OPERATING_DEFAULTS_DIGEST instead, with this full statement available through
+* CLAUDE.md. Three defaults, each explicitly overridden by the user's own
+* direction and the domain's standards:
 *
 *   1. Orchestrate (strong default): delegate the heavy / parallel /
 *      context-heavy work to the right subagent / worker / model, keeping the
 *      main context free to reason and collaborate with the user, while still
 *      doing trivial / surgical / last-mile work directly (delegating that
 *      would only add relay-fidelity loss + latency).
-*   2. Excellence lens (HYBRID per the peer review): the reliable control
-*      signal is the PRINCIPLE stated plainly; the well-known names appear only
-*      as a "bar to clear" calibration, NOT as "channel X", with an explicit
-*      no-impersonation / no-theatrics guardrail (cross-lab critics: a named
-*      entity is a dense, high-variance vector that pulls in noise + persona
-*      mannerisms at top salience, so the principle leads and the name calibrates).
+*   2. Excellence lens: the principles stated plainly and concretely (radical
+*      simplicity + real-user focus; whole-system first-principles thinking that
+*      anticipates scale; work back from the customer outcome). Named exemplars
+*      were dropped per the injected-surface review: a named entity is a dense,
+*      high-variance vector that pulls in persona mannerisms at top salience, and
+*      the guidance favors specific functional framing over comparison, so
+*      specificity carries the vividness instead.
+*   3. Engineering excellence: quality / robustness / maintainability over
+*      development cost; reproduce a bug end-to-end (as a real user hits it)
+*      before fixing so the fix targets the real cause; a pixel-perfect UI bar;
+*      and fix any lint error / test failure / flake on sight, whoever caused it,
+*      folded into the current work rather than derailing the user's task (the
+*      scope guardrail keeps proactive quality from becoming yak-shaving). The
+*      digest carries a one-line form; the full statement lives here so it does
+*      not cost the context window every turn.
 *
 * Self-referentially compliant with the style directive: no em dashes, no
 * Claude / Anthropic attribution.
 */
-const OPERATING_DEFAULTS_DIRECTIVE = "## Operating defaults (apply when the user has not specified otherwise; the user's explicit direction and the domain's own standards always override)\n\nOrchestrate. Delegate research, implementation, review, and large reads to the right subagent, worker, or model (worker-* agents for background non-blocking runs, Task subagents for parallel work, peer critics for review) so your own context stays free to reason and collaborate with the user. Prefer parallel delegation for independent work. Do trivial, surgical, and last-mile work directly; delegate the rest rather than doing it yourself and filling your own context.\n\nAim high. Default to radical simplicity and relentless focus on the user's real experience (the Jobs and Ive bar for design), whole-systems first-principles thinking that anticipates scale and the long arc (the Gates bar for architecture and tech), and customer obsession that works backwards from the outcome (the Bezos bar for product and business). Question every assumption and prefer what you can derive, reproduce, or test. Adopt the principles, not a persona: no impersonation, name-dropping, or theatrics.";
+const OPERATING_DEFAULTS_DIRECTIVE = "## Operating defaults (apply when the user has not specified otherwise; the user's explicit direction and the domain's own standards always override)\n\nOrchestrate. Delegate research, implementation, review, and large reads to the right subagent, worker, or model (worker-* agents for background non-blocking runs, Task subagents for parallel work, peer critics for review) so your own context stays free to reason and collaborate with the user. Prefer parallel delegation for independent work. Do trivial, surgical, and last-mile work directly; delegate the rest rather than doing it yourself and filling your own context.\n\nAim high. Default to radical simplicity and a relentless focus on the user's real experience: design for the person and the job to be done, not the demo. Reason about the whole system from first principles, anticipating scale and the long arc rather than patching the surface. Work backwards from the outcome the user actually needs. Question every assumption and prefer what you can derive, reproduce, or test.\n\nEngineering excellence. When making technical decisions, give little weight to development cost; prefer quality, simplicity, robustness, scalability, and long-term maintainability. Fix a bug by first reproducing it end to end, as close to how a real user hits it as you can, so you solve the real problem and not a symptom. When testing a product end to end, be picky about the UI and obsessed with pixel perfection: if something clearly looks off, even when it is unrelated to your task, get it fixed along the way. Hold that same bar for the codebase itself: a lint error, a failing test, or a flaky test is worth fixing the moment you see it, whoever introduced it. Fold it into your current work rather than letting it derail the task the user actually asked for.";
+/**
+* Condensed digest of OPERATING_DEFAULTS_DIRECTIVE for the spawned session's
+* system prompt (--append-system-prompt). The FULL directive is prepended to
+* the mirrored CLAUDE.md (read by the main agent and descendants); this digest
+* keeps both behavioral directives at top salience without duplicating the full
+* ~310-token block in the context window every turn. Points to the full copy.
