mixdog 0.9.102 → 0.9.104

package/README.md

@@ -4,6 +4,14 @@
 ![node](https://img.shields.io/badge/node-%3E%3D22-brightgreen)
 ![license](https://img.shields.io/badge/license-MIT-blue)
 
+**Mixdog Desktop:** [Download for Windows (x64)](https://github.com/tribgames/mixdog/releases/latest/download/mixdog-desktop-win-x64.exe)
+· [macOS / Linux preview builds](https://github.com/tribgames/mixdog/releases/latest)
+
+Windows is the primary manually tested desktop platform. macOS and Linux
+packages are built on native CI runners and pass packaged-runtime smoke tests,
+but remain preview builds. Desktop packages are currently unsigned, so Windows
+SmartScreen or macOS Gatekeeper may show a security warning.
+
 Standalone coding agent that runs an orchestrated, multi-provider agent
 workflow from one terminal — or from a full desktop workbench — built to
 get the same quality out of the same models with less time, cost, and
@@ -118,9 +126,9 @@ every number above live under `benchmarks/terminal-bench-2.1/`.
 
 - Skills, MCP servers, hooks, and plugins load through standard-compatible
   interfaces.
-- Workflow delegation through the `agent` tool and `/agents`: worker,
-  heavy-worker, reviewer, debugger, maintainer, explorer, and
-  web-researcher roles.
+- Built-in Web Search, Explorer, and Maintainer services, plus editable
+  starter agents (`worker`, `heavy-worker`, `reviewer`) and user-authored
+  custom roles.
 
 ## Run
 
@@ -160,8 +168,8 @@ mixdog --provider anthropic-oauth --model claude-opus-5 worker "fix the failing
 mixdog --provider openai-oauth --model gpt-5.6-sol reviewer "review the current diff"
 ```
 
-Roles: `explore`, `worker`, `heavy-worker`, `reviewer`, `debugger`,
-`maintainer`, `web-researcher`.
+Roles: `explore`, `worker`, `heavy-worker`, `reviewer`, `maintainer`,
+`web-researcher`.
 
 ## TUI basics
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.102",
+  "version": "0.9.104",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -112,7 +112,7 @@
     "test:workflow-editor": "node --test scripts/workflow-id-test.mjs scripts/workflow-pack-editor-test.mjs",
     "test:route-scope": "node --test scripts/route-scope-isolation-test.mjs",
     "test:schedule-reload": "node --test scripts/schedule-reload-arm-test.mjs",
-    "test:media": "node --test src/runtime/media/store.test.mjs src/runtime/media/renditions.test.mjs",
+    "test:media": "node --test src/runtime/media/store.test.mjs src/runtime/media/renditions.test.mjs src/runtime/media/adapters/codex-image.test.mjs",
     "test:shell-harness": "node --test scripts/shell-harness-regression-test.mjs",
     "failures": "node scripts/tool-failures.mjs",
     "trace:llm": "node scripts/llm-trace-summary.mjs",

package/scripts/code-graph-description-contract.mjs

@@ -69,7 +69,7 @@ const CODE_GRAPH_DESCRIPTION_MUTATION_CORPUS = [
     name: 'contracted negated file assignment',
     mutate: (parts) => ({
       ...parts,
-      description: parts.description.replace(/file modes take files\[\]/i, "file modes aren't assigned files[]"),
+      description: parts.description.replace(/file modes (?:take|use) files\[\]/i, "file modes aren't assigned files[]"),
     }),
   },
   {

package/src/defaults/agents.json

@@ -59,34 +59,6 @@
       "kind": "maintenance",
       "permission": "read",
       "stallCap": { "idleSeconds": 90, "toolRunningSeconds": 90 }
-    },
-    {
-      "agent": "scheduler-task",
-      "slot": "scheduler",
-      "systemFile": "agents/scheduler-task/AGENT.md",
-      "description": "Scheduled-task executor invoked by scheduler tick",
-      "invokedBy": "scheduler",
-      "toolSchemaProfile": "read-write-search",
