feat(core): tighten the default system prompt (#120)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/core/test/state.test.ts

@@ -117,6 +117,9 @@ describe("loadOrInitAgentState", () => {
       // delegation entry point).
       expect(state.systemConfig.system_prompt).toContain("PenguinHarness");
       expect(state.systemConfig.system_prompt).not.toContain("exec_command");
+      // Personality pins the reply language to the user's own (the tool schema asks the same of
+      // every call description, so the two can't disagree).
+      expect(state.systemConfig.system_prompt).toContain("in the user's language");
       // Suggested workflows absorbs Subagent delegation and task conventions (self-reported
       // identity as a soft convention, parallelism, file exchange).
       expect(state.systemConfig.system_prompt).toContain("# Suggested workflows");
@@ -164,6 +167,13 @@ describe("loadOrInitAgentState", () => {
       expect(tpl).toContain("# Skills");
       expect(tpl).toContain(SKILL_METADATA_PLACEHOLDER);
       expect(tpl).toContain("[use_skills]");
+      // Tooling installs once into a shared per-Agent directory rather than per task, so a
+      // Session's scratchpad never becomes the home of a virtualenv. It governs every task, not
+      // just skill runs, so it belongs to # File system — pinned by position, since the rule
+      // reads as skills-only the moment it drifts back under # Skills.
+      expect(tpl).toContain("<app_data_dir>/agents/<agent_id>/shared_env/");
+      expect(tpl.indexOf("# File system")).toBeLessThan(tpl.indexOf("shared_env/"));
+      expect(tpl.indexOf("shared_env/")).toBeLessThan(tpl.indexOf("# Skills"));
       expect(tpl.indexOf("[/developer_instructions]")).toBeLessThan(tpl.indexOf("# Vault"));
       expect(tpl.indexOf("# Vault")).toBeLessThan(tpl.indexOf(VAULT_KEYS_PLACEHOLDER));
       expect(tpl.indexOf(VAULT_KEYS_PLACEHOLDER)).toBeLessThan(tpl.indexOf("# Skills"));
@@ -489,9 +499,13 @@ describe("assembleSystemPrompt", () => {
     expect(prompt).toContain("pick another free port");
     expect(prompt).toContain("PenguinHarness service port");
     expect(prompt).not.toContain("7364");
-    // Auth/key failures: retry at most once (Constraints), then stop and ask the user to update
-    // the key outside the chat (Stop rules) — no CLI commands, no secret values in the conversation.
-    expect(prompt).toContain("retry at most once");
+    // Auth/key failures live entirely in Stop rules, as a special case of the
+    // unresolvable-error rule: retry at most once, then stop and ask the user to update the key
+    // outside the chat — no CLI commands, no secret values in the conversation.
+    // Position, not presence: `# Stop rules` exists either way, so only the ordering pins that
+    // the retry rule sits inside that section instead of back up in Constraints.
+    expect(prompt.indexOf("# Stop rules")).toBeLessThan(prompt.indexOf("retry at most once"));
+    expect(prompt.indexOf("retry at most once")).toBeLessThan(prompt.indexOf("# Tool use"));
     expect(prompt).toContain("stop calling tools");
     expect(prompt).toContain("never be pasted into the conversation");
     expect(prompt).toContain("next conversation");