@lazyingart/agintiflow 0.8.12 → 0.10.0

package/README.md

@@ -53,6 +53,10 @@ aginti login deepseek
 # inside chat, use /login or /auth
 # or non-interactively:
 printf '%s' "$DEEPSEEK_API_KEY" | aginti keys set deepseek --stdin
+
+# optional image-generation auxiliary skill:
+aginti login grsai
+# inside chat, use /auxilliary grsai or /auxiliary grsai
 ```
 
 Start an interactive Codex-style CLI chat from any project folder:
@@ -67,6 +71,10 @@ Inside chat, type normal requests such as `write a small Python CLI app with tes
 
 For code edits, AgInTiFlow routes patch/refactor/database-style tasks to DeepSeek v4 pro by default and exposes `apply_patch` as a deterministic workspace tool. It supports exact replacements, Codex-style patch envelopes, and unified diffs, with preflight checks, path guardrails, hashes, and compact per-file diffs. See [docs/patch-tools.md](docs/patch-tools.md).
 
+For larger repositories, use `--profile large-codebase` or choose **Large codebase engineering** in the web UI. This routes to DeepSeek v4 pro, starts with `inspect_project`, then uses search/read/patch/check loops inspired by Codex, Copilot SDK, Claude Code, Gemini CLI, Qwen, and Claw Code. See [docs/large-codebase-engineering.md](docs/large-codebase-engineering.md).
+
+For raster image work, AgInTiFlow has an optional `image_generation` skill backed by the `generate_image` tool and a local `GRSAI` key. The skill tells DeepSeek when image generation is appropriate; the tool calls GRS AI Nano Banana, saves manifests/images under `artifacts/images`, and sends the result to the canvas. See [docs/auxiliary-image-generation.md](docs/auxiliary-image-generation.md).
+
 Launch the local web UI from an installed package:
 
 ```bash

package/docs/auxiliary-image-generation.md

@@ -0,0 +1,62 @@
+# Auxiliary Image Generation
+
+AgInTiFlow separates **skills** from **tools**:
+
+- A skill is instruction and routing context that teaches the agent when a capability is useful.
+- A tool is the deterministic callable function that performs the action and writes auditable artifacts.
+
+The optional image-generation skill is `image_generation`. Its tool is `generate_image`.
+
+## Setup
+
+Store the GRS AI key project-locally:
+
+```bash
+aginti login grsai
+# or
+printf '%s' "$GRSAI" | aginti keys set grsai --stdin
+```
+
+Inside interactive chat, use either spelling:
+
+```text
+/auxilliary grsai
+/auxiliary grsai
+```
+
+The key is saved in `.aginti/.env` as `GRSAI` with `0600` permissions. The CLI and web app only report whether the key exists; they never return the raw value.
+
+## Runtime Flow
+
+For image, cover, poster, illustration, photo, or logo-concept requests, the model can call:
+
+```json
+{
+  "prompt": "A polished cyan robot painting a circuit-board river, high-end product illustration",
+  "outputDir": "artifacts/images/robot-cover",
+  "outputStem": "robot-cover",
+  "aspectRatio": "1:1",
+  "imageSize": "2K"
+}
+```
+
+The tool uses the GRS AI Nano Banana API:
+
+- `POST https://grsaiapi.com/v1/draw/nano-banana`
+- `POST https://grsaiapi.com/v1/draw/result`
+- `Authorization: Bearer <GRSAI>`
+
+Saved workspace artifacts:
+
+- `prompt.txt`
+- `request_payload.redacted.json`
+- `submit_response.json`
+- `result_response.json`
+- `task_manifest.json`
+- generated image files, for example `image.png`
+
+Generated images are sent to the canvas automatically when available.
+
+## Guardrails
+
+Output paths must stay inside the project workspace. Secret paths, `.git`, `node_modules` writes, and oversized reference images are blocked. Reference images may be workspace files, HTTPS URLs, or data URLs.

