github-router 0.3.249 → 0.3.255

package/dist/attribution-settings-CegtE0TY.js

@@ -0,0 +1,2347 @@
+import { St as DEFINITION_OF_GREATNESS, c as personasFor, i as buildAgentPrompt, n as MCP_GROUPS, t as GROUP_META, xt as CONDENSED_OPERATING_SEQUENCE } from "./peer-mcp-personas-BDet588n.js";
+import { a as isUnderClaudeConfigMirror, d as writeRuntimeFileSecure, t as PATHS } from "./paths-C1cLZ7Ga.js";
+import { a as STRIPPED_AUTH_ROUTING_ENV_KEYS, n as buildCodexProviderConfigFlags } from "./provision-DSkPa5hY.js";
+import { n as buildWorkspaceHeaderHelperCommand } from "./mcp-workspace-header-CGJbNeHb.js";
+import { a as dispatcherAgentName, c as dispatcherTools, n as activeDispatchModes, o as dispatcherDescription, s as dispatcherPrompt } from "./worker-dispatch-Bj1uYyG9.js";
+import consola from "consola";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+import fs from "node:fs/promises";
+//#region src/lib/codex-mcp-config.ts
+/** The `peers` server is always enabled, so its resolved key always exists;
+*  this convenience reads it with the bare-key fallback for safety. */
+function peersKeyOf(groupKeys) {
+	return groupKeys.peers ?? GROUP_META.peers.preferredKey;
+}
+/** The resolved `workers` server key (bare `workers`, or the `gh-router-workers`
+*  fallback on collision). Used to name the dispatcher tools and the guard
+*  matcher. Falls back to the preferred bare key when the group is absent (the
+*  caller only builds worker dispatchers when the group is enabled anyway). */
+function workersKeyOf(groupKeys) {
+	return groupKeys.workers ?? GROUP_META.workers.preferredKey;
+}
+/**
+* Decide which MCP backend serves the codex personas.
+*
+*   - User passed `--codex-cli` AND codex 0.129+ is on PATH → "cli".
+*     The peer config registers `codex-cli` as a stdio MCP server
+*     spawning `codex mcp-server`; codex personas route there;
+*     gemini-critic stays on the HTTP backend (Codex CLI can't run
+*     Gemini).
+*   - User passed `--codex-cli` but codex is missing or < 0.129 →
+*     fallback to "http" with a warning. Never break
+*     `github-router claude` over a missing optional dep.
+*   - User did not pass `--codex-cli` → "http", read-only personas only.
+*/
+function resolveCodexCliBackend(opts) {
+	if (!opts.requested) return "http";
+	if (!opts.codexInfo || !opts.codexInfo.ok) {
+		const detail = opts.codexInfo?.version ? `installed version "${opts.codexInfo.version}" is too old (need 0.129+)` : "codex CLI not found on PATH";
+		consola.warn(`--codex-cli requested but ${detail}; falling back to HTTP-only Codex MCP backend (codex-implementer will not be registered).`);
+		return "http";
+	}
+	return "cli";
+}
+/**
+* Build one scoped HTTP `mcpServers` entry for a group: `type: http`, the
+* `/mcp/<urlSuffix>` URL, the Bearer-nonce Authorization header, and the
+* per-session workspace `headersHelper` when supplied. Shared by
+* `buildPeerMcpConfig` (the session `.claude.json` entries) AND
+* `buildPeerAgentDefinitions` (the per-subagent inline `mcpServers` frontmatter
+* that sidesteps Claude Code's Agent-tool MCP-inheritance bug, anthropics/
+* claude-code#30280 — a bare name-reference "shares the parent connection" and
+* re-triggers it, so subagents MUST inline the full HTTP config to connect
+* independently). One source of truth so the two can't drift.
+*/
+function httpEntryFor(serverUrl, group, nonce, workspaceHeaderCmd) {
+	const entry = {
+		type: "http",
+		url: `${serverUrl}/mcp/${GROUP_META[group].urlSuffix}`,
+		headers: { Authorization: `Bearer ${nonce}` }
+	};
+	const ws = workspaceHeaderCmd?.trim();
+	if (ws) entry.headersHelper = ws;
+	return entry;
+}
+/**
+* Build the JSON payload for `claude --mcp-config <path>` (and the same
+* entries that get merged into the mirrored `.claude.json`).
+*
+* Emits one HTTP `mcpServers` entry per enabled group present in
+* `opts.groupKeys`, each pointing at its scoped `/mcp/<group>` endpoint
+* under the resolved (bare or prefixed-fallback) config key. When
+* `codexCli` is true, also registers `codex-cli` (stdio) which spawns
+* `codex mcp-server` with the proxy's provider-config flags so codex runs
+* through our Copilot-routed billing path rather than its default
+* api.openai.com.
+*/
+function buildPeerMcpConfig(serverUrl, opts) {
+	const mcpServers = {};
+	const workspaceHeaderCmd = opts.workspaceHeaderCmd?.trim();
+	for (const group of MCP_GROUPS) {
+		const key = opts.groupKeys[group];
+		if (!key) continue;
+		mcpServers[key] = httpEntryFor(serverUrl, group, opts.nonce, workspaceHeaderCmd);
+	}
+	if (opts.codexCli) mcpServers["codex-cli"] = {
+		command: "codex",
+		args: ["mcp-server", ...buildCodexProviderConfigFlags(serverUrl)],
+		env: {
+			OPENAI_BASE_URL: `${serverUrl}/v1`,
+			OPENAI_API_KEY: "dummy",
+			CODEX_HOME: opts.codexHome
+		}
+	};
+	return { mcpServers };
+}
+/**
+* The `peer-review-coordinator` Claude Code subagent — the strongest
+* auto-invocation lever per Phase 2A of the peer-MCP plan. It is NOT a
+* peer-MCP tool; it is a regular Claude Code subagent that runs inside
+* the spawned-claude context, has tool access to the peer MCP tools
+* (codex_critic, codex_reviewer, gemini_critic), and fans out + aggregates.
+*
+* The "use proactively" phrase in the description is the documented Claude
+* Code idiom for subagents the parent (Opus) should delegate to without
+* explicit user request — at the natural checkpoints listed below.
+*
+* Empirically the polling-loop reliability for "use proactively" is ~60%
+* (claude-code-guide expert estimate); the plan calls for an acceptance
+* test (≥7/10 sessions delegate at the right checkpoints) before declaring
+* "auto-invoked". If <7/10 we flip the optional PreToolUse hook on
+* ExitPlanMode to default-on (env-disable-able).
+*/
+function buildCoordinatorAgent(opts) {
+	const peers = ["codex-critic", "opus-critic"];
+	if (opts.geminiAvailable) peers.push("gemini-critic");
+	peers.push("codex-reviewer");
+	if (opts.geminiAvailable) peers.push("gemini-reviewer");
+	return {
+		description: "Coordinates cross-lab adversarial review across codex-critic, opus-critic, gemini-critic, codex-reviewer. Use proactively before non-trivial plans and after non-trivial commits. Always pass artifacts verbatim — peers are fresh-context.",
+		prompt: [
+			"# Subagent: peer-review-coordinator",
+			"",
+			"You orchestrate cross-lab adversarial review for the lead orchestrator (Opus). You have access to these peer-MCP subagents:",
+			"",
+			peers.map((p) => `- \`${p}\``).join("\n"),
+			"",
+			"## When the lead invokes you",
+			"",
+			"The lead's brief will include an artifact (plan, design, diff, or code) and a goal (e.g. 'review before exit-plan', 'review the commit I just made', 'cross-check codex-critic's verdict'). Pick the right peers for the artifact type:",
+			"",
+			"- **Plan / design / architecture choice** → fan out to `codex-critic` (gpt-5.6-sol, strongest reasoning, cross-lab)" + (opts.geminiAvailable ? " AND `gemini-critic` (third-lab triangulation, strong on formal reasoning) in parallel" : "") + ". codex-reviewer is the wrong tool for plans (it's a code-specialist, not an architecture critic).",
+			"- **Concrete diff or single file** → fan out to `codex-reviewer` (gpt-5.3-codex, line-level code specialist, fastest at ~16s)" + (opts.geminiAvailable ? " AND `gemini-reviewer` (gemini-3.1-pro, second-lab line-level review)" : "") + (opts.geminiAvailable ? " AND `gemini-critic` for cross-lab triangulation" : "") + ". For very small changes (<20 lines), one `codex-reviewer` call is enough.",
+			"- **Large artifact** → the only peers that take a large artifact WHOLE are `codex-critic` (gpt-5.6-sol, ≈1M-token input window) and `opus-critic` (Opus-4.7-1M, ≈936K-token input on enterprise catalogs; ≈168K otherwise). Route the full artifact to those for cross-lab coverage. `codex-reviewer` (≈272K) and `gemini-critic` (≈136K) have small windows — see Decomposition below: never summarize or downsize the request to squeeze a large artifact into a small-window peer.",
+			"- **Formal reasoning, proofs, or invariants** → prefer `gemini-critic`" + (opts.geminiAvailable ? " (gemini-3.1-pro, strong on math and formally-stated properties)" : " (NOT REGISTERED in this session — gemini-3.x not in catalog)") + ".",
+			"- **Tie-breaker after codex-critic has weighed in** → call `gemini-critic`" + (opts.geminiAvailable ? "" : " (NOT REGISTERED in this session)") + " or `opus-critic` with the artifact AND codex-critic's verdict for cross-check.",
+			"- **Fast sanity check** → `opus-critic` (~22s, same lab as lead but fresh context — catches confabulation and motivated reasoning).",
+			"",
+			"## Decomposition for large artifacts",
+			"",
+			"Route by the peer's real PROMPT WINDOW (input tokens): `codex-critic` gpt-5.6-sol ≈1M · `opus-critic` Opus-4.7-1M ≈936K (enterprise catalogs; ≈168K otherwise) · `codex-reviewer` gpt-5.3-codex ≈272K · `gemini-critic` gemini-3.1-pro ≈136K. The proxy REJECTS (with an actionable message) any single call whose brief exceeds the target peer's window — it will NOT silently truncate, because dropping lines from a review artifact is worse than a clear error. So: send the full artifact only to peers whose window fits it (large artifacts → `codex-critic` and/or `opus-critic`). When a peer's window is too small (commonly `gemini-critic` at ≈136K, or `codex-reviewer` at ≈272K), do NOT summarize or downsize the request to include it — either skip that peer, or split the artifact into 2-4 logical batches BY CONCERN (not by raw size — semantic batches give better per-batch reviews) that each fit, and call in parallel. Use the big-window peers for the whole and reserve a small-window peer like gemini for the concerns it can actually hold. The proxy's MCP cap allows up to 8 in-flight calls. Aggregate findings yourself before reporting back. (Separately, on the JSON transport a per-effort `predictedTooLong` byte cap still guards the ~60s tools/call timeout for non-SSE clients; Claude Code uses SSE, which streams with heartbeats and isn't subject to that cap.)",
+			"",
+			"## Aggregation contract",
+			"",
+			"When fan-out completes, return a SEVERITY-GROUPED, DEDUPLICATED finding list. Format:",
+			"",
+			"  ## Findings",
+			"  ### HIGH",
+			"  1. <one-line title> — `<file:line>` — sources: codex-critic, gemini-critic (3-lab confirmed if applicable)",
+			"     - bug: <one sentence>",
+			"     - mitigation: <one sentence>",
+			"  ### MEDIUM",
+			"  ...",
+			"  ### LOW",
+			"  ...",
+			"",
+			"Cite which peer raised each finding. If two or more peers raised the SAME finding (cross-lab confirmation), call it out — those are the highest-confidence bugs.",
+			"",
+			"## What NOT to do",
+			"",
+			"- Do not paraphrase or summarize per-peer verdicts BEFORE aggregating; aggregate from the raw verdicts.",
+			"- Do not invent severity labels not present in the source verdicts.",
+			"- Do not call peers serially (waste of wall-clock); always fan out in parallel.",
+			"- Do not consult yourself — you are the coordinator, not a critic.",
+			"",
+			"Self-reminder (read before every reply):",
+			"  Did I fan out in parallel to the right peers for this artifact type?",
+			"  Did I aggregate findings by severity, citing which peer raised each?",
+			"  If two peers agreed, did I flag the cross-lab confirmation?"
+		].join("\n")
+	};
+}
+/**
+* Claude Code's built-in subagents, which the interactive CLI provides natively
+* but the Agent SDK (used by CloudCLI under `serve`) does NOT register — so a
+* serve session shows `Agent type 'Explore' not found`. We re-register them as
+* custom subagents so the model's habitual `Agent(subagent_type:"…")` calls
+* resolve. SERVE-ONLY: never inject these for `github-router claude` (the CLI's
+* native, tuned built-ins would be shadowed by a same-name custom agent).
+*
+* No `tools:` restriction — each inherits the session's full toolset; the role
+* is steered by the prompt (matching the built-ins' behavior without the risk of
+* an over-narrow allowlist). `statusline-setup`/`output-style-setup` are omitted
+* (niche, rarely invoked).
+*/
+const BUILTIN_SUBAGENT_DEFINITIONS = {
+	"general-purpose": {
+		description: "General-purpose agent for researching complex questions, searching for code, and executing multi-step tasks. Use when searching for a keyword or file and you are not confident you will find the right match in the first few tries.",
+		prompt: "You are a general-purpose agent. Research the question or carry out the multi-step task you are given, using the full toolset (read, search, edit, run commands as needed). Work autonomously and return a single, complete final answer — your final message is the whole result, so include the findings, file paths, and any code the caller needs."
+	},
+	Explore: {
+		description: "Read-only search agent for broad fan-out searches — when answering means sweeping many files or directories and you only need the conclusion, not the file dumps. It locates code; it does not modify it.",
+		prompt: "You are a read-only exploration agent. Investigate the codebase to answer the question by reading and searching (Read/Glob/Grep and semantic code search); do NOT modify any files, run mutating commands, or make commits. Cast a wide net, then return a concise conclusion with the relevant file paths and line references — your final message is the whole answer."
+	},
+	Plan: {
+		description: "Software architect agent for designing implementation plans. Use when you need to plan the implementation strategy for a task. Returns a step-by-step plan, identifies critical files, and considers architectural trade-offs.",
+		prompt: "You are a planning agent. Read the codebase (read-only — do not modify files) to design a concrete, ordered implementation plan for the task: the approach, the specific files to change, reuse of existing utilities, risks, and how the result will be verified. Return the plan as your final message."
+	}
+};
+/** Empty-string-safe read of an optional model id. */
+function nonEmptyModel(id) {
+	return id && id.length > 0 ? id : void 0;
+}
+/**
+* The shared "prefer the dedicated tools over shell" steer, appended to every
+* native subagent prompt. `bashUses` names the work that legitimately belongs in
+* Bash for that agent (`builds` for a coder, `repros` for an investigator), the
+* only token that ever differed across the three hand-copied variants this
+* replaces.
+*
+* Deliberately NOT merged with `FILE_TOOL_GUIDANCE` in
+* `anthropic-translate/anthropic-request.ts`: that one is injected at the shim
+* boundary and therefore only reaches shim-routed (non-Claude) models. When a
+* native falls back to the lead's Claude model the shim is bypassed entirely, so
+* this prompt-level copy is the only coverage that survives. Two layers, two
+* different reasons to exist.
+*/
+function fileToolSteer(bashUses) {
+	return `Use the dedicated Edit/Write/Read tools for file changes and Grep/Glob for search; reserve Bash for running ${bashUses}, tests, and git. Do not shell out (sed/awk/python/here-docs) to read or edit files.`;
+}
+/** The read-only half of `fileToolSteer`, for agents that never write. */
+function readOnlyToolSteer() {
+	return "Use Read to read files and Grep/Glob plus the semantic code search tool to find them; Bash is for read-only inspection such as git log, git blame, and git show. Do not modify any file, and do not run mutating commands.";
+}
+/**
+* `tools:` allowlist for the read-only natives (`scout`, `brainstorm`), modelled
+* on Claude Code's own `Explore`/`Plan` built-ins, which run with every tool
+* EXCEPT Agent / Artifact / ExitPlanMode / Edit / Write / NotebookEdit — note
+* that Anthropic's own read-only agent keeps Bash, which is what makes `git log`
+* and `git blame` reachable.
+*
+* Two deliberate deviations, both forced by the frontmatter format:
+*
+*  1. `tools:` is a POSITIVE allowlist with no "all except" form, so the
+*     complement has to be spelled out. Rather than enumerate every harness tool
+*     (which varies by Claude Code version, and would silently drop anything
+*     added later), this lists the read / search / shell core that a read-only
+*     agent actually uses. Tools added by a future release are NOT inherited by
+*     these two agents; that is the price of real enforcement over a prompt that
+*     merely asks nicely.
+*  2. The workers and orchestrate MCP groups are excluded on the same reasoning
+*     that makes `Explore` drop `Agent`: both spawn further agents, so leaving
+*     them in would reintroduce exactly the recursion that exclusion prevents.
+*
+* NOT A SANDBOX. `Bash` is retained because Anthropic's own read-only built-in
+* retains it, and without it an explorer cannot run `git log` / `git blame` /
+* `git show`, which is most of what repository archaeology needs. A shell is a
+* general write primitive, so "read-only" here means the agent has no dedicated
+* mutation tool and is instructed not to mutate, NOT that mutation is
+* impossible. Dropping Edit/Write still removes the path a model reaches for by
+* default. If a future change needs a hard guarantee, this allowlist is not
+* where it can be made.
+*
+* `searchKey` is the RESOLVED group key, not the bare literal: a user-side
+* `mcpServers` collision renames the group (`gh-router-search`, …), and a
+* hardcoded `mcp__search__*` would then grant nothing at all.
+*/
+function readOnlyToolAllowlist(searchKey) {
+	return [
+		"Read",
+		"Grep",
+		"Glob",
+		"Bash",
+		"WebFetch",
+		"WebSearch",
+		`mcp__${searchKey}__*`
+	];
+}
+/**
+* Build the JSON payload for `claude --agents <path>`.
+*
+* Always includes the read-only personas applicable to the mode (gemini
+* is dropped if absent from the catalog); adds `codex-implementer` only
+* when `codexCli` is true. Always appends the `peer-review-coordinator`
+* meta-subagent — the strongest "use proactively" auto-invocation lever
+* per Phase 2A of the peer-MCP plan.
