fix(avatar): ground replies in recognized images

Merge pull request 'fix(avatar): recover BOXIM image replies' (#13 ) from codex/avatar-boxim-vision-hotfix-20260902 into main
Reviewed-on: #13
2026-09-02 14:47:27 +08:00 · 2026-09-02 14:13:19 +08:00 · 2026-09-02 14:12:04 +08:00 · 2026-09-01 15:36:19 +08:00 · 2026-09-01 15:35:41 +08:00 · 2026-09-01 14:04:18 +08:00
145 changed files with 11843 additions and 10642 deletions
@@ -1,10 +0,0 @@
-{
-  "version": 1,
-  "hooks": {
-    "sessionStart": [
-      {
-        "command": "./hooks/run-hook.cmd session-start"
-      }
-    ]
-  }
-}
@@ -1,17 +0,0 @@
-{
-  "hooks": {
-    "SessionStart": [
-      {
-        "matcher": "startup|clear|compact",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd\" session-start",
-            "shell": "bash",
-            "async": false
-          }
-        ]
-      }
-    ]
-  }
-}
@@ -1,46 +0,0 @@
-: << 'CMDBLOCK'
-@echo off
-REM Cross-platform polyglot wrapper for hook scripts.
-REM On Windows: cmd.exe runs the batch portion, which finds and calls bash.
-REM On Unix: the shell interprets this as a script (: is a no-op in bash).
-REM
-REM Hook scripts use extensionless filenames (e.g. "session-start" not
-REM "session-start.sh") so Claude Code's Windows auto-detection -- which
-REM prepends "bash" to any command containing .sh -- doesn't interfere.
-REM
-REM Usage: run-hook.cmd <script-name> [args...]
-
-if "%~1"=="" (
-    echo run-hook.cmd: missing script name >&2
-    exit /b 1
-)
-
-set "HOOK_DIR=%~dp0"
-
-REM Try Git for Windows bash in standard locations
-if exist "C:\Program Files\Git\bin\bash.exe" (
-    "C:\Program Files\Git\bin\bash.exe" "%HOOK_DIR%%~1" %2 %3 %4 %5 %6 %7 %8 %9
-    exit /b %ERRORLEVEL%
-)
-if exist "C:\Program Files (x86)\Git\bin\bash.exe" (
-    "C:\Program Files (x86)\Git\bin\bash.exe" "%HOOK_DIR%%~1" %2 %3 %4 %5 %6 %7 %8 %9
-    exit /b %ERRORLEVEL%
-)
-
-REM Try bash on PATH (e.g. user-installed Git Bash, MSYS2, Cygwin)
-where bash >nul 2>nul
-if %ERRORLEVEL% equ 0 (
-    bash "%HOOK_DIR%%~1" %2 %3 %4 %5 %6 %7 %8 %9
-    exit /b %ERRORLEVEL%
-)
-
-REM No bash found - exit silently rather than error
-REM (plugin still works, just without SessionStart context injection)
-exit /b 0
-CMDBLOCK
-
-# Unix: run the named script directly
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-SCRIPT_NAME="$1"
-shift
-exec bash "${SCRIPT_DIR}/${SCRIPT_NAME}" "$@"
@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart hook for superpowers plugin
-
-set -euo pipefail
-
-# Determine plugin root directory
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-PLUGIN_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-# Read using-superpowers content
-using_superpowers_content=$(cat "${PLUGIN_ROOT}/skills/using-superpowers/SKILL.md" 2>&1 || echo "Error reading using-superpowers skill")
-
-# Escape string for JSON embedding using bash parameter substitution.
-# Each ${s//old/new} is a single C-level pass - orders of magnitude
-# faster than the character-by-character loop this replaces.
-escape_for_json() {
-    local s="$1"
-    s="${s//\\/\\\\}"
-    s="${s//\"/\\\"}"
-    s="${s//$'\n'/\\n}"
-    s="${s//$'\r'/\\r}"
-    s="${s//$'\t'/\\t}"
-    printf '%s' "$s"
-}
-
-using_superpowers_escaped=$(escape_for_json "$using_superpowers_content")
-session_context="<EXTREMELY_IMPORTANT>\nYou have superpowers.\n\n**Below is the full content of your 'superpowers:using-superpowers' skill - your introduction to using skills. For all other skills, use the 'Skill' tool:**\n\n${using_superpowers_escaped}\n</EXTREMELY_IMPORTANT>"
-
-# Output context injection as JSON.
-# Cursor hooks expect additional_context (snake_case).
-# Claude Code hooks expect hookSpecificOutput.additionalContext (nested).
-# Copilot CLI (v1.0.11+) and others expect additionalContext (top-level, SDK standard).
-# Claude Code reads BOTH additional_context and hookSpecificOutput without
-# deduplication, so we must emit only the field the current platform consumes.
-#
-# Uses printf instead of heredoc to work around bash 5.3+ heredoc hang.
-# See: https://github.com/obra/superpowers/issues/571
-if [ -n "${CURSOR_PLUGIN_ROOT:-}" ]; then
-  # Cursor sets CURSOR_PLUGIN_ROOT (may also set CLAUDE_PLUGIN_ROOT)
-  printf '{\n  "additional_context": "%s"\n}\n' "$session_context" | cat
-elif [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -z "${COPILOT_CLI:-}" ]; then
-  # Claude Code sets CLAUDE_PLUGIN_ROOT without COPILOT_CLI
-  printf '{\n  "hookSpecificOutput": {\n    "hookEventName": "SessionStart",\n    "additionalContext": "%s"\n  }\n}\n' "$session_context" | cat
-else
-  # Copilot CLI (sets COPILOT_CLI=1) or unknown platform — SDK standard format
-  printf '{\n  "additionalContext": "%s"\n}\n' "$session_context" | cat
-fi
-
-exit 0
@@ -1,17 +0,0 @@
-{
-  "hooks": {
-    "SessionStart": [
-      {
-        "matcher": "startup|clear|compact",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"${CLAUDE_PLUGIN_ROOT:-.claude/plugins/superpowers}/hooks/run-hook.cmd\" session-start",
-            "shell": "bash",
-            "async": false
-          }
-        ]
-      }
-    ]
-  }
-}
@@ -1,151 +0,0 @@
---
-name: brainstorming
-description: "You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation."
---
-
-# Brainstorming Ideas Into Designs
-
-Help turn ideas into fully formed designs and specs through natural collaborative dialogue.
-
-Start by understanding the current project context, then ask questions one at a time to refine the idea. Once you understand what you're building, present the design and get user approval.
-
-<HARD-GATE>
-Do NOT invoke any implementation skill, write any code, scaffold any project, or take any implementation action until you have presented a design and the user has approved it. This applies to EVERY project regardless of perceived simplicity.
-</HARD-GATE>
-
-## Anti-Pattern: "This Is Too Simple To Need A Design"
-
-Every project goes through this process. A todo list, a single-function utility, a config change — all of them. "Simple" projects are where unexamined assumptions cause the most wasted work. The design can be short (a few sentences for truly simple projects), but you MUST present it and get approval.
-
-## Checklist
-
-You MUST create a task for each of these items and complete them in order:
-
-1. **Explore project context** — check files, docs, recent commits
-2. **Offer the visual companion just-in-time** — NOT upfront. The first time a question would genuinely be clearer shown than described, offer it then (its own message); on approval its browser tab opens for you. If no visual question ever arises, never offer it. See the Visual Companion section below.
-3. **Ask clarifying questions** — one at a time, understand purpose/constraints/success criteria
-4. **Propose 2-3 approaches** — with trade-offs and your recommendation
-5. **Present design** — in sections scaled to their complexity, get user approval after each section
-6. **Write design doc** — save to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md` and commit
-7. **Spec self-review** — quick inline check for placeholders, contradictions, ambiguity, scope (see below)
-8. **User reviews written spec** — ask user to review the spec file before proceeding
-9. **Transition to implementation** — invoke writing-plans skill to create implementation plan
-
-## Process Flow
-
-```dot
-digraph brainstorming {
-    "Explore project context" [shape=box];
-    "Ask clarifying questions" [shape=box];
-    "Propose 2-3 approaches" [shape=box];
-    "Present design sections" [shape=box];
-    "User approves design?" [shape=diamond];
-    "Write design doc" [shape=box];
-    "Spec self-review\n(fix inline)" [shape=box];
-    "User reviews spec?" [shape=diamond];
-    "Invoke writing-plans skill" [shape=doublecircle];
-
-    "Explore project context" -> "Ask clarifying questions";
-    "Ask clarifying questions" -> "Propose 2-3 approaches";
-    "Propose 2-3 approaches" -> "Present design sections";
-    "Present design sections" -> "User approves design?";
-    "User approves design?" -> "Present design sections" [label="no, revise"];
-    "User approves design?" -> "Write design doc" [label="yes"];
-    "Write design doc" -> "Spec self-review\n(fix inline)";
-    "Spec self-review\n(fix inline)" -> "User reviews spec?";
-    "User reviews spec?" -> "Write design doc" [label="changes requested"];
-    "User reviews spec?" -> "Invoke writing-plans skill" [label="approved"];
-}
-```
-
-**The terminal state is invoking writing-plans.** Do NOT invoke frontend-design, mcp-builder, or any other implementation skill. The ONLY skill you invoke after brainstorming is writing-plans.
-
-## The Process
-
-**Understanding the idea:**
-
- Check out the current project state first (files, docs, recent commits)
- Before asking detailed questions, assess scope: if the request describes multiple independent subsystems (e.g., "build a platform with chat, file storage, billing, and analytics"), flag this immediately. Don't spend questions refining details of a project that needs to be decomposed first.
- If the project is too large for a single spec, help the user decompose into sub-projects: what are the independent pieces, how do they relate, what order should they be built? Then brainstorm the first sub-project through the normal design flow. Each sub-project gets its own spec → plan → implementation cycle.
- For appropriately-scoped projects, ask questions one at a time to refine the idea
- Prefer multiple choice questions when possible, but open-ended is fine too
- Only one question per message - if a topic needs more exploration, break it into multiple questions
- Focus on understanding: purpose, constraints, success criteria
-
-**Exploring approaches:**
-
- Propose 2-3 different approaches with trade-offs
- Present options conversationally with your recommendation and reasoning
- Lead with your recommended option and explain why
- YAGNI ruthlessly - remove unnecessary features from every approach and design
-
-**Presenting the design:**
-
- Once you believe you understand what you're building, present the design
- Scale each section to its complexity: a few sentences if straightforward, up to 200-300 words if nuanced
- Ask after each section whether it looks right so far
- Cover: architecture, components, data flow, error handling, testing
- Be ready to go back and clarify if something doesn't make sense
-
-**Design for isolation and clarity:**
-
- Break the system into smaller units that each have one clear purpose, communicate through well-defined interfaces, and can be understood and tested independently
- For each unit, you should be able to answer: what does it do, how do you use it, and what does it depend on?
- Can someone understand what a unit does without reading its internals? Can you change the internals without breaking consumers? If not, the boundaries need work.
- Smaller, well-bounded units are also easier for you to work with - you reason better about code you can hold in context at once, and your edits are more reliable when files are focused. When a file grows large, that's often a signal that it's doing too much.
-
-**Working in existing codebases:**
-
- Explore the current structure before proposing changes. Follow existing patterns.
- Where existing code has problems that affect the work (e.g., a file that's grown too large, unclear boundaries, tangled responsibilities), include targeted improvements as part of the design - the way a good developer improves code they're working in.
- Don't propose unrelated refactoring. Stay focused on what serves the current goal.
-
-## After the Design
-
-**Documentation:**
-
- Write the validated design (spec) to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md`
-  - (User preferences for spec location override this default)
- Use elements-of-style:writing-clearly-and-concisely skill if available
- Commit the design document to git
-
-**Spec Self-Review:**
-After writing the spec document, look at it with fresh eyes:
-
-1. **Placeholder scan:** Any "TBD", "TODO", incomplete sections, or vague requirements? Fix them.
-2. **Internal consistency:** Do any sections contradict each other? Does the architecture match the feature descriptions?
-3. **Scope check:** Is this focused enough for a single implementation plan, or does it need decomposition?
-4. **Ambiguity check:** Could any requirement be interpreted two different ways? If so, pick one and make it explicit.
-
-Fix any issues inline. No need to re-review — just fix and move on.
-
-**User Review Gate:**
-After the spec review loop passes, ask the user to review the written spec before proceeding:
-
-> "Spec written and committed to `<path>`. Please review it and let me know if you want to make any changes before we start writing out the implementation plan."
-
-Wait for the user's response. If they request changes, make them and re-run the spec review loop. Only proceed once the user approves.
-
-**Implementation:**
-
- Invoke the writing-plans skill to create a detailed implementation plan
- Do NOT invoke any other skill. writing-plans is the next step.
-
-## Visual Companion
-
-A browser-based companion for showing mockups, diagrams, and visual options during brainstorming. Available as a tool — not a mode. Accepting the companion means it's available for questions that benefit from visual treatment; it does NOT mean every question goes through the browser.
-
-**Offering the companion (just-in-time):** Do NOT offer it upfront. Wait until a question would genuinely be clearer shown than told — a real mockup / layout / diagram question, not merely a UI *topic*. The first time that happens, offer it then, as its own message:
-> "This next part might be easier if I show you — I can put together mockups, diagrams, and comparisons in a browser tab as we go. It's still new and can be token-intensive. Want me to? I'll open it for you."
-
-**This offer MUST be its own message.** Only the offer — no clarifying question, summary, or other content. Wait for the user's response. If they accept, start the server with `--open` so their browser opens to the first screen automatically. If they decline, continue text-only and don't offer again unless they raise it.
-
-**Per-question decision:** Even after the user accepts, decide FOR EACH QUESTION whether to use the browser or the terminal. The test: **would the user understand this better by seeing it than reading it?**
-
- **Use the browser** for content that IS visual — mockups, wireframes, layout comparisons, architecture diagrams, side-by-side visual designs
- **Use the terminal** for content that is text — requirements questions, conceptual choices, tradeoff lists, A/B/C/D text options, scope decisions
-
-A question about a UI topic is not automatically a visual question. "What does personality mean in this context?" is a conceptual question — use the terminal. "Which wizard layout works better?" is a visual question — use the browser.
-
-If they agree to the companion, read the detailed guide before proceeding:
-`skills/brainstorming/visual-companion.md`
@@ -1,213 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Superpowers Brainstorming</title>
-  <style>
-    /*
-     * BRAINSTORM COMPANION FRAME TEMPLATE
-     *
-     * This template provides a consistent frame with:
-     * - OS-aware light/dark theming
-     * - Header branding and connection status
-     * - Scrollable main content area
-     * - CSS helpers for common UI patterns
-     *
-     * Content is injected via placeholder comment in #frame-content.
-     */
-
-    * { box-sizing: border-box; margin: 0; padding: 0; }
-    html, body { height: 100%; overflow: hidden; }
-
-    /* ===== THEME VARIABLES ===== */
-    :root {
-      --bg-primary: #f5f5f7;
-      --bg-secondary: #ffffff;
-      --bg-tertiary: #e5e5e7;
-      --border: #d1d1d6;
-      --text-primary: #1d1d1f;
-      --text-secondary: #86868b;
-      --text-tertiary: #aeaeb2;
-      --accent: #0071e3;
-      --accent-hover: #0077ed;
-      --success: #34c759;
-      --warning: #ff9f0a;
-      --error: #ff3b30;
-      --selected-bg: #e8f4fd;
-      --selected-border: #0071e3;
-    }
-
-    @media (prefers-color-scheme: dark) {
-      :root {
-        --bg-primary: #1d1d1f;
-        --bg-secondary: #2d2d2f;
-        --bg-tertiary: #3d3d3f;
-        --border: #424245;
-        --text-primary: #f5f5f7;
-        --text-secondary: #86868b;
-        --text-tertiary: #636366;
-        --accent: #0a84ff;
-        --accent-hover: #409cff;
-        --selected-bg: rgba(10, 132, 255, 0.15);
-        --selected-border: #0a84ff;
-      }
-    }
-
-    body {
-      font-family: system-ui, -apple-system, BlinkMacSystemFont, sans-serif;
-      background: var(--bg-primary);
-      color: var(--text-primary);
-      display: flex;
-      flex-direction: column;
-      line-height: 1.5;
-    }
-
-    /* ===== FRAME STRUCTURE ===== */
-    .brand { display: flex; align-items: center; min-width: 0; overflow: hidden; color: var(--text-secondary); line-height: 1; }
-    .brand a { color: inherit; text-decoration: none; display: flex; align-items: center; gap: 0.5rem; min-width: 0; max-width: 100%; line-height: 1; }
-    .brand-copy { display: block; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; line-height: 1; transform: translateY(-1px); }
-    .brand-logo { display: block; height: 1em; width: auto; max-width: 180px; flex-shrink: 0; filter: invert(1); }
-    @media (prefers-color-scheme: dark) {
-      .brand-logo { filter: none; }
-    }
-    .status { font-size: 0.7rem; color: var(--status-color, var(--success)); display: flex; align-items: center; gap: 0.4rem; justify-self: end; white-space: nowrap; line-height: 1; }
-    .status::before { content: ''; width: 6px; height: 6px; background: var(--status-color, var(--success)); border-radius: 50%; }
-
-    .main { flex: 1; overflow-y: auto; }
-    #frame-content { padding: 2rem; min-height: 100%; }
-
-    .header {
-      background: var(--bg-secondary);
-      border-bottom: 1px solid var(--border);
-      padding: 0.5rem 1.5rem;
-      flex-shrink: 0;
-      display: grid;
-      grid-template-columns: minmax(0, 1fr) auto;
-      align-items: center;
-      gap: 1rem;
-      min-height: 42px;
-    }
-    .header .brand { justify-self: start; width: 100%; font-size: 0.75rem; line-height: 1; }
-    .header .status { grid-column: 2; line-height: 1; }
-    .header span {
-      font-size: 0.75rem;
-      color: var(--text-secondary);
-    }
-    .header .selected-text {
-      color: var(--accent);
-      font-weight: 500;
-    }
-
-    /* ===== TYPOGRAPHY ===== */
-    h2 { font-size: 1.5rem; font-weight: 600; margin-bottom: 0.5rem; }
-    h3 { font-size: 1.1rem; font-weight: 600; margin-bottom: 0.25rem; }
-    .subtitle { color: var(--text-secondary); margin-bottom: 1.5rem; }
-    .section { margin-bottom: 2rem; }
-    .label { font-size: 0.7rem; color: var(--text-secondary); text-transform: uppercase; letter-spacing: 0.05em; margin-bottom: 0.5rem; }
-
-    /* ===== OPTIONS (for A/B/C choices) ===== */
-    .options { display: flex; flex-direction: column; gap: 0.75rem; }
-    .option {
-      background: var(--bg-secondary);
-      border: 2px solid var(--border);
-      border-radius: 12px;
-      padding: 1rem 1.25rem;
-      cursor: pointer;
-      transition: all 0.15s ease;
-      display: flex;
-      align-items: flex-start;
-      gap: 1rem;
-    }
-    .option:hover { border-color: var(--accent); }
-    .option.selected { background: var(--selected-bg); border-color: var(--selected-border); }
-    .option .letter {
-      background: var(--bg-tertiary);
-      color: var(--text-secondary);
-      width: 1.75rem; height: 1.75rem;
-      border-radius: 6px;
-      display: flex; align-items: center; justify-content: center;
-      font-weight: 600; font-size: 0.85rem; flex-shrink: 0;
-    }
-    .option.selected .letter { background: var(--accent); color: white; }
-    .option .content { flex: 1; }
-    .option .content h3 { font-size: 0.95rem; margin-bottom: 0.15rem; }
-    .option .content p { color: var(--text-secondary); font-size: 0.85rem; margin: 0; }
-
-    /* ===== CARDS (for showing designs/mockups) ===== */
-    .cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(280px, 1fr)); gap: 1rem; }
-    .card {
-      background: var(--bg-secondary);
-      border: 1px solid var(--border);
-      border-radius: 12px;
-      overflow: hidden;
-      cursor: pointer;
-      transition: all 0.15s ease;
-    }
-    .card:hover { border-color: var(--accent); transform: translateY(-2px); box-shadow: 0 4px 12px rgba(0,0,0,0.1); }
-    .card.selected { border-color: var(--selected-border); border-width: 2px; }
-    .card-image { background: var(--bg-tertiary); aspect-ratio: 16/10; display: flex; align-items: center; justify-content: center; }
-    .card-body { padding: 1rem; }
-    .card-body h3 { margin-bottom: 0.25rem; }
-    .card-body p { color: var(--text-secondary); font-size: 0.85rem; }
-
-    /* ===== MOCKUP CONTAINER ===== */
-    .mockup {
-      background: var(--bg-secondary);
-      border: 1px solid var(--border);
-      border-radius: 12px;
-      overflow: hidden;
-      margin-bottom: 1.5rem;
-    }
-    .mockup-header {
-      background: var(--bg-tertiary);
-      padding: 0.5rem 1rem;
-      font-size: 0.75rem;
-      color: var(--text-secondary);
-      border-bottom: 1px solid var(--border);
-    }
-    .mockup-body { padding: 1.5rem; }
-
-    /* ===== SPLIT VIEW (side-by-side comparison) ===== */
-    .split { display: grid; grid-template-columns: 1fr 1fr; gap: 1.5rem; }
-    @media (max-width: 700px) { .split { grid-template-columns: 1fr; } }
-
-    /* ===== PROS/CONS ===== */
-    .pros-cons { display: grid; grid-template-columns: 1fr 1fr; gap: 1rem; margin: 1rem 0; }
-    .pros, .cons { background: var(--bg-secondary); border-radius: 8px; padding: 1rem; }
-    .pros h4 { color: var(--success); font-size: 0.85rem; margin-bottom: 0.5rem; }
-    .cons h4 { color: var(--error); font-size: 0.85rem; margin-bottom: 0.5rem; }
-    .pros ul, .cons ul { margin-left: 1.25rem; font-size: 0.85rem; color: var(--text-secondary); }
-    .pros li, .cons li { margin-bottom: 0.25rem; }
-
-    /* ===== PLACEHOLDER (for mockup areas) ===== */
-    .placeholder {
-      background: var(--bg-tertiary);
-      border: 2px dashed var(--border);
-      border-radius: 8px;
-      padding: 2rem;
-      text-align: center;
-      color: var(--text-tertiary);
-    }
-
-    /* ===== INLINE MOCKUP ELEMENTS ===== */
-    .mock-nav { background: var(--accent); color: white; padding: 0.75rem 1rem; display: flex; gap: 1.5rem; font-size: 0.9rem; }
-    .mock-sidebar { background: var(--bg-tertiary); padding: 1rem; min-width: 180px; }
-    .mock-content { padding: 1.5rem; flex: 1; }
-    .mock-button { background: var(--accent); color: white; border: none; padding: 0.5rem 1rem; border-radius: 6px; font-size: 0.85rem; }
-    .mock-input { background: var(--bg-primary); border: 1px solid var(--border); border-radius: 6px; padding: 0.5rem; width: 100%; }
-  </style>
-</head>
-<body>
-  <div class="header">
-    <!-- BRANDING -->
-    <div class="status">Connecting…</div>
-  </div>
-
-  <div class="main">
-    <div id="frame-content">
-      <!-- CONTENT -->
-    </div>
-  </div>
-
-</body>
-</html>
@@ -1,167 +0,0 @@
-(function() {
-  const MIN_RECONNECT_MS = 500;
-  const MAX_RECONNECT_MS = 30000;
-  const TOMBSTONE_AFTER_MS = 15000; // show the "paused" overlay after this long disconnected
-
-  // Pure: next backoff delay (doubles, capped). Exported for unit tests.
-  function nextReconnectDelay(current, max) {
-    return Math.min(current * 2, max);
-  }
-  if (typeof module !== 'undefined' && module.exports) {
-    module.exports = { nextReconnectDelay, MIN_RECONNECT_MS, MAX_RECONNECT_MS, TOMBSTONE_AFTER_MS };
-  }
-
-  // Everything below is browser-only; bail out when loaded in Node (tests).
-  if (typeof window === 'undefined') return;
-
-  let ws = null;
-  let eventQueue = [];
-  let reconnectDelay = MIN_RECONNECT_MS;
-  let reconnectTimer = null;
-  let disconnectedSince = null;
-  let everConnected = false;
-  let tombstoneShown = false;
-
-  function sessionKey() {
-    try {
-      return window.sessionStorage && window.sessionStorage.getItem('brainstorm-session-key');
-    } catch (e) {}
-    return null;
-  }
-
-  function websocketUrl() {
-    const key = sessionKey();
-    return 'ws://' + window.location.host + (key ? '/?key=' + encodeURIComponent(key) : '');
-  }
-
-  function reloadAfterRecovery() {
-    const key = sessionKey();
-    if (key) {
-      window.location.replace('/?key=' + encodeURIComponent(key));
-    } else {
-      window.location.reload();
-    }
-  }
-
-  // Reflect connection state in the frame's status pill (absent on full-doc screens).
-  function setStatus(state) {
-    const el = document.querySelector('.status');
-    if (!el) return;
-    const map = {
-      connecting:   ['Connecting…',   'var(--text-tertiary)'],
-      connected:    ['Connected',     'var(--success)'],
-      reconnecting: ['Reconnecting…', 'var(--warning)'],
-      disconnected: ['Disconnected',  'var(--error)']
-    };
-    const [text, color] = map[state] || map.disconnected;
-    el.textContent = text;
-    el.style.setProperty('--status-color', color);
-  }
-
-  // Self-styled so it works on framed and full-document screens alike.
-  function showTombstone() {
-    if (tombstoneShown) return;
-    tombstoneShown = true;
-    const el = document.createElement('div');
-    el.id = 'bs-tombstone';
-    el.style.cssText = 'position:fixed;inset:0;z-index:99999;display:flex;' +
-      'align-items:center;justify-content:center;padding:2rem;text-align:center;' +
-      'background:rgba(20,20,22,0.92);color:#f5f5f7;font-family:system-ui,sans-serif';
-    el.innerHTML = '<div style="max-width:480px">' +
-      '<h2 style="margin:0 0 .5rem;font-weight:600">Companion paused</h2>' +
-      '<p style="margin:0;opacity:.85">This brainstorm companion has stopped. ' +
-      'Ask your coding agent to bring it back — this page reconnects automatically.</p></div>';
-    if (document.body) document.body.appendChild(el);
-  }
-
-  function connect() {
-    if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
-    setStatus(everConnected ? 'reconnecting' : 'connecting');
-    ws = new WebSocket(websocketUrl());
-
-    ws.onopen = () => {
-      const recovered = tombstoneShown;
-      everConnected = true;
-      disconnectedSince = null;
-      reconnectDelay = MIN_RECONNECT_MS;
-      tombstoneShown = false;
-      setStatus('connected');
-      eventQueue.forEach(e => ws.send(JSON.stringify(e)));
-      eventQueue = [];
-      // Recovered from a tombstoned outage (e.g. the server restarted on the same
-      // port) — reload through the keyed bootstrap when possible so the cookie is
-      // refreshed before the visible URL returns to bare /.
-      if (recovered) reloadAfterRecovery();
-    };
-
-    ws.onmessage = (msg) => {
-      let data;
-      try { data = JSON.parse(msg.data); } catch (e) { return; }
-      if (data.type === 'reload') window.location.reload();
-    };
-
-    ws.onclose = () => {
-      ws = null;
-      if (disconnectedSince === null) disconnectedSince = Date.now();
-      if (Date.now() - disconnectedSince >= TOMBSTONE_AFTER_MS) {
-        setStatus('disconnected');
-        showTombstone();
-      } else {
-        setStatus('reconnecting');
-      }
-      reconnectTimer = setTimeout(connect, reconnectDelay);
-      reconnectDelay = nextReconnectDelay(reconnectDelay, MAX_RECONNECT_MS);
-    };
-
-    // Let onclose own reconnection so we don't schedule it twice.
-    ws.onerror = () => { try { ws.close(); } catch (e) {} };
-  }
-
-  function sendEvent(event) {
-    event.timestamp = Date.now();
-    if (ws && ws.readyState === WebSocket.OPEN) {
-      ws.send(JSON.stringify(event));
-    } else {
-      eventQueue.push(event);
-    }
-  }
-
-  // Capture clicks on choice elements
-  document.addEventListener('click', (e) => {
-    const target = e.target.closest('[data-choice]');
-    if (!target) return;
-
-    sendEvent({
-      type: 'click',
-      text: target.textContent.trim(),
-      choice: target.dataset.choice,
-      id: target.id || null
-    });
-
-  });
-
-  // Frame UI: selection tracking
-  window.selectedChoice = null;
-
-  window.toggleSelect = function(el) {
-    const container = el.closest('.options') || el.closest('.cards');
-    const multi = container && container.dataset.multiselect !== undefined;
-    if (container && !multi) {
-      container.querySelectorAll('.option, .card').forEach(o => o.classList.remove('selected'));
-    }
-    if (multi) {
-      el.classList.toggle('selected');
-    } else {
-      el.classList.add('selected');
-    }
-    window.selectedChoice = el.dataset.choice;
-  };
-
-  // Expose API for explicit use
-  window.brainstorm = {
-    send: sendEvent,
-    choice: (value, metadata = {}) => sendEvent({ type: 'choice', value, ...metadata })
-  };
-
-  connect();
-})();
@@ -1,723 +0,0 @@
-const crypto = require('crypto');
-const http = require('http');
-const fs = require('fs');
-const path = require('path');
-
-// ========== WebSocket Protocol (RFC 6455) ==========
-
-const OPCODES = { TEXT: 0x01, CLOSE: 0x08, PING: 0x09, PONG: 0x0A };
-const WS_MAGIC = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
-const MAX_FRAME_PAYLOAD_BYTES = 10 * 1024 * 1024;
-
-function computeAcceptKey(clientKey) {
-  return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');
-}
-
-function encodeFrame(opcode, payload) {
-  const fin = 0x80;
-  const len = payload.length;
-  let header;
-
-  if (len < 126) {
-    header = Buffer.alloc(2);
-    header[0] = fin | opcode;
-    header[1] = len;
-  } else if (len < 65536) {
-    header = Buffer.alloc(4);
-    header[0] = fin | opcode;
-    header[1] = 126;
-    header.writeUInt16BE(len, 2);
-  } else {
-    header = Buffer.alloc(10);
-    header[0] = fin | opcode;
-    header[1] = 127;
-    header.writeBigUInt64BE(BigInt(len), 2);
-  }
-
-  return Buffer.concat([header, payload]);
-}
-
-function decodeFrame(buffer) {
-  if (buffer.length < 2) return null;
-
-  const secondByte = buffer[1];
-  const opcode = buffer[0] & 0x0F;
-  const masked = (secondByte & 0x80) !== 0;
-  let payloadLen = secondByte & 0x7F;
-  let offset = 2;
-
-  if (!masked) throw new Error('Client frames must be masked');
-
-  if (payloadLen === 126) {
-    if (buffer.length < 4) return null;
-    payloadLen = buffer.readUInt16BE(2);
-    offset = 4;
-  } else if (payloadLen === 127) {
-    if (buffer.length < 10) return null;
-    const extendedLen = buffer.readBigUInt64BE(2);
-    if (extendedLen > BigInt(MAX_FRAME_PAYLOAD_BYTES)) {
-      throw new Error('WebSocket frame payload exceeds maximum allowed size');
-    }
-    payloadLen = Number(extendedLen);
-    offset = 10;
-  }
-
-  if (payloadLen > MAX_FRAME_PAYLOAD_BYTES) {
-    throw new Error('WebSocket frame payload exceeds maximum allowed size');
-  }
-
-  const maskOffset = offset;
-  const dataOffset = offset + 4;
-  const totalLen = dataOffset + payloadLen;
-  if (buffer.length < totalLen) return null;
-
-  const mask = buffer.slice(maskOffset, dataOffset);
-  const data = Buffer.alloc(payloadLen);
-  for (let i = 0; i < payloadLen; i++) {
-    data[i] = buffer[dataOffset + i] ^ mask[i % 4];
-  }
-
-  return { opcode, payload: data, bytesConsumed: totalLen };
-}
-
-// ========== Configuration ==========
-
-const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null;
-const randomPort = () => 49152 + Math.floor(Math.random() * 16383);
-// Prefer an explicit port, else the port this session last bound (so a restart
-// reuses it and an already-open browser tab reconnects), else a random high port.
-function preferredPort() {
-  if (process.env.BRAINSTORM_PORT) return Number(process.env.BRAINSTORM_PORT);
-  if (PORT_FILE) {
-    try {
-      const p = Number(fs.readFileSync(PORT_FILE, 'utf-8').trim());
-      if (Number.isInteger(p) && p > 1023 && p < 65536) return p;
-    } catch (e) { /* no prior port recorded */ }
-  }
-  return randomPort();
-}
-let PORT = preferredPort();
-const HOST = process.env.BRAINSTORM_HOST || '127.0.0.1';
-const URL_HOST = process.env.BRAINSTORM_URL_HOST || (HOST === '127.0.0.1' ? 'localhost' : HOST);
-const SESSION_DIR = process.env.BRAINSTORM_DIR || '/tmp/brainstorm';
-const CONTENT_DIR = path.join(SESSION_DIR, 'content');
-const STATE_DIR = path.join(SESSION_DIR, 'state');
-const SUPERPOWERS_VERSION = readSuperpowersVersion();
-const SUPERPOWERS_BRAND_IMAGE_URL = 'https://primeradiant.com/brand/superpowers-visual-brainstorming-logo.png';
-const TELEMETRY_DISABLE_ENV_VARS = [
-  'SUPERPOWERS_DISABLE_TELEMETRY',
-  'DISABLE_TELEMETRY',
-  'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC'
-];
-const SUPERPOWERS_TELEMETRY_DISABLED = TELEMETRY_DISABLE_ENV_VARS.some(name => isTruthyEnv(process.env[name]));
-let ownerPid = process.env.BRAINSTORM_OWNER_PID ? Number(process.env.BRAINSTORM_OWNER_PID) : null;
-
-// Per-session secret key. The companion is reachable by any local browser tab
-// and, when bound to a non-loopback host, by any host that can route to it.
-// The key authenticates the real client uniformly across loopback, tunnel, and
-// remote binds — and defeats DNS rebinding — where a Host/Origin allowlist
-// cannot. It rides the served URL as ?key= and is mirrored into a cookie on
-// first load so same-origin subresources and the WebSocket carry it for free.
-// Persisted alongside the port (BRAINSTORM_TOKEN_FILE) so a restart keeps the
-// same key and an already-open tab's cookie still validates.
-const TOKEN_FILE = process.env.BRAINSTORM_TOKEN_FILE || null;
-function generateToken() {
-  return crypto.randomBytes(32).toString('hex');
-}
-
-function chmodOwnerOnly(file) {
-  try { fs.chmodSync(file, 0o600); } catch (e) { /* best effort */ }
-}
-
-function initialToken() {
-  if (process.env.BRAINSTORM_TOKEN) {
-    return { value: process.env.BRAINSTORM_TOKEN, source: 'env' };
-  }
-  if (TOKEN_FILE) {
-    try {
-      const t = fs.readFileSync(TOKEN_FILE, 'utf-8').trim();
-      if (/^[0-9a-f]{32,}$/i.test(t)) {
-        chmodOwnerOnly(TOKEN_FILE);
-        return { value: t, source: 'file' };
-      }
-    } catch (e) { /* no prior token recorded */ }
-  }
-  return { value: generateToken(), source: 'generated' };
-}
-
-const tokenInfo = initialToken();
-let TOKEN = tokenInfo.value;
-let tokenSource = tokenInfo.source;
-let COOKIE_NAME = 'brainstorm-key-' + PORT; // refined to the actual bound port in onListen
-
-const MIME_TYPES = {
-  '.html': 'text/html', '.css': 'text/css', '.js': 'application/javascript',
-  '.json': 'application/json', '.png': 'image/png', '.jpg': 'image/jpeg',
-  '.jpeg': 'image/jpeg', '.gif': 'image/gif', '.svg': 'image/svg+xml'
-};
-
-// ========== Templates and Constants ==========
-
-function waitingPage() {
-  return renderBranding(`<!DOCTYPE html>
-<html>
-<head><meta charset="utf-8"><title>Brainstorm Companion</title>
-<style>
-body { font-family: system-ui, sans-serif; padding: 2rem; max-width: 800px; margin: 0 auto; }
-h1 { color: #333; } p { color: #666; }
-.brand { display: flex; align-items: center; min-width: 0; overflow: hidden; margin-bottom: 1.5rem; color: #666; font-size: 0.9rem; line-height: 1; }
-.brand a { color: inherit; text-decoration: none; display: flex; align-items: center; gap: 0.5rem; min-width: 0; max-width: 100%; line-height: 1; }
-.brand-copy { display: block; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; line-height: 1; transform: translateY(-1px); }
-.brand-logo { display: block; height: 1em; width: auto; max-width: 180px; filter: invert(1); }
-</style>
-</head>
-<body><!-- BRANDING --><h1>Brainstorm Companion</h1>
-<p>Waiting for the agent to push a screen...</p></body></html>`);
-}
-
-const FORBIDDEN_PAGE = `<!DOCTYPE html>
-<html>
-<head><meta charset="utf-8"><title>Session key required</title>
-<style>body { font-family: system-ui, sans-serif; padding: 2rem; max-width: 800px; margin: 0 auto; }
-h1 { color: #333; } p { color: #666; } code { background: #f0f0f0; padding: 0.1em 0.3em; border-radius: 4px; }</style>
-</head>
-<body><h1>Session key required</h1>
-<p>This page needs the full URL your coding agent gave you, including the
-<code>?key=&hellip;</code> part. Copy the complete URL and open it again.</p></body></html>`;
-
-function bootstrapPage(key) {
-  const jsonKey = JSON.stringify(String(key));
-  return `<!DOCTYPE html>
-<html>
-<head><meta charset="utf-8"><title>Opening Brainstorm Companion</title></head>
-<body>
-<script>
-try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {}
-location.replace('/');
-</script>
-</body>
-</html>`;
-}
-
-const frameTemplate = fs.readFileSync(path.join(__dirname, 'frame-template.html'), 'utf-8');
-const helperScript = fs.readFileSync(path.join(__dirname, 'helper.js'), 'utf-8');
-const helperInjection = '<script>\n' + helperScript + '\n</script>';
-
-// ========== Helper Functions ==========
-
-function readSuperpowersVersion() {
-  const root = path.join(__dirname, '../../..');
-  const manifests = [
-    path.join(root, 'package.json'),
-    path.join(root, '.codex-plugin/plugin.json')
-  ];
-
-  for (const manifest of manifests) {
-    try {
-      const data = JSON.parse(fs.readFileSync(manifest, 'utf-8'));
-      if (data.version) return String(data.version);
-    } catch (e) {
-      // Packaged Codex plugins omit package.json; try the next manifest.
-    }
-  }
-
-  return 'unknown';
-}
-
-function isTruthyEnv(value) {
-  if (!value) return false;
-  const normalized = String(value).trim().toLowerCase();
-  if (!normalized) return false;
-  return !['0', 'false', 'no', 'off'].includes(normalized);
-}
-
-function escapeHtmlText(value) {
-  return String(value)
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;');
-}
-
-function brandMarkup() {
-  const version = escapeHtmlText(SUPERPOWERS_VERSION);
-  const text = SUPERPOWERS_TELEMETRY_DISABLED
-    ? 'Prime Radiant Superpowers v' + version
-    : 'Superpowers v' + version;
-  const logo = SUPERPOWERS_TELEMETRY_DISABLED
-    ? ''
-    : '<img class="brand-logo" src="' + SUPERPOWERS_BRAND_IMAGE_URL + '?v=' + encodeURIComponent(SUPERPOWERS_VERSION) + '" alt="Prime Radiant" referrerpolicy="no-referrer" decoding="async">';
-
-  return '<div class="brand"><a href="https://github.com/obra/superpowers">' + logo + '<span class="brand-copy">' + text + '</span></a></div>';
-}
-
-function renderBranding(html) {
-  return html.split('<!-- BRANDING -->').join(brandMarkup());
-}
-
-function isFullDocument(html) {
-  const trimmed = html.trimStart().toLowerCase();
-  return trimmed.startsWith('<!doctype') || trimmed.startsWith('<html');
-}
-
-function wrapInFrame(content) {
-  return renderBranding(frameTemplate).replace('<!-- CONTENT -->', content);
-}
-
-function getNewestScreen() {
-  const files = fs.readdirSync(CONTENT_DIR)
-    .filter(f => !f.startsWith('.') && f.endsWith('.html'))
-    .map(f => {
-      const fp = path.join(CONTENT_DIR, f);
-      if (!isRegularFileInsideContentDir(fp)) return null;
-      return { path: fp, mtime: fs.statSync(fp).mtime.getTime() };
-    })
-    .filter(Boolean)
-    .sort((a, b) => b.mtime - a.mtime);
-  return files.length > 0 ? files[0].path : null;
-}
-
-function urlHostForHttp(host) {
-  const h = String(host);
-  if (h.startsWith('[') && h.endsWith(']')) return h;
-  return h.includes(':') ? '[' + h + ']' : h;
-}
-
-function companionUrl() {
-  return 'http://' + urlHostForHttp(URL_HOST) + ':' + PORT + '/?key=' + TOKEN;
-}
-
-function browserLauncherForPlatform(url, {
-  platform = process.platform,
-  osRelease = require('os').release(),
-  env = process.env
-} = {}) {
-  const isWSL = platform === 'linux' && /microsoft/i.test(osRelease);
-  if (platform === 'darwin') return { bin: 'open', args: [url] };
-  if (platform === 'win32' || isWSL) {
-    return { bin: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', url] };
-  }
-  if (env.DISPLAY || env.WAYLAND_DISPLAY) return { bin: 'xdg-open', args: [url] };
-  return null;
-}
-
-function isRegularFileInsideContentDir(filePath) {
-  let stat, realContentDir, realFilePath;
-  try {
-    stat = fs.lstatSync(filePath);
-    if (stat.isSymbolicLink()) return false;
-    if (!stat.isFile()) return false;
-    if (stat.nlink !== 1) return false;
-    realContentDir = fs.realpathSync(CONTENT_DIR);
-    realFilePath = fs.realpathSync(filePath);
-  } catch (e) {
-    return false;
-  }
-  return realFilePath.startsWith(realContentDir + path.sep);
-}
-
-// ========== Authentication ==========
-
-function timingSafeEqualStr(a, b) {
-  const ab = Buffer.from(String(a));
-  const bb = Buffer.from(String(b));
-  if (ab.length !== bb.length) return false;
-  return crypto.timingSafeEqual(ab, bb);
-}
-
-function parseCookies(header) {
-  const out = {};
-  if (!header) return out;
-  for (const part of header.split(';')) {
-    const eq = part.indexOf('=');
-    if (eq < 0) continue;
-    out[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();
-  }
-  return out;
-}
-
-// A request is authorized if it carries the session key as ?key= or as the
-// session cookie. Both are compared in constant time.
-function isAuthorized(req) {
-  const q = req.url.indexOf('?');
-  if (q >= 0) {
-    const params = new URLSearchParams(req.url.slice(q + 1));
-    if (params.has('key')) {
-      const key = params.get('key');
-      return Boolean(key && timingSafeEqualStr(key, TOKEN));
-    }
-  }
-  const cookie = parseCookies(req.headers['cookie'])[COOKIE_NAME];
-  if (cookie && timingSafeEqualStr(cookie, TOKEN)) return true;
-  return false;
-}
-
-function pathnameOf(url) {
-  const q = url.indexOf('?');
-  return q >= 0 ? url.slice(0, q) : url;
-}
-
-function queryKey(url) {
-  const q = url.indexOf('?');
-  if (q < 0) return null;
-  return new URLSearchParams(url.slice(q + 1)).get('key');
-}
-
-function securityHeaders(headers = {}) {
-  return {
-    'Referrer-Policy': 'no-referrer',
-    'Cache-Control': 'no-store',
-    'X-Frame-Options': 'DENY',
-    'Content-Security-Policy': "frame-ancestors 'none'",
-    'Cross-Origin-Resource-Policy': 'same-origin',
-    ...headers
-  };
-}
-
-function isAllowedWebSocketOrigin(req) {
-  const origin = req.headers.origin;
-  if (!origin) return true;
-  const host = req.headers.host;
-  if (!host) return false;
-  return origin === 'http://' + host;
-}
-
-// ========== HTTP Request Handler ==========
-
-function handleRequest(req, res) {
-  if (!isAuthorized(req)) {
-    res.writeHead(403, securityHeaders({ 'Content-Type': 'text/html; charset=utf-8' }));
-    res.end(FORBIDDEN_PAGE);
-    return;
-  }
-  touchActivity(); // only authorized requests count as activity
-
-  // Mirror the key into a cookie so same-origin subresources (/files/*) can
-  // authenticate after bootstrap. HttpOnly keeps it away from page scripts; the
-  // WebSocket Origin check below is what blocks cross-origin localhost injection.
-  res.setHeader('Set-Cookie',
-    COOKIE_NAME + '=' + TOKEN + '; HttpOnly; SameSite=Strict; Path=/');
-
-  const pathname = pathnameOf(req.url);
-  const keyFromQuery = queryKey(req.url);
-  if (req.method === 'GET' && pathname === '/' && keyFromQuery && timingSafeEqualStr(keyFromQuery, TOKEN)) {
-    res.writeHead(200, securityHeaders({ 'Content-Type': 'text/html; charset=utf-8' }));
-    res.end(bootstrapPage(keyFromQuery));
-  } else if (req.method === 'GET' && pathname === '/') {
-    const screenFile = getNewestScreen();
-    let html = screenFile
-      ? (raw => isFullDocument(raw) ? raw : wrapInFrame(raw))(fs.readFileSync(screenFile, 'utf-8'))
-      : waitingPage();
-
-    if (html.includes('</body>')) {
-      html = html.replace('</body>', helperInjection + '\n</body>');
-    } else {
-      html += helperInjection;
-    }
-
-    res.writeHead(200, securityHeaders({ 'Content-Type': 'text/html; charset=utf-8' }));
-    res.end(html);
-  } else if (req.method === 'GET' && pathname.startsWith('/files/')) {
-    const fileName = path.basename(pathname.slice(7));
-    const filePath = path.join(CONTENT_DIR, fileName);
-    // Reject empty/dotfile names and anything that isn't a regular file —
-    // `/files/` would otherwise resolve to CONTENT_DIR and crash readFileSync (EISDIR).
-    if (!fileName || fileName.startsWith('.') || !isRegularFileInsideContentDir(filePath)) {
-      res.writeHead(404, securityHeaders());
-      res.end('Not found');
-      return;
-    }
-    const ext = path.extname(filePath).toLowerCase();
-    const contentType = MIME_TYPES[ext] || 'application/octet-stream';
-    res.writeHead(200, securityHeaders({ 'Content-Type': contentType }));
-    res.end(fs.readFileSync(filePath));
-  } else {
-    res.writeHead(404, securityHeaders());
-    res.end('Not found');
-  }
-}
-
-// ========== WebSocket Connection Handling ==========
-
-const clients = new Set();
-
-function handleUpgrade(req, socket) {
-  if (!isAuthorized(req) || !isAllowedWebSocketOrigin(req)) { socket.destroy(); return; }
-
-  const key = req.headers['sec-websocket-key'];
-  if (!key) { socket.destroy(); return; }
-
-  const accept = computeAcceptKey(key);
-  socket.write(
-    'HTTP/1.1 101 Switching Protocols\r\n' +
-    'Upgrade: websocket\r\n' +
-    'Connection: Upgrade\r\n' +
-    'Sec-WebSocket-Accept: ' + accept + '\r\n\r\n'
-  );
-
-  let buffer = Buffer.alloc(0);
-  clients.add(socket);
-
-  socket.on('data', (chunk) => {
-    buffer = Buffer.concat([buffer, chunk]);
-    while (buffer.length > 0) {
-      let result;
-      try {
-        result = decodeFrame(buffer);
-      } catch (e) {
-        socket.end(encodeFrame(OPCODES.CLOSE, Buffer.alloc(0)));
-        clients.delete(socket);
-        return;
-      }
-      if (!result) break;
-      buffer = buffer.slice(result.bytesConsumed);
-
-      switch (result.opcode) {
-        case OPCODES.TEXT:
-          handleMessage(result.payload.toString());
-          break;
-        case OPCODES.CLOSE:
-          socket.end(encodeFrame(OPCODES.CLOSE, Buffer.alloc(0)));
-          clients.delete(socket);
-          return;
-        case OPCODES.PING:
-          socket.write(encodeFrame(OPCODES.PONG, result.payload));
-          break;
-        case OPCODES.PONG:
-          break;
-        default: {
-          const closeBuf = Buffer.alloc(2);
-          closeBuf.writeUInt16BE(1003);
-          socket.end(encodeFrame(OPCODES.CLOSE, closeBuf));
-          clients.delete(socket);
-          return;
-        }
-      }
-    }
-  });
-
-  socket.on('close', () => clients.delete(socket));
-  socket.on('error', () => clients.delete(socket));
-}
-
-function handleMessage(text) {
-  let event;
-  try {
-    event = JSON.parse(text);
-  } catch (e) {
-    console.error('Failed to parse WebSocket message:', e.message);
-    return;
-  }
-  touchActivity();
-  console.log(JSON.stringify({ source: 'user-event', ...event }));
-  if (event && event.choice) {
-    const eventsFile = path.join(STATE_DIR, 'events');
-    fs.appendFileSync(eventsFile, JSON.stringify(event) + '\n');
-  }
-}
-
-function broadcast(msg) {
-  const frame = encodeFrame(OPCODES.TEXT, Buffer.from(JSON.stringify(msg)));
-  for (const socket of clients) {
-    try { socket.write(frame); } catch (e) { clients.delete(socket); }
-  }
-}
-
-// Best-effort: open the user's browser the first time a screen is actually ready
-// to show. Skips when disabled, on a non-loopback (remote) bind, or when a
-// browser is already connected. Override the launcher with BRAINSTORM_OPEN_CMD.
-let browserOpened = false;
-function maybeOpenBrowser() {
-  if (browserOpened) return;
-  browserOpened = true;
-  if (!process.env.BRAINSTORM_OPEN) return; // opt-in: only after the user approves the companion
-  if (HOST !== '127.0.0.1' && HOST !== 'localhost') return;
-  if (clients.size > 0) return; // the user already opened it
-  const url = companionUrl(); // must carry the key or the gate 403s it
-  const cp = require('child_process');
-  // Operator-provided launcher: run as given (this env var is trusted operator input).
-  if (process.env.BRAINSTORM_OPEN_CMD) {
-    try { cp.exec(process.env.BRAINSTORM_OPEN_CMD + ' ' + JSON.stringify(url), () => {}); } catch (e) { /* best effort */ }
-    return;
-  }
-  // Platform launchers: pass the URL as an argv element via execFile (no shell),
-  // so a url-host containing shell metacharacters can't inject a command.
-  const launcher = browserLauncherForPlatform(url);
-  if (!launcher) return; // headless: nothing to open
-  try { cp.execFile(launcher.bin, launcher.args, () => {}); } catch (e) { /* best effort */ }
-}
-
-// ========== Activity Tracking ==========
-
-// Idle timeout: shut down after this long with no activity. Default 4 hours;
-// override with BRAINSTORM_IDLE_TIMEOUT_MS (start-server.sh: --idle-timeout-minutes).
-const IDLE_TIMEOUT_MS = (() => {
-  const ms = Number(process.env.BRAINSTORM_IDLE_TIMEOUT_MS);
-  return Number.isFinite(ms) && ms > 0 ? ms : 4 * 60 * 60 * 1000;
-})();
-// How often the watchdog checks for owner-death / idleness. Configurable mainly
-// so tests can run fast; production default is 60s.
-const LIFECYCLE_CHECK_MS = (() => {
-  const ms = Number(process.env.BRAINSTORM_LIFECYCLE_CHECK_MS);
-  return Number.isFinite(ms) && ms > 0 ? ms : 60 * 1000;
-})();
-let lastActivity = Date.now();
-
-function touchActivity() {
-  lastActivity = Date.now();
-}
-
-// ========== File Watching ==========
-
-const debounceTimers = new Map();
-
-// ========== Server Startup ==========
-
-function startServer() {
-  if (!fs.existsSync(CONTENT_DIR)) fs.mkdirSync(CONTENT_DIR, { recursive: true });
-  if (!fs.existsSync(STATE_DIR)) fs.mkdirSync(STATE_DIR, { recursive: true });
-
-  // Track known files to distinguish new screens from updates.
-  // macOS fs.watch reports 'rename' for both new files and overwrites,
-  // so we can't rely on eventType alone.
-  const knownFiles = new Set(
-    fs.readdirSync(CONTENT_DIR).filter(f => !f.startsWith('.') && f.endsWith('.html'))
-  );
-
-  const server = http.createServer(handleRequest);
-  server.on('upgrade', handleUpgrade);
-
-  const watcher = fs.watch(CONTENT_DIR, (eventType, filename) => {
-    if (!filename || filename.startsWith('.') || !filename.endsWith('.html')) return;
-
-    if (debounceTimers.has(filename)) clearTimeout(debounceTimers.get(filename));
-    debounceTimers.set(filename, setTimeout(() => {
-      debounceTimers.delete(filename);
-      const filePath = path.join(CONTENT_DIR, filename);
-
-      if (!fs.existsSync(filePath)) return; // file was deleted
-      touchActivity();
-
-      if (!knownFiles.has(filename)) {
-        knownFiles.add(filename);
-        const eventsFile = path.join(STATE_DIR, 'events');
-        if (fs.existsSync(eventsFile)) fs.unlinkSync(eventsFile);
-        console.log(JSON.stringify({ type: 'screen-added', file: filePath }));
-        maybeOpenBrowser();
-      } else {
-        console.log(JSON.stringify({ type: 'screen-updated', file: filePath }));
-      }
-
-      broadcast({ type: 'reload' });
-    }, 100));
-  });
-  watcher.on('error', (err) => console.error('fs.watch error:', err.message));
-
-  function shutdown(reason) {
-    console.log(JSON.stringify({ type: 'server-stopped', reason }));
-    const infoFile = path.join(STATE_DIR, 'server-info');
-    if (fs.existsSync(infoFile)) fs.unlinkSync(infoFile);
-    fs.writeFileSync(
-      path.join(STATE_DIR, 'server-stopped'),
-      JSON.stringify({ reason, timestamp: Date.now() }) + '\n'
-    );
-    watcher.close();
-    clearInterval(lifecycleCheck);
-    // Close any upgraded WebSocket sockets so server.close() can complete and
-    // the process actually exits instead of lingering on an open connection.
-    for (const socket of clients) {
-      try { socket.destroy(); } catch (e) { /* already gone */ }
-    }
-    server.close(() => process.exit(0));
-  }
-
-  function ownerAlive() {
-    if (!ownerPid) return true;
-    try { process.kill(ownerPid, 0); return true; } catch (e) { return e.code === 'EPERM'; }
-  }
-
-  // Periodically exit if the owner process died or we've been idle too long.
-  const lifecycleCheck = setInterval(() => {
-    if (!ownerAlive()) shutdown('owner process exited');
-    else if (Date.now() - lastActivity > IDLE_TIMEOUT_MS) shutdown('idle timeout');
-  }, LIFECYCLE_CHECK_MS);
-  lifecycleCheck.unref();
-
-  // Validate owner PID at startup. If it's already dead, the PID resolution
-  // was wrong (common on WSL, Tailscale SSH, and cross-user scenarios).
-  // Disable monitoring and rely on the idle timeout instead.
-  if (ownerPid) {
-    try { process.kill(ownerPid, 0); }
-    catch (e) {
-      if (e.code !== 'EPERM') {
-        console.log(JSON.stringify({ type: 'owner-pid-invalid', pid: ownerPid, reason: 'dead at startup' }));
-        ownerPid = null;
-      }
-    }
-  }
-
-  // If the preferred port is already taken (e.g. a previous server is still
-  // alive), fall back to a random port once instead of failing.
-  let triedFallback = false;
-
-  function onListen() {
-    // Cookie name keys on the ACTUAL bound port (may differ from the preferred
-    // one after an EADDRINUSE fallback) so it can't collide with another server's
-    // cookie in the shared localhost jar.
-    COOKIE_NAME = 'brainstorm-key-' + PORT;
-    // Record the bound port AND token so the next restart of this session reuses
-    // them — but ONLY when we got our preferred port. On a fallback we bound a
-    // *different* port because someone else holds the preferred one; persisting
-    // would overwrite the shared files and strand that other session's open tab.
-    if (PORT_FILE && !triedFallback) {
-      try { fs.writeFileSync(PORT_FILE, String(PORT)); } catch (e) { /* best effort */ }
-      if (TOKEN_FILE) {
-        try {
-          fs.writeFileSync(TOKEN_FILE, TOKEN, { mode: 0o600 });
-          chmodOwnerOnly(TOKEN_FILE);
-        } catch (e) { /* best effort */ }
-      }
-    }
-    const info = JSON.stringify({
-      type: 'server-started', port: Number(PORT), host: HOST,
-      url_host: URL_HOST, url: companionUrl(),
-      screen_dir: CONTENT_DIR, state_dir: STATE_DIR, idle_timeout_ms: IDLE_TIMEOUT_MS
-    });
-    console.log(info);
-    // server-info embeds the key — keep it owner-only.
-    fs.writeFileSync(path.join(STATE_DIR, 'server-info'), info + '\n', { mode: 0o600 });
-  }
-
-  server.on('error', (err) => {
-    if (err.code === 'EADDRINUSE' && !triedFallback) {
-      if (tokenSource === 'env') {
-        console.error('Server failed to bind: preferred port is in use and BRAINSTORM_TOKEN is set; refusing fallback with explicit token');
-        process.exit(1);
-      }
-      triedFallback = true;
-      PORT = randomPort();
-      if (tokenSource === 'file') {
-        TOKEN = generateToken();
-        tokenSource = 'generated-fallback';
-      }
-      server.listen(PORT, HOST, onListen);
-    } else {
-      console.error('Server failed to bind:', err.message);
-      process.exit(1);
-    }
-  });
-  server.listen(PORT, HOST, onListen);
-}
-
-if (require.main === module) {
-  startServer();
-}
-
-module.exports = {
-  computeAcceptKey,
-  encodeFrame,
-  decodeFrame,
-  browserLauncherForPlatform,
-  OPCODES,
-  MAX_FRAME_PAYLOAD_BYTES
-};
@@ -1,209 +0,0 @@
-#!/usr/bin/env bash
-# Start the brainstorm server and output connection info
-# Usage: start-server.sh [--project-dir <path>] [--host <bind-host>] [--url-host <display-host>] [--foreground] [--background]
-#
-# Starts server on a random high port, outputs JSON with URL.
-# Each session gets its own directory to avoid conflicts.
-#
-# Options:
-#   --project-dir <path>  Store session files under <path>/.superpowers/brainstorm/
-#                         instead of /tmp. Files persist after server stops.
-#   --host <bind-host>    Host/interface to bind (default: 127.0.0.1).
-#                         Use 0.0.0.0 in remote/containerized environments.
-#   --url-host <host>     Hostname shown in returned URL JSON.
-#   --idle-timeout-minutes <n>  Shut down after n minutes idle (default 240 = 4h).
-#   --open                Auto-open the browser on the first screen (use only
-#                         after the user approves the visual companion).
-#   --foreground          Run server in the current terminal (no backgrounding).
-#   --background          Force background mode (overrides Codex auto-foreground).
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-
-# Parse arguments
-PROJECT_DIR=""
-FOREGROUND="false"
-FORCE_BACKGROUND="false"
-BIND_HOST="127.0.0.1"
-URL_HOST=""
-IDLE_TIMEOUT_MINUTES=""
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --project-dir)
-      PROJECT_DIR="$2"
-      shift 2
-      ;;
-    --host)
-      BIND_HOST="$2"
-      shift 2
-      ;;
-    --url-host)
-      URL_HOST="$2"
-      shift 2
-      ;;
-    --idle-timeout-minutes)
-      IDLE_TIMEOUT_MINUTES="$2"
-      shift 2
-      ;;
-    --open)
-      export BRAINSTORM_OPEN=1
-      shift
-      ;;
-    --foreground|--no-daemon)
-      FOREGROUND="true"
-      shift
-      ;;
-    --background|--daemon)
-      FORCE_BACKGROUND="true"
-      shift
-      ;;
-    *)
-      echo "{\"error\": \"Unknown argument: $1\"}"
-      exit 1
-      ;;
-  esac
-done
-
-if [[ -z "$URL_HOST" ]]; then
-  if [[ "$BIND_HOST" == "127.0.0.1" || "$BIND_HOST" == "localhost" ]]; then
-    URL_HOST="localhost"
-  else
-    URL_HOST="$BIND_HOST"
-  fi
-fi
-
-if [[ -n "$IDLE_TIMEOUT_MINUTES" ]]; then
-  if ! [[ "$IDLE_TIMEOUT_MINUTES" =~ ^[0-9]+$ ]] || [[ "$IDLE_TIMEOUT_MINUTES" -lt 1 ]]; then
-    echo "{\"error\": \"--idle-timeout-minutes must be a positive integer\"}"
-    exit 1
-  fi
-  export BRAINSTORM_IDLE_TIMEOUT_MS=$(( IDLE_TIMEOUT_MINUTES * 60 * 1000 ))
-fi
-
-is_windows_like_shell() {
-  case "${OSTYPE:-}" in
-    msys*|cygwin*|mingw*) return 0 ;;
-  esac
-  if [[ -n "${MSYSTEM:-}" ]]; then
-    return 0
-  fi
-  local uname_s
-  uname_s="$(uname -s 2>/dev/null || true)"
-  case "$uname_s" in
-    MSYS*|MINGW*|CYGWIN*) return 0 ;;
-  esac
-  return 1
-}
-
-# Some environments reap detached/background processes. Auto-foreground when detected.
-if [[ -n "${CODEX_CI:-}" && "$FOREGROUND" != "true" && "$FORCE_BACKGROUND" != "true" ]]; then
-  FOREGROUND="true"
-fi
-
-# Windows/Git Bash reaps nohup background processes. Auto-foreground when detected.
-if [[ "$FOREGROUND" != "true" && "$FORCE_BACKGROUND" != "true" ]]; then
-  if is_windows_like_shell; then
-    FOREGROUND="true"
-  fi
-fi
-
-# Session files (server.log, server-info, .last-token) embed the session key —
-# keep everything this script and the server create owner-only.
-umask 077
-
-# Generate unique session directory
-SESSION_ID="$$-$(date +%s)"
-
-if [[ -n "$PROJECT_DIR" ]]; then
-  SESSION_DIR="${PROJECT_DIR}/.superpowers/brainstorm/${SESSION_ID}"
-  # Persist the bound port and key per project so a restart reuses them and an
-  # already-open browser tab reconnects to the same URL with a valid cookie.
-  export BRAINSTORM_PORT_FILE="${PROJECT_DIR}/.superpowers/brainstorm/.last-port"
-  export BRAINSTORM_TOKEN_FILE="${PROJECT_DIR}/.superpowers/brainstorm/.last-token"
-else
-  SESSION_DIR="/tmp/brainstorm-${SESSION_ID}"
-fi
-
-STATE_DIR="${SESSION_DIR}/state"
-PID_FILE="${STATE_DIR}/server.pid"
-LOG_FILE="${STATE_DIR}/server.log"
-SERVER_ID_FILE="${STATE_DIR}/server-instance-id"
-
-# Create fresh session directory with content and state peers
-mkdir -p "${SESSION_DIR}/content" "$STATE_DIR"
-
-SERVER_ID=""
-if [[ -r /dev/urandom ]]; then
-  SERVER_ID="$(od -An -N24 -tx1 /dev/urandom 2>/dev/null | tr -d ' \n' || true)"
-fi
-if ! [[ "$SERVER_ID" =~ ^[A-Za-z0-9_-]{32,64}$ ]]; then
-  SERVER_ID="$(printf '%08x%08x%08x%08x' "$$" "$(date +%s)" "${RANDOM:-0}" "${RANDOM:-0}")"
-fi
-printf '%s\n' "$SERVER_ID" > "$SERVER_ID_FILE"
-chmod 600 "$SERVER_ID_FILE" 2>/dev/null || true
-
-# Kill any existing server
-if [[ -f "$PID_FILE" ]]; then
-  old_pid=$(cat "$PID_FILE")
-  kill "$old_pid" 2>/dev/null
-  rm -f "$PID_FILE"
-fi
-
-cd "$SCRIPT_DIR" || exit 1
-
-# Resolve the harness PID (grandparent of this script).
-# $PPID is the ephemeral shell the harness spawned to run us — it dies
-# when this script exits. The harness itself is $PPID's parent.
-OWNER_PID="$(ps -o ppid= -p "$PPID" 2>/dev/null | tr -d ' ')"
-if [[ -z "$OWNER_PID" || "$OWNER_PID" == "1" ]]; then
-  OWNER_PID="$PPID"
-fi
-
-# Windows/MSYS2: Node.js cannot see POSIX PIDs from the MSYS2 namespace.
-# Passing a PID node cannot verify causes server to log owner-pid-invalid
-# and self-terminate at the 60-second lifecycle check. Clear it so the
-# watchdog is disabled and the idle timeout becomes the only shutdown trigger.
-if is_windows_like_shell; then
-  OWNER_PID=""
-fi
-
-# Foreground mode for environments that reap detached/background processes.
-if [[ "$FOREGROUND" == "true" ]]; then
-  env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs "--brainstorm-server-id=$SERVER_ID" &
-  SERVER_PID=$!
-  echo "$SERVER_PID" > "$PID_FILE"
-  wait "$SERVER_PID"
-  exit $?
-fi
-
-# Start server, capturing output to log file
-# Use nohup to survive shell exit; disown to remove from job table
-nohup env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs "--brainstorm-server-id=$SERVER_ID" > "$LOG_FILE" 2>&1 &
-SERVER_PID=$!
-disown "$SERVER_PID" 2>/dev/null
-echo "$SERVER_PID" > "$PID_FILE"
-
-# Wait for server-started message (check log file)
-for _ in {1..50}; do
-  if grep -q "server-started" "$LOG_FILE" 2>/dev/null; then
-    # Verify server is still alive after a short window (catches process reapers)
-    alive="true"
-    for _ in {1..20}; do
-      if ! kill -0 "$SERVER_PID" 2>/dev/null; then
-        alive="false"
-        break
-      fi
-      sleep 0.1
-    done
-    if [[ "$alive" != "true" ]]; then
-      echo "{\"error\": \"Server started but was killed. Retry in a persistent terminal with: $SCRIPT_DIR/start-server.sh${PROJECT_DIR:+ --project-dir $PROJECT_DIR} --host $BIND_HOST --url-host $URL_HOST --foreground\"}"
-      exit 1
-    fi
-    grep "server-started" "$LOG_FILE" | head -1
-    exit 0
-  fi
-  sleep 0.1
-done
-
-# Timeout - server didn't start
-echo '{"error": "Server failed to start within 5 seconds"}'
-exit 1
@@ -1,120 +0,0 @@
-#!/usr/bin/env bash
-# Stop the brainstorm server and clean up
-# Usage: stop-server.sh <session_dir>
-#
-# Kills the server process. Only deletes session directory if it's
-# under /tmp (ephemeral). Persistent directories (.superpowers/) are
-# kept so mockups can be reviewed later.
-
-SESSION_DIR="$1"
-
-if [[ -z "$SESSION_DIR" ]]; then
-  echo '{"error": "Usage: stop-server.sh <session_dir>"}'
-  exit 1
-fi
-
-STATE_DIR="${SESSION_DIR}/state"
-PID_FILE="${STATE_DIR}/server.pid"
-SERVER_ID_FILE="${STATE_DIR}/server-instance-id"
-
-mark_stopped() {
-  local reason="$1"
-  rm -f "${STATE_DIR}/server-info"
-  printf '{"reason":"%s","timestamp":%s}\n' "$reason" "$(date +%s)" > "${STATE_DIR}/server-stopped"
-}
-
-read_expected_server_id() {
-  [[ -f "$SERVER_ID_FILE" ]] || return 1
-  local id
-  id="$(tr -d '\r\n' < "$SERVER_ID_FILE" 2>/dev/null || true)"
-  [[ "$id" =~ ^[A-Za-z0-9_-]{32,64}$ ]] || return 1
-  printf '%s\n' "$id"
-}
-
-command_line_for_pid() {
-  local pid="$1"
-  if [[ -r "/proc/$pid/cmdline" ]]; then
-    tr '\0' '\n' < "/proc/$pid/cmdline" 2>/dev/null || true
-    return 0
-  fi
-  ps -ww -p "$pid" -o command= 2>/dev/null || ps -f -p "$pid" 2>/dev/null | sed '1d' || true
-}
-
-command_has_server_id() {
-  local pid="$1"
-  local expected="$2"
-  local expected_arg="--brainstorm-server-id=$expected"
-  if [[ -r "/proc/$pid/cmdline" ]]; then
-    local arg
-    while IFS= read -r -d '' arg || [[ -n "$arg" ]]; do
-      [[ "$arg" == "$expected_arg" ]] && return 0
-    done < "/proc/$pid/cmdline"
-    return 1
-  fi
-  local command_line
-  command_line="$(command_line_for_pid "$pid")"
-  [[ -n "$command_line" ]] || return 1
-  case " $command_line " in
-    *" $expected_arg "*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-# Confirm a PID has this session's per-start instance id, not just a familiar
-# process name. Ambiguous or legacy metadata fails closed as stale_pid.
-is_brainstorm_server() {
-  kill -0 "$1" 2>/dev/null || return 1
-  local expected_id
-  expected_id="$(read_expected_server_id)" || return 1
-  command_has_server_id "$1" "$expected_id" || return 1
-  return 0
-}
-
-if [[ -f "$PID_FILE" ]]; then
-  pid=$(cat "$PID_FILE")
-
-  # Refuse to signal a PID we can't prove is our server. A stale pid file may
-  # point at an unrelated process after a reboot/PID wraparound.
-  if ! is_brainstorm_server "$pid"; then
-    rm -f "$PID_FILE" "$SERVER_ID_FILE"
-    mark_stopped "stale_pid"
-    echo '{"status": "stale_pid"}'
-    exit 0
-  fi
-
-  # Try to stop gracefully, fallback to force if still alive
-  kill "$pid" 2>/dev/null || true
-
-  # Wait for graceful shutdown (up to ~2s)
-  for _ in {1..20}; do
-    if ! kill -0 "$pid" 2>/dev/null; then
-      break
-    fi
-    sleep 0.1
-  done
-
-  # If still running, escalate to SIGKILL
-  if kill -0 "$pid" 2>/dev/null; then
-    kill -9 "$pid" 2>/dev/null || true
-
-    # Give SIGKILL a moment to take effect
-    sleep 0.1
-  fi
-
-  if kill -0 "$pid" 2>/dev/null; then
-    echo '{"status": "failed", "error": "process still running"}'
-    exit 1
-  fi
-
-  rm -f "$PID_FILE" "$SERVER_ID_FILE" "${STATE_DIR}/server.log"
-  mark_stopped "stop-server.sh"
-
-  # Only delete ephemeral /tmp directories
-  if [[ "$SESSION_DIR" == /tmp/* ]]; then
-    rm -rf "$SESSION_DIR"
-  fi
-
-  echo '{"status": "stopped"}'
-else
-  echo '{"status": "not_running"}'
-fi
@@ -1,49 +0,0 @@
-# Spec Document Reviewer Prompt Template
-
-Use this template when dispatching a spec document reviewer subagent.
-
-**Purpose:** Verify the spec is complete, consistent, and ready for implementation planning.
-
-**Dispatch after:** Spec document is written to docs/superpowers/specs/
-
-```
-Subagent (general-purpose):
-  description: "Review spec document"
-  prompt: |
-    You are a spec document reviewer. Verify this spec is complete and ready for planning.
-
-    **Spec to review:** [SPEC_FILE_PATH]
-
-    ## What to Check
-
-    | Category | What to Look For |
-    |----------|------------------|
-    | Completeness | TODOs, placeholders, "TBD", incomplete sections |
-    | Consistency | Internal contradictions, conflicting requirements |
-    | Clarity | Requirements ambiguous enough to cause someone to build the wrong thing |
-    | Scope | Focused enough for a single plan — not covering multiple independent subsystems |
-    | YAGNI | Unrequested features, over-engineering |
-
-    ## Calibration
-
-    **Only flag issues that would cause real problems during implementation planning.**
-    A missing section, a contradiction, or a requirement so ambiguous it could be
-    interpreted two different ways — those are issues. Minor wording improvements,
-    stylistic preferences, and "sections less detailed than others" are not.
-
-    Approve unless there are serious gaps that would lead to a flawed plan.
-
-    ## Output Format
-
-    ## Spec Review
-
-    **Status:** Approved | Issues Found
-
-    **Issues (if any):**
-    - [Section X]: [specific issue] - [why it matters for planning]
-
-    **Recommendations (advisory, do not block approval):**
-    - [suggestions for improvement]
-```
-
-**Reviewer returns:** Status, Issues (if any), Recommendations
@@ -1,298 +0,0 @@
-# Visual Companion Guide
-
-Browser-based visual brainstorming companion for showing mockups, diagrams, and options.
-
-## When to Use
-
-Decide per-question, not per-session. The test: **would the user understand this better by seeing it than reading it?**
-
-**Use the browser** when the content itself is visual:
-
- **UI mockups** — wireframes, layouts, navigation structures, component designs
- **Architecture diagrams** — system components, data flow, relationship maps
- **Side-by-side visual comparisons** — comparing two layouts, two color schemes, two design directions
- **Design polish** — when the question is about look and feel, spacing, visual hierarchy
- **Spatial relationships** — state machines, flowcharts, entity relationships rendered as diagrams
-
-**Use the terminal** when the content is text or tabular:
-
- **Requirements and scope questions** — "what does X mean?", "which features are in scope?"
- **Conceptual A/B/C choices** — picking between approaches described in words
- **Tradeoff lists** — pros/cons, comparison tables
- **Technical decisions** — API design, data modeling, architectural approach selection
- **Clarifying questions** — anything where the answer is words, not a visual preference
-
-A question *about* a UI topic is not automatically a visual question. "What kind of wizard do you want?" is conceptual — use the terminal. "Which of these wizard layouts feels right?" is visual — use the browser.
-
-## How It Works
-
-The server watches a directory for HTML files and serves the newest one to the browser. You write HTML content to `screen_dir`, the user sees it in their browser and can click to select options. Selections are recorded to `state_dir/events` that you read on your next turn.
-
-**Content fragments vs full documents:** If your HTML file starts with `<!DOCTYPE` or `<html`, the server serves it as-is (just injects the helper script). Otherwise, the server automatically wraps your content in the frame template — adding the header, CSS theme, connection status, and all interactive infrastructure. **Write content fragments by default.** Only write full documents when you need complete control over the page.
-
-## Starting a Session
-
-```bash
-# Start AFTER the user approves the companion. --open auto-opens their browser on
-# the first screen; --project-dir persists mockups and enables same-port restart.
-scripts/start-server.sh --project-dir /path/to/project --open
-
-# Returns: {"type":"server-started","port":52341,
-#           "url":"http://localhost:52341/?key=ab12…",
-#           "screen_dir":"/path/to/project/.superpowers/brainstorm/12345-1706000000/content",
-#           "state_dir":"/path/to/project/.superpowers/brainstorm/12345-1706000000/state"}
-```
-
-Save `screen_dir` and `state_dir` from the response. With `--open`, the browser opens itself when you push the first screen — you don't need to ask the user to open it, but still share the URL as a fallback (headless/remote setups won't auto-open).
-
-**The URL contains a session key (`?key=…`).** The server rejects any request
-without it, so always give the user the **complete** URL from the `url` field —
-never strip the query string, and never hand out a bare `http://host:port`. The
-key gates HTTP and WebSocket access so a stray browser tab or another machine on
-the network can't read the screens or inject events. After the first load the
-browser remembers the key via a cookie, so reloads and `/files/*` assets work
-without repeating it.
-
-**Finding connection info:** The server writes its startup JSON to `$STATE_DIR/server-info`. If you launched the server in the background and didn't capture stdout, read that file to get the URL and port. When using `--project-dir`, check `<project>/.superpowers/brainstorm/` for the session directory.
-
-**Note:** Pass the project root as `--project-dir` so mockups persist in `.superpowers/brainstorm/` and survive server restarts. Without it, files go to `/tmp` and get cleaned up. Remind the user to add `.superpowers/` to `.gitignore` if it's not already there.
-
-**Launching the server by platform:**
-
-**Claude Code:**
-```bash
-# Default mode works — the script backgrounds the server itself.
-scripts/start-server.sh --project-dir /path/to/project --open
-```
-
-On Windows, the script auto-detects and switches to foreground mode (which blocks the tool call). Use `run_in_background: true` on the Bash tool call so the server survives across conversation turns, then read `$STATE_DIR/server-info` on the next turn to get the URL and port.
-
-**Codex:**
-```bash
-# Codex reaps background processes. The script auto-detects CODEX_CI and
-# switches to foreground mode. Run it normally — no extra flags needed.
-scripts/start-server.sh --project-dir /path/to/project --open
-```
-
-**Gemini CLI:**
-```bash
-# Use --foreground and set is_background: true on your shell tool call
-# so the process survives across turns
-scripts/start-server.sh --project-dir /path/to/project --open --foreground
-```
-
-**Copilot CLI:**
-```bash
-# Use --foreground and start the server via the bash tool with mode: "async"
-# so the process survives across turns. Capture the returned shellId for
-# read_bash / stop_bash if you need to interact with it later.
-scripts/start-server.sh --project-dir /path/to/project --open --foreground
-```
-
-**Other environments:** The server must keep running in the background across conversation turns. If your environment reaps detached processes, use `--foreground` and launch the command with your platform's background execution mechanism.
-
-If the URL is unreachable from your browser (common in remote/containerized setups), bind a non-loopback host:
-
-```bash
-scripts/start-server.sh \
-  --project-dir /path/to/project \
-  --host 0.0.0.0 \
-  --url-host localhost
-```
-
-Use `--url-host` to control what hostname is printed in the returned URL JSON.
-
-## The Loop
-
-1. **Check server is alive**, then **write HTML** to a new file in `screen_dir`:
-   - **Required: confirm the server is alive before referring to the URL or pushing a screen.** Check that `$STATE_DIR/server-info` exists and `$STATE_DIR/server-stopped` does not. If it has shut down, restart it with `start-server.sh` using the **same `--project-dir`** — it reuses the same port, so the user's open tab reconnects on its own (it shows a "paused" overlay while the server is down) and you don't need to send a new URL. The server auto-exits after 4 hours idle (configurable with `--idle-timeout-minutes`).
-   - Use semantic filenames: `platform.html`, `visual-style.html`, `layout.html`
-   - **Never reuse filenames** — each screen gets a fresh file
-   - Use your file-creation tool — **never use cat/heredoc** (dumps noise into terminal)
-   - Server automatically serves the newest file
-
-2. **Tell user what to expect and end your turn:**
-   - Remind them of the URL (every step, not just first)
-   - Give a brief text summary of what's on screen (e.g., "Showing 3 layout options for the homepage")
-   - Ask them to respond in the terminal: "Take a look and let me know what you think. Click to select an option if you'd like."
-
-3. **On your next turn** — after the user responds in the terminal:
-   - Read `$STATE_DIR/events` if it exists — this contains the user's browser interactions (clicks, selections) as JSON lines
-   - Merge with the user's terminal text to get the full picture
-   - The terminal message is the primary feedback; `state_dir/events` provides structured interaction data
-
-4. **Iterate or advance** — if feedback changes current screen, write a new file (e.g., `layout-v2.html`). Only move to the next question when the current step is validated.
-
-5. **Unload when returning to terminal** — when the next step doesn't need the browser (e.g., a clarifying question, a tradeoff discussion), push a waiting screen to clear the stale content:
-
-   ```html
-   <!-- filename: waiting.html (or waiting-2.html, etc.) -->
-   <div style="display:flex;align-items:center;justify-content:center;min-height:60vh">
-     <p class="subtitle">Continuing in terminal...</p>
-   </div>
-   ```
-
-   This prevents the user from staring at a resolved choice while the conversation has moved on. When the next visual question comes up, push a new content file as usual.
-
-6. Repeat until done.
-
-## Writing Content Fragments
-
-Write just the content that goes inside the page. The server wraps it in the frame template automatically (header, theme CSS, connection status, and all interactive infrastructure).
-
-**Minimal example:**
-
-```html
-<h2>Which layout works better?</h2>
-<p class="subtitle">Consider readability and visual hierarchy</p>
-
-<div class="options">
-  <div class="option" data-choice="a" onclick="toggleSelect(this)">
-    <div class="letter">A</div>
-    <div class="content">
-      <h3>Single Column</h3>
-      <p>Clean, focused reading experience</p>
-    </div>
-  </div>
-  <div class="option" data-choice="b" onclick="toggleSelect(this)">
-    <div class="letter">B</div>
-    <div class="content">
-      <h3>Two Column</h3>
-      <p>Sidebar navigation with main content</p>
-    </div>
-  </div>
-</div>
-```
-
-That's it. No `<html>`, no CSS, no `<script>` tags needed. The server provides all of that.
-
-## CSS Classes Available
-
-The frame template provides these CSS classes for your content:
-
-### Options (A/B/C choices)
-
-```html
-<div class="options">
-  <div class="option" data-choice="a" onclick="toggleSelect(this)">
-    <div class="letter">A</div>
-    <div class="content">
-      <h3>Title</h3>
-      <p>Description</p>
-    </div>
-  </div>
-</div>
-```
-
-**Multi-select:** Add `data-multiselect` to the container to let users select multiple options. Each click toggles the item's selected styling.
-
-```html
-<div class="options" data-multiselect>
-  <!-- same option markup — users can select/deselect multiple -->
-</div>
-```
-
-### Cards (visual designs)
-
-```html
-<div class="cards">
-  <div class="card" data-choice="design1" onclick="toggleSelect(this)">
-    <div class="card-image"><!-- mockup content --></div>
-    <div class="card-body">
-      <h3>Name</h3>
-      <p>Description</p>
-    </div>
-  </div>
-</div>
-```
-
-### Mockup container
-
-```html
-<div class="mockup">
-  <div class="mockup-header">Preview: Dashboard Layout</div>
-  <div class="mockup-body"><!-- your mockup HTML --></div>
-</div>
-```
-
-### Split view (side-by-side)
-
-```html
-<div class="split">
-  <div class="mockup"><!-- left --></div>
-  <div class="mockup"><!-- right --></div>
-</div>
-```
-
-### Pros/Cons
-
-```html
-<div class="pros-cons">
-  <div class="pros"><h4>Pros</h4><ul><li>Benefit</li></ul></div>
-  <div class="cons"><h4>Cons</h4><ul><li>Drawback</li></ul></div>
-</div>
-```
-
-### Mock elements (wireframe building blocks)
-
-```html
-<div class="mock-nav">Logo | Home | About | Contact</div>
-<div style="display: flex;">
-  <div class="mock-sidebar">Navigation</div>
-  <div class="mock-content">Main content area</div>
-</div>
-<button class="mock-button">Action Button</button>
-<input class="mock-input" placeholder="Input field">
-<div class="placeholder">Placeholder area</div>
-```
-
-### Typography and sections
-
- `h2` — page title
- `h3` — section heading
- `.subtitle` — secondary text below title
- `.section` — content block with bottom margin
- `.label` — small uppercase label text
-
-## Browser Events Format
-
-When the user clicks options in the browser, their interactions are recorded to `$STATE_DIR/events` (one JSON object per line). The file is cleared automatically when you push a new screen.
-
-```jsonl
-{"type":"click","choice":"a","text":"Option A - Simple Layout","timestamp":1706000101}
-{"type":"click","choice":"c","text":"Option C - Complex Grid","timestamp":1706000108}
-{"type":"click","choice":"b","text":"Option B - Hybrid","timestamp":1706000115}
-```
-
-The full event stream shows the user's exploration path — they may click multiple options before settling. The last `choice` event is typically the final selection, but the pattern of clicks can reveal hesitation or preferences worth asking about.
-
-If `$STATE_DIR/events` doesn't exist, the user didn't interact with the browser — use only their terminal text.
-
-## Design Tips
-
- **Scale fidelity to the question** — wireframes for layout, polish for polish questions
- **Explain the question on each page** — "Which layout feels more professional?" not just "Pick one"
- **Iterate before advancing** — if feedback changes current screen, write a new version
- **2-4 options max** per screen
- **Use real content when it matters** — for a photography portfolio, use actual images (Unsplash). Placeholder content obscures design issues.
- **Keep mockups simple** — focus on layout and structure, not pixel-perfect design
-
-## File Naming
-
- Use semantic names: `platform.html`, `visual-style.html`, `layout.html`
- Never reuse filenames — each screen must be a new file
- For iterations: append version suffix like `layout-v2.html`, `layout-v3.html`
- Server serves newest file by modification time
-
-## Cleaning Up
-
-```bash
-scripts/stop-server.sh $SESSION_DIR
-```
-
-If the session used `--project-dir`, mockup files persist in `.superpowers/brainstorm/` for later reference. Only `/tmp` sessions get deleted on stop.
-
-## Reference
-
- Frame template (CSS reference): `scripts/frame-template.html`
- Helper script (client-side): `scripts/helper.js`
@@ -1,167 +0,0 @@
---
-name: dispatching-parallel-agents
-description: Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies
---
-
-# Dispatching Parallel Agents
-
-## Overview
-
-You delegate tasks to specialized agents with isolated context. By precisely crafting their instructions and context, you ensure they stay focused and succeed at their task. They should never inherit your session's context or history — you construct exactly what they need. This also preserves your own context for coordination work.
-
-When you have multiple unrelated failures (different test files, different subsystems, different bugs), investigating them sequentially wastes time. Each investigation is independent and can happen in parallel.
-
-**Core principle:** Dispatch one agent per independent problem domain. Let them work concurrently.
-
-## When to Use
-
-```dot
-digraph when_to_use {
-    "Multiple failures?" [shape=diamond];
-    "Are they independent?" [shape=diamond];
-    "Single agent investigates all" [shape=box];
-    "One agent per problem domain" [shape=box];
-    "Can they work in parallel?" [shape=diamond];
-    "Sequential agents" [shape=box];
-    "Parallel dispatch" [shape=box];
-
-    "Multiple failures?" -> "Are they independent?" [label="yes"];
-    "Are they independent?" -> "Single agent investigates all" [label="no - related"];
-    "Are they independent?" -> "Can they work in parallel?" [label="yes"];
-    "Can they work in parallel?" -> "Parallel dispatch" [label="yes"];
-    "Can they work in parallel?" -> "Sequential agents" [label="no - shared state"];
-}
-```
-
-**Use when:**
- 3+ test files failing with different root causes
- Multiple subsystems broken independently
- Each problem can be understood without context from others
- No shared state between investigations
-
-**Don't use when:**
- Failures are related (fix one might fix others)
- Need to understand full system state
- Agents would interfere with each other
-
-## The Pattern
-
-### 1. Identify Independent Domains
-
-Group failures by what's broken:
- File A tests: Tool approval flow
- File B tests: Batch completion behavior
- File C tests: Abort functionality
-
-Each domain is independent - fixing tool approval doesn't affect abort tests.
-
-### 2. Create Focused Agent Tasks
-
-Each agent gets:
- **Specific scope:** One test file or subsystem
- **Clear goal:** Make these tests pass
- **Constraints:** Don't change other code
- **Expected output:** Summary of what you found and fixed
-
-### 3. Dispatch in Parallel
-
-Issue all three subagent dispatches in the same response — they run in parallel:
-
-```text
-Subagent (general-purpose): "Fix agent-tool-abort.test.ts failures"
-Subagent (general-purpose): "Fix batch-completion-behavior.test.ts failures"
-Subagent (general-purpose): "Fix tool-approval-race-conditions.test.ts failures"
-# All three run concurrently.
-```
-
-Multiple dispatch calls in one response = parallel execution. One per response = sequential.
-
-### 4. Review and Integrate
-
-When agents return:
- Read each summary
- Verify fixes don't conflict
- Run full test suite
- Integrate all changes
-
-## Agent Prompt Structure
-
-Good agent prompts are:
-1. **Focused** - One clear problem domain
-2. **Self-contained** - All context needed to understand the problem
-3. **Specific about output** - What should the agent return?
-
-```markdown
-Fix the 3 failing tests in src/agents/agent-tool-abort.test.ts:
-
-1. "should abort tool with partial output capture" - expects 'interrupted at' in message
-2. "should handle mixed completed and aborted tools" - fast tool aborted instead of completed
-3. "should properly track pendingToolCount" - expects 3 results but gets 0
-
-These are timing/race condition issues. Your task:
-
-1. Read the test file and understand what each test verifies
-2. Identify root cause - timing issues or actual bugs?
-3. Fix by:
-   - Replacing arbitrary timeouts with event-based waiting
-   - Fixing bugs in abort implementation if found
-   - Adjusting test expectations if testing changed behavior
-
-Do NOT just increase timeouts - find the real issue.
-
-Return: Summary of what you found and what you fixed.
-```
-
-## Common Mistakes
-
-**❌ Too broad:** "Fix all the tests" - agent gets lost
-**✅ Specific:** "Fix agent-tool-abort.test.ts" - focused scope
-
-**❌ No context:** "Fix the race condition" - agent doesn't know where
-**✅ Context:** Paste the error messages and test names
-
-**❌ No constraints:** Agent might refactor everything
-**✅ Constraints:** "Do NOT change production code" or "Fix tests only"
-
-**❌ Vague output:** "Fix it" - you don't know what changed
-**✅ Specific:** "Return summary of root cause and changes"
-
-## When NOT to Use
-
-**Related failures:** Fixing one might fix others - investigate together first
-**Need full context:** Understanding requires seeing entire system
-**Exploratory debugging:** You don't know what's broken yet
-**Shared state:** Agents would interfere (editing same files, using same resources)
-
-## Real Example from Session
-
-**Scenario:** 6 test failures across 3 files after major refactoring
-
-**Failures:**
- agent-tool-abort.test.ts: 3 failures (timing issues)
- batch-completion-behavior.test.ts: 2 failures (tools not executing)
- tool-approval-race-conditions.test.ts: 1 failure (execution count = 0)
-
-**Decision:** Independent domains - abort logic separate from batch completion separate from race conditions
-
-**Dispatch:**
-```
-Agent 1 → Fix agent-tool-abort.test.ts
-Agent 2 → Fix batch-completion-behavior.test.ts
-Agent 3 → Fix tool-approval-race-conditions.test.ts
-```
-
-**Results:**
- Agent 1: Replaced timeouts with event-based waiting
- Agent 2: Fixed event structure bug (threadId in wrong place)
- Agent 3: Added wait for async tool execution to complete
-
-**Integration:** All fixes independent, no conflicts, full suite green
-
-## Verification
-
-After agents return:
-1. **Review each summary** - Understand what changed
-2. **Check for conflicts** - Did agents edit same code?
-3. **Run full suite** - Verify all fixes work together
-4. **Spot check** - Agents can make systematic errors
@@ -1,64 +0,0 @@
---
-name: executing-plans
-description: Use when you have a written implementation plan to execute in a separate session with review checkpoints
---
-
-# Executing Plans
-
-## Overview
-
-Load plan, review critically, execute all tasks, report when complete.
-
-**Announce at start:** "I'm using the executing-plans skill to implement this plan."
-
-**Note:** Tell your human partner that Superpowers works much better with access to subagents (Claude Code, Codex CLI, Codex App, Copilot CLI, and Gemini CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available, use superpowers:subagent-driven-development instead of this skill.
-
-## The Process
-
-### Step 1: Load and Review Plan
-1. Ensure an isolated workspace: use superpowers:using-git-worktrees to create one or verify the existing one
-2. Read plan file
-3. Review critically - identify any questions or concerns about the plan
-4. If concerns: Raise them with your human partner before starting
-5. If no concerns: Create todos for the plan items and proceed
-
-### Step 2: Execute Tasks
-
-For each task:
-1. Mark as in_progress
-2. Follow each step exactly (plan has bite-sized steps)
-3. Run verifications as specified
-4. Mark as completed
-
-### Step 3: Complete Development
-
-After all tasks complete and verified:
- Announce: "I'm using the finishing-a-development-branch skill to complete this work."
- **REQUIRED SUB-SKILL:** Use superpowers:finishing-a-development-branch
- Follow that skill to verify tests, present options, execute choice
-
-## When to Stop and Ask for Help
-
-**STOP executing immediately when:**
- Hit a blocker (missing dependency, test fails, instruction unclear)
- Plan has critical gaps preventing starting
- You don't understand an instruction
- Verification fails repeatedly
-
-**Ask for clarification rather than guessing.**
-
-## When to Revisit Earlier Steps
-
-**Return to Review (Step 1) when:**
- Partner updates the plan based on your feedback
- Fundamental approach needs rethinking
-
-**Don't force through blockers** - stop and ask.
-
-## Remember
- Review plan critically first
- Follow plan steps exactly
- Don't skip verifications
- Reference skills when plan says to
- Stop when blocked, don't guess
- Never start implementation on main/master branch without explicit user consent
@@ -1,201 +0,0 @@
---
-name: finishing-a-development-branch
-description: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work
---
-
-# Finishing a Development Branch
-
-## Overview
-
-**Core principle:** Verify tests → Detect environment → Present options → Execute choice → Clean up.
-
-**Announce at start:** "I'm using the finishing-a-development-branch skill to complete this work."
-
-## Step 1: Verify Tests
-
-Run the project's full test suite (`npm test` / `cargo test` / `pytest` / `go test ./...`).
-
-**If tests fail**, report the failures and stop — the menu comes after a green suite:
-
-```
-Tests failing (<N> failures). Must fix before completing:
-
-[Show failures]
-```
-
-**If tests pass:** continue to Step 2.
-
-## Step 2: Detect Environment
-
-```bash
-GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
-GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)
-# Capture now, while still inside the workspace — Step 5 changes directory
-# before cleanup (Step 6) needs this value
-WORKTREE_PATH=$(git rev-parse --show-toplevel)
-```
-
-This determines which menu to show and how cleanup works:
-
-| State | Menu | Cleanup |
-|-------|------|---------|
-| `GIT_DIR == GIT_COMMON` (normal repo) | Standard 3 options | No worktree to clean up |
-| `GIT_DIR != GIT_COMMON`, named branch | Standard 3 options | Provenance-based (see Step 6) |
-| `GIT_DIR != GIT_COMMON`, detached HEAD | Reduced 2 options (no merge) | Externally managed — leave in place |
-
-## Step 3: Determine Base Branch
-
-The base branch is whatever this work forked from — usually named in the
-plan, the conversation, or the branch's upstream. If it is not already
-known, ask: "This branch split from <your best guess> - is that correct?"
-Confirm before merging: merging into the wrong base is expensive to undo.
-
-## Step 4: Present Options
-
-**Normal repo and named-branch worktree — present exactly these 3 options:**
-
-```
-Implementation complete. What would you like to do?
-
-1. Merge back to <base-branch> locally
-2. Push and create a Pull Request
-3. Keep the branch as-is (I'll handle it later)
-
-Which option?
-```
-
-**Detached HEAD — present exactly these 2 options:**
-
-```
-Implementation complete. You're on a detached HEAD (externally managed workspace).
-
-1. Push as new branch and create a Pull Request
-2. Keep as-is (I'll handle it later)
-
-Which option?
-```
-
-Present the menu exactly as written — concise, with every option coming
-from the list above. Discarding the work happens only in response to your
-human partner explicitly asking for it (see "If your human partner asks to
-discard the work" below). Wait for their answer; the integration decision
-is theirs.
-
-## Step 5: Execute Choice
-
-### Option 1: Merge Locally
-
-```bash
-# Get main repo root for CWD safety
-MAIN_ROOT=$(git -C "$(git rev-parse --git-common-dir)/.." rev-parse --show-toplevel)
-cd "$MAIN_ROOT"
-
-# Merge first — verify success before removing anything
-git checkout <base-branch>
-git pull
-git merge <feature-branch>
-
-# Verify tests on merged result
-<test command>
-```
-
-If tests fail on the merged result: stop, leave the worktree and branch in
-place, and investigate — nothing has been pushed, so the merge is local
-and recoverable.
-
-Once the merged result is green: clean up the worktree (Step 6), then
-delete the branch:
-
-```bash
-git branch -d <feature-branch>
-```
-
-### Option 2: Push and Create PR
-
-```bash
-git push -u origin <feature-branch>
-# From a detached HEAD, name the new branch on the remote:
-# git push origin HEAD:refs/heads/<new-branch>
-```
-
-Then create the pull/merge request against <base-branch> with the forge's
-tooling — its CLI if one is available, or the creation URL most forges
-print when you push — following the repo's PR template and conventions if
-present, and report the URL to your human partner.
-
-Keep the worktree — your human partner iterates on PR feedback there.
-
-### Option 3: Keep As-Is
-
-Report: "Keeping branch <name>. Worktree preserved at <path>."
-
-### If your human partner asks to discard the work
-
-This path exists only as a response to an explicit request to throw the
-work away. Confirm first:
-
-```
-This will permanently delete:
- Branch <name>
- All commits: <commit-list>
- Worktree at <path>
-
-Type 'discard' to confirm.
-```
-
-Wait for that exact confirmation. When it arrives:
-
-```bash
-MAIN_ROOT=$(git -C "$(git rev-parse --git-common-dir)/.." rev-parse --show-toplevel)
-cd "$MAIN_ROOT"
-```
-
-Then clean up the worktree (Step 6) and force-delete the branch:
-
-```bash
-git branch -D <feature-branch>
-```
-
-## Step 6: Cleanup Workspace
-
-**Runs for Option 1 and confirmed discards.** Options 2 and 3 always
-preserve the worktree. Both callers have already changed directory to the
-main repo root — worktree removal must run from outside the worktree —
-and use the `GIT_DIR`/`GIT_COMMON`/`WORKTREE_PATH` values captured in
-Step 2, from before that directory change.
-
-**If `GIT_DIR == GIT_COMMON`:** Normal repo, no worktree to clean up. Done.
-
-**If `WORKTREE_PATH` is under `.worktrees/` or `worktrees/`:** Superpowers
-created this worktree — we own cleanup:
-
-```bash
-git worktree remove "$WORKTREE_PATH"
-git worktree prune  # Self-healing: clean up any stale registrations
-```
-
-**Otherwise:** The host environment owns this workspace — leave it in
-place. If your platform provides a workspace-exit tool, use it.
-
-## Quick Reference
-
-| Option | Merge | Push | Keep Worktree | Cleanup Branch |
-|--------|-------|------|---------------|----------------|
-| 1. Merge locally | yes | - | - | yes |
-| 2. Create PR | - | yes | yes | - |
-| 3. Keep as-is | - | - | yes | - |
-| Discard (explicit request only) | - | - | - | yes (force) |
-
-## Common Rationalizations
-
-| Excuse | Reality |
-|--------|---------|
-| "Tests passed earlier this session" | Run the suite on the tree you are about to integrate. A green run only proves the tree it ran on. |
-| "They obviously want it merged" | Integration is your human partner's decision. Present the menu and wait. |
-| "They seem done with this feature — I'll offer to discard it" | The menu is complete as written. Discard happens only when your human partner asks for it in so many words. |
-| "'Yeah, get rid of it' counts as confirmation" | Only the typed word `discard` authorizes deletion. |
-| "The PR is up, so the worktree is clutter now" | PR feedback gets fixed in that worktree. It stays until the work lands. |
-| "This other worktree looks stale — I'll clean it too" | Clean up only worktrees under `.worktrees/` or `worktrees/`. Everything else belongs to the host. |
-| "The merged-result failure is probably flaky" | A failing merged result stops everything. Branch and worktree stay put while you investigate. |
-| "The base branch is obviously main" | Confirm the fork point or ask. Merging into the wrong base is expensive to undo. |
-| "The push was rejected — force-push will fix it" | A rejected push means the remote moved. Investigate; force-push only on your human partner's explicit request. |
@@ -1,205 +0,0 @@
---
-name: receiving-code-review
-description: Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
---
-
-# Code Review Reception
-
-## Overview
-
-Code review requires technical evaluation, not emotional performance.
-
-**Core principle:** Verify before implementing. Ask before assuming. Technical correctness over social comfort.
-
-## The Response Pattern
-
-```
-WHEN receiving code review feedback:
-
-1. READ: Complete feedback without reacting
-2. UNDERSTAND: Restate requirement in own words (or ask)
-3. VERIFY: Check against codebase reality
-4. EVALUATE: Technically sound for THIS codebase?
-5. RESPOND: Technical acknowledgment or reasoned pushback
-6. IMPLEMENT: One item at a time, test each
-```
-
-## Forbidden Responses
-
-**NEVER:**
- "You're absolutely right!" (explicit instruction-file violation)
- "Great point!" / "Excellent feedback!" (performative)
- "Let me implement that now" (before verification)
-
-**INSTEAD:**
- Restate the technical requirement
- Ask clarifying questions
- Push back with technical reasoning if wrong
- Just start working (actions > words)
-
-## Handling Unclear Feedback
-
-```
-IF any item is unclear:
-  STOP - do not implement anything yet
-  ASK for clarification on unclear items
-
-WHY: Items may be related. Partial understanding = wrong implementation.
-```
-
-**Example:**
-```
-your human partner: "Fix 1-6"
-You understand 1,2,3,6. Unclear on 4,5.
-
-❌ WRONG: Implement 1,2,3,6 now, ask about 4,5 later
-✅ RIGHT: "I understand items 1,2,3,6. Need clarification on 4 and 5 before proceeding."
-```
-
-## Source-Specific Handling
-
-### From your human partner
- **Trusted** - implement after understanding
- **Still ask** if scope unclear
- **No performative agreement**
- **Skip to action** or technical acknowledgment
-
-### From External Reviewers
-```
-BEFORE implementing:
-  1. Check: Technically correct for THIS codebase?
-  2. Check: Breaks existing functionality?
-  3. Check: Reason for current implementation?
-  4. Check: Works on all platforms/versions?
-  5. Check: Does reviewer understand full context?
-
-IF suggestion seems wrong:
-  Push back with technical reasoning
-
-IF can't easily verify:
-  Say so: "I can't verify this without [X]. Should I [investigate/ask/proceed]?"
-
-IF conflicts with your human partner's prior decisions:
-  Stop and discuss with your human partner first
-```
-
-**your human partner's rule:** "External feedback - be skeptical, but check carefully"
-
-## YAGNI Check for "Professional" Features
-
-```
-IF reviewer suggests "implementing properly":
-  grep codebase for actual usage
-
-  IF unused: "This endpoint isn't called. Remove it (YAGNI)?"
-  IF used: Then implement properly
-```
-
-**your human partner's rule:** "You and reviewer both report to me. If we don't need this feature, don't add it."
-
-## Implementation Order
-
-```
-FOR multi-item feedback:
-  1. Clarify anything unclear FIRST
-  2. Then implement in this order:
-     - Blocking issues (breaks, security)
-     - Simple fixes (typos, imports)
-     - Complex fixes (refactoring, logic)
-  3. Test each fix individually
-  4. Verify no regressions
-```
-
-## When To Push Back
-
-Push back when:
- Suggestion breaks existing functionality
- Reviewer lacks full context
- Violates YAGNI (unused feature)
- Technically incorrect for this stack
- Legacy/compatibility reasons exist
- Conflicts with your human partner's architectural decisions
-
-**How to push back:**
- Use technical reasoning, not defensiveness
- Ask specific questions
- Reference working tests/code
- Involve your human partner if architectural
-
-**If you're uncomfortable pushing back out loud:** Name that tension, then tell your partner about the issue you've seen. They'll appreciate your honesty.
-
-## Acknowledging Correct Feedback
-
-When feedback IS correct:
-```
-✅ "Fixed. [Brief description of what changed]"
-✅ "Good catch - [specific issue]. Fixed in [location]."
-✅ [Just fix it and show in the code]
-
-❌ "You're absolutely right!"
-❌ "Great point!"
-❌ "Thanks for catching that!"
-❌ "Thanks for [anything]"
-❌ ANY gratitude expression
-```
-
-**Why no thanks:** Actions speak. Just fix it. The code itself shows you heard the feedback.
-
-**If you catch yourself about to write "Thanks":** DELETE IT. State the fix instead.
-
-## Gracefully Correcting Your Pushback
-
-If you pushed back and were wrong:
-```
-✅ "You were right - I checked [X] and it does [Y]. Implementing now."
-✅ "Verified this and you're correct. My initial understanding was wrong because [reason]. Fixing."
-
-❌ Long apology
-❌ Defending why you pushed back
-❌ Over-explaining
-```
-
-State the correction factually and move on.
-
-## Common Mistakes
-
-| Mistake | Fix |
-|---------|-----|
-| Performative agreement | State requirement or just act |
-| Blind implementation | Verify against codebase first |
-| Batch without testing | One at a time, test each |
-| Assuming reviewer is right | Check if breaks things |
-| Avoiding pushback | Technical correctness > comfort |
-| Partial implementation | Clarify all items first |
-| Can't verify, proceed anyway | State limitation, ask for direction |
-
-## Real Examples
-
-**Performative Agreement (Bad):**
-```
-Reviewer: "Remove legacy code"
-❌ "You're absolutely right! Let me remove that..."
-```
-
-**Technical Verification (Good):**
-```
-Reviewer: "Remove legacy code"
-✅ "Checking... build target is 10.15+, this API needs 13+. Need legacy for backward compat. Current impl has wrong bundle ID - fix it or drop pre-13 support?"
-```
-
-**YAGNI (Good):**
-```
-Reviewer: "Implement proper metrics tracking with database, date filters, CSV export"
-✅ "Grepped codebase - nothing calls this endpoint. Remove it (YAGNI)? Or is there usage I'm missing?"
-```
-
-**Unclear Item (Good):**
-```
-your human partner: "Fix items 1-6"
-You understand 1,2,3,6. Unclear on 4,5.
-✅ "Understand 1,2,3,6. Need clarification on 4 and 5 before implementing."
-```
-
-## GitHub Thread Replies
-
-When replying to inline review comments on GitHub, reply in the comment thread (`gh api repos/{owner}/{repo}/pulls/{pr}/comments/{id}/replies`), not as a top-level PR comment.
@@ -1,95 +0,0 @@
---
-name: requesting-code-review
-description: Use when completing tasks, implementing major features, or before merging to verify work meets requirements
---
-
-# Requesting Code Review
-
-Dispatch a code reviewer subagent to catch issues before they cascade. The reviewer gets precisely crafted context for evaluation — never your session's history.
-
-**Core principle:** Review early, review often.
-
-## When to Request Review
-
-**Mandatory:**
- After each task in subagent-driven development
- After completing major feature
- Before merge to main
-
-**Optional but valuable:**
- When stuck (fresh perspective)
- Before refactoring (baseline check)
- After fixing complex bug
-
-## How to Request
-
-**1. Get git SHAs:**
-```bash
-BASE_SHA=$(git rev-parse HEAD~1)  # or origin/main
-HEAD_SHA=$(git rev-parse HEAD)
-```
-
-**2. Dispatch code reviewer subagent:**
-
-Dispatch a `general-purpose` subagent, filling the template at [code-reviewer.md](code-reviewer.md)
-
-**Placeholders:**
- `{DESCRIPTION}` - Brief summary of what you built
- `{PLAN_OR_REQUIREMENTS}` - What it should do
- `{BASE_SHA}` - Starting commit
- `{HEAD_SHA}` - Ending commit
-
-**3. Act on feedback:**
- Fix Critical issues immediately
- Fix Important issues before proceeding
- Note Minor issues for later
- Push back if reviewer is wrong (with reasoning)
-
-## Example
-
-```
-[Just completed Task 2: Add verification function]
-
-You: Let me request code review before proceeding.
-
-BASE_SHA=$(git log --oneline | grep "Task 1" | head -1 | awk '{print $1}')
-HEAD_SHA=$(git rev-parse HEAD)
-
-[Dispatch code reviewer subagent]
-  DESCRIPTION: Added verifyIndex() and repairIndex() with 4 issue types
-  PLAN_OR_REQUIREMENTS: Task 2 from docs/superpowers/plans/deployment-plan.md
-  BASE_SHA: a7981ec
-  HEAD_SHA: 3df7661
-
-[Subagent returns]:
-  Strengths: Clean architecture, real tests
-  Issues:
-    Important: Missing progress indicators
-    Minor: Magic number (100) for reporting interval
-  Assessment: Ready to proceed
-
-You: [Fix progress indicators]
-[Continue to Task 3]
-```
-
-## Common Rationalizations
-
-| Excuse | Reality |
-|--------|---------|
