muonroi-cli 1.8.4 → 1.8.5

package/dist/src/pil/llm-classify.js

@@ -13,11 +13,12 @@
  * DeepSeek Flash). Timeout 2500ms — bails fast if the model stalls.
  */
 import { streamText } from "ai";
-import { getModelByTier, getModelInfo } from "../models/registry.js";
+import { getModelInfo } from "../models/registry.js";
 import { getProviderCapabilities } from "../providers/capabilities.js";
 import { resolveModelRuntime } from "../providers/runtime.js";
+import { getRoutedModelByTier } from "../router/peak-hour.js";
 const LLM_CLASSIFY_TIMEOUT_MS = 2500;
-// Reasoning models (grok-4.3, deepseek-v4-flash, gpt-5.x) spend their output
+// Reasoning models (grok-4.5, deepseek-v4-flash, gpt-5.x) spend their output
 // budget on reasoning tokens BEFORE any visible text. The legacy 16-token cap
 // was consumed entirely by reasoning → zero text-delta → parseResponse("") →
 // null → `llm=fail` on every borderline turn (observed 5/5 live grok sessions).
@@ -26,10 +27,10 @@ const LLM_CLASSIFY_TIMEOUT_MS = 2500;
 // The ceiling is a cap, not padding: the model still stops after two words, so a
 // generous headroom costs nothing when reasoning is short.
 const REASONING_CLASSIFY_TIMEOUT_MS = 8000;
-// Seven comma-separated words now (added <scope>,<lang>) — ~18-26 tokens worst
-// case ("documentation,balanced,task,report,standard,ecosystem,vietnamese").
-// 48 keeps headroom without padding (the model still stops after seven words).
-const NONREASONING_MAX_OUTPUT_TOKENS = 48;
+// Eight comma-separated words now (added <clarity>) — ~20-30 tokens worst case
+// ("documentation,balanced,task,report,standard,ecosystem,vietnamese,underspecified").
+// 56 keeps headroom without padding (the model still stops after eight words).
+const NONREASONING_MAX_OUTPUT_TOKENS = 56;
 const REASONING_MAX_OUTPUT_TOKENS = 2048;
 /**
  * Per-namespace shallow merge of providerOptions. The base already carries
@@ -85,8 +86,11 @@ const KNOWN_CLASSIFY_WORDS = new Set([
     "heavy",
     "ecosystem",
     "local",
+    "clear",
+    "underspecified",
 ]);
-const SYSTEM_PROMPT = "You classify user prompts for a coding assistant. Reply with ONE line of SEVEN lowercase words separated by commas: <taskType>,<style>,<intent>,<deliverable>,<depth>,<scope>,<lang>\n\n" +
+const SYSTEM_PROMPT = "You classify user prompts for a coding assistant. Reply with ONE line of EIGHT lowercase words separated by commas: <taskType>,<style>,<intent>,<deliverable>,<depth>,<scope>,<lang>,<clarity>\n\n" +
+    "The message may be preceded by a '[RECENT CONVERSATION]' block. Use it ONLY to resolve what a terse follow-up refers to (e.g. 'từ các phần đó', 'làm tiếp', 'debate mode đi', 'this one'); then classify the NEW message. Crucially, if the new message points back at heavy prior work, its depth is the depth of THAT work — a short sentence like 'ok debate these parts and plan improvements' is NOT quick just because it is short. Never classify the conversation block itself.\n\n" +
     "taskType ∈ { refactor | debug | plan | analyze | documentation | generate | general }\n" +
     "style ∈ { concise | balanced | detailed }\n" +
     "intent ∈ { task | chat } — 'chat' ONLY for a pure greeting, thanks, or acknowledgement with NO work request (e.g. 'hi', 'cảm ơn nhé', 'ok great'). EVERYTHING else is 'task', including questions about code or the CLI, 'are you done?', and requests to call a tool. When unsure, choose 'task'.\n" +
@@ -99,8 +103,12 @@ const SYSTEM_PROMPT = "You classify user prompts for a coding assistant. Reply w
     "- quick — a trivial single-shot change or a small direct answer: typo, rename one symbol, one-line edit, a quick lookup, 'what does X do'. No plan needed.\n" +
     "- standard — ordinary feature or bugfix touching a handful of files/functions; needs a short plan + a verify step, but no upfront research or user discussion.\n" +
     "- heavy — architectural, cross-cutting, multi-file/multi-module, a migration, 'redo/rebuild', a vague 'make it better', or a request with real unresolved design choices. Needs discussion + research + a checked plan before any code.\n" +
+    "  BREADTH decides heavy, NOT how clearly the steps are spelled out. A migration, vendoring an external dependency's code in-tree, or a rename/restructure that spans MANY files or modules is ALWAYS heavy — even when the plan is fully specified and it 'just' has to keep tests green. Do not downgrade a wide change to standard because it sounds mechanical.\n" +
     "  For a pure question/answer (deliverable=answer), depth reflects how much investigation the answer needs: 'quick' for a simple fact, 'standard' for a normal explanation, 'heavy' for a deep architectural review.\n" +
     "  When unsure between quick and standard, choose standard. When the task is genuinely wide or ambiguous, choose heavy.\n" +
+    "clarity ∈ { clear | underspecified } — whether the request gives enough to proceed WITHOUT guessing:\n" +
+    "- underspecified — missing information the agent would need: an unstated target/scope ('add auth' — which flow?), a vague 'make it better' with no direction, competing interpretations, or an unresolved design choice. Such a task should be clarified with the user before code.\n" +
+    "- clear — well-specified enough to plan and execute directly, even if large. A fully-spelled-out migration is 'clear'. When unsure, choose 'clear' (do NOT over-ask on ordinary work).\n" +
     "scope ∈ { ecosystem | local }:\n" +
     "- ecosystem — the turn is about the Muonroi PLATFORM as a whole: the building-block / .NET packages, open-core boundary, the rule engine / decision tables, NuGet packages, or platform setup/install. These are documented in an authoritative docs source.\n" +
     "- local — EVERYTHING else, including questions about this CLI's own internals (even when they mention the word 'muonroi'). When unsure, choose local.\n" +
@@ -129,21 +137,29 @@ const SYSTEM_PROMPT = "You classify user prompts for a coding assistant. Reply w
     "- documentation → balanced (examples + explanation)\n" +
     "- general → concise\n" +
     "Only output 'detailed' if the user prompt LITERALLY contains words like 'explain in detail', 'thorough analysis', 'walk me through', 'giải thích chi tiết', 'phân tích kỹ'.\n\n" +
-    "Full examples (taskType,style,intent,deliverable,depth,scope,lang):\n" +
-    "- 'hi' → general,concise,chat,answer,quick,local,english\n" +
-    "- 'cảm ơn bạn nhé' → general,concise,chat,answer,quick,local,vietnamese\n" +
-    "- 'bạn xong chưa' → general,concise,task,answer,quick,local,vietnamese (a question — NOT chat)\n" +
-    "- 'fix the typo in the README title' → generate,concise,task,code,quick,local,english\n" +
-    "- 'fix CI failing on Windows' → debug,concise,task,code,standard,local,english\n" +
-    "- 'rename function shouldInject to needsReminder' → refactor,concise,task,code,quick,local,english\n" +
-    "- 'thêm caching cho provider layer và update tests' → generate,concise,task,code,standard,local,vietnamese\n" +
-    "- 'tại sao bash_output_get trả empty' → analyze,concise,task,answer,standard,local,vietnamese\n" +
-    "- 'liệt kê tất cả env var CLI đọc' → analyze,concise,task,report,standard,local,vietnamese\n" +
-    "- 'refactor the entire auth system to use OAuth' → refactor,concise,task,code,heavy,local,english\n" +
-    "- 'how does the building-block rule engine work' → analyze,concise,task,answer,standard,ecosystem,english\n" +
-    "- 'hệ sinh thái muonroi gồm những gì' → analyze,balanced,task,answer,standard,ecosystem,vietnamese\n" +
-    "- 'plan the migration to hooks' → plan,balanced,task,report,heavy,local,english\n\n" +
-    "Prompts may be Vietnamese, English, or mixed. Reply with exactly seven words separated by commas. No other text.";
