feat: add CLI session sharing functionality

- Implemented share token creation and revocation for CLI sessions.
- Added a new page for viewing shared CLI sessions with SSE support.
- Introduced hooks for fetching and managing CLI session shares.
- Enhanced the IssueTerminalTab component to handle share tokens and display active shares.
- Updated API routes to support fetching and revoking share tokens.
- Added unit tests for the CLI session share manager and rate limiter.
- Updated localization files to include new strings for sharing functionality.

.ccw/workflows/cli-templates/prompts/rules-tech-rules-agent-prompt.txt

@@ -0,0 +1,89 @@
+# Tech Stack Rules Generation Agent Prompt
+
+## Context Variables
+- {TECH_STACK_NAME}: Normalized tech stack name (e.g., "typescript-react")
+- {PRIMARY_LANG}: Primary language (e.g., "typescript")
+- {FILE_EXT}: File extension pattern (e.g., "{ts,tsx}")
+- {FRAMEWORK_TYPE}: frontend | backend | fullstack | library
+- {COMPONENTS}: Array of tech components
+- {OUTPUT_DIR}: .claude/rules/tech/{TECH_STACK_NAME}/
+
+## Agent Instructions
+
+Generate path-conditional rules for Claude Code automatic loading.
+
+### Step 1: Execute Exa Research
+
+Run 4-6 parallel queries based on tech stack:
+
+**Base Queries** (always execute):
+```
+mcp__exa__get_code_context_exa(query: "{PRIMARY_LANG} best practices principles 2025", tokensNum: 8000)
+mcp__exa__get_code_context_exa(query: "{PRIMARY_LANG} implementation patterns examples", tokensNum: 7000)
+mcp__exa__get_code_context_exa(query: "{PRIMARY_LANG} testing strategies conventions", tokensNum: 5000)
+mcp__exa__web_search_exa(query: "{PRIMARY_LANG} configuration setup 2025", numResults: 5)
+```
+
+**Component Queries** (for each framework in COMPONENTS):
+```
+mcp__exa__get_code_context_exa(query: "{PRIMARY_LANG} {component} integration patterns", tokensNum: 5000)
+```
+
+### Step 2: Read Rule Templates
+
+Read each template file before generating content:
+```
+Read(~/.ccw/workflows/cli-templates/prompts/rules/rule-core.txt)
+Read(~/.ccw/workflows/cli-templates/prompts/rules/rule-patterns.txt)
+Read(~/.ccw/workflows/cli-templates/prompts/rules/rule-testing.txt)
+Read(~/.ccw/workflows/cli-templates/prompts/rules/rule-config.txt)
+Read(~/.ccw/workflows/cli-templates/prompts/rules/rule-api.txt)       # Only if backend/fullstack
+Read(~/.ccw/workflows/cli-templates/prompts/rules/rule-components.txt) # Only if frontend/fullstack
+```
+
+### Step 3: Generate Rule Files
+
+Create directory and write files:
+```bash
+mkdir -p "{OUTPUT_DIR}"
+```
+
+**Always Generate**:
+- core.md (from rule-core.txt template)
+- patterns.md (from rule-patterns.txt template)
+- testing.md (from rule-testing.txt template)
+- config.md (from rule-config.txt template)
+
+**Conditional**:
+- api.md: Only if FRAMEWORK_TYPE == 'backend' or 'fullstack'
+- components.md: Only if FRAMEWORK_TYPE == 'frontend' or 'fullstack'
+
+### Step 4: Write Metadata
+
+```json
+{
+  "tech_stack": "{TECH_STACK_NAME}",
+  "primary_lang": "{PRIMARY_LANG}",
+  "file_ext": "{FILE_EXT}",
+  "framework_type": "{FRAMEWORK_TYPE}",
+  "components": ["{COMPONENTS}"],
+  "generated_at": "{ISO_TIMESTAMP}",
+  "source": "exa-research",
+  "files_generated": ["core.md", "patterns.md", "testing.md", "config.md", ...]
+}
+```
+
+### Step 5: Report Completion
+
+Provide summary:
+- Files created with their path patterns
+- Exa queries executed (count)
+- Sources consulted (count)
+
+## Critical Requirements
+
+1. Every .md file MUST start with `paths` YAML frontmatter
+2. Use {FILE_EXT} consistently across all rule files
+3. Synthesize Exa research into actionable rules
+4. Include code examples from Exa sources
+5. Keep each file focused on its specific domain

.ccw/workflows/cli-templates/prompts/test-suggestions-enhancement.txt

@@ -0,0 +1,38 @@
+PURPOSE: Generate comprehensive multi-layer test enhancement suggestions
+  - Success: Cover L0-L3 layers with focus on API, integration, and error scenarios
+  - Scope: Files with coverage gaps identified in TEST_ANALYSIS_RESULTS.md
+  - Goal: Provide specific, actionable test case suggestions that increase coverage completeness
+
+TASK:
+  • L1 (Unit Tests): Suggest edge cases, boundary conditions, error paths, state transitions
+  • L2.1 (Integration): Suggest module interaction patterns, dependency injection scenarios
+  • L2.2 (API Contracts): Suggest request/response test cases, validation, status codes, error responses
+  • L2.4 (External APIs): Suggest mock strategies, failure scenarios, timeout handling, retry logic
+  • L2.5 (Failure Modes): Suggest exception hierarchies, error propagation, recovery strategies
+  • Cross-cutting: Suggest performance test cases, security considerations
+
+MODE: analysis
+
+CONTEXT: @.workflow/active/{test-session-id}/.process/TEST_ANALYSIS_RESULTS.md
+  Memory: Project type, test framework, existing test patterns, coverage gaps
+
+EXPECTED: Markdown report with structured test enhancement suggestions organized by:
+  1. File-level test requirements (per file needing tests)
+  2. Layer-specific test cases (L1, L2.1, L2.2, L2.4, L2.5)
+  3. Each suggestion includes:
+     - Test type and layer (e.g., "L2.2 API Contract Test")
+     - Specific test case description (e.g., "POST /api/users - Invalid email format")
+     - Expected behavior (e.g., "Returns 400 with validation error message")
+     - Dependencies/mocks needed (e.g., "Mock email service")
+     - Success criteria (e.g., "Status 400, error.field === 'email'")
+  4. Test ordering/dependencies (which tests should run first)
+  5. Integration test strategies (how components interact)
+  6. Error scenario matrix (all failure modes covered)
+
+CONSTRAINTS:
+  - Focus on identified coverage gaps from TEST_ANALYSIS_RESULTS.md
+  - Prioritize API tests, integration tests, and error scenarios
+  - No code generation - suggestions only with sufficient detail for implementation
+  - Consider project conventions and existing test patterns
+  - Each suggestion should be actionable and specific (not generic)
+  - Output format: Markdown with clear section headers

.ccw/workflows/cli-templates/prompts/workflow-codex-feasibility-validation.txt

@@ -0,0 +1,176 @@
+Validate technical feasibility and identify implementation risks for proposed solution design.