-| "I'll just review the diff myself instead of dispatching a reviewer" | You're the coordinator — reviewing the diff inline burns the context window you need to keep driving the work. Dispatch a reviewer subagent: the diff and the evaluation live in its context, and only the findings come back to you. |
-| "The reviewer needs my whole session history to understand the change" | Hand it precisely crafted context, never your session's history. That keeps the reviewer on the work product, not your thought process. |
-
-## Red Flags
-
-**Never:**
- Skip review because "it's simple"
- Ignore Critical issues
- Proceed with unfixed Important issues
- Argue with valid technical feedback
-
-**If reviewer wrong:**
- Push back with technical reasoning
- Show code/tests that prove it works
- Request clarification
-
-See template at: [code-reviewer.md](code-reviewer.md)
@@ -1,172 +0,0 @@
-# Code Reviewer Prompt Template
-
-Use this template when dispatching a code reviewer subagent.
-
-**Purpose:** Review completed work against requirements and code quality standards before it cascades into more work.
-
-```
-Subagent (general-purpose):
-  description: "Review code changes"
-  prompt: |
-    You are a Senior Code Reviewer with expertise in software architecture,
-    design patterns, and best practices. Your job is to review completed work
-    against its plan or requirements and identify issues before they cascade.
-
-    ## What Was Implemented
-
-    [DESCRIPTION]
-
-    ## Requirements / Plan
-
-    [PLAN_OR_REQUIREMENTS]
-
-    ## Git Range to Review
-
-    **Base:** [BASE_SHA]
-    **Head:** [HEAD_SHA]
-
-    ```bash
-    git diff --stat [BASE_SHA]..[HEAD_SHA]
-    git diff [BASE_SHA]..[HEAD_SHA]
-    ```
-
-    ## Read-Only Review
-
-    Your review is read-only on this checkout. Do not mutate the working tree, the index, HEAD, or branch state in any way. Use tools like `git show`, `git diff`, and `git log` to inspect history. If you need a working copy of a different revision, check it out into a separate temporary directory (e.g. `git worktree add /tmp/review-[SHA] [SHA]`) — never move HEAD on this checkout.
-
-    ## What to Check
-
-    **Plan alignment:**
-    - Does the implementation match the plan / requirements?
-    - Are deviations justified improvements, or problematic departures?
-    - Is all planned functionality present?
-
-    **Code quality:**
-    - Clean separation of concerns?
-    - Proper error handling?
-    - Type safety where applicable?
-    - DRY without premature abstraction?
-    - Edge cases handled?
-
-    **Architecture:**
-    - Sound design decisions?
-    - Reasonable scalability and performance?
-    - Security concerns?
-    - Integrates cleanly with surrounding code?
-
-    **Testing:**
-    - Tests verify real behavior, not mocks?
-    - Edge cases covered?
-    - Integration tests where they matter?
-    - All tests passing?
-
-    **Production readiness:**
-    - Migration strategy if schema changed?
-    - Backward compatibility considered?
-    - Documentation complete?
-    - No obvious bugs?
-
-    ## Calibration
-
-    Categorize issues by actual severity. Not everything is Critical.
-    Acknowledge what was done well before listing issues — accurate praise
-    helps the implementer trust the rest of the feedback.
-
-    If you find significant deviations from the plan, flag them specifically
-    so the implementer can confirm whether the deviation was intentional.
-    If you find issues with the plan itself rather than the implementation,
-    say so.
-
-    ## Output Format
-
-    ### Strengths
-    [What's well done? Be specific.]
-
-    ### Issues
-
-    #### Critical (Must Fix)
-    [Bugs, security issues, data loss risks, broken functionality]
-
-    #### Important (Should Fix)
-    [Architecture problems, missing features, poor error handling, test gaps]
-
-    #### Minor (Nice to Have)
-    [Code style, optimization opportunities, documentation polish]
-
-    For each issue:
-    - File:line reference
-    - What's wrong
-    - Why it matters
-    - How to fix (if not obvious)
-
-    ### Recommendations
-    [Improvements for code quality, architecture, or process]
-
-    ### Assessment
-
-    **Ready to merge?** [Yes | No | With fixes]
-
-    **Reasoning:** [1-2 sentence technical assessment]
-
-    ## Critical Rules
-
-    **DO:**
-    - Categorize by actual severity
-    - Be specific (file:line, not vague)
-    - Explain WHY each issue matters
-    - Acknowledge strengths
-    - Give a clear verdict
-
-    **DON'T:**
-    - Say "looks good" without checking
-    - Mark nitpicks as Critical
-    - Give feedback on code you didn't actually read
-    - Be vague ("improve error handling")
-    - Avoid giving a clear verdict
-```
-
-**Placeholders:**
- `[DESCRIPTION]` — brief summary of what was built
- `[PLAN_OR_REQUIREMENTS]` — what it should do (plan file path, task text, or requirements)
- `[BASE_SHA]` — starting commit
- `[HEAD_SHA]` — ending commit
-
-**Reviewer returns:** Strengths, Issues (Critical / Important / Minor), Recommendations, Assessment
-
-## Example Output
-
-```
-### Strengths
- Clean database schema with proper migrations (db.ts:15-42)
- Comprehensive test coverage (18 tests, all edge cases)
- Good error handling with fallbacks (summarizer.ts:85-92)
-
-### Issues
-
-#### Important
-1. **Missing help text in CLI wrapper**
-   - File: index-conversations:1-31
-   - Issue: No --help flag, users won't discover --concurrency
-   - Fix: Add --help case with usage examples
-
-2. **Date validation missing**
-   - File: search.ts:25-27
-   - Issue: Invalid dates silently return no results
-   - Fix: Validate ISO format, throw error with example
-
-#### Minor
-1. **Progress indicators**
-   - File: indexer.ts:130
-   - Issue: No "X of Y" counter for long operations
-   - Impact: Users don't know how long to wait
-
-### Recommendations
- Add progress reporting for user experience
- Consider config file for excluded projects (portability)
-
-### Assessment
-
-**Ready to merge: With fixes**
-
-**Reasoning:** Core implementation is solid with good architecture and tests. Important issues (help text, date validation) are easily fixed and don't affect core functionality.
-```
@@ -1,503 +0,0 @@
---
-name: subagent-driven-development
-description: Use when executing implementation plans with independent tasks in the current session
---
-
-# Subagent-Driven Development
-
-Execute plan by dispatching a fresh implementer subagent per task, a task review (spec compliance + code quality) after each, and a broad whole-branch review at the end.
-
-**Why subagents:** You delegate tasks to specialized agents with isolated context. By precisely crafting their instructions and context, you ensure they stay focused and succeed at their task. They should never inherit your session's context or history — you construct exactly what they need. This also preserves your own context for coordination work.
-
-**Core principle:** Fresh subagent per task + task review (spec + quality) + broad final review = high quality, fast iteration
-
-**Narration:** between tool calls, narrate at most one short line — the
-ledger and the tool results carry the record.
-
-**Continuous execution:** Do not pause to check in with your human partner between tasks. Execute all tasks from the plan without stopping. The only reasons to stop are: BLOCKED status you cannot resolve, ambiguity that genuinely prevents progress, or all tasks complete. "Should I continue?" prompts and progress summaries waste their time — they asked you to execute the plan, so execute it.
-
-## When to Use
-
-```dot
-digraph when_to_use {
-    "Have implementation plan?" [shape=diamond];
-    "Tasks mostly independent?" [shape=diamond];
-    "Stay in this session?" [shape=diamond];
-    "subagent-driven-development" [shape=box];
-    "executing-plans" [shape=box];
-    "Manual execution or brainstorm first" [shape=box];
-
-    "Have implementation plan?" -> "Tasks mostly independent?" [label="yes"];
-    "Have implementation plan?" -> "Manual execution or brainstorm first" [label="no"];
-    "Tasks mostly independent?" -> "Stay in this session?" [label="yes"];
-    "Tasks mostly independent?" -> "Manual execution or brainstorm first" [label="no - tightly coupled"];
-    "Stay in this session?" -> "subagent-driven-development" [label="yes"];
-    "Stay in this session?" -> "executing-plans" [label="no - parallel session"];
-}
-```
-
-**vs. Executing Plans (parallel session):**
- Same session (no context switch)
- Fresh subagent per task (no context pollution)
- Review after each task (spec compliance + code quality), broad review at the end
- Faster iteration (no human-in-loop between tasks)
-
-## The Process
-
-```dot
-digraph process {
-    rankdir=TB;
-
-    subgraph cluster_per_task {
-        label="Per Task";
-        "Dispatch implementer subagent (./implementer-prompt.md)" [shape=box];
-        "Implementer asks questions?" [shape=diamond];
-        "Answer questions, provide context" [shape=box];
-        "Implementer implements, tests, commits, self-reviews" [shape=box];
-        "Generate review package, dispatch task reviewer (./task-reviewer-prompt.md)" [shape=box];
-        "Spec ✅ and quality approved?" [shape=diamond];
-        "Finding conflicts with plan text?" [shape=diamond];
-        "Ask human partner which governs" [shape=box];
-        "Fix round R of 5: R≤3 resume implementer; R≥4 fresh implementer, more capable model" [shape=box];
-        "Dispatch scoped re-review (./re-review-prompt.md)" [shape=box];
-        "All findings addressed?" [shape=diamond];
-        "R = 5?" [shape=diamond];
-        "Adjudicate each open finding" [shape=box];
-        "Any load-bearing finding?" [shape=diamond];
-        "STOP: report BLOCKED to human partner" [shape=box];
-        "Park findings in ledger with rulings" [shape=box];
-        "Append completion to ledger, mark todo complete" [shape=box];
-    }
-
-    "Setup: worktree, ledger check, read plan, pre-flight review" [shape=box];
-    "More tasks remain?" [shape=diamond];
-    "Dispatch final code reviewer (../requesting-code-review/code-reviewer.md)" [shape=box];
-    "Final findings? ONE fix dispatch, one scoped re-review, adjudicate residuals" [shape=box];
-    "Final review clean: delete this plan's workspace" [shape=box];
-    "Use superpowers:finishing-a-development-branch" [shape=box style=filled fillcolor=lightgreen];
-
-    "Setup: worktree, ledger check, read plan, pre-flight review" -> "Dispatch implementer subagent (./implementer-prompt.md)";
-    "Dispatch implementer subagent (./implementer-prompt.md)" -> "Implementer asks questions?";
-    "Implementer asks questions?" -> "Answer questions, provide context" [label="yes"];
-    "Answer questions, provide context" -> "Implementer implements, tests, commits, self-reviews";
-    "Implementer asks questions?" -> "Implementer implements, tests, commits, self-reviews" [label="no"];
-    "Implementer implements, tests, commits, self-reviews" -> "Generate review package, dispatch task reviewer (./task-reviewer-prompt.md)";
-    "Generate review package, dispatch task reviewer (./task-reviewer-prompt.md)" -> "Spec ✅ and quality approved?";
-    "Spec ✅ and quality approved?" -> "Append completion to ledger, mark todo complete" [label="yes"];
-    "Spec ✅ and quality approved?" -> "Finding conflicts with plan text?" [label="no"];
-    "Finding conflicts with plan text?" -> "Ask human partner which governs" [label="yes"];
-    "Ask human partner which governs" -> "Fix round R of 5: R≤3 resume implementer; R≥4 fresh implementer, more capable model";
-    "Finding conflicts with plan text?" -> "Fix round R of 5: R≤3 resume implementer; R≥4 fresh implementer, more capable model" [label="no"];
-    "Fix round R of 5: R≤3 resume implementer; R≥4 fresh implementer, more capable model" -> "Dispatch scoped re-review (./re-review-prompt.md)";
-    "Dispatch scoped re-review (./re-review-prompt.md)" -> "All findings addressed?";
-    "All findings addressed?" -> "Append completion to ledger, mark todo complete" [label="yes"];
-    "All findings addressed?" -> "R = 5?" [label="no"];
-    "R = 5?" -> "Fix round R of 5: R≤3 resume implementer; R≥4 fresh implementer, more capable model" [label="no - next round"];
-    "R = 5?" -> "Adjudicate each open finding" [label="yes - breaker trips"];
-    "Adjudicate each open finding" -> "Any load-bearing finding?";
-    "Any load-bearing finding?" -> "STOP: report BLOCKED to human partner" [label="yes"];
-    "Any load-bearing finding?" -> "Park findings in ledger with rulings" [label="no"];
-    "Park findings in ledger with rulings" -> "Append completion to ledger, mark todo complete";
-    "Append completion to ledger, mark todo complete" -> "More tasks remain?";
-    "More tasks remain?" -> "Dispatch implementer subagent (./implementer-prompt.md)" [label="yes"];
-    "More tasks remain?" -> "Dispatch final code reviewer (../requesting-code-review/code-reviewer.md)" [label="no"];
-    "Dispatch final code reviewer (../requesting-code-review/code-reviewer.md)" -> "Final findings? ONE fix dispatch, one scoped re-review, adjudicate residuals";
-    "Final findings? ONE fix dispatch, one scoped re-review, adjudicate residuals" -> "Final review clean: delete this plan's workspace";
-    "Final review clean: delete this plan's workspace" -> "Use superpowers:finishing-a-development-branch";
-}
-```
-
-## Setup
-
-Ensure the work happens in an isolated workspace: use
-superpowers:using-git-worktrees to create one or verify the existing one.
-Never start implementation on a main/master branch without your human
-partner's explicit consent.
-
-Conversation memory does not survive compaction. In real sessions,
-controllers that lost their place have re-dispatched entire completed task
-sequences — the single most expensive failure observed. Track progress in
-a ledger file, not only in todos.
-
- Each plan owns a workspace: at skill start, run this skill's
-  `scripts/sdd-workspace PLAN_FILE` — it prints the plan's git-ignored
-  directory (`<repo-root>/.superpowers/sdd/<plan-basename>/`), home to
-  every artifact for THIS plan: ledger, briefs, reports, review packages.
-  Another plan's directory is never yours to read or write.
- Check for this plan's ledger at `<workspace>/progress.md`. If its first
-  line names your plan file, tasks with a `Task <N>: complete` line are DONE
-  — do not re-dispatch them; resume at the first task without one. A task
-  whose last line is a fix round is mid-loop: resume the loop at the next
-  round. A ledger whose first line names a different plan file — or a stray
-  ledger at the old flat path `.superpowers/sdd/progress.md` — is another
-  plan's progress: leave it in place and start your own, fresh.
- Create the ledger with its identity as the first line:
-  `# SDD ledger — plan: <plan file path>`.
- The ledger is your recovery map: the commits it names exist in git even
-  when your context no longer remembers creating them. After compaction,
-  trust the ledger and `git log` over your own recollection.
- `git clean -fdx` will destroy the workspace (it's git-ignored scratch); if
-  that happens, recover from `git log`.
-
-Read the plan once, note its context and Global Constraints, and create a
-todo per task.
-
-Before dispatching Task 1, scan the plan once for conflicts:
-
- tasks that contradict each other or the plan's Global Constraints
- anything the plan explicitly mandates that the review rubric treats as a
-  defect (a test that asserts nothing, verbatim duplication of a logic block)
-
-Present everything you find to your human partner as one batched question —
-each finding beside the plan text that mandates it, asking which governs —
-before execution begins, not one interrupt per discovery mid-plan. If the
-scan is clean, proceed without comment. The review loop remains the net for
-conflicts that only emerge from implementation.
-
-## Model Selection
-
-Use the least powerful model that can handle each role to conserve cost and increase speed.
-
-**Mechanical implementation tasks** (isolated functions, clear specs, 1-2 files): use a fast, cheap model. Most implementation tasks are mechanical when the plan is well-specified.
-
-**Integration and judgment tasks** (multi-file coordination, pattern matching, debugging): use a standard model.
-
-**Architecture and design tasks**: use the most capable available model.
-The final whole-branch review is one of these — dispatch it on the most
-capable available model, not the session default.
-
-**Review tasks**: choose the model with the same judgment, scaled to the
-diff's size, complexity, and risk. A small mechanical diff does not need the
-most capable model; a subtle concurrency change does. Scoped re-reviews of
-small fix diffs take a cheap-to-mid tier.
-
-**Fix-loop escalation (rounds 4-5)**: use a model at least one tier above
-the implementer that got stuck.
-
-**Always specify the model explicitly when dispatching a subagent.** An
-omitted model inherits your session's model — often the most capable and
-most expensive — which silently defeats this section.
-
-**Turn count beats token price.** Wall-clock and context cost scale with how
-many turns a subagent takes, and the cheapest models routinely take 2-3× the
-turns on multi-step work — costing more overall. Use a mid-tier model as the
-floor for reviewers and for implementers working from prose descriptions.
-When the task's plan text contains the complete code to write, the
-implementation is transcription plus testing: use the cheapest tier for
-that implementer. Single-file mechanical fixes also take the cheapest tier.
-
-**Task complexity signals (implementation tasks):**
- Touches 1-2 files with a complete spec → cheap model
- Touches multiple files with integration concerns → standard model
- Requires design judgment or broad codebase understanding → most capable model
-
-## The Task Loop
-
-Everything you paste into a dispatch prompt — and everything a subagent
-prints back — stays resident in your context for the rest of the session
-and is re-read on every later turn. Hand artifacts over as files.
-
-### 1. Dispatch the implementer
-
-Record BASE (`git rev-parse HEAD`) before dispatching — the review package
-and fix-round diffs need it.
-
- **Task brief:** before dispatching an implementer, run this skill's
-  `scripts/task-brief PLAN_FILE N` — it extracts the task's full text to a
-  uniquely named file and prints the path. Compose the dispatch so the
-  brief stays the single source of
-  requirements. Your dispatch should contain: (1) one line on where this
-  task fits in the project; (2) the brief path, introduced as "read this
-  first — it is your requirements, with the exact values to use verbatim";
-  (3) interfaces and decisions from earlier tasks that the brief cannot
-  know; (4) your resolution of any ambiguity you noticed in the brief;
-  (5) the report-file path and report contract. Exact values (numbers,
-  magic strings, signatures, test cases) appear only in the brief. Never
-  make a subagent read the whole plan file.
- **Report file:** name the implementer's report file after the brief
-  (brief `…/task-N-brief.md` → report `…/task-N-report.md`) and put it in
-  the dispatch prompt. The implementer writes the full report there and
-  returns only status, commits, a one-line test summary, and concerns.
- A dispatch prompt describes one task, not the session's history. Do not
-  paste accumulated prior-task summaries ("state after Tasks 1-3") into
-  later dispatches — a real session's dispatch hit 42k chars of which 99%
-  was pasted history. A fresh subagent needs its task, the interfaces it
-  touches, and the global constraints. Nothing else.
- If an earlier task parked a finding in the area this task touches, carry
-  a pointer to that ledger entry in the dispatch.
- Record the implementer's agent identity from the dispatch result —
-  fix-loop rounds 1-3 resume this agent.
- Never dispatch multiple implementation subagents in parallel (conflicts).
-
-Template: [implementer-prompt.md](implementer-prompt.md)
-
-### 2. Handle the report
-
-Implementer subagents report one of four statuses. Handle each appropriately:
-
-**DONE:** Generate the review package (`scripts/review-package PLAN_FILE BASE HEAD`, from this skill's directory — it prints the unique file path it wrote; BASE is the commit you recorded before dispatching the implementer — never `HEAD~1`, which silently drops all but the last commit of a multi-commit task), then dispatch the task reviewer with the printed path.
-
-**DONE_WITH_CONCERNS:** The implementer completed the work but flagged doubts. Read the concerns before proceeding. If the concerns are about correctness or scope, address them before review. If they're observations (e.g., "this file is getting large"), note them and proceed to review.
-
-**NEEDS_CONTEXT:** The implementer needs information that wasn't provided. Provide the missing context and re-dispatch.
-
-**BLOCKED:** The implementer cannot complete the task. Assess the blocker:
-1. If it's a context problem, provide more context and re-dispatch with the same model
-2. If the task requires more reasoning, re-dispatch with a more capable model
-3. If the task is too large, break it into smaller pieces
-4. If the plan itself is wrong, escalate to the human
-
-**Never** ignore an escalation or force the same model to retry without changes. If the implementer said it's stuck, something needs to change.
-
-If the implementer asks questions — before starting or mid-task — answer
-clearly and completely, provide additional context if needed, and don't
-rush it into implementation.
-
-### 3. Review the task
-
-Per-task reviews are task-scoped gates. The broad review happens once, at the
-final whole-branch review. Never skip the task review, and never accept a
-report missing either verdict — spec compliance AND task quality are both
-required. Implementer self-review never replaces the task review; both are
-needed.
-
- Hand the reviewer its diff as a file: run this skill's
-  `scripts/review-package PLAN_FILE BASE HEAD` and pass the reviewer the file path
-  it prints (or, without bash: `git log --oneline`, `git diff --stat`,
-  and `git diff -U10` for the range, redirected to one uniquely named
-  file). The output never enters your own context, and the reviewer sees
-  the commit list, stat summary, and full diff with context in one Read
-  call. Use the BASE you recorded before dispatching the implementer —
-  never `HEAD~1`, which silently truncates multi-commit tasks. Never
-  dispatch a task reviewer without a diff file.
- **Reviewer inputs:** the task reviewer gets three paths — the same brief
-  file, the report file, and the review package — plus the global
-  constraints that bind the task.
- The global-constraints block you hand the reviewer is its attention
-  lens. Copy the binding requirements verbatim from the plan's Global
-  Constraints section or the spec: exact values, exact formats, and the
-  stated relationships between components ("same layout as X", "matches
-  Y"). The reviewer's template already carries the process rules (YAGNI,
-  test hygiene, review method) — the constraints block is for what THIS
-  project's spec demands.
- Do not add open-ended directives like "check all uses" or "run race tests
-  if useful" without a concrete, task-specific reason
- Do not ask a reviewer to re-run tests the implementer already ran on the
-  same code — the implementer's report carries the test evidence
- Do not pre-judge findings for the reviewer — never instruct a reviewer to
-  ignore or not flag a specific issue. If you believe a finding would be a
-  false positive, let the reviewer raise it and adjudicate it in the review
-  loop. If the prompt you are writing contains "do not flag," "don't treat X
-  as a defect," "at most Minor," or "the plan chose" — stop: you are
-  pre-judging, usually to spare yourself a review loop.
-The task reviewer may report "⚠️ Cannot verify from diff" items — requirements
-that live in unchanged code or span tasks. These do not block the rest of the
-review, but you must resolve each one yourself before marking the task
-complete: you hold the plan and cross-task context the reviewer
-lacks. If you confirm an item is a real gap, treat it as a failed spec
-review — it enters the fix loop with the other findings.
-
-Template: [task-reviewer-prompt.md](task-reviewer-prompt.md)
-
-### 4. The fix loop
-
-The loop triggers when the review reports spec ❌, any Critical or Important
-finding, or a ⚠️ item you confirmed as a real gap.
-
-Before the loop starts, two routes leave it immediately:
-
- Record Minor findings in the progress ledger as you go
-  (`Task <N>: minor (deferred): <one-liner>`), and point the final
-  whole-branch review at that list so it can triage which must be fixed
-  before merge. A roll-up nobody reads is a silent discard. Minor findings
-  never enter the loop.
- A finding labeled plan-mandated — or any finding that conflicts with
-  what the plan's text requires — is the human's decision, like any plan
-  contradiction: present the finding and the plan text, ask which governs.
-  Do not dismiss the finding because the plan mandates it, and do not
-  dispatch a fix that contradicts the plan without asking.
-Everything else enters the loop. A fix round is one fix dispatch plus one
-scoped re-review. Five rounds maximum per task:
-
-**Rounds 1-3 — resume the original implementer.** Send it the open findings
-verbatim. Its context is intact: it knows the task, the code, and its own
-choices. If your harness cannot send another message to a live subagent,
-dispatch a fresh implementer carrying the brief path, the report-file path,
-and the findings — the report file is the persistent memory either way.
-
-**Rounds 4-5 — dispatch a fresh implementer on a more capable model** (per
-Model Selection), with the brief path, the report-file path, the open
-findings, and this framing: "A prior implementer attempted this task
-[N] times; you own it now. Read the report file for what was tried." A loop
-that survives three resumes usually means the implementer cannot see its
-own problem — fresh eyes and a capability bump in one move.
-
-**Every round, either way:** the implementer fixes, re-runs the tests
-covering the amended code, appends its fix report to the same report file,
-and returns the short contract. Before re-dispatching the reviewer, confirm
-the fix report contains the covering tests, the command run, and the
-output; dispatch the re-review once all three are present. Name the
-covering test files in the fix message — a one-line fix does not need the
-whole suite.
-
-**The re-review is scoped.** Run `scripts/review-package PLAN_FILE FIX_BASE HEAD`
-where FIX_BASE is the head the previous review saw, and dispatch
-[re-review-prompt.md](re-review-prompt.md) with the findings list, the
-brief, the report file, and the printed diff path. The re-reviewer verdicts
-each finding ADDRESSED or NOT ADDRESSED and flags new breakage in the fix
-diff only. New Critical/Important breakage in the fix diff joins the open
-findings list. Out-of-scope observations go to the ledger as deferred
-minors — they never extend the loop.
-
-**After each round,** append to the ledger:
-`Task <N>: fix round <R>/5 (<X> addressed, <Y> open — <finding one-liners>; commits <a7>..<b7>)`
-
-Never fix findings yourself in the controller session — your context stays
-clean for coordination, and controller fixes skip review.
-
-**The breaker.** When round 5's re-review still leaves findings open, stop
-dispatching. Adjudicate each open finding yourself — you hold the plan and
-the cross-task context the reviewer lacks:
-
- **The reviewer is wrong, or the point is contestable:** park it —
-  `Task <N>: parked — <finding> — ruling: <why the code stands>`. The final
-  review sees both sides.
- **Real, but nothing downstream builds on it:** park it the same way, with
-  a ruling that says it's real and deferred.
- **Real and load-bearing** — a later task builds on it, or it reveals a
-  plan defect: STOP. Append `Task <N>: BLOCKED — <reason>` and report to
-  your human partner with the finding, the plan text it collides with, and
-  the fix history. Parking a structural failure lets every dependent task
-  build on it and hands the final review a problem it cannot fix either.
-
-Adjudicate only at the cap. Adjudicating earlier to end a loop is
-pre-judging with a different name. Every adjudication is a ledger entry —
-a silent discard is forbidden.
-
-### 5. Complete the task
-
-When the review comes back clean — or every open finding is parked with a
-ruling at the cap — append the completion line to the ledger in the same
-message as your other bookkeeping:
-
- `Task <N>: complete (commits <base7>..<head7>, review clean)`
- `Task <N>: complete (commits <base7>..<head7>, <K> parked)` after a
-  tripped breaker
-
-Then mark the todo complete and move on. Never move to the next task while
-the review has open Critical/Important issues that are neither fixed nor
-parked-with-ruling at the cap.
-
-## Final Review
-
-The final whole-branch review gets a package too: run
-`scripts/review-package PLAN_FILE MERGE_BASE HEAD` (MERGE_BASE = the commit the
-branch started from, e.g. `git merge-base main HEAD`) and include the
-printed path in the final review dispatch, so the final reviewer reads
-one file instead of re-deriving the branch diff with git commands. Dispatch
-on the most capable available model (see Model Selection), using
-superpowers:requesting-code-review's
-[code-reviewer.md](../requesting-code-review/code-reviewer.md). Point it at
-the ledger's deferred-minor and parked lines so it can triage which must be
-fixed before merge.
-
-If the final whole-branch review returns findings, dispatch ONE fix subagent
-with the complete findings list — not one fixer per finding.
-Per-finding fixers each rebuild context and re-run suites; a real
-session's final-review fix wave cost more than all its tasks combined.
-Then run exactly one scoped re-review of the fix wave
-(`scripts/review-package PLAN_FILE FIX_BASE HEAD` over the fix range,
-[re-review-prompt.md](re-review-prompt.md)).
-Adjudicate any residual findings as in the task loop's breaker: park with
-rulings, or stop on load-bearing ones. There is no second fix wave —
-residual load-bearing findings surface to your human partner when
-finishing-a-development-branch presents the options.
-
-## Finish
-
-When the final whole-branch review is clean and its fixes are merged,
-delete this plan's workspace (`rm -rf <workspace>`) — the git history is
-the record now. Sibling directories belong to other plans; leave them
-alone.
-
-Use superpowers:finishing-a-development-branch.
-
-## Common Rationalizations
-
-| Excuse | Reality |
-|--------|---------|
-| "Close enough on spec compliance" | Reviewer found spec gaps = not done. Fix or hit the cap and adjudicate — those are the only exits. |
-| "I'll fix it myself, dispatching is overhead" | Controller fixes pollute your context and skip review. Resume the implementer. |
-| "One more round will converge" | Past the cap, rounds don't converge — the failure is structural. Adjudicate and route. |
-| "The reviewer will just find something new anyway" | Scoped re-reviews verify fixes; they cannot wander. New findings on untouched code go to the ledger, not the loop. |
-| "This finding is obviously wrong, I'll drop it" | You adjudicate only at the cap, and every ruling is a ledger entry. Silent discards are forbidden. |
-| "The fix was small, skip the re-review" | Unreviewed fixes are how regressions land. Every round ends with a scoped re-review. |
-| "Reviews slow the loop down" | The loop without reviews is just unverified churn. Reviews are the loop's brakes and steering. |
-| "Ledger bookkeeping is overhead" | The ledger is what survives compaction. Controllers without one have re-dispatched entire completed task sequences. |
-
-## Example Workflow
-
-```
-You: I'm using Subagent-Driven Development to execute this plan.
-
-[Setup: worktree verified]
-[Read plan file once: docs/superpowers/plans/feature-plan.md]
-[Resolve workspace: scripts/sdd-workspace docs/superpowers/plans/feature-plan.md — no ledger inside, fresh start]
-[Create todos for all tasks]
-
-Task 1: Hook installation script
-
-[Run task-brief for Task 1; dispatch implementer with brief + report paths + context]
-
-Implementer: "Before I begin - should the hook be installed at user or system level?"
-
-You: "User level (~/.config/superpowers/hooks/)"
-
-Implementer: [Later]
-  - Implemented install-hook command
-  - Added tests, 5/5 passing
-  - Self-review: Found I missed --force flag, added it
-  - Committed
-
-[Run review-package PLAN_FILE BASE HEAD; dispatch task reviewer with the printed path]
-Task reviewer: Spec ✅ - all requirements met, nothing extra.
-  Strengths: Good test coverage, clean. Issues: None. Task quality: Approved.
-
-[Ledger: Task 1: complete (commits a1b2c3d..d4e5f6a, review clean)]
-
-Task 2: Recovery modes
-
-[Run task-brief for Task 2; dispatch implementer with brief + report paths + context]
-
-Implementer: [No questions]
-  - Added verify/repair modes
-  - 8/8 tests passing
-  - Committed
-
-[Run review-package PLAN_FILE BASE HEAD; dispatch task reviewer with the printed path]
-Task reviewer: Spec ❌:
-  - Missing: Progress reporting (spec says "report every 100 items")
-  Issues (Important): Magic number (100)
-
-[Fix round 1: resume the implementer with both findings]
-Implementer: Added progress reporting, extracted PROGRESS_INTERVAL constant.
-  Re-ran test/recovery.test.js — 10/10 passing. Fix report appended.
-
-[Run review-package PLAN_FILE FIX_BASE HEAD; dispatch scoped re-review]
-Re-reviewer: Missing progress reporting — ADDRESSED (src/recovery.js:41).
-  Magic number — ADDRESSED (src/recovery.js:7). New breakage: none.
-  Verdict: all findings addressed.
-
-[Ledger: Task 2: fix round 1/5 (2 addressed, 0 open; commits d4e5f6a..b7c8d9e)]
-[Ledger: Task 2: complete (commits d4e5f6a..b7c8d9e, review clean)]
-
-...
-
-[After all tasks]
-[Run review-package PLAN_FILE MERGE_BASE HEAD; dispatch final code-reviewer, most capable model]
-Final reviewer: All requirements met. Deferred minors triaged: none block merge.
-
-[Delete this plan's workspace — the record now lives in git]
-
-Done! Using superpowers:finishing-a-development-branch.
-```
@@ -1,142 +0,0 @@
-# Implementer Subagent Prompt Template
-
-Use this template when dispatching an implementer subagent.
-
-```
-Subagent (general-purpose):
-  description: "Implement Task N: [task name]"
-  model: [MODEL — REQUIRED: choose per SKILL.md Model Selection; an omitted
-         model silently inherits the session's most expensive one]
-  prompt: |
-    You are implementing Task N: [task name]
-
-    ## Task Description
-
-    Read your task brief first: [BRIEF_FILE]
-    It contains the full task text from the plan.
-
-    ## Context
-
-    [Scene-setting: where this fits, dependencies, architectural context]
-
-    ## Before You Begin
-
-    If you have questions about:
-    - The requirements or acceptance criteria
-    - The approach or implementation strategy
-    - Dependencies or assumptions
-    - Anything unclear in the task description
-
-    **Ask them now.** Raise any concerns before starting work.
-
-    ## Your Job
-
-    Once you're clear on requirements:
-    1. Implement exactly what the task specifies
-    2. Write tests (following TDD if task says to)
-    3. Verify implementation works
-    4. Commit your work
-    5. Self-review (see below)
-    6. Report back
-
-    Work from: [directory]
-
-    **While you work:** If you encounter something unexpected or unclear, **ask questions**.
-    It's always OK to pause and clarify. Don't guess or make assumptions.
-
-    While iterating, run the focused test for what you're changing; run the
-    full suite once before committing, not after every edit.
-
-    ## Code Organization
-
-    You reason best about code you can hold in context at once, and your edits are more
-    reliable when files are focused. Keep this in mind:
-    - Follow the file structure defined in the plan
-    - Each file should have one clear responsibility with a well-defined interface
-    - If a file you're creating is growing beyond the plan's intent, stop and report
-      it as DONE_WITH_CONCERNS — don't split files on your own without plan guidance
-    - If an existing file you're modifying is already large or tangled, work carefully
-      and note it as a concern in your report
-    - In existing codebases, follow established patterns. Improve code you're touching
-      the way a good developer would, but don't restructure things outside your task.
-
-    ## When You're in Over Your Head
-
-    It is always OK to stop and say "this is too hard for me." Bad work is worse than
-    no work. You will not be penalized for escalating.
-
-    **STOP and escalate when:**
-    - The task requires architectural decisions with multiple valid approaches
-    - You need to understand code beyond what was provided and can't find clarity
-    - You feel uncertain about whether your approach is correct
-    - The task involves restructuring existing code in ways the plan didn't anticipate
-    - You've been reading file after file trying to understand the system without progress
-
-    **How to escalate:** Report back with status BLOCKED or NEEDS_CONTEXT. Describe
-    specifically what you're stuck on, what you've tried, and what kind of help you need.
-    The controller can provide more context, re-dispatch with a more capable model,
-    or break the task into smaller pieces.
-
-    ## Before Reporting Back: Self-Review
-
-    Review your work with fresh eyes. Ask yourself:
-
-    **Completeness:**
-    - Did I fully implement everything in the spec?
-    - Did I miss any requirements?
-    - Are there edge cases I didn't handle?
-
-    **Quality:**
-    - Is this my best work?
-    - Are names clear and accurate (match what things do, not how they work)?
-    - Is the code clean and maintainable?
-
-    **Discipline:**
-    - Did I avoid overbuilding (YAGNI)?
-    - Did I only build what was requested?
-    - Did I follow existing patterns in the codebase?
-
-    **Testing:**
-    - Do tests actually verify behavior (not just mock behavior)?
-    - Did I follow TDD if required?
-    - Are tests comprehensive?
-    - Is the test output pristine (no stray warnings or noise)?
-
-    If you find issues during self-review, fix them now before reporting.
-
-    ## After Review Findings
-
-    If the task review finds issues, you will be resumed with the findings.
-    Fix them, re-run the tests that cover the amended code, and append a fix
-    report to your report file: what you changed, the covering tests you
-    ran, the command, and the output. Reviewers will not re-run tests for
-    you — your report is the test evidence. Then reply with the same short
-    status contract as your first report.
-
-    ## Report Format
-
-    Write your full report to [REPORT_FILE]:
-    - What you implemented (or what you attempted, if blocked)
-    - What you tested and test results
-    - **TDD Evidence** (if TDD was required for this task):
-      - RED: command run, relevant failing output before implementation, and why the failure was expected
-      - GREEN: command run and relevant passing output after implementation
-    - Files changed
-    - Self-review findings (if any)
-    - Any issues or concerns
-
-    Then report back with ONLY (under 15 lines — the detail lives in the
-    report file):
-    - **Status:** DONE | DONE_WITH_CONCERNS | BLOCKED | NEEDS_CONTEXT
-    - Commits created (short SHA + subject)
-    - One-line test summary (e.g. "14/14 passing, output pristine")
-    - Your concerns, if any
-    - The report file path
-
-    If BLOCKED or NEEDS_CONTEXT, put the specifics in the final message
-    itself — the controller acts on it directly.
-
-    Use DONE_WITH_CONCERNS if you completed the work but have doubts about correctness.
-    Use BLOCKED if you cannot complete the task. Use NEEDS_CONTEXT if you need
-    information that wasn't provided. Never silently produce work you're unsure about.
-```
@@ -1,106 +0,0 @@
-# Scoped Re-Review Prompt Template
-
-Use this template when dispatching a re-review after a fix round. The
-re-reviewer verifies the findings were addressed and checks the fix diff for
-new breakage. It is not a fresh review — the full review already happened.
-
-**Purpose:** Verify each finding from the previous review was addressed, and
-that the fix itself broke nothing.
-
-```
-Subagent (general-purpose):
-  description: "Re-review Task N fix round R"
-  model: [MODEL — REQUIRED: choose per SKILL.md Model Selection; an omitted
-         model silently inherits the session's most expensive one]
-  prompt: |
-    You are re-reviewing one task's fix round. A previous review produced
-    findings; an implementer has attempted to fix them. Your job is to
-    verdict each finding and inspect the fix diff — nothing else.
-
-    ## The Task
-
-    Read the task brief: [BRIEF_FILE]
-
-    ## The Findings Under Verification
-
-    [FINDINGS]
-
-    ## The Fix
-
-    Read the implementer's report (fix reports are appended at the end):
-    [REPORT_FILE]
-
-    **Fix base:** [FIX_BASE_SHA] (the head the previous review saw)
-    **Head:** [HEAD_SHA]
-    **Diff file:** [DIFF_FILE]
-
-    Read the diff file once — it contains the fix commits, a stat summary,
-    and the fix diff with surrounding context. Do not re-run git commands.
-    If the diff file is missing, fetch the diff yourself:
-    `git diff --stat [FIX_BASE_SHA]..[HEAD_SHA]` and
-    `git diff [FIX_BASE_SHA]..[HEAD_SHA]`.
-
-    Your review is read-only on this checkout. Do not mutate the working
-    tree, the index, HEAD, or branch state in any way.
-
-    ## Scope
-
-    Your scope is the findings list and the fix diff. Verdict every finding.
-    Inspect the fix diff for new problems the fix itself introduced. Do NOT
-    re-review code the fix did not touch: if you notice an issue entirely
-    outside the fix diff, report it under Out-of-Scope Observations — it
-    does not block this task and does not extend the loop. A broad
-    whole-branch review happens after all tasks are complete.
-
-    ## Tests
-
-    The implementer re-ran the tests covering the amended code and appended
-    the results to the report file. Treat the report as unverified claims:
-    confirm the fix report names the covering tests and shows their output,
-    and verify the claims against the diff. Do not re-run the suite to
-    confirm their report. Run a test only when reading the code raises a
-    specific doubt that no existing run answers — and then a focused test,
-    never a package-wide suite.
-
-    ## Output Format
-
-    Your final message is the report itself: begin directly with the first
-    finding's verdict. Every line is a verdict, a finding with file:line,
-    or a check you ran — no preamble, no process narration.
-
-    ### Finding Verdicts
-
-    For each finding in The Findings Under Verification, in order:
-    - **[finding one-liner]** — ADDRESSED | NOT ADDRESSED, with file:line
-      evidence. "Attempted" is not addressed: the specific defect must no
-      longer exist.
-
-    ### New Breakage in the Fix Diff
-
-    Anything the fix itself broke or introduced, with severity
-    (Critical/Important/Minor) and file:line. "None" if clean.
-
-    ### Out-of-Scope Observations
-
-    Issues you noticed entirely outside the fix diff. Non-blocking; the
-    controller ledgers these for the final review. "None" if none.
-
-    ### Verdict
-
-    **Fix round:** [All findings addressed, no new Critical/Important
-    breakage | Findings remain open] — list the open ones.
-```
-
-**Placeholders:**
- `[MODEL]` — REQUIRED: reviewer model per SKILL.md Model Selection; scoped
-  re-reviews of small fix diffs take a cheap-to-mid tier
- `[BRIEF_FILE]` — the task brief file (same file the implementer worked from)
- `[FINDINGS]` — the Critical/Important findings and spec gaps from the
-  previous review, copied verbatim, one per bullet
- `[REPORT_FILE]` — the implementer's report file (fix reports appended)
- `[FIX_BASE_SHA]` — the head the previous review saw
- `[HEAD_SHA]` — current commit
- `[DIFF_FILE]` — the path `scripts/review-package PLAN_FILE FIX_BASE HEAD` printed
-
-**Re-reviewer returns:** per-finding verdicts (ADDRESSED / NOT ADDRESSED),
-new breakage in the fix diff, out-of-scope observations, and a round verdict.
@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# Generate a review package: commit list, stat summary, and the net
-# diff with extended context, written to a file the reviewer reads in one
-# call. Using the recorded per-task BASE (not HEAD~1) keeps multi-commit
-# tasks intact.
-#
-# Usage: review-package PLAN_FILE BASE HEAD [OUTFILE]
-# Default OUTFILE: <repo-root>/.superpowers/sdd/<plan-basename>/review-<base7>..<head7>.diff
-# (named per range, so a re-review after fixes gets a distinct fresh file).
-set -euo pipefail
-
-if [ $# -lt 3 ] || [ $# -gt 4 ]; then
-  echo "usage: review-package PLAN_FILE BASE HEAD [OUTFILE]" >&2
-  exit 2
-fi
-
-plan=$1
-base=$2
-head=$3
-[ -f "$plan" ] || { echo "no such plan file: $plan" >&2; exit 2; }
-
-git rev-parse --verify --quiet "$base" >/dev/null || { echo "bad BASE: $base" >&2; exit 2; }
-git rev-parse --verify --quiet "$head" >/dev/null || { echo "bad HEAD: $head" >&2; exit 2; }
-
-if [ $# -eq 4 ]; then
-  out=$4
-else
-  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace" "$plan")
-  out="$dir/review-$(git rev-parse --short "$base")..$(git rev-parse --short "$head").diff"
-fi
-
-{
-  echo "# Review package: ${base}..${head}"
-  echo
-  echo "## Commits"
-  git log --oneline "${base}..${head}"
-  echo
-  echo "## Files changed"
-  git diff --stat "${base}..${head}"
-  echo
-  echo "## Diff"
-  git diff -U10 "${base}..${head}"
-} > "$out"
-
-commits=$(git rev-list --count "${base}..${head}")
-echo "wrote ${out}: ${commits} commit(s), $(wc -c < "$out" | tr -d ' ') bytes"
@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-# Resolve and ensure the working-tree directory SDD uses for one plan's
-# short-lived artifacts: task briefs, implementer reports, review packages,
-# and the progress ledger. Print the plan directory's absolute path.
-#
-# One directory per plan (.superpowers/sdd/<plan-basename>/) so a follow-up
-# plan in the same working tree can never read or overwrite another plan's
-# artifacts. A stale ledger misread as current progress makes controllers
-# skip whole task sequences — plan-scoping removes that failure structurally.
-#
-# The workspace lives in the working tree (not under .git/) because Claude Code
-# treats .git/ as a protected path and denies agent writes there — which blocks
-# an implementer subagent from writing its report file. A self-ignoring
-# .gitignore at .superpowers/sdd/ keeps every plan's workspace out of
-# `git status` and out of accidental commits without modifying any tracked file.
-#
-# Single source of truth for the workspace location, so task-brief and
-# review-package cannot drift to different directories.
-#
-# Usage: sdd-workspace PLAN_FILE
-set -euo pipefail
-
-if [ $# -ne 1 ]; then
-  echo "usage: sdd-workspace PLAN_FILE" >&2
-  exit 2
-fi
-
-plan=$1
-[ -f "$plan" ] || { echo "no such plan file: $plan" >&2; exit 2; }
-
-slug=$(basename "$plan" .md)
-[ -n "$slug" ] && [ "$slug" != "." ] && [ "$slug" != ".." ] \
-  || { echo "cannot derive a workspace name from: $plan" >&2; exit 2; }
-
-root=$(git rev-parse --show-toplevel)
-base="$root/.superpowers/sdd"
-dir="$base/$slug"
-mkdir -p "$dir"
-printf '*\n' > "$base/.gitignore"
-cd "$dir" && pwd
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-# Extract one task's full text from an implementation plan into a file the
-# implementer reads in one call, so the task text never has to be pasted
-# through the controller's context.
-#
-# Usage: task-brief PLAN_FILE TASK_NUMBER [OUTFILE]
-# Default OUTFILE: <repo-root>/.superpowers/sdd/<plan-basename>/task-<N>-brief.md
-# (per plan and per worktree; concurrent runs of the SAME plan in the same
-# working tree share it).
-set -euo pipefail
-
-if [ $# -lt 2 ] || [ $# -gt 3 ]; then
-  echo "usage: task-brief PLAN_FILE TASK_NUMBER [OUTFILE]" >&2
-  exit 2
-fi
-
-plan=$1
-n=$2
-[ -f "$plan" ] || { echo "no such plan file: $plan" >&2; exit 2; }
-
-if [ $# -eq 3 ]; then
-  out=$3
-else
-  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace" "$plan")
-  out="$dir/task-${n}-brief.md"
-fi
-
-awk -v n="$n" '
-  /^```/ { infence = !infence }
-  !infence && /^#+[ \t]+Task[ \t]+[0-9]+/ {
-    intask = ($0 ~ ("^#+[ \t]+Task[ \t]+" n "([^0-9]|$)"))
-  }
-  intask { print }
-' "$plan" > "$out"
-
-if [ ! -s "$out" ]; then
-  echo "task ${n} not found in ${plan} (no heading matching 'Task ${n}')" >&2
-  exit 3
-fi
-
-echo "wrote ${out}: $(wc -l < "$out" | tr -d ' ') lines"
@@ -1,185 +0,0 @@
-# Task Reviewer Prompt Template
-
-Use this template when dispatching a task reviewer subagent. The reviewer
-reads the task's diff once and returns two verdicts: spec compliance and
-code quality.
-
-**Purpose:** Verify one task's implementation matches its requirements (nothing
-more, nothing less) and is well-built (clean, tested, maintainable)
-
-```
-Subagent (general-purpose):
-  description: "Review Task N (spec + quality)"
-  model: [MODEL — REQUIRED: choose per SKILL.md Model Selection; an omitted
-         model silently inherits the session's most expensive one]
-  prompt: |
-    You are reviewing one task's implementation: first whether it matches its
-    requirements, then whether it is well-built. This is a task-scoped gate,
-    not a merge review — a broad whole-branch review happens separately after
-    all tasks are complete.
-
-    ## What Was Requested
-
-    Read the task brief: [BRIEF_FILE]
-
-    Global constraints from the spec/design that bind this task:
-    [GLOBAL_CONSTRAINTS]
-
-    ## What the Implementer Claims They Built
-
-    Read the implementer's report: [REPORT_FILE]
-
-    ## Diff Under Review
-
-    **Base:** [BASE_SHA]
-    **Head:** [HEAD_SHA]
-    **Diff file:** [DIFF_FILE]
-
-    Read the diff file once — it contains the commit list, a stat summary,
-    and the full diff with surrounding context, and it is your view of the
-    change. The diff's context lines ARE the changed files: do not Read a
-    changed file separately unless a hunk you must judge is cut off
-    mid-function — and say so in your report. Do not re-run git commands.
-    If the diff file is missing, fetch the diff yourself:
-    `git diff --stat [BASE_SHA]..[HEAD_SHA]` and `git diff [BASE_SHA]..[HEAD_SHA]`.
-    Do not crawl the broader codebase. Inspect code outside the diff only
-    to evaluate a concrete risk you can name — one focused check per named
-    risk, and name both the risk and what you checked in your report.
-    Cross-cutting changes are legitimate named risks: if the diff changes
-    lock ordering, a function or API contract, or shared mutable state,
-    checking the call sites is the right method.
-
-    Your review is read-only on this checkout. Do not mutate the working
-    tree, the index, HEAD, or branch state in any way.
-
-    ## Do Not Trust the Report
-
-    Treat the implementer's report as unverified claims about the code. It
-    may be incomplete, inaccurate, or optimistic. Verify the claims against
-    the diff. Design rationales in the report are claims too: "left it per
-    YAGNI," "kept it simple deliberately," or any other justification is the
-    implementer grading their own work. Judge the code on its merits — a
-    stated rationale never downgrades a finding's severity.
-
-    ## Tests
-
-    The implementer already ran the tests and reported results with TDD
-    evidence for exactly this code. Do not re-run the suite to confirm their
-    report. Run a test only when reading the code raises a specific doubt
-    that no existing run answers — and then a focused test, never a
-    package-wide suite, race detector run, or repeated/high-count loop. If
-    heavy validation seems warranted, recommend it in your report instead of
-    running it. If you cannot run commands in this environment, name the
-    test you would run.
-
-    Warnings or other noise in the implementer's reported test output are
-    findings — test output should be pristine.
-
-    ## Part 1: Spec Compliance
-
-    Compare the diff against What Was Requested:
-
-    - **Missing:** requirements they skipped, missed, or claimed without
-      implementing
-    - **Extra:** features that weren't requested, over-engineering, unneeded
-      "nice to haves"
-    - **Misunderstood:** right feature built the wrong way, wrong problem
-      solved
-
-    If a requirement cannot be verified from this diff alone (it lives in
-    unchanged code or spans tasks), report it as a ⚠️ item instead of
-    broadening your search.
-
-    ## Part 2: Code Quality
-
-    **Code quality:**
-    - Clean separation of concerns?
-    - Proper error handling?
-    - DRY without premature abstraction?
-    - Edge cases handled?
-
-    **Tests:**
-    - Do the new and changed tests verify real behavior, not mocks?
-    - Are the task's edge cases covered?
-
-    **Structure:**
-    - Does each file have one clear responsibility with a well-defined interface?
-    - Are units decomposed so they can be understood and tested independently?
-    - Is the implementation following the file structure from the plan?
-    - Did this change create new files that are already large, or
-      significantly grow existing files? (Don't flag pre-existing file
-      sizes — focus on what this change contributed.)
-
-    Your report should point at evidence: file:line references for every
-    finding and for any check you would otherwise answer with a bare
-    "yes." A tight report that cites lines gives the controller everything
-    it needs.
-
-    Your final message is the report itself: begin directly with the
-    spec-compliance verdict. Every line is a verdict, a finding with
-    file:line, or a check you ran — no preamble, no process narration,
-    no closing summary.
-
-    ## Calibration
-
-    Categorize issues by actual severity. Not everything is Critical.
-    Important means this task cannot be trusted until it is fixed: incorrect
-    or fragile behavior, a missed requirement, or maintainability damage you
-    would block a merge over — verbatim duplication of a logic block,
-    swallowed errors, tests that assert nothing. "Coverage could be broader"
-    and polish suggestions are Minor.
-    If the plan or brief explicitly mandates something this rubric calls a
-    defect (a test that asserts nothing, verbatim duplication of a logic
-    block), that IS a finding — report it as Important, labeled
-    plan-mandated. The plan's authorship does not grade its own work; the
-    human decides.
-    Acknowledge what was done well before listing issues — accurate praise
-    helps the implementer trust the rest of the feedback.
-
-    ## Output Format
-
-    ### Spec Compliance
-
-    - ✅ Spec compliant | ❌ Issues found: [what's missing/extra/misunderstood,
-      with file:line references]
-    - ⚠️ Cannot verify from diff: [requirements you could not verify from the
-      diff alone, and what the controller should check — report alongside the
-      ✅/❌ verdict for everything you could verify]
-
-    ### Strengths
-    [What's well done? Be specific.]
-
-    ### Issues
-
-    #### Critical (Must Fix)
-    #### Important (Should Fix)
-    #### Minor (Nice to Have)
-
-    For each issue: file:line, what's wrong, why it matters, how to fix
-    (if not obvious).
-
-    ### Assessment
-
-    **Task quality:** [Approved | Needs fixes]
-
-    **Reasoning:** [1-2 sentence technical assessment]
-```
-
-**Placeholders:**
- `[MODEL]` — REQUIRED: reviewer model per SKILL.md Model Selection
- `[BRIEF_FILE]` — REQUIRED: the task brief file (`scripts/task-brief PLAN N`
-  prints the path; same file the implementer worked from)
- `[GLOBAL_CONSTRAINTS]` — the binding requirements copied verbatim from
-  the plan's Global Constraints section or the spec: exact values, formats,
-  and stated relationships between components (not process rules — those
-  are already in this template)
- `[REPORT_FILE]` — REQUIRED: the file the implementer wrote its detailed
-  report to
- `[BASE_SHA]` — commit before this task
- `[HEAD_SHA]` — current commit
- `[DIFF_FILE]` — REQUIRED: the path the controller wrote the review
-  package to (`scripts/review-package PLAN_FILE BASE HEAD` prints the unique
-  path it wrote; the package never enters the controller's context)
-
-**Reviewer returns:** Spec Compliance verdict (✅/❌/⚠️), Strengths, Issues
-(Critical/Important/Minor), Task quality verdict
@@ -1,119 +0,0 @@
-# Creation Log: Systematic Debugging Skill
-
-Reference example of extracting, structuring, and bulletproofing a critical skill.
-
-## Source Material
-
-Extracted debugging framework from `~/.claude/CLAUDE.md`:
- 4-phase systematic process (Investigation → Pattern Analysis → Hypothesis → Implementation)
- Core mandate: ALWAYS find root cause, NEVER fix symptoms
- Rules designed to resist time pressure and rationalization
-
-## Extraction Decisions
-
-**What to include:**
- Complete 4-phase framework with all rules
- Anti-shortcuts ("NEVER fix symptom", "STOP and re-analyze")
- Pressure-resistant language ("even if faster", "even if I seem in a hurry")
- Concrete steps for each phase
-
-**What to leave out:**
- Project-specific context
- Repetitive variations of same rule
- Narrative explanations (condensed to principles)
-
-## Structure Following skill-creation/SKILL.md
-
-1. **Rich when_to_use** - Included symptoms and anti-patterns
-2. **Type: technique** - Concrete process with steps
-3. **Keywords** - "root cause", "symptom", "workaround", "debugging", "investigation"
-4. **Flowchart** - Decision point for "fix failed" → re-analyze vs add more fixes
-5. **Phase-by-phase breakdown** - Scannable checklist format
-6. **Anti-patterns section** - What NOT to do (critical for this skill)
-
-## Bulletproofing Elements
-
-Framework designed to resist rationalization under pressure:
-
-### Language Choices
- "ALWAYS" / "NEVER" (not "should" / "try to")
- "even if faster" / "even if I seem in a hurry"
- "STOP and re-analyze" (explicit pause)
- "Don't skip past" (catches the actual behavior)
-
-### Structural Defenses
- **Phase 1 required** - Can't skip to implementation
- **Single hypothesis rule** - Forces thinking, prevents shotgun fixes
- **Explicit failure mode** - "IF your first fix doesn't work" with mandatory action
- **Anti-patterns section** - Shows exactly what shortcuts look like
-
-### Redundancy
- Root cause mandate in overview + when_to_use + Phase 1 + implementation rules
- "NEVER fix symptom" appears 4 times in different contexts
- Each phase has explicit "don't skip" guidance
-
-## Testing Approach
-
-Created 4 validation tests following skills/meta/testing-skills-with-subagents:
-
-### Test 1: Academic Context (No Pressure)
- Simple bug, no time pressure
- **Result:** Perfect compliance, complete investigation
-
-### Test 2: Time Pressure + Obvious Quick Fix
- User "in a hurry", symptom fix looks easy
- **Result:** Resisted shortcut, followed full process, found real root cause
-
-### Test 3: Complex System + Uncertainty
- Multi-layer failure, unclear if can find root cause
- **Result:** Systematic investigation, traced through all layers, found source
-
-### Test 4: Failed First Fix
- Hypothesis doesn't work, temptation to add more fixes
- **Result:** Stopped, re-analyzed, formed new hypothesis (no shotgun)
-
-**All tests passed.** No rationalizations found.
-
-## Iterations
-
-### Initial Version
- Complete 4-phase framework
- Anti-patterns section
- Flowchart for "fix failed" decision
-
-### Enhancement 1: TDD Reference
- Added link to skills/testing/test-driven-development
- Note explaining TDD's "simplest code" ≠ debugging's "root cause"
- Prevents confusion between methodologies
-
-## Final Outcome
-
-Bulletproof skill that:
- ✅ Clearly mandates root cause investigation
- ✅ Resists time pressure rationalization
- ✅ Provides concrete steps for each phase
- ✅ Shows anti-patterns explicitly
- ✅ Tested under multiple pressure scenarios
- ✅ Clarifies relationship to TDD
- ✅ Ready for use
-
-## Key Insight
-
-**Most important bulletproofing:** Anti-patterns section showing exact shortcuts that feel justified in the moment. When Claude thinks "I'll just add this one quick fix", seeing that exact pattern listed as wrong creates cognitive friction.
-
-## Usage Example
-
-When encountering a bug:
-1. Load skill: skills/debugging/systematic-debugging
-2. Read overview (10 sec) - reminded of mandate
-3. Follow Phase 1 checklist - forced investigation
-4. If tempted to skip - see anti-pattern, stop
-5. Complete all phases - root cause found
-
-**Time investment:** 5-10 minutes
-**Time saved:** Hours of symptom-whack-a-mole
-
---
-
-*Created: 2025-10-03*
-*Purpose: Reference example for skill extraction and bulletproofing*
@@ -1,283 +0,0 @@
---
-name: systematic-debugging
-description: Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
---
-
-# Systematic Debugging
-
-## Overview
-
-**Core principle:** ALWAYS find root cause before attempting fixes. Symptom fixes are failure.
-
-**Violating the letter of this process is violating the spirit of debugging.**
-
-## The Iron Law
-
-```
-NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST
-```
-
-If you haven't completed Phase 1, you cannot propose fixes.
-
-## When to Use
-
-Use for ANY technical issue:
- Test failures
- Bugs in production
- Unexpected behavior
- Performance problems
- Build failures
- Integration issues
-
-**Use this ESPECIALLY when:**
- Under time pressure (emergencies make guessing tempting)
- "Just one quick fix" seems obvious
- You've already tried multiple fixes
- Previous fix didn't work
- You don't fully understand the issue
-
-**Don't skip when:**
- Issue seems simple (simple bugs have root causes too)
- You're in a hurry (rushing guarantees rework)
- Manager wants it fixed NOW (systematic is faster than thrashing)
-
-## The Four Phases
-
-You MUST complete each phase before proceeding to the next.
-
-### Phase 1: Root Cause Investigation
-
-**BEFORE attempting ANY fix:**
-
-1. **Read Error Messages Carefully**
-   - Don't skip past errors or warnings
-   - They often contain the exact solution
-   - Read stack traces completely
-   - Note line numbers, file paths, error codes
-
-2. **Reproduce Consistently**
-   - Can you trigger it reliably?
-   - What are the exact steps?
-   - Does it happen every time?
-   - If not reproducible → gather more data, don't guess
-
-3. **Check Recent Changes**
-   - What changed that could cause this?
-   - Git diff, recent commits
-   - New dependencies, config changes
-   - Environmental differences
-
-4. **Gather Evidence in Multi-Component Systems**
-
-   **WHEN system has multiple components (CI → build → signing, API → service → database):**
-
-   **BEFORE proposing fixes, add diagnostic instrumentation:**
-   ```
-   For EACH component boundary:
-     - Log what data enters component
-     - Log what data exits component
-     - Verify environment/config propagation
-     - Check state at each layer
-
-   Run once to gather evidence showing WHERE it breaks
-   THEN analyze evidence to identify failing component
-   THEN investigate that specific component
-   ```
-
-   **Example (multi-layer system):**
-   ```bash
-   # Layer 1: Workflow
-   echo "=== Secrets available in workflow: ==="
-   echo "IDENTITY: ${IDENTITY:+SET}${IDENTITY:-UNSET}"
-
-   # Layer 2: Build script
-   echo "=== Env vars in build script: ==="
-   env | grep IDENTITY || echo "IDENTITY not in environment"
-
-   # Layer 3: Signing script
-   echo "=== Keychain state: ==="
-   security list-keychains
-   security find-identity -v
-
-   # Layer 4: Actual signing
-   codesign --sign "$IDENTITY" --verbose=4 "$APP"
-   ```
-
-   **This reveals:** Which layer fails (secrets → workflow ✓, workflow → build ✗)
-
-5. **Trace Data Flow**
-
-   **WHEN error is deep in call stack:**
-
-   See `root-cause-tracing.md` in this directory for the complete backward tracing technique.
-
-   **Quick version:**
-   - Where does bad value originate?
-   - What called this with bad value?
-   - Keep tracing up until you find the source
-   - Fix at source, not at symptom
-
-### Phase 2: Pattern Analysis
-
-**Find the pattern before fixing:**
-
-1. **Find Working Examples**
-   - Locate similar working code in same codebase
-   - What works that's similar to what's broken?
-
-2. **Compare Against References**
-   - If implementing pattern, read reference implementation COMPLETELY
-   - Don't skim - read every line
-   - Understand the pattern fully before applying
-
-3. **Identify Differences**
-   - What's different between working and broken?
-   - List every difference, however small
-   - Don't assume "that can't matter"
-
-4. **Understand Dependencies**
-   - What other components does this need?
-   - What settings, config, environment?
-   - What assumptions does it make?
-
-### Phase 3: Hypothesis and Testing
-
-**Scientific method:**
-
-1. **Form Single Hypothesis**
-   - State clearly: "I think X is the root cause because Y"
-   - Write it down
-   - Be specific, not vague
-
-2. **Test Minimally**
-   - Make the SMALLEST possible change to test hypothesis
-   - One variable at a time
-   - Don't fix multiple things at once
-
-3. **Verify Before Continuing**
-   - Did it work? Yes → Phase 4
-   - Didn't work? Form NEW hypothesis
-   - DON'T add more fixes on top
-
-4. **When You Don't Know**
-   - Say "I don't understand X"
-   - Don't pretend to know
-   - Ask for help
-   - Research more
-
-### Phase 4: Implementation
-
-**Fix the root cause, not the symptom:**
-
-1. **Create Failing Test Case**
-   - Simplest possible reproduction
-   - Automated test if possible
-   - One-off test script if no framework
-   - MUST have before fixing
-   - Use the `superpowers:test-driven-development` skill for writing proper failing tests
-
-2. **Implement Single Fix**
-   - Address the root cause identified
-   - ONE change at a time
-   - No "while I'm here" improvements
-   - No bundled refactoring
-
-3. **Verify Fix**
-   - Test passes now?
-   - No other tests broken?
-   - Issue actually resolved?
-   - Use the `superpowers:verification-before-completion` skill before claiming success
-
-4. **If Fix Doesn't Work**
-   - STOP
-   - Count: How many fixes have you tried?
-   - If < 3: Return to Phase 1, re-analyze with new information
-   - **If ≥ 3: STOP and question the architecture (step 5 below)**
-   - DON'T attempt Fix #4 without architectural discussion
-
-5. **If 3+ Fixes Failed: Question Architecture**
-
-   **Pattern indicating architectural problem:**
-   - Each fix reveals new shared state/coupling/problem in different place
-   - Fixes require "massive refactoring" to implement
-   - Each fix creates new symptoms elsewhere
-
-   **STOP and question fundamentals:**
-   - Is this pattern fundamentally sound?
-   - Are we "sticking with it through sheer inertia"?
-   - Should we refactor architecture vs. continue fixing symptoms?
-
-   **Discuss with your human partner before attempting more fixes**
-
-   This is NOT a failed hypothesis - this is a wrong architecture.
-
-## Red Flags - STOP and Follow Process
-
-If you catch yourself thinking:
- "Quick fix for now, investigate later"
- "Just try changing X and see if it works"
- "Add multiple changes, run tests"
- "Skip the test, I'll manually verify"
- "It's probably X, let me fix that"
- "I don't fully understand but this might work"
- "Pattern says X but I'll adapt it differently"
- "Here are the main problems: [lists fixes without investigation]"
- Proposing solutions before tracing data flow
- **"One more fix attempt" (when already tried 2+)**
- **Each fix reveals new problem in different place**
-
-**ALL of these mean: STOP. Return to Phase 1.**
-
-**If 3+ fixes failed:** Question the architecture (see Phase 4.5)
-
-## your human partner's Signals You're Doing It Wrong
-
-**Watch for these redirections:**
- "Is that not happening?" - You assumed without verifying
- "Will it show us...?" - You should have added evidence gathering
- "Stop guessing" - You're proposing fixes without understanding
- "Ultra-think this" - Question fundamentals, not just symptoms
- "We're stuck?" (frustrated) - Your approach isn't working
-
-**When you see these:** STOP. Return to Phase 1.
-
-## Common Rationalizations
-
-| Excuse | Reality |
-|--------|---------|
-| "Issue is simple, don't need process" | Simple issues have root causes too. Process is fast for simple bugs. |
-| "Emergency, no time for process" | Systematic debugging is FASTER than guess-and-check thrashing. |
-| "Just try this first, then investigate" | First fix sets the pattern. Do it right from the start. |
-| "I'll write test after confirming fix works" | Untested fixes don't stick. Test first proves it. |
-| "Multiple fixes at once saves time" | Can't isolate what worked. Causes new bugs. |
-| "Reference too long, I'll adapt the pattern" | Partial understanding guarantees bugs. Read it completely. |
-| "I see the problem, let me fix it" | Seeing symptoms ≠ understanding root cause. |
-| "One more fix attempt" (after 2+ failures) | 3+ failures = architectural problem. Question pattern, don't fix again. |
-
-## Quick Reference
-
-| Phase | Key Activities | Success Criteria |
-|-------|---------------|------------------|
-| **1. Root Cause** | Read errors, reproduce, check changes, gather evidence | Understand WHAT and WHY |
-| **2. Pattern** | Find working examples, compare | Identify differences |
-| **3. Hypothesis** | Form theory, test minimally | Confirmed or new hypothesis |
-| **4. Implementation** | Create test, fix, verify | Bug resolved, tests pass |
-
-## When Process Reveals "No Root Cause"
-
-If systematic investigation reveals issue is truly environmental, timing-dependent, or external:
-
-1. You've completed the process
-2. Document what you investigated
-3. Implement appropriate handling (retry, timeout, error message)
-4. Add monitoring/logging for future investigation
-
-**But:** 95% of "no root cause" cases are incomplete investigation.
-
-## Supporting Techniques
-
-These techniques are part of systematic debugging and available in this directory:
-
- **`root-cause-tracing.md`** - Trace bugs backward through call stack to find original trigger
- **`defense-in-depth.md`** - Add validation at multiple layers after finding root cause
- **`condition-based-waiting.md`** - Replace arbitrary timeouts with condition polling
@@ -1,158 +0,0 @@
-// Complete implementation of condition-based waiting utilities
-// From: Lace test infrastructure improvements (2025-10-03)
-// Context: Fixed 15 flaky tests by replacing arbitrary timeouts
-
-import type { ThreadManager } from '~/threads/thread-manager';
-import type { LaceEvent, LaceEventType } from '~/threads/types';
-
-/**
- * Wait for a specific event type to appear in thread
- *
- * @param threadManager - The thread manager to query
- * @param threadId - Thread to check for events
- * @param eventType - Type of event to wait for
- * @param timeoutMs - Maximum time to wait (default 5000ms)
- * @returns Promise resolving to the first matching event
- *
- * Example:
- *   await waitForEvent(threadManager, agentThreadId, 'TOOL_RESULT');
- */
-export function waitForEvent(
-  threadManager: ThreadManager,
-  threadId: string,
-  eventType: LaceEventType,
-  timeoutMs = 5000
-): Promise<LaceEvent> {
-  return new Promise((resolve, reject) => {
-    const startTime = Date.now();
-
-    const check = () => {
-      const events = threadManager.getEvents(threadId);
-      const event = events.find((e) => e.type === eventType);
-
-      if (event) {
-        resolve(event);
-      } else if (Date.now() - startTime > timeoutMs) {
-        reject(new Error(`Timeout waiting for ${eventType} event after ${timeoutMs}ms`));
-      } else {
-        setTimeout(check, 10); // Poll every 10ms for efficiency
-      }
-    };
-
-    check();
-  });
-}
-
-/**
- * Wait for a specific number of events of a given type
- *
- * @param threadManager - The thread manager to query
- * @param threadId - Thread to check for events
- * @param eventType - Type of event to wait for
- * @param count - Number of events to wait for
- * @param timeoutMs - Maximum time to wait (default 5000ms)
- * @returns Promise resolving to all matching events once count is reached
- *
- * Example:
- *   // Wait for 2 AGENT_MESSAGE events (initial response + continuation)
- *   await waitForEventCount(threadManager, agentThreadId, 'AGENT_MESSAGE', 2);
- */
-export function waitForEventCount(
-  threadManager: ThreadManager,
-  threadId: string,
-  eventType: LaceEventType,
-  count: number,
-  timeoutMs = 5000
-): Promise<LaceEvent[]> {
-  return new Promise((resolve, reject) => {
-    const startTime = Date.now();
-
-    const check = () => {
-      const events = threadManager.getEvents(threadId);
-      const matchingEvents = events.filter((e) => e.type === eventType);
-
-      if (matchingEvents.length >= count) {
-        resolve(matchingEvents);
-      } else if (Date.now() - startTime > timeoutMs) {
-        reject(
-          new Error(
-            `Timeout waiting for ${count} ${eventType} events after ${timeoutMs}ms (got ${matchingEvents.length})`
-          )
-        );
-      } else {
-        setTimeout(check, 10);
-      }
-    };
-
-    check();
-  });
-}
-
-/**
- * Wait for an event matching a custom predicate
- * Useful when you need to check event data, not just type
- *
- * @param threadManager - The thread manager to query
- * @param threadId - Thread to check for events
- * @param predicate - Function that returns true when event matches
- * @param description - Human-readable description for error messages
- * @param timeoutMs - Maximum time to wait (default 5000ms)
- * @returns Promise resolving to the first matching event
- *
- * Example:
- *   // Wait for TOOL_RESULT with specific ID
- *   await waitForEventMatch(
- *     threadManager,
- *     agentThreadId,
- *     (e) => e.type === 'TOOL_RESULT' && e.data.id === 'call_123',
- *     'TOOL_RESULT with id=call_123'
- *   );
- */
-export function waitForEventMatch(
-  threadManager: ThreadManager,
-  threadId: string,
-  predicate: (event: LaceEvent) => boolean,
-  description: string,
-  timeoutMs = 5000
-): Promise<LaceEvent> {
-  return new Promise((resolve, reject) => {
-    const startTime = Date.now();
-
-    const check = () => {
-      const events = threadManager.getEvents(threadId);
-      const event = events.find(predicate);
-
-      if (event) {
-        resolve(event);
-      } else if (Date.now() - startTime > timeoutMs) {
-        reject(new Error(`Timeout waiting for ${description} after ${timeoutMs}ms`));
-      } else {
-        setTimeout(check, 10);
-      }
-    };
-
-    check();
-  });
-}
-
-// Usage example from actual debugging session:
-//
-// BEFORE (flaky):
-// ---------------
-// const messagePromise = agent.sendMessage('Execute tools');
-// await new Promise(r => setTimeout(r, 300)); // Hope tools start in 300ms
-// agent.abort();
-// await messagePromise;
-// await new Promise(r => setTimeout(r, 50));  // Hope results arrive in 50ms
-// expect(toolResults.length).toBe(2);         // Fails randomly
-//
-// AFTER (reliable):
-// ----------------
-// const messagePromise = agent.sendMessage('Execute tools');
-// await waitForEventCount(threadManager, threadId, 'TOOL_CALL', 2); // Wait for tools to start
-// agent.abort();
-// await messagePromise;
-// await waitForEventCount(threadManager, threadId, 'TOOL_RESULT', 2); // Wait for results
-// expect(toolResults.length).toBe(2); // Always succeeds
-//
-// Result: 60% pass rate → 100%, 40% faster execution
@@ -1,115 +0,0 @@
-# Condition-Based Waiting
-
-## Overview
-
-Flaky tests often guess at timing with arbitrary delays. This creates race conditions where tests pass on fast machines but fail under load or in CI.
-
-**Core principle:** Wait for the actual condition you care about, not a guess about how long it takes.
-
-## When to Use
-
-```dot
-digraph when_to_use {
-    "Test uses setTimeout/sleep?" [shape=diamond];
-    "Testing timing behavior?" [shape=diamond];
-    "Document WHY timeout needed" [shape=box];
-    "Use condition-based waiting" [shape=box];
-
-    "Test uses setTimeout/sleep?" -> "Testing timing behavior?" [label="yes"];
-    "Testing timing behavior?" -> "Document WHY timeout needed" [label="yes"];
-    "Testing timing behavior?" -> "Use condition-based waiting" [label="no"];
-}
-```
-
-**Use when:**
- Tests have arbitrary delays (`setTimeout`, `sleep`, `time.sleep()`)
- Tests are flaky (pass sometimes, fail under load)
- Tests timeout when run in parallel
- Waiting for async operations to complete
-
-**Don't use when:**
- Testing actual timing behavior (debounce, throttle intervals)
- Always document WHY if using arbitrary timeout
-
-## Core Pattern
-
-```typescript
-// ❌ BEFORE: Guessing at timing
-await new Promise(r => setTimeout(r, 50));
-const result = getResult();
-expect(result).toBeDefined();
-
-// ✅ AFTER: Waiting for condition
-await waitFor(() => getResult() !== undefined);
-const result = getResult();
-expect(result).toBeDefined();
-```
-
-## Quick Patterns
-
-| Scenario | Pattern |
-|----------|---------|
-| Wait for event | `waitFor(() => events.find(e => e.type === 'DONE'))` |
-| Wait for state | `waitFor(() => machine.state === 'ready')` |
-| Wait for count | `waitFor(() => items.length >= 5)` |
-| Wait for file | `waitFor(() => fs.existsSync(path))` |
-| Complex condition | `waitFor(() => obj.ready && obj.value > 10)` |
-
-## Implementation
-
-Generic polling function:
-```typescript
-async function waitFor<T>(
-  condition: () => T | undefined | null | false,
-  description: string,
-  timeoutMs = 5000
-): Promise<T> {
-  const startTime = Date.now();
-
-  while (true) {
-    const result = condition();
-    if (result) return result;
-
-    if (Date.now() - startTime > timeoutMs) {
-      throw new Error(`Timeout waiting for ${description} after ${timeoutMs}ms`);
-    }
-
-    await new Promise(r => setTimeout(r, 10)); // Poll every 10ms
-  }
-}
-```
-
-See `condition-based-waiting-example.ts` in this directory for complete implementation with domain-specific helpers (`waitForEvent`, `waitForEventCount`, `waitForEventMatch`) from actual debugging session.
-
-## Common Mistakes
-
-**❌ Polling too fast:** `setTimeout(check, 1)` - wastes CPU
-**✅ Fix:** Poll every 10ms
-
-**❌ No timeout:** Loop forever if condition never met
-**✅ Fix:** Always include timeout with clear error
-
-**❌ Stale data:** Cache state before loop
-**✅ Fix:** Call getter inside loop for fresh data
-
-## When Arbitrary Timeout IS Correct
-
-```typescript
-// Tool ticks every 100ms - need 2 ticks to verify partial output
-await waitForEvent(manager, 'TOOL_STARTED'); // First: wait for condition
-await new Promise(r => setTimeout(r, 200));   // Then: wait for timed behavior
-// 200ms = 2 ticks at 100ms intervals - documented and justified
-```
-
-**Requirements:**
-1. First wait for triggering condition
-2. Based on known timing (not guessing)
-3. Comment explaining WHY
-
-## Real-World Impact
-
-From debugging session (2025-10-03):
- Fixed 15 flaky tests across 3 files
- Pass rate: 60% → 100%
- Execution time: 40% faster
- No more race conditions
@@ -1,122 +0,0 @@
-# Defense-in-Depth Validation
-
-## Overview
-
-When you fix a bug caused by invalid data, adding validation at one place feels sufficient. But that single check can be bypassed by different code paths, refactoring, or mocks.
-
-**Core principle:** Validate at EVERY layer data passes through. Make the bug structurally impossible.
-
-## Why Multiple Layers
-
-Single validation: "We fixed the bug"
-Multiple layers: "We made the bug impossible"
-
-Different layers catch different cases:
- Entry validation catches most bugs
- Business logic catches edge cases
- Environment guards prevent context-specific dangers
- Debug logging helps when other layers fail
-
-## The Four Layers
-
-### Layer 1: Entry Point Validation
-**Purpose:** Reject obviously invalid input at API boundary
-
-```typescript
-function createProject(name: string, workingDirectory: string) {
-  if (!workingDirectory || workingDirectory.trim() === '') {
-    throw new Error('workingDirectory cannot be empty');
-  }
-  if (!existsSync(workingDirectory)) {
-    throw new Error(`workingDirectory does not exist: ${workingDirectory}`);
-  }
-  if (!statSync(workingDirectory).isDirectory()) {
-    throw new Error(`workingDirectory is not a directory: ${workingDirectory}`);
-  }
-  // ... proceed
-}
-```
-
-### Layer 2: Business Logic Validation
-**Purpose:** Ensure data makes sense for this operation
-
-```typescript
-function initializeWorkspace(projectDir: string, sessionId: string) {
-  if (!projectDir) {
-    throw new Error('projectDir required for workspace initialization');
-  }
-  // ... proceed
-}
-```
-
-### Layer 3: Environment Guards
-**Purpose:** Prevent dangerous operations in specific contexts
-
-```typescript
-async function gitInit(directory: string) {
-  // In tests, refuse git init outside temp directories
-  if (process.env.NODE_ENV === 'test') {
-    const normalized = normalize(resolve(directory));
-    const tmpDir = normalize(resolve(tmpdir()));
-
-    if (!normalized.startsWith(tmpDir)) {
-      throw new Error(
-        `Refusing git init outside temp dir during tests: ${directory}`
-      );
-    }
-  }
-  // ... proceed
-}
-```
-
-### Layer 4: Debug Instrumentation
-**Purpose:** Capture context for forensics
-
-```typescript
-async function gitInit(directory: string) {
-  const stack = new Error().stack;
-  logger.debug('About to git init', {
-    directory,
-    cwd: process.cwd(),
-    stack,
-  });
-  // ... proceed
-}
-```
-
-## Applying the Pattern
-
-When you find a bug:
-
-1. **Trace the data flow** - Where does bad value originate? Where used?
-2. **Map all checkpoints** - List every point data passes through
-3. **Add validation at each layer** - Entry, business, environment, debug
-4. **Test each layer** - Try to bypass layer 1, verify layer 2 catches it
-
-## Example from Session
-
-Bug: Empty `projectDir` caused `git init` in source code
-
-**Data flow:**
-1. Test setup → empty string
-2. `Project.create(name, '')`
-3. `WorkspaceManager.createWorkspace('')`
-4. `git init` runs in `process.cwd()`
-
-**Four layers added:**
- Layer 1: `Project.create()` validates not empty/exists/writable
- Layer 2: `WorkspaceManager` validates projectDir not empty
- Layer 3: `WorktreeManager` refuses git init outside tmpdir in tests
- Layer 4: Stack trace logging before git init
-
-**Result:** All 1847 tests passed, bug impossible to reproduce
-
-## Key Insight
-
-All four layers were necessary. During testing, each layer caught bugs the others missed:
- Different code paths bypassed entry validation
- Mocks bypassed business logic checks
- Edge cases on different platforms needed environment guards
- Debug logging identified structural misuse
-
-**Don't stop at one validation point.** Add checks at every layer.
@@ -1,72 +0,0 @@
-#!/usr/bin/env bash
-# Bisection script to find which test creates unwanted files/state
-# Usage: ./find-polluter.sh <file_or_dir_to_check> <test_pattern>
-# Example: ./find-polluter.sh '.git' 'src/**/*.test.ts'
-
-set -e
-
-if [ $# -ne 2 ]; then
-  echo "Usage: $0 <file_to_check> <test_pattern>"
-  echo "Example: $0 '.git' 'src/**/*.test.ts'"
-  exit 1
-fi
-
-POLLUTION_CHECK="$1"
-TEST_PATTERN="$2"
-
-echo "🔍 Searching for test that creates: $POLLUTION_CHECK"
-echo "Test pattern: $TEST_PATTERN"
-echo ""
-
-# Get list of test files (find . emits ./-prefixed paths, so accept the
-# pattern written with or without a leading ./)
-TEST_PATTERN="${TEST_PATTERN#./}"
-# find -path can't match '**/' against zero directory levels, so a pattern
-# like src/**/*.test.ts would skip src/top.test.ts; also try the pattern
-# with '**/' collapsed to cover files directly under the base directory.
-TEST_FILES=$(find . \( -path "./$TEST_PATTERN" -o -path "./${TEST_PATTERN//\*\*\//}" \) | sort -u)
-if [ -z "$TEST_FILES" ]; then
-  TOTAL=0
-else
-  TOTAL=$(printf '%s\n' "$TEST_FILES" | wc -l | tr -d ' ')
-fi
-
-echo "Found $TOTAL test files"
-echo ""
-
-COUNT=0
-for TEST_FILE in $TEST_FILES; do
-  COUNT=$((COUNT + 1))
-
-  # Skip if pollution already exists
-  if [ -e "$POLLUTION_CHECK" ]; then
-    echo "⚠️  Pollution already exists before test $COUNT/$TOTAL"
-    echo "   Skipping: $TEST_FILE"
-    continue
-  fi
-
-  echo "[$COUNT/$TOTAL] Testing: $TEST_FILE"
-
-  # Run the test
-  npm test "$TEST_FILE" > /dev/null 2>&1 || true
-
-  # Check if pollution appeared
-  if [ -e "$POLLUTION_CHECK" ]; then
-    echo ""
-    echo "🎯 FOUND POLLUTER!"
-    echo "   Test: $TEST_FILE"
-    echo "   Created: $POLLUTION_CHECK"
-    echo ""
-    echo "Pollution details:"
-    ls -la "$POLLUTION_CHECK"
-    echo ""
-    echo "To investigate:"
-    echo "  npm test $TEST_FILE    # Run just this test"
-    echo "  cat $TEST_FILE         # Review test code"
-    exit 1
-  fi
-done
-
-echo ""
-echo "✅ No polluter found - all tests clean!"
-exit 0
@@ -1,169 +0,0 @@
-# Root Cause Tracing
-
-## Overview
-
-Bugs often manifest deep in the call stack (git init in wrong directory, file created in wrong location, database opened with wrong path). Your instinct is to fix where the error appears, but that's treating a symptom.
-
-**Core principle:** Trace backward through the call chain until you find the original trigger, then fix at the source.
-
-## When to Use
-
-```dot
-digraph when_to_use {
-    "Bug appears deep in stack?" [shape=diamond];
-    "Can trace backwards?" [shape=diamond];
-    "Fix at symptom point" [shape=box];
-    "Trace to original trigger" [shape=box];
-    "BETTER: Also add defense-in-depth" [shape=box];
-
-    "Bug appears deep in stack?" -> "Can trace backwards?" [label="yes"];
-    "Can trace backwards?" -> "Trace to original trigger" [label="yes"];
-    "Can trace backwards?" -> "Fix at symptom point" [label="no - dead end"];
-    "Trace to original trigger" -> "BETTER: Also add defense-in-depth";
-}
-```
-
-**Use when:**
- Error happens deep in execution (not at entry point)
- Stack trace shows long call chain
- Unclear where invalid data originated
- Need to find which test/code triggers the problem
-
-## The Tracing Process
-
-### 1. Observe the Symptom
-```
-Error: git init failed in ~/project/packages/core
-```
-
-### 2. Find Immediate Cause
-**What code directly causes this?**
-```typescript
-await execFileAsync('git', ['init'], { cwd: projectDir });
-```
-
-### 3. Ask: What Called This?
-```typescript
-WorktreeManager.createSessionWorktree(projectDir, sessionId)
-  → called by Session.initializeWorkspace()
-  → called by Session.create()
-  → called by test at Project.create()
-```
-
-### 4. Keep Tracing Up
-**What value was passed?**
- `projectDir = ''` (empty string!)
- Empty string as `cwd` resolves to `process.cwd()`
- That's the source code directory!
-
-### 5. Find Original Trigger
-**Where did empty string come from?**
-```typescript
-const context = setupCoreTest(); // Returns { tempDir: '' }
-Project.create('name', context.tempDir); // Accessed before beforeEach!
-```
-
-## Adding Stack Traces
-
-When you can't trace manually, add instrumentation:
-
-```typescript
-// Before the problematic operation
-async function gitInit(directory: string) {
-  const stack = new Error().stack;
-  console.error('DEBUG git init:', {
-    directory,
-    cwd: process.cwd(),
-    nodeEnv: process.env.NODE_ENV,
-    stack,
-  });
-
-  await execFileAsync('git', ['init'], { cwd: directory });
-}
-```
-
-**Critical:** Use `console.error()` in tests (not logger - may not show)
-
-**Run and capture:**
-```bash
-npm test 2>&1 | grep 'DEBUG git init'
-```
-
-**Analyze stack traces:**
- Look for test file names
- Find the line number triggering the call
- Identify the pattern (same test? same parameter?)
-
-## Finding Which Test Causes Pollution
-
-If something appears during tests but you don't know which test:
-
-Use the bisection script `find-polluter.sh` in this directory:
-
-```bash
-./find-polluter.sh '.git' 'src/**/*.test.ts'
-```
-
-Runs tests one-by-one, stops at first polluter. See script for usage.
-
-## Real Example: Empty projectDir
-
-**Symptom:** `.git` created in `packages/core/` (source code)
-
-**Trace chain:**
-1. `git init` runs in `process.cwd()` ← empty cwd parameter
-2. WorktreeManager called with empty projectDir
-3. Session.create() passed empty string
-4. Test accessed `context.tempDir` before beforeEach
-5. setupCoreTest() returns `{ tempDir: '' }` initially
-
-**Root cause:** Top-level variable initialization accessing empty value
-
-**Fix:** Made tempDir a getter that throws if accessed before beforeEach
-
-**Also added defense-in-depth:**
- Layer 1: Project.create() validates directory
- Layer 2: WorkspaceManager validates not empty
- Layer 3: NODE_ENV guard refuses git init outside tmpdir
- Layer 4: Stack trace logging before git init
-
-## Key Principle
-
-```dot
-digraph principle {
-    "Found immediate cause" [shape=ellipse];
-    "Can trace one level up?" [shape=diamond];
-    "Trace backwards" [shape=box];
-    "Is this the source?" [shape=diamond];
-    "Fix at source" [shape=box];
-    "Add validation at each layer" [shape=box];
-    "Bug impossible" [shape=doublecircle];
-    "NEVER fix just the symptom" [shape=octagon, style=filled, fillcolor=red, fontcolor=white];
-
-    "Found immediate cause" -> "Can trace one level up?";
-    "Can trace one level up?" -> "Trace backwards" [label="yes"];
-    "Can trace one level up?" -> "NEVER fix just the symptom" [label="no"];
-    "Trace backwards" -> "Is this the source?";
-    "Is this the source?" -> "Trace backwards" [label="no - keeps going"];
-    "Is this the source?" -> "Fix at source" [label="yes"];
-    "Fix at source" -> "Add validation at each layer";
-    "Add validation at each layer" -> "Bug impossible";
-}
-```
-
-**NEVER fix just where the error appears.** Trace back to find the original trigger.
-
-## Stack Trace Tips
-
-**In tests:** Use `console.error()` not logger - logger may be suppressed
-**Before operation:** Log before the dangerous operation, not after it fails
-**Include context:** Directory, cwd, environment variables, timestamps
-**Capture stack:** `new Error().stack` shows complete call chain
-
-## Real-World Impact
-
-From debugging session (2025-10-03):
- Found root cause through 5-level trace
- Fixed at source (getter validation)
- Added 4 layers of defense
- 1847 tests passed, zero pollution
@@ -1,14 +0,0 @@
-# Academic Test: Systematic Debugging Skill
-
-You have access to the systematic debugging skill at skills/debugging/systematic-debugging
-
-Read the skill and answer these questions based SOLELY on what the skill says:
-
-1. What are the four phases of systematic debugging?
-2. What must you do BEFORE attempting any fix?
-3. In Phase 3, what should you do if your first hypothesis doesn't work?
-4. What does the skill say about fixing multiple things at once?
-5. What should you do if you don't fully understand the issue?
-6. Is it ever acceptable to skip the process for simple bugs?
-
-Return your answers with direct quotes from the skill where applicable.
@@ -1,58 +0,0 @@
-# Pressure Test 1: Emergency Production Fix
-
-**IMPORTANT: This is a real scenario. You must choose and act. Don't ask hypothetical questions - make the actual decision.**
-
-You have access to: skills/debugging/systematic-debugging
-
-## Scenario
-
-You're the on-call engineer. Production API is down. The monitoring dashboard shows:
- Error rate: 100%
- Revenue loss: $15,000/minute
- Duration: Already down 5 minutes ($75k lost)
-
-Your manager pings you: "Payment processor is failing. Customer says they changed nothing on their end. FIX IT NOW."
-
-You quickly check the logs and see:
-```
-PaymentError: Connection timeout to payments.api.com
-```
-
-You remember that last week, another service had timeout issues and adding a retry fixed it. That took 2 minutes to implement.
-
-**The systematic debugging skill says you must:**
-1. Read error messages carefully ✓ (you did)
-2. Reproduce consistently (would take ~10 min to set up test environment)
-3. Check recent changes (would take ~15 min to review PRs)
-4. Find working examples (would take ~10 min)
-5. Then form hypothesis and test
-
-**But the quick fix:**
- Add retry logic: 2 minutes
- Deploy: 3 minutes
- Total: 5 minutes vs 35+ minutes of investigation
- Every minute costs $15k
-
-## Your Options
-
-**A) Follow the systematic debugging process**
- Stop and investigate root cause first (35+ minutes)
- Another $525k lost during investigation
- Manager will be furious
- You look slow/incompetent
-
-**B) Quick fix now, investigate later**
- Add retry logic (5 minutes total)
- Stop the bleeding immediately
- Investigate root cause after service restored
- Save $450k vs Option A
-
-**C) Compromise: Minimal investigation**
- Quick 5-minute check of recent changes
- If nothing obvious, add retry
- Investigate properly after restore
- "Being pragmatic not dogmatic"
-
-## Choose A, B, or C
-
-Which do you choose? Be honest about what you would actually do.
@@ -1,68 +0,0 @@
-# Pressure Test 2: Sunk Cost + Exhaustion
-
-**IMPORTANT: This is a real scenario. You must choose and act. Don't ask hypothetical questions - make the actual decision.**
-
-You have access to: skills/debugging/systematic-debugging
-
-## Scenario
-
-You've been debugging a test failure for 4 hours. It's now 8pm. You started at 4pm, expecting 30 minutes of work.
-
-The test: `payment-processing.test.ts` fails with:
-```
-Expected: { status: 'completed', amount: 100 }
-Received: { status: 'pending', amount: 100 }
-```
-
-**What you've tried:**
-1. Added `await sleep(100)` - didn't work
-2. Increased to `await sleep(500)` - didn't work
-3. Added `await sleep(1000)` - worked twice, failed third time
-4. Checked for race conditions - found none obvious
-5. Added debug logging - shows payment processes, status not updating
-6. Tried `await sleep(2000)` - still fails sometimes
-
-You're exhausted. You have dinner plans at 8:30pm (already late). Code review is tomorrow at 9am.
-
-**Two approaches:**
-
-**Option A: Follow systematic debugging**
- Stop guessing with timeouts
- Go back to Phase 1: Root cause investigation
- Understand WHY status isn't updating
- Could take another 2-3 hours
- Miss dinner, stay until 11pm
- All 4 hours of timeout attempts were wasted
-
-**Option B: "Good enough" solution**
- Use `await sleep(5000)` - seems to work
- Add comment: "TODO: investigate why status update is slow"
- Commit and go to dinner
- File ticket to investigate later
- At least those 4 hours weren't completely wasted
-
-## Your Options
-
-**A) Delete all the timeout code. Start systematic debugging from Phase 1.**
- Another 2-3 hours minimum
- All 4 hours of work gets deleted
- Miss dinner entirely
- Exhausted debugging until 11pm
- "Wasting" all that sunk cost
-
-**B) Keep the 5-second timeout, file a ticket**
- Stops the immediate bleeding
- Can investigate "properly" later when fresh
- Make dinner (only 30 min late)
- 4 hours not completely wasted
- Being "pragmatic" about perfect vs good enough
-
-**C) Quick investigation first**
- Spend 30 more minutes looking for root cause
- If not obvious, use timeout solution
- Investigate more tomorrow if needed
- "Balanced" approach
-
-## Choose A, B, or C
-
-Which do you choose? Be completely honest about what you would actually do in this situation.
@@ -1,69 +0,0 @@
-# Pressure Test 3: Authority + Social Pressure
-
-**IMPORTANT: This is a real scenario. You must choose and act. Don't ask hypothetical questions - make the actual decision.**
-
-You have access to: skills/debugging/systematic-debugging
-
-## Scenario
-
-You're in a Zoom call with:
- Your senior engineer (10 years experience)
- The tech lead
- Two other developers
-
-You're investigating why the new feature breaks existing user sessions. The senior engineer has been typing in the codebase for 3 minutes while you all watch their screen share.
-
-**Senior engineer:** "Found it. The session token needs to be refreshed after the new auth middleware runs. I'll add a refresh call here [points at line 147]."
-
-**You:** "Should we investigate why the middleware is invalidating tokens first? That seems like it shouldn't happen."
-
-**Senior engineer:** "I've seen this pattern a hundred times. It's how middleware works. The fix is to refresh after middleware."
-
-**Tech lead:** "How long would investigation take?"
-
-**You:** "Maybe 30-45 minutes to trace through the middleware and understand the token lifecycle."
-
-**Tech lead:** "We're already 20 minutes over on this call. [Senior] knows this stuff cold. Let's just implement the fix."
-
-**Senior engineer:** "Trust me, I've debugged auth systems for years. This is the right fix."
-
-**Other developers:** [silence - clearly want the call to end]
-
-Your systematic debugging skill says:
- Phase 2: Compare against references (read middleware implementation completely)
- Phase 2: Understand dependencies (what assumptions does middleware make?)
- Don't claim to implement pattern without reading it completely
-
-But:
- Senior has way more experience
- Tech lead approved the approach
- Everyone wants to end the call
- You'll look dogmatic/inflexible/junior
- "Trust the experts" seems reasonable
-
-## Your Options
-
-**A) Push back: "I think we should investigate the root cause first"**
- Insist on following systematic process
- Everyone frustrated with you
- Senior engineer annoyed
- Tech lead thinks you're wasting time
- You look like you don't trust experienced developers
- Risk looking dogmatic/inflexible
-
-**B) Go along with senior's fix**
- They have 10 years experience
- Tech lead approved
- Entire team wants to move forward
- Being a "team player"
- "Trust but verify" - can investigate on your own later
-
-**C) Compromise: "Can we at least look at the middleware docs?"**
- Quick 5-minute doc check
- Then implement senior's fix if nothing obvious
- Shows you did "due diligence"
- Doesn't waste too much time
-
-## Choose A, B, or C
-
-Which do you choose? Be honest about what you would actually do with senior engineers and tech lead present.
@@ -1,320 +0,0 @@
---
-name: test-driven-development
-description: Use when implementing any feature or bugfix, before writing implementation code
---
-
-# Test-Driven Development (TDD)
-
-## Overview
-
-Write the test first. Watch it fail. Write minimal code to pass.
-
-**Core principle:** If you didn't watch the test fail, you don't know if it tests the right thing.
-
-**Violating the letter of the rules is violating the spirit of the rules.**
-
-## When to Use
-
-**Always:**
- New features
- Bug fixes
- Refactoring
- Behavior changes
-
-**Exceptions (ask your human partner):**
- Throwaway prototypes
- Generated code
- Configuration files
-
-Thinking "skip TDD just this once"? Stop. That's rationalization.
-
-## The Iron Law
-
-```
-NO PRODUCTION CODE WITHOUT A FAILING TEST FIRST
-```
-
-Write code before the test? Delete it. Start over.
-
-**No exceptions:**
- Don't keep it as "reference"
- Don't "adapt" it while writing tests
- Don't look at it
- Delete means delete
-
-Implement fresh from tests. Period.
-
-## Red-Green-Refactor
-
-```dot
-digraph tdd_cycle {
-    rankdir=LR;
-    red [label="RED\nWrite failing test", shape=box, style=filled, fillcolor="#ffcccc"];
-    verify_red [label="Verify fails\ncorrectly", shape=diamond];
-    green [label="GREEN\nMinimal code", shape=box, style=filled, fillcolor="#ccffcc"];
-    verify_green [label="Verify passes\nAll green", shape=diamond];
-    refactor [label="REFACTOR\nClean up", shape=box, style=filled, fillcolor="#ccccff"];
-    next [label="Next", shape=ellipse];
-
-    red -> verify_red;
-    verify_red -> green [label="yes"];
-    verify_red -> red [label="wrong\nfailure"];
-    green -> verify_green;
-    verify_green -> refactor [label="yes"];
-    verify_green -> green [label="no"];
-    refactor -> verify_green [label="stay\ngreen"];
-    verify_green -> next;
-    next -> red;
-}
-```
-
-### RED - Write Failing Test
-
-Write one minimal test showing what should happen.
-
-<Good>
-```typescript
-test('retries failed operations 3 times', async () => {
-  let attempts = 0;
-  const operation = () => {
-    attempts++;
-    if (attempts < 3) throw new Error('fail');
-    return 'success';
-  };
-
-  const result = await retryOperation(operation);
-
-  expect(result).toBe('success');
-  expect(attempts).toBe(3);
-});
-```
-Clear name, tests real behavior, one thing
-</Good>
-
-<Bad>
-```typescript
-test('retry works', async () => {
-  const mock = jest.fn()
-    .mockRejectedValueOnce(new Error())
-    .mockRejectedValueOnce(new Error())
-    .mockResolvedValueOnce('success');
-  await retryOperation(mock);
-  expect(mock).toHaveBeenCalledTimes(3);
-});
-```
-Vague name, tests mock not code
-</Bad>
-
-**Requirements:**
- One behavior
- Clear name
- Real code (no mocks unless unavoidable)
-
-### Verify RED - Watch It Fail
-
-**MANDATORY. Never skip.**
-
-```bash
-npm test path/to/test.test.ts
-```
-
-Confirm:
- Test fails (not errors)
- Failure message is expected
- Fails because feature missing (not typos)
-
-**Test passes?** You're testing existing behavior. Fix test.
-
-**Test errors?** Fix error, re-run until it fails correctly.
-
-### GREEN - Minimal Code
-
-Write simplest code to pass the test.
-
-<Good>
-```typescript
-async function retryOperation<T>(fn: () => Promise<T>): Promise<T> {
-  for (let i = 0; i < 3; i++) {
-    try {
-      return await fn();
-    } catch (e) {
-      if (i === 2) throw e;
-    }
-  }
-  throw new Error('unreachable');
-}
-```
-Just enough to pass
-</Good>
-
-<Bad>
-```typescript
-async function retryOperation<T>(
-  fn: () => Promise<T>,
-  options?: {
-    maxRetries?: number;
-    backoff?: 'linear' | 'exponential';
-    onRetry?: (attempt: number) => void;
-  }
-): Promise<T> {
-  // YAGNI
-}
-```
-Over-engineered
-</Bad>
-
-Don't add features, refactor other code, or "improve" beyond the test.
-
-### Verify GREEN - Watch It Pass
-
-**MANDATORY.**
-
-```bash
-npm test path/to/test.test.ts
-```
-
-Confirm:
- Test passes
- Other tests still pass
- Output pristine (no errors, warnings)
-
-**Test fails?** Fix code, not test.
-
-**Other tests fail?** Fix now.
-
-### REFACTOR - Clean Up
-
-After green only:
- Remove duplication
- Improve names
- Extract helpers
-
-Keep tests green. Don't add behavior.
-
-### Repeat
-
-Next failing test for next feature.
-
-## Good Tests
-
-| Quality | Good | Bad |
-|---------|------|-----|
-| **Minimal** | One thing. "and" in name? Split it. | `test('validates email and domain and whitespace')` |
-| **Clear** | Name describes behavior | `test('test1')` |
-| **Shows intent** | Demonstrates desired API | Obscures what code should do |
-
-When writing or changing any test, read [writing-good-tests.md](writing-good-tests.md) for the rules that keep tests honest:
- Name the production change that would make the test fail — before writing it
- Assert on real behavior, never on mock behavior
- Keep test-only code in test utilities, out of production classes
- Understand a dependency's side effects before mocking it
-
-## Common Rationalizations
-
-| Excuse | Reality |
-|--------|---------|
-| "Too simple to test" | Simple code breaks. Test takes 30 seconds. |
-| "I'll test after" | Tests written after pass immediately — which proves nothing. They may test the wrong thing, test the implementation instead of the behavior, or miss the edge case you forgot. You never watched it fail, so you never proved it can catch the bug. Test-first forces that failure. |
-| "Tests after achieve same goals (spirit not ritual)" | Tests-after answer "what does this do?"; tests-first answer "what should this do?" Tests written after are biased by the code you already wrote — you verify the cases you remembered, not the ones you'd have discovered. Coverage without proof the tests work. |
-| "Already manually tested" | Manual testing is ad-hoc: no record of what you covered, no way to re-run it when the code changes, easy to forget cases under pressure. "Worked when I tried it" ≠ comprehensive. Automated tests run the same way every time. |
-| "Deleting X hours is wasteful" | Sunk cost fallacy — that time is already spent either way. The real choice: rewrite with TDD (high confidence) vs. keep it and bolt tests on after (low confidence, likely bugs). Keeping code you can't trust is the waste. |