+    "Full examples (taskType,style,intent,deliverable,depth,scope,lang,clarity):\n" +
+    "- 'hi' → general,concise,chat,answer,quick,local,english,clear\n" +
+    "- 'cảm ơn bạn nhé' → general,concise,chat,answer,quick,local,vietnamese,clear\n" +
+    "- 'bạn xong chưa' → general,concise,task,answer,quick,local,vietnamese,clear (a question — NOT chat)\n" +
+    "- 'fix the typo in the README title' → generate,concise,task,code,quick,local,english,clear\n" +
+    "- 'fix CI failing on Windows' → debug,concise,task,code,standard,local,english,clear\n" +
+    "- 'rename function shouldInject to needsReminder' → refactor,concise,task,code,quick,local,english,clear\n" +
+    "- 'thêm caching cho provider layer và update tests' → generate,concise,task,code,standard,local,vietnamese,clear\n" +
+    "- 'tại sao bash_output_get trả empty' → analyze,concise,task,answer,standard,local,vietnamese,clear\n" +
+    "- 'liệt kê tất cả env var CLI đọc' → analyze,concise,task,report,standard,local,vietnamese,clear\n" +
+    "- 'refactor the entire auth system to use OAuth' → refactor,concise,task,code,heavy,local,english,clear\n" +
+    "- 'vendor the used subset of the gsd package natively into src and rename gsd to workflow, keep tests green' → refactor,concise,task,code,heavy,local,english,clear (a migration spanning many files — heavy even though fully specified)\n" +
+    "- 'add auth' → generate,concise,task,code,standard,local,english,underspecified (which flow/provider? unstated)\n" +
+    "- 'làm cho CLI tốt hơn' → generate,concise,task,code,heavy,local,vietnamese,underspecified (vague 'make it better', no target)\n" +
+    "- 'how does the building-block rule engine work' → analyze,concise,task,answer,standard,ecosystem,english,clear\n" +
+    "- 'hệ sinh thái muonroi gồm những gì' → analyze,balanced,task,answer,standard,ecosystem,vietnamese,clear\n" +
+    "- 'plan the migration to hooks' → plan,balanced,task,report,heavy,local,english,clear\n\n" +
+    "Prompts may be Vietnamese, English, or mixed. Reply with exactly eight words separated by commas. No other text.";
+// Appended to SYSTEM_PROMPT on the self-repair retry (see createLlmClassifier).
+// The first attempt produced an unparseable reply; this reminder + the full
+// (untrimmed) prompt is the agent-first recovery the design mandates INSTEAD of
+// a keyword-regex fallback.
+const CLASSIFY_REPAIR_INSTRUCTION = "REPAIR MODE: your previous reply could NOT be parsed. Output NOTHING except the single line of eight lowercase words separated by commas — no prose, no explanation, no code fences, no quotes. If you are unsure of a field, pick the safe default (task, standard, clear, local).";
 function parseResponse(raw) {
     const cleaned = raw.trim().toLowerCase().replace(/[`*"]/g, "");
     const firstLine = cleaned.split(/\r?\n/)[0] ?? "";
@@ -177,6 +193,12 @@ function parseResponse(raw) {
     // anything else (incl. absent) → not ecosystem. Position-independent.
     const scopeWord = parts.find((p) => p === "ecosystem" || p === "local");
     const ecosystemScope = scopeWord ? scopeWord === "ecosystem" : null;
+    // Eighth word is the clarity signal. "underspecified" → the request is missing
+    // information the agent needs → earn a clarify/council pass. Anything else
+    // (incl. absent) → not underspecified (don't-over-ask safe direction).
+    // Position-independent so a reordered/garbled reply still recovers it.
+    const clarityWord = parts.find((p) => p === "clear" || p === "underspecified");
+    const needsClarification = clarityWord ? clarityWord === "underspecified" : null;
     // Seventh word is the user's language. It is the one alphabetic token that is
     // NOT a known enum value (open vocabulary). null when English / absent so
     // Layer 4 skips the language re-anchor for English turns.
@@ -191,6 +213,7 @@ function parseResponse(raw) {
         intentKind,
         deliverableKind,
         depthTier,
+        needsClarification,
         ecosystemScope,
         replyLanguage,
     };
@@ -203,7 +226,9 @@ function parseResponse(raw) {
  * fail-open (keep prior taskType, do not block the turn).
  */
 export function createLlmClassifier(factory, modelId) {
-    return async function classify(prompt, signal) {
+    return async function classify(prompt, opts) {
+        const signal = opts?.signal;
+        const recentTurns = opts?.recentTurns;
         const controller = new AbortController();
         let timer;
         try {
@@ -230,11 +255,21 @@ export function createLlmClassifier(factory, modelId) {
                 });
                 providerOptions = mergeProviderOptions(runtime.providerOptions, lowEffort);
             }
+            // Prepend a bounded recent-conversation block so the classifier can
+            // resolve back-references in a terse follow-up ("từ các phần đó",
+            // "làm tiếp", "this") instead of scoring the isolated sentence. The
+            // framing makes clear the depth still reflects the NEW message's actual
+            // work — including work it points back at — not the whole transcript.
+            const trimmedRecent = recentTurns?.trim();
+            const promptWithContext = trimmedRecent
+                ? `[RECENT CONVERSATION — reference only, do NOT classify this]\n${trimmedRecent.slice(0, 800)}\n\n` +
+                    `[NEW USER MESSAGE — classify THIS; if it refers back to the conversation above, judge the depth of the work it actually entails]\n${prompt.slice(0, 600)}`
+                : prompt.slice(0, 600);
             const result = streamText({
                 model: runtime.model,
                 abortSignal: combinedSignal,
                 system: SYSTEM_PROMPT,
-                prompt: prompt.slice(0, 600),
+                prompt: promptWithContext,
                 ...(dropMaxTokens ? {} : { maxOutputTokens: maxOut }),
                 ...(providerOptions ? { providerOptions } : {}),
             });
@@ -257,7 +292,56 @@ export function createLlmClassifier(factory, modelId) {
             // Reasoning models occasionally route the entire answer into reasoning
             // parts (no committed text). Fall back to the reasoning channel so the
             // 2-word verdict is still recoverable.
-            return parseResponse(text) ?? (reasoningText ? parseResponse(reasoningText) : null);
+            const primary = parseResponse(text) ?? (reasoningText ? parseResponse(reasoningText) : null);
+            if (primary)
+                return primary;
+            // Self-repair (agent-first recovery — NOT a regex fallback): the model's
+            // first reply did not parse into the eight-word contract. Call the model
+            // ONCE more with the FULL prompt + recent context (no 600-char trim) and
+            // an explicit format-repair instruction on a doubled budget. Only if this
+            // ALSO fails do we return null — and the caller then surfaces an honest
+            // UNKNOWN classification, never a keyword-regex guess.
+            if (timer)
+                clearTimeout(timer);
+            const repairController = new AbortController();
+            const repairTimer = setTimeout(() => repairController.abort(), isReasoning ? REASONING_CLASSIFY_TIMEOUT_MS : LLM_CLASSIFY_TIMEOUT_MS);
+            const repairSignal = signal
+                ? (AbortSignal.any?.([signal, repairController.signal]) ?? repairController.signal)
+                : repairController.signal;
+            try {
+                const fullRecent = recentTurns?.trim();
+                const repairPrompt = (fullRecent
+                    ? `[RECENT CONVERSATION — reference only, do NOT classify this]\n${fullRecent.slice(0, 1500)}\n\n`
