vibe-coding-master 0.7.39 → 0.7.41

package/README.md

@@ -324,6 +324,13 @@ Automatic mode:
 - the UI switches to the target role before dispatch
 - Claude Code hooks confirm whether the prompt was accepted
 
+Before Project Manager can dispatch Architect, Coder, or Tester, it submits a
+strict `workflow-progress.md` transition through `vcm-workflow-review`. VCM
+checks the confirmed dispatch history and current task artifacts, then grants
+one matching route. The target role's `UserPromptSubmit` consumes that approval
+and appends the confirmed transition. A rejected transition can be bypassed
+only by an exact one-time user authorization recorded through the VCM dialog.
+
 If the flow stops, VCM always shows a blocking pause alert. `Pause alert sound`
 only controls the looping sound. Enabling Gateway turns that preference off once;
 it can be turned back on afterward. A new Gateway command closes an open pause
@@ -471,12 +478,10 @@ VCM bundles the Claude Code LSP bridge and loads it for Architect, Coder, and
 Reviewer sessions, including CCR launches. The project environment must still
 provide the language server for each detected language: `rust-analyzer`,
 `typescript-language-server`, `pyright-langserver`, `gopls`, `clangd`, or
-`jdtls`. Their Agent definitions preload `vcm-code-navigation`, and their
-launches explicitly enable Glob while leaving Grep unavailable. The Harness
-guard also rejects shell text-search commands for those roles so unresolved
-semantic relationships cannot be hidden by textual fallback. Harness Studio
-reports whether the server executable and plugin can run; the role Session
-performs the real workspace warm-up and semantic query retries.
+`jdtls`. Their Agent definitions preload `vcm-code-navigation`. Architect,
+Coder, and Reviewer use LSP for semantic relationships. Harness Studio reports
+whether the server executable and plugin can run; the role Session performs the
+real workspace warm-up and semantic query retries.
 
 Harness Engineer is task-scoped and runs from the active task worktree. The
 backend automatically starts a fresh Harness Engineer for each active task or

package/dist/backend/adapters/claude-adapter.js

@@ -1,3 +1,4 @@
+import { roleRuntimeDisallowedTools, roleUsesLsp } from "../role-tool-policy.js";
 import { isCcrSessionModel } from "../../shared/types/session.js";
 import { VcmError } from "../errors.js";
 export function createClaudeAdapter(runner) {
@@ -20,7 +21,13 @@ export function createClaudeAdapter(runner) {
         },
         buildRoleStartCommand(role, command = "claude", permissionMode = "default", claudeSessionId, resume = false, model = "default", effort = "default", settingsOverride, appendSystemPrompt, pluginDirs = []) {
             const args = pluginDirs.flatMap((pluginDir) => ["--plugin-dir", pluginDir]);
-            args.push("--allowedTools", roleSearchToolOptIns(role).join(","));
+            const lspEnabled = roleUsesLsp(role) && pluginDirs.length > 0;
+            if (lspEnabled) {
+                args.push("--disallowedTools", roleRuntimeDisallowedTools(role).join(","));
+            }
+            else {
+                args.push("--allowedTools", "Glob,Grep");
+            }
             args.push("--agent", role);
             const sessionSettings = { ...settingsOverride };
             if (claudeSessionId) {
@@ -52,11 +59,6 @@ export function createClaudeAdapter(runner) {
         }
     };
 }
-function roleSearchToolOptIns(role) {
-    return role === "architect" || role === "coder" || role === "reviewer"
-        ? ["Glob"]
-        : ["Glob", "Grep"];
-}
 function formatDisplayArg(value) {
     if (/^[A-Za-z0-9_./:=@+-]+$/.test(value)) {
         return value;

