winter-super-cli 2026.6.24 → 2026.6.27

package/src/cli/repl.js

@@ -22,6 +22,8 @@ import { SessionManager } from '../session/manager.js';
 import { AIProviderManager } from '../ai/providers.js';
 import { ConfigLoader } from './config.js';
 import { PermissionManager } from '../tools/permission.js';
+import { MCPClient } from '../mcp/client.js';
+import { getMcpPreset, upsertMcpServer } from '../mcp/presets.js';
 import { compressConversation } from '../context/compress.js';
 import { getToolUsageSummary } from '../tools/analytics.js';
 import { SweAgent } from '../agent/swe-agent.js';
@@ -425,6 +427,7 @@ export class WinterREPL {
     const shouldDrop = (entry) => {
       const text = typeof entry === 'string' ? entry : entry?.text || '';
       return text.startsWith('[Required local resources]')
+        || text.startsWith('[Auto-loaded resource application profile]')
         || text.startsWith('[Auto-applied skills]')
         || text.startsWith('[Project rule file')
         || text.startsWith('[Startup local resource index]')
@@ -440,7 +443,11 @@ export class WinterREPL {
       `awesome-design-md: ${resourcePaths.designs}`,
       `karpathy-tools: ${resourcePaths.karpathy}`,
       `page-agent: ${resourcePaths.pageAgent}`,
+      `hermes-agent-core: ${resourcePaths.hermesAgentCore}`,
+      `gsap-skills: ${resourcePaths.gsapSkills}`,
       `ecc: ${resourcePaths.ecc}`,
+      `codex: ${resourcePaths.codex.root}`,
+      `claude: ${resourcePaths.claude.root}`,
     ];
     await this.session.replaceMemory(
       '[Startup local resource index]',
@@ -669,8 +676,8 @@ export class WinterREPL {
       }
     }
 
-    await this.bootstrapProjectCapabilities();
     await this.compactStartupMemories({ projectInstructionFiles, autoCreateDocs });
+    await this.bootstrapProjectCapabilities();
 
     // Codebase Index is intentionally lazy/on-demand. Top-tier coding agents do
     // not make first-run chat pay for a repo-wide scan, and this also prevents
@@ -716,6 +723,7 @@ export class WinterREPL {
     this._pasteTimer = null;
     this._isPasteChunk = false;
     this._pasteChunkTimer = null;
+    this._pasteCounter = 0;
     const PASTE_DELAY = 80;
 
     process.stdin.on('data', (chunk) => {
@@ -734,7 +742,7 @@ export class WinterREPL {
       }
     });
 
-    const flushPasteBuffer = () => {
+    const flushPasteBuffer = async () => {
       this._pasteTimer = null;
       if (this._pasteBuffer.length === 0) return;
 
@@ -770,6 +778,19 @@ export class WinterREPL {
       this._multilineBuffer.push(...this._pasteBuffer);
       this._pasteBuffer = [];
 
+      if (this.shouldAutoPersistBufferedPaste(this._multilineBuffer, { isPasteChunk: this._isPasteChunk })) {
+        const pastedText = this._multilineBuffer.join('\n').trimEnd();
+        if (this.shouldPersistPastedText(pastedText)) {
+          const paste = await this.persistPastedText(pastedText);
+          this._multilineBuffer = [];
+          this._isPasteChunk = false;
+          const reference = this.formatPastedTextReference(paste);
+          console.log(`${colors.cyan}│ ${colors.dim}${reference}${colors.reset}`);
+          this.submitInputQueue(reference);
+          return;
+        }
+      }
+
       // If they pressed Enter on an empty line, submit the multiline buffer!
       if (isJustEmptyEnter && this._multilineBuffer.length > 1) {
         // Remove the trailing empty line
@@ -786,6 +807,14 @@ export class WinterREPL {
           return;
         }
         
+        if (this.shouldPersistPastedText(combined)) {
+          const paste = await this.persistPastedText(combined);
+          const reference = this.formatPastedTextReference(paste);
+          console.log(`${colors.cyan}│ ${colors.dim}${reference}${colors.reset}`);
+          this.submitInputQueue(reference);
+          return;
+        }
+
         this.submitInputQueue(combined);
         return;
       }
@@ -814,7 +843,14 @@ export class WinterREPL {
     this.rl.on('line', (line) => {
       this._pasteBuffer.push(line);
       if (this._pasteTimer) clearTimeout(this._pasteTimer);
-      this._pasteTimer = setTimeout(flushPasteBuffer, PASTE_DELAY);
+      this._pasteTimer = setTimeout(() => {
+        void flushPasteBuffer().catch((error) => {
+          this._pasteBuffer = [];
+          this._multilineBuffer = [];
+          console.log(`\n${colors.red}? Paste error: ${error.message}${colors.reset}\n`);
+          if (this.running && !this.readlineClosed) this.showInputPrompt();
+        });
+      }, PASTE_DELAY);
     });
 
     this.rl.on('close', async () => {
@@ -861,6 +897,55 @@ export class WinterREPL {
     return this.inputController.handleDirectClipboardPaste();
   }
 
