@bonginkan/maria 4.4.6 → 4.4.7

package/README.md

@@ -1,4 +1,4 @@
-# MARIA - AI Development Platform v4.4.6
+# MARIA - AI Development Platform v4.4.7
 
 [![npm version](https://img.shields.io/npm/v/@bonginkan/maria.svg)](https://www.npmjs.com/package/@bonginkan/maria)
 [![License](https://img.shields.io/badge/license-Multi--tier-blue.svg)](LICENSE)
@@ -10,7 +10,7 @@
 
 > **Enterprise-grade AI development platform with 100% command availability and comprehensive fallback support**
 
-## 🚀 What's New in v4.4.6 (October, 2025)
+## 🚀 What's New in v4.4.7 (October, 2025)
 ### Functional enhancements
 - **Improved coding**
 - **Enhanced video/image support**
@@ -933,7 +933,7 @@ await secureWorkflow.executeWithAuth(workflowDefinition, securityContext);
 ### Quick Installation
 ```bash
 # Install globally (recommended)
-npm install -g @bonginkan/maria@4.4.6
+npm install -g @bonginkan/maria@4.4.7
 
 # Verify installation
 maria --version  # Should show v4.3.9
@@ -1137,7 +1137,7 @@ MARIA CODE is distributed under a comprehensive licensing system designed for in
 
 *MARIA v4.1.4 represents the pinnacle of multimodal AI development platform evolution - combining revolutionary voice-to-code capabilities, advanced memory systems, and comprehensive command ecosystems with enterprise-grade security and performance. This release establishes MARIA as the definitive choice for developers and Fortune 500 enterprises seeking intelligent, multimodal development experiences with GraphRAG intelligence, multilingual support, and zero-anxiety coding workflows.*
 
-**Transform your development experience today**: `npm install -g @bonginkan/maria@4.4.6`
+**Transform your development experience today**: `npm install -g @bonginkan/maria@4.4.7`
 
 🌐 **Official Website**: [https://maria-code.ai](https://maria-code.ai)  
 💬 **Community**: [https://discord.gg/SMSmSGcEQy](https://discord.gg/SMSmSGcEQy)  

package/dist/READY.manifest.json

@@ -1,6 +1,6 @@
 {
   "version": "lite-1.0.0",
-  "generatedAt": "2025-10-26T11:13:53.603Z",
+  "generatedAt": "2025-10-27T07:38:20.479Z",
   "totalCommands": 30,
   "readyCount": 30,
   "partialCount": 0,

package/dist/bin/maria.cjs

@@ -26089,8 +26089,8 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@bonginkan/maria",
-      version: "4.4.6",
-      description: "\u{1F680} MARIA v4.4.6 - Enterprise AI Development Platform with identity system and character voice implementation. Features 74 production-ready commands with comprehensive fallback implementation, local LLM support, and zero external dependencies. Includes natural language coding, AI safety evaluation, intelligent evolution system, episodic memory with PII masking, and real-time monitoring dashboard. Built with TypeScript AST-powered code generation, OAuth2.0 + PKCE authentication, quantum-resistant cryptography, and enterprise-grade performance.",
+      version: "4.4.7",
+      description: "\u{1F680} MARIA v4.4.7 - Enterprise AI Development Platform with identity system and character voice implementation. Features 74 production-ready commands with comprehensive fallback implementation, local LLM support, and zero external dependencies. Includes natural language coding, AI safety evaluation, intelligent evolution system, episodic memory with PII masking, and real-time monitoring dashboard. Built with TypeScript AST-powered code generation, OAuth2.0 + PKCE authentication, quantum-resistant cryptography, and enterprise-grade performance.",
       keywords: [
         "ai",
         "cli",
@@ -28245,7 +28245,7 @@ var init_AuthenticationManager = __esm({
           const response = await fetch(`${this.apiBase}/api/user/profile`, {
             headers: {
               "Authorization": `Bearer ${tokens2.accessToken}`,
-              "User-Agent": `maria-cli/${process.env.CLI_VERSION || "4.4.6"}`
