Manager — codeword-triggered Manager mode + HARD delegation wall

The HARD wall is an optional, project-scoped guard that physically blocks the main Claude session from writing or editing files. Subagents always stay fully free — delegation is never blocked.

Install-once + state-gate

/brewtools:manager on copies hardmode-guard.mjs from the plugin cache into <cwd>/.claude/brewtools/manager/hardmode-guard.mjs and registers a PreToolUse * entry in <cwd>/.claude/settings.local.json (personal, gitignored). The guard is registered once; subsequent on calls overwrite it (so plugin updates propagate) without adding duplicates. A /reload or session restart is required after first install.

The guard reads <cwd>/.claude/brewtools/manager/state.json on every PreToolUse call. When hard !== true, the guard exits immediately — no denial. off flips state.hard=false without touching settings.local.json; the guard stays registered but becomes a no-op. This split exists because editing settings while the wall is armed would be blocked — the state flip is self-exempt and always succeeds.

agent_id linchpin — main session blocked, subagents free

The PreToolUse payload carries agent_id / agent_type only for subagent-internal tool calls. Main-session calls have no agent_id. The guard denies mutations only when agent_id is absent. Subagents pass through freely — delegation itself is never blocked.

Tool buckets

Strict vs balanced

The balanced Bash classifier is an allowlist of known-safe read-only commands, NOT a shell evaluator. Command substitution $(...) and node -e / --eval are denied even in balanced mode.

Off-switch safety

How the codeword injection works

On every user message, manager-prompt.mjs scans the prompt text. Detection order follows longest-prefix first: ++mp → ++m → ++rr → ++r. This ensures ++mp is never mis-matched as ++m, and ++rr is never mis-matched as ++r. If no codeword is present (and the wall is not armed), the hook exits immediately — no file I/O, zero overhead.

The hook resolves the prompt text for the detected mode (full or planmode) via three-level fallback:

1. Project override: .claude/brewtools/manager/prompts/<mode>.md
2. Global override: ~/.claude/manager/prompts/<mode>.md
3. Plugin default: plugin references/<mode>.md

Project and global overrides survive plugin updates because they live outside the plugin cache.

When the HARD wall is armed, the Manager (full) block is also ambient-injected every turn with no codeword needed — codewords and wall injection are independent channels.

Scope table

The wall flags (hard/level) are resolved project-only. Passing --scope global to on/off/level is silently ignored (wall has no global scope); the flag only applies to prompt-text override scope in edit/reset.

Prompt resolution chain

Global paths (~/.claude/*) are protected from direct Write/Edit tool access (Claude Code v3.4.70+). The skill writes them via bundled Node helpers using atomic lock+tmp+rename.

Plan Mode addon (++mp)

When ++mp is detected, the hook injects both the full Manager block and the Plan Mode addon. The addon instructs the model to: write the full TaskGraph in English into the plan before starting; mark tasks with parallel / critical-path indicators; output all task and plan text in English regardless of user prompt language.

The skill also understands natural-language Russian (e.g. on/off, hard mode, status). The complete RU+EN trigger list lives in the skill’s SKILL.md.

Actions

Expected status output (wall off)

# Manager -- status

## Codewords (ALWAYS active -- hook-driven, independent of this skill)
Type `++m` anywhere   -> injects the Manager (full) block for that one turn.
Type `++mp` anywhere  -> injects the Manager + Plan Mode block for that one turn.
Type `++rr` anywhere  -> injects the Regression Review contract for that one turn.
Type `++r` anywhere   -> injects the Review contract for that one turn.

--- injected by ++m (full) ---
<full Manager block text>

--- injected by ++mp (planmode) ---
<planmode block text>

## HARD wall (this project) -- registered=no  armed=OFF  level=balanced  (state source: default)
Enable:    /brewtools:manager on
Disable:   /brewtools:manager off
Uninstall: /brewtools:manager uninstall
Level:     /brewtools:manager level strict | balanced

hard-one-shot vs manager-run

hard-one-shot (<task> in hard mode) actually toggles the guard: wall ON — task runs — wall auto-reverts OFF when done, even on failure or abort. The guard never silently persists.

manager-run (<task> as manager) does NOT touch the wall state at all. Manager discipline is enforced via the injected prompt only. Use this when you want Manager behavior without arming or changing the guard.