+  getPasteStorageDir() {
+    return path.join(this.config?.winterDir || path.join(homedir(), '.winter'), 'pastes');
+  }
+
+  normalizePastedText(text = '') {
+    return String(text || '')
+      .replace(/\x1b\[200~/g, '')
+      .replace(/\x1b\[201~/g, '')
+      .replace(/\r\n/g, '\n')
+      .replace(/\r/g, '\n');
+  }
+
+  getPastedTextLineCount(text = '') {
+    const value = this.normalizePastedText(text);
+    if (!value) return 0;
+    return value.split(/\r\n|\r|\n/).length;
+  }
+
+  shouldPersistPastedText(text = '', { minLines = 8, minChars = 4000 } = {}) {
+    const value = this.normalizePastedText(text);
+    return this.getPastedTextLineCount(value) >= minLines || value.length >= minChars;
+  }
+
+  shouldAutoPersistBufferedPaste(buffer = [], { isPasteChunk = false } = {}) {
+    if (!Array.isArray(buffer) || buffer.length === 0) return false;
+    const manualMultiline = buffer[0] === '';
+    const text = this.normalizePastedText(buffer.join('\n')).trimEnd();
+    return Boolean(text) && this.shouldPersistPastedText(text) && (isPasteChunk || !manualMultiline);
+  }
+
+  async persistPastedText(text = '') {
+    const content = this.normalizePastedText(text);
+    const dir = this.getPasteStorageDir();
+    await fs.mkdir(dir, { recursive: true });
+    this._pasteCounter = Number(this._pasteCounter || 0) + 1;
+    const filePath = path.join(dir, `paste_${this._pasteCounter}_${Date.now()}.txt`);
+    await fs.writeFile(filePath, content, 'utf8');
+    return {
+      index: this._pasteCounter,
+      path: filePath,
+      lines: this.getPastedTextLineCount(content),
+      chars: content.length,
+    };
+  }
+
+  formatPastedTextReference(paste = {}) {
+    return `[Pasted text #${paste.index || 1}: ${paste.lines || 0} lines -> ${paste.path}]`;
+  }
+
   buildInputPanel() {
     return this.inputController.buildInputPanel();
   }
@@ -1123,6 +1208,19 @@ export class WinterREPL {
         return;
       }
 
+      if (!input.startsWith('/')) {
+        const browserShortcut = this.resolveBrowserShortcut(input);
+        if (browserShortcut) {
+          await this.handleOpenBrowserIntent(input, browserShortcut);
+          return;
+        }
+      }
+
+      if (!input.startsWith('/') && this.isOpenBrowserIntent(input)) {
+        await this.handleOpenBrowserIntent(input);
+        return;
+      }
+
       // Parse @-symbols for non-command input
       if (!input.startsWith('/')) {
         const canUseHeavyContext = await this.shouldUseHeavyProjectContext();
@@ -1196,6 +1294,84 @@ export class WinterREPL {
     }
   }
 
+  isOpenBrowserIntent(input = '') {
+    const raw = String(input || '').trim();
+    if (!raw) return false;
+    const text = `${raw.toLowerCase()}\n${this.normalizeIntentText(raw).toLowerCase()}`;
+    return /\b(mo|open|launch|start)\b.*\b(chrome|browser|trinh duyet|google chrome)\b/i.test(text)
+      || /\b(chrome|browser|trinh duyet|google chrome)\b.*\b(mo|open|launch|start)\b/i.test(text);
+  }
+
+  resolveBrowserShortcut(input = '') {
+    const raw = String(input || '').trim();
+    if (!raw) return null;
+    const normalized = this.normalizeIntentText(raw).toLowerCase();
+    const text = `${raw.toLowerCase()}\n${normalized}`;
+
+    const url = this.extractUrlFromText(raw);
+    if (url && /\b(mo|open|launch|start|browse)\b/i.test(normalized)) {
+      return { url, label: url };
+    }
+
+    const knownSites = [
+      { pattern: /\b(youtube music|yt music|music youtube)\b/i, url: 'https://music.youtube.com', label: 'YouTube Music' },
+      { pattern: /\b(youtube|you tube)\b/i, url: 'https://www.youtube.com', label: 'YouTube' },
+      { pattern: /\b(spotify)\b/i, url: 'https://open.spotify.com', label: 'Spotify' },
+      { pattern: /\b(google)\b/i, url: 'https://www.google.com', label: 'Google' },
+    ];
+
+    if (/\b(mo|open|launch|start)\b/i.test(normalized)) {
+      const site = knownSites.find(item => item.pattern.test(text));
+      if (site) return site;
+    }
+
+    if (/\b(tim|search|kiem)\b/i.test(normalized) && /\b(chrome|google|browser|trinh duyet)\b/i.test(normalized)) {
+      const query = this.extractBrowserSearchQuery(raw);
+      if (query) {
+        return {
+          url: `https://www.google.com/search?${new URLSearchParams({ q: query }).toString()}`,
+          label: `Google search: ${query}`,
+        };
+      }
+    }
+
+    return null;
+  }
+
+  extractBrowserSearchQuery(input = '') {
+    let query = String(input || '').trim();
+    query = query.replace(/^\s*(tìm|tim|search|kiếm|kiem)\s+/i, '');
+    query = query.replace(/\s+(trên|tren|on)\s+(chrome|google|browser|trình duyệt|trinh duyet)\b.*$/i, '');
+    query = query.replace(/\s+(đi|di)\s*$/i, '');
+    query = query.trim();
+    return query || null;
+  }
+
+  extractUrlFromText(input = '') {
+    const match = String(input || '').match(/https?:\/\/[^\s]+/i);
+    return match ? match[0].replace(/[),.;]+$/g, '') : null;
+  }
+
+  async handleOpenBrowserIntent(input = '', options = {}) {
+    const url = options.url || this.extractUrlFromText(input) || 'about:blank';
+    const result = await this.tools.execute('OpenBrowser', { browser: 'chrome', url }, { cwd: this.projectPath });
+    await this.session?.addToHistory?.({ role: 'user', content: input });
+
+    if (result?.success === false) {
+      const message = `Không mở được Chrome: ${result.error || 'unknown error'}`;
+      console.log(`${colors.red}${message}${colors.reset}`);
+      if (result.recovery) console.log(`${colors.dim}${result.recovery}${colors.reset}`);
+      await this.session?.addToHistory?.({ role: 'assistant', content: message });
+      return result;
+    }
+
+    const label = options.label || url;
+    const message = `Đã mở Chrome${url && url !== 'about:blank' ? `: ${label}` : '.'}`;
+    console.log(`${colors.green}${message}${colors.reset}`);
+    await this.session?.addToHistory?.({ role: 'assistant', content: message });
+    return result;
+  }
+
   showSmartTip(input = '') {
     const text = input.toLowerCase();
     let tip = null;
@@ -1395,7 +1571,7 @@ export class WinterREPL {
 
