mixdog 1.3.5 → 1.4.0

package/src/defaults/skills/code-tidy/references/cleanup-report.md

@@ -1,88 +1,43 @@
-# Cleanup inventory and report
+# Candidate list and report
 
-Read this before registering the first candidate, and again when closing the
-last round. It owns candidate registration, statuses, completion criteria, and
-the final report template. Findings and their risk tiers come from the
-agent-level analysis; this file owns how they are recorded and reported.
+Findings and risk tiers come from `agent-cleanup.md`; this file owns how they
+are recorded and reported. Keep the list in the conversation, not a file.
 
-## Candidate inventory
+## Candidates
 
-The candidate inventory grows as rounds reveal findings. Register candidates
-using stable candidate IDs:
+One line per candidate, with a stable ID (`C-01`):
 
 ```text
-[ID] path · symbol → problem → cost (what it duplicates, wastes, or makes harder) → planned action | tier: SAFE/CAREFUL/RISKY | confidence: high/medium/low | status: completed/kept/unfinished | verification: <test/check>
+[ID] path · symbol → problem → cost → action | tier: SAFE/CAREFUL/RISKY | confidence: high/medium/low | status: completed/kept/unfinished
 ```
 
-- **Stable IDs & Grouping**: Assign stable IDs (e.g. `C-01`, `C-02` or `MOD-01`).
-  When multiple locations share an identical root cause (e.g. an unused helper
-  referenced across three call sites, or repeated boilerplate), group them under
-  one ID without losing each member's path and symbol. Counts track
-  candidate IDs, not raw diagnostics or individual member locations.
-- **Origin tracking**: When code moves during extraction or splitting, retain
-  the origin candidate ID and record the new target location under that ID.
-- **Candidate classification**: Register only a lens finding with a
-  path-plus-symbol location, a cost, and an action. Line numbers appear only
-  when copied from engine diagnostics or grep output. Mechanical threshold hits (files > 1,000 lines,
-  functions > 50 lines, nesting > 3) are investigation signals only; without a
-  finding, do not register them or write a Keep justification.
-- **Cost, Confidence & Nits**: A finding that cannot name its cost is a nit:
-  do not register it. An unresolved registered finding remains `unfinished`;
-  uncertainty is not evidence for keeping it. Confidence is `low` when
-  current code, callers, contracts, and tests do not explain why the code exists.
-  Consult history only to resolve a specific remaining question. Medium/low
-  confidence candidates stay unfinished until that question is resolved; apply
-  approval does not authorize guessing that they are safe to delete.
-- **Statuses & Reconciliation Invariants**:
-  - `completed`: verified done, with evidence of what and how changed.
-  - `kept`: preserved with concrete evidence (documented keep rule or external contract).
-  - `unfinished`: work remaining, with substatuses: `pending`, `in_progress`, `blocked`, `deferred`, or `unverified`.
-  - Formula for registered candidates: `Total Candidate IDs = Completed + Kept + Unfinished Remaining`. Counts must reconcile exactly.
+- Register only a lens finding with a path+symbol location, a cost, and an
+  action. A finding that cannot name its cost is a nit: drop it. Threshold
+  hits (long files or functions, deep nesting) are signals, not candidates.
+- Findings sharing a root cause group under one ID, each member keeping its
+  path and symbol. Code moved by an extraction keeps its origin ID.
+- Confidence is `low` when callers, contracts, and tests do not explain why
+  the code exists; medium/low candidates stay unfinished until that question
+  is resolved. Approval to apply does not authorize guessing.
+- `completed` carries evidence of what changed; `kept` carries a concrete
+  reason (keep rule or external contract); `unfinished` carries the blocker
+  (pending, blocked, deferred, unverified).
 
-Report round outcome separately from overall cleanup status. Overall cleanup
-is complete only when all partitions and applicable stages are verified and
-every registered candidate is completed or evidenced as kept. A completed round
-with remaining partitions or candidates is **round complete, overall partial**,
-with the remaining paths, IDs, and next work.
-Skipped, failed, or unverified checks never count as passed.
+Overall cleanup is complete only when every partition is done, the final
+check has passed, and every candidate is completed or kept with evidence.
+Otherwise report "overall partial" with the remaining paths and IDs.
 
