@lazyingart/agintiflow 0.20.185 → 0.20.187

package/docs/auxiliary-image-generation.md

@@ -75,6 +75,21 @@ That SVG request returns a PNG fallback contract rather than pretending SVG was
 }
 ```
 
+The CLI exposes the same direct path for shell scripts and other local apps:
+
+```bash
+aginti image --json --dry-run \
+  --provider venice \
+  --format svg \
+  --output-dir artifacts/images/robot-cover \
+  --output-stem cover.svg \
+  "A cyan robot painting a poster, clean product illustration"
+```
+
+`aginti image ...` returns the same `requestedFormat`, `actualFormat`, and `formatNotice` fields as the web API. Use this direct CLI when
+an app needs a deterministic tool call. Use `aginti --image "..."` when the user wants an agent-mediated image task that may plan, inspect
+references, create files, or send artifacts to the canvas.
+
 With GRS AI, the tool uses the Nano Banana API:
 
 - `POST https://grsaiapi.com/v1/draw/nano-banana`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.185",
+  "version": "0.20.187",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/public/app.js

@@ -1251,6 +1251,37 @@ function workspaceFilesByLane() {
   return groups;
 }
 
+function buildWorkspaceFolderTree(files = []) {
+  const root = { name: "", path: "", dirs: new Map(), files: [] };
+  for (const file of files) {
+    const parts = String(file.path || "")
+      .split("/")
+      .filter(Boolean);
+    if (!parts.length) continue;
+    const fileName = parts.pop();
+    let node = root;
+    let currentPath = "";
+    for (const part of parts) {
+      currentPath = currentPath ? `${currentPath}/${part}` : part;
+      if (!node.dirs.has(part)) node.dirs.set(part, { name: part, path: currentPath, dirs: new Map(), files: [] });
+      node = node.dirs.get(part);
+    }
+    node.files.push({ ...file, name: file.name || fileName });
+  }
+  return root;
+}
+
+function workspaceFolderCount(node) {
+  if (!node) return 0;
+  let count = node.files?.length || 0;
+  for (const child of node.dirs?.values?.() || []) count += workspaceFolderCount(child);
+  return count;
+}
+
+function sortWorkspaceFiles(left, right) {
+  return String(left.path || "").localeCompare(String(right.path || ""));
+}
+
 function workspaceActiveFile() {
   return workspaceBrowser.files.find((file) => file.path === workspaceBrowser.activePath) || null;
 }
@@ -1279,12 +1310,18 @@ function renderWorkspaceExplorer() {
   const activeLane = workspaceBrowser.activeLane || "all";
   const warnings = workspaceBrowser.warnings?.length ? ` · ${workspaceBrowser.warnings.length} warning(s)` : "";
   const truncated = workspaceBrowser.truncated ? " · truncated" : "";
-  const status = workspaceBrowser.loading
-    ? "Loading workspace..."
-    : workspaceBrowser.error
-      ? `Workspace unavailable: ${workspaceBrowser.error}`
-      : `${workspaceBrowser.files.length} files · ${workspaceBrowser.root || workspaceRoot()}${warnings}${truncated}`;
-  workspaceBrowserStatusEl.textContent = status;
+  if (workspaceBrowser.loading) {
+    workspaceBrowserStatusEl.textContent = "Loading workspace...";
+  } else if (workspaceBrowser.error) {
+    workspaceBrowserStatusEl.textContent = `Workspace unavailable: ${workspaceBrowser.error}`;
+  } else {
+    workspaceBrowserStatusEl.innerHTML = `
+      <span class="workspace-status-chip">${workspaceBrowser.files.length} files</span>
+      <span class="workspace-status-chip">${escapeHtml(activeLane)}</span>
+      <code class="workspace-root-path">${escapeHtml(workspaceBrowser.root || workspaceRoot())}</code>
+      ${warnings || truncated ? `<span class="workspace-status-warn">${escapeHtml(`${warnings}${truncated}`.replace(/^ · /, ""))}</span>` : ""}
+    `;
+  }
 
   workspaceLanesEl.innerHTML = WORKSPACE_LANES.map((lane) => {
     const count = groups[lane.id]?.length || 0;
@@ -1302,34 +1339,69 @@ function renderWorkspaceExplorer() {
     `;
   }).join("");
 
-  const visibleFiles = (groups[activeLane] || []).slice().sort((left, right) => left.path.localeCompare(right.path));
+  const visibleFiles = (groups[activeLane] || []).slice().sort(sortWorkspaceFiles);
   if (!visibleFiles.length) {
     workspaceTreeEl.innerHTML = `<p class="subtle workspace-empty">No files in this category.</p>`;
     return;
   }
 
-  workspaceTreeEl.innerHTML = visibleFiles
-    .map((file) => {
-      const lane = inferWorkspaceLane(file);