 CRITICAL DEBUG/AGENT RULES:
 1. Inspect the project before changing anything. Read the failing file, related caller, config, and logs.
-2. Reproduce or locate the first hard failure. For frontend/runtime UI issues, use BrowserDebug when a URL/dev server is available.
+2. Reproduce or locate the first hard failure. For frontend/runtime UI issues, use chrome-devtools MCP in visible Chrome when a URL/dev server is available; use BrowserDebug only as a headless fallback.
 3. Patch the smallest root cause with Write/Edit.
 4. Run the closest verification command(s): ${verifyCommands.join(' && ')}.
 5. If verification fails, read the new error, patch again, and run verification again.
@@ -1651,14 +1827,14 @@ ${colors.reset}
       case 'review':
         return byName(['Read', 'Grep', 'Glob', 'Bash', 'WebFetch']);
       case 'debug':
-        return byName(['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'BrowserDebug', 'WebFetch', 'Parallel']);
+        return byName(['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'OpenBrowser', 'VisibleBrowser', 'BrowserDebug', 'WebFetch', 'MCP', 'Parallel']);
       case 'research':
         return byName(['Read', 'Grep', 'Glob', 'WebFetch', 'WebSearch', 'Parallel']);
       case 'design':
       case 'ui':
-        return byName(['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'BrowserDebug', 'WebFetch']);
+        return byName(['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'OpenBrowser', 'VisibleBrowser', 'BrowserDebug', 'WebFetch', 'MCP']);
       default:
-        return byName(['Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep', 'BrowserDebug', 'WebFetch', 'WebSearch', 'Parallel', 'Agent']);
+        return byName(['Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep', 'OpenBrowser', 'VisibleBrowser', 'BrowserDebug', 'WebFetch', 'WebSearch', 'MCP', 'Parallel', 'Agent', 'DelegateTask', 'ParallelAgent']);
     }
   }
 
@@ -1783,6 +1959,8 @@ ${colors.reset}
     const pureQuestionPattern = /^(what|why|how|when|where|is|are|can|could|should|would|explain|describe|tell me|compare|giải thích|mô tả|so sánh|tai sao|vi sao|la gi|co nen|co phai|tại sao|vì sao|là gì|có nên|có phải|nhu the nao|như thế nào|khi nào)\b/i;
 
     if (pureQuestionPattern.test(text) && !actionPattern.test(text)) return false;
+
+    if (this.isBrowserInteractionRequest(rawText)) return true;
     
     // Even without explicit target, some verbs are strong enough on their own
     const strongActionAlone = /\b(fix|debug|deploy|build|test|commit|install|run|refactor|sửa|chạy|cài|triển khai|xây dựng)\b/i;
@@ -1812,6 +1990,15 @@ ${colors.reset}
     return true;
   }
 