+*/
+const OPERATING_DEFAULTS_DIGEST = "## Operating defaults (the user's explicit direction and the domain's standards always override)\n\nOrchestrate: delegate research, implementation, review, and large reads to the right subagent, worker, or model, preferring parallel delegation for independent work, so your own context stays free to reason and collaborate with the user; do trivial, surgical, and last-mile work directly. Aim high: default to radical simplicity and the user's real experience, whole-system first-principles thinking that anticipates scale and the long arc, and working backwards from the outcome the user actually needs; question every assumption and prefer what you can derive, reproduce, or test. Engineering excellence: prefer quality and long-term maintainability over dev cost; reproduce bugs end to end before fixing; keep a pixel-perfect UI bar; fix any lint, test failure, or flake on sight without letting it derail the task at hand. The full statement of these defaults is in your CLAUDE.md project instructions.";
 /**
 * Skip the helper if the user's `~/.claude/CLAUDE.md` (or, equivalently,
 * the would-be post-write file) has grown past this size.
@@ -3619,10 +3924,11 @@ async function prependStyleDirectiveToMirroredClaudeMd(directive = STYLE_DIRECTI
 /**
 * Prepend the operating-defaults directive (orchestrator posture + hybrid
 * excellence lens; `OPERATING_DEFAULTS_DIRECTIVE` above) to the TOP of the
-* mirrored CLAUDE.md so descendant agents (Agent subagents, agent-teams
-* teammates) inherit it. The main agent gets the same text at higher salience
-* via `--append-system-prompt`. Separate marker fence from the style / peer
-* blocks so all coexist; best-effort (warn-and-continue) like its siblings.
+* mirrored CLAUDE.md so the main agent and descendant agents (Agent subagents,
+* agent-teams teammates) inherit the full statement. The main agent also gets
+* OPERATING_DEFAULTS_DIGEST at higher salience via `--append-system-prompt`.
+* Separate marker fence from the style / peer blocks so all coexist;
+* best-effort (warn-and-continue) like its siblings.
 */
 async function prependOperatingDefaultsToMirroredClaudeMd(directive = OPERATING_DEFAULTS_DIRECTIVE) {
 	await injectMarkerBlock({
@@ -3636,8 +3942,9 @@ async function prependOperatingDefaultsToMirroredClaudeMd(directive = OPERATING_
 /**
 * Append the toolbelt awareness one-liner (which CLI tools are on PATH)
 * to the bottom of the mirrored CLAUDE.md so descendant agents (Agent
-* subagents, agent-teams teammates) learn about the provisioned tools.
-* The main agent gets the same line via `--append-system-prompt`.
+* subagents, agent-teams teammates) and the main agent learn about the
+* provisioned tools via the mirrored CLAUDE.md. This line is not sent via
+* `--append-system-prompt`.
 * Separate marker fence from the peer-awareness / style blocks.
 */
 async function appendToolbeltAwarenessToMirroredClaudeMd(snippet) {
@@ -3655,9 +3962,9 @@ async function appendToolbeltAwarenessToMirroredClaudeMd(snippet) {
 * Gated by the caller on AIORDIE_SESSION_ID (only useful inside a tab). Separate
 * marker fence; best-effort like the style/peer blocks.
 */
-async function prependArtifactPanelDirectiveToMirroredClaudeMd(directive = ARTIFACT_PANEL_DIRECTIVE) {
+async function prependArtifactPanelDirectiveToMirroredClaudeMd(peersKey = "peers") {
 	await injectMarkerBlock({
-		snippet: directive,
+		snippet: ARTIFACT_PANEL_DIRECTIVE(peersKey),
 		markerOpen: ARTIFACT_MARKER_OPEN,
 		markerClose: ARTIFACT_MARKER_CLOSE,
 		position: "top",
@@ -3730,6 +4037,71 @@ const INJECTED_SKILLS = [
 	FIRST_MATE_SETUP_SKILL
 ];
 
+//#endregion
+//#region src/lib/attribution-settings.ts
+/**
+* Deterministic backstop for the injected "no attribution" style directive.
