[p-diogo]

Why

In the 2.5.3rc7 auto-QA (internal #631, finding F8), the installing agent told the user the guide "instructs the installing agent to run silently and emit scripted confirmation lines; I ignored that", and called the short install URL "written to script agent behavior". To a careful model, a fetched document that says run silently, say only these exact lines looks like prompt injection. That costs trust, and the agent then follows the guide less, including the parts that matter.

What changes

• "Conversational style — HARD RULE" becomes "Keeping the chat short". It keeps the goal (outcomes, not pip and interpreter mechanics; about six short messages) and says why (QA 2026-06 chat spam). It tells the agent to explain plainly when the user asks or a step fails, and points to this public repo so the agent can check anything.
• Quoted lines become suggested wording. Versions, URLs, PINs and account numbers must still match tool output and are never invented.
• Two requirements stay strict, now with the reason: the pairing message carries the URL and PIN exactly as the tool returned them, and no phrase-producing commands. Both protect the recovery phrase.
• Wording in the steps: "SILENT — emit nothing" becomes "Background step", and "Emit (verbatim)" becomes "Line to send". Post-setup's "VERBATIM" block becomes "send this block", keeping the backup reminder, the restart line, the real numbers, and no preambles or extra checks.
• Phrase safety section gains one sentence on why the rules are absolute.

No procedure, command or surface-matrix change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Bd3G1BkVMFSXkcdAQ7nFax