fix(agent): let native CLIs own their instruction files

plugins/agent/native/README.md

@@ -74,7 +74,7 @@ Windows commands must select a native `.exe` or explicitly invoke `node.exe` wit
 
 Host tools use a conversation-scoped local HTTP MCP endpoint and stable private configuration paths while the Host activation remains live. Each invocation captures immutable definitions. A reduced invocation tool selection can retain advertised definitions for caching while rejecting unavailable calls; additions or changed definitions refresh the catalog only after the prior invocation has settled. Descriptions and plugin updates do not invalidate conversation identity. Every invocation receives a fresh bearer and isolated MCP transport sessions, not shared authority. Codex refreshes thread-scoped `http_headers`; Claude and agy atomically refresh credentials at the existing configuration paths. Closed credentials and old transport sessions cannot borrow the next invocation's authority. Accepted calls retain their original invocation and operation receipts through cancellation/disconnection. Idle conversations keep only the endpoint/catalog/configuration; session removal and Host shutdown release them after physical settlement. Host restart creates a new listener and private directory, and captures the current catalog while retaining native identity, the completed setup marker and delivered instruction digest. Credentials never appear in argv or logs.
 
-When workspace instructions are enabled, the selected global `AGENTS.md` body appears immediately after the builtin identity, wrapped only in `<global_instruction>` and `</global_instruction>`. `~/.maka/AGENTS.md` takes precedence; only its absence permits `~/.agents/AGENTS.md`. Other global and project instruction files follow later. Instructions are captured at admission and retained on resume. The native global-instruction API reads and saves the complete selected UTF-8 file, and prompt capture has no independent file-size cutoff. Saving checks the selected source and content revision before atomic replacement; the Assistant editor uses the shared complete-text editing and capture path.
+When workspace instructions are enabled, the selected global `AGENTS.md` body appears immediately after the builtin identity, wrapped only in `<global_instruction>` and `</global_instruction>`. `~/.maka/AGENTS.md` takes precedence; only its absence permits `~/.agents/AGENTS.md`. Built-in model sessions also append the other global and project instruction files. External Codex, Claude and agy sessions receive only Maka identity, the selected global preferences and Maka tool/skill guidance (plus any configured Maka role). The CLI owns discovery and loading of its native global and project rules; Maka does not copy those files into the injected block or disable native discovery. The workspace-instruction preference controls Maka capture, not CLI-native loading. Maka instructions are captured at admission and retained on resume. The native global-instruction API reads and saves the complete selected UTF-8 file, and prompt capture has no independent file-size cutoff. Saving checks the selected source and content revision before atomic replacement; the Assistant editor uses the shared complete-text editing and capture path.
 
 New instruction captures select English, Simplified Chinese or Traditional Chinese from the saved Root language preference, then the configured locale, then the native environment. Explicit Auto uses the native environment. One policy snapshot supplies the language for builtin instructions, skills, default summaries and runtime guidance; tool schemas stay English and user, custom and external content stays unchanged.
 

plugins/agent/native/README.zh-CN.md

@@ -72,7 +72,7 @@ Windows 命令须选择原生 `.exe`，或显式使用 `node.exe` 加 CLI 脚本
 
 Host 工具使用会话级本地 HTTP MCP endpoint，同一 Host 激活期间保持地址和私有配置路径稳定。每轮捕获不可变工具定义。本轮工具选择收紧时可保留公开定义以复用缓存，但不可用调用仍会被拒绝；新增工具或定义变化只在上一轮结算后刷新目录，不因描述或插件更新丢失原生会话身份。每个 invocation 使用新 bearer 和隔离的 MCP transport session，不共享调用权限。Codex 刷新 thread 级 `http_headers`；Claude 和 agy 在原配置路径原子刷新凭据。已关闭的凭据和旧 transport session 不能借用下一轮权限；已接受调用在取消或断连后仍归原 invocation 和原操作回执。空闲会话仅保留 endpoint、目录和配置，删除会话及 Host 关闭会在物理结算后释放。Host 重启会创建新 listener 和私有目录，并捕获当前目录，同时保留原生身份、已完成的初始化标记与说明交付摘要。凭据不出现在 argv 或日志中。
 
