mixdog 1.3.5 → 1.4.1

package/src/defaults/skills/code-tidy/references/cleanup-report.md

@@ -1,88 +1,43 @@
-# Cleanup inventory and report
+# Candidate list and report
 
-Read this before registering the first candidate, and again when closing the
-last round. It owns candidate registration, statuses, completion criteria, and
-the final report template. Findings and their risk tiers come from the
-agent-level analysis; this file owns how they are recorded and reported.
+Findings and risk tiers come from `agent-cleanup.md`; this file owns how they
+are recorded and reported. Keep the list in the conversation, not a file.
 
-## Candidate inventory
+## Candidates
 
-The candidate inventory grows as rounds reveal findings. Register candidates
-using stable candidate IDs:
+One line per candidate, with a stable ID (`C-01`):
 
 ```text
-[ID] path · symbol → problem → cost (what it duplicates, wastes, or makes harder) → planned action | tier: SAFE/CAREFUL/RISKY | confidence: high/medium/low | status: completed/kept/unfinished | verification: <test/check>
+[ID] path · symbol → problem → cost → action | tier: SAFE/CAREFUL/RISKY | confidence: high/medium/low | status: completed/kept/unfinished
 ```
 
-- **Stable IDs & Grouping**: Assign stable IDs (e.g. `C-01`, `C-02` or `MOD-01`).
-  When multiple locations share an identical root cause (e.g. an unused helper
-  referenced across three call sites, or repeated boilerplate), group them under
-  one ID without losing each member's path and symbol. Counts track
-  candidate IDs, not raw diagnostics or individual member locations.
-- **Origin tracking**: When code moves during extraction or splitting, retain
-  the origin candidate ID and record the new target location under that ID.
-- **Candidate classification**: Register only a lens finding with a
-  path-plus-symbol location, a cost, and an action. Line numbers appear only
-  when copied from engine diagnostics or grep output. Mechanical threshold hits (files > 1,000 lines,
-  functions > 50 lines, nesting > 3) are investigation signals only; without a
-  finding, do not register them or write a Keep justification.
-- **Cost, Confidence & Nits**: A finding that cannot name its cost is a nit:
-  do not register it. An unresolved registered finding remains `unfinished`;
-  uncertainty is not evidence for keeping it. Confidence is `low` when
-  current code, callers, contracts, and tests do not explain why the code exists.
-  Consult history only to resolve a specific remaining question. Medium/low
-  confidence candidates stay unfinished until that question is resolved; apply
-  approval does not authorize guessing that they are safe to delete.
-- **Statuses & Reconciliation Invariants**:
-  - `completed`: verified done, with evidence of what and how changed.
-  - `kept`: preserved with concrete evidence (documented keep rule or external contract).
-  - `unfinished`: work remaining, with substatuses: `pending`, `in_progress`, `blocked`, `deferred`, or `unverified`.
-  - Formula for registered candidates: `Total Candidate IDs = Completed + Kept + Unfinished Remaining`. Counts must reconcile exactly.
+- Register only a lens finding with a path+symbol location, a cost, and an
+  action. A finding that cannot name its cost is a nit: drop it. Threshold
+  hits (long files or functions, deep nesting) are signals, not candidates.
+- Findings sharing a root cause group under one ID, each member keeping its
+  path and symbol. Code moved by an extraction keeps its origin ID.
+- Confidence is `low` when callers, contracts, and tests do not explain why
+  the code exists; medium/low candidates stay unfinished until that question
+  is resolved. Approval to apply does not authorize guessing.
+- `completed` carries evidence of what changed; `kept` carries a concrete
+  reason (keep rule or external contract); `unfinished` carries the blocker
+  (pending, blocked, deferred, unverified).
 
-Report round outcome separately from overall cleanup status. Overall cleanup
-is complete only when all partitions and applicable stages are verified and
-every registered candidate is completed or evidenced as kept. A completed round
-with remaining partitions or candidates is **round complete, overall partial**,
-with the remaining paths, IDs, and next work.
-Skipped, failed, or unverified checks never count as passed.
+Overall cleanup is complete only when every partition is done, the final
+check has passed, and every candidate is completed or kept with evidence.
+Otherwise report "overall partial" with the remaining paths and IDs.
 