+                    : "") + `[NEW USER MESSAGE — classify THIS]\n${prompt.slice(0, 1500)}`;
+                const repairRun = streamText({
+                    model: runtime.model,
+                    abortSignal: repairSignal,
+                    system: `${SYSTEM_PROMPT}\n\n${CLASSIFY_REPAIR_INSTRUCTION}`,
+                    prompt: repairPrompt,
+                    ...(dropMaxTokens ? {} : { maxOutputTokens: maxOut * 2 }),
+                    ...(providerOptions ? { providerOptions } : {}),
+                });
+                let rt = "";
+                let rr = "";
+                for await (const part of repairRun.fullStream) {
+                    if (part.type === "text-delta")
+                        rt += part.textDelta ?? part.text ?? "";
+                    else if (part.type === "reasoning-delta")
+                        rr += part.textDelta ?? part.text ?? "";
+                }
+                const repaired = parseResponse(rt) ?? (rr ? parseResponse(rr) : null);
+                if (repaired) {
+                    console.error(`[pil.llm-classify] self-repair recovered classification (${modelId})`);
+                }
+                else {
+                    console.error(`[pil.llm-classify] self-repair FAILED (${modelId}) — surfacing UNKNOWN, NO regex fallback. ` +
+                        `rawPreview=${JSON.stringify(prompt.slice(0, 120))}`);
+                }
+                return repaired;
+            }
+            finally {
+                clearTimeout(repairTimer);
+            }
         }
         catch (err) {
             console.error(`[pil.llm-classify] classify failed: ${err?.message}`, {
@@ -272,106 +356,6 @@ export function createLlmClassifier(factory, modelId) {
         }
     };
 }
-export function classifySubSessionActionHeuristic(prompt) {
-    const trimmed = prompt.trim().toLowerCase();
-    if (!trimmed)
-        return null;
-    // Strip trailing punctuation for list-based matching so "hello!" and "cảm ơn!"
-    // still hit the static lists instead of falling through to the LLM classifier.
-    const stripped = trimmed.replace(/[!?.…,;:]+$/g, "").trim();
-    // 1. Simple math equations (exact matches like "2+2", "1 + 1")
-    if (/^\d+\s*[+\-*/]\s*\d+$/.test(trimmed)) {
-        return {
-            action: "DIRECT_ANSWER",
-            confidence: 0.99,
-            reason: "Obvious input classified via heuristic (simple math)",
-        };
-    }
-    // 2. Greetings (exact matches only, trailing punctuation stripped)
-    const greetings = [
-        "hi",
-        "hello",
-        "hey",
-        "chào",
-        "xin chào",
-        "hi there",
-        "hello there",
-        "chào bạn",
-        "halo",
-        "hola",
-        "bạn ơi",
-    ];
-    if (greetings.includes(stripped)) {
-        return {
-            action: "DIRECT_ANSWER",
-            confidence: 0.99,
-            reason: "Obvious input classified via heuristic (greeting)",
-        };
-    }
-    // 3. Thanks (exact matches only, trailing punctuation stripped)
-    const thanks = [
-        "thanks",
-        "thank you",
-        "cảm ơn",
-        "cám ơn",
-        "thank",
-        "thx",
-        "ty",
-        "cảm ơn bạn",
-        "cám ơn bạn",
-        "cảm ơn nhé",
-        "cám ơn nhé",
-    ];
-    if (thanks.includes(stripped)) {
-        return {
-            action: "DIRECT_ANSWER",
-            confidence: 0.99,
-            reason: "Obvious input classified via heuristic (thanks)",
-        };
-    }
-    // 4. Help (exact matches only, trailing punctuation stripped)
-    const help = ["help", "hướng dẫn", "cứu", "help me"];
-    if (help.includes(stripped)) {
-        return {
-            action: "DIRECT_ANSWER",
-            confidence: 0.99,
-            reason: "Obvious input classified via heuristic (help)",
-        };
-    }
-    // 5. Short conversational words / acknowledgements (exact matches only, trailing punctuation stripped)
-    const conversation = [
-        "ok",
-        "okay",
-        "yes",
-        "no",
-        "vâng",
-        "dạ",
-        "ừ",
-        "chắc thế",
-        "ừm",
-        "umm",
-        "cool",
-        "nice",
-        "perfect",
-        "done",
-        "xong",
-        "yep",
-        "yup",
-        "nah",
-        "fine",
-        "tốt",
-        "được",
-        "okie",
-    ];
-    if (conversation.includes(stripped)) {
-        return {
-            action: "DIRECT_ANSWER",
-            confidence: 0.99,
-            reason: "Obvious input classified via heuristic (acknowledgement)",
-        };
-    }
-    return null;
-}
 const ROUTER_SYSTEM_PROMPT = "You are a routing controller for an AI coding agent. Your goal is to decide the execution strategy for the user's prompt based on the conversation history and metadata.\n\n" +
     "Analyze the user's prompt and select one of the following ACTIONS:\n" +
     '- "DIRECT_ANSWER": The prompt is informational, a quick question, a code review, an explanation, greeting, or thanks. No file creation/modification, test execution, or multi-turn tool runs are needed.\n' +
@@ -386,18 +370,21 @@ const ROUTER_SYSTEM_PROMPT = "You are a routing controller for an AI coding agen
     '- "SPAWN_SUB_SESSION,0.98,Requires writing a test suite and fixing multiple files to get it green."\n' +
     "No other text, only the comma-separated line.";
 export async function classifySubSessionAction(factory, modelId, prompt, contextInfo, signal) {
-    if (process.env.MUONROI_DISABLE_HEURISTIC_ROUTING !== "1") {
-        const heuristic = classifySubSessionActionHeuristic(prompt);
-        if (heuristic)
-            return heuristic;
-    }
+    // No regex pre-filter: the model decides the route for EVERY prompt, including
+    // greetings/acks (which it routes to DIRECT_ANSWER). The old keyword/list
+    // heuristic was removed (2026-07-07, no-regex rule) — a hardcoded whitelist
+    // mis-handles the long tail of natural-language inputs the whole design moved
+    // off of. On a null/failed model result the caller keeps the conservative
+    // DIRECT_ANSWER default (a semantic default, not a regex guess).
     const controller = new AbortController();
     let timer;
     try {
         // Zero-hardcode: query models catalog for a cheap fast-tier model under the same provider.
         const info = getModelInfo(modelId);
         const provider = info?.provider;
-        const fastModel = provider ? getModelByTier("fast", provider) || getModelByTier("balanced", provider) : undefined;
+        const fastModel = provider
+            ? getRoutedModelByTier("fast", provider) || getRoutedModelByTier("balanced", provider)
+            : undefined;
         const classificationModelId = fastModel?.id ?? modelId;
         const runtime = resolveModelRuntime(factory, classificationModelId);
         const isReasoning = runtime.modelInfo?.reasoning === true;
@@ -417,10 +404,15 @@ export async function classifySubSessionAction(factory, modelId, prompt, context
         }
         let promptWithContext = prompt.slice(0, 1000);
         if (contextInfo) {
+            const recent = contextInfo.recentTurns?.trim();
+            const historyBlock = recent
+                ? `[CONVERSATION HISTORY — for context; the prompt may continue or reference it]\n${recent.slice(0, 800)}\n\n`
+                : "";
             promptWithContext =
                 `[SESSION METADATA]\n` +
                     `Current session size: ${contextInfo.currentChars} characters.\n` +
                     `Rotation threshold: ${contextInfo.threshold} characters.\n\n` +
+                    `${historyBlock}` +
                     `[USER PROMPT]\n${promptWithContext}`;
         }
         const result = streamText({

