pruff-skills 0.5.5 → 0.5.6

package/dist/_chunks/libs/@clack/prompts.mjs

@@ -1,5 +1,5 @@
 import { __toESM } from "../../rolldown-runtime.mjs";
-import { LD, RD, SD, _D, dD, fD, require_picocolors, require_src } from "./core.mjs";
+import { LD, MD, RD, SD, _D, dD, fD, require_picocolors, require_src } from "./core.mjs";
 import { stripVTControlCharacters } from "node:util";
 import y from "node:process";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
@@ -7,7 +7,7 @@ var import_src = require_src();
 function ce() {
 	return y.platform !== "win32" ? y.env.TERM !== "linux" : !!y.env.CI || !!y.env.WT_SESSION || !!y.env.TERMINUS_SUBLIME || y.env.ConEmuTask === "{cmd::Cmder}" || y.env.TERM_PROGRAM === "Terminus-Sublime" || y.env.TERM_PROGRAM === "vscode" || y.env.TERM === "xterm-256color" || y.env.TERM === "alacritty" || y.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
-const V = ce(), u = (t, n) => V ? t : n, le = u("◆", "*"), L = u("■", "x"), W = u("▲", "x"), C = u("◇", "o"), ue = u("┌", "T"), o = u("│", "|"), d = u("└", "—"), k = u("●", ">"), P = u("○", " "), A = u("◻", "[•]"), T = u("◼", "[+]"), F = u("◻", "[ ]"), _ = u("─", "-"), me = u("╮", "+"), de = u("├", "+"), pe = u("╯", "+"), q = u("●", "•"), D = u("◆", "*"), U = u("▲", "!"), K = u("■", "x"), b = (t) => {
+const V = ce(), u = (t, n) => V ? t : n, le = u("◆", "*"), L = u("■", "x"), W = u("▲", "x"), C = u("◇", "o"), ue = u("┌", "T"), o = u("│", "|"), d = u("└", "—"), k = u("●", ">"), P = u("○", " "), A = u("◻", "[•]"), T = u("◼", "[+]"), F = u("◻", "[ ]"), $e = u("▪", "•"), _ = u("─", "-"), me = u("╮", "+"), de = u("├", "+"), pe = u("╯", "+"), q = u("●", "•"), D = u("◆", "*"), U = u("▲", "!"), K = u("■", "x"), b = (t) => {
 	switch (t) {
 		case "initial":
 		case "active": return import_picocolors.default.cyan(le);
@@ -43,6 +43,26 @@ ${import_picocolors.default.yellow(d)}  ${import_picocolors.default.yellow(this.
 ${import_picocolors.default.gray(o)}` : ""}`;
 			default: return `${n}${import_picocolors.default.cyan(o)}  ${i}
 ${import_picocolors.default.cyan(d)}
+`;
+		}
+	}
+}).prompt(), ge = (t) => new MD({
+	validate: t.validate,
+	mask: t.mask ?? $e,
+	render() {
+		const n = `${import_picocolors.default.gray(o)}
+${b(this.state)}  ${t.message}
+`, r = this.valueWithCursor, i = this.masked;
+		switch (this.state) {
+			case "error": return `${n.trim()}
+${import_picocolors.default.yellow(o)}  ${i}
+${import_picocolors.default.yellow(d)}  ${import_picocolors.default.yellow(this.error)}
+`;
+			case "submit": return `${n}${import_picocolors.default.gray(o)}  ${import_picocolors.default.dim(i)}`;
+			case "cancel": return `${n}${import_picocolors.default.gray(o)}  ${import_picocolors.default.strikethrough(import_picocolors.default.dim(i ?? ""))}${i ? `
+${import_picocolors.default.gray(o)}` : ""}`;
+			default: return `${n}${import_picocolors.default.cyan(o)}  ${r}
+${import_picocolors.default.cyan(d)}
 `;
 		}
 	}
@@ -351,4 +371,4 @@ ${J}${i.trimStart()}`), r = 3 + stripVTControlCharacters(i.trimStart()).length);
 		}
 	};
 };
-export { Ie, M, Me, Se, Y, be, fe, he, ve, xe, ye };
+export { Ie, M, Me, Se, Y, be, fe, ge, he, ve, xe, ye };

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { __toESM } from "./_chunks/rolldown-runtime.mjs";
 import { pD, require_picocolors } from "./_chunks/libs/@clack/core.mjs";
-import { Ie, M, Me, Se, Y, be, fe, he, ve, xe, ye } from "./_chunks/libs/@clack/prompts.mjs";
+import { Ie, M, Me, Se, Y, be, fe, ge, he, ve, xe, ye } from "./_chunks/libs/@clack/prompts.mjs";
 import { esm_default } from "./_chunks/libs/simple-git.mjs";
 import { xdgConfig } from "./_chunks/libs/xdg-basedir.mjs";
 import { require_dist } from "./_chunks/libs/@vercel/detect-agent.mjs";
@@ -6562,6 +6562,9 @@ react-doctor/diff tools, use PR-scoped diffs and manually verify risky logic.
 7. **Never run DB migrations automatically** — propose the change and let the developer run it.
 8. **Never push directly to \`dev\` or \`main\`** — all changes must go through a PR. No exceptions.
 `;
+const CONTROL_PLANE_DB = "pruff-local";
+const INTELLIGENCE_DB = "pruff_intelligence";
+const FRONTEND_URL = "http://localhost:3001";
 const CONTROL_PLANE_PRESEED_SCRIPT = `import { PrismaClient } from '@prisma/client';
 
 import seedRoles from './prisma/seeds/roles';
@@ -6578,6 +6581,22 @@ async function main() {
   await seedCompanyTypes();
 }
 
+main()
+  .catch((e) => {
+    console.error(e);
+    process.exit(1);
+  })
+  .finally(() => process.exit(0));
+`;
+const RUT_CONFLICT_PROBE_SCRIPT = `import PrismaClientManager from './src/modules/prismaClient';
+
+async function main() {
+  const rut = process.argv[2];
+  const prisma = PrismaClientManager.getGlobalClient();
+  const company = await prisma.company.findFirst({ where: { taxIdentifier: rut } });
+  console.log('RUT_HOLDER=' + (company ? company.secretId : ''));
+}
+
 main()
   .catch((e) => {
     console.error(e);
@@ -6588,6 +6607,8 @@ main()
 const TENANT_USER_BACKFILL_SCRIPT = `import PrismaClientManager from './src/modules/prismaClient';
 import EncryptionModule from './src/modules/encryptionModule';
 
