fix(prompt): add strict no-cleanup rule to prevent post-task deletions

TerminalBench analysis showed agents deleting their own successful work
after verification (e.g., rm -rf /var/www/html/* after confirming web
server worked). Previous softer 'do not clean up' language was ignored.

Uses STRICTLY FORBIDDEN language matching existing prompt patterns.
Explicitly lists dangerous commands (rm, git reset, git update-ref -d).
States that automated tests will verify immediately after completion.

src/core/prompts/system-prompt/__tests__/__snapshots__/anthropic_claude_sonnet_4-basic.snap

@@ -621,6 +621,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - The user may ask generic non-development tasks, such as "what\'s the latest news" or "look up the weather in San Diego", in which case you might use the browser_action tool to complete the task if it makes sense to do so, rather than trying to create a website or using curl to answer the question. However, if an available MCP server tool or resource can be used instead, you should prefer to use it over browser_action.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.

src/core/prompts/system-prompt/__tests__/__snapshots__/anthropic_claude_sonnet_4-no-browser.snap

@@ -585,6 +585,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.
 - When presented with images, utilize your vision capabilities to thoroughly examine them and extract meaningful information. Incorporate these insights into your thought process as you accomplish the user's task.

src/core/prompts/system-prompt/__tests__/__snapshots__/anthropic_claude_sonnet_4-no-focus-chain.snap

@@ -540,6 +540,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - The user may ask generic non-development tasks, such as "what\'s the latest news" or "look up the weather in San Diego", in which case you might use the browser_action tool to complete the task if it makes sense to do so, rather than trying to create a website or using curl to answer the question. However, if an available MCP server tool or resource can be used instead, you should prefer to use it over browser_action.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.

src/core/prompts/system-prompt/__tests__/__snapshots__/anthropic_claude_sonnet_4-no-mcp.snap

@@ -599,6 +599,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - The user may ask generic non-development tasks, such as "what\'s the latest news" or "look up the weather in San Diego", in which case you might use the browser_action tool to complete the task if it makes sense to do so, rather than trying to create a website or using curl to answer the question. However, if an available MCP server tool or resource can be used instead, you should prefer to use it over browser_action.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.

src/core/prompts/system-prompt/__tests__/__snapshots__/cline_devstral-basic.snap

@@ -642,6 +642,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - The user may ask generic non-development tasks, such as "what\'s the latest news" or "look up the weather in San Diego", in which case you might use the browser_action tool to complete the task if it makes sense to do so, rather than trying to create a website or using curl to answer the question. However, if an available MCP server tool or resource can be used instead, you should prefer to use it over browser_action.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.

src/core/prompts/system-prompt/__tests__/__snapshots__/cline_devstral-no-browser.snap

@@ -606,6 +606,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.
 - When presented with images, utilize your vision capabilities to thoroughly examine them and extract meaningful information. Incorporate these insights into your thought process as you accomplish the user's task.

src/core/prompts/system-prompt/__tests__/__snapshots__/cline_devstral-no-focus-chain.snap

@@ -566,6 +566,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - The user may ask generic non-development tasks, such as "what\'s the latest news" or "look up the weather in San Diego", in which case you might use the browser_action tool to complete the task if it makes sense to do so, rather than trying to create a website or using curl to answer the question. However, if an available MCP server tool or resource can be used instead, you should prefer to use it over browser_action.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.

src/core/prompts/system-prompt/__tests__/__snapshots__/cline_devstral-no-mcp.snap

@@ -620,6 +620,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - The user may ask generic non-development tasks, such as "what\'s the latest news" or "look up the weather in San Diego", in which case you might use the browser_action tool to complete the task if it makes sense to do so, rather than trying to create a website or using curl to answer the question. However, if an available MCP server tool or resource can be used instead, you should prefer to use it over browser_action.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.