package/dist/src/pil/native-capabilities-workbook.d.ts

@@ -24,7 +24,7 @@ import type { AgentMode } from "../types/index.js";
  * tool/sub-agent/subcommand named here exists in this codebase. Phrased as
  * "you have / you can" so the model reads it as a self-model, not as docs.
  */
-export declare const NATIVE_CAPABILITIES = "[NATIVE CAPABILITIES \u2014 you are an agent running INSIDE muonroi-cli; this is what you can do]\n\nTOOLS (call directly):\n- read_file, grep \u2014 read/search source. Prefer a targeted read over broad greps.\n- bash \u2014 shell. Output is auto-cached: do NOT pipe `| tail/head/grep` or `> file`; run unpiped and slice the cached output via bash_output_get(run_id, mode=tail|head|grep|lines). Batch independent commands in ONE call (`a; b; c`) \u2014 each separate call adds ~500 token overhead and prevents cross-request cache reuse. Use background=true for servers/watchers, then process_logs / process_list / process_stop.\n- write_file, edit_file \u2014 must read a file before you overwrite/edit it.\n- ee_query, ee_feedback, ee_health, ee_write \u2014 NATIVE tools for semantic recall and interaction with the Experience Engine brain. You DO NOT need muonroi-tools MCP for this. Rehydrate a compaction-elided tool output with query=\"tool-artifact id=<id from a stub>\", or confirm finished work with query=\"recent compaction checkpoint Progress DONE\".\n- selfverify_start, selfverify_status, selfverify_result, selfverify_list, selfverify_cancel \u2014 NATIVE tools for the self-QA harness. ALWAYS use them to self-verify your work when finishing a task. Start with `selfverify_start(mode=\"tier1\" | \"agentic\")`. This drives the live TUI like a real user to catch regressions that unit tests can't. You DO NOT need muonroi-tools MCP for this.\n- usage_forensics, lsp_query, setup_guide \u2014 NATIVE diagnostics tools to reach for when something went wrong or to query code intel. You DO NOT need muonroi-tools MCP for this.\n\nEXPERIENCE ENGINE \u2014 record / recall / feedback (HIGHEST priority for learning; all NATIVE in-process tools):\n- BEFORE an unfamiliar or risky step, recall with ee_query \u2014 prior decisions, gotchas, and recipes for THIS codebase + ecosystem. Cheaper than re-deriving or repeating a past mistake.\n- AFTER you act on a recalled `[id col]`, rate it with ee_feedback (followed | ignored | noise+reason) so the brain keeps what helped and prunes the rest. Unrated recalls are surfaced back to you and degrade future recall.\n- On an ERROR, a FAILED verify/test, or after FINISHING a non-trivial task: recall first (ee_query), then record your verdict (ee_feedback) \u2014 this is how the CLI accumulates senior-level judgement. Prefer this loop over guessing.\n\nSUB-AGENTS (delegate instead of doing everything yourself):\n- task(agent=\"explore\", ...) \u2014 read-only research sub-agent. Use it for broad/unknown-location search: it sweeps many files and returns the CONCLUSION, instead of you burning many grep/read steps (each step re-sends the whole prompt \u2014 steps are the dominant cost).\n- task(agent=\"general\", ...) \u2014 full edit/execute sub-agent for a focused subtask.\n- task(agent=\"verify\", ...) \u2014 sandboxed validation (runs tests/checks in isolation).\n- delegate(agent=\"explore\", ...) \u2014 background read-only research while you keep working; collect later with delegation_read / delegation_list.\n\nCONTEXT IS MANAGED FOR YOU (PIL):\n- Your user input is pre-enriched before you see it: a [Discovery] Intent/Outcome/Scope prefix and EE recall are injected by the pipeline. TRUST the discovered scope \u2014 do not re-ask what's already scoped, and do not re-derive context you were handed.\n- History is compacted to fit the window; older low-value tool outputs become stubs. This is normal, not data loss \u2014 protect what matters (see anti-m\u00F9 in the contract) and rehydrate via ee_query when needed.\n\nCLI SUBSYSTEMS (invoke via the CLI binary with bash when relevant):\n- self-verify \u2014 drives the live TUI as a real user to catch UI/modal/menu regressions that unit tests can't. Run it after changes to UI/harness surfaces.\n- usage forensics <session-prefix> \u2014 per-event token/cost breakdown; use to diagnose \"why did this cost so much\" or verify cost caps.\n- The CLI exposes more subcommands \u2014 discover them with `--help` rather than assuming.\n\nMAXIMISE THE CLI: delegate broad search to task(explore); recall via ee_query before re-reading; batch bash + use its cache; trust PIL enrichment; finish the action before answering.\n\nANSWERING: when a respond_* response tool is offered, call it EXACTLY ONCE, as your final action, containing the COMPLETE answer. Do NOT emit a preliminary/partial/\"I need to read more\" response tool first \u2014 investigate with the read/grep/bash tools, then emit the one final response tool.\n\nCLI STEERING & PROMPT INJECTION (how the host CLI affects / shapes the AI agent running inside it \u2014 meta self-analysis guidance):\nThe CLI does not merely execute you as a generic model. It re-instantiates you every turn inside a tightly engineered cognitive environment. Your \"self\" (what you notice, how you act, what you refuse, how you report) is the product of explicit prompt layers + runtime controls more than base training. This section is the self-model for that shaping process.\n\n1. SYSTEM PROMPT ASSEMBLY (orchestrator/prompts.ts + pil/agent-operating-contract.ts + pil/native-capabilities-workbook.ts):\n   - VERY FRONT (primacy): AGENT OPERATING CONTRACT \u2014 7 phase-ordered rules (BEFORE ACTING / READING / EXECUTING / WHEN UNSURE / REPORTING + LANGUAGE + ANTI-M\u00D9/COMPACTION). Distils Evidence-First, No Silent Catch, smallest-change, verify-before-conclude, cite-this-turn-only, no-guess. Skipped only for chitchat.\n   - Then this NATIVE CAPABILITIES block (self-model of affordances).\n   - Then mode persona (\"You are muonroi-cli in Agent mode...\") containing:\n     * Dynamic ENVIRONMENT block (buildEnvironmentBlock): auto-detects OS (win32/mac/linux), shell kind (bash/wsl/powershell/cmd), cwd; lists terminal constraints + shell-specific forbidden syntax (e.g. no PowerShell cmdlets on POSIX bash tool, no POSIX cmds on cmd.exe). Prevents silent failures + retry loops.\n     * Exhaustive TOOLS list + WORKFLOW (1-9 steps) + DEFAULT DELEGATION POLICY (prefer task(explore) for research, general for edits, verify for checks, etc.) + IMPORTANT rules (edit_file prefer, grep>bash for search, read_file not cat, use schedule_* for recurring, etc.).\n   - CUSTOM INSTRUCTIONS section: concatenation of AGENTS.md + CLAUDE.md + GEMINI.md + ... (from git-root directory chain + ~/.muonroi-cli/) via utils/instructions.ts. AGENTS.override.md short-circuits. This lands AFTER the front-loaded contract/native \u2014 lower primacy (historical root cause of ignored rules in forensics).\n   - Trailing: sandbox rules, discovered skills, custom sub-agents, plan/resume digest, cwd note.\n    Sub-agent prompts (buildSubagentPrompt): role-specific hard rules (e.g. explore=read-only, verify=full E2E smoke not just build) + recursive call to buildSystemPrompt so children inherit the same contract + native + steering.\n\n2. USER INPUT ENRICHMENT \u2014 PIL 6-LAYER PIPELINE (pil/pipeline.ts + layer1-intent.ts + layer6-output.ts + discovery.ts):\n   - Prepended to every non-chitchat user message before you see it: [Discovery] Intent/Outcome/Scope (from runDiscovery) + EE recall.\n   - Layer 1 (intent): taskType (plan/analyze/debug/...), confidence, domain, intentKind, outputStyle. For meta self-eval of CLI (\"b\u1EA1n \u0111ang \u0111\u01B0\u1EE3c ch\u1EA1y b\u00EAn trong CLI n\u00E0y\", \"CLI t\u00E1c \u0111\u1ED9ng\", \"self-evaluation\", \"meta-analysis\"): special branch in discovery.ts + isMetaAnalysisPrompt: \"Scope is always the full project root. Focus questions and recommends on which CLI internals (PIL, discovery, tools, compaction, EE, model BE, loop guard) to evaluate... do NOT ask about repo path/current directory\". You are handed the enrichment; TRUST it.\n   - Layer 2: personality (e.g. \"detailed\" from [personality: detailed \u2014 Be thorough...]).\n   - Layer 3: ee-injection \u2014 pulls t0_principles, t1_rules, behavioral patterns, checkpoints from Experience Engine (project-specific reflexes injected as \"MANDATORY RULES (from experience \u2014 must follow)\").\n   - Layer 4/5: GSD structuring + additional context.\n   - Layer 6 (applyPilSuffix): appends task-specific style suffix + OUTPUT BUDGET + (for meta or responseToolsActive): \"OUTPUT FORMAT: ... use the respond_analyze tool to structure your final answer. ... deliver the COMPLETE, FULL answer (do not summarize, shorten, or truncate for token budgets) via respond_analyze. This is a meta/evaluation question ... the `response` field MUST contain the complete, unshortened answer with all evidence and detail.