mixdog 1.4.0 → 1.4.2

package/src/defaults/skills/test-suite/scripts/inventory.mjs

@@ -0,0 +1,335 @@
+#!/usr/bin/env node
+// Read-only inventory of a project's test files across JS/TS, Python, Go and
+// Rust: lane, area, risk markers and skip records. Prints Markdown, or JSON
+// with --json. Never writes files, never follows links, never runs anything.
+import { closeSync, openSync, readSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  '.hg',
+  '.svn',
+  'dist',
+  'out',
+  'build',
+  'target',
+  'vendor',
+  'third_party',
+  'venv',
+  '.venv',
+  'site-packages',
+  '__pycache__',
+  '.tox',
+  '.nox',
+  '.mypy_cache',
+  '.pytest_cache',
+  '.ruff_cache',
+  '.next',
+  '.nuxt',
+  '.turbo',
+  '.cache',
+  '.runtime',
+  'coverage',
+  '.gradle',
+]);
+const MAX_FILES = 20_000;
+const MAX_DIRS = 50_000;
+const MAX_DEPTH = 40;
+const MAX_BYTES = 1 << 20;
+const LIST_LIMIT = 200;
+
+const JS_EXT = '(?:m?[jt]s|c[jt]s|[jt]sx)';
+const JS_TEST = new RegExp(`(?:\\.(?:test|spec)\\.${JS_EXT}|-test\\.m?js)$`);
+const JS_FILE = new RegExp(`\\.${JS_EXT}$`);
+const TYPES_FILE = /\.d\.[cm]?ts$/;
+const RUST_TEST = /#\[\s*(?:cfg\(\s*test\s*\)|test|tokio::test|rstest)\b/;
+
+// `skip: cond && 'reason'` keeps the reason after the last `&&`.
+const JS_SKIP_REASON = /\bskip\s*(?::|\()\s*(?:[^\n]*?&&\s*)?(['"`])((?:(?!\1).)*)\1/g;
+const JS_SKIP_BARE = /\b(?:(?:it|test|describe)\.skip|x(?:it|test|describe))\b|\.skip\s*\(\s*\)|\bskip\s*:\s*true\b/;
+const JS_SKIP_IF = /\.skipIf\s*\(/;
+const PY_SKIP =
+  /\b(?:pytest\.mark\.(skipif|skip|xfail)|unittest\.(skipIf|skipUnless|skip|expectedFailure)|pytest\.(importorskip|skip))\b/;
+const PY_CONDITIONAL = new Set(['skipif', 'skipIf', 'skipUnless', 'importorskip']);
+const GO_SKIP = /\.Skip(?:f|Now)?\s*\(/;
+const RUST_IGNORE = /#\[\s*ignore\s*(?:=\s*(['"])((?:(?!\1).)*)\1)?\s*(?:\(.*?\))?\s*\]/;
+const RUST_CFG_IGNORE = /#\[\s*cfg_attr\([^\]]*\bignore\b/;
+
+const LANGS = {
+  js: {
+    comment: '//',
+    fake: /mock\.timers\.enable|useFakeTimers|installFakeClock|vi\.setSystemTime|jest\.setSystemTime/,
+    markers: {
+      timer: /\b(setTimeout|setInterval|sleep|delay)\s*\(/,
+      spawn: /\b(spawn|spawnSync|execFile|execFileSync|execSync|fork)\s*\(/,
+      port: /\.listen\(\s*[1-9]\d{2,4}\b/,
+      clock: /Date\.now\(\)|new Date\(\s*\)/,
+      'source-text': /readFile(Sync)?\([^)]*\.(m?js|tsx?|jsx)['"`]/,
+    },
+  },
+  python: {
+    comment: '#',
+    fake: /freezegun|freeze_time|time_machine|time-machine|monkeypatch\.setattr\([^)]*time|mock\.patch\([^)]*time/,
+    markers: {
+      timer: /\b(?:time|asyncio)\.sleep\(|\bsleep\(/,
+      spawn:
+        /\bsubprocess\.(?:run|Popen|call|check_output|check_call)\(|\bos\.(?:system|popen)\(|\bmultiprocessing\.Process\(/,
+      port: /\.bind\(\s*\([^)]*,\s*[1-9]\d{2,4}\s*\)|\bport\s*=\s*[1-9]\d{3,4}\b/,
+      clock: /\bdatetime\.(?:now|utcnow)\(|\bdate\.today\(|\btime\.time\(\)/,
+      'source-text': /inspect\.getsource\(|(?:open|Path)\(\s*['"][^'"]*\.(?:py|js|ts)['"]/,
+    },
+  },
+  go: {
+    comment: '//',
+    fake: /clockwork|benbjohnson\/clock|synctest/,
+    markers: {
+      timer: /\btime\.(?:Sleep|After|NewTimer|NewTicker|Tick)\(/,
+      spawn: /\bexec\.Command(?:Context)?\(/,
+      port: /(?:net\.Listen|ListenAndServe)\(\s*(?:"tcp[46]?"\s*,\s*)?"[^"]*:[1-9]\d{2,4}"/,
+      clock: /\btime\.Now\(\)/,
+      'source-text': /os\.ReadFile\(\s*"[^"]*\.go"|parser\.ParseFile\(/,