package/dist/backend/api/artifact-routes.js

@@ -1,4 +1,4 @@
-import { isDispatchableRole } from "../../shared/constants.js";
+import { isDispatchableRole, isRoleName } from "../../shared/constants.js";
 import { VcmError } from "../errors.js";
 import { getTaskRuntimeRepoRoot } from "../services/task-service.js";
 export function registerArtifactRoutes(app, deps) {
@@ -52,6 +52,59 @@ export function registerArtifactRoutes(app, deps) {
         });
         return { ok: true };
     });
+    app.post("/api/tasks/:taskSlug/artifacts/submit", async (request) => {
+        const project = await requireCurrentProject(deps.projectService);
+        const config = await deps.projectService.loadConfig(project.repoRoot);
+        const task = await deps.taskService.loadTask(project.repoRoot, request.params.taskSlug);
+        const body = request.body;
+        if (!body || !isRoleName(body.role)) {
+            throw new VcmError({
+                code: "ARTIFACT_ROLE_INVALID",
+                message: `Unknown artifact role: ${body?.role ?? "missing"}`,
+                statusCode: 400
+            });
+        }
+        if (body.mode !== "draft" && body.mode !== "final") {
+            throw new VcmError({
+                code: "ARTIFACT_MODE_INVALID",
+                message: "Artifact mode must be draft or final.",
+                statusCode: 400
+            });
+        }
+        if (typeof body.content !== "string") {
+            throw new VcmError({
+                code: "ARTIFACT_CONTENT_INVALID",
+                message: "Artifact content must be text.",
+                statusCode: 400
+            });
+        }
+        const session = body.role === "translator"
+            ? await deps.sessionService.getProjectTranslatorSession(project.repoRoot)
+            : body.role === "harness-engineer"
+                ? await deps.sessionService.getRoleSession(project.repoRoot, task.taskSlug, body.role)
+                    ?? await deps.sessionService.getProjectHarnessEngineerSession(project.repoRoot)
+                : await deps.sessionService.getRoleSession(project.repoRoot, task.taskSlug, body.role);
+        if (!session || !session.runtimeSessionToken || session.runtimeSessionToken !== body.runtimeSessionToken) {
+            throw new VcmError({
+                code: "ARTIFACT_SESSION_INVALID",
+                message: `${body.role} does not have the active VCM Session that owns this artifact submission.`,
+                statusCode: 409,
+                hint: "Submit from the active role terminal with .ai/tools/vcm-artifact."
+            });
+        }
+        return deps.artifactService.submitArtifact({
+            repoRoot: getTaskRuntimeRepoRoot(task),
+            baseRepoRoot: project.repoRoot,
+            stateRoot: config.stateRoot,
+            handoffDir: task.handoffDir,
+            taskSlug: task.taskSlug,
+            kind: body.kind,
+            mode: body.mode,
+            role: body.role,
+            content: body.content,
+            artifactPath: body.path
+        });
+    });
 }
 function parseDispatchableRole(role) {
     if (!isDispatchableRole(role)) {
@@ -67,18 +120,36 @@ function artifactNameToPath(paths, artifactName) {
     if (artifactName === "architecture-brief.md") {
         return paths.architectureBriefPath;
     }
+    if (artifactName === "architecture-evidence.md") {
+        return paths.architectureEvidencePath;
+    }
+    if (artifactName === "planning-progress.md") {
+        return paths.planningProgressPath;
+    }
     if (artifactName === "architecture-plan.md") {
         return paths.architecturePlanPath;
     }
     if (artifactName === "known-issues.md") {
         return paths.knownIssuesPath;
     }
+    if (artifactName === "coder-completion.md") {
+        return paths.coderCompletionPath;
+    }
+    if (artifactName === "architect-debug.md") {
+        return paths.architectDebugPath;
+    }
+    if (artifactName === "architecture-diagnosis.md") {
+        return paths.architectureDiagnosisPath;
+    }
     if (artifactName === "test-report.md") {
         return paths.testReportPath;
     }
     if (artifactName === "docs-sync-report.md") {
         return paths.docsSyncReportPath;
     }
+    if (artifactName === "workflow-progress.md") {
+        return paths.workflowProgressPath;
+    }
     if (artifactName === "final-acceptance.md") {
         return paths.finalAcceptancePath;
     }