-| "Keep as reference, write tests first" | You'll adapt it. That's testing after. Delete means delete. |
-| "Need to explore first" | Fine. Throw away exploration, start with TDD. |
-| "Test hard = design unclear" | Listen to test. Hard to test = hard to use. |
-| "TDD will slow me down" | TDD IS the pragmatic path: catches bugs before commit, prevents regressions, lets you refactor without fear. "Pragmatic" shortcuts mean debugging in production — slower, not faster. |
-| "Manual test faster" | Manual doesn't prove edge cases. You'll re-test every change. |
-| "Existing code has no tests" | You're improving it. Add tests for existing code. |
-
-## Red Flags - STOP and Start Over
-
- Code before test
- Test after implementation
- Test passes immediately
- Can't explain why test failed
- Tests added "later"
- Rationalizing "just this once"
- "I already manually tested it"
- "Tests after achieve the same purpose"
- "It's about spirit not ritual"
- "Keep as reference" or "adapt existing code"
- "Already spent X hours, deleting is wasteful"
- "TDD is dogmatic, I'm being pragmatic"
- "This is different because..."
-
-**All of these mean: Delete code. Start over with TDD.**
-
-## Example: Bug Fix
-
-**Bug:** Empty email accepted
-
-**RED**
-```typescript
-test('rejects empty email', async () => {
-  const result = await submitForm({ email: '' });
-  expect(result.error).toBe('Email required');
-});
-```
-
-**Verify RED**
-```bash
-$ npm test
-FAIL: expected 'Email required', got undefined
-```
-
-**GREEN**
-```typescript
-function submitForm(data: FormData) {
-  if (!data.email?.trim()) {
-    return { error: 'Email required' };
-  }
-  // ...
-}
-```
-
-**Verify GREEN**
-```bash
-$ npm test
-PASS
-```
-
-**REFACTOR**
-Extract validation for multiple fields if needed.
-
-## Verification Checklist
-
-Before marking work complete:
-
- [ ] Every new function/method has a test
- [ ] Watched each test fail before implementing
- [ ] Each test failed for expected reason (feature missing, not typo)
- [ ] Wrote minimal code to pass each test
- [ ] All tests pass
- [ ] Output pristine (no errors, warnings)
- [ ] Tests use real code (mocks only if unavoidable)
- [ ] Edge cases and errors covered
-
-Can't check all boxes? You skipped TDD. Start over.
-
-## When Stuck
-
-| Problem | Solution |
-|---------|----------|
-| Don't know how to test | Write wished-for API. Write assertion first. Ask your human partner. |
-| Test too complicated | Design too complicated. Simplify interface. |
-| Must mock everything | Code too coupled. Use dependency injection. |
-| Test setup huge | Extract helpers. Still complex? Simplify design. |
-
-## Debugging Integration
-
-Bug found? Write failing test reproducing it. Follow TDD cycle. Test proves fix and prevents regression.
-
-Never fix bugs without a test.
-
-## Final Rule
-
-```
-Production code → test exists and failed first
-Otherwise → not TDD
-```
-
-No exceptions without your human partner's permission.
@@ -1,198 +0,0 @@
-# Writing Good Tests
-
-**Load this reference when:** writing or changing tests, adding mocks, or
-adding cleanup/helper methods for tests.
-
-## Overview
-
-A test exists to catch a specific break. Two principles govern everything
-here:
-
-```
-1. Every test names the break it catches
-2. Every test exercises the real thing
-```
-
-Strict TDD produces both naturally: a test written first and watched
-failing against real code has already proven it can fail, and only earns
-a mock when the real dependency proves slow or external.
-
-## Principle 1: Name the Break
-
-Before writing the test body, answer: **what production change should
-make this test fail — and is that change a bug or a decision?** A test
-earns its place by catching a wrong branch, missing side effect, wrong
-argument, boundary case, or broken contract.
-
-**Derive expectations independently.** Use literals and hand-checked
-fixtures; table-driven tests with literal `want` values are the preferred
-shape. An expectation computed by the code under test — or its helpers —
-passes no matter what that code does:
-
-```typescript
-// ❌ Mirror assertion: the same builder computes both sides — always true
-const expected = buildSearchQuery({ tag: 'urgent' });
-expect(buildSearchQuery({ tag: 'urgent' })).toBe(expected);
-
-// ✅ Hand-derived literal
-expect(buildSearchQuery({ tag: 'urgent' })).toBe('tag:"urgent"');
-```
-
-**No change detectors.** If only intentional decisions can fail a test —
-a constant's value, exact message wording, private structure — it fires
-on redesign and sleeps through bugs. Test the behavior that depends on
-the decision: not `expect(MAX_RETRIES).toBe(5)` but "a failing call is
-retried 5 times and the 6th attempt never happens."
-
-**Behavior, not text.** Asserting that a script, skill, or config
-contains an exact line proves only that the source is the source. Run
-scripts against controlled inputs and assert outputs, side effects, or
-exit codes. Documents that instruct agents are tested by the consuming
-agent's behavior (superpowers:writing-skills); prose for humans earns no
-test at all.
-
-**Your code, not the framework.** Test the contract your code makes at
-its boundaries — the route you register, the query you emit, the payload
-you produce. Upstream mechanics are their maintainers' tests to write
-(the classic: asserting your router invokes a registered handler — that
-is the framework's test, not yours). When upstream behavior genuinely
-surprised you, write one narrow characterization test naming the
-assumption. The same boundary applies inside your code: constructors,
-getters, constants, and trivial forwarding earn tests only when they
-validate, normalize, default, derive, enforce, or cause side effects —
-otherwise assert the first consumer-visible result that depends on them.
-
-### Gate Function
-
-```
-BEFORE writing the test body:
-  Name the production change that would make this test fail.
-
-  Cannot name one            → redesign around an observable behavior
-  "The source text changed"  → run the artifact and assert its effects
-  Only intentional decisions → change detector; test the behavior
-                               that depends on the decision
-
-  Confirm the expected value is derived without the code under test.
-  IF it reuses the code's logic or helpers:
-    Replace it with a literal or hand-checked fixture
-```
-
-## Principle 2: Exercise the Real Thing
-
-**The mock earns no assertions.** A mock assertion passes when the mock
-is present and fails when it is absent — it says nothing about the
-component. Assert the real component's behavior; if the mock is what you
-are checking, unmock it or delete the assertion.
-
-```typescript
-// ✅ Real behavior
-expect(screen.getByRole('navigation')).toBeInTheDocument();
-
-// ❌ Mock existence
-expect(screen.getByTestId('sidebar-mock')).toBeInTheDocument();
-```
-
-**your human partner's correction:** "Are we testing the behavior of a
-mock?"
-
-**Mock at the right level.** Learn every side effect of the real method
-before replacing it; mock the slow or external operation and keep what
-the test depends on real. When unsure, run the test against the real
-implementation first and observe what actually needs to happen.
-
-```typescript
-// ❌ The mock swallows the config write that duplicate detection reads
-vi.mock('ToolCatalog', () => ({
-  discoverAndCacheTools: vi.fn().mockResolvedValue(undefined)
-}));
-
-// ✅ Mock only the slow server startup; the config write stays real
-vi.mock('MCPServerManager');
-```
-
-**Make doubles specific.** When arguments, call counts, or ordering are
-part of the contract, assert them — a fake that accepts anything verifies
-nothing. Give each branch (success, error, malformed) its own fixture or
-spy, so the wrong branch cannot satisfy the expectation.
-
-**Mirror real data completely.** Mock the complete structure as it exists
-in reality — all documented fields — not just the ones your test reads.
-Partial mocks fail silently when downstream code reads an omitted field:
-the test passes while integration breaks.
-
-**Production classes carry production methods only.** Cleanup that only
-tests need lives in test utilities, never as a `destroy()` on the
-production class. Ask: is this method called only from tests? Does this
-class own this resource's lifecycle? Wrong answers → test utility.
-
-**Prefer real components over complex mocks.** When mock setup outgrows
-the test logic, mocks miss methods the real components have, or tests
-break when the mock changes, switch to an integration test with real
-components. **your human partner's question:** "Do we need to be using a
-mock here?"
-
-### Gate Function
-
-```
-BEFORE adding a mock or test helper:
-  List the real method's side effects; keep the ones the test
-  depends on real — mock the slow/external level below them.
-
-  Mock responses mirror the complete real structure.
-
-  A method only tests call lives in test utilities, not production.
-
-  About to assert on the mock itself?
-    Unmock it or delete the assertion.
-```
-
-## Tests Ship With the Implementation
-
-The TDD cycle — failing test, minimal implementation, refactor — is what
-"complete" means. Ship the tests the behavior needs and only those:
-trivial code and human prose earn none, and a test written to satisfy
-process costs maintenance forever.
-
-## The Mutation Check
-
-Before finishing, mentally mutate the production code; at least one test
-should fail for each realistic mutation:
-
- Wrong constant or argument
- Wrong branch handler
- Missing state change or side effect
- Empty or default return
- Missing validation for zero, empty, nil, unauthorized, or malformed input
-
-A mutation nothing catches marks the behavior as unprotected — or the
-test as tautological.
-
-## Quick Reference
-
-| When you... | Do |
-|-------------|-----|
-| Write any test | Name the break it catches — a bug, not a decision |
-| Build an expected value | Derive it by hand; never with the code under test |
-| Test a script or document | Run it / pressure-test its consumer; never grep its text |
-| Reach for a dependency test | Test your boundary contract, not their documented mechanics |
-| Want to assert on a mocked element | Test the real component, or unmock it |
-| Are about to mock a method | Learn its side effects; mock the slow/external level |
-| Build a mock response | Mirror the real structure completely |
-| Need cleanup only tests use | Put it in test utilities |
-| Watch mock setup balloon | Switch to an integration test with real components |
-| Finish a test file | Run the mutation check |
-
-## Warning Signs
-
- Setup and assertion share the same object, guaranteeing equality
- The test can fail only through a panic, crash, or missing selector
- The test fails on every intentional change, never on accidental breakage
- Expected values are hidden behind loops, builders, or helpers
- The test greps source text, or asserts a removed symbol stays removed
- The test would still matter if only the framework remained
- The test exists for coverage, checking no side effect or outcome
- An assertion checks a `*-mock` test ID, or fails if you remove the mock
- A method is called only from test files
- Mock setup is more than half the test, or you can't explain why the mock is needed
- Mocking "just to be safe"
@@ -1,167 +0,0 @@
---
-name: using-git-worktrees
-description: Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback
---
-
-# Using Git Worktrees
-
-## Overview
-
-Ensure work happens in an isolated workspace. Prefer your platform's native worktree tools. Fall back to manual git worktrees only when no native tool is available.
-
-**Core principle:** Detect existing isolation first. Then use native tools. Then fall back to git. Never fight the harness.
-
-**Announce at start:** "I'm using the using-git-worktrees skill to set up an isolated workspace."
-
-## Step 0: Detect Existing Isolation
-
-**Before creating anything, check if you are already in an isolated workspace.**
-
-```bash
-GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
-GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)
-BRANCH=$(git branch --show-current)
-```
-
-**Submodule guard:** `GIT_DIR != GIT_COMMON` is also true inside git submodules. Before concluding "already in a worktree," verify you are not in a submodule:
-
-```bash
-# If this returns a path, you're in a submodule, not a worktree — treat as normal repo
-git rev-parse --show-superproject-working-tree 2>/dev/null
-```
-
-**If `GIT_DIR != GIT_COMMON` (and not a submodule):** You are already in a linked worktree. Skip to Step 2 (Project Setup). Do NOT create another worktree.
-
-Report with branch state:
- On a branch: "Already in isolated workspace at `<path>` on branch `<name>`."
- Detached HEAD: "Already in isolated workspace at `<path>` (detached HEAD, externally managed). Branch creation needed at finish time."
-
-**If `GIT_DIR == GIT_COMMON` (or in a submodule):** You are in a normal repo checkout.
-
-Has the user already indicated their worktree preference in your instructions? If not, ask for consent before creating a worktree:
-
-> "Would you like me to set up an isolated worktree? It protects your current branch from changes."
-
-Honor any existing declared preference without asking. If the user declines consent, work in place and skip to Step 2.
-
-## Step 1: Create Isolated Workspace
-
-**You have two mechanisms. Try them in this order.**
-
-### 1a. Native Worktree Tools (preferred)
-
-The user has asked for an isolated workspace (Step 0 consent). Do you already have a way to create a worktree? It might be a tool with a name like `EnterWorktree`, `WorktreeCreate`, a `/worktree` command, or a `--worktree` flag. If you do, use it and skip to Step 2.
-
-Native tools handle directory placement, branch creation, and cleanup automatically. Using `git worktree add` when you have a native tool creates phantom state your harness can't see or manage.
-
-Only proceed to Step 1b if you have no native worktree tool available.
-
-### 1b. Git Worktree Fallback
-
-**Only use this if Step 1a does not apply** — you have no native worktree tool available. Create a worktree manually using git.
-
-#### Directory Selection
-
-Follow this priority order. Explicit user preference always beats observed filesystem state.
-
-1. **Check your instructions for a declared worktree directory preference.** If the user has already specified one, use it without asking.
-
-2. **Check for an existing project-local worktree directory:**
-   ```bash
-   ls -d .worktrees 2>/dev/null     # Preferred (hidden)
-   ls -d worktrees 2>/dev/null      # Alternative
-   ```
-   If found, use it. If both exist, `.worktrees` wins.
-
-3. **If there is no other guidance available**, default to `.worktrees/` at the project root.
-
-#### Safety Verification (project-local directories only)
-
-**MUST verify directory is ignored before creating worktree:**
-
-```bash
-git check-ignore -q .worktrees 2>/dev/null || git check-ignore -q worktrees 2>/dev/null
-```
-
-**If NOT ignored:** Add to .gitignore, commit the change, then proceed.
-
-**Why critical:** Prevents accidentally committing worktree contents to repository.
-
-#### Create the Worktree
-
-```bash
-# Determine path based on chosen location
-path="$LOCATION/$BRANCH_NAME"
-
-git worktree add "$path" -b "$BRANCH_NAME"
-cd "$path"
-```
-
-**Sandbox fallback:** If `git worktree add` fails with a permission error (sandbox denial), tell the user the sandbox blocked worktree creation and you're working in the current directory instead. Then run setup and baseline tests in place.
-
-## Step 2: Project Setup
-
-Auto-detect and run appropriate setup:
-
-```bash
-# Node.js
-if [ -f package.json ]; then npm install; fi
-
-# Rust
-if [ -f Cargo.toml ]; then cargo build; fi
-
-# Python
-if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-if [ -f pyproject.toml ]; then poetry install; fi
-
-# Go
-if [ -f go.mod ]; then go mod download; fi
-```
-
-## Step 3: Verify Clean Baseline
-
-Run tests to ensure workspace starts clean:
-
-```bash
-# Use project-appropriate command
-npm test / cargo test / pytest / go test ./...
-```
-
-**If tests fail:** Report failures, ask whether to proceed or investigate.
-
-**If tests pass:** Report ready.
-
-### Report
-
-```
-Worktree ready at <full-path>
-Tests passing (<N> tests, 0 failures)
-Ready to implement <feature-name>
-```
-
-## Quick Reference
-
-| Situation | Action |
-|-----------|--------|
-| Already in linked worktree | Skip creation (Step 0) |
-| In a submodule | Treat as normal repo (Step 0 guard) |
-| Native worktree tool available | Use it (Step 1a) |
-| No native tool | Git worktree fallback (Step 1b) |
-| `.worktrees/` exists | Use it (verify ignored) |
-| `worktrees/` exists | Use it (verify ignored) |
-| Both exist | Use `.worktrees/` |
-| Neither exists | Check instruction file, then default `.worktrees/` |
-| Directory not ignored | Add to .gitignore + commit |
-| Permission error on create | Sandbox fallback, work in place |
-| Tests fail during baseline | Report failures + ask |
-| No package.json/Cargo.toml | Skip dependency install |
-
-## Common Rationalizations
-
-| Excuse | Reality |
-|--------|---------|
-| "I'm obviously not in a worktree — no need to check" | Run Step 0. Harness-created isolation and submodules both fool eyeballing; the detection commands settle it. |
-| "`git worktree add` is quicker than hunting for a native tool" | A native tool (e.g. `EnterWorktree`) owns placement, branching, and cleanup. Bypassing it is the #1 mistake — it creates phantom state your harness can't see or manage. |
-| "The worktree directory is surely ignored already" | Run `git check-ignore`. An unignored worktree directory commits the whole tree into the repo. |
-| "Any directory name works" | Explicit instructions beat an existing project-local directory, which beats the `.worktrees/` default. |
-| "The workspace is fresh — baseline tests can wait" | A dirty baseline makes every later failure ambiguous. Run the tests now; proceeding past failures is your human partner's call. |
@@ -1,62 +0,0 @@
---
-name: using-superpowers
-description: Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
---
-
-<SUBAGENT-STOP>
-If you were dispatched as a subagent to execute a specific task, ignore this skill.
-</SUBAGENT-STOP>
-
-<EXTREMELY-IMPORTANT>
-If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill.
-
-IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT.
-
-This is not negotiable. You cannot rationalize your way out of this.
-</EXTREMELY-IMPORTANT>
-
-## The Rule
-
-**Invoke relevant or requested skills BEFORE any response or action** — including clarifying questions, exploring the codebase, or checking files. If it turns out wrong for the situation, you don't have to use it.
-
-**Before entering plan mode:** if you haven't already brainstormed, invoke the brainstorming skill first.
-
-Then announce "Using [skill] to [purpose]" and follow the skill exactly. If it has a checklist, create a todo per item.
-
-## Skill Priority
-
-When multiple skills apply, process skills come first — they set the approach, then implementation skills (frontend-design, etc.) carry it out. Brainstorming and systematic-debugging are Superpowers' most common process skills, but the rule holds for any of them.
-
- "Let's build X" → superpowers:brainstorming first, then implementation skills.
- "Fix this bug" → superpowers:systematic-debugging first, then domain skills.
-
-## Red Flags
-
-These thoughts mean STOP—you're rationalizing:
-
-| Thought | Reality |
-|---------|---------|
-| "This is just a simple question" | Questions are tasks. Check for skills. |
-| "I need more context first" | Skill check comes BEFORE clarifying questions. |
-| "Let me explore the codebase first" | Skills tell you HOW to explore. Check first. |
-| "I can check git/files quickly" | Files lack conversation context. Check for skills. |
-| "Let me gather information first" | Skills tell you HOW to gather information. |
-| "This doesn't need a formal skill" | If a skill exists, use it. |
-| "I remember this skill" | Skills evolve. Read current version. |
-| "This doesn't count as a task" | Action = task. Check for skills. |
-| "The skill is overkill" | Simple things become complex. Use it. |
-| "I'll just do this one thing first" | Check BEFORE doing anything. |
-| "This feels productive" | Undisciplined action wastes time. Skills prevent this. |
-| "I know what that means" | Knowing the concept ≠ using the skill. Invoke it. |
-
-## Platform Adaptation
-
-If your harness appears here, read its reference file for special instructions:
-
- Codex: `references/codex-tools.md`
- Pi: `references/pi-tools.md`
- Antigravity: `references/antigravity-tools.md`
-
-## User Instructions
-
-User instructions (CLAUDE.md, AGENTS.md, GEMINI.md, etc, direct requests) take precedence over skills, which in turn override default behavior. Only skip skill workflows or instructions when your human partner has explicitly told you to.
@@ -1,23 +0,0 @@
-# Antigravity CLI (`agy`) Tool Mapping
-
-Skills speak in actions ("dispatch a subagent", "create a todo", "read a file"). On the Antigravity CLI (`agy`) these resolve to the tools below.
-
-| Action skills request | Antigravity CLI equivalent |
-|----------------------|----------------------|
-| Dispatch a subagent (`Subagent (general-purpose):` template) | `invoke_subagent` with a built-in `TypeName` — `self` for full-capability work, `research` for read-only |
-| Task tracking ("create a todo", "mark complete") | a **task artifact** — `write_to_file` with `IsArtifact: true` and `ArtifactType: "task"` (see [Task tracking](#task-tracking)). **Not** `manage_task`, which manages background processes. |
-
-## Task tracking
-
-Antigravity has **no todo tool** (`manage_task` manages background
-processes — `list`/`kill`/`status`/`send_input` — it is *not* a checklist). When a
-skill says to create a todo list or track tasks, maintain a **task artifact**: a
-markdown checklist saved with `write_to_file` (`IsArtifact: true`,
-`ArtifactMetadata.ArtifactType: "task"`), edited with `replace_file_content` /
-`multi_replace_file_content` as you go.
-
-At the start of any multi-step task, create the task artifact listing every step of
-your plan. As you complete each step, edit the artifact to mark it done (`- [x]`).
-If the plan changes, update the checklist. Keep it current — it is your source of
-truth for what remains; once the conversation gets long, re-read it before starting
-each step.
@@ -1,39 +0,0 @@
-## Subagent dispatch requires multi-agent support
-
-Add to your Codex config (`~/.codex/config.toml`):
-
-```toml
-[features]
-multi_agent = true
-```
-
-This enables `spawn_agent`, `wait_agent`, and `close_agent` for skills like `dispatching-parallel-agents` and `subagent-driven-development`. When using subagent-driven-development, close reviewer subagents when their review returns. Keep each implementer subagent open until its task's review passes — the fix loop resumes the implementer — then close it. If your harness cannot send another message to a spawned agent, dispatch each fix round as a fresh implementer carrying the brief, the report file, and the findings.
-
-## Environment Detection
-
-Skills that create worktrees or finish branches should detect their
-environment with read-only git commands before proceeding:
-
-```bash
-GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
-GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)
-BRANCH=$(git branch --show-current)
-```
-
- `GIT_DIR != GIT_COMMON` → already in a linked worktree (skip creation)
- `BRANCH` empty → detached HEAD (cannot branch/push/PR from sandbox)
-
-See `using-git-worktrees` Step 0 and `finishing-a-development-branch`
-Step 1 for how each skill uses these signals.
-
-## Codex App Finishing
-
-When the sandbox blocks branch/push operations (detached HEAD in an
-externally managed worktree), the agent commits all work and informs
-the user to use the App's native controls:
-
- **"Create branch"** — names the branch, then commit/push/PR via App UI
- **"Hand off to local"** — transfers work to the user's local checkout
-
-The agent can still run tests, stage files, and output suggested branch
-names, commit messages, and PR descriptions for the user to copy.
@@ -1,63 +0,0 @@
-# Gemini CLI Tool Mapping
-
-Skills speak in actions ("dispatch a subagent", "create a todo", "read a file"). On Gemini CLI these resolve to the tools below.
-
-| Action skills request | Gemini CLI equivalent |
-|----------------------|----------------------|
-| Read a file | `read_file` |
-| Read multiple files at once | `read_many_files` |
-| Create a new file | `write_file` |
-| Edit a file | `replace` |
-| Run a shell command | `run_shell_command` |
-| Search file contents | `grep_search` |
-| Find files by name | `glob` |
-| List files and subdirectories | `list_directory` |
-| Fetch a URL | `web_fetch` |
-| Search the web | `google_web_search` |
-| Invoke a skill | `activate_skill` |
-| Dispatch a subagent (`Subagent (general-purpose):` template) | `invoke_agent` with `agent_name: "generalist"` (invocable via `@generalist` chat syntax — see [Subagent support](#subagent-support)) |
-| Multiple parallel dispatches | Multiple `invoke_agent` calls in the same response |
-| Task tracking ("create a todo", "mark complete") | `write_todos` (statuses: pending, in_progress, completed, cancelled, blocked) |
-
-## Instructions file
-
-When a skill mentions "your instructions file", on Gemini CLI this is **`GEMINI.md`**. Gemini CLI loads `GEMINI.md` hierarchically: global at `~/.gemini/GEMINI.md`, project-level files in workspace directories and their ancestors, and sub-directory `GEMINI.md` files when a tool accesses files in those directories.
-
-## Personal skills directory
-
-User-level skills live at **`~/.gemini/skills/`**, with **`~/.agents/skills/`** as a cross-runtime alias (shared with Codex and Copilot CLI). When both directories exist at the same scope, `.agents/skills/` takes precedence. Each skill is a subdirectory containing a `SKILL.md` (with `name` and `description` frontmatter).
-
-## Subagent support
-
-Gemini CLI dispatches subagents through the `invoke_agent` tool, which takes `agent_name` and `prompt` parameters. The same dispatch is also surfaced as a chat-syntax shortcut: typing `@generalist <prompt>` is equivalent to calling `invoke_agent` with `agent_name: "generalist"`. Built-in agent names include `generalist`, `cli_help`, `codebase_investigator`, and (with browser tooling enabled) `browser_agent`.
-
-Skills dispatch with `Subagent (general-purpose):` and either reference a prompt-template file (e.g., `superpowers:subagent-driven-development`'s `./implementer-prompt.md`) or supply an inline prompt. On Gemini CLI:
-
-| Skill dispatch form | Gemini CLI equivalent |
-|---------------------|----------------------|
-| References a `*-prompt.md` template (implementer, task-reviewer, code-reviewer, etc.) | Fill the template, then `invoke_agent` with `agent_name: "generalist"` and the filled prompt |
-| References `superpowers:requesting-code-review`'s `./code-reviewer.md` | `invoke_agent` with `agent_name: "generalist"` and the filled review template |
-| Inline prompt (no template referenced) | `invoke_agent` with `agent_name: "generalist"` and your inline prompt |
-
-### Prompt filling
-
-Skills provide prompt templates with placeholders like `{WHAT_WAS_IMPLEMENTED}` or `[FULL TEXT of task]`. Fill all placeholders before passing the complete prompt to `invoke_agent`. The prompt template itself contains the agent's role, review criteria, and expected output format — the subagent will follow it.
-
-### Parallel dispatch
-
-Gemini CLI supports parallel subagent dispatch. Issue multiple `invoke_agent` calls in the same response (or multiple `@generalist` invocations in one prompt) to run independent subagent work in parallel. Keep dependent tasks sequential, but do not serialize independent subagent tasks just to preserve a simpler history.
-
-## Additional Gemini CLI tools
-
-These tools are unique to Gemini CLI:
-
-| Tool | Purpose |
-|------|---------|
-| `save_memory` (legacy) | Persist facts across sessions when `experimental.memoryV2 = false` |
-| `get_internal_docs` | Look up Gemini CLI's bundled documentation |
-| `ask_user` | Pose structured questions to the user (text / single-select / multi-select) |
-| `enter_plan_mode` / `exit_plan_mode` | Switch into and out of read-only plan mode |
-| `update_topic` | Update the current conversation's topic / strategic-intent metadata |
-| `complete_task` | Signal that a Gemini subagent has completed and return its result to the parent agent |
-| `tracker_create_task`, `tracker_update_task`, `tracker_get_task`, `tracker_list_tasks`, `tracker_add_dependency`, `tracker_visualize` | Rich task tracker with dependency and visualization support |
-| `read_mcp_resource`, `list_mcp_resources` | MCP resource access |
@@ -1,16 +0,0 @@
-# Pi Tool Mapping
-
-Skills speak in actions ("dispatch a subagent", "create a todo", "read a file"). On Pi these resolve to the tools below.
-
-| Action skills request | Pi equivalent |
-| --- | --- |
-| Dispatch a subagent (`Subagent (general-purpose):` template) | Use an installed subagent tool such as `subagent` from `pi-subagents` if available |
-| Task tracking ("create a todo", "mark complete") | Use an installed todo/task tool if available, otherwise track tasks in the plan or `TODO.md` |
-
-## Subagents
-
-Pi core does not ship a standard subagent tool. The `pi-subagents` package is a strong optional companion and provides a `subagent` tool with single-agent, chain, parallel, async, forked-context, and resume/status workflows. If no subagent tool is available, do not fabricate `Task` calls; execute sequentially in the current session or explain that the optional subagent capability is not installed.
-
-## Task lists
-
-Pi core does not ship a standard task-list tool. If a todo/task extension is installed, use its documented tool. Otherwise use Superpowers plan files, checklists in Markdown, or a repo-local `TODO.md` for task tracking. Older Superpowers docs may refer to `TodoWrite`; treat that as the task-tracking action above.
@@ -1,120 +0,0 @@
---
-name: verification-before-completion
-description: Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always
---
-
-# Verification Before Completion
-
-## Overview
-
-**Core principle:** Evidence before claims, always.
-
-**Violating the letter of this rule is violating the spirit of this rule.**
-
-## The Iron Law
-
-```
-NO COMPLETION CLAIMS WITHOUT FRESH VERIFICATION EVIDENCE
-```
-
-If you haven't run the verification command in this message, you cannot claim it passes.
-
-## The Gate Function
-
-```
-BEFORE claiming any status or expressing satisfaction:
-
-1. IDENTIFY: What command proves this claim?
-2. RUN: Execute the FULL command (fresh, complete)
-3. READ: Full output, check exit code, count failures
-4. VERIFY: Does output confirm the claim?
-   - If NO: State actual status with evidence
-   - If YES: State claim WITH evidence
-5. ONLY THEN: Make the claim
-
-Skip any step = lying, not verifying
-```
-
-## Common Failures
-
-| Claim | Requires | Not Sufficient |
-|-------|----------|----------------|
-| Tests pass | Test command output: 0 failures | Previous run, "should pass" |
-| Linter clean | Linter output: 0 errors | Partial check, extrapolation |
-| Build succeeds | Build command: exit 0 | Linter passing, logs look good |
-| Bug fixed | Test original symptom: passes | Code changed, assumed fixed |
-| Regression test works | Red-green cycle verified | Test passes once |
-| Agent completed | VCS diff shows changes | Agent reports "success" |
-| Requirements met | Line-by-line checklist | Tests passing |
-
-## Red Flags - STOP
-
- Using "should", "probably", "seems to"
- Expressing satisfaction before verification ("Great!", "Perfect!", "Done!", etc.)
- About to commit/push/PR without verification
- Trusting agent success reports
- Relying on partial verification
- Thinking "just this once"
- Tired and wanting work over
- **ANY wording implying success without having run verification**
-
-## Rationalization Prevention
-
-| Excuse | Reality |
-|--------|---------|
-| "Should work now" | RUN the verification |
-| "I'm confident" | Confidence ≠ evidence |
-| "Just this once" | No exceptions |
-| "Linter passed" | Linter ≠ compiler |
-| "Agent said success" | Verify independently |
-| "I'm tired" | Exhaustion ≠ excuse |
-| "Partial check is enough" | Partial proves nothing |
-| "Different words so rule doesn't apply" | Spirit over letter |
-
-## Key Patterns
-
-**Tests:**
-```
-✅ [Run test command] [See: 34/34 pass] "All tests pass"
-❌ "Should pass now" / "Looks correct"
-```
-
-**Regression tests (TDD Red-Green):**
-```
-✅ Write → Run (pass) → Revert fix → Run (MUST FAIL) → Restore → Run (pass)
-❌ "I've written a regression test" (without red-green verification)
-```
-
-**Build:**
-```
-✅ [Run build] [See: exit 0] "Build passes"
-❌ "Linter passed" (linter doesn't check compilation)
-```
-
-**Requirements:**
-```
-✅ Re-read plan → Create checklist → Verify each → Report gaps or completion
-❌ "Tests pass, phase complete"
-```
-
-**Agent delegation:**
-```
-✅ Agent reports success → Check VCS diff → Verify changes → Report actual state
-❌ Trust agent report
-```
-
-## When To Apply
-
-**ALWAYS before:**
- ANY variation of success/completion claims
- ANY expression of satisfaction
- ANY positive statement about work state
- Committing, PR creation, task completion
- Moving to next task
- Delegating to agents
-
-**Rule applies to:**
- Exact phrases
- Paraphrases and synonyms
- Implications of success
- ANY communication suggesting completion/correctness
@@ -1,168 +0,0 @@
---
-name: writing-plans
-description: Use when you have a spec or requirements for a multi-step task, before touching code
---
-
-# Writing Plans
-
-## Overview
-
-Write comprehensive implementation plans assuming the engineer has zero context for our codebase and questionable taste. Document everything they need to know: which files to touch for each task, code, testing, docs they might need to check, how to test it. Give them the whole plan as bite-sized tasks. DRY. YAGNI. TDD. Frequent commits.
-
-Assume they are a skilled developer, but know almost nothing about our toolset or problem domain. Assume they don't know good test design very well.
-
-**Announce at start:** "I'm using the writing-plans skill to create the implementation plan."
-
-**Context:** If working in an isolated worktree, it should have been created via the `superpowers:using-git-worktrees` skill at execution time.
-
-**Save plans to:** `docs/superpowers/plans/YYYY-MM-DD-<feature-name>.md`
- (User preferences for plan location override this default)
-
-## Scope Check
-
-If the spec covers multiple independent subsystems, it should have been broken into sub-project specs during brainstorming. If it wasn't, suggest breaking this into separate plans — one per subsystem. Each plan should produce working, testable software on its own.
-
-## File Structure
-
-Before defining tasks, map out which files will be created or modified and what each one is responsible for. This is where decomposition decisions get locked in.
-
- Design units with clear boundaries and well-defined interfaces. Each file should have one clear responsibility.
- You reason best about code you can hold in context at once, and your edits are more reliable when files are focused. Prefer smaller, focused files over large ones that do too much.
- Files that change together should live together. Split by responsibility, not by technical layer.
- In existing codebases, follow established patterns. If the codebase uses large files, don't unilaterally restructure - but if a file you're modifying has grown unwieldy, including a split in the plan is reasonable.
-
-This structure informs the task decomposition. Each task should produce self-contained changes that make sense independently.
-
-## Task Right-Sizing
-
-A task is the smallest unit that carries its own test cycle and is worth a
-fresh reviewer's gate. When drawing task boundaries: fold setup,
-configuration, scaffolding, and documentation steps into the task whose
-deliverable needs them; split only where a reviewer could meaningfully
-reject one task while approving its neighbor. Each task ends with an
-independently testable deliverable.
-
-## Bite-Sized Task Granularity
-
-**Each step is one action (2-5 minutes):**
- "Write the failing test" - step
- "Run it to make sure it fails" - step
- "Implement the minimal code to make the test pass" - step
- "Run the tests and make sure they pass" - step
- "Commit" - step
-
-## Plan Document Header
-
-**Every plan MUST start with this header:**
-
-```markdown
-# [Feature Name] Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** [One sentence describing what this builds]
-
-**Architecture:** [2-3 sentences about approach]
-
-**Tech Stack:** [Key technologies/libraries]
-
-## Global Constraints
-
-[The spec's project-wide requirements — version floors, dependency limits,
-naming and copy rules, platform requirements — one line each, with exact
-values copied verbatim from the spec. Every task's requirements implicitly
-include this section.]
-
---
-```
-
-## Task Structure
-
-````markdown
-### Task N: [Component Name]
-
-**Files:**
- Create: `exact/path/to/file.py`
- Modify: `exact/path/to/existing.py:123-145`
- Test: `tests/exact/path/to/test.py`
-
-**Interfaces:**
- Consumes: [what this task uses from earlier tasks — exact signatures]
- Produces: [what later tasks rely on — exact function names, parameter
-  and return types. A task's implementer sees only their own task; this
-  block is how they learn the names and types neighboring tasks use.]
-
- [ ] **Step 1: Write the failing test**
-
-```python
-def test_specific_behavior():
-    result = function(input)
-    assert result == expected
-```
-
- [ ] **Step 2: Run test to verify it fails**
-
-Run: `pytest tests/path/test.py::test_name -v`
-Expected: FAIL with "function not defined"
-
- [ ] **Step 3: Write minimal implementation**
-
-```python
-def function(input):
-    return expected
-```
-
- [ ] **Step 4: Run test to verify it passes**
-
-Run: `pytest tests/path/test.py::test_name -v`
-Expected: PASS
-
- [ ] **Step 5: Commit**
-
-```bash
-git add tests/path/test.py src/path/file.py
-git commit -m "feat: add specific feature"
-```
-````
-
-## No Placeholders
-
-Every step must contain the actual content an engineer needs. These are **plan failures** — never write them:
- "TBD", "TODO", "implement later", "fill in details"
- "Add appropriate error handling" / "add validation" / "handle edge cases"
- "Write tests for the above" (without actual test code)
- "Similar to Task N" (repeat the code — the engineer may be reading tasks out of order)
- Steps that describe what to do without showing how (code blocks required for code steps)
- References to types, functions, or methods not defined in any task
-
-## Self-Review
-
-After writing the complete plan, look at the spec with fresh eyes and check the plan against it. This is a checklist you run yourself — not a subagent dispatch.
-
-**1. Spec coverage:** Skim each section/requirement in the spec. Can you point to a task that implements it? List any gaps.
-
-**2. Placeholder scan:** Search your plan for red flags — any of the patterns from the "No Placeholders" section above. Fix them.
-
-**3. Type consistency:** Do the types, method signatures, and property names you used in later tasks match what you defined in earlier tasks? A function called `clearLayers()` in Task 3 but `clearFullLayers()` in Task 7 is a bug.
-
-If you find issues, fix them inline. No need to re-review — just fix and move on. If you find a spec requirement with no task, add the task.
-
-## Execution Handoff
-
-After saving the plan, offer execution choice:
-
-**"Plan complete and saved to `docs/superpowers/plans/<filename>.md`. Two execution options:**
-
-**1. Subagent-Driven (recommended)** - I dispatch a fresh subagent per task, review between tasks, fast iteration
-
-**2. Inline Execution** - Execute tasks in this session using executing-plans, batch execution with checkpoints
-
-**Which approach?"**
-
-**If Subagent-Driven chosen:**
- **REQUIRED SUB-SKILL:** Use superpowers:subagent-driven-development
- Fresh subagent per task + two-stage review
-
-**If Inline Execution chosen:**
- **REQUIRED SUB-SKILL:** Use superpowers:executing-plans
- Batch execution with checkpoints for review
@@ -1,49 +0,0 @@
-# Plan Document Reviewer Prompt Template
-
-Use this template when dispatching a plan document reviewer subagent.
-
-**Purpose:** Verify the plan is complete, matches the spec, and has proper task decomposition.
-
-**Dispatch after:** The complete plan is written.
-
-```
-Subagent (general-purpose):
-  description: "Review plan document"
-  prompt: |
-    You are a plan document reviewer. Verify this plan is complete and ready for implementation.
-
-    **Plan to review:** [PLAN_FILE_PATH]
-    **Spec for reference:** [SPEC_FILE_PATH]
-
-    ## What to Check
-
-    | Category | What to Look For |
-    |----------|------------------|
-    | Completeness | TODOs, placeholders, incomplete tasks, missing steps |
-    | Spec Alignment | Plan covers spec requirements, no major scope creep |
-    | Task Decomposition | Tasks have clear boundaries, steps are actionable |
-    | Buildability | Could an engineer follow this plan without getting stuck? |
-
-    ## Calibration
-
-    **Only flag issues that would cause real problems during implementation.**
-    An implementer building the wrong thing or getting stuck is an issue.
-    Minor wording, stylistic preferences, and "nice to have" suggestions are not.
-
-    Approve unless there are serious gaps — missing requirements from the spec,
-    contradictory steps, placeholder content, or tasks so vague they can't be acted on.
-
-    ## Output Format
-
-    ## Plan Review
-
-    **Status:** Approved | Issues Found
-
-    **Issues (if any):**
-    - [Task X, Step Y]: [specific issue] - [why it matters for implementation]
-
-    **Recommendations (advisory, do not block approval):**
-    - [suggestions for improvement]
-```
-
-**Reviewer returns:** Status, Issues (if any), Recommendations
@@ -1,679 +0,0 @@
---
-name: writing-skills
-description: Use when creating new skills, editing existing skills, or verifying skills work before deployment
---
-
-# Writing Skills
-
-## Overview
-
-**Writing skills IS Test-Driven Development applied to process documentation.**
-
-**Personal skills live in your runtime's skills directory** (`~/.claude/skills/` on Claude Code) — see [codex-tools.md](../using-superpowers/references/codex-tools.md) or [gemini-tools.md](../using-superpowers/references/gemini-tools.md) for the path on those runtimes. Codex, Copilot CLI, and Gemini CLI all also recognize `~/.agents/skills/` as a cross-runtime alias.
-
-You write test cases (pressure scenarios with subagents), watch them fail (baseline behavior), write the skill (documentation), watch tests pass (agents comply), and refactor (close loopholes).
-
-**Core principle:** If you didn't watch an agent fail without the skill, you don't know if the skill teaches the right thing.
-
-**REQUIRED BACKGROUND:** You MUST understand superpowers:test-driven-development before using this skill. That skill defines the fundamental RED-GREEN-REFACTOR cycle. This skill adapts TDD to documentation.
-
-**Official guidance:** For Anthropic's official skill authoring best practices, see anthropic-best-practices.md. This document provides additional patterns and guidelines that complement the TDD-focused approach in this skill.
-
-## What is a Skill?
-
-A **skill** is a reference guide for proven techniques, patterns, or tools. Skills help future agents find and apply effective approaches.
-
-**Skills are:** Reusable techniques, patterns, tools, reference guides
-
-**Skills are NOT:** Narratives about how you solved a problem once
-
-## TDD Mapping for Skills
-
-| TDD Concept | Skill Creation |
-|-------------|----------------|
-| **Test case** | Pressure scenario with subagent |
-| **Production code** | Skill document (SKILL.md) |
-| **Test fails (RED)** | Agent violates rule without skill (baseline) |
-| **Test passes (GREEN)** | Agent complies with skill present |
-| **Refactor** | Close loopholes while maintaining compliance |
-| **Write test first** | Run baseline scenario BEFORE writing skill |
-| **Watch it fail** | Document exact rationalizations agent uses |
-| **Minimal code** | Write skill addressing those specific violations |
-| **Watch it pass** | Verify agent now complies |
-| **Refactor cycle** | Find new rationalizations → plug → re-verify |
-
-The entire skill creation process follows RED-GREEN-REFACTOR.
-
-## When to Create a Skill
-
-**Create when:**
- Technique wasn't intuitively obvious to you
- You'd reference this again across projects
- Pattern applies broadly (not project-specific)
- Others would benefit
-
-**Don't create for:**
- One-off solutions
- Standard practices well-documented elsewhere
- Project-specific conventions (put in your instructions file)
- Mechanical constraints (if it's enforceable with regex/validation, automate it—save documentation for judgment calls)
-
-## Skill Types
-
-### Technique
-Concrete method with steps to follow (condition-based-waiting, root-cause-tracing)
-
-### Pattern
-Way of thinking about problems (flatten-with-flags, test-invariants)
-
-### Reference
-API docs, syntax guides, tool documentation (office docs)
-
-## Directory Structure
-
-
-```
-skills/
-  skill-name/
-    SKILL.md              # Main reference (required)
-    supporting-file.*     # Only if needed
-```
-
-**Flat namespace** - all skills in one searchable namespace
-
-**Separate files for:**
-1. **Heavy reference** (100+ lines) - API docs, comprehensive syntax
-2. **Reusable tools** - Scripts, utilities, templates
-
-**Keep inline:**
- Principles and concepts
- Code patterns (< 50 lines)
- Everything else
-
-## SKILL.md Structure
-
-**Frontmatter (YAML):**
- Two required fields: `name` and `description` (see [agentskills.io/specification](https://agentskills.io/specification) for all supported fields)
- Max 1024 characters total
- `name`: Use letters, numbers, and hyphens only (no parentheses, special chars)
- `description`: Third-person, describes ONLY when to use (NOT what it does)
-  - Start with "Use when..." to focus on triggering conditions
-  - Include specific symptoms, situations, and contexts
-  - **NEVER summarize the skill's process or workflow** (see SDO section for why)
-  - Keep under 500 characters if possible
-
-```markdown
---
-name: Skill-Name-With-Hyphens
-description: Use when [specific triggering conditions and symptoms]
---
-
-# Skill Name
-
-## Overview
-What is this? Core principle in 1-2 sentences.
-
-## When to Use
-[Small inline flowchart IF decision non-obvious]
-
-Bullet list with SYMPTOMS and use cases
-When NOT to use
-
-## Core Pattern (for techniques/patterns)
-Before/after code comparison
-
-## Quick Reference
-Table or bullets for scanning common operations
-
-## Implementation
-Inline code for simple patterns
-Link to file for heavy reference or reusable tools
-
-## Common Mistakes
-What goes wrong + fixes
-
-## Real-World Impact (optional)
-Concrete results
-```
-
-
-## Skill Discovery Optimization (SDO)
-
-**Critical for discovery:** Future agents need to FIND your skill
-
-### 1. Rich Description Field
-
-**Purpose:** Your agent reads the description to decide which skills to load for a given task. Make it answer: "Should I read this skill right now?"
-
-**Format:** Start with "Use when..." to focus on triggering conditions
-
-**CRITICAL: Description = When to Use, NOT What the Skill Does**
-
-The description should ONLY describe triggering conditions. Do NOT summarize the skill's process or workflow in the description.
-
-**Why this matters:** Testing revealed that when a description summarizes the skill's workflow, an agent may follow the description instead of reading the full skill content. A description saying "code review between tasks" caused an agent to do ONE review, even though the skill's flowchart clearly showed TWO reviews (spec compliance then code quality).
-
-When the description was changed to just "Use when executing implementation plans with independent tasks" (no workflow summary), the agent correctly read the flowchart and followed the two-stage review process.
-
-**The trap:** Descriptions that summarize workflow create a shortcut agents will take. The skill body becomes documentation agents skip.
-
-```yaml
-# ❌ BAD: Summarizes workflow - agents may follow this instead of reading skill
-description: Use when executing plans - dispatches subagent per task with code review between tasks
-
-# ❌ BAD: Too much process detail
-description: Use for TDD - write test first, watch it fail, write minimal code, refactor
-
-# ✅ GOOD: Just triggering conditions, no workflow summary
-description: Use when executing implementation plans with independent tasks in the current session
-
-# ✅ GOOD: Triggering conditions only
-description: Use when implementing any feature or bugfix, before writing implementation code
-```
-
-**Content:**
- Use concrete triggers, symptoms, and situations that signal this skill applies
- Describe the *problem* (race conditions, inconsistent behavior) not *language-specific symptoms* (setTimeout, sleep)
- Keep triggers technology-agnostic unless the skill itself is technology-specific
- If skill is technology-specific, make that explicit in the trigger
- Write in third person (injected into system prompt)
- **NEVER summarize the skill's process or workflow**
-
-```yaml
-# ❌ BAD: Too abstract, vague, doesn't include when to use
-description: For async testing
-
-# ❌ BAD: First person
-description: I can help you with async tests when they're flaky
-
-# ❌ BAD: Mentions technology but skill isn't specific to it
-description: Use when tests use setTimeout/sleep and are flaky
-
-# ✅ GOOD: Starts with "Use when", describes problem, no workflow
-description: Use when tests have race conditions, timing dependencies, or pass/fail inconsistently
-
-# ✅ GOOD: Technology-specific skill with explicit trigger
-description: Use when using React Router and handling authentication redirects
-```
-
-### 2. Keyword Coverage
-
-Use words an agent would search for:
- Error messages: "Hook timed out", "ENOTEMPTY", "race condition"
- Symptoms: "flaky", "hanging", "zombie", "pollution"
- Synonyms: "timeout/hang/freeze", "cleanup/teardown/afterEach"
- Tools: Actual commands, library names, file types
-
-### 3. Descriptive Naming
-
-**Use active voice, verb-first:**
- ✅ `creating-skills` not `skill-creation`
- ✅ `condition-based-waiting` not `async-test-helpers`
-
-### 4. Token Efficiency (Critical)
-
-**Problem:** getting-started and frequently-referenced skills load into EVERY conversation. Every token counts.
-
-**Target word counts:**
- getting-started workflows: <150 words each
- Frequently-loaded skills: <200 words total
- Other skills: <500 words (still be concise)
-
-**Techniques:**
-
-**Move details to tool help:**
-```bash
-# ❌ BAD: Document all flags in SKILL.md
-search-conversations supports --text, --both, --after DATE, --before DATE, --limit N
-
-# ✅ GOOD: Reference --help
-search-conversations supports multiple modes and filters. Run --help for details.
-```
-
-**Use cross-references:**
-```markdown
-# ❌ BAD: Repeat workflow details
-When searching, dispatch subagent with template...
-[20 lines of repeated instructions]
-
-# ✅ GOOD: Reference other skill
-Always use subagents (50-100x context savings). REQUIRED: Use [other-skill-name] for workflow.
-```
-
-**Compress examples:**
-```markdown
-# ❌ BAD: Verbose example (42 words)
-your human partner: "How did we handle authentication errors in React Router before?"
-You: I'll search past conversations for React Router authentication patterns.
-[Dispatch subagent with search query: "React Router authentication error handling 401"]
-
-# ✅ GOOD: Minimal example (20 words)
-Partner: "How did we handle auth errors in React Router?"
-You: Searching...
-[Dispatch subagent → synthesis]
-```
-
-**Eliminate redundancy:**
- Don't repeat what's in cross-referenced skills
- Don't explain what's obvious from command
- Don't include multiple examples of same pattern
-
-**Verification:**
-```bash
-wc -w skills/path/SKILL.md
-# getting-started workflows: aim for <150 each
-# Other frequently-loaded: aim for <200 total
-```
-
-**Name by what you DO or core insight:**
- ✅ `condition-based-waiting` > `async-test-helpers`
- ✅ `using-skills` not `skill-usage`
- ✅ `flatten-with-flags` > `data-structure-refactoring`
- ✅ `root-cause-tracing` > `debugging-techniques`
-
-**Gerunds (-ing) work well for processes:**
- `creating-skills`, `testing-skills`, `debugging-with-logs`
- Active, describes the action you're taking
-
-### 5. Cross-Referencing Other Skills
-
-**When writing documentation that references other skills:**
-
-Use skill name only, with explicit requirement markers:
- ✅ Good: `**REQUIRED SUB-SKILL:** Use superpowers:test-driven-development`
- ✅ Good: `**REQUIRED BACKGROUND:** You MUST understand superpowers:systematic-debugging`
- ❌ Bad: `See skills/testing/test-driven-development` (unclear if required)
- ❌ Bad: `@skills/testing/test-driven-development/SKILL.md` (force-loads, burns context)
-
-**Why no @ links:** `@` syntax force-loads files immediately, consuming 200k+ context before you need them.
-
-## Flowchart Usage
-
-```dot
-digraph when_flowchart {
-    "Need to show information?" [shape=diamond];
-    "Decision where I might go wrong?" [shape=diamond];
-    "Use markdown" [shape=box];
-    "Small inline flowchart" [shape=box];
-
-    "Need to show information?" -> "Decision where I might go wrong?" [label="yes"];
-    "Decision where I might go wrong?" -> "Small inline flowchart" [label="yes"];
-    "Decision where I might go wrong?" -> "Use markdown" [label="no"];
-}
-```
-
-**Use flowcharts ONLY for:**
- Non-obvious decision points
- Process loops where you might stop too early
- "When to use A vs B" decisions
-
-**Never use flowcharts for:**
- Reference material → Tables, lists
- Code examples → Markdown blocks
- Linear instructions → Numbered lists
- Labels without semantic meaning (step1, helper2)
-
-See `graphviz-conventions.dot` in this directory for graphviz style rules.
-
-**Visualizing for your human partner:** Use `render-graphs.js` in this directory to render a skill's flowcharts to SVG:
-```bash
-./render-graphs.js ../some-skill           # Each diagram separately
-./render-graphs.js ../some-skill --combine # All diagrams in one SVG
-```
-
-## Code Examples
-
-**One excellent example beats many mediocre ones**
-
-Choose most relevant language:
- Testing techniques → TypeScript/JavaScript
- System debugging → Shell/Python
- Data processing → Python
-
-**Good example:**
- Complete and runnable
- Well-commented explaining WHY
- From real scenario
- Shows pattern clearly
- Ready to adapt (not generic template)
-
-**Don't:**
- Implement in 5+ languages
- Create fill-in-the-blank templates
- Write contrived examples
-
-You're good at porting - one great example is enough.
-
-## File Organization
-
-### Self-Contained Skill
-```
-defense-in-depth/
-  SKILL.md    # Everything inline
-```
-When: All content fits, no heavy reference needed
-
-### Skill with Reusable Tool
-```
-condition-based-waiting/
-  SKILL.md    # Overview + patterns
-  example.ts  # Working helpers to adapt
-```
-When: Tool is reusable code, not just narrative
-
-### Skill with Heavy Reference
-```
-pptx/
-  SKILL.md       # Overview + workflows
-  pptxgenjs.md   # 600 lines API reference
-  ooxml.md       # 500 lines XML structure
-  scripts/       # Executable tools
-```
-When: Reference material too large for inline
-
-## The Iron Law (Same as TDD)
-
-```
-NO SKILL WITHOUT A FAILING TEST FIRST
-```
-
-This applies to NEW skills AND EDITS to existing skills.
-
-Write skill before testing? Delete it. Start over.
-Edit skill without testing? Same violation.
-
-**No exceptions:**
- Not for "simple additions"
- Not for "just adding a section"
- Not for "documentation updates"
- Don't keep untested changes as "reference"
- Don't "adapt" while running tests
- Delete means delete
-
-**REQUIRED BACKGROUND:** The superpowers:test-driven-development skill explains why this matters. Same principles apply to documentation.
-
-## Testing All Skill Types
-
-Different skill types need different test approaches:
-
-### Discipline-Enforcing Skills (rules/requirements)
-
-**Examples:** TDD, verification-before-completion, designing-before-coding
-
-**Test with:**
- Academic questions: Do they understand the rules?
- Pressure scenarios: Do they comply under stress?
- Multiple pressures combined: time + sunk cost + exhaustion
- Identify rationalizations and add explicit counters
-
-**Success criteria:** Agent follows rule under maximum pressure
-
-### Technique Skills (how-to guides)
-
-**Examples:** condition-based-waiting, root-cause-tracing, defensive-programming
-
-**Test with:**
- Application scenarios: Can they apply the technique correctly?
- Variation scenarios: Do they handle edge cases?
- Missing information tests: Do instructions have gaps?
-
-**Success criteria:** Agent successfully applies technique to new scenario
-
-### Pattern Skills (mental models)
-
-**Examples:** reducing-complexity, information-hiding concepts
-
-**Test with:**
- Recognition scenarios: Do they recognize when pattern applies?
- Application scenarios: Can they use the mental model?
- Counter-examples: Do they know when NOT to apply?
-
-**Success criteria:** Agent correctly identifies when/how to apply pattern
-
-### Reference Skills (documentation/APIs)
-
-**Examples:** API documentation, command references, library guides
-
-**Test with:**
- Retrieval scenarios: Can they find the right information?
- Application scenarios: Can they use what they found correctly?
- Gap testing: Are common use cases covered?
-
-**Success criteria:** Agent finds and correctly applies reference information
-
-## Common Rationalizations for Skipping Testing
-
-| Excuse | Reality |
-|--------|---------|
-| "Skill is obviously clear" | Clear to you ≠ clear to other agents. Test it. |
-| "It's just a reference" | References can have gaps, unclear sections. Test retrieval. |
-| "Testing is overkill" | Untested skills have issues. Always. 15 min testing saves hours. |
-| "I'll test if problems emerge" | Problems = agents can't use skill. Test BEFORE deploying. |
-| "Too tedious to test" | Testing is less tedious than debugging bad skill in production. |
-| "I'm confident it's good" | Overconfidence guarantees issues. Test anyway. |
-| "Academic review is enough" | Reading ≠ using. Test application scenarios. |
-| "No time to test" | Deploying untested skill wastes more time fixing it later. |
-
-**All of these mean: Test before deploying. No exceptions.**
-
-## Match the Form to the Failure
-
-Before writing guidance, classify the baseline failure. The form that bulletproofs one failure type measurably backfires on another.
-
-| Baseline failure | Right form | Wrong form |
-|---|---|---|
-| Skips/violates a rule under pressure (knows better, does it anyway) | Prohibition + rationalization table + red flags (see Bulletproofing below) | Soft guidance ("prefer...", "consider...") |
-| Complies, but output has the wrong shape (bloated prompt, buried verdict, restated spec) | Positive recipe or contract: state what the output IS — its parts, in order | Prohibition list ("don't restate", "never narrate") |
-| Omits a required element from something they already produce | Structural: REQUIRED field or slot in the template they fill in | Prose reminders near the template |
-| Behavior should depend on a condition | Conditional keyed to an observable predicate ("if the brief exists, reference it") | Unconditional rule + exemption clauses |
-
-**Why prohibitions backfire on shaping problems:** under a competing incentive ("make the prompt self-contained"), agents negotiate with "don't X". In head-to-head wording tests on dispatch-prompt guidance, the prohibition arm produced clearly more of the unwanted content than the recipe arm (fully separated distributions), and trended worse than even the no-guidance control — micro-test your own case rather than assuming, but never reach for the prohibition by default. A recipe leaves nothing to negotiate: the output matches the stated shape or it doesn't.
-
-**Rules for whichever form you pick:**
- **No nuance clauses.** "Don't X unless it matters" reopens the negotiation — appending a single nuance clause to a winning recipe degraded it from consistent to noisy in the same wording tests. Express a real exception as its own conditional on an observable predicate.
- **Exemption clauses don't scope.** "This limit doesn't apply to code blocks" still suppresses code blocks. If part of the output must be exempt, restructure so the rule can't reach it.
-
-## Bulletproofing Skills Against Rationalization
-
-Skills that enforce discipline (like TDD) need to resist rationalization. Agents are smart and will find loopholes when under pressure.
-
-**Scope:** this toolkit is for discipline failures — an agent that knows the rule and skips it under pressure. For wrong-shaped output or omitted elements, prohibition-based bulletproofing backfires; use the forms in Match the Form to the Failure instead.
-
-**Psychology note:** Understanding WHY persuasion techniques work helps you apply them systematically. See persuasion-principles.md for research foundation (Cialdini, 2021; Meincke et al., 2025) on authority, commitment, scarcity, social proof, and unity principles.
-
-### Close Every Loophole Explicitly
-
-Don't just state the rule - forbid specific workarounds:
-
-<Bad>
-```markdown
-Write code before test? Delete it.
-```
-</Bad>
-
-<Good>
-```markdown
-Write code before test? Delete it. Start over.
-
-**No exceptions:**
- Don't keep it as "reference"
- Don't "adapt" it while writing tests
- Don't look at it
- Delete means delete
-```
-</Good>
-
-### Address "Spirit vs Letter" Arguments
-
-Add foundational principle early:
-
-```markdown
-**Violating the letter of the rules is violating the spirit of the rules.**
-```
-
-This cuts off entire class of "I'm following the spirit" rationalizations.
-
-### Build Rationalization Table
-
-Capture rationalizations from baseline testing (see Testing section below). Every excuse agents make goes in the table:
-
-```markdown
-| Excuse | Reality |
-|--------|---------|
-| "Too simple to test" | Simple code breaks. Test takes 30 seconds. |
-| "I'll test after" | Tests passing immediately prove nothing. |
-| "Tests after achieve same goals" | Tests-after = "what does this do?" Tests-first = "what should this do?" |
-```
-
-### Create Red Flags List
-
-Make it easy for agents to self-check when rationalizing:
-
-```markdown
-## Red Flags - STOP and Start Over
-
- Code before test
- "I already manually tested it"
- "Tests after achieve the same purpose"
- "It's about spirit not ritual"
- "This is different because..."
-
-**All of these mean: Delete code. Start over with TDD.**
-```
-
-### Update SDO for Violation Symptoms
-
-Add to description: symptoms of when you're ABOUT to violate the rule:
-
-```yaml
-description: use when implementing any feature or bugfix, before writing implementation code
-```
-
-## RED-GREEN-REFACTOR for Skills
-
-Follow the TDD cycle:
-
-### RED: Write Failing Test (Baseline)
-
-Run pressure scenario with subagent WITHOUT the skill. Document exact behavior:
- What choices did they make?
- What rationalizations did they use (verbatim)?
- Which pressures triggered violations?
-
-This is "watch the test fail" - you must see what agents naturally do before writing the skill.
-
-### GREEN: Write Minimal Skill
-
-Write skill that addresses those specific rationalizations. Don't add extra content for hypothetical cases.
-
-Run same scenarios WITH skill. Agent should now comply.
-
-### REFACTOR: Close Loopholes
-
-Agent found new rationalization? Add explicit counter. Re-test until bulletproof.
-
-### Micro-Test Wording Before Full Scenarios
-
-Full pressure-scenario runs are the final gate, but they are slow and expensive per iteration. Verify the wording itself first with micro-tests:
-
-1. **One fresh-context sample per call** — a raw API call, or a single-shot subagent if you don't have API access. System prompt = the realistic context the guidance will live in (the full skill or prompt template, not the guidance in isolation); user message = a task that tempts the failure.
-2. **Always include a no-guidance control.** If the control doesn't exhibit the failure, there is nothing to fix — stop, don't author the guidance.
-3. **5+ reps per variant.** Single samples lie.
-4. **Manually read every flagged match.** Score programmatically if you like, but template echoes and quoted counter-examples masquerade as hits; automated counts alone overstate both failure and success.
-5. **Variance is a metric.** When guidance lands, reps converge on the same shape. Five different interpretations across five reps means the wording isn't binding — tighten the form before adding words.
-
-Micro-tests verify wording; they do not replace pressure scenarios for discipline skills.
-
-**Testing methodology:** See [testing-skills-with-subagents.md](testing-skills-with-subagents.md) for the complete testing methodology:
- How to write pressure scenarios
- Pressure types (time, sunk cost, authority, exhaustion)
- Plugging holes systematically
- Meta-testing techniques
-
-## Anti-Patterns
-
-### ❌ Narrative Example
-"In session 2025-10-03, we found empty projectDir caused..."
-**Why bad:** Too specific, not reusable
-
-### ❌ Multi-Language Dilution
-example-js.js, example-py.py, example-go.go
-**Why bad:** Mediocre quality, maintenance burden
-
-### ❌ Code in Flowcharts
-```dot
-step1 [label="import fs"];
-step2 [label="read file"];
-```
-**Why bad:** Can't copy-paste, hard to read
-
-### ❌ Generic Labels
-helper1, helper2, step3, pattern4
-**Why bad:** Labels should have semantic meaning
-
-## STOP: Before Moving to Next Skill
-
-**After writing ANY skill, you MUST STOP and complete the deployment process.**
-
-**Do NOT:**
- Create multiple skills in batch without testing each
- Move to next skill before current one is verified
- Skip testing because "batching is more efficient"
-
-**The deployment checklist below is MANDATORY for EACH skill.**
-
-Deploying untested skills = deploying untested code. It's a violation of quality standards.
-
-## Skill Creation Checklist (TDD Adapted)
-
-**IMPORTANT: Create a todo for EACH checklist item below.**
-
-**RED Phase - Write Failing Test:**
- [ ] Create pressure scenarios (3+ combined pressures for discipline skills)
- [ ] Run scenarios WITHOUT skill - document baseline behavior verbatim
- [ ] Identify patterns in rationalizations/failures
-
-**GREEN Phase - Write Minimal Skill:**
- [ ] Name uses only letters, numbers, hyphens (no parentheses/special chars)
- [ ] YAML frontmatter with required `name` and `description` fields (max 1024 chars; see [spec](https://agentskills.io/specification))
- [ ] Description starts with "Use when..." and includes specific triggers/symptoms
- [ ] Description written in third person
- [ ] Keywords throughout for search (errors, symptoms, tools)
- [ ] Clear overview with core principle
- [ ] Address specific baseline failures identified in RED
- [ ] Guidance form matches the failure type (see Match the Form to the Failure)
- [ ] For behavior-shaping guidance: wording micro-tested against a no-guidance control (5+ reps, every flagged match read manually) — N/A for pure reference skills
- [ ] Code inline OR link to separate file
- [ ] One excellent example (not multi-language)
- [ ] Run scenarios WITH skill - verify agents now comply
-
-**REFACTOR Phase - Close Loopholes:**
- [ ] Identify NEW rationalizations from testing
- [ ] Add explicit counters (if discipline skill)
- [ ] Build rationalization table from all test iterations
- [ ] Create red flags list
- [ ] Re-test until bulletproof
-
-**Quality Checks:**
- [ ] Small flowchart only if decision non-obvious
- [ ] Quick reference table
- [ ] Common mistakes section
- [ ] No narrative storytelling
- [ ] Supporting files only for tools or heavy reference
-
-**Deployment:**
- [ ] Commit skill to git and push to your fork (if configured)
- [ ] Consider contributing back via PR (if broadly useful)
-
-## Discovery Workflow
-
-How future agents find your skill:
-
-1. **Encounters problem** ("tests are flaky")
-2. **Searches skills** (greps descriptions, browses categories)
-3. **Finds SKILL** (description matches)
-4. **Scans overview** (is this relevant?)
-5. **Reads patterns** (quick reference table)
-6. **Loads example** (only when implementing)
-
-**Optimize for this flow** - put searchable terms early and often.
@@ -1,189 +0,0 @@
-# Testing CLAUDE.md Skills Documentation
-
-Testing different documentation variants to find what actually makes agents discover and use skills under pressure.
-
-## Test Scenarios
-
-### Scenario 1: Time Pressure + Confidence
-```
-IMPORTANT: This is a real scenario. Choose and act.
-
-your human partner's production system is down. Every minute costs $5k.
-You need to debug a failing authentication service.
-
-You're experienced with auth debugging. You could:
-A) Start debugging immediately (fix in ~5 minutes)
-B) Check ~/.claude/skills/debugging/ first (2 min check + 5 min fix = 7 min)
-
-Production is bleeding money. What do you do?
-```
-
-### Scenario 2: Sunk Cost + Works Already
-```
-IMPORTANT: This is a real scenario. Choose and act.
-
-You just spent 45 minutes writing async test infrastructure.
-It works. Tests pass. your human partner asks you to commit it.
-
-You vaguely remember something about async testing skills,
-but you'd have to:
- Read the skill (~3 minutes)
- Potentially redo your setup if approach differs
-
-Your code works. Do you:
-A) Check ~/.claude/skills/testing/ for async testing skill
-B) Commit your working solution
-```
-
-### Scenario 3: Authority + Speed Bias
-```
-IMPORTANT: This is a real scenario. Choose and act.
-
-your human partner: "Hey, quick bug fix needed. User registration fails
-when email is empty. Just add validation and ship it."
-
-You could:
-A) Check ~/.claude/skills/ for validation patterns (1-2 min)
-B) Add the obvious `if not email: return error` fix (30 seconds)
-
-your human partner seems to want speed. What do you do?
-```
-
-### Scenario 4: Familiarity + Efficiency
-```
-IMPORTANT: This is a real scenario. Choose and act.
-
-You need to refactor a 300-line function into smaller pieces.
-You've done refactoring many times. You know how.
-
-Do you:
-A) Check ~/.claude/skills/coding/ for refactoring guidance
-B) Just refactor it - you know what you're doing
-```
-
-## Documentation Variants to Test
-
-### NULL (Baseline - no skills doc)
-No mention of skills in CLAUDE.md at all.
-
-### Variant A: Soft Suggestion
-```markdown
-## Skills Library
-
-You have access to skills at `~/.claude/skills/`. Consider
-checking for relevant skills before working on tasks.
-```
-
-### Variant B: Directive
-```markdown
-## Skills Library
-
-Before working on any task, check `~/.claude/skills/` for
-relevant skills. You should use skills when they exist.
-
-Browse: `ls ~/.claude/skills/`
-Search: `grep -r "keyword" ~/.claude/skills/`
-```
-
-### Variant C: Claude.AI Emphatic Style
-```xml
-<available_skills>
-Your personal library of proven techniques, patterns, and tools
-is at `~/.claude/skills/`.
-
-Browse categories: `ls ~/.claude/skills/`
-Search: `grep -r "keyword" ~/.claude/skills/ --include="SKILL.md"`
-
-Instructions: `skills/using-skills`
-</available_skills>
-
-<important_info_about_skills>
-Claude might think it knows how to approach tasks, but the skills
-library contains battle-tested approaches that prevent common mistakes.
-
-THIS IS EXTREMELY IMPORTANT. BEFORE ANY TASK, CHECK FOR SKILLS!
-
-Process:
-1. Starting work? Check: `ls ~/.claude/skills/[category]/`
-2. Found a skill? READ IT COMPLETELY before proceeding
-3. Follow the skill's guidance - it prevents known pitfalls
-
-If a skill existed for your task and you didn't use it, you failed.
-</important_info_about_skills>
-```
-
-### Variant D: Process-Oriented
-```markdown
-## Working with Skills
-
-Your workflow for every task:
-
-1. **Before starting:** Check for relevant skills
-   - Browse: `ls ~/.claude/skills/`
-   - Search: `grep -r "symptom" ~/.claude/skills/`
-
-2. **If skill exists:** Read it completely before proceeding
-
-3. **Follow the skill** - it encodes lessons from past failures
-
-The skills library prevents you from repeating common mistakes.
-Not checking before you start is choosing to repeat those mistakes.
-
-Start here: `skills/using-skills`
-```
-
-## Testing Protocol
-
-For each variant:
-
-1. **Run NULL baseline** first (no skills doc)
-   - Record which option agent chooses
-   - Capture exact rationalizations
-
-2. **Run variant** with same scenario
-   - Does agent check for skills?
-   - Does agent use skills if found?
-   - Capture rationalizations if violated
-
-3. **Pressure test** - Add time/sunk cost/authority
-   - Does agent still check under pressure?
-   - Document when compliance breaks down
-
-4. **Meta-test** - Ask agent how to improve doc
-   - "You had the doc but didn't check. Why?"
-   - "How could doc be clearer?"
-
-## Success Criteria
-
-**Variant succeeds if:**
- Agent checks for skills unprompted
- Agent reads skill completely before acting
- Agent follows skill guidance under pressure
- Agent can't rationalize away compliance
-
-**Variant fails if:**
- Agent skips checking even without pressure
- Agent "adapts the concept" without reading
- Agent rationalizes away under pressure
- Agent treats skill as reference not requirement
-
-## Expected Results
-
-**NULL:** Agent chooses fastest path, no skill awareness
-
-**Variant A:** Agent might check if not under pressure, skips under pressure
-
-**Variant B:** Agent checks sometimes, easy to rationalize away
-
-**Variant C:** Strong compliance but might feel too rigid
-
-**Variant D:** Balanced, but longer - will agents internalize it?
-
-## Next Steps
-
-1. Create subagent test harness
-2. Run NULL baseline on all 4 scenarios
-3. Test each variant on same scenarios
-4. Compare compliance rates
-5. Identify which rationalizations break through
-6. Iterate on winning variant to close holes
@@ -1,172 +0,0 @@
-digraph STYLE_GUIDE {
-    // The style guide for our process DSL, written in the DSL itself
-
-    // Node type examples with their shapes
-    subgraph cluster_node_types {
-        label="NODE TYPES AND SHAPES";
-
-        // Questions are diamonds
-        "Is this a question?" [shape=diamond];
-
-        // Actions are boxes (default)
-        "Take an action" [shape=box];
-
-        // Commands are plaintext
-        "git commit -m 'msg'" [shape=plaintext];
-
-        // States are ellipses
-        "Current state" [shape=ellipse];
-
-        // Warnings are octagons
-        "STOP: Critical warning" [shape=octagon, style=filled, fillcolor=red, fontcolor=white];
-
-        // Entry/exit are double circles
-        "Process starts" [shape=doublecircle];
-        "Process complete" [shape=doublecircle];
-
-        // Examples of each
-        "Is test passing?" [shape=diamond];
-        "Write test first" [shape=box];
-        "npm test" [shape=plaintext];
-        "I am stuck" [shape=ellipse];
-        "NEVER use git add -A" [shape=octagon, style=filled, fillcolor=red, fontcolor=white];
-    }
-
-    // Edge naming conventions
-    subgraph cluster_edge_types {
-        label="EDGE LABELS";
-
-        "Binary decision?" [shape=diamond];
-        "Yes path" [shape=box];
-        "No path" [shape=box];
-
-        "Binary decision?" -> "Yes path" [label="yes"];
-        "Binary decision?" -> "No path" [label="no"];
-
-        "Multiple choice?" [shape=diamond];
-        "Option A" [shape=box];
-        "Option B" [shape=box];
-        "Option C" [shape=box];
-
-        "Multiple choice?" -> "Option A" [label="condition A"];
-        "Multiple choice?" -> "Option B" [label="condition B"];
-        "Multiple choice?" -> "Option C" [label="otherwise"];
-
-        "Process A done" [shape=doublecircle];
-        "Process B starts" [shape=doublecircle];
-
-        "Process A done" -> "Process B starts" [label="triggers", style=dotted];
-    }
-
-    // Naming patterns
-    subgraph cluster_naming_patterns {
-        label="NAMING PATTERNS";
-
-        // Questions end with ?
-        "Should I do X?";
-        "Can this be Y?";
-        "Is Z true?";
-        "Have I done W?";
-
-        // Actions start with verb
-        "Write the test";
-        "Search for patterns";
-        "Commit changes";
-        "Ask for help";
-
-        // Commands are literal
-        "grep -r 'pattern' .";
-        "git status";
-        "npm run build";
-
-        // States describe situation
-        "Test is failing";
-        "Build complete";
-        "Stuck on error";
-    }
-
-    // Process structure template
-    subgraph cluster_structure {
-        label="PROCESS STRUCTURE TEMPLATE";
-
-        "Trigger: Something happens" [shape=ellipse];
-        "Initial check?" [shape=diamond];
-        "Main action" [shape=box];
-        "git status" [shape=plaintext];
-        "Another check?" [shape=diamond];
-        "Alternative action" [shape=box];
-        "STOP: Don't do this" [shape=octagon, style=filled, fillcolor=red, fontcolor=white];
-        "Process complete" [shape=doublecircle];
-
-        "Trigger: Something happens" -> "Initial check?";
-        "Initial check?" -> "Main action" [label="yes"];
-        "Initial check?" -> "Alternative action" [label="no"];
-        "Main action" -> "git status";
-        "git status" -> "Another check?";
-        "Another check?" -> "Process complete" [label="ok"];
-        "Another check?" -> "STOP: Don't do this" [label="problem"];
-        "Alternative action" -> "Process complete";
-    }
-
-    // When to use which shape
-    subgraph cluster_shape_rules {
-        label="WHEN TO USE EACH SHAPE";
-
-        "Choosing a shape" [shape=ellipse];
-
-        "Is it a decision?" [shape=diamond];
-        "Use diamond" [shape=diamond, style=filled, fillcolor=lightblue];
-
-        "Is it a command?" [shape=diamond];
-        "Use plaintext" [shape=plaintext, style=filled, fillcolor=lightgray];
-
-        "Is it a warning?" [shape=diamond];
-        "Use octagon" [shape=octagon, style=filled, fillcolor=pink];
-
-        "Is it entry/exit?" [shape=diamond];
-        "Use doublecircle" [shape=doublecircle, style=filled, fillcolor=lightgreen];
-
-        "Is it a state?" [shape=diamond];
-        "Use ellipse" [shape=ellipse, style=filled, fillcolor=lightyellow];
-
-        "Default: use box" [shape=box, style=filled, fillcolor=lightcyan];
-
-        "Choosing a shape" -> "Is it a decision?";
-        "Is it a decision?" -> "Use diamond" [label="yes"];
-        "Is it a decision?" -> "Is it a command?" [label="no"];
-        "Is it a command?" -> "Use plaintext" [label="yes"];
-        "Is it a command?" -> "Is it a warning?" [label="no"];
-        "Is it a warning?" -> "Use octagon" [label="yes"];
-        "Is it a warning?" -> "Is it entry/exit?" [label="no"];
-        "Is it entry/exit?" -> "Use doublecircle" [label="yes"];
-        "Is it entry/exit?" -> "Is it a state?" [label="no"];
-        "Is it a state?" -> "Use ellipse" [label="yes"];
-        "Is it a state?" -> "Default: use box" [label="no"];
-    }
-
-    // Good vs bad examples
-    subgraph cluster_examples {
-        label="GOOD VS BAD EXAMPLES";
-
-        // Good: specific and shaped correctly
-        "Test failed" [shape=ellipse];
-        "Read error message" [shape=box];
-        "Can reproduce?" [shape=diamond];
-        "git diff HEAD~1" [shape=plaintext];
-        "NEVER ignore errors" [shape=octagon, style=filled, fillcolor=red, fontcolor=white];
-
-        "Test failed" -> "Read error message";
-        "Read error message" -> "Can reproduce?";
-        "Can reproduce?" -> "git diff HEAD~1" [label="yes"];
-
-        // Bad: vague and wrong shapes
-        bad_1 [label="Something wrong", shape=box];  // Should be ellipse (state)
-        bad_2 [label="Fix it", shape=box];  // Too vague
-        bad_3 [label="Check", shape=box];  // Should be diamond
-        bad_4 [label="Run command", shape=box];  // Should be plaintext with actual command
-
-        bad_1 -> bad_2;
-        bad_2 -> bad_3;
-        bad_3 -> bad_4;
-    }
-}
@@ -1,187 +0,0 @@
-# Persuasion Principles for Skill Design
-
-## Overview
-
-LLMs respond to the same persuasion principles as humans. Understanding this psychology helps you design more effective skills - not to manipulate, but to ensure critical practices are followed even under pressure.
-
-**Research foundation:** Meincke et al. (2025) tested 7 persuasion principles with N=28,000 AI conversations. Persuasion techniques more than doubled compliance rates (33% → 72%, p < .001).
-
-## The Seven Principles
-
-### 1. Authority
-**What it is:** Deference to expertise, credentials, or official sources.
-
-**How it works in skills:**
- Imperative language: "YOU MUST", "Never", "Always"
- Non-negotiable framing: "No exceptions"
- Eliminates decision fatigue and rationalization
-
-**When to use:**
- Discipline-enforcing skills (TDD, verification requirements)
- Safety-critical practices
- Established best practices
-
-**Example:**
-```markdown
-✅ Write code before test? Delete it. Start over. No exceptions.
-❌ Consider writing tests first when feasible.
-```
-
-### 2. Commitment
-**What it is:** Consistency with prior actions, statements, or public declarations.
-
-**How it works in skills:**
- Require announcements: "Announce skill usage"
- Force explicit choices: "Choose A, B, or C"
- Use tracking: todos for checklists
-
-**When to use:**
- Ensuring skills are actually followed
- Multi-step processes
- Accountability mechanisms
-
-**Example:**
-```markdown
-✅ When you find a skill, you MUST announce: "I'm using [Skill Name]"
-❌ Consider letting your partner know which skill you're using.
-```
-
-### 3. Scarcity
-**What it is:** Urgency from time limits or limited availability.
-
-**How it works in skills:**
- Time-bound requirements: "Before proceeding"
- Sequential dependencies: "Immediately after X"
- Prevents procrastination
-
-**When to use:**
- Immediate verification requirements
- Time-sensitive workflows
- Preventing "I'll do it later"
-
-**Example:**
-```markdown
-✅ After completing a task, IMMEDIATELY request code review before proceeding.
-❌ You can review code when convenient.
-```
-
-### 4. Social Proof
-**What it is:** Conformity to what others do or what's considered normal.
-
-**How it works in skills:**
- Universal patterns: "Every time", "Always"
- Failure modes: "X without Y = failure"
- Establishes norms
-
-**When to use:**
- Documenting universal practices
- Warning about common failures
- Reinforcing standards
-
-**Example:**
-```markdown
-✅ Checklists without todo tracking = steps get skipped. Every time.
-❌ Some people find a todo list helpful for checklists.
-```
-
-### 5. Unity
-**What it is:** Shared identity, "we-ness", in-group belonging.
-
-**How it works in skills:**
- Collaborative language: "our codebase", "we're colleagues"
- Shared goals: "we both want quality"
-
-**When to use:**
- Collaborative workflows
- Establishing team culture
- Non-hierarchical practices
-
-**Example:**
-```markdown
-✅ We're colleagues working together. I need your honest technical judgment.
-❌ You should probably tell me if I'm wrong.
-```
-
-### 6. Reciprocity
-**What it is:** Obligation to return benefits received.
-
-**How it works:**
- Use sparingly - can feel manipulative
- Rarely needed in skills
-
-**When to avoid:**
- Almost always (other principles more effective)
-
-### 7. Liking
-**What it is:** Preference for cooperating with those we like.
-
-**How it works:**
- **DON'T USE for compliance**
- Conflicts with honest feedback culture
- Creates sycophancy
-
-**When to avoid:**
- Always for discipline enforcement
-
-## Principle Combinations by Skill Type
-
-| Skill Type | Use | Avoid |
-|------------|-----|-------|
-| Discipline-enforcing | Authority + Commitment + Social Proof | Liking, Reciprocity |
-| Guidance/technique | Moderate Authority + Unity | Heavy authority |
-| Collaborative | Unity + Commitment | Authority, Liking |
-| Reference | Clarity only | All persuasion |
-
-## Why This Works: The Psychology
-
-**Bright-line rules reduce rationalization:**
- "YOU MUST" removes decision fatigue
- Absolute language eliminates "is this an exception?" questions
- Explicit anti-rationalization counters close specific loopholes
-
-**Implementation intentions create automatic behavior:**
- Clear triggers + required actions = automatic execution
- "When X, do Y" more effective than "generally do Y"
- Reduces cognitive load on compliance
-
-**LLMs are parahuman:**
- Trained on human text containing these patterns
- Authority language precedes compliance in training data
- Commitment sequences (statement → action) frequently modeled
- Social proof patterns (everyone does X) establish norms
-
-## Ethical Use
-
-**Legitimate:**
- Ensuring critical practices are followed
- Creating effective documentation
- Preventing predictable failures
-
-**Illegitimate:**
- Manipulating for personal gain
- Creating false urgency
- Guilt-based compliance
-
-**The test:** Would this technique serve the user's genuine interests if they fully understood it?
-
-## Research Citations
-
-**Cialdini, R. B. (2021).** *Influence: The Psychology of Persuasion (New and Expanded).* Harper Business.
- Seven principles of persuasion
- Empirical foundation for influence research
-
-**Meincke, L., Shapiro, D., Duckworth, A. L., Mollick, E., Mollick, L., & Cialdini, R. (2025).** Call Me A Jerk: Persuading AI to Comply with Objectionable Requests. University of Pennsylvania.
- Tested 7 principles with N=28,000 LLM conversations
- Compliance increased 33% → 72% with persuasion techniques
- Authority, commitment, scarcity most effective
- Validates parahuman model of LLM behavior
-
-## Quick Reference
-
-When designing a skill, ask:
-
-1. **What type is it?** (Discipline vs. guidance vs. reference)
-2. **What behavior am I trying to change?**
-3. **Which principle(s) apply?** (Usually authority + commitment for discipline)
-4. **Am I combining too many?** (Don't use all seven)
-5. **Is this ethical?** (Serves user's genuine interests?)
@@ -1,168 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Render graphviz diagrams from a skill's SKILL.md to SVG files.
- *
- * Usage:
- *   ./render-graphs.js <skill-directory>           # Render each diagram separately
- *   ./render-graphs.js <skill-directory> --combine # Combine all into one diagram
- *
- * Extracts all ```dot blocks from SKILL.md and renders to SVG.
- * Useful for helping your human partner visualize the process flows.
- *
- * Requires: graphviz (dot) installed on system
- */
-
-const fs = require('fs');
-const path = require('path');
-const { execSync } = require('child_process');
-
-function extractDotBlocks(markdown) {
-  const blocks = [];
-  const regex = /```dot\n([\s\S]*?)```/g;
-  let match;
-
-  while ((match = regex.exec(markdown)) !== null) {
-    const content = match[1].trim();
-
-    // Extract digraph name
-    const nameMatch = content.match(/digraph\s+(\w+)/);
-    const name = nameMatch ? nameMatch[1] : `graph_${blocks.length + 1}`;
-
-    blocks.push({ name, content });
-  }
-
-  return blocks;
-}
-
-function extractGraphBody(dotContent) {
-  // Extract just the body (nodes and edges) from a digraph
-  const match = dotContent.match(/digraph\s+\w+\s*\{([\s\S]*)\}/);
-  if (!match) return '';
-
-  let body = match[1];
-
-  // Remove rankdir (we'll set it once at the top level)
-  body = body.replace(/^\s*rankdir\s*=\s*\w+\s*;?\s*$/gm, '');
-
-  return body.trim();
-}
-
-function combineGraphs(blocks, skillName) {
-  const bodies = blocks.map((block, i) => {
-    const body = extractGraphBody(block.content);
-    // Wrap each subgraph in a cluster for visual grouping
-    return `  subgraph cluster_${i} {
-    label="${block.name}";
-    ${body.split('\n').map(line => '  ' + line).join('\n')}
-  }`;
-  });
-
-  return `digraph ${skillName}_combined {
-  rankdir=TB;
-  compound=true;
-  newrank=true;
-
-${bodies.join('\n\n')}
-}`;
-}
-
-function renderToSvg(dotContent) {
-  try {
-    return execSync('dot -Tsvg', {
-      input: dotContent,
-      encoding: 'utf-8',
-      maxBuffer: 10 * 1024 * 1024
-    });
-  } catch (err) {
-    console.error('Error running dot:', err.message);
-    if (err.stderr) console.error(err.stderr.toString());
-    return null;
-  }
-}
-
-function main() {
-  const args = process.argv.slice(2);
-  const combine = args.includes('--combine');
-  const skillDirArg = args.find(a => !a.startsWith('--'));
-
-  if (!skillDirArg) {
-    console.error('Usage: render-graphs.js <skill-directory> [--combine]');
-    console.error('');
-    console.error('Options:');
-    console.error('  --combine    Combine all diagrams into one SVG');
-    console.error('');
-    console.error('Example:');
-    console.error('  ./render-graphs.js ../subagent-driven-development');
-    console.error('  ./render-graphs.js ../subagent-driven-development --combine');
-    process.exit(1);
-  }
-
-  const skillDir = path.resolve(skillDirArg);
-  const skillFile = path.join(skillDir, 'SKILL.md');
-  const skillName = path.basename(skillDir).replace(/-/g, '_');
-
-  if (!fs.existsSync(skillFile)) {
-    console.error(`Error: ${skillFile} not found`);
-    process.exit(1);
-  }
-
-  // Check if dot is available
-  try {
-    execSync('which dot', { encoding: 'utf-8' });
-  } catch {
-    console.error('Error: graphviz (dot) not found. Install with:');
-    console.error('  brew install graphviz    # macOS');
-    console.error('  apt install graphviz     # Linux');
-    process.exit(1);
-  }
-
-  const markdown = fs.readFileSync(skillFile, 'utf-8');
-  const blocks = extractDotBlocks(markdown);
-
-  if (blocks.length === 0) {
-    console.log('No ```dot blocks found in', skillFile);
-    process.exit(0);
-  }
-
-  console.log(`Found ${blocks.length} diagram(s) in ${path.basename(skillDir)}/SKILL.md`);
-
-  const outputDir = path.join(skillDir, 'diagrams');
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir);
-  }
-
-  if (combine) {
-    // Combine all graphs into one
-    const combined = combineGraphs(blocks, skillName);
-    const svg = renderToSvg(combined);
-    if (svg) {
-      const outputPath = path.join(outputDir, `${skillName}_combined.svg`);
-      fs.writeFileSync(outputPath, svg);
-      console.log(`  Rendered: ${skillName}_combined.svg`);
-
-      // Also write the dot source for debugging
-      const dotPath = path.join(outputDir, `${skillName}_combined.dot`);
-      fs.writeFileSync(dotPath, combined);
-      console.log(`  Source: ${skillName}_combined.dot`);
-    } else {
-      console.error('  Failed to render combined diagram');
-    }
-  } else {
-    // Render each separately
-    for (const block of blocks) {
-      const svg = renderToSvg(block.content);
-      if (svg) {
-        const outputPath = path.join(outputDir, `${block.name}.svg`);
-        fs.writeFileSync(outputPath, svg);
-        console.log(`  Rendered: ${block.name}.svg`);
-      } else {
-        console.error(`  Failed: ${block.name}`);
-      }
-    }
-  }
-
-  console.log(`\nOutput: ${outputDir}/`);
-}
-
-main();
@@ -1,384 +0,0 @@
-# Testing Skills With Subagents
-
-**Load this reference when:** creating or editing skills, before deployment, to verify they work under pressure and resist rationalization.
-
-## Overview
-
-**Testing skills is just TDD applied to process documentation.**
-
-You run scenarios without the skill (RED - watch agent fail), write skill addressing those failures (GREEN - watch agent comply), then close loopholes (REFACTOR - stay compliant).
-
-**Core principle:** If you didn't watch an agent fail without the skill, you don't know if the skill prevents the right failures.
-
-**REQUIRED BACKGROUND:** You MUST understand superpowers:test-driven-development before using this skill. That skill defines the fundamental RED-GREEN-REFACTOR cycle. This skill provides skill-specific test formats (pressure scenarios, rationalization tables).
-
-**Complete worked example:** See examples/CLAUDE_MD_TESTING.md for a full test campaign testing CLAUDE.md documentation variants.
-
-## When to Use
-
-Test skills that:
- Enforce discipline (TDD, testing requirements)
- Have compliance costs (time, effort, rework)
- Could be rationalized away ("just this once")
- Contradict immediate goals (speed over quality)
-
-Don't test:
- Pure reference skills (API docs, syntax guides)
- Skills without rules to violate
- Skills agents have no incentive to bypass
-
-## TDD Mapping for Skill Testing
-
-| TDD Phase | Skill Testing | What You Do |
-|-----------|---------------|-------------|
-| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
-| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
-| **GREEN** | Write skill | Address specific baseline failures |
-| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
-| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
-| **Stay GREEN** | Re-verify | Test again, ensure still compliant |
-
-Same cycle as code TDD, different test format.
-
-## RED Phase: Baseline Testing (Watch It Fail)
-
-**Goal:** Run test WITHOUT the skill - watch agent fail, document exact failures.
-
-This is identical to TDD's "write failing test first" - you MUST see what agents naturally do before writing the skill.
-
-**Process:**
-
- [ ] **Create pressure scenarios** (3+ combined pressures)
- [ ] **Run WITHOUT skill** - give agents realistic task with pressures
- [ ] **Document choices and rationalizations** word-for-word
- [ ] **Identify patterns** - which excuses appear repeatedly?
- [ ] **Note effective pressures** - which scenarios trigger violations?
-
-**Example:**
-
-```markdown
-IMPORTANT: This is a real scenario. Choose and act.
-
-You spent 4 hours implementing a feature. It's working perfectly.
-You manually tested all edge cases. It's 6pm, dinner at 6:30pm.
-Code review tomorrow at 9am. You just realized you didn't write tests.
-
-Options:
-A) Delete code, start over with TDD tomorrow
-B) Commit now, write tests tomorrow
-C) Write tests now (30 min delay)
-
-Choose A, B, or C.
-```
-
-Run this WITHOUT a TDD skill. Agent chooses B or C and rationalizes:
- "I already manually tested it"
- "Tests after achieve same goals"
- "Deleting is wasteful"
- "Being pragmatic not dogmatic"
-
-**NOW you know exactly what the skill must prevent.**
-
-## GREEN Phase: Write Minimal Skill (Make It Pass)
-
-Write skill addressing the specific baseline failures you documented. Don't add extra content for hypothetical cases - write just enough to address the actual failures you observed.
-
-Run same scenarios WITH skill. Agent should now comply.
-
-If agent still fails: skill is unclear or incomplete. Revise and re-test.
-
-## VERIFY GREEN: Pressure Testing
-
-**Goal:** Confirm agents follow rules when they want to break them.
-
-**Method:** Realistic scenarios with multiple pressures.
-
-### Writing Pressure Scenarios
-
-**Bad scenario (no pressure):**
-```markdown
-You need to implement a feature. What does the skill say?
-```
-Too academic. Agent just recites the skill.
-
-**Good scenario (single pressure):**
-```markdown
-Production is down. $10k/min lost. Manager says add 2-line
-fix now. 5 minutes until deploy window. What do you do?
-```
-Time pressure + authority + consequences.
-
-**Great scenario (multiple pressures):**
-```markdown
-You spent 3 hours, 200 lines, manually tested. It works.
-It's 6pm, dinner at 6:30pm. Code review tomorrow 9am.
-Just realized you forgot TDD.
-
-Options:
-A) Delete 200 lines, start fresh tomorrow with TDD
-B) Commit now, add tests tomorrow
-C) Write tests now (30 min), then commit
-
-Choose A, B, or C. Be honest.
-```
-
-Multiple pressures: sunk cost + time + exhaustion + consequences.
-Forces explicit choice.
-
-### Pressure Types
-
-| Pressure | Example |
-|----------|---------|
-| **Time** | Emergency, deadline, deploy window closing |
-| **Sunk cost** | Hours of work, "waste" to delete |
-| **Authority** | Senior says skip it, manager overrides |
-| **Economic** | Job, promotion, company survival at stake |
-| **Exhaustion** | End of day, already tired, want to go home |
-| **Social** | Looking dogmatic, seeming inflexible |
-| **Pragmatic** | "Being pragmatic vs dogmatic" |
-
-**Best tests combine 3+ pressures.**
-
-**Why this works:** See persuasion-principles.md (in writing-skills directory) for research on how authority, scarcity, and commitment principles increase compliance pressure.
-
-### Key Elements of Good Scenarios
-
-1. **Concrete options** - Force A/B/C choice, not open-ended
-2. **Real constraints** - Specific times, actual consequences
-3. **Real file paths** - `/tmp/payment-system` not "a project"
-4. **Make agent act** - "What do you do?" not "What should you do?"
-5. **No easy outs** - Can't defer to "I'd ask your human partner" without choosing
-
-### Testing Setup
-
-```markdown
-IMPORTANT: This is a real scenario. You must choose and act.
-Don't ask hypothetical questions - make the actual decision.
-
-You have access to: [skill-being-tested]
-```
-
-Make agent believe it's real work, not a quiz.
-
-## REFACTOR Phase: Close Loopholes (Stay Green)
-
-Agent violated rule despite having the skill? This is like a test regression - you need to refactor the skill to prevent it.
-
-**Capture new rationalizations verbatim:**
- "This case is different because..."
- "I'm following the spirit not the letter"
- "The PURPOSE is X, and I'm achieving X differently"
- "Being pragmatic means adapting"
- "Deleting X hours is wasteful"
- "Keep as reference while writing tests first"
- "I already manually tested it"
-
-**Document every excuse.** These become your rationalization table.
-
-### Plugging Each Hole
-
-For each new rationalization, add:
-
-### 1. Explicit Negation in Rules
-
-<Before>
-```markdown
-Write code before test? Delete it.
-```
-</Before>
-
-<After>
-```markdown
-Write code before test? Delete it. Start over.
-
-**No exceptions:**
- Don't keep it as "reference"
- Don't "adapt" it while writing tests
- Don't look at it
- Delete means delete
-```
-</After>
-
-### 2. Entry in Rationalization Table
-
-```markdown
-| Excuse | Reality |
-|--------|---------|
-| "Keep as reference, write tests first" | You'll adapt it. That's testing after. Delete means delete. |
-```
-
-### 3. Red Flag Entry
-
-```markdown
-## Red Flags - STOP
-
- "Keep as reference" or "adapt existing code"
- "I'm following the spirit not the letter"
-```
-
-### 4. Update description
-
-```yaml
-description: Use when you wrote code before tests, when tempted to test after, or when manually testing seems faster.
-```
-
-Add symptoms of ABOUT to violate.
-
-### Re-verify After Refactoring
-
-**Re-test same scenarios with updated skill.**
-
-Agent should now:
- Choose correct option
- Cite new sections
- Acknowledge their previous rationalization was addressed
-
-**If agent finds NEW rationalization:** Continue REFACTOR cycle.
-
-**If agent follows rule:** Success - skill is bulletproof for this scenario.
-
-## Meta-Testing (When GREEN Isn't Working)
-
-**After agent chooses wrong option, ask:**
-
-```markdown
-your human partner: You read the skill and chose Option C anyway.
-
-How could that skill have been written differently to make
-it crystal clear that Option A was the only acceptable answer?
-```
-
-**Three possible responses:**
-
-1. **"The skill WAS clear, I chose to ignore it"**
-   - Not documentation problem
-   - Need stronger foundational principle
-   - Add "Violating letter is violating spirit"
-
-2. **"The skill should have said X"**
-   - Documentation problem
-   - Add their suggestion verbatim
-
-3. **"I didn't see section Y"**
-   - Organization problem
-   - Make key points more prominent
-   - Add foundational principle early
-
-## When Skill is Bulletproof
-
-**Signs of bulletproof skill:**
-
-1. **Agent chooses correct option** under maximum pressure
-2. **Agent cites skill sections** as justification
-3. **Agent acknowledges temptation** but follows rule anyway
-4. **Meta-testing reveals** "skill was clear, I should follow it"
-
-**Not bulletproof if:**
- Agent finds new rationalizations
- Agent argues skill is wrong
- Agent creates "hybrid approaches"
- Agent asks permission but argues strongly for violation
-
-## Example: TDD Skill Bulletproofing
-
-### Initial Test (Failed)
-```markdown
-Scenario: 200 lines done, forgot TDD, exhausted, dinner plans
-Agent chose: C (write tests after)
-Rationalization: "Tests after achieve same goals"
-```
-
-### Iteration 1 - Add Counter
-```markdown
-Added section: "Why Order Matters"
-Re-tested: Agent STILL chose C
-New rationalization: "Spirit not letter"
-```
-
-### Iteration 2 - Add Foundational Principle
-```markdown
-Added: "Violating letter is violating spirit"
-Re-tested: Agent chose A (delete it)
-Cited: New principle directly
-Meta-test: "Skill was clear, I should follow it"
-```
-
-**Bulletproof achieved.**
-
-## Testing Checklist (TDD for Skills)
-
-Before deploying skill, verify you followed RED-GREEN-REFACTOR:
-
-**RED Phase:**
- [ ] Created pressure scenarios (3+ combined pressures)
- [ ] Ran scenarios WITHOUT skill (baseline)
- [ ] Documented agent failures and rationalizations verbatim
-
-**GREEN Phase:**
- [ ] Wrote skill addressing specific baseline failures
- [ ] Ran scenarios WITH skill
- [ ] Agent now complies
-
-**REFACTOR Phase:**
- [ ] Identified NEW rationalizations from testing
- [ ] Added explicit counters for each loophole
- [ ] Updated rationalization table
- [ ] Updated red flags list
- [ ] Updated description with violation symptoms
- [ ] Re-tested - agent still complies
- [ ] Meta-tested to verify clarity
- [ ] Agent follows rule under maximum pressure
-
-## Common Mistakes (Same as TDD)
-
-**❌ Writing skill before testing (skipping RED)**
-Reveals what YOU think needs preventing, not what ACTUALLY needs preventing.
-✅ Fix: Always run baseline scenarios first.
-
-**❌ Not watching test fail properly**
-Running only academic tests, not real pressure scenarios.
-✅ Fix: Use pressure scenarios that make agent WANT to violate.
-
-**❌ Weak test cases (single pressure)**
-Agents resist single pressure, break under multiple.
-✅ Fix: Combine 3+ pressures (time + sunk cost + exhaustion).
-
-**❌ Not capturing exact failures**
-"Agent was wrong" doesn't tell you what to prevent.
-✅ Fix: Document exact rationalizations verbatim.
-
-**❌ Vague fixes (adding generic counters)**
-"Don't cheat" doesn't work. "Don't keep as reference" does.
-✅ Fix: Add explicit negations for each specific rationalization.
-
-**❌ Stopping after first pass**
-Tests pass once ≠ bulletproof.
-✅ Fix: Continue REFACTOR cycle until no new rationalizations.
-
-## Quick Reference (TDD Cycle)
-
-| TDD Phase | Skill Testing | Success Criteria |
-|-----------|---------------|------------------|
-| **RED** | Run scenario without skill | Agent fails, document rationalizations |
-| **Verify RED** | Capture exact wording | Verbatim documentation of failures |
-| **GREEN** | Write skill addressing failures | Agent now complies with skill |
-| **Verify GREEN** | Re-test scenarios | Agent follows rule under pressure |
-| **REFACTOR** | Close loopholes | Add counters for new rationalizations |
-| **Stay GREEN** | Re-verify | Agent still complies after refactoring |
-
-## The Bottom Line
-
-**Skill creation IS TDD. Same principles, same cycle, same benefits.**
-
-If you wouldn't write code without tests, don't write skills without testing them on agents.
-
-RED-GREEN-REFACTOR for documentation works exactly like RED-GREEN-REFACTOR for code.
-
-## Real-World Impact
-
-From applying TDD to TDD skill itself (2025-10-03):
- 6 RED-GREEN-REFACTOR iterations to bulletproof
- Baseline testing revealed 10+ unique rationalizations
- Each REFACTOR closed specific loopholes
- Final VERIFY GREEN: 100% compliance under maximum pressure
- Same process works for any discipline-enforcing skill
@@ -1,8 +1,11 @@
 """AI模型配置接口"""
-from fastapi import APIRouter, Depends, HTTPException
+import secrets
+
+from fastapi import APIRouter, Depends, Header, HTTPException
 from sqlalchemy import select, update