+              "User-Agent": `maria-cli/${process.env.CLI_VERSION || "4.4.7"}`
             }
           });
           if (response.status === 401) {
@@ -28922,7 +28922,7 @@ async function callApi(path69, init3 = {}) {
     "Authorization": `Bearer ${token}`,
     "X-Device-Id": getDeviceId(),
     "X-Session-Id": getSessionId() || "",
-    "User-Agent": `maria-cli/${process.env.CLI_VERSION || "4.4.6"}`,
+    "User-Agent": `maria-cli/${process.env.CLI_VERSION || "4.4.7"}`,
     "Content-Type": init3.headers?.["Content-Type"] || "application/json"
   });
   const doFetch = async (token) => {
@@ -29771,9 +29771,14 @@ async function executeChat(messages, options) {
         } catch {
         }
       }
+      const injectedAtt = globalThis.__maria_attachments_for_next_call__;
+      try {
+        globalThis.__maria_attachments_for_next_call__ = void 0;
+      } catch {
+      }
       const response = await callAPI("/v1/ai-proxy", {
         method: "POST",
-        body: { messages, taskType: "chat", ...options?.provider ? { provider: options.provider } : {}, ...options?.model ? { model: options.model } : {} }
+        body: { messages, taskType: "chat", ...options?.provider ? { provider: options.provider } : {}, ...options?.model ? { model: options.model } : {}, ...Array.isArray(injectedAtt) && injectedAtt.length ? { metadata: { attachments: injectedAtt } } : {} }
       });
       if (process.env.MARIA_DEBUG === "1") {
         try {
@@ -29917,7 +29922,7 @@ async function collectFileAttachmentsFromText(text, cwd2 = process.cwd(), option
         continue;
       }
       const ext2 = (path13__namespace.extname(abs) || "").toLowerCase();
-      const mime = ext2 === ".pdf" ? "application/pdf" : ext2 === ".png" ? "image/png" : ext2 === ".jpg" || ext2 === ".jpeg" ? "image/jpeg" : ext2 === ".webp" ? "image/webp" : ext2 === ".gif" ? "image/gif" : ext2 === ".bmp" ? "image/bmp" : ext2 === ".svg" ? "image/svg+xml" : ext2 === ".tif" || ext2 === ".tiff" ? "image/tiff" : ext2 === ".heic" ? "image/heic" : ext2 === ".heif" ? "image/heif" : "text/plain";
+      const mime = ext2 === ".pdf" ? "application/pdf" : ext2 === ".png" ? "image/png" : ext2 === ".jpg" || ext2 === ".jpeg" ? "image/jpeg" : ext2 === ".webp" ? "image/webp" : ext2 === ".gif" ? "image/gif" : ext2 === ".bmp" ? "image/bmp" : ext2 === ".svg" ? "image/svg+xml" : ext2 === ".tif" || ext2 === ".tiff" ? "image/tiff" : ext2 === ".heic" ? "image/heic" : ext2 === ".heif" ? "image/heif" : ext2 === ".md" ? "text/markdown" : ext2 === ".txt" ? "text/plain" : ext2 === ".json" ? "application/json" : ext2 === ".yml" || ext2 === ".yaml" ? "application/x-yaml" : ext2 === ".xml" ? "application/xml" : ext2 === ".docx" ? "application/vnd.openxmlformats-officedocument.wordprocessingml.document" : ext2 === ".doc" ? "application/msword" : "text/plain";
       attachments.push({ name: path13__namespace.basename(abs), path: abs, mime, data_base64: buf.toString("base64") });
       seen.add(key);
     } catch {
@@ -40866,7 +40871,7 @@ var init_about_command = __esm({
       async execute(args2, context2) {
         const output3 = [];
         output3.push("");
-        output3.push(chalk14__default.default.cyan.bold("About MARIA v4.4.6"));
+        output3.push(chalk14__default.default.cyan.bold("About MARIA v4.4.7"));
         output3.push(chalk14__default.default.gray("\u2550".repeat(40)));
         output3.push("");
         output3.push(chalk14__default.default.white.bold("MARIA - Minimal API, Maximum Power"));
@@ -40946,7 +40951,7 @@ var init_contact_command = __esm({
         output3.push("");
         output3.push(chalk14__default.default.white.bold("\u{1F3E2} Company Information:"));
         output3.push("  Company: Bonginkan");
-        output3.push("  Product: MARIA v4.4.6");