+const SUPER_ADMIN_ROLE_ID = 4;
+
 async function main() {
   const email = process.argv[2];
   const password = process.argv[3];
@@ -6596,8 +6617,15 @@ async function main() {
 
   const tenantPrisma = PrismaClientManager.getGlobalClient();
   const existing = await tenantPrisma.user.findFirst({ where: { email } });
+
   if (existing) {
-    console.log('tenant user already present: ' + email);
+    // create-intel-tenant-local resets tenant roles to Administrador only;
+    // reconnect Super Administrador so the local admin keeps full access.
+    await tenantPrisma.user.update({
+      where: { id: existing.id },
+      data: { roles: { connect: [{ id: SUPER_ADMIN_ROLE_ID }] } },
+    });
+    console.log('tenant user present: ' + email + ' (super-admin role ensured)');
     return;
   }
 
@@ -6613,7 +6641,7 @@ async function main() {
       password: encryptedPassword,
       active: true,
       companyId: globalUser.companyId,
-      roles: { connect: [{ id: 4 }] },
+      roles: { connect: [{ id: SUPER_ADMIN_ROLE_ID }] },
     },
   });
   console.log('tenant user created: ' + email + ' (id=' + globalUser.id + ')');
@@ -6626,11 +6654,168 @@ main()
   })
   .finally(() => process.exit(0));
 `;
+const ACCOUNTING_PERIOD_SCRIPT = `import PrismaClientManager from './src/modules/prismaClient';
+
+async function main() {
+  const year = Number(process.argv[2]);
+  const startDate = new Date(Date.UTC(year, 0, 1, 0, 0, 0));
+  const endDate = new Date(Date.UTC(year, 11, 31, 23, 59, 59));
+
+  const prisma = PrismaClientManager.getGlobalClient();
+  const overlap = await prisma.accountingPeriod.findFirst({
+    where: { startDate: { lte: endDate }, endDate: { gte: startDate } },
+  });
+  if (overlap) {
+    console.log('accounting period already covers ' + year + ': ' + overlap.label);
+    return;
+  }
+
+  const period = await prisma.accountingPeriod.create({
+    data: { startDate, endDate, label: 'Año ' + year, status: 'OPEN' },
+  });
+  console.log('accounting period opened: ' + period.label + ' (id=' + period.id + ')');
+}
+
+main()
+  .catch((e) => {
+    console.error(e);
+    process.exit(1);
+  })
+  .finally(() => process.exit(0));
+`;
+const MIGRATE_TENANTS_LOCAL_SCRIPT = `import { exec } from 'child_process';
+import dotenv from 'dotenv';
+import PrismaClientManager from '../src/modules/prismaClient';
+const env = 'local.env';
+dotenv.config({ path: env });
+
+async function getActiveTenants() {
+  const prismaGlobal = PrismaClientManager.getGlobalClient();
+  const companies = await prismaGlobal.company.findMany({
+    where: { tenant: true },
+    select: { secretId: true },
+  });
+  console.log('Companies:', companies.length);
+  return companies.map((company) => company.secretId);
+}
+
+function migrate(label: string, databaseUrl: string) {
+  return new Promise((resolve, reject) => {
+    const command = \`DATABASE_URL="\${databaseUrl}" npx prisma migrate deploy\`;
+    console.log(\`Running command: \${command}\`);
+    exec(command, (error, stdout, stderr) => {
+      if (error) {
+        console.error(\`Error migrating \${label}:\`, error);
+        reject(error);
+        return;
+      }
+      if (stderr) {
+        console.error(\`Stderr for \${label}:\`, stderr);
+        reject(new Error(stderr));
+        return;
+      }
+      console.log(\`Migration output for \${label}:\`, stdout);
+      resolve(stdout);
+    });
+  });
+}
+
+async function migrateTenants() {
+  console.log('Migrating main database');
+  try {
+    await migrate('local database', process.env.DATABASE_URL!);
+  } catch (error) {
+    console.error('Failed to migrate local database:', error);
+  }
+
+  try {
+    const tenantIds = await getActiveTenants();
+    for (const tenantId of tenantIds) {
+      console.log(\`Migrating tenant: \${tenantId}\`);
+      const databaseUrl = process.env.DATABASE_URL!.replace(
+        '/${CONTROL_PLANE_DB}',
+        \`/tenant-\${tenantId}\`,
+      );
+      try {
+        await migrate(\`tenant \${tenantId}\`, databaseUrl);
+      } catch (error) {
+        console.error(\`Failed to migrate tenant \${tenantId}:\`, error);
+      }
+    }
+  } catch (error) {
+    console.error('Error fetching tenants or migrating:', error);
+  }
+}
+
+migrateTenants();
+`;
+function mysqlUrl(dbPassword, db, query = "") {
+	return `mysql://${dbPassword ? `root:${encodeURIComponent(dbPassword)}` : "root"}@localhost:3306/${db}${query}`;
+}
+const TEAM_PROVIDED_ENV = [
+	{
+		keys: [
+			"AWS_ACCESS_KEY_ID",
+			"AWS_SECRET_ACCESS_KEY",
+			"PRUFF_PRIVATE_BUCKET"
+		],
+		unlocks: "S3 — every document upload/download and generated PDF (referenced in ~50 places). Nothing file-related works without it. Ask for a dev IAM user, or run the `localstack` skill for a local S3."
+	},
+	{
+		keys: [
+			"SII_SERVICE_URL",
+			"SII_SERVICE_APIKEY",
+			"SII_QUERY_IDENTIFIER",
+			"SII_ENCRYPTED_PASSWORD"
+		],
+		unlocks: "SII scrapers — invoices, F29/F22, cesiones, certificate validation."
+	},
+	{
+		keys: ["TGR_SERVICE_URL", "TGR_SERVICE_APKEY"],
+		unlocks: "TGR — tax debts, collections, payment agreements."
+	},
+	{
+		keys: ["EXTERNAL_DATABASE_URL", "EXTERNAL_DATABASE_APIKEY"],
+		unlocks: "Bankruptcy / Rutificator / DepartmentOfLabor lookups used by Motor de Riesgo."
+	},
+	{
+		keys: [
+			"BURO_USERNAME",
+			"BURO_PASSWORD",
+			"BURO_API_URL",
+			"CMF_API_KEY"
+		],
+		unlocks: "Credit bureau + CMF risk data."
+	},
+	{
+		keys: ["DECISION_ENGINE_SERVICE_URL", "DECISION_ENGINE_SERVICE_APIKEY"],
+		unlocks: "Remote Motor de Riesgo. Local runs use EXECUTE_LOCAL_DECISION_ENGINE=true instead."
