chore: commit pending changes from session

- Add permission rules to .claude/settings.json
- Document empty merge and direct-to-master problems in problems.md
- Fix agent stream URL to use vite proxy instead of hardcoded host
- Add /agents proxy config to vite.config.ts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -60,7 +60,16 @@
       "Edit",
       "Write",
       "Bash(find *)",
-      "Bash(sqlite3 *)"
+      "Bash(sqlite3 *)",
+      "Bash(cat <<:*)",
+      "Bash(cat <<'ENDJSON:*)",
+      "Bash(make release:*)",
+      "Bash(npm test:*)",
+      "Bash(head *)",
+      "Bash(tail *)",
+      "Bash(wc *)",
+      "Bash(npx vite:*)",
+      "Bash(npm run dev:*)"
     ]
   }
 }

.story_kit/problems.md

@@ -2,6 +2,15 @@
 
 Recurring issues observed during pipeline operation. Review periodically and create stories for systemic problems.
 
+## 2026-03-18: Stories graduating to "done" with empty merges
+
+Pipeline allows stories to move through coding → QA → merge → done without any actual code changes landing on master. The squash-merge produces an empty diff but the pipeline still marks the story as done. Confirmed affected: 247, 273, 280. Stories 274, 278, 279 appeared empty via merge commits but code was actually committed directly to master by agents (see next problem). Root cause: no check that the merge commit contains a non-empty diff before advancing to done. Frequency: 3+ confirmed cases out of 10 done stories.
+
 ## 2026-03-18: Agent committed directly to master instead of worktree
 
-Commit `5f4591f` ("fix: update should_commit_stage test to match 5_done") was made directly on master by an agent (likely mergemaster). Agents should only commit to their feature branch or merge-queue branch, never to master directly. The commit content was correct but the target branch was wrong. Suspect the agent ran `git commit` in the project root instead of the merge worktree directory.
+Multiple agents have committed directly to master instead of their worktree/feature branch:
+
+- Commit `5f4591f` ("fix: update should_commit_stage test to match 5_done") — likely mergemaster
+- Commit `a32cfbd` ("Add bot-level command registry with help command") — story 285 coder committed code + Cargo.lock directly to master
+
+Agents should only commit to their feature branch or merge-queue branch, never to master directly. Suspect agents are running `git commit` in the project root instead of the worktree directory. This can also revert uncommitted fixes on master (e.g. project.toml pkill fix was overwritten). Frequency: at least 2 confirmed cases. This is a recurring and serious problem — needs a guard in the server or agent prompts.

frontend/src/api/agents.ts

@@ -128,8 +128,7 @@ export function subscribeAgentStream(
 	onEvent: (event: AgentEvent) => void,
 	onError?: (error: Event) => void,
 ): () => void {
-	const host = import.meta.env.DEV ? "http://127.0.0.1:3001" : "";
-	const url = `${host}/agents/${encodeURIComponent(storyId)}/${encodeURIComponent(agentName)}/stream`;
+	const url = `/agents/${encodeURIComponent(storyId)}/${encodeURIComponent(agentName)}/stream`;
 
 	const eventSource = new EventSource(url);
 

frontend/vite.config.ts

@@ -23,6 +23,13 @@ export default defineConfig(() => {
             });
           },
         },
+        "/agents": {
+          target: `http://127.0.0.1:${String(backendPort)}`,
+          timeout: 120000,
+          configure: (proxy) => {
+            proxy.on("error", (_err) => {});
+          },
+        },
       },
       watch: {
         ignored: [