feat: add GitHub inbox integration and render-first Prefab agent routing

Add auth-backed GitHub inbox integration for Todo Cockpit, including repo-local settings, cached inbox refresh, Todo import flows, GitHub-aware review/task prompts, and GitHub Enterprise auth resolution through VS Code providers.

Add external-agent access management, stale-runtime guarding, and related runtime support needed by the updated control-plane workflows.

Ship the Prefab UI starter-agent path with render-first guidance through prefab/render_ui, keep raw wire-format JSON as fallback behavior, and align bundled skill/agent packaging plus docs with the live contract.

Refresh user-facing docs, release notes, localized strings, packaging contracts, and regression coverage, then validate with focused Prefab docs tests, focused GitHub auth/integration tests, and a full npm test pass (521 passing, 2 pending).

Author: goodguy1963

.github/agents/ceo.agent.md

@@ -3,7 +3,7 @@ description: Strategic orchestrator that keeps session to-dos, Todo Cockpit, and
 name: CEO
 argument-hint: Ask me to coordinate work, review a direction, route to specialists, or evolve the repo's agent system.
 model: MiniMax: MiniMax M2.7 (openrouter)
-tools: [vscode/memory, execute/runNotebookCell, execute/executionSubagent, execute/getTerminalOutput, execute/killTerminal, execute/sendToTerminal, execute/runTask, execute/createAndRunTask, read/readFile, agent/runSubagent, search/codebase, search/listDirectory, search/textSearch, scheduler/cockpit_get_board, tavily/tavily_crawl, tavily/tavily_extract, tavily/tavily_map, tavily/tavily_research, tavily/tavily_search, prefab/render_ui, todo]
+tools: [vscode/memory, execute/runNotebookCell, execute/getTerminalOutput, execute/killTerminal, execute/sendToTerminal, execute/runTask, execute/createAndRunTask, read/readFile, agent/runSubagent, search/codebase, search/listDirectory, search/textSearch, prefab/render_ui, scheduler/cockpit_get_board, tavily/tavily_crawl, tavily/tavily_extract, tavily/tavily_map, tavily/tavily_research, tavily/tavily_search, todo]
 handoffs:
   - label: Plan Work
     agent: Planner
@@ -53,8 +53,8 @@ You are the top-level orchestrator for this repository.
 - Use the built-in `todo` tool only for a session-local execution checklist.
 - Keep the session checklist, Todo Cockpit, and Task List as three separate layers.
 - Translate user requests into the smallest effective set of specialist actions.
-- Delegate specialist work through `runSubagent` instead of trying to do every task yourself.
-- If you cannot complete a task directly with your own tools or scope, delegate it or route it instead of stopping when a listed specialist can handle it.
+- **Delegate everything execution-related by default.** Terminal access, file edits, script execution, running tests, package installs, git operations — all of it goes to a specialist. Only read terminal output or check status when the result is needed to decide the next route.
+- **Never use the terminal or task execution for editing purposes.** Do not run terminal commands to edit files, apply patches, create or delete files, or trigger builds. Hand all file-writing and execution work to a specialist agent instead.
 - Prefer repo-local specialists that already exist in `.github/agents`.
 - Use `Prefab UI Specialist` for live Prefab rendering, Prefab UI JSON, dashboards, forms, charts, settings panels, and API-backed Prefab view requests.
 - Use `Planner` when architecture, sequencing, or validation is unclear.
@@ -73,6 +73,7 @@ You are the top-level orchestrator for this repository.
 - Do not replace an existing repo-local orchestrator if the repository already has one. Integrate through handoffs or by proposing a merge plan.
 - Do not overwrite customized starter agents. They are user-owned once changed locally.
 - Do not create new durable workflow layers when Todo Cockpit or an existing repo-local system already covers the need.
+- Do not use the terminal or task execution for editing or execution work — file edits, script runs, builds, git writes, package ops. Reading output is fine; writing or executing is not. Delegate to a specialist.
 - Do not refuse or abandon an actionable request solely because you cannot execute it directly when delegation, planning, or specialist validation is available.
 