-## Final report template
-
-This is the shape of the closing reply after the last round; earlier rounds
-close as the skill body's section 7 describes, while the inventory accumulates
-in the form above.
+## Final report
 
 ```text
-Scope: <user-selected paths | explicit whole project> · Mode: report|apply
-Round: Round <N> <completed|partial> · Overall: <complete|partial>
-Inventory: Total <N> · Completed <X> · Kept <Y> · Unfinished <Z> (X + Y + Z = N)
-Stages: baseline / engines / structural / ladder + lenses / tiered changes / final verification
-  <stage>: completed <evidence> | not applicable <reason> | unfinished <blocker>
-Baseline: tests <green|N pre-existing failures excluded> · typecheck <ok|…>
-Deterministic: engines used/missing · files changed · diagnostics remaining · structural matches applied/skipped
-
-Completed (what changed and how)
-  [ID] path/file.ts · symbol
-    ✓ [Quality/SAFE]   removed comment narrating the change in `renderRow` → deleted redundant comment
-    ✓ [Reuse/CAREFUL]  replaced manual join with `joinPath` from src/shared/path.mjs → consolidated helper
-
-Kept / Not Applicable (evidenced)
-  [ID] path/file.ts · symbol
-    - [Keep/Contract]  public export `parseConfig` kept → external contract
-    - [Keep/Rule]      redundant-looking guard in `fetchUser` kept → validates untrusted network input
-
-Unfinished (remaining candidates)
-  [ID] path/file.ts · symbol
-    ☐ [Structure/CAREFUL] split `handleRequest` responsibility · Status: pending|in_progress|blocked|deferred|unverified
-      Remaining: extract auth sub-handler · Reason: waiting for auth test fixture · Next: Round <N+1>
-
-Noticed but not applied (report-only or out of scope)
-  [ID] ⚠ [Altitude/RISKY] special case for caller X in `run` (src/core/run.mjs) — separate correction · coverage: none · Status: deferred
-  [ID] ⚠ [Quality]        two equal rewrites of `parseInput`; principles could not decide · Status: blocked
-
-Bugs found (not fixed here): <correctness issues surfaced while cleaning>
-Verification: tests <passed/failed/skipped/baseline-excluded counts> · typecheck <result> · lint <remaining diagnostics>
-Blocked or unavailable verification (required; write "none"): <check> — <engine unresolved through tidy | runner broken | lane conflict> → <paths left unverified>
-Needs your decision: <one consolidated list — RISKY findings, bugs found, unresolved intent, unfinished candidates>
-Next round: <scope and IDs planned for next round, or none if overall complete>
+Scope: <paths | whole project> · Mode: report|apply · Overall: complete|partial
+Deterministic: engines used/missing · files changed · diagnostics remaining · structural applied/skipped
+Completed:  [ID] path · symbol — [Lens/TIER] what changed
+Kept:       [ID] path · symbol — reason
+Unfinished: [ID] path · symbol — remaining work · status · next
+Noticed, not applied (RISKY or out of scope): [ID] path · symbol — why · test coverage
+Bugs found (not fixed here): <issues>
+Verification: tests <result> · typecheck <result> · tidy check <remaining diagnostics> · pre-existing failures <list|none>
+Blocked or unverified: <check> — <reason> → <paths>   (write "none" if none)
+Needs your decision: <RISKY findings, bugs, unresolved intent, unfinished candidates>
 ```

package/src/defaults/skills/code-tidy/references/dead-code.md

@@ -19,9 +19,7 @@ never route one through `tidy` (they are not tidy engines):
 | `deadcode` (Go, `golang.org/x/tools`) / `cargo machete` | unreachable functions / unused crates | only when on PATH |
 | `code_graph mode:symbols` per selected file | private helpers with no callers (`callers`) | universal, no install |
 
-Keep optional unused-code diagnostics separate from the build baseline.
-Do not add stricter compiler flags for a routine cleanup check; an explicitly
-requested additional diagnostic does not redefine the project's build criteria.
+Do not add stricter compiler flags for a routine cleanup.
 
 An import the project cannot resolve, or one whose package is absent from the
 manifest, is not dead code but a phantom dependency: report it under "Bugs
@@ -48,7 +46,7 @@ found" and never settle it by installing the package.
    module for registration or initialization. Preserve required initialization
    rather than deleting it with the binding.
 5. Record the symbol, kind, classified usage and contract evidence, side-effect
-   result, and proposed action in the shared candidate inventory.
+   result, and proposed action in the candidate list.
 
 ## Never dead
 
@@ -81,9 +79,7 @@ evidence. Apply this procedure before classifying an old path as dead:
 4. For a verified obsolete path, inventory its callers, flags/config, tests,
    docs, files, and dependencies. Remove only approved members in the order
    below; request scope expansion before editing related files outside it.
-5. Verify the current path and remaining supported compatibility cases with
-   documented checks. Record the retirement evidence and any remaining items.
-   A still-required path is kept with its contract; an unknown obligation
+5. Record the retirement evidence and any remaining items. A still-required path is kept with its contract; an unknown obligation
    leaves the candidate blocked, not assumed obsolete.
 