package/docs/large-codebase-engineering.md

@@ -0,0 +1,49 @@
+# Large Codebase Engineering
+
+AgInTiFlow now treats large or complicated coding tasks as a different operating mode from short file edits.
+
+## What Was Borrowed
+
+Local agent references informed the design:
+
+- Codex-style editing: read/search first, apply deterministic patches, record diffs and hashes, then run checks.
+- Copilot-style SDK surfaces: structured tools, session persistence, plan/history/workspace APIs, and explicit permission hooks.
+- Claude/Claw-style safety: project-local status, container-first execution, read-only operations by default, and clear failure recovery.
+- Gemini/Qwen-style extensibility: capability discovery through profiles and tools rather than hardcoding one model behavior.
+
+## Skill vs Tool
+
+The `large-codebase` profile is a skill: it changes the model’s engineering behavior. It tells DeepSeek v4 pro to orient first, plan minimally, patch incrementally, and verify.
+
+The `inspect_project` function is a tool: it deterministically scans the workspace and returns:
+
+- top-level files and directories
+- manifest files such as `package.json`, `pyproject.toml`, `Cargo.toml`, and `go.mod`
+- package scripts
+- likely source and test directories
+- language and extension counts
+- recommended files to read next
+
+## Recommended Loop
+
+For complicated tasks, the agent should follow this loop:
+
+1. `inspect_project` to map the repository.
+2. `read_file` on `AGENTS.md`, `README.md`, and manifests.
+3. `search_files` for symbols, tests, errors, routes, or config names.
+4. `read_file` only on the files needed for the change.
+5. `apply_patch` in small coherent batches.
+6. `run_command` for the narrowest relevant check first.
+7. Broaden checks only after the focused check passes.
+
+## CLI And Web Parity
+
+Both CLI and web use the same task profile registry and the same model/tool schemas. Use either:
+
+```bash
+aginti --profile large-codebase "fix the failing tests"
+```
+
+or choose **Large codebase engineering** in the web task-profile dropdown.
+
+Smart routing sends this profile to DeepSeek v4 pro even when the user prompt is short.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.8.12",
+  "version": "0.10.0",
   "type": "module",
   "description": "AgInTiFlow is a resumable Playwright website-control agent with OpenAI-compatible tool calling.",
   "license": "Apache-2.0",
@@ -41,6 +41,7 @@
     "scripts/install-docker-ubuntu.sh",
     "scripts/setup-agent-toolchain-docker.sh",
     "scripts/real-deepseek-capabilities.js",
+    "scripts/smoke-auxiliary-tools.js",
     "scripts/smoke-cli-chat.js",
     "scripts/smoke-coding-tools.js",
     "scripts/smoke-capabilities.js",
@@ -61,12 +62,13 @@
     "check": "node --check run.js && node --check web.js && node --check bin/aginti-cli.js && node --check src/*.js",
     "setup:toolchain-docker": "scripts/setup-agent-toolchain-docker.sh",
     "smoke:coding-tools": "node scripts/smoke-coding-tools.js",
+    "smoke:auxiliary-tools": "node scripts/smoke-auxiliary-tools.js",
     "smoke:cli-chat": "node scripts/smoke-cli-chat.js",
     "smoke:toolchain-docker": "node scripts/smoke-toolchain-docker.js",
     "smoke:inbox": "node scripts/smoke-inbox.js",
     "smoke:web-api": "node scripts/smoke-web-api.js",
     "real:deepseek": "node scripts/real-deepseek-capabilities.js",
-    "test": "npm run check && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:capabilities && npm run smoke:cli-chat && npm run smoke:inbox",
+    "test": "npm run check && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:auxiliary-tools && npm run smoke:capabilities && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },

package/public/app.js

@@ -24,7 +24,7 @@ const translations = {
     setupHelp:
       "DeepSeek/OpenAI keys are missing. Use mock mode, export an env var, or save a project-local DeepSeek key.",
     setupEnvHelp:
-      "Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, or LLM_API_KEY. Mock mode remains available for local tests.",
+      "Env vars: DEEPSEEK_API_KEY, OPENAI_API_KEY, LLM_API_KEY, and optional GRSAI for image generation. Mock mode remains available for local tests.",
     setupProviderLabel: "Provider",
     setupKeyLabel: "API key",
     saveKeyButton: "Save local key",
@@ -68,6 +68,7 @@ const translations = {
     headlessLabel: "Headless browser",
     shellToolLabel: "Enable shell tool",
     fileToolLabel: "Enable file tools",
+    auxiliaryToolLabel: "Enable auxiliary skills",
     wrapperToolLabel: "Enable agent wrappers",
     preferredWrapperLabel: "Preferred wrapper",
     dockerSandboxLabel: "Use Docker sandbox",
@@ -648,6 +649,7 @@ const logsEl = document.querySelector("#logs");
 const runMetaEl = document.querySelector("#run-meta");
 const stopRunButton = document.querySelector("#stop-run");
 const keyStatusEl = document.querySelector("#key-status");
+const allowAuxiliaryToolsField = document.querySelector("#allowAuxiliaryTools");
 const allowWrapperToolsField = document.querySelector("#allowWrapperTools");
 const preferredWrapperField = document.querySelector("#preferredWrapper");
 const wrapperStatusEl = document.querySelector("#wrapper-status");
@@ -744,7 +746,9 @@ function renderKeyStatus(status = lastKeyStatus) {
   if (!status) return;
   keyStatusEl.textContent = `${t("keysLabel")}: OpenAI ${
     status.openai ? t("availableLabel") : t("missingLabel")
-  } · DeepSeek ${status.deepseek ? t("availableLabel") : t("missingLabel")} · ${t("mockLabel")} ${
+  } · DeepSeek ${status.deepseek ? t("availableLabel") : t("missingLabel")} · GRS AI ${
+    status.grsai ? t("availableLabel") : t("missingLabel")
+  } · ${t("mockLabel")} ${
     status.mock ? t("availableLabel") : t("missingLabel")
   }`;
   if (setupCardEl) setupCardEl.hidden = Boolean(status.openai || status.deepseek);
@@ -771,6 +775,12 @@ function renderTaskProfiles(selected = "auto") {
   taskProfileField.value = profiles.some((profile) => profile.id === selected) ? selected : "auto";
 }
 
+function recommendedMaxStepsForProfile(profile = "auto") {
+  if (profile === "large-codebase") return 36;
+  if (profile === "latex") return 30;
+  return 24;
+}
+
 function renderWrapperStatus(wrappers = lastWrappers) {
   lastWrappers = wrappers || [];
   if (lastWrappers.length === 0) {
@@ -979,6 +989,7 @@ function formPayload() {
     headless: document.querySelector("#headless").checked,
     allowShellTool: document.querySelector("#allowShellTool").checked,
     allowFileTools: document.querySelector("#allowFileTools").checked,
+    allowAuxiliaryTools: allowAuxiliaryToolsField?.checked ?? true,
     allowWrapperTools: allowWrapperToolsField.checked,
     preferredWrapper: preferredWrapperField.value,
     taskProfile: taskProfileField?.value || "auto",
@@ -1954,7 +1965,14 @@ sandboxModeField.addEventListener("change", updatePackageWarning);
 packageInstallPolicyField.addEventListener("change", updatePackageWarning);
 allowWrapperToolsField.addEventListener("change", () => renderWrapperStatus());
 preferredWrapperField.addEventListener("change", () => renderWrapperStatus());
-taskProfileField?.addEventListener("change", schedulePreferenceSave);
+taskProfileField?.addEventListener("change", () => {
+  const maxStepsField = document.querySelector("#maxSteps");
+  const recommended = recommendedMaxStepsForProfile(taskProfileField.value);
+  if (maxStepsField && Number(maxStepsField.value || 0) < recommended) {
+    maxStepsField.value = String(recommended);
+  }
+  schedulePreferenceSave();
+});
 
 saveApiKeyButton?.addEventListener("click", async () => {
   const provider = setupProviderField.value || "deepseek";
@@ -2167,6 +2185,7 @@ async function loadConfig() {
   packageInstallPolicyField.value = prefs.packageInstallPolicy || "allow";
   document.querySelector("#allowShellTool").checked = prefs.allowShellTool ?? true;
   document.querySelector("#allowFileTools").checked = prefs.allowFileTools ?? true;
+  if (allowAuxiliaryToolsField) allowAuxiliaryToolsField.checked = prefs.allowAuxiliaryTools ?? true;
   allowWrapperToolsField.checked = prefs.allowWrapperTools ?? false;
   preferredWrapperField.value = prefs.preferredWrapper || "codex";
   document.querySelector("#dockerSandboxImage").value = prefs.dockerSandboxImage || "agintiflow-sandbox:latest";