-      const active = file.path === workspaceBrowser.activePath;
-      const meta = [lane, formatBytes(file.size), file.binary ? "binary" : "text"].join(" · ");
-      return `
-        <button
-          type="button"
-          class="workspace-file-row"
-          data-workspace-file="${escapeHtml(file.path)}"
-          data-selected="${active}"
-          draggable="true"
-        >
-          <span class="workspace-file-main">
-            <strong>${escapeHtml(workspaceBaseName(file.path))}</strong>
-            <small>${escapeHtml(workspaceDir(file.path) || ".")}</small>
-          </span>
-          <span class="workspace-file-meta">${escapeHtml(meta)}</span>
-        </button>
-      `;
-    })
-    .join("");
+  const tree = buildWorkspaceFolderTree(visibleFiles);
+  workspaceTreeEl.innerHTML = `
+    <div class="workspace-tree-toolbar">
+      <span>${escapeHtml(WORKSPACE_LANES.find((lane) => lane.id === activeLane)?.label || "Files")}</span>
+      <strong>${visibleFiles.length}</strong>
+    </div>
+    <div class="workspace-folder-root">
+      ${renderWorkspaceFolderNode(tree, 0)}
+    </div>
+  `;
+}
+
+function renderWorkspaceFileNode(file, depth = 0) {
+  const lane = inferWorkspaceLane(file);
+  const active = file.path === workspaceBrowser.activePath;
+  const meta = [lane, formatBytes(file.size), file.binary ? "binary" : "text"].join(" · ");
+  return `
+    <button
+      type="button"
+      class="workspace-file-row workspace-tree-file"
+      data-workspace-file="${escapeHtml(file.path)}"
+      data-selected="${active}"
+      draggable="true"
+      style="--depth: ${depth};"
+    >
+      <span class="workspace-file-icon" aria-hidden="true">${file.binary ? "bin" : "txt"}</span>
+      <span class="workspace-file-main">
+        <strong>${escapeHtml(workspaceBaseName(file.path))}</strong>
+        <small>${escapeHtml(workspaceDir(file.path) || ".")}</small>
+      </span>
+      <span class="workspace-file-meta">${escapeHtml(meta)}</span>
+    </button>
+  `;
+}
+
+function renderWorkspaceFolderNode(node, depth = 0) {
+  const dirs = [...(node.dirs?.values?.() || [])].sort((left, right) => left.name.localeCompare(right.name));
+  const files = (node.files || []).slice().sort(sortWorkspaceFiles);
+  const children = [
+    ...dirs.map((child) => renderWorkspaceFolderNode(child, depth + 1)),
+    ...files.map((file) => renderWorkspaceFileNode(file, depth)),
+  ].join("");
+  if (depth === 0) return children;
+  const activeInside = workspaceBrowser.activePath && workspaceBrowser.activePath.startsWith(`${node.path}/`);
+  const open = depth <= 2 || activeInside;
+  return `
+    <details class="workspace-folder" ${open ? "open" : ""} style="--depth: ${Math.max(depth - 1, 0)};">
+      <summary>
+        <span class="workspace-folder-icon" aria-hidden="true">&gt;</span>
+        <span class="workspace-folder-name">${escapeHtml(node.name)}</span>
+        <small>${workspaceFolderCount(node)}</small>
+      </summary>
+      <div class="workspace-folder-children">
+        ${children}
+      </div>
+    </details>
+  `;
 }
 
 function renderWorkspaceWorkbench() {

package/public/styles.css

@@ -959,10 +959,43 @@ button.danger {
 }
 
 .workspace-browser-status {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 7px;
   line-height: 1.35;
   overflow-wrap: anywhere;
 }
 
+.workspace-status-chip {
+  padding: 4px 8px;
+  border: 1px solid rgba(15, 118, 110, 0.16);
+  border-radius: 999px;
+  background: rgba(255, 253, 250, 0.86);
+  color: var(--ink);
+  font-size: 0.76rem;
+  font-weight: 700;
+  text-transform: capitalize;
+}
+
+.workspace-root-path {
+  min-width: 0;
+  max-width: 100%;
+  padding: 5px 8px;
+  border: 1px solid rgba(15, 118, 110, 0.14);
+  border-radius: 10px;
+  background: rgba(13, 148, 136, 0.07);
+  color: #155e75;
+  font-family: "IBM Plex Mono", "SFMono-Regular", monospace;
+  font-size: 0.76rem;
+  overflow-wrap: anywhere;
+}
+
+.workspace-status-warn {
+  color: #b45309;
+  font-size: 0.76rem;
+}
+
 .workspace-lanes {
   display: grid;
   grid-template-columns: repeat(auto-fit, minmax(82px, 1fr));
@@ -995,11 +1028,105 @@ button.danger {
 }
 
 .workspace-tree {
-  display: grid;
-  gap: 7px;
   max-height: 440px;
   overflow: auto;
-  padding-right: 2px;
+  padding: 8px;
+  border: 1px solid rgba(15, 118, 110, 0.12);
+  border-radius: 16px;
+  background:
+    linear-gradient(180deg, rgba(255, 253, 250, 0.88), rgba(240, 253, 250, 0.58)),
+    rgba(255, 255, 255, 0.72);
+}
+
+.workspace-tree-toolbar {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 10px;
+  margin: -8px -8px 8px;
+  padding: 8px 10px;
+  border-bottom: 1px solid rgba(15, 118, 110, 0.1);
+  background: rgba(255, 253, 250, 0.95);
+  color: var(--muted);
+  font-size: 0.78rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+}
+
+.workspace-tree-toolbar strong {
+  color: var(--accent);
+}
+
+.workspace-folder-root,
+.workspace-folder-children {
+  display: grid;
+  gap: 4px;
+}
+
+.workspace-folder {
+  margin-left: calc(var(--depth, 0) * 12px);
+}
+
+.workspace-folder summary {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  min-height: 32px;
+  padding: 6px 8px;
+  border: 1px solid transparent;
+  border-radius: 11px;
+  color: var(--ink);
+  cursor: pointer;
+  list-style: none;
+  user-select: none;
+}
+
+.workspace-folder summary::-webkit-details-marker {
+  display: none;
+}
+
+.workspace-folder summary:hover {
+  border-color: rgba(15, 118, 110, 0.16);
+  background: rgba(240, 253, 250, 0.72);
+}
+
+.workspace-folder-icon {
+  display: inline-grid;
+  place-items: center;
+  width: 18px;
+  height: 18px;
+  border: 1px solid rgba(15, 118, 110, 0.18);
+  border-radius: 6px;
+  color: var(--accent);
+  font-family: "IBM Plex Mono", "SFMono-Regular", monospace;
+  font-size: 0.68rem;
+  transition: transform 0.16s ease;
+}
+
+.workspace-folder[open] > summary .workspace-folder-icon {
+  transform: rotate(90deg);
+}
+
+.workspace-folder-name {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-weight: 750;
+}
+
+.workspace-folder summary small {
+  margin-left: auto;
+  color: var(--muted);
+  font-size: 0.72rem;
+}
+
+.workspace-folder-children {
+  margin-top: 4px;
 }
 
 .workspace-empty {
@@ -1011,18 +1138,23 @@ button.danger {
 
 .workspace-file-row {
   display: grid;
-  grid-template-columns: minmax(0, 1fr);
-  gap: 3px;
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 6px 8px;
+  align-items: center;
   width: 100%;
-  padding: 10px 11px;
+  padding: 8px 10px;
   border: 1px solid rgba(217, 119, 6, 0.16);
-  border-radius: 14px;
+  border-radius: 12px;
   background: rgba(255, 253, 250, 0.72);
   color: var(--ink);
   cursor: pointer;
   text-align: left;
 }
 
+.workspace-tree-file {
+  margin-left: calc(var(--depth, 0) * 12px);
+}
+
 .workspace-file-row:hover {
   border-color: rgba(15, 118, 110, 0.34);
   background: rgba(240, 253, 250, 0.72);
@@ -1030,10 +1162,24 @@ button.danger {
 
 .workspace-file-row[data-selected="true"] {
   border-color: rgba(15, 118, 110, 0.58);
-  background: linear-gradient(135deg, rgba(15, 118, 110, 0.18), rgba(255, 255, 255, 0.92));
+  background: linear-gradient(135deg, rgba(15, 118, 110, 0.22), rgba(255, 255, 255, 0.96));
   box-shadow: 0 0 0 2px rgba(15, 118, 110, 0.1);
 }
 
+.workspace-file-icon {
+  display: inline-grid;
+  place-items: center;
+  width: 30px;
+  height: 24px;
+  border-radius: 8px;
+  background: rgba(15, 118, 110, 0.09);
+  color: #155e75;
+  font-family: "IBM Plex Mono", "SFMono-Regular", monospace;
+  font-size: 0.62rem;
+  font-weight: 800;
+  text-transform: uppercase;
+}
+
 .workspace-file-main {
   display: grid;
   gap: 1px;
@@ -1050,6 +1196,7 @@ button.danger {
 
 .workspace-file-main small,
 .workspace-file-meta {
+  grid-column: 2;
   color: var(--muted);
   font-size: 0.76rem;
 }

package/references/agintiflow-npm-publication-memory.md

@@ -10,6 +10,28 @@ This note records the working publication route for AgInTiFlow so future release
 
 Latest verified release:
 
+- Version: `0.20.186`
+- Commit: `f32a748`
+- GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26700782132`
+- Workflow result: success
+- npm registry check: `npm view @lazyingart/agintiflow version dist-tags.latest --registry=https://registry.npmjs.org` returned `0.20.186`.
+- Installed verification: `npm install -g @lazyingart/agintiflow@0.20.186` then `aginti --version` returned `0.20.186`.
+- Webapp verification: `aginti webapp restart --port 3210` then `curl -fsS http://127.0.0.1:3210/health` returned `version":"0.20.186"` from the global npm package path.
+- Direct image CLI verification: `aginti image --json --dry-run --format svg` returned `requestedFormat:"svg"`, `actualFormat:"png"`, and a clear raster PNG fallback notice.
