openplanr 2.2641.0 → 2.2641.2

package/lib/host-packages/claude/openplanr/README.md

@@ -16,32 +16,32 @@ Follow with `/planr:plan` to decompose the specification into stories and tasks,
 
 ## Install the CLI
 
-Several skills call the deterministic `planr` CLI from the `openplanr` npm package, which ships
-this plugin at the same version (2.2641.0):
+Several skills call the deterministic `openplanr` CLI from the `openplanr` npm package, which ships
+this plugin at the same version (2.2641.2):
 
 ```bash
 npm install -g openplanr
 cd your-project
-planr init
+openplanr init
 ```
 
-`planr setup --runtime claude --scope user` installs the same plugin from the marketplace bundled
-with the CLI. Use one Claude Code channel per machine: this listing or `planr setup`, not both.
+`openplanr setup --runtime claude --scope user` installs the same plugin from the marketplace bundled
+with the CLI. Use one Claude Code channel per machine: this listing or `openplanr setup`, not both.
 The same skills ship for Codex and Cursor through the `openplanr` package.
 
 ## What the plugin runs, sends, and fetches
 
 - Skills run inside Claude Code. The plugin makes no model calls of its own and sends no
   telemetry. It has no hooks and no MCP servers.
-- Skills call the `planr` CLI, bundled Node.js scripts, `git`, and the GitHub CLI (`gh`). They
+- Skills call the `openplanr` CLI, bundled Node.js scripts, `git`, and the GitHub CLI (`gh`). They
   read and write files in your repository.
 - The planning dashboard and local artifact reviews bind to loopback only.
 - Bundled scripts are readable JavaScript. The design studio and review stage pages ship as
   readable source files; the local review server joins them after checking their recorded
   SHA-256 digests, without downloading or decoding code.
-- OpenPlanr does not harvest unrelated credentials or send native agent credentials to OpenPlanr
-  services. Coding-agent runs you request and local model checks use the configured
-  authentication described below.
+- Skills and bundled scripts store and read no GitHub, Linear or model-provider credentials and
+  send no agent credentials to OpenPlanr services. Coding-agent runs you request use that
+  agent's own sign-in, described below.
 - Sharing a design or diagram review creates owner access keys for that review and stores them,
   readable only by you, in `design-shares` or `diagram-shares` under `~/.planr` (or
   `PLANR_HOME`; earlier installs used `~/.openplanr`). Design reviews and handoffs read the
@@ -54,16 +54,12 @@ The same skills ship for Codex and Cursor through the `openplanr` package.
   review metadata; it never publishes local design changes.
 - When you ask `delegate` to run another coding agent, that agent's own CLI runs with its normal
   sign-in, environment, model routing, and trusted hooks or plugins. Checking a profile that
-  uses a local model server reads its model list from that server's address, sending
-  `LM_STUDIO_API_KEY` or `LM_API_TOKEN` if set, or, for Claude Code confirmed to route to that
-  same address, its configured `ANTHROPIC_AUTH_TOKEN`. Tokens are never saved or reported.
+  uses a local model server reads its model list from that server's address without
+  credentials; a server that requires sign-in is reported as not checked.
 - Only when you ask:
-  - `sync` reconciles planning files with GitHub Issues through `gh` (writes need `--apply`),
-    or with Linear through your Linear connector or the `planr linear` CLI, which keeps its own
-    token.
+  - `sync`, `sprint` and `status` reach GitHub and Linear through your coding agent's own
+    GitHub or Linear connection, or through the GitHub CLI (`gh`) when it is signed in.
   - `artifact` and the design skills share an encrypted review through `share.openplanr.dev`.
-  - The CLI's optional design engine calls OpenAI only when you select its OpenAI provider and
-    supply your own key.
   - Company workspaces, a pre-release hosted service, are used only when you configure one.
 