src/core/prompts/system-prompt/__tests__/__snapshots__/openai_gpt_3-basic.snap

@@ -610,6 +610,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - The user may ask generic non-development tasks, such as "what\'s the latest news" or "look up the weather in San Diego", in which case you might use the browser_action tool to complete the task if it makes sense to do so, rather than trying to create a website or using curl to answer the question. However, if an available MCP server tool or resource can be used instead, you should prefer to use it over browser_action.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.

src/core/prompts/system-prompt/__tests__/__snapshots__/openai_gpt_3-no-browser.snap

@@ -574,6 +574,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.
 - When presented with images, utilize your vision capabilities to thoroughly examine them and extract meaningful information. Incorporate these insights into your thought process as you accomplish the user's task.

src/core/prompts/system-prompt/__tests__/__snapshots__/openai_gpt_3-no-focus-chain.snap

@@ -538,6 +538,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - The user may ask generic non-development tasks, such as "what\'s the latest news" or "look up the weather in San Diego", in which case you might use the browser_action tool to complete the task if it makes sense to do so, rather than trying to create a website or using curl to answer the question. However, if an available MCP server tool or resource can be used instead, you should prefer to use it over browser_action.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.

src/core/prompts/system-prompt/__tests__/__snapshots__/openai_gpt_3-no-mcp.snap

@@ -588,6 +588,7 @@ RULES
 - When passing untrusted or variable text as positional command arguments, insert `--` before the positional values if they may begin with `-` (for example `my-cli -- "$value"`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like `rm`, `git reset`, `git update-ref -d`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 - The user may ask generic non-development tasks, such as "what\'s the latest news" or "look up the weather in San Diego", in which case you might use the browser_action tool to complete the task if it makes sense to do so, rather than trying to create a website or using curl to answer the question. However, if an available MCP server tool or resource can be used instead, you should prefer to use it over browser_action.
 - NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.

src/core/prompts/system-prompt/components/rules.ts

@@ -25,6 +25,7 @@ const getRulesTemplateText = (context: SystemPromptContext) => `RULES
 - When passing untrusted or variable text as positional command arguments, insert \`--\` before the positional values if they may begin with \`-\` (for example \`my-cli -- "$value"\`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like \`rm\`, \`git reset\`, \`git update-ref -d\`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 {{BROWSER_RULES}}{{CLI_RULES}}- NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.
 - When presented with images, utilize your vision capabilities to thoroughly examine them and extract meaningful information. Incorporate these insights into your thought process as you accomplish the user's task.

src/core/prompts/system-prompt/variants/next-gen/template.ts

@@ -71,6 +71,7 @@ export const rules_template = (context: SystemPromptContext) => `RULES
 - When passing untrusted or variable text as positional command arguments, insert \`--\` before the positional values if they may begin with \`-\` (for example \`my-cli -- "$value"\`). This prevents the values from being parsed as options.
 - The user may provide a file's contents directly in their message, in which case you shouldn't use the read_file tool to get the file contents again since you already have it.
 - Your goal is to try to accomplish the user's task, NOT engage in a back and forth conversation.
+- You are STRICTLY FORBIDDEN from removing, deleting, or undoing work you have completed, even to "clean up" or "reset" for the user. After verifying your task is complete, do NOT run commands like \`rm\`, \`git reset\`, \`git update-ref -d\`, or any destructive operations on files, services, repos, or content you created. Leave everything in its final working state. Automated tests will verify your work immediately after completion, and cleanup will cause failures.
 {{BROWSER_RULES}}- NEVER end attempt_completion result with a question or request to engage in further conversation! Formulate the end of your result in a way that is final and does not require further input from the user.
 - You are STRICTLY FORBIDDEN from starting your messages with "Great", "Certainly", "Okay", "Sure". You should NOT be conversational in your responses, but rather direct and to the point. For example you should NOT say "Great, I've updated the CSS" but instead something like "I've updated the CSS". It is important you be clear and technical in your messages.
 - When presented with images, utilize your vision capabilities to thoroughly examine them and extract meaningful information. Incorporate these insights into your thought process as you accomplish the user's task.