+*
+* github-router injects a CLAUDE.md style directive telling the agent not to
+* attribute work to Claude / AI / Anthropic. That directive is ADVISORY (prose
+* the model may or may not follow). Claude Code also exposes a HARNESS-ENFORCED
+* control that suppresses attribution at the source: the `attribution`
+* settings.json key (Claude Code v2.0.62+; string `commit` / `pr` sub-fields),
+* which supersedes the deprecated boolean `includeCoAuthoredBy`. Setting both
+* sub-fields to the empty string removes the "Generated with Claude Code"
+* commit footer and the "Co-Authored-By: Claude" byline from commits and PRs.
+* Because the harness reads and applies this itself, it holds even when the
+* model ignores the prose directive — a deterministic backstop, not a second
+* suggestion.
+*
+* PRESENCE-GUARDED. If the mirrored settings already carry `attribution` OR
+* `includeCoAuthoredBy`, the user expressed a deliberate preference in their
+* real config (which the one-way mirror snapshotted); we DO NOT override it.
+* Only a user who has expressed no preference receives github-router's
+* no-attribution default. This keeps faith with "the user's explicit direction
+* always overrides".
+*
+* The mirror is a per-launch snapshot of the user's real `~/.claude` config, so
+* this write never propagates back to the user's own settings.json. A
+* project-scope `<repo>/.claude/settings.json` still overrides the mirror
+* (global scope) at runtime, so the default remains overridable per-repo.
+*
+* Failure model matches the sibling settings writers: a transient read error
+* or a non-object settings.json throws (never clobber a file we don't
+* understand); the caller wraps this in warn-and-continue so a settings-write
+* hiccup never blocks launch.
+*/
+async function injectAttributionSuppressionIntoSettingsFile(settingsPath) {
+	let existing = {};
+	let raw;
+	try {
+		raw = await fs.readFile(settingsPath, "utf8");
+	} catch (err) {
+		if (err.code !== "ENOENT") throw err;
+		raw = void 0;
+	}
+	if (raw !== void 0) {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) existing = parsed;
+		else throw new Error(`settings.json at ${settingsPath} is not a JSON object; refusing to overwrite`);
+	}
+	if ("attribution" in existing || "includeCoAuthoredBy" in existing) return {
+		written: false,
+		reason: "user-set"
+	};
+	const merged = {
+		...existing,
+		attribution: {
+			commit: "",
+			pr: ""
+		}
+	};
+	const tmp = `${settingsPath}.${process.pid}.attr.tmp`;
+	await fs.writeFile(tmp, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+	await fs.rename(tmp, settingsPath);
+	return { written: true };
+}
+
 //#endregion
 //#region src/lib/toolbelt/provision.ts
 /** Per-download cap (bytes) — these binaries are a few MB at most. */
@@ -4344,7 +4716,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version$1 = "0.3.168";
+var version$1 = "0.3.175";
 
 //#endregion
 //#region src/lib/approval.ts
@@ -8097,14 +8469,15 @@ const claude = defineCommand({
 		};
 		let onShutdown = baseShutdown;
 		let peerAwarenessSnippet;
+		let peerAwarenessSummary;
 		if (args["codex-mcp"] !== false) try {
 			const requestedCli = args["codex-cli"] ?? false;
 			const backend = resolveCodexCliBackend({
 				requested: requestedCli,
 				codexInfo: requestedCli ? getCodexVersion() : null
 			});
-			const geminiAvailable = state.models?.data.some((m) => /^gemini-3\..*pro/i.test(m.id)) ?? false;
-			if (!geminiAvailable) consola.info("gemini-3.1-pro-preview not found in your Copilot model catalog; gemini-critic persona will not be registered.");
+			const geminiModelsAvailable = geminiAvailable();