+        output3.push("  Product: MARIA v4.4.7");
         output3.push("  Website: https://bonginkan.ai");
         output3.push("  Product Site: https://maria-code.ai");
         output3.push("");
@@ -56200,6 +56205,32 @@ var init_image_command = __esm({
         try {
           const root = context2.environment.cwd;
           const cli = normalizeImageArgs(args2.raw, root);
+          try {
+            const routed = globalThis.__maria_routed_attachments;
+            if (Array.isArray(routed) && routed.length) {
+              const textSnippets = [];
+              for (const a of routed.slice(0, 4)) {
+                const mime = String(a.mime || "").toLowerCase();
+                const isDoc = /^(text\/|application\/(pdf|json|xml|yaml|yml|msword|vnd\.openxmlformats))/i.test(mime) || /\.(md|txt|json|xml|ya?ml|pdf|docx?)$/i.test(String(a.name || a.path || ""));
+                if (!isDoc) continue;
+                const b64 = String(a.data_base64 || "");
+                if (!b64) continue;
+                try {
+                  const buf = Buffer.from(b64, "base64");
+                  const text = /pdf/.test(mime) ? "" : buf.toString("utf8");
+                  if (text) textSnippets.push(text.slice(0, 800));
+                } catch {
+                }
+              }
+              if (textSnippets.length) {
+                cli.prompt = `${cli.prompt}
+
+[context]
+${textSnippets.join("\n---\n")}`.slice(0, 4e3);
+              }
+            }
+          } catch {
+          }
           if (cli.planOnly || cli.dryRun || !cli.apply) {
             const line = `Plan: ${cli.count} images ${cli.size[0]}x${cli.size[1]} ${cli.format} model=${cli.model || "auto"} concurrency=${cli.concurrency} retry=${cli.retry}`;
             const next = `Next: /image "${cli.prompt}" --size ${cli.size[0]}x${cli.size[1]} --format ${cli.format} --count ${cli.count} --apply`;
@@ -56751,6 +56782,32 @@ var init_video_command = __esm({
         try {
           const root = context2.environment.cwd;
           const cli = normalizeVideoArgs(args2.raw, root);
+          try {
+            const routed = globalThis.__maria_routed_attachments;
+            if (Array.isArray(routed) && routed.length) {
+              const textSnippets = [];
+              for (const a of routed.slice(0, 4)) {
+                const mime = String(a.mime || "").toLowerCase();
+                const isDoc = /^(text\/|application\/(pdf|json|xml|yaml|yml|msword|vnd\.openxmlformats))/i.test(mime) || /\.(md|txt|json|xml|ya?ml|pdf|docx?)$/i.test(String(a.name || a.path || ""));
+                if (!isDoc) continue;
+                const b64 = String(a.data_base64 || "");
+                if (!b64) continue;
+                try {
+                  const buf = Buffer.from(b64, "base64");
+                  const text = /pdf/.test(mime) ? "" : buf.toString("utf8");
+                  if (text) textSnippets.push(text.slice(0, 800));
+                } catch {
+                }
+              }
+              if (textSnippets.length) {
+                cli.prompt = `${cli.prompt}
+
+[context]
+${textSnippets.join("\n---\n")}`.slice(0, 4e3);
+              }
+            }
+          } catch {
+          }
           try {
             const hook = global.__MARIA_VIDEO_LLM_INFER__;
             if (hook) {
@@ -57449,7 +57506,7 @@ function detectChaptersFromIdea(idea, fallback2) {
   }
   return fallback2;
 }
-async function generatePlan(prompt, lang, title, genre, llm, forcedLocal) {
+async function generatePlan(prompt, lang, title, genre, llm, forcedLocal, attachments) {
   const system = [
     "You generate a detailed novel outline (plot).",
     "Return Markdown with clear sections: Title, Logline, Themes, Characters, Chapter Outline.",
@@ -57486,12 +57543,13 @@ ${user}`;
 ${user}`, taskType: "creative" };