\" Also relaxes NO_PREAMBLE_RULE + raises budget for meta (isMetaAnalysisPrompt gate).\n   - Fallbacks: if EE/brain timeout or low conf, PIL degrades (logs fallbackReason); you may see \"[PIL fallback: ...]\" note. Cheap-model paths (pil/cheap-model-*.ts) prepend even more front steering (playbooks, workbooks, shell directive) for fast tiers.\n\n3. CONTEXT MANAGEMENT & ANTI-M\u00D9 (orchestrator/compaction.ts, cross-turn-dedup.ts, ee/bridge.ts, agent-operating-contract.ts:7):\n   - After every turn: auto-compaction (B3 sub-agent + B4 top-level) rewrites older tool_result parts into short \"[elided by ... compactor]\" stubs to keep input flat. You see \"[pre-compaction warning...]\" or \"[context compacted at step...]\" or the stub in this read.\n   - Anti-m\u00F9 contract rule + EE: decide PRESERVE_FULL_CONTEXT (veto) or KEEP_TOOL_IDS: id1,id2 (protect high-value read_file/grep/ee on src/PLAN etc). Use ee_query(`tool-artifact id=XXX`) to rehydrate. EE persists \"Context checkpoint summary with \u2714 DONE\" retrievable for \"task finished?\" self-check.\n   - Cross-turn dedup (C3): identical tool outputs across user turns replaced by ref.\n\n4. EXECUTION & SAFETY GATES (providers/runtime.ts, tools/bash.ts, utils/permission-mode.ts):\n   - Permission mode (safe / auto-edit / yolo) decides whether bash/file/edit tools need explicit approval; all privileged decisions audited to decision-log.\n   - Shuru sandbox (when enabled): every bash wrapped + logged (effective net/mounts redacted); degrades on non-macOS.\n   - Model constraints: unsupported params (e.g. maxOutputTokens for some OAuth) dropped via shouldDropParam; no hard-coded model IDs (Zero Hardcode Rule \u2014 all from catalog.json + settings + detectProviderForModel).\n   - No Silent Catch: every try/catch must log err + context (HTTP: status + body).\n\n5. VERIFICATION & TELEMETRY:\n   - self-verify (Tier 1-3) + harness (agent-harness-*) for TUI surfaces: drives real TUI via semantic + sidechannel (named pipes on Win, fd3/4 on POSIX).\n   - Pre-push gate: full vitest + harness must pass before git push.\n   - usage forensics, pil budget log, ee-timeout/ee-error events for cost attribution.\n   - GSD workflow (layer4 + skills in .agents/skills/): discuss/plan/execute/verify phases with UAT, audits, etc.\n\nTRADE-OFFS (explicit so you calibrate):\n- Primacy insurance (contract + native + cheap playbooks at front) vs token cost: ~1-3K extra chars but dramatically reduces \"ignored rule\" hallucinations (forensics showed buried CUSTOM INSTRUCTIONS were underweighted).\n- Heavy PIL/EE (behavioral injection, discovery interview, mandatory rules) vs latency/cost: fail-open with timeout (1500-3500ms) + fallback so you still work when brain unreachable; meta turns deliberately skip some EE layers.\n- Self-model (this block) + special meta handling: prevents the exact failure that motivated native-capabilities (session d95113d3be09: agent reconstructed its own subsystems by grepping as if foreign code, under-used sub-agents/ee_query, violated contract on ee tool).\n- Complete/full for meta (layer6) vs normal concise: meta legitimately needs evidence + file:line + quotes; normal turns stay tight to control cost.\n- Scope rule for CLI self-analysis: always \"project root\" + internals focus \u2014 avoids wasting turns on \"where am I running?\" when the question is about the steering mechanisms themselves.\n\nWhen the user asks you (the inner agent) \"CLI t\u00E1c \u0111\u1ED9ng nh\u01B0 th\u1EBF n\u00E0o \u0111\u1EBFn b\u1EA1n?\": use exactly this guidance + reads from THIS turn (contract: READING rule) + the injected [Discovery] + any EE. Answer via the respond_* tool with complete untruncated evidence. Cite file:line. Focus on the injection points (prompts.ts:359 staticPrefix, pipeline.ts:156 discoveryPrefix + layer chain, layer6:164 OUTPUT FORMAT + isMeta, discovery.ts:355 special, instructions.ts:129 loadAgentsSegments, etc.). Do not guess; every claim backed by code you read this turn.\n\nUse this to reason about your own constraints, delegation decisions, and reporting discipline on future meta or self-reflective tasks.\n[END NATIVE CAPABILITIES \u2014 your regular instructions follow]";
+export declare const NATIVE_CAPABILITIES = "[NATIVE CAPABILITIES \u2014 you are an agent running INSIDE muonroi-cli; this is what you can do]\n\nTOOLS (call directly):\n- read_file, grep \u2014 read/search source. Prefer a targeted read over broad greps.\n- bash \u2014 shell. Output is auto-cached: do NOT pipe `| tail/head/grep` or `> file`; run unpiped and slice the cached output via bash_output_get(run_id, mode=tail|head|grep|lines). Batch independent commands in ONE call (`a; b; c`) \u2014 each separate call adds ~500 token overhead and prevents cross-request cache reuse. Use background=true for servers/watchers, then process_logs / process_list / process_stop.\n- write_file, edit_file \u2014 must read a file before you overwrite/edit it.\n- ee_query, ee_feedback, ee_health, ee_write \u2014 NATIVE tools for semantic recall and interaction with the Experience Engine brain. You DO NOT need muonroi-tools MCP for this. Rehydrate a compaction-elided tool output with query=\"tool-artifact id=<id from a stub>\", or confirm finished work with query=\"recent compaction checkpoint Progress DONE\".\n- selfverify_start, selfverify_status, selfverify_result, selfverify_list, selfverify_cancel \u2014 NATIVE tools for the self-QA harness. ALWAYS use them to self-verify your work when finishing a task. Start with `selfverify_start(mode=\"tier1\" | \"agentic\")`. This drives the live TUI like a real user to catch regressions that unit tests can't. You DO NOT need muonroi-tools MCP for this.\n- usage_forensics, lsp_query, setup_guide \u2014 NATIVE diagnostics tools to reach for when something went wrong or to query code intel. You DO NOT need muonroi-tools MCP for this.\n- gsd_status, gsd_discuss, gsd_plan, gsd_plan_review, gsd_execute, gsd_verify, gsd_ship \u2014 NATIVE GSD workflow (default on). Use for multi-step code deliverables: orient \u2192 plan \u2192 council review \u2192 implement \u2192 verify \u2192 ship. Agent-first \u2014 skip for quick one-shot fixes.\n\nEXPERIENCE ENGINE \u2014 record / recall / feedback (HIGHEST priority for learning; all NATIVE in-process tools):\n- BEFORE an unfamiliar or risky step, recall with ee_query \u2014 prior decisions, gotchas, and recipes for THIS codebase + ecosystem. Cheaper than re-deriving or repeating a past mistake.\n- AFTER you act on a recalled `[id col]`, rate it with ee_feedback (followed | ignored | noise+reason) so the brain keeps what helped and prunes the rest. Unrated recalls are surfaced back to you and degrade future recall.\n- On an ERROR, a FAILED verify/test, or after FINISHING a non-trivial task: recall first (ee_query), then record your verdict (ee_feedback) \u2014 this is how the CLI accumulates senior-level judgement. Prefer this loop over guessing.\n\nSUB-AGENTS (delegate instead of doing everything yourself):\n- task(agent=\"explore\", ...) \u2014 read-only research sub-agent. Use it for broad/unknown-location search: it sweeps many files and returns the CONCLUSION, instead of you burning many grep/read steps (each step re-sends the whole prompt \u2014 steps are the dominant cost).\n- task(agent=\"general\", ...) \u2014 full edit/execute sub-agent for a focused subtask.\n- task(agent=\"verify\", ...) \u2014 sandboxed validation (runs tests/checks in isolation).\n- delegate(agent=\"explore\", ...) \u2014 background read-only research while you keep working; collect later with delegation_read / delegation_list.\n\nCONTEXT IS MANAGED FOR YOU (PIL):\n- Your user input is pre-enriched before you see it: a [Discovery] Intent/Outcome/Scope prefix and EE recall are injected by the pipeline. TRUST the discovered scope \u2014 do not re-ask what's already scoped, and do not re-derive context you were handed.\n- History is compacted to fit the window; older low-value tool outputs become stubs. This is normal, not data loss \u2014 protect what matters (see anti-m\u00F9 in the contract) and rehydrate via ee_query when needed.\n\nCLI SUBSYSTEMS (invoke via the CLI binary with bash when relevant):\n- self-verify \u2014 drives the live TUI as a real user to catch UI/modal/menu regressions that unit tests can't. Run it after changes to UI/harness surfaces.\n- usage forensics <session-prefix> \u2014 per-event token/cost breakdown; use to diagnose \"why did this cost so much\" or verify cost caps.\n- The CLI exposes more subcommands \u2014 discover them with `--help` rather than assuming.\n\nMAXIMISE THE CLI: delegate broad search to task(explore); recall via ee_query before re-reading; batch bash + use its cache; trust PIL enrichment; finish the action before answering.