 ## Remove in order
@@ -98,11 +94,9 @@ evidence. Apply this procedure before classifying an old path as dead:
    project's own package manager.
 
 Group edits by file so one batch never touches a file another batch edits.
-Verification and failure rollback follow the skill body (section 4 step 3 and
-the test-failure pitfall); never patch forward past a failure.
+Verification and rollback follow the skill body (section 5).
 
 ## Report
 
-Use the shared candidate inventory and closing report, not a second dead-code
-ledger. Include the symbol/kind, usage and side-effect evidence, any legacy
-obligations, and verification result for each completed, kept, or unfinished ID.
+Use the shared candidate list and closing report, with usage and side-effect
+evidence per ID.

package/src/defaults/skills/computer-use/SKILL.md

@@ -8,6 +8,8 @@ dependencies:
   tools:
     - type: tool
       value: computer
+    - type: tool
+      value: handoff_user
 ---
 
 # Computer Use
@@ -41,8 +43,11 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
 - Mixdog browser pages → Browser Use (`browser`). A refused or unfinished
   page action stays on that route for recovery or user handoff; never retry
   it through `computer` or move it to another browser.
-- On either route, permission denials, CAPTCHA/2FA, identity checks, and user
-  stops are not fallback signals: report or hand off, never bypass them.
+- On either route, permission denials, CAPTCHA/2FA (authenticator, SMS,
+  passkey), identity checks, and user stops are not fallback signals: report
+  or hand off, never bypass them. A "check your e-mail" step of a sign-up or
+  sign-in Mixdog started is not one: finish it from a connected mailbox
+  (browser-use skill, E-mail verification).
 - Use the screen when a UI itself is the subject: checking a desktop app's GUI
   after a change, a GUI-only bug, UI-only settings, a cross-app flow.
 - Service CLIs and deterministic file, process, or config work → `shell`/`edit`;
@@ -83,8 +88,10 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
   `input_may_have_executed:true` or unknown delivery is not a no-input refusal.
   A refusal applies to that action, not to earlier completed steps. Keep the
   selected app/browser session when choosing another supported delivery route.
-- User intervention means pending work, not permission to work around the pause
-  through background input. Resume only through the recovery flow below.
+- Background work continues while the user works. A foreground step is refused
+  or interrupted (that action only, `user_input_active`) when the user acts; it
+  never pauses the session. Retry it after the user pauses. Explicit
+  Stop/Pause still halts everything; resume through the recovery flow below.
 
 ## Rules
 
@@ -114,11 +121,14 @@ GNOME with Mixdog's own shell extension, which the app sets up); prefer accessib
 - Window pixels come only from a window-owned capture, never a sampled region
   of the shared desktop. If that surface is unavailable, use semantic refs or
   report `pixel_unavailable`; do not substitute a screen grab.
-- If the user intervenes, preserve their cursor and focus. Worker termination
-  and input cleanup must finish before resuming. The user's Resume on the
-  overlay continues a pause; an ordinary physical-input pause may also resume
-  after the host's configured quiet interval (renewed input resets it), while
-  explicit pauses, stops and uncertain cleanup never auto-resume. Stop (or
+- If the user's physical input interrupts an action, it fails alone with
+  `user_input_active` (input may have landed: capture fresh state, never replay,
+  no `wait_for_user`). Their cursor and focus stay theirs. Worker
+  termination and input cleanup must finish before resuming a pause. The user's
+  Resume on the overlay continues a pause; an unverified-recovery pause may
+  also resume after the host's configured quiet interval (renewed input resets
+  it), while explicit pauses, stops and uncertain cleanup never auto-resume.
+  Stop (or
   `Ctrl+Alt+Esc`) cancels the task, which then reports the stop as a failure.
   A cleanup that could not be confirmed is retried before the next input
   command; if it still fails, that command returns the reason — relay it to
@@ -222,6 +232,22 @@ refs still work.
 `type` text, optional `key` Enter → inspect the returned value. Use `verify`
 only if the result does not establish the required value or completion state.
 