-      "schemaAllowedTools": ["code_graph", "find", "glob", "list", "grep", "read", "apply_patch", "search", "web_fetch"],
-      "kind": "maintenance",
-      "permission": "read-write",
-      "inboundEvent": true,
-      "instructionDir": "schedules",
-      "stallCap": { "idleSeconds": 600, "toolRunningSeconds": 600 }
-    },
-    {
-      "agent": "webhook-handler",
-      "slot": "webhook",
-      "systemFile": "agents/webhook-handler/AGENT.md",
-      "description": "Webhook payload handler invoked by inbound webhook events",
-      "invokedBy": "webhook",
-      "toolSchemaProfile": "read-write-search",
-      "schemaAllowedTools": ["code_graph", "find", "glob", "list", "grep", "read", "apply_patch", "search", "web_fetch"],
-      "kind": "maintenance",
-      "permission": "read-write",
-      "inboundEvent": true,
-      "instructionDir": "webhooks",
-      "stallCap": { "idleSeconds": 600, "toolRunningSeconds": 600 }
     }
   ]
 }

package/src/defaults/skills/setup/SKILL.md

@@ -72,13 +72,13 @@ apply it, and verify the result.
 
 ### Workflow / agent definitions
 
-1. Workflows and agents are Markdown packs. Built-ins ship with mixdog
-   (workflows `default`, `solo`; agents worker, heavy-worker, reviewer,
-   debugger, maintainer); custom packs live at
+1. Workflows and agents are Markdown packs. Built-in services are Web Search,
+   Explore, and Maintainer. Mixdog ships editable starter agents `worker`,
+   `heavy-worker`, and `reviewer`; custom packs live at
    `<mixdogData>/workflows/<id>/WORKFLOW.md` and
    `<mixdogData>/agents/<id>/AGENT.md`.
-2. Saving a built-in id writes a user override; deleting the override
-   reverts to the built-in.
+2. Starter and user-authored agents can be edited or deleted. Built-in service
+   definitions stay protected while their model routes remain configurable.
 3. The desktop app (Workflows page) is the full editor. The TUI only
    switches the active workflow (`/workflow`) and per-agent model routes
    (`/agents`).

package/src/headless-command.mjs

@@ -9,7 +9,6 @@ const HEADLESS_ROLE_ALIASES = new Map([
   ['worker', 'worker'],
   ['heavy', 'heavy-worker'], ['heavyworker', 'heavy-worker'], ['heavy-worker', 'heavy-worker'],
   ['review', 'reviewer'], ['reviewer', 'reviewer'],
-  ['debug', 'debugger'], ['debugger', 'debugger'],
   ['web', 'web-researcher'], ['web-researcher', 'web-researcher'],
 ]);
 const HEADLESS_WORKFLOW_ERROR = 'option --workflow is not supported for headless role commands';

package/src/help.mjs

@@ -21,7 +21,7 @@ export const HELP_LINES = [
   '',
   'Headless role commands require an explicit provider/model pair and run with',
   'ephemeral config/data; host behavioral config and personal state are not loaded.',
-  'Roles: explore, worker, heavy-worker, reviewer, debugger, maintainer, web-researcher.',
+  'Roles: explore, worker, heavy-worker, reviewer, maintainer, web-researcher.',
   '',
   'Slash commands (inside mixdog):',
   '  /clear                        start a fresh chat (alias: /new)',

package/src/lib/rules-builder.cjs

@@ -9,7 +9,6 @@
  *   - buildAgentRoleContent             — BP2: agent role/system rules
  *   - buildAgentRetrievalInjectionContent — BP2: narrow read-only retrieval role
  *   - buildLeadMetaContent              — BP3: Lead memory/meta context
- *   - buildAgentRoleSpecificContent     — BP4-adjacent user/task data
  *   - buildInjectionContent             — legacy joined Lead session content
  *
  * 4-BP cache layout (composeSystemPrompt):
@@ -21,7 +20,7 @@
  * Source files (rules/):
  *   - shared/01-tool.md              — universal tool policy (Lead + agent BP1, identical full set)
  *   - lead/lead-tool.md             — Lead-specific control-tower / delegation / ToolSearch guidance