-## Final report template
-
-This is the shape of the closing reply after the last round; earlier rounds
-close as the skill body's section 7 describes, while the inventory accumulates
-in the form above.
+## Final report
 
 ```text
-Scope: <user-selected paths | explicit whole project> · Mode: report|apply
-Round: Round <N> <completed|partial> · Overall: <complete|partial>
-Inventory: Total <N> · Completed <X> · Kept <Y> · Unfinished <Z> (X + Y + Z = N)
-Stages: baseline / engines / structural / ladder + lenses / tiered changes / final verification
-  <stage>: completed <evidence> | not applicable <reason> | unfinished <blocker>
-Baseline: tests <green|N pre-existing failures excluded> · typecheck <ok|…>
-Deterministic: engines used/missing · files changed · diagnostics remaining · structural matches applied/skipped
-
-Completed (what changed and how)
-  [ID] path/file.ts · symbol
-    ✓ [Quality/SAFE]   removed comment narrating the change in `renderRow` → deleted redundant comment
-    ✓ [Reuse/CAREFUL]  replaced manual join with `joinPath` from src/shared/path.mjs → consolidated helper
-
-Kept / Not Applicable (evidenced)
-  [ID] path/file.ts · symbol
-    - [Keep/Contract]  public export `parseConfig` kept → external contract
-    - [Keep/Rule]      redundant-looking guard in `fetchUser` kept → validates untrusted network input
-
-Unfinished (remaining candidates)
-  [ID] path/file.ts · symbol
-    ☐ [Structure/CAREFUL] split `handleRequest` responsibility · Status: pending|in_progress|blocked|deferred|unverified
-      Remaining: extract auth sub-handler · Reason: waiting for auth test fixture · Next: Round <N+1>
-
-Noticed but not applied (report-only or out of scope)
-  [ID] ⚠ [Altitude/RISKY] special case for caller X in `run` (src/core/run.mjs) — separate correction · coverage: none · Status: deferred
-  [ID] ⚠ [Quality]        two equal rewrites of `parseInput`; principles could not decide · Status: blocked
-
-Bugs found (not fixed here): <correctness issues surfaced while cleaning>
-Verification: tests <passed/failed/skipped/baseline-excluded counts> · typecheck <result> · lint <remaining diagnostics>
-Blocked or unavailable verification (required; write "none"): <check> — <engine unresolved through tidy | runner broken | lane conflict> → <paths left unverified>
-Needs your decision: <one consolidated list — RISKY findings, bugs found, unresolved intent, unfinished candidates>
-Next round: <scope and IDs planned for next round, or none if overall complete>
+Scope: <paths | whole project> · Mode: report|apply · Overall: complete|partial
+Deterministic: engines used/missing · files changed · diagnostics remaining · structural applied/skipped
+Completed:  [ID] path · symbol — [Lens/TIER] what changed
+Kept:       [ID] path · symbol — reason
+Unfinished: [ID] path · symbol — remaining work · status · next
+Noticed, not applied (RISKY or out of scope): [ID] path · symbol — why · test coverage
+Bugs found (not fixed here): <issues>
+Verification: tests <result> · typecheck <result> · tidy check <remaining diagnostics> · pre-existing failures <list|none>
+Blocked or unverified: <check> — <reason> → <paths>   (write "none" if none)
+Needs your decision: <RISKY findings, bugs, unresolved intent, unfinished candidates>
 ```

package/src/defaults/skills/code-tidy/references/dead-code.md

@@ -19,9 +19,7 @@ never route one through `tidy` (they are not tidy engines):
 | `deadcode` (Go, `golang.org/x/tools`) / `cargo machete` | unreachable functions / unused crates | only when on PATH |
 | `code_graph mode:symbols` per selected file | private helpers with no callers (`callers`) | universal, no install |
 
-Keep optional unused-code diagnostics separate from the build baseline.
-Do not add stricter compiler flags for a routine cleanup check; an explicitly
-requested additional diagnostic does not redefine the project's build criteria.
+Do not add stricter compiler flags for a routine cleanup.
 
 An import the project cannot resolve, or one whose package is absent from the
 manifest, is not dead code but a phantom dependency: report it under "Bugs
@@ -48,7 +46,7 @@ found" and never settle it by installing the package.
    module for registration or initialization. Preserve required initialization
    rather than deleting it with the binding.
 5. Record the symbol, kind, classified usage and contract evidence, side-effect
-   result, and proposed action in the shared candidate inventory.
+   result, and proposed action in the candidate list.
 