+
+Previous verified release:
+
+- Version: `0.20.185`
+- Commit: `58d6087`
+- GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26700387931`
+- Workflow result: success
+- npm registry check: `npm view @lazyingart/agintiflow version dist-tags.latest --registry=https://registry.npmjs.org` returned `0.20.185`.
+- Installed verification: `npm install -g @lazyingart/agintiflow@0.20.185` then `aginti --version` returned `0.20.185`.
+- Webapp verification: `aginti webapp restart --port 3210` then `curl -fsS http://127.0.0.1:3210/health` returned `version":"0.20.185"` from the global npm package path.
+- Image API verification: `POST /api/auxiliary/generate-image` with `format:"svg"` and `dryRun:true` returned `requestedFormat:"svg"`, `actualFormat:"png"`, and a clear raster PNG fallback notice.
+
+Previous verified release:
+
 - Version: `0.20.184`
 - Commit: `9b22f4c`
 - GitHub Actions run: `https://github.com/lazyingart/AgInTiFlow/actions/runs/26700154894`

package/scripts/smoke-auxiliary-tools.js

@@ -3,6 +3,8 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { execFile as execFileCallback } from "node:child_process";
+import { promisify } from "node:util";
 import { runAgent } from "../src/agent-runner.js";
 import { generateImage, listAuxiliarySkills } from "../src/auxiliary-tools.js";
 import { resolveRuntimeConfig } from "../src/config.js";
@@ -10,6 +12,7 @@ import { providerKeyStatus, setProviderKey } from "../src/project.js";
 import { SessionStore } from "../src/session-store.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const execFile = promisify(execFileCallback);
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-auxiliary-"));
 process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
 const runtimeDir = path.join(tempRoot, "runtime");
@@ -82,6 +85,37 @@ try {
   );
   assert(svgFallbackManifest.requestedFormat === "svg" && svgFallbackManifest.actualFormat === "png", "SVG fallback manifest missing format contract");
 
+  const cliImage = await execFile(
+    process.execPath,
+    [
+      path.join(repoRoot, "bin/aginti-cli.js"),
+      "--no-auto-update",
+      "image",
+      "--json",
+      "--dry-run",
+      "--cwd",
+      workspace,
+      "--provider",
+      "venice",
+      "--format",
+      "svg",
+      "--output-dir",
+      "artifacts/images/cli-svg-fallback",
+      "--output-stem",
+      "diagram.svg",
+      "A simple geometric diagram requested as SVG.",
+    ],
+    {
+      cwd: repoRoot,
+      env: { ...process.env, AGINTIFLOW_HOME: process.env.AGINTIFLOW_HOME },
+    }
+  );
+  const cliImageResult = JSON.parse(cliImage.stdout);
+  assert(cliImageResult.ok && cliImageResult.requestedFormat === "svg", "direct image CLI did not record requestedFormat");
+  assert(cliImageResult.actualFormat === "png", "direct image CLI did not select PNG fallback");
+  assert(/raster PNG/i.test(cliImageResult.formatNotice || ""), "direct image CLI did not explain SVG-to-PNG fallback");
+  await fs.access(path.join(workspace, "artifacts/images/cli-svg-fallback/task_manifest.json"));
+
   const blocked = await generateImage(
     {
       prompt: "blocked",
@@ -131,6 +165,7 @@ try {
           "generate_image_dry_run",
           "venice_generate_image_dry_run",
           "svg_request_png_fallback",
+          "direct_image_cli_svg_request_png_fallback",
           "generate_image_guardrail",
           "mock_agent_image_tool",
         ],

package/scripts/smoke-web-api.js

@@ -93,6 +93,7 @@ try {
   await fs.mkdir(path.join(runtimeDir, "data"), { recursive: true });
   await fs.writeFile(path.join(runtimeDir, "notes", "workspace-smoke.md"), "# Workspace smoke\n\nEditable text.\n");
   await fs.writeFile(path.join(runtimeDir, "data", "workspace-smoke.csv"), "sample,value\nalpha,1\n");
+  await fs.writeFile(path.join(runtimeDir, ".aginti", ".env"), "DEEPSEEK_API_KEY=should-not-render\n");
 
   const webAppHtml = await fs.readFile(path.join(repoRoot, "public", "index.html"), "utf8");
   const chatThreadIndex = webAppHtml.indexOf('id="chat-thread"');
@@ -145,6 +146,9 @@ try {
   if (!workspaceSnapshot.files?.some((file) => file.path === "notes/workspace-smoke.md" && file.content.includes("Editable text."))) {
     throw new Error(`workspace snapshot did not include editable note: ${JSON.stringify(workspaceSnapshot.files?.slice(0, 5))}`);
   }
+  if (workspaceSnapshot.files?.some((file) => file.path === ".aginti/.env" || file.path === ".aginti/mcp.json" || file.path === ".env")) {