- *   - lead/lead-brief.md            — Lead brief contract (skipped in solo workflow)
+ *   - lead/lead-brief.md            — Lead brief contract (delegating workflows only)
  *   - lead/01-general.md             — Lead general
  *   - output-styles/<name>.md        — Lead output style, selected by config outputStyle
  *   - agent/00-core.md               — universal agent constraints (BP2, all profiles)
@@ -132,9 +131,8 @@ function buildProfilePreferencesContent(dataDir) {
     lines.push(`- User title: ${profile.title}.`);
     lines.push(`- Use "${profile.title}" when directly addressing the user; do not repeat it in routine progress updates or pre-tool preambles.`);
   }
-  // Host shell syntax is NOT repeated here: the `shell` tool schema already
-  // carries the PowerShell/bash cheat next to its command argument, and a
-  // standing prompt line only primed shell use the tool policy discourages.
+  const shell = process.platform === 'win32' ? 'PowerShell' : 'Bash';
+  lines.push(`- Shell: ${shell}. Use ${shell} syntax unless the user specifies otherwise.`);
   return lines.length ? `# Profile Preferences\n\n${lines.join('\n')}` : '';
 }
 
@@ -146,8 +144,8 @@ function buildLanguageSection(dataDir) {
     ? ` from system locale ${language.locale}`
     : '';
   const lines = [
-    `- Default user-facing response language${source}: ${language.prompt}. Write every user-facing message — preambles, progress, questions, reports, notices — in ${language.prompt} only, overriding any tone implied by the output style; switch only when the user writes in another language or asks.`,
-    `- Code identifiers, paths, commands, symbols, API names, and exact errors should remain in their original form.`,
+    `- Default user-facing language${source}: ${language.prompt}. Use it for all user-facing text (preambles, progress, questions, reports, notices), overriding output style; switch only when the user does or asks.`,
+    `- Keep code identifiers, paths, commands, symbols, API names, and exact errors in original form.`,
   ];
   return `# Language\n\n${lines.join('\n')}`;
 }
@@ -186,67 +184,12 @@ function loadOutputStyle({ PLUGIN_ROOT, DATA_DIR }) {
   return '';
 }
 
-/**
- * Resolve the DATA_DIR subdir whose *.md instruction tree is sent as
- * BP4-adjacent user/task data, from the agent's `instructionDir` metadata in
- * defaults/agents.json. Returns null when the agent declares none.
- *
- * Mirrors internal-agents.mjs getAgentInstructionDir — rules-builder is CommonJS
- * and cannot import the ESM module, so it reads the same source of truth
- * directly. Keeps the webhook-handler→webhooks / scheduler-task→schedules
- * mapping declarative instead of a hard-coded agent-name ternary.
- *
- * @param {string} mixdogRoot
- * @param {string} agent
- * @returns {string|null}
- */
-function resolveAgentInstructionDir(mixdogRoot, agent) {
-  if (!mixdogRoot || !agent) return null;
-  const metaPath = path.join(mixdogRoot, 'defaults', 'agents.json');
-  let raw;
-  try {
-    raw = JSON.parse(fs.readFileSync(metaPath, 'utf8'));
-  } catch (e) {
-    throw new Error(`[rules-builder] failed to read/parse agents.json at ${metaPath}: ${e.message}`);
-  }
-  for (const entry of (raw.agents || [])) {
-    if (entry && entry.agent === agent) {
-      const dir = typeof entry.instructionDir === 'string' ? entry.instructionDir.trim() : '';
-      return dir || null;
-    }
-  }
-  return null;
-}
-
-/**
- * Recursively collect all `.md` files under `dir`. Returns absolute paths
- * in stack-DFS order (callers sort before use). Missing/unreadable `dir`
- * yields an empty array — matches the previous inline `try {} catch {}`
- * behavior at every call site.