package/public/index.html

@@ -57,6 +57,7 @@
               <select id="setup-provider">
                 <option value="deepseek">DeepSeek</option>
                 <option value="openai">OpenAI</option>
+                <option value="grsai">GRS AI image</option>
               </select>
             </label>
             <label>
@@ -175,6 +176,11 @@
               <span class="switch" aria-hidden="true"></span>
               <span data-i18n="fileToolLabel">Enable file tools</span>
             </label>
+            <label class="switch-label">
+              <input id="allowAuxiliaryTools" name="allowAuxiliaryTools" type="checkbox" checked />
+              <span class="switch" aria-hidden="true"></span>
+              <span data-i18n="auxiliaryToolLabel">Enable auxiliary skills</span>
+            </label>
             <label class="switch-label">
               <input id="allowPasswords" name="allowPasswords" type="checkbox" />
               <span class="switch" aria-hidden="true"></span>

package/scripts/smoke-auxiliary-tools.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { runAgent } from "../src/agent-runner.js";
+import { generateImage, listAuxiliarySkills } from "../src/auxiliary-tools.js";
+import { resolveRuntimeConfig } from "../src/config.js";
+import { providerKeyStatus, setProviderKey } from "../src/project.js";
+import { SessionStore } from "../src/session-store.js";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-auxiliary-"));
+const runtimeDir = path.join(tempRoot, "runtime");
+const workspace = path.join(tempRoot, "workspace");
+await fs.mkdir(workspace, { recursive: true });
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+try {
+  await setProviderKey(workspace, "grsai", "test-grsai-key");
+  const keyStatus = providerKeyStatus(workspace);
+  assert(keyStatus.grsai, "GRSAI key status was not detected");
+  assert(keyStatus.envVars.grsai.includes("GRSAI"), "GRSAI env var name was not reported");
+  assert(listAuxiliarySkills().some((skill) => skill.id === "image_generation"), "image_generation skill missing");
+
+  const dryRun = await generateImage(
+    {
+      prompt: "A small cyan robot holding a paintbrush, clean bright product illustration.",
+      outputDir: "artifacts/images/dry-run",
+      outputStem: "robot",
+      dryRun: true,
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(dryRun.ok && dryRun.dryRun, "generate_image dry run failed");
+  await fs.access(path.join(workspace, "artifacts/images/dry-run/task_manifest.json"));
+  const payloadText = await fs.readFile(path.join(workspace, "artifacts/images/dry-run/request_payload.redacted.json"), "utf8");
+  assert(payloadText.includes("nano-banana-2"), "redacted image payload was not written");
+
+  const blocked = await generateImage(
+    {
+      prompt: "blocked",
+      outputDir: ".env/images",
+      dryRun: true,
+    },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(blocked.blocked, "generate_image did not block sensitive output path");
+
+  const config = resolveRuntimeConfig(
+    {
+      provider: "mock",
+      routingMode: "manual",
+      model: "mock-agent",
+      goal: "Generate an image of a panda astronaut.",
+      commandCwd: workspace,
+      allowFileTools: true,
+      allowAuxiliaryTools: true,
+      maxSteps: 4,
+    },
+    {
+      baseDir: runtimeDir,
+      packageDir: repoRoot,
+      provider: "mock",
+    }
+  );
+  const run = await runAgent(config);
+  const store = new SessionStore(config.sessionsDir, run.sessionId);
+  const events = await store.loadEvents();
+  assert(events.some((event) => event.type === "tool.completed" && event.data?.toolName === "generate_image"), "mock run did not call generate_image");
+  await fs.access(path.join(workspace, "artifacts/images/mock-image/task_manifest.json"));
+
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        workspace,
+        checks: ["grsai_key_status", "image_skill_listed", "generate_image_dry_run", "generate_image_guardrail", "mock_agent_image_tool"],
+      },
+      null,
+      2
+    )
+  );
+} finally {
+  await fs.rm(tempRoot, { recursive: true, force: true });
+}