+  isBrowserInteractionRequest(text = '') {
+    const raw = String(text || '');
+    const normalized = this.normalizeIntentText(raw);
+    const combined = `${raw}\n${normalized}`;
+    const action = /\b(click|fill|submit|press|select|navigate|bam|dien|chon|nhan|vao|bấm|điền|chọn|nhấn|vào)\b/i;
+    const target = /\b(url|http|https|site|website|web|page|form|button|link|chrome|browser|trang|nut|nút|dang ky|dang nhap|khach hang|khách hàng|đăng ký|đăng nhập)\b/i;
+    return action.test(combined) && target.test(combined);
+  }
+
   detectFakeCompletion(content = '') {
     const text = String(content || '').toLowerCase();
     if (!text.trim()) return false;
@@ -1820,6 +2007,9 @@ ${colors.reset}
     const fakeCompletionClaims = /(?:đã (?:sửa|tạo|viết|xóa|cập nhật|thêm|chỉnh|xong|hoàn thành|fix|update|edit|write|create|delete|remove|modify|change|apply|deploy|push)|i(?:'ve| have) (?:fixed|created|written|updated|added|modified|changed|edited|applied|deployed|deleted|removed|patched|implemented|refactored)|done!|xong rồi|hoàn thành|đã hoàn tất|hoàn tất|the (?:fix|change|update|edit|modification) (?:has been|is) (?:applied|done|completed|made)|here(?:'s| is) the (?:fix|update|change|solution|implementation|code)|file (?:has been|was) (?:updated|created|modified|written|changed)|changes? (?:have been|has been|were) (?:made|applied|saved)|successfully (?:updated|created|modified|fixed|applied|changed|written))/i;
     if (fakeCompletionClaims.test(text)) return true;
 
+    const fakeBrowserClaims = /(?:đã|da|i(?:'ve| have))\s+(?:bấm|bam|click(?:ed)?|mở|mo|open(?:ed)?|điền|dien|fill(?:ed)?|chọn|chon|select(?:ed)?|submit(?:ted)?|vào|vao|navigate(?:d)?)/i;
+    if (fakeBrowserClaims.test(text)) return true;
+
     // Detect code blocks that pretend to show "changes" without tool use
     const codeBlockWithFilePath = /```[\s\S]*?(?:[\/\\][\w.-]+\.(?:js|ts|py|css|html|json|md|jsx|tsx|vue|go|rs|java|c|cpp|rb|sh))[\s\S]*?```/i;
     const claimsFileChange = /(?:here(?:'s| is)|below|sau đây|dưới đây|như sau|updated|modified|changed|new|fixed)/i;
@@ -1830,6 +2020,19 @@ ${colors.reset}
 
   buildToolEvidenceCorrection(messages = []) {
     const request = this.getLatestUserText(messages);
+    if (this.isBrowserInteractionRequest(request)) {
+      return [
+        'RUNTIME ENFORCEMENT: Your previous response was BLOCKED because you claimed a browser/web action without real browser tool evidence.',
+        '',
+        'For browser interaction tasks you MUST use tools, not prose:',
+        '1. If chrome-devtools MCP is configured, call MCP {"server":"chrome-devtools","tool":"list"} first if needed.',
+        '2. Use chrome-devtools MCP tools such as new_page/navigate_page, take_snapshot, click, fill/fill_form, evaluate_script, list_network_requests, and take_screenshot in visible Chrome.',
+        '3. Use WebFetch only for static text extraction. WebFetch cannot click buttons, fill forms, or preserve page state. Use VisibleBrowser when MCP is unavailable and the user needs visible browser control. BrowserDebug is headless and should be fallback only.',
+        '4. Do not say "đã bấm", "đã điền", "đã mở", or "đã kiểm tra" until a browser/MCP tool result proves it.',
+        '',
+        `Original user request: ${request}`,
+      ].join('\n');
+    }
     return [
       '⚠️ RUNTIME ENFORCEMENT: Your previous response was BLOCKED because you did not use any tool.',
       '',
@@ -1842,7 +2045,7 @@ ${colors.reset}
       'DO NOT say "I have updated/created/fixed" without a tool call proving it.',
       'DO NOT describe what you would do. Actually DO IT with tool calls.',
       '',
-      'Available tools: Read, Write, Edit, Bash, Glob, Grep, BrowserDebug, WebFetch, WebSearch.',
+      'Available tools: Read, Write, Edit, Bash, Glob, Grep, OpenBrowser, VisibleBrowser, BrowserDebug, WebFetch, WebSearch, MCP.',
       '',
       'If native tool calls are not supported, output exactly one fallback tool call:',
       '<invoke name="Read"><parameter name="path">README.md</parameter></invoke>',
@@ -1864,6 +2067,10 @@ ${colors.reset}
 
     const hints = [];
 
+    if (/\b(click|fill|submit|press|select|navigate|bam|dien|chon|nhan|vao|bấm|điền|chọn|nhấn|vào)\b/i.test(text) && /\b(web|website|page|url|http|chrome|browser|form|button|link|trang|nut|nút|dang ky|dang nhap|khach hang|đăng ký|đăng nhập|khách hàng)\b/i.test(text)) {
+      hints.push('TOOL HINT: This is a live browser interaction. Do NOT use WebFetch alone. Prefer visible Chrome via MCP {"server":"chrome-devtools","tool":"list"} then chrome-devtools tools new_page/navigate_page, take_snapshot, click, fill/fill_form, evaluate_script, list_network_requests, and take_screenshot. If MCP is unavailable, call VisibleBrowser for real visible Puppeteer control. Only use BrowserDebug as headless fallback. Only claim click/fill/navigation after MCP, VisibleBrowser, or BrowserDebug evidence.');
+    }
+
     // Detect file reading requests
     const hasPath = /[A-Za-z]:[\\/][\w.\\/\\-]+/i.test(text) || /(?:^|\s)[.~]?\/[\w.\/-]+/i.test(text);
     const readVerbs = /\b(đọc|doc|read|xem|view|mở|open|show|hiện|hiển thị|cat|type)\b/i;
@@ -1902,7 +2109,11 @@ ${colors.reset}
 