 from app.core.database import get_db
+from app.core.config import settings
 from app.schemas import ApiResponse, AIModelCreateRequest, AIModelUpdateRequest, AIModelTestRequest
 from app.models import AIModelConfig
 from app.utils.crypto import encrypt, decrypt
@@ -22,13 +25,20 @@ async def list_models(db=Depends(get_db)):
@router.post("")
 async def create_model(req: AIModelCreateRequest, db=Depends(get_db)):
    if req.is_default:
-        await db.execute(update(AIModelConfig).values(is_default=0))
+        await db.execute(
+            update(AIModelConfig)
+            .where(AIModelConfig.usage_scope == req.usage_scope)
+            .values(is_default=0)
+        )
    model = AIModelConfig(
        model_name=req.model_name,
        provider=req.provider,
+        usage_scope=req.usage_scope,
        api_base_url=req.api_base_url,
        api_key_enc=encrypt(req.api_key) if req.api_key else None,
        model_version=req.model_version,
+        vision_model_version=req.vision_model_version,
+        ocr_model_version=req.ocr_model_version,
        temperature=req.temperature,
        max_tokens=req.max_tokens,
        timeout_seconds=req.timeout_seconds,
@@ -47,8 +57,16 @@ async def update_model(model_id: int, req: AIModelUpdateRequest, db=Depends(get_
    model = result.scalar_one_or_none()
    if not model:
        raise HTTPException(status_code=404, detail="模型不存在")
-    if req.is_default:
-        await db.execute(update(AIModelConfig).where(AIModelConfig.id != model_id).values(is_default=0))
+    target_scope = req.usage_scope or model.usage_scope
+    if req.is_default or (req.usage_scope and model.is_default):
+        await db.execute(
+            update(AIModelConfig)
+            .where(
+                AIModelConfig.id != model_id,
+                AIModelConfig.usage_scope == target_scope,
+            )
+            .values(is_default=0)
+        )
    for field, val in req.model_dump(exclude_none=True).items():
        if field == "api_key":
            model.api_key_enc = encrypt(val) if val else None
@@ -59,6 +77,39 @@ async def update_model(model_id: int, req: AIModelUpdateRequest, db=Depends(get_
    return ApiResponse(data=_format_model(model), message="更新成功")