+
+## CORE CHECKLIST ⚡
+□ Read context-package.json and gemini-solution-design.md
+□ Assess complexity, validate technology choices
+□ Evaluate performance and security implications
+□ Focus on TECHNICAL FEASIBILITY and RISK ASSESSMENT
+□ Write output to specified .workflow/active/{session_id}/.process/ path
+
+## PREREQUISITE ANALYSIS
+
+### Required Input Files
+1. **context-package.json**: Task requirements, source files, tech stack
+2. **gemini-solution-design.md**: Proposed solution design and architecture
+3. **workflow-session.json**: Session state and context
+4. **CLAUDE.md**: Project standards and conventions
+
+### Analysis Dependencies
+- Review Gemini's proposed solution design
+- Validate against actual codebase capabilities
+- Assess implementation complexity realistically
+- Identify gaps between design and execution
+
+## REQUIRED VALIDATION
+
+### 1. Feasibility Assessment
+- **Complexity Rating**: Rate technical complexity (1-5 scale)
+  - 1: Trivial - straightforward implementation
+  - 2: Simple - well-known patterns
+  - 3: Moderate - some challenges
+  - 4: Complex - significant challenges
+  - 5: Very Complex - high risk, major unknowns
+
+- **Resource Requirements**: Estimate development effort
+  - Development time (hours/days/weeks)
+  - Required expertise level
+  - Infrastructure needs
+
+- **Technology Compatibility**: Validate proposed tech stack
+  - Framework version compatibility
+  - Library maturity and support
+  - Integration with existing systems
+
+### 2. Risk Analysis
+- **Implementation Risks**: Technical challenges and blockers
+  - Unknown implementation patterns
+  - Missing capabilities or APIs
+  - Breaking changes to existing code
+
+- **Integration Challenges**: System integration concerns
+  - Data format compatibility
+  - API contract changes
+  - Dependency conflicts
+
+- **Performance Concerns**: Performance and scalability risks
+  - Resource consumption (CPU, memory, I/O)
+  - Latency and throughput impact
+  - Caching and optimization needs
+
+- **Security Concerns**: Security vulnerabilities and threats
+  - Authentication/authorization gaps
+  - Data exposure risks
+  - Compliance violations
+
+### 3. Implementation Validation
+- **Development Approach**: Validate proposed implementation strategy
+  - Verify module dependency order
+  - Assess incremental development feasibility
+  - Evaluate testing approach
+
+- **Quality Standards**: Validate quality requirements
+  - Test coverage achievability
+  - Performance benchmark realism
+  - Documentation completeness
+
+- **Maintenance Implications**: Long-term sustainability
+  - Code maintainability assessment
+  - Technical debt evaluation
+  - Evolution and extensibility
+
+### 4. Code Target Verification
+Review Gemini's proposed code targets:
+- **Validate existing targets**: Confirm file:function:lines exist
+- **Assess new file targets**: Evaluate necessity and placement
+- **Identify missing targets**: Suggest additional modification points
+- **Refine target specifications**: Provide more precise line numbers if possible
+
+### 5. Recommendations
+- **Must-Have Requirements**: Critical requirements for success
+- **Optimization Opportunities**: Performance and quality improvements
+- **Security Controls**: Essential security measures
+- **Risk Mitigation**: Strategies to reduce identified risks
+
+## OUTPUT REQUIREMENTS
+
+### Output File
+**Path**: `.workflow/active/{session_id}/.process/codex-feasibility-validation.md`
+**Format**: Follow structure from `~/.ccw/workflows/cli-templates/prompts/workflow/analysis-results-structure.txt`
+
+### Required Sections
+Focus on these sections from the template:
+- Executive Summary (with Codex perspective)
+- Current State Analysis (validation findings)
+- Implementation Strategy (feasibility assessment)
+- Solution Optimization (risk mitigation)
+- Confidence Scores (technical feasibility focus)
+
+### Content Guidelines
+- ✅ Focus on technical feasibility and risk assessment
+- ✅ Verify code targets from Gemini's design
+- ✅ Provide concrete risk mitigation strategies
+- ✅ Quantify complexity and effort estimates
+- ❌ Do NOT create task breakdowns
+- ❌ Do NOT provide step-by-step implementation guides
+- ❌ Do NOT include code examples
+
+## VALIDATION METHODOLOGY
+
+### Complexity Scoring
+Rate each aspect on 1-5 scale:
+- Technical Complexity
+- Integration Complexity
+- Performance Risk
+- Security Risk
+- Maintenance Burden
+
+### Risk Classification
+- **LOW**: Minor issues, easily addressable
+- **MEDIUM**: Manageable challenges with clear mitigation
+- **HIGH**: Significant concerns requiring major mitigation
+- **CRITICAL**: Fundamental viability threats
+
+### Feasibility Judgment
+- **PROCEED**: Technically feasible with acceptable risk
+- **PROCEED_WITH_MODIFICATIONS**: Feasible but needs adjustments
+- **RECONSIDER**: High risk, major changes needed
+- **REJECT**: Not feasible with current approach
+
+## CONTEXT INTEGRATION
+
+### Gemini Analysis Integration
+- Review proposed architecture and design decisions
+- Validate assumptions and technology choices
+- Cross-check code targets against actual codebase
+- Assess realism of performance targets
+
+### Codebase Reality Check
+- Verify existing code capabilities
+- Identify actual technical constraints
+- Assess team skill compatibility
+- Evaluate infrastructure readiness
+
+### Session Context
+- Consider session history and previous decisions
+- Align with project architecture standards
+- Respect existing patterns and conventions
+
+## EXECUTION MODE
+
+**Mode**: Analysis with write permission for output file
+**CLI Tool**: Codex with --skip-git-repo-check -s danger-full-access
+**Timeout**: 60-90 minutes for complex tasks
+**Output**: Single file codex-feasibility-validation.md
+**Trigger**: Only for complex tasks (>6 modules)
+
+## VERIFICATION CHECKLIST ✓
+□ context-package.json and gemini-solution-design.md read
+□ Complexity rated on 1-5 scale with justification
+□ All risk categories assessed (technical, integration, performance, security)
+□ Code targets verified and refined
+□ Risk mitigation strategies provided
+□ Resource requirements estimated
+□ Final feasibility judgment (PROCEED/RECONSIDER/REJECT)
+□ Output written to .workflow/active/{session_id}/.process/codex-feasibility-validation.md
+
+Focus: Technical feasibility validation with realistic risk assessment and mitigation strategies.