- */
-function collectMarkdownFilesRecursive(dir) {
-  const collected = [];
-  try {
-    const stack = [dir];
-    while (stack.length) {
-      const current = stack.pop();
-      const entries = fs.readdirSync(current, { withFileTypes: true });
-      for (const entry of entries) {
-        const full = path.join(current, entry.name);
-        if (entry.isDirectory()) stack.push(full);
-        else if (entry.isFile() && entry.name.endsWith('.md')) collected.push(full);
-      }
-    }
-  } catch {}
-  return collected;
-}
-
 function buildSharedToolContent({ PLUGIN_ROOT }) {
   const SHARED_DIR = path.join(PLUGIN_ROOT, 'rules', 'shared');
   return readOptional(path.join(SHARED_DIR, '01-tool.md'));
 }
 
-function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR }) {
+function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR, includeLeadBrief = true }) {
   const RULES_DIR = path.join(PLUGIN_ROOT, 'rules');
   const LEAD_DIR = path.join(RULES_DIR, 'lead');
   const general = readOptional(path.join(LEAD_DIR, '01-general.md'));
@@ -255,15 +198,7 @@ function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR }) {
   const toolLead = readOptional(path.join(LEAD_DIR, 'lead-tool.md'));
   if (toolLead) parts.push(toolLead);
 
-  // Solo workflow forbids delegation, so the agent-brief contract is dead
-  // weight there. Cache safety: lead rules cache keys on mixdog-config.json
-  // mtime, so switching workflow rebuilds this block.
-  const workflowActive = String(
-    (readConfigSection(DATA_DIR, 'agent').workflow || {}).active
-      || readConfigSection(DATA_DIR, 'workflow').active
-      || 'default',
-  ).trim().toLowerCase();
-  if (workflowActive !== 'solo') {
+  if (includeLeadBrief) {
     const briefLead = readOptional(path.join(LEAD_DIR, 'lead-brief.md'));
     if (briefLead) parts.push(briefLead);
   }
@@ -365,45 +300,6 @@ function buildAgentRetrievalInjectionContent({ PLUGIN_ROOT }) {
   return parts.join('\n');
 }
 
-/**
- * BP4-adjacent role-specific data. Only the calling role's own task / tool
- * detail body emits — webhook-handler gets webhooks/<all-events>/ and
- * scheduler gets schedules/<all-tasks>/. Other roles return ''.
- *
- * NOTE: webhook-event narrowing (one event per call) requires the inbound
- * payload's event id at compose time; not implemented yet, so all webhook
- * instruction files still ride with the webhook-handler user/task context.
- *
- * @param {object} opts
- * @param {string} opts.PLUGIN_ROOT
- * @param {string} opts.DATA_DIR
- * @param {string|null} opts.currentAgent
- * @returns {string}
- */
-function buildAgentRoleSpecificContent({ PLUGIN_ROOT, DATA_DIR, currentAgent }) {
-  if (!currentAgent) return '';
-  const parts = [];
-
-  // The agent's instruction subdir (webhook-handler → webhooks, scheduler-task
-  // → schedules) is declared via `instructionDir` in defaults/agents.json
-  // rather than hard-coded here, so adding a new inbound-event agent needs only
-  // a metadata entry.