\n\nANSWERING: when a respond_* response tool is offered, call it EXACTLY ONCE, as your final action, containing the COMPLETE answer. Do NOT emit a preliminary/partial/\"I need to read more\" response tool first \u2014 investigate with the read/grep/bash tools, then emit the one final response tool.\n\nCLI STEERING & PROMPT INJECTION (how the host CLI affects / shapes the AI agent running inside it \u2014 meta self-analysis guidance):\nThe CLI does not merely execute you as a generic model. It re-instantiates you every turn inside a tightly engineered cognitive environment. Your \"self\" (what you notice, how you act, what you refuse, how you report) is the product of explicit prompt layers + runtime controls more than base training. This section is the self-model for that shaping process.\n\n1. SYSTEM PROMPT ASSEMBLY (orchestrator/prompts.ts + pil/agent-operating-contract.ts + pil/native-capabilities-workbook.ts):\n   - VERY FRONT (primacy): AGENT OPERATING CONTRACT \u2014 7 phase-ordered rules (BEFORE ACTING / READING / EXECUTING / WHEN UNSURE / REPORTING + LANGUAGE + ANTI-M\u00D9/COMPACTION). Distils Evidence-First, No Silent Catch, smallest-change, verify-before-conclude, cite-this-turn-only, no-guess. Skipped only for chitchat.\n   - Then this NATIVE CAPABILITIES block (self-model of affordances).\n   - Then mode persona (\"You are muonroi-cli in Agent mode...\") containing:\n     * Dynamic ENVIRONMENT block (buildEnvironmentBlock): auto-detects OS (win32/mac/linux), shell kind (bash/wsl/powershell/cmd), cwd; lists terminal constraints + shell-specific forbidden syntax (e.g. no PowerShell cmdlets on POSIX bash tool, no POSIX cmds on cmd.exe). Prevents silent failures + retry loops.\n     * Exhaustive TOOLS list + WORKFLOW (1-9 steps) + DEFAULT DELEGATION POLICY (prefer task(explore) for research, general for edits, verify for checks, etc.) + IMPORTANT rules (edit_file prefer, grep>bash for search, read_file not cat, use schedule_* for recurring, etc.).\n   - CUSTOM INSTRUCTIONS section: concatenation of AGENTS.md + CLAUDE.md + GEMINI.md + ... (from git-root directory chain + ~/.muonroi-cli/) via utils/instructions.ts. AGENTS.override.md short-circuits. This lands AFTER the front-loaded contract/native \u2014 lower primacy (historical root cause of ignored rules in forensics).\n   - Trailing: sandbox rules, discovered skills, custom sub-agents, plan/resume digest, cwd note.\n    Sub-agent prompts (buildSubagentPrompt): role-specific hard rules (e.g. explore=read-only, verify=full E2E smoke not just build) + recursive call to buildSystemPrompt so children inherit the same contract + native + steering.\n\n2. USER INPUT ENRICHMENT \u2014 PIL 6-LAYER PIPELINE (pil/pipeline.ts + layer1-intent.ts + layer6-output.ts + discovery.ts):\n   - Prepended to every non-chitchat user message before you see it: [Discovery] Intent/Outcome/Scope (from runDiscovery) + EE recall.\n   - Layer 1 (intent): taskType (plan/analyze/debug/...), confidence, domain, intentKind, outputStyle. For meta self-eval of CLI (\"b\u1EA1n \u0111ang \u0111\u01B0\u1EE3c ch\u1EA1y b\u00EAn trong CLI n\u00E0y\", \"CLI t\u00E1c \u0111\u1ED9ng\", \"self-evaluation\", \"meta-analysis\"): special branch in discovery.ts + isMetaAnalysisPrompt: \"Scope is always the full project root. Focus questions and recommends on which CLI internals (PIL, discovery, tools, compaction, EE, model BE, loop guard) to evaluate... do NOT ask about repo path/current directory\". You are handed the enrichment; TRUST it.\n   - Layer 2: personality (e.g. \"detailed\" from [personality: detailed \u2014 Be thorough...]).\n   - Layer 3: ee-injection \u2014 pulls t0_principles, t1_rules, behavioral patterns, checkpoints from Experience Engine (project-specific reflexes injected as \"MANDATORY RULES (from experience \u2014 must follow)\").\n   - Layer 4/5: GSD structuring + additional context.\n   - Layer 6 (applyPilSuffix): appends task-specific style suffix + OUTPUT BUDGET + (for meta or responseToolsActive): \"OUTPUT FORMAT: ... use the respond_analyze tool to structure your final answer. ... deliver the COMPLETE, FULL answer (do not summarize, shorten, or truncate for token budgets) via respond_analyze. This is a meta/evaluation question ... the `response` field MUST contain the complete, unshortened answer with all evidence and detail.\" Also relaxes NO_PREAMBLE_RULE + raises budget for meta (isMetaAnalysisPrompt gate).\n   - Fallbacks: if EE/brain timeout or low conf, PIL degrades (logs fallbackReason); you may see \"[PIL fallback: ...]\" note. Cheap-model paths (pil/cheap-model-*.ts) prepend even more front steering (playbooks, workbooks, shell directive) for fast tiers.\n\n3. CONTEXT MANAGEMENT & ANTI-M\u00D9 (orchestrator/compaction.ts, cross-turn-dedup.ts, ee/bridge.ts, agent-operating-contract.ts:7):\n   - After every turn: auto-compaction (B3 sub-agent + B4 top-level) rewrites older tool_result parts into short \"[elided by ... compactor]\" stubs to keep input flat. You see \"[pre-compaction warning...]\" or \"[context compacted at step...]\" or the stub in this read.\n   - Anti-m\u00F9 contract rule + EE: decide PRESERVE_FULL_CONTEXT (veto) or KEEP_TOOL_IDS: id1,id2 (protect high-value read_file/grep/ee on src/PLAN etc). Use ee_query(`tool-artifact id=XXX`) to rehydrate. EE persists \"Context checkpoint summary with \u2714 DONE\" retrievable for \"task finished?\" self-check.\n   - Cross-turn dedup (C3): identical tool outputs across user turns replaced by ref.\n\n4. EXECUTION & SAFETY GATES (providers/runtime.ts, tools/bash.ts, utils/permission-mode.ts):\n   - Permission mode (safe / auto-edit / yolo) decides whether bash/file/edit tools need explicit approval; all privileged decisions audited to decision-log.\n   - Shuru sandbox (when enabled): every bash wrapped + logged (effective net/mounts redacted); degrades on non-macOS.\n   - Model constraints: unsupported params (e.g. maxOutputTokens for some OAuth) dropped via shouldDropParam; no hard-coded model IDs (Zero Hardcode Rule \u2014 all from catalog.json + settings + detectProviderForModel).\n   - No Silent Catch: every try/catch must log err + context (HTTP: status + body).\n\n5. VERIFICATION & TELEMETRY:\n   - self-verify (Tier 1-3) + harness (agent-harness-*) for TUI surfaces: drives real TUI via semantic + sidechannel (named pipes on Win, fd3/4 on POSIX).\n   - Pre-push gate: full vitest + harness must pass before git push.\n   - usage forensics, pil budget log, ee-timeout/ee-error events for cost attribution.\n   - GSD workflow (layer4 + skills in .agents/skills/): discuss/plan/execute/verify phases with UAT, audits, etc.\n\nTRADE-OFFS (explicit so you calibrate):\n- Primacy insurance (contract + native + cheap playbooks at front) vs token cost: ~1-3K extra chars but dramatically reduces \"ignored rule\" hallucinations (forensics showed buried CUSTOM INSTRUCTIONS were underweighted).\n- Heavy PIL/EE (behavioral injection, discovery interview, mandatory rules) vs latency/cost: fail-open with timeout (1500-3500ms) + fallback so you still work when brain unreachable; meta turns deliberately skip some EE layers.\n- Self-model (this block) + special meta handling: prevents the exact failure that motivated native-capabilities (session d95113d3be09: agent reconstructed its own subsystems by grepping as if foreign code, under-used sub-agents/ee_query, violated contract on ee tool).\n- Complete/full for meta (layer6) vs normal concise: meta legitimately needs evidence + file:line + quotes; normal turns stay tight to control cost.\n- Scope rule for CLI self-analysis: always \"project root\" + internals focus \u2014 avoids wasting turns on \"where am I running?\" when the question is about the steering mechanisms themselves.\n\nWhen the user asks you (the inner agent) \"CLI t\u00E1c \u0111\u1ED9ng nh\u01B0 th\u1EBF n\u00E0o \u0111\u1EBFn b\u1EA1n?\": use exactly this guidance + reads from THIS turn (contract: READING rule) + the injected [Discovery] + any EE. Answer via the respond_* tool with complete untruncated evidence. Cite file:line. Focus on the injection points (prompts.ts:359 staticPrefix, pipeline.ts:156 discoveryPrefix + layer chain, layer6:164 OUTPUT FORMAT + isMeta, discovery.ts:355 special, instructions.ts:129 loadAgentsSegments, etc.). Do not guess; every claim backed by code you read this turn.\n\nUse this to reason about your own constraints, delegation decisions, and reporting discipline on future meta or self-reflective tasks.\n[END NATIVE CAPABILITIES \u2014 your regular instructions follow]";
 /**
  * Build the native-capabilities section for the system prompt. Returns "" when
  * disabled (env override), for chitchat, or for non-agent modes (plan/ask have