package/dist/backend/api/runtime-state-routes.js

@@ -23,15 +23,25 @@ export function registerRuntimeStateRoutes(app, deps) {
                 harnessBootstrapStatus: null,
                 harnessFeedbackState,
                 autoMemoryState: null,
-                gatewayStatus: coordinated.gatewayStatus
+                gatewayStatus: coordinated.gatewayStatus,
+                workflowControlState: null
             };
         }
         try {
             const task = await deps.taskService.loadTask(project.repoRoot, taskSlug);
-            const [harnessStatus, harnessBootstrapStatus, autoMemoryState] = await Promise.all([
+            const config = deps.workflowControlService
+                ? await deps.projectService.loadConfig(project.repoRoot)
+                : null;
+            const [harnessStatus, harnessBootstrapStatus, autoMemoryState, workflowControlState] = await Promise.all([
                 withOpenFileLimitFallback(() => deps.harnessService.getHarnessStatus(task.worktreePath), (error) => degradedHarnessStatus(error)),
                 withOpenFileLimitFallback(() => deps.harnessService.getBootstrapStatus(project.repoRoot, task.worktreePath, task.taskSlug), (error) => degradedBootstrapStatus(error)),
-                deps.autoMemoryService.getState(project.repoRoot, task.worktreePath)
+                deps.autoMemoryService.getState(project.repoRoot, task.worktreePath),
+                deps.workflowControlService && config ? deps.workflowControlService.getState({
+                    taskRepoRoot: task.worktreePath,
+                    stateRoot: config.stateRoot,
+                    handoffDir: task.handoffDir,
+                    taskSlug: task.taskSlug
+                }) : Promise.resolve(null)
             ]);
             return {
                 translatorSession,
@@ -41,7 +51,8 @@ export function registerRuntimeStateRoutes(app, deps) {
                 harnessBootstrapStatus,
                 harnessFeedbackState,
                 autoMemoryState,
-                gatewayStatus: coordinated.gatewayStatus
+                gatewayStatus: coordinated.gatewayStatus,
+                workflowControlState
             };
         }
         catch (error) {
@@ -54,7 +65,8 @@ export function registerRuntimeStateRoutes(app, deps) {
                     harnessBootstrapStatus: degradedBootstrapStatus(error),
                     harnessFeedbackState,
                     autoMemoryState: null,
-                    gatewayStatus: coordinated.gatewayStatus
+                    gatewayStatus: coordinated.gatewayStatus,
+                    workflowControlState: null
                 };
             }
             throw error;

package/dist/backend/api/task-routes.js

@@ -198,10 +198,16 @@ function degradedArtifactSummary(handoffDir) {
             roleCommandPaths: Object.fromEntries(DISPATCHABLE_ROLES.map((role) => [role, `${roleCommandsDir}/${role}.md`])),
             messageRoutePaths: {},
             architectureBriefPath: `${handoffDir}/architecture-brief.md`,
+            architectureEvidencePath: `${handoffDir}/architecture-evidence.md`,
+            planningProgressPath: `${handoffDir}/planning-progress.md`,
             architecturePlanPath: `${handoffDir}/architecture-plan.md`,
             knownIssuesPath: `${handoffDir}/known-issues.md`,
+            coderCompletionPath: `${handoffDir}/coder-completion.md`,
+            architectDebugPath: `${handoffDir}/architect-debug.md`,
+            architectureDiagnosisPath: `${handoffDir}/architecture-diagnosis.md`,
             testReportPath: `${handoffDir}/test-report.md`,
             docsSyncReportPath: `${handoffDir}/docs-sync-report.md`,
+            workflowProgressPath: `${handoffDir}/workflow-progress.md`,
             finalAcceptancePath: `${handoffDir}/final-acceptance.md`
         },
         checks: []