+    throw new Error(`workspace snapshot exposed protected internal/secret files: ${JSON.stringify(workspaceSnapshot.files?.slice(0, 10))}`);
+  }
   const rawWorkspaceResponse = await fetch(
     `${baseUrl}/api/workspace/raw?commandCwd=${encodeURIComponent(runtimeDir)}&path=${encodeURIComponent("notes/workspace-smoke.md")}`
   );
@@ -152,6 +156,20 @@ try {
   if (!rawWorkspaceResponse.ok || !rawWorkspaceText.includes("Workspace smoke")) {
     throw new Error(`workspace raw endpoint failed: status=${rawWorkspaceResponse.status} body=${rawWorkspaceText.slice(0, 120)}`);
   }
+  const protectedRawResponse = await fetch(
+    `${baseUrl}/api/workspace/raw?commandCwd=${encodeURIComponent(runtimeDir)}&path=${encodeURIComponent(".aginti/.env")}`
+  );
+  if (protectedRawResponse.ok) {
+    throw new Error("workspace raw endpoint exposed protected .aginti/.env");
+  }
+  const protectedWriteResponse = await fetch(`${baseUrl}/api/workspace/write`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ commandCwd: runtimeDir, path: ".env", content: "SECRET=blocked\n" }),
+  });
+  if (protectedWriteResponse.ok) {
+    throw new Error("workspace write endpoint allowed protected .env");
+  }
   const writtenWorkspace = await fetchJson("/api/workspace/write", {
     method: "POST",
     headers: { "Content-Type": "application/json" },

package/scripts/smoke-web-ui.js

@@ -73,8 +73,10 @@ let browser;
 
 try {
   await waitForHealth();
+  await fs.mkdir(path.join(runtimeDir, ".aginti"), { recursive: true });
   await fs.mkdir(path.join(runtimeDir, "notes"), { recursive: true });
   await fs.mkdir(path.join(runtimeDir, "data"), { recursive: true });
+  await fs.writeFile(path.join(runtimeDir, ".aginti", ".env"), "DEEPSEEK_API_KEY=should-not-render\n");
   await fs.writeFile(path.join(runtimeDir, "notes", "workspace-ui.md"), "# Workspace UI\n\ninitial body\n");
   await fs.writeFile(path.join(runtimeDir, "data", "workspace-ui.csv"), "sample,value\nalpha,1\n");
   browser = await chromium.launch({ headless: true });
@@ -102,6 +104,16 @@ try {
   if ((await page.locator("#workspace-lanes [data-workspace-lane]").count()) < 8) {
     throw new Error("workspace explorer did not render general category lanes");
   }
+  if ((await page.locator('[data-workspace-file=".aginti/.env"]').count()) !== 0) {
+    throw new Error("workspace explorer exposed protected .aginti/.env");
+  }
+  if ((await page.locator("#workspace-tree details.workspace-folder").count()) < 1) {
+    throw new Error("workspace explorer did not render a folder tree");
+  }
+  const statusText = await page.locator("#workspace-browser-status").innerText();
+  if (!statusText.includes(runtimeDir) || !/files/i.test(statusText)) {
+    throw new Error(`workspace explorer status did not show file count and root path: ${statusText}`);
+  }
   if ((await page.locator('[data-workspace-file="notes/workspace-ui.md"]').getAttribute("draggable")) !== "true") {
     throw new Error("workspace file rows are not draggable");
   }
@@ -305,6 +317,9 @@ try {
           "working-directory-search-top",
           "project-status-chips",
           "workspace-explorer-general-lanes",
+          "workspace-explorer-folder-tree",
+          "workspace-explorer-protected-files-hidden",
+          "workspace-explorer-status-root",
           "workspace-file-selection",
           "workspace-editor-save-persists",
           "workspace-file-drop-to-chat",

package/src/cli.js

@@ -30,6 +30,7 @@ import { listTaskProfiles } from "./task-profiles.js";
 import { recommendedMaxStepsForTask } from "./engineering-guidance.js";
 import { normalizeAuthProvider, promptHidden, runAuthWizard, shouldPromptForDeepSeek } from "./auth-onboarding.js";
 import { listSkills, selectSkillsForGoal } from "./skill-library.js";
+import { generateImage } from "./auxiliary-tools.js";
 import { languageLabel, resolveLanguage } from "./i18n.js";
 import { maybeAutoUpdate } from "./auto-update.js";
 import { readHousekeepingSummary } from "./housekeeping.js";
@@ -761,7 +762,7 @@ function exitOnUnknownOptions(parsed) {
 
 function printUsage() {
   console.log(