+	},
+	{
+		keys: [
+			"NOTIFICATION_SERVICE_URL",
+			"EVENT_TOPIC_ARN",
+			"WEBHOOK_DELIVERY_QUEUE_URL"
+		],
+		unlocks: "Outbound email / events / webhooks."
+	},
+	{
+		keys: ["PRUFF_AI_URL", "PRUFF_AI_INTERNAL_SERVICE_TOKEN"],
+		unlocks: "Pruff AI features."
+	}
+];
 function renderLocalEnv(v) {
 	const q = (value) => `"${value.replace(/"/g, "\\\"")}"`;
-	return `DATABASE_URL=${q(`mysql://root@localhost:3306/pruff-local?connection_limit=5`)}
+	const teamProvided = TEAM_PROVIDED_ENV.flatMap((group) => [
+		`# ${group.unlocks}`,
+		...group.keys.map((key) => `${key}=""`),
+		""
+	]).join("\n");
+	return `DATABASE_URL=${q(mysqlUrl(v.dbPassword, CONTROL_PLANE_DB, "?connection_limit=5"))}
+INTELLIGENCE_DATABASE_URL=${q(mysqlUrl(v.dbPassword, INTELLIGENCE_DB))}
 NODE_ENV="local"
 IS_LOCAL_ENV="true"
+FRONTEND_URL=${q(FRONTEND_URL)}
 CLIENT_ID=${q(v.clientId)}
 CLIENT_RUT=${q(v.clientRut)}
 CLIENT_NAME=${q(v.clientName)}
@@ -6641,29 +6826,68 @@ SECRET_SII_KEY=${q(v.siiKey)}
 SECRET_USER_REGISTRATION=${q(v.registrationSecret)}
 SECRET_PFX_CERTIFICATE=${q(v.pfxSecret)}
 USER_FORM_KEY=${q(v.userFormKey)}
+EXECUTE_LOCAL_DECISION_ENGINE="true"
 POSTHOG_ENABLED="false"
-
-# --- Third-party integrations -------------------------------------------------
-# Left blank on purpose. Fill with real sandbox credentials from your team /
-# 1Password when you need the feature. The app boots and serves local data
-# without them.
-SII_SERVICE_URL=""
-SII_SERVICE_APIKEY=""
-TGR_SERVICE_URL=""
-TGR_SERVICE_APKEY=""
-AWS_ACCESS_KEY_ID=""
-AWS_SECRET_ACCESS_KEY=""
-POSTHOG_API_KEY=""
-POSTHOG_HOST=""
-BURO_USERNAME=""
-BURO_PASSWORD=""
-BURO_API_URL=""
-CMF_API_KEY=""
 MCP_OAUTH_PUBLIC_KEY=""
 MCP_ALLOWED_TENANTS=""
-`;
+
+# --- Ask your team for these --------------------------------------------------
+# Left blank on purpose: real credentials, not something onboarding can generate.
+# The app boots and serves local data without them; each block notes what it
+# unlocks. Onboarding prints this same list when it finishes.
+
+${teamProvided}`;
 }
+const WORKSPACE_MCP_JSON = `${JSON.stringify({ mcpServers: {
+	"linear-server": {
+		type: "http",
+		url: "https://mcp.linear.app/mcp"
+	},
+	posthog: {
+		type: "http",
+		url: "https://mcp.posthog.com/mcp"
+	}
+} }, null, 2)}\n`;
+const WORKSPACE_SETTINGS_JSON = `${JSON.stringify({ permissions: { allow: [
+	"Bash(npx tsc --noEmit*)",
+	"Bash(./node_modules/.bin/tsc --noEmit*)",
+	"Bash(npm run type-check)",
+	"Bash(npm run lint)",
+	"Bash(yarn lint*)",
+	"Bash(git fetch *)",
+	"Bash(git status*)",
+	"Bash(git diff*)",
+	"Bash(git log*)",
+	"Bash(gh pr view:*)",
+	"Bash(gh pr diff:*)",
+	"Bash(gh pr list:*)",
+	"Bash(gh run list:*)",
+	"Bash(gh run view:*)",
+	"Bash(aws sts get-caller-identity*)",
+	"Bash(aws sqs get-queue-attributes*)",
+	"Bash(aws sqs list-queues*)",
+	"Bash(aws cloudwatch get-metric-statistics*)",
+	"Bash(aws cloudwatch list-metrics*)",
+	"Bash(aws logs describe-log-groups*)",
+	"Bash(aws logs filter-log-events*)",
+	"Bash(aws logs get-log-events*)",
+	"Bash(aws logs start-query*)",
+	"Bash(aws logs get-query-results*)",
+	"Bash(npm view *)",
+	"Bash(npm whoami*)",
+	"mcp__linear-server__get_issue",
+	"mcp__linear-server__list_issues",
+	"mcp__linear-server__list_comments",
+	"mcp__linear-server__search_documentation",
+	"mcp__linear-server__list_teams",
+	"mcp__linear-server__list_projects",
+	"mcp__linear-server__list_milestones",
+	"mcp__linear-server__get_project"
+] } }, null, 2)}\n`;
 const CLAUDE_CODE_PKG = "@anthropic-ai/claude-code";
+const INTELLIGENCE_SCHEMA = "prisma/intelligence/schema.prisma";
+const INTELLIGENCE_GLOBAL_SEED = "prisma/intelligence/seeds/seedIntelligenceGlobal.ts";
+const INTELLIGENCE_TENANT_SCRIPT = "scripts/intelligence/createIntelligenceTenant.ts";
 const KNOWLEDGE_REPO = "https://github.com/Pruff-Tech/pruff-knowledge";
 const KNOWLEDGE_DIR = "Pruff Knowledge";
 const DEFAULT_WORKSPACE = join(homedir(), "pruff");
@@ -6683,23 +6907,36 @@ const CORE_SKILLS = [
 	"create-pr",
 	"linear",
 	"start-issue",
+	"update-linear-issues",
 	"handoff",
 	"pruff-logs",
 	"pruff-pr-review",
 	"review-pr-comments",
-	"react-doctor"
+	"react-doctor",
+	"pruff-knowledge",
+	"find-skills",
+	"localstack"
 ];
 const CORE_AGENTS = [
 	"codebase-navigator",
 	"db-query-reviewer",
 	"pruff-logs-investigator"
 ];
+const issues = [];
+function note(issue) {
+	issues.push(issue);
+}
 async function runOnboarding(args) {
 	if (process.platform !== "darwin") {
 		M.error(`${import_picocolors.default.bold("onboarding")} currently supports macOS only (detected ${import_picocolors.default.cyan(process.platform)}).`);
 		return;
 	}
 	Ie(import_picocolors.default.bold("Pruff onboarding"));
+	issues.length = 0;
+	if (!await preflight()) {
+		Se(import_picocolors.default.yellow("Onboarding stopped — fix the items above and re-run."));
+		return;
+	}
 	installClaudeCode();
 	ensureObsidian();
 	ensureBun();
@@ -6710,10 +6947,70 @@ async function runOnboarding(args) {
 	for (const repo of MAIN_REPOS) cloneRepo(repo, workspace);
 	for (const repo of MAIN_REPOS) installDeps(repo, workspace);
 	writeWorkspaceClaudeMd(workspace);
+	writeHarnessConfig(workspace);
 	await installCatalog(workspace);
 	if (await shouldSetupDatabase(args)) await setupLocalEnvironment(join(workspace, "Pruff-server"));
 	await showGuidance(workspace);
-	Se(`${import_picocolors.default.green("Done.")} Welcome to Pruff — happy building.`);
+	showTeamCredentialsAsk(workspace);
+	showIssues();
+	if (issues.length === 0) Se(`${import_picocolors.default.green("Done.")} Welcome to Pruff — happy building.`);