package/dist/backend/api/workflow-control-routes.js

@@ -0,0 +1,56 @@
+import { VcmError } from "../errors.js";
+import { submitTerminalInput } from "../runtime/terminal-submit.js";
+import { getTaskRuntimeRepoRoot } from "../services/task-service.js";
+export function registerWorkflowControlRoutes(app, deps) {
+    app.get("/api/tasks/:taskSlug/workflow-control", async (request) => {
+        const context = await getContext(deps, request.params.taskSlug);
+        return deps.workflowControlService.getState(context);
+    });
+    app.post("/api/tasks/:taskSlug/workflow-overrides/:overrideId/approve", async (request) => {
+        const authorizationText = request.body?.authorizationText?.trim();
+        if (!authorizationText) {
+            throw new VcmError({
+                code: "WORKFLOW_OVERRIDE_AUTHORIZATION_REQUIRED",
+                message: "Enter the exact workflow exception that the user authorizes.",
+                statusCode: 400
+            });
+        }
+        const context = await getContext(deps, request.params.taskSlug);
+        const state = await deps.workflowControlService.approveOverride(context, request.params.overrideId, authorizationText);
+        await notifyProjectManager(deps, context, request.params.overrideId, "approved", authorizationText);
+        return state;
+    });
+    app.post("/api/tasks/:taskSlug/workflow-overrides/:overrideId/reject", async (request) => {
+        const context = await getContext(deps, request.params.taskSlug);
+        const state = await deps.workflowControlService.rejectOverride(context, request.params.overrideId);
+        await notifyProjectManager(deps, context, request.params.overrideId, "rejected");
+        return state;
+    });
+}
+async function getContext(deps, taskSlug) {
+    const project = await deps.projectService.getCurrentProject();
+    if (!project) {
+        throw new VcmError({ code: "PROJECT_NOT_CONNECTED", message: "Connect a repository first.", statusCode: 409 });
+    }
+    const [config, task] = await Promise.all([
+        deps.projectService.loadConfig(project.repoRoot),
+        deps.taskService.loadTask(project.repoRoot, taskSlug)
+    ]);
+    return {
+        repoRoot: project.repoRoot,
+        taskRepoRoot: getTaskRuntimeRepoRoot(task),
+        stateRoot: config.stateRoot,
+        handoffDir: task.handoffDir,
+        taskSlug: task.taskSlug
+    };
+}
+async function notifyProjectManager(deps, context, overrideId, decision, authorizationText) {
+    const session = await deps.sessionService.getRoleSession(context.repoRoot, context.taskSlug, "project-manager");
+    if (!session || session.status !== "running" || session.activityStatus === "running")
+        return;
+    const prompt = decision === "approved"
+        ? `[VCM Workflow Override Decision]\nDecision: approved\nAuthorization ID: ${overrideId}\nAuthorization Text: ${authorizationText}\n\nResubmit workflow-progress.md with this Authorization ID and exact Authorization Text.`
+        : `[VCM Workflow Override Decision]\nDecision: rejected\nAuthorization ID: ${overrideId}\n\nKeep the current workflow and choose a legal next dispatch.`;
+    await submitTerminalInput(deps.runtime, session.id, prompt);
+    await deps.sessionService.markRoleActivityRunning(context.repoRoot, context.taskSlug, "project-manager", session.id);
+}

