default-mode (system-transform):
- e5463e2db introduced auto-activation of ultrawork+ralph-loop, and
dc2e082ac then skipped the ultrawork system prompt whenever ralph_loop
was also enabled. Net effect: the keyword-detector still showed
'Default ultrawork mode enabled' to the user, but the first turn had
none of the ultrawork behavior. Loop continuation kept the ultrawork
prefix, so the contract was honored only on later iterations.
- Drop the skip so the initial turn matches what the toast advertises.
New matrix test pins all four (ultrawork, ralph_loop) combinations.
multimodal-looker:
- Prompt claimed 'read' and 'call_omo_agent' were available, but the
look_at invocation runtime explicitly disables both via READ_ENABLED
and createAgentToolAllowlist([]). Small VL models trusted the prompt
and looped on rejected tool calls (#4116).
- Rewrite the agent prompt to describe direct-attachment analysis and
forbid tool/agent calls. Add a consistency test that extracts the
prompt's 'available tools' claim and compares it against the
configured allowlist.
delegate-task (skill-resolver):
- 088693697 filtered per-agent restricted skills at the skill tool and
builtin agent prompt layers, but delegate-task itself happily injected
whatever skill name a caller passed. A target agent could be force-fed
a skill marked agent: oracle just by listing it in load_skills.
- Thread the target agent through resolveSkills and silently filter
skills whose definition.agent does not include it. Public skills with
no restriction are unaffected. Regression test pins the bypass.
When both default_mode.ultrawork and default_mode.ralph_loop are true,
the ralph loop handles ultrawork behavior via its continuation mechanism
(prepends 'ultrawork' to each iteration prompt). Injecting the ultrawork
system prompt on top would be redundant — the continuation prompt
re-triggers keyword detection, which defeats the purpose of invisible
system prompt injection.
The ultrawork flag still controls loop behavior (500 max iterations +
Oracle verification gate) via chat-message.ts startLoop({ ultrawork }).
When default_mode.ultrawork is enabled, inject the ultrawork behavioral
instructions into the system prompt (experimental.chat.system.transform)
instead of prepending them to the user's visible chat message.
- system-transform.ts: No-op handler now injects ultrawork message into
output.system[] when defaultMode.ultrawork is active. Checks for existing
<ultrawork-mode> tag to avoid re-injection after compaction.
- keyword-detector/hook.ts: Removes the visible text injection
(output.parts[].text prepend) for default_mode.ultrawork path. Only
shows the toast as the user-facing indicator.
- plugin-interface.ts: Wires getUltraworkMessage from keyword-detector
into createSystemTransformHandler.
Result: Ultrawork mode activates silently via system prompt — the chat
stays clean, and only a toast shows 'Ultrawork Mode Active'.
YeonGyu-Kim