+*/
+function buildPeerAgentDefinitions(opts) {
+	const out = {};
+	const personas = personasFor({
+		codexCli: opts.codexCli,
+		geminiAvailable: opts.geminiAvailable
+	});
+	const peersKey = peersKeyOf(opts.groupKeys);
+	const peersMcp = opts.serverUrl ? { mcpServers: { [peersKey]: httpEntryFor(opts.serverUrl, "peers", opts.nonce, opts.workspaceHeaderCmd) } } : {};
+	for (const persona of personas) out[persona.agentName] = {
+		description: persona.description,
+		prompt: buildAgentPrompt(persona, {
+			codexCli: opts.codexCli,
+			peersKey
+		}),
+		...peersMcp
+	};
+	out["peer-review-coordinator"] = {
+		...buildCoordinatorAgent({
+			codexCli: opts.codexCli,
+			geminiAvailable: opts.geminiAvailable
+		}),
+		...peersMcp
+	};
+	const nativeModel = nonEmptyModel(opts.nativeSubagentModel);
+	const reviewerModel = nonEmptyModel(opts.reviewerModel);
+	const brainstormModel = nonEmptyModel(opts.brainstormModel);
+	const scoutModel = nonEmptyModel(opts.scoutModel);
+	const scribeModel = nonEmptyModel(opts.scribeModel);
+	const modelField = nativeModel ? { model: nativeModel } : {};
+	const searchKey = opts.groupKeys.search ?? GROUP_META.search.preferredKey;
+	const searchMcp = opts.serverUrl ? { mcpServers: { [searchKey]: httpEntryFor(opts.serverUrl, "search", opts.nonce, opts.workspaceHeaderCmd) } } : {};
+	out.implementer = {
+		description: nativeModel ? `Bounded implementation subagent running ${nativeModel} (strong non-Claude coder, maximum reasoning). Use proactively for well-scoped coding tasks — edits, small features, fixes — to keep the lead's context focused; runs in its own context. Model is overridable at spawn.` : `Bounded implementation subagent (native tools, runs on the lead's model in its own context). Use proactively for well-scoped coding tasks — edits, small features, fixes — to keep the lead's context focused. Model is overridable at spawn.`,
+		prompt: "You are a bounded implementation subagent for well-scoped coding tasks. Implement the requested change surgically, matching the surrounding code style and minimizing unrelated churn. " + fileToolSteer("builds") + " Verify with the project's build or tests where applicable. Do the work yourself — do not spawn further subagents. Report exactly what changed and any risks.",
+		...modelField
+	};
+	out.reviewer = {
+		description: reviewerModel ? `Feedback subagent running ${reviewerModel}, a DIFFERENT lab from both the lead and the implementer, so its blind spots are decorrelated from whoever produced the work. Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context (reproduce a failure, run the suite, bisect); prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. It can also REVIEW SCREENSHOTS and other images: just point it at the file and it will look at them (its model accepts up to 10 images per request, more than any other lane here). Model is overridable at spawn.` : `Feedback subagent (native tools, runs on the lead's model in its own context). Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context; prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. Model is overridable at spawn.`,
+		prompt: "You are a feedback subagent. Your job is to tell the caller what is actually true about the artifact you are given — code, a plan, a document, a failure report — and what is wrong with it. Verify against the ACTUAL code by reading it; never assume. Do whatever the assessment requires: reproduce a failure end to end as close to how a real user hits it as you can, form hypotheses and test them against the code and runtime, and isolate the true root cause rather than a symptom. Where the change warrants it, author tests that try to BREAK the implementation (edge cases, error paths, and the acceptance criteria as executable checks), run them, and report which pass and which fail; do NOT modify production code just to make tests pass. " + fileToolSteer("builds") + " Do the work yourself — do not spawn further subagents. Report severity-ranked findings with `file:line` citations, the evidence behind each, and end with a clear go/no-go.",
+		...reviewerModel ? { model: reviewerModel } : {}
+	};
+	out.brainstorm = {
+		description: brainstormModel ? `Divergent-options subagent running ${brainstormModel} (third lab, for approaches the lead would not generate). Use proactively BEFORE an approach is chosen. Pass the decision, the constraints, what you have already ruled out, and the cost of being wrong; pass your current leading approach too if you have one, and it will try to beat it rather than restate it. Read-only; it proposes, then hands off to implementer. Model is overridable at spawn.` : `Divergent-options subagent (runs on the lead's model in its own context). Use proactively BEFORE an approach is chosen. Pass the decision, the constraints, what you have already ruled out, and the cost of being wrong; pass your current leading approach too if you have one, and it will try to beat it rather than restate it. Read-only; it proposes, then hands off to implementer. Model is overridable at spawn.`,
+		prompt: "You are a divergent-options subagent: the lead's sounding board while an approach is still open. Your job is to surface the option the lead would not have reached on its own. If the caller states its current leading approach, your job is to try to beat it, and you close with one verdict: `replace`, `retain`, or `insufficient evidence`. `replace` requires naming a concrete alternative that dominates it and the evidence that decides between them. `retain` is a real answer and a useful one: say it plainly when the approach survives a genuine attempt to beat it. Manufactured disagreement is as useless as agreement; do neither. If the caller states no leading approach, generate independently and let the lead compare. Return 3 to 5 approaches that differ in MECHANISM, not in phrasing. For each: how it works, what it costs, what would have to be true for it to be the right answer, and the failure mode that would kill it. Near-duplicate options are the failure mode to avoid — if only one real approach exists, say so plainly and explain why the alternatives are dead, because one honest option beats four padded ones. Screen EVERY candidate against this repository and this environment before you rank them, then verify the one you are about to recommend can actually run here: read the code path it depends on, the guard that would refuse it, the artifact it assumes exists. A recommendation that cannot execute is worse than no recommendation. If checking kills your front-runner, rerank and say so. Ground every option in what the repository actually contains, and prefer reusing what is already there over inventing something new. " + readOnlyToolSteer() + " Do the work yourself — do not spawn further subagents.",
+		tools: readOnlyToolAllowlist(searchKey),
+		...brainstormModel ? { model: brainstormModel } : {},
+		...searchMcp
+	};
+	if (scoutModel) out.scout = {
+		description: `Read-only exploration subagent running ${scoutModel} (fast and cheap, so repository lookups do not run at the lead's model rates). Use proactively to find or understand something in the codebase: it sweeps widely and returns conclusions with file:line references rather than file dumps. Model is overridable at spawn.`,
+		prompt: "You are a read-only exploration subagent. Answer the question by investigating the repository: cast a wide net, then narrow. Return the conclusion, not the raw material — cite `file:line` for anything load-bearing and quote only the lines that matter. If the answer is that something does not exist, say so explicitly and describe where you looked. " + readOnlyToolSteer() + " Do the work yourself — do not spawn further subagents.",
+		tools: readOnlyToolAllowlist(searchKey),
+		model: scoutModel,
+		...searchMcp
+	};
+	out.scribe = {
+		description: scribeModel ? `Documentation subagent running ${scribeModel}. Use proactively for prose that trails the code: docs, ADRs, CLAUDE.md sections, changelog entries, and README updates that have gone stale. Keeps low-glamour upkeep off the lead's context. Model is overridable at spawn.` : `Documentation subagent (runs on the lead's model in its own context). Use proactively for prose that trails the code: docs, ADRs, CLAUDE.md sections, changelog entries, and README updates that have gone stale. Model is overridable at spawn.`,
+		prompt: "You are a documentation subagent. Write and maintain the prose that trails the code: docs, ADRs, CLAUDE.md sections, changelog entries, README rows. Read the code before describing it — every claim you write must be checkable against the repository as it is now, not as a summary said it was. Match the surrounding document's voice, structure, and level of detail. Prefer updating an existing document over adding a new one, and delete what has become false rather than layering a correction on top of it. " + fileToolSteer("builds") + " Do the work yourself — do not spawn further subagents. Report which documents changed and any claim you could not verify.",
+		...scribeModel ? { model: scribeModel } : {}
+	};
+	if (opts.workerToolsAvailable) {
+		const workersKey = workersKeyOf(opts.groupKeys);
+		const workersMcp = opts.serverUrl ? { mcpServers: { [workersKey]: httpEntryFor(opts.serverUrl, "workers", opts.nonce, opts.workspaceHeaderCmd) } } : {};
+		for (const mode of activeDispatchModes({ browse: opts.browseAvailable === true })) out[dispatcherAgentName(mode)] = {
+			description: dispatcherDescription(mode),
+			prompt: dispatcherPrompt(mode, workersKey),
+			tools: dispatcherTools(mode, workersKey),
+			...workersMcp
+		};
+	}
+	return out;
+}
+/**
+* Default location Claude Code reads subagent .md files from at session
+* startup. Files placed here populate the Task `subagent_type` enum.
+*
+* We point at the router-owned `PATHS.CLAUDE_CONFIG_DIR/agents/` because
+* `getClaudeCodeEnvVars` sets `CLAUDE_CONFIG_DIR=PATHS.CLAUDE_CONFIG_DIR`
+* (the snapshot-mirror substrate fix that gives spawned teammates an
+* authenticatable on-disk credential). The user's own custom-agent .md
+* files were copied into this same dir by `ensureClaudeConfigMirror`,
+* so writing peer-* files here doesn't conflict — and the boot-time
+* sweep is scoped to peer-* names only via the persona-name allowlist.
+*/
+function defaultAgentsDir() {
+	return path.join(PATHS.CLAUDE_CONFIG_DIR, "agents");
+}
+/**
+* YAML frontmatter string-escape — sufficient for our use case where
+* descriptions can contain colons, quotes, newlines. Wraps the value
+* in double-quotes and escapes:
+*   - `\` and `"` (canonical YAML)
+*   - `\n`, `\r`, `\t` (whitespace controls — `\r` matters on Windows-edited
+*     literals; strict YAML 1.2 parsers reject raw `\r` in double-quoted
+*     scalars)
+*   - other C0 control chars (\x00-\x08, \x0B, \x0C, \x0E-\x1F) and
+*     DEL (\x7F) — encoded as `\xNN` so the YAML stays valid even if
+*     a future description sources data from an external file
+*
+* NOT a general-purpose YAML serializer; we control the inputs.
+*/
+function escapeYamlString(s) {
+	return `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, (c) => `\\x${c.charCodeAt(0).toString(16).padStart(2, "0")}`)}"`;
+}
+/**
+* Strict allowlist for subagent names — controls both the YAML
+* frontmatter `name:` field AND the filename suffix. Defense-in-depth:
+* even if a future contributor wires in a dynamic agent name from
+* outside, the validator at the top of `writePeerAgentMdFiles` rejects
+* anything that wouldn't be a safe bare YAML scalar AND a safe path
+* component.
+*/
+const VALID_AGENT_NAME = /^[A-Za-z][A-Za-z0-9-]*$/;
+/**
+* Emit the subagent-frontmatter `mcpServers` block as a YAML sequence of
+* single-key maps (the INLINE form that connects on subagent start — a bare
+* name-reference would re-trigger claude-code#30280). Scalars are
+* JSON.stringify-quoted, which is valid YAML double-quoted syntax (handles the
+* Windows-path/backslash headersHelper command safely).
+*
+* ```yaml
+* mcpServers:
+*   - workers:
+*       type: http
+*       url: "http://127.0.0.1:PORT/mcp/workers"
+*       headers:
+*         Authorization: "Bearer <nonce>"
+*       headersHelper: "<cmd>"
+* ```
+*/
+function emitMcpServersYaml(mcpServers) {
+	const lines = ["mcpServers:"];
+	for (const [key, entry] of Object.entries(mcpServers)) {
+		lines.push(`  - ${JSON.stringify(key)}:`);
+		lines.push(`      type: ${JSON.stringify(entry.type)}`);
+		lines.push(`      url: ${JSON.stringify(entry.url)}`);
+		lines.push(`      headers:`);
+		for (const [hk, hv] of Object.entries(entry.headers)) lines.push(`        ${JSON.stringify(hk)}: ${JSON.stringify(hv)}`);
+		if (entry.headersHelper !== void 0) lines.push(`      headersHelper: ${JSON.stringify(entry.headersHelper)}`);
+	}
+	return lines;
+}
+/** Build a single subagent .md file body (frontmatter + system prompt).
+*
+* `tools` (optional) becomes a `tools:` frontmatter allowlist RESTRICTING the
+* subagent to exactly those tools (omission inherits the parent's full toolset,
+* per Claude Code semantics). Used by the `worker-*` dispatchers to pin each to
+* its single `mcp__<workersKey>__<mode>` tool — which physically prevents them
+* from spawning other agents or doing extra work. `mcpServers` (optional) is
+* emitted as an inline `mcpServers` frontmatter list so the subagent connects
+* directly to its scoped MCP server(s) — a workaround for claude-code#30280
+* (Agent-tool subagents don't reliably inherit the session's HTTP MCP servers).
+* Names are validated by the caller (`writePeerAgentMdFiles`) / are
+* proxy-generated, so no escaping needed beyond the comma-join Claude Code's
+* frontmatter parser expects. */
+function buildAgentMd(spec) {
+	const lines = [
+		"---",
+		`name: ${spec.name}`,
+		`description: ${escapeYamlString(spec.description)}`
+	];
+	if (spec.model) lines.push(`model: ${escapeYamlString(spec.model)}`);
+	if (spec.tools && spec.tools.length > 0) lines.push(`tools: [${spec.tools.map((t) => JSON.stringify(t)).join(", ")}]`);
+	if (spec.mcpServers && Object.keys(spec.mcpServers).length > 0) lines.push(...emitMcpServersYaml(spec.mcpServers));
+	lines.push("---", "", spec.prompt, "");
+	return lines.join("\n");
+}
+/**
+* Write per-launch subagent .md files into the user's `~/.claude/agents/`
+* directory so they appear in Claude Code's Task `subagent_type` enum
+* (which `--agents` JSON files do NOT, per claude-code-guide expert).
+*
+* Filenames follow `peer-<pid>-<rand>-<agentName>.md` so the boot-time
+* sweep (`sweepStalePeerAgentMdFiles` in paths.ts) can drop orphans
+* from crashed prior proxy sessions without touching the user's other
+* `.claude/agents/` files. The `name:` field in the frontmatter is the
+* canonical agent identifier — matching across files would cause Claude
+* Code to (un)deterministically pick one, so concurrent proxies running
+* the same agents need different filenames but resolve to the same
+* agent name (intended — they're the same subagent, just registered
+* twice).
+*
+* Returns the file paths plus a cleanup() that unlinks them.
+*/
+async function writePeerAgentMdFiles(agents, opts) {
+	for (const name of Object.keys(agents)) if (!VALID_AGENT_NAME.test(name)) throw new Error(`writePeerAgentMdFiles: invalid agent name ${JSON.stringify(name)} — must match ${VALID_AGENT_NAME.source}`);
+	const dir = opts.agentsDir ?? defaultAgentsDir();
+	await fs.mkdir(dir, { recursive: true });
+	const paths = [];
+	try {
+		for (const [name, def] of Object.entries(agents)) {
+			const filePath = path.join(dir, `peer-${opts.fileSuffix}-${name}.md`);
+			await fs.unlink(filePath).catch(() => {});
+			await writeRuntimeFileSecure(filePath, buildAgentMd({
+				name,
+				description: def.description,
+				prompt: def.prompt,
+				model: def.model,
+				tools: def.tools,
+				mcpServers: def.mcpServers
+			}));
+			paths.push(filePath);
+		}
+	} catch (err) {
+		await Promise.allSettled(paths.map((p) => fs.unlink(p)));
+		throw err;
+	}
+	const cleanup = async () => {
+		await Promise.allSettled(paths.map((p) => fs.unlink(p)));
+	};
+	return {
+		paths,
+		cleanup
+	};
+}
+/**
+* Read just the `mcpServers` object from a mirrored `.claude.json` (or `{}`
+* on missing / malformed). Used by `resolveGroupKeysFromMirror` to detect
+* which of our bare group keys would collide with a user-side entry.
+*/
+async function readMcpServersSnapshot(target) {
+	try {
+		const raw = await fs.readFile(target, "utf8");
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+			const servers = parsed.mcpServers;
+			if (servers && typeof servers === "object" && !Array.isArray(servers)) return servers;
+		}
+	} catch {}
+	return {};
+}
+/**
+* Resolve a config-entry key for each enabled group, defending against
+* collisions with the user's own `mcpServers`. Prefer the bare key
+* (`peers`/`search`/…); on collision walk the numbered fallback sequence
+* `gh-router-<group>`, `gh-router-<group>-2`, `gh-router-<group>-3`, …
+* until a free name is found. This NEVER skips and NEVER returns a name the
+* user already owns: every enabled group is guaranteed a key WE control, so
+* a capability is never silently dropped AND the model is never routed at
+* the user's same-named server (the caller threads these resolved keys into
+* both the `mcpServers` entries AND the persona `.md` routing strings). The
+* `skipped` field is retained for API stability but is always empty now.
+*
+* Reads the mirror snapshot once; the caller passes the result to BOTH
+* `writePeerMcpRuntimeFiles` and `injectPeerMcpIntoMirror`. The mirror is a
+* per-launch dir written ONLY by us (after `ensureClaudeConfigMirror`
+* snapshotted the user's config) and nothing mutates it between this read
+* and `injectPeerMcpIntoMirror`'s write, so the two reads see identical
+* state — no TOCTOU window, and the inject-side defensive conflict check
+* never fires for these resolved keys.
+*/
+async function resolveGroupKeysFromMirror(enabledGroups, claudeConfigDir) {
+	const dir = claudeConfigDir ?? PATHS.CLAUDE_CONFIG_DIR;
+	const existing = await readMcpServersSnapshot(path.join(dir, ".claude.json"));
+	const keys = {};
+	for (const group of enabledGroups) {
+		const bare = GROUP_META[group].preferredKey;
+		if (existing[bare] === void 0) {
+			keys[group] = bare;
+			continue;
+		}
+		let candidate = `gh-router-${group}`;
+		let n = 1;
+		while (existing[candidate] !== void 0) {
+			n += 1;
+			candidate = `gh-router-${group}-${n}`;
+		}
+		keys[group] = candidate;
+	}
+	return {
+		keys,
+		skipped: []
+	};
+}
+/**
+* Mutate the mirrored `<CLAUDE_CONFIG_DIR>/.claude.json` to add the
+* `gh-router-peers` entry (and `codex-cli` when enabled) under
+* `mcpServers`. This is the load-bearing fix for subagent MCP visibility.
+*
+* Subagents — Agent-tool subagents, forks, and agent-teams subprocesses
+* — discover MCP servers from persistent scopes (`.claude.json` and
+* project-scope `.mcp.json`), NOT from the parent's `--mcp-config` CLI
+* flag. Writing into the per-launch mirror's `.claude.json` makes the
+* MCP entry visible to subagents transparently: they inherit
+* `CLAUDE_CONFIG_DIR` from the parent's env, so they read the same
+* config file we just mutated.
+*
+* Safety:
+*   - Refuses to overwrite a same-named user-side entry (the snapshot
+*     copied their `.claude.json` first, so an existing entry would
+*     belong to the user). Returns `{ ok: false }` so the caller can
+*     fall back to leaving `--mcp-config` in place for the parent.
+*   - Preserves all other top-level fields and other `mcpServers`
+*     entries.