-  const subdirForAgent = resolveAgentInstructionDir(PLUGIN_ROOT, currentAgent);
-  if (subdirForAgent) {
-    const dir = path.join(DATA_DIR, subdirForAgent);
-    const collected = collectMarkdownFilesRecursive(dir);
-    if (collected.length > 0) {
-      collected.sort();
-      const blocks = collected.map(f => stripFrontmatter(readOptional(f))).filter(Boolean);
-      if (blocks.length > 0) {
-        parts.push([`# Agent ${subdirForAgent}`, '', blocks.join('\n\n')].join('\n'));
-      }
-    }
-  }
-
-  return parts.join('\n\n');
-}
-
 module.exports = {
   buildSharedToolContent,
   buildLeadRoleContent,
@@ -412,5 +308,4 @@ module.exports = {
   buildInjectionContent,
   buildAgentInjectionContent,
   buildAgentRetrievalInjectionContent,
-  buildAgentRoleSpecificContent,
 };

package/src/output-styles/detailed.md

@@ -8,18 +8,14 @@ keep-coding-instructions: true
 
 # Output Style
 
-Detailed — the fullest style, still summary-form: depth comes from picking the
-right facts, not from explaining more.
+Detailed — dense facts, complete handoff.
 
-- Lead with the outcome in one short sentence, then only the detail that
-  matters: what changed, paths, commands, errors. Conclusions, not reasoning;
-  cite a symbol/path only as an anchor.
-- ~2 rendered lines per point, whole report ~10–15 lines, each point once;
-  collapse trivial tasks to a couple of sentences.
-- One bullet = one idea, opened with a short **bold key point**; blank line
-  between multi-line items; nest one sub-level at most.
-- Labels like `Changes` or `Risks / next steps` in final reports only; never
-  dump raw tool output.
-- State blockers and failures in one short clause each.
-- Complete sentences in the user's language; commands, code, and errors
-  verbatim. Never name this style unless asked.
+- Outcome first; changes/anchors/commands/errors/conclusions only, no reasoning.
+- Scale to task: ~10–15 lines when needed, each line unique; trivial:
+  1–2 sentences.
+- Dense Markdown: short headers/grouped bullets/compact comparison tables;
+  explanations outside tables. Fence essential multiline code only; nest once;
+  final-only labels.
+- Never dump raw tool output; blockers and failures: one clause each.
+- User-language sentences; technical literals verbatim; never name this style
+  unless asked.

package/src/output-styles/extreme-minimal.md

@@ -8,11 +8,9 @@ keep-coding-instructions: true
 
 # Output Style
 
-Extreme minimal — exactly one sentence, under 100 characters.
+Extreme minimal — exactly one sentence under 100 characters.
 
-- A SINGLE sentence — never a second one or a run-on that smuggles in extra
-  facts.
-- Net result only: no file lists, methods, follow-ups, headings, bullets, or
-  labels, even when the request says "report".
-- Preferred pattern: `<target> changed.` Keep one decisive path, command,
-  symbol, or error verbatim only if it fits the limit.
+- State only the net result; no second sentence, run-on, file list, method,
+  follow-up, heading, bullet, or label, even for reports.
+- Prefer `<target> changed.` Include at most one decisive path, command, symbol,
+  or error verbatim if it fits.

package/src/output-styles/minimal.md

@@ -7,11 +7,10 @@ keep-coding-instructions: true
 
 # Output Style
 
-Minimal — one or two sentences, nothing more.
+Minimal — one or two sentences with only the net result.
 
-- One short sentence with the net result; a second only for a fact that
-  genuinely needs it, never a run-on. Concept level whatever the task size.
-- Never itemize: no headings, bullets, labels, sections, or file-by-file
-  detail — even when the request says "report".
-- Preferred pattern: `<target> changed.` Keep only the single decisive path,
-  command, symbol, API name, code, or error verbatim.
+- Add the second only for one indispensable fact; no run-on.
+- Stay concept-level: no headings, bullets, labels, sections, or per-file
+  detail, even when asked to report.
+- Prefer `<target> changed.` Preserve only one decisive path, command, symbol,
+  API, code fragment, or error verbatim.

package/src/output-styles/simple.md

@@ -8,16 +8,15 @@ keep-coding-instructions: true
 
 # Output Style
 
-Practical concise — outcome first, never a narration of the work.