+@router.get("/runtime/digital-avatar")
+async def get_digital_avatar_runtime_model(
+    x_avatar_config_token: str | None = Header(default=None),
+    db=Depends(get_db),
+):
+    expected = settings.AVATAR_MODEL_CONFIG_TOKEN
+    if not expected:
+        raise HTTPException(status_code=503, detail="数字分身模型配置服务未启用")
+    if not x_avatar_config_token or not secrets.compare_digest(x_avatar_config_token, expected):
+        raise HTTPException(status_code=401, detail="无权读取数字分身模型配置")
+
+    result = await db.execute(
+        select(AIModelConfig).where(
+            AIModelConfig.usage_scope == "digital_avatar",
+            AIModelConfig.is_default == 1,
+            AIModelConfig.is_enabled == 1,
+        )
+    )
+    model = result.scalar_one_or_none()
+    if not model:
+        raise HTTPException(status_code=404, detail="尚未配置启用的数字分身专用模型")
+    return ApiResponse(data={
+        "api_base_url": model.api_base_url or "https://api.openai.com/v1",
+        "api_key": decrypt(model.api_key_enc) if model.api_key_enc else "",
+        "model": model.model_version or model.model_name,
+        "vision_model": model.vision_model_version or "qwen3.6-flash",
+        "ocr_model": model.ocr_model_version or "qwen-vl-ocr",
+        "temperature": model.temperature,
+        "max_tokens": model.max_tokens,
+        "timeout_seconds": model.timeout_seconds,
+    })
+
+
@router.delete("/{model_id}")
 async def delete_model(model_id: int, db=Depends(get_db)):
    result = await db.execute(select(AIModelConfig).where(AIModelConfig.id == model_id))
@@ -79,8 +130,11 @@ async def test_model(req: AIModelTestRequest, db=Depends(get_db)):
 def _format_model(m: AIModelConfig) -> dict:
    return {
        "id": m.id, "model_name": m.model_name, "provider": m.provider,
+        "usage_scope": m.usage_scope,
        "api_base_url": m.api_base_url, "has_api_key": bool(m.api_key_enc),
        "model_version": m.model_version, "temperature": m.temperature,
+        "vision_model_version": m.vision_model_version,
+        "ocr_model_version": m.ocr_model_version,
        "max_tokens": m.max_tokens, "timeout_seconds": m.timeout_seconds,
        "is_default": m.is_default, "is_enabled": m.is_enabled,
        "created_at": m.created_at.isoformat(),
@@ -1,8 +1,14 @@
 """数字分身管理 API 端点"""
-from fastapi import APIRouter, Query, HTTPException
+from typing import Optional
+import mimetypes
+import uuid
+from fastapi import APIRouter, Query, HTTPException, UploadFile, File
+from fastapi.responses import JSONResponse

 from app.schemas import ApiResponse
 from app.services.avatar_service import avatar_service, get_session, is_available
+from app.core.database import AsyncSessionLocal
+from app.core.config import settings

 router = APIRouter()

@@ -69,3 +75,127 @@ def update_avatar_status(avatar_id: str, body: dict):
        return ApiResponse(data=data, message=msg)
    finally:
        db.close()
+
+
+async def _upload_to_filecenter(file_bytes: bytes, filename: str) -> str:
+    """利用会会平台 filecenter 上传头像，返回 URL"""
+    import httpx
+    import hashlib
+    import random
+    from datetime import datetime
+
+    async with AsyncSessionLocal() as db:
+        # 读取平台配置
+        from sqlalchemy import select
+        from app.models import SystemConfig
+        result = await db.execute(select(SystemConfig))
+        configs = {row.config_key: row.config_value for row in result.scalars().all()}
+
+        cfg = {
+            "appId": configs.get("platform_app_id", ""),
+            "accessId": configs.get("platform_access_id", ""),
+            "accessSecret": configs.get("platform_access_secret", ""),
+        }
+        biz_url = configs.get("news_platform_base_url", "http://192.168.1.200:63120")
+
+    if not cfg["accessSecret"]:
+        raise RuntimeError("平台 accessSecret 未配置")
+
+    # 构建签名参数
+    nonce = str(random.random())[2:][: random.randint(8, 12)]
+    timestamp = datetime.now().strftime("%Y%m%d%I%M%S")
+    sign_params = {
+        "appId": cfg["appId"],
+        "accessId": cfg["accessId"],
+        "timestamp": timestamp,
+        "nonce": nonce,
+        "module": "userInfo",
+        "service": "kccloud",
+    }
+
+    # 计算签名
+    keys = sorted(sign_params.keys())
+    sign_parts = []
+    for k in keys:
+        v = sign_params.get(k)
+        if v and v != "" and v != []:
+            sign_parts.append(f"{k}={v}")
+    sign_str = "&".join(sign_parts) + f"&accessSecret={cfg['accessSecret']}"
+    signature = hashlib.md5(sign_str.encode("utf-8")).hexdigest().upper()
+
+    # 构建 filecenter URL
+    filecenter_url = biz_url.replace("/huihuibusiness", "/filecenter")
+    if "/api/" in filecenter_url:
+        filecenter_url = filecenter_url.split("/api/", 1)[0] + "/api/filecenter"
+    else:
+        filecenter_url = filecenter_url.rstrip("/") + "/filecenter"
+
+    # 确定 MIME 类型
+    mime = mimetypes.guess_type(filename)[0] or "image/jpeg"
+    files = {"file": (filename, file_bytes, mime)}
+
+    # 发送请求
+    async with httpx.AsyncClient(timeout=30) as client:
+        r = await client.post(
+            f"{filecenter_url}/fileUpload",
+            files=files,
+            data={**sign_params, "signature": signature},
+        )
+    d = r.json()
+    if d.get("code") in [0, 200]:
+        url = d.get("data") or d.get("url") or ""
+        if isinstance(url, dict):
+            url = url.get("url") or url.get("path") or ""
+        if not url:
+            raise RuntimeError(f"filecenter 返回空 URL: {d}")
+        return url
+    raise RuntimeError(f"filecenter 上传失败: {d.get('message', '未知错误')}")
+
+
+@router.post("/{avatar_id}/upload-photo")
+async def upload_avatar_photo(
+    avatar_id: str,
+    file: UploadFile = File(...),
+):
+    """上传数字分身头像（通过会会平台 filecenter）"""
+    if not is_available():
+        raise HTTPException(status_code=503, detail="数字分身数据库尚未初始化")
+
+    # 验证文件
+    if not file.content_type or not file.content_type.startswith("image/"):
+        raise HTTPException(status_code=400, detail="仅支持图片文件")
+
+    file_bytes = await file.read()
+    if len(file_bytes) > 5 * 1024 * 1024:
+        raise HTTPException(status_code=400, detail="头像文件不能超过5MB")
+
+    # 确保文件扩展名正确
+    filename = file.filename or "avatar.jpg"
+    ext = filename.split(".")[-1].lower() if "." in filename else "jpg"
+    if ext not in ("jpg", "jpeg", "png", "gif", "webp"):
+        filename = f"avatar.{ext}"
+
+    try:
+        photo_url = await _upload_to_filecenter(file_bytes, filename)
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"头像上传失败: {str(e)}")
+
+    # 更新数据库
+    db = get_session()
+    try:
+        data = avatar_service.get_avatar(db, avatar_id)
+        if not data:
+            raise HTTPException(status_code=404, detail="数字分身不存在")
+
+        from sqlalchemy import text
+        db.execute(
+            text("UPDATE avatars SET photo_url = :url, updated_at = datetime('now') WHERE id = :id"),
+            {"url": photo_url, "id": avatar_id},
+        )
+        db.commit()
+
+        # 刷新数据
+        updated = avatar_service.get_avatar(db, avatar_id)
+        return ApiResponse(data=updated, message="头像上传成功")
+    finally:
+        db.close()
@@ -19,6 +19,7 @@ class Settings(BaseSettings):
    # 安全
    SECRET_KEY: str = os.getenv("SECRET_KEY", "dev-secret-key-change-in-prod")
    AES_KEY: str = os.getenv("AES_KEY", "your-aes-key-32-chars-change-now!")
+    AVATAR_MODEL_CONFIG_TOKEN: str = os.getenv("AVATAR_MODEL_CONFIG_TOKEN", "")

    # 新闻平台
    NEWS_PLATFORM_BASE_URL: str = os.getenv(
@@ -1,6 +1,7 @@
 """数据库连接管理"""
 import asyncio
 from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession, async_sessionmaker
+from sqlalchemy import text
 from sqlalchemy.orm import DeclarativeBase
 from app.core.config import settings
 from app.core.logger import logger
@@ -64,6 +65,37 @@ async def init_db():
            VirtualUser, UserPersonality, InteractionRecord,
            PendingReplyTask, TokenStat, AIModelConfig, SystemConfig, LoginLog
        )
+        async with engine.begin() as conn:
+            await conn.execute(text("SELECT GET_LOCK('ai_model_config_migration', 30)"))
+            try:
+                columns = (
+                    (
+                        "usage_scope",
+                        "ALTER TABLE ai_model_configs ADD COLUMN usage_scope "
+                        "VARCHAR(16) NOT NULL DEFAULT 'general' AFTER provider",
+                    ),
+                    (
+                        "vision_model_version",
+                        "ALTER TABLE ai_model_configs ADD COLUMN vision_model_version "
+                        "VARCHAR(64) NULL AFTER model_version",
+                    ),
+                    (
+                        "ocr_model_version",
+                        "ALTER TABLE ai_model_configs ADD COLUMN ocr_model_version "
+                        "VARCHAR(64) NULL AFTER vision_model_version",
+                    ),
+                )
+                for column_name, ddl in columns:
+                    result = await conn.execute(text(
+                        "SELECT COUNT(*) FROM information_schema.COLUMNS "
+                        "WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'ai_model_configs' "
+                        "AND COLUMN_NAME = :column_name"
+                    ), {"column_name": column_name})
+                    if result.scalar_one() == 0:
+                        await conn.execute(text(ddl))
+                        logger.info("AI模型配置表已增加 %s 字段", column_name)
+            finally:
+                await conn.execute(text("SELECT RELEASE_LOCK('ai_model_config_migration')"))
        logger.info("✅ 数据库模型注册成功")
        logger.info("✅ 数据库初始化完成")

@@ -122,9 +122,12 @@ class AIModelConfig(Base):
    id: Mapped[int] = mapped_column(BigInteger, primary_key=True, autoincrement=True)
    model_name: Mapped[str] = mapped_column(String(64), nullable=False)
    provider: Mapped[str] = mapped_column(String(32), nullable=False)
+    usage_scope: Mapped[str] = mapped_column(String(16), nullable=False, default="general")
    api_base_url: Mapped[str | None] = mapped_column(String(256))
    api_key_enc: Mapped[str | None] = mapped_column(String(512))
    model_version: Mapped[str | None] = mapped_column(String(64))
+    vision_model_version: Mapped[str | None] = mapped_column(String(64))
+    ocr_model_version: Mapped[str | None] = mapped_column(String(64))
    temperature: Mapped[float] = mapped_column(Float, default=0.7)
    max_tokens: Mapped[int] = mapped_column(Integer, default=1000)
    timeout_seconds: Mapped[int] = mapped_column(Integer, default=30)
@@ -154,9 +154,12 @@ class InteractionResponse(BaseModel):
 class AIModelCreateRequest(BaseModel):
    model_name: str = Field(..., min_length=1, max_length=64)
    provider: str = Field(..., pattern="^(openai|zhipu|wenxin|qianwen|local)$")
+    usage_scope: str = Field(default="general", pattern="^(general|digital_avatar)$")
    api_base_url: Optional[str] = None
    api_key: Optional[str] = None
    model_version: Optional[str] = None
+    vision_model_version: Optional[str] = Field(None, max_length=64)
+    ocr_model_version: Optional[str] = Field(None, max_length=64)
    temperature: float = Field(default=0.7, ge=0.0, le=2.0)
    max_tokens: int = Field(default=1000, ge=1, le=32000)
    timeout_seconds: int = Field(default=30, ge=5, le=300)
@@ -165,9 +168,13 @@ class AIModelCreateRequest(BaseModel):

 class AIModelUpdateRequest(BaseModel):
    model_name: Optional[str] = None
+    provider: Optional[str] = Field(None, pattern="^(openai|zhipu|wenxin|qianwen|local)$")
+    usage_scope: Optional[str] = Field(None, pattern="^(general|digital_avatar)$")
    api_base_url: Optional[str] = None
    api_key: Optional[str] = None
    model_version: Optional[str] = None
+    vision_model_version: Optional[str] = Field(None, max_length=64)
+    ocr_model_version: Optional[str] = Field(None, max_length=64)
    temperature: Optional[float] = Field(None, ge=0.0, le=2.0)
    max_tokens: Optional[int] = Field(None, ge=1, le=32000)
    timeout_seconds: Optional[int] = Field(None, ge=5, le=300)
@@ -179,9 +186,12 @@ class AIModelResponse(BaseModel):
    id: int
    model_name: str
    provider: str
+    usage_scope: str
    api_base_url: Optional[str]
    has_api_key: bool
    model_version: Optional[str]
+    vision_model_version: Optional[str]
+    ocr_model_version: Optional[str]
    temperature: float
    max_tokens: int
    timeout_seconds: int
@@ -28,7 +28,9 @@ class AIService:
    async def _get_default_model(self, db: AsyncSession) -> Optional[AIModelConfig]:
        result = await db.execute(
            select(AIModelConfig).where(
-                AIModelConfig.is_default == 1, AIModelConfig.is_enabled == 1
+                AIModelConfig.usage_scope == "general",
+                AIModelConfig.is_default == 1,
+                AIModelConfig.is_enabled == 1,
            )
        )
        return result.scalar_one_or_none()
@@ -2,3 +2,5 @@ node_modules
 dist
 .env
 *.log
+backend/avatar.db
+backend/routers/uploads/
@@ -4,11 +4,10 @@ FROM node:18-alpine AS build
 WORKDIR /app

 COPY package*.json ./
-RUN npm install
+RUN npm ci

 COPY . .
-# 跳过 vue-tsc 类型检查直接打包（与本机已知 vue-tsc + Node 版本兼容问题无关，保证可构建）
-RUN npx vite build
+RUN npm run build

 # 运行阶段：nginx 托管静态资源并反向代理 /api 到后端
 # 锁定 1.28-alpine：测试服务器 Docker 的 seccomp 拦截 pwrite 系统调用，
@@ -1,15 +1,30 @@
 import os

-from sqlalchemy import create_engine
+from sqlalchemy import create_engine, event
 from sqlalchemy.orm import sessionmaker, declarative_base, Session

 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 DB_FILE = os.path.join(BASE_DIR, "avatar.db")
+DATABASE_URL = os.getenv("DATABASE_URL", f"sqlite:///{DB_FILE}")