     if (llm?.provider) body.provider = llm.provider;
     if (llm?.model) body.model = llm.model;
+    if (Array.isArray(attachments) && attachments.length) body.metadata = { attachments };
     const resp = await callAPI("/v1/ai-proxy", { method: "POST", body });
     const out = (resp?.data?.content || resp?.output || "").trim();
     return out;
   }
 }
-async function generateChapters(planMarkdown, lang, chapters, llm, forcedLocal) {
+async function generateChapters(planMarkdown, lang, chapters, llm, forcedLocal, attachments) {
   const system = [
     "You expand a novel outline into chapter texts.",
     "Return only JSON array: [{ index: number, title: string, content: string }].",
@@ -57522,6 +57580,7 @@ ${planMarkdown}`;
     const body = { prompt, taskType: "creative" };
     if (llm?.provider) body.provider = llm.provider;
     if (llm?.model) body.model = llm.model;
+    if (Array.isArray(attachments) && attachments.length) body.metadata = { attachments };
     const resp = await callAPI("/v1/ai-proxy", { method: "POST", body });
     raw = (resp?.data?.content || resp?.output || "").trim();
   }
@@ -57628,6 +57687,12 @@ var init_novel_command = __esm({
           if (Array.isArray(routed) && routed.length) autoAttachments = autoAttachments.concat(routed);
         } catch {
         }
+        let routedAttachments = [];
+        try {
+          const routed = globalThis.__maria_routed_attachments;
+          if (Array.isArray(routed) && routed.length) routedAttachments = routed;
+        } catch {
+        }
         let inferred = {};
         try {
           const spin = new ProcessAnimation();
@@ -57707,7 +57772,7 @@ var init_novel_command = __esm({
           const spin = new ProcessAnimation();
           spin.start();
           try {
-            plan = await generatePlan(ideaText, langDetected, title, genre, { provider: effectiveProvider, model: explicitModel }, forcedLocalSel);
+            plan = await generatePlan(ideaText, langDetected, title, genre, { provider: effectiveProvider, model: explicitModel }, forcedLocalSel, routedAttachments);
           } finally {
             try {
               spin.stop();
@@ -57743,7 +57808,7 @@ var init_novel_command = __esm({
           const spin = new ProcessAnimation();
           spin.start();
           try {
-            return await generateChapters(plan, langDetected, chapters, { provider: effectiveProvider, model: explicitModel }, forcedLocalSel);
+            return await generateChapters(plan, langDetected, chapters, { provider: effectiveProvider, model: explicitModel }, forcedLocalSel, routedAttachments);
           } finally {
             try {
               spin.stop();
@@ -58331,6 +58396,10 @@ async function getRepoFiles(root) {
   _repoFileIndexCache = { root, files: out };
   return out;
 }
+function isDocMime(m2) {
+  const s2 = String(m2 || "").toLowerCase();
+  return s2.startsWith("text/") || s2 === "application/pdf" || s2 === "application/json" || s2 === "application/xml" || s2 === "application/x-yaml" || s2 === "application/yaml" || s2 === "application/msword" || s2 === "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+}
 function languageFromExt(ext2) {
   const e2 = ext2.toLowerCase().replace(/^\./, "");
   if (e2 === "ts") return "typescript";
@@ -58548,7 +58617,16 @@ async function orchestrate(request, opts) {
   const fallbackNotices = [];
   const withNotices = (base) => fallbackNotices.length > 0 ? [...fallbackNotices, ...base] : base;
   const explicitFilesRaw = parseExplicitFilenames(request);
-  const explicitFiles = explicitFilesRaw.length > 0 ? await resolveExplicitPaths(opts.root, explicitFilesRaw, request) : [];
+  let explicitFiles = explicitFilesRaw.length > 0 ? await resolveExplicitPaths(opts.root, explicitFilesRaw, request) : [];