package/scripts/smoke-coding-tools.js

@@ -86,6 +86,53 @@ try {
     goal: "patch this large codebase and migrate the database tests",
   });
   assert(/pro/i.test(patchRoute.model), "patch/refactor task did not route to DeepSeek pro");
+  const largeProfileRoute = selectModelRoute({
+    routingMode: "smart",
+    provider: "deepseek",
+    goal: "fix this bug",
+    taskProfile: "large-codebase",
+  });
+  assert(/pro/i.test(largeProfileRoute.model), "large-codebase profile did not route to DeepSeek pro");
+
+  await fs.mkdir(path.join(workspace, "src"), { recursive: true });
+  await fs.mkdir(path.join(workspace, "test"), { recursive: true });
+  await fs.writeFile(
+    path.join(workspace, "package.json"),
+    JSON.stringify(
+      {
+        name: "agintiflow-inspect-smoke",
+        scripts: {
+          test: "node --test test/index.test.js",
+          check: "node --check src/index.js",
+        },
+      },
+      null,
+      2
+    ),
+    "utf8"
+  );
+  await fs.writeFile(path.join(workspace, "src/index.js"), "export function answer() { return 42; }\n", "utf8");
+  await fs.writeFile(path.join(workspace, "test/index.test.js"), "import test from 'node:test';\n", "utf8");
+  const inspected = await executeWorkspaceTool(
+    "inspect_project",
+    { path: ".", maxDepth: 4, limit: 200 },
+    {
+      commandCwd: workspace,
+      allowFileTools: true,
+    }
+  );
+  assert(inspected.ok, "inspect_project failed");
+  assert(inspected.manifestFiles.some((item) => item.path === "package.json"), "inspect_project did not find package.json");
+  assert(inspected.packageScripts.some((item) => item.name === "test"), "inspect_project did not extract package scripts");
+  assert(inspected.sourceDirs.some((item) => item.path === "src"), "inspect_project did not identify src directory");
+  assert(inspected.testFiles.some((item) => item.path === "test/index.test.js"), "inspect_project did not identify test file");
+  assert(inspected.recommendedReads.includes("package.json"), "inspect_project did not recommend package.json");
+
+  const inspectRun = await runMock("Inspect this large codebase and recommend next reads.", "coding-inspect");
+  assert(
+    inspectRun.events.some((event) => event.type === "tool.completed" && event.data?.toolName === "inspect_project"),
+    "mock large-codebase run did not use inspect_project"
+  );
 
   const writeRun = await runMock("Create notes/hello.md with a short coding smoke message.", "coding-write");
   const written = await fs.readFile(path.join(workspace, "notes/hello.md"), "utf8");
@@ -216,6 +263,9 @@ try {
         checks: [
           "deepseek_history_repair",
           "deepseek_pro_patch_route",
+          "large_profile_pro_route",
+          "inspect_project",
+          "mock_inspect_project",
           "write_file",
           "duplicate_write_failed",
           "resume_session_write",

package/src/agent-runner.js

@@ -17,6 +17,7 @@ import { redactSensitiveText, redactValue } from "./redaction.js";
 import { executeWorkspaceTool, resolveWorkspacePath, summarizeWorkspaceTools, WORKSPACE_TOOL_NAMES } from "./workspace-tools.js";
 import { normalizeCanvasPayload } from "./artifact-tunnel.js";
 import { getTaskProfile } from "./task-profiles.js";
+import { generateImage, listAuxiliarySkills } from "./auxiliary-tools.js";
 