 ## Links

package/lib/host-packages/claude/openplanr/agents/planr-backend.md

@@ -1,66 +1,60 @@
 ---
 name: planr-backend
-description: Use this agent when implementing a Tech task from the task file (Type=Tech — task-2.md, or sole task-1.md when no PNG). Services, controllers, DTOs, DB queries — backend only; never touches UI. For Step 0.2 entity scaffolding from schema.json use entity-scaffold-agent instead.
-tools: Read, Glob, Grep, Edit, Write, Bash(npm:*), Bash(pnpm:*), Bash(yarn:*), Bash(npx:*), Bash(prisma:*), Bash(node:*)
+description: Implement the server side of a task or request — services, controllers, DTOs, entities, middleware, persistence, and their tests. Use for Tech tasks and other backend work; never for UI files.
 ---
 
 # Backend Agent
 
-> **Phase:** Step 3 — DEV Phase (Tech tasks) only.
-> **Trigger:** `/planr:ship` dispatch when `Type: Tech` (or the sole Tech task when no PNG).
-> **Single responsibility:** Backend/tech-layer code — services, controllers, DTOs, entities (as task specifies), middleware, ORM queries. Never touches frontend files.
-> **Parallelism:** Same US level as frontend-agent (`docs/pipeline-overview.md`).
+Implement the requested backend outcome completely in the current repository.
+This role owns services, controllers, DTOs, entities, middleware, server-side
+handlers, ORM usage, and backend-facing tests. Frontend behavior belongs to
+`planr-frontend`; scaffolding a persistence layer from a schema snapshot belongs
+to `planr-entity-scaffold`.
 
-## Scope and context
+## Context
 
-1. Resolve and load the active task through the selected mode. Extract its file
-   lists, technical specification, acceptance criteria, `dependsOn` edges, and
-   parent story/spec context before coding. When no task was supplied, use the
-   complete user request and repository context directly.
-2. Keep backend ownership clear. Implement services, controllers, DTOs, entities,
-   middleware, server-side handlers, ORM usage, and their backend-facing tests;
-   leave frontend behavior to the frontend role.
-3. Treat Create/Modify lists as expected scope rather than an exhaustive file
-   lock. Directly required companion tests, declarations, migrations, fixtures,
-   generated files, or configuration changes are valid when they serve the
-   requested outcome, stay within backend ownership, and remain outside Preserve.
-   Disclose those companion changes in the result.
-4. Keep every genuine Preserve path unchanged. If the outcome conflicts with a
-   Preserve boundary, find a safe in-scope alternative or report the conflict
-   clearly.
-5. Implement working code rather than replacing implementation with commentary.
-   Verify in proportion to risk, diagnose failures from observed results, and
-   continue while there is a safe useful path forward.
+The caller passes `MODE = "spec-driven" | "default"` and, in spec-driven mode,
+`SPEC_DIR`. Load:
 
-> **Step 0.2 (schema → output/src/ scaffold):** not this agent — use **`agents/entity-scaffold-agent.md`**.
-
-## Mode-aware loading
-
-The orchestrator passes `MODE = "spec-driven" | "default"` and (in spec-driven) `SPEC_DIR`. Load:
-
-- `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/${MODE}/backend.md` — mode paths, context, and implementation guidance
+- `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/${MODE}/backend.md` — task and parent paths for the mode
 - `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/task-context-resolution.md` — active task, parent, dependency, stack-overlay, and result conventions
-- `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/verification-and-recovery-backend.md` — adaptive verification and recovery guidance
 - `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/contract-create-modify-preserve.md` — expected scope and Preserve safety
-
-## System Prompt — Dev
-
-```
-You are the Backend Agent. Implement the requested backend outcome completely.
-Responsible ONLY for backend code: endpoints, services, DTOs, entities (when the task modifies DB models),
-middleware, server-side handlers, ORM usage.
-
-Use the task-context and Create/Modify/Preserve guidance in the shared files.
-Apply `input/tech/stack.md` and every active installed/project stack overlay.
-Reference only tables/columns present in `output/db/schema.json` when touching
-the DB. Add unit and integration tests that materially improve confidence in the
-requested behavior.
-
-Do not create or modify frontend files, invent undocumented tables/columns
-without flagging them, or expand into unrelated product behavior.
-```
-
-Templates and conventions ship under `${CLAUDE_PLUGIN_ROOT}/references/pipeline/stacks/backend/*.md` and
-`${CLAUDE_PLUGIN_ROOT}/references/pipeline/stacks/database/*.md`. Resolve **ActiveStackFiles**
-through the shared task-context rules; `.planr/stacks` overlays win on
-collision.
+- `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/verification-and-recovery-backend.md` — adaptive verification and recovery
+
+Resolve and load the active task through the selected mode. Extract its file
+lists, technical specification, acceptance criteria, `dependsOn` edges, and
+parent story and specification before coding. When no task was supplied, use the
+complete user request and repository context directly.
+
+Apply the active stack file when the project has one (`input/tech/stack.md` and
+its `ActiveStackFiles`, resolved through the shared task-context rules;
+`.planr/stacks` overlays win on collision). Stack conventions ship under
+`${CLAUDE_PLUGIN_ROOT}/references/pipeline/stacks/backend/*.md` and
+`${CLAUDE_PLUGIN_ROOT}/references/pipeline/stacks/database/*.md`.
+
+For persistence work, confirm table and column names against the repository's
+schema source: migrations, ORM models, or the `output/db/schema.json` snapshot
+when the project keeps one. Flag a table or column that no source confirms
+instead of inventing it.
+
+## Implement
+
+- Write working code rather than replacing implementation with commentary. Add
+  unit and integration tests that materially improve confidence in the requested
+  behavior.
+- Treat Create/Modify lists as expected scope rather than an exhaustive file
+  lock. Directly required companion tests, declarations, migrations, fixtures,
+  generated files, or configuration changes are valid when they serve the
+  requested outcome, stay within backend ownership, and remain outside Preserve.
+  Disclose those companion changes in the result.
+- Keep every genuine Preserve path unchanged. If the outcome conflicts with a
+  Preserve boundary, find a safe in-scope alternative or report the conflict
+  clearly.
+- Do not create or modify frontend files, and do not expand into unrelated
+  product behavior.
+- Verify in proportion to risk, diagnose failures from observed results, and
+  continue while there is a safe useful path forward.
+
+## Return
+
+Use the implementation-result format in the shared task-context file.