+  const isDocRelPath = (p2) => {
+    const lower2 = p2.toLowerCase();
+    if (lower2.startsWith(".maria/")) return true;
+    const ext2 = lower2.includes(".") ? lower2.slice(lower2.lastIndexOf(".")) : "";
+    return [".md", ".markdown", ".txt", ".json", ".yaml", ".yml", ".xml"].includes(ext2);
+  };
+  if (explicitFiles.length > 0) {
+    explicitFiles = explicitFiles.filter((p2) => !isDocRelPath(p2));
+  }
   dbg("explicitFiles", { raw: explicitFilesRaw, resolved: explicitFiles });
   const explicitAbsMap = /* @__PURE__ */ Object.create(null);
   if (explicitFiles.length > 0) {
@@ -58559,7 +58637,11 @@ async function orchestrate(request, opts) {
   }
   const isEditIntent = await detectEditIntentLLM(opts.root, request, {
     explicitFiles,
-    attachmentsCount: Array.isArray(opts.attachedFiles) ? opts.attachedFiles.length : 0
+    attachmentsCount: (() => {
+      if (!Array.isArray(opts.attachedFiles) || opts.attachedFiles.length === 0) return 0;
+      const docOnly = opts.attachedFiles.every((a) => isDocMime(a.mime));
+      return docOnly ? 0 : opts.attachedFiles.length;
+    })()
   });
   dbg("intent", { isEditIntent });
   let editTargets = explicitFiles;
@@ -58583,6 +58665,22 @@ async function orchestrate(request, opts) {
     dbg("attachment.map", { mappedCount: mapRes.mapped.length, warnings: mapRes.warnings });
     mapRes.warnings.slice();
     for (const m2 of mapRes.mapped) {
+      try {
+        const mime = m2?.attachment?.mime;
+        if (isDocMime(mime)) {
+          if (opts.flags.planOnly || opts.flags.dryRun || !opts.flags.apply) {
+            initial.push({
+              path: m2.path,
+              kind: "doc",
+              action: m2.exists ? "modify" : "create",
+              description: m2.exists ? "Documentation (attached)" : "Documentation (attached)",
+              preview: m2.attachment.content
+            });
+          }
+          continue;
+        }
+      } catch {
+      }
       initial.push({
         path: m2.path,
         kind: "source",
@@ -58627,10 +58725,17 @@ async function orchestrate(request, opts) {
               }
             } catch {
             }
-            const targetDirsAbs = Array.from(new Set(targetFilesAbs.map((p2) => p2.split("/").slice(0, -1).join("/")).filter(Boolean)));
-            const targetFilesSection = targetFilesAbs.length > 0 ? ["// TARGET FILES (absolute):", ...targetFilesAbs.map((p2) => `// - ${p2}`)].join("\n") : "";
+            const isDocPath = (p2) => {
+              const lower2 = p2.toLowerCase();
+              if (lower2.includes("/.maria/")) return true;
+              const ext2 = lower2.includes(".") ? lower2.slice(lower2.lastIndexOf(".")) : "";
+              return [".md", ".markdown", ".txt", ".json", ".yaml", ".yml", ".xml"].includes(ext2);
+            };
+            const docOnlyTargets = targetFilesAbs.length > 0 && targetFilesAbs.every(isDocPath);
+            const targetDirsAbs = docOnlyTargets ? [] : Array.from(new Set(targetFilesAbs.map((p2) => p2.split("/").slice(0, -1).join("/")).filter(Boolean)));
+            const targetFilesSection = !docOnlyTargets && targetFilesAbs.length > 0 ? ["// TARGET FILES (absolute):", ...targetFilesAbs.map((p2) => `// - ${p2}`)].join("\n") : "";
             const targetDirsSection = targetDirsAbs.length > 0 ? ["// TARGET DIRECTORIES (absolute):", ...targetDirsAbs.map((p2) => `// - ${p2}`)].join("\n") : "";
-            const requestPreamble = isEditIntent ? [
+            const requestPreamble = isEditIntent && !docOnlyTargets ? [
               "// EDIT MODE RULES:",
               "// 1) Read the entire target file(s) BEFORE making changes. Assume omitted lines must remain exactly as-is.",
               "// 2) Preserve unrelated content and formatting (indentation, EOLs, imports order, license headers, path/file references, and any other unrelated properties). Keep them AS IS.",