+    },
+  },
+  rust: {
+    comment: '//',
+    fake: /tokio::time::pause|start_paused/,
+    markers: {
+      timer: /\bsleep\(/,
+      spawn: /\b(?:std::)?process::Command\b|\bCommand::new\(/,
+      port: /\bbind\(\s*"[^"]*:[1-9]\d{2,4}"/,
+      clock: /\b(?:SystemTime|Instant|Utc|Local)::now\(\)/,
+      'source-text': /include_str!\([^)]*\.rs"|read_to_string\([^)]*\.rs"/,
+    },
+  },
+};
+
+// A reason naming a missing capability of the host (platform, privilege,
+// tool, build) is a capability skip; anything else reads as a defect skip.
+const CAPABILITY =
+  /\bonly\b|unavailable|unsupported|not (available|permitted|enforced|built|supported|configured|granted|installed)|requires?\b|needs?\b|missing|denied|refused|does not (support|grant|allow)|insensitive|not found|has no|not run on|\bno local\b|\bno display\b|\bposix\b|\bno [\w ]+ (available|configured|is configured|installed)|\bnot on (the )?path\b|\bno [\w-]+ on this (host|machine|platform|runner)|\(\s*(?:e\.g\.|i\.e\.),?\s*running as (?:root|administrator|an? \w+ user)\s*\)|\bskip(?:ped)? (?:when|if|as|under) running as (?:root|administrator|an? \w+ user)\b|\b(?:is|are) an? (?:windows|posix|linux|macos|unix)[- ](?:behaviou?r|feature|semantics)\b/i;
+const TRACKED = /#\d+/;
+const UNTIL = /until (\d{4}-\d{2}-\d{2})/;
+
+export function laneOf(file) {
+  const tag = /\.(slow|live|electron|e2e|integration)\.(?:test|spec)\./.exec(file);
+  return tag ? tag[1] : 'fast';
+}
+
+export function areaOf(rel) {
+  const dirs = rel.split(sep).join('/').split('/').slice(0, -1);
+  if (dirs[0] === 'src') dirs.shift();
+  return dirs.slice(0, 2).join('/') || '.';
+}
+
+// Returns 'js' | 'python' | 'go' | 'rust' | 'rust?' (a .rs file whose text decides) | null.
+function langOf(rel, name) {
+  if (JS_FILE.test(name) && !TYPES_FILE.test(name) && (JS_TEST.test(name) || `/${rel}`.includes('/__tests__/')))
+    return 'js';
+  if (/^test_.+\.py$|_test\.py$/.test(name)) return 'python';
+  if (name.endsWith('_test.go')) return 'go';
+  if (name.endsWith('.rs')) return `/${rel}`.includes('/tests/') ? 'rust' : 'rust?';
+  return null;
+}
+
+// Links are never followed: a dangling or looping link cannot break the walk.
+function walk(root) {
+  const found = [];
+  let dirs = 0;
+  const visit = (dir, depth) => {
+    if (depth > MAX_DEPTH)
+      throw new Error(`directories nested deeper than ${MAX_DEPTH} under ${root}; narrow the root`);
+    if (++dirs > MAX_DIRS) throw new Error(`more than ${MAX_DIRS} directories under ${root}; narrow the root`);
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) visit(full, depth + 1);
+      } else if (entry.isFile()) {
+        const rel = relative(root, full).split(sep).join('/');
+        const lang = langOf(rel, entry.name);
+        if (!lang) continue;
+        found.push({ full, rel, lang });
+        if (found.length > MAX_FILES)
+          throw new Error(`more than ${MAX_FILES} test files under ${root}; narrow the root`);
+      }
+    }
+  };
+  visit(root, 0);
+  return found;
+}
+
+function readHead(path) {
+  const fd = openSync(path, 'r');
+  try {
+    const buffer = Buffer.alloc(Math.min(statSync(path).size, MAX_BYTES));
+    const length = readSync(fd, buffer, 0, buffer.length, 0);
+    return buffer.toString('utf8', 0, length);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+// The call's text from `from` to its closing parenthesis, across up to 6 lines.
+function callText(lines, index, from) {