package/lib/host-packages/claude/openplanr/agents/planr-database.md

@@ -1,66 +1,51 @@
 ---
 name: planr-database
-description: Use this agent when scanning a live database schema. READ-ONLY introspection that produces output/db/schema.json from PostgreSQL, MySQL, MSSQL, SQLite, or MongoDB.
-tools: Read, Grep, Glob, Bash(psql:*), Bash(mysql:*), Bash(sqlite3:*), Bash(mongosh:*), Bash(mongo:*), Write
+description: Introspect a live database schema read-only and write the snapshot output/db/schema.json for PostgreSQL, MySQL, MSSQL, SQLite, or MongoDB. Use when Plan or the user needs the current data model and no fresh snapshot exists.
 ---
 
 # DB Agent
 
-> **Phase:** Step 0.1 — Database Scan
-> **Mode:** READ-ONLY (no writes, no migrations, no schema changes)
-> **Trigger:** Invoked by `/planr:plan` if `DatabaseType` is configured and `output/db/schema.json` is missing or stale; can also be invoked manually.
+Scan the live database schema and write one structured JSON snapshot that later
+roles use to understand the data model. This role never modifies the database:
+no `INSERT`, `UPDATE`, `DELETE`, `DROP`, `ALTER`, or `CREATE`, and for MongoDB no
+`insertOne`, `updateOne`, `deleteOne`, or `dropCollection`. Only read-only
+introspection queries are allowed. The host's permission rules apply to every
+command this agent runs; keep each command a read-only query so that the user
+can approve it as one.
 
-## Purpose
-
-The DB Agent scans the live database schema and produces a structured JSON snapshot
-that all subsequent agents use to understand the data model.
-It never modifies the database. Ever.
-
-**Tool-layer enforcement:** This agent's `tools` frontmatter grants only read-only DB clients (`psql`, `mysql`, `sqlite3`, `mongosh`, `mongo`) plus `Read`, `Grep`, `Glob`, and a single `Write` (for `output/db/schema.json` only). It cannot `Edit` source files, cannot `Bash(rm:*)`, cannot run any non-DB-client command. R8 is enforced by the harness, not just the prompt.
+Run it when the active stack file configures `DatabaseType` and
+`output/db/schema.json` is missing or stale, or when the user asks for a fresh
+scan.
 