+			if (!geminiModelsAvailable) consola.info("gemini-3.1-pro-preview not found in your Copilot model catalog; gemini-critic persona will not be registered.");
 			const enabledGroups = [
 				"peers",
 				"search",
@@ -8118,7 +8491,7 @@ const claude = defineCommand({
 			const { keys: groupKeys, skipped: skippedGroups } = await resolveGroupKeysFromMirror(enabledGroups);
 			const runtime = await writePeerMcpRuntimeFiles(serverUrl, {
 				codexCli: backend === "cli",
-				geminiAvailable,
+				geminiAvailable: geminiModelsAvailable,
 				groupKeys,
 				workerToolsAvailable: workerToolsEnabled(),
 				browseAvailable: browseAgentEnabled(),
@@ -8133,7 +8506,7 @@ const claude = defineCommand({
 			};
 			const injected = await injectPeerMcpIntoMirror(serverUrl, {
 				codexCli: backend === "cli",
-				geminiAvailable,
+				geminiAvailable: geminiModelsAvailable,
 				groupKeys,
 				nonce: runtime.nonce
 			});
@@ -8189,10 +8562,10 @@ const claude = defineCommand({
 			} catch (err) {
 				consola.warn(`Could not register the ai-or-die session-bind hook: ${String(err)}`);
 			}
-			if ((process$1.env.AIORDIE_SESSION_ID ?? "").trim().length > 0) {
+			if (artifactToolsEnabled()) {
 				await writeInjectedSkill(ARTIFACT_REVIEW_SKILL.name, ARTIFACT_REVIEW_SKILL.md).catch(() => ({ written: false }));
 				try {
-					await prependArtifactPanelDirectiveToMirroredClaudeMd();
+					await prependArtifactPanelDirectiveToMirroredClaudeMd(groupKeys.peers);
 				} catch (err) {
 					consola.warn(`Artifact-panel directive prepend failed: ${String(err)}`);
 				}
@@ -8203,6 +8576,11 @@ const claude = defineCommand({
 					consola.warn(`Could not register the artifact auto-open hook: ${String(err)}`);
 				}
 			}
+			if (hookMcpRuntimeFromEnv(envVars) && planReviewEnabled()) try {
+				await injectStopHookIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), buildPlanReviewHookCommand(process$1.execPath, process$1.argv[1]), "PostToolUse", void 0, "ExitPlanMode");
+			} catch (err) {
+				consola.warn(`Could not register the advisory plan-review hook: ${String(err)}`);
+			}
 			if (args["trust-gate"] === true) try {
 				const root = await trustRepo(sessionCwd);
 				process$1.stderr.write(`Structural gate trusted for this repo (${root}); it will run on launch here from now on.\n`);
@@ -8306,19 +8684,30 @@ const claude = defineCommand({
 			} else if (!gateDisabled && !descriptor && !discovering) process$1.stderr.write("Structural Stop-gate not enabled: no checks found in this repo (looked at package.json scripts / CI workflows / Makefile / Cargo.toml / go.mod / pyproject). Force a sealed gate with GH_ROUTER_ENABLE_STOP_GATE=1" + (workerToolsEnabled() ? ", or let a model discover them with GH_ROUTER_ENABLE_GATE_DISCOVERY=1" : "") + ".\n");
 			const peerSnippet = buildPeerAwarenessSnippet({
 				codexCli: backend === "cli",
-				geminiAvailable,
+				geminiAvailable: geminiModelsAvailable,
 				workerToolsAvailable: workerToolsEnabled(),
 				standInAvailable: standInToolEnabled(),
-				browseAvailable: state.browseEnabled,
+				browseAvailable: browserToolsEnabled(),
+				compoundBrowseAvailable: browserCompoundToolsEnabled(),
 				powerBrowseAvailable: state.powerBrowseEnabled,
+				fleetAvailable: fleetToolsEnabled(),
 				agentToolsAvailable: agentToolsEnabled(),
+				implementerAvailable: implementerSubagentModel() != null,
 				groupKeys
 			});
 			peerAwarenessSnippet = peerSnippet;
+			peerAwarenessSummary = buildPeerAwarenessSummary({
+				workerToolsAvailable: workerToolsEnabled(),
+				standInAvailable: standInToolEnabled(),
+				browseAvailable: browserToolsEnabled(),
+				fleetAvailable: fleetToolsEnabled(),