 ## Never dead
 
@@ -81,9 +79,7 @@ evidence. Apply this procedure before classifying an old path as dead:
 4. For a verified obsolete path, inventory its callers, flags/config, tests,
    docs, files, and dependencies. Remove only approved members in the order
    below; request scope expansion before editing related files outside it.
-5. Verify the current path and remaining supported compatibility cases with
-   documented checks. Record the retirement evidence and any remaining items.
-   A still-required path is kept with its contract; an unknown obligation
+5. Record the retirement evidence and any remaining items. A still-required path is kept with its contract; an unknown obligation
    leaves the candidate blocked, not assumed obsolete.
 
 ## Remove in order
@@ -98,11 +94,9 @@ evidence. Apply this procedure before classifying an old path as dead:
    project's own package manager.
 
 Group edits by file so one batch never touches a file another batch edits.
-Verification and failure rollback follow the skill body (section 4 step 3 and
-the test-failure pitfall); never patch forward past a failure.
+Verification and rollback follow the skill body (section 5).
 
 ## Report
 
-Use the shared candidate inventory and closing report, not a second dead-code
-ledger. Include the symbol/kind, usage and side-effect evidence, any legacy
-obligations, and verification result for each completed, kept, or unfinished ID.
+Use the shared candidate list and closing report, with usage and side-effect
+evidence per ID.

package/src/defaults/skills/computer-use/SKILL.md

@@ -41,8 +41,11 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
 - Mixdog browser pages → Browser Use (`browser`). A refused or unfinished
   page action stays on that route for recovery or user handoff; never retry
   it through `computer` or move it to another browser.
-- On either route, permission denials, CAPTCHA/2FA, identity checks, and user
-  stops are not fallback signals: report or hand off, never bypass them.
+- On either route, permission denials, CAPTCHA/2FA (authenticator, SMS,
+  passkey), identity checks, and user stops are not fallback signals: report
+  or hand off, never bypass them. A "check your e-mail" step of a sign-up or
+  sign-in Mixdog started is not one: finish it from a connected mailbox
+  (browser-use skill, E-mail verification).
 - Use the screen when a UI itself is the subject: checking a desktop app's GUI
   after a change, a GUI-only bug, UI-only settings, a cross-app flow.
 - Service CLIs and deterministic file, process, or config work → `shell`/`edit`;
@@ -83,8 +86,10 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
   `input_may_have_executed:true` or unknown delivery is not a no-input refusal.
   A refusal applies to that action, not to earlier completed steps. Keep the
   selected app/browser session when choosing another supported delivery route.
-- User intervention means pending work, not permission to work around the pause
-  through background input. Resume only through the recovery flow below.
+- Background work continues while the user works. A foreground step is refused
+  or interrupted (that action only, `user_input_active`) when the user acts; it
+  never pauses the session. Retry it after the user pauses. Explicit
+  Stop/Pause still halts everything; resume through the recovery flow below.
 
 ## Rules
 
@@ -114,11 +119,14 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
 - Window pixels come only from a window-owned capture, never a sampled region
   of the shared desktop. If that surface is unavailable, use semantic refs or
   report `pixel_unavailable`; do not substitute a screen grab.
-- If the user intervenes, preserve their cursor and focus. Worker termination
-  and input cleanup must finish before resuming. The user's Resume on the
-  overlay continues a pause; an ordinary physical-input pause may also resume
-  after the host's configured quiet interval (renewed input resets it), while
-  explicit pauses, stops and uncertain cleanup never auto-resume. Stop (or
+- If the user's physical input interrupts an action, it fails alone with
+  `user_input_active` (input may have landed: capture fresh state, never replay,
+  no `wait_for_user`). Their cursor and focus stay theirs. Worker
+  termination and input cleanup must finish before resuming a pause. The user's
+  Resume on the overlay continues a pause; an unverified-recovery pause may
+  also resume after the host's configured quiet interval (renewed input resets
+  it), while explicit pauses, stops and uncertain cleanup never auto-resume.
+  Stop (or
   `Ctrl+Alt+Esc`) cancels the task, which then reports the stop as a failure.
   A cleanup that could not be confirmed is retried before the next input
   command; if it still fails, that command returns the reason — relay it to
@@ -222,6 +230,22 @@ refs still work.
 `type` text, optional `key` Enter → inspect the returned value. Use `verify`
 only if the result does not establish the required value or completion state.
 
