On Windows, path.resolve() returns paths with backslash separators. The previous endsWith("dist/cli.js") check uses forward slashes and always returned false on Windows, causing both LSP and ast-grep MCPs to fall through to the bootstrap path even when the dist cli exists. Result: LSP MCP completely unusable on Windows with MODULE_NOT_FOUND for dist/packages/lsp-tools-mcp/dist/cli.js.
Fix: derive a platform-aware suffix at module load time by replacing forward slashes in DIST_CLI_REL / SOURCE_CLI_REL with path.sep, then use that suffix in the endsWith check.
Verification: all 4 src/mcp/lsp.test.ts cases pass on Windows (previously 2 failed); all 13 src/mcp/ast-grep.test.ts cases pass (previously 2 failed). Total: 17/17 src/mcp tests green. bun run typecheck clean.
Maintainer feedback (#4071 review): the original guard rejected
sisyphus and atlas as subagent targets even from team-mode where
resolveMember() intentionally calls resolveSubagentExecution with
allowPrimaryAgentDelegation: true. Per AGENT_ELIGIBILITY_REGISTRY
(src/features/team-mode/types.ts), only prometheus is hard-reject;
sisyphus and atlas are explicitly verdict: 'eligible' for team
membership.
Shrink COORDINATOR_AGENT_NAMES to ['prometheus'] so the guard
aligns with the registry's authoritative classification, document
the scoping rule in a comment, and add regression tests covering:
- sisyphus is NOT blocked by the coordinator guard (registry eligible)
- atlas is NOT blocked by the coordinator guard (registry eligible)
- prometheus IS blocked even when allowPrimaryAgentDelegation: true
(registry hard-reject is authoritative)
Fixes the 5 zauc-mocks resolver tests that were locking in the
wrong rejection set (including 'allows delegating to a primary
agent when allowPrimaryAgentDelegation is enabled'). The one test
asserting the literal primary-agent error string for Prometheus
display-name was loosened to a regex that accepts either guard's
message, since prometheus is now caught by the coordinator path
which fires before the primary-agent lookup.
Agents could select coordinator/meta agents (Prometheus, Atlas,
Sisyphus/Ultraworker) as subagent targets via task() / delegation,
producing duplicate orchestration loops and conflicting team state.
This is the inverse of #3987 / #4065 — symmetric guard on the
delegation TARGET side, using the same AGENT_ELIGIBILITY_REGISTRY
classification.
Add a runtime guard at the delegation entry point that rejects
task() calls whose subagent_type resolves to an agent marked as
hard-reject / coordinator-only in the eligibility registry, with
an actionable error naming the agent. Regression test asserts a
prometheus-targeted delegation is rejected before any subagent
session spawns.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
PLANNING_CONSULT_WARNING was prepended to the prompt forwarded to
subagent LLMs via task(). Its leading bracket-enclosed marker
`[SYSTEM DIRECTIVE: OH-MY-OPENCODE - PROMETHEUS READ-ONLY]` is
exactly the indirect-prompt-injection signature that Azure OpenAI
Prompt Shield flags in user-role content; on GPT-5.4 through
Azure, the model returns "I'm sorry, but I cannot assist with
that request." before any planning work runs, making Prometheus
non-functional on Azure.
The bracket marker was designed for internal hook-to-hook
filtering, but PLANNING_CONSULT_WARNING leaks it to external LLM
payloads. Replace the header with a neutral XML-tag wrapper
(`<planning-context source="prometheus-read-only">`) that Azure's
filter does not match while preserving the human-readable warning
body. Internal isSystemDirective() consumers are unaffected.
Regression test asserts the post-hook task() prompt does not
begin with the flagged bracket sequence.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace 'FN.' shorthand with explicit examples 'F1.', 'F2.' to prevent
LLMs from generating literal 'FN.' labels that the parser rejects.
Identified by cubic.
- Strengthen Prometheus plan template with FORMAT constraint
- Add task label format check to Oracle phase-2 (N/6 → N/7)
- Add format checks to self-review checklist
- New plan-format-validator hook: compares raw checkbox count
against getPlanProgress() after plan writes, warns agent when
labels are malformed (0/0 or partial skip scenarios)
- P1: When allowedEnvVars is provided, PATH was missing from the base
restricted env, causing non-builtin commands to fail at exec time
- P2: Allowlisted HOME/CLAUDE_PROJECT_DIR could overwrite normalized
values from getHomeDirectory()/cwd with ambient process.env values
- P2: Test suite mutated shared pluginHooksState singleton without
resetting it in afterEach, causing cross-test state leaks
MoerAI