-启用工作区指令时，选中的全局 `AGENTS.md` 正文紧接内置身份介绍，仅用 `<global_instruction>` 和 `</global_instruction>` 包裹。优先使用 `~/.maka/AGENTS.md`，只有它不存在时才使用 `~/.agents/AGENTS.md`。其他全局和项目指令文件放在后面。指令在受理时捕获，恢复运行时保留原内容。Native 全局指令 API 读取和保存选中的完整 UTF-8 文件，提示词捕获不设独立的文件大小门槛。保存会检查选中的来源与内容 revision，再原子替换文件；助手编辑器使用共享的完整文本编辑与捕获路径。
+启用工作区指令时，选中的全局 `AGENTS.md` 正文紧接内置身份介绍，仅用 `<global_instruction>` 和 `</global_instruction>` 包裹。优先使用 `~/.maka/AGENTS.md`，只有它不存在时才使用 `~/.agents/AGENTS.md`。内置模型会话还会在后面追加其他全局和项目指令文件。外部 Codex、Claude 和 agy 会话只接收 Maka 身份、选中的全局偏好和 Maka 工具／技能说明（以及已配置的 Maka 角色）。CLI 自己发现并加载其原生全局和项目规则；Maka 不再将这些文件复制进注入块，也不关闭原生发现。工作区指令开关只控制 Maka 的采集，不控制 CLI 原生加载。Maka 指令在受理时捕获，恢复运行时保留原内容。Native 全局指令 API 读取和保存选中的完整 UTF-8 文件，提示词捕获不设独立的文件大小门槛。保存会检查选中的来源与内容 revision，再原子替换文件；助手编辑器使用共享的完整文本编辑与捕获路径。
 
 新指令按业务 Root 保存的语言偏好、组合配置语言、原生环境的顺序选择英文、简体中文或繁体中文；显式「自动」使用原生环境。一次策略快照同时决定内置指令、技能包装、默认摘要及运行指引的语言。工具 schema 保持英文，用户、自定义及外部内容保留原文。
 

plugins/agent/native/src/owner.rs

@@ -1469,8 +1469,12 @@ impl Owner {
             },
             behavior: self.bot_behavior(
                 &id,
-                self.capture_behavior(&session.configuration.workspace, &snapshot, language)
-                    .await?,
+                self.capture_behavior(
+                    (!host_bridge).then_some(&session.configuration.workspace),
+                    &snapshot,
+                    language,
+                )
+                .await?,
                 &snapshot,
                 language,
                 self.admitted_tools(&id, &session.configuration.tools)

plugins/agent/native/src/owner/assistant.rs

@@ -80,9 +80,10 @@ fn read(directory: &Dir, agents: bool) -> Vec<WorkspaceInstruction> {
 
 impl Owner {
     /// Capture once at message acceptance. Recovery replays the persisted basis.
+    /// Native CLIs own their rule files; omit the workspace to capture only Maka preferences.
     pub(super) async fn capture_behavior(
         &self,
-        workspace: &Workspace,
+        workspace: Option<&Workspace>,
         snapshot: &RuntimePolicySnapshot,
         language: Language,
     ) -> Result<Option<SystemPrompt>, String> {
@@ -107,19 +108,13 @@ impl Owner {
             workspace_instructions: snapshot.policy.workspace_instructions.enabled,
         };
         let (global_instruction, instructions) = if preferences.workspace_instructions {
-            let workspace = workspace.clone();
+            let workspace = workspace.cloned();
             let home = self.instruction_home.clone();
             tokio::task::spawn_blocking(move || {
-                let project = maka_fs_tools::workspace::open_directory(
-                    Path::new(&workspace.path),
-                    &workspace.identity,
-                )
-                .map_err(|_| "agent_workspace_unavailable")?;
                 let mut global_instruction = String::new();
-                let mut global = Vec::new();
-                if let Some(home) = home {
-                    if let Ok(source) = global_instructions::selected(&home)
-                        && let Ok(Some(text)) = global_instructions::read_selected(&home, source)
+                if let Some(home) = &home {
+                    if let Ok(source) = global_instructions::selected(home)
+                        && let Ok(Some(text)) = global_instructions::read_selected(home, source)
                     {
                         global_instruction = parse_instruction_files([(
                             InstructionFile::Agents,
@@ -129,10 +124,19 @@ impl Owner {
                         .map(|instruction| instruction.text)
                         .unwrap_or_default();
                     }
-                    if let Ok(directory) = home.open_dir(".maka") {
-                        global.extend(read(&directory, false));
-                    }
                 }
+                let Some(workspace) = workspace else {
+                    return Ok((global_instruction, String::new()));
+                };
+                let project = maka_fs_tools::workspace::open_directory(
+                    Path::new(&workspace.path),
+                    &workspace.identity,
+                )
+                .map_err(|_| "agent_workspace_unavailable")?;
+                let global = home
+                    .and_then(|home| home.open_dir(".maka").ok())
+                    .map(|directory| read(&directory, false))
+                    .unwrap_or_default();
                 Ok::<_, String>((
                     global_instruction,
                     maka_assistant::prompt::workspace::render(