-    'Usage: aginti [chat] OR aginti init [--template minimal|disciplined|coding|research|writing|design|aaps|supervision] OR aginti web [--port 3210] OR aginti docker [status|setup|install-host] OR aginti update OR aginti models OR aginti aaps [status|init|files|validate|compile|check|run] OR aginti mcp [status|config|inspect|tools|resources|read|prompts|prompt|call|restart] OR aginti skills [query] OR aginti skillmesh [status|off|record|share|sync|serve|service] OR aginti housekeeping [--json] OR aginti auth [deepseek|openai|qwen|venice|grsai] OR aginti resume [--all-sessions] [latest|<session-id>] ["prompt"] OR aginti --remove-empty-sessions OR aginti --remove-sessions OR aginti queue <session-id> "message" OR aginti [--no-auto-update] [-s safe|normal|danger] [--language en|ja|zh-Hans|zh-Hant|ko|fr|es|ar|vi|de|ru] [--image] [--latex] [--scs|--scs auto|--no-scs] [--dynamic-steps auto|on|off] [--routing smart|fast|complex|manual] [--provider deepseek|openai|qwen|venice|mock] [--model MODEL] [--route-model MODEL] [--main-model MODEL] [--spare-model MODEL --spare-reasoning medium] [--aux-provider grsai|venice --aux-model MODEL] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-file-tools|--no-file-tools] [--web-search|--no-web-search] [--mcp|--no-mcp] [--parallel-scouts|--no-parallel-scouts --scout-count 1..10] [--allow-auxiliary-tools|--no-auxiliary-tools] [--allow-wrappers --wrapper codex --wrapper-model gpt-5.5] [--list-models|--list-routes] "your task"'
+    'Usage: aginti [chat] OR aginti init [--template minimal|disciplined|coding|research|writing|design|aaps|supervision] OR aginti web [--port 3210] OR aginti docker [status|setup|install-host] OR aginti update OR aginti image [--json] [--dry-run] [--format png|webp|svg] "prompt" OR aginti models OR aginti aaps [status|init|files|validate|compile|check|run] OR aginti mcp [status|config|inspect|tools|resources|read|prompts|prompt|call|restart] OR aginti skills [query] OR aginti skillmesh [status|off|record|share|sync|serve|service] OR aginti housekeeping [--json] OR aginti auth [deepseek|openai|qwen|venice|grsai] OR aginti resume [--all-sessions] [latest|<session-id>] ["prompt"] OR aginti --remove-empty-sessions OR aginti --remove-sessions OR aginti queue <session-id> "message" OR aginti [--no-auto-update] [-s safe|normal|danger] [--language en|ja|zh-Hans|zh-Hant|ko|fr|es|ar|vi|de|ru] [--image] [--latex] [--scs|--scs auto|--no-scs] [--dynamic-steps auto|on|off] [--routing smart|fast|complex|manual] [--provider deepseek|openai|qwen|venice|mock] [--model MODEL] [--route-model MODEL] [--main-model MODEL] [--spare-model MODEL --spare-reasoning medium] [--aux-provider grsai|venice --aux-model MODEL] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-file-tools|--no-file-tools] [--web-search|--no-web-search] [--mcp|--no-mcp] [--parallel-scouts|--no-parallel-scouts --scout-count 1..10] [--allow-auxiliary-tools|--no-auxiliary-tools] [--allow-wrappers --wrapper codex --wrapper-model gpt-5.5] [--list-models|--list-routes] "your task"'
   );
   console.log("Permission shortcuts: -s safe asks before writes/setup; -s normal allows current-project writes and Docker setup; -s danger enables trusted host/full-access mode.");
   console.log(`Languages: ${["en", "ja", "zh-Hans", "zh-Hant", "ko", "fr", "es", "ar", "vi", "de", "ru"].map((code) => `${code}=${languageLabel(code)}`).join(", ")}`);
@@ -790,6 +791,211 @@ function splitToolCommandArgv(argv = []) {
   return { actionArgv, optionArgv, json };
 }
 
+function takeImageOptionValue(argv, index, option) {
+  const equals = String(option || "").match(/^([^=]+)=(.*)$/);
+  if (equals) return { value: equals[2], nextIndex: index + 1 };
+  const value = argv[index + 1];
+  return { value: value && !String(value).startsWith("--") ? value : "", nextIndex: value && !String(value).startsWith("--") ? index + 2 : index + 1 };
+}
+
+function parseImageCommandArgs(argv = []) {
+  const result = {
+    prompt: "",
+    provider: "",
+    model: "",
+    format: "",
+    outputDir: "",
+    outputStem: "",
+    aspectRatio: "",
+    imageSize: "",
+    host: "",
+    referenceImages: [],
+    commandCwd: "",
+    requestTimeoutMs: "",
+    pollTimeoutMs: "",
+    pollIntervalMs: "",
+    dryRun: false,
+    json: false,
+    stdin: false,
+    help: false,
+    unknownOptions: [],
+  };
+  const promptParts = [];
+  let index = 0;
+  if (["generate", "create", "make"].includes(String(argv[0] || "").toLowerCase())) index = 1;
+
+  while (index < argv.length) {
+    const arg = String(argv[index] || "");
+    const name = arg.split("=")[0];
+    if (arg === "--") {
+      promptParts.push(...argv.slice(index + 1));
+      break;
+    }
+    if (arg === "--help" || arg === "-h") {
+      result.help = true;
+      index += 1;
+      continue;
+    }
+    if (arg === "--json") {
+      result.json = true;
+      index += 1;
+      continue;
+    }
+    if (arg === "--dry-run" || arg === "--dryrun") {
+      result.dryRun = true;
