Fugu Agent Skill

<!-- elves-managed-alias: claude-skill-alias v1 -->

Fugu Task or Review

This is the Elves-managed Claude Code alias for

/fugu [--deep|--ultra|--max] [--max-wait SECONDS] [--preflight] [--write] [--include PATH] <task>

and

/fugu [--deep|--ultra|--max] [--max-wait SECONDS] [--preflight] review <scope>.

Load the installed elves skill's Provider shortcut protocols and

references/provider-shortcuts.md. Resolve scripts/run_fugu.sh from the active Elves skill root,

keep the target repository as the working directory, pass through the validated mode/profile/context,

and run it.

Host Fugu routing (required when the user omits a profile flag). Natural language "use Fugu"

or plain /fugu <task> is not always bare fugu/high. Before launch, decide and state one

short Fugu route: … line. Prefer the cheapest matching lane; explicit user flags always win.

Profile locks model + effort.

• Host-native first if rg/git/gh can finish in under a minute.
• Task mode: general (default) vs review <scope> when the user asked for a review/audit.
• Profile: first paid call is plain (fugu/high) unless the user set a flag. --deep only

after plain failed or for real multi-module/security xhigh need. Prefer --ultra over plain/deep

when the run must return a written report (reserved synthesis survives the wall; plain/deep

die empty on timeout). --max only for one already-tight high-stakes gate (Ultra/Max often run

20–60+ minutes). Prefer --max-wait over automatic --deep when you only need more wall.

• Write: read-only default; --write only with independent implementation authority on qualified

Linux bwrap PID-namespace (unavailable on macOS: say so in one line).

• Context: the isolation snapshot is always on. Put goal, paths, done-when, and out-of-scope in the

task string. Add exact --include PATH only for non-gitignored files; **if any include, run

--preflight first** and launch only when admitted. No separate "minimal snapshot" product.

• Capture: redirect to a log file (never | tail / | head). Chat cancel does not stop the

provider; wait up to the wall or kill the process group. On timeout/crash, harvest any

Fugu partial salvage markers before relaunch. Verify findings host-native; clean up handoffs

and leftover process groups (see references/fugu-calling-guide.md).

Full decision table, route templates, wait/poll contract, and field notes:

references/provider-shortcuts.md (Host routing when the user says "use Fugu") and

references/fugu-calling-guide.md.

Plain /fugu <task> is a general read-only task whose answer follows the request;

/fugu review <scope> is the opinionated read-only review. Use --write only when the user's

surrounding request independently authorizes implementation and the platform provides qualified

recursive Linux bwrap PID-namespace containment. It is unavailable on macOS today. A qualified

write edits solely inside the disposable kernel-isolated snapshot and returns a bounded mode-aware

audited handoff for host inspection, never an automatic checkout edit. Exact includes must be

admitted and copied; both .env.* and *.env names are excluded. Live writable-state limits

tolerate benign disappearing temporary subtrees and fail closed on other audit errors. macOS

read-only cleanup remains best-effort and never claims recursive containment.

The runner uses the official codex-fugu launcher with policy-admitted tracked and non-ignored

untracked context, closed interactive input, and a hard wall-clock bound. It selects regular

fugu/high when the host chooses plain, fugu/xhigh with --deep, fugu-ultra-v1.1/high with

--ultra, or fugu-ultra-v1.1/max with --max.

Regular/deep sessions are ephemeral; Ultra uses exact-session staged synthesis, with its state

confined to the disposable isolated lane, events carried by a bounded host-owned pipe, final

output pinned to a no-follow descriptor, and a final descriptor-safe writable-state audit after

each settled phase.

Do not replace it with an improvised API request or remove its sandbox and timeout controls.