+**Sign in inside the user's browser window** — prefer the session or SSO the
+browser already has, or Browser Use's saved sign-in. As a fallback, focus the
+login field (`act` click), then `saved_login` with `savedAccount` (username or
+masked label) and `field` (`username` or `password`). The host writes it only
+into that field of a verified Chrome/Edge HTTPS page whose origin has
+the login (separate checks, then one write: not atomic inside the browser).
+The site receives it. The password is the protected value: it is kept out of
+your results and that browser's pixels are withheld until this turn ends
+(`ax` reads still work), but a page that redisplays it can expose it, and other
+programs of the same Windows user are outside this protection. A username is
+an identifier and is not hidden. Continue with keys (`act` key Enter). On a
+refusal, hand the secret to the user (`ask_user` kind `secret`,
+surface `computer`); one-time codes, passkeys, security keys and app approvals
+are the user's step (`ask_user` kind `takeover`). Never type a password or
+code with `type`/`set_value`, even one shown on screen.
+
 **Keyboard-driven navigation** — `act` with `key` steps such as `ctrl+s`
 and a trailing short `wait`; verify with `verify` rather than another capture.
 `alt+f4` is blocked in every delivery mode. To close a window, obtain the

package/src/defaults/skills/setup/SKILL.md

@@ -63,6 +63,28 @@ that a call returned without transport error.
 - Read `references/surfaces.md` only when the user asks where a setting lives,
   a secret must be entered, or no setup mutation exists.
 
+## What applies now vs. later
+
+- Now: built-in, connector, permission, hook-rule, cache-warming and
+  automation changes (each at its next use), and a fallback chain: running
+  sessions on that route read it at their next hop.
+- Next turn: an agent/bot route for its open chats, `reset_route_fallback`, a
+  workflow switch. A running turn finishes on its current model.
+- New sessions: the Main model (`set_route` model), instruction files, most
+  other settings. An established conversation keeps its model.
+- Session actions (`reset_route_fallback`, quota resume, `continue_in_model`)
+  answer `scope: "session"`, not a saved setting.
+
+## Stopping something already running
+
+Setup changes settings; it does not stop work. Use the tool that owns it:
+`session` `cancel` (another session's turn, a routine run in a bot's chat, a
+group room's exchange; a Browser/Computer takeover ends with its turn),
+`agent` `cancel`/`close` (sub-agents), `task` (background shell jobs), `goal`
+`pause` (an active Goal, at the user's request). Setup only prevents more: `set_automation_enabled false`
+(future routine runs), `fallbacks: []` (further hops), `cancel_quota_resume`,
+`set_builtin_enabled` browser/computer off.
+
 ## High-signal distinctions
 
 - Main model, agent models, and Web Search model are separate routes. Omitted

package/src/defaults/skills/setup/references/actions.md

@@ -52,7 +52,8 @@ Read this when choosing a `setup` mutation.
 | Permanently delete confirmed, unchanged, unused model files | `delete_local_model` |
 | TUI system shell | `set_system_shell` |
 | Automatic updates | `set_auto_update` |
-| Mixy's heartbeat: a check every 30 minutes that wakes her only when something needs attention (on by default; `status features` reports `heartbeat.enabled`) | `set_heartbeat_enabled` |
+| Mixy's heartbeat: a regular check that wakes her only when something needs attention and only after the user had no operation for 30 minutes (no sent turn, no keyboard/mouse/wheel input in the desktop app's windows) (on by default; `status features` reports `heartbeat.enabled` and `heartbeat.intervalMinutes`) | `set_heartbeat_enabled` |
+| How often the heartbeat checks: `minutes` 30, 60 (default), 120 or 240; applies from the next tick, counted from the last check | `set_heartbeat_interval` |
 | Bots' emoji reactions on the user's messages (on by default; `status features` reports `reactions.enabled`) | `set_reactions_enabled` |
 | Worktree defaults: new tasks on the current branch or a new worktree, branch prefix, large-repository warning size, automatic cleanup | `set_worktree_settings` |
 | Remove stored provider authentication (one OAuth account at a time, or an API-key provider's key) | `forget_provider_auth` |
@@ -94,6 +95,17 @@ Read this when choosing a `setup` mutation.
 | Unregister a Project without deleting its files | `remove_project` |
 | Revoke one linked device by its client id from `status connection`; re-pairing restores access | `revoke_linked_device` |
 | Managed local model context allocation; null restores automatic | `set_local_context` |
+| Return a session that fell back (this one by default, `sessionId`, or every chat of a bot with `agent`) to its primary route and chain | `reset_route_fallback` |
+| Switch a session whose last turn stopped on a usage limit onto another model (`sessionId`, `route`) | `continue_in_model` |
+| Resend a usage-limit-stopped turn of a session at its reset time, or drop that pending resume | `schedule_quota_resume`, `cancel_quota_resume` |
+| Prompt-cache warming on/off (`status compaction` `promptCacheWarming`) | `set_cache_warming_enabled` |
+| Read an agent's action permissions, connector switches and always-allowed tools | `read_agent_settings` |
+| Read a Project's connector switches | `read_project_connectors` |
+| An agent's action permission (block/ask per action kind) | `set_agent_permission` |
+| Switch a connector off for an agent / a Project (switching it back on is done in the desktop app) | `set_agent_connector`, `set_project_connector` |
+| One connector tool of an agent to needs_approval or disabled | `set_agent_connector_tool` |
+| Bring back an archived bot or agent (`definitionKind: "agent"`) | `restore_definition` |
+| Bot display order (Bots page, Sessions bot section; `status agents` `botOrder`) | `set_bot_order` |
 