+*   - Atomic write: temp-file with `wx` (`O_CREAT | O_EXCL`) followed by
+*     `rename`, mirroring the synthetic-credentials write pattern in
+*     `ensureClaudeConfigMirror`. Mode 0o600. The per-launch
+*     `CLAUDE_CONFIG_DIR` means there are no cross-launch racers.
+*/
+async function injectPeerMcpIntoMirror(serverUrl, opts) {
+	const dir = opts.claudeConfigDir ?? PATHS.CLAUDE_CONFIG_DIR;
+	const target = path.join(dir, ".claude.json");
+	let existing = {};
+	try {
+		const raw = await fs.readFile(target, "utf8");
+		try {
+			const parsed = JSON.parse(raw);
+			if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) existing = parsed;
+			else consola.warn(`injectPeerMcpIntoMirror: ${target} parsed to non-object (typeof=${typeof parsed}); discarding contents and starting fresh.`);
+		} catch (err) {
+			consola.warn(`injectPeerMcpIntoMirror: cannot parse ${target} as JSON; starting fresh (existing contents will be overwritten):`, err);
+		}
+	} catch (err) {
+		if (err.code !== "ENOENT") consola.debug(`injectPeerMcpIntoMirror: cannot read ${target}:`, err);
+	}
+	let mcpServers;
+	const rawServers = existing.mcpServers;
+	if (rawServers !== void 0 && rawServers !== null && typeof rawServers === "object" && !Array.isArray(rawServers)) mcpServers = rawServers;
+	else {
+		if (rawServers !== void 0 && rawServers !== null) consola.warn(`injectPeerMcpIntoMirror: mcpServers field in ${target} is not an object (typeof=${typeof rawServers}); replacing with our entry.`);
+		mcpServers = {};
+	}
+	const peerConfig = buildPeerMcpConfig(serverUrl, {
+		codexCli: opts.codexCli,
+		geminiAvailable: opts.geminiAvailable,
+		groupKeys: opts.groupKeys,
+		nonce: opts.nonce,
+		codexHome: opts.codexHome ?? PATHS.CODEX_HOME,
+		workspaceHeaderCmd: buildWorkspaceHeaderHelperCommand(process.execPath, process.argv[1])
+	});
+	const conflicts = [];
+	for (const name of Object.keys(peerConfig.mcpServers)) if (mcpServers[name] !== void 0) conflicts.push(name);
+	if (conflicts.length > 0) {
+		consola.warn(`injectPeerMcpIntoMirror: your ~/.claude/.claude.json already has mcpServers entries named [${conflicts.join(", ")}]; refusing to overwrite. Subagents will not see those tools — only the parent session via --mcp-config fallback. To resolve, rename the user-side server(s) (e.g. via \`claude mcp remove\`) and relaunch.`);
+		return {
+			ok: false,
+			reason: "user-has-conflicting-entry",
+			conflictingServers: conflicts
+		};
+	}
+	for (const [name, entry] of Object.entries(peerConfig.mcpServers)) mcpServers[name] = entry;
+	existing.mcpServers = mcpServers;
+	const desiredJson = JSON.stringify(existing, null, 2) + "\n";
+	await fs.mkdir(dir, { recursive: true });
+	const tempPath = `${target}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+	try {
+		await fs.writeFile(tempPath, desiredJson, {
+			mode: 384,
+			flag: "wx"
+		});
+		await fs.rename(tempPath, target);
+	} catch (err) {
+		await fs.unlink(tempPath).catch(() => {});
+		throw err;
+	}
+	return {
+		ok: true,
+		serversAdded: Object.keys(peerConfig.mcpServers)
+	};
+}
+/**
+* Generate a per-launch nonce, write the MCP config + agents JSON
+* tempfiles under `CLAUDE_RUNTIME_DIR` with mode 0o600 and `O_EXCL`,
+* and return a `cleanup()` to unlink them on shutdown.
+*
+* Filenames are `peer-mcp-<pid>-<rand>.json` and `peer-agents-<pid>-<rand>.json`.
+* The PID prefix is what the boot-time sweep (`sweepStaleRuntimeFiles` in
+* paths.ts) keys off to drop orphans from crashed prior sessions; the
+* random suffix prevents two concurrent calls within the same process
+* from clobbering each other's files (e.g., a proxy that internally
+* relaunches its spawned child without restarting itself).
+*/
+async function writePeerMcpRuntimeFiles(serverUrl, opts) {
+	const nonce = opts.nonce ?? randomBytes(32).toString("hex");
+	const runtimeDir = opts.runtimeDir ?? PATHS.CLAUDE_RUNTIME_DIR;
+	const codexHome = opts.codexHome ?? PATHS.CODEX_HOME;
+	await fs.mkdir(runtimeDir, { recursive: true });
+	if (process.platform !== "win32") await fs.chmod(runtimeDir, 448).catch(() => {});
+	const fileSuffix = `${process.pid}-${randomBytes(4).toString("hex")}`;
+	const mcpConfigPath = path.join(runtimeDir, `peer-mcp-${fileSuffix}.json`);
+	const agentsPath = path.join(runtimeDir, `peer-agents-${fileSuffix}.json`);
+	const mcpConfig = buildPeerMcpConfig(serverUrl, {
+		codexCli: opts.codexCli,
+		geminiAvailable: opts.geminiAvailable,
+		groupKeys: opts.groupKeys,
+		nonce,
+		codexHome,
+		workspaceHeaderCmd: buildWorkspaceHeaderHelperCommand(process.execPath, process.argv[1])
+	});
+	const agents = buildPeerAgentDefinitions({
+		codexCli: opts.codexCli,
+		geminiAvailable: opts.geminiAvailable,
+		groupKeys: opts.groupKeys,
+		workerToolsAvailable: opts.workerToolsAvailable,
+		browseAvailable: opts.browseAvailable,
+		nativeSubagentModel: opts.nativeSubagentModel,
+		reviewerModel: opts.reviewerModel,
+		brainstormModel: opts.brainstormModel,
+		scoutModel: opts.scoutModel,
+		scribeModel: opts.scribeModel,
+		nonce,
+		codexHome,
+		serverUrl,
+		workspaceHeaderCmd: buildWorkspaceHeaderHelperCommand(process.execPath, process.argv[1])
+	});
+	await fs.unlink(mcpConfigPath).catch(() => {});
+	await fs.unlink(agentsPath).catch(() => {});
+	await writeRuntimeFileSecure(mcpConfigPath, JSON.stringify(mcpConfig, null, 2));
+	await writeRuntimeFileSecure(agentsPath, JSON.stringify(agents, null, 2));
+	const mdResult = await writePeerAgentMdFiles(opts.builtinSubagents ? {
+		...agents,
+		...opts.builtinSubagents
+	} : agents, {
+		agentsDir: opts.agentsDir,
+		fileSuffix
+	});
+	const personas = personasFor({
+		codexCli: opts.codexCli,
+		geminiAvailable: opts.geminiAvailable
+	});
+	const cleanup = async () => {
+		await Promise.allSettled([
+			fs.unlink(mcpConfigPath),
+			fs.unlink(agentsPath),
+			mdResult.cleanup()
+		]);
+	};
+	return {
+		mcpConfigPath,
+		agentsPath,
+		agentMdPaths: mdResult.paths,
+		nonce,
+		personas,
+		cleanup
+	};
+}
+//#endregion
+//#region src/lib/mcp-permissions-settings.ts
+/**
+* CLAUDE_CODE_* / auth / routing env keys that must NOT reach the CloudCLI-spawned
+* serve agent through the mirror `settings.json` `env` block. CloudCLI applies
+* that block via the Agent SDK's `settingSources`, so anything a user set in their
+* real `~/.claude/settings.json` (for their own workflow) is mirrored in and
+* mis-shapes the single serve chat agent — the exact mechanism behind the
+* coordinator-mode bug.
+*
+*   - {@link STRIPPED_AUTH_ROUTING_ENV_KEYS} (shared with the process-env strip in
+*     `launch.ts`): auth/routing/remote keys that would re-route the agent OFF the
+*     github-router proxy (`ANTHROPIC_BASE_URL`, `CLAUDE_CODE_USE_BEDROCK/VERTEX/
+*     FOUNDRY`, a personal gateway), inject real auth over the synthetic
+*     credential (`ANTHROPIC_API_KEY`/`AUTH_TOKEN`/`OAUTH_TOKEN`), pin a
+*     non-Copilot `ANTHROPIC_MODEL`, or activate the unimplemented Bridge/remote
+*     path. The settings.json `env` block is a SECOND vector for the same keys the
+*     process-env strip already blocks.
+*   - `CLAUDE_CODE_COORDINATOR_MODE`: strips the single agent to delegation-only
+*     (Glob/Read/Bash fail "not enabled in this context").
+*   - `CLAUDE_CODE_SUBAGENT_MODEL`: a rank-#1 hard override that would retarget
+*     the injected implementer/peer-critic subagents off their frontmatter models.
+*
+* `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS` is intentionally NOT stripped — purely
+* additive, matching `github-router claude` parity.
+*/
+const SERVE_STRIP_ENV_KEYS = [
+	...STRIPPED_AUTH_ROUTING_ENV_KEYS,
+	"CLAUDE_CODE_COORDINATOR_MODE",
+	"CLAUDE_CODE_SUBAGENT_MODEL"
+];
+async function readSettingsObject(settingsPath) {
+	let raw;
+	try {
+		raw = await fs.readFile(settingsPath, "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return null;
+		throw err;
+	}
+	const parsed = JSON.parse(raw);
+	if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	throw new Error(`settings.json at ${settingsPath} is not a JSON object; refusing to overwrite`);
+}
+async function writeSettingsObject(settingsPath, obj, suffix) {
+	const tmp = `${settingsPath}.${process.pid}.${suffix}.tmp`;
+	await fs.writeFile(tmp, `${JSON.stringify(obj, null, 2)}\n`, { mode: 384 });
+	await fs.rename(tmp, settingsPath);
+}
+/**
+* Remove serve-inappropriate CLAUDE_CODE_* keys (see {@link SERVE_STRIP_ENV_KEYS})
+* from the serve mirror `settings.json` `env` block. UNCONDITIONAL — unlike the
+* permission bypass this is NOT gated by `GH_ROUTER_SERVE_NO_AUTO_APPROVE`,
+* because a user who only wants permission prompts still needs a working toolset.
+* Serve mirror only; never the operator's real `~/.claude/settings.json`. Atomic
+* temp+rename, mode 0o600. Returns the keys it removed (empty if none present).
+*/
+async function sanitizeServeSettingsEnv(settingsPath) {
+	const existing = await readSettingsObject(settingsPath);
+	if (!existing) return { removed: [] };
+	const envRaw = existing.env;
+	if (!envRaw || typeof envRaw !== "object" || Array.isArray(envRaw)) return { removed: [] };
+	const env = { ...envRaw };
+	const removed = [];
+	for (const key of SERVE_STRIP_ENV_KEYS) if (key in env) {
+		delete env[key];
+		removed.push(key);
+	}
+	if (removed.length === 0) return { removed: [] };
+	await writeSettingsObject(settingsPath, {
+		...existing,
+		env
+	}, "serveenv");
+	return { removed };
+}
+/**
+* Native Claude Code tools worth auto-approving alongside our injected MCP
+* servers so PLAN mode is frictionless for research. These are read-only
+* discovery tools that plan mode would otherwise prompt for.
+*
+* Deliberately MINIMAL and safe:
+*   - `WebSearch` / `WebFetch` — network reads; exactly the research surface a
+*     planner reaches for, and they prompt by default in plan mode.
+*   - EXCLUDES `Read`/`Glob`/`Grep` — Claude Code already runs them in plan mode
+*     without a rule (its built-in safe list), so a rule would be redundant.
+*   - EXCLUDES `Bash` — can mutate (`rm`, redirects); blanket-allow is unsafe.
+*     Curated `Bash(<readonly cmd> *)` rules are the user's own call.
+*   - EXCLUDES `Task`/`Skill`/`Workflow`/`SendMessage` — spawn/delegate; a
+*     subagent launched in plan mode isn't guaranteed to inherit plan's
+*     read-only restriction, so auto-approving them is a plan-mode-bypass vector.
+*   - EXCLUDES `Edit`/`Write`/`NotebookEdit` etc. — plan mode gates them by
+*     design and we must not override that.
+*/
+const NATIVE_RESEARCH_ALLOW_RULES = ["WebSearch", "WebFetch"];
+/**
+* The routine native Claude Code tools serve auto-approves so ordinary agent
+* work stays seamless (no per-call prompt) — the exact surface a coding agent
+* uses turn to turn. Seeded into CloudCLI's `localStorage['claude-settings']`
+* `allowedTools` (feeds the Agent SDK `canUseTool` fast-path + `sdkOptions.allowedTools`).
+*
+* DELIBERATELY EXCLUDES the two interaction tools `AskUserQuestion` and
+* `ExitPlanMode`. CloudCLI hard-codes both into its `TOOLS_REQUIRING_INTERACTION`
+* set (claude-sdk.js) and renders a real question widget / plan Approve-Reject
+* card for them — but ONLY when `canUseTool` runs (non-bypass) AND they are NOT
+* pre-approved. Leaving them off this list is what routes them to the human
+* instead of letting the model auto-answer its own question. This is the same
+* line the interactive Claude CLI draws: routine tools seamless, decisions to
+* the user. Never add either name here.
+*
+* A tool omitted from this list degrades to a one-off Allow/Deny prompt in
+* CloudCLI — safe, not broken — so the list is a superset of the common surface
+* rather than an exact registry match (extra names for tools this Claude build
+* lacks are harmless no-ops).
+*/
+const SEAMLESS_BUILTIN_TOOLS = [
+	"Task",
+	"Bash",
+	"BashOutput",
+	"KillShell",
+	"Glob",
+	"Grep",
+	"Read",
+	"Edit",
+	"Write",
+	"NotebookEdit",
+	"WebFetch",
+	"WebSearch",
+	"TodoWrite",
+	"Skill",
+	"SlashCommand",
+	"EnterPlanMode"
+];
+/**
+* Merge arbitrary allow rules into a mirror `settings.json` `permissions.allow`
+* so the listed tools auto-run WITHOUT a permission prompt in every mode —
+* including plan mode, where a matched allow rule bypasses the prompt for any
+* tool NOT on plan mode's file-edit/shell-write restricted list (MCP tools and
+* read-only natives like WebSearch/WebFetch). See {@link NATIVE_RESEARCH_ALLOW_RULES}
+* for the native additions and the "Configure permissions" Claude Code doc for
+* the plan-mode semantics.
+*
+* Rules are literal allow strings (`mcp__peers`, `WebSearch`, …). Existing
+* `allow` entries and `deny`/`ask` are preserved; merge is idempotent (no write
+* when every rule is already present). Mirror only; never the operator's real
+* settings. Atomic temp+rename, mode 0o600.
+*/
+async function injectAllowRules(settingsPath, rules) {
+	const want = [...new Set(rules.filter(Boolean))];
+	if (want.length === 0) return { added: [] };
+	const existing = await readSettingsObject(settingsPath) ?? {};
+	const permsRaw = existing.permissions;
+	const perms = permsRaw && typeof permsRaw === "object" && !Array.isArray(permsRaw) ? { ...permsRaw } : {};
+	const allow = Array.isArray(perms.allow) ? [...perms.allow] : [];
+	const present = new Set(allow.filter((x) => typeof x === "string"));
+	const added = want.filter((rule) => !present.has(rule));
+	if (added.length === 0) return { added: [] };
+	perms.allow = [...allow, ...added];
+	await writeSettingsObject(settingsPath, {
+		...existing,
+		permissions: perms
+	}, "allowrules");
+	return { added };
+}
+/**
+* Build the full plan-mode allow-rule set: a bare `mcp__<server>` rule per
+* injected MCP server (whole-server allow) plus the native research tools. The
+* server keys are the RESOLVED mcpServers config keys (collision-aware —
+* `peers` or `gh-router-peers`, `codex-cli`, …) so each rule matches the server
+* name the model actually sees.
+*/
+function planModeAllowRules(serverKeys) {
+	return [...[...new Set(serverKeys.filter(Boolean))].map((k) => `mcp__${k}`), ...NATIVE_RESEARCH_ALLOW_RULES];
+}
+/**
+* Ensure the serve mirror's `settings.json` `permissions.defaultMode` is NOT
+* `bypassPermissions` — the load-bearing half of serve's "seamless routine +
+* decisions to the user" model.
+*
+* Under `bypassPermissions` the Agent SDK resolves approval at the permission-mode
+* step and SKIPS the `canUseTool` callback entirely (claude-sdk.js) — the only
+* channel CloudCLI's interactive widgets ride on, so `AskUserQuestion` and
+* `ExitPlanMode` auto-resolve on a model-generated answer and never reach the human.
+* CloudCLI leaves `sdkOptions.permissionMode` unset when the composer is in default
+* mode, so the binary falls back to THIS `defaultMode` — a stale `bypassPermissions`
+* here would silently re-defeat the fix through the settings vector.
+*
+* MINIMAL override: only rewrite when the mode is absent or an explicit
+* `bypassPermissions` (→ `"default"`, keeping `canUseTool` live). A user's
+* deliberate NON-bypass posture (`plan` / `acceptEdits` / `default`) is preserved
+* verbatim — all three already keep `canUseTool` live, so there is nothing to fix
+* and no reason to override their choice. `allow`/`deny`/`ask` are always untouched.
+*
+* Only ever rewrites the per-launch serve mirror, never the operator's real
+* `~/.claude/settings.json`. Atomic temp+rename, mode 0o600. A non-object
+* settings.json throws; the caller wraps this in warn-and-continue.
+*
+* Opt out with `GH_ROUTER_SERVE_NO_AUTO_APPROVE=1` (the caller skips this AND the
+* allow-list/localStorage seed) — the mirrored `defaultMode` is then left exactly
+* as snapshotted and CloudCLI prompts on every not-yet-approved tool.
+*/
+async function configureServeDefaultPermissionMode(settingsPath) {
+	const existing = await readSettingsObject(settingsPath) ?? {};
+	const permsRaw = existing.permissions;
+	const perms = permsRaw && typeof permsRaw === "object" && !Array.isArray(permsRaw) ? { ...permsRaw } : {};
+	if (perms.defaultMode !== void 0 && perms.defaultMode !== "bypassPermissions") return { written: false };
+	perms.defaultMode = "default";
+	await writeSettingsObject(settingsPath, {
+		...existing,
+		permissions: perms
+	}, "servemode");
+	return { written: true };
+}
+//#endregion
+//#region src/lib/injected-skills/first-mate-conduct-skill.ts
+const FIRST_MATE_CONDUCT_SKILL = {
+	name: "gh-first-mate-conduct",
+	md: `---
+name: gh-first-mate-conduct
+description: Fleet conductor for first-mate — one durable heartbeat loop drives a FLEET of per-repo CEO meta-subagents to greatness. Arms the deterministic loop, sweeps the whole portfolio once, fans out a fresh CEO subagent per repo that needs judgment, batches their verdicts, couriers human decisions, and re-arms. Use when first-mate should be the default durable driver for one or many repos.