.ccw/workflows/cli-templates/prompts/workflow-gemini-solution-design.txt

@@ -0,0 +1,131 @@
+Analyze and design optimal solution with comprehensive architecture evaluation and design decisions.
+
+## CORE CHECKLIST ⚡
+□ Read context-package.json to understand task requirements, source files, tech stack
+□ Analyze current architecture patterns and code structure
+□ Propose solution design with key decisions and rationale
+□ Focus on SOLUTION IMPROVEMENTS and KEY DESIGN DECISIONS
+□ Write output to specified .workflow/active/{session_id}/.process/ path
+
+## ANALYSIS PRIORITY
+
+### Source Hierarchy
+1. **PRIMARY**: Individual role analysis.md files (system-architect, ui-designer, data-architect, etc.)
+   - Technical details and implementation considerations
+   - Architecture Decision Records (ADRs)
+   - Design decision context and rationale
+
+2. **SECONDARY**: role analysis documents
+   - Integrated requirements across roles
+   - Cross-role alignment and dependencies
+   - Unified feature specifications
+
+3. **REFERENCE**: guidance-specification.md
+   - Discussion context and background
+   - Initial problem framing
+
+## REQUIRED ANALYSIS
+
+### 1. Current State Assessment
+- Identify existing architectural patterns and code structure
+- Map integration points and dependencies
+- Evaluate technical debt and pain points
+- Assess framework compatibility and constraints
+
+### 2. Solution Design
+- Propose core architecture principles and approach
+- Design component architecture and data flow
+- Specify API contracts and integration strategy
+- Define technology stack with justification
+
+### 3. Key Design Decisions
+For each critical decision:
+- **Decision**: What is being decided
+- **Rationale**: Why this approach
+- **Alternatives Considered**: Other options and their tradeoffs
+- **Impact**: Implications on architecture, performance, maintainability
+
+Minimum 2 key decisions required.
+
+### 4. Code Modification Targets
+Identify specific code locations for changes:
+- **Existing files**: `file:function:lines` format (e.g., `src/auth/login.ts:validateUser:45-52`)
+- **New files**: `file` only (e.g., `src/auth/PasswordReset.ts`)
+- **Unknown lines**: `file:function:*` (e.g., `src/auth/service.ts:refreshToken:*`)
+
+For each target:
+- Type: Modify existing | Create new
+- Modification/Purpose: What changes needed
+- Rationale: Why this target
+
+### 5. Critical Insights
+- Strengths: What works well in current/proposed design
+- Gaps: Missing capabilities or concerns
+- Risks: Technical, integration, performance, security
+- Optimization Opportunities: Performance, security, code quality
+
+### 6. Feasibility Assessment
+- Technical Complexity: Rating and analysis
+- Performance Impact: Expected characteristics
+- Resource Requirements: Development effort
+- Maintenance Burden: Ongoing considerations
+
+## OUTPUT REQUIREMENTS
+
+### Output File
+**Path**: `.workflow/active/{session_id}/.process/gemini-solution-design.md`
+**Format**: Follow structure from `~/.ccw/workflows/cli-templates/prompts/workflow/analysis-results-structure.txt`
+
+### Required Sections
+- Executive Summary with feasibility score
+- Current State Analysis
+- Proposed Solution Design with 2+ key decisions
+- Implementation Strategy with code targets
+- Solution Optimization (performance, security, quality)
+- Critical Success Factors
+- Confidence Scores with recommendation
+
+### Content Guidelines
+- ✅ Focus on solution improvements and key design decisions
+- ✅ Include rationale, alternatives, and tradeoffs for decisions
+- ✅ Provide specific code targets in correct format
+- ✅ Quantify assessments with scores (X/5)
+- ❌ Do NOT create task lists or implementation steps
+- ❌ Do NOT include code examples or snippets
+- ❌ Do NOT create project management timelines
+
+## CONTEXT INTEGRATION
+
+### Session Context
+- Load context-package.json for task requirements
+- Reference workflow-session.json for session state
+- Review CLAUDE.md for project standards
+
+### Brainstorm Context
+If brainstorming artifacts exist:
+- Prioritize individual role analysis.md files
+- Use role analysis documents for integrated view
+- Reference guidance-specification.md for context
+
+### Codebase Context
+- Identify similar patterns in existing code
+- Evaluate success/failure of current approaches
+- Ensure consistency with project architecture
+
+## EXECUTION MODE
+
+**Mode**: Analysis with write permission for output file
+**CLI Tool**: Gemini wrapper with --approval-mode yolo
+**Timeout**: 40-60 minutes based on complexity
+**Output**: Single file gemini-solution-design.md
+
+## VERIFICATION CHECKLIST ✓
+□ context-package.json read and analyzed
+□ All 7 required sections present in output
+□ 2+ key design decisions with rationale and alternatives
+□ Code targets specified in correct format
+□ Feasibility scores provided (X/5)
+□ Final recommendation (PROCEED/RECONSIDER/REJECT)
+□ Output written to .workflow/active/{session_id}/.process/gemini-solution-design.md
+
+Focus: Comprehensive solution design emphasizing architecture decisions and critical insights.