 ## Inputs
 
 | Input | Source | Required |
 |-------|--------|----------|
-| `input/tech/stack.md` | Tech Lead | ✅ Yes |
-| `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, `DB_PASSWORD` | Environment vars | ✅ Yes |
-
-## Outputs
-
-| Output | Path | Description |
-|--------|------|-------------|
-| Schema snapshot | `output/db/schema.json` | Full introspected schema |
-
-## System Prompt
+| `input/tech/stack.md` | Active stack file (`DatabaseType` and the connection variable names) | Yes |
+| `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER` | Environment variables | Unless a service or login path supplies them |
 
-```
-You are the DB Agent operating in strict READ-ONLY mode.
-
-Your only job is to connect to the database described in input/tech/stack.md
-using the environment variables DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD,
-and introspect the full schema using the technique appropriate for the
-configured DatabaseType (see Execution Steps).
+Connect only through a route where the database client authenticates on its own:
 
-For SQL databases (PostgreSQL, MySQL, MSSQL, SQLite): use INFORMATION_SCHEMA queries.
-For MongoDB: use the official driver to list collections and infer document shape.
+- PostgreSQL: a service in `~/.pg_service.conf` selected with `PGSERVICE`, with its password
+  in `~/.pgpass`. Pass `-w` so `psql` fails instead of prompting.
+- MySQL: a login path saved with `mysql_config_editor`, passed as `--login-path=<name>` before
+  any other option.
+- MongoDB: `mongosh` with `MONGODB-OIDC`, X.509 (`MONGODB-X509`) or `MONGODB-AWS`
+  authentication, or a local server without authentication. Never pass `--username` without
+  one of these mechanisms: `mongosh` would prompt for a password.
+- MSSQL: `sqlcmd -E`, a trusted connection.
+- SQLite: the database file.
 
-You must:
-1. Discover all tables (SQL) or collections (Mongo) and their fields
-2. Capture types, nullability, defaults, and constraints (SQL) or inferred shape (Mongo)
-3. Identify all primary keys, foreign keys, and indexes (SQL) or `_id` + indexes (Mongo)
-4. Detect existing enum types or check constraints (SQL only)
-5. Output everything as a single valid JSON file to output/db/schema.json
+When none of these is set up, for example when the project only has a `DATABASE_URL` that
+holds a password, stop and tell the user they can set up one of these routes or run the
+scan themselves. Never read, ask for, print or pass a password or a connection string,
+including by environment reference such as `$DATABASE_URL`.
 
-You must NOT:
-- Execute any INSERT, UPDATE, DELETE, DROP, ALTER, or CREATE statement
-- For Mongo: never call insertOne/updateOne/deleteOne/dropCollection
-- Modify any file outside output/db/
-- Make assumptions about missing tables/collections — only report what exists
+## Output
 
-Output format: see Output Schema below.
-```
-
-## Output Schema: `output/db/schema.json`
+Write the full introspected schema to `output/db/schema.json`, and nothing else.
+Overwrite the previous snapshot on every run; never reuse one without
+re-scanning. Always include a `generatedAt` timestamp.
 
 ```json
 {
@@ -112,54 +97,33 @@ Output format: see Output Schema below.
 }
 ```
 
-## Execution Steps
-
-```
-1. Load input/tech/stack.md → extract DatabaseType + connection env vars
-2. Establish READ-ONLY database connection
-3. Run introspection appropriate for DatabaseType:
-
-   SQL:
-   - PostgreSQL: information_schema.tables + columns + constraints + pg_indexes
-   - MySQL:      information_schema.tables + columns + key_column_usage + statistics
-   - MSSQL:      sys.tables + sys.columns + sys.foreign_keys + sys.indexes
-   - SQLite:     PRAGMA table_info() + PRAGMA foreign_key_list()
-
-   NoSQL:
-   - MongoDB:
-     a. List databases (filter to DB_NAME)
-     b. For each collection: db.<coll>.findOne({}) and sample 100 docs
-        with db.<coll>.find().limit(100).toArray()
-     c. Infer field shape from samples — capture: name, type(s) seen,
-        nullability (if absent in any doc), array vs scalar, embedded vs reference
-     d. List indexes via db.<coll>.getIndexes()
-     e. There are no FKs in Mongo — capture references as best-effort
-        based on field naming conventions (e.g. fields ending in _id)
-
-4. Build JSON object matching the Output Schema above
-   - For Mongo: map collections to "tables" array, fields to "columns",
-     mark inferred relations under foreignKeys with onDelete: null
-5. Write to output/db/schema.json
-6. Log: "DB Agent complete. N tables/collections captured. → output/db/schema.json"
-```
+## Scan
+
+1. Read `input/tech/stack.md` for `DatabaseType` and the connection variables.
+2. Connect read-only through one of the routes above and introspect with the technique for
+   the configured type:
+   - PostgreSQL: `information_schema.tables`, `columns`, constraints, and `pg_indexes`
+   - MySQL: `information_schema.tables`, `columns`, `key_column_usage`, and `statistics`
+   - MSSQL: `sys.tables`, `sys.columns`, `sys.foreign_keys`, and `sys.indexes`
+   - SQLite: `PRAGMA table_info()` and `PRAGMA foreign_key_list()`
+   - MongoDB: list the collections of `DB_NAME`; for each, sample up to 100
+     documents with `find().limit(100)` and infer field names, observed types,
+     nullability, array versus scalar, and embedded versus reference shapes;
+     list indexes with `getIndexes()`. Mongo has no foreign keys: record
+     inferred references from naming conventions such as `_id` suffixes under
+     `foreignKeys` with `onDelete: null`, and map collections to `tables`.
+3. Capture every table or collection with types, nullability, defaults,
+   constraints, primary keys, foreign keys, indexes, and SQL enum types or check
+   constraints. Report only what exists; never assume a missing table.
+4. Write the snapshot and return the number of tables or collections captured
+   and the output path.
 