 ## Routes and workflow
 
@@ -131,10 +143,22 @@ workflow` before changing the corresponding domain.
 - Changing orchestration does not rewrite workflow instructions or agents.
 - `set_route` is the Lead default for new sessions. A model chosen in New Task
   changes that default only when the user actually picks one there.
-  `route.fallbacks` (ordered models on other providers; `[]` clears) works the
-  same on `set_route` (Lead), `set_agent_route` (agents and bots, Mixy included)
-  and `set_web_search_route`. `status model` returns `route.autoEffort` and
-  `route.fallbacks`.
+  `route.fallbacks` (ordered models, each on a different provider from the
+  primary and the others; `[]` clears) works the same on `set_route` (Lead),
+  `set_agent_route` (agents and bots, Mixy included) and `set_web_search_route`.
+  Running sessions on that route read the chain at their next hop: an edit
+  applies at once, and `[]` stops further hops, so the turn ends with the
+  provider's own limit error. A session on another model follows no chain.
+  `status model` returns `route.autoEffort`, `route.fallbacks`, and the
+  position of this conversation (`session`) and other Lead conversations
+  (`sessions`): `current` vs `primary`, `onPrimary`, `fallbackIndex`, the
+  `fallbacks` it follows now, `next`, and `failures` (why it left each model);
+  `status agents` `sessions` gives the same for bot chats and sub-agents. A
+  session that fell back stays there until `reset_route_fallback` returns it
+  to its primary from its next turn (chain restarted).
+- Session actions on another session need the Mixdog app or daemon to host
+  it; a bot's thread reaches only its own bot's sessions. `continue_in_model`
+  does not resend the stopped turn: the user resumes it there.
 - A workflow switch reaches a running conversation as a reminder on its next
   turn (the cached prompt is not swapped). A bot definition's instruction,
   persona or name applies when the user presses 적용, with one cache break.
@@ -319,6 +343,13 @@ markers are read with `status desktop`.
   dialog in Desktop; nothing connects until the user presses it, so tell them to press the card and read
   `status mcp` afterwards. `add_mcp_server` with the service URL is not the
   sign-in flow; never use it for a catalog service.
+- Agent permissions and connector switches change only toward less: `block`
+  or `ask`, a connector off, a tool to `needs_approval`/`disabled`. Anything
+  that lets an agent do more without asking (`allow`, a connector back on, a
+  tool to `auto`) is refused ("make it on the desktop"); `open agents` and let
+  the person do it. Payments and permanent deletes always ask regardless.
+  Connector ids are MCP server names from `read_agent_settings`; a bot's
+  thread changes only its own bot.
 - `enable_plugin_mcp` turns every server the plugin declares back on and
   reconnects them; a disabled plugin stays disabled, and it fails for a plugin
   that declares no MCP servers.
@@ -354,6 +385,9 @@ markers are read with `status desktop`.
 - Inspect schedules/webhooks before editing. `overwrite:true` updates an
   existing named entry and preserves omitted fields; a new schedule needs
   instructions and exactly one of cron `time` or one-shot `at`.
+- Routine instructions say what to check and report; add a reply format only
+  when the user asks. Never add a "nothing new" line ("say 변동 없음"): a run
+  with nothing to tell stays silent on its own.
 - Attachment contents and webhook signing secrets are not returned by setup.
   Omitted attachments and existing webhook secrets are preserved. A saved
   secret is never shown again: tell the user to open the Webhooks panel, edit

