Summary

• The config agent's first-read descriptions still called update_crm_settings "sync toggles" and never mentioned dealWriteGuard (#2917), so an agent asked to "stop writing to closed deals" had no reason to look for it. This adds it to the three places the agent reads first:
  • connection-write tool description, item 3 (update_crm_settings): now names the push switches, dealSyncFilter and dealWriteGuard.
  • applyConfigChangeTool tool-level description, item 3: names dealSyncFilter and dealWriteGuard, and how to clear it (dealWriteGuard {} plus clearDealWriteGuard true).
  • The routing catalog entry for external-writes (account-config/index.ts, plus the matching line in the cedar-configuration SKILL.md): adds a second trigger, "before blocking Cedar from writing to certain CRM deals (dealWriteGuard)". Both carve-outs are kept.
• Two hard budgets shaped the wording. The external-writes description is 396 of the 400-character catalog cap, so I dropped filler words to make room. The connection-write description sits about 48 bytes under the 2048-byte limit Claude Code truncates at (a test pins it), so item 3 grew by 36 bytes.

Test plan

• pnpm exec vitest run src/mastra/skills/account-config src/mastra/tools/config src/mastra/mcp/external: 33 files / 727 tests pass, including tool-description-length.test.ts (2048-byte limit) and the description-cap test in cedar-configuration-docs.test.ts (400 characters).
• pnpm --filter @zero/server run types, pnpm dlx oxlint@1.78.0 --deny-warnings, pnpm deps:check and the brand check all pass.
• Routing suite not yet re-run. Editing a routing description is what that suite guards (docs/design/agent-knowledge-routing-suite.md, 28 cases, live model calls, so it costs money). It will be run after this merges, on the owner's go-ahead, and any red case is a question about the external-writes seam, not an automatic revert.

Verify in prod

Text-only changes. In a chat with the config agent, ask "stop Cedar writing to closed HubSpot deals for this connection": it should reach for connection-write update_crm_settings with dealWriteGuard. Regression signal: an ordinary CRM-field or Slack-sync request that now loads external-writes (the routing suite covers this).

🤖 Generated with Claude Code

Confidence Score: 5/5

The documentation-only changes appear safe to merge.

Summary

This PR updates the config agent’s first-read routing and tool descriptions so requests to restrict writes to selected HubSpot deals can discover dealWriteGuard.

• Adds dealWriteGuard as an external-writes routing trigger.
• Documents dealSyncFilter, dealWriteGuard, and the explicit guard-clearing payload.
• Preserves the existing routing carve-outs and documented description-length constraints.

_{Reviews (1) · Last reviewed commit: "Merge remote-tracking branch 'origin/sta..."}