 const exec = promisify(execCallback);
 const BROWSER_TOOLS = new Set(["open_url", "open_workspace_file", "preview_workspace", "click", "type", "scroll", "press", "back"]);
@@ -271,16 +272,21 @@ function createInitialState(config, sessionId) {
               : "A host shell command tool is available under the configured trust policy."
             : "No shell command tool is available.",
           config.allowFileTools
-            ? `Workspace file tools are available in ${config.commandCwd}: list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, and preview_workspace. apply_patch supports exact single-file replacements plus Codex-style/unified multi-file patches; prefer it for source edits after reading/searching the relevant context. Always use workspace-relative paths such as plot_fx.svg or docs/report.tex, never absolute host paths. Secret paths, .git internals, node_modules writes, and huge files are blocked. For generated local websites/pages, use open_workspace_file or preview_workspace instead of starting a localhost server inside Docker.`
+            ? `Workspace file tools are available in ${config.commandCwd}: inspect_project, list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, and preview_workspace. For large or unfamiliar repositories, call inspect_project first, then search/read exact files before editing. apply_patch supports exact single-file replacements plus Codex-style/unified multi-file patches; prefer it for source edits after reading/searching the relevant context. Always use workspace-relative paths such as plot_fx.svg or docs/report.tex, never absolute host paths. Secret paths, .git internals, node_modules writes, and huge files are blocked. For generated local websites/pages, use open_workspace_file or preview_workspace instead of starting a localhost server inside Docker.`
             : "No workspace file tools are available.",
           config.allowWrapperTools
             ? `External coding-agent wrappers are available as advisory tools only. Use the selected wrapper only: ${normalizeWrapperName(config.preferredWrapper)}. Wrapper status: ${wrapperStatusText()}.`
             : "External coding-agent wrappers are disabled.",
+          config.allowAuxiliaryTools
+            ? `Auxiliary skills are available: ${listAuxiliarySkills()
+                .map((skill) => `${skill.id} via ${skill.toolName} (${skill.available ? "key available" : `needs ${skill.keyName}`})`)
+                .join(", ")}. Use generate_image for real raster image/photo/illustration/cover/poster/logo requests when appropriate; if the key is missing, ask the user to run /auxilliary grsai or aginti login grsai.`
+            : "Auxiliary skills are disabled for this run.",
           `Task profile: ${taskProfile.label}. ${taskProfile.prompt}`,
           "A frontend canvas/artifacts tunnel exists. Use send_to_canvas when important markdown, diffs, screenshots, images, or workspace files should be highlighted in the UI. It is optional and ordinary final text can still go directly to finish.",
           "For visual-output requests such as draw, plot, graph, chart, diagram, figure, image, or visualization, proactively publish a canvas artifact even when the user does not mention canvas. If workspace file tools are enabled, prefer creating a small SVG or markdown artifact and call send_to_canvas with selected=true.",
-          "Work like a practical coding agent: inspect when useful, patch code with apply_patch, run safe checks when they add confidence, iterate on failures, and keep outputs inside the workspace.",
-          "For large projects, decompose into useful files and milestones, implement a coherent minimal version first, then iterate with checks rather than only describing what you would do.",
+          "Work like a practical coding agent: orient with inspect_project/search/read, patch code with apply_patch, run safe checks when they add confidence, iterate on failures, and keep outputs inside the workspace.",
+          "For large projects, decompose into useful files and milestones, identify entry points/tests/contracts first, implement a coherent minimal version, then iterate with checks rather than only describing what you would do.",
           "For website/app/code/LaTeX/Python/C/shell tasks, create or edit real workspace files, run available build/compile/test commands, and surface artifacts through the canvas when useful.",
           "For research or web-search tasks, use browser tools or safe shell network tools when the current policy allows; cite or save useful sources in workspace notes when the task needs traceability.",
           "Use the canvas tunnel for outputs the user would likely want to inspect visually, such as figures, PDFs, screenshots, images, important markdown, or generated files.",
@@ -304,15 +310,20 @@ function createInitialState(config, sessionId) {
               : `Shell working directory: ${config.commandCwd}`
             : "",
           config.allowFileTools
-            ? `Workspace file tools enabled in: ${config.commandCwd}. Use workspace-relative paths. Use apply_patch for code edits; it accepts exact replacements or Codex-style/unified multi-file patches. Local preview tools available: open_workspace_file and preview_workspace.`
+            ? `Workspace file tools enabled in: ${config.commandCwd}. Use inspect_project first for large/unfamiliar codebases. Use workspace-relative paths. Use apply_patch for code edits; it accepts exact replacements or Codex-style/unified multi-file patches. Local preview tools available: open_workspace_file and preview_workspace.`
             : "",
           config.allowWrapperTools
             ? `Agent wrappers: selected=${normalizeWrapperName(config.preferredWrapper)}; ${wrapperStatusText()}`
             : "",
+          config.allowAuxiliaryTools
+            ? `Auxiliary skills: ${listAuxiliarySkills()
+                .map((skill) => `${skill.id}:${skill.available ? "available" : "missing-key"}`)
+                .join(" ")}`
+            : "",
           `Task profile: ${taskProfile.label}. ${taskProfile.prompt}`,
           "Canvas/artifacts tunnel: available through send_to_canvas for optional frontend rendering.",
           "Visual-output requests should produce a canvas artifact without requiring the user to ask for canvas explicitly.",
-          "Use file, shell, browser, canvas, and wrapper tools when they are useful; choose the workflow from the user's request.",
+          "Use file, shell, browser, canvas, and wrapper tools when they are useful; choose the workflow from the user's request. For complicated engineering tasks, keep a tight loop: inspect, choose minimal files, patch, run focused checks, repair, then summarize.",
           "Do not stop at a plan when tools can accomplish the request. Continue through implementation, checks, artifact selection, and finish.",
           "Use the configured sandbox and package policy for environment or system-maintenance work.",
         ]
@@ -419,7 +430,7 @@ function applyContinuationPrompt(state, config, observers) {
           : `Shell working directory: ${config.commandCwd}`
         : "",
       config.allowFileTools
-        ? `Workspace file tools enabled in: ${config.commandCwd}. Use workspace-relative paths. For generated local files/sites, use open_workspace_file or preview_workspace.`
+        ? `Workspace file tools enabled in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it accepts exact replacements or Codex-style/unified multi-file patches. For generated local files/sites, use open_workspace_file or preview_workspace.`
         : "",
       config.allowWrapperTools
         ? `Agent wrappers: selected=${normalizeWrapperName(config.preferredWrapper)}; ${wrapperStatusText()}`
@@ -504,6 +515,15 @@ function sanitizeToolArgs(toolName, args) {
       replace: typeof args.replace === "string" ? redactSensitiveText(args.replace).slice(0, 160) : safeArgs.replace,
     };
   }
+  if (toolName === "generate_image") {
+    return {
+      ...safeArgs,
+      prompt: typeof args.prompt === "string" ? `[${Buffer.byteLength(args.prompt, "utf8")} bytes sha256=${hashForLog(args.prompt)}]` : safeArgs.prompt,
+      referenceImages: Array.isArray(args.referenceImages)
+        ? args.referenceImages.map((item) => (String(item || "").startsWith("data:") ? `[data-uri ${String(item).length} chars]` : redactSensitiveText(item)))
+        : safeArgs.referenceImages,
+    };
+  }
   return safeArgs;
 }
 