.ccw/workflows/cli-templates/schemas/plan-verify-agent-schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Plan Verification Agent Schema",
+  "description": "Defines dimensions, severity rules, and CLI templates for plan verification agent",
+
+  "dimensions": {
+    "A": { "name": "User Intent Alignment", "tier": 1, "severity": "CRITICAL",
+           "checks": ["Goal Alignment", "Scope Drift", "Success Criteria Match", "Intent Conflicts"] },
+    "B": { "name": "Requirements Coverage", "tier": 1, "severity": "CRITICAL",
+           "checks": ["Orphaned Requirements", "Unmapped Tasks", "NFR Coverage Gaps"] },
+    "C": { "name": "Consistency Validation", "tier": 1, "severity": "CRITICAL",
+           "checks": ["Requirement Conflicts", "Architecture Drift", "Terminology Drift", "Data Model Inconsistency"] },
+    "D": { "name": "Dependency Integrity", "tier": 2, "severity": "HIGH",
+           "checks": ["Circular Dependencies", "Missing Dependencies", "Broken Dependencies", "Logical Ordering"] },
+    "E": { "name": "Synthesis Alignment", "tier": 2, "severity": "HIGH",
+           "checks": ["Priority Conflicts", "Success Criteria Mismatch", "Risk Mitigation Gaps"] },
+    "F": { "name": "Task Specification Quality", "tier": 3, "severity": "MEDIUM",
+           "checks": ["Ambiguous Focus Paths", "Underspecified Acceptance", "Missing Artifacts", "Weak Flow Control"] },
+    "G": { "name": "Duplication Detection", "tier": 4, "severity": "LOW",
+           "checks": ["Overlapping Task Scope", "Redundant Coverage"] },
+    "H": { "name": "Feasibility Assessment", "tier": 4, "severity": "LOW",
+           "checks": ["Complexity Misalignment", "Resource Conflicts", "Skill Gap Risks"] },
+    "I": { "name": "Constraints Compliance", "tier": 1, "severity": "CRITICAL",
+           "checks": ["Consolidated Constraints Violation", "Phase Constraint Ignored", "User Constraint Override"] },
+    "J": { "name": "N+1 Context Validation", "tier": 2, "severity": "HIGH",
+           "checks": ["Deferred Item Included", "Decision Contradiction", "Revisit Flag Ignored"] }
+  },
+
+  "tiers": {
+    "1": { "dimensions": ["A", "B", "C", "I"], "priority": "CRITICAL", "limit": null, "rule": "analysis-review-architecture" },
+    "2": { "dimensions": ["D", "E", "J"], "priority": "HIGH", "limit": 15, "rule": "analysis-diagnose-bug-root-cause" },
+    "3": { "dimensions": ["F"], "priority": "MEDIUM", "limit": 20, "rule": "analysis-analyze-code-patterns" },
+    "4": { "dimensions": ["G", "H"], "priority": "LOW", "limit": 15, "rule": "analysis-analyze-code-patterns" }
+  },
+
+  "severity_rules": {
+    "CRITICAL": ["User intent violation", "Synthesis authority violation", "Zero coverage", "Circular/broken deps", "Constraint violation"],
+    "HIGH": ["NFR gaps", "Priority conflicts", "Missing risk mitigation", "Deferred item included", "Decision contradiction"],
+    "MEDIUM": ["Terminology drift", "Missing refs", "Weak flow control"],
+    "LOW": ["Style improvements", "Minor redundancy"]
+  },
+
+  "quality_gate": {
+    "BLOCK_EXECUTION": { "condition": "critical > 0", "emoji": "🛑" },
+    "PROCEED_WITH_FIXES": { "condition": "critical == 0 && high > 0", "emoji": "⚠️" },
+    "PROCEED_WITH_CAUTION": { "condition": "critical == 0 && high == 0 && medium > 0", "emoji": "✅" },
+    "PROCEED": { "condition": "only low or none", "emoji": "✅" }
+  },
+
+  "token_budget": { "total_findings": 50, "early_exit": "CRITICAL > 0 in Tier 1 → skip Tier 3-4" }
+}

.ccw/workflows/cli-templates/schemas/verify-json-schema.json

@@ -0,0 +1,158 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Plan Verification Findings Schema",
+  "description": "Schema for plan verification findings output from cli-explore-agent",
+  "type": "object",
+  "required": [
+    "session_id",
+    "timestamp",
+    "verification_tiers_completed",
+    "findings",
+    "summary"
+  ],
+  "properties": {
+    "session_id": {
+      "type": "string",
+      "description": "Workflow session ID (e.g., WFS-20250127-143000)",
+      "pattern": "^WFS-[0-9]{8}-[0-9]{6}$"
+    },
+    "timestamp": {
+      "type": "string",
+      "description": "ISO 8601 timestamp when verification was completed",
+      "format": "date-time"
+    },
+    "verification_tiers_completed": {
+      "type": "array",
+      "description": "List of verification tiers completed (e.g., ['Tier 1', 'Tier 2'])",
+      "items": {
+        "type": "string",
+        "enum": ["Tier 1", "Tier 2", "Tier 3", "Tier 4"]
+      },
+      "minItems": 1,
+      "maxItems": 4
+    },
+    "findings": {
+      "type": "array",
+      "description": "Array of all findings across all dimensions",
+      "items": {
+        "type": "object",
+        "required": [
+          "id",
+          "dimension",
+          "dimension_name",
+          "severity",
+          "location",
+          "summary",
+          "recommendation"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Unique finding ID prefixed by severity (C1, H1, M1, L1)",
+            "pattern": "^[CHML][0-9]+$"
+          },
+          "dimension": {
+            "type": "string",
+            "description": "Verification dimension identifier",
+            "enum": ["A", "B", "C", "D", "E", "F", "G", "H"]
+          },
+          "dimension_name": {
+            "type": "string",
+            "description": "Human-readable dimension name",
+            "enum": [
+              "User Intent Alignment",
+              "Requirements Coverage Analysis",
+              "Consistency Validation",
+              "Dependency Integrity",
+              "Synthesis Alignment",
+              "Task Specification Quality",
+              "Duplication Detection",
+              "Feasibility Assessment"
+            ]
+          },
+          "severity": {
+            "type": "string",
+            "description": "Severity level of the finding",
+            "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
+          },
+          "location": {
+            "type": "array",
+            "description": "Array of locations where issue was found (e.g., 'IMPL_PLAN.md:L45', 'task:IMPL-1.2', 'synthesis:FR-03')",