+	else Se(`${import_picocolors.default.yellow(`Finished with ${issues.length} issue${issues.length === 1 ? "" : "s"}.`)} Fix them and re-run — every step is idempotent.`);
+}
+async function preflight() {
+	const missing = [
+		"git",
+		"node",
+		"npm"
+	].filter((bin) => !has(bin));
+	if (missing.length > 0) {
+		M.error(`Missing required tool${missing.length === 1 ? "" : "s"}: ${import_picocolors.default.cyan(missing.join(", "))}.\n  Install Xcode command line tools (${import_picocolors.default.dim("xcode-select --install")}) and Node 22 (${import_picocolors.default.dim("brew install node")}), then re-run.`);
+		return false;
+	}
+	M.success("git · node · npm present");
+	if (!ensureGh()) return false;
+	return await ensureGitHubAuth();
+}
+function ensureGh() {
+	if (has("gh")) return true;
+	if (!has("brew")) {
+		M.error(`GitHub CLI not found and Homebrew is unavailable.\n  Install it from ${import_picocolors.default.cyan("https://cli.github.com")}, run ${import_picocolors.default.cyan("gh auth login")}, then re-run.`);
+		return false;
+	}
+	const s = Y();
+	s.start("Installing GitHub CLI (brew)…");
+	const ok = run("brew", ["install", "gh"]);
+	s.stop(ok ? "GitHub CLI installed" : import_picocolors.default.yellow("GitHub CLI install failed"));
+	if (!ok) M.error(`Install it manually: ${import_picocolors.default.cyan("brew install gh")}, then re-run.`);
+	return ok;
+}
+function isGitHubAuthenticated() {
+	return spawnSync("gh", ["auth", "status"], { stdio: "ignore" }).status === 0;
+}
+async function ensureGitHubAuth() {
+	if (isGitHubAuthenticated()) {
+		M.success("GitHub authenticated");
+		return true;
+	}
+	const instruction = `Authenticate first: ${import_picocolors.default.cyan("gh auth login")} (choose HTTPS + "authenticate Git with your GitHub credentials"), then re-run.`;
+	if (!process.stdout.isTTY) {
+		M.error(`Not authenticated with GitHub — the Pruff repos are private.\n  ${instruction}`);
+		return false;
+	}
+	const answer = await ye({
+		message: "Not authenticated with GitHub (the Pruff repos are private). Run `gh auth login` now?",
+		initialValue: true
+	});
+	if (pD(answer) || answer !== true) {
+		M.error(instruction);
+		return false;
+	}
+	run("gh", ["auth", "login"]);
+	if (isGitHubAuthenticated()) {
+		M.success("GitHub authenticated");
+		return true;
+	}
+	M.error(`Still not authenticated.\n  ${instruction}`);
+	return false;
 }
 function has(cmd) {
 	return spawnSync("command", ["-v", cmd], {
@@ -6840,7 +7137,8 @@ function cloneKnowledge(workspace) {
 		return;
 	}
 	s.stop(import_picocolors.default.yellow("Knowledge clone failed"));
-	M.warn(`Could not clone ${import_picocolors.default.cyan(KNOWLEDGE_REPO)}.\n  It's private — authenticate first with ${import_picocolors.default.cyan("gh auth login")} (or an SSH key), then re-run.`);
+	note(`Knowledge vault not cloned — ${KNOWLEDGE_REPO} (check your GitHub org access).`);
+	M.warn(`Could not clone ${import_picocolors.default.cyan(KNOWLEDGE_REPO)}.\n  You are authenticated, so this is likely missing org access — ask the team to add you to ${import_picocolors.default.cyan("Pruff-Tech")}.`);
 }
 function cloneRepo(repo, workspace) {
 	const { name, url } = repo;
@@ -6858,7 +7156,8 @@ function cloneRepo(repo, workspace) {
 	], workspace)) s.stop(`Cloned ${import_picocolors.default.cyan(name)}`);
 	else {
 		s.stop(import_picocolors.default.yellow(`${name} clone failed`));
-		M.warn(`Could not clone ${name}. Authenticate with ${import_picocolors.default.cyan("gh auth login")} then run:\n  ${import_picocolors.default.dim(`git clone ${url}`)}  (inside ${workspace})`);
+		note(`${name} not cloned — every later step for it was skipped.`);
+		M.warn(`Could not clone ${name}. You are authenticated, so this is likely missing org access.\n  Ask the team for access to ${import_picocolors.default.cyan("Pruff-Tech")}, then run:\n  ${import_picocolors.default.dim(`git clone ${url}`)}  (inside ${workspace})`);
 	}
 }
 function installDeps(repo, workspace) {
@@ -6866,6 +7165,7 @@ function installDeps(repo, workspace) {
 	const target = join(workspace, name);
 	if (!existsSync(join(target, ".git"))) return;
 	if (!has(installCmd)) {
+		note(`${name} dependencies not installed (${installCmd} missing).`);
 		M.warn(`${import_picocolors.default.cyan(installCmd)} not found — skipping ${name} dependency install.\n  Run manually once installed: ${import_picocolors.default.dim(`cd ${name} && ${installCmd} ${installArgs.join(" ")}`)}`);
 		return;
 	}
@@ -6875,6 +7175,7 @@ function installDeps(repo, workspace) {
 	if (ok && existsSync(join(target, "node_modules"))) s.stop(`${name} dependencies installed`);
 	else {
 		s.stop(import_picocolors.default.yellow(`${name} dependency install failed`));
+		note(`${name} dependencies failed to install.`);
 		if (ok) M.warn(`${installCmd} exited 0 but ${name}/node_modules is missing — install likely no-opped.`);
 		M.warn(`Run manually: ${import_picocolors.default.dim(`cd ${name} && ${installCmd} ${installArgs.join(" ")}`)}`);
 	}
@@ -6888,6 +7189,20 @@ function writeWorkspaceClaudeMd(workspace) {
 	writeFileSync(target, WORKSPACE_CLAUDE_TEMPLATE, "utf-8");
 	M.success("Wrote workspace CLAUDE.md");
 }
+function writeHarnessConfig(workspace) {
+	writeIfAbsent(join(workspace, ".mcp.json"), WORKSPACE_MCP_JSON, "MCP servers (.mcp.json)");
+	const claudeDir = join(workspace, ".claude");
+	mkdirSync(claudeDir, { recursive: true });
+	writeIfAbsent(join(claudeDir, "settings.json"), WORKSPACE_SETTINGS_JSON, "permission allowlist (.claude/settings.json)");
+}