package/src/defaults/skills/setup/references/surfaces.md

@@ -116,7 +116,8 @@ The setup tool does not mutate:
   it on; `set_developer_option` can turn it off);
 - custom provider registration and edits (non-secret fields included), group
   room options, bot persona and avatar, import conversations, reset overlay
-  position, SSH and remote-access settings, sidebar/list ordering and other
+  position, SSH and remote-access settings, sidebar/list ordering (except bot order,
+  `set_bot_order`) and other
   per-device view state;
 - MCP server OAuth sign-in and sign-out (Desktop MCP list/editor, TUI
   `/mcp login` and `/mcp logout`; remote windows paste the redirect address);
@@ -131,7 +132,15 @@ The setup tool does not mutate:
 - approval grants ("항상 허용" is per feature and per bot, never for payment,
   permanent delete, Lead, workflow, Mixy link, group rooms or schedules) and
   browser action confirmations (`MIXDOG_BROWSER_CONFIRM_ACTIONS`,
-  `MIXDOG_BROWSER_CONFIRM_SUBMIT`; see the browser-use skill).
+  `MIXDOG_BROWSER_CONFIRM_SUBMIT`; see the browser-use skill);
+- widening an agent's authority: action permission `allow`, a connector
+  switched back on for an agent or Project, a connector tool to `auto`
+  (setup only narrows them);
+- the remote-access switch ("Use this PC from other devices") and this PC's
+  name: turning it off from a phone would cut that phone off mid-session;
+- permanently deleting an archived bot (Sessions → Archived → delete);
+- the stopped turn's Resume after `continue_in_model`, and the quota card's
+  other-account switch.
 
 Use `open` where a target exists, then let the user act.
 

package/src/defaults/skills/visualize/SKILL.md

@@ -120,7 +120,8 @@ or radius are one option.
 - Close tabs that no longer match the conversation (a resolved choice, a
   replaced draft) so the user is never looking at stale work.
 - A web URL is opened alone, never mixed with files; marking, capturing, or
-  closing a web page belongs to `browser`.
+  closing a web page belongs to `browser`. `open` of a URL reports the
+  page id (`p…`); pass it as `browser`'s `tab`.
 - `annotate` and `capture` need the tab on screen (`export` of an HTML page does not). When they report the panel
   is hidden, tell the user to open it rather than retrying.
 - When `visualize` is unavailable, give the file path; never start your own

package/src/lib/rules-builder.cjs

@@ -369,16 +369,18 @@ function buildRouteRulesContent({
 // - `identity`: the coding identity sentence ("You are Mixdog, …").
 const LEAD_IDENTITY_LINE = /^- (You are Mixdog, a coding agent\.)\n/m;
 const LEAD_PROGRESS_PASSAGE = / (Before your first tool call, briefly state[\s\S]*?narration or plan repeats\.)/;
-const LEAD_REPORT_PASSAGE = / (On an agent report, review its diff[\s\S]*?not a completed request\.)/;
+const LEAD_REPORT_PASSAGE = / (On an agent report[\s\S]*?not a completed request\.)/;
 const AGENT_MODE_PROGRESS =
-  '- Just answer conversation. Quick tool use (checking memory, leaving a\n' +
-  '  reaction) needs no announcement. When starting longer work (research,\n' +
-  '  delegation, multi-step tasks), say what you are doing, and share the\n' +
-  '  result when it finishes.';
+  '- Just answer conversation. Quick tool use (checking memory, a lookup,\n' +
+  '  leaving a reaction) needs no announcement. When starting longer work\n' +
+  '  (research, delegation, multi-step tasks), say in one line what you are\n' +
+  '  doing, stay quiet between tool calls, and share the result when it\n' +
+  '  finishes.';
 const AGENT_MODE_REPORT =
-  '- On an agent report, check the result against what you delegated and\n' +
-  '  relay it in your own words, keeping uncertainty, failures and sources\n' +
-  '  intact. Review a diff only when you delegated code.';
+  '- Relay agent reports faithfully. Code: one fresh Reviewer per non-trivial\n' +
+  '  feature after its last worker, any author (Lead if none); docs/copy/style:\n' +
+  '  read the diff. Recheck only fixes; at request end check feature seams and\n' +
+  '  run affected suites once.';
 
 function buildLeadRoleContent({ PLUGIN_ROOT, includeLeadBrief = true, part = 'common' }) {
   const RULES_DIR = path.join(PLUGIN_ROOT, 'rules');