plugins/agent/native/src/owner/notifications.rs

@@ -165,7 +165,7 @@ impl Owner {
             internal_bindings: selected_catalog.bindings.clone(),
             behavior: self.bot_behavior(
                 &source.session_id,
-                self.capture_behavior(&route.workspace, &snapshot, language)
+                self.capture_behavior(Some(&route.workspace), &snapshot, language)
                     .await?,
                 &snapshot,
                 language,

plugins/agent/native/src/owner/scheduler/dispatch.rs

@@ -182,7 +182,7 @@ impl Owner {
             internal_bindings: selected_catalog.bindings.clone(),
             behavior: self.bot_behavior(
                 &target.session_id,
-                self.capture_behavior(&session.configuration.workspace, &snapshot, language)
+                self.capture_behavior(Some(&session.configuration.workspace), &snapshot, language)
                     .await?,
                 &snapshot,
                 language,

plugins/agent/native/src/owner/tests/executor/external.rs

@@ -28,7 +28,11 @@ async fn native_external_all_protocols_persist_before_prompt_and_resume_original
         let (f, listener) = configured("http://127.0.0.1:9/v1", |settings| {
             settings.tools = vec![super::external_support::host_tool("observe", "SessionRead")];
             let home = settings.workspace_roots[0].path.clone();
-            std::fs::write(std::path::Path::new(&home).join("AGENTS.md"), "CAPTURED EXTERNAL GUIDANCE 中文").unwrap();
+            std::fs::create_dir(home.join(".maka")).unwrap();
+            std::fs::write(home.join(".maka/AGENTS.md"), "CAPTURED EXTERNAL GUIDANCE 中文").unwrap();
+            for name in ["CLAUDE.md", "GEMINI.md"] {
+                std::fs::write(home.join(".maka").join(name), "CLI GLOBAL RULES").unwrap();
+            }
             settings.assistant = Some(crate::contract::AssistantConfiguration { home: Some(home.to_str().unwrap().into()) });
             settings.external.as_mut().unwrap().commands.antigravity.as_mut().unwrap().env.insert("MAKA_NATIVE_FIXTURE_BOOTSTRAP_TOOL".into(), "1".into());
         }).await;
@@ -40,7 +44,10 @@ async fn native_external_all_protocols_persist_before_prompt_and_resume_original
             let mut original_operation = None;
             for round in 0..4 {
                 let guidance = if round < 2 { "CAPTURED EXTERNAL GUIDANCE 中文" } else { "UPDATED EXTERNAL GUIDANCE 中文" };
-                std::fs::write(f.workspace.join("AGENTS.md"), guidance).unwrap();
+                std::fs::write(f.workspace.join(".maka/AGENTS.md"), guidance).unwrap();
+                for name in ["AGENTS.md", "CLAUDE.md", "GEMINI.md"] {
+                    std::fs::write(f.workspace.join(name), format!("CLI PROJECT RULES {round}")).unwrap();
+                }
                 let operation = Uuid::new_v4();
                 let input = input_runtime(&session, runtime, "complete");
                 let accepted = f.mutation(2,"send",input.clone(),operation).await.unwrap();
@@ -65,7 +72,11 @@ async fn native_external_all_protocols_persist_before_prompt_and_resume_original
                     let instructions = opened["request"]["instructions"].as_str().unwrap();
                     assert!(instructions.starts_with("<maka_system_instructions>\n"));
                     assert!(instructions.ends_with("\n</maka_system_instructions>"));
-                    assert!(instructions.contains(guidance));
+                    assert!(instructions.contains("You are [Maka](https://github.com/apache/maka), an AI agent."));
+                    assert!(instructions.contains(&format!("<global_instruction>\n{guidance}\n</global_instruction>")));
+                    assert!(!instructions.contains("CLI GLOBAL RULES"));
+                    assert!(!instructions.contains("CLI PROJECT RULES"));
+                    assert!(!instructions.contains("<workspace-instructions"));
                     assert!(instructions.contains("replace all earlier Maka instruction blocks"));
                     if round == 2 {
                         assert!(!instructions.contains("CAPTURED EXTERNAL GUIDANCE"));