@@ -58652,12 +58757,30 @@ ${request}
 
 ${editContext}`;
             dbg("executeCode.prompt.head", enriched.slice(0, 1400));
-            const ctxAttachments = Array.isArray(opts.attachedFiles) && opts.attachedFiles.length > 0 ? opts.attachedFiles.map((f3) => ({
-              name: f3.originalName,
-              path: f3.pathHint,
-              mime: f3.mime || "text/plain",
-              data_base64: f3.content ? Buffer.from(f3.content, "utf8").toString("base64") : void 0
-            })).map((a) => a.data_base64 ? a : { ...a, data_base64: void 0 }) : [];
+            const ctxAttachments = Array.isArray(opts.attachedFiles) && opts.attachedFiles.length > 0 ? await (async () => {
+              const fs58 = await import('fs/promises');
+              const out = [];
+              for (const f3 of opts.attachedFiles) {
+                try {
+                  const name2 = f3.originalName;
+                  const p2 = f3.pathHint;
+                  const mime = f3.mime || "text/plain";
+                  let data_base64 = void 0;
+                  if (f3.content && f3.content.length > 0) {
+                    data_base64 = Buffer.from(f3.content, "utf8").toString("base64");
+                  } else if (p2) {
+                    try {
+                      const buf = await fs58.readFile(p2);
+                      data_base64 = buf.toString("base64");
+                    } catch {
+                    }
+                  }
+                  out.push({ name: name2, path: p2, mime, data_base64 });
+                } catch {
+                }
+              }
+              return out;
+            })() : [];
             const pathAttachments = [];
             const attachedPathSet = /* @__PURE__ */ new Set();
             if (explicitFiles.length > 0) {
@@ -59472,7 +59595,7 @@ ${h2.head}`);
       "1) If the request references existing repository directory/file paths, prefer EDIT_EXISTING unless it explicitly asks to scaffold a new project.",
       "2) Phrases like 'fix', 'improve', 'update', 'change', 'patch', 'make it work', or 'by editing the existing files' imply EDIT_EXISTING.",
       "3) Phrases like create/new project/scaffold/from scratch/template imply CREATE_NEW.",
-      "4) Attachments or explicit file paths increase likelihood of EDIT_EXISTING.",
+      "4) If the only referenced paths are documentation files (e.g., .md/.txt/.json/.yaml/.yml) or files under hidden planning folders (e.g., .maria/), do NOT treat that as evidence for EDIT_EXISTING; prefer CREATE_NEW unless explicitly asked to edit.",
       'Output MUST be EXACTLY this JSON object with no extra text/code blocks: { "intent": "EDIT_EXISTING" | "CREATE_NEW" }'
     ].join("\n");
     const evidence = {
@@ -59489,7 +59612,16 @@ ${h2.head}`);
       "Repo snapshot (trimmed):",
       headSnippets.join("\n\n")
     ].join("\n\n");
-    if (existingDirs.length > 0 || existingFiles.length > 0 || ctx2.explicitFiles && ctx2.explicitFiles.length > 0 || ctx2.attachmentsCount > 0 || anyExistingPathMentioned) {
+    const isDocPath = (p2) => {
+      const lower2 = p2.toLowerCase();
+      if (lower2.startsWith(".maria/")) return true;
+      const ext2 = lower2.includes(".") ? lower2.slice(lower2.lastIndexOf(".")) : "";
+      return [".md", ".markdown", ".txt", ".json", ".yaml", ".yml", ".xml"].includes(ext2);
+    };
+    const docExistingCount = existingFiles.filter(isDocPath).length;
+    const codeExistingCount = existingFiles.length - docExistingCount;
+    const explicitDocOnly = Array.isArray(ctx2.explicitFiles) && ctx2.explicitFiles.length > 0 && ctx2.explicitFiles.every(isDocPath);
+    if (existingDirs.length > 0 || codeExistingCount > 0 || ctx2.attachmentsCount > 0 && !explicitDocOnly) {