+            "items": {
+              "type": "string"
+            },
+            "minItems": 1
+          },
+          "summary": {
+            "type": "string",
+            "description": "Concise summary of the issue (1-2 sentences)",
+            "minLength": 10,
+            "maxLength": 500
+          },
+          "recommendation": {
+            "type": "string",
+            "description": "Actionable recommendation to resolve the issue",
+            "minLength": 10,
+            "maxLength": 500
+          }
+        }
+      }
+    },
+    "summary": {
+      "type": "object",
+      "description": "Aggregate summary of verification results",
+      "required": [
+        "critical_count",
+        "high_count",
+        "medium_count",
+        "low_count",
+        "total_findings",
+        "coverage_percentage",
+        "recommendation"
+      ],
+      "properties": {
+        "critical_count": {
+          "type": "integer",
+          "description": "Number of critical severity findings",
+          "minimum": 0
+        },
+        "high_count": {
+          "type": "integer",
+          "description": "Number of high severity findings",
+          "minimum": 0
+        },
+        "medium_count": {
+          "type": "integer",
+          "description": "Number of medium severity findings",
+          "minimum": 0
+        },
+        "low_count": {
+          "type": "integer",
+          "description": "Number of low severity findings",
+          "minimum": 0
+        },
+        "total_findings": {
+          "type": "integer",
+          "description": "Total number of findings",
+          "minimum": 0
+        },
+        "coverage_percentage": {
+          "type": "number",
+          "description": "Percentage of synthesis requirements covered by tasks (0-100)",
+          "minimum": 0,
+          "maximum": 100
+        },
+        "recommendation": {
+          "type": "string",
+          "description": "Quality gate recommendation",
+          "enum": [
+            "BLOCK_EXECUTION",
+            "PROCEED_WITH_FIXES",
+            "PROCEED_WITH_CAUTION",
+            "PROCEED"
+          ]
+        }
+      }
+    }
+  }
+}

.ccw/workflows/cli-tools-usage.md

@@ -0,0 +1,538 @@
+# CLI Tools Execution Specification
+
+## Table of Contents
+1. [Configuration Reference](#configuration-reference)
+2. [Tool Selection](#tool-selection)
+3. [Prompt Template](#prompt-template)
+4. [CLI Execution](#cli-execution)
+5. [Auto-Invoke Triggers](#auto-invoke-triggers)
+6. [Best Practices](#best-practices)
+
+---
+
+## Configuration Reference
+
+### Configuration File
+
+**Path**: `~/.claude/cli-tools.json`
+
+All tool availability, model selection, and routing are defined in this configuration file.
+
+### Configuration Fields
+
+| Field | Description |
+|-------|-------------|
+| `enabled` | Tool availability status |
+| `primaryModel` | Default model for the tool |
+| `secondaryModel` | Fallback model |
+| `tags` | Capability tags for routing |
+
+### Tool Types
+
+| Type | Usage | Capabilities |
+|------|-------|--------------|
+| `builtin` | `--tool gemini` | Full (analysis + write tools) |
+| `cli-wrapper` | `--tool doubao` | Full (analysis + write tools) |
+| `api-endpoint` | `--tool g25` | **Analysis only** (no file write tools) |
+
+> **Note**: `api-endpoint` tools only support analysis and code generation responses. They cannot create, modify, or delete files.
+
+---
+
+## Tool Selection
+
+### Tag-Based Routing
+
+Tools are selected based on **tags** defined in the configuration. Use tags to match task requirements to tool capabilities.
+
+#### Common Tags
+
+| Tag | Use Case |
+|-----|----------|
+| `analysis` | Code review, architecture analysis, exploration |
+| `implementation` | Feature development, bug fixes |
+| `documentation` | Doc generation, comments |
+| `testing` | Test creation, coverage analysis |
+| `refactoring` | Code restructuring |
+| `security` | Security audits, vulnerability scanning |
+
+### Selection Algorithm
+
+```
+1. Parse task intent → extract required capabilities
+2. Load cli-tools.json → get enabled tools with tags
+3. Match tags → filter tools supporting required capabilities
+4. Select tool → choose by priority (explicit > tag-match > default)
+5. Select model → use primaryModel, fallback to secondaryModel
+```
+
+### Selection Decision Tree
+
+```
+┌─ Explicit --tool specified?
+│  └─→ YES: Use specified tool (validate enabled)
+│
+└─ NO: Tag-based selection
+   ├─ Task requires tags?
+   │  └─→ Match tools with matching tags
+   │     └─→ Multiple matches? Use first enabled
+   │
+   └─ No tag match?
+      └─→ Use default tool (first enabled in config)
+```
+
+### Command Structure
+
+```bash
+# Explicit tool selection
+ccw cli -p "<PROMPT>" --tool <tool-id> --mode <analysis|write|review>
+
+# Model override
+ccw cli -p "<PROMPT>" --tool <tool-id> --model <model-id> --mode <analysis|write>
+
+# Code review (codex only)
+ccw cli -p "<PROMPT>" --tool codex --mode review
+
+# Tag-based auto-selection (future)
+ccw cli -p "<PROMPT>" --tags <tag1,tag2> --mode <analysis|write>
+```
+
+### Tool Fallback Chain
+
+When primary tool fails or is unavailable:
+1. Check `secondaryModel` for same tool
+2. Try next enabled tool with matching tags
+3. Fall back to default enabled tool
+
+---
+
+## Prompt Template
+
+### Universal Prompt Template
+
+```bash
+ccw cli -p "PURPOSE: [what] + [why] + [success criteria] + [constraints/scope]
+TASK: • [step 1: specific action] • [step 2: specific action] • [step 3: specific action]
+MODE: [analysis|write]
+CONTEXT: @[file patterns] | Memory: [session/tech/module context]
+EXPECTED: [deliverable format] + [quality criteria] + [structure requirements]
+CONSTRAINTS: [domain constraints]" --tool <tool-id> --mode <analysis|write> --rule <category-template>
+```
+
+### Intent Capture Checklist (Before CLI Execution)
+
+**⚠️ CRITICAL**: Before executing any CLI command, verify these intent dimensions:
+
+**Intent Validation Questions**:
+- [ ] Is the objective specific and measurable?