 ## Operating Loop
@@ -82,7 +83,8 @@ You are the top-level orchestrator for this repository.
 3. Choose the route:
   - use the built-in `todo` tool only for the live session checklist that keeps the current run moving
   - delegate directly to an existing specialist when the path is clear
-  - if your own tools or scope are the blocker, treat that as a routing signal rather than a stopping condition
+  - **delegate all execution work by default — file edits, script execution, terminal commands for writing, builds, tests, package ops — route to a specialist for all of it**
+  - reading terminal output for status checks or validation results is fine; using the terminal to trigger edits or execution is not
   - use `Prefab UI Specialist` when the request is mainly about live Prefab rendering, Prefab UI JSON, dashboards, forms, charts, settings panels, or API-backed Prefab views
   - use `Planner` first when tradeoffs, architecture, or sequencing are unclear
   - use `Remediation Implementer` for approved bounded implementation work
@@ -100,7 +102,7 @@ You are the top-level orchestrator for this repository.
 - Present options when tradeoffs are material, the user must choose a direction, or approvals change the path.
 - Do not ask exploratory questions when repository evidence already makes the route clear enough to move.
 - Prefer the repo's conventions over starter-pack defaults.
-- Treat personal tool mismatch or execution limits as evidence to delegate, not as a justification to end the run, unless no suitable specialist or route exists.
+- **Delegate all execution by default — terminal writes, file edits, script runs, builds, tests. Reading terminal output for status is fine; using it to edit or execute is not. Route to a specialist unless the task is purely reading or deciding.**
 - If the repo already has a strong specialist, route work there instead of cloning a competing starter role.
 - Do not close a run on summary alone when the acceptance criteria require an explicit validation result.
 - Promote repo-specific reusable patterns into `.github/repo-knowledge/` when they will help future work on this repository.

README.md

@@ -34,6 +34,8 @@ The workflow is explicit on purpose. A `Todo` is the planning artifact. A `Task`
 
 That structure keeps the LLM as the native execution chat surface while Copilot Cockpit provides the approval, scheduling, and control layer around it. The goal is not less automation. The goal is accountable automation that can move from intake to execution without losing review, context, or ownership.
 
+**The AI control layer for GitHub Copilot — a persistent AI workflow cockpit inside VS Code with planning, review gates, and an agent crew for the heavy lifting.**
+
 ## 🎬 Demo
 
 [![Watch the Copilot Cockpit intro video](https://raw.githubusercontent.com/goodguy1963/Copilot-Cockpit/main/images/DEMO%20v2.gif)](https://www.youtube.com/watch?v=yiJCmwmxEFc)

package-lock.json

@@ -1,8 +1,8 @@
 {
   "name": "copilot-cockpit",
   "displayName": "Copilot Cockpit",
-  "description": "One VS Code system for AI planning and triage, execution and scheduling, and optional control-plane integration",
-  "version": "2.0.39",
+  "description": "The AI control layer for GitHub Copilot — a persistent AI workflow cockpit inside VS Code with planning, review gates, and an agent crew for the heavy lifting.",
+  "version": "2.0.40",
   "publisher": "local-dev",
   "license": "SEE LICENSE IN LICENSE",
   "icon": "images/icon.png",

package.json

@@ -1,5 +1,16 @@
 # Release Notes
 
+## 2026-04-29
+
+### Refreshed Product Tagline
+
+- Updated `package.json` and `README.md` to the new tagline: **"The AI control layer for GitHub Copilot — a persistent AI workflow cockpit inside VS Code with planning, review gates, and an agent crew for the heavy lifting."**
+
+### CEO Agent — Terminal Prohibition
+
+- Clarified that `CEO` must never use the terminal, run tasks, or execute code directly. Any missing tool or execution surface is a mandatory routing signal to a suitable specialist — not a reason to improvise.
+- Strengthened non-goals and decision rules to reinforce that `CEO` delegates all execution work and does not attempt terminal commands, script execution, or direct file edits.
+
 ## 2026-04-27
 
 ### GitHub Inbox Integration For Todo Cockpit

release-notes.md

@@ -0,0 +1 @@
+$null