+      index += 1;
+      continue;
+    }
+    if (arg === "--stdin") {
+      result.stdin = true;
+      index += 1;
+      continue;
+    }
+
+    const valueOptions = new Map([
+      ["--provider", "provider"],
+      ["--aux-provider", "provider"],
+      ["--auxiliary-provider", "provider"],
+      ["--model", "model"],
+      ["--aux-model", "model"],
+      ["--auxiliary-model", "model"],
+      ["--format", "format"],
+      ["--output-dir", "outputDir"],
+      ["--out-dir", "outputDir"],
+      ["--dir", "outputDir"],
+      ["--output-stem", "outputStem"],
+      ["--stem", "outputStem"],
+      ["--aspect-ratio", "aspectRatio"],
+      ["--ratio", "aspectRatio"],
+      ["--image-size", "imageSize"],
+      ["--size", "imageSize"],
+      ["--host", "host"],
+      ["--cwd", "commandCwd"],
+      ["--request-timeout-ms", "requestTimeoutMs"],
+      ["--poll-timeout-ms", "pollTimeoutMs"],
+      ["--poll-interval-ms", "pollIntervalMs"],
+    ]);
+    if (valueOptions.has(name)) {
+      const { value, nextIndex } = takeImageOptionValue(argv, index, arg);
+      if (!value) result.unknownOptions.push(arg);
+      else result[valueOptions.get(name)] = value;
+      index = nextIndex;
+      continue;
+    }
+    if (["--reference", "--reference-image", "--ref", "--image-ref"].includes(name)) {
+      const { value, nextIndex } = takeImageOptionValue(argv, index, arg);
+      if (!value) result.unknownOptions.push(arg);
+      else result.referenceImages.push(value);
+      index = nextIndex;
+      continue;
+    }
+    if (arg.startsWith("--") && promptParts.length === 0) {
+      result.unknownOptions.push(arg);
+      index += 1;
+      continue;
+    }
+    promptParts.push(arg);
+    index += 1;
+  }
+
+  result.prompt = promptParts.join(" ").trim();
+  return result;
+}
+
+function printImageCommandUsage() {
+  console.log(
+    'Usage: aginti image [generate] [--json] [--dry-run] [--provider grsai|venice] [--model MODEL] [--format png|webp|svg] [--output-dir DIR] [--output-stem STEM] [--aspect-ratio 1:1] [--image-size 1K|2K|4K|1024x1024] [--reference path-or-url] "prompt"'
+  );
+  console.log("Direct image CLI calls the same generate_image tool as the web API. SVG/vector requests return PNG with requestedFormat/actualFormat/formatNotice.");
+  console.log('Agent-mediated image work is still available as: aginti --image "draw a poster"');
+}
+
+function directImageCommandArgv(argv = []) {
+  const first = String(argv[0] || "").toLowerCase();
+  const second = String(argv[1] || "").toLowerCase();
+  if (["image", "imagegen", "image-gen", "generate-image", "image-generate"].includes(first)) return argv.slice(1);
+  if (["aux", "auxiliary"].includes(first) && ["image", "imagegen", "image-gen", "generate-image", "generate"].includes(second)) {
+    return argv.slice(2);
+  }
+  return null;
+}
+
+function printImageCommandResult(result = {}) {
+  const status = result.dryRun ? "prepared" : result.ok ? "generated" : result.blocked ? "blocked" : "failed";
+  console.log(`image: ${status}`);
+  if (result.summary) console.log(`summary: ${result.summary}`);
+  if (result.provider) console.log(`provider: ${result.provider}`);
+  if (result.requestedFormat || result.actualFormat) {
+    const requested = result.requestedFormat || "auto";
+    const actual = result.actualFormat || "unknown";
+    console.log(`format: ${requested}${requested === actual ? "" : ` -> ${actual}`}`);
+  }
+  if (result.formatNotice) console.log(`notice: ${result.formatNotice}`);
+  if (result.path) console.log(`path: ${result.path}`);
+  if (result.imagePaths?.length) console.log(`images: ${result.imagePaths.join(", ")}`);
+  if (result.manifestPath) console.log(`manifest: ${result.manifestPath}`);
+  if (result.promptPath) console.log(`prompt: ${result.promptPath}`);
+  if (result.requestPayloadPath) console.log(`request: ${result.requestPayloadPath}`);
+  if (result.reason) console.log(`reason: ${result.reason}`);
+}
+
+async function handleImageCommand(argv, { commandCwd = process.cwd() } = {}) {
+  const parsed = parseImageCommandArgs(argv);
+  if (parsed.help) {
+    printImageCommandUsage();
+    return;
+  }
+  if (parsed.unknownOptions.length) {
+    printUnknownCliOptions(parsed.unknownOptions);
+    process.exit(1);
+  }
+  const prompt = parsed.stdin ? await readStdin() : parsed.prompt;
+  if (!prompt) {
+    printImageCommandUsage();
+    process.exit(1);
+  }
+  const effectiveCommandCwd = path.resolve(parsed.commandCwd || commandCwd || process.cwd());