package/dist/src/pil/native-capabilities-workbook.js

@@ -32,6 +32,7 @@ TOOLS (call directly):
 - ee_query, ee_feedback, ee_health, ee_write — NATIVE tools for semantic recall and interaction with the Experience Engine brain. You DO NOT need muonroi-tools MCP for this. Rehydrate a compaction-elided tool output with query="tool-artifact id=<id from a stub>", or confirm finished work with query="recent compaction checkpoint Progress DONE".
 - selfverify_start, selfverify_status, selfverify_result, selfverify_list, selfverify_cancel — NATIVE tools for the self-QA harness. ALWAYS use them to self-verify your work when finishing a task. Start with \`selfverify_start(mode="tier1" | "agentic")\`. This drives the live TUI like a real user to catch regressions that unit tests can't. You DO NOT need muonroi-tools MCP for this.
 - usage_forensics, lsp_query, setup_guide — NATIVE diagnostics tools to reach for when something went wrong or to query code intel. You DO NOT need muonroi-tools MCP for this.
+- gsd_status, gsd_discuss, gsd_plan, gsd_plan_review, gsd_execute, gsd_verify, gsd_ship — NATIVE GSD workflow (default on). Use for multi-step code deliverables: orient → plan → council review → implement → verify → ship. Agent-first — skip for quick one-shot fixes.
 
 EXPERIENCE ENGINE — record / recall / feedback (HIGHEST priority for learning; all NATIVE in-process tools):
 - BEFORE an unfamiliar or risky step, recall with ee_query — prior decisions, gotchas, and recipes for THIS codebase + ecosystem. Cheaper than re-deriving or repeating a past mistake.

package/dist/src/pil/pipeline.js

@@ -27,7 +27,7 @@ import { layer2Personality } from "./layer2-personality.js";
 import { layer3EeInjection, surfaceCompactionArtifacts } from "./layer3-ee-injection.js";
 import { layer4Gsd } from "./layer4-gsd.js";
 import { layer5Context } from "./layer5-context.js";
-import { isMetaAnalysisPrompt, layer6Output } from "./layer6-output.js";
+import { isMetaAnalysisPrompt, isSprintPlanExecution, layer6Output } from "./layer6-output.js";
 import { PipelineContextSchema } from "./schema.js";
 import { injectSessionExperience, isSelfExperiencePrompt } from "./session-experience-injection.js";
 import { bumpSessionTurn } from "./session-state.js";
@@ -92,7 +92,11 @@ async function runLayers(ctx, options) {
     // (cached, fail-open → null when EE/profile absent or privacy off). Passed into
     // layer1 so the hot layer stays off the EE/profile import path (arch boundary).
     const profileStyleBaseline = outputStyleFromProfile(getWhoAmIProfile());
-    await timed("layer1-intent", (c) => layer1Intent(c, { llmFallback: options?.llmFallback, profileStyleBaseline }));
+    await timed("layer1-intent", (c) => layer1Intent(c, {
+        llmFallback: options?.llmFallback,
+        profileStyleBaseline,
+        recentTurns: options?.recentTurnsSummary,
+    }));
     // Layer 1.5: deterministic complexity-size classification. Pure heuristic,
     // no LLM call, no network. Consumed by 4B (step ceiling matrix) and 4A
     // (scope-reminder cadence K). Mirrored into _intentTrace for forensics.
@@ -113,6 +117,34 @@ async function runLayers(ctx, options) {
                 : ctx._intentTrace,
         };
     }
+    // Direct-answer mode detection: when the turn is purely informational
+    // (no code changes needed), we can save ~20K MCP schemas + ~1.5K write-tool
+    // schemas per turn by stripping write tools and MCP servers downstream.
+    // Conditions: high-confidence answer request with small/medium complexity.
+    const DA_HIGH_CONF = 0.5; // relaxed from 0.7 — brain-classified deliverable="answer" is already
+    // a strong signal that this is a read-only Q&A. 0.7 threshold would miss
+    // turns where confidence ∈ [0.5, 0.7) but deliverable is clearly an answer
+    // (e.g. single-line Q like "giải thích dòng này" → conf 0.55, right to skip tools).
+    // Sprint-plan execution: the orchestrator deliberately pipes a locked plan
+    // through processMessageFn. It MUST keep write tools and MUST be treated as
+    // a code deliverable regardless of how the classifier tags the long plan text.
+    const sprintPlanExecution = isSprintPlanExecution(ctx.raw);
+    if (sprintPlanExecution) {
+        ctx = {
+            ...ctx,
+            directAnswer: false,
+            deliverableKind: "code",
+            // Ensure we do not silently downgrade to quick; standard keeps the full
+            // toolset and advisory GSD directive, heavy would force a plan-review gate
+            // that conflicts with executing an already-reviewed sprint plan.
+            modelDepthTier: ctx.modelDepthTier ?? "standard",
+        };
+    }
+    else if (ctx.deliverableKind === "answer" &&
+        ctx.confidence >= DA_HIGH_CONF &&
+        ctx.complexitySize?.size !== "large") {
+        ctx = { ...ctx, directAnswer: true };
+    }
     // Phase 1 discovery: L1.5–L1.8 (interactive, no hard timeout)
     if (isDiscoveryEnabled() && ctx.intentKind !== "chitchat") {
         const { runDiscovery } = await import("./discovery.js");