+**Sign in inside the user's browser window** — prefer the session or SSO the
+browser already has, or Browser Use's saved sign-in. As a fallback, focus the
+login field (`act` click), then `saved_login` with `savedAccount` (username or
+masked label) and `field` (`username` or `password`). The host writes it only
+into that field of a verified Chrome/Edge HTTPS page whose origin has
+the login (separate checks, then one write: not atomic inside the browser).
+The site receives it. The password is the protected value: it is kept out of
+your results and that browser's pixels are withheld until this turn ends
+(`ax` reads still work), but a page that redisplays it can expose it, and other
+programs of the same Windows user are outside this protection. A username is
+an identifier and is not hidden. Continue with keys (`act` key Enter). On a
+refusal, hand the secret to the user (`handoff_user` kind `secret`,
+surface `computer`); one-time codes, passkeys, security keys and app approvals
+are the user's step (`handoff_user` kind `takeover`). Never type a password or
+code with `type`/`set_value`, even one shown on screen.
+
 **Keyboard-driven navigation** — `act` with `key` steps such as `ctrl+s`
 and a trailing short `wait`; verify with `verify` rather than another capture.
 `alt+f4` is blocked in every delivery mode. To close a window, obtain the

package/src/defaults/skills/setup/SKILL.md

@@ -63,6 +63,28 @@ that a call returned without transport error.
 - Read `references/surfaces.md` only when the user asks where a setting lives,
   a secret must be entered, or no setup mutation exists.
 
+## What applies now vs. later
+
+- Now: built-in, connector, permission, hook-rule, cache-warming and
+  automation changes (each at its next use), and a fallback chain: running
+  sessions on that route read it at their next hop.
+- Next turn: an agent/bot route for its open chats, `reset_route_fallback`, a
+  workflow switch. A running turn finishes on its current model.
+- New sessions: the Main model (`set_route` model), instruction files, most
+  other settings. An established conversation keeps its model.
+- Session actions (`reset_route_fallback`, quota resume, `continue_in_model`)
+  answer `scope: "session"`, not a saved setting.
+
+## Stopping something already running
+
+Setup changes settings; it does not stop work. Use the tool that owns it:
+`session` `cancel` (another session's turn, a routine run in a bot's chat, a
+group room's exchange; a Browser/Computer takeover ends with its turn),
+`agent` `cancel`/`close` (sub-agents), `task` (background shell jobs), `goal`
+`pause` (an active Goal, at the user's request). Setup only prevents more: `set_automation_enabled false`
+(future routine runs), `fallbacks: []` (further hops), `cancel_quota_resume`,
+`set_builtin_enabled` browser/computer off.
+
 ## High-signal distinctions
 
 - Main model, agent models, and Web Search model are separate routes. Omitted

package/src/defaults/skills/setup/references/actions.md

@@ -52,7 +52,8 @@ Read this when choosing a `setup` mutation.
 | Permanently delete confirmed, unchanged, unused model files | `delete_local_model` |
 | TUI system shell | `set_system_shell` |
 | Automatic updates | `set_auto_update` |
-| Mixy's heartbeat: a check every 30 minutes that wakes her only when something needs attention (on by default; `status features` reports `heartbeat.enabled`) | `set_heartbeat_enabled` |
+| Mixy's heartbeat: a regular check that wakes her only when something needs attention and only after the user had no operation for 30 minutes (no sent turn, no keyboard/mouse/wheel input in the desktop app's windows) (on by default; `status features` reports `heartbeat.enabled` and `heartbeat.intervalMinutes`) | `set_heartbeat_enabled` |
+| How often the heartbeat checks: `minutes` 30, 60 (default), 120 or 240; applies from the next tick, counted from the last check | `set_heartbeat_interval` |
 | Bots' emoji reactions on the user's messages (on by default; `status features` reports `reactions.enabled`) | `set_reactions_enabled` |
 | Worktree defaults: new tasks on the current branch or a new worktree, branch prefix, large-repository warning size, automatic cleanup | `set_worktree_settings` |
 | Remove stored provider authentication (one OAuth account at a time, or an API-key provider's key) | `forget_provider_auth` |
@@ -94,6 +95,17 @@ Read this when choosing a `setup` mutation.
 | Unregister a Project without deleting its files | `remove_project` |
 | Revoke one linked device by its client id from `status connection`; re-pairing restores access | `revoke_linked_device` |
 | Managed local model context allocation; null restores automatic | `set_local_context` |
+| Return a session that fell back (this one by default, `sessionId`, or every chat of a bot with `agent`) to its primary route and chain | `reset_route_fallback` |
+| Switch a session whose last turn stopped on a usage limit onto another model (`sessionId`, `route`) | `continue_in_model` |
+| Resend a usage-limit-stopped turn of a session at its reset time, or drop that pending resume | `schedule_quota_resume`, `cancel_quota_resume` |
+| Prompt-cache warming on/off (`status compaction` `promptCacheWarming`) | `set_cache_warming_enabled` |
+| Read an agent's action permissions, connector switches and always-allowed tools | `read_agent_settings` |
+| Read a Project's connector switches | `read_project_connectors` |
+| An agent's action permission (block/ask per action kind) | `set_agent_permission` |
+| Switch a connector off for an agent / a Project (switching it back on is done in the desktop app) | `set_agent_connector`, `set_project_connector` |
+| One connector tool of an agent to needs_approval or disabled | `set_agent_connector_tool` |
+| Bring back an archived bot or agent (`definitionKind: "agent"`) | `restore_definition` |
+| Bot display order (Bots page, Sessions bot section; `status agents` `botOrder`) | `set_bot_order` |
 