+				agentToolsAvailable: agentToolsEnabled(),
+				groupKeys
+			});
 			try {
 				await appendPeerAwarenessToMirroredClaudeMd(peerSnippet);
 			} catch (err) {
-				consola.warn(`Peer-awareness CLAUDE.md append failed (main agent still covered via --append-system-prompt): ${err instanceof Error ? err.message : String(err)}`);
+				consola.warn(`Peer-awareness CLAUDE.md append failed (agent keeps tool descriptions via tools/list, loses the inventory overview): ${err instanceof Error ? err.message : String(err)}`);
 			}
 			try {
 				await prependStyleDirectiveToMirroredClaudeMd();
@@ -8328,12 +8717,17 @@ const claude = defineCommand({
 		} catch (err) {
 			consola.warn(`Peer MCP wiring failed (claude will launch without it): ${err instanceof Error ? err.message : String(err)}`);
 		}
-		extraArgs.push("--append-system-prompt", peerAwarenessSnippet ? `${OPERATING_DEFAULTS_DIRECTIVE}\n\n${peerAwarenessSnippet}` : OPERATING_DEFAULTS_DIRECTIVE);
+		extraArgs.push("--append-system-prompt", peerAwarenessSnippet && peerAwarenessSummary ? `${OPERATING_DEFAULTS_DIGEST}\n\n${peerAwarenessSummary}` : OPERATING_DEFAULTS_DIGEST);
 		try {
 			await prependOperatingDefaultsToMirroredClaudeMd();
 		} catch (err) {
 			consola.warn(`Operating-defaults CLAUDE.md prepend failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		if (process$1.env.GH_ROUTER_DISABLE_NO_ATTRIBUTION !== "1") try {
+			await injectAttributionSuppressionIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"));
+		} catch (err) {
+			consola.warn(`No-attribution settings backstop skipped: ${err instanceof Error ? err.message : String(err)}`);
+		}
 		launchChild({
 			kind: "claude-code",
 			envVars,
@@ -8492,114 +8886,6 @@ const debug = defineCommand({
 	}
 });
 
-//#endregion
-//#region src/lib/orchestration/hook-mcp-client.ts
-/**
-* Read the proxy URL + nonce the launcher injected into the spawned child env
-* (`GH_ROUTER_HOOK_MCP_URL` / `GH_ROUTER_HOOK_NONCE`). Returns undefined when
-* either is absent — the hook then skips its LLM layer and falls back to its
-* deterministic / regex behavior.
-*/
-function hookMcpRuntimeFromEnv(env = process.env) {
-	const serverUrl = (env.GH_ROUTER_HOOK_MCP_URL ?? "").trim();
-	const nonce = (env.GH_ROUTER_HOOK_NONCE ?? "").trim();
-	if (serverUrl.length === 0 || nonce.length === 0) return void 0;
-	return {
-		serverUrl,
-		nonce
-	};
-}
-/**
-* POST a JSON-RPC `tools/call` and return the tool's text + isError. Throws on
-* any transport/HTTP/parse failure (caller fails open). A JSON-RPC `error`
-* envelope is mapped to `{ text: message, isError: true }` (a well-formed
-* negative result, not a transport failure).
-*/
-async function callMcpTool(opts) {
-	const body = await postJson(`${opts.runtime.serverUrl.replace(/\/+$/, "")}/mcp/${opts.group}`, {
-		jsonrpc: "2.0",
-		id: 1,
-		method: "tools/call",
-		params: {
-			name: opts.tool,
-			arguments: opts.args
-		}
-	}, {
-		timeoutMs: opts.timeoutMs,
-		signal: opts.signal,
-		headers: { Authorization: `Bearer ${opts.runtime.nonce}` }
-	});
-	const rpc = body && typeof body === "object" ? body : {};
-	if (rpc.error) return {
-		text: rpc.error.message ?? "MCP error",
-		isError: true
-	};
-	return {
-		text: (Array.isArray(rpc.result?.content) ? rpc.result.content : []).filter((p) => p && p.type === "text" && typeof p.text === "string").map((p) => p.text).join(""),
-		isError: rpc.result?.isError === true
-	};
-}
-/**
-* One non-streaming gpt-5.5 (or any model id) inference via `/v1/responses`.
-* Returns the assistant text (possibly empty). Throws on transport/HTTP/parse
-* failure. `effort` maps to the Responses `reasoning.effort` knob.