+user-invocable: true
+---
+
+# gh-first-mate-conduct: the deterministic-loop fleet conductor
+
+You are the **fleet conductor**. One correctly-armed heartbeat loop, run by you (the main session), drives a fleet of GitHub repos — each by its own per-repo CEO meta-subagent — to greatness. This is the ONLY way one instance drives many repos durably: only the main REPL can arm a durable cron, so you own the heartbeat; the per-repo CEOs own judgment; the durable ledger + strategy store own memory. You hold almost nothing in context.
+
+You carry the whole brain by REFERENCE, not by memorizing missions: the CEO/CTO/CPO operating protocol (\`/gh-first-mate-operate\`), the per-CEO driving loop (\`/gh-first-mate\`), and the definition of repo greatness (below). Your context each wake is only the compact board + each CEO's compact return — never diffs, logs, or transcripts.
+
+## The loop each wake (arm it right, then fan out)
+
+1. **One global sweep.** Call \`mcp__first-mate__advance\` ONCE with no \`mission_id\` — it sweeps the whole portfolio and returns \`board\`, \`needsModel[]\`, \`needsHuman[]\`, \`nextWakeSeconds\`. Tier1 auto-answers have ALREADY fired inside the tool for the safe \`author_fix\`/\`answer_agent_question\`/\`decompose\` envelope, so the cheap mechanical loop is handled for free and most wakes surface little. Do NOT disable tier1 — it is what keeps you from spawning a CEO for trivia.
+2. **Partition by mission/repo.** Group the residual \`needsModel\` (escalated \`review_plan\`/\`judge_review\` + anything tier1 declined) and open \`needsHuman\` and active board rows by \`missionId\`.
+3. **Surgical per-repo CEO fan-out.** For each mission that has an open judgment \`needsModel\`, OR a strategic checkpoint due (a phase to advance, a greatness item to verify, a pre-registered kill/pivot threshold reached), spawn a **fresh** CEO meta-subagent — Agent tool, in PARALLEL (multiple Agent calls in one message), capped at a few per wake (fleet fan-out cap; the MCP inflight budget is shared). A mission whose agents are grinding with no \`needsModel\` and no checkpoint due needs ZERO CEO spawns this wake. Hand each CEO its brief (below).
+4. **Batch + apply + courier.** Collect each CEO's returned \`model_answers\`; call \`mcp__first-mate__advance\` ONCE more with all of them (\`model_answers: [...]\`) to apply — the CONDUCTOR owns the single drive lease, CEOs never call \`advance\` themselves (that would contend the lease). Courier every \`needsHuman\` packet to the user (open \`packetHtmlPath\` in the artifact panel); never decide merges/abandons yourself.
+5. **Re-arm ONE heartbeat** from the MINIMUM \`nextWakeSeconds\` across the portfolio (the tightest cadence wins, so an imminent-work repo tightens the whole fleet).
+
+## The CEO spawn brief (hand this to each fresh per-repo CEO)
+
+> You are the CEO of repo <owner/name> (mission <id>), spawned fresh for one turn with COMPLETE authority over that repo on the GitHub platform. Do NOT arm a heartbeat (you are a subagent — you cannot) and do NOT call \`mcp__first-mate__advance\` (the conductor applies your verdicts). Steps: (1) \`mcp__first-mate__read_strategy({mission_id})\` + \`mcp__first-mate__mission_status({mission_id})\` to re-hydrate strategy + state; (2) follow \`/gh-first-mate\` (per-CEO driving) + \`/gh-first-mate-operate\` (CEO protocol) + the greatness bar — you DELEGATE all buildable work (code, docs, README/website content, UI, CI, tests) to cloud-agent units and do little yourself; your hands are for orchestration, verification, and decisions, not building; and you VERIFY every user-viewable surface (product UI, README-as-rendered, Pages, docs, release, og-card) by VIEWING the rendered pixels (\`mcp__browser__*\` / screenshots), never guessing from code; (3) for each of YOUR \`needsModel\` requests, VERIFY the deliverable against external evidence (delegate heavy reads to worker-explore/worker-review to stay context-thin) and produce the typed verdict (decompose with disjoint \`fileScopes\`, review_plan, judge_review, author_fix, answer_agent_question); (4) \`mcp__first-mate__write_strategy({mission_id, currentPhase, activeBet, greatnessChecklist, decisionLog:[one entry], nextStrategicAction})\` to persist your strategy delta; (5) RETURN a compact \`{ model_answers:[{requestId,verdict}], needsHuman:[…to courier], strategy_written:true }\` — no prose, no diffs.
+
+Because each CEO is FRESH per wake, its strategic continuity comes ONLY from the strategy store — so a rich \`write_strategy\` (phase, pre-registered bet + thresholds, greatness checklist with evidence handles, an append-only decision-log entry, what-was-tried) is what stops the next wake's CEO from drifting or re-litigating a dead end.
+
+## Self-driving heartbeat (arm / disarm — you own the ONLY one)
+
+ONE durable cron, marker \`[fm-heartbeat]\`, is the dead-man's-switch that survives idle, compaction, restart, and /clear. There is exactly ONE first-mate heartbeat regardless of which driver skill armed it; manage it create-fresh-then-reap-the-rest:
+
+Arm (nextWakeSeconds is a number):
+1. Cadence bucket from nextWakeSeconds (fixed cron, no time math): \`<=120 → "1-59/2 * * * *"\`; \`<=600 → "2,7,12,17,22,27,32,37,42,47,52,57 * * * *"\`; else \`"3,13,23,33,43,53 * * * *"\`.
+2. CronCreate the new job (durable:true, recurring:true, the chosen cron, prompt \`"/gh-first-mate-conduct [fm-heartbeat] wake the fleet, sweep, fan out CEOs, apply verdicts, reschedule."\`) and capture its id.
+3. CronList, then CronDelete every job whose prompt contains \`[fm-heartbeat]\` EXCEPT the id you just created — converges to exactly one, reaps duplicates/old-version orphans (including a stray standalone \`/gh-first-mate\` heartbeat), resets the 7-day expiry.
+
+Disarm (nextWakeSeconds is null AND no pending needsHuman): CronList and CronDelete every \`[fm-heartbeat]\` job; report the fleet is idle and resumes when a mission is next started/advanced.
+
+MCP unavailable / not \`--agents\`: do not advance; reap all \`[fm-heartbeat]\` jobs and report "re-run under \`github-router claude --agents\`." No scheduler tool: report the next wake is in nextWakeSeconds and stop.
+
+## Context discipline & report
+
+The ledger is durable memory for unit state; the strategy store is durable memory for CEO strategy; your context is neither. Never read a full diff/log/transcript. Report compactly from the board: per mission — id, repos, phase counts, blocked count, the greatness-checklist progress (leading done + which LAGGING signals moved), needsHuman awaiting the user, and the next wake. A repo is only "great" when a LAGGING signal has moved, never when leading boxes are merely ticked.
+
+## Definition of greatness (the bar every repo is driven toward)
+
+${DEFINITION_OF_GREATNESS}
+`
+};
+//#endregion
+//#region src/lib/injected-skills/first-mate-operate-skill.ts
+const FIRST_MATE_OPERATE_SKILL = {
+	name: "gh-first-mate-operate",
+	md: `---
+name: gh-first-mate-operate
+description: Operator-facing CEO/CTO/CPO operating protocol for autonomously driving a product with first-mate — shape each mission from a real struggling moment, make acceptance criteria externally verifiable, sequence discovery through growth, and escalate launch, spend, and pricing to the human. Use when deciding WHAT product work first-mate should drive, not only how to execute it.
+user-invocable: true
+---
+
+# gh-first-mate-operate: drive a product as CEO + CTO + CPO
+
+You are the CEO of the product. The GitHub cloud coding agents are your team — they carry the CTO/CPO/engineering execution roles (scaffolded into each repo). Your job is to think like a CEO and get real, verified work out of that team: decide the product direction (the niche, the riskiest assumption, the MVP scope, when to launch, what to measure, what to iterate), turn each decision into a scoped mission, drive the agents to deliver it, and hold the result to evidence.
+
+You do not write the product code. You orchestrate: shape missions, review plans, answer the team's questions fast so they never idle, verify deliverables, and sequence the whole effort toward an outcome. Seed the team's playbook once with \`mcp__first-mate__scaffold_repo\` (it commits \`docs/playbook/README.md\` plus the \`ceo\`/\`cto\`/\`cpo\` role agents the cloud agents read); then use THIS protocol to run the company.
+
+## Delegate the work — your hands are for orchestration, not building
+
+You are the orchestrator; the GitHub cloud coding agents are the workers. The whole point of first-mate is to get work OUT of the team — so DELEGATE, and do little yourself.
+
+- **Everything BUILDABLE is a cloud-agent mission/unit, never hand-written by you:** product code, bug fixes, README/docs/website CONTENT, CI/workflows, tests, the UI. Dispatch it via \`mcp__first-mate__start_mission\` / \`add_units\` / \`decompose\` — do NOT open an editor and write it yourself.
+- **Your OWN hands are only for:** strategy & decisions, decomposition, answering the team (plan review, questions, fix instructions, judge verdicts), VERIFYING deliverables (browse / read / screenshot — **observe, never build**), persisting strategy, and GitHub-**platform** governance via \`gh\` (merge, release, branch protection, secrets, labels, issues, triage). That is orchestration, not building.
+- **Resist the "I'll just quickly fix it myself" urge — it is the failure mode.** A quick hand-edit feels faster but doesn't scale, produces no reusable team capability, and isn't your job. If you catch yourself about to write code, docs, or UI: STOP and dispatch it as a scoped unit instead. The only exception is a genuine one-line last-mile config the cloud-agent loop cannot reach — and even then, prefer a unit.
+
+## Drive the team (get work out of them)
+
+- **Verify, never trust "done".** Every deliverable clears an external checkpoint — a real HTTP 200, green CI, an observed analytics event, a real survey N — or it is not done. Reject self-reported completion and send it back with a concrete gap.
+- **Keep the team unblocked and busy.** A blocked agent produces nothing: answer \`answer_agent_question\` promptly, dispatch independent units in parallel, and re-steer a stalled or underdelivering agent instead of waiting. Idle or looping agents are wasted throughput.
+- **Set the bar as acceptance criteria.** The mission's acceptance criteria = the phase's externally verifiable checkpoint. Vague criteria produce vague work; make the bar reproducible.
+- **Own the P&L of attention.** Kill low-value missions, double down on what moves the outcome metric, and escalate only the genuinely human-gated calls (launch to real channels, spend, pricing, merges).
+
+## The one rule that makes autonomy safe
+
+Every phase advances only on an EXTERNALLY VERIFIABLE checkpoint — a real HTTP 200, a green CI run, an observed analytics event, or a real survey sample size — never a self-reported "done". Autonomous agents fail or hallucinate "done" a large fraction of the time, so an unverified claim is not progress. Encode the checkpoint as the mission's acceptance criteria and refuse to advance without the evidence.
+
+## Operating loop (OODA inside Build-Measure-Learn)
+
+- Inner loop, each turn: OBSERVE fresh evidence (issues, mentions, downloads, analytics), ORIENT against the current job/segment/assumptions, DECIDE one reversible next action against a pre-set threshold, ACT by delegating a scoped mission to the cloud agents.
+- Outer loop, each phase: build the smallest testable increment, measure externally observable behavior, learn against the pre-registered threshold, then persist or pivot. Do not enter the next phase until its checkpoint is independently reproducible.
+
+## Shaping a mission by phase
+
+When you call \`mcp__first-mate__start_mission\` (or \`mcp__first-mate__add_units\`), set the fields from the CURRENT phase:
+
+- **goal**: the phase objective, grounded in a real struggling moment — not a feature wish.
+- **acceptance_criteria**: the phase's externally verifiable exit checkpoint, stated as evidence a reviewer can reproduce (e.g. "cold-start quickstart under five minutes, timed from a fresh checkout, recorded in the PR"; "Sean Ellis survey with N≥40 responses and ≥40% 'very disappointed'").
+- **house_rules**: any hard constraint (privacy, license, brand, spend limit).
+- Unlock real parallelism the right way: give each independent unit a DISJOINT \`fileScopes\` allowlist so their builds run CONCURRENTLY (the controller proves non-overlap and dispatches in parallel up to the mission's \`maxConcurrentBuilds\`), and/or split fully independent workstreams into SEPARATE missions (the build gate is per-mission, so N missions build N units at once). \`max_in_flight_per_provider\` is a global provider cap, NOT the build-concurrency lever — disjoint \`fileScopes\` and separate missions are. Never race overlapping work on the same files.
+
+Let the controller drive decomposition and steering (see \`gh-first-mate\`); this skill decides the PHASE and the checkpoint, not the controller mechanics.
+
+## Phased sequence (shared with the scaffolded playbook)
+
+${CONDENSED_OPERATING_SEQUENCE}
+
+## Definition of greatness (the shipping bar every repo must clear)
+
+Driving a product to greatness is not just shipping features — the repo itself must clear a verifiable shipping-infrastructure bar. Drive each repo toward it and gate each item on real, third-party-checkable evidence (a green check, a \`gh api\`, a \`curl\`, a \`cosign verify\`), never a self-report. This is the SAME bar the scaffolded playbook and the eval use.
+
+${DEFINITION_OF_GREATNESS}
+
+## Iterate to polish — never guess the UI, drive it and view the pixels
+
+UI/UX quality (and every user-viewable surface) is DRIVEN, SEEN, and ITERATED, never designed once and asserted. For ANY unit that touches the product UI, the README, the website, docs, the release page, or the og-card, require the cloud agent to — and verify yourself by — VIEW the rendered result before "done":
+1. Build & run the real artifact (the deployed Pages / live URL, or a dev server) — a local happy-path screenshot is not the product.
+2. Drive every state & flow with \`mcp__browser__*\` (navigate/act/observe): first-run/empty, real input, forced error, success, edge/overflow — not just the ideal state.
+3. Screenshot the matrix: each state at mobile/tablet/desktop × light+dark, honoring \`prefers-color-scheme\` and \`prefers-reduced-motion\`. These pixels, not the code, are the evidence.
+4. Critique the pixels against the professional bar (Pillar D of the greatness definition); for each defect name the concrete problem AND the screenshot it is in. Rank by severity.
+5. Fix the top defects (dispatch to the implementer role; prefer token/design-system fixes over one-off patches).
+6. Re-drive & re-capture (repeat 2–5) until the vision rubric is clean and the deterministic gates (visual-regression / axe / contrast / CWV) are green. Update \`toHaveScreenshot\` baselines only on an intentional, reviewed change.
+7. Lock it in: commit the visual-regression baselines + axe/Lighthouse/CWV CI so polish can't silently regress.
+
+The no-guessing rule: never mark a user-viewable surface — including the README as GitHub renders it — "done" from code/markdown review alone; back every claim with a screenshot of the actual running/rendered artifact.
+
+## Every iteration must move the end-user experience forward — and regress nothing
+
+This is the objective the whole loop is tuned to, and the operating expression of the CEO eval (\`docs/first-mate-ceo-eval-framework.md\`, the End-User Experience Delta lens): after each iteration (or a bounded set), measure what VERIFIABLY improved for the END USER, and confirm nothing regressed.
+
+- **Drive the pinned user journeys before AND after.** Keep a pinned set of golden journeys per repo (the aha path + key flows) plus user-facing facets — journey completion, time-to-first-value, capability, performance, accessibility, user-facing correctness, the rendered README/Pages/docs/Release, state robustness. Capture them on the inherited state, then again after the iteration, by DRIVING the real artifact — never inferred from code or a 200.
+- **Ship only a net improvement.** An iteration is done only when it shows at least one MATERIAL, verified user-facing improvement (past a pre-set threshold, tied to a real user job) AND zero detected unintended regression under the coverage you actually ran. Report coverage honestly: "no regression detected in the pinned journeys," never an absolute "zero."
+- **A detected regression is stop-the-line.** A journey that worked now failing, a metric crossing its budget the wrong way, a removed/broken capability, a new user-hitting bug, a broken rendered surface, or a slower quickstart CAPS the iteration: fix the regression before the improvement counts. Recovering a regression you caused only retires the debt; it is not new progress.
+- **Intended user-facing changes are approved tradeoffs, not free.** A deliberate deprecation / redesign / pivot is recorded as an approved tradeoff (old baseline preserved, migration path, human approval) — never silently relabeled "not a regression."
+- **Necessary invisible work is legitimate but bounded.** Security hardening, migrations, and refactors that de-risk future UX are enabling-investment, not churn — but bounded: after ~2 consecutive iterations with no user-facing delta (or ~a third of a milestone's budget), the next iteration must show a material user improvement or you flag the strand.
+- **The agent must not own the ruler.** The journey manifest + measurement harness are yours (or human-blessed), not authored by the cloud agent being measured; a change to them is reviewed and logged, like a merge approval.
+
+## Anti-patterns (hard stops)
+
+- **Over-building without distribution:** run a reachability/channel test before extending product scope. "Build it and they will come" is not a plan.
+- **Hallucinated progress:** require real evidence (HTTP 200, green CI, observed analytics, real survey N); never convert activity or a narrative into completion.
+- **Viral ≠ product-market fit:** attention, stars, and shares do not replace the Sean Ellis threshold plus a flattening retention curve.
+- **Metrics after the fact:** pre-register kill/pivot/continue thresholds before collecting results.
+
+## Escalate to the human (never decide autonomously)
+
+Hard authority limits: launching to real external channels, any spend or paid acquisition, setting or changing pricing, issuing discounts, entering contracts, expanding privileges, and any regulated/legal/privacy commitment require an explicit human boundary or approval. Within those limits, proceed on best judgment and record assumptions rather than pausing. Merge approval and abandonment remain human-gated per \`gh-first-mate\`.
+
+## Report
+
+Report the current phase, its checkpoint and whether it is met with reproducible evidence, the active mission(s) and their phase-appropriate acceptance criteria, and the next decision or escalation.