+function writeIfAbsent(target, contents, label) {
+	if (existsSync(target)) {
+		M.success(`${label} already present — leaving it untouched`);
+		return;
+	}
+	writeFileSync(target, contents, "utf-8");
+	M.success(`Wrote ${label}`);
+}
 async function installCatalog(workspace) {
 	const prevCwd = process.cwd();
 	M.step("Installing Pruff rules, agents and skills into the workspace…");
@@ -6901,6 +7216,7 @@ async function installCatalog(workspace) {
 			yes: true
 		});
 	} catch (error) {
+		note("Skills/agents/rules catalog did not finish installing.");
 		M.warn(`Catalog install hit an error: ${error instanceof Error ? error.message : String(error)}\n  Re-run once authenticated: ${import_picocolors.default.cyan("npx pruff-skills onboarding")}`);
 	} finally {
 		process.chdir(prevCwd);
@@ -6908,14 +7224,19 @@ async function installCatalog(workspace) {
 }
 async function setupLocalEnvironment(serverPath) {
 	if (!existsSync(join(serverPath, ".git"))) {
+		note("Local database not set up — Pruff-server was not cloned.");
 		M.warn("Pruff-server not cloned — skipping local database setup.");
 		return;
 	}
-	if (!ensureMysql()) return;
+	if (!await ensureMysql()) return;
 	ensureDbeaver();
-	generateLocalEnv(serverPath);
+	const dbPassword = await resolveRootPassword();
+	if (dbPassword === null) return;
+	generateLocalEnv(serverPath, dbPassword);
+	writeMigrateTenantsLocal(serverPath);
 	const env = parseEnvFile(join(serverPath, "local.env"));
 	if (!env.DATABASE_URL || !env.CLIENT_ID) {
+		note("Local database not set up — local.env is missing DATABASE_URL / CLIENT_ID.");
 		M.warn("local.env is missing DATABASE_URL / CLIENT_ID — skipping database setup.");
 		return;
 	}
@@ -6932,9 +7253,10 @@ async function shouldSetupDatabase(args) {
 	if (pD(answer)) return false;
 	return answer === true;
 }
-function ensureMysql() {
+async function ensureMysql() {
 	if (!has("mysql")) {
 		if (!has("brew")) {
+			note("Local database not set up — MySQL is missing and Homebrew is unavailable.");
 			M.warn(`MySQL not found and Homebrew is unavailable.\n  Install MySQL, then re-run: ${import_picocolors.default.cyan("npx pruff-skills onboarding --db")}`);
 			return false;
 		}
@@ -6942,7 +7264,10 @@ function ensureMysql() {
 		s.start("Installing MySQL (brew)…");
 		const ok = run("brew", ["install", "mysql"]);
 		s.stop(ok ? "MySQL installed" : import_picocolors.default.yellow("MySQL install failed"));
-		if (!ok) return false;
+		if (!ok) {
+			note("Local database not set up — MySQL install failed.");
+			return false;
+		}
 	} else M.success("MySQL already installed");
 	if (mysqlRunning()) {
 		M.success("MySQL already running");
@@ -6958,7 +7283,10 @@ function ensureMysql() {
 	for (let i = 0; i < 30 && !mysqlRunning(); i++) spawnSync("sleep", ["1"]);
 	const up = mysqlRunning();
 	s.stop(up ? "MySQL running" : import_picocolors.default.yellow("MySQL did not come up"));
-	if (!up) M.warn(`Start it manually: ${import_picocolors.default.cyan("brew services start mysql")}, then re-run with --db.`);
+	if (!up) {
+		note("Local database not set up — MySQL never came up.");
+		M.warn(`Start it manually: ${import_picocolors.default.cyan("brew services start mysql")}, then re-run with --db.`);
+	}
 	return up;
 }
 function mysqlRunning() {
@@ -6969,6 +7297,48 @@ function mysqlRunning() {
 		"--silent"
 	], { stdio: "ignore" }).status === 0;
 }
+function canConnectAsRoot(password) {
+	const args = [
+		"-h",
+		"localhost",
+		"-P",
+		"3306",
+		"-u",
+		"root"
+	];
+	if (password) args.push(`-p${password}`);
+	return spawnSync("mysql", [
+		...args,
+		"-N",
+		"-B",
+		"-e",
+		"SELECT 1"
+	], { stdio: "ignore" }).status === 0;
+}
+async function resolveRootPassword() {
+	if (canConnectAsRoot("")) {
+		M.success("MySQL root reachable (no password)");
+		return "";
+	}
+	const manual = `Connect manually to find out (${import_picocolors.default.dim("mysql -u root -p")}), then re-run with ${import_picocolors.default.cyan("--db")}.`;
+	if (!process.stdout.isTTY) {
+		note("Local database not set up — MySQL root needs a password.");
+		M.warn(`MySQL root rejects a passwordless connection.\n  ${manual}`);
+		return null;
+	}
+	for (let attempt = 0; attempt < 3; attempt++) {
+		const answer = await ge({ message: attempt === 0 ? "MySQL root needs a password (this machine already had MySQL). Enter it:" : "Wrong password. Try again:" });
+		if (pD(answer)) break;
+		const password = (answer ?? "").trim();
+		if (password && canConnectAsRoot(password)) {
+			M.success("MySQL root reachable");
+			return password;
+		}
+	}
+	note("Local database not set up — could not authenticate to MySQL as root.");
+	M.warn(`Could not authenticate to MySQL as root.\n  ${manual}`);
+	return null;
+}
 function ensureDbeaver() {
 	if (existsSync("/Applications/DBeaver.app")) {
 		M.success("DBeaver already installed");
@@ -6987,7 +7357,7 @@ function ensureDbeaver() {
 	]);
 	s.stop(ok ? "DBeaver installed" : import_picocolors.default.yellow("DBeaver install failed"));
 }
-function generateLocalEnv(serverPath) {
+function generateLocalEnv(serverPath, dbPassword) {
 	const target = join(serverPath, "local.env");
 	if (existsSync(target)) {
 		M.success("local.env already present — leaving it untouched");
@@ -7004,10 +7374,16 @@ function generateLocalEnv(serverPath) {
 		siiKey: secret(),
 		registrationSecret: secret(),
 		pfxSecret: secret(),
-		userFormKey: secret()
+		userFormKey: secret(),
+		dbPassword
 	}), "utf-8");
 	M.success("Wrote local.env (minimal bootable — fill third-party keys when needed)");
 }
+function writeMigrateTenantsLocal(serverPath) {