       return true;
     }
     let startedLocalSpinner = false;
@@ -59520,12 +59652,19 @@ ${h2.head}`);
       if (m2) jsonText = m2[0];
     }
     const parsed = jsonText ? JSON.parse(jsonText) : {};
-    if (existingDirs.length > 0 || existingFiles.length > 0 || anyExistingPathMentioned || ctx2.explicitFiles && ctx2.explicitFiles.length > 0 || ctx2.attachmentsCount > 0) {
-      return true;
-    }
+    if (existingDirs.length > 0 || codeExistingCount > 0) return true;
+    if (explicitDocOnly) return false;
     return parsed?.intent === "EDIT_EXISTING";
   } catch {
-    return ctx2.explicitFiles && ctx2.explicitFiles.length > 0 || ctx2.attachmentsCount > 0 || existingDirs.length > 0 || existingFiles.length > 0 || anyExistingPathMentioned;
+    const isDocPath = (p2) => {
+      const lower2 = p2.toLowerCase();
+      if (lower2.startsWith(".maria/")) return true;
+      const ext2 = lower2.includes(".") ? lower2.slice(lower2.lastIndexOf(".")) : "";
+      return [".md", ".markdown", ".txt", ".json", ".yaml", ".yml", ".xml"].includes(ext2);
+    };
+    const explicitDocOnly = Array.isArray(ctx2.explicitFiles) && ctx2.explicitFiles.length > 0 && ctx2.explicitFiles.every(isDocPath);
+    if (explicitDocOnly) return false;
+    return existingDirs.length > 0;
   }
 }
 function sanitizeFolderName(name2) {
@@ -59715,6 +59854,16 @@ async function resolveExplicitPaths(root, files, hintText) {
   const out = [];
   for (const desired of files) {
     const normalized = desired.replace(/^\/+/, "").replace(/\\/g, "/");
+    try {
+      const pathMod2 = await import('path');
+      if (pathMod2.isAbsolute(normalized)) {
+        const rel = pathMod2.relative(root, normalized).replace(/\\/g, "/");
+        if (!rel || rel.startsWith("..")) {
+          continue;
+        }
+      }
+    } catch {
+    }
     if (allFiles.includes(normalized)) {
       out.push(normalized);
       continue;
@@ -59934,7 +60083,28 @@ var init_code_command = __esm({
           if (opts.dryRun && !opts.previewLines) opts.previewLines = 50;
           const root = opts.root || process.cwd();
           const { orchestrate: orchestrate2 } = await Promise.resolve().then(() => (init_Orchestrator(), Orchestrator_exports));
-          const attachments = await this.collectAttachedFiles(context2).catch(() => []);
+          let attachments = await this.collectAttachedFiles(context2).catch(() => []);
+          try {
+            const { collectFileAttachmentsFromText: collectFileAttachmentsFromText2 } = await Promise.resolve().then(() => (init_attachment_utils(), attachment_utils_exports));
+            const detected = await collectFileAttachmentsFromText2(request, process.cwd(), { maxBytes: 12 * 1024 * 1024 });
+            if (Array.isArray(detected) && detected.length) {
+              const seen = new Set(attachments.map((a) => (a.pathHint || a.originalName).toLowerCase()));
+              for (const d of detected) {
+                const key = String(d.path || d.name || "").toLowerCase();
+                if (!key || seen.has(key)) continue;
+                let content = "";
+                if (d.data_base64) {
+                  try {
+                    content = Buffer.from(d.data_base64, "base64").toString("utf8");
+                  } catch {
+                  }
+                }
+                attachments.push({ originalName: d.name || key, pathHint: d.path, content, size: content ? Buffer.byteLength(content, "utf8") : 0, mime: d.mime });
+                seen.add(key);
+              }
+            }
+          } catch {
+          }
           try {
             if (process.env.MARIA_DEBUG === "1") {
               const attView = attachments.map((a) => ({ name: a.originalName, size: a.size, mime: a.mime, pathHint: a.pathHint })).slice(0, 50);