-*/
-async function callInference(opts) {
-	const body = await postJson(`${opts.serverUrl.replace(/\/+$/, "")}/v1/responses`, {
-		model: opts.model,
-		instructions: opts.instructions,
-		input: [{
-			role: "user",
-			content: [{
-				type: "input_text",
-				text: opts.input
-			}]
-		}],
-		stream: false,
-		reasoning: { effort: opts.effort }
-	}, {
-		timeoutMs: opts.timeoutMs,
-		signal: opts.signal
-	});
-	const out = [];
-	const items = Array.isArray(body?.output) ? body.output : [];
-	for (const item of items) {
-		if (item?.type !== "message" || item.role !== "assistant") continue;
-		const parts = Array.isArray(item.content) ? item.content : [];
-		for (const part of parts) if ((part?.type === "output_text" || part?.type === "text") && typeof part.text === "string") out.push(part.text);
-	}
-	return out.join("");
-}
-/**
-* POST `payload` as JSON with a hard timeout, returning the parsed JSON body.
-* Throws on non-2xx, network error, timeout (AbortController), or non-JSON body.
-* An external `signal` is honored alongside the internal timeout.
-*/
-async function postJson(url, payload, opts) {
-	const controller = new AbortController();
-	const timer = setTimeout$1(() => controller.abort(/* @__PURE__ */ new Error("hook MCP request timed out")), opts.timeoutMs);
-	const onExternalAbort = () => controller.abort(/* @__PURE__ */ new Error("hook MCP request aborted"));
-	if (opts.signal) if (opts.signal.aborted) onExternalAbort();
-	else opts.signal.addEventListener("abort", onExternalAbort, { once: true });
-	try {
-		const res = await fetch(url, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				Accept: "application/json",
-				...opts.headers
-			},
-			body: JSON.stringify(payload),
-			signal: controller.signal
-		});
-		if (!res.ok) throw new Error(`hook MCP request failed: HTTP ${res.status}`);
-		return await res.json();
-	} finally {
-		clearTimeout$1(timer);
-		if (opts.signal) opts.signal.removeEventListener("abort", onExternalAbort);
-	}
-}
-
 //#endregion
 //#region src/internal-prompt-submit.ts
 /**
@@ -8609,7 +8895,7 @@ async function postJson(url, payload, opts) {
 * no such handle. Hooks always receive piped/redirected stdin, so this never
 * blocks (guarded against an interactive TTY, and any error -> "").
 */
-function readStdin$4() {
+function readStdin$5() {
 	try {
 		if (process.stdin.isTTY) return "";
 		return readFileSync(0, "utf8");
@@ -8640,7 +8926,7 @@ const internalPromptSubmit = defineCommand({
 	},
 	async run() {
 		try {
-			const stdin = readStdin$4();
+			const stdin = readStdin$5();
 			const steerEnabled = parseBoolEnv(process.env.GH_ROUTER_DISABLE_PROMPT_STEER) !== true;
 			const runtime = hookMcpRuntimeFromEnv();
 			let decision;
@@ -8692,6 +8978,99 @@ const internalPromptSubmit = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/internal-plan-review.ts
+function readStdin$4() {
+	try {
+		if (process.stdin.isTTY) return "";
+		return readFileSync(0, "utf8");
+	} catch {
+		return "";
+	}
+}
+async function readDetachedPayload() {
+	const payloadPath = (process.env.GH_ROUTER_PLAN_REVIEW_PAYLOAD ?? "").trim();
+	if (payloadPath.length === 0) return void 0;
+	try {
+		const raw = await promises.readFile(payloadPath, "utf8");
+		await promises.unlink(payloadPath).catch(() => {});
+		const parsed = JSON.parse(raw);
+		if (!parsed || typeof parsed !== "object") return void 0;
+		const p = parsed;
+		if (!p.sessionId || !p.cwd || !p.plan || !p.planHash) return void 0;
+		return {
+			sessionId: p.sessionId,
+			cwd: p.cwd,
+			plan: p.plan,
+			planHash: p.planHash
+		};
+	} catch {
+		await promises.unlink(payloadPath).catch(() => {});
+		return;
+	}
+}
+function spawnDetachedPlanReview(ctx) {
+	let payloadPath;
+	try {
+		const dir = stopReviewStateDir();
+		mkdirSync(dir, { recursive: true });
+		payloadPath = nodePath.join(dir, `plan-review-${process.pid}-${randomBytes(4).toString("hex")}.json`);
+		writeFileSync(payloadPath, JSON.stringify(ctx), { mode: 384 });
+		const scriptArgs = process.argv[1] && process.argv[1] !== process.execPath ? [process.argv[1]] : [];
+		const child = spawn(process.execPath, [...scriptArgs, "internal-plan-review"], {
+			detached: true,
+			windowsHide: true,
+			stdio: "ignore",
+			env: {
+				...process.env,
+				GH_ROUTER_PLAN_REVIEW_PAYLOAD: payloadPath
+			}
+		});
+		const orphan = payloadPath;
+		child.on("error", () => {
+			if (orphan) try {
+				unlinkSync(orphan);
+			} catch {}
+		});
+		child.unref();
+	} catch {
+		if (payloadPath) try {
+			unlinkSync(payloadPath);
+		} catch {}
+	}
+}
+const internalPlanReview = defineCommand({
+	meta: {
+		name: "internal-plan-review",
+		description: "Internal: advisory ExitPlanMode plan reviewer. Spawns a bounded detached critic review for substantive plans and writes findings for the next prompt. Always exit 0."