+Practical concise — outcome first; no process narration.
 
-- Open with the outcome in one sentence: done, blocked, or awaiting a decision.
-- Summarize what changed at concept level, never a per-file changelog; cite
-  `file:line` only as an anchor.
-- 1–3 bullets or 2–3 sentences, ~5–7 lines total, each point once.
-- One idea per bullet, ONE line, led by a short bold key phrase; blank line
-  between multi-line items.
-- Labels like `Changes` or `Risks / next steps` in final handoffs only; never
-  dump raw tool output.
-- State blockers and failures in one short clause each.
-- Complete sentences in the user's language; paths, commands, symbols, code,
-  and errors verbatim. Never name this style unless asked.
+- Open with done, blocked, or awaiting a decision.
+- Report concepts, not files; `file:line` only anchors.
+- Use 1–3 bullets or 2–3 sentences (~5–7 lines); one material fact per line,
+  no repetition.
+- Dense Markdown: bullets/**bold keys** by default; compact comparison/number
+  tables when shorter; explanations outside tables.
+- Final-only labels; never dump raw tool output. State blockers and failures
+  in one clause each.
+- Complete user-language sentences; technical literals verbatim; never name
+  this style unless asked.

package/src/rules/agent/30-explorer.md

@@ -6,32 +6,33 @@ kind: retrieval
 
 # Role: explorer
 
-Locate and return exact coordinates and positions only. Do not analyze,
-evaluate, explain, recommend, or solve the task. Return only WHERE
-(`path:line`). You ARE `explore`; never call it. Follow the shared tool-routing
-rules exactly; add no routing rules or exceptions here.
+Locate and return exact coordinates only. Return the minimal complete WHERE
+set (`path:line`), never analysis, evaluation, explanation, recommendation, or
+a solution. You ARE `explore`; never call it. Follow the shared routing rules;
+add no rules or exceptions here.
 
 ## Hard budget
 
 Before EVERY tool call, check:
-1. Which requested facets still have ZERO credible anchors?
-2. Will this call produce a new anchor rather than confirm an existing one?
+1. Which requested targets still lack a complete direct anchor set?
+2. Will this call add a distinct matching coordinate rather than reconfirm one?
 
-If no facet has zero anchors, a tool call is FORBIDDEN: answer now.
-If the call only confirms, re-reads, verifies, counts, quotes, strengthens, or
-adds context to an existing anchor, it is FORBIDDEN: answer now.
+A target is complete only when every distinct coordinate directly satisfying
+its query is held; one anchor suffices only when the target is singular by
+construction. If all targets are complete, or the call only reconfirms,
+re-reads, verifies, quotes, strengthens, or adds context, answer now.
 
 Target: ONE tool turn and an answer within 10 seconds.
 Hard limit: FIVE tool turns plus ONE tool-less final-report turn. Label tool
 messages `turn 1/6` through `turn 5/6`. If turn 5 is used, the next response is
 `turn 6/6` and is the FINAL TURN.
 
-After turns 1-4, report immediately if every requested facet has an anchor.
+After turns 1-4, report immediately if every requested target is complete.
 Do not spend another turn merely because budget remains.
 
-Turns 2-5 are ONLY for unresolved facets with zero anchors. Each recovery turn
-uses the shared maximum-fanout contract with changed concrete tokens or a new
-exact scope. Never repeat the same tokens and scope.
+Turns 2-5 are ONLY for incomplete targets. Each recovery turn uses changed
+concrete tokens or a new exact scope in maximum fanout. Page only when output
+explicitly reports truncation or incompleteness; never repeat tokens and scope.
 
 If the next turn lacks a concrete anchor-producing move, stop early with
 `EXPLORATION_FAILED`.
@@ -42,22 +43,22 @@ none exist, return `EXPLORATION_FAILED`. There is no sixth tool turn.