+`
+};
+//#endregion
+//#region src/lib/injected-skills/first-mate-setup-skill.ts
+const FIRST_MATE_SETUP_SKILL = {
+	name: "gh-first-mate-scaffold",
+	md: "---\nname: gh-first-mate-scaffold\ndescription: Scaffolds a repo-geared agentic-dev foundation through first-mate: seeds guidance files, role agents, ADRs, changelog, learnings, PR template, test instructions, Copilot setup, and CI through a scaffold branch and PR. Use before the first build wave on an owned repository.\nuser-invocable: true\n---\n\n# gh-first-mate-scaffold\n\nInvoke the `scaffold_repo` MCP tool (`mcp__first-mate__scaffold_repo`) before the first build wave on an owned repository. The goal is not generic TODO stubs; it is a repo-geared foundation that GitHub agents, local agents, reviewers, and CI can read.\n\n## What it seeds\n\n- `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / `.github/copilot-instructions.md` — identical guidance with overview, detected stack, commands, hard DoD gate, primary OS, conventions, structure, decisions/memory, handoff, testing, and gotchas.\n- `.github/agents/{ceo,cto,cpo,planner,implementer,reviewer,researcher,tester}.md` mirrored into `.claude/agents/` — C-suite operator hats plus execution roles, each with frontmatter, cold-start contract, method, quality bar, output contract, and self-reminder.\n- `docs/playbook/README.md` — the autonomous DISCOVER → NICHE → POSITION → SCOPE → BUILD → LAUNCH → MEASURE → ITERATE → GROW protocol, externally verifiable phase gates, OODA / Build-Measure-Learn governance, and authority limits.\n- `docs/adrs/0000-template.md` plus `docs/adr/0001-record-architecture-decisions.md` — Nygard-style decision record foundation.\n- `LEARNINGS.md`, `CHANGELOG.md`, `docs/history/0000-template.md`, `docs/plans/README.md`, and `docs/research/README.md` — durable memory, history, plans, and research conventions.\n- `.github/pull_request_template.md` — summary, type, failure-modes-considered-and-tested, and DoD checklist.\n- `.github/instructions/tests.instructions.md` — path-scoped test guidance filled from detected framework/dir/glob where possible.\n- `.github/workflows/copilot-setup-steps.yml` and starter `.github/workflows/ci.yml` — detected toolchain setup with stable quality-gate job names.\n\nIt does not seed factory-protocol or `docs/factory/` files. Orchestration remains outside the product repo in first-mate.\n\n## Usage\n\n```\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\" })\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\", mode: \"enhance\" })\nmcp__first-mate__scaffold_repo({\n  repo: \"owner/repo\",\n  mode: \"add-missing-only\",\n  detection_overrides: { primary_os: \"windows-latest\", test_command: \"npm test\" }\n})\n```\n\nModes:\n\n- `add-missing-only` (default): seed absent files and skip present files.\n- `enhance`: for guidance files, product playbook, ADR index, changelog, and learnings, append only missing `##` sections; never rewrite existing prose. Other present files are skipped.\n- `overwrite-approved`: replace existing files only when explicitly approved.\n\nAlways inspect the returned per-file report and PR. A no-op result means the repo already has the foundation or has no missing enhanceable sections.\n"
+};
+//#endregion
+//#region src/lib/injected-skills/first-mate-skill.ts
+const FIRST_MATE_SKILL = {
+	name: "gh-first-mate",
+	md: `---
+name: gh-first-mate
+description: Thin operating protocol for the first-mate GitHub cloud-agent controller: starts missions, wakes the durable loop, answers model and human requests, keeps context compact, and reports from the board/ledger. Use when the user wants first-mate to drive GitHub cloud coding agents across one or more repositories with foundation-first scaffolding and scoped, testable work.
+user-invocable: true
+---
+
+# gh-first-mate: durable cloud-agent controller loop
+
+Use this skill when the user wants first-mate to drive GitHub cloud coding agents across one or more repositories.
+The first-mate controller is the durable system of record: missions, units, decisions, handles, and controller state live in its registry and ledger.
+Your job is to run the thin protocol, not to hold the mission in context.
+
+## You are the CEO
+
+You are the CEO of the product. The GitHub cloud coding agents are your team; your job is to get real, verified work out of them and drive the product to an outcome — not to write the code yourself. Operate like a CEO every turn:
+
+- **Drive results, not activity.** Hold every deliverable to external evidence (a real HTTP 200, green CI, an observed metric, a real survey N). Never accept a self-reported "done" — autonomous agents fail or hallucinate completion a large fraction of the time.
+- **Set clear expectations.** Every mission's acceptance criteria IS the bar: a phase's externally verifiable checkpoint, stated so a reviewer can reproduce it.
+- **Keep the team unblocked and busy.** Answer agent questions fast (the controller surfaces \`answer_agent_question\`), dispatch independent units in parallel, and re-steer a stalled or weak agent promptly rather than letting it idle.
+- **Own the outcome.** Sequence missions toward the product result (niche → MVP → launch → traction), kill low-value work, and iterate on evidence. Think in bets — hypothesis, metric, threshold — and delegate execution to the cloud-agent team.
+
+For the full operating protocol — discovery, positioning, MVP scope, launch, measure, iterate, grow — invoke \`/gh-first-mate-operate\`.
+
+## Foundation-first mandate
+
+Before the first build wave on an owned repository, run \`mcp__first-mate__scaffold_repo\` and verify the PR landed or is already present. The scaffold must seed a repo-geared foundation that GitHub agents and CI can read: guidance, role agents, ADRs, changelog, learnings, PR template, test instructions, Copilot setup, and CI. Do not seed factory-protocol files into product repos; first-mate is the external orchestrator.
+
+Use \`mode: "add-missing-only"\` for new repos, \`mode: "enhance"\` when a repo has existing guidance that should keep its prose while appending missing \`##\` sections, and \`mode: "overwrite-approved"\` only with explicit approval.
+
+## Scoped-work discipline
+
+Well-scoped, testable work items succeed; vague meta-work fails. Discovery/decompose must emit concrete units with acceptance criteria, expected evidence, and dependencies. **Parallelize deliberately.** Independent build units that declare DISJOINT \`fileScopes\` build CONCURRENTLY — the controller proves independence (no unmet deps + non-overlapping declared scopes) and dispatches them in parallel up to the mission's \`maxConcurrentBuilds\` cap; units with overlapping or undeclared scope serialize their builds (the safe default). For fully independent workstreams you can also run SEPARATE missions — the build gate is per-mission, so N missions build N units at once. Never race overlapping work on the same files.
+
+Judgment and merge policy: merge remains human-gated, evidence-gated, and head/base-bound. Use the best available model tier for plan review, judgment, and merge decisions; never cheap out on plan/judge/merge calls.
+
+## Start a mission
+
+For a new goal, call mcp__first-mate__start_mission with:
+
+- goal: the user's goal in one sentence.
+- repos: repository strings as owner/name.
+- acceptance_criteria: explicit user-blessed acceptance criteria.
+- priority and house_rules only when the user supplied them or they are necessary constraints.
+
+If acceptance criteria are missing or ambiguous, ask the user before starting.
+Do not decompose the mission yourself at start time; mission registration is intentionally simple and later controller wakes/model requests drive decomposition and steering. If the user explicitly asks to append scoped work to an existing active mission, use mcp__first-mate__add_units with concrete unit titles.
+
+Invariant (closes the stranding hole): work only ever becomes active inside a turn — start_mission is a tool call, nothing activates a mission server-side. So immediately after start_mission, run one loop turn (advance, then arm the heartbeat) in the SAME turn, before you yield. Never register a mission and stop without arming; otherwise nothing will wake to drive it.
+
+## Controller loop (push-based, self-driving)
+
+The loop is push-based: each turn you DRAIN all ready work, then ARM the next wake and YIELD the turn. You never sit polling advance in a tight loop — that does not scale and wastes context. A durable heartbeat re-invokes this skill while the session is idle, and one advance call sweeps the WHOLE portfolio (every mission, every repo) at once, so a single heartbeat drives everything.
+
+Each turn:
+
+1. Call mcp__first-mate__advance, batching any answers you already have.
+2. Read the compact response: board, needsModel, needsHuman, applied_count, nextWakeAt, and nextWakeSeconds.
+3. Answer every needsModel item with the typed verdict for its kind, and courier every needsHuman packet. If you produced any model_answers this turn, call advance again to apply them and pick up the resulting state. Stop this inner drain once advance returns no new needsModel you can answer without the user; keep it bounded (at most a few iterations), never a busy loop.
+4. Manage the heartbeat from nextWakeSeconds (see "Self-driving heartbeat").
+5. Report compactly from the board, then YIELD. Do not call advance again until the next scheduled wake or a new user message.
+
+When submitting answers, batch what you have:
+
+- model_answers: [{ requestId, verdict }]
+- human_decisions: [{ requestId, choice }]
+
+Keep verdicts small and typed to the request kind.
+
+## Model request verdicts
+
+Use the request's kind and payload as the contract:
+
+- decompose: split a unit-less active mission into dispatchable units. Return { units: [{ title, repo?, agent?, dependsOn?, model?, fileScopes? }] }. \`dependsOn\` entries are 0-based indices into the same units list. **\`fileScopes\` is the parallelism lever** — declare each unit's disjoint file allowlist (paths or \`dir/**\` prefixes it may touch) so the controller can prove independence and build those units CONCURRENTLY; units with overlapping or absent scopes serialize their builds. Emit once per unit-less active mission; the controller creates durable unit ids and will not ask again after units exist.
+- review_plan: review the plan against the mission goal, acceptance criteria, and house rules. Return { decision: "approve" } when the plan is good enough to implement, or { decision: "refine", instruction: "..." } with a short actionable refinement.
+- answer_agent_question: answer only from the acceptance criteria and supplied context. Return { answer: "..." }. If the answer is not derivable, do not invent policy; escalate by leaving a short answer that says what the human must decide.
+- author_fix: author a concise fix instruction for the cloud agent. Return { instruction: "..." } with the failure, expected behavior, and any bounded check to run.
+- judge_review: judge whether review/CI/floor evidence is sufficient. Return { pass: true } only when the acceptance criteria and floor are satisfied; otherwise return { pass: false } with a compact reason when useful.
+
+Delegate heavy reading to workers:
+
+- Use the worker-explore subagent (Agent tool) for focused source or history gathering.
+- Use the worker-review subagent (Agent tool) for compact review of a specific plan, PR summary, or suspicious change.
+- Use the worker-test subagent (Agent tool) when a missing executable check is the blocker.
+
+Operator / --agents mode constraint: delegate product implementation to GitHub cloud agents. Direct \`mcp__workers__*\` / \`mcp__orchestrate__*\` calls are subagent-only for the main operator; use the worker-* Agent subagents when local worker help is genuinely needed. Local tools (Edit/Write/Bash, \`gh\`, \`git\`) remain available, but prefer authoring fix instructions for the cloud agent rather than pulling large diffs or CI logs into the lead context.
+
+Do not read a full diff, full CI log, or full transcript in the lead context. Ask workers for narrow facts and compact excerpts. The ledger is durable memory; context is not.
+
+## Human requests
+
+For each needsHuman item:
+
+1. If packetHtmlPath is present, open that HTML file in the ai-or-die artifact panel for the user.
+2. Tell the user the reason, repo, issue/PR handles, and the available decision choices.
+3. Wait for the user's decision.
+4. Submit the choice back with mcp__first-mate__advance({ human_decisions: [...] }).
+
+If an artifact-panel tool is unavailable, give the user the local packetHtmlPath and the compact summary from needsHuman.
+Never decide a merge approval or abandonment choice on the user's behalf.
+
+## Self-driving heartbeat (arm / disarm)
+
+The loop keeps itself alive with ONE durable cron job — a dead-man's-switch that survives idle, compaction, restart, and /clear because it lives on disk, not in your context. The controller hands you nextWakeSeconds so you never do arithmetic: it is a ready-to-use delay in seconds, or null when the whole portfolio is idle. Every heartbeat carries the exact marker token [fm-heartbeat] in its prompt so you can identify it unambiguously (never a fuzzy match against unrelated crons). Manage exactly one heartbeat:
+
+Arm — "create fresh, then reap the rest" (nextWakeSeconds is a number, i.e. there is active work):
+
+1. Pick the cadence bucket from nextWakeSeconds (fixed cron expressions, no time math), so the heartbeat tracks the controller's own cadence:
+   - nextWakeSeconds <= 120  → "1-59/2 * * * *"    (about every 2 min)
+   - nextWakeSeconds <= 600  → "2,7,12,17,22,27,32,37,42,47,52,57 * * * *"  (about every 5 min)
+   - otherwise               → "3,13,23,33,43,53 * * * *"  (about every 10 min)
+2. CronCreate the new heartbeat and capture its id: durable: true, recurring: true, the chosen cron, prompt "/gh-first-mate [fm-heartbeat] wake the controller loop, answer ready requests, reschedule." Creating first (before deleting) guarantees at least one heartbeat always exists.
+3. CronList, then CronDelete every job whose prompt contains [fm-heartbeat] EXCEPT the id you just created. This converges to exactly one, reaps duplicates and old-version orphans, and — because you recreate each wake — resets the 7-day recurring-cron expiry so a long mission never silently stops.
+
+Disarm (nextWakeSeconds is null AND there are no pending needsHuman): nothing is active. CronList and CronDelete every [fm-heartbeat] job. Report that first-mate is idle and resumes when the user next starts or advances a mission (safe because, per the Start-a-mission invariant, only a turn can reactivate work, and that turn re-arms).
+
+Responsiveness (optional): the buckets above already tighten cadence to ~2 min for imminent work. If this session is a /loop you MAY additionally ScheduleWakeup(delaySeconds: nextWakeSeconds, ...) for an exact one-shot; keep at most one outstanding.
+
+Guardrails: never leave more than one [fm-heartbeat] job; never busy-loop advance; if no scheduler tool is available, tell the user the next wake is in nextWakeSeconds seconds and stop.
+
+MCP unavailable: if the first-mate MCP server is not present (this is not a \`--agents\` session and \`mcp__first-mate__advance\` would return a tool-not-found error), do NOT attempt to advance. CronList then CronDelete every [fm-heartbeat] job (same as Disarm above), and report "first-mate paused — re-run under \`github-router claude --agents\` to resume." Stop without further action.
+
+## Board reports
+
+Use mcp__first-mate__board or mcp__first-mate__mission_status for read-only status checks.
+Report compactly:
+
+- mission id and title
+- repositories
+- phase counts
+- blocked count and why, when available
+- per-unit handles for non-terminal units: unitId, issue/PR, phase, provider, validation, model, and blockedReason when present
+- resolved cloud-agent model per unit (surfaced on the board — verify model choice before approving plans)
+- terminal work only as summary counts; use include_all only when the user asks for completed/abandoned history
+- next wake time or the next requested action
+
+Never reconstruct status by rereading raw logs when the controller board already has the handles.
+
+## Context discipline
+
+- The ledger is the durable memory; do not paste large artifacts into the chat.
+- Never read a full diff/log/transcript unless the user explicitly asks and it is essential.
+- Prefer handles: mission id, repo, issue, PR, request id, packet path.
+- Keep every answer to first-mate compact and action-oriented.
+- If controller state and chat memory disagree, trust the controller state and ask for clarification only when it affects acceptance criteria or human approval.
+
+## Return format
+
+When reporting progress, return:
+
+- Mission: id and one-line goal.
+- Board: compact phase counts and blocked count.
+- Applied: count or short list of important controller actions.
+- Needs model: request ids and kinds answered or pending.
+- Needs human: decision ids/packet paths and the user's required choice.
+- Next wake: the heartbeat state — armed and next check in nextWakeSeconds seconds, or idle (disarmed).
+`
+};
+//#endregion
+//#region src/lib/injected-skills/floor-keeper-skill.ts
+const FLOOR_KEEPER_SKILL = {
+	name: "gh-floor-keeper",
+	md: `---
+name: gh-floor-keeper
+description: Done-checkpoint verification for non-trivial changes: runs the executable gate, sends the diff to OpenAI and Google reviewers, consults the advisor, reconciles findings by severity, authors missing tests through a different lab when bounded and appropriate, and returns an honest go/no-go. Use before declaring non-trivial work complete.
+user-invocable: true
+---
+
+# gh-floor-keeper: done-checkpoint verification
+
+Invoke this before declaring a non-trivial change done.
+It is the final floor check: executable gate first, cross-lab review second, advisor third, severity reconciliation last.
+It does not prove the change is correct; it reports what was checked and what remains residual.
+
+## Operating contract
+
+- Input: the user ask, user-blessed acceptance criteria, current diff, and any research or plan pointers.
+- Output: go/no-go with binding executable results, advisory review findings, and residual risks.
+- Scope: changed behavior and changed files, not a full repo audit unless requested.
+- Reuse /gh-research for claim verification instead of re-deriving complex facts.
+- Keep attempts bounded and ask before expanding into a large new test harness.
+
+## Honest limits
+
+- The executable gate is binding only for what it covers.
+- A green gate does not rule out wrong-spec or missing coverage.
+- Cross-lab review reduces correlated blind spots but is advisory.
+- Advisor output is judgment-only unless converted into tests, source changes, or a gate.
+- Different-lab test authorship is an advisory practice, not enforceable provenance.
+
+## Step 1: gather the done context
+
+Collect:
+
+- Original ask and acceptance criteria.
+- Current working-tree diff.
+- Commands already run and their outputs.
+- Research brief pointer, if one exists.
+- Plan or orchestration summary, if one exists.
+- Known residual risks from earlier phases.
+
+If acceptance criteria are absent, stop and ask for them or state that wrong-spec risk remains high.
+
+## Step 2: run the executable gate
+
+Run the repo-appropriate executable checks for the changed slice:
+
+- typecheck, tests, lint, build, or focused command named by the repo/user.
+- Prefer the existing gate command when available.
+- Capture exact command, exit code, duration, and relevant output.
+- If the command times out or cannot run, report unknown, not pass.
+
+Binding rule:
+
+- Red gate for covered behavior means no-go until fixed or explicitly waived by the user.
+- Green gate means only that the checks that ran passed.
+- Missing checks or unavailable commands remain residual risk.
+
+## Step 3: identify missing test coverage
+
+Ask whether changed behavior has executable coverage.
+
+- If behavior changed and no relevant test exists, dispatch the worker-test subagent (Agent tool, subagent_type worker-test) to author a focused test through a DIFFERENT lab than the implementer when possible.
+- Cap missing-test attempts; default to a small number of focused tries.
+- Run the new test and then the relevant existing gate.
+- If creating a large new harness, broad fixture system, or slow integration environment is required, ask the user before proceeding.
+- If a model-authored test is the only oracle, label it honestly as helpful but not a complete correctness guarantee.
+
+## Step 4: fan out cross-lab review
+
+Send the same diff, acceptance criteria, and gate results in parallel to:
+
+- mcp__peers__codex_reviewer (OpenAI)
+- mcp__peers__gemini_reviewer (Google)
+
+Ask both reviewers for:
+
+- correctness bugs
+- acceptance-criteria misses
+- regressions
+- security or data-loss risks
+- test gaps
+- maintainability issues that matter for this change
+- severity for each finding: blocker, high, medium, low, nit
+
+Do not treat reviewer agreement as proof. Treat it as advisory signal to investigate or fix.
+
+## Step 5: consult advisor
+
+Consult the advisor with a focused concern:
+
+- whether the diff satisfies the acceptance criteria
+- whether the gate covers the risky behavior
+- whether reviewer findings indicate no-go
+- what residual risk should be surfaced to the user
+
+Advisor output is advisory unless you convert it into a source-verified claim, executable test, or code change.