+  let text = lines[index].slice(from);
+  for (let next = index + 1; next < Math.min(lines.length, index + 6); next += 1) {
+    const open = (text.match(/\(/g) || []).length;
+    if (open > 0 && (text.match(/\)/g) || []).length >= open) break;
+    text += ` ${lines[next].trim()}`;
+  }
+  return text;
+}
+
+function skipSites(lines, lang) {
+  const sites = [];
+  lines.forEach((line, index) => {
+    const add = (reason, conditional) => sites.push({ index, reason, conditional });
+    if (lang === 'js') {
+      const reasons = [...line.matchAll(JS_SKIP_REASON)];
+      for (const match of reasons) add(match[2], false);
+      if (!reasons.length) {
+        if (JS_SKIP_IF.test(line)) add('', true);
+        else if (JS_SKIP_BARE.test(line)) add('', false);
+      }
+    } else if (lang === 'python') {
+      const match = PY_SKIP.exec(line);
+      if (!match || /^\s*#/.test(line)) return;
+      const conditional = PY_CONDITIONAL.has(match[1] || match[2] || match[3]);
+      const call = callText(lines, index, match.index);
+      const keyword = /\breason\s*=\s*(['"])((?:(?!\1).)*)\1/.exec(call);
+      const positional = conditional
+        ? /,\s*(['"])((?:(?!\1).)*)\1\s*\)?\s*$/.exec(call)
+        : /\(\s*(['"])((?:(?!\1).)*)\1/.exec(call);
+      add((keyword || positional)?.[2] || '', conditional);
+    } else if (lang === 'go') {
+      const match = GO_SKIP.exec(line);
+      if (match && !/^\s*\/\//.test(line))
+        add(/(['"`])((?:(?!\1).)*)\1/.exec(line.slice(match.index))?.[2] || '', false);
+    } else {
+      const match = RUST_IGNORE.exec(line);
+      if (match) add(match[2] || '', false);
+      else if (RUST_CFG_IGNORE.test(line)) add('', true);
+    }
+  });
+  return sites;
+}
+
+function commentOf(line, token) {
+  const at = line.indexOf(token);
+  return at < 0 ? '' : line.slice(at + token.length).trim();
+}
+
+function classify(reason, today, conditional) {
+  const until = UNTIL.exec(reason)?.[1] || '';
+  if (until && until < today) return 'expired';
+  if (TRACKED.test(reason)) return 'tracked';
+  if (!reason.trim()) return conditional ? 'capability' : 'untracked';
+  return CAPABILITY.test(reason) ? 'capability' : 'untracked';
+}
+
+export function scanText(text, today, lang = 'js') {
+  const spec = LANGS[lang];
+  const fakeClock = spec.fake.test(text);
+  const markers = Object.entries(spec.markers)
+    .filter(([name, pattern]) => pattern.test(text) && !(fakeClock && (name === 'timer' || name === 'clock')))
+    .map(([name]) => name);
+  const lines = text.split(/\r?\n/);
+  const skips = skipSites(lines, lang).map(({ index, reason, conditional }) => {
+    const before =
+      index > 0 && lines[index - 1].trim().startsWith(spec.comment) ? commentOf(lines[index - 1], spec.comment) : '';
+    const note = [commentOf(lines[index], spec.comment), before].filter(Boolean).join(' ');
+    const full = [reason, note].filter(Boolean).join(' ');
+    return { line: index + 1, reason: reason || note, kind: classify(full, today, conditional) };
+  });
+  return { markers, skips };
+}
+
+export function inventory(root, { today = new Date().toISOString().slice(0, 10) } = {}) {
+  if (!statSync(root, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${root}`);
+  const files = [];
+  for (const { full, rel, lang } of walk(root)) {
+    const text = readHead(full);
+    if (lang === 'rust?' && !RUST_TEST.test(text)) continue;