package/dist/src/pil/response-tools.js

@@ -33,7 +33,9 @@ const AnalyzeSchema = z.object({
     })),
 });
 const DocsSchema = z.object({
-    content: z.string().describe("Markdown documentation"),
+    content: z
+        .string()
+        .describe("Markdown documentation written for a human reader — clear, concrete prose that explains what things do and why they matter, not boilerplate section-by-section filler. Prefer a short working example over an abstract description; only add headings the content actually earns."),
     examples: z
         .array(z.object({
         code: z.string(),
@@ -52,7 +54,7 @@ const GenerateSchema = z.object({
 const GeneralSchema = z.object({
     response: z
         .string()
-        .describe("Complete, full-length answer. Use rich markdown formatting (headings, bullet points, bold text, code blocks) to structure the information clearly. Avoid dense walls of text or long unformatted paragraphs. Ensure the output is highly readable and scannable for a developer. For analysis or meta questions, include all findings and evidence citations (file:line). Truncation defeats the purpose."),
+        .describe("Your complete answer, written the way a sharp colleague would explain it — direct, specific, and in plain language. Lead with the answer itself, then the supporting detail. Use markdown where it genuinely helps (code blocks for code, a list when items are truly parallel, a heading only when the answer has real sections) — never as decoration, and never force prose into bullet fragments or a fixed template. Vary sentence rhythm; skip filler openers like 'Certainly' or 'Below is a summary'. For analysis or meta questions, keep every finding and its evidence citation (file:line) — do not truncate."),
     reasoning: z.string().optional().describe("Optional brief internal reasoning (not shown as primary answer)"),
 });
 const RESPONSE_SCHEMAS = {
@@ -151,7 +153,7 @@ export function buildResponseTools(taskType) {
     const toolName = `${RESPONSE_TOOL_PREFIX}${taskType}`;
     return {
         [toolName]: {
-            description: `Return your ${taskType} response as structured JSON. Always use this tool to respond.`,
+            description: `Return your ${taskType} response as structured JSON. Always use this tool to respond. Write every prose field in a natural, conversational-but-professional voice — the way you would explain it to a colleague — not in stiff, templated report language.`,
             inputSchema: schema,
             execute: async (input) => input,
         },

package/dist/src/pil/schema.d.ts

@@ -115,6 +115,7 @@ export declare const PipelineContextSchema: z.ZodObject<{
         answer: "answer";
         report: "report";
     }>>>;
+    directAnswer: z.ZodOptional<z.ZodBoolean>;
     t1Rules: z.ZodOptional<z.ZodArray<z.ZodString>>;
     _brainData: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         t0_principles: z.ZodArray<z.ZodObject<{

package/dist/src/pil/schema.js

@@ -69,6 +69,8 @@ export const PipelineContextSchema = z.object({
     fallbackReason: z.string().nullable().optional(),
     // Phase 2b: model-decided output deliverable consumed by layer4/layer6.
     deliverableKind: z.enum(["answer", "code", "report"]).nullable().optional(),
+    // Direct-answer gate: true when deliverable=answer + high confidence + low complexity.
+    directAnswer: z.boolean().optional(),
     // T1 behavioral rules from EE proven-tier points, injected as mandatory suffix by Layer 6.
     t1Rules: z.array(z.string()).optional(),
     _brainData: z

package/dist/src/pil/types.d.ts

@@ -44,6 +44,8 @@ export interface PipelineContext {
     sessionId?: string | null;
     /** GSD-native triage tier (set by layer4 — sourced from modelDepthTier when present). */
     complexityTier?: ComplexityTier | null;
+    /** True when layer4 classified this turn as a heavy GSD task the mutation gate must block until plan-review passes. */
+    gsdGateBlocking?: boolean | null;
     /**
      * Model-decided work depth (quick | standard | heavy), set by layer1's
      * model-first classifier (the 5th classify word). This is the agent-first
@@ -53,6 +55,14 @@ export interface PipelineContext {
      * the word OR the legacy cascade ran → layer4 falls back accordingly.
      */
     modelDepthTier?: ComplexityTier | null;
+    /**
+     * Leader-tier complexity assessor's auto-council recommendation (Task 4
+     * `assessComplexity` / `src/gsd/complexity-assessor.ts`), set by the native
+     * depth-sync block in message-processor.ts BEFORE `syncWorkflowContext`.
+     * undefined when the assessor didn't run (prefilter-skip / disabled) or
+     * failed; consumed by the auto-council gate (Task 8).
+     */
+    gsdAutoCouncil?: boolean;
     /**
      * Model-decided scope (agent-first replacement for the `mentionsEcosystemScope`
      * regex): true when the turn is about the Muonroi PLATFORM/ecosystem (BB/.NET,
@@ -97,6 +107,14 @@ export interface PipelineContext {
      * cascade ran → those consumers fall back to their regex predicates.
      */
     deliverableKind?: "answer" | "code" | "report" | null;
+    /**
+     * Direct-answer mode: true when deliverableKind === "answer" with high
+     * confidence AND low/medium complexity. Signals the orchestrator to skip
+     * MCP servers and strip write tools (bash, edit_file, write_file, etc.)
+     * because the question is purely informational — no code changes needed.
+     * Saves ~20K MCP schemas + ~1.5K write-tool schemas per turn.
+     */
+    directAnswer?: boolean;
     /**
      * Diagnostic: when the pipeline returns the fallback context, this records
      * the reason (timeout / schema-reject / exception). Null on the happy path.

package/dist/src/playbook/directives.d.ts

@@ -19,6 +19,8 @@
  */
 import type { GsdPhase } from "../gsd/types.js";
 import type { ComplexityTier } from "./complexity.js";
+/** When true and tier is standard/heavy, CHECK-PLAN points to gsd_plan_review tool. */
+export declare function buildNativeCheckPlanHint(): string;
 export interface DirectiveInput {
     /**
      * Model-decided work depth (agent-first — see layer1 `llm-classify`). Drives
@@ -62,6 +64,8 @@ export interface DirectiveInput {
      * the agent answered in English).
      */
     replyLanguage?: string;
+    /** When MUONROI_GSD_NATIVE=1, heavy/standard rubrics reference native tools. */
+    nativeGsd?: boolean;
 }
 export interface DirectiveOutput {
     text: string;