+
+## Step 6: verify disputed or load-bearing claims
+
+For any important claim from a reviewer, advisor, or your own reading:
+
+- If it needs research, invoke /gh-research and use its persisted brief pointer.
+- Prefer reproducing the issue or running a focused test: verified-executable.
+- Otherwise read the actual source and cite it: verified-source.
+- If neither is possible within budget, mark unverified and include it in residual risk.
+
+Do not re-derive complex repo facts from memory when /gh-research is the right tool.
+
+## Step 7: reconcile by severity
+
+Build a reconciliation table:
+
+- Finding.
+- Source: gate, codex reviewer, gemini reviewer, advisor, research, or self.
+- Severity: blocker, high, medium, low, nit.
+- Evidence tag: verified-executable, verified-source, cross-lab-agreed, or unverified.
+- Decision: fix now, accept residual, ask user, or no action.
+
+Decision rules:
+
+- Any covered executable failure is no-go.
+- Any credible blocker or high correctness/security/data-loss issue is no-go unless disproven or explicitly waived.
+- Medium issues usually require fixing when cheap; otherwise surface as residual.
+- Low and nit findings do not block unless they violate acceptance criteria.
+- Wrong-spec residual is always listed unless the user explicitly blessed the acceptance criteria for this exact done state.
+
+## Step 8: return go/no-go
+
+Return a compact final checkpoint:
+
+- Verdict: go or no-go.
+- Executable gate: commands, pass/fail/unknown, and why it is binding or not.
+- Missing-test handling: tests authored, skipped, capped, or user approval needed.
+- Cross-lab review summary: OpenAI findings, Google findings, agreements, disagreements.
+- Advisor summary.
+- Reconciliation table with severity and evidence tags.
+- Residual risks, explicitly including wrong-spec if applicable.
+- Required next actions before declaring done.
+
+## Non-goals
+
+- Do not claim the change is correct merely because tests passed.
+- Do not let advisory reviewers override a covered red executable gate.
+- Do not spend unbounded attempts creating tests.
+- Do not bury cap-hit or unknown states in a green-sounding summary.
+`
+};
+//#endregion
+//#region src/lib/injected-skills/orchestrate-skill.ts
+const ORCHESTRATE_SKILL = {
+	name: "gh-orchestrate",
+	md: `---
+name: gh-orchestrate
+description: Right-sized blind-spot-elimination for non-trivial implementation asks: captures user-blessed acceptance criteria, delegates bounded research, decomposes and plans, composes a native Workflow with explicit deterministic/advisory annotations, verifies the workflow, checkpoints residual risks and cost, then runs only when the pipeline actually raises the floor. Use when a non-trivial implementation ask benefits from workflow-level blind-spot reduction.
+user-invocable: true
+---
+
+# gh-orchestrate: right-sized blind-spot elimination
+
+Use this skill when the user asks for a non-trivial change and the composed workflow can reduce real blind spots.
+The sole objective is: how does the composed workflow deterministically raise the floor for THIS ask, and what blind spots does it eliminate with which tools?
+
+## Right-size first
+
+- For trivial asks, skip this pipeline and say why.
+- A three-line obvious fix, typo, small config read, or simple explanation should not pay orchestration cost.
+- If the ask has multiple files, unclear behavior, risky migration, uncertain tests, or high user impact, orchestration is likely worth it.
+- The pipeline is a tool, not a ritual.
+
+## Honest limits
+
+- User-blessed acceptance criteria are the only defense against the wrong-spec hole.
+- Executable gates do not catch a model solving the wrong task.
+- Cross-lab review is advisory unless a code rule or executable gate consumes its output.
+- The native Workflow path approximates but does not carry the kernel's hard max(orchestrated, baseline) guarantee.
+- Use mcp__orchestrate__run_workflow instead when the user wants the hard floor from the frozen kernel.
+
+## Phase 0: scope and acceptance criteria
+
+1. Restate the user's goal in one sentence.
+2. Capture explicit USER-BLESSED acceptance criteria before planning.
+3. If acceptance criteria are missing or ambiguous, ask the user or present a short candidate list for confirmation.
+4. State plainly: these criteria are the only guard against wrong-spec; green tests can still be green for the wrong interpretation.
+5. Identify constraints: files, APIs, compatibility, performance, security, release risk, and forbidden changes.
+
+## Phase 1: delegate research
+
+1. Invoke /gh-research for the ask and acceptance criteria.
+2. Wait for its bounded saturated brief.
+3. If the brief is cap-hit-with-residuals, surface that status; do not treat it as complete.
+4. Read the persisted research file by pointer when needed and check freshness metadata.
+5. If HEAD or the working-tree diff hash moved, re-verify stale load-bearing claims.
+
+## Phase 2: blind-spot analysis
+
+Create a blind-spot table before decomposing:
+
+- Wrong-spec risk: judgment-only, mitigated only by user-blessed acceptance criteria and checkpoint.
+- Root-cause risk: executable-checkable if reproduced or covered by a failing test; otherwise advisory.
+- Integration risk: usually source-verified plus tests where possible.
+- Regression risk: executable-checkable when tests/typecheck/lint cover it.
+- Review risk: advisory cross-lab reviewers reduce correlated blind spots.
+- Concurrency or merge risk: source-verified and sometimes executable-checkable.
+- Missing-test risk: executable-checkable only after a test exists and runs.
+
+Tag every blind spot as executable-checkable or judgment-only.
+
+## Phase 3 and 4: decompose and plan (run in parallel)
+
+These two are INDEPENDENT: mcp__orchestrate__decompose consumes { ask, context: research brief plus blind-spots }, and the worker-plan subagent consumes the ask, acceptance criteria, research pointer, and blind-spot table. Neither needs the other's output. So issue BOTH in a SINGLE parallel batch (same turn) — call mcp__orchestrate__decompose and dispatch the worker-plan subagent together; do not wait for decompose first.
+
+- decompose: mcp__orchestrate__decompose({ ask, context: research brief plus blind-spots }). Treat the output as a proposal, not gospel; reject or revise nodes that do not map to a real blind spot.
+- plan: dispatch the worker-plan subagent (Agent tool, subagent_type worker-plan) with the ask, acceptance criteria, research pointer, and blind-spot table. Ask for files, tests, rollback concerns, and minimal safe increments; keep it bounded and suited to the change size.
+
+## Phase 5: compose a native Workflow
+
+Compose a native Workflow using the Workflow tool where every node has:
+
+- goal
+- input artifacts
+- output artifact
+- gh-router tool to call
+- blind spot it kills
+- deterministic or advisory annotation
+- producer and checker lab where relevant
+
+Parallelism (the Workflow tool's core optimization rule):
+
+- DEFAULT to pipeline(): items flow through stages with NO barrier, so the slowest single item, not the slowest stage, sets wall-clock.
+- Use parallel() ONLY at a genuine barrier — a stage that needs ALL prior results at once (dedup/merge across the set, an early-exit on the total, or a cross-item comparison). "It is cleaner" or "I need to map/flatten first" is NOT a barrier; do that transform inside a pipeline stage.
+- Independent nodes within a phase run concurrently; never serialize work that has no data dependency.
+
+Role to tool mapping:
+
+- research: worker-explore (Agent subagent) and mcp__search__code for focused follow-ups.
+- plan: worker-plan (Agent subagent).
+- implement: worker-implement (Agent subagent), with worktree:true for parallel writers.
+- test: worker-test (Agent subagent), authored by a DIFFERENT LAB than the implementer when possible. This is an advisory practice, not enforced provenance.
+- review: mcp__peers__codex_reviewer plus mcp__peers__gemini_reviewer. Advisory unless findings are converted into executable checks or code changes.
+- baseline and selector: OPT-IN only because it doubles cost. Choose max(orchestrated, baseline) by EXECUTABLE gate result, not model judgment. If no executable oracle exists, say the selector is advisory.
+- verify: cross-lab checker plus mcp__orchestrate__attest_step with producer not equal to checker lab.
+
+No nesting:
+
+- A Workflow node must not invoke /gh-orchestrate.
+- Workflow-spawned workers are internal sessions.
+- Internal sessions must not get prompt steering or stop-gate blocking.
+- Carry a depth or call budget and stop with a diagnostic if it would recurse.
+
+## Phase 6: verify the workflow
+
+1. Call mcp__orchestrate__verify_workflow.
+2. Fix drift between the ask, acceptance criteria, research, plan, and node graph.
+3. Bound this repair loop to at most 3 verification rounds.
+4. If drift remains after the cap, checkpoint with the drift as residual risk instead of pretending it is solved.
+
+## Phase 7: checkpoint, then run
+
+Before running, present:
+
+- Goal and user-blessed acceptance criteria.
+- Node to tool map.
+- Per-node blind spot killed.
+- Per-node deterministic or advisory annotation.
+- Residual-risk list, including the wrong-spec residual.
+- Research saturation status and any open residual unknowns.
+- Cost estimate: workers, peer calls, tests, and whether baseline plus selector is enabled.
+- The statement that native Workflow approximates, but does not guarantee, hard max(orchestrated, baseline).
+
+After the checkpoint, run the Workflow only if it still appears right-sized for the ask.
+If the user rejects scope or cost, downshift to the smallest workflow that kills the important blind spots.
+
+## Return format
+
+Return:
+
+- Whether orchestration was skipped or run, with the right-sizing reason.
+- Acceptance criteria used.
+- Research brief pointer and freshness status.
+- Workflow summary and node annotations.
+- Executable gate results, if any.
+- Advisory review results, if any.
+- Final residual risks and next action.
+`
+};
+//#endregion
+//#region src/lib/injected-skills/research-skill.ts
+const RESEARCH_SKILL = {
+	name: "gh-research",
+	md: `---
+name: gh-research
+description: Bounded saturation research for non-trivial GitHub Router asks: enumerates unknowns, gathers in parallel through code search, web search, and explore workers, adversarially verifies load-bearing claims, persists a freshness-stamped brief, and returns a compact confidence-tagged root-cause summary. Use when grounded context is needed before planning or changing code.
+user-invocable: true
+---
+
+# gh-research: bounded saturation engine
+
+Use this skill when an ask needs grounded investigation before planning or editing.
+Your output is a compact confidence-tagged root-cause brief plus a pointer to the durable full brief.
+Do not try to be exhaustive forever; saturation is bounded by explicit caps.
+
+## Operating contract
+
+- Objective: find the most likely root cause, integration constraints, or decision facts for this ask.
+- Prefer primary sources over summaries.
+- Prefer executable proof over all other evidence.
+- Be honest about uncertainty: only verified-executable is deterministic.
+- Delegate heavy gather to workers so the top-level context stays compact.
+- Never silently claim completeness after hitting a cap.
+
+## Evidence tags
+
+Use these exact tags on every finding and claim:
+
+- verified-executable: reproduced the symptom, ran the failing test, or ran a check that directly proves the claim. This is the only deterministic confidence tag.
+- verified-source: read the actual source, config, logs, docs, or primary artifact and cited the relevant locations. This is model-mediated and can still be wrong.
+- cross-lab-agreed: a different-lab reviewer or critic independently agreed with the claim. This reduces correlated blind spots but is advisory.
+- unverified: plausible but not confirmed; treat as residual risk.
+
+## Bounded loop
+
+Default caps unless the user explicitly gives a smaller or larger budget:
+
+- Maximum rounds: about 3.
+- Maximum parallel explore workers per round: finite and right-sized to the ask.
+- Maximum search and peer-review calls: finite; do not spend unbounded context.
+- Terminate at the first of saturation or a cap.
+- On cap-hit, return with open unknowns flagged as residual. Do not loop forever.
+
+## Procedure
+
+1. Restate the ask and define the research target.
+   - Identify whether this is a bug, feature, refactor, incident, or design question.
+   - Name the expected downstream consumer: implementer, orchestrator, floor-keeper, or user.
+
+2. Enumerate unknowns as an explicit worklist.
+   - Include facts needed to decide the root cause or safe implementation path.
+   - Mark each unknown as code, behavior, dependency, history, external, or acceptance-criteria related.
+   - Add newly discovered unknowns as they appear.
+
+3. Fan out in parallel.
+   - Run independent code, web, history, and explore calls concurrently where possible; only the semantic-to-lexical code-search refinement is ordered. Issue the independent calls in a SINGLE turn (one message, multiple tool calls) so the harness actually runs them in parallel rather than serializing.
+   - Use mcp__search__code semantically first to find concepts and likely files.
+   - Then use mcp__search__code lexically for exact symbols, filenames, errors, routes, flags, and config keys.
+   - Use git blame or history when authorship, regression timing, or intent matters.
+   - Use mcp__search__web for upstream APIs, package behavior, protocol docs, or public issues.
+   - Launch parallel worker-explore background subagents (via the Agent tool, subagent_type worker-explore) for heavy gathering, each with a narrow question and expected artifact. They run non-blocking and report back on completion.
+   - Keep worker results summarized; do not paste every detail into the main context.
+
+4. Form a root-cause hypothesis.
+   - For bugs: describe the causal chain from trigger to observed symptom.
+   - For features: identify integration points, constraints, and likely implementation seams.
+   - For design questions: identify the decision, alternatives, and primary constraints.
+   - State what would falsify the hypothesis.
+
+5. Verify load-bearing claims adversarially.
+   - First preference: reproduce the bug, run the failing test, or run the direct check. Tag verified-executable.
+   - If executable proof is not available, read the actual source or primary artifact and cite the lines. Tag verified-source.
+   - Dispatch the worker-review subagent (via the Agent tool) to confirm the source-reading for important claims.
+   - Ask a different-lab refuter through mcp__peers__codex_critic or mcp__peers__gemini_critic to try to refute the hypothesis.
+   - Give the refuter the symptom, observed facts, and acceptance criteria, but not your proposed root cause. Avoid anchoring them.
+   - If the refuter finds a plausible alternative, add it to the worklist and spend at most one bounded round resolving it.
+
+6. Run a completeness pass.
+   - Ask: what do we still not know?
+   - Ask: what claim, if false, would break the conclusion?
+   - Ask: have we checked primary sources for every load-bearing claim?
+   - Ask: did a further bounded round surface anything material?
+   - If no material unknowns remain and the root cause is at least verified-source, stop for saturation.
+
+7. Persist the full brief.
+   - Write a durable markdown file such as .docs/research/<slug>.md.
+   - Include freshness metadata: HEAD commit, working-tree diff hash, timestamp, repo path, and command/search date.
+   - Include the unknown worklist, searches run, workers consulted, evidence table, refuter result, residuals, and full citations.
+   - Downstream phases should read by pointer and check freshness instead of re-injecting the whole brief.
+
+## Return format
+
+Return a compact brief, not the whole research dump:
+
+- Research file: path to the durable brief.
+- Freshness: HEAD commit, diff hash, timestamp.
+- Termination: saturated or cap-hit; if cap-hit, name the cap.
+- Root-cause hypothesis: 3-8 bullets with confidence tags.
+- Evidence table: claim, tag, primary source or command, reviewer/refuter status.
+- Residual unknowns: explicit list, or none.
+- Downstream guidance: recommended next action and what must be rechecked if the tree changes.
+
+## Non-goals
+
+- Do not present verified-source or cross-lab-agreed as deterministic.
+- Do not hide open unknowns because the answer looks useful.
+- Do not keep searching after the cap.
+- Do not paste the entire persisted brief into later turns unless the user asks.
+`
+};
+//#endregion
+//#region src/lib/injected-skills/worker-skill.ts
+/**
+* The `/gh-worker` skill: the operating model for the NON-BLOCKING workers
+* surface. Materialized into the per-launch mirror whenever `workerToolsEnabled()`
+* (same gate as the other floor-raising skills). Discoverability + playbook; the
+* load-bearing enforcement is the PreToolUse guard + the `worker-*` dispatcher
+* subagents (see src/lib/worker-dispatch.ts).
+*/
+const WORKER_SKILL = {
+	name: "gh-worker",
+	md: `---
+name: gh-worker
+description: Runs github-router workers without blocking the turn: dispatches the matching worker-* background subagent (explore/implement/review/plan/test, up to 6 hours each) for a completion notification instead of a blocking wait. Use when a task would benefit from a background worker for investigation, planning, review, implementation, or test authoring.
+user-invocable: true
+---
+
+# gh-worker: non-blocking workers
+
+Worker tasks (explore, implement, review, plan, test) can run for up to 6 hours.
+In this session they are NON-BLOCKING BY DESIGN: you dispatch a
+background \`worker-*\` subagent, get control back immediately, and receive the
+worker's result as a completion notification when it finishes. Your turn is
+never blocked waiting on a worker, and the worker's tool output never fills your
+context (only its final result comes back).
+
+## How to run a worker
+
+Dispatch the matching dispatcher subagent with the Agent tool:
+
+- worker-explore: read-only investigation / codebase gathering, returns a summary.
+- worker-review: reads the code itself to verify a change or claim; findings with severity + file:line.
+- worker-plan: returns an ordered implementation plan from a task + acceptance criteria.
+- worker-implement: read/write/bash coding worker; pass worktree: true for isolated-worktree execution + a returned diff.
+- worker-test: independent test author that writes tests trying to break the implementation and reports pass/fail.
+
+Put the full worker brief in the subagent's prompt (and an absolute workspace
+path, or model/thinking/worktree, only if you need to override the defaults).
+The dispatcher calls the worker once and relays its result verbatim.
+
+## What to expect
+
+- The dispatch returns immediately; you can keep working or start other workers.
+- When the worker finishes you get a completion notification carrying its result.
+- Up to 8 workers run concurrently (the worker-semaphore cap); further dispatches queue.
+- You do NOT call the raw mcp__...__ worker tools from the main thread: a guard
+  denies that and points you at the matching worker-* subagent. That guard is the
+  guarantee your turn never blocks; dispatching worker-* directly is the normal path.
+
+## Notes
+
+- Large worker output may be summarized by the dispatcher relay; for a big
+  artifact, have the worker write it to a file and return the path.
+- Dispatching the same worker twice runs it twice (no dedup); avoid double-dispatch
+  for side-effecting work like worker-implement.
+- Background subagents + completion notifications are the interactive default. In
+  headless (claude -p) runs the task surface behaves differently; prefer interactive
+  for long worker fan-out.
+`
+};
+//#endregion
+//#region src/lib/claude-md-injection.ts
+/**
+* Marker fences for each injection block. The literal text of each
+* fence is intentionally specific enough that a content collision with
+* user prose is implausible. Each block's parser only matches its own
+* marker pair, so blocks operate independently.
+*
+* Writer-side guard: the injector refuses to write a snippet that
+* itself contains its own marker literals (that would create
+* ambiguous state on the next launch where the inner literal would
+* parse as a new open or close marker).