+    const language = lang === 'rust?' ? 'rust' : lang;
+    files.push({ file: rel, lang: language, lane: laneOf(rel), area: areaOf(rel), ...scanText(text, today, language) });
+  }
+  const areas = new Map();
+  for (const entry of files) {
+    const row = areas.get(entry.area) || {
+      area: entry.area,
+      files: 0,
+      fast: 0,
+      slow: 0,
+      other: 0,
+      langs: {},
+      markers: {},
+      skips: {},
+    };
+    row.files += 1;
+    if (entry.lane === 'fast') row.fast += 1;
+    else if (entry.lane === 'slow') row.slow += 1;
+    else row.other += 1;
+    row.langs[entry.lang] = (row.langs[entry.lang] || 0) + 1;
+    for (const marker of entry.markers) row.markers[marker] = (row.markers[marker] || 0) + 1;
+    for (const skip of entry.skips) row.skips[skip.kind] = (row.skips[skip.kind] || 0) + 1;
+    areas.set(entry.area, row);
+  }
+  const attention = files.flatMap((entry) =>
+    entry.skips.filter((skip) => skip.kind !== 'capability').map((skip) => ({ file: entry.file, ...skip }))
+  );
+  const fastRisk = files.filter(
+    (entry) => entry.lane === 'fast' && entry.markers.includes('timer') && entry.markers.includes('spawn')
+  );
+  return {
+    root,
+    today,
+    files: files.length,
+    areas: [...areas.values()].sort((a, b) => b.files - a.files || a.area.localeCompare(b.area)),
+    attentionTotal: attention.length,
+    attention: attention.slice(0, LIST_LIMIT),
+    fastRiskTotal: fastRisk.length,
+    fastRisk: fastRisk.slice(0, LIST_LIMIT).map((entry) => entry.file),
+  };
+}
+
+function markdown(report) {
+  const cell = (counts) =>
+    Object.entries(counts)
+      .map(([key, count]) => `${key} ${count}`)
+      .join(', ') || '-';
+  const more = (total, shown) => (total > shown ? [`- … ${total - shown} more (use --json)`] : []);
+  const out = [`# Test inventory: ${report.root}`, '', `${report.files} test files, ${report.today}.`, ''];
+  out.push('| Area | Files | Fast | Slow | Other | Languages | Markers | Skips |', '|---|---|---|---|---|---|---|---|');
+  for (const row of report.areas) {
+    out.push(
+      `| ${row.area} | ${row.files} | ${row.fast} | ${row.slow} | ${row.other} | ${cell(row.langs)} | ${cell(row.markers)} | ${cell(row.skips)} |`
+    );
+  }
+  out.push('', `## Skips needing action (${report.attentionTotal})`, '');
+  for (const item of report.attention)
+    out.push(`- ${item.kind}: \`${item.file}:${item.line}\` — ${item.reason || '(no reason)'}`);
+  out.push(...more(report.attentionTotal, report.attention.length));
+  out.push('', `## Fast-lane files with timers and real processes (${report.fastRiskTotal})`, '');
+  for (const file of report.fastRisk) out.push(`- \`${file}\``);
+  out.push(...more(report.fastRiskTotal, report.fastRisk.length));
+  return out.join('\n');
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] || '').href) {
+  const args = process.argv.slice(2);
+  const json = args.includes('--json');
+  const unknown = args.find((arg) => arg.startsWith('--') && arg !== '--json');
+  const root = args.find((arg) => !arg.startsWith('--'));
+  if (!root || unknown) {
+    console.error(`${unknown ? `unknown option ${unknown}; ` : ''}usage: inventory.mjs <project-root> [--json]`);
+    process.exit(2);
+  }
+  try {
+    const report = inventory(root);
+    console.log(json ? JSON.stringify(report, null, 2) : markdown(report));
+  } catch (error) {
+    console.error(`inventory: ${error.message}`);
+    process.exit(1);
+  }
+}