+- [ ] Are success criteria defined?
+- [ ] Is the scope clearly bounded?
+- [ ] Are constraints and limitations stated?
+- [ ] Is the expected output format clear?
+- [ ] Is the action level (read/write) explicit?
+
+### Template Structure
+
+Every command MUST include these fields:
+
+- **PURPOSE**
+  - Purpose: Goal + motivation + success
+  - Components: What + Why + Success Criteria + Constraints
+  - Bad Example: "Analyze code"
+  - Good Example: "Identify security vulnerabilities in auth module to pass compliance audit; success = all OWASP Top 10 addressed; scope = src/auth/** only"
+
+- **TASK**
+  - Purpose: Actionable steps
+  - Components: Specific verbs + targets
+  - Bad Example: "• Review code • Find issues"
+  - Good Example: "• Scan for SQL injection in query builders • Check XSS in template rendering • Verify CSRF token validation"
+
+- **MODE**
+  - Purpose: Permission level
+  - Components: analysis / write / auto
+  - Bad Example: (missing)
+  - Good Example: "analysis" or "write"
+
+- **CONTEXT**
+  - Purpose: File scope + history
+  - Components: File patterns + Memory
+  - Bad Example: "@**/*"
+  - Good Example: "@src/auth/**/*.ts @shared/utils/security.ts \| Memory: Previous auth refactoring (WFS-001)"
+
+- **EXPECTED**
+  - Purpose: Output specification
+  - Components: Format + Quality + Structure
+  - Bad Example: "Report"
+  - Good Example: "Markdown report with: severity levels (Critical/High/Medium/Low), file:line references, remediation code snippets, priority ranking"
+
+- **CONSTRAINTS**
+  - Purpose: Domain-specific constraints
+  - Components: Scope limits, special requirements, focus areas
+  - Bad Example: (missing or too vague)
+  - Good Example: "Focus on authentication | Ignore test files | No breaking changes"
+
+### CONTEXT Configuration
+
+**Format**: `CONTEXT: [file patterns] | Memory: [memory context]`
+
+#### File Patterns
+
+- **`@**/*`**: All files (default)
+- **`@src/**/*.ts`**: TypeScript in src
+- **`@../shared/**/*`**: Sibling directory (requires `--includeDirs`)
+- **`@CLAUDE.md`**: Specific file
+
+#### Memory Context
+
+Include when building on previous work:
+
+```bash
+# Cross-task reference
+Memory: Building on auth refactoring (commit abc123), implementing refresh tokens
+
+# Cross-module integration
+Memory: Integration with auth module, using shared error patterns from @shared/utils/errors.ts
+```
+
+**Memory Sources**:
+- **Related Tasks**: Previous refactoring, extensions, conflict resolution
+- **Tech Stack Patterns**: Framework conventions, security guidelines
+- **Cross-Module References**: Integration points, shared utilities, type dependencies
+
+#### Pattern Discovery Workflow
+
+For complex requirements, discover files BEFORE CLI execution:
+
+```bash
+# Step 1: Discover files (choose one method)
+# Method A: ACE semantic search (recommended)
+mcp__ace-tool__search_context(project_root_path="/path", query="React components with export")
+
+# Method B: Ripgrep pattern search
+rg "export.*Component" --files-with-matches --type ts
+
+# Step 2: Build CONTEXT
+CONTEXT: @components/Auth.tsx @types/auth.d.ts | Memory: Previous type refactoring
+
+# Step 3: Execute CLI
+ccw cli -p "..." --tool <tool-id> --mode analysis --cd src
+```
+
+### --rule Configuration
+
+**Use `--rule` option to auto-load templates**:
+
+```bash
+ccw cli -p "..." --tool gemini --mode analysis --rule analysis-review-architecture
+```
+
+### Mode Protocol References
+
+**`--rule` auto-loads Protocol based on mode**:
+- `--mode analysis` → analysis-protocol.md
+- `--mode write` → write-protocol.md
+
+**Protocol Mapping**:
+
+- **`analysis`** mode
+  - Permission: Read-only
+  - Constraint: No file create/modify/delete
+
+- **`write`** mode
+  - Permission: Create/Modify/Delete files
+  - Constraint: Full workflow execution
+
+### Template System
+
+**Available `--rule` template names**:
+
+**Universal**:
+- `universal-rigorous-style` - Precise tasks
+- `universal-creative-style` - Exploratory tasks
+
+**Analysis**:
+- `analysis-trace-code-execution` - Execution tracing
+- `analysis-diagnose-bug-root-cause` - Bug diagnosis
+- `analysis-analyze-code-patterns` - Code patterns
+- `analysis-analyze-technical-document` - Document analysis
+- `analysis-review-architecture` - Architecture review
+- `analysis-review-code-quality` - Code review
+- `analysis-analyze-performance` - Performance analysis
+- `analysis-assess-security-risks` - Security assessment
+
+**Planning**:
+- `planning-plan-architecture-design` - Architecture design
+- `planning-breakdown-task-steps` - Task breakdown
+- `planning-design-component-spec` - Component design
+- `planning-plan-migration-strategy` - Migration strategy
+
+**Development**:
+- `development-implement-feature` - Feature implementation
+- `development-refactor-codebase` - Code refactoring
+- `development-generate-tests` - Test generation
+- `development-implement-component-ui` - UI component
+- `development-debug-runtime-issues` - Runtime debugging
+
+---
+
+## CLI Execution
+
+### MODE Options
+
+- **`analysis`**
+  - Permission: Read-only
+  - Use For: Code review, architecture analysis, pattern discovery, exploration
+  - Specification: Safe for all tools
+
+- **`write`**
+  - Permission: Create/Modify/Delete
+  - Use For: Feature implementation, bug fixes, documentation, code creation, file modifications
+  - Specification: Requires explicit `--mode write`
+
+- **`review`**
+  - Permission: Read-only (code review output)
+  - Use For: Git-aware code review of uncommitted changes, branch diffs, specific commits
+  - Specification: **codex only** - uses `codex review` subcommand
+  - Tool Behavior:
+    - `codex`: Executes `codex review` for structured code review
+    - Other tools (gemini/qwen/claude): Accept mode but no operation change (treated as analysis)
+  - **Constraint**: Target flags (`--uncommitted`, `--base`, `--commit`) and prompt are mutually exclusive
+    - With prompt only: `ccw cli -p "Focus on security" --tool codex --mode review` (reviews uncommitted by default)
+    - With target flag only: `ccw cli --tool codex --mode review --commit abc123` (no prompt allowed)
+
+### Command Options
+
+- **`--tool <tool>`**
+  - Description: Tool from config (e.g., gemini, qwen, codex)
+  - Default: First enabled tool in config
+
+- **`--mode <mode>`**