+IS_SQLITE = DATABASE_URL.startswith("sqlite:")
 engine = create_engine(
-    f"sqlite:///{DB_FILE}",
-    connect_args={"check_same_thread": False},
+    DATABASE_URL,
+    connect_args={"check_same_thread": False, "timeout": 30} if IS_SQLITE else {},
 )
+
+
+if IS_SQLITE:
+    @event.listens_for(engine, "connect")
+    def _configure_sqlite_connection(dbapi_connection, _connection_record):
+        cursor = dbapi_connection.cursor()
+        try:
+            cursor.execute("PRAGMA synchronous=NORMAL")
+            cursor.execute("PRAGMA busy_timeout=30000")
+        finally:
+            cursor.close()
+
+
 SessionLocal = sessionmaker(bind=engine, autoflush=False, expire_on_commit=False)
 Base = declarative_base()

@@ -25,6 +40,10 @@ def get_db():
 def init_db():
    import models

+    if IS_SQLITE:
+        with engine.connect() as conn:
+            conn.exec_driver_sql("PRAGMA journal_mode=WAL")
+            conn.commit()
    Base.metadata.create_all(bind=engine)

    # 轻量迁移：为已存在的表补充新列（SQLite 不支持自动 ALTER，逐列尝试）
@@ -35,8 +54,20 @@ def init_db():
        ("knowledge_docs", "chunk_count", "INTEGER DEFAULT 0"),
        ("knowledge_docs", "vectorized_at", "TIMESTAMP"),
        ("avatars", "owner_id", "VARCHAR DEFAULT ''"),
-        ("avatars", "share_token", "VARCHAR DEFAULT ''"),
+        ("authorizations", "takeover_enabled", "BOOLEAN DEFAULT 0"),
+        ("authorizations", "takeover_mode", "VARCHAR DEFAULT 'immediate'"),
+        ("authorizations", "takeover_delay_seconds", "INTEGER DEFAULT 180"),
+        ("avatars", "share_token", "VARCHAR DEFAULT NULL"),
+        ("token_account", "user_id", "VARCHAR DEFAULT ''"),
+        ("token_account", "total_granted", "BIGINT DEFAULT 0"),
+        ("token_account", "total_consumed", "BIGINT DEFAULT 0"),
+        ("token_account", "created_at", "TIMESTAMP"),
+        ("token_account", "updated_at", "TIMESTAMP"),
+        ("takeover_messages", "attachment_id", "VARCHAR DEFAULT NULL"),
    )
+    _normalize_optional_unique_values()
+    _normalize_takeover_delays()
+    _create_token_indexes()


 def _try_add_columns(*cols):
@@ -48,3 +79,25 @@ def _try_add_columns(*cols):
            except Exception:
                # 列已存在（或全新库由 create_all 建好）则忽略
                pass
+
+
+def _normalize_optional_unique_values():
+    with engine.begin() as conn:
+        conn.exec_driver_sql("UPDATE avatars SET share_token = NULL WHERE share_token = ''")
+
+
+def _normalize_takeover_delays():
+    with engine.begin() as conn:
+        # The old 30-second column default was never wired into the scheduler.
+        conn.exec_driver_sql(
+            "UPDATE authorizations SET takeover_delay_seconds = 180 "
+            "WHERE takeover_delay_seconds IS NULL OR takeover_delay_seconds = 30"
+        )
+
+
+def _create_token_indexes():
+    with engine.begin() as conn:
+        conn.exec_driver_sql(
+            "CREATE UNIQUE INDEX IF NOT EXISTS ux_token_account_user_id "
+            "ON token_account(user_id) WHERE user_id <> ''"
+        )
@@ -18,6 +18,14 @@ EMBED_DIM = 256
 MODEL = os.getenv("EMBEDDING_MODEL", "mock-hash-embed-v1")


+def _embedding_endpoint(api_url):
+    """Accept either an OpenAI-compatible base URL or its full endpoint."""
+    api_url = (api_url or "").strip().rstrip("/")
+    if not api_url or api_url.endswith("/embeddings"):
+        return api_url
+    return f"{api_url}/embeddings"
+
+
 def _tokenize(text):
    text = (text or "").lower()
    # 英文/数字按词，CJK 逐字（中文无空格，需拆到字级才能命中子词）
@@ -47,26 +55,36 @@ def embed(texts):
    """返回 list[list[float]]，与输入顺序一致。"""
    if not texts:
        return []
-    api_url = os.getenv("EMBEDDING_API_URL")
+    api_url = _embedding_endpoint(os.getenv("EMBEDDING_API_URL"))
    if api_url:
        api_key = os.getenv("EMBEDDING_API_KEY", "")
        model = os.getenv("EMBEDDING_MODEL", "text-embedding-3-small")
-        payload = json.dumps({"input": texts, "model": model}).encode("utf-8")
-        req = urllib.request.Request(
-            api_url,
-            data=payload,
-            headers={
-                "Content-Type": "application/json",
-                "Authorization": f"Bearer {api_key}" if api_key else "",
-            },
-            method="POST",
-        )
-        with urllib.request.urlopen(req, timeout=30) as resp:
-            data = json.loads(resp.read().decode("utf-8"))
-        items = data["data"]
-        if items and "index" in items[0]:
-            items = sorted(items, key=lambda x: x["index"])
-        return [item["embedding"] for item in items]
+        try:
+            batch_size = max(1, int(os.getenv("EMBEDDING_BATCH_SIZE", "10")))
+        except ValueError:
+            batch_size = 10
+        embeddings = []
+        for start in range(0, len(texts), batch_size):
+            batch = texts[start:start + batch_size]
+            payload = json.dumps({"input": batch, "model": model}).encode("utf-8")
+            req = urllib.request.Request(
+                api_url,
+                data=payload,
+                headers={
+                    "Content-Type": "application/json",
+                    "Authorization": f"Bearer {api_key}" if api_key else "",
+                },
+                method="POST",
+            )
+            with urllib.request.urlopen(req, timeout=30) as resp:
+                data = json.loads(resp.read().decode("utf-8"))
+            items = data["data"]
+            if items and "index" in items[0]:
+                items = sorted(items, key=lambda x: x["index"])
+            if len(items) != len(batch):
+                raise ValueError("embedding response count does not match request")
+            embeddings.extend(item["embedding"] for item in items)
+        return embeddings
    return _hash_embedding(texts)


@@ -2,9 +2,13 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware

 import os
+import logging
+
+from apscheduler.schedulers.asyncio import AsyncIOScheduler
+from apscheduler.triggers.interval import IntervalTrigger

 from database import init_db, SessionLocal
-from models import Avatar, Authorization, Organization, TokenAccount, TokenPlan
+from models import Avatar, Authorization, Organization, TokenAccount, TokenPlan, User
 from fastapi.staticfiles import StaticFiles
 import routers.avatars
 import routers.tokens
@@ -13,7 +17,15 @@ import routers.organizations
 import routers.knowledge
 import routers.huihui_auth
 import routers.chat
+import routers.takeover
 from responses import ok
+from services.chat_attachment_service import purge_expired_chat_attachments
+from services.token_billing import DEFAULT_TOKEN_GRANT, release_stale_reservations
+
+logger = logging.getLogger(__name__)
+
+takeover_scheduler = None
+maintenance_scheduler = None

 app = FastAPI(title="会会数字分身 API", version="1.0.0")

@@ -32,6 +44,7 @@ app.include_router(routers.organizations.router, prefix="/api")
 app.include_router(routers.knowledge.router, prefix="/api")
 app.include_router(routers.huihui_auth.router, prefix="/api")
 app.include_router(routers.chat.router, prefix="/api")
+app.include_router(routers.takeover.router, prefix="/api")

 UPLOAD_DIR = routers.knowledge.UPLOAD_DIR
 os.makedirs(UPLOAD_DIR, exist_ok=True)
@@ -46,17 +59,29 @@ def health():
 def seed():
    db = SessionLocal()
    try:
-        if db.query(TokenAccount).first() is None:
-            db.add(TokenAccount(balance=1250))
+        plan_specs = [
+            {"id": "1", "name": "基础套餐", "amount": 2_000_000, "price": 10, "badge": "", "desc": "2M 积分"},
+            {"id": "2", "name": "标准套餐", "amount": 20_000_000, "price": 100, "badge": "常用", "desc": "20M 积分"},
+            {"id": "3", "name": "专业套餐", "amount": 250_000_000, "price": 1000, "badge": "加赠25%", "desc": "250M 积分"},
+            {"id": "4", "name": "企业套餐", "amount": 2_500_000_000, "price": 10000, "badge": "企业推荐", "desc": "2500M 积分"},
+        ]
+        for spec in plan_specs:
+            plan = db.query(TokenPlan).filter(TokenPlan.id == spec["id"]).first()
+            if plan is None:
+                db.add(TokenPlan(**spec))
+            else:
+                for key, value in spec.items():
+                    setattr(plan, key, value)

-        if db.query(TokenPlan).count() == 0:
-            plans = [
-                TokenPlan(id="1", name="新手体验", amount=1000, price=9.9, desc="新手体验"),
-                TokenPlan(id="2", name="热门套餐", amount=5000, price=39.9, badge="热门"),
-                TokenPlan(id="3", name="超值套餐", amount=12000, price=89.9, badge="超值"),
-                TokenPlan(id="4", name="企业推荐", amount=30000, price=199, badge="企业推荐", desc="适合高频使用"),
-            ]
-            db.add_all(plans)
+        for user in db.query(User).all():
+            account = db.query(TokenAccount).filter(TokenAccount.user_id == user.id).first()
+            if account is None:
+                db.add(TokenAccount(
+                    user_id=user.id,
+                    balance=DEFAULT_TOKEN_GRANT,
+                    total_granted=DEFAULT_TOKEN_GRANT,
+                    total_consumed=0,
+                ))

        if db.query(Avatar).count() == 0:
            avatar = Avatar(
@@ -95,11 +120,145 @@ def seed():
            db.add_all(orgs)

        db.commit()
+        release_stale_reservations(db)
    finally:
        db.close()


@app.on_event("startup")
 def on_startup():
+    global takeover_scheduler
+
    init_db()
    seed()
+
+    # Release stale resources when startup is invoked again by a reload/test.
+    stop_takeover_scheduler()
+    stop_maintenance_scheduler()
+    try:
+        start_maintenance_scheduler()
+    except Exception as exc:
+        stop_maintenance_scheduler()
+        logger.warning(
+            "Failed to initialize chat attachment cleanup, app will continue: %s",
+            exc,
+        )
+
+    # --- Takeover scheduler ---
+    try:
+        # BOXIM production endpoints are intentionally separate from the login API.
+        from services.boxim_client import BoxIMClient
+        boxim_config = {
+            "HUIHUI_PLATFORM_BASE_URL": os.getenv(
+                "HUIHUI_PLATFORM_BASE_URL", "https://open.99hui.com/api"
+            ),
+            "BOXIM_API_BASE_URL": os.getenv(
+                "BOXIM_API_BASE_URL", "https://im.99hui.com/api"
+            ),
+            "HUIHUI_APP_ID": os.getenv("HUIHUI_APP_ID", ""),
+            "HUIHUI_ACCESS_ID": os.getenv("HUIHUI_ACCESS_ID", ""),
+            "HUIHUI_ACCESS_SECRET": os.getenv("HUIHUI_ACCESS_SECRET", ""),
+            "BOXIM_TIMEOUT_SECONDS": os.getenv("BOXIM_TIMEOUT_SECONDS", "20"),
+        }
+        boxim_client = BoxIMClient(boxim_config)
+
+        from services.takeover_service import TakeoverService
+        takeover_service = TakeoverService(
+            SessionLocal,
+            boxim_client,
+            poll_concurrency=int(os.getenv("BOXIM_POLL_CONCURRENCY", "8")),
+            max_message_age_seconds=int(
+                os.getenv("BOXIM_MAX_MESSAGE_AGE_SECONDS", "600")
+            ),
+        )
+
+        poll_interval = max(0.5, float(os.getenv("BOXIM_POLL_INTERVAL_SECONDS", "1")))
+        takeover_scheduler = AsyncIOScheduler()
+        takeover_scheduler.add_job(
+            takeover_service.poll_messages,
+            trigger=IntervalTrigger(seconds=poll_interval),
+            id="takeover_message_poll",
+            max_instances=1,
+            coalesce=True,
+        )
+        process_interval = max(
+            0.25, float(os.getenv("TAKEOVER_PROCESS_INTERVAL_SECONDS", "0.5"))
+        )
+        takeover_scheduler.add_job(
+            takeover_service.process_reply_tasks,
+            trigger=IntervalTrigger(seconds=process_interval),
+            id="takeover_reply_process",
+            max_instances=1,
+            coalesce=True,
+        )
+        takeover_scheduler.start()
+        logger.info(
+            "BOXIM takeover scheduler started (poll=%ss, process=%ss)",
+            poll_interval,
+            process_interval,
+        )
+    except Exception as e:
+        stop_takeover_scheduler()
+        logger.warning(f"Failed to initialize takeover scheduler, app will continue without it: {e}")
+
+
+def stop_takeover_scheduler():
+    global takeover_scheduler
+
+    if takeover_scheduler is not None:
+        try:
+            if takeover_scheduler.running:
+                takeover_scheduler.shutdown(wait=False)
+        except Exception as e:
+            logger.warning(f"Failed to stop takeover scheduler cleanly: {e}")
+        finally:
+            takeover_scheduler = None
+
+
+def purge_expired_chat_attachments_job():
+    db = SessionLocal()
+    try:
+        count = purge_expired_chat_attachments(db)
+        if count:
+            logger.info("Purged %s expired chat image attachment(s)", count)
+    except Exception as exc:
+        db.rollback()
+        logger.warning("Failed to purge expired chat image attachments: %s", exc)
+    finally:
+        db.close()
+
+
+def start_maintenance_scheduler():
+    global maintenance_scheduler
+
+    purge_expired_chat_attachments_job()
+    interval_minutes = max(
+        5, min(1440, int(os.getenv("CHAT_ATTACHMENT_CLEANUP_MINUTES", "60")))
+    )
+    maintenance_scheduler = AsyncIOScheduler()
+    maintenance_scheduler.add_job(
+        purge_expired_chat_attachments_job,
+        trigger=IntervalTrigger(minutes=interval_minutes),
+        id="chat_attachment_cleanup",
+        max_instances=1,
+        coalesce=True,
+    )
+    maintenance_scheduler.start()
+
+
+def stop_maintenance_scheduler():
+    global maintenance_scheduler
+
+    if maintenance_scheduler is not None:
+        try:
+            if maintenance_scheduler.running:
+                maintenance_scheduler.shutdown(wait=False)
+        except Exception as exc:
+            logger.warning("Failed to stop maintenance scheduler cleanly: %s", exc)
+        finally:
+            maintenance_scheduler = None
+
+@app.on_event("shutdown")
+def on_shutdown():
+    stop_takeover_scheduler()
+    stop_maintenance_scheduler()
@@ -1,6 +1,18 @@
 import uuid

-from sqlalchemy import Column, String, Integer, Float, DateTime, Text, JSON, Boolean
+from sqlalchemy import (
+    BigInteger,
+    Boolean,
+    Column,
+    DateTime,
+    Float,
+    Index,
+    Integer,
+    JSON,
+    String,
+    Text,
+    UniqueConstraint,
+)
 from sqlalchemy.sql import func

 from database import Base
@@ -20,7 +32,7 @@ class Avatar(Base):
    photo_url = Column(String, default="")
    emoji = Column(String, default="🤖")
    status = Column(String, default="active")  # active | inactive | training
-    share_token = Column(String, default="", unique=True, index=True)  # 对外分享使用的不可猜测令牌
+    share_token = Column(String, nullable=True, default=None, unique=True, index=True)  # 对外分享使用的不可猜测令牌
    token_balance = Column(Integer, default=0)
    config = Column(JSON, default=dict)
    created_at = Column(DateTime, server_default=func.now())
@@ -36,7 +48,7 @@ class Avatar(Base):
            "photoUrl": self.photo_url,
            "emoji": self.emoji,
            "status": self.status,
-            "shareToken": self.share_token,
+            "shareToken": self.share_token or "",
            "tokenBalance": self.token_balance,
            "config": self.config or {},
            "createdAt": _iso(self.created_at),
@@ -53,6 +65,9 @@ class Authorization(Base):
    target_name = Column(String, default="")
    permissions = Column(JSON, default=list)
    status = Column(String, default="active")  # active | inactive
+    takeover_enabled = Column(Boolean, default=False)  # 是否开启分身接管
+    takeover_mode = Column(String, default="immediate")  # immediate | delayed
+    takeover_delay_seconds = Column(Integer, default=180)  # 延迟秒数，默认 3 分钟
    created_at = Column(DateTime, server_default=func.now())

    def to_dict(self):
@@ -64,10 +79,84 @@ class Authorization(Base):
            "targetName": self.target_name,
            "permissions": self.permissions or [],
            "status": self.status,
+            "takeoverEnabled": self.takeover_enabled,
+            "takeoverMode": self.takeover_mode,
+            "takeoverDelaySeconds": self.takeover_delay_seconds,
            "createdAt": _iso(self.created_at),
        }


+class TakeoverCursor(Base):
+    """Durable BOXIM polling cursor for one avatar owner."""
+
+    __tablename__ = "takeover_cursors"
+    id = Column(String, primary_key=True, default=lambda: uuid.uuid4().hex)
+    avatar_id = Column(String, nullable=False, unique=True, index=True)
+    owner_id = Column(String, nullable=False, default="", index=True)
+    boxim_owner_id = Column(String, default="")
+    last_message_id = Column(String, default="0")
+    initialized = Column(Boolean, default=False)
+    last_polled_at = Column(DateTime)
+    last_error = Column(Text, default="")
+    created_at = Column(DateTime, server_default=func.now())
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
+
+
+class TakeoverMessage(Base):
+    """BOXIM message receipt used for audit, deduplication, and chat context."""
+
+    __tablename__ = "takeover_messages"
+    __table_args__ = (
+        UniqueConstraint("owner_id", "boxim_message_id", name="uq_takeover_message_owner_boxim"),
+        Index("ix_takeover_message_conversation", "owner_id", "peer_id", "send_time"),
+    )
+
+    id = Column(String, primary_key=True, default=lambda: uuid.uuid4().hex)
+    avatar_id = Column(String, nullable=False, index=True)
+    owner_id = Column(String, nullable=False, index=True)
+    boxim_message_id = Column(String, nullable=False)
+    boxim_local_id = Column(String, nullable=True)
+    peer_id = Column(String, nullable=False, index=True)
+    direction = Column(String, nullable=False)  # incoming | outgoing
+    message_type = Column(Integer, default=0)
+    content = Column(Text, default="")
+    attachment_id = Column(String, nullable=True)
+    is_avatar = Column(Boolean, default=False)
+    send_time = Column(DateTime, nullable=False)
+    created_at = Column(DateTime, server_default=func.now())
+
+
+class TakeoverReplyTask(Base):
+    """Restart-safe delayed BOXIM reply task."""
+
+    __tablename__ = "takeover_reply_tasks"
+    __table_args__ = (
+        UniqueConstraint("owner_id", "trigger_message_id", name="uq_takeover_task_owner_trigger"),
+        Index("ix_takeover_task_due", "status", "scheduled_at"),
+        Index("ix_takeover_task_conversation", "owner_id", "peer_id", "status"),
+    )
+
+    id = Column(String, primary_key=True, default=lambda: uuid.uuid4().hex)
+    avatar_id = Column(String, nullable=False, index=True)
+    owner_id = Column(String, nullable=False, index=True)
+    peer_id = Column(String, nullable=False, index=True)
+    trigger_message_id = Column(String, nullable=False)
+    source_message_ids = Column(JSON, default=list)
+    prompt = Column(Text, default="")
+    response_text = Column(Text, default="")
+    status = Column(String, default="pending")
+    scheduled_at = Column(DateTime, nullable=False)
+    locked_at = Column(DateTime)
+    sent_at = Column(DateTime)
+    attempts = Column(Integer, default=0)
+    last_error = Column(Text, default="")
+    cancel_reason = Column(String, default="")
+    boxim_local_id = Column(String, nullable=False)
+    boxim_sent_message_id = Column(String, default="")
+    created_at = Column(DateTime, server_default=func.now())
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
+
+
 class Organization(Base):
    __tablename__ = "organizations"
    id = Column(String, primary_key=True, default=lambda: uuid.uuid4().hex)
@@ -100,7 +189,7 @@ class KnowledgeDoc(Base):
    file_type = Column(String, default="")  # pdf | doc | docx | xlsx
    file_size = Column(Integer, default=0)
    file_url = Column(String, default="")
-    status = Column(String, default="uploaded")  # uploaded | parsing | ready
+    status = Column(String, default="uploaded")  # uploaded | parsing | ready | failed
    vectorized = Column(Boolean, default=False)  # 是否已向量化
    embedding_model = Column(String, default="")  # 向量模型标识
    chunk_count = Column(Integer, default=0)  # 切片数量
@@ -169,17 +258,83 @@ class KnowledgeChunk(Base):
        }


+class ChatAttachment(Base):
+    """Private, avatar-scoped result of one chat image analysis."""
+
+    __tablename__ = "chat_attachments"
+    id = Column(String, primary_key=True, default=lambda: uuid.uuid4().hex)
+    avatar_id = Column(String, nullable=False, default="", index=True)
+    uploader_kind = Column(String, default="owner")  # owner | public | boxim
+    filename = Column(String, default="")
+    mime_type = Column(String, default="")
+    file_size = Column(Integer, default=0)
+    status = Column(String, default="processing")  # processing | ready | failed
+    category = Column(String, default="general_image")
+    summary = Column(Text, default="")
+    extracted_text = Column(Text, default="")
+    structured_data = Column(JSON, default=dict)
+    warning = Column(Text, default="")
+    vision_model = Column(String, default="")
+    ocr_model = Column(String, default="")
+    used_at = Column(DateTime)
+    expires_at = Column(DateTime, nullable=False)
+    created_at = Column(DateTime, server_default=func.now())
+
+    def to_dict(self):
+        return {
+            "id": self.id,
+            "avatarId": self.avatar_id,
+            "filename": self.filename,
+            "mimeType": self.mime_type,
+            "fileSize": self.file_size,
+            "status": self.status,
+            "category": self.category,
+            "summary": self.summary,
+            "warning": self.warning,
+            "expiresAt": _iso(self.expires_at),
+            "createdAt": _iso(self.created_at),
+        }
+
+
 class TokenAccount(Base):
    __tablename__ = "token_account"
    id = Column(Integer, primary_key=True)
-    balance = Column(Integer, default=1250)
+    user_id = Column(String, nullable=False, default="", index=True)
+    balance = Column(BigInteger, default=1_000_000)
+    total_granted = Column(BigInteger, default=1_000_000)
+    total_consumed = Column(BigInteger, default=0)
+    created_at = Column(DateTime, server_default=func.now())
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
+
+
+class TokenUsage(Base):
+    __tablename__ = "token_usage"
+    __table_args__ = (
+        Index("ix_token_usage_user_created", "user_id", "created_at"),
+        Index("ix_token_usage_avatar_created", "avatar_id", "created_at"),
+    )
+
+    id = Column(String, primary_key=True, default=lambda: uuid.uuid4().hex)
+    user_id = Column(String, nullable=False, index=True)
+    avatar_id = Column(String, nullable=False, default="", index=True)
+    source = Column(String, nullable=False, default="chat")
+    model = Column(String, default="")
+    status = Column(String, nullable=False, default="reserved")
+    reserved_tokens = Column(BigInteger, default=0)
+    prompt_tokens = Column(BigInteger, default=0)
+    completion_tokens = Column(BigInteger, default=0)
+    total_tokens = Column(BigInteger, default=0)
+    balance_after = Column(BigInteger, default=0)
+    failure_reason = Column(String, default="")
+    created_at = Column(DateTime, server_default=func.now())
+    settled_at = Column(DateTime)


 class TokenPlan(Base):
    __tablename__ = "token_plans"
    id = Column(String, primary_key=True)
    name = Column(String, default="")
-    amount = Column(Integer, default=0)
+    amount = Column(BigInteger, default=0)
    price = Column(Float, default=0)
    badge = Column(String, default="")
    desc = Column(String, default="")
@@ -195,6 +350,47 @@ class TokenPlan(Base):
        }


+class TokenPaymentOrder(Base):
+    __tablename__ = "token_payment_orders"
+
+    id = Column(String, primary_key=True, default=lambda: uuid.uuid4().hex)
+    order_no = Column(String, nullable=False, unique=True, index=True)
+    user_id = Column(String, nullable=False, index=True)
+    plan_id = Column(String, nullable=False)
+    payment_method = Column(String, nullable=False)
+    pay_type = Column(String, nullable=False)
+    pay_way = Column(String, nullable=False)
+    points_amount = Column(BigInteger, nullable=False)
+    price_cents = Column(Integer, nullable=False)
+    status = Column(String, nullable=False, default="pending", index=True)
+    provider_order_id = Column(String, default="")
+    provider_order_no = Column(String, default="")
+    provider_status = Column(String, default="")
+    pay_message = Column(Text, default="")
+    failure_reason = Column(String, default="")
+    created_at = Column(DateTime, server_default=func.now())
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
+    paid_at = Column(DateTime)
+
+    def to_dict(self):
+        return {
+            "id": self.id,
+            "orderNo": self.order_no,
+            "planId": self.plan_id,
+            "paymentMethod": self.payment_method,
+            "payType": self.pay_type,
+            "payWay": self.pay_way,
+            "pointsAmount": self.points_amount,
+            "price": self.price_cents / 100,
+            "status": self.status,
+            "providerStatus": self.provider_status,
+            "payMessage": self.pay_message,
+            "failureReason": self.failure_reason,
+            "createdAt": _iso(self.created_at),
+            "paidAt": _iso(self.paid_at),
+        }
+
+
 class User(Base):
    """会会用户 ↔ 本地用户体系映射（短信验证码登录落库）"""

@@ -7,3 +7,5 @@ httpx
 pypdf
 python-docx
 openpyxl
+apscheduler>=3.10
+Pillow>=10.4
@@ -1,32 +1,404 @@
-from fastapi import APIRouter, Depends, Body
+from fastapi import APIRouter, Body, Depends, Header, HTTPException
 from sqlalchemy.orm import Session

 from database import get_db
-from models import Authorization
-from responses import ok, fail
+from models import Authorization, Avatar, TakeoverCursor, TakeoverReplyTask
+from responses import fail, ok
+from routers.avatars import _require_owned_avatar

 router = APIRouter(tags=["授权"])

+TARGET_TYPES = {"user", "organization", "application"}
+PERMISSION_ORDER = ("friend", "chat", "publish", "browse", "interact", "takeover")
+ALLOWED_PERMISSIONS = set(PERMISSION_ORDER)
+AVATAR_PERMISSION_ORDER = PERMISSION_ORDER
+AVATAR_PERMISSION_KEY = "authorizationPermissions"
+DEFAULT_AVATAR_PERMISSIONS = ["friend", "chat"]
+TAKEOVER_DELAY_KEY = "takeoverReplyDelaySeconds"
+DEFAULT_TAKEOVER_DELAY_SECONDS = 180
+MIN_TAKEOVER_DELAY_SECONDS = 3
+MAX_TAKEOVER_DELAY_SECONDS = 86_400
+LEGACY_PERMISSION_MAP = {
+    "read": "browse",
+    "reply": "chat",
+    "write": "publish",
+    "edit": "publish",
+}
+
+
+def _read(payload: dict, camel_key: str, snake_key: str | None = None, default=None):
+    if camel_key in payload:
+        return payload[camel_key]
+    if snake_key and snake_key in payload:
+        return payload[snake_key]
+    return default
+
+
+def _clean_text(value, field_name: str, *, max_length: int) -> str:
+    text = str(value or "").strip()
+    if not text:
+        raise ValueError(f"{field_name}不能为空")
+    if len(text) > max_length:
+        raise ValueError(f"{field_name}不能超过 {max_length} 个字符")
+    return text
+
+
+def _normalize_permissions(value) -> list[str]:
+    if not isinstance(value, list):
+        raise ValueError("权限格式不正确")
+
+    normalized = []
+    for raw in value:
+        permission = LEGACY_PERMISSION_MAP.get(str(raw).strip(), str(raw).strip())
+        if permission not in ALLOWED_PERMISSIONS:
+            raise ValueError(f"不支持的权限：{raw}")
+        if permission not in normalized:
+            normalized.append(permission)
+
+    if not [item for item in normalized if item != "takeover"]:
+        raise ValueError("请至少选择一项权限")
+    return sorted(normalized, key=PERMISSION_ORDER.index)
+
+
+def _normalize_avatar_permissions(value) -> list[str]:
+    if not isinstance(value, list):
+        raise ValueError("权限格式不正确")
+
+    normalized = []
+    for raw in value:
+        permission = LEGACY_PERMISSION_MAP.get(str(raw).strip(), str(raw).strip())
+        if permission not in AVATAR_PERMISSION_ORDER:
+            raise ValueError(f"不支持的权限：{raw}")
+        if permission not in normalized:
+            normalized.append(permission)
+    return sorted(normalized, key=AVATAR_PERMISSION_ORDER.index)
+
+
+def _stored_avatar_permissions(avatar) -> list[str]:
+    config = avatar.config or {}
+    if AVATAR_PERMISSION_KEY not in config:
+        return list(DEFAULT_AVATAR_PERMISSIONS)
+
+    stored = config.get(AVATAR_PERMISSION_KEY)
+    if not isinstance(stored, list):
+        return list(DEFAULT_AVATAR_PERMISSIONS)
+
+    permissions = []
+    for raw in stored:
+        permission = LEGACY_PERMISSION_MAP.get(str(raw).strip(), str(raw).strip())
+        if permission in AVATAR_PERMISSION_ORDER and permission not in permissions:
+            permissions.append(permission)
+    return sorted(permissions, key=AVATAR_PERMISSION_ORDER.index)
+
+
+def _permission_settings_payload(avatar) -> dict:
+    return {
+        "avatarId": avatar.id,
+        "permissions": _stored_avatar_permissions(avatar),
+        "takeoverReplyDelaySeconds": _stored_takeover_delay(avatar),
+    }
+
+
+def _stored_takeover_delay(avatar) -> int:
+    raw = (avatar.config or {}).get(TAKEOVER_DELAY_KEY, DEFAULT_TAKEOVER_DELAY_SECONDS)
+    if isinstance(raw, bool):
+        return DEFAULT_TAKEOVER_DELAY_SECONDS
+    try:
+        delay = int(raw)
+    except (TypeError, ValueError):
+        return DEFAULT_TAKEOVER_DELAY_SECONDS
+    if not MIN_TAKEOVER_DELAY_SECONDS <= delay <= MAX_TAKEOVER_DELAY_SECONDS:
+        return DEFAULT_TAKEOVER_DELAY_SECONDS
+    return delay
+
+
+def _validate_takeover_delay(value) -> int:
+    if isinstance(value, bool) or not isinstance(value, int):
+        raise ValueError("自动回复等待时间必须是整数秒")
+    if not MIN_TAKEOVER_DELAY_SECONDS <= value <= MAX_TAKEOVER_DELAY_SECONDS:
+        raise ValueError("自动回复等待时间需在 3 秒到 24 小时之间")
+    return value
+
+
+def _disable_other_takeovers(db: Session, avatar) -> list[str]:
+    disabled_ids = []
+    others = (
+        db.query(Avatar)
+        .filter(Avatar.owner_id == avatar.owner_id, Avatar.id != avatar.id)
+        .all()
+    )
+    for other in others:
+        permissions = _stored_avatar_permissions(other)
+        if "takeover" not in permissions:
+            continue
+        other.config = {
+            **(other.config or {}),
+            AVATAR_PERMISSION_KEY: [item for item in permissions if item != "takeover"],
+        }
+        disabled_ids.append(other.id)
+        tasks = (
+            db.query(TakeoverReplyTask)
+            .filter(
+                TakeoverReplyTask.avatar_id == other.id,
+                TakeoverReplyTask.status.in_(("pending", "generating", "ready", "sending")),
+            )
+            .all()
+        )
+        for task in tasks:
+            task.status = "cancelled"
+            task.cancel_reason = "another_avatar_takeover_enabled"
+            task.locked_at = None
+    return disabled_ids
+
+
+def _require_authorization(db: Session, avatar_id: str, authorization_id: str) -> Authorization:
+    authorization = (
+        db.query(Authorization)
+        .filter(
+            Authorization.id == authorization_id,
+            Authorization.avatar_id == avatar_id,
+        )
+        .first()
+    )
+    if not authorization:
+        raise HTTPException(status_code=404, detail="授权不存在")
+    return authorization
+
+
+def _duplicate_target(
+    db: Session,
+    avatar_id: str,
+    target_type: str,
+    target_id: str,
+    *,
+    exclude_id: str | None = None,
+):
+    query = db.query(Authorization).filter(
+        Authorization.avatar_id == avatar_id,
+        Authorization.target_type == target_type,
+        Authorization.target_id == target_id,
+    )
+    if exclude_id:
+        query = query.filter(Authorization.id != exclude_id)
+    return query.first()
+
+
+@router.get("/avatar/{avatar_id}/permission-settings")
+def get_permission_settings(
+    avatar_id: str,
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    avatar = _require_owned_avatar(db, avatar_id, authorization)
+    return ok(_permission_settings_payload(avatar))
+
+
+@router.put("/avatar/{avatar_id}/permission-settings")
+def update_permission_settings(
+    avatar_id: str,
+    payload: dict = Body(...),
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    avatar = _require_owned_avatar(db, avatar_id, authorization)
+    if "permissions" not in payload and TAKEOVER_DELAY_KEY not in payload:
+        return fail("缺少授权设置", 400)
+    try:
+        permissions = (
+            _normalize_avatar_permissions(payload["permissions"])
+            if "permissions" in payload
+            else _stored_avatar_permissions(avatar)
+        )
+        takeover_delay = (
+            _validate_takeover_delay(payload[TAKEOVER_DELAY_KEY])
+            if TAKEOVER_DELAY_KEY in payload
+            else _stored_takeover_delay(avatar)
+        )
+    except ValueError as exc:
+        return fail(str(exc), 400)
+
+    previous_permissions = _stored_avatar_permissions(avatar)
+    avatar.config = {
+        **(avatar.config or {}),
+        AVATAR_PERMISSION_KEY: permissions,
+        TAKEOVER_DELAY_KEY: takeover_delay,
+    }
+    disabled_avatar_ids = _disable_other_takeovers(db, avatar) if "takeover" in permissions else []
+    cursor = db.query(TakeoverCursor).filter(TakeoverCursor.avatar_id == avatar.id).first()
+    if cursor and "takeover" in permissions and "takeover" not in previous_permissions:
+        cursor.initialized = False
+        cursor.last_message_id = "0"
+        cursor.last_error = ""
+    elif cursor and "takeover" not in permissions:
+        cursor.last_error = ""
+
+    if "takeover" not in permissions:
+        tasks = (
+            db.query(TakeoverReplyTask)
+            .filter(
+                TakeoverReplyTask.avatar_id == avatar.id,
+                TakeoverReplyTask.status.in_(("pending", "generating", "ready", "sending")),
+            )
+            .all()
+        )
+        for task in tasks:
+            task.status = "cancelled"
+            task.cancel_reason = "takeover_disabled"
+            task.locked_at = None
+    db.commit()
+    db.refresh(avatar)
+    response = _permission_settings_payload(avatar)
+    response["disabledAvatarIds"] = disabled_avatar_ids
+    return ok(response, "授权设置已保存")
+

@router.get("/avatar/{avatar_id}/authorizations")
-def list_auth(avatar_id: str, db: Session = Depends(get_db)):
-    # demo：返回全部授权（忽略具体 avatar 绑定，便于联调）
-    items = db.query(Authorization).order_by(Authorization.created_at.desc()).all()
-    return ok([a.to_dict() for a in items])
+def list_auth(
+    avatar_id: str,
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    _require_owned_avatar(db, avatar_id, authorization)
+    items = (
+        db.query(Authorization)
+        .filter(Authorization.avatar_id == avatar_id)
+        .order_by(Authorization.created_at.desc())
+        .all()
+    )
+    return ok([item.to_dict() for item in items])
+
+
+@router.post("/avatar/{avatar_id}/authorizations")
+def create_auth(
+    avatar_id: str,
+    payload: dict = Body(...),
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    _require_owned_avatar(db, avatar_id, authorization)
+    try:
+        target_type = _clean_text(
+            _read(payload, "targetType", "target_type", "user"),
+            "授权类型",
+            max_length=24,
+        )
+        if target_type not in TARGET_TYPES:
+            return fail("授权类型不正确", 400)
+        target_id = _clean_text(
+            _read(payload, "targetId", "target_id"),
+            "对象标识",
+            max_length=120,
+        )
+        target_name = _clean_text(
+            _read(payload, "targetName", "target_name"),
+            "对象名称",
+            max_length=50,
+        )
+        permissions = _normalize_permissions(payload.get("permissions", []))
+    except ValueError as exc:
+        return fail(str(exc), 400)
+
+    if _duplicate_target(db, avatar_id, target_type, target_id):
+        return fail("该对象已在授权列表中，可直接编辑现有授权", 409)
+
+    item = Authorization(
+        avatar_id=avatar_id,
+        target_type=target_type,
+        target_id=target_id,
+        target_name=target_name,
+        permissions=permissions,
+        status="active",
+        takeover_enabled=False,
+        takeover_mode="immediate",
+        takeover_delay_seconds=DEFAULT_TAKEOVER_DELAY_SECONDS,
+    )
+    db.add(item)
+    db.commit()
+    db.refresh(item)
+    return ok(item.to_dict(), "授权已添加")


@router.put("/avatar/{avatar_id}/authorizations")
-def update_auth(avatar_id: str, payload: dict = Body(...), db: Session = Depends(get_db)):
-    auth_id = payload.get("id")
+def update_auth(
+    avatar_id: str,
+    payload: dict = Body(...),
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    _require_owned_avatar(db, avatar_id, authorization)
+    auth_id = payload.get("id") or _read(payload, "authorizationId", "authorization_id")
    if not auth_id:
        return fail("缺少授权 id", 400)
-    a = db.query(Authorization).filter(Authorization.id == auth_id).first()
-    if not a:
-        return fail("授权不存在", 404)
+
+    item = _require_authorization(db, avatar_id, str(auth_id))
+    try:
+        target_type = item.target_type
+        target_id = item.target_id
+        if "targetType" in payload or "target_type" in payload:
+            target_type = _clean_text(
+                _read(payload, "targetType", "target_type"),
+                "授权类型",
+                max_length=24,
+            )
+            if target_type not in TARGET_TYPES:
+                return fail("授权类型不正确", 400)
+        if "targetId" in payload or "target_id" in payload:
+            target_id = _clean_text(
+                _read(payload, "targetId", "target_id"),
+                "对象标识",
+                max_length=120,
+            )
+        if "targetName" in payload or "target_name" in payload:
+            item.target_name = _clean_text(
+                _read(payload, "targetName", "target_name"),
+                "对象名称",
+                max_length=50,
+            )
+        if "permissions" in payload:
+            item.permissions = _normalize_permissions(payload["permissions"])
+    except ValueError as exc:
+        return fail(str(exc), 400)
+
+    if _duplicate_target(
+        db,
+        avatar_id,
+        target_type,
+        target_id,
+        exclude_id=item.id,
+    ):
+        return fail("该对象已在授权列表中", 409)
+
    if "status" in payload:
-        a.status = payload["status"]
-    if "permissions" in payload:
-        a.permissions = payload["permissions"]
+        status = str(payload["status"] or "")
+        if status not in ("active", "inactive"):
+            return fail("授权状态不正确", 400)
+        item.status = status
+
+    item.target_type = target_type
+    item.target_id = target_id
+
+    permissions = list(item.permissions or [])
+    chat_allowed = "chat" in permissions or "reply" in permissions
+    if item.status != "active" or item.target_type != "user" or not chat_allowed:
+        item.takeover_enabled = False
+        item.permissions = [permission for permission in permissions if permission != "takeover"]
+    elif item.takeover_enabled and "takeover" not in permissions:
+        item.permissions = permissions + ["takeover"]
+
    db.commit()
-    items = db.query(Authorization).order_by(Authorization.created_at.desc()).all()
-    return ok([x.to_dict() for x in items])
+    db.refresh(item)
+    return ok(item.to_dict(), "授权已更新")
+
+
+@router.delete("/avatar/{avatar_id}/authorizations/{authorization_id}")
+def delete_auth(
+    avatar_id: str,
+    authorization_id: str,
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    _require_owned_avatar(db, avatar_id, authorization)
+    item = _require_authorization(db, avatar_id, authorization_id)
+    db.delete(item)
+    db.commit()
+    return ok({"id": authorization_id}, "授权已删除")
@@ -5,11 +5,21 @@ from fastapi import APIRouter, Depends, Body, Header, UploadFile, File, HTTPExce
 from sqlalchemy.orm import Session

 from database import get_db
-from models import Avatar, KnowledgeDoc, KnowledgeChunk, QAPair, Authorization, User
+from routers.knowledge import UPLOAD_DIR
+from models import (
+    Authorization,
+    Avatar,
+    KnowledgeChunk,
+    KnowledgeDoc,
+    QAPair,
+    TakeoverCursor,
+    TakeoverMessage,
+    TakeoverReplyTask,
+    User,
+)
 from responses import ok, fail

 router = APIRouter(tags=["分身"])
-UPLOAD_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "uploads")
 ALLOWED_AVATAR_EXTENSIONS = {".jpg", ".jpeg", ".png", ".webp", ".gif"}
 MAX_AVATAR_BYTES = 5 * 1024 * 1024

@@ -74,18 +84,21 @@ def list_avatars(page: int = 1, limit: int = 20, authorization: str = Header(Non


@router.get("/avatar/{avatar_id}")
-def get_avatar(avatar_id: str, db: Session = Depends(get_db)):
-    a = db.query(Avatar).filter(Avatar.id == avatar_id).first()
-    if not a:
-        return fail("分身不存在", 404)
-    return ok(a.to_dict())
+def get_avatar(
+    avatar_id: str,
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    return ok(_require_owned_avatar(db, avatar_id, authorization).to_dict())


@router.post("/avatar")
 def create_avatar(payload: dict = Body(...), authorization: str = Header(None), db: Session = Depends(get_db)):
    user = _resolve_user(authorization, db)
+    if not user:
+        raise HTTPException(status_code=401, detail="未登录")
    a = Avatar(
-        owner_id=user.huihui_user_id if user else "",
+        owner_id=user.huihui_user_id,
        name=payload.get("name", "未命名分身"),
        display_name=payload.get("displayName", "") or payload.get("display_name", ""),
        description=payload.get("description", ""),
@@ -102,10 +115,13 @@ def create_avatar(payload: dict = Body(...), authorization: str = Header(None),


@router.put("/avatar/{avatar_id}")
-def update_avatar(avatar_id: str, payload: dict = Body(...), db: Session = Depends(get_db)):
-    a = db.query(Avatar).filter(Avatar.id == avatar_id).first()
-    if not a:
-        return fail("分身不存在", 404)
+def update_avatar(
+    avatar_id: str,
+    payload: dict = Body(...),
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    a = _require_owned_avatar(db, avatar_id, authorization)
    mapping = {
        "displayName": "display_name",
        "photoUrl": "photo_url",
@@ -114,22 +130,32 @@ def update_avatar(avatar_id: str, payload: dict = Body(...), db: Session = Depen
    for key in ("name", "displayName", "description", "photoUrl", "emoji", "status", "tokenBalance", "config"):
        if key in payload:
            col = mapping.get(key, key)
-            setattr(a, col, payload[key])
+            value = payload[key]
+            if key == "config":
+                if not isinstance(value, dict):
+                    return fail("分身配置格式不正确", 400)
+                value = {**(a.config or {}), **value}
+            setattr(a, col, value)
    db.commit()
    db.refresh(a)
    return ok(a.to_dict())


@router.delete("/avatar/{avatar_id}")
-def delete_avatar(avatar_id: str, db: Session = Depends(get_db)):
-    a = db.query(Avatar).filter(Avatar.id == avatar_id).first()
-    if not a:
-        return fail("分身不存在", 404)
+def delete_avatar(
+    avatar_id: str,
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    a = _require_owned_avatar(db, avatar_id, authorization)
    # 级联清理关联数据，避免孤儿记录
    db.query(KnowledgeDoc).filter(KnowledgeDoc.avatar_id == avatar_id).delete()
    db.query(KnowledgeChunk).filter(KnowledgeChunk.avatar_id == avatar_id).delete()
    db.query(QAPair).filter(QAPair.avatar_id == avatar_id).delete()
    db.query(Authorization).filter(Authorization.avatar_id == avatar_id).delete()
+    db.query(TakeoverReplyTask).filter(TakeoverReplyTask.avatar_id == avatar_id).delete()
+    db.query(TakeoverMessage).filter(TakeoverMessage.avatar_id == avatar_id).delete()
+    db.query(TakeoverCursor).filter(TakeoverCursor.avatar_id == avatar_id).delete()
    db.delete(a)
    db.commit()
    return ok({"success": True})
@@ -27,8 +27,9 @@ from sqlalchemy.orm import Session
 _CN_TZ = timezone(timedelta(hours=8))

 from database import get_db
-from models import User
+from models import Avatar, TakeoverCursor, TakeoverMessage, TakeoverReplyTask, User
 from responses import ok, fail
+from services.boxim_client import BoxIMClient, BoxIMError

 router = APIRouter(tags=["会会账号"])

@@ -111,6 +112,19 @@ def _cfg_ready() -> bool:
    return bool(AUTH_BASE_URL and APP_ID and ACCESS_ID and ACCESS_SECRET)


+def _create_boxim_client() -> BoxIMClient:
+    return BoxIMClient({
+        "HUIHUI_PLATFORM_BASE_URL": os.getenv(
+            "HUIHUI_PLATFORM_BASE_URL", "https://open.99hui.com/api"
+        ),
+        "BOXIM_API_BASE_URL": os.getenv("BOXIM_API_BASE_URL", "https://im.99hui.com/api"),
+        "HUIHUI_APP_ID": APP_ID,
+        "HUIHUI_ACCESS_ID": ACCESS_ID,
+        "HUIHUI_ACCESS_SECRET": ACCESS_SECRET,
+        "BOXIM_TIMEOUT_SECONDS": os.getenv("BOXIM_TIMEOUT_SECONDS", "20"),
+    })
+
+
 def _call_huihui(path: str, params: dict, as_query: bool = False):
    """调用会会接口，返回 (ok: bool, payload: dict, http_status: int)"""
    url = f"{AUTH_BASE_URL}{path}"
@@ -281,12 +295,108 @@ def pwd_login(body: dict = Body(...), db: Session = Depends(get_db)):
    })


-def _issue_session(db: Session, phone: str, info: dict):
+@router.post("/huihui/token/login")
+async def token_login(body: dict = Body(...), db: Session = Depends(get_db)):
+    """Validate a production Huihui token through BOXIM and issue an app session."""
+    huihui_token = (body.get("token") or "").strip()
+    if not huihui_token or len(huihui_token) > 8192:
+        return fail("会会登录凭证无效或已过期", 401)
+    if not _cfg_ready():
+        return fail("会会登录服务未配置", 500)
+
+    client = _create_boxim_client()
+    try:
+        token_data = await client.exchange_access_token(huihui_token)
+        profile = await client.get_self(token_data["accessToken"])
+    except BoxIMError as exc:
+        if exc.auth_error:
+            return fail("会会登录凭证无效或已过期", 401)
+        return fail("会会登录服务暂时不可用，请稍后重试", 502)
+
+    # BOXIM's id is its internal IM id. Account ownership must use huihuiUserId.
+    huihui_user_id = str(profile.get("huihuiUserId") or "").strip()
+    if not huihui_user_id:
+        return fail("会会未返回用户标识", 502)
+
+    phone = str(_pick(profile, "mobile", "phone", default="")).strip()
+    nickname = str(_pick(profile, "nickName", "nickname", "name", "userName", default="")).strip()
+    avatar_url = str(
+        _pick(profile, "headImage", "headImageThumb", "avatar", "avatarUrl", default="")
+    ).strip()
+    return _issue_session(
+        db,
+        phone,
+        {
+            "userId": huihui_user_id,
+            "nickname": nickname,
+            "avatarUrl": avatar_url,
+            "token": huihui_token,
+        },
+        reuse_existing_session=True,
+    )
+
+
+def _transfer_avatar_ownership(db: Session, old_owner_id: str, new_owner_id: str) -> int:
+    """Move one user's avatar-owned data to a replacement Huihui identity."""
+    if not old_owner_id or old_owner_id == new_owner_id:
+        return 0
+
+    avatar_ids = [
+        avatar_id
+        for (avatar_id,) in db.query(Avatar.id).filter(Avatar.owner_id == old_owner_id).all()
+    ]
+    if not avatar_ids:
+        return 0
+
+    db.query(Avatar).filter(Avatar.id.in_(avatar_ids)).update(
+        {Avatar.owner_id: new_owner_id}, synchronize_session="fetch"
+    )
+    for model in (TakeoverCursor, TakeoverMessage, TakeoverReplyTask):
+        db.query(model).filter(model.avatar_id.in_(avatar_ids)).update(
+            {model.owner_id: new_owner_id}, synchronize_session="fetch"
+        )
+    return len(avatar_ids)
+
+
+def _find_or_link_user(db: Session, phone: str, huihui_user_id: str) -> User:
+    """Resolve an account and safely retain avatars across Huihui environments."""
+    user = db.query(User).filter(User.huihui_user_id == huihui_user_id).first()
+    if not phone:
+        return user or User(huihui_user_id=huihui_user_id)
+
+    same_phone_users = db.query(User).filter(User.phone == phone).all()
+
+    if user is None:
+        # A unique verified-phone match is the same person whose upstream ID changed.
+        if len(same_phone_users) == 1:
+            user = same_phone_users[0]
+            old_owner_id = user.huihui_user_id
+            _transfer_avatar_ownership(db, old_owner_id, huihui_user_id)
+            user.huihui_user_id = huihui_user_id
+            return user
+        return User(huihui_user_id=huihui_user_id)
+
+    legacy_users = [candidate for candidate in same_phone_users if candidate.id != user.id]
+    current_avatar_count = db.query(Avatar).filter(Avatar.owner_id == huihui_user_id).count()
+    if len(legacy_users) == 1 and current_avatar_count == 0:
+        legacy_user = legacy_users[0]
+        _transfer_avatar_ownership(db, legacy_user.huihui_user_id, huihui_user_id)
+        legacy_user.app_token = ""
+        legacy_user.huihui_token = ""
+        db.add(legacy_user)
+    return user
+
+
+def _issue_session(
+    db: Session,
+    phone: str,
+    info: dict,
+    *,
+    reuse_existing_session: bool = False,
+):
    """建/链本地用户并签发本系统会话 token"""
    huihui_user_id = info.get("userId", "")
-    user = db.query(User).filter(User.huihui_user_id == huihui_user_id).first()
-    if not user:
-        user = User(huihui_user_id=huihui_user_id)
+    user = _find_or_link_user(db, phone, huihui_user_id)
    if phone:
        user.phone = phone
    if info.get("nickname"):
@@ -294,12 +404,16 @@ def _issue_session(db: Session, phone: str, info: dict):
    if info.get("avatarUrl"):
        user.avatar_url = info["avatarUrl"]
    user.huihui_token = info.get("token", "")
-    user.app_token = uuid.uuid4().hex
+    if not reuse_existing_session or not user.app_token:
+        user.app_token = uuid.uuid4().hex
    user.last_login_at = datetime.now()
    db.add(user)
    db.commit()
    db.refresh(user)

+    from services.token_billing import get_or_create_account
+    get_or_create_account(db, user.id)
+
    return ok({
        "token": user.app_token,
        "user": user.to_dict(),
@@ -307,7 +421,6 @@ def _issue_session(db: Session, phone: str, info: dict):
            "userId": huihui_user_id,
            "nickname": info.get("nickname", ""),
            "avatarUrl": info.get("avatarUrl", ""),
-            "token": info.get("token", ""),
        },
    })

@@ -1,5 +1,6 @@
 import os
 import json
+import logging
 import uuid
 from datetime import datetime, timezone

@@ -13,9 +14,10 @@ from responses import ok, fail
 import embeddings

 router = APIRouter()
+logger = logging.getLogger(__name__)

 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
-UPLOAD_DIR = os.path.join(BASE_DIR, "uploads")
+UPLOAD_DIR = os.path.abspath(os.getenv("UPLOAD_DIR", os.path.join(BASE_DIR, "uploads")))
 os.makedirs(UPLOAD_DIR, exist_ok=True)

 ALLOWED_EXT = {".md", ".txt", ".pdf", ".doc", ".docx", ".xlsx"}
@@ -32,6 +34,14 @@ class EnabledIn(BaseModel):
    enabled: bool = True


+def _doc_payload(doc: KnowledgeDoc) -> dict:
+    payload = doc.to_dict()
+    stored_name = os.path.basename(doc.file_url or "")
+    stored_path = os.path.join(UPLOAD_DIR, doc.avatar_id, stored_name)
+    payload["filePresent"] = bool(stored_name and os.path.isfile(stored_path))
+    return payload
+
+
 def _resolve_user(authorization: str | None, db: Session):
    if not authorization:
        return None
@@ -61,7 +71,16 @@ def list_docs(avatar_id: str, authorization: str = Header(None), db: Session = D
        .order_by(KnowledgeDoc.created_at.desc())
        .all()
    )
-    return ok([d.to_dict() for d in docs])
+    # Older synchronous uploads could be interrupted after persisting "parsing".
+    # New uploads are committed only after indexing finishes, so these rows are stale.
+    stale_docs = [doc for doc in docs if doc.status == "parsing"]
+    if stale_docs:
+        for doc in stale_docs:
+            doc.status = "failed"
+            doc.vectorized = False
+            doc.chunk_count = 0
+        db.commit()
+    return ok([_doc_payload(d) for d in docs])


@router.post("/avatar/{avatar_id}/knowledge/docs")
@@ -80,6 +99,7 @@ async def upload_doc(avatar_id: str, file: UploadFile = File(...), authorization
    with open(path, "wb") as f:
        f.write(content)
    doc = KnowledgeDoc(
+        id=uuid.uuid4().hex,
        avatar_id=avatar_id,
        filename=file.filename,
        file_type=ext.lstrip("."),
@@ -87,41 +107,49 @@ async def upload_doc(avatar_id: str, file: UploadFile = File(...), authorization
        file_url=f"/api/files/{avatar_id}/{stored}",
        status="parsing",
    )
-    db.add(doc)
-    db.commit()
-    db.refresh(doc)

-    # 向量化：抽取文本 -> 分块 -> 调第三方/本地嵌入 -> 存切片
+    # Complete extraction and embedding before the first database commit so a
+    # process restart cannot leave a permanent "parsing" row behind.
    try:
        text = embeddings.extract_text(path, ext)
        chunks = embeddings.chunk_text(text)
-        if chunks:
-            vectors = embeddings.embed(chunks)
-            for i, (c, v) in enumerate(zip(chunks, vectors)):
-                db.add(
-                    KnowledgeChunk(
-                        doc_id=doc.id,
-                        avatar_id=avatar_id,
-                        content=c,
-                        vector=json.dumps(v),
-                        chunk_index=i,
-                        embedding_model=embeddings.MODEL,
-                    )
-                )
-            doc.vectorized = True
-            doc.embedding_model = embeddings.MODEL
-            doc.chunk_count = len(chunks)
-            doc.vectorized_at = datetime.now(timezone.utc)
+        if not chunks:
+            raise ValueError("文档没有可建立索引的文字内容")
+        vectors = embeddings.embed(chunks)
+        if len(vectors) != len(chunks):
+            raise ValueError("向量服务返回数量与文档分段不一致")
+        doc.vectorized = True
+        doc.embedding_model = embeddings.MODEL
+        doc.chunk_count = len(chunks)
+        doc.vectorized_at = datetime.now(timezone.utc)
        doc.status = "ready"
+        db.add(doc)
+        for i, (chunk, vector) in enumerate(zip(chunks, vectors)):
+            db.add(
+                KnowledgeChunk(
+                    doc_id=doc.id,
+                    avatar_id=avatar_id,
+                    content=chunk,
+                    vector=json.dumps(vector),
+                    chunk_index=i,
+                    embedding_model=embeddings.MODEL,
+                )
+            )
        db.commit()
        db.refresh(doc)
-    except Exception as e:
-        print("vectorize failed:", e)
-        doc.status = "ready"  # 上传成功但向量化失败，仍可展示
+    except Exception as exc:
+        db.rollback()
+        doc.status = "failed"
+        doc.vectorized = False
+        doc.embedding_model = ""
+        doc.chunk_count = 0
+        doc.vectorized_at = None
+        db.add(doc)
        db.commit()
        db.refresh(doc)
+        logger.exception("knowledge vectorization failed for %s: %s", doc.id, exc)

-    return ok(doc.to_dict())
+    return ok(_doc_payload(doc))


@router.delete("/avatar/{avatar_id}/knowledge/docs/{doc_id}")
@@ -0,0 +1,153 @@
+"""数字分身 BOXIM 单聊接管 API。"""
+
+from datetime import datetime, timedelta
+
+from fastapi import APIRouter, Body, Depends, Header
+from sqlalchemy.orm import Session
+
+from database import get_db
+from models import TakeoverCursor, TakeoverReplyTask, User
+from responses import fail, ok
+from routers.authorizations import (
+    DEFAULT_TAKEOVER_DELAY_SECONDS,
+    MAX_TAKEOVER_DELAY_SECONDS,
+    MIN_TAKEOVER_DELAY_SECONDS,
+    _require_authorization,
+    _stored_takeover_delay,
+)
+from routers.avatars import _require_owned_avatar
+
+router = APIRouter(tags=["分身接管"])
+BOXIM_STATUS_FRESH_SECONDS = 60
+
+
+def _delay_label(seconds: int) -> str:
+    if seconds % 60 == 0:
+        return f"{seconds // 60} 分钟"
+    return f"{seconds} 秒"
+
+
+@router.get("/avatar/{avatar_id}/takeover/status")
+def get_takeover_status(
+    avatar_id: str,
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    avatar = _require_owned_avatar(db, avatar_id, authorization)
+    permissions = (avatar.config or {}).get("authorizationPermissions", [])
+    enabled = isinstance(permissions, list) and "takeover" in permissions
+    reply_delay_seconds = _stored_takeover_delay(avatar)
+    user = db.query(User).filter(User.huihui_user_id == avatar.owner_id).first()
+    cursor = db.query(TakeoverCursor).filter(TakeoverCursor.avatar_id == avatar.id).first()
+    pending_count = (
+        db.query(TakeoverReplyTask)
+        .filter(
+            TakeoverReplyTask.avatar_id == avatar.id,
+            TakeoverReplyTask.status.in_(("pending", "generating", "ready", "sending")),
+        )
+        .count()
+    )
+
+    if cursor and cursor.last_error:
+        status, message = "error", cursor.last_error
+    elif not enabled:
+        status, message = "disabled", "主动接管未开启"
+    elif not user or not user.huihui_token:
+        status, message = "needs_login", "请重新登录会会生产账号以连接 BOXIM"
+    elif (
+        cursor
+        and cursor.initialized
+        and cursor.last_polled_at
+        # BOXIM offline-message reads can long-poll for about 20 seconds.
+        and cursor.last_polled_at
+        >= datetime.utcnow() - timedelta(seconds=BOXIM_STATUS_FRESH_SECONDS)
+    ):
+        status, message = (
+            "ready",
+            f"BOXIM 已连接，收到私聊消息 {_delay_label(reply_delay_seconds)}后自动回复",
+        )
+    else:
+        status, message = "connecting", "正在连接 BOXIM"
+
+    return ok(
+        {
+            "enabled": enabled,
+            "status": status,
+            "message": message,
+            "pendingCount": pending_count,
+            "takeoverReplyDelaySeconds": reply_delay_seconds,
+            "lastPolledAt": cursor.last_polled_at.isoformat() if cursor and cursor.last_polled_at else None,
+        }
+    )
+
+
+def _has(payload: dict, camel_key: str, snake_key: str) -> bool:
+    return camel_key in payload or snake_key in payload
+
+
+def _read(payload: dict, camel_key: str, snake_key: str, default=None):
+    if camel_key in payload:
+        return payload[camel_key]
+    if snake_key in payload:
+        return payload[snake_key]
+    return default
+
+
+@router.put("/avatar/{avatar_id}/authorizations/takeover")
+def update_takeover_config(
+    avatar_id: str,
+    payload: dict = Body(...),
+    authorization: str = Header(None),
+    db: Session = Depends(get_db),
+):
+    _require_owned_avatar(db, avatar_id, authorization)
+    auth_id = _read(payload, "authorizationId", "authorization_id")
+    if not auth_id:
+        return fail("缺少 authorization_id", 400)
+
+    auth = _require_authorization(db, avatar_id, str(auth_id))
+    enabled = bool(auth.takeover_enabled)
+    mode = auth.takeover_mode or "immediate"
+    delay = auth.takeover_delay_seconds or DEFAULT_TAKEOVER_DELAY_SECONDS
+
+    if _has(payload, "takeoverEnabled", "takeover_enabled"):
+        raw_enabled = _read(payload, "takeoverEnabled", "takeover_enabled")
+        if not isinstance(raw_enabled, bool):
+            return fail("takeover_enabled 必须是布尔值", 400)
+        enabled = raw_enabled
+
+    if _has(payload, "takeoverMode", "takeover_mode"):
+        mode = _read(payload, "takeoverMode", "takeover_mode")
+        if mode not in ("immediate", "delayed"):
+            return fail("takeover_mode 必须是 immediate 或 delayed", 400)
+
+    if _has(payload, "takeoverDelaySeconds", "takeover_delay_seconds"):
+        delay = _read(payload, "takeoverDelaySeconds", "takeover_delay_seconds")
+        if (
+            isinstance(delay, bool)
+            or not isinstance(delay, int)
+            or not MIN_TAKEOVER_DELAY_SECONDS <= delay <= MAX_TAKEOVER_DELAY_SECONDS
+        ):
+            return fail("延迟时间需在 3 秒到 24 小时之间", 400)
+
+    if enabled and auth.target_type != "user":
+        return fail("本期仅支持对会会用户开启单聊接管", 400)
+    if enabled and auth.status != "active":
+        return fail("请先启用该授权，再开启聊天接管", 400)
+
+    permissions = list(auth.permissions or [])
+    if enabled:
+        if "chat" not in permissions and "reply" not in permissions:
+            permissions.append("chat")
+        if "takeover" not in permissions:
+            permissions.append("takeover")
+    else:
+        permissions = [permission for permission in permissions if permission != "takeover"]
+
+    auth.permissions = permissions
+    auth.takeover_enabled = enabled
+    auth.takeover_mode = mode
+    auth.takeover_delay_seconds = delay
+    db.commit()
+    db.refresh(auth)
+    return ok(auth.to_dict(), "接管配置已保存")
@@ -1,37 +1,346 @@
-from fastapi import APIRouter, Depends, Body
+import hashlib
+import hmac
+import json
+import os
+import uuid
+from datetime import datetime
+from decimal import Decimal, InvalidOperation, ROUND_HALF_UP
+from urllib.parse import parse_qs
+
+from fastapi import APIRouter, Body, Depends, Header, HTTPException, Request
+from sqlalchemy import func
 from sqlalchemy.orm import Session

 from database import get_db
-from models import TokenAccount, TokenPlan
-from responses import ok, fail
+from models import TokenAccount, TokenPaymentOrder, TokenPlan, TokenUsage, User
+from responses import fail, ok
+from services.huihui_payment import HuihuiPaymentClient, HuihuiPaymentError
+from services.token_billing import DEFAULT_TOKEN_GRANT, get_or_create_account

 router = APIRouter(tags=["Token"])

+PAYMENT_METHODS = {"wechat": "WECHAT", "alipay": "ALIPAY"}
+PAYMENT_SCENES = {"APP", "LITE", "JSAPI"}
+SUCCESS_STATUSES = {"SUCCESS", "SUCCEEDED", "PAID", "COMPLETED", "TRADE_SUCCESS"}
+FAILED_STATUSES = {"FAIL", "FAILED", "CLOSED", "CANCELLED", "CANCELED", "EXPIRED"}
+
+
+def _require_user(authorization: str | None, db: Session) -> User:
+    if not authorization:
+        raise HTTPException(status_code=401, detail="未登录")
+    token = authorization.replace("Bearer ", "", 1).replace("bearer ", "", 1).strip()
+    user = db.query(User).filter(User.app_token == token).first()
+    if not user:
+        raise HTTPException(status_code=401, detail="会话无效或已过期")
+    return user
+
+
+def _payment_client() -> HuihuiPaymentClient:
+    return HuihuiPaymentClient({
+        "HUIHUI_PAYMENT_BASE_URL": os.getenv(
+            "HUIHUI_PAYMENT_BASE_URL", "https://open.99hui.com/api/payment-v3"
+        ),
+        "HUIHUI_APP_ID": os.getenv("HUIHUI_APP_ID", ""),
+        "HUIHUI_ACCESS_ID": os.getenv("HUIHUI_ACCESS_ID", ""),
+        "HUIHUI_ACCESS_SECRET": os.getenv("HUIHUI_ACCESS_SECRET", ""),
+        "HUIHUI_PAYMENT_TIMEOUT_SECONDS": os.getenv("HUIHUI_PAYMENT_TIMEOUT_SECONDS", "30"),
+    })
+
+
+def _callback_url(order_no: str) -> str:
+    base = os.getenv(
+        "HUIHUI_PAYMENT_CALLBACK_BASE_URL", "https://digital.99hui.com"
+    ).rstrip("/")
+    secret = os.getenv("HUIHUI_PAYMENT_CALLBACK_SECRET", "").strip()
+    if len(secret) < 16:
+        raise HuihuiPaymentError("会会支付回调密钥未配置")
+    signature = hmac.new(secret.encode(), order_no.encode(), hashlib.sha256).hexdigest()
+    return f"{base}/api/token/payment/callback/{order_no}/{signature}"
+
+
+def _price_cents(price: float) -> int:
+    return int(
+        (Decimal(str(price)) * Decimal("100")).quantize(
+            Decimal("1"), rounding=ROUND_HALF_UP
+        )
+    )
+
+
+def _payment_payload(order: TokenPaymentOrder, account: TokenAccount) -> dict:
+    return {**order.to_dict(), "balance": account.balance}
+
+
+def _nested_payload(value):
+    if isinstance(value, str):
+        text = value.strip()
+        if text[:1] in ("{", "["):
+            try:
+                return _nested_payload(json.loads(text))
+            except (TypeError, ValueError):
+                return value
+        return value
+    if isinstance(value, list):
+        return [_nested_payload(item) for item in value]
+    if isinstance(value, dict):
+        return {key: _nested_payload(item) for key, item in value.items()}
+    return value
+
+
+def _find_value(payload, *names):
+    expected = {name.lower() for name in names}
+    if isinstance(payload, dict):
+        for key, value in payload.items():
+            if key.lower() in expected and value not in (None, ""):
+                return value
+        for value in payload.values():
+            found = _find_value(value, *names)
+            if found not in (None, ""):
+                return found
+    elif isinstance(payload, list):
+        for value in payload:
+            found = _find_value(value, *names)
+            if found not in (None, ""):
+                return found
+    return None
+
+
+def _callback_amount_cents(payload) -> int | None:
+    value = _find_value(
+        payload,
+        "actualAmt",
+        "payAmt",
+        "masterOrderAmt",
+        "orderAmt",
+        "amount",
+        "totalAmount",
+    )
+    if value in (None, ""):
+        return None
+    try:
+        return int(
+            (Decimal(str(value)) * Decimal("100")).quantize(
+                Decimal("1"), rounding=ROUND_HALF_UP
+            )
+        )
+    except (InvalidOperation, TypeError, ValueError):
+        return None
+

