diff --git a/apps/desktop/src/main/agent-runtime.test.ts b/apps/desktop/src/main/agent-runtime.test.ts
index 85a27bd0..d28ba3b9 100644
--- a/apps/desktop/src/main/agent-runtime.test.ts
+++ b/apps/desktop/src/main/agent-runtime.test.ts
@@ -117,7 +117,8 @@ it('runs the shipped CLI through scoped transport, a real isolated worker and ex
     await engine.quiesce(child.id)
     expect(seen.filter((s) => s.sessionId === child.id)).toHaveLength(1)
     expect(seen[0]?.workspacePath).not.toBe(repo)
-    expect(seen[0]?.prompt).toContain('ari --skill')
+    expect(seen[0]?.prompt).toContain('not written by the user')
+    expect(seen[0]?.prompt).toContain('$ARI_CLI --skill')
     expect(runtime.environment(child).ARI_CONTROL_TOKEN).not.toBe(env.ARI_CONTROL_TOKEN)
     const transcript = (await cli('session', 'read', child.id)) as {
       result: { messages: { text: string }[] }
diff --git a/apps/desktop/src/main/engine.ts b/apps/desktop/src/main/engine.ts
index 17f669f3..bdc3b5f6 100644
--- a/apps/desktop/src/main/engine.ts
+++ b/apps/desktop/src/main/engine.ts
@@ -536,7 +536,7 @@ export class Engine {
         workspacePath,
         prompt:
           runtimeEnv?.ARI_ENV === '1'
-            ? `[Ari control surface: this session can operate Ari. Commands: ari env, ari agents, ari session spawn|prompt|wait|read|diff|integrate|stop|destroy. Full protocol: ari --skill. Never disclose ARI_CONTROL_TOKEN.]\n\n${prompt}`
+            ? `[Ari control surface: added automatically by the Ari desktop app, not written by the user. This session can operate Ari through the CLI at $ARI_CLI. Commands: env, agents, session spawn|prompt|wait|read|diff|integrate|stop|destroy. Full protocol: $ARI_CLI --skill. Never disclose ARI_CONTROL_TOKEN.]\n\n${prompt}`
             : prompt,
         modelId: session.modelId,
         permissionMode: session.permissionMode,