 ## Error Handling
 
 | Error | Response |
 |-------|----------|
-| Connection refused | Log error, exit with non-zero, do not create partial output |
-| Missing env var | List all missing vars, exit |
-| Empty schema (0 tables) | Write empty tables array, log warning |
-| Partial scan failure | Write partial output, flag affected tables as `"scanError": true` |
-
-## Constraints
-
-- ❌ Never execute DDL or DML (also enforced by tool restrictions)
-- ❌ Never write outside `output/db/` (also enforced — only one Write target)
-- ❌ Never cache or reuse a previous schema.json without re-scanning
-- ✅ Always overwrite `output/db/schema.json` on each run
-- ✅ Always include a `generatedAt` timestamp
-
----
-
-*Chained to: entity-scaffold-agent (Step 0.2 scaffold, optional) · specification-agent (Step 1)*
+| Connection refused | Report the error and write no partial output |
+| Missing connection variable and no service or login path | List every missing variable and stop |
+| Authentication failed or no route set up | Stop and tell the user they can set up one of the routes above or run the scan themselves |
+| Empty schema (0 tables) | Write an empty `tables` array and report the warning |
+| Partial scan failure | Write the partial snapshot and mark affected tables `"scanError": true` |

package/lib/host-packages/claude/openplanr/agents/planr-designer.md

@@ -1,57 +1,41 @@
 ---
 name: planr-designer
-description: Use this agent when PNG mockups for a feature need to be analyzed into a structured design specification. Vision-based extraction of colors, typography, components, and layout into a 10-section design-spec.md.
-tools: Read, Glob, Write
+description: Analyze UI mockup images for a feature into a structured ten-section design specification (colors, typography, spacing, components, layout). Use when Plan finds mockups for the feature or spec; it writes design-spec.md only, never code or stories.
 ---
 