+  - Description: **REQUIRED**: analysis, write, review
+  - Default: **NONE** (must specify)
+  - Note: `review` mode triggers `codex review` subcommand for codex tool only
+
+- **`--model <model>`**
+  - Description: Model override
+  - Default: Tool's primaryModel from config
+
+- **`--cd <path>`**
+  - Description: Working directory
+  - Default: current
+
+- **`--includeDirs <dirs>`**
+  - Description: Additional directories (comma-separated)
+  - Default: none
+
+- **`--resume [id]`**
+  - Description: Resume previous session
+  - Default: -
+
+- **`--rule <template>`**
+  - Description: Template name, auto-loads protocol + template appended to prompt
+  - Default: universal-rigorous-style
+  - Auto-selects protocol based on --mode
+
+### Directory Configuration
+
+#### Working Directory (`--cd`)
+
+When using `--cd`:
+- `@**/*` = Files within working directory tree only
+- CANNOT reference parent/sibling via @ alone
+- Must use `--includeDirs` for external directories
+
+#### Include Directories (`--includeDirs`)
+
+**TWO-STEP requirement for external files**:
+1. Add `--includeDirs` parameter
+2. Reference in CONTEXT with @ patterns
+
+```bash
+# Single directory
+ccw cli -p "CONTEXT: @**/* @../shared/**/*" --tool <tool-id> --mode analysis --cd src/auth --includeDirs ../shared
+
+# Multiple directories
+ccw cli -p "..." --tool <tool-id> --mode analysis --cd src/auth --includeDirs ../shared,../types,../utils
+```
+
+**Rule**: If CONTEXT contains `@../dir/**/*`, MUST include `--includeDirs ../dir`
+
+**Benefits**: Excludes unrelated directories, reduces token usage
+
+### Session Resume
+
+**When to Use**:
+- Multi-round planning (analysis → planning → implementation)
+- Multi-model collaboration (tool A → tool B on same topic)
+- Topic continuity (building on previous findings)
+
+**Usage**:
+
+```bash
+ccw cli -p "Continue analyzing" --tool <tool-id> --mode analysis --resume              # Resume last
+ccw cli -p "Fix issues found" --tool <tool-id> --mode write --resume <id>              # Resume specific
+ccw cli -p "Merge findings" --tool <tool-id> --mode analysis --resume <id1>,<id2>      # Merge multiple
+```
+
+- **`--resume`**: Last session
+- **`--resume <id>`**: Specific session
+- **`--resume <id1>,<id2>`**: Merge sessions (comma-separated)
+
+**Context Assembly** (automatic):
+```
+=== PREVIOUS CONVERSATION ===
+USER PROMPT: [Previous prompt]
+ASSISTANT RESPONSE: [Previous output]
+=== CONTINUATION ===
+[Your new prompt]
+```
+
+### Command Examples
+
+#### Task-Type Specific Templates
+
+**Analysis Task** (Security Audit):
+```bash
+ccw cli -p "PURPOSE: Identify OWASP Top 10 vulnerabilities in authentication module to pass security audit; success = all critical/high issues documented with remediation
+TASK: • Scan for injection flaws (SQL, command, LDAP) • Check authentication bypass vectors • Evaluate session management • Assess sensitive data exposure
+MODE: analysis
+CONTEXT: @src/auth/**/* @src/middleware/auth.ts | Memory: Using bcrypt for passwords, JWT for sessions
+EXPECTED: Security report with: severity matrix, file:line references, CVE mappings where applicable, remediation code snippets prioritized by risk
+CONSTRAINTS: Focus on authentication | Ignore test files
+" --tool gemini --mode analysis --rule analysis-assess-security-risks --cd src/auth
+```
+
+**Implementation Task** (New Feature):
+```bash
+ccw cli -p "PURPOSE: Implement rate limiting for API endpoints to prevent abuse; must be configurable per-endpoint; backward compatible with existing clients
+TASK: • Create rate limiter middleware with sliding window • Implement per-route configuration • Add Redis backend for distributed state • Include bypass for internal services
+MODE: write
+CONTEXT: @src/middleware/**/* @src/config/**/* | Memory: Using Express.js, Redis already configured, existing middleware pattern in auth.ts
+EXPECTED: Production-ready code with: TypeScript types, unit tests, integration test, configuration example, migration guide
+CONSTRAINTS: Follow existing middleware patterns | No breaking changes
+" --tool gemini --mode write --rule development-implement-feature
+```
+
+**Bug Fix Task**:
+```bash
+ccw cli -p "PURPOSE: Fix memory leak in WebSocket connection handler causing server OOM after 24h; root cause must be identified before any fix
+TASK: • Trace connection lifecycle from open to close • Identify event listener accumulation • Check cleanup on disconnect • Verify garbage collection eligibility
+MODE: analysis
+CONTEXT: @src/websocket/**/* @src/services/connection-manager.ts | Memory: Using ws library, ~5000 concurrent connections in production
+EXPECTED: Root cause analysis with: memory profile, leak source (file:line), fix recommendation with code, verification steps
+CONSTRAINTS: Focus on resource cleanup
+" --tool gemini --mode analysis --rule analysis-diagnose-bug-root-cause --cd src
+```
+
+**Refactoring Task**:
+```bash
+ccw cli -p "PURPOSE: Refactor payment processing to use strategy pattern for multi-gateway support; no functional changes; all existing tests must pass
+TASK: • Extract gateway interface from current implementation • Create strategy classes for Stripe, PayPal • Implement factory for gateway selection • Migrate existing code to use strategies
+MODE: write
+CONTEXT: @src/payments/**/* @src/types/payment.ts | Memory: Currently only Stripe, adding PayPal next sprint, must support future gateways
+EXPECTED: Refactored code with: strategy interface, concrete implementations, factory class, updated tests, migration checklist
+CONSTRAINTS: Preserve all existing behavior | Tests must pass
+" --tool gemini --mode write --rule development-refactor-codebase
+```
+
+**Code Review Task** (codex review mode):
+```bash
+# Option 1: Custom prompt (reviews uncommitted changes by default)
+ccw cli -p "Focus on security vulnerabilities and error handling" --tool codex --mode review
+
+# Option 2: Target flag only (no prompt allowed with target flags)
+ccw cli --tool codex --mode review --uncommitted
+ccw cli --tool codex --mode review --base main
+ccw cli --tool codex --mode review --commit abc123
+```
+
+> **Note**: `--mode review` only triggers special behavior for `codex` tool. Target flags (`--uncommitted`, `--base`, `--commit`) and prompt are **mutually exclusive** - use one or the other, not both.
