Prompt Injection

Type a standalone codeword to add its operating instructions for that turn. The plugin’s manager-prompt.mjs hook returns additionalContext; your original prompt, including the codeword, remains unchanged. The optional manager hard wall is installed separately.

Quick reference

Alphabetic codewords are case-insensitive. Manager, architecture, and review are independent groups; ++rr wins over ++r. A standalone +++ is independent of ++m and requires the hook payload’s permission_mode to equal plan. Embedded words and longer plus sequences do not activate the tokens.

When combined, blocks are emitted in this order: cron planning, manager, architecture, then the selected review contract. The hook is codeword-only: an armed hard wall injects no prompt block; its deny messages explain themselves.

Example

++m ++a fix the login flow

The model receives Manager and architecture context alongside the original message. Manager instructions require bounded delegated units, owners and real dependencies, evidence review, and a final simplification task after all implementation is written. Architecture instructions require following existing project patterns and the closest well-built counterpart.

How it works

Plan-only anti-drift instructions

While already in Plan mode, type:

+++ plan the migration and task tracking

This works without ++m and without installing the hard wall. It requires a read-only plan to include task methodology, base work units and graph reconciliation, a complete unique task-specific tick prompt, and a future execution step through task-board.

During authorized execution, the main session’s task-board flow reconciles one session timer per active top-level task, hourly by default or at your requested cadence. Child work units use their parent’s timer. Planning itself writes no files and creates or deletes no timers.

The planned tick rereads the goal, shared/task methodology, anti-drift instructions, task/spec records, and user corrections. It collects concise active-agent evidence, reconciles statuses, dependencies, counts, and remaining work, and rebuilds the graph. Retain every unfinished node and the latest ten completed nodes; preserve older completion evidence in task records before pruning graph rows. Check drift against acceptance evidence, correct deviations within scope, and advance the next authorized unblocked step.

The report uses at most five short lines: local time/timezone, delivered tick number and elapsed time; 🟢 achievements; 🔵 remaining work and next action; 🔴 present problems, blockers, or questions; ⚪ drift verdict. Omit empty rows; keep full evidence in task records.

Task-board records the prompt, scheduling state, and stop rule and verifies stopping on completion or cancellation. Missing tools are reported as a scheduling gap. Timers belong to the session; due time does not guarantee exact receipt or delivery after session closure. Outside verified Plan mode, +++ adds no cron instruction; other codewords still add their own context.

Prompt sources and customization

The resolver supports full, planmode, cron-plan, architect, review-double, and review-regression. Fenced prompt blocks are extracted in order; an unfenced file uses its complete trimmed text. Overrides live outside the plugin cache and can therefore retain older wording after an update.

Use /brewtools:manager-setup status to inspect effective sources and /brewtools:manager-setup edit to prepare an override. Purge removes owned overrides and wall state according to the skill’s removal contract.

Other operating context

Brewcode’s prompt and session hooks can supply operating context independently of these codewords. See Brewcode hooks. Teams and agent generation also add the closest-counterpart rule for agents that write code, scripts, schemas, or infrastructure.

These are Claude Code product contracts. Codex uses separate native instructions and tools; the plugin’s Claude hooks do not configure Codex runtime state.

Related