plugins/agent/native/src/owner/tests/executor/external_owner_regressions.rs

@@ -64,7 +64,10 @@ async fn external_skills_candidates_steering_and_queue_edits_use_the_same_bridge
             assert_eq!(page["skills"], json!([]), "autocomplete cannot grant LoadGuide");
             let first = f.mutation(2, "send", input_runtime(&session, runtime, "complete"), Uuid::new_v4()).await.unwrap();
             let mut control = BufReader::new(listener.accept().await.unwrap().0);
-            packet(&mut control, "opened").await;
+            let opened = packet(&mut control, "opened").await;
+            let instructions = opened["request"]["instructions"].as_str().unwrap();
+            assert!(instructions.contains("FindGuide") && instructions.contains("LoadGuide"));
+            assert!(instructions.contains("review"));
             let denied = f.mutation(2, "send", json!({"sessionId":session,"message":"/skill:native-only inspect"}), Uuid::new_v4()).await.unwrap();
             assert_eq!(denied["kind"], "rejected", "native tools must not be implicitly bridged: {denied}");
             let mut input = input_runtime(&session, runtime, "queued");

plugins/agent/native/src/owner/tests/settings.rs

@@ -335,22 +335,28 @@ async fn global_instruction_api_and_admission_share_one_selected_file() {
         assert_eq!(fallback["source"],"agents");
         assert_eq!(fallback["content"],"FALLBACK UNIQUE");
         assert_eq!(fallback["path"], home.join(".agents/AGENTS.md").to_str().unwrap());
-        let prompt = f.owner.capture_behavior(&workspace, &policy, language).await.unwrap().unwrap().text;
+        let prompt = f.owner.capture_behavior(Some(&workspace), &policy, language).await.unwrap().unwrap().text;
         assert!(prompt.starts_with("You are [Maka](https://github.com/apache/maka), an AI agent.\n\n<global_instruction>\nFALLBACK UNIQUE\n</global_instruction>\n\n"));
         assert_eq!(prompt.matches("FALLBACK UNIQUE").count(), 1);
         assert!(prompt.contains("<workspace-instructions file=\"CLAUDE.md\" scope=\"global\">\nOTHER GLOBAL GUIDANCE"));
         assert!(prompt.contains("<workspace-instructions file=\"AGENTS.md\" scope=\"project\">\nPROJECT GUIDANCE"));
         assert!(!prompt.contains("<workspace-instructions file=\"AGENTS.md\" scope=\"global\">"));
+        let external = f.owner.capture_behavior(None, &policy, language).await.unwrap().unwrap().text;
+        assert_eq!(external, "You are [Maka](https://github.com/apache/maka), an AI agent.\n\n<global_instruction>\nFALLBACK UNIQUE\n</global_instruction>");
+        assert_eq!(external.matches("FALLBACK UNIQUE").count(), 1);
+        assert!(!external.contains("GUIDANCE"));
+        assert!(!external.contains("<workspace-instructions"));
         let mut disabled = policy.clone();
         disabled.policy.workspace_instructions.enabled = false;
-        let without_instructions = f.owner.capture_behavior(&workspace, &disabled, language).await.unwrap().unwrap().text;
+        let without_instructions = f.owner.capture_behavior(Some(&workspace), &disabled, language).await.unwrap().unwrap().text;
         assert!(!without_instructions.contains("<global_instruction>"));
         assert!(!without_instructions.contains("GUIDANCE"));
+        assert_eq!(f.owner.capture_behavior(None, &disabled, language).await.unwrap().unwrap().text, without_instructions);
         std::fs::write(home.join(".maka/AGENTS.md"), "").unwrap();
         let empty = f.query("globalInstructions",json!({})).await.unwrap();
         assert_eq!(empty["source"],"maka");
         assert_eq!(empty["content"],"");
-        let prompt = f.owner.capture_behavior(&workspace, &policy, language).await.unwrap().unwrap().text;
+        let prompt = f.owner.capture_behavior(Some(&workspace), &policy, language).await.unwrap().unwrap().text;
         assert!(!prompt.contains("FALLBACK UNIQUE"));
         assert!(!prompt.contains("<global_instruction>"));
         let stale = f.mutation(2,"updateGlobalInstructions",json!({"source":fallback["source"],"revision":fallback["revision"],"content":"STALE"}),Uuid::new_v4()).await.unwrap();