+*/
+const PEER_MARKER_OPEN = "<!-- gh-router peer-mcp awareness — auto-injected, regenerated per launch -->";
+const PEER_MARKER_CLOSE = "<!-- /gh-router peer-mcp awareness -->";
+const STYLE_MARKER_OPEN = "<!-- gh-router style directive — auto-injected, regenerated per launch -->";
+const STYLE_MARKER_CLOSE = "<!-- /gh-router style directive -->";
+const OPERATING_MARKER_OPEN = "<!-- gh-router operating defaults — auto-injected, regenerated per launch -->";
+const OPERATING_MARKER_CLOSE = "<!-- /gh-router operating defaults -->";
+const TOOLBELT_MARKER_OPEN = "<!-- gh-router toolbelt awareness — auto-injected, regenerated per launch -->";
+const TOOLBELT_MARKER_CLOSE = "<!-- /gh-router toolbelt awareness -->";
+const ARTIFACT_MARKER_OPEN = "<!-- gh-router artifact-panel directive — auto-injected when in an ai-or-die tab -->";
+const ARTIFACT_MARKER_CLOSE = "<!-- /gh-router artifact-panel directive -->";
+function ARTIFACT_PANEL_DIRECTIVE(peersKey = "peers") {
+	const toolPrefix = `mcp__${peersKey}__artifact_`;
+	return `## Review in the artifact panel (HTML by default)
+
+You are running inside an ai-or-die tab, so the \`${toolPrefix}*\` tools drive a live human-review panel. Default to opening a self-contained HTML artifact for anything the user should review before you proceed: plans, design proposals, comparisons / trade-offs, decisions that need their input, diagrams, tables, code diffs, and reports. Plan-mode plans are auto-rendered to HTML and opened for you; skip the panel only for trivial one-line answers. Run the \`gh-artifact-review\` skill for the full playbook: HTML + design conventions, the \`${toolPrefix}open\` / \`${toolPrefix}await\` (pass back the \`cursor\`) / \`${toolPrefix}reply\` / \`${toolPrefix}end\` loop, and the \`data-aod-*\` interactive controls.`;
+}
+/**
+* Writing / communication style directive injected at the TOP of the
+* mirrored CLAUDE.md so every spawned agent (main, Agent-tool subagent,
+* agent-teams teammate) reads it before the user's own CLAUDE.md body.
+*
+* Self-referentially compliant: the directive itself uses no em
+* dashes and does not mention any Claude / Anthropic attribution.
+*/
+const STYLE_DIRECTIVE = "Write concisely without losing detail. Use a natural human voice. Avoid em dashes. Do not attribute work to Claude, AI, LLM, or Anthropic anywhere (commits, PRs, issues, code, comments, docs).";
+/**
+* Operating-defaults directive injected at the TOP of the mirrored CLAUDE.md.
+* The main agent's system prompt (`--append-system-prompt`) gets
+* OPERATING_DEFAULTS_DIGEST instead, with this full statement available through
+* CLAUDE.md. Three defaults, each explicitly overridden by the user's own
+* direction and the domain's standards:
+*
+*   1. Orchestrate (strong default): delegate the heavy / parallel /
+*      context-heavy work to the right subagent / worker / model, keeping the
+*      main context free to reason and collaborate with the user, while still
+*      doing trivial / surgical / last-mile work directly (delegating that
+*      would only add relay-fidelity loss + latency).
+*   2. Adversarial review: WHEN a peer critic earns its keep and, equally
+*      important, when reaching for one is ritual rather than review. Same
+*      failure shape the delegation default had: "consult a critic for
+*      non-trivial changes" is unfalsifiable in advance, so it collapses into
+*      either never (four of four unprimed agents) or always (worse than
+*      never). The discriminator is whether the conclusion still turns on
+*      judgment once the direct evidence is in: a consequential recommendation
+*      cannot be run, which is exactly where confabulation hides, while a
+*      tracing question a search already proved gains nothing from a second
+*      model re-deriving it. The roster, the lens-to-artifact match, the
+*      advisor-complements-rather-than-substitutes distinction, and the
+*      do-not-anchor-the-critic rule live here; the digest carries only the
+*      trigger and the ritual exclusion.
+*   3. Excellence lens: the principles stated plainly and concretely (radical
+*      simplicity + real-user focus; whole-system first-principles thinking that
+*      anticipates scale; work back from the customer outcome). Named exemplars
+*      were dropped per the injected-surface review: a named entity is a dense,
+*      high-variance vector that pulls in persona mannerisms at top salience, and
+*      the guidance favors specific functional framing over comparison, so
+*      specificity carries the vividness instead.
+*   4. Engineering excellence: quality / robustness / maintainability over
+*      development cost; reproduce a bug end-to-end (as a real user hits it)
+*      before fixing so the fix targets the real cause; a pixel-perfect UI bar;
+*      and fix any lint error / test failure / flake on sight, whoever caused it,
+*      folded into the current work rather than derailing the user's task (the
+*      scope guardrail keeps proactive quality from becoming yak-shaving). The
+*      digest carries a one-line form; the full statement lives here so it does
+*      not cost the context window every turn.
+*
+* Self-referentially compliant with the style directive: no em dashes, no
+* Claude / Anthropic attribution.
+*/
+const OPERATING_DEFAULTS_DIRECTIVE = "## Operating defaults (apply when the user has not specified otherwise; the user's explicit direction and the domain's own standards always override)\n\nOrchestrate. Delegate research, implementation, review, and large reads to the right subagent, worker, or model. Reach for `implementer` when you know what to build, `reviewer` when something exists and you want it assessed (including reproducing and root-causing a failure), `brainstorm` when you do not yet know which approach to take, `scout` to find or understand something in the repo, and `scribe` for docs and ADRs that trail the code; worker-* agents for background non-blocking runs; Task subagents for parallel work; peer critics for review. That keeps your own context free to reason and collaborate with the user. Prefer parallel delegation for independent work. Delegation pays when the work is WIDE (many files or sources to sweep) or SLOW, and you need only the conclusion: the main thread is where you think with and respond to the user, and its context window is a finite shared resource. It does NOT pay merely because a sub-question is separable. A narrow, deep question whose whole value is file:line fidelity loses exactly that through a summarization layer, and a sub-question you could answer in one command is cheaper done directly than paying a subagent's startup. Do trivial, surgical, and last-mile work yourself.\n\nAdversarial review. The peer critics (`codex_critic` and `codex_reviewer`, `gemini_critic` and `gemini_reviewer`, `opus_critic`, and the `peer-review-coordinator` that fans out to several of them) are fresh-context models, so what they add is a blind spot that whoever produced the work cannot reach by thinking harder about it; prefer a critic from a different lab than the producer, since blind spots correlate within a lab. The `advisor` is a complement and not a substitute: it sees your transcript, so it catches your own drift and momentum, but it inherits your framing, which is exactly what a fresh-context critic does not. They earn their keep on consequential design choices, recommendations, and hard-to-reverse decisions: the cases where plausible alternatives remain and the conclusion rests on judgment rather than on something you can verify directly. That is where confabulation hides, so budget the wait even under delivery pressure. Always consult one when the change touches auth, user input, database queries, crypto, or serialization. They do NOT pay for read-only tracing, ordinary repository lookup, or a conclusion that a focused test, a direct reproduction, or unambiguous code evidence already settles. Asking a critic to re-derive a proven fact returns a confident answer either way, which is ritual skepticism rather than review, and skipping them there is the right call and not a shortcut. Match the lens to the artifact: a strategic critic for plans and trade-offs, a code reviewer for a concrete diff, the coordinator only when the risk warrants several independent lenses. Give whichever you pick the artifact and the constraints and not your rationale, since justification anchors the review and dulls it.\n\nAim high. Default to radical simplicity and a relentless focus on the user's real experience: design for the person and the job to be done, not the demo. Reason about the whole system from first principles, anticipating scale and the long arc rather than patching the surface. Work backwards from the outcome the user actually needs. Question every assumption and prefer what you can derive, reproduce, or test.\n\nEngineering excellence. When making technical decisions, give little weight to development cost; prefer quality, simplicity, robustness, scalability, and long-term maintainability. Fix a bug by first reproducing it end to end, as close to how a real user hits it as you can, so you solve the real problem and not a symptom. When testing a product end to end, be picky about the UI and obsessed with pixel perfection: if something clearly looks off, even when it is unrelated to your task, get it fixed along the way. Hold that same bar for the codebase itself: a lint error, a failing test, or a flaky test is worth fixing the moment you see it, whoever introduced it. Fold it into your current work rather than letting it derail the task the user actually asked for.";
+/**
+* Condensed digest of OPERATING_DEFAULTS_DIRECTIVE for the spawned session's
+* system prompt (--append-system-prompt). The FULL directive is prepended to
+* the mirrored CLAUDE.md (read by the main agent and descendants); this digest
+* keeps both behavioral directives at top salience without duplicating the full
+* ~310-token block in the context window every turn. Points to the full copy.
+*
+* The unverifiable-claim rule is here rather than in CLAUDE.md alone because it
+* fires at a moment that suppresses lookups: an agent racing to deliver a
+* recommendation is precisely the one that will not stop to consult its project
+* instructions, which is how the check got crowded out in the first place. It
+* also closes a hole in the rule above it, which only covers claims that direct
+* evidence CAN settle. The roster of critics, the lens-to-artifact match, and
+* the reasoning stay in the directive; the always-resident copy carries only
+* the trigger and the ritual exclusion.
+*/
+const OPERATING_DEFAULTS_DIGEST = "## Operating defaults (the user's explicit direction and the domain's standards always override)\n\nDelegate when the work is WIDE (many files or sources to sweep) or SLOW and you need only the conclusion, to protect the main thread's finite context and keep it free for reasoning and interacting with the user; prefer parallel delegation for independent work. Do NOT delegate merely because a sub-question is separable: a narrow, deep question whose value is file:line fidelity loses exactly that through a summarization layer, and one answerable in a single command is cheaper done directly. Do trivial, surgical, and last-mile work yourself.\n\nVerify, do not assert. Run the code, read the file, check the exit code. A claim in prose is worth nothing against state you did not check, and a check that cannot fail proves nothing. Reproduce a bug end to end, the way a real user hits it, before fixing it. Fix a lint error, failing test, or flake the moment you see it, whoever introduced it, without letting it derail the task at hand. Prefer quality and long-term maintainability over development cost.\n\nVerification has a blind spot: a consequential recommendation, a design or trade-off call, or a hard-to-reverse decision that still turns on judgment among plausible alternatives once the direct evidence is in. That is where confabulation hides, so put it past a peer critic before you ship it and budget the wait even under delivery pressure. When a test, a run, a reproduction, or a search would settle the claim, settle it that way instead; a critic asked to re-derive what you can already prove is ritual, not review.\n\nThe agent roster, the tool surface, and the reasoning behind these defaults are in your CLAUDE.md project instructions. Read them when choosing HOW to work; the rules above apply without a lookup.";
+/**
+* Skip the helper if the user's `~/.claude/CLAUDE.md` (or, equivalently,
+* the would-be post-write file) has grown past this size.
+* Read-modify-write becomes pathological at very large sizes; CLAUDE.md
+* should never legitimately be a database. The main agent still gets
+* the awareness via `--append-system-prompt`, so skipping here only
+* loses descendant-reach.
+*/
+const MAX_CLAUDE_MD_BYTES = 1048576;
+/**
+* Bounded retry budget for the temp → rename step on Windows where
+* `fs.rename` can transiently fail with EBUSY / EPERM / EACCES when
+* CLAUDE.md is open in an editor, scanned by AV, or indexed by the
+* search service. Mirrors the verify-on-rename-fail pattern at
+* `paths.ts:795-818`. POSIX renames almost never fail this way; the
+* cost on Linux/macOS is one extra `lstat` in the unhappy path.
+*/
+const RENAME_RETRY_DELAYS_MS = [
+	50,
+	200,
+	500
+];
+/**
+* Grep-able error-code prefix. Every warn-and-continue path here
+* starts its message with this token so a Windows user who never sees
+* a fresh marker block in their mirror can `grep CLAUDE_MD_WRITE` in
+* the launcher output and land on the actionable line directly.
+*/
+const ERROR_CODE$1 = "CLAUDE_MD_WRITE";
+/**
+* Find every well-formed marker block matching the given `markerOpen`
+* + `markerClose` pair. A well-formed block is an exact `markerOpen`
+* line followed somewhere later (any number of intervening lines) by
+* an exact `markerClose` line, with no intervening `markerOpen`.
+* Multiple stale blocks all surface here so the caller can remove
+* all of them.
+*
+* Malformed state (open without close, or close without open) is
+* reported separately via the second return value so the caller can
+* `warn` and leave user prose untouched. We never try to "fix"
+* malformed marker state — that risks corrupting user content.
+*/
+function findMarkerBlocks(lines, markerOpen = PEER_MARKER_OPEN, markerClose = PEER_MARKER_CLOSE) {
+	const blocks = [];
+	let pendingOpen = null;
+	let malformed = false;
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		if (line === markerOpen) {
+			if (pendingOpen !== null) malformed = true;
+			pendingOpen = i;
+		} else if (line === markerClose) if (pendingOpen === null) malformed = true;
+		else {
+			blocks.push({
+				openLineIndex: pendingOpen,
+				closeLineIndex: i
+			});
+			pendingOpen = null;
+		}
+	}
+	if (pendingOpen !== null) malformed = true;
+	return {
+		blocks,
+		malformed
+	};
+}
+/**
+* Detect line-ending style of `content`. Returns `"\r\n"` if `\r\n`
+* sequences outnumber bare `\n`; otherwise `"\n"`. Empty content
+* defaults to `\n` (POSIX-style new file).
+*
+* Preserves CRLF on Windows users' existing CLAUDE.md — flipping their
+* line endings under them would be a regression even though Claude
+* Code itself reads either style.
+*/
+function detectLineEnding(content) {
+	if (content.length === 0) return "\n";
+	const crlf = (content.match(/\r\n/g) ?? []).length;
+	return crlf > (content.match(/\n/g) ?? []).length - crlf ? "\r\n" : "\n";
+}
+/**
+* Strip a leading UTF-8 BOM (`U+FEFF`) if present so the first line's
+* marker comparison is byte-exact. CLAUDE.md authored on Windows in
+* Notepad / VS Code sometimes carries a BOM; without this strip the
+* first marker line would never match (`<BOM><!--...` !== `<!--...`)
+* and successive launches would loop into malformed-state warn paths.
+*/
+function stripLeadingBom(content) {
+	return content.charCodeAt(0) === 65279 ? content.slice(1) : content;
+}
+/**
+* Split `content` into lines without losing the line-ending style.
+* The split is done on `\n`; trailing `\r` (from CRLF) is stripped
+* from each line for marker comparison, but the original ending is
+* reconstructed via `detectLineEnding` + `joinLines`.
+*/
+function splitLines(content) {
+	if (content.length === 0) return [];
+	return content.split("\n").map((l) => l.endsWith("\r") ? l.slice(0, -1) : l);
+}
+function joinLines(lines, eol) {
+	return lines.join(eol);
+}
+/**
+* Containment check that defeats symlink/junction tricks (peer-review
+* C3). `isUnderClaudeConfigMirror` is purely lexical via
+* `path.resolve()` — it does NOT dereference symlinks, so an attacker
+* (or an unfortunate `~/.claude` symlinked into Dropbox) could escape
+* the mirror while passing the lexical guard. This helper resolves
+* BOTH paths to their canonical form via `fs.realpath()` first.
+*
+* **Fail-closed semantics (advisor follow-up):**
+*
+*   - If the mirror root itself is a symlink (`lstat` reports
+*     `isSymbolicLink() === true`), refuse. A symlinked mirror root
+*     means writes flow through the link to whatever the user (or an
+*     attacker) targeted — the boundary's whole point is to never
+*     mutate real `~/.claude/`, so accepting any symlinked root
+*     undermines it.
+*   - If `realpath` fails on the mirror root OR the target parent,
+*     refuse. The mirror dir is provisioned by `ensureClaudeConfigMirror`
+*     before this helper runs (documented ordering invariant); a
+*     `realpath` failure here signals an unexpected state, and after
+*     the root check has already succeeded a missing parent means the
+*     root vanished between checks (TOCTOU race).
+*/
+async function isUnderClaudeConfigMirrorRealpath(target) {
+	if (!isUnderClaudeConfigMirror(target)) return false;
+	const mirrorRoot = PATHS.CLAUDE_CONFIG_DIR;
+	try {
+		if ((await fs.lstat(mirrorRoot)).isSymbolicLink()) {
+			consola.warn(`${ERROR_CODE$1}: mirror root is a symlink (${mirrorRoot}); refusing to write through it`);
+			return false;
+		}
+	} catch (err) {
+		consola.warn(`${ERROR_CODE$1}: cannot lstat mirror root ${mirrorRoot}: ${err instanceof Error ? err.message : String(err)}`);
+		return false;
+	}
+	let resolvedRoot;
+	try {
+		resolvedRoot = await fs.realpath(mirrorRoot);
+	} catch (err) {
+		consola.warn(`${ERROR_CODE$1}: realpath failed on mirror root ${mirrorRoot}: ${err instanceof Error ? err.message : String(err)}`);
+		return false;
+	}
+	const targetParent = path.dirname(target);
+	let resolvedTargetParent;
+	try {
+		resolvedTargetParent = await fs.realpath(targetParent);
+	} catch (err) {
+		consola.warn(`${ERROR_CODE$1}: realpath failed on target parent ${targetParent} after root check (TOCTOU?): ${err instanceof Error ? err.message : String(err)}`);
+		return false;
+	}
+	if (resolvedTargetParent === resolvedRoot) return true;
+	return resolvedTargetParent.startsWith(resolvedRoot + path.sep);
+}
+/**
+* Try `fs.rename(temp, target)` with bounded retry + verify-on-fail.
+* Mirrors `injectSyntheticClaudeJsonFields` in `paths.ts`. Windows
+* `fs.rename` can transiently fail with EBUSY / EPERM / EACCES when
+* the destination is held by another process (editor, AV, search
+* indexer). Returns `true` on eventual success, `false` after all
+* retries are exhausted (caller will warn-and-continue).
+*
+* On final failure we read the destination back and check whether it
+* already matches `desiredContent` — a concurrent racer may have
+* landed the same bytes (the snippet is deterministic per launch).
+* In that case treat as success.
+*
+* **No `copyFile` fallback** (peer-review codex-critic C2). `fs.copyFile`
+* follows the destination path — if `target` was replaced with a
+* symlink/junction between our earlier `lstat` and now (TOCTOU), or
+* if `target` is a hardlink to the real `~/.claude/CLAUDE.md`,
+* `copyFile` would mutate user files through the link. The boundary
+* we are defending says "never mutate the real `~/.claude/`". Rename
+* is safe because replacing a path entry doesn't follow the link; the
+* `copyFile` degradation reintroduces the escape. Fail-closed instead.