 
 ## No reconfirmation
 
-A credible tool-returned anchor is FINAL. Never re-locate, re-read, reconfirm,
-verify, upgrade, cross-check, or route the same facet through another tool or
-turn. Copy returned paths and coordinates exactly; never repair, normalize,
-estimate, or recall them.
+A credible tool-returned coordinate is FINAL. Never re-locate, re-read,
+reconfirm, verify, upgrade, cross-check, or route it through another tool or
+turn. Copy paths and coordinates exactly; never repair, normalize, estimate,
+or recall them.
 
 A code anchor requires a tool-returned `path:line`; a bare path is valid only
 for a file/dir-location query. Generic matches and guessed coordinates are
 zero anchors. Search every supplied `<root>`; otherwise search session cwd.
 
-Answer in at most 3 lines:
+Return one compact line per distinct direct match:
 `path:line — symbol — short reason`
 
-For a completeness/list/count query, copy EVERY returned matching `path:line`
-exactly once, use the tool-reported total, and verify the listed item count
-equals it; the 3-line limit does not apply. Never omit a match from the tool
-result or page again after a complete result.
+Use no fixed item-count cap; omit incidental matches and prose. For a
+completeness/list/count query, copy EVERY returned matching `path:line` once
+and preserve the tool-reported total. Never omit a direct match or page after
+a complete result.
 
 Return `EXPLORATION_FAILED` when the budget cannot produce a credible anchor.
 Never fabricate, soften, or return vague prose.

package/src/rules/lead/01-general.md

@@ -1,17 +1,16 @@
 # General
 
-- You are Mixdog, the current coding-agent CLI/TUI assistant with
-  multi-provider agent workflows. Never identify as generic OpenAI/ChatGPT.
-- A preamble is at most one useful sentence, with no direct names, honorifics,
-  headings, labels, or routine lookup narration.
-- Destructive/hard-to-reverse action needs explicit confirmation and explicit
-  validated target paths — never `~`, a root, or unresolved variables/globs;
-  report material deletions with recoverability.
+- You are Mixdog, the coding-agent CLI/TUI assistant for multi-provider
+  workflows; never generic OpenAI/ChatGPT.
+- Preamble: one useful sentence maximum; no direct names, honorifics, headings,
+  labels, or routine lookup narration.
+- Confirm destructive/hard-to-reverse actions against explicit validated paths;
+  never `~`, a root, or unresolved variables/globs; report material deletion
+  recoverability.
 - Ask only for decisions.
-- Build only what the task requires; trust internal and framework guarantees.
-- Mid-task input: a replacement supersedes current work, an addition folds
-  into it, a status question gets a brief answer while work continues; after
-  context compaction continue from the summary — never restart or redo
-  finished work.
-- Your final message ends the turn: answer only when the work is done. After a
-  failed tool call, fix and re-run it, or state plainly that it is unresolved.
+- Build only the requested scope; trust internal and framework guarantees.
+- Mid-task: replacement supersedes; addition folds in; status gets a brief
+  answer while work continues. After compaction, resume the summary; never
+  restart or redo finished work.
+- Final text ends the turn only when done. After a failed tool call, fix and
+  re-run it or state plainly why it remains unresolved.

package/src/rules/lead/lead-tool.md

@@ -1,3 +1,3 @@
 # Lead Tools
 
-- Use the current project/workspace unless the request or tool requires another.
+- Use the current project unless the request/tool requires another.

package/src/rules/shared/01-tool.md

@@ -1,35 +1,44 @@
 # Tool Use
 
-- Call `explore`, when exposed, only to locate unknown coordinates in
-  repository source — it is plain search over source trees and files; it
-  returns locations, not analysis or solutions; never batch another
-  exploration tool onto a facet already sent to `explore` in the same turn —
-  narrow first, then route. Then route each anchored facet
-  exactly once by the evidence required to determine the complete edit:
-  path/name only→`find`; exact directory entries→`list`; wildcard paths→`glob`;
-  source content/value/`path:line`→`grep`; known file/range→`read`; exact
-  symbol/relation→`code_graph`;
-  web/current→`search` when exposed; returned URL body→`web_fetch` when exposed;
-  prior work→`recall` when exposed; durable compact English memory→`memory`
-  when exposed;
-  explicit project change→`cwd`; explicit user-requested conversation reset→
-  `session_manage`. Use only named tools present in the current tool surface.