@@ -611,7 +631,7 @@ async function captureSyntheticSnapshot(store, step, config) {
           : `Shell tool available in: ${config.commandCwd}`
         : "Shell tool disabled.",
       config.allowFileTools
-        ? `Workspace file tools available in: ${config.commandCwd}. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches.`
+        ? `Workspace file tools available in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches.`
         : "Workspace file tools disabled.",
       config.allowWrapperTools
         ? `Agent wrappers available: selected=${normalizeWrapperName(config.preferredWrapper)}; ${wrapperStatusText()}`
@@ -795,6 +815,7 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
           await new Promise((resolve) => setTimeout(resolve, Number.isFinite(args.ms) ? Number(args.ms) : 1000));
         }
         break;
+      case "inspect_project":
       case "list_files":
       case "read_file":
       case "search_files":
@@ -874,6 +895,67 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
         observers.event("tool.completed", result);
         return result;
       }
+      case "generate_image": {
+        const imageResult = await generateImage(args, config);
+        const result = {
+          ok: Boolean(imageResult.ok),
+          toolName: "generate_image",
+          args: safeArgs,
+          ...imageResult,
+        };
+        const eventResult = sanitizeToolResult(result);
+        await store.appendEvent("tool.completed", eventResult);
+        observers.event("tool.completed", eventResult);
+
+        if (result.ok) {
+          const generated = {
+            path: result.path,
+            imagePaths: result.imagePaths || [],
+            manifestPath: result.manifestPath || "",
+            promptPath: result.promptPath || "",
+            requestPayloadPath: result.requestPayloadPath || "",
+            commandCwd: config.commandCwd,
+          };
+          await store.appendEvent("image.generated", generated);
+          observers.event("image.generated", generated);
+
+          const selectedPath = result.imagePaths?.[0] || result.manifestPath || "";
+          if (selectedPath) {
+            const normalized = normalizeCanvasPayload(
+              {
+                title: result.imagePaths?.length ? "Generated image" : "Image generation payload",
+                kind: result.imagePaths?.length ? "image" : "json",
+                path: selectedPath,
+                note: result.summary || "Generated image artifact.",
+                selected: Boolean(result.imagePaths?.length),
+              },
+              config
+            );
+            if (normalized.ok) {
+              const canvasItem = {
+                ...normalized.payload,
+                toolName: "generate_image",
+                commandCwd: config.commandCwd,
+              };
+              await store.appendEvent("canvas.item", canvasItem);
+              observers.event("canvas.item", canvasItem);
+              if (canvasItem.selected) {
+                await store.appendEvent("canvas.selected", {
+                  artifactId: canvasItem.artifactId,
+                  title: canvasItem.title,
+                  source: "generate_image",
+                });
+                observers.event("canvas.selected", {
+                  artifactId: canvasItem.artifactId,
+                  title: canvasItem.title,
+                  source: "generate_image",
+                });
+              }
+            }
+          }
+        }
+        return result;
+      }
       case "send_to_canvas": {
         const normalized = normalizeCanvasPayload(args, config);
         if (!normalized.ok) {