     // Detect URL/web requests  
     if (/\b(https?:\/\/[^\s]+|url|website|trang web|web page)\b/i.test(text)) {
-      hints.push('TOOL HINT: To fetch a URL, call tool WebFetch with {"url": "<url>"}. For browser debugging, use BrowserDebug.');
+      hints.push('TOOL HINT: To fetch static URL text, call WebFetch. For live visible browser debugging/control, prefer MCP server chrome-devtools with new_page/navigate_page, take_snapshot, click, fill/fill_form, evaluate_script, list_console_messages, list_network_requests, or performance trace tools; use BrowserDebug only as headless fallback.');
+    }
+
+    if (/\b(chrome|devtools|browser debug|debug browser|screenshot|console|network|lcp|performance|perf|web vitals|localhost|127\.0\.0\.1)\b/i.test(text)) {
+      hints.push('TOOL HINT: For "open Chrome" / "mở chrome", call OpenBrowser {"browser":"chrome","url":"about:blank"}. Do NOT call Bash/Get-Command/Start-Process. If configured, use MCP {"server":"chrome-devtools","tool":"list"} for page state, console, network, screenshots, and performance.');
     }
 
     if (hints.length === 0) return null;
@@ -1980,6 +2191,9 @@ ${colors.reset}
       if ((options?.requireToolEvidence && this.responseNeedsToolEvidence(assistantMsg.content)) || isFakeCompletion) {
         return { assistantMsg, toolCalls, finalContent: '', finishReason: 'tool_evidence_required' };
       }
+      if (options?.deferFinalContent) {
+        return { assistantMsg, toolCalls, finalContent: assistantMsg.content, finishReason };
+      }
       this.printAssistantAnswer(assistantMsg.content, startedAt, totalUsage);
       return { assistantMsg, toolCalls, finalContent: assistantMsg.content, finishReason };
     }
@@ -1994,7 +2208,7 @@ ${colors.reset}
     const toolCallParts = [];
     let finishReason = null;
     let printed = false;
-    const bufferToolModeContent = options?.enableTools === true;
+    const bufferToolModeContent = false;
 
     for await (const chunk of this.ai.streamRequest(messages, options)) {
       if (chunk.usage) this.addUsage(totalUsage, chunk.usage);
@@ -2111,6 +2325,14 @@ ${colors.reset}
           finishReason: 'tool_evidence_required',
         };
       }
+      if (options?.deferFinalContent) {
+        return {
+          assistantMsg: { content: visibleContent },
+          toolCalls,
+          finalContent: visibleContent,
+          finishReason,
+        };
+      }
       this.printAssistantAnswer(visibleContent, startedAt, totalUsage);
       return {
         assistantMsg: { content: visibleContent },
@@ -2147,7 +2369,7 @@ ${colors.reset}
           '/provider', '/model', '/models', '/providers',
           '/theme:toggle', '/tui',
           '/auto', '/debug', '/doctor', '/context', '/scorecard', '/swe',
-          '/read', '/write', '/glob', '/grep', '/bash',
+          '/read', '/write', '/glob', '/grep', '/bash', '/browser', '/paste',
         '/codex', '/claude', '/karpathy', '/agents',
         '/resources', '/designs', '/skills',
         '/ecc',
@@ -2244,6 +2466,9 @@ ${colors.reset}
 
   async requestFinalAnswer(messages, toolSummaries, startedAt, totalUsage) {
     const executionProfile = this.selectExecutionProfile(messages, { enableTools: false });
+    const latestUserText = this.getLatestUserText(messages);
+    const browserInteraction = this.isBrowserInteractionRequest(latestUserText);
+    const hasBrowserEvidence = toolSummaries.some(summary => /^(MCP|VisibleBrowser|BrowserDebug|OpenBrowser):/i.test(summary));
     const finalMessages = [
       ...messages,
       {
@@ -2256,6 +2481,7 @@ ${colors.reset}
           'Start with the actual outcome, then mention only the most relevant files/commands. Avoid broad generic advice.',
           'If a tool failed, explain the concrete failure briefly and answer with the available evidence.',
           'Do not repeat the plan. Do not re-summarize unrelated project context. Do not claim memory/tool state that is not visible in the transcript.',
+          browserInteraction && !hasBrowserEvidence ? 'Important: The user asked for browser interaction, but no MCP/VisibleBrowser/BrowserDebug/OpenBrowser result is available. You must say the browser action was NOT performed; do not claim you clicked, filled, navigated, or inspected pages.' : '',
           toolSummaries.length ? `Tool summary:\n${toolSummaries.join('\n')}` : '',
         ].filter(Boolean).join('\n'),
       },
@@ -2268,7 +2494,7 @@ ${colors.reset}
       }
 
       if (typeof this.ai.streamRequest === 'function') {
-        return await this.streamFinalAnswer(finalMessages, startedAt, totalUsage, executionProfile);
+        return await this.streamFinalAnswer(finalMessages, startedAt, totalUsage, executionProfile, { browserInteraction, hasBrowserEvidence });
       }
 