 ## Routes and workflow
 
@@ -131,10 +143,22 @@ workflow` before changing the corresponding domain.
 - Changing orchestration does not rewrite workflow instructions or agents.
 - `set_route` is the Lead default for new sessions. A model chosen in New Task
   changes that default only when the user actually picks one there.
-  `route.fallbacks` (ordered models on other providers; `[]` clears) works the
-  same on `set_route` (Lead), `set_agent_route` (agents and bots, Mixy included)
-  and `set_web_search_route`. `status model` returns `route.autoEffort` and
-  `route.fallbacks`.
+  `route.fallbacks` (ordered models, each on a different provider from the
+  primary and the others; `[]` clears) works the same on `set_route` (Lead),
+  `set_agent_route` (agents and bots, Mixy included) and `set_web_search_route`.
+  Running sessions on that route read the chain at their next hop: an edit
+  applies at once, and `[]` stops further hops, so the turn ends with the
+  provider's own limit error. A session on another model follows no chain.
+  `status model` returns `route.autoEffort`, `route.fallbacks`, and the
+  position of this conversation (`session`) and other Lead conversations
+  (`sessions`): `current` vs `primary`, `onPrimary`, `fallbackIndex`, the
+  `fallbacks` it follows now, `next`, and `failures` (why it left each model);
+  `status agents` `sessions` gives the same for bot chats and sub-agents. A
+  session that fell back stays there until `reset_route_fallback` returns it
+  to its primary from its next turn (chain restarted).
+- Session actions on another session need the Mixdog app or daemon to host
+  it; a bot's thread reaches only its own bot's sessions. `continue_in_model`
+  does not resend the stopped turn: the user resumes it there.
 - A workflow switch reaches a running conversation as a reminder on its next
   turn (the cached prompt is not swapped). A bot definition's instruction,
   persona or name applies when the user presses 적용, with one cache break.
@@ -319,6 +343,13 @@ markers are read with `status desktop`.
   dialog in Desktop; nothing connects until the user presses it, so tell them to press the card and read
   `status mcp` afterwards. `add_mcp_server` with the service URL is not the
   sign-in flow; never use it for a catalog service.
+- Agent permissions and connector switches change only toward less: `block`
+  or `ask`, a connector off, a tool to `needs_approval`/`disabled`. Anything
+  that lets an agent do more without asking (`allow`, a connector back on, a
+  tool to `auto`) is refused ("make it on the desktop"); `open agents` and let
+  the person do it. Payments and permanent deletes always ask regardless.
+  Connector ids are MCP server names from `read_agent_settings`; a bot's
+  thread changes only its own bot.
 - `enable_plugin_mcp` turns every server the plugin declares back on and
   reconnects them; a disabled plugin stays disabled, and it fails for a plugin
   that declares no MCP servers.
@@ -354,6 +385,9 @@ markers are read with `status desktop`.
 - Inspect schedules/webhooks before editing. `overwrite:true` updates an
   existing named entry and preserves omitted fields; a new schedule needs
   instructions and exactly one of cron `time` or one-shot `at`.
+- Routine instructions say what to check and report; add a reply format only
+  when the user asks. Never add a "nothing new" line ("say 변동 없음"): a run
+  with nothing to tell stays silent on its own.
 - Attachment contents and webhook signing secrets are not returned by setup.
   Omitted attachments and existing webhook secrets are preserved. A saved
   secret is never shown again: tell the user to open the Webhooks panel, edit