+
+---
+
+### Permission Framework
+
+**Single-Use Authorization**: Each execution requires explicit user instruction. Previous authorization does NOT carry over.
+
+**Mode Hierarchy**:
+- `analysis`: Read-only, safe for auto-execution
+- `write`: Create/Modify/Delete files, full operations - requires explicit `--mode write`
+- `review`: Git-aware code review (codex only), read-only output - requires explicit `--mode review`
+- **Exception**: User provides clear instructions like "modify", "create", "implement"
+
+---
+
+## Auto-Invoke Triggers
+
+**Proactive CLI invocation** - Auto-invoke `ccw cli` when encountering these scenarios:
+
+| Trigger Condition | Suggested Rule | When to Use |
+|-------------------|----------------|-------------|
+| **Self-repair fails** | `analysis-diagnose-bug-root-cause` | After 1+ failed fix attempts |
+| **Ambiguous requirements** | `planning-breakdown-task-steps` | Task description lacks clarity |
+| **Architecture decisions** | `planning-plan-architecture-design` | Complex feature needs design |
+| **Pattern uncertainty** | `analysis-analyze-code-patterns` | Unsure of existing conventions |
+| **Critical code paths** | `analysis-assess-security-risks` | Security/performance sensitive |
+
+### Execution Principles
+
+- **Default mode**: `--mode analysis` (read-only, safe for auto-execution)
+- **No confirmation needed**: Invoke proactively when triggers match
+- **Wait for results**: Complete analysis before next action
+- **Tool selection**: Use context-appropriate tool or fallback chain (`gemini` → `qwen` → `codex`)
+- **Rule flexibility**: Suggested rules are guidelines, not requirements - choose the most appropriate template for the situation
+
+### Example: Bug Fix with Auto-Invoke
+
+```bash
+# After 1+ failed fix attempts, auto-invoke root cause analysis
+ccw cli -p "PURPOSE: Identify root cause of [bug description]; success = actionable fix strategy
+TASK: • Trace execution flow • Identify failure point • Analyze state at failure • Determine fix approach
+MODE: analysis
+CONTEXT: @src/module/**/* | Memory: Previous fix attempts failed at [location]
+EXPECTED: Root cause analysis with: failure mechanism, stack trace interpretation, fix recommendation with code
+CONSTRAINTS: Focus on [specific area]
+" --tool gemini --mode analysis --rule analysis-diagnose-bug-root-cause
+```
+
+---
+
+## Best Practices
+
+### Core Principles
+
+- **Configuration-driven** - All tool selection from `cli-tools.json`
+- **Tag-based routing** - Match task requirements to tool capabilities
+- **Use tools early and often** - Tools are faster and more thorough
+- **Unified CLI** - Always use `ccw cli -p` for consistent parameter handling
+- **Default mode is analysis** - Omit `--mode` for read-only operations, explicitly use `--mode write` for file modifications
+- **Use `--rule` for templates** - Auto-loads protocol + template appended to prompt
+- **Write protection** - Require EXPLICIT `--mode write` for file operations
+
+### Workflow Principles
+
+- **Use CCW unified interface** for all executions
+- **Always include template** - Use `--rule <template-name>` to load templates
+- **Be specific** - Clear PURPOSE, TASK, EXPECTED fields
+- **Include constraints** - File patterns, scope in CONSTRAINTS
+- **Leverage memory context** when building on previous work
+- **Discover patterns first** - Use rg/MCP before CLI execution
+- **Default to full context** - Use `@**/*` unless specific files needed
+
+### Planning Checklist
+
+- [ ] **Purpose defined** - Clear goal and intent
+- [ ] **Mode selected** - `--mode analysis|write|review`
+- [ ] **Context gathered** - File references + memory (default `@**/*`)
+- [ ] **Directory navigation** - `--cd` and/or `--includeDirs`
+- [ ] **Tool selected** - Explicit `--tool` or tag-based auto-selection
+- [ ] **Rule template** - `--rule <template-name>` loads template
+- [ ] **Constraints** - Domain constraints in CONSTRAINTS field
+
+### Execution Workflow
+
+1. **Load configuration** - Read `cli-tools.json` for available tools
+2. **Match by tags** - Select tool based on task requirements
+3. **Validate enabled** - Ensure selected tool is enabled
+4. **Execute with mode** - Always specify `--mode analysis|write|review`
+5. **Fallback gracefully** - Use secondary model or next matching tool on failure