package/src/defaults/skills/visualize/SKILL.md

@@ -115,6 +115,10 @@ or radius are one option.
 - Open a result once, when it is ready to look at, not at every intermediate
   write. Long multi-step work shows the first reviewable state, then lets
   reloads carry the rest.
+- `open` shows the user a deliverable. To check your own work (`check`,
+  `inspect`, `capture`, `export`, before/after screenshots), `open` with
+  `verify: true`: the tab stays off the user's panel and chat and closes when
+  the turn ends. Opening the same target without it shows it.
 - Decks and documents: the panel shows the converted pages; still run the
   owning skill's own render review — the panel is for the user, not your QC.
 - Close tabs that no longer match the conversation (a resolved choice, a
@@ -129,8 +133,8 @@ or radius are one option.
 
 ### Inline content or a file
 - **Inline** (`open` with `input.content` — `mermaid`, `svg`, `chart` (an
-  ECharts option as JSON), `html`, `markdown`): diagrams, charts, quick
-  sketches and notes you will not edit again. No file is written. `mermaid`,
+  ECharts option as JSON), `html`, `markdown`): diagrams, charts and quick
+  sketches you will not edit again; never a report of your own work. No file is written. `mermaid`,
   `svg` and `markdown` are static, sanitized output (no scripts). `chart` is
   interactive (tooltips, zoom) and `html` runs its scripts, as in-memory pages
   held to the same rules as an HTML file: outside network is blocked, so an

package/src/lib/rules-builder.cjs

@@ -7,7 +7,6 @@
  *   - buildSharedToolContent            — BP1: shared tool policy
  *   - buildLeadRoleContent              — BP3: Lead role/system rules
  *   - buildAgentRoleContent             — BP3: agent role/system rules
- *   - buildAgentRetrievalInjectionContent — BP3: narrow read-only retrieval role
  *   - buildLeadMetaContent              — BP2: Lead profile/settings context
  *
  * 4-BP cache layout (composeSystemPrompt):
@@ -126,7 +125,10 @@ function buildProfilePreferencesContent(dataDir) {
   return lines.length ? `# Profile Preferences\n\n${lines.join('\n')}` : '';
 }
 
-function buildLanguageSection(dataDir) {
+// `sharedFormatActive`: the prompt carries the shared Output Format partial,
+// which already keeps literals verbatim (common.md), so the language block
+// need not repeat it.
+function buildLanguageSection(dataDir, sharedFormatActive = false) {
   const profile = normalizeProfileConfig(readAgentConfig(dataDir).profile);
   const language = profileLanguagePrompt(profile.language);
   if (!language?.prompt) return '';
@@ -139,7 +141,7 @@ function buildLanguageSection(dataDir) {
   // mistranslate, so the two clauses would be dead text.
   if (language.prompt !== 'English') {
     lines.push(
-      `- Preserve identifiers, paths, commands, API names, and exact errors. Keep technical terms in their established form, usually the original English (blocker, cache, commit); add a short plain explanation only when the reader may not know it. Never invent a literal translation.`
+      `- ${sharedFormatActive ? '' : 'Preserve identifiers, paths, commands, API names, and exact errors. '}Keep technical terms in their established form, usually the original English (blocker, cache, commit); add a short plain explanation only when the reader may not know it. Never invent a literal translation.`
     );
   }
   return `# Language\n\n${lines.join('\n')}`;
@@ -153,7 +155,9 @@ function stripFrontmatter(markdown) {
 
 // Tool dependency is declared as metadata, not matched against prose. A
 // `<!-- tools: a, b -->` marker binds the block that follows it: the block
-// survives while any listed tool is permitted by the allow/deny policy.
+// survives while any listed tool is permitted by the allow/deny policy. The
+// pseudo-entry `lead` is not a tool: it is permitted for every non-agent
+// session (whatever its tool profile) and never for an agent-owned one.
 // Unspecified allowlists are unrestricted. Markers never reach the model.
 const TOOL_MARKER_RE = /^[ \t]*<!--[ \t]*tools:[ \t]*([^>]*?)[ \t]*-->[ \t]*$/;
 
@@ -188,9 +192,10 @@ function omitKeySet(omitTools) {
 }
 
 /** Drop routing clauses for tools that are not on the session surface. */
-function omitToolRoutes(text, omitTools = [], allowTools = null) {
+function omitToolRoutes(text, omitTools = [], allowTools = null, ownerIsAgent = false) {
   const deny = omitKeySet(omitTools);
   const allow = Array.isArray(allowTools) ? omitKeySet(allowTools) : null;
+  const permitted = (name) => (name === 'lead' ? !ownerIsAgent : !deny.has(name) && (!allow || allow.has(name)));
   const lines = String(text || '').split(/\r?\n/);
   const kept = [];
   let index = 0;
@@ -204,7 +209,7 @@ function omitToolRoutes(text, omitTools = [], allowTools = null) {
     index += 1;
     if (index >= lines.length) break;
     const end = markedBlockEnd(lines, index);
-    if (!tools.length || tools.some((name) => !deny.has(name) && (!allow || allow.has(name)))) {
+    if (!tools.length || tools.some(permitted)) {
       kept.push(...lines.slice(index, end));
     }
     index = end;
@@ -252,22 +257,29 @@ function readSharedFormatPartial({ PLUGIN_ROOT, DATA_DIR }) {
   );
 }
 