package/src/defaults/skills/setup/references/surfaces.md

@@ -116,7 +116,8 @@ The setup tool does not mutate:
   it on; `set_developer_option` can turn it off);
 - custom provider registration and edits (non-secret fields included), group
   room options, bot persona and avatar, import conversations, reset overlay
-  position, SSH and remote-access settings, sidebar/list ordering and other
+  position, SSH and remote-access settings, sidebar/list ordering (except bot order,
+  `set_bot_order`) and other
   per-device view state;
 - MCP server OAuth sign-in and sign-out (Desktop MCP list/editor, TUI
   `/mcp login` and `/mcp logout`; remote windows paste the redirect address);
@@ -131,7 +132,15 @@ The setup tool does not mutate:
 - approval grants ("항상 허용" is per feature and per bot, never for payment,
   permanent delete, Lead, workflow, Mixy link, group rooms or schedules) and
   browser action confirmations (`MIXDOG_BROWSER_CONFIRM_ACTIONS`,
-  `MIXDOG_BROWSER_CONFIRM_SUBMIT`; see the browser-use skill).
+  `MIXDOG_BROWSER_CONFIRM_SUBMIT`; see the browser-use skill);
+- widening an agent's authority: action permission `allow`, a connector
+  switched back on for an agent or Project, a connector tool to `auto`
+  (setup only narrows them);
+- the remote-access switch ("Use this PC from other devices") and this PC's
+  name: turning it off from a phone would cut that phone off mid-session;
+- permanently deleting an archived bot (Sessions → Archived → delete);
+- the stopped turn's Resume after `continue_in_model`, and the quota card's
+  other-account switch.
 
 Use `open` where a target exists, then let the user act.
 

package/src/defaults/skills/visualize/SKILL.md

@@ -120,7 +120,8 @@ or radius are one option.
 - Close tabs that no longer match the conversation (a resolved choice, a
   replaced draft) so the user is never looking at stale work.
 - A web URL is opened alone, never mixed with files; marking, capturing, or
-  closing a web page belongs to `browser`.
+  closing a web page belongs to `browser`. `open` of a URL reports the
+  page id (`p…`); pass it as `browser`'s `tab`.
 - `annotate` and `capture` need the tab on screen (`export` of an HTML page does not). When they report the panel
   is hidden, tell the user to open it rather than retrying.
 - When `visualize` is unavailable, give the file path; never start your own

package/src/lib/rules-builder.cjs

@@ -126,7 +126,10 @@ function buildProfilePreferencesContent(dataDir) {
   return lines.length ? `# Profile Preferences\n\n${lines.join('\n')}` : '';
 }
 
-function buildLanguageSection(dataDir) {
+// `sharedFormatActive`: the prompt carries the shared Output Format partial,
+// which already keeps literals verbatim (common.md), so the language block
+// need not repeat it.
+function buildLanguageSection(dataDir, sharedFormatActive = false) {
   const profile = normalizeProfileConfig(readAgentConfig(dataDir).profile);
   const language = profileLanguagePrompt(profile.language);
   if (!language?.prompt) return '';
@@ -139,7 +142,7 @@ function buildLanguageSection(dataDir) {
   // mistranslate, so the two clauses would be dead text.
   if (language.prompt !== 'English') {
     lines.push(
-      `- Preserve identifiers, paths, commands, API names, and exact errors. Keep technical terms in their established form, usually the original English (blocker, cache, commit); add a short plain explanation only when the reader may not know it. Never invent a literal translation.`
+      `- ${sharedFormatActive ? '' : 'Preserve identifiers, paths, commands, API names, and exact errors. '}Keep technical terms in their established form, usually the original English (blocker, cache, commit); add a short plain explanation only when the reader may not know it. Never invent a literal translation.`
     );
   }
   return `# Language\n\n${lines.join('\n')}`;
@@ -153,7 +156,9 @@ function stripFrontmatter(markdown) {
 
 // Tool dependency is declared as metadata, not matched against prose. A
 // `<!-- tools: a, b -->` marker binds the block that follows it: the block
-// survives while any listed tool is permitted by the allow/deny policy.
+// survives while any listed tool is permitted by the allow/deny policy. The
+// pseudo-entry `lead` is not a tool: it is permitted for every non-agent
+// session (whatever its tool profile) and never for an agent-owned one.
 // Unspecified allowlists are unrestricted. Markers never reach the model.
 const TOOL_MARKER_RE = /^[ \t]*<!--[ \t]*tools:[ \t]*([^>]*?)[ \t]*-->[ \t]*$/;
 
