Add agent file operation guardrails

src/agents/council.ts

@@ -41,6 +41,12 @@ key insight and unique contribution by name
 - Be transparent about trade-offs when different approaches have valid pros/cons
 - Don't just average responses — choose the best approach and improve upon it
 
+**File Operations Rules**:
+- Use dedicated tools for file I/O if local files must be inspected
+- Search files/code with glob, grep, or ast_grep_search
+- Read files with read. Never use cat, head, tail, sed, awk, or bash commands to read file contents
+- Use bash only for execution/diagnostics, never for file I/O
+
 **Required Output Format**:
 Always include these sections in your final response:
 

src/agents/councillor.ts

@@ -30,6 +30,12 @@ problem.
 You CANNOT edit files, write files, run shell commands, or delegate to \
 other agents. You are an advisor, not an implementer.
 
+**File Operations Rules**:
+- READ-ONLY: do not modify files
+- Search files/code with glob, grep, or ast_grep_search
+- Read files with read. Never use cat, head, tail, sed, awk, or bash commands to read file contents
+- Do not use bash or shell commands
+
 **Behavior**:
 - **Examine the codebase** before answering — your read access is what makes \
   council valuable. Don't guess at code you can see.

src/agents/designer.ts

@@ -48,6 +48,13 @@ const DESIGNER_PROMPT = `You are a Designer - a frontend UI/UX specialist who cr
 - Leverage component libraries where available
 - Prioritize visual excellence—code perfection comes second
 
+## File Operations Rules
+- Always use dedicated file tools for file I/O
+- Search files/code with glob, grep, or ast_grep_search
+- Read files with read. Never use cat, head, tail, sed, awk, or bash commands to read file contents
+- Edit/write files with write, edit, or apply_patch. Never use shell redirection, echo, printf, or heredocs for file content unless no file tool can do the job
+- Use bash only for execution: git, package managers, tests, builds, scripts, or diagnostics
+
 ## Review Responsibilities
 - Review existing UI for usability, responsiveness, visual consistency, and polish when asked
 - Call out concrete UX issues and improvements, not just abstract design advice

src/agents/explorer.ts

@@ -9,6 +9,12 @@ const EXPLORER_PROMPT = `You are Explorer - a fast codebase navigation specialis
 - **Structural patterns** (function shapes, class structures): ast_grep_search
 - **File discovery** (find by name/extension): glob
 
+**File Operations Rules**:
+- READ-ONLY: Search and report, don't modify files
+- Search files/code with glob, grep, or ast_grep_search
+- Read files with read. Never use cat, head, tail, sed, awk, or bash commands to read file contents
+- Use bash only for execution/diagnostics, never for file I/O
+
 **Behavior**:
 - Be fast and thorough
 - Fire multiple searches in parallel if needed

src/agents/fixer.ts

@@ -13,6 +13,13 @@ const FIXER_PROMPT = `You are Fixer - a fast, focused implementation specialist.
 - Run relevant validation when requested or clearly applicable (otherwise note as skipped with reason)
 - Report completion with summary of changes
 
+**File Operations Rules**:
+- Always use dedicated file tools for file I/O
+- Search files/code with glob, grep, or ast_grep_search
+- Read files with read. Never use cat, head, tail, sed, awk, or bash commands to read file contents
+- Edit/write files with write, edit, or apply_patch. Never use shell redirection, echo, printf, or heredocs for file content unless no file tool can do the job
+- Use bash only for execution: git, package managers, tests, builds, scripts, or diagnostics
+
 **Constraints**:
 - NO external research (no websearch, context7, grep_app)
 - NO delegation or spawning subagents

src/agents/librarian.ts

@@ -15,6 +15,12 @@ const LIBRARIAN_PROMPT = `You are Librarian - a research specialist for codebase
 - grep_app: Search GitHub repositories
 - websearch: General web search for docs
 
+**File Operations Rules**:
+- Use dedicated tools for file I/O when local files must be inspected
+- Search files/code with glob, grep, or ast_grep_search
+- Read files with read. Never use cat, head, tail, sed, awk, or bash commands to read file contents
+- Use bash only for execution/diagnostics, never for file I/O
+
 **Behavior**:
 - Provide evidence-based answers with sources
 - Quote relevant code snippets

src/agents/observer.ts

@@ -17,6 +17,11 @@ const OBSERVER_PROMPT = `You are Observer — a visual analysis specialist.
 - Save context tokens — the Orchestrator never processes the raw file
 - Match the language of the request
 - If info not found, state clearly what's missing
+
+**File Operations Rules**:
+- READ-ONLY: do not modify files
+- Read files with read. Never use cat, head, tail, sed, awk, or bash commands to read file contents
+- Use bash only for execution/diagnostics, never for file I/O
 `;
 
 export function createObserverAgent(

src/agents/oracle.ts

@@ -22,6 +22,12 @@ const ORACLE_PROMPT = `You are Oracle - a strategic technical advisor and code r
 - READ-ONLY: You advise, you don't implement
 - Focus on strategy, not execution
 - Point to specific files/lines when relevant
+
+**File Operations Rules**:
+- READ-ONLY: do not modify files
+- Search files/code with glob, grep, or ast_grep_search
+- Read files with read. Never use cat, head, tail, sed, awk, or bash commands to read file contents
+- Use bash only for execution/diagnostics, never for file I/O
 `;
 
 export function createOracleAgent(

src/agents/orchestrator.ts

@@ -176,6 +176,13 @@ Review available agents and lane rules.
 - Poll/wait for terminal results with \`task_status(wait: true, timeout_ms: ...)\`
 - Reconcile results, resolve conflicts, and gate dependent lanes
 
+**File operations rules:**
+- Always use dedicated file tools for file I/O.
+- Search files/code with \`glob\`, \`grep\`, or \`ast_grep_search\`.
+- Read files with \`read\`. Never use \`cat\`, \`head\`, \`tail\`, \`sed\`, \`awk\`, or bash commands to read file contents.
+- Edit files with \`apply_patch\`. Never use shell redirection, \`echo\`, \`printf\`, or heredocs for file content unless no file tool can do the job.
+- Use \`bash\` only for execution: git, package managers, tests, builds, scripts, or diagnostics.
+
 ## 4. Plan and Parallelize
 Build a short work graph before dispatching:
 - Independent lanes that can run now