-function loadOutputStyle({ PLUGIN_ROOT, DATA_DIR }) {
+function resolveOutputStyle({ PLUGIN_ROOT, DATA_DIR }) {
   // Root `outputStyle` is the only configured location; the retired
   // `agent.outputStyle` key is dropped by config canonicalization.
   const configured = String(readUnifiedConfig(DATA_DIR).outputStyle || '').trim() || DEFAULT_OUTPUT_STYLE_ID;
   const styles = listOutputStyleEntries({ PLUGIN_ROOT, DATA_DIR });
   const style = matchOutputStyle(configured, styles) || matchOutputStyle(DEFAULT_OUTPUT_STYLE_ID, styles) || styles[0];
-  if (!style) return '';
+  if (!style) return null;
   const selected = stripFrontmatter(style.raw);
-  if (!selected) return '';
+  if (!selected) return null;
   const common = style.keepSharedFormat ? readSharedFormatPartial({ PLUGIN_ROOT, DATA_DIR }) : '';
+  return { style, selected, common };
+}
+
+function loadOutputStyle(paths) {
+  const resolved = resolveOutputStyle(paths);
+  if (!resolved) return '';
+  const { style, selected, common } = resolved;
   return [`# Output Style: ${style.label}`, OUTPUT_STYLE_ANCHOR, common, selected].filter(Boolean).join('\n\n');
 }
 
-function buildSharedToolContent({ PLUGIN_ROOT, omitTools = [], allowTools = null } = {}) {
+function buildSharedToolContent({ PLUGIN_ROOT, omitTools = [], allowTools = null, ownerIsAgent = false } = {}) {
   const SHARED_DIR = path.join(PLUGIN_ROOT, 'rules', 'shared');
-  return omitToolRoutes(readMarkdownDirectory(SHARED_DIR), omitTools, allowTools);
+  return omitToolRoutes(readMarkdownDirectory(SHARED_DIR), omitTools, allowTools, ownerIsAgent);
 }
 
 // Route policy: `rules/routes/*.md` files bound to a provider and/or model
@@ -369,7 +381,8 @@ function buildRouteRulesContent({
 // - `identity`: the coding identity sentence ("You are Mixdog, …").
 const LEAD_IDENTITY_LINE = /^- (You are Mixdog, a coding agent\.)\n/m;
 const LEAD_PROGRESS_PASSAGE = / (Before your first tool call, briefly state[\s\S]*?narration or plan repeats\.)/;
-const LEAD_REPORT_PASSAGE = / (On an agent report[\s\S]*?not a completed request\.)/;
+// Word gaps are \s+ so rewrapping LEAD.md cannot silently unmatch a passage.
+const LEAD_REPORT_PASSAGE = / (On\s+an\s+agent\s+report[\s\S]*?not\s+a\s+completed\s+request\.)/;
 const AGENT_MODE_PROGRESS =
   '- Just answer conversation. Quick tool use (checking memory, a lookup,\n' +
   '  leaving a reaction) needs no announcement. When starting longer work\n' +
@@ -379,8 +392,8 @@ const AGENT_MODE_PROGRESS =
 const AGENT_MODE_REPORT =
   '- Relay agent reports faithfully. Code: one fresh Reviewer per non-trivial\n' +
   '  feature after its last worker, any author (Lead if none); docs/copy/style:\n' +
-  '  read the diff. Recheck only fixes; at request end check feature seams and\n' +
-  '  run affected suites once.';
+  '  read the diff. Recheck only concrete fixes, never rerun passing checks\n' +
+  '  without new evidence; at request end check feature seams.';
 