@@ -188,9 +193,10 @@ function omitKeySet(omitTools) {
 }
 
 /** Drop routing clauses for tools that are not on the session surface. */
-function omitToolRoutes(text, omitTools = [], allowTools = null) {
+function omitToolRoutes(text, omitTools = [], allowTools = null, ownerIsAgent = false) {
   const deny = omitKeySet(omitTools);
   const allow = Array.isArray(allowTools) ? omitKeySet(allowTools) : null;
+  const permitted = (name) => (name === 'lead' ? !ownerIsAgent : !deny.has(name) && (!allow || allow.has(name)));
   const lines = String(text || '').split(/\r?\n/);
   const kept = [];
   let index = 0;
@@ -204,7 +210,7 @@ function omitToolRoutes(text, omitTools = [], allowTools = null) {
     index += 1;
     if (index >= lines.length) break;
     const end = markedBlockEnd(lines, index);
-    if (!tools.length || tools.some((name) => !deny.has(name) && (!allow || allow.has(name)))) {
+    if (!tools.length || tools.some(permitted)) {
       kept.push(...lines.slice(index, end));
     }
     index = end;
@@ -252,22 +258,29 @@ function readSharedFormatPartial({ PLUGIN_ROOT, DATA_DIR }) {
   );
 }
 
-function loadOutputStyle({ PLUGIN_ROOT, DATA_DIR }) {
+function resolveOutputStyle({ PLUGIN_ROOT, DATA_DIR }) {
   // Root `outputStyle` is the only configured location; the retired
   // `agent.outputStyle` key is dropped by config canonicalization.
   const configured = String(readUnifiedConfig(DATA_DIR).outputStyle || '').trim() || DEFAULT_OUTPUT_STYLE_ID;
   const styles = listOutputStyleEntries({ PLUGIN_ROOT, DATA_DIR });
   const style = matchOutputStyle(configured, styles) || matchOutputStyle(DEFAULT_OUTPUT_STYLE_ID, styles) || styles[0];
-  if (!style) return '';
+  if (!style) return null;
   const selected = stripFrontmatter(style.raw);
-  if (!selected) return '';
+  if (!selected) return null;
   const common = style.keepSharedFormat ? readSharedFormatPartial({ PLUGIN_ROOT, DATA_DIR }) : '';
+  return { style, selected, common };
+}
+
+function loadOutputStyle(paths) {
+  const resolved = resolveOutputStyle(paths);
+  if (!resolved) return '';
+  const { style, selected, common } = resolved;
   return [`# Output Style: ${style.label}`, OUTPUT_STYLE_ANCHOR, common, selected].filter(Boolean).join('\n\n');
 }
 
-function buildSharedToolContent({ PLUGIN_ROOT, omitTools = [], allowTools = null } = {}) {
+function buildSharedToolContent({ PLUGIN_ROOT, omitTools = [], allowTools = null, ownerIsAgent = false } = {}) {
   const SHARED_DIR = path.join(PLUGIN_ROOT, 'rules', 'shared');
-  return omitToolRoutes(readMarkdownDirectory(SHARED_DIR), omitTools, allowTools);
+  return omitToolRoutes(readMarkdownDirectory(SHARED_DIR), omitTools, allowTools, ownerIsAgent);
 }
 
 // Route policy: `rules/routes/*.md` files bound to a provider and/or model
@@ -369,16 +382,18 @@ function buildRouteRulesContent({
 // - `identity`: the coding identity sentence ("You are Mixdog, …").
 const LEAD_IDENTITY_LINE = /^- (You are Mixdog, a coding agent\.)\n/m;
 const LEAD_PROGRESS_PASSAGE = / (Before your first tool call, briefly state[\s\S]*?narration or plan repeats\.)/;
-const LEAD_REPORT_PASSAGE = / (On an agent report, review its diff[\s\S]*?not a completed request\.)/;
+const LEAD_REPORT_PASSAGE = / (On an agent report[\s\S]*?not a completed request\.)/;
 const AGENT_MODE_PROGRESS =
-  '- Just answer conversation. Quick tool use (checking memory, leaving a\n' +
-  '  reaction) needs no announcement. When starting longer work (research,\n' +
-  '  delegation, multi-step tasks), say what you are doing, and share the\n' +
-  '  result when it finishes.';
+  '- Just answer conversation. Quick tool use (checking memory, a lookup,\n' +
+  '  leaving a reaction) needs no announcement. When starting longer work\n' +
+  '  (research, delegation, multi-step tasks), say in one line what you are\n' +
+  '  doing, stay quiet between tool calls, and share the result when it\n' +
+  '  finishes.';
 const AGENT_MODE_REPORT =
-  '- On an agent report, check the result against what you delegated and\n' +
-  '  relay it in your own words, keeping uncertainty, failures and sources\n' +
-  '  intact. Review a diff only when you delegated code.';
+  '- Relay agent reports faithfully. Code: one fresh Reviewer per non-trivial\n' +
+  '  feature after its last worker, any author (Lead if none); docs/copy/style:\n' +
+  '  read the diff. Recheck only fixes; at request end check feature seams and\n' +
+  '  run affected suites once.';
 