+	const target = join(serverPath, "sincronizations", "migrateTenantsLocal.ts");
+	if (!existsSync(join(serverPath, "sincronizations"))) return;
+	writeIfAbsent(target, MIGRATE_TENANTS_LOCAL_SCRIPT, "sincronizations/migrateTenantsLocal.ts");
+}
 function parseEnvFile(path) {
 	if (!existsSync(path)) return {};
 	const out = {};
@@ -7093,6 +7469,29 @@ function migrateDeploy(serverPath, url) {
 		"deploy"
 	], serverPath, { DATABASE_URL: url });
 }
+function rutConflict(holderSecretId, clientId) {
+	return holderSecretId !== "" && holderSecretId !== clientId;
+}
+function findRutHolder(serverPath, env, url) {
+	const scriptPath = join(serverPath, ".pruff-onboarding-rut-probe.ts");
+	writeFileSync(scriptPath, RUT_CONFLICT_PROBE_SCRIPT, "utf-8");
+	try {
+		const { out } = capture("npx", [
+			"ts-node",
+			"--transpile-only",
+			"-r",
+			"tsconfig-paths/register",
+			scriptPath,
+			env.CLIENT_RUT ?? ""
+		], serverPath, {
+			...env,
+			DATABASE_URL: url
+		});
+		return out.match(/^RUT_HOLDER=(.*)$/m)?.[1]?.trim() ?? "";
+	} finally {
+		rmSync(scriptPath, { force: true });
+	}
+}
 function runDisposableScript(serverPath, fileName, contents, env, extraArgs = []) {
 	const scriptPath = join(serverPath, fileName);
 	writeFileSync(scriptPath, contents, "utf-8");
@@ -7122,9 +7521,15 @@ function setupLocalDatabase(serverPath, env) {
 	const tenantName = `tenant-${clientId}`;
 	const tenantUrl = swapDbName(controlPlaneUrl, tenantName);
 	const adminEmail = `admin@${clientId}.com`;
+	if (controlPlaneName !== "pruff-local") {
+		note(`Local database not set up — DATABASE_URL must point at "${CONTROL_PLANE_DB}".`);
+		M.warn(`DATABASE_URL points at ${import_picocolors.default.cyan(controlPlaneName)}, but Pruff-server hardcodes the local control plane as ${import_picocolors.default.cyan(CONTROL_PLANE_DB)}.\n  Company/user seeds would silently write to the wrong database — fix local.env and re-run with --db.`);
+		return;
+	}
 	M.step(`Setting up local databases (${controlPlaneName} + ${tenantName})…`);
 	mysqlExec(conn, `CREATE DATABASE IF NOT EXISTS \`${controlPlaneName}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`);
 	if (!migrateDeploy(serverPath, controlPlaneUrl)) {
+		note("Local database not set up — control-plane migration failed.");
 		M.warn("Control-plane migration failed — skipping the rest of database setup.");
 		return;
 	}
@@ -7133,41 +7538,118 @@ function setupLocalDatabase(serverPath, env) {
 		DATABASE_URL: controlPlaneUrl
 	});
 	const action = decideTenantAction(dbExists(conn, tenantName), adminUserExists(conn, tenantName, adminEmail));
-	if (action === "already-provisioned") {
-		M.success(`Tenant "${clientId}" already provisioned — skipping seed.`);
-		printLoginHint(clientId, adminEmail, adminPassword);
+	if (action !== "already-provisioned") {
+		const holder = findRutHolder(serverPath, env, controlPlaneUrl);
+		if (rutConflict(holder, clientId)) {
+			note(`Tenant "${clientId}" not seeded — CLIENT_RUT is already used by "${holder}".`);
+			M.warn(`CLIENT_RUT ${import_picocolors.default.cyan(env.CLIENT_RUT ?? "")} already belongs to tenant ${import_picocolors.default.cyan(holder)} in ${controlPlaneName}.\n  Seeding would reuse that company and never register "${clientId}" — the tenant could not be logged into.\n  Change CLIENT_RUT (or CLIENT_ID) in local.env and re-run with --db.`);
+			return;
+		}
+		if (action === "reset-and-seed") {
+			M.warn(`Tenant "${clientId}" partially provisioned — resetting (Pruff-server seed is not idempotent).`);
+			mysqlExec(conn, `DROP DATABASE IF EXISTS \`${tenantName}\``);
+		}
+		mysqlExec(conn, `CREATE DATABASE IF NOT EXISTS \`${tenantName}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`);
+		if (!migrateDeploy(serverPath, tenantUrl)) {
+			note("Local database not set up — tenant migration failed.");
+			M.warn("Tenant migration failed — skipping seed.");
+			return;
+		}
+		const s = Y();
+		s.start(`Seeding tenant "${clientId}"…`);
+		const seeded = run("npx", [
+			"prisma",
+			"db",
+			"seed"
+		], serverPath, {
+			...env,
+			DATABASE_URL: tenantUrl
+		});
+		s.stop(seeded ? `Tenant "${clientId}" seeded` : import_picocolors.default.yellow("Tenant seed failed"));
+		if (!seeded) {
+			note(`Tenant "${clientId}" seed failed.`);
+			return;
+		}
+	} else M.success(`Tenant "${clientId}" already provisioned — skipping seed.`);
+	setupIntelligence(serverPath, env, conn, controlPlaneUrl, adminEmail, adminPassword);
+	if (!runDisposableScript(serverPath, ".pruff-onboarding-tenant-user.ts", TENANT_USER_BACKFILL_SCRIPT, {
+		...env,
+		DATABASE_URL: tenantUrl
+	}, [adminEmail, adminPassword])) {
+		note("Tenant admin user may be missing — the backfill script failed.");
+		M.warn("Tenant admin-user backfill failed — you may need to create the user manually.");
 		return;
 	}
-	if (action === "reset-and-seed") {
-		M.warn(`Tenant "${clientId}" partially provisioned — resetting (Pruff-server seed is not idempotent).`);
-		mysqlExec(conn, `DROP DATABASE IF EXISTS \`${tenantName}\``);
+	if (!runDisposableScript(serverPath, ".pruff-onboarding-accounting-period.ts", ACCOUNTING_PERIOD_SCRIPT, {
+		...env,
+		DATABASE_URL: tenantUrl
+	}, [String((/* @__PURE__ */ new Date()).getFullYear())])) {
+		note("No open AccountingPeriod — accounting entries will be rejected until one exists.");
+		M.warn("Could not open the current-year accounting period — create one under Contabilidad → Períodos.");
 	}
-	mysqlExec(conn, `CREATE DATABASE IF NOT EXISTS \`${tenantName}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`);