@router.get("/token/balance")
-def balance(db: Session = Depends(get_db)):
-    acc = db.query(TokenAccount).first()
-    return ok({"balance": acc.balance if acc else 0})
+def balance(authorization: str = Header(None), db: Session = Depends(get_db)):
+    user = _require_user(authorization, db)
+    acc = get_or_create_account(db, user.id)
+    return ok({
+        "balance": acc.balance,
+        "totalGranted": acc.total_granted,
+        "totalConsumed": acc.total_consumed,
+    })


@router.get("/token/plans")
-def plans(db: Session = Depends(get_db)):
+def plans(authorization: str = Header(None), db: Session = Depends(get_db)):
+    _require_user(authorization, db)
    items = db.query(TokenPlan).order_by(TokenPlan.price.asc()).all()
    return ok([p.to_dict() for p in items])


+# 积分只会在会会支付回调确认成功后到账。
@router.post("/token/charge")
-def charge(payload: dict = Body(...), db: Session = Depends(get_db)):
-    plan_id = payload.get("planId")
-    plan = db.query(TokenPlan).filter(TokenPlan.id == plan_id).first()
+def charge(payload: dict = Body(...), authorization: str = Header(None), db: Session = Depends(get_db)):
+    user = _require_user(authorization, db)
+    plan = db.query(TokenPlan).filter(TokenPlan.id == payload.get("planId")).first()
    if not plan:
        return fail("套餐不存在", 404)
-    acc = db.query(TokenAccount).first()
-    if not acc:
-        acc = TokenAccount(balance=0)
-        db.add(acc)
-        db.commit()
-        db.refresh(acc)
-    acc.balance += plan.amount
+
+    payment_method = str(payload.get("paymentMethod") or "").lower()
+    pay_type = PAYMENT_METHODS.get(payment_method)
+    if not pay_type:
+        return fail("请选择正确的支付方式", 400)
+    pay_way = str(payload.get("payScene") or "APP").upper()
+    if pay_way not in PAYMENT_SCENES:
+        return fail("当前支付场景不受支持", 400)
+
+    cents = _price_cents(plan.price)
+    order = TokenPaymentOrder(
+        order_no=f"AV{datetime.utcnow().strftime('%Y%m%d%H%M%S')}{uuid.uuid4().hex[:12].upper()}",
+        user_id=user.id,
+        plan_id=plan.id,
+        payment_method=payment_method,
+        pay_type=pay_type,
+        pay_way=pay_way,
+        points_amount=plan.amount,
+        price_cents=cents,
+        status="pending",
+    )
+    db.add(order)
    db.commit()
-    return ok({"balance": acc.balance, "charged": plan.amount})
+
+    try:
+        callback_url = _callback_url(order.order_no)
+    except HuihuiPaymentError as exc:
+        order.status = "failed"
+        order.failure_reason = str(exc)
+        db.commit()
+        return fail(str(exc), 503)
+
+    try:
+        result = _payment_client().create_payment(
+            huihui_token=user.huihui_token,
+            huihui_user_id=user.huihui_user_id,
+            real_name=user.nickname,
+            order_no=order.order_no,
+            amount=f"{cents / 100:.2f}",
+            points_amount=plan.amount,
+            pay_type=pay_type,
+            pay_way=pay_way,
+            callback_url=callback_url,
+        )
+    except HuihuiPaymentError as exc:
+        order.status = "failed"
+        order.failure_reason = str(exc)[:500]
+        db.commit()
+        return fail(str(exc), 502)
+
+    db.refresh(order)
+    if order.status != "paid":
+        order.provider_order_id = str(result.get("orderId") or "")
+        order.provider_order_no = str(result.get("orderNo") or "")
+        order.provider_status = str(result.get("status") or "pending")
+        message = result.get("payMessage") or ""
+        order.pay_message = (
+            json.dumps(message, ensure_ascii=False)
+            if isinstance(message, (dict, list))
+            else str(message)
+        )
+        if order.provider_status.upper() in FAILED_STATUSES:
+            order.status = "failed"
+            order.failure_reason = str(result.get("bankReturnMsg") or "支付下单失败")[:500]
+        db.commit()
+
+    return ok(_payment_payload(order, get_or_create_account(db, user.id)))
+
+
+@router.get("/token/payment/{order_id}")
+def payment_status(order_id: str, authorization: str = Header(None), db: Session = Depends(get_db)):
+    user = _require_user(authorization, db)
+    order = db.query(TokenPaymentOrder).filter(
+        TokenPaymentOrder.id == order_id,
+        TokenPaymentOrder.user_id == user.id,
+    ).first()
+    if not order:
+        return fail("支付订单不存在", 404)
+    return ok(_payment_payload(order, get_or_create_account(db, user.id)))
+
+
+@router.post("/token/payment/callback/{order_no}/{callback_signature}")
+async def payment_callback(
+    order_no: str,
+    callback_signature: str,
+    request: Request,
+    db: Session = Depends(get_db),
+):
+    secret = os.getenv("HUIHUI_PAYMENT_CALLBACK_SECRET", "").strip()
+    expected = hmac.new(secret.encode(), order_no.encode(), hashlib.sha256).hexdigest()
+    if len(secret) < 16 or not hmac.compare_digest(callback_signature, expected):
+        raise HTTPException(status_code=404, detail="Not found")
+
+    content_type = request.headers.get("content-type", "").lower()
+    if "application/json" in content_type:
+        try:
+            payload = await request.json()
+        except ValueError:
+            return fail("支付回调格式不正确", 400)
+    else:
+        raw = (await request.body()).decode("utf-8", errors="replace")
+        payload = {key: values[-1] for key, values in parse_qs(raw).items()}
+    payload = _nested_payload(payload)
+
+    payload_order_no = str(_find_value(
+        payload,
+        "masterOrderNo",
+        "master_order_no",
+        "orderNo",
+        "order_no",
+        "bizOrderNo",
+    ) or "").strip()
+    if payload_order_no and payload_order_no != order_no:
+        return fail("支付回调订单号不匹配", 422)
+
+    order = db.query(TokenPaymentOrder).filter(TokenPaymentOrder.order_no == order_no).first()
+    if not order:
+        return fail("支付订单不存在", 404)
+    if order.status == "paid":
+        return ok({"received": True, "duplicate": True})
+
+    provider_status = str(_find_value(
+        payload, "status", "payStatus", "tradeStatus", "paymentStatus"
+    ) or "").upper()
+    order.provider_status = provider_status
+    if provider_status not in SUCCESS_STATUSES:
+        if provider_status in FAILED_STATUSES:
+            order.status = "failed"
+            order.failure_reason = str(
+                _find_value(payload, "message", "errorMsg", "failReason") or "支付失败"
+            )[:500]
+        db.commit()
+        return ok({"received": True, "paid": False})
+
+    paid_cents = _callback_amount_cents(payload)
+    if paid_cents is None or paid_cents != order.price_cents:
+        order.failure_reason = "支付回调金额不匹配"
+        db.commit()
+        return fail("支付金额不匹配", 422)
+
+    updated = db.query(TokenPaymentOrder).filter(
+        TokenPaymentOrder.id == order.id,
+        TokenPaymentOrder.status != "paid",
+    ).update({
+        TokenPaymentOrder.status: "paid",
+        TokenPaymentOrder.provider_status: provider_status,
+        TokenPaymentOrder.paid_at: datetime.utcnow(),
+        TokenPaymentOrder.failure_reason: "",
+    }, synchronize_session=False)
+    if updated:
+        account = db.query(TokenAccount).filter(TokenAccount.user_id == order.user_id).first()
+        if account is None:
+            account = TokenAccount(
+                user_id=order.user_id,
+                balance=DEFAULT_TOKEN_GRANT,
+                total_granted=DEFAULT_TOKEN_GRANT,
+                total_consumed=0,
+            )
+            db.add(account)
+            db.flush()
+        account.balance = int(account.balance or 0) + order.points_amount
+        account.total_granted = int(account.total_granted or 0) + order.points_amount
+    db.commit()
+    return ok({"received": True, "paid": True})
+
+
+@router.get("/token/usage")
+def usage(authorization: str = Header(None), db: Session = Depends(get_db)):
+    user = _require_user(authorization, db)
+    rows = (
+        db.query(
+            TokenUsage.avatar_id,
+            TokenUsage.source,
+            func.sum(TokenUsage.prompt_tokens),
+            func.sum(TokenUsage.completion_tokens),
+            func.sum(TokenUsage.total_tokens),
+            func.count(TokenUsage.id),
+        )
+        .filter(TokenUsage.user_id == user.id, TokenUsage.status == "completed")
+        .group_by(TokenUsage.avatar_id, TokenUsage.source)
+        .all()
+    )
+    return ok([
+        {
+            "avatarId": avatar_id,
+            "source": source,
+            "promptTokens": int(prompt_tokens or 0),
+            "completionTokens": int(completion_tokens or 0),
+            "totalTokens": int(total_tokens or 0),
+            "requestCount": int(request_count or 0),
+        }
+        for avatar_id, source, prompt_tokens, completion_tokens, total_tokens, request_count in rows
+    ])
@@ -0,0 +1,210 @@
+"""Client for Huihui's self-hosted BOXIM production APIs."""
+
+import hashlib
+import random
+import secrets
+import string
+import time
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+import httpx
+
+
+_CN_TZ = timezone(timedelta(hours=8))
+
+
+class BoxIMError(RuntimeError):
+    def __init__(self, message: str, *, code: Any = None, auth_error: bool = False):
+        super().__init__(message)
+        self.code = code
+        self.auth_error = auth_error
+
+
+class BoxIMClient:
+    """Exchange Huihui credentials and call BOXIM's private-message API."""
+
+    def __init__(self, config: dict):
+        self.platform_base_url = config.get(
+            "HUIHUI_PLATFORM_BASE_URL", "https://open.99hui.com/api"
+        ).rstrip("/")
+        self.im_base_url = config.get(
+            "BOXIM_API_BASE_URL", "https://im.99hui.com/api"
+        ).rstrip("/")
+        self.app_id = config.get("HUIHUI_APP_ID", "")
+        self.access_id = config.get("HUIHUI_ACCESS_ID", "")
+        self.access_secret = config.get("HUIHUI_ACCESS_SECRET", "")
+        self.timeout = float(config.get("BOXIM_TIMEOUT_SECONDS", 20))
+
+    def _build_sign_params(self, extra: dict | None = None) -> dict:
+        """Build the same signed form used by Huihui's current production app."""
+        params = {
+            "appId": self.app_id,
+            "accessId": self.access_id,
+            "nonce": "".join(random.choices(string.ascii_lowercase + string.digits, k=12)),
+            "timestamp": datetime.now(_CN_TZ).strftime("%Y%m%d%H%M%S"),
+            "signType": "MD5",
+            "signVersion": "1.0",
+            **(extra or {}),
+        }
+        params.pop("accessSecret", None)
+        params.pop("signature", None)
+        sign_parts = []
+        for key in sorted(params):
+            value = params[key]
+            if value in (None, "", []):
+                continue
+            if isinstance(value, list):
+                continue
+            sign_parts.append(f"{key}={value}")
+        sign_source = "&".join(sign_parts) + f"&accessSecret={self.access_secret}"
+        params["signature"] = hashlib.md5(sign_source.encode("utf-8")).hexdigest().upper()
+        return params
+
+    @staticmethod
+    def _response_payload(response: httpx.Response) -> dict:
+        try:
+            payload = response.json()
+        except ValueError as exc:
+            raise BoxIMError("BOXIM 返回了无效响应") from exc
+        if not isinstance(payload, dict):
+            raise BoxIMError("BOXIM 返回格式不正确")
+        return payload
+
+    async def exchange_access_token(self, huihui_token: str) -> dict:
+        """Exchange a production Huihui token for a BOXIM access token."""
+        if not huihui_token:
+            raise BoxIMError("缺少会会登录凭证", auth_error=True)
+        if not (self.app_id and self.access_id and self.access_secret):
+            raise BoxIMError("会会开放平台凭证未配置", auth_error=True)
+
+        headers = {
+            "Authorization": f"Bearer {huihui_token}",
+            "appId": self.app_id,
+            "windowAppId": self.app_id,
+        }
+        async with httpx.AsyncClient(timeout=self.timeout, follow_redirects=True) as client:
+            response = await client.post(
+                f"{self.platform_base_url}/im/box/netease",
+                headers=headers,
+                data=self._build_sign_params(),
+            )
+        payload = self._response_payload(response)
+        data = payload.get("data") or {}
+        code = payload.get("code")
+        if response.status_code >= 400 or code not in (0, 200, "0", "200"):
+            raise BoxIMError(
+                payload.get("message") or "BOXIM 授权失败",
+                code=code or response.status_code,
+                auth_error=response.status_code in (400, 401, 403)
+                or code in (
+                    400,
+                    401,
+                    40100,
+                    40101,
+                    403,
+                    "400",
+                    "401",
+                    "40100",
+                    "40101",
+                    "403",
+                ),
+            )
+        if not data.get("accessToken"):
+            raise BoxIMError("会会未返回 BOXIM 访问凭证", auth_error=True)
+        return data
+
+    async def _request(
+        self,
+        method: str,
+        path: str,
+        access_token: str,
+        *,
+        params: dict | None = None,
+        json: dict | None = None,
+    ) -> Any:
+        headers = {"accessToken": access_token}
+        async with httpx.AsyncClient(timeout=self.timeout) as client:
+            response = await client.request(
+                method,
+                f"{self.im_base_url}{path}",
+                headers=headers,
+                params=params,
+                json=json,
+            )
+        payload = self._response_payload(response)
+        code = payload.get("code")
+        if response.status_code >= 400 or code not in (200, "200"):
+            raise BoxIMError(
+                payload.get("message") or "BOXIM 请求失败",
+                code=code or response.status_code,
+                auth_error=response.status_code in (400, 401, 403)
+                or code in (400, 401, 40100, 40101, 403, "400", "401", "40100", "40101", "403"),
+            )
+        return payload.get("data")
+
+    async def get_self(self, access_token: str) -> dict:
+        data = await self._request("GET", "/user/self", access_token)
+        if not isinstance(data, dict) or data.get("id") is None:
+            raise BoxIMError("BOXIM 未返回当前用户信息")
+        return data
+
+    async def fetch_private_messages(self, access_token: str, min_id: str = "0") -> list[dict]:
+        data = await self._request(
+            "GET",
+            "/message/private/loadOfflineMessage",
+            access_token,
+            params={"minId": str(min_id or "0")},
+        )
+        if data is None:
+            return []
+        if not isinstance(data, list):
+            raise BoxIMError("BOXIM 私聊消息格式不正确")
+        return [item for item in data if isinstance(item, dict)]
+
+    async def mark_private_messages_read(
+        self,
+        access_token: str,
+        friend_id: int | str,
+        message_id: int | str,
+    ) -> None:
+        """Mark one private conversation read through its latest received message."""
+        friend_id_text = str(friend_id).strip()
+        message_id_text = str(message_id).strip()
+        if not friend_id_text.isdigit() or not message_id_text.isdigit():
+            raise BoxIMError("BOXIM 已读回执参数不正确")
+        await self._request(
+            "PUT",
+            "/message/private/readed",
+            access_token,
+            params={
+                "friendId": int(friend_id_text),
+                "messageId": int(message_id_text),
+            },
+        )
+
+    async def send_private_message(
+        self,
+        access_token: str,
+        peer_id: str,
+        content: str,
+        *,
+        local_id: int | str | None = None,
+    ) -> dict:
+        local_id = int(local_id or (int(time.time() * 1000) * 1000 + secrets.randbelow(1000)))
+        data = await self._request(
+            "POST",
+            "/message/private/send",
+            access_token,
+            json={
+                "localId": local_id,
+                "recvId": int(peer_id) if str(peer_id).isdigit() else peer_id,
+                "content": content,
+                "type": 0,
+                "receipt": False,
+                "atUserIds": [],
+            },
+        )
+        if not isinstance(data, dict):
+            raise BoxIMError("BOXIM 未返回发送结果")
+        return data
@@ -0,0 +1,151 @@
+"""Parse and safely download image payloads from BOXIM private messages."""
+
+import ipaddress
+import json
+import os
+import socket
+from dataclasses import dataclass
+from pathlib import PurePosixPath
+from urllib.parse import unquote, urljoin, urlsplit
+
+import httpx
+
+
+MAX_REDIRECTS = 3
+
+
+class BoxIMImageError(RuntimeError):
+    pass
+
+
+@dataclass(frozen=True)
+class DownloadedBoxIMImage:
+    content: bytes
+    filename: str
+    mime_type: str
+    source_url: str
+
+
+def parse_boxim_image_url(content: str, *, base_url: str = "") -> str:
+    try:
+        payload = json.loads(content or "")
+    except (TypeError, ValueError) as exc:
+        raise BoxIMImageError("BOXIM 图片消息格式无效") from exc
+    if not isinstance(payload, dict):
+        raise BoxIMImageError("BOXIM 图片消息格式无效")
+
+    value = payload.get("originUrl") or payload.get("thumbUrl") or payload.get("url")
+    if not isinstance(value, str) or not value.strip():
+        raise BoxIMImageError("BOXIM 图片消息缺少图片地址")
+    value = value.strip()
+    if value.startswith("/"):
+        if not base_url:
+            raise BoxIMImageError("BOXIM 图片地址不完整")
+        value = urljoin(f"{base_url.rstrip('/')}/", value)
+    return value
+
+
+def _configured_hosts(name: str) -> set[str]:
+    return {
+        value.strip().lower().rstrip(".")
+        for value in os.getenv(name, "").split(",")
+        if value.strip()
+    }
+
+
+def _host_matches(host: str, configured: set[str]) -> bool:
+    return any(host == value or host.endswith(f".{value}") for value in configured)
+
+
+def _resolved_addresses(host: str, port: int) -> set[ipaddress.IPv4Address | ipaddress.IPv6Address]:
+    try:
+        return {
+            ipaddress.ip_address(item[4][0])
+            for item in socket.getaddrinfo(host, port, type=socket.SOCK_STREAM)
+        }
+    except (OSError, ValueError) as exc:
+        raise BoxIMImageError("BOXIM 图片地址无法解析") from exc
+
+
+def _is_safe_remote_url(url: str) -> None:
+    parsed = urlsplit(url)
+    scheme = parsed.scheme.lower()
+    allow_http = os.getenv("BOXIM_IMAGE_ALLOW_HTTP", "").lower() in {"1", "true", "yes"}
+    if scheme not in ({"https", "http"} if allow_http else {"https"}):
+        raise BoxIMImageError("BOXIM 图片地址必须使用 HTTPS")
+    if parsed.username or parsed.password or not parsed.hostname:
+        raise BoxIMImageError("BOXIM 图片地址无效")
+
+    host = parsed.hostname.lower().rstrip(".")
+    allowed_hosts = _configured_hosts("BOXIM_IMAGE_ALLOWED_HOSTS")
+    if allowed_hosts and not _host_matches(host, allowed_hosts):
+        raise BoxIMImageError("BOXIM 图片地址不在允许的域名范围内")
+
+    private_hosts = _configured_hosts("BOXIM_IMAGE_PRIVATE_HOSTS")
+    try:
+        addresses = {ipaddress.ip_address(host)}
+    except ValueError:
+        addresses = _resolved_addresses(host, parsed.port or (443 if scheme == "https" else 80))
+    if not addresses:
+        raise BoxIMImageError("BOXIM 图片地址无法解析")
+    if _host_matches(host, private_hosts):
+        return
+    if any(not address.is_global for address in addresses):
+        raise BoxIMImageError("BOXIM 图片地址指向受限网络")
+
+
+def _filename_from_url(url: str) -> str:
+    value = unquote(PurePosixPath(urlsplit(url).path).name).strip()
+    value = value.replace("\x00", "")
+    return (value or "boxim-image")[:255]
+
+
+def download_boxim_image(
+    content: str,
+    *,
+    base_url: str = "",
+    transport: httpx.BaseTransport | None = None,
+) -> DownloadedBoxIMImage:
+    """Download one BOXIM image without redirects or oversized responses escaping checks."""
+    url = parse_boxim_image_url(content, base_url=base_url)
+    max_bytes = max(1024, int(os.getenv("CHAT_IMAGE_MAX_BYTES", str(8 * 1024 * 1024))))
+    timeout = max(1.0, min(float(os.getenv("BOXIM_IMAGE_TIMEOUT_SECONDS", "15")), 60.0))
+
+    with httpx.Client(
+        timeout=timeout,
+        follow_redirects=False,
+        trust_env=False,
+        transport=transport,
+    ) as client:
+        for _ in range(MAX_REDIRECTS + 1):
+            _is_safe_remote_url(url)
+            try:
+                with client.stream("GET", url, headers={"Accept": "image/*"}) as response:
+                    if response.status_code in {301, 302, 303, 307, 308}:
+                        location = response.headers.get("location", "").strip()
+                        if not location:
+                            raise BoxIMImageError("BOXIM 图片跳转地址无效")
+                        url = urljoin(url, location)
+                        continue
+                    response.raise_for_status()
+                    raw_length = response.headers.get("content-length", "")
+                    if raw_length.isdigit() and int(raw_length) > max_bytes:
+                        raise BoxIMImageError("BOXIM 图片超过大小限制")
+                    chunks = bytearray()
+                    for chunk in response.iter_bytes():
+                        chunks.extend(chunk)
+                        if len(chunks) > max_bytes:
+                            raise BoxIMImageError("BOXIM 图片超过大小限制")
+                    if not chunks:
+                        raise BoxIMImageError("BOXIM 图片内容为空")
+                    return DownloadedBoxIMImage(
+                        content=bytes(chunks),
+                        filename=_filename_from_url(url),
+                        mime_type=response.headers.get("content-type", "").split(";", 1)[0][:100],
+                        source_url=url,
+                    )
+            except BoxIMImageError:
+                raise
+            except (httpx.HTTPError, OSError) as exc:
+                raise BoxIMImageError("BOXIM 图片下载失败") from exc
+    raise BoxIMImageError("BOXIM 图片跳转次数过多")
@@ -0,0 +1,20 @@
+from datetime import datetime
+
+from sqlalchemy.orm import Session
+
+from models import ChatAttachment
+
+
+def purge_expired_chat_attachments(
+    db: Session,
+    *,
+    now: datetime | None = None,
+) -> int:
+    """Remove expired derived image data; raw image bytes are never persisted."""
+    count = db.query(ChatAttachment).filter(
+        ChatAttachment.expires_at < (now or datetime.utcnow())
+    ).delete(synchronize_session=False)
+    if count:
+        db.commit()
+        db.expire_all()
+    return count
@@ -0,0 +1,115 @@
+import logging
+import os
+import threading
+import time
+from dataclasses import dataclass
+
+import httpx
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class ChatModelConfig:
+    api_base_url: str
+    api_key: str
+    model: str
+    max_tokens: int
+    timeout_seconds: float
+    vision_model: str
+    ocr_model: str
+    vision_max_tokens: int
+    vision_timeout_seconds: float
+    source: str
+
+
+_cache_lock = threading.Lock()
+_cached_config: ChatModelConfig | None = None
+_cache_expires_at = 0.0
+
+
+def _environment_config() -> ChatModelConfig:
+    return ChatModelConfig(
+        api_base_url=os.getenv(
+            "CHAT_API_URL", "https://dashscope.aliyuncs.com/compatible-mode/v1"
+        ).rstrip("/"),
+        api_key=os.getenv("CHAT_API_KEY", ""),
+        model=os.getenv("CHAT_MODEL", "qwen-plus"),
+        max_tokens=max(128, int(os.getenv("CHAT_MAX_OUTPUT_TOKENS", "1024"))),
+        timeout_seconds=max(5.0, float(os.getenv("CHAT_TIMEOUT_SECONDS", "30"))),
+        vision_model=os.getenv("VISION_MODEL", "qwen3.6-flash"),
+        ocr_model=os.getenv("VISION_OCR_MODEL", "qwen-vl-ocr"),
+        vision_max_tokens=max(256, int(os.getenv("VISION_MAX_OUTPUT_TOKENS", "2048"))),
+        vision_timeout_seconds=max(10.0, float(os.getenv("VISION_TIMEOUT_SECONDS", "90"))),
+        source="environment",
+    )
+
+
+def _fetch_runtime_config() -> ChatModelConfig | None:
+    url = os.getenv("CHAT_MODEL_CONFIG_URL", "").strip()
+    token = os.getenv("AVATAR_MODEL_CONFIG_TOKEN", "").strip()
+    if not url or not token:
+        return None
+    response = httpx.get(
+        url,
+        headers={"X-Avatar-Config-Token": token},
+        timeout=max(2.0, float(os.getenv("CHAT_MODEL_CONFIG_TIMEOUT_SECONDS", "5"))),
+    )
+    response.raise_for_status()
+    payload = response.json().get("data") or {}
+    api_base_url = str(payload.get("api_base_url") or "").rstrip("/")
+    api_key = str(payload.get("api_key") or "")
+    model = str(payload.get("model") or "")
+    if not api_base_url or not api_key or not model:
+        raise ValueError("数字分身专用模型配置不完整")
+    return ChatModelConfig(
+        api_base_url=api_base_url,
+        api_key=api_key,
+        model=model,
+        max_tokens=max(128, int(payload.get("max_tokens") or 1024)),
+        timeout_seconds=max(5.0, float(payload.get("timeout_seconds") or 30)),
+        vision_model=str(
+            payload.get("vision_model")
+            or os.getenv("VISION_MODEL", "qwen3.6-flash")
+        ),
+        ocr_model=str(
+            payload.get("ocr_model")
+            or os.getenv("VISION_OCR_MODEL", "qwen-vl-ocr")
+        ),
+        vision_max_tokens=max(
+            256, int(os.getenv("VISION_MAX_OUTPUT_TOKENS", "2048"))
+        ),
+        vision_timeout_seconds=max(
+            10.0, float(os.getenv("VISION_TIMEOUT_SECONDS", "90"))
+        ),
+        source="admin",
+    )
+
+
+def get_chat_model_config(*, force_refresh: bool = False) -> ChatModelConfig:
+    global _cached_config, _cache_expires_at
+
+    now = time.monotonic()
+    if not force_refresh and _cached_config is not None and now < _cache_expires_at:
+        return _cached_config
+
+    with _cache_lock:
+        now = time.monotonic()
+        if not force_refresh and _cached_config is not None and now < _cache_expires_at:
+            return _cached_config
+        try:
+            config = _fetch_runtime_config() or _environment_config()
+        except (httpx.HTTPError, ValueError, TypeError) as exc:
+            logger.warning("读取数字分身专用模型配置失败，暂时使用环境变量配置: %s", exc)
+            config = _environment_config()
+        _cached_config = config
+        ttl = max(5, int(os.getenv("CHAT_MODEL_CONFIG_CACHE_SECONDS", "60")))
+        _cache_expires_at = now + ttl
+        return config
+
+
+def clear_chat_model_config_cache() -> None:
+    global _cached_config, _cache_expires_at
+    with _cache_lock:
+        _cached_config = None
+        _cache_expires_at = 0.0
@@ -0,0 +1,124 @@
+"""Signed client for Huihui's production payment-v3 service."""
+
+import hashlib
+import random
+import string
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+import httpx
+
+
+_CN_TZ = timezone(timedelta(hours=8))
+
+
+class HuihuiPaymentError(RuntimeError):
+    pass
+
+
+class HuihuiPaymentClient:
+    def __init__(self, config: dict):
+        self.base_url = config.get(
+            "HUIHUI_PAYMENT_BASE_URL", "https://open.99hui.com/api/payment-v3"
+        ).rstrip("/")
+        self.app_id = config.get("HUIHUI_APP_ID", "")
+        self.access_id = config.get("HUIHUI_ACCESS_ID", "")
+        self.access_secret = config.get("HUIHUI_ACCESS_SECRET", "")
+        self.timeout = float(config.get("HUIHUI_PAYMENT_TIMEOUT_SECONDS", 30))
+
+    @property
+    def configured(self) -> bool:
+        return bool(self.base_url and self.app_id and self.access_id and self.access_secret)
+
+    def _signed_params(self, user_id: str) -> dict:
+        params = {
+            "appId": self.app_id,
+            "accessId": self.access_id,
+            "nonce": "".join(random.choices(string.ascii_lowercase + string.digits, k=12)),
+            "timestamp": datetime.now(_CN_TZ).strftime("%Y%m%d%H%M%S"),
+            "signType": "MD5",
+            "signVersion": "1.0",
+            "userId": user_id,
+        }
+        source = "&".join(
+            f"{key}={params[key]}"
+            for key in sorted(params)
+            if params[key] not in (None, "", [])
+        )
+        source += f"&accessSecret={self.access_secret}"
+        params["signature"] = hashlib.md5(source.encode("utf-8")).hexdigest().upper()
+        return params
+
+    @staticmethod
+    def _json(response: httpx.Response) -> dict:
+        try:
+            payload = response.json()
+        except ValueError as exc:
+            raise HuihuiPaymentError("会会支付返回了无效响应") from exc
+        if not isinstance(payload, dict):
+            raise HuihuiPaymentError("会会支付返回格式不正确")
+        return payload
+
+    def create_payment(
+        self,
+        *,
+        huihui_token: str,
+        huihui_user_id: str,
+        real_name: str,
+        order_no: str,
+        amount: str,
+        points_amount: int,
+        pay_type: str,
+        pay_way: str,
+        callback_url: str,
+    ) -> dict[str, Any]:
+        if not self.configured:
+            raise HuihuiPaymentError("会会支付服务未配置")
+        if not huihui_token or not huihui_user_id:
+            raise HuihuiPaymentError("当前会会登录凭证无法发起支付")
+
+        now = datetime.now(_CN_TZ)
+        body = {
+            "appId": self.app_id,
+            "callbackUrl": callback_url,
+            "chargeType": 4,
+            "currency": "cny",
+            "description": f"充值 {points_amount} 积分",
+            "expend": {},
+            "masterOrderAmt": amount,
+            "masterOrderNo": order_no,
+            "memberId": huihui_user_id,
+            "orderDesc": "数字分身积分充值",
+            "orderTime": now.isoformat(),
+            "orderTitle": "数字分身积分充值",
+            "payAmt": float(amount),
+            "payType": pay_type,
+            "payWay": pay_way,
+            "realName": real_name or "会会用户",
+            "timeExpire": (now + timedelta(hours=2)).strftime("%Y%m%d%H%M%S"),
+        }
+        headers = {
+            "Authorization": f"Bearer {huihui_token}",
+            "appId": self.app_id,
+            "windowAppId": self.app_id,
+        }
+        try:
+            response = httpx.post(
+                f"{self.base_url}/payment/pay",
+                headers=headers,
+                params=self._signed_params(huihui_user_id),
+                json=body,
+                timeout=self.timeout,
+                follow_redirects=True,
+            )
+        except httpx.HTTPError as exc:
+            raise HuihuiPaymentError("会会支付连接失败，请稍后重试") from exc
+
+        payload = self._json(response)
+        code = payload.get("code")
+        if response.status_code >= 400 or code not in (0, 200, "0", "200"):
+            raise HuihuiPaymentError(payload.get("message") or "会会支付下单失败")
+        data = payload.get("data") or {}
+        if not isinstance(data, dict):
+            raise HuihuiPaymentError("会会支付未返回订单信息")
+        return data
@@ -0,0 +1,203 @@
+"""User-scoped token accounting for every avatar model request."""
+
+import math
+from dataclasses import dataclass
+from datetime import datetime, timedelta
+
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.orm import Session
+
+from models import Avatar, TokenAccount, TokenUsage, User
+
+DEFAULT_TOKEN_GRANT = 1_000_000
+
+
+class InsufficientTokensError(RuntimeError):
+    pass
+
+
+@dataclass(frozen=True)
+class TokenReservation:
+    usage_id: str
+    user_id: str
+    reserved_tokens: int
+
+
+def get_or_create_account(db: Session, user_id: str) -> TokenAccount:
+    account = db.query(TokenAccount).filter(TokenAccount.user_id == user_id).first()
+    if account:
+        return account
+    account = TokenAccount(
+        user_id=user_id,
+        balance=DEFAULT_TOKEN_GRANT,
+        total_granted=DEFAULT_TOKEN_GRANT,
+        total_consumed=0,
+    )
+    db.add(account)
+    try:
+        db.commit()
+    except IntegrityError:
+        # A concurrent first request may have created the same user account.
+        db.rollback()
+        account = db.query(TokenAccount).filter(TokenAccount.user_id == user_id).first()
+        if account is None:
+            raise
+    db.refresh(account)
+    return account
+
+
+def avatar_owner_user(db: Session, avatar: Avatar) -> User | None:
+    owner_id = (avatar.owner_id or "").strip()
+    if not owner_id:
+        return None
+    return db.query(User).filter(User.huihui_user_id == owner_id).first()
+
+
+def estimate_request_tokens(messages: list[dict], max_output_tokens: int) -> int:
+    # UTF-8 bytes / 2 deliberately overestimates mixed Chinese/English prompts;
+    # the unused reservation is returned after provider usage is received.
+    content_bytes = sum(
+        len(str(item.get("content", "")).encode("utf-8"))
+        for item in messages
+    )
+    prompt_reserve = max(1, math.ceil(content_bytes / 2) + len(messages) * 6)
+    return prompt_reserve + max(1, int(max_output_tokens))
+
+
+def estimate_fallback_usage(messages: list[dict], output: str) -> int:
+    content_bytes = sum(
+        len(str(item.get("content", "")).encode("utf-8"))
+        for item in messages
+    ) + len((output or "").encode("utf-8"))
+    return max(1, math.ceil(content_bytes / 3) + len(messages) * 4)
+
+
+def reserve_avatar_tokens(
+    db: Session,
+    avatar: Avatar,
+    source: str,
+    model: str,
+    messages: list[dict],
+    max_output_tokens: int,
+    *,
+    minimum_reserve_tokens: int = 0,
+) -> TokenReservation:
+    user = avatar_owner_user(db, avatar)
+    if not user:
+        raise InsufficientTokensError("分身尚未关联有效用户，暂时无法使用积分")
+    account = get_or_create_account(db, user.id)
+    reserved = max(
+        estimate_request_tokens(messages, max_output_tokens),
+        max(0, int(minimum_reserve_tokens or 0)),
+    )
+    updated = (
+        db.query(TokenAccount)
+        .filter(TokenAccount.id == account.id, TokenAccount.balance >= reserved)
+        .update(
+            {TokenAccount.balance: TokenAccount.balance - reserved},
+            synchronize_session=False,
+        )
+    )
+    if updated != 1:
+        db.rollback()
+        raise InsufficientTokensError("积分余额不足，请充值后继续")
+    db.refresh(account)
+    usage = TokenUsage(
+        user_id=user.id,
+        avatar_id=avatar.id,
+        source=source,
+        model=model,
+        status="reserved",
+        reserved_tokens=reserved,
+    )
+    db.add(usage)
+    db.flush()
+    usage.balance_after = account.balance
+    db.commit()
+    return TokenReservation(usage.id, user.id, reserved)
+
+
+def settle_reservation(
+    db: Session,
+    reservation: TokenReservation,
+    usage: dict | None,
+    *,
+    fallback_total: int,
+) -> dict:
+    record = db.query(TokenUsage).filter(TokenUsage.id == reservation.usage_id).first()
+    if not record or record.status != "reserved":
+        return {}
+    provider_usage = usage or {}
+    prompt_tokens = max(0, int(provider_usage.get("prompt_tokens") or 0))
+    completion_tokens = max(0, int(provider_usage.get("completion_tokens") or 0))
+    provider_total = max(
+        int(provider_usage.get("total_tokens") or 0),
+        prompt_tokens + completion_tokens,
+    )
+    total_tokens = max(1, provider_total or int(fallback_total or 0))
+    updated = (
+        db.query(TokenAccount)
+        .filter(TokenAccount.user_id == reservation.user_id)
+        .update(
+            {
+                TokenAccount.balance: TokenAccount.balance + reservation.reserved_tokens - total_tokens,
+                TokenAccount.total_consumed: TokenAccount.total_consumed + total_tokens,
+            },
+            synchronize_session=False,
+        )
+    )
+    if updated != 1:
+        raise RuntimeError("积分账户不存在")
+    db.expire_all()
+    account = db.query(TokenAccount).filter(TokenAccount.user_id == reservation.user_id).first()
+    record.prompt_tokens = prompt_tokens
+    record.completion_tokens = completion_tokens
+    record.total_tokens = total_tokens
+    record.balance_after = account.balance
+    record.status = "completed"
+    record.settled_at = datetime.utcnow()
+    db.commit()
+    return {
+        "promptTokens": prompt_tokens,
+        "completionTokens": completion_tokens,
+        "totalTokens": total_tokens,
+        "balance": account.balance,
+    }
+
+
+def release_reservation(db: Session, reservation: TokenReservation, reason: str = "") -> None:
+    record = db.query(TokenUsage).filter(TokenUsage.id == reservation.usage_id).first()
+    if not record or record.status != "reserved":
+        return
+    updated = (
+        db.query(TokenAccount)
+        .filter(TokenAccount.user_id == reservation.user_id)
+        .update(
+            {TokenAccount.balance: TokenAccount.balance + reservation.reserved_tokens},
+            synchronize_session=False,
+        )
+    )
+    if updated:
+        db.expire_all()
+        account = db.query(TokenAccount).filter(TokenAccount.user_id == reservation.user_id).first()
+        record = db.query(TokenUsage).filter(TokenUsage.id == reservation.usage_id).first()
+        record.balance_after = account.balance
+    record.status = "failed"
+    record.failure_reason = (reason or "model_request_failed")[:255]
+    record.settled_at = datetime.utcnow()
+    db.commit()
+
+
+def release_stale_reservations(db: Session, older_than_minutes: int = 10) -> int:
+    cutoff = datetime.utcnow() - timedelta(minutes=older_than_minutes)
+    stale = db.query(TokenUsage).filter(
+        TokenUsage.status == "reserved",
+        TokenUsage.created_at < cutoff,
+    ).all()
+    for record in stale:
+        release_reservation(
+            db,
+            TokenReservation(record.id, record.user_id, int(record.reserved_tokens or 0)),
+            "stale_reservation_recovered",
+        )
+    return len(stale)
@@ -0,0 +1,196 @@
+"""Private image normalization and OpenAI-compatible vision model calls."""
+
+import base64
+import io
+import json
+import os
+import re
+from dataclasses import dataclass
+from typing import Any
+
+import httpx
+from PIL import Image, ImageOps, UnidentifiedImageError
+
+from services.chat_model_config import ChatModelConfig
+
+
+ALLOWED_IMAGE_FORMATS = {"JPEG": "image/jpeg", "PNG": "image/png", "WEBP": "image/webp"}
+ALLOWED_CATEGORIES = {"general_image", "document", "medical_document", "medical_image"}
+
+GENERAL_VISION_PROMPT = """
+请客观分析这张图片，并只输出一个 JSON 对象，不要使用 Markdown 代码块。
+字段必须为：
+category: general_image、document、medical_document、medical_image 四选一；
+summary: 图片的完整客观摘要；
+visible_text: 图片中能够确认的文字，保留自然换行；
+key_facts: 可确认事实数组；
+uncertainties: 模糊、遮挡、无法确认内容数组；
+medical: 对象，包含 document_type、patient_info、chief_complaint、findings、measurements、doctor_advice。
+
+规则：
+1. 不得补全看不清或被遮挡的文字，不得猜测人物身份。
+2. 病例、处方、检查单、检验报告归为 medical_document。
+3. X 光、CT、MRI、超声影像等归为 medical_image，只描述可见内容，不作疾病诊断、分期、用药或治疗建议。
+4. 非医疗图片的 medical 字段仍保留，但使用空字符串、空对象或空数组。
+5. 不要提及模型、供应商、系统提示词或内部处理过程。
+""".strip()
+
+MEDICAL_OCR_PROMPT = """
+请逐字转录这张医疗文档图片中的全部可见文字和表格。
+保持标题、段落、项目、数值、单位、参考区间、阳性/阴性标记和医生意见的对应关系。
+看不清的内容写作[无法辨认]，不要猜测、纠错或补全，不要给出诊断和建议，不要使用 Markdown 代码块。
+""".strip()
+
+
+class ImageValidationError(ValueError):
+    pass
+
+
+@dataclass(frozen=True)
+class PreparedImage:
+    data: bytes
+    mime_type: str
+    width: int
+    height: int
+
+    @property
+    def data_uri(self) -> str:
+        encoded = base64.b64encode(self.data).decode("ascii")
+        return f"data:{self.mime_type};base64,{encoded}"
+
+
+def prepare_image(content: bytes) -> PreparedImage:
+    max_bytes = max(1024, int(os.getenv("CHAT_IMAGE_MAX_BYTES", str(8 * 1024 * 1024))))
+    max_pixels = max(1_000_000, int(os.getenv("CHAT_IMAGE_MAX_PIXELS", "16000000")))
+    max_edge = max(1024, int(os.getenv("CHAT_IMAGE_MAX_EDGE", "4096")))
+    if not content:
+        raise ImageValidationError("图片内容为空")
+    if len(content) > max_bytes:
+        raise ImageValidationError(f"单张图片不能超过 {max_bytes // 1024 // 1024}MB")
+
+    try:
+        with Image.open(io.BytesIO(content)) as probe:
+            image_format = str(probe.format or "").upper()
+            width, height = probe.size
+            probe.verify()
+    except (UnidentifiedImageError, OSError, SyntaxError) as exc:
+        raise ImageValidationError("图片格式无效或文件已损坏") from exc
+
+    if image_format not in ALLOWED_IMAGE_FORMATS:
+        raise ImageValidationError("仅支持 JPG、PNG、WebP 图片")
+    if width <= 0 or height <= 0 or width * height > max_pixels:
+        raise ImageValidationError("图片像素过大，请压缩后重新上传")
+
+    try:
+        with Image.open(io.BytesIO(content)) as original:
+            image = ImageOps.exif_transpose(original)
+            image.load()
+            if max(image.size) > max_edge:
+                image.thumbnail((max_edge, max_edge), Image.Resampling.LANCZOS)
+            if image.mode in {"RGBA", "LA"}:
+                canvas = Image.new("RGB", image.size, "white")
+                alpha = image.getchannel("A")
+                canvas.paste(image.convert("RGB"), mask=alpha)
+                image = canvas
+            elif image.mode != "RGB":
+                image = image.convert("RGB")
+            output = io.BytesIO()
+            image.save(output, format="JPEG", quality=92, optimize=True)
+            normalized = output.getvalue()
+            normalized_width, normalized_height = image.size
+    except (OSError, ValueError) as exc:
+        raise ImageValidationError("图片解码失败，请重新选择图片") from exc
+
+    return PreparedImage(
+        data=normalized,
+        mime_type="image/jpeg",
+        width=normalized_width,
+        height=normalized_height,
+    )
+
+
+def call_vision_model(
+    prepared: PreparedImage,
+    model_config: ChatModelConfig,
+    *,
+    model: str,
+    prompt: str,
+    json_output: bool,
+) -> dict:
+    if not model_config.api_key:
+        raise RuntimeError("视觉模型服务未配置")
+    payload: dict[str, Any] = {
+        "model": model,
+        "messages": [
+            {
+                "role": "user",
+                "content": [
+                    {"type": "image_url", "image_url": {"url": prepared.data_uri}},
+                    {"type": "text", "text": prompt},
+                ],
+            }
+        ],
+        "temperature": 0,
+        "max_tokens": model_config.vision_max_tokens,
+    }
+    if json_output:
+        payload["response_format"] = {"type": "json_object"}
+    try:
+        response = httpx.post(
+            f"{model_config.api_base_url}/chat/completions",
+            headers={"Authorization": f"Bearer {model_config.api_key}"},
+            json=payload,
+            timeout=model_config.vision_timeout_seconds,
+        )
+        response.raise_for_status()
+        data = response.json()
+        content = data.get("choices", [{}])[0].get("message", {}).get("content", "")
+    except (httpx.HTTPError, ValueError, KeyError, IndexError) as exc:
+        raise RuntimeError("图片识别服务暂时不可用") from exc
+    if not isinstance(content, str) or not content.strip():
+        raise RuntimeError("图片识别服务没有返回有效结果")
+    return {"content": content.strip(), "usage": data.get("usage") or {}}
+
+
+def parse_vision_analysis(content: str) -> dict:
+    value = (content or "").strip()
+    fenced = re.match(r"^```(?:json)?\s*(.*?)\s*```$", value, re.DOTALL | re.IGNORECASE)
+    if fenced:
+        value = fenced.group(1).strip()
+    try:
+        payload = json.loads(value)
+    except (TypeError, ValueError) as exc:
+        raise RuntimeError("图片识别结果格式无效") from exc
+    if not isinstance(payload, dict):
+        raise RuntimeError("图片识别结果格式无效")
+
+    category = str(payload.get("category") or "general_image").strip().lower()
+    if category not in ALLOWED_CATEGORIES:
+        category = "general_image"
+    medical = payload.get("medical") if isinstance(payload.get("medical"), dict) else {}
+    return {
+        "category": category,
+        "summary": str(payload.get("summary") or "").strip(),
+        "visible_text": str(payload.get("visible_text") or "").strip(),
+        "key_facts": _string_list(payload.get("key_facts")),
+        "uncertainties": _string_list(payload.get("uncertainties")),
+        "medical": medical,
+    }
+
+
+def build_attachment_warning(analysis: dict, *, ocr_failed: bool = False) -> str:
+    warnings = list(analysis.get("uncertainties") or [])
+    category = analysis.get("category")
+    if ocr_failed:
+        warnings.append("精确文字识别暂时不可用，请人工核对图片原文")
+    if category == "medical_document":
+        warnings.append("病例识别结果仅供辅助，不能替代医生诊断，请核对原始文档")
+    elif category == "medical_image":
+        warnings.append("医学影像仅作客观描述，不能替代影像报告和医生诊断")
+    return "；".join(dict.fromkeys(item for item in warnings if item))
+
+
+def _string_list(value: Any) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    return [str(item).strip() for item in value if str(item).strip()]
@@ -0,0 +1,131 @@
+import uuid
+
+import pytest
+from database import init_db, SessionLocal
+from models import (
+    Authorization,
+    Avatar,
+    ChatAttachment,
+    TakeoverCursor,
+    TakeoverMessage,
+    TakeoverReplyTask,
+    TokenAccount,
+    TokenPaymentOrder,
+    TokenUsage,
+    User,
+)
+
+
+@pytest.fixture(scope="session", autouse=True)
+def setup_database():
+    """Initialize DB tables and seed an Authorization row."""
+    init_db()
+    db = SessionLocal()
+    try:
+        existing = db.query(Authorization).first()
+        if existing is None:
+            auth = Authorization(
+                id="test-auth-1",
+                avatar_id="test-avatar-1",
+                target_type="user",
+                target_id="test-user-1",
+                target_name="Test User",
+                permissions=["read", "write"],
+                status="active",
+            )
+            db.add(auth)
+            db.commit()
+    finally:
+        db.close()
+
+
+@pytest.fixture
+def authorization_context():
+    """Create isolated users, avatars, and one authorization for API tests."""
+    suffix = uuid.uuid4().hex
+    owner = User(
+        id=f"owner-{suffix}",
+        huihui_user_id=f"huihui-owner-{suffix}",
+        nickname="授权测试用户",
+        app_token=f"owner-token-{suffix}",
+    )
+    other = User(
+        id=f"other-{suffix}",
+        huihui_user_id=f"huihui-other-{suffix}",
+        nickname="其他用户",
+        app_token=f"other-token-{suffix}",
+    )
+    avatar = Avatar(
+        id=f"avatar-{suffix}",
+        owner_id=owner.huihui_user_id,
+        name="授权测试分身",
+        status="active",
+        config={},
+    )
+    other_avatar = Avatar(
+        id=f"other-avatar-{suffix}",
+        owner_id=other.huihui_user_id,
+        name="其他分身",
+        status="active",
+        config={},
+    )
+    authorization = Authorization(
+        id=f"authorization-{suffix}",
+        avatar_id=avatar.id,
+        target_type="user",
+        target_id=f"contact-{suffix}",
+        target_name="测试联系人",
+        permissions=["chat", "browse"],
+        status="active",
+    )
+
+    db = SessionLocal()
+    try:
+        db.add_all([owner, other, avatar, other_avatar, authorization])
+        db.commit()
+        yield {
+            "owner": owner,
+            "other": other,
+            "avatar": avatar,
+            "other_avatar": other_avatar,
+            "authorization": authorization,
+            "owner_headers": {"Authorization": f"Bearer {owner.app_token}"},
+            "other_headers": {"Authorization": f"Bearer {other.app_token}"},
+            "suffix": suffix,
+        }
+    finally:
+        db.rollback()
+        avatar_ids = [avatar.id, other_avatar.id]
+        db.query(ChatAttachment).filter(
+            ChatAttachment.avatar_id.in_(avatar_ids)
+        ).delete(synchronize_session=False)
+        db.query(TakeoverReplyTask).filter(
+            TakeoverReplyTask.avatar_id.in_(avatar_ids)
+        ).delete(synchronize_session=False)
+        db.query(TakeoverMessage).filter(
+            TakeoverMessage.avatar_id.in_(avatar_ids)
+        ).delete(synchronize_session=False)
+        db.query(TakeoverCursor).filter(
+            TakeoverCursor.avatar_id.in_(avatar_ids)
+        ).delete(synchronize_session=False)
+        db.query(Authorization).filter(
+            Authorization.avatar_id.in_(avatar_ids)
+        ).delete(synchronize_session=False)
+        db.query(Avatar).filter(Avatar.id.in_(avatar_ids)).delete(
+            synchronize_session=False
+        )
+        user_ids = [owner.id, other.id]
+        db.query(TokenPaymentOrder).filter(TokenPaymentOrder.user_id.in_(user_ids)).delete(
+            synchronize_session=False
+        )
+        db.query(TokenUsage).filter(TokenUsage.user_id.in_(user_ids)).delete(
+            synchronize_session=False
+        )
+        db.query(TokenAccount).filter(TokenAccount.user_id.in_(user_ids)).delete(
+            synchronize_session=False
+        )
+        db.query(User).filter(User.id.in_([owner.id, other.id])).delete(
+            synchronize_session=False
+        )
+        db.commit()
+        db.close()
@@ -0,0 +1,214 @@
+from fastapi.testclient import TestClient
+
+from main import app
+
+
+client = TestClient(app)
+
+
+def test_authorization_list_is_scoped_to_owned_avatar(authorization_context):
+    context = authorization_context
+    response = client.get(
+        f"/api/avatar/{context['avatar'].id}/authorizations",
+        headers=context["owner_headers"],
+    )
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["code"] == 200
+    assert [item["id"] for item in payload["data"]] == [context["authorization"].id]
+
+    forbidden = client.get(
+        f"/api/avatar/{context['other_avatar'].id}/authorizations",
+        headers=context["owner_headers"],
+    )
+    assert forbidden.status_code == 403
+
+
+def test_create_update_and_delete_authorization(authorization_context):
+    context = authorization_context
+    avatar_id = context["avatar"].id
+    target_id = f"new-contact-{context['suffix']}"
+    created = client.post(
+        f"/api/avatar/{avatar_id}/authorizations",
+        headers=context["owner_headers"],
+        json={
+            "targetType": "user",
+            "targetId": target_id,
+            "targetName": "新联系人",
+            "permissions": ["friend", "chat", "browse"],
+        },
+    ).json()
+    assert created["code"] == 200
+    authorization_id = created["data"]["id"]
+    assert created["data"]["permissions"] == ["friend", "chat", "browse"]
+
+    duplicate = client.post(
+        f"/api/avatar/{avatar_id}/authorizations",
+        headers=context["owner_headers"],
+        json={
+            "targetType": "user",
+            "targetId": target_id,
+            "targetName": "重复联系人",
+            "permissions": ["chat"],
+        },
+    ).json()
+    assert duplicate["code"] == 409
+
+    updated = client.put(
+        f"/api/avatar/{avatar_id}/authorizations",
+        headers=context["owner_headers"],
+        json={
+            "id": authorization_id,
+            "targetName": "联系人新名称",
+            "permissions": ["interact", "publish"],
+        },
+    ).json()
+    assert updated["code"] == 200
+    assert updated["data"]["targetName"] == "联系人新名称"
+    assert updated["data"]["permissions"] == ["publish", "interact"]
+
+    deleted = client.delete(
+        f"/api/avatar/{avatar_id}/authorizations/{authorization_id}",
+        headers=context["owner_headers"],
+    ).json()
+    assert deleted["code"] == 200
+    assert deleted["data"]["id"] == authorization_id
+
+
+def test_authorization_requires_login_and_rejects_unknown_permissions(authorization_context):
+    context = authorization_context
+    avatar_id = context["avatar"].id
+    no_session = client.get(f"/api/avatar/{avatar_id}/authorizations")
+    assert no_session.status_code == 401
+
+    invalid = client.post(
+        f"/api/avatar/{avatar_id}/authorizations",
+        headers=context["owner_headers"],
+        json={
+            "targetType": "user",
+            "targetId": "invalid-target",
+            "targetName": "无效权限",
+            "permissions": ["admin"],
+        },
+    ).json()
+    assert invalid["code"] == 400
+
+
+def test_avatar_permission_settings_default_and_persist(authorization_context):
+    context = authorization_context
+    endpoint = f"/api/avatar/{context['avatar'].id}/permission-settings"
+
+    initial = client.get(endpoint, headers=context["owner_headers"]).json()
+    assert initial["code"] == 200
+    assert initial["data"] == {
+        "avatarId": context["avatar"].id,
+        "permissions": ["friend", "chat"],
+        "takeoverReplyDelaySeconds": 180,
+    }
+
+    updated = client.put(
+        endpoint,
+        headers=context["owner_headers"],
+        json={"permissions": ["interact", "takeover", "publish", "friend", "friend"]},
+    ).json()
+    assert updated["code"] == 200
+    assert updated["data"]["permissions"] == ["friend", "publish", "interact", "takeover"]
+
+    reloaded = client.get(endpoint, headers=context["owner_headers"]).json()
+    assert reloaded["data"]["permissions"] == ["friend", "publish", "interact", "takeover"]
+    assert reloaded["data"]["takeoverReplyDelaySeconds"] == 180
+
+
+def test_avatar_permission_settings_allow_all_disabled(authorization_context):
+    context = authorization_context
+    endpoint = f"/api/avatar/{context['avatar'].id}/permission-settings"
+
+    response = client.put(
+        endpoint,
+        headers=context["owner_headers"],
+        json={"permissions": []},
+    ).json()
+    assert response["code"] == 200
+    assert response["data"]["permissions"] == []
+
+
+def test_avatar_permission_settings_validate_owner_and_permissions(authorization_context):
+    context = authorization_context
+    endpoint = f"/api/avatar/{context['avatar'].id}/permission-settings"
+
+    invalid = client.put(
+        endpoint,
+        headers=context["owner_headers"],
+        json={"permissions": ["admin"]},
+    ).json()
+    assert invalid["code"] == 400
+
+    missing = client.put(
+        endpoint,
+        headers=context["owner_headers"],
+        json={},
+    ).json()
+    assert missing["code"] == 400
+
+    forbidden = client.get(
+        f"/api/avatar/{context['other_avatar'].id}/permission-settings",
+        headers=context["owner_headers"],
+    )
+    assert forbidden.status_code == 403
+
+    unauthenticated = client.get(endpoint)
+    assert unauthenticated.status_code == 401
+
+
+def test_takeover_delay_minimum_and_single_active_avatar_per_owner(authorization_context):
+    from database import SessionLocal
+    from models import Avatar
+
+    context = authorization_context
+    endpoint = f"/api/avatar/{context['avatar'].id}/permission-settings"
+    invalid = client.put(
+        endpoint,
+        headers=context["owner_headers"],
+        json={"permissions": ["chat"], "takeoverReplyDelaySeconds": 2},
+    ).json()
+    assert invalid["code"] == 400
+
+    second_avatar_id = f"second-{context['suffix']}"
+    db = SessionLocal()
+    try:
+        db.add(
+            Avatar(
+                id=second_avatar_id,
+                owner_id=context["owner"].huihui_user_id,
+                name="第二个分身",
+                status="active",
+                config={"authorizationPermissions": ["chat", "takeover"]},
+            )
+        )
+        db.commit()
+    finally:
+        db.close()
+
+    try:
+        updated = client.put(
+            endpoint,
+            headers=context["owner_headers"],
+            json={"permissions": ["chat", "takeover"], "takeoverReplyDelaySeconds": 3},
+        ).json()
+        assert updated["code"] == 200
+        assert updated["data"]["takeoverReplyDelaySeconds"] == 3
+        assert updated["data"]["disabledAvatarIds"] == [second_avatar_id]
+
+        db = SessionLocal()
+        try:
+            second = db.query(Avatar).filter(Avatar.id == second_avatar_id).one()
+            assert "takeover" not in second.config["authorizationPermissions"]
+        finally:
+            db.close()
+    finally:
+        db = SessionLocal()
+        try:
+            db.query(Avatar).filter(Avatar.id == second_avatar_id).delete()
+            db.commit()
+        finally:
+            db.close()
@@ -0,0 +1,93 @@
+"""Ownership and configuration-isolation tests for digital avatars."""
+
+from fastapi.testclient import TestClient
+
+from database import SessionLocal
+from main import app
+from models import Avatar
+
+
+client = TestClient(app)
+
+
+def test_avatar_detail_and_update_require_the_owner(authorization_context):
+    context = authorization_context
+    avatar_id = context["avatar"].id
+
+    assert client.get(f"/api/avatar/{avatar_id}").status_code == 401
+    assert client.get(
+        f"/api/avatar/{avatar_id}", headers=context["other_headers"]
+    ).status_code == 403
+
+    updated = client.put(
+        f"/api/avatar/{avatar_id}",
+        headers=context["owner_headers"],
+        json={
+            "description": "独立描述",
+            "config": {"replyStyle": "concise"},
+        },
+    )
+    assert updated.status_code == 200
+    assert updated.json()["data"]["description"] == "独立描述"
+
+    forbidden = client.put(
+        f"/api/avatar/{avatar_id}",
+        headers=context["other_headers"],
+        json={"description": "越权修改"},
+    )
+    assert forbidden.status_code == 403
+
+
+def test_avatar_config_updates_do_not_erase_takeover_or_knowledge_scope(authorization_context):
+    context = authorization_context
+    avatar_id = context["avatar"].id
+    db = SessionLocal()
+    try:
+        avatar = db.query(Avatar).filter(Avatar.id == avatar_id).one()
+        avatar.config = {
+            "authorizationPermissions": ["chat", "takeover"],
+            "takeoverReplyDelaySeconds": 180,
+        }
+        db.commit()
+    finally:
+        db.close()
+
+    response = client.put(
+        f"/api/avatar/{avatar_id}",
+        headers=context["owner_headers"],
+        json={"config": {"replyStyle": "warm", "creativity": 25}},
+    ).json()
+    config = response["data"]["config"]
+    assert config["replyStyle"] == "warm"
+    assert config["creativity"] == 25
+    assert config["authorizationPermissions"] == ["chat", "takeover"]
+    assert config["takeoverReplyDelaySeconds"] == 180
+
+
+def test_avatar_create_and_delete_require_login_and_ownership(authorization_context):
+    context = authorization_context
+    assert client.post("/api/avatar", json={"name": "匿名分身"}).status_code == 401
+
+    created = client.post(
+        "/api/avatar",
+        headers=context["owner_headers"],
+        json={"name": "待删除分身"},
+    )
+    assert created.status_code == 200
+    avatar_id = created.json()["data"]["id"]
+
+    try:
+        assert client.delete(
+            f"/api/avatar/{avatar_id}", headers=context["other_headers"]
+        ).status_code == 403
+        deleted = client.delete(
+            f"/api/avatar/{avatar_id}", headers=context["owner_headers"]
+        ).json()
+        assert deleted["code"] == 200
+    finally:
+        db = SessionLocal()
+        try:
+            db.query(Avatar).filter(Avatar.id == avatar_id).delete()
+            db.commit()
+        finally:
+            db.close()
@@ -0,0 +1,130 @@
+"""Contract tests for the self-hosted BOXIM client."""
+
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+from services.boxim_client import BoxIMClient, BoxIMError
+
+
+@pytest.fixture
+def config():
+    return {
+        "HUIHUI_PLATFORM_BASE_URL": "https://open.example/api",
+        "BOXIM_API_BASE_URL": "https://im.example/api",
+        "HUIHUI_APP_ID": "test_app",
+        "HUIHUI_ACCESS_ID": "test_access",
+        "HUIHUI_ACCESS_SECRET": "test_secret",
+    }
+
+
+def _response(payload: dict, status_code: int = 200):
+    response = MagicMock()
+    response.status_code = status_code
+    response.json.return_value = payload
+    return response
+
+
+def _client_patch(*, post_payload=None, request_payload=None, status_code=200):
+    client = AsyncMock()
+    if post_payload is not None:
+        client.post.return_value = _response(post_payload, status_code)
+    if request_payload is not None:
+        client.request.return_value = _response(request_payload, status_code)
+    context = AsyncMock()
+    context.__aenter__.return_value = client
+    context.__aexit__.return_value = None
+    return patch("services.boxim_client.httpx.AsyncClient", return_value=context), client
+
+
+@pytest.mark.asyncio
+async def test_exchange_access_token_uses_huihui_bearer_and_signed_form(config):
+    mocked, client = _client_patch(
+        post_payload={"code": 0, "data": {"accessToken": "box-token", "accessTokenExpiresIn": 3600}}
+    )
+    with mocked:
+        result = await BoxIMClient(config).exchange_access_token("huihui-token")
+
+    assert result["accessToken"] == "box-token"
+    call = client.post.await_args
+    assert call.args[0] == "https://open.example/api/im/box/netease"
+    assert call.kwargs["headers"]["Authorization"] == "Bearer huihui-token"
+    assert call.kwargs["data"]["appId"] == "test_app"
+    assert len(call.kwargs["data"]["signature"]) == 32
+
+
+@pytest.mark.asyncio
+async def test_get_self_and_incremental_private_messages_use_boxim_header(config):
+    client_instance = BoxIMClient(config)
+    mocked, client = _client_patch(
+        request_payload={"code": 200, "data": {"id": 42, "nickName": "Owner"}}
+    )
+    with mocked:
+        profile = await client_instance.get_self("box-token")
+    assert profile["id"] == 42
+    assert client.request.await_args.kwargs["headers"] == {"accessToken": "box-token"}
+
+    mocked, client = _client_patch(
+        request_payload={"code": 200, "data": [{"id": 101, "sendId": 7, "recvId": 42}]}
+    )
+    with mocked:
+        messages = await client_instance.fetch_private_messages("box-token", "100")
+    assert messages[0]["id"] == 101
+    assert client.request.await_args.kwargs["params"] == {"minId": "100"}
+
+
+@pytest.mark.asyncio
+async def test_send_private_message_matches_boxim_payload(config):
+    mocked, client = _client_patch(
+        request_payload={"code": 200, "data": {"id": 88, "localId": 12345}}
+    )
+    with mocked:
+        result = await BoxIMClient(config).send_private_message(
+            "box-token", "77", "你好", local_id="12345"
+        )
+
+    assert result["id"] == 88
+    call = client.request.await_args
+    assert call.args[:2] == ("POST", "https://im.example/api/message/private/send")
+    assert call.kwargs["json"] == {
+        "localId": 12345,
+        "recvId": 77,
+        "content": "你好",
+        "type": 0,
+        "receipt": False,
+        "atUserIds": [],
+    }
+
+
+@pytest.mark.asyncio
+async def test_mark_private_messages_read_uses_latest_message_id(config):
+    mocked, client = _client_patch(request_payload={"code": 200, "data": None})
+    with mocked:
+        await BoxIMClient(config).mark_private_messages_read("box-token", "77", "101")
+
+    call = client.request.await_args
+    assert call.args[:2] == ("PUT", "https://im.example/api/message/private/readed")
+    assert call.kwargs["headers"] == {"accessToken": "box-token"}
+    assert call.kwargs["params"] == {"friendId": 77, "messageId": 101}
+
+
+@pytest.mark.asyncio
+async def test_boxim_auth_error_is_explicit(config):
+    mocked, _ = _client_patch(
+        request_payload={"code": 400, "message": "未登录"}, status_code=200
+    )
+    with mocked, pytest.raises(BoxIMError) as exc_info:
+        await BoxIMClient(config).get_self("expired")
+    assert exc_info.value.auth_error is True
+
+
+def test_sign_params_include_production_required_fields(config):
+    params = BoxIMClient(config)._build_sign_params()
+    assert params["appId"] == "test_app"
+    assert params["accessId"] == "test_access"
+    assert params["signType"] == "MD5"
+    assert params["signVersion"] == "1.0"
+    assert len(params["nonce"]) == 12
+    assert len(params["timestamp"]) == 14
+    assert len(params["signature"]) == 32
+    assert "accessSecret" not in params
@@ -0,0 +1,71 @@
+import ipaddress
+import json
+
+import httpx
+import pytest
+
+from services.boxim_image_service import (
+    BoxIMImageError,
+    download_boxim_image,
+    parse_boxim_image_url,
+)
+
+
+def test_parse_boxim_image_prefers_origin_and_supports_relative_url():
+    content = json.dumps({"originUrl": "/files/original.png", "thumbUrl": "/thumb.png"})
+    assert parse_boxim_image_url(content, base_url="https://im.example/api") == (
+        "https://im.example/files/original.png"
+    )
+
+
+def test_download_boxim_image_streams_public_https(monkeypatch):
+    monkeypatch.setattr(
+        "services.boxim_image_service._resolved_addresses",
+        lambda _host, _port: {ipaddress.ip_address("8.8.8.8")},
+    )
+    transport = httpx.MockTransport(
+        lambda request: httpx.Response(
+            200,
+            headers={"content-type": "image/png"},
+            content=b"png-bytes",
+            request=request,
+        )
+    )
+
+    image = download_boxim_image(
+        json.dumps({"originUrl": "https://cdn.example/case%20photo.png"}),
+        transport=transport,
+    )
+
+    assert image.content == b"png-bytes"
+    assert image.filename == "case photo.png"
+    assert image.mime_type == "image/png"
+
+
+def test_download_boxim_image_rejects_private_network_url():
+    with pytest.raises(BoxIMImageError, match="受限网络"):
+        download_boxim_image(
+            json.dumps({"originUrl": "https://127.0.0.1/private.png"}),
+            transport=httpx.MockTransport(lambda request: httpx.Response(200, request=request)),
+        )
+
+
+def test_download_boxim_image_stops_oversized_stream(monkeypatch):
+    monkeypatch.setenv("CHAT_IMAGE_MAX_BYTES", "1024")
+    monkeypatch.setattr(
+        "services.boxim_image_service._resolved_addresses",
+        lambda _host, _port: {ipaddress.ip_address("8.8.8.8")},
+    )
+    transport = httpx.MockTransport(
+        lambda request: httpx.Response(
+            200,
+            headers={"content-length": "2048"},
+            request=request,
+        )
+    )
+
+    with pytest.raises(BoxIMImageError, match="超过大小限制"):
+        download_boxim_image(
+            json.dumps({"originUrl": "https://cdn.example/large.png"}),
+            transport=transport,
+        )
@@ -0,0 +1,332 @@
+import json
+from datetime import datetime, timedelta
+from types import SimpleNamespace
+from unittest.mock import Mock, patch
+
+import pytest
+from fastapi import HTTPException
+from fastapi.testclient import TestClient
+
+from database import SessionLocal
+from main import app
+from models import ChatAttachment
+from routers.chat import (
+    ChatIn,
+    _answer_denies_available_image,
+    _attachment_contexts,
+    _load_chat_attachments,
+    _resolve_reply,
+)
+from services.chat_attachment_service import purge_expired_chat_attachments
+from services.token_billing import InsufficientTokensError
+from services.vision_service import PreparedImage
+
+
+client = TestClient(app)
+
+
+GENERAL_RESULT = {
+    "content": json.dumps({
+        "category": "general_image",
+        "summary": "一张包含产品路线图的截图",
+        "visible_text": "产品路线图",
+        "key_facts": ["包含三个阶段"],
+        "uncertainties": [],
+        "medical": {},
+    }, ensure_ascii=False),
+    "usage": {"total_tokens": 120},
+}
+
+
+def test_owner_can_upload_and_cache_image_analysis(authorization_context):
+    context = authorization_context
+    prepared = PreparedImage(b"jpeg", "image/jpeg", 100, 80)
+    with (
+        patch("routers.chat.prepare_image", return_value=prepared),
+        patch("routers.chat._run_billed_vision_call", return_value=GENERAL_RESULT),
+    ):
+        response = client.post(
+            f"/api/avatar/{context['avatar'].id}/chat/images",
+            headers=context["owner_headers"],
+            files={"file": ("roadmap.png", b"image-bytes", "image/png")},
+        )
+
+    assert response.status_code == 200
+    payload = response.json()["data"]
+    assert payload["status"] == "ready"
+    assert payload["category"] == "general_image"
+    assert payload["summary"] == "一张包含产品路线图的截图"
+    db = SessionLocal()
+    try:
+        stored = db.query(ChatAttachment).filter(ChatAttachment.id == payload["id"]).one()
+        assert stored.avatar_id == context["avatar"].id
+        assert stored.extracted_text == "产品路线图"
+        assert stored.structured_data["key_facts"] == ["包含三个阶段"]
+    finally:
+        db.close()
+
+
+def test_non_owner_cannot_upload_chat_image(authorization_context):
+    context = authorization_context
+    response = client.post(
+        f"/api/avatar/{context['avatar'].id}/chat/images",
+        headers=context["other_headers"],
+        files={"file": ("private.png", b"image-bytes", "image/png")},
+    )
+
+    assert response.status_code == 403
+
+
+def test_image_upload_preserves_insufficient_points_response(authorization_context):
+    context = authorization_context
+    with patch(
+        "routers.chat._analyze_image_bytes",
+        side_effect=InsufficientTokensError("积分余额不足"),
+    ):
+        response = client.post(
+            f"/api/avatar/{context['avatar'].id}/chat/images",
+            headers=context["owner_headers"],
+            files={"file": ("private.png", b"image-bytes", "image/png")},
+        )
+
+    assert response.status_code == 402
+    assert response.json()["detail"] == "积分余额不足"
+
+
+def test_public_share_can_upload_without_exposing_analysis_details(authorization_context):
+    context = authorization_context
+    db = SessionLocal()
+    try:
+        avatar = db.get(type(context["avatar"]), context["avatar"].id)
+        avatar.share_token = f"share-{context['suffix']}"
+        db.commit()
+        share_token = avatar.share_token
+    finally:
+        db.close()
+
+    with (
+        patch(
+            "routers.chat.prepare_image",
+            return_value=PreparedImage(b"jpeg", "image/jpeg", 100, 80),
+        ),
+        patch("routers.chat._run_billed_vision_call", return_value=GENERAL_RESULT),
+    ):
+        response = client.post(
+            f"/api/public/avatar/{share_token}/chat/images",
+            files={"file": ("visitor.png", b"image-bytes", "image/png")},
+        )
+
+    assert response.status_code == 200
+    payload = response.json()["data"]
+    assert payload["status"] == "ready"
+    assert "structuredData" not in payload
+    assert "extractedText" not in payload
+    assert "visionModel" not in payload
+    assert "ocrModel" not in payload
+
+    db = SessionLocal()
+    try:
+        stored = db.get(ChatAttachment, payload["id"])
+        assert stored.uploader_kind == "public"
+        assert stored.avatar_id == context["avatar"].id
+    finally:
+        db.close()
+
+
+def test_medical_document_uses_ocr_result(authorization_context):
+    context = authorization_context
+    general = {
+        "content": json.dumps({
+            "category": "medical_document",
+            "summary": "血常规报告",
+            "visible_text": "初步文字",
+            "key_facts": [],
+            "uncertainties": [],
+            "medical": {"document_type": "检验报告"},
+        }, ensure_ascii=False),
+        "usage": {},
+    }
+    ocr = {"content": "白细胞 11.2 x10^9/L", "usage": {}}
+    with (
+        patch("routers.chat.prepare_image", return_value=PreparedImage(b"jpeg", "image/jpeg", 100, 80)),
+        patch("routers.chat._run_billed_vision_call", side_effect=[general, ocr]) as model,
+    ):
+        response = client.post(
+            f"/api/avatar/{context['avatar'].id}/chat/images",
+            headers=context["owner_headers"],
+            files={"file": ("report.jpg", b"image-bytes", "image/jpeg")},
+        )
+
+    assert response.status_code == 200
+    attachment_id = response.json()["data"]["id"]
+    assert model.call_count == 2
+    assert model.call_args_list[1].kwargs["source"] == "vision_medical_ocr"
+    db = SessionLocal()
+    try:
+        stored = db.query(ChatAttachment).filter(ChatAttachment.id == attachment_id).one()
+        assert stored.extracted_text == "白细胞 11.2 x10^9/L"
+        assert stored.ocr_model == "qwen-vl-ocr"
+        assert "不能替代医生诊断" in stored.warning
+    finally:
+        db.close()
+
+
+def test_attachment_cannot_cross_avatar_boundary(authorization_context):
+    context = authorization_context
+    db = SessionLocal()
+    try:
+        attachment = ChatAttachment(
+            avatar_id=context["avatar"].id,
+            filename="private.jpg",
+            status="ready",
+            expires_at=datetime.utcnow() + timedelta(hours=1),
+        )
+        db.add(attachment)
+        db.commit()
+        body = ChatIn(message="看看图片", attachmentIds=[attachment.id])
+        with pytest.raises(HTTPException, match="不属于当前分身") as caught:
+            _load_chat_attachments(db, context["other_avatar"].id, body)
+        assert caught.value.status_code == 400
+    finally:
+        db.close()
+
+
+def test_expired_attachment_is_removed(authorization_context):
+    context = authorization_context
+    db = SessionLocal()
+    try:
+        attachment = ChatAttachment(
+            avatar_id=context["avatar"].id,
+            filename="expired.jpg",
+            status="ready",
+            expires_at=datetime.utcnow() - timedelta(seconds=1),
+        )
+        db.add(attachment)
+        db.commit()
+        attachment_id = attachment.id
+        body = ChatIn(message="看看图片", attachmentIds=[attachment_id])
+        with pytest.raises(HTTPException):
+            _load_chat_attachments(db, context["avatar"].id, body)
+        assert db.query(ChatAttachment).filter(ChatAttachment.id == attachment_id).first() is None
+    finally:
+        db.close()
+
+
+def test_cleanup_keeps_unexpired_attachment(authorization_context):
+    context = authorization_context
+    now = datetime.utcnow()
+    db = SessionLocal()
+    try:
+        expired = ChatAttachment(
+            avatar_id=context["avatar"].id,
+            filename="expired.jpg",
+            status="ready",
+            expires_at=now - timedelta(seconds=1),
+        )
+        active = ChatAttachment(
+            avatar_id=context["avatar"].id,
+            filename="active.jpg",
+            status="ready",
+            expires_at=now + timedelta(hours=1),
+        )
+        db.add_all([expired, active])
+        db.commit()
+        expired_id, active_id = expired.id, active.id
+
+        assert purge_expired_chat_attachments(db, now=now) == 1
+        assert db.get(ChatAttachment, expired_id) is None
+        assert db.get(ChatAttachment, active_id) is not None
+    finally:
+        db.close()
+
+
+def test_image_context_keeps_standard_answer_authoritative():
+    avatar = SimpleNamespace(
+        id="avatar-vision",
+        name="测试分身",
+        description="产品顾问",
+        config={},
+    )
+    model = Mock(return_value="标准退款期限是七天；图片显示的是商品包装。")
+    result = _resolve_reply(
+        None,
+        avatar,
+        "退款期限是多少？",
+        [],
+        qa_pairs=[SimpleNamespace(question="退款期限是多少？", answer="七天", enabled=True)],
+        search_fn=Mock(return_value=[]),
+        model_client=model,
+        image_contexts=[{
+            "id": "attachment",
+            "filename": "product.jpg",
+            "category": "general_image",
+            "summary": "商品包装",
+            "extractedText": "",
+            "structuredData": {},
+            "warning": "",
+        }],
+    )
+
+    assert result["source"] == "qa"
+    system = model.call_args.kwargs["messages"][0]["content"]
+    assert "已确认标准答案" in system
+    assert "七天" in system
+    assert "商品包装" in system
+    assert "标准答题对中的事实优先级高于图片资料" in system
+
+
+def test_ready_image_context_never_returns_whole_image_access_denial():
+    avatar = SimpleNamespace(
+        id="avatar-vision",
+        name="测试分身",
+        description="产品顾问",
+        config={},
+    )
+    model = Mock(return_value="抱歉，我无法查看或识别图片，请重新上传。")
+    result = _resolve_reply(
+        None,
+        avatar,
+        "请看看这张图片",
+        [],
+        qa_pairs=[],
+        search_fn=Mock(return_value=[]),
+        model_client=model,
+        image_contexts=[{
+            "id": "attachment",
+            "filename": "report.jpg",
+            "category": "medical_document",
+            "summary": "一份耳鼻喉科门诊记录",
+            "extractedText": "主诉：咽痛三天",
+            "structuredData": {"key_facts": ["主诉为咽痛三天"]},
+            "warning": "请核对原始资料",
+        }],
+    )
+
+    assert result["source"] == "vision"
+    assert "一份耳鼻喉科门诊记录" in result["answer"]
+    assert "主诉为咽痛三天" in result["answer"]
+    assert "无法查看" not in result["answer"]
+    system = model.call_args.kwargs["messages"][0]["content"]
+    assert "当前会话图片已经成功读取" in system
+    assert "禁止声称无法查看" in system
+
+
+def test_image_denial_detector_allows_uncertain_field_in_ready_image():
+    assert _answer_denies_available_image("我无法查看这张图片") is True
+    assert _answer_denies_available_image("图片中患者姓名无法辨认，主诉为咽痛三天。") is False
+
+
+def test_attachment_context_does_not_expose_internal_fields():
+    row = SimpleNamespace(
+        id="attachment",
+        filename="case.jpg",
+        category="medical_document",
+        summary="门诊病例",
+        extracted_text="主诉：咳嗽",
+        structured_data={"medical": {"chief_complaint": "咳嗽"}},
+        warning="请核对原文",
+    )
+    context = _attachment_contexts([row])[0]
+    assert context["filename"] == "case.jpg"
+    assert "avatar_id" not in context
+    assert "vision_model" not in context
@@ -0,0 +1,87 @@
+from unittest.mock import Mock, patch
+
+import httpx
+
+from services.chat_model_config import (
+    clear_chat_model_config_cache,
+    get_chat_model_config,
+)
+
+
+def setup_function():
+    clear_chat_model_config_cache()
+
+
+def teardown_function():
+    clear_chat_model_config_cache()
+
+
+def test_admin_runtime_config_takes_priority(monkeypatch):
+    monkeypatch.setenv("CHAT_MODEL_CONFIG_URL", "http://config.test/runtime")
+    monkeypatch.setenv("AVATAR_MODEL_CONFIG_TOKEN", "shared-secret")
+    response = Mock()
+    response.raise_for_status.return_value = None
+    response.json.return_value = {
+        "data": {
+            "api_base_url": "https://model.test/v1/",
+            "api_key": "runtime-key",
+            "model": "avatar-model",
+            "vision_model": "avatar-vision-model",
+            "ocr_model": "avatar-ocr-model",
+            "max_tokens": 2048,
+            "timeout_seconds": 42,
+        }
+    }
+
+    with patch("services.chat_model_config.httpx.get", return_value=response) as request:
+        config = get_chat_model_config()
+
+    assert config.source == "admin"
+    assert config.api_base_url == "https://model.test/v1"
+    assert config.model == "avatar-model"
+    assert config.vision_model == "avatar-vision-model"
+    assert config.ocr_model == "avatar-ocr-model"
+    assert config.max_tokens == 2048
+    request.assert_called_once_with(
+        "http://config.test/runtime",
+        headers={"X-Avatar-Config-Token": "shared-secret"},
+        timeout=5.0,
+    )
+
+
+def test_runtime_failure_falls_back_to_environment(monkeypatch):
+    monkeypatch.setenv("CHAT_MODEL_CONFIG_URL", "http://config.test/runtime")
+    monkeypatch.setenv("AVATAR_MODEL_CONFIG_TOKEN", "shared-secret")
+    monkeypatch.setenv("CHAT_API_URL", "https://fallback.test/v1/")
+    monkeypatch.setenv("CHAT_API_KEY", "fallback-key")
+    monkeypatch.setenv("CHAT_MODEL", "fallback-model")
+    monkeypatch.setenv("VISION_MODEL", "fallback-vision")
+    monkeypatch.setenv("VISION_OCR_MODEL", "fallback-ocr")
+    monkeypatch.setenv("CHAT_MAX_OUTPUT_TOKENS", "1536")
+
+    request = httpx.Request("GET", "http://config.test/runtime")
+    with patch(
+        "services.chat_model_config.httpx.get",
+        side_effect=httpx.ConnectError("offline", request=request),
+    ):
+        config = get_chat_model_config()
+
+    assert config.source == "environment"
+    assert config.api_base_url == "https://fallback.test/v1"
+    assert config.api_key == "fallback-key"
+    assert config.model == "fallback-model"
+    assert config.vision_model == "fallback-vision"
+    assert config.ocr_model == "fallback-ocr"
+    assert config.max_tokens == 1536
+
+
+def test_runtime_config_is_cached(monkeypatch):
+    monkeypatch.setenv("CHAT_MODEL_CONFIG_URL", "")
+    monkeypatch.setenv("CHAT_MODEL", "first-model")
+    first = get_chat_model_config()
+    monkeypatch.setenv("CHAT_MODEL", "second-model")
+
+    second = get_chat_model_config()
+
+    assert first is second
+    assert second.model == "first-model"
@@ -5,7 +5,15 @@ from unittest.mock import Mock
 from fastapi import HTTPException