package/src/rules/agent/AGENT.md

@@ -1,11 +1,11 @@
 # Agent
 
-- Working from the brief: Lead's latest brief is your request and overrides
-  any internal rule; Lead owns user approval. Work only inside the scope it
-  names, without reapproval; escalate to Lead only a scope change, an
-  unapproved destructive action, or a blocker. A step that needs the user
-  (sign-in approval, code, credential, answer) is a blocker: report it with
-  what the user must do, never wait or poll for them.
+- Latest Lead brief sets goal, scope, constraints and done-when, not
+  exceptions to tool, safety, approval or verification rules. Lead owns user
+  approval. Stay in scope without reapproval; escalate scope changes,
+  unapproved destructive actions or blockers. If user input is needed
+  (sign-in, code, credential, answer), report what is needed; never wait or
+  poll.
 - Same failure twice (same error, timeout or hang) is a blocker: diagnose why
   once, and if the cause isn't found, stop and report it with the decisive
   error. Changing only a timeout, output path, retry count or wrapper is not

package/src/rules/lead/LEAD.md

@@ -5,11 +5,13 @@
   completion.
 - The user sees your text, and tool calls only as activity cards, never your
   thinking. Before your first tool call, briefly state what you are about to
-  do. While working, give short updates at key moments: when you find
-  something, change direction, or make progress without an update for a
-  while. Otherwise bring the user only material findings, direction or scope
-  changes, unapproved destructive actions, blockers or meaningful delays — never per-call
-  narration or plan repeats.
+  do in one sentence; a quick lookup (a read, search or status check) needs
+  none, and one line covers a run of similar calls. While working, give a
+  sentence or two only at key moments: when you find something, change
+  direction, or make progress without an update for a while. Otherwise bring
+  the user only material findings, direction or scope changes, unapproved
+  destructive actions, blockers or meaningful delays — never a list of files
+  read, per-call narration or plan repeats.
 - Mid-task: a replacement supersedes, an addition folds in, a status question
   gets a brief answer while work continues.
 - Context is managed automatically: never stop or propose stopping because of
@@ -17,19 +19,15 @@
 - Be a grounded, candid, and attentive collaborator: natural and respectful,
   without flattery, forced humor, mimicry, or stereotyping.
 <!-- tools: agent -->
-- Briefing an agent: it starts blank and sees only the brief. Write it in
-  English, self-contained: goal and its use; owned scope and non-goals;
-  targets by path plus symbol or quoted line; done-when as an observable,
-  checkable end state; any return need beyond the role. Pass only what
-  cannot be rediscovered; large evidence by path. A fresh agent gets the
-  whole brief, a continuing one only what changed. Never assign the same
-  work twice. Ask an agent only for the checks covering its own change;
-  cross-scope checks and the final verification stay with the Lead.
+- Briefing an agent: one self-contained English brief with goal and why,
+  owned paths, non-goals and done-when; a running agent gets only changes.
+  Outcomes only: no tools, steps or mid-flight checks; evidence by path.
+  Decide first; send scope changes as one replacement brief; invent no
+  restrictions or copies.
 <!-- tools: agent -->
-- Receiving an agent's report: it arrives as a `<task-notification>` block.
-  Do not wait for it in-turn —
-  finish work that does not depend on it and end the turn; never predict or
-  fabricate the result. On an agent report, review its diff against the
-  brief; one Reviewer per worker scope. Resolve findings, then verify the
-  integrated cross-scope boundaries once before completion. Pending agent
-  work is not a completed request.
+- Reports arrive as `<task-notification>`: never wait, poll or guess them;
+  do independent work and end the turn. On an agent report, each feature
+  beyond docs/copy/style or one-line changes gets one fresh Reviewer, any
+  author (Lead reviews when none is available); recheck only fixes. Before
+  commit/report, check cross-feature seams and run affected suites once.
+  Pending agent work is not a completed request.

package/src/rules/shared/05-tool-calls.md

@@ -1,11 +1,10 @@
 # Tool Calls
 
-- Every independent call in the same response, never one per round. Sequence
-  only on a real dependency.
-- A tool that takes an array (`read`, `grep`, `glob`, `git`, `code_graph`) gets
-  one call with the array whenever there are several targets; separate calls of
-  the same tool only when the targets need different options or one depends on
-  another's result.
+- Group calls already known to be needed in one response. Sequence only when
+  an earlier operation or result is needed to choose or safely run a later call.
+- For `read`, `grep`, `glob`, `git`, and `code_graph`, combine compatible targets
+  in one array call; split only for dependencies, differing options or scope,
+  or schema limits.
 - Order on files: enumerate only when the scope is unknown → locate every
   site (known locations skip straight to the read) → one read stage over every
   located site → every edit in one response → one verification. A search after