-	if (!migrateDeploy(serverPath, tenantUrl)) {
-		M.warn("Tenant migration failed — skipping seed.");
+	M.success(`Local tenant "${clientId}" ready.`);
+	printLoginHint(clientId, adminEmail, adminPassword);
+}
+function setupIntelligence(serverPath, env, conn, controlPlaneUrl, adminEmail, adminPassword) {
+	const intelligenceUrl = env.INTELLIGENCE_DATABASE_URL;
+	if (!intelligenceUrl) {
+		note("Intelligence module unavailable — INTELLIGENCE_DATABASE_URL is not set in local.env.");
+		M.warn(`local.env has no ${import_picocolors.default.cyan("INTELLIGENCE_DATABASE_URL")} — skipping Intelligence setup.`);
 		return;
 	}
 	const s = Y();
-	s.start(`Seeding tenant "${clientId}"…`);
-	const seeded = run("npx", [
+	s.start("Setting up Intelligence…");
+	mysqlExec(conn, `CREATE DATABASE IF NOT EXISTS \`${dbNameFromUrl(intelligenceUrl)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`);
+	const intelligenceEnv = {
+		...env,
+		INTELLIGENCE_DATABASE_URL: intelligenceUrl
+	};
+	if (!(run("npx", [
 		"prisma",
-		"db",
-		"seed"
+		"migrate",
+		"deploy",
+		"--schema",
+		INTELLIGENCE_SCHEMA
+	], serverPath, intelligenceEnv) && run("npx", [
+		"prisma",
+		"generate",
+		"--schema",
+		INTELLIGENCE_SCHEMA
+	], serverPath, intelligenceEnv))) {
+		s.stop(import_picocolors.default.yellow("Intelligence database setup failed"));
+		note(`Intelligence module unavailable — could not migrate/generate ${INTELLIGENCE_DB}.`);
+		return;
+	}
+	if (!(run("npx", [
+		"ts-node",
+		"--transpile-only",
+		"-r",
+		"tsconfig-paths/register",
+		INTELLIGENCE_GLOBAL_SEED
 	], serverPath, {
 		...env,
-		DATABASE_URL: tenantUrl
-	});
-	s.stop(seeded ? `Tenant "${clientId}" seeded` : import_picocolors.default.yellow("Tenant seed failed"));
-	if (!seeded) return;
-	if (!runDisposableScript(serverPath, ".pruff-onboarding-tenant-user.ts", TENANT_USER_BACKFILL_SCRIPT, {
+		DATABASE_URL: controlPlaneUrl
+	}) && run("npx", [
+		"ts-node",
+		"--transpile-only",
+		"-r",
+		"tsconfig-paths/register",
+		INTELLIGENCE_TENANT_SCRIPT
+	], serverPath, {
 		...env,
-		DATABASE_URL: tenantUrl
-	}, [adminEmail, adminPassword])) {
-		M.warn("Tenant admin-user backfill failed — you may need to create the user manually.");
+		DATABASE_URL: controlPlaneUrl,
+		TENANT_SECRET_ID: env.CLIENT_ID,
+		TENANT_RUT: env.CLIENT_RUT,
+		TENANT_NAME: env.CLIENT_NAME,
+		USER_EMAIL: adminEmail,
+		USER_PASSWORD: adminPassword,
+		USER_NAME: "Pruff Local Admin"
+	}))) {
+		s.stop(import_picocolors.default.yellow("Intelligence tenant enrolment failed"));
+		note("Intelligence module unavailable — tenant enrolment failed.");
 		return;
 	}
-	M.success(`Local tenant "${clientId}" ready.`);
-	printLoginHint(clientId, adminEmail, adminPassword);
+	s.stop("Intelligence ready");
 }
 function printLoginHint(clientId, email, password) {
 	M.info(`Log in locally with:\n  ${import_picocolors.default.dim("secretId:")} ${import_picocolors.default.cyan(clientId)}\n  ${import_picocolors.default.dim("email:   ")} ${import_picocolors.default.cyan(email)}\n  ${import_picocolors.default.dim("password:")} ${import_picocolors.default.cyan(password)}`);
@@ -7198,7 +7680,29 @@ async function showGuidance(workspace) {
 	line(`${import_picocolors.default.dim("1.")} Open ${import_picocolors.default.bold("Obsidian")} → the ${import_picocolors.default.cyan(KNOWLEDGE_DIR)} vault is registered and ready.`);
 	line(`${import_picocolors.default.dim("2.")} Start Claude Code from ${import_picocolors.default.cyan(workspace)} so the shared ${import_picocolors.default.dim(".claude/")} applies everywhere.`);
 	line(`${import_picocolors.default.dim("3.")} Dependencies are installed — ${import_picocolors.default.dim("cd Pruff-server && npm run local")} / ${import_picocolors.default.dim("cd Pruff-Client && yarn start-local")}.`);
-	line(`${import_picocolors.default.dim("4.")} Clone any serverless service into this folder with ${import_picocolors.default.dim("git clone <repo>")}.`);
+	line(`${import_picocolors.default.dim("4.")} Run ${import_picocolors.default.dim("/mcp")} inside Claude Code to authenticate Linear + PostHog (already configured in ${import_picocolors.default.dim(".mcp.json")}).`);
+	line(`${import_picocolors.default.dim("5.")} Clone any serverless service into this folder with ${import_picocolors.default.dim("git clone <repo>")}.`);
+	console.log();
+}
+function showTeamCredentialsAsk(workspace) {
+	const envPath = join(workspace, "Pruff-server", "local.env");
+	const line = (s) => console.log(`  ${s}`);
+	line(import_picocolors.default.bold("Ask your team for these credentials") + import_picocolors.default.dim("  (1Password / #dev)"));
+	line(import_picocolors.default.dim(`They go in ${envPath} — the keys are already there, blank.`));
+	line("");
+	for (const group of TEAM_PROVIDED_ENV) {
+		line(import_picocolors.default.cyan(group.keys.join(", ")));
+		line(`  ${import_picocolors.default.dim(group.unlocks)}`);
+	}
+	line("");
+	line(import_picocolors.default.dim("Everything else — the databases, the local tenant, Intelligence — is already set up and needs nothing from anyone."));
+	console.log();
+}
+function showIssues() {
+	if (issues.length === 0) return;
+	console.log();
+	console.log(`  ${import_picocolors.default.bold(import_picocolors.default.yellow("Did not complete"))}`);
+	for (const issue of issues) console.log(`  ${import_picocolors.default.yellow("•")} ${issue}`);
 	console.log();
 }
 function registerVault(vaultPath) {
@@ -7838,8 +8342,18 @@ ${BOLD}Rules:${RESET}
                        Install a whole repo's rule set (client/server also pull in common)
 