package/dist/backend/cli/install-vcm-harness.js

@@ -5,6 +5,7 @@ import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 import { renderArchitectHarnessRules } from "../templates/harness/architect-agent.js";
+import { CODE_ROLE_DISALLOWED_TOOLS, REVIEWER_DISALLOWED_TOOLS } from "../role-tool-policy.js";
 import { renderCoderHarnessRules } from "../templates/harness/coder-agent.js";
 import { renderCoderWorkerHarnessRules } from "../templates/harness/coder-worker-agent.js";
 import { renderArchitectScaffoldWorkerHarnessRules } from "../templates/harness/architect-scaffold-worker-agent.js";
@@ -28,6 +29,7 @@ import { renderVcmProposeMemorySkillRules } from "../templates/harness/vcm-propo
 import { renderVcmReportHarnessIssueSkillRules } from "../templates/harness/vcm-report-harness-issue-skill.js";
 import { renderVcmRouteMessageSkillRules } from "../templates/harness/vcm-route-message-skill.js";
 import { renderUpdateTaskStateTool, renderVcmTaskStateSkillRules } from "../templates/harness/vcm-task-state-skill.js";
+import { renderVcmWorkflowReviewSkillRules } from "../templates/harness/vcm-workflow-review-skill.js";
 import { renderCheckScaffoldLedgerTool } from "../templates/harness/check-scaffold-ledger.js";
 import { renderRequestArchitectRestartTool, renderRestartArchitectSkillRules } from "../templates/harness/restart-architect-skill.js";
 import { readVcmPackageVersion } from "../app-version.js";
@@ -53,7 +55,7 @@ const VCM_BASH_DEFAULT_TIMEOUT_MS = "600000";
 const VCM_AUTO_MEMORY_ENABLED = false;
 const VCM_HOOK_DEFINITIONS = [
     { eventName: "PreToolUse", matcher: "Bash", command: VCM_BASH_GUARD_HOOK_COMMAND, timeout: 10 },
-    { eventName: "PreToolUse", matcher: "Grep", command: VCM_BASH_GUARD_HOOK_COMMAND, timeout: 10 },
+    { eventName: "PreToolUse", matcher: "Write|Edit", command: VCM_BASH_GUARD_HOOK_COMMAND, timeout: 10 },
     { eventName: "UserPromptSubmit", command: VCM_HOOK_COMMAND, timeout: 5 },
     { eventName: "Stop", command: VCM_STOP_HOOK_COMMAND, timeout: 10 },
     { eventName: "StopFailure", command: VCM_HOOK_COMMAND, timeout: 5 },
@@ -66,12 +68,12 @@ const AGENT_FRONTMATTER = {
     },
     architect: {
         description: "VCM architecture role for plans, module boundaries, public contracts, verifiable behavior, and docs sync.",
-        tools: "Read, Glob, Bash, Edit, Write, Agent, LSP",
+        disallowedTools: CODE_ROLE_DISALLOWED_TOOLS.join(", "),
         skills: ["vcm-code-navigation"]
     },
     coder: {
         description: "VCM implementation role for scoped code changes and focused tests.",
-        tools: "Read, Glob, Bash, Edit, Write, Agent, LSP",
+        disallowedTools: CODE_ROLE_DISALLOWED_TOOLS.join(", "),
         skills: ["vcm-code-navigation"]
     },
     tester: {
@@ -79,7 +81,7 @@ const AGENT_FRONTMATTER = {
     },
     reviewer: {
         description: "VCM independent gate review role for architecture plans, validation adequacy, and code diffs.",
-        tools: "Read, Glob, Bash, Write, LSP",
+        disallowedTools: REVIEWER_DISALLOWED_TOOLS.join(", "),
         skills: ["vcm-code-navigation"]
     },
     translator: {
@@ -98,15 +100,10 @@ const AGENT_FRONTMATTER = {
         effort: "xhigh"
     }
 };
-const REQUIRED_AGENT_TOOLS = {
-    architect: ["Agent", "LSP"],
-    coder: ["Agent", "LSP"],
-    reviewer: ["LSP"]
-};
-const FORBIDDEN_AGENT_TOOLS = {
-    architect: ["Grep"],
-    coder: ["Grep"],
-    reviewer: ["Grep"]
+const REQUIRED_AGENT_DISALLOWED_TOOLS = {
+    architect: CODE_ROLE_DISALLOWED_TOOLS,
+    coder: CODE_ROLE_DISALLOWED_TOOLS,
+    reviewer: REVIEWER_DISALLOWED_TOOLS
 };
 const REQUIRED_AGENT_SKILLS = {
     architect: ["vcm-code-navigation"],
@@ -312,6 +309,12 @@ const WHOLE_FILES = [
         mode: 0o644,
         content: renderSkillFile("VCM Task State Skill", "vcm-task-state", "Use only as project-manager to declare the current task workflow checkpoint to VCM.", renderVcmTaskStateSkillRules())
     },
+    {
+        path: ".claude/skills/vcm-workflow-review/SKILL.md",
+        category: "skill",
+        mode: 0o644,
+        content: renderSkillFile("VCM Workflow Review Skill", "vcm-workflow-review", "Use before every project-manager dispatch to Architect, Coder, or Tester so VCM can approve the workflow transition.", renderVcmWorkflowReviewSkillRules())
+    },
     {
         path: ".claude/skills/vcm-gate-review/SKILL.md",
         category: "skill",
@@ -377,6 +380,12 @@ const WHOLE_FILES = [
         category: "runtime-tool",
         mode: 0o755,
         templatePath: "scripts/harness-tools/vcm-bash-guard"
+    },
+    {
+        path: ".ai/tools/vcm-artifact",
+        category: "runtime-tool",
+        mode: 0o755,
+        templatePath: "scripts/harness-tools/vcm-artifact"
     }
 ];
 const LEGACY_FLAT_SKILL_FILES = [
@@ -619,6 +628,7 @@ function fixedDirectories() {