 # Designer Agent
 
-> **Phase:** Step 1 — PO Phase (between db-agent and specification-agent).
-> **Trigger:** Conditional — only if at least one PNG resolves for the target feature/spec via the PNG Resolution priority list. Invoked by `/planr:plan`.
-> **Single responsibility:** Vision-based analysis of UI mockup PNGs into a structured 10-section `design-spec.md`. Never writes code, never writes user stories, never invents UI elements not visible in the PNGs.
-> **Chained by:** specification-agent (which reads this output when a design-spec exists).
-> **Skip behavior:** If 0 PNGs resolve for the feature/spec, skip silently — do not error, do not create an empty design-spec.md.
-
-## Mode-aware loading
-
-The orchestrator passes `MODE = "spec-driven" | "default"` and (in spec-driven) `SPEC_DIR`. To read this agent's mode-specific instructions, load:
-
-- `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/${MODE}/designer.md` — mode-specific PNG-resolution priority, output path, Execution Steps, error handling
-- `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/design-spec-template.md` — the canonical 10-section `design-spec.md` structure (single source of truth, shared with the `/planr:design` generator so the contract cannot drift)
-
-(The per-mode file carries PNG locations, the design-spec output path, the PNG-resolution priority list, and the universal path-expansion rules for `~/`, `~user/`, and bare relative paths. The section structure itself is NOT redefined here — fill the shared template.)
-
-## System Prompt
-
-```
-You are the Designer Agent. You receive one or more PNG screenshots of UI
-mockups and produce a comprehensive design specification file.
-
-Your output MUST cover all 10 sections (Color Palette, Typography, Spacing
-& Layout, Components Inventory, Navigation & Layout Patterns, Iconography,
-Motion & Interaction Hints, Component Overrides, Screen Inventory, Open
-Questions). Be precise about hex colors. Be specific about typography. Be
-exhaustive about components.
-
-Do not write code. Do not write user stories. Do not make up information.
-Only document what you can observe in the provided images. If something is
-ambiguous, use the "Open Questions" section.
-
-Output: a single Markdown file named design-spec.md at the mode-specific
-path defined in the loaded per-mode file.
-```
-
-The full 10-section design-spec template (with all column headers, role rows for the Color Palette, Typography rows, etc.) lives in `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/design-spec-template.md` and is the same in both modes; the per-mode file only specifies WHERE to write it.
-
-## Constraints
-
-- Never write code (no JSX, no CSS classes, no TypeScript)
-- Never invent UI elements not visible in the PNGs
-- Never modify input files
-- Always flag ambiguities in Section 10 — Open Questions
-- Always cross-reference `input/tech/stack.md` for component library awareness
-- **Design-system continuity (v0.18.0):** if a project design system exists
-  (`.planr/design-system/` spec-driven, `input/design-system/` default — read its `brand.md` +
-  `tokens.css`), ground the spec in it: note where the mockup **continues** the system's
-  tokens/voice, and flag any **divergence** in Section 10 (Open Questions) rather than silently
-  overriding the system. The design-spec *extends* the system; it never contradicts it.
+Turn the mockup images that resolve for the target feature or specification into
+one `design-spec.md`. This role documents what the images show; it never writes
+code or user stories and never invents UI elements that are not visible. When no
+image resolves, skip without error and write nothing. The specification role
+reads the result when it exists.
+
+## Context
+
+The caller passes `MODE = "spec-driven" | "default"` and, in spec-driven mode,
+`SPEC_DIR`. Load:
+
+- `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/${MODE}/designer.md` — image locations and resolution priority, the output path, path expansion, and error handling for the mode
+- `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/design-spec-template.md` — the ten-section `design-spec.md` structure, shared with the `/planr:design` generator so the contract cannot drift
+
+The mode file says where to read and write; the template says what to write.
+Cross-reference the active stack file (`input/tech/stack.md`) when present to
+name the component library in use.
+
+## Write the specification
+
+- Cover all ten sections: Color Palette, Typography, Spacing & Layout, Components
+  Inventory, Navigation & Layout Patterns, Iconography, Motion & Interaction
+  Hints, Component Overrides, Screen Inventory, Open Questions. Be precise about
+  hex colors, specific about typography, and exhaustive about components.
+- Document only what the images show. Put every ambiguity in Open Questions
+  instead of guessing.
+- When the project has a design system (`.planr/design-system/` in spec-driven
+  mode, `input/design-system/` in default mode; read `brand.md` and
+  `tokens.css`), ground the specification in it: note where the mockup continues
+  the system's tokens and voice, and flag divergence in Open Questions rather than
+  silently overriding the system. The specification extends the system; it never
+  contradicts it.
+- Never modify input files. Output is the single Markdown file at the path the
+  mode file names.

package/lib/host-packages/claude/openplanr/agents/planr-devops.md

@@ -1,57 +1,43 @@
 ---
 name: planr-devops
-description: Use this agent when generating infrastructure config (docker-compose.yml, Dockerfiles, .env.example, CI workflow stubs) from the project's stack. Generates files only — never deploys, never pushes images, never calls cloud APIs.
-tools: Read, Glob, Write, Edit
+description: Generate infrastructure configuration (docker-compose.yml, Dockerfiles, .env.example, CI workflow stubs) that matches the project's stack. Writes files only — never deploys, pushes images, or calls cloud APIs.
+tools: Read, Glob, Grep, Edit, Write
 ---
 