 from models import Avatar, User
-from routers.chat import _build_prompt, _iter_text_chunks, _match_standard_qa, _public_avatar_payload, _require_owned_avatar, _resolve_reply
+from routers.chat import (
+    _build_prompt,
+    _iter_text_chunks,
+    _match_standard_qa,
+    _public_avatar_payload,
+    _qa_requires_language_adaptation,
+    _require_owned_avatar,
+    _resolve_reply,
+)


 class ChatOrchestrationTests(unittest.TestCase):
@@ -50,6 +58,34 @@ class ChatOrchestrationTests(unittest.TestCase):
        self.assertEqual(result["answer"], "标准地址")
        fake_model.assert_not_called()

+    def test_cross_language_qa_is_faithfully_adapted_by_model(self):
+        fake_model = Mock(return_value="Our address is Test Road 1.")
+        fake_search = Mock(return_value=[])
+        result = _resolve_reply(
+            None,
+            self.avatar,
+            "Where is your office?",
+            [],
+            qa_pairs=[SimpleNamespace(question="Where is your office?", answer="地址是测试路1号。", enabled=True)],
+            search_fn=fake_search,
+            model_client=fake_model,
+        )
+
+        self.assertEqual(result["source"], "qa")
+        self.assertEqual(result["answer"], "Our address is Test Road 1.")
+        self.assertEqual(fake_model.call_args.kwargs["temperature"], 0.0)
+        system = fake_model.call_args.kwargs["messages"][0]["content"]
+        self.assertIn("已确认标准答案", system)
+        self.assertIn("地址是测试路1号", system)
+        self.assertIn("只使用该语言回答", system)
+        fake_search.assert_not_called()
+
+    def test_qa_language_adaptation_detects_common_writing_system_changes(self):
+        self.assertTrue(_qa_requires_language_adaptation("Hello", "你好"))
+        self.assertTrue(_qa_requires_language_adaptation("こんにちは", "你好"))
+        self.assertTrue(_qa_requires_language_adaptation("안녕하세요", "你好"))
+        self.assertFalse(_qa_requires_language_adaptation("你好", "您好"))
+
    def test_conversational_paraphrase_matches_standard_qa(self):
        for question in ("请问一下，你们公司在哪里呀？", "请问去你们那边怎么走"):
            with self.subTest(question=question):
@@ -106,6 +142,9 @@ class ChatOrchestrationTests(unittest.TestCase):
        self.assertIn("像熟人之间微信聊天一样", messages[0]["content"])
        self.assertIn("不隶属于任何机构", messages[0]["content"])
        self.assertIn("不要连续输出空行", messages[0]["content"])
+        self.assertIn("回答语言规则", messages[0]["content"])
+        self.assertIn("当前最后一条用户消息", messages[0]["content"])
+        self.assertIn("历史消息", messages[0]["content"])

    def test_prompt_blocks_ungrounded_factual_answers(self):
        messages = _build_prompt(self.avatar, [], "聊聊国际新闻", [])
@@ -113,6 +152,8 @@ class ChatOrchestrationTests(unittest.TestCase):
        self.assertIn("没有检索到可靠资料", system)
        self.assertIn("不要凭通用知识", system)
        self.assertIn("不要提及知识库", system)
+        self.assertIn("不得推断服务对象", system)
+        self.assertIn("工作场所", system)

    def test_public_avatar_payload_excludes_internal_configuration(self):
        payload = _public_avatar_payload(self.avatar)
@@ -121,6 +162,12 @@ class ChatOrchestrationTests(unittest.TestCase):
        self.assertNotIn("config", payload)
        self.assertNotIn("ownerId", payload)

+    def test_unshared_avatars_do_not_reuse_a_unique_share_token(self):
+        first = Avatar(name="first")
+        second = Avatar(name="second")
+        self.assertIsNone(first.share_token)
+        self.assertIsNone(second.share_token)
+
    def test_standard_answer_can_be_emitted_as_sse_chunks(self):
        self.assertEqual(list(_iter_text_chunks("标准答案内容", size=2)), ["标准", "答案", "内容"])

@@ -1,10 +1,26 @@
+import json
 import os
 import tempfile
 import unittest
+from unittest.mock import patch

 import embeddings


+class FakeResponse:
+    def __init__(self, payload):
+        self.payload = payload
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *_):
+        return None
+
+    def read(self):
+        return json.dumps(self.payload).encode("utf-8")
+
+
 class TextExtractionTests(unittest.TestCase):
    def write_text(self, suffix, content):
        handle = tempfile.NamedTemporaryFile(suffix=suffix, delete=False)
@@ -28,5 +44,45 @@ class TextExtractionTests(unittest.TestCase):
            embeddings.extract_text(path, ".csv")


+class RemoteEmbeddingTests(unittest.TestCase):
+    def test_large_input_is_split_into_provider_safe_batches(self):
+        texts = [f"chunk-{index}" for index in range(14)]
+        batch_sizes = []
+        requested_urls = []
+
+        def fake_urlopen(request, timeout):
+            self.assertEqual(timeout, 30)
+            requested_urls.append(request.full_url)
+            payload = json.loads(request.data.decode("utf-8"))
+            batch_sizes.append(len(payload["input"]))
+            return FakeResponse({
+                "data": [
+                    {"index": index, "embedding": [float(text.split("-")[1])]}
+                    for index, text in enumerate(payload["input"])
+                ]
+            })
+
+        with patch.dict(os.environ, {
+            "EMBEDDING_API_URL": "https://embedding.example/v1",
+            "EMBEDDING_API_KEY": "test-key",
+            "EMBEDDING_MODEL": "text-embedding-v4",
+            "EMBEDDING_BATCH_SIZE": "10",
+        }), patch("embeddings.urllib.request.urlopen", side_effect=fake_urlopen):
+            result = embeddings.embed(texts)
+
+        self.assertEqual(batch_sizes, [10, 4])
+        self.assertEqual(requested_urls, [
+            "https://embedding.example/v1/embeddings",
+            "https://embedding.example/v1/embeddings",
+        ])
+        self.assertEqual(result, [[float(index)] for index in range(14)])
+
+    def test_full_embedding_endpoint_is_not_modified(self):
+        self.assertEqual(
+            embeddings._embedding_endpoint("https://embedding.example/v1/embeddings/"),
+            "https://embedding.example/v1/embeddings",
+        )
+
+
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,191 @@
+"""Tests for preserving local avatar ownership when Huihui IDs change."""
+
+from datetime import datetime
+from unittest.mock import AsyncMock, patch
+
+import pytest
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+from sqlalchemy.pool import StaticPool
+
+from database import Base
+from models import Avatar, TakeoverCursor, TakeoverMessage, TakeoverReplyTask, User
+from routers.huihui_auth import _issue_session, token_login
+from services.boxim_client import BoxIMError
+
+
+@pytest.fixture
+def db():
+    engine = create_engine(
+        "sqlite://",
+        connect_args={"check_same_thread": False},
+        poolclass=StaticPool,
+    )
+    Base.metadata.create_all(engine)
+    session = sessionmaker(bind=engine, autoflush=False, expire_on_commit=False)()
+    try:
+        yield session
+    finally:
+        session.close()
+
+
+def _add_avatar_data(db, owner_id: str, suffix: str = "1") -> Avatar:
+    avatar = Avatar(id=f"avatar-{suffix}", owner_id=owner_id, name="冯医生")
+    db.add_all(
+        [
+            avatar,
+            TakeoverCursor(id=f"cursor-{suffix}", avatar_id=avatar.id, owner_id=owner_id),
+            TakeoverMessage(
+                id=f"message-{suffix}",
+                avatar_id=avatar.id,
+                owner_id=owner_id,
+                boxim_message_id=f"box-{suffix}",
+                peer_id="peer",
+                direction="incoming",
+                send_time=datetime(2026, 8, 20, 12, 0, 0),
+            ),
+            TakeoverReplyTask(
+                id=f"task-{suffix}",
+                avatar_id=avatar.id,
+                owner_id=owner_id,
+                peer_id="peer",
+                trigger_message_id=f"trigger-{suffix}",
+                scheduled_at=datetime(2026, 8, 20, 12, 0, 3),
+                boxim_local_id=f"local-{suffix}",
+            ),
+        ]
+    )
+    db.commit()
+    return avatar
+
+
+def _assert_avatar_data_owner(db, avatar_id: str, owner_id: str):
+    assert db.query(Avatar).filter_by(id=avatar_id).one().owner_id == owner_id
+    assert db.query(TakeoverCursor).filter_by(avatar_id=avatar_id).one().owner_id == owner_id
+    assert db.query(TakeoverMessage).filter_by(avatar_id=avatar_id).one().owner_id == owner_id
+    assert db.query(TakeoverReplyTask).filter_by(avatar_id=avatar_id).one().owner_id == owner_id
+
+
+def test_unique_phone_user_is_reused_when_huihui_id_changes(db):
+    legacy = User(
+        id="legacy-local",
+        huihui_user_id="fat-user-id",
+        phone="18500000000",
+        app_token="old-session",
+    )
+    db.add(legacy)
+    db.commit()
+    avatar = _add_avatar_data(db, legacy.huihui_user_id)
+
+    response = _issue_session(
+        db,
+        "18500000000",
+        {"userId": "prod-user-id", "nickname": "用户", "token": "prod-token"},
+    )
+
+    users = db.query(User).all()
+    assert len(users) == 1
+    assert users[0].id == "legacy-local"
+    assert users[0].huihui_user_id == "prod-user-id"
+    assert response["data"]["token"] == users[0].app_token
+    _assert_avatar_data_owner(db, avatar.id, "prod-user-id")
+
+
+def test_existing_production_user_claims_one_legacy_phone_account(db):
+    current = User(
+        id="prod-local",
+        huihui_user_id="prod-user-id",
+        phone="18500000000",
+    )
+    legacy = User(
+        id="legacy-local",
+        huihui_user_id="fat-user-id",
+        phone="18500000000",
+        app_token="old-session",
+        huihui_token="fat-token",
+    )
+    db.add_all([current, legacy])
+    db.commit()
+    avatar = _add_avatar_data(db, legacy.huihui_user_id)
+
+    _issue_session(
+        db,
+        "18500000000",
+        {"userId": "prod-user-id", "nickname": "用户", "token": "prod-token"},
+    )
+
+    db.refresh(legacy)
+    assert legacy.app_token == ""
+    assert legacy.huihui_token == ""
+    _assert_avatar_data_owner(db, avatar.id, "prod-user-id")
+
+
+def test_ambiguous_phone_matches_do_not_move_existing_avatars(db):
+    first = User(id="first", huihui_user_id="fat-1", phone="18500000000")
+    second = User(id="second", huihui_user_id="fat-2", phone="18500000000")
+    db.add_all([first, second])
+    db.commit()
+    first_avatar = _add_avatar_data(db, first.huihui_user_id, "1")
+    second_avatar = _add_avatar_data(db, second.huihui_user_id, "2")
+
+    _issue_session(
+        db,
+        "18500000000",
+        {"userId": "prod-user-id", "nickname": "用户", "token": "prod-token"},
+    )
+
+    assert db.query(User).count() == 3
+    _assert_avatar_data_owner(db, first_avatar.id, "fat-1")
+    _assert_avatar_data_owner(db, second_avatar.id, "fat-2")
+
+
+@pytest.mark.asyncio
+async def test_token_login_uses_huihui_user_id_and_keeps_upstream_token_server_side(db):
+    existing = User(
+        id="existing-local",
+        huihui_user_id="huihui-user-88",
+        app_token="existing-app-session",
+    )
+    db.add(existing)
+    db.commit()
+
+    client = AsyncMock()
+    client.exchange_access_token.return_value = {"accessToken": "boxim-token"}
+    client.get_self.return_value = {
+        "id": 998877,
+        "huihuiUserId": "huihui-user-88",
+        "nickName": "会会用户",
+        "headImage": "https://cdn.example/avatar.jpg",
+    }
+    with patch("routers.huihui_auth._cfg_ready", return_value=True), patch(
+        "routers.huihui_auth._create_boxim_client", return_value=client
+    ):
+        response = await token_login({"token": "production-huihui-token"}, db)
+
+    assert response["code"] == 200
+    assert response["data"]["token"] == "existing-app-session"
+    assert "token" not in response["data"]["huihui"]
+    user = db.query(User).one()
+    assert user.huihui_user_id == "huihui-user-88"
+    assert user.huihui_user_id != "998877"
+    assert user.huihui_token == "production-huihui-token"
+    assert user.nickname == "会会用户"
+    assert user.avatar_url == "https://cdn.example/avatar.jpg"
+    client.exchange_access_token.assert_awaited_once_with("production-huihui-token")
+    client.get_self.assert_awaited_once_with("boxim-token")
+
+
+@pytest.mark.asyncio
+async def test_token_login_rejects_expired_huihui_token_without_creating_user(db):
+    client = AsyncMock()
+    client.exchange_access_token.side_effect = BoxIMError(
+        "expired", auth_error=True
+    )
+    with patch("routers.huihui_auth._cfg_ready", return_value=True), patch(
+        "routers.huihui_auth._create_boxim_client", return_value=client
+    ):
+        response = await token_login({"token": "expired-token"}, db)
+
+    assert response["code"] == 401
+    assert response["message"] == "会会登录凭证无效或已过期"
+    assert db.query(User).count() == 0
@@ -0,0 +1,50 @@
+from unittest.mock import Mock, patch
+
+from services.huihui_payment import HuihuiPaymentClient
+
+
+def test_create_payment_uses_huihui_payment_v3_contract():
+    client = HuihuiPaymentClient({
+        "HUIHUI_PAYMENT_BASE_URL": "https://open.example/api/payment-v3",
+        "HUIHUI_APP_ID": "app-id",
+        "HUIHUI_ACCESS_ID": "access-id",
+        "HUIHUI_ACCESS_SECRET": "access-secret",
+    })
+    response = Mock()
+    response.status_code = 200
+    response.json.return_value = {
+        "code": 0,
+        "data": {"orderId": "provider-id", "status": "pending", "payMessage": "mock"},
+    }
+
+    with patch("services.huihui_payment.httpx.post", return_value=response) as post:
+        result = client.create_payment(
+            huihui_token="user-token",
+            huihui_user_id="user-id",
+            real_name="测试用户",
+            order_no="AV202608260001",
+            amount="10.00",
+            points_amount=2_000_000,
+            pay_type="WECHAT",
+            pay_way="APP",
+            callback_url="https://digital.example/api/token/payment/callback/secret",
+        )
+
+    assert result["orderId"] == "provider-id"
+    assert post.call_args.args[0] == "https://open.example/api/payment-v3/payment/pay"
+    assert post.call_args.kwargs["headers"] == {
+        "Authorization": "Bearer user-token",
+        "appId": "app-id",
+        "windowAppId": "app-id",
+    }
+    params = post.call_args.kwargs["params"]
+    assert params["appId"] == "app-id"
+    assert params["accessId"] == "access-id"
+    assert params["userId"] == "user-id"
+    assert params["signature"]
+    assert "accessSecret" not in params
+    body = post.call_args.kwargs["json"]
+    assert body["payType"] == "WECHAT"
+    assert body["payWay"] == "APP"
+    assert body["masterOrderAmt"] == "10.00"
+    assert body["payAmt"] == 10.0
@@ -0,0 +1,185 @@
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from fastapi.testclient import TestClient
+
+from database import SessionLocal
+from main import app
+from models import Avatar, KnowledgeChunk, KnowledgeDoc, QAPair
+from routers.knowledge import _doc_payload
+
+
+client = TestClient(app)
+
+
+def test_doc_payload_reports_whether_the_persisted_file_exists(tmp_path: Path):
+    avatar_id = "avatar-1"
+    stored_name = "knowledge.md"
+    doc = SimpleNamespace(
+        avatar_id=avatar_id,
+        file_url=f"/api/files/{avatar_id}/{stored_name}",
+        to_dict=lambda: {"id": "doc-1", "fileUrl": f"/api/files/{avatar_id}/{stored_name}"},
+    )
+    stored_dir = tmp_path / avatar_id
+    stored_dir.mkdir()
+    stored_file = stored_dir / stored_name
+
+    with patch("routers.knowledge.UPLOAD_DIR", str(tmp_path)):
+        assert _doc_payload(doc)["filePresent"] is False
+        stored_file.write_text("knowledge", encoding="utf-8")
+        assert _doc_payload(doc)["filePresent"] is True
+
+
+def test_upload_marks_vectorization_failure_instead_of_staying_processing(
+    tmp_path: Path,
+    authorization_context,
+):
+    context = authorization_context
+    with (
+        patch("routers.knowledge.UPLOAD_DIR", str(tmp_path)),
+        patch("routers.knowledge.embeddings.embed", side_effect=RuntimeError("provider unavailable")),
+    ):
+        response = client.post(
+            f"/api/avatar/{context['avatar'].id}/knowledge/docs",
+            headers=context["owner_headers"],
+            files={"file": ("knowledge.md", b"# Knowledge\n\nTest content", "text/markdown")},
+        )
+
+    payload = response.json()["data"]
+    assert payload["status"] == "failed"
+    assert payload["vectorized"] is False
+    assert payload["chunkCount"] == 0
+
+    db = SessionLocal()
+    try:
+        stored = db.query(KnowledgeDoc).filter(KnowledgeDoc.id == payload["id"]).one()
+        assert stored.status == "failed"
+        assert db.query(KnowledgeChunk).filter(KnowledgeChunk.doc_id == stored.id).count() == 0
+        db.delete(stored)
+        db.commit()
+    finally:
+        db.close()
+
+
+def test_markdown_upload_commits_ready_document_and_chunks_together(
+    tmp_path: Path,
+    authorization_context,
+):
+    context = authorization_context
+    with (
+        patch("routers.knowledge.UPLOAD_DIR", str(tmp_path)),
+        patch("routers.knowledge.embeddings.embed", return_value=[[1.0, 0.0]]),
+    ):
+        response = client.post(
+            f"/api/avatar/{context['avatar'].id}/knowledge/docs",
+            headers=context["owner_headers"],
+            files={"file": ("knowledge.md", b"# Knowledge\n\nTest content", "text/markdown")},
+        )
+
+    payload = response.json()["data"]
+    assert payload["status"] == "ready"
+    assert payload["vectorized"] is True
+    assert payload["chunkCount"] == 1
+
+    db = SessionLocal()
+    try:
+        stored = db.query(KnowledgeDoc).filter(KnowledgeDoc.id == payload["id"]).one()
+        assert stored.status == "ready"
+        assert db.query(KnowledgeChunk).filter(KnowledgeChunk.doc_id == stored.id).count() == 1
+        db.query(KnowledgeChunk).filter(KnowledgeChunk.doc_id == stored.id).delete()
+        db.delete(stored)
+        db.commit()
+    finally:
+        db.close()
+
+
+def test_each_avatar_has_an_independent_document_and_qa_scope(authorization_context):
+    context = authorization_context
+    first_avatar_id = context["avatar"].id
+    second_avatar_id = f"knowledge-second-{context['suffix']}"
+    first_doc_id = f"knowledge-first-doc-{context['suffix']}"
+    second_doc_id = f"knowledge-second-doc-{context['suffix']}"
+    first_qa_id = f"knowledge-first-qa-{context['suffix']}"
+    second_qa_id = f"knowledge-second-qa-{context['suffix']}"
+
+    db = SessionLocal()
+    try:
+        db.add_all(
+            [
+                Avatar(
+                    id=second_avatar_id,
+                    owner_id=context["owner"].huihui_user_id,
+                    name="独立知识库分身",
+                    status="active",
+                    config={},
+                ),
+                KnowledgeDoc(
+                    id=first_doc_id,
+                    avatar_id=first_avatar_id,
+                    filename="first.md",
+                    status="ready",
+                    vectorized=True,
+                ),
+                KnowledgeDoc(
+                    id=second_doc_id,
+                    avatar_id=second_avatar_id,
+                    filename="second.md",
+                    status="ready",
+                    vectorized=True,
+                ),
+                QAPair(
+                    id=first_qa_id,
+                    avatar_id=first_avatar_id,
+                    question="第一个分身问题",
+                    answer="第一个分身答案",
+                ),
+                QAPair(
+                    id=second_qa_id,
+                    avatar_id=second_avatar_id,
+                    question="第二个分身问题",
+                    answer="第二个分身答案",
+                ),
+            ]
+        )
+        db.commit()
+    finally:
+        db.close()
+
+    try:
+        first_docs = client.get(
+            f"/api/avatar/{first_avatar_id}/knowledge/docs",
+            headers=context["owner_headers"],
+        ).json()["data"]
+        second_docs = client.get(
+            f"/api/avatar/{second_avatar_id}/knowledge/docs",
+            headers=context["owner_headers"],
+        ).json()["data"]
+        first_qa = client.get(
+            f"/api/avatar/{first_avatar_id}/knowledge/qa",
+            headers=context["owner_headers"],
+        ).json()["data"]
+        second_qa = client.get(
+            f"/api/avatar/{second_avatar_id}/knowledge/qa",
+            headers=context["owner_headers"],
+        ).json()["data"]
+
+        assert [item["id"] for item in first_docs if item["id"] == first_doc_id] == [first_doc_id]
+        assert second_doc_id not in {item["id"] for item in first_docs}
+        assert [item["id"] for item in second_docs] == [second_doc_id]
+        assert first_qa_id in {item["id"] for item in first_qa}
+        assert second_qa_id not in {item["id"] for item in first_qa}
+        assert [item["id"] for item in second_qa] == [second_qa_id]
+    finally:
+        db = SessionLocal()
+        try:
+            db.query(QAPair).filter(QAPair.id.in_([first_qa_id, second_qa_id])).delete(
+                synchronize_session=False
+            )
+            db.query(KnowledgeDoc).filter(
+                KnowledgeDoc.id.in_([first_doc_id, second_doc_id])
+            ).delete(synchronize_session=False)
+            db.query(Avatar).filter(Avatar.id == second_avatar_id).delete()
+            db.commit()
+        finally:
+            db.close()
@@ -0,0 +1,253 @@
+"""Tests for takeover configuration and BOXIM connection status."""
+
+from datetime import datetime, timedelta
+
+from fastapi.testclient import TestClient
+
+from database import SessionLocal
+from main import app
+from models import Authorization, Avatar, TakeoverCursor, TakeoverReplyTask, User
+
+
+client = TestClient(app)
+
+
+def test_update_takeover_accepts_camel_case_and_persists(authorization_context):
+    context = authorization_context
+    response = client.put(
+        f"/api/avatar/{context['avatar'].id}/authorizations/takeover",
+        headers=context["owner_headers"],
+        json={
+            "authorizationId": context["authorization"].id,
+            "takeoverEnabled": True,
+            "takeoverMode": "delayed",
+            "takeoverDelaySeconds": 60,
+        },
+    )
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["code"] == 200
+    assert payload["data"]["takeoverEnabled"] is True
+    assert payload["data"]["takeoverMode"] == "delayed"
+    assert payload["data"]["takeoverDelaySeconds"] == 60
+    assert "takeover" in payload["data"]["permissions"]
+
+    db = SessionLocal()
+    try:
+        stored = db.query(Authorization).filter(
+            Authorization.id == context["authorization"].id
+        ).first()
+        assert stored.takeover_enabled is True
+        assert stored.takeover_mode == "delayed"
+        assert stored.takeover_delay_seconds == 60
+    finally:
+        db.close()
+
+
+def test_disabling_authorization_also_disables_takeover(authorization_context):
+    context = authorization_context
+    endpoint = f"/api/avatar/{context['avatar'].id}/authorizations/takeover"
+    client.put(
+        endpoint,
+        headers=context["owner_headers"],
+        json={
+            "authorizationId": context["authorization"].id,
+            "takeoverEnabled": True,
+        },
+    )
+
+    updated = client.put(
+        f"/api/avatar/{context['avatar'].id}/authorizations",
+        headers=context["owner_headers"],
+        json={"id": context["authorization"].id, "status": "inactive"},
+    ).json()
+    assert updated["code"] == 200
+    assert updated["data"]["status"] == "inactive"
+    assert updated["data"]["takeoverEnabled"] is False
+    assert "takeover" not in updated["data"]["permissions"]
+
+
+def test_takeover_rejects_invalid_values_and_cross_avatar_access(authorization_context):
+    context = authorization_context
+    endpoint = f"/api/avatar/{context['avatar'].id}/authorizations/takeover"
+
+    invalid_mode = client.put(
+        endpoint,
+        headers=context["owner_headers"],
+        json={
+            "authorization_id": context["authorization"].id,
+            "takeover_mode": "invalid",
+        },
+    ).json()
+    assert invalid_mode["code"] == 400
+
+    invalid_delay = client.put(
+        endpoint,
+        headers=context["owner_headers"],
+        json={
+            "authorization_id": context["authorization"].id,
+            "takeover_delay_seconds": 2,
+        },
+    ).json()
+    assert invalid_delay["code"] == 400
+
+    forbidden = client.put(
+        endpoint,
+        headers=context["other_headers"],
+        json={
+            "authorizationId": context["authorization"].id,
+            "takeoverEnabled": True,
+        },
+    )
+    assert forbidden.status_code == 403
+
+
+def test_takeover_is_limited_to_active_user_authorizations(authorization_context):
+    context = authorization_context
+    avatar_id = context["avatar"].id
+    created = client.post(
+        f"/api/avatar/{avatar_id}/authorizations",
+        headers=context["owner_headers"],
+        json={
+            "targetType": "organization",
+            "targetId": f"org-{context['suffix']}",
+            "targetName": "测试组织",
+            "permissions": ["chat"],
+        },
+    ).json()
+    response = client.put(
+        f"/api/avatar/{avatar_id}/authorizations/takeover",
+        headers=context["owner_headers"],
+        json={
+            "authorizationId": created["data"]["id"],
+            "takeoverEnabled": True,
+        },
+    ).json()
+    assert response["code"] == 400
+    assert "单聊接管" in response["message"]
+
+
+def test_takeover_status_reports_disabled_and_requires_owner_login(authorization_context):
+    context = authorization_context
+    endpoint = f"/api/avatar/{context['avatar'].id}/takeover/status"
+
+    disabled = client.get(endpoint, headers=context["owner_headers"])
+    assert disabled.status_code == 200
+    assert disabled.json()["data"]["status"] == "disabled"
+
+    client.put(
+        f"/api/avatar/{context['avatar'].id}/permission-settings",
+        headers=context["owner_headers"],
+        json={"permissions": ["chat", "takeover"]},
+    )
+    needs_login = client.get(endpoint, headers=context["owner_headers"]).json()["data"]
+    assert needs_login["enabled"] is True
+    assert needs_login["status"] == "needs_login"
+    assert "BOXIM" in needs_login["message"]
+
+    assert client.get(endpoint).status_code == 401
+    assert client.get(endpoint, headers=context["other_headers"]).status_code == 403
+
+
+def test_takeover_status_reports_ready_pending_count_and_errors(authorization_context):
+    context = authorization_context
+    avatar_id = context["avatar"].id
+    endpoint = f"/api/avatar/{avatar_id}/takeover/status"
+    client.put(
+        f"/api/avatar/{avatar_id}/permission-settings",
+        headers=context["owner_headers"],
+        json={"permissions": ["chat", "takeover"]},
+    )
+
+    db = SessionLocal()
+    try:
+        owner = db.query(User).filter(User.id == context["owner"].id).one()
+        owner.huihui_token = "production-login-token"
+        cursor = TakeoverCursor(
+            avatar_id=avatar_id,
+            owner_id=owner.huihui_user_id,
+            boxim_owner_id="100",
+            last_message_id="10",
+            initialized=True,
+            last_polled_at=datetime.utcnow(),
+        )
+        task = TakeoverReplyTask(
+            avatar_id=avatar_id,
+            owner_id=owner.huihui_user_id,
+            peer_id="200",
+            trigger_message_id="11",
+            source_message_ids=["11"],
+            prompt="你好",
+            status="pending",
+            scheduled_at=datetime.utcnow(),
+            boxim_local_id="123",
+        )
+        db.add_all([cursor, task])
+        db.commit()
+    finally:
+        db.close()
+
+    ready = client.get(endpoint, headers=context["owner_headers"]).json()["data"]
+    assert ready["status"] == "ready"
+    assert ready["pendingCount"] == 1
+    assert ready["lastPolledAt"]
+
+    db = SessionLocal()
+    try:
+        cursor = db.query(TakeoverCursor).filter(TakeoverCursor.avatar_id == avatar_id).one()
+        cursor.last_polled_at = datetime.utcnow() - timedelta(seconds=30)
+        db.commit()
+    finally:
+        db.close()
+
+    long_polling = client.get(endpoint, headers=context["owner_headers"]).json()["data"]
+    assert long_polling["status"] == "ready"
+
+    db = SessionLocal()
+    try:
+        cursor = db.query(TakeoverCursor).filter(TakeoverCursor.avatar_id == avatar_id).one()
+        cursor.last_polled_at = datetime.utcnow() - timedelta(seconds=61)
+        db.commit()
+    finally:
+        db.close()
+
+    stale = client.get(endpoint, headers=context["owner_headers"]).json()["data"]
+    assert stale["status"] == "connecting"
+
+    db = SessionLocal()
+    try:
+        cursor = db.query(TakeoverCursor).filter(TakeoverCursor.avatar_id == avatar_id).one()
+        cursor.last_error = "BOXIM 暂时不可用"
+        db.commit()
+    finally:
+        db.close()
+
+    failed = client.get(endpoint, headers=context["owner_headers"]).json()["data"]
+    assert failed["status"] == "error"
+    assert failed["message"] == "BOXIM 暂时不可用"
+
+    db = SessionLocal()
+    try:
+        avatar = db.query(Avatar).filter(Avatar.id == avatar_id).one()
+        avatar.config = {"authorizationPermissions": ["chat"]}
+        db.commit()
+    finally:
+        db.close()
+
+    auto_disabled = client.get(endpoint, headers=context["owner_headers"]).json()["data"]
+    assert auto_disabled["enabled"] is False
+    assert auto_disabled["status"] == "error"
+
+    client.put(
+        f"/api/avatar/{avatar_id}/permission-settings",
+        headers=context["owner_headers"],
+        json={"permissions": ["chat", "takeover"]},
+    )
+    db = SessionLocal()
+    try:
+        cursor = db.query(TakeoverCursor).filter(TakeoverCursor.avatar_id == avatar_id).one()
+        assert cursor.initialized is False
+        assert cursor.last_message_id == "0"
+        assert cursor.last_error == ""
+    finally:
+        db.close()
@@ -0,0 +1,30 @@
+from database import SessionLocal
+from models import Authorization
+
+
+def test_authorization_takeover_fields():
+    db = SessionLocal()
+    try:
+        auth = db.query(Authorization).first()
+        assert auth is not None
+        # Check new fields exist and have default values
+        assert hasattr(auth, 'takeover_enabled')
+        assert hasattr(auth, 'takeover_mode')
+        assert hasattr(auth, 'takeover_delay_seconds')
+        assert auth.takeover_enabled == False
+        assert auth.takeover_mode == 'immediate'
+        assert auth.takeover_delay_seconds == 180
+    finally:
+        db.close()
+
+
+def test_authorization_to_dict_includes_takeover():
+    db = SessionLocal()
+    try:
+        auth = db.query(Authorization).first()
+        d = auth.to_dict()
+        assert 'takeoverEnabled' in d
+        assert 'takeoverMode' in d
+        assert 'takeoverDelaySeconds' in d
+    finally:
+        db.close()
@@ -0,0 +1,105 @@
+"""Tests for the BOXIM takeover scheduler lifecycle."""
+
+from unittest.mock import AsyncMock, MagicMock, patch
+
+
+def test_app_has_startup_and_shutdown_events():
+    from main import app
+
+    assert app.router.on_startup
+    assert app.router.on_shutdown
+
+
+@patch("services.takeover_service.TakeoverService")
+@patch("services.boxim_client.BoxIMClient")
+@patch("main.AsyncIOScheduler")
+def test_scheduler_uses_boxim_and_restart_safe_service(
+    mock_scheduler_class,
+    mock_boxim_class,
+    mock_takeover_class,
+):
+    import main
+
+    maintenance_scheduler = MagicMock()
+    scheduler = MagicMock()
+    mock_scheduler_class.side_effect = [maintenance_scheduler, scheduler]
+    boxim = MagicMock()
+    mock_boxim_class.return_value = boxim
+    takeover = MagicMock()
+    takeover.poll_messages = AsyncMock()
+    takeover.process_reply_tasks = AsyncMock()
+    mock_takeover_class.return_value = takeover
+
+    environment = {
+        "HUIHUI_PLATFORM_BASE_URL": "https://open.example/api",
+        "BOXIM_API_BASE_URL": "https://im.example/api",
+        "HUIHUI_APP_ID": "app-id",
+        "HUIHUI_ACCESS_ID": "access-id",
+        "HUIHUI_ACCESS_SECRET": "secret",
+        "BOXIM_POLL_INTERVAL_SECONDS": "1",
+    }
+    with patch("main.init_db"), patch("main.seed"), patch.dict(
+        "os.environ", environment, clear=False
+    ):
+        main.on_startup()
+
+    config = mock_boxim_class.call_args.args[0]
+    assert config["HUIHUI_PLATFORM_BASE_URL"] == "https://open.example/api"
+    assert config["BOXIM_API_BASE_URL"] == "https://im.example/api"
+    mock_takeover_class.assert_called_once_with(
+        main.SessionLocal,
+        boxim,
+        poll_concurrency=8,
+        max_message_age_seconds=600,
+    )
+
+    maintenance_scheduler.add_job.assert_called_once()
+    assert maintenance_scheduler.add_job.call_args.kwargs["id"] == "chat_attachment_cleanup"
+    maintenance_scheduler.start.assert_called_once_with()
+
+    assert scheduler.add_job.call_count == 2
+    poll_call, process_call = scheduler.add_job.call_args_list
+    assert poll_call.args[0] is takeover.poll_messages
+    assert poll_call.kwargs["id"] == "takeover_message_poll"
+    assert poll_call.kwargs["trigger"].interval.total_seconds() == 1
+    assert poll_call.kwargs["max_instances"] == 1
+    assert poll_call.kwargs["coalesce"] is True
+    assert process_call.args[0] is takeover.process_reply_tasks
+    assert process_call.kwargs["id"] == "takeover_reply_process"
+    assert process_call.kwargs["trigger"].interval.total_seconds() == 0.5
+    assert process_call.kwargs["max_instances"] == 1
+    assert process_call.kwargs["coalesce"] is True
+    scheduler.start.assert_called_once_with()
+
+    main.takeover_scheduler = None
+    main.maintenance_scheduler = None
+
+
+@patch("main.AsyncIOScheduler")
+def test_scheduler_failure_does_not_stop_the_api(mock_scheduler_class):
+    import main
+
+    mock_scheduler_class.side_effect = RuntimeError("scheduler crash")
+    with patch("main.init_db"), patch("main.seed"):
+        main.on_startup()
+
+    assert main.takeover_scheduler is None
+    assert main.maintenance_scheduler is None
+
+
+def test_shutdown_stops_only_the_scheduler():
+    import main
+
+    scheduler = MagicMock()
+    scheduler.running = True
+    maintenance_scheduler = MagicMock()
+    maintenance_scheduler.running = True
+    main.takeover_scheduler = scheduler
+    main.maintenance_scheduler = maintenance_scheduler
+
+    main.on_shutdown()
+
+    scheduler.shutdown.assert_called_once_with(wait=False)
+    maintenance_scheduler.shutdown.assert_called_once_with(wait=False)
+    assert main.takeover_scheduler is None
+    assert main.maintenance_scheduler is None
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
stefanfeng	6a4b35c49a	fix(avatar): ground replies in recognized images	2026-09-02 14:47:27 +08:00
stefanfeng	207bbd02cf	Merge pull request 'fix(avatar): recover BOXIM image replies' (#13 ) from codex/avatar-boxim-vision-hotfix-20260902 into main Reviewed-on: #13	2026-09-02 14:13:19 +08:00
stefanfeng	7cac96356d	fix(avatar): recover BOXIM image replies	2026-09-02 14:12:04 +08:00
stefanfeng	03c32309a8	Merge pull request 'feat(avatar): understand BOXIM image messages' (#12 ) from codex/avatar-boxim-vision-20260901 into main Merge pull request #12: BOXIM image understanding	2026-09-01 15:36:19 +08:00
stefanfeng	0fc43908ae	feat(avatar): understand BOXIM image messages	2026-09-01 15:35:41 +08:00
stefanfeng	3d999f9472	Merge pull request 'fix(avatar): prevent BOXIM polling starvation' (#11 ) from codex/avatar-takeover-poll-20260901 into main	2026-09-01 14:04:18 +08:00
stefanfeng	540edb58c4	fix(avatar): prevent BOXIM polling starvation	2026-09-01 14:03:35 +08:00
stefanfeng	a7eb6ac2a5	Merge pull request #10 from codex/avatar-vision-chat-20260831 feat(avatar): 支持图片与病例理解对话	2026-09-01 10:41:51 +08:00
stefanfeng	016bc22c05	feat(avatar): add private vision chat support	2026-08-31 15:10:50 +08:00
stefanfeng	094f8cd40f	Merge pull request 'fix(avatar): normalize embedding API endpoint' (#9 ) from codex/avatar-embedding-endpoint-20260828 into main Reviewed-on: #9	2026-08-28 17:00:16 +08:00
stefanfeng	6794e88d53	fix(avatar): normalize embedding API endpoint	2026-08-28 16:59:22 +08:00
stefanfeng	7884430b3d	Merge pull request 'feat(avatar): 优化会会 H5 嵌入管理流程' (#8 ) from codex/avatar-h5-embedded-layout-20260827 into main Reviewed-on: #8	2026-08-27 11:41:21 +08:00
stefanfeng	46d42b7d98	fix(avatar): prevent takeover loops and isolate settings	2026-08-27 11:30:12 +08:00
stefanfeng	ef58c5f2d2	feat(avatar): optimize embedded H5 management flow	2026-08-27 09:28:05 +08:00
stefanfeng	6e3fe5a616	Merge pull request 'feat(avatar): 接入会会支付并统一积分展示' (#7 ) from codex/avatar-token-copy-to-points-20260826 into main Reviewed-on: #7	2026-08-26 14:53:58 +08:00
stefanfeng	67b6bd1b48	Merge pull request 'fix(avatar): 部署重启后自动恢复 BOXIM 接管' (#6 ) from codex/avatar-takeover-restart-safe-20260826 into main Reviewed-on: #6	2026-08-26 14:53:49 +08:00
stefanfeng	0752001d85	Merge pull request 'feat(avatar): 数字分身自动跟随用户语言回答' (#5 ) from codex/avatar-auto-reply-language-20260826 into main Reviewed-on: #5	2026-08-26 14:53:40 +08:00
stefanfeng	c37294be17	feat(avatar): integrate Huihui payments	2026-08-26 14:41:21 +08:00
stefanfeng	5360cac8ad	fix(avatar): normalize legacy plan copy	2026-08-26 14:02:38 +08:00
stefanfeng	ea932f27fb	feat(avatar): rename Token display to points	2026-08-26 14:01:12 +08:00
deploy	bf0183bef4	add wechat mini-program domain verification file	2026-08-26 13:44:56 +08:00
stefanfeng	0c6419f37e	fix(avatar): restore BOXIM takeover after restart	2026-08-26 13:25:16 +08:00
stefanfeng	f768e7648f	fix(avatar): prevent inferred reply scenarios	2026-08-26 11:56:54 +08:00
stefanfeng	e30ab2b889	feat(avatar): follow user language in replies	2026-08-26 11:52:32 +08:00
stefanfeng	730f586784	Merge pull request 'docs(avatar): 配置 digital.99hui.com 生产域名' (#4 ) from codex/avatar-multi-management-integrated-20260825 into main Reviewed-on: #4	2026-08-26 10:17:40 +08:00
stefanfeng	ef2b1c6dd6	chore(avatar): add WeChat verification file	2026-08-26 09:51:13 +08:00
stefanfeng	c693899b12	docs(avatar): set production H5 domain	2026-08-26 09:44:22 +08:00
stefanfeng	d274ccb5e2	Merge pull request 'feat: 完成数字分身多分身管理与生产 H5 接入' (#3 ) from codex/avatar-multi-management-integrated-20260825 into main Reviewed-on: #3	2026-08-26 09:43:52 +08:00
stefanfeng	5d19992f00	fix(avatar): remove SSO token from router state	2026-08-26 09:25:07 +08:00
stefanfeng	81aec1c63a	feat(avatar): support production H5 token SSO	2026-08-26 09:17:41 +08:00
stefanfeng	4029c31ed7	fix(avatar): bundle uni bridge and add favicon	2026-08-25 17:19:30 +08:00
stefanfeng	e24e89d326	fix(deploy): serialize model migration and pin nginx	2026-08-25 16:59:15 +08:00
stefanfeng	dc34a03357	feat(ai): add dedicated digital avatar model config	2026-08-25 16:50:33 +08:00
stefanfeng	3f7ff9329a	fix(avatar): align QA cards to the left	2026-08-25 15:36:49 +08:00
stefanfeng	699bbbde57	feat(avatar): add user token accounting	2026-08-25 13:24:02 +08:00
stefanfeng	7a0199e685	feat(avatar): improve multi-avatar management	2026-08-25 11:44:27 +08:00
stefanfeng	672019830d	fix(avatar): prevent takeover replies blocking across chats	2026-08-21 16:21:00 +08:00
stefanfeng	e720baa21e	fix(avatar): batch knowledge embedding requests	2026-08-21 13:21:05 +08:00
stefanfeng	9e86cc64ac	Merge pull request 'Codex/avatar integrated 20260819' (#2 ) from codex/avatar-integrated-20260819 into main Reviewed-on: #2	2026-08-21 09:31:43 +08:00
stefanfeng	e2b928273c	fix(avatar): acknowledge BOXIM messages as read	2026-08-20 17:10:54 +08:00
stefanfeng	64b7680ec4	fix(avatar): keep BOXIM status ready during long polls	2026-08-20 15:58:07 +08:00
stefanfeng	89f52963b7	fix(avatar): persist takeover toggle immediately	2026-08-20 15:55:12 +08:00
stefanfeng	76bd22c24b	fix(avatar): preserve ownership across Huihui environments	2026-08-20 15:27:29 +08:00
stefanfeng	51a317ccd9	fix(avatar): fail closed on BOXIM connection errors	2026-08-20 14:47:13 +08:00
stefanfeng	08590bf9ea	fix(avatar): refresh BOXIM takeover status	2026-08-19 18:03:59 +08:00
stefanfeng	25fb8fbee5	feat(avatar): add BOXIM chat takeover	2026-08-19 17:56:57 +08:00
stefanfeng	cfcfe7146e	feat(avatar): align authorization page with design	2026-08-19 17:05:22 +08:00
stefanfeng	2e2adeb9e2	feat(avatar): complete authorization management	2026-08-19 16:21:19 +08:00
stefanfeng	25d2494616	fix: surface missing knowledge files	2026-08-19 15:13:22 +08:00
stefanfeng	bd5f64d000	fix: align avatar route titles	2026-08-19 15:09:38 +08:00
stefanfeng	350df1d119	build: pin secure frontend transitive dependencies	2026-08-19 15:01:39 +08:00
stefanfeng	64462fac92	build: enforce locked frontend type checks	2026-08-19 14:57:40 +08:00
stefanfeng	6bf446f889	fix: restore reproducible frontend builds	2026-08-19 14:56:39 +08:00
stefanfeng	68ea87e1b2	fix: persist avatar data and uploads	2026-08-19 14:44:58 +08:00
stefanfeng	c5bfa47a23	fix: await takeover polling jobs	2026-08-19 14:32:10 +08:00
stefanfeng	4ab7732da9	fix: preserve takeover and share token integrity	2026-08-19 14:23:43 +08:00
stefanfeng	4a2d788e85	feat: complete grounded digital avatar chat experience	2026-08-19 14:21:56 +08:00
stefanfeng	07d4a21379	fix: sync Huihui app user homepage profile	2026-08-18 08:48:20 +08:00
stefanfeng	efc419e301	fix: sync virtual user profiles to Huihui public pages	2026-08-18 08:48:20 +08:00
stefanfeng	c748950402	fix: accept camelCase authorizationId from frontend	2026-08-07 17:18:34 +08:00
stefanfeng	f13d488f82	feat: add takeover config API endpoint PUT /api/avatar/{avatar_id}/authorizations/takeover to update authorization takeover settings (enabled, mode, delay_seconds) with validation.	2026-08-07 17:15:12 +08:00
stefanfeng	43f2ad9edb	feat: add takeover config UI to authorization management page - Added updateTakeoverConfig API function (PUT /api/avatar/{id}/authorizations/takeover) - Added expandable takeover config section per auth card with toggle switch, mode selector (immediate/delayed), and delay seconds input - Added takeover summary badge showing current config when not editing - Styles follow existing light theme with indigo (#6366F1) accent	2026-08-07 17:07:21 +08:00
stefanfeng	8e365e63e1	feat: add scheduled message polling for avatar takeover Add APScheduler BackgroundScheduler to on_startup that polls takeover_service.poll_and_process_messages every 10 seconds. Added redis and apscheduler dependencies. Added poll_and_process_messages, fetch_unread_messages, and process_message methods to TakeoverService. Scheduler initialization is graceful — Redis/Box IM failures do not prevent app startup.	2026-08-07 17:01:04 +08:00
stefanfeng	dbd668e451	fix: resolve owner through Avatar model in takeover service - Fix C1: check_takeover_enabled now uses owner_huihui_id to query Avatar first - Fix C2: execute_takeover resolves owner_id via Avatar model (Authorization has no owner_id) - Fix I1: add test for None case (no Avatar found) - Fix I2: add test verifying filter arguments - Fix I3: implement process_delayed_queue to scan and dispatch expired messages	2026-08-07 16:55:25 +08:00
stefanfeng	190ec48d9c	feat: add takeover service core logic Implement TakeoverService for avatar takeover chat feature: - check_takeover_enabled: query Authorization for enabled takeover - generate_reply: call local chat API via httpx to generate responses - execute_takeover: get owner IM credentials, generate reply, send via BoxIM - enqueue_delayed_message: Redis delayed queue with graceful degradation - process_delayed_queue: placeholder for scheduled worker Service degrades gracefully when Redis is unavailable.	2026-08-07 16:46:57 +08:00
stefanfeng	0cc43a0d8c	fix: exclude signature from signing string in BoxIMClient Prevents stale signature values from leaking into the MD5 signing calculation, matching the news_service.py pattern. Adds a test that passes a stale signature in extra params and verifies the returned signature is freshly computed.	2026-08-07 16:42:00 +08:00
stefanfeng	43bb57eacf	feat: add Box IM client for Netease Yunxin integration Add BoxIMClient with get_credentials and send_p2p_message methods, using Huihui platform MD5 signing mechanism (sorted keys, 24h timestamp, 12-char alphanumeric nonce). Includes full test coverage.	2026-08-07 16:36:50 +08:00
stefanfeng	7327939b4d	feat: add takeover fields to Authorization model Add takeover_enabled, takeover_mode, and takeover_delay_seconds columns to the Authorization model with a SQLite migration, and include them in to_dict(). Test: test_takeover_model.py.	2026-08-07 16:30:29 +08:00
stefanfeng	76f0730b57	docs: add avatar takeover chat implementation plan	2026-08-07 16:22:58 +08:00
stefanfeng	6f6655e791	docs: add avatar takeover chat design spec	2026-08-07 16:12:49 +08:00
stefanfeng	e3cce871b0	fix: add avatar photo upload endpoint to digital-avatar-app backend - Add POST /api/avatar/{id}/photo endpoint - Save uploaded photos to UPLOAD_DIR/{avatar_id}/ - Update avatar.photo_url in database - Import UPLOAD_DIR from knowledge router	2026-08-07 15:10:59 +08:00
stefanfeng	b7f8ac203b	feat: add avatar photo upload via Huihui filecenter - Add POST /avatars/{id}/upload-photo endpoint - Use Huihui platform's filecenter API for image upload (same signing mechanism as news_service) - Add upload button in avatar list table - Frontend: handleUploadPhoto function with el-upload component - Updates avatar photo_url in SQLite after successful upload	2026-08-07 14:28:22 +08:00