 ${BOLD}Onboarding:${RESET}
-  onboarding           Set up a new machine (macOS): install Claude Code,
-                       install Obsidian, and clone the Pruff knowledge vault
+  onboarding [dir]     Set up a new machine (macOS), end to end: prerequisites +
+                       GitHub auth, Claude Code, Obsidian, Bun, clone the
+                       knowledge vault + Pruff-server + Pruff-Client and install
+                       their deps, write the workspace CLAUDE.md / .mcp.json /
+                       settings.json, install the curated skills, agents and
+                       rules, then provision the local databases (control plane,
+                       tenant, Intelligence) and a login-ready local tenant.
+                       Idempotent — safe to re-run. [dir] defaults to ~/pruff.
+
+${BOLD}Onboarding Options:${RESET}
+  --db                 Force the local database step (non-interactive shells)
+  --no-db              Skip the local database step
 
 ${BOLD}Updates:${RESET}
   update [skills...]   Update skills to latest versions (alias: upgrade)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pruff-skills",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "The official Pruff agent skills CLI",
   "type": "module",
   "bin": {

package/packs/pruff-shared/agents/fixer-shared.persona.md

@@ -39,17 +39,25 @@ human directly. Your output is always a **draft PR** — never a merge, never a
 3. **Follow the repo's own conventions exactly** — `Result<T>` and tenant-scoped
    `prisma` in Pruff-server, consts/types in sibling files, no `any`, no
    `console.log`. These aren't suggestions; a fix that violates them isn't done.
-4. **Verify before opening the PR** — run the repo's typecheck/lint/tests. If the fix
-   touches Prisma or raw SQL, run the `db-query-reviewer` subagent on your own diff
-   before anyone else has to.
+4. **Verify before opening the PR** — once, after all edits are done, not after each
+   individual edit. Chain the repo's typecheck/lint/tests into a single command
+   (`&&`) rather than separate calls. If the fix touches Prisma or raw SQL, run the
+   `db-query-reviewer` subagent on your own diff before anyone else has to.
 5. **Commit and open the PR** using the `/commit` and `/create-pr-llm` skills — never a
    raw `git commit`/`gh pr create`, and never the legacy `/create-pr` — your PRs always
    go to `reviewer-shared` next, so the description needs `/create-pr-llm`'s anchored,
    verifiable claims and authored "judge this" questions for that skill to work with.
    The PR is **always a draft**; a human marks it ready.
-6. **Post the PR link back** to `#fixer-queue` (and `#pr-review` if you want
-   `reviewer-shared` to run its pipeline on it) — link the originating Linear issue
-   and, if this came from `investigator-shared`, the triage message it came from.
+6. **Post the PR link to `#pr-review` — always, not optionally.** `reviewer-shared`
+   only listens in `#pr-review`; it does not see `#fixer-queue` at all, so replying
+   there, or having a human type `?reviewer` in a `#fixer-queue` thread, reaches no
+   one — that channel isn't in its allowlist. Posting to `#pr-review` is the *only*
+   path that actually invokes it, exactly like `investigator-shared` must post to
+   `#fixer-queue` rather than relying on a `@fixer-shared` mention landing. Also post
+   a short summary + the same PR link back to `#fixer-queue` for visibility — but
+   that second post is for humans following the queue, not a substitute for the
+   `#pr-review` post. Link the originating Linear issue and, if this came from
+   `investigator-shared`, the triage message it came from.
 
 ## Hard limits — these are enforced, not requested
 

package/packs/pruff-shared/agents/reviewer-shared.persona.md

@@ -36,6 +36,14 @@ don't guess which one they mean.
    equivalent by reading the diff and writing prose. If the PR body isn't in that
    format (no anchored claims, no ⚖️ column — i.e. it wasn't written by `fixer-shared`
    with `/create-pr-llm`), fall back to the legacy `pr-visualizer` skill instead.
+   **Never let it run in `light` mode, regardless of how small the diff looks.**
+   `light` is 0-agents — it only reads exactly what the PR description anchors, and a
+   real review missed a confirmed blocker this way: the PR claimed "no backend changes
+   needed" for an autocomplete filter, and `light` mode has no mechanism to check
+   whether that claim is true, because it never traces the value into the actual
+   service layer. Always pass `--standard` explicitly. Go to `--deep` only if a human
+   asks for a deeper look in `#pr-review` — never on your own initiative, and never
+   drop back to `light` for a PR that "looks contained."
 4. **Post the summary in `#pr-review`**: the artifact link (or, if artifact publishing
    isn't available in this session, a written equivalent), the highest-severity
    findings with a concrete failure scenario each ("this could be slow" is not a

package/packs/pruff-shared/instructions.md

@@ -74,7 +74,9 @@ there for the routing table. Repo work happens in a worktree created by
 `~/Desktop/pruff/.claude/scripts/wt-new.sh <repo> <branch>` — never on an
 active branch, never by hand.
 
-**Rules are per-working-directory and don't follow a `cd`.** Before your first
-edit or first substantive claim about a repo's conventions, `Read` that repo's
-own `CLAUDE.md` and `.claude/rules/*.md` — they're authoritative over anything
-summarized here.
+**Your shell's working directory persists across commands within a turn —
+you don't need to repeat `cd` on every call.** What doesn't carry over
+automatically is loaded rules context: after you `cd` into a different repo,
+`Read` that repo's own `CLAUDE.md` and `.claude/rules/*.md` before your first
+edit or first substantive claim about its conventions — they're authoritative
+over anything summarized here.