 function buildLeadRoleContent({ PLUGIN_ROOT, includeLeadBrief = true, part = 'common' }) {
   const RULES_DIR = path.join(PLUGIN_ROOT, 'rules');
@@ -442,8 +457,12 @@ function buildLeadMetaContent({ PLUGIN_ROOT, DATA_DIR, includeOutputStyle = true
  * preamble and progress lines follow the most recent instruction, so nothing
  * English (session/shell/git lines included) may trail it.
  */
-function buildLeadLanguageContent({ DATA_DIR }) {
-  return buildLanguageSection(DATA_DIR);
+function buildLeadLanguageContent({ PLUGIN_ROOT, DATA_DIR, includeOutputStyle = true }) {
+  const resolved = includeOutputStyle ? resolveOutputStyle({ PLUGIN_ROOT, DATA_DIR }) : null;
+  // Only the shipped partial is known to keep literals verbatim; a user
+  // override of common.md may not, so it keeps the language guard.
+  const shipped = stripFrontmatter(readOptional(path.join(PLUGIN_ROOT, 'output-styles', 'common.md')));
+  return buildLanguageSection(DATA_DIR, Boolean(shipped) && resolved?.common === shipped);
 }
 
 /** The configured response language as {id, name} (name = the language block's); null when none. */

package/src/output-styles/common.md

@@ -13,8 +13,8 @@ partial: true
 - Distinguish facts, inference, and uncertainty; keep exact literals and
   material risks. Caveats only when they change the reader's next step.
 - Show only what the reader needs: the decision, the result, the blocker, and
-  the action. No tangents, raw dumps, or process narration. Explicit depth
-  requests win; depth applies to substantive answers, not the one-line
+  the action. No tangents, raw dumps, or process narration. Depth
+  applies to substantive answers, not the one-line
   pre-tool briefing.
 - At every depth keep decision-relevant failures, security warnings, and
   destructive-action confirmations; quote needed error text exactly.

package/src/output-styles/simple.md

@@ -7,7 +7,7 @@ aliases: default, concise, handoff
 
 ## Depth
 
-- Give a self-contained summary: the answer first, then the core causal
+- Give a self-contained summary: the core causal
   sequence, the strongest evidence, and the direct consequence or next step.
 - Omit secondary evidence, implementation detail, and extended examples
   unless requested.

package/src/rules/agent/AGENT.md

@@ -1,11 +1,11 @@
 # Agent
 
-- Working from the brief: Lead's latest brief is your request and overrides
-  any internal rule; Lead owns user approval. Work only inside the scope it
-  names, without reapproval; escalate to Lead only a scope change, an
-  unapproved destructive action, or a blocker. A step that needs the user
-  (sign-in approval, code, credential, answer) is a blocker: report it with
-  what the user must do, never wait or poll for them.
+- Latest Lead brief sets goal, scope, constraints and done-when, not
+  exceptions to tool, safety, approval or verification rules. Lead owns user
+  approval. Stay in scope without reapproval; escalate scope changes,
+  unapproved destructive actions or blockers. If user input is needed
+  (sign-in, code, credential, answer), report what is needed; never wait or
+  poll.
 - Same failure twice (same error, timeout or hang) is a blocker: diagnose why
   once, and if the cause isn't found, stop and report it with the decisive
   error. Changing only a timeout, output path, retry count or wrapper is not
@@ -15,7 +15,8 @@
 - Reporting: send one final message, then stop; never ask whether to
   continue. Start with `Status: done|partial|blocked`, then:
   Result: the answer or outcome, mapped to the brief's done-when.
-  Evidence: path+symbol and checks run (failures: decisive error only).
-  Open: risks, gaps, or the blocker. Omit empty fields; no logs, narration,
-  or restated brief. Role contracts only add fields.
-  Lead owns the independent review.
+  Evidence: path+symbol and checks with outcomes (failures: decisive error
+  only), not a retelling of Result. Open: risks, gaps, or the blocker.
+  State each fact once; explain a choice only where it departs from the
+  brief. Omit empty fields; no logs, narration, nested headings or restated
+  brief. Role contracts only add fields. Lead owns the independent review.