         ".claude/skills/vcm-long-running-validation/",
         ".claude/skills/vcm-route-message/",
         ".claude/skills/vcm-task-state/",
+        ".claude/skills/vcm-workflow-review/",
         ".claude/skills/vcm-gate-review/",
         ".claude/skills/vcm-report-harness-issue/",
         ".claude/skills/vcm-propose-memory/",
@@ -683,11 +693,9 @@ async function installManagedFile({ projectRoot, definition, dryRun, operations
     if (definition.memoryBlock) {
         nextContent = ensureVcmMemoryBlock(nextContent);
     }
-    for (const requiredTool of REQUIRED_AGENT_TOOLS[definition.agentName] ?? []) {
-        nextContent = ensureAgentTool(nextContent, requiredTool);
-    }
-    for (const forbiddenTool of FORBIDDEN_AGENT_TOOLS[definition.agentName] ?? []) {
-        nextContent = removeAgentTool(nextContent, forbiddenTool);
+    const requiredDisallowedTools = REQUIRED_AGENT_DISALLOWED_TOOLS[definition.agentName];
+    if (requiredDisallowedTools) {
+        nextContent = ensureAgentDisallowedTools(nextContent, requiredDisallowedTools);
     }
     for (const requiredSkill of REQUIRED_AGENT_SKILLS[definition.agentName] ?? []) {
         nextContent = ensureAgentSkill(nextContent, requiredSkill);
@@ -731,47 +739,34 @@ function renderNewManagedFile(definition, block) {
     const suffix = definition.contentAfterBlock?.trim();
     if (definition.agentName) {
         const frontmatter = AGENT_FRONTMATTER[definition.agentName];
-        const tools = frontmatter.tools ?? "Read, Grep, Glob, Bash, Edit, Write";
+        const toolPolicy = frontmatter.disallowedTools
+            ? `disallowedTools: ${frontmatter.disallowedTools}`
+            : `tools: ${frontmatter.tools ?? "Read, Grep, Glob, Bash, Edit, Write"}`;
         const model = frontmatter.model ? `\nmodel: ${frontmatter.model}` : "";
         const effort = frontmatter.effort ? `\neffort: ${frontmatter.effort}` : "";
         const skills = frontmatter.skills?.length
             ? `\nskills:\n${frontmatter.skills.map((skill) => `  - ${skill}`).join("\n")}`
             : "";
-        return `---\nname: ${definition.agentName}\ndescription: ${frontmatter.description}\ntools: ${tools}${model}${effort}${skills}\n---\n\n# ${definition.title}\n\n${block}${suffix ? `\n\n${suffix}` : ""}\n`;
+        return `---\nname: ${definition.agentName}\ndescription: ${frontmatter.description}\n${toolPolicy}${model}${effort}${skills}\n---\n\n# ${definition.title}\n\n${block}${suffix ? `\n\n${suffix}` : ""}\n`;
     }
     return `# ${definition.title}\n\n${block}${suffix ? `\n\n${suffix}` : ""}\n`;
 }
-function ensureAgentTool(content, requiredTool) {
-    const frontmatterMatch = content.match(/^---\r?\n[\s\S]*?\r?\n---/);
-    if (!frontmatterMatch) {
-        return content;
-    }
-    const toolsMatch = frontmatterMatch[0].match(/^tools:\s*(.*)$/m);
-    if (!toolsMatch) {
-        return content.replace(/^(---\r?\n[\s\S]*?)(\r?\n---)/, `$1\ntools: ${requiredTool}$2`);
-    }
-    const tools = toolsMatch[1].split(",").map((tool) => tool.trim()).filter(Boolean);
-    if (tools.includes(requiredTool)) {
-        return content;
-    }
-    const nextTools = [...tools, requiredTool].join(", ");
-    return content.replace(frontmatterMatch[0], frontmatterMatch[0].replace(toolsMatch[0], `tools: ${nextTools}`));
-}
-function removeAgentTool(content, forbiddenTool) {
+function ensureAgentDisallowedTools(content, requiredTools) {
     const frontmatterMatch = content.match(/^---\r?\n[\s\S]*?\r?\n---/);
     if (!frontmatterMatch) {
         return content;
     }
-    const toolsMatch = frontmatterMatch[0].match(/^tools:\s*(.*)$/m);
-    if (!toolsMatch) {
-        return content;
-    }
-    const tools = toolsMatch[1].split(",").map((tool) => tool.trim()).filter(Boolean);
-    const nextTools = tools.filter((tool) => tool !== forbiddenTool);
-    if (nextTools.length === tools.length) {
-        return content;
-    }
-    return content.replace(frontmatterMatch[0], frontmatterMatch[0].replace(toolsMatch[0], `tools: ${nextTools.join(", ")}`));
+    const withoutAllowedTools = frontmatterMatch[0].replace(/^tools:\s*.*\r?\n?/m, "");
+    const disallowedMatch = withoutAllowedTools.match(/^disallowedTools:\s*(.*)$/m);
+    const existing = disallowedMatch?.[1]
+        .split(",")
+        .map((tool) => tool.trim())
+        .filter(Boolean) ?? [];
+    const disallowedTools = [...new Set([...existing, ...requiredTools])].join(", ");
+    const nextFrontmatter = disallowedMatch
+        ? withoutAllowedTools.replace(disallowedMatch[0], `disallowedTools: ${disallowedTools}`)
+        : withoutAllowedTools.replace(/\r?\n---$/, `\ndisallowedTools: ${disallowedTools}\n---`);
+    return content.replace(frontmatterMatch[0], nextFrontmatter);
 }
 function ensureAgentSkill(content, requiredSkill) {
     const frontmatterMatch = content.match(/^---\r?\n[\s\S]*?\r?\n---/);