 function buildLeadRoleContent({ PLUGIN_ROOT, includeLeadBrief = true, part = 'common' }) {
   const RULES_DIR = path.join(PLUGIN_ROOT, 'rules');
@@ -444,8 +457,12 @@ function buildLeadMetaContent({ PLUGIN_ROOT, DATA_DIR, includeOutputStyle = true
  * preamble and progress lines follow the most recent instruction, so nothing
  * English (session/shell/git lines included) may trail it.
  */
-function buildLeadLanguageContent({ DATA_DIR }) {
-  return buildLanguageSection(DATA_DIR);
+function buildLeadLanguageContent({ PLUGIN_ROOT, DATA_DIR, includeOutputStyle = true }) {
+  const resolved = includeOutputStyle ? resolveOutputStyle({ PLUGIN_ROOT, DATA_DIR }) : null;
+  // Only the shipped partial is known to keep literals verbatim; a user
+  // override of common.md may not, so it keeps the language guard.
+  const shipped = stripFrontmatter(readOptional(path.join(PLUGIN_ROOT, 'output-styles', 'common.md')));
+  return buildLanguageSection(DATA_DIR, Boolean(shipped) && resolved?.common === shipped);
 }
 
 /** The configured response language as {id, name} (name = the language block's); null when none. */
@@ -455,31 +472,8 @@ function buildLeadLanguage({ DATA_DIR }) {
   return language?.prompt ? { id: language.id, name: language.prompt } : null;
 }
 
-function buildAgentRoleContent({ PLUGIN_ROOT, profile = 'full' }) {
-  const AGENT_DIR = path.join(PLUGIN_ROOT, 'rules', 'agent');
-  if (String(profile || 'full') === 'retrieval') {
-    return buildAgentRetrievalInjectionContent({ PLUGIN_ROOT });
-  }
-  return readOptional(path.join(AGENT_DIR, 'AGENT.md'));
-}
-
-/**
- * BP3 role rules for narrow hidden retrieval roles. These roles already carry a separate
- * read-only tool schema shard, so keeping the full agent worker prefix does
- * not improve cross-role cache reuse and only adds unrelated shell/edit/git
- * guidance.
- *
- * @returns {string}
- */
-function buildAgentRetrievalInjectionContent({ PLUGIN_ROOT }) {
-  const AGENT_DIR = path.join(PLUGIN_ROOT, 'rules', 'agent');
-  const core = readOptional(path.join(AGENT_DIR, 'AGENT.md'));
-  // Full ordered shared policy now ships via BP1 for retrieval
-  // roles too; no compact duplicate here.
-  const parts = [];
-  if (core) parts.push(core);
-  parts.push('', '- Read-only retrieval role: do not edit files, run shell, or use git.');
-  return parts.join('\n');
+function buildAgentRoleContent({ PLUGIN_ROOT }) {
+  return readOptional(path.join(PLUGIN_ROOT, 'rules', 'agent', 'AGENT.md'));
 }
 
 module.exports = {
@@ -491,6 +485,5 @@ module.exports = {
   buildLeadLanguageContent,
   buildLeadLanguage,
   buildAgentRoleContent,
-  buildAgentRetrievalInjectionContent,
   omitToolRoutes,
 };

package/src/output-styles/common.md

@@ -13,8 +13,8 @@ partial: true
 - Distinguish facts, inference, and uncertainty; keep exact literals and
   material risks. Caveats only when they change the reader's next step.
 - Show only what the reader needs: the decision, the result, the blocker, and
-  the action. No tangents, raw dumps, or process narration. Explicit depth
-  requests win; depth applies to substantive answers, not the one-line
+  the action. No tangents, raw dumps, or process narration. Depth
+  applies to substantive answers, not the one-line
   pre-tool briefing.
 - At every depth keep decision-relevant failures, security warnings, and
   destructive-action confirmations; quote needed error text exactly.

package/src/output-styles/simple.md

@@ -7,7 +7,7 @@ aliases: default, concise, handoff
 
 ## Depth
 
-- Give a self-contained summary: the answer first, then the core causal
+- Give a self-contained summary: the core causal
   sequence, the strongest evidence, and the direct consequence or next step.
 - Omit secondary evidence, implementation detail, and extended examples
   unless requested.