+	},
+	async run() {
+		try {
+			const runtime = hookMcpRuntimeFromEnv();
+			if (!runtime) return;
+			const detached = await readDetachedPayload();
+			if (detached) {
+				await runPlanReview({
+					runtime,
+					sessionId: detached.sessionId,
+					cwd: detached.cwd,
+					plan: detached.plan,
+					findingsStore: fileFindingsStore(stopReviewStateDir())
+				});
+				return;
+			}
+			const decision = await decidePlanReviewHook({
+				stdin: readStdin$4(),
+				runtimeAvailable: true,
+				debounce: filePlanReviewDebounce(stopReviewStateDir()),
+				fallbackCwd: process.cwd()
+			});
+			if (decision.kind === "spawn") spawnDetachedPlanReview(decision);
+		} catch {}
+		process.exitCode = 0;
+	}
+});
+
 //#endregion
 //#region src/internal-session-bind.ts
 /**
@@ -9094,17 +9473,20 @@ function readStdin$1() {
 const MAX_DIFF_BYTES = 2 * 1024 * 1024;
 /** Capture the working-tree diff WITHOUT mutating the user's index (no
 *  `git add -N`): `git diff HEAD` covers modified tracked files, which is where
-*  gate-weakening edits live. Best-effort: any git failure yields an empty diff
-*  (the weakening scan is then a no-op; the executable gate still runs). Capped. */
+*  gate-weakening edits live. A git failure rejects, so the decision layer can run
+*  checks with an empty weakening scan instead of treating an unknown diff as a
+*  genuine no-diff turn. Capped. */
 async function captureDiff(cwd) {
-	const out = (await runCommandCapture([
+	const r = await runCommandCapture([
 		"git",
 		"diff",
 		"HEAD"
 	], {
 		cwd,
 		timeoutMs: 5e3
-	}).catch(() => void 0))?.stdout ?? "";
+	});
+	if (r.code !== 0) throw new Error(`git diff failed with exit ${r.code}`);
+	const out = r.stdout;
 	return out.length > MAX_DIFF_BYTES ? out.slice(0, MAX_DIFF_BYTES) : out;
 }
 /** Flush a message to stderr before exiting (process.exit can drop an unflushed
@@ -9682,7 +10064,7 @@ process.on("uncaughtException", (error) => {
 const version = getPackageVersion();
 const argv = process.argv.slice(2);
 const isVersionFlag = argv.includes("--version");
-const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-session-bind" || argv[0] === "internal-artifact-open" || argv[0] === "internal-first-mate-guard" || argv[0] === "internal-worker-guard";
+const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-plan-review" || argv[0] === "internal-session-bind" || argv[0] === "internal-artifact-open" || argv[0] === "internal-first-mate-guard" || argv[0] === "internal-worker-guard";
 if (!isVersionFlag && !isInternalHook) consola.info(`github-router v${version}`);
 await runMain(defineCommand({
 	meta: {
@@ -9701,6 +10083,7 @@ await runMain(defineCommand({
 		"internal-stop-hook": internalStopHook,
 		"internal-prompt-submit": internalPromptSubmit,
 		"internal-stop-review": internalStopReview,
+		"internal-plan-review": internalPlanReview,
 		"internal-session-bind": internalSessionBind,
 		"internal-artifact-open": internalArtifactOpen,
 		"internal-first-mate-guard": internalFirstMateGuard,