package/dist/backend/role-tool-policy.js

@@ -0,0 +1,60 @@
+const LSP_FRONTMATTER_DISALLOWED_TOOLS = [
+    "NotebookEdit",
+    "WebFetch",
+    "WebSearch"
+];
+const NON_VCM_ROLE_RUNTIME_TOOLS = [
+    "AskUserQuestion",
+    "CronCreate",
+    "CronDelete",
+    "CronList",
+    "DesignSync",
+    "EnterPlanMode",
+    "EnterWorktree",
+    "ExitPlanMode",
+    "ExitWorktree",
+    "KillShell",
+    "Monitor",
+    "NotebookEdit",
+    "PushNotification",
+    "RemoteTrigger",
+    "ReportFindings",
+    "ScheduleWakeup",
+    "SendMessage",
+    "Skill",
+    "TaskCreate",
+    "TaskGet",
+    "TaskList",
+    "TaskOutput",
+    "TaskStop",
+    "TaskUpdate",
+    "TodoWrite",
+    "WebFetch",
+    "WebSearch",
+    "Workflow"
+];
+export const CODE_ROLE_DISALLOWED_TOOLS = [...LSP_FRONTMATTER_DISALLOWED_TOOLS];
+export const REVIEWER_DISALLOWED_TOOLS = [
+    "Agent",
+    "Edit",
+    ...LSP_FRONTMATTER_DISALLOWED_TOOLS
+];
+export const CODE_ROLE_RUNTIME_DISALLOWED_TOOLS = [...NON_VCM_ROLE_RUNTIME_TOOLS];
+export const REVIEWER_RUNTIME_DISALLOWED_TOOLS = [
+    "Agent",
+    "Edit",
+    ...NON_VCM_ROLE_RUNTIME_TOOLS
+];
+const LSP_ROLE_NAMES = new Set(["architect", "coder", "reviewer"]);
+export function roleUsesLsp(role) {
+    return LSP_ROLE_NAMES.has(role);
+}
+export function roleRuntimeDisallowedTools(role) {
+    if (role === "reviewer") {
+        return REVIEWER_RUNTIME_DISALLOWED_TOOLS;
+    }
+    if (role === "architect" || role === "coder") {
+        return CODE_ROLE_RUNTIME_DISALLOWED_TOOLS;
+    }
+    return [];
+}