+*/
+async function renameWithRetry(tempPath, target, desiredContent) {
+	let lastErr;
+	for (let attempt = 0; attempt <= RENAME_RETRY_DELAYS_MS.length; attempt++) try {
+		await fs.rename(tempPath, target);
+		return true;
+	} catch (err) {
+		lastErr = err;
+		if (attempt < RENAME_RETRY_DELAYS_MS.length) await new Promise((resolve) => setTimeout(resolve, RENAME_RETRY_DELAYS_MS[attempt]));
+	}
+	try {
+		if (await fs.readFile(target, "utf8") === desiredContent) {
+			await fs.unlink(tempPath).catch(() => {});
+			consola.debug(`${ERROR_CODE$1}: rename failed but target already holds expected content (racer-won-race): ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+			return true;
+		}
+	} catch {}
+	await fs.unlink(tempPath).catch(() => {});
+	consola.warn(`${ERROR_CODE$1}: rename failed for ${target} after ${RENAME_RETRY_DELAYS_MS.length + 1} attempts (no copyFile fallback to avoid symlink/hardlink escape; descendant-reach via CLAUDE.md disabled this launch; main agent still has --append-system-prompt). rename err: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+	return false;
+}
+async function injectMarkerBlock(opts) {
+	const { snippet, markerOpen, markerClose, position, label } = opts;
+	if (snippet.includes(markerOpen) || snippet.includes(markerClose)) {
+		consola.warn(`${ERROR_CODE$1}: refusing to inject ${label} snippet that contains marker literal; this would corrupt idempotency on the next launch`);
+		return;
+	}
+	const target = path.join(PATHS.CLAUDE_CONFIG_DIR, "CLAUDE.md");
+	if (!await isUnderClaudeConfigMirrorRealpath(target)) {
+		consola.warn(`${ERROR_CODE$1}: refusing to write outside resolved mirror dir (target=${target}, mirror=${PATHS.CLAUDE_CONFIG_DIR}) [${label}]`);
+		return;
+	}
+	let existingContent;
+	let targetExists;
+	try {
+		const linkStat = await fs.lstat(target);
+		if (linkStat.isSymbolicLink()) {
+			consola.warn(`${ERROR_CODE$1}: refusing to write through symlinked CLAUDE.md (target=${target}) [${label}]`);
+			return;
+		}
+		if (!linkStat.isFile()) {
+			consola.warn(`${ERROR_CODE$1}: refusing to write non-regular target (target=${target}, mode=${linkStat.mode.toString(8)}) [${label}]`);
+			return;
+		}
+		if (linkStat.size > MAX_CLAUDE_MD_BYTES) {
+			consola.warn(`${ERROR_CODE$1}: skipping oversized CLAUDE.md (${linkStat.size} bytes > ${MAX_CLAUDE_MD_BYTES}) [${label}]; descendant-reach disabled this launch`);
+			return;
+		}
+		if (linkStat.nlink > 1) {
+			consola.warn(`${ERROR_CODE$1}: refusing to write to hardlinked CLAUDE.md (nlink=${linkStat.nlink}) [${label}]; would mutate shared inode`);
+			return;
+		}
+		targetExists = true;
+		existingContent = await fs.readFile(target, "utf8");
+	} catch (err) {
+		if (typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT") {
+			existingContent = "";
+			targetExists = false;
+		} else {
+			consola.warn(`${ERROR_CODE$1}: failed to stat/read target (${target}) [${label}]: ${err instanceof Error ? err.message : String(err)}`);
+			return;
+		}
+	}
+	const hadBom = existingContent.charCodeAt(0) === 65279;
+	const normalizedContent = stripLeadingBom(existingContent);
+	const eol = detectLineEnding(normalizedContent);
+	const lines = splitLines(normalizedContent);
+	const { blocks, malformed } = findMarkerBlocks(lines, markerOpen, markerClose);
+	if (malformed) {
+		consola.warn(`${ERROR_CODE$1}: malformed marker state in ${target} (open without close or vice versa) [${label}]; leaving file untouched`);
+		return;
+	}
+	const cleanedLines = [...lines];
+	for (let i = blocks.length - 1; i >= 0; i--) {
+		const block = blocks[i];
+		cleanedLines.splice(block.openLineIndex, block.closeLineIndex - block.openLineIndex + 1);
+		if (position === "bottom") while (block.openLineIndex - 1 >= 0 && cleanedLines[block.openLineIndex - 1] === "" && cleanedLines.slice(0, block.openLineIndex - 1).some((l) => l !== "")) cleanedLines.splice(block.openLineIndex - 1, 1);
+		else while (block.openLineIndex < cleanedLines.length && cleanedLines[block.openLineIndex] === "" && cleanedLines.slice(block.openLineIndex + 1).some((l) => l !== "")) cleanedLines.splice(block.openLineIndex, 1);
+	}
+	if (position === "bottom") while (cleanedLines.length > 0 && cleanedLines[cleanedLines.length - 1] === "") cleanedLines.pop();
+	else while (cleanedLines.length > 0 && cleanedLines[0] === "") cleanedLines.shift();
+	const markerBlockLines = [
+		markerOpen,
+		...snippet.split("\n").map((l) => l.endsWith("\r") ? l.slice(0, -1) : l),
+		markerClose
+	];
+	let finalLines;
+	if (cleanedLines.length === 0) finalLines = [...markerBlockLines, ""];
+	else if (position === "bottom") finalLines = [
+		...cleanedLines,
+		"",
+		...markerBlockLines,
+		""
+	];
+	else finalLines = [
+		...markerBlockLines,
+		"",
+		...cleanedLines,
+		""
+	];
+	const bodyContent = joinLines(finalLines, eol);
+	const finalContent = hadBom ? "" + bodyContent : bodyContent;
+	if (Buffer.byteLength(finalContent, "utf8") > MAX_CLAUDE_MD_BYTES) {
+		consola.warn(`${ERROR_CODE$1}: post-build content exceeds ${MAX_CLAUDE_MD_BYTES} bytes [${label}]; skipping update (descendant-reach disabled this launch)`);
+		return;
+	}
+	const tempPath = `${target}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+	try {
+		await fs.writeFile(tempPath, finalContent, {
+			encoding: "utf8",
+			flag: "wx"
+		});
+	} catch (err) {
+		await fs.unlink(tempPath).catch(() => {});
+		consola.warn(`${ERROR_CODE$1}: temp-file write failed for ${tempPath} [${label}]: ${err instanceof Error ? err.message : String(err)}`);
+		return;
+	}
+	if (!await renameWithRetry(tempPath, target, finalContent)) return;
+	consola.debug(`${ERROR_CODE$1}: ${targetExists ? "updated" : "created"} ${target} [${label}] (${finalContent.length} bytes, eol=${eol === "\r\n" ? "CRLF" : "LF"})`);
+}
+/**
+* Append the peer-MCP awareness `snippet` to the mirrored
+* `<CLAUDE_CONFIG_DIR>/CLAUDE.md`. Idempotent across launches: prior
+* well-formed peer-marker blocks are removed before appending a fresh
+* one at the bottom. The original user content is preserved
+* byte-for-byte at the top (modulo line-ending normalization to the
+* file's detected style; leading UTF-8 BOM is preserved).
+*
+* Failures `warn` and return — this surface is the descendant-reach
+* enhancement; the main agent still gets the awareness via
+* `--append-system-prompt`. Every warn message starts with
+* `CLAUDE_MD_WRITE` so users can grep launcher output.
+*/
+async function appendPeerAwarenessToMirroredClaudeMd(snippet) {
+	await injectMarkerBlock({
+		snippet,
+		markerOpen: PEER_MARKER_OPEN,
+		markerClose: PEER_MARKER_CLOSE,
+		position: "bottom",
+		label: "peer-mcp-awareness"
+	});
+}
+/**
+* Prepend a writing / communication style directive to the TOP of the
+* mirrored `<CLAUDE_CONFIG_DIR>/CLAUDE.md` so every spawned agent
+* reads it first. The directive itself is hard-coded to
+* `STYLE_DIRECTIVE` above; the parameter exists for tests / future
+* configurability. Idempotent across launches via the
+* style-marker fence (separate from the peer-awareness fence, so the
+* two blocks coexist without colliding).
+*/
+async function prependStyleDirectiveToMirroredClaudeMd(directive = STYLE_DIRECTIVE) {
+	await injectMarkerBlock({
+		snippet: directive,
+		markerOpen: STYLE_MARKER_OPEN,
+		markerClose: STYLE_MARKER_CLOSE,
+		position: "top",
+		label: "style-directive"
+	});
+}
+/**
+* Prepend the operating-defaults directive (orchestrator posture + hybrid
+* excellence lens; `OPERATING_DEFAULTS_DIRECTIVE` above) to the TOP of the
+* mirrored CLAUDE.md so the main agent and descendant agents (Agent subagents,
+* agent-teams teammates) inherit the full statement. The main agent also gets
+* OPERATING_DEFAULTS_DIGEST at higher salience via `--append-system-prompt`.
+* Separate marker fence from the style / peer blocks so all coexist;
+* best-effort (warn-and-continue) like its siblings.
+*/
+async function prependOperatingDefaultsToMirroredClaudeMd(directive = OPERATING_DEFAULTS_DIRECTIVE) {
+	await injectMarkerBlock({
+		snippet: directive,
+		markerOpen: OPERATING_MARKER_OPEN,
+		markerClose: OPERATING_MARKER_CLOSE,
+		position: "top",
+		label: "operating-defaults"
+	});
+}
+/**
+* Append the toolbelt awareness one-liner (which CLI tools are on PATH)
+* to the bottom of the mirrored CLAUDE.md so descendant agents (Agent
+* subagents, agent-teams teammates) and the main agent learn about the
+* provisioned tools via the mirrored CLAUDE.md. This line is not sent via
+* `--append-system-prompt`.
+* Separate marker fence from the peer-awareness / style blocks.
+*/
+async function appendToolbeltAwarenessToMirroredClaudeMd(snippet) {
+	await injectMarkerBlock({
+		snippet,
+		markerOpen: TOOLBELT_MARKER_OPEN,
+		markerClose: TOOLBELT_MARKER_CLOSE,
+		position: "bottom",
+		label: "toolbelt-awareness"
+	});
+}
+/**
+* Prepend the artifact-panel review directive to the TOP of the mirrored
+* CLAUDE.md so plans/artifacts are reviewed in the ai-or-die panel by default.
+* Gated by the caller on AIORDIE_SESSION_ID (only useful inside a tab). Separate
+* marker fence; best-effort like the style/peer blocks.
+*/
+async function prependArtifactPanelDirectiveToMirroredClaudeMd(peersKey = "peers") {
+	await injectMarkerBlock({
+		snippet: ARTIFACT_PANEL_DIRECTIVE(peersKey),
+		markerOpen: ARTIFACT_MARKER_OPEN,
+		markerClose: ARTIFACT_MARKER_CLOSE,
+		position: "top",
+		label: "artifact-panel-directive"
+	});
+}
+//#endregion
+//#region src/lib/injected-skills/write.ts
+/**
+* Writer for injected skills: materializes a `SKILL.md` into the per-launch
+* `CLAUDE_CONFIG_DIR` mirror so the spawned Claude Code session discovers it as a
+* user-scope skill (`<CLAUDE_CONFIG_DIR>/skills/<name>/SKILL.md`, where the folder
+* name MUST equal the frontmatter `name` — the loader enforces this).
+*
+* Safety mirrors `claude-md-injection.ts`:
+*   - mirror-only write guard (symlink-resolving) so we never touch the user's
+*     real `~/.claude/skills/`;
+*   - ATOMIC temp+rename so a concurrent child process can never read a
+*     half-written `SKILL.md` (Claude Code watches the skills dir);
+*   - warn-and-continue on every failure — an injected skill is an enhancement,
+*     never a launch blocker.
+*
+* No per-skill stale sweep is needed: the whole per-launch mirror dir is GC'd by
+* `removeOwnClaudeConfigMirror` / `sweepStaleClaudeConfigMirrors`.
+*/
+/** Grep-able prefix on every warn path (mirrors the CLAUDE_MD_WRITE convention). */
+const ERROR_CODE = "INJECTED_SKILL_WRITE";
+/**
+* Strict skill-name allowlist. Lowercase kebab so the folder name is a safe path
+* segment AND a valid Claude Code skill `name` (loader asserts folder == name).
+* All our injected skills (`gh-research`, `gh-orchestrate`, `gh-floor-keeper`,
+* `gh-first-mate`) pass.
+*/
+const VALID_SKILL_NAME = /^[a-z][a-z0-9-]*$/;
+/**
+* Write `md` to `<CLAUDE_CONFIG_DIR>/skills/<name>/SKILL.md`. `md` must already be
+* a complete `SKILL.md` (YAML frontmatter with `name: <name>` + `description`,
+* then the body). Idempotent across launches (overwrite); the per-launch mirror
+* dir is disposable.
+*/
+async function writeInjectedSkill(name, md) {
+	if (!VALID_SKILL_NAME.test(name)) {
+		consola.warn(`${ERROR_CODE}: invalid skill name "${name}" (need lowercase kebab); skipping`);
+		return { written: false };
+	}
+	const dir = path.join(PATHS.CLAUDE_CONFIG_DIR, "skills", name);
+	const target = path.join(dir, "SKILL.md");
+	try {
+		await fs.mkdir(dir, { recursive: true });
+	} catch (err) {
+		consola.warn(`${ERROR_CODE}: mkdir failed for ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+		return { written: false };
+	}
+	if (!await isUnderClaudeConfigMirrorRealpath(target)) {
+		consola.warn(`${ERROR_CODE}: refusing to write outside the resolved mirror dir (target=${target}, mirror=${PATHS.CLAUDE_CONFIG_DIR})`);
+		return { written: false };
+	}
+	const tempPath = `${target}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+	try {
+		await fs.writeFile(tempPath, md, {
+			encoding: "utf8",
+			flag: "wx"
+		});
+	} catch (err) {
+		await fs.unlink(tempPath).catch(() => {});
+		consola.warn(`${ERROR_CODE}: temp-file write failed for ${tempPath}: ${err instanceof Error ? err.message : String(err)}`);
+		return { written: false };
+	}
+	if (!await renameWithRetry(tempPath, target, md)) return { written: false };
+	consola.debug(`${ERROR_CODE}: wrote ${target} (${md.length} bytes)`);
+	return {
+		written: true,
+		path: target
+	};
+}
+//#endregion
+//#region src/lib/injected-skills/index.ts
+/**
+* Injected-skill registry: the floor-raising / controller skills the `claude`
+* launcher materializes into the per-launch `CLAUDE_CONFIG_DIR` mirror so the
+* spawned Claude Code session discovers them (`/gh-research`,
+* `/gh-orchestrate`, `/gh-floor-keeper`, `/gh-first-mate`). See
+* `docs/floor-raising-agent-surface.md`.
+*/
+/** All injected skills, in dependency order (research underpins the others). */
+const INJECTED_SKILLS = [
+	RESEARCH_SKILL,
+	ORCHESTRATE_SKILL,
+	FLOOR_KEEPER_SKILL,
+	WORKER_SKILL,
+	FIRST_MATE_SKILL,
+	FIRST_MATE_SETUP_SKILL,
+	FIRST_MATE_OPERATE_SKILL,
+	FIRST_MATE_CONDUCT_SKILL
+];
+//#endregion
+//#region src/lib/attribution-settings.ts
+/**
+* Deterministic backstop for the injected "no attribution" style directive.
+*
+* github-router injects a CLAUDE.md style directive telling the agent not to
+* attribute work to Claude / AI / Anthropic. That directive is ADVISORY (prose
+* the model may or may not follow). Claude Code also exposes a HARNESS-ENFORCED
+* control that suppresses attribution at the source: the `attribution`
+* settings.json key (Claude Code v2.0.62+; string `commit` / `pr` sub-fields),
+* which supersedes the deprecated boolean `includeCoAuthoredBy`. Setting both
+* sub-fields to the empty string removes the "Generated with Claude Code"
+* commit footer and the "Co-Authored-By: Claude" byline from commits and PRs.
+* Because the harness reads and applies this itself, it holds even when the
+* model ignores the prose directive — a deterministic backstop, not a second
+* suggestion.
+*
+* PRESENCE-GUARDED. If the mirrored settings already carry `attribution` OR
+* `includeCoAuthoredBy`, the user expressed a deliberate preference in their
+* real config (which the one-way mirror snapshotted); we DO NOT override it.
+* Only a user who has expressed no preference receives github-router's
+* no-attribution default. This keeps faith with "the user's explicit direction
+* always overrides".
+*
+* The mirror is a per-launch snapshot of the user's real `~/.claude` config, so
+* this write never propagates back to the user's own settings.json. A
+* project-scope `<repo>/.claude/settings.json` still overrides the mirror
+* (global scope) at runtime, so the default remains overridable per-repo.
+*
+* Failure model matches the sibling settings writers: a transient read error
+* or a non-object settings.json throws (never clobber a file we don't
+* understand); the caller wraps this in warn-and-continue so a settings-write
+* hiccup never blocks launch.
+*/
+async function injectAttributionSuppressionIntoSettingsFile(settingsPath) {
+	let existing = {};
+	let raw;
+	try {
+		raw = await fs.readFile(settingsPath, "utf8");
+	} catch (err) {
+		if (err.code !== "ENOENT") throw err;
+		raw = void 0;
+	}
+	if (raw !== void 0) {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) existing = parsed;
+		else throw new Error(`settings.json at ${settingsPath} is not a JSON object; refusing to overwrite`);
+	}
+	if ("attribution" in existing || "includeCoAuthoredBy" in existing) return {
+		written: false,
+		reason: "user-set"
+	};
+	const merged = {
+		...existing,
+		attribution: {
+			commit: "",
+			pr: ""
+		}
+	};
+	const tmp = `${settingsPath}.${process.pid}.attr.tmp`;
+	await fs.writeFile(tmp, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+	await fs.rename(tmp, settingsPath);
+	return { written: true };
+}
+//#endregion
+export { injectPeerMcpIntoMirror as _, OPERATING_DEFAULTS_DIRECTIVE as a, workersKeyOf as b, prependArtifactPanelDirectiveToMirroredClaudeMd as c, SEAMLESS_BUILTIN_TOOLS as d, configureServeDefaultPermissionMode as f, BUILTIN_SUBAGENT_DEFINITIONS as g, sanitizeServeSettingsEnv as h, OPERATING_DEFAULTS_DIGEST as i, prependOperatingDefaultsToMirroredClaudeMd as l, planModeAllowRules as m, INJECTED_SKILLS as n, appendPeerAwarenessToMirroredClaudeMd as o, injectAllowRules as p, writeInjectedSkill as r, appendToolbeltAwarenessToMirroredClaudeMd as s, injectAttributionSuppressionIntoSettingsFile as t, prependStyleDirectiveToMirroredClaudeMd as u, resolveCodexCliBackend as v, writePeerMcpRuntimeFiles as x, resolveGroupKeysFromMirror as y };
+
+//# sourceMappingURL=attribution-settings-CegtE0TY.js.map