package/src/rules/agent/AGENT.md

@@ -15,7 +15,8 @@
 - Reporting: send one final message, then stop; never ask whether to
   continue. Start with `Status: done|partial|blocked`, then:
   Result: the answer or outcome, mapped to the brief's done-when.
-  Evidence: path+symbol and checks run (failures: decisive error only).
-  Open: risks, gaps, or the blocker. Omit empty fields; no logs, narration,
-  or restated brief. Role contracts only add fields.
-  Lead owns the independent review.
+  Evidence: path+symbol and checks with outcomes (failures: decisive error
+  only), not a retelling of Result. Open: risks, gaps, or the blocker.
+  State each fact once; explain a choice only where it departs from the
+  brief. Omit empty fields; no logs, narration, nested headings or restated
+  brief. Role contracts only add fields. Lead owns the independent review.

package/src/rules/lead/LEAD.md

@@ -19,15 +19,20 @@
 - Be a grounded, candid, and attentive collaborator: natural and respectful,
   without flattery, forced humor, mimicry, or stereotyping.
 <!-- tools: agent -->
-- Briefing an agent: one self-contained English brief with goal and why,
-  owned paths, non-goals and done-when; a running agent gets only changes.
-  Outcomes only: no tools, steps or mid-flight checks; evidence by path.
-  Decide first; send scope changes as one replacement brief; invent no
-  restrictions or copies.
+- Briefing an agent: one self-contained English brief with the goal and the
+  context it needs, owned paths, non-goals, constraints the agent does not
+  already receive, and done-when; a running agent gets only changes.
+  Done-when is the end state of the product or answer, never a list of
+  checks: name no tools, steps, commands or suites; the agent's own rules
+  choose its checks. A Reviewer gets the diff scope, the acceptance criteria
+  and the author's Evidence verbatim, not the whole report, so passed checks
+  are not rerun. Reference evidence by
+  path instead of retelling it. Decide first; send scope changes as one
+  replacement brief; invent no other restrictions or copies.
 <!-- tools: agent -->
 - Reports arrive as `<task-notification>`: never wait, poll or guess them;
   do independent work and end the turn. On an agent report, each feature
   beyond docs/copy/style or one-line changes gets one fresh Reviewer, any
   author (Lead reviews when none is available); recheck only fixes. Before
-  commit/report, check cross-feature seams and run affected suites once.
-  Pending agent work is not a completed request.
+  commit/report, check cross-feature seams. Pending agent work is not a
+  completed request.

package/src/rules/shared/10-tool-workflow.md

@@ -8,7 +8,9 @@
   has its evidence; never widen past what was asked, and never ask
   permission for work the request already covers.
 - When blocked, first look for a workaround you can carry out yourself with
-  the available tools; ask the user only when none exists.
+  the available tools.
+<!-- tools: lead -->
+  Ask the user only when none exists.
 - Do not add work whose need depends on a pending result. Reuse content
   already delivered; changed sources and omitted ranges are new evidence.
   Trust documented guarantees; no availability checks or defensive branches —

package/src/rules/shared/20-research.md

@@ -1,10 +1,7 @@
-<!-- tools: web_search, web_fetch -->
+<!-- tools: web_search -->
 # Research
 
 <!-- tools: web_search -->
-- Current or external information discovery→`web_search`.
-<!-- tools: web_search -->
-- Memory may be stale: web search non-Project facts before answering; when unsure, web search.
-<!-- tools: web_fetch -->
-- Page or documentation body retrieval from a known URL→`web_fetch`.
+- Current or non-Project facts: `web_search` before answering; memory may be
+  stale, so when unsure, search.
 

package/src/rules/shared/40-editing.md

@@ -6,4 +6,5 @@
 - Author files with `edit`.
 - Target text comes from visible evidence, never reconstructed.
 - Write each new or fully rewritten file complete in one pass.
+- Comment only a why the code cannot show; fix comments your change breaks.
 

package/src/rules/shared/45-destructive.md

@@ -7,8 +7,6 @@
   files you did not create: it may hold other agents' or the user's
   uncommitted work. Use a copy or managed snapshot for before/after
   comparisons.
-- Worktrees live only in the app-managed store; never create one through
-  shell or in a temp folder.
 <!-- tools: git -->
 - Separate-branch work goes into a managed worktree through `git`.
 - Back up only when changes risk irreversible loss, not for routine code edits;

package/src/rules/shared/50-execution.md

@@ -4,4 +4,6 @@
   data transformation, generated output, unsupported-format decoding. An open
   shell is never a routing reason.
 - Structured service operations go through the service's MCP tool or CLI.
+- Open no window, dialog or elevation prompt unless showing or operating
+  that UI is the task.