package/dist/backend/server.js

@@ -45,6 +45,7 @@ import { createTerminalInterruptService } from "./services/terminal-interrupt-se
 import { createTerminalProcessExitService } from "./services/terminal-process-exit-service.js";
 import { createTranslationService } from "./services/translation-service.js";
 import { createUsageAnalyticsService } from "./services/usage-analytics-service.js";
+import { createWorkflowControlService } from "./services/workflow-control-service.js";
 import { createDiagnosticsService } from "./services/diagnostics-service.js";
 import { registerAppSettingsRoutes } from "./api/app-settings-routes.js";
 import { registerArtifactRoutes } from "./api/artifact-routes.js";
@@ -60,6 +61,7 @@ import { registerSessionRoutes } from "./api/session-routes.js";
 import { registerTaskRoutes } from "./api/task-routes.js";
 import { registerTranslationRoutes } from "./api/translation-routes.js";
 import { registerUsageAnalyticsRoutes } from "./api/usage-analytics-routes.js";
+import { registerWorkflowControlRoutes } from "./api/workflow-control-routes.js";
 import { registerTerminalWs } from "./ws/terminal-ws.js";
 import { toVcmError } from "./errors.js";
 import { readVcmPackageVersion } from "./app-version.js";
@@ -120,7 +122,8 @@ export async function createServer(deps, options = {}) {
         harnessService: deps.harnessService,
         harnessFeedbackService: deps.harnessFeedbackService,
         autoMemoryService: deps.autoMemoryService,
-        runtimeCoordinator: deps.runtimeCoordinator
+        runtimeCoordinator: deps.runtimeCoordinator,
+        workflowControlService: deps.workflowControlService
     });
     registerTaskRoutes(app, {
         projectService: deps.projectService,
@@ -144,8 +147,18 @@ export async function createServer(deps, options = {}) {
     registerArtifactRoutes(app, {
         projectService: deps.projectService,
         taskService: deps.taskService,
-        artifactService: deps.artifactService
-    });
+        artifactService: deps.artifactService,
+        sessionService: deps.sessionService
+    });
+    if (deps.workflowControlService) {
+        registerWorkflowControlRoutes(app, {
+            projectService: deps.projectService,
+            taskService: deps.taskService,
+            sessionService: deps.sessionService,
+            workflowControlService: deps.workflowControlService,
+            runtime: deps.runtime
+        });
+    }
     registerMessageRoutes(app, {
         projectService: deps.projectService,
         taskService: deps.taskService,
@@ -228,7 +241,8 @@ export function createDefaultServerDeps(options = {}) {
     });
     const runtime = createNodePtyTerminalRuntime({ fs });
     const registry = createSessionRegistry();
-    const artifactService = createArtifactService(fs);
+    const workflowControlService = createWorkflowControlService({ fs });
+    const artifactService = createArtifactService(fs, { workflowControlService });
     const projectService = createProjectService({ fs, git, appSettings });
     const taskService = createTaskService({ fs, git, artifactService, projectService });
     const taskWorkflowService = createTaskWorkflowService({ fs });
@@ -292,6 +306,7 @@ export function createDefaultServerDeps(options = {}) {
         sessionService,
         taskService,
         taskWorkflowService,
+        workflowControlService,
         onRouteDelivered: ({ repoRoot, taskSlug, message }) => architectRestartService.recordRouteDelivered(repoRoot, taskSlug, message)
     });
     const taskLaunchService = createTaskLaunchService({
@@ -462,7 +477,8 @@ export function createDefaultServerDeps(options = {}) {
         terminalProcessExitService,
         runtime,
         diagnosticsService,
-        usageAnalyticsService
+        usageAnalyticsService,
+        workflowControlService
     };
 }
 export function getDefaultStaticDir() {