+  const config = loadConfig(
+    {
+      goal: prompt,
+      taskProfile: "image",
+      commandCwd: effectiveCommandCwd,
+      auxiliaryProvider: parsed.provider,
+      auxiliaryModel: parsed.model,
+      allowFileTools: true,
+      allowAuxiliaryTools: true,
+    },
+    { packageDir, baseDir: effectiveCommandCwd }
+  );
+  const result = await generateImage(
+    {
+      prompt,
+      provider: parsed.provider,
+      model: parsed.model,
+      format: parsed.format,
+      outputDir: parsed.outputDir || undefined,
+      outputStem: parsed.outputStem || undefined,
+      aspectRatio: parsed.aspectRatio || undefined,
+      imageSize: parsed.imageSize || undefined,
+      host: parsed.host || undefined,
+      referenceImages: parsed.referenceImages,
+      requestTimeoutMs: parsed.requestTimeoutMs || undefined,
+      pollTimeoutMs: parsed.pollTimeoutMs || undefined,
+      pollIntervalMs: parsed.pollIntervalMs || undefined,
+      dryRun: parsed.dryRun,
+    },
+    {
+      ...config,
+      commandCwd: effectiveCommandCwd,
+      allowFileTools: true,
+      allowAuxiliaryTools: true,
+    }
+  );
+  if (parsed.json) console.log(JSON.stringify(result, null, 2));
+  else printImageCommandResult(result);
+  if (!result.ok) process.exit(1);
+}
+
 function parseDockerCommandArgs(argv = [], fallbackCwd = process.cwd()) {
   const result = {
     action: "status",
@@ -1856,6 +2062,20 @@ export async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  const imageCommand = directImageCommandArgv(commandArgv);
+  if (imageCommand) {
+    try {
+      await handleImageCommand(imageCommand, { commandCwd });
+    } catch (error) {
+      const wantsJson = imageCommand.includes("--json");
+      const message = error instanceof Error ? error.message : String(error);
+      if (wantsJson) console.log(JSON.stringify({ ok: false, error: message }, null, 2));
+      else console.error(message);
+      process.exit(1);
+    }
+    return;
+  }
+
   if (commandArgv.includes("--remove-empty-sessions") || commandArgv[0] === "remove-empty-sessions") {
     await handleRemoveSessionsCommand({ emptyOnly: true });
     return;

package/web.js

@@ -778,8 +778,11 @@ const WORKSPACE_SKIP_NAMES = new Set([
   ".git",
   ".hg",
   ".svn",
+  ".aginti",
+  ".aginti-work",
   ".aginti-sessions",
   ".agintiflow-home",
+  ".sessions",
   ".cache",
   ".pytest_cache",
   ".ruff_cache",
@@ -790,9 +793,26 @@ const WORKSPACE_SKIP_NAMES = new Set([
   "dist",
   "node_modules",
 ]);
+const WORKSPACE_PROTECTED_DIRS = new Set([".aginti", ".aginti-work", ".aginti-sessions", ".agintiflow-home", ".sessions", ".git", ".hg", ".svn"]);
+const WORKSPACE_PROTECTED_FILES = new Set([".env", ".npmrc", ".pypirc", ".netrc"]);
 const WORKSPACE_MAX_FILES = 1600;
 const WORKSPACE_MAX_TEXT_BYTES = 512 * 1024;
 
+function isProtectedEnvName(name = "") {
+  const value = String(name || "");
+  if (value === ".env") return true;
+  if (!value.startsWith(".env.")) return false;
+  return !/\.(example|sample|template)$/i.test(value);
+}
+
+function isProtectedWorkspacePath(relativePath = "") {
+  const normalized = String(relativePath || "")
+    .replace(/\\/g, "/")
+    .replace(/^\/+/, "");
+  const parts = normalized.split("/").filter(Boolean);
+  return parts.some((part) => WORKSPACE_PROTECTED_DIRS.has(part) || WORKSPACE_PROTECTED_FILES.has(part) || isProtectedEnvName(part));
+}
+
 function isInsideDirectory(parent, candidate) {
   const relative = path.relative(parent, candidate);
   return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
@@ -820,6 +840,9 @@ async function resolveWorkspaceFilePath(root, relativePath = "", { mustExist = f
     .replace(/\\/g, "/")
     .replace(/^\/+/, "");
   if (!normalizedRelative || normalizedRelative.includes("\0")) throw new Error("Workspace file path is required.");
+  if (isProtectedWorkspacePath(normalizedRelative)) {
+    throw new Error("Workspace file is protected because it may contain secrets or AgInTiFlow internals.");
+  }
   const absolutePath = path.resolve(root, normalizedRelative);
   if (!isInsideDirectory(root, absolutePath)) throw new Error("Workspace file path escapes the selected folder.");
 
@@ -892,6 +915,7 @@ async function buildWorkspaceSnapshot(root) {
 
       const absolutePath = path.join(currentDir, entry.name);
       const relativePath = relativeWorkspacePath(root, absolutePath);
+      if (isProtectedWorkspacePath(relativePath)) continue;
       let stat;
       let realPath = absolutePath;
       let symlink = false;