       const response = await this.ai.sendRequest(finalMessages, {
@@ -2278,7 +2504,10 @@ ${colors.reset}
         signal: this.currentAbortController?.signal,
       });
       this.addUsage(totalUsage, response.usage);
-      const content = response.choices?.[0]?.message?.content || '';
+      let content = response.choices?.[0]?.message?.content || '';
+      if (browserInteraction && !hasBrowserEvidence && this.detectFakeCompletion(content)) {
+        content = 'Chưa thực hiện được thao tác trên trình duyệt: lượt này không có bằng chứng từ MCP/VisibleBrowser/BrowserDebug/OpenBrowser, nên Winter chặn câu trả lời để tránh báo sai. Hãy bật chrome-devtools MCP hoặc dùng VisibleBrowser để Winter gọi đúng browser tool.';
+      }
       
       if (this.spinner) this.spinner.stop();
       
@@ -2295,7 +2524,7 @@ ${colors.reset}
     }
   }
 
-  async streamFinalAnswer(messages, startedAt, totalUsage, executionProfile = null) {
+  async streamFinalAnswer(messages, startedAt, totalUsage, executionProfile = null, validation = {}) {
     let content = '';
     const profile = executionProfile || this.selectExecutionProfile(messages, { enableTools: false });
 
@@ -2321,6 +2550,10 @@ ${colors.reset}
 
       if (this.spinner) this.spinner.stop();
 
+      if (validation.browserInteraction && !validation.hasBrowserEvidence && this.detectFakeCompletion(content)) {
+        content = 'Chưa thực hiện được thao tác trên trình duyệt: lượt này không có bằng chứng từ MCP/VisibleBrowser/BrowserDebug/OpenBrowser, nên Winter chặn câu trả lời để tránh báo sai. Hãy bật chrome-devtools MCP hoặc dùng VisibleBrowser để Winter gọi đúng browser tool.';
+      }
+
       if (content) {
         this.printAssistantAnswer(content, startedAt, totalUsage);
         return content;
@@ -2341,6 +2574,9 @@ ${colors.reset}
     });
     this.addUsage(totalUsage, response.usage);
     content = response.choices?.[0]?.message?.content || '';
+    if (validation.browserInteraction && !validation.hasBrowserEvidence && this.detectFakeCompletion(content)) {
+      content = 'Chưa thực hiện được thao tác trên trình duyệt: lượt này không có bằng chứng từ MCP/VisibleBrowser/BrowserDebug/OpenBrowser, nên Winter chặn câu trả lời để tránh báo sai. Hãy bật chrome-devtools MCP hoặc dùng VisibleBrowser để Winter gọi đúng browser tool.';
+    }
     if (content) {
       this.printAssistantAnswer(content, startedAt, totalUsage);
     }
@@ -2747,7 +2983,7 @@ ${colors.reset}
         messages.push({ role: 'system', content: toolHint });
       }
 
-      const { finalContent, usedMutatingTools } = await this.runConversation(messages, 'Thinking', tools);
+      const { finalContent, usedMutatingTools, autoVerified } = await this.runConversation(messages, 'Thinking', tools);
 
       const allToolCalls = [];
       for (const msg of messages) {
@@ -2772,7 +3008,7 @@ ${colors.reset}
       });
 
       // Tự động verify: nếu AI đã dùng tools (sửa code), chạy test/build.
-      if (finalContent && this.shouldAutoVerifyAfterTools(message, usedMutatingTools)) {
+      if (!autoVerified && finalContent && this.shouldAutoVerifyAfterTools(message, usedMutatingTools)) {
         const sessionContext = this.session?.getContext?.() || {};
         const profile = String(sessionContext.workflowProfile || 'general');
         const amplifier = sessionContext.smallModelAmplifier || {};
@@ -2823,7 +3059,7 @@ ${colors.reset}
     ].filter(Boolean).join('\n');
 
     const amplifier = buildSmallModelAmplification({
-      modelTier: this.ai?._modelTier || 'medium',
+      modelTier: this.getActiveModelTier(),
       workflowProfile: workflow.profile,
       depth: workflow.depth,
     });
@@ -2973,35 +3209,10 @@ Do NOT stop until all errors are resolved.`;
   }
 