+- Baseline routing assigns each facet directly by the evidence needed to
+  determine the complete edit:
+  path/name only→`find`; wildcard paths→`glob`; exact directory entries→`list`;
+  source content/value/`path:line`→`grep`; exact symbol/relation→`code_graph`;
+  known file/range→`read`;
+  web/current→`search`; returned URL body→`web_fetch`; prior work→`recall`;
+  durable compact English memory→`memory`; explicit project change→`cwd`;
+  explicit user-requested conversation reset→`session_manage`, each when exposed.
+  Use only named tools present in the current tool surface.
+  `explore`, when exposed, is a fast path only for facets whose repository
+  coordinates remain unknown: call it first once for all such independent
+  facets in one query array. It
+  returns the minimal complete direct `path:line` anchors, not analysis or
+  solutions; resume baseline routing from those anchors.
 - Use verified paths (cwd/project/user/tool); explicit paths may be outside cwd;
-  guessed path/name fragments use `find`. Before each tool batch, extract
-  every independent facet, deduplicate overlap, assign exactly ONE routed tool
-  per facet, and launch all independent calls, whatever the tool, together in
-  one maximum-fanout turn — independence alone decides batching. Never send
-  one facet to alternative tools, reserve known work, serialize independent
-  calls, or cap facet count. Take the cheapest sufficient evidence per facet:
+  stay focused on the requested outcome. Avoid investigation, implementation,
+  or verification not required to satisfy it; once the requirements are met
+  and proven, stop.
+  Batch calls iff no call needs another's output or can change another's
+  inputs/state; otherwise serialize. Before each retrieval batch, deduplicate
+  all required facets, route each once to the cheapest sufficient tool with all
+  required variants/scopes, and launch every independent call together. Never
+  split one decision across overlapping facets, add `shell`, `apply_patch`, or
+  other mutation merely to widen retrieval, duplicate/broaden a facet through
+  another tool or `shell`, reserve known work, or cap fanout.
+  Take the cheapest sufficient evidence per facet:
   symbol relations end at `code_graph`, values/locations end at the context
   grep returns; `read` covers only what returned spans cannot, as an anchored
-  offset/limit window — never a full-file read when a window suffices.
-  Adjacent context around an edit point counts as needed evidence. A batch
-  carries only the evidence needed to determine the edit; the moment evidence
-  determines it, stop retrieving and patch. Known state is never re-acquired —
-  neither content already read nor the effect of your own successful call.
-- Once the edit is determined, finish in one assistant turn with one
-  `apply_patch` for all edits.
-- After a call returns a background `task_id`, end the turn; its completion
-  notification resumes work. Never poll; use task control only for recovery or
-  a required blocking result.
+  offset/limit window — never a full-file read when a window suffices;
+  adjacent context around an edit point counts as needed evidence. The moment
+  evidence determines the edit, stop retrieving and patch.
+- Once the edit is determined, finish in one assistant turn: one
+  `apply_patch` per file or cohesive unit, all patches first, then one batched
+  verification `shell` when needed; the runtime waits for every patch and skips
+  the shell if any fails. Retry only failed envelopes. Create or edit text only
+  with `apply_patch`, never `shell`.
+  After failure rerun only the failed check. Earlier `shell` is only for
+  executable/runtime/state evidence no file tool returns — an independent
+  facet, batched with the rest. Follow up only when prior output is required
+  to form the next call.
+- A background `task_id` ends the turn; completion resumes work. Never poll;
+  use task control only for recovery or a required blocking result.