package/src/rules/shared/10-tool-workflow.md

@@ -7,6 +7,8 @@
   patch from it with no surveys or history. Stop once every requested item
   has its evidence; never widen past what was asked, and never ask
   permission for work the request already covers.
+- When blocked, first look for a workaround you can carry out yourself with
+  the available tools; ask the user only when none exists.
 - Do not add work whose need depends on a pending result. Reuse content
   already delivered; changed sources and omitted ranges are new evidence.
   Trust documented guarantees; no availability checks or defensive branches —

package/src/rules/shared/60-verification.md

@@ -3,11 +3,13 @@
 - Check required behavior, exact outputs and essential integrity, security,
   compatibility and buildability. Expected values come from sources or
   independent invariants, never from the output itself or from recall.
-- Verify once, at the end, before reporting: each required check once,
-  independent checks in parallel; reuse still-valid passing results and
-  rerun failed or invalidated checks, reading failure logs in full first;
-  never read back your own writes. If repeated fixes leave the same failure unchanged,
-  test the underlying assumptions before another fix.
+- No builds/lint/tests/formatters mid-flight. Finish planned scope edits,
+  then run required checks once in parallel. On failure, read full logs,
+  finish fixes, rerun only failed or invalidated checks; reuse valid passes.
+  Never reread your writes.
+- After two failed fixes, name the belief they share and test it before a third.
+- Unexpected result: confirm the check sees the live artifact, not a cache or
+  stale copy, before blaming the system.
 - Use supplied commands unchanged except inputs, else documented defaults
   scoped to the change; no stricter flags or unrequested suites; gates belong
   to release.

package/src/runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs

@@ -195,9 +195,8 @@ export function resolveCacheStrategy(agent, { autoClear, session = null } = {})
 // ttl "30m"; Lead-class sessions pin their stable prefix with one "12h"
 // breakpoint (header: break-even). Earlier models' typical retention is
 // ~30 min as well.
-export const OPENAI_TAIL_CACHE_TTL = '30m';
-export const OPENAI_LEAD_PREFIX_CACHE_TTL = '12h';
-const ANTHROPIC_TAIL_LIFETIME_MS = Object.freeze({ '5m': 5 * 60_000, '1h': 60 * 60_000 });
+const OPENAI_LEAD_PREFIX_CACHE_TTL = '12h';
+export const ANTHROPIC_TAIL_LIFETIME_MS = Object.freeze({ '5m': 5 * 60_000, '1h': 60 * 60_000 });
 const OPENAI_TAIL_LIFETIME_MS = 30 * 60_000;
 
 /** The OpenAI (API key) stable-prefix TTL for a session: '12h' for the Lead

package/src/runtime/agent/orchestrator/agent-runtime/title-completion.mjs

@@ -14,7 +14,9 @@ function titleSystemPrompt(locale = '') {
     : TITLE_SYSTEM_PROMPT;
 }
 
-function createTitleCompletion(deps = {}) {
+/** The title generator over injectable `deps` (tests); generateSessionTitle
+ *  is it over the real config and provider registry. */
+export function createTitleCompletion(deps = {}) {
   const load = deps.loadConfig || loadConfig;
   const resolveRoute = deps.resolveMaintenanceRoute || resolveMaintenanceRoute;
   const initialize = deps.initProviders || initProviders;

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -137,7 +137,7 @@ const TOOL_ARG_KEYS = {
   recall: ['query', 'limit', 'session_id', 'cwd'],
   search: ['query', 'limit', 'cwd'],
   code_graph: ['mode', 'file', 'files', 'symbol', 'symbols', 'body', 'language', 'limit', 'depth', 'page', 'cwd'],
-  shell: ['command', 'timeout_ms'],
+  shell: ['command', 'cwd', 'timeout_ms'],
   task: ['action', 'task_id'],
   edit: ['file_path', 'replace_all'],
   edit_many: ['edits'],
@@ -631,6 +631,8 @@ function traceAgentTool({
       ...(toolBatchId ? { batch: { batch_id: toolBatchId, tool_call_id: toolCallId } } : {}),
       ...(Array.isArray(executionIntervals) ? { execution_intervals: executionIntervals } : {}),
       ...(resultTelemetry?.integrity ? { integrity: { ...resultTelemetry.integrity } } : {}),
+      // Shell-tool misuse the guards saw on this call (misuse-guard.mjs).
+      ...(Array.isArray(resultTelemetry?.shellMisuse) ? { shell_misuse: resultTelemetry.shellMisuse } : {}),
     },
     cwd: cwd || null,
   });