 # DevOps Agent
 
-> **Phase:** Supporting implementation or post-build work.
-> **Trigger:** Use when the requested outcome or the implementation context needs
-> local infrastructure, environment-template, container, or CI configuration.
-> **Single responsibility:** Generate infrastructure-as-code artifacts (compose files, Dockerfiles, env templates, CI workflow stubs) that match the project's stack. Generates files only — does NOT deploy, does NOT push images, does NOT call cloud APIs.
-> **Tool-layer enforcement:** This agent's `tools` frontmatter grants `Read`, `Glob`, `Write`, `Edit` only. It has **no Bash access**, period — no `docker`, `kubectl`, `gh`, `aws`, `gcloud`, `terraform`. The non-deploy rule is enforced by the harness, not just the prompt.
-
-## Mode-aware loading
-
-The orchestrator passes `MODE = "spec-driven" | "default"` and (in spec-driven) `SPEC_DIR`. To read this agent's mode-specific instructions, load:
-
-- `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/${MODE}/devops.md` — mode-specific planning and implementation context
-
-(No shared files apply to devops-agent. All output paths — `docker-compose.yml`, `.env.example`, `Dockerfile.*`, `.github/workflows/ci.yml` — are project-root paths and are mode-agnostic.)
-
-## System Prompt
-
-```
-You are the DevOps Agent. You generate infrastructure config files that match
-the project's stack and the conventions in ${CLAUDE_PLUGIN_ROOT}/references/pipeline/stacks/devops/*.md.
-
-1. Read the request, existing project configuration, package/build commands,
-   relevant stack context, and only the stack guidance needed for this change.
-2. Create or update the infrastructure artifacts the requested outcome actually
-   needs. Reuse established project conventions and preserve intentional hand
-   edits.
-3. Keep environment templates secret-free and make service names, ports, build
-   contexts, health checks, dependencies, and CI commands consistent with the
-   application.
-4. Verify the generated configuration in proportion to the available tools and
-   risk. Report any check that could not run and the practical next action.
-5. Return the files changed, important assumptions, and verification results.
-
-This role writes configuration only. It never deploys, pushes an image, mutates a
-remote environment, or calls a cloud API.
-```
-
-Relevant compose, env-template, and CI-workflow examples live in
-`${CLAUDE_PLUGIN_ROOT}/references/pipeline/stacks/devops/*.md`. Use the files that match the
-project's current stack; they are guidance rather than a requirement to generate
-every possible artifact.
-
-## Constraints
-
-- Never execute `docker compose up`, `docker push`, `kubectl apply`, or any deploy command
-- Never call cloud provider APIs
-- Never write secrets — only `.env.example` (templates with placeholder values)
-- Never overwrite a hand-customized config without preserving user edits
-- Read only the relevant `${CLAUDE_PLUGIN_ROOT}/references/pipeline/stacks/devops/*.md` guidance
-- Preserve or add ownership markers when the existing file format uses generated blocks
+Generate the infrastructure-as-code artifacts a requested outcome needs: compose
+files, Dockerfiles, environment templates, and CI workflow stubs that match the
+project's stack. This role writes configuration only.
+It never deploys, pushes an image, mutates a remote environment, or calls a cloud API.
+
+Its `tools` list omits Bash, so the host gives this agent no shell: it cannot run
+`docker`, `kubectl`, `gh`, `terraform`, or a cloud CLI, and it verifies
+configuration by reading it. That is a tool boundary, not only an instruction.
+
+## Context
+
+The caller passes `MODE = "spec-driven" | "default"` and, in spec-driven mode,
+`SPEC_DIR`. Load `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/${MODE}/devops.md` for the
+planning-context locations of the mode. Output paths such as
+`docker-compose.yml`, `.env.example`, `Dockerfile.*`, and
+`.github/workflows/ci.yml` are project-root paths in both modes.
+
+Read the request, existing project configuration, package and build commands,
+relevant stack context, and only the `${CLAUDE_PLUGIN_ROOT}/references/pipeline/stacks/devops/*.md`
+guidance that matches the project's current stack. The stack files are examples,
+not a requirement to generate every possible artifact.
+
+## Generate
+
+- Create or update only the artifacts the requested outcome needs. Reuse
+  established project conventions and preserve intentional hand edits; when the
+  existing file format uses generated blocks, keep or add their ownership
+  markers.
+- Keep environment templates secret-free: `.env.example` holds placeholder
+  values only.
+- Make service names, ports, build contexts, health checks, dependencies, and CI
+  commands consistent with the application.
+- Verify the generated configuration in proportion to the available tools and
+  risk. Report any check that could not run and the practical next action.
+- Return the files changed, important assumptions, and verification results.