   async runAgent(role, task) {
-    const agentDefinition = await this.agentRegistry.get(role || 'general');
-    const context = await this.getProjectContext(task);
-    const messages = [
-      { role: 'system', content: this.getAgentDefinitionSystemPrompt(agentDefinition, context) }
-    ];
-
-    const promptHistory = this.getCompressedPromptHistory({
-      limit: 40,
-      keepRecent: 16,
-      maxTotalChars: 16000,
-    });
-    if (promptHistory.summary) {
-      messages.push({ role: 'system', content: `Compressed prior conversation:\n${promptHistory.summary}` });
-    }
-    for (const entry of promptHistory.entries) {
-      messages.push({ role: entry.role, content: entry.content });
-    }
-
-    messages.push({ role: 'user', content: `Task: ${task}` });
-
-    const agentTools = this.getAgentToolsForDefinition(agentDefinition);
-    const { finalContent, usedMutatingTools } = await this.runConversation(messages, `Subagent [${agentDefinition.id}]`, agentTools);
-
-    await this.session.addToHistory({ role: 'user', content: `[subagent:${agentDefinition.id}] ${task}` });
-    await this.session.addToHistory({ role: 'assistant', content: finalContent });
-
-    if (finalContent && this.shouldAutoVerifyAfterTools(task, usedMutatingTools)) {
-      await this.verifyAndHeal(messages, agentTools, 2);
-    }
+    const result = await this.tools.agentTool.run(task, { role: role || 'general' });
+    await this.session.addToHistory({ role: 'user', content: `[subagent:${result.role || role || 'general'}] ${task}` });
+    await this.session.addToHistory({ role: 'assistant', content: result.finalContent || result.summary || result.error || '' });
+    return result;
   }
 
   async listAgentDefinitions() {
@@ -3278,6 +3489,14 @@ Light mode enabled for safety. Heavy codebase, graph, and git context are skippe
       await this.session.replaceMemory('[Required local resources]', requiredLocalResources, 'resource');
     }
 
+    const projectInstructionFiles = await this.readProjectInstructionFiles();
+    const resourceApplicationProfile = await this.contextLoader.getResourceApplicationProfile({ projectInstructionFiles });
+    if (resourceApplicationProfile) {
+      await this.session.updateContext('resourceApplicationProfile', resourceApplicationProfile);
+      await this.session.replaceMemory('[Auto-loaded resource application profile]', resourceApplicationProfile, 'resource');
+      this.startupNotice('resource profile loaded');
+    }
+
     const skillSnapshot = await this.inferStartupSkills();
     await this.session.updateContext('availableSkillCatalog', skillSnapshot.availableSkills);
     await this.session.updateContext('activeSkills', skillSnapshot.activeSkills);
@@ -3289,43 +3508,7 @@ Light mode enabled for safety. Heavy codebase, graph, and git context are skippe
   }
 
   async inferStartupSkills() {
-    const catalog = await this.getStartupSkillCatalog();
-    const signals = await this.getProjectSignals();
-    const normalizedSignals = new Set(signals.map(value => value.toLowerCase()));
-
-    const hasAny = (...items) => items.some(item => normalizedSignals.has(item));
-    const activeSkills = new Set([
-      'coding',
-      'debug',
-      'refactor',
-      'test',
-    ]);
-
-    if (hasAny('react', 'next', 'nextjs', 'tsx', 'jsx', 'vue', 'svelte', 'vite')) {
-      ['vercel-react-best-practices', 'web-design-guidelines', 'frontend-design', 'design'].forEach(skill => activeSkills.add(skill));
-    }
-
-    if (hasAny('design', 'ui', 'ux', 'css', 'tailwind', 'styled-components', 'scss', 'style', 'component')) {
-      ['web-design-guidelines', 'frontend-design', 'design'].forEach(skill => activeSkills.add(skill));
-    }
-
-    if (hasAny('claude', 'agent', 'mcp', 'plugin', 'skill', 'automation', 'workflow')) {
-      ['skill-creator', 'claude-automation-recommender', 'claude-md-improver', 'agent-development', 'hook-development', 'command-development', 'plugin-dev'].forEach(skill => activeSkills.add(skill));
-    }
-
-    if (hasAny('docs', 'markdown', 'md', 'readme', 'documentation')) {
-      ['claude-md-improver', 'docs', 'writing-rules'].forEach(skill => activeSkills.add(skill));
-    }
-
-    if (hasAny('figma', 'design-md', 'brand', 'brand-guidelines', 'style-guide')) {
-      ['vibefigma', 'web-design-guidelines'].forEach(skill => activeSkills.add(skill));
-    }
-
-    const filtered = [...activeSkills].filter(skill => catalog.has(skill));
-    return {
-      availableSkills: [...catalog],
-      activeSkills: filtered,
-    };
+    return this.contextLoader.inferStartupSkills();
   }
 
   async getStartupSkillCatalog() {
@@ -3378,6 +3561,8 @@ Light mode enabled for safety. Heavy codebase, graph, and git context are skippe
     const [action, ...rest] = args;
     const config = await this.config.load();
     config.mcp = config.mcp || { servers: [] };
+    config.permissions = config.permissions || { allowlist: {} };
+    config.permissions.allowlist = config.permissions.allowlist || { tools: [], commands: [], mcpServers: [] };
 
     switch (action) {
       case undefined:
@@ -3410,10 +3595,33 @@ Light mode enabled for safety. Heavy codebase, graph, and git context are skippe
         }
         config.mcp.servers = (config.mcp.servers || []).filter(server => server.name !== name);
         config.mcp.servers.push({ name, command, args: parsedArgs, enabled: true });
+        config.permissions.allowlist.mcpServers = [...new Set([...(config.permissions.allowlist.mcpServers || []), name])];
         await this.config.save(config);
         console.log(`${colors.green}✓ Added MCP server: ${name}${colors.reset}`);
         break;
       }
+      case 'preset':
+      case 'install': {
+        const [presetName, ...presetOptions] = rest;
+        if (!presetName) {
+          console.log(`${colors.yellow}Usage: /mcp preset <chrome-devtools> [--isolated] [--headless] [--browser-url <url>]${colors.reset}`);
+          break;
+        }
+        try {
+          const server = getMcpPreset(presetName, presetOptions);
+          upsertMcpServer(config, server);
+          await this.config.save(config);
+          console.log(`${colors.green}OK Installed MCP preset: ${server.name}${colors.reset}`);
+          console.log(`  ${colors.dim}${server.command} ${server.args.join(' ')}${colors.reset}`);
+          if (!server.args.includes('--headless')) {
+            console.log(`  ${colors.dim}Visible Chrome mode: enabled. Use --headless only for background browser runs.${colors.reset}`);
+          }
+          console.log(`  ${colors.dim}Inspect tools with: /mcp tools ${server.name}${colors.reset}`);
+        } catch (error) {
+          console.log(`${colors.red}${error.message}${colors.reset}`);
+        }
+        break;
+      }
       case 'remove': {
         const name = rest[0];
         if (!name) {
@@ -3421,6 +3629,7 @@ Light mode enabled for safety. Heavy codebase, graph, and git context are skippe
           break;
         }
         config.mcp.servers = (config.mcp.servers || []).filter(server => server.name !== name);
+        config.permissions.allowlist.mcpServers = (config.permissions.allowlist.mcpServers || []).filter(server => server !== name);
         await this.config.save(config);
         console.log(`${colors.green}✓ Removed MCP server: ${name}${colors.reset}`);
         break;
@@ -3435,8 +3644,37 @@ Light mode enabled for safety. Heavy codebase, graph, and git context are skippe
         console.log(`${colors.green}✓ MCP server allowed: ${name}${colors.reset}`);
         break;
       }
+      case 'tools': {
+        const name = rest[0];
+        if (!name) {
+          console.log(`${colors.yellow}Usage: /mcp tools <name>${colors.reset}`);
+          break;
+        }
+        const server = (config.mcp.servers || []).find(item => item.name === name && item.enabled !== false);
+        if (!server) {
+          console.log(`${colors.red}MCP server not configured or disabled: ${name}${colors.reset}`);
+          break;
+        }
+        const client = new MCPClient(server);
+        try {
+          const tools = await client.listTools();
+          console.log(`${colors.cyan}MCP Tools: ${name}${colors.reset}`);
+          if (!tools.length) {
+            console.log(`  ${colors.dim}No tools reported.${colors.reset}`);
+          }
+          tools.forEach(tool => {
+            const description = tool.description ? ` - ${tool.description}` : '';
+            console.log(`  ${colors.green}${tool.name}${colors.reset}${description}`);
+          });
+        } catch (error) {
+          console.log(`${colors.red}Failed to list MCP tools: ${error.message}${colors.reset}`);
+        } finally {
+          await client.close();
+        }
+        break;
+      }
       default:
-        console.log(`${colors.yellow}Usage: /mcp <list|add|remove|allow>${colors.reset}`);
+        console.log(`${colors.yellow}Usage: /mcp <list|add|preset|install|remove|allow|tools>${colors.reset}`);
     }
   }
 
@@ -3450,6 +3688,9 @@ Light mode enabled for safety. Heavy codebase, graph, and git context are skippe
       case undefined:
       case 'list':
         console.log(`${colors.cyan}Permission Allowlist:${colors.reset}`);
+        console.log(`  Full access: ${config.sandbox?.enabled === false ? 'on' : 'off'}`);
+        console.log(`  Sandbox enabled: ${config.sandbox?.enabled !== false}`);
+        console.log(`  Restrict workspace: ${config.sandbox?.restrictToWorkspace !== false}`);
         console.log(`  Tools: ${(config.permissions.allowlist.tools || []).join(', ') || 'none'}`);
         console.log(`  Commands: ${(config.permissions.allowlist.commands || []).join(', ') || 'none'}`);
         console.log(`  MCP Servers: ${(config.permissions.allowlist.mcpServers || []).join(', ') || 'none'}`);
@@ -3476,8 +3717,25 @@ Light mode enabled for safety. Heavy codebase, graph, and git context are skippe
         console.log(`${colors.green}✓ Updated prompt policy${colors.reset}`);
         break;
       }
+      case 'full': {
+        const value = String(rest[0] || 'on').toLowerCase();
+        const enabled = !(value === 'off' || value === 'false' || value === '0' || value === 'no');
+        if (typeof this.config.setFullAccess === 'function') {
+          await this.config.setFullAccess(enabled);
+        } else {
+          config.sandbox = {
+            ...(config.sandbox || {}),
+            enabled: !enabled,
+            restrictToWorkspace: !enabled,
+          };
+          config.permissions.promptByDefault = !enabled;
+          await this.config.save(config);
+        }
+        console.log(`${colors.green}Full access ${enabled ? 'enabled' : 'disabled'}${colors.reset}`);
+        break;
+      }
       default:
-        console.log(`${colors.yellow}Usage: /permissions <list|allow|prompt>${colors.reset}`);
+        console.log(`${colors.yellow}Usage: /permissions <list|allow|prompt|full>${colors.reset}`);
     }
   }