@oh-my-pi/pi-coding-agent 3.20.1 → 3.24.0

package/src/core/session-manager.ts

@@ -13,11 +13,11 @@ import {
 	type WriteStream,
 } from "node:fs";
 import { basename, join, resolve } from "node:path";
+import type { ImageContent, Message, TextContent, Usage } from "@mariozechner/pi-ai";
 import type { AgentMessage } from "@oh-my-pi/pi-agent-core";
-import type { ImageContent, Message, TextContent, Usage } from "@oh-my-pi/pi-ai";
 import { nanoid } from "nanoid";
-import sharp from "sharp";
 import { getAgentDir as getDefaultAgentDir } from "../config";
+import { resizeImage } from "../utils/image-resize";
 import {
 	type BashExecutionMessage,
 	type CustomMessage,
@@ -644,28 +644,17 @@ function isImageBlock(value: unknown): value is { type: "image"; data: string; m
 
 async function compressImageForPersistence(image: ImageContent): Promise<ImageContent> {
 	try {
-		const buffer = Buffer.from(image.data, "base64");
-		const pipeline = sharp(buffer, { failOnError: false });
-		const metadata = await pipeline.metadata();
-		const width = metadata.width ?? 0;
-		const height = metadata.height ?? 0;
-		const hasDims = width > 0 && height > 0;
-		const targetWidth = hasDims && width >= height ? 512 : undefined;
-		const targetHeight = hasDims && height > width ? 512 : undefined;
-		const resized = await pipeline
-			.resize({
-				width: hasDims ? targetWidth : 512,
-				height: hasDims ? targetHeight : 512,
-				fit: "inside",
-				withoutEnlargement: true,
-			})
-			.jpeg({ quality: 70 })
-			.toBuffer();
-		const base64 = resized.toString("base64");
-		if (base64.length > MAX_PERSIST_CHARS) {
+		const maxBytes = Math.floor((MAX_PERSIST_CHARS * 3) / 4);
+		const resized = await resizeImage(image, {
+			maxWidth: 512,
+			maxHeight: 512,
+			maxBytes,
+			jpegQuality: 70,
+		});
+		if (resized.data.length > MAX_PERSIST_CHARS) {
 			return { type: "image", data: PLACEHOLDER_IMAGE_DATA, mimeType: "image/jpeg" };
 		}
-		return { type: "image", data: base64, mimeType: "image/jpeg" };
+		return { type: "image", data: resized.data, mimeType: resized.mimeType };
 	} catch {
 		return { type: "image", data: PLACEHOLDER_IMAGE_DATA, mimeType: "image/jpeg" };
 	}
@@ -709,6 +698,13 @@ async function truncateForPersistence<T>(obj: T, key?: string): Promise<T> {
 		let changed = false;
 		const result: Record<string, unknown> = {};
 		for (const [k, v] of Object.entries(obj as Record<string, unknown>)) {
+			// Strip transient/redundant properties that shouldn't be persisted
+			// - partialJson: streaming accumulator for tool call JSON parsing
+			// - jsonlEvents: raw subprocess streaming events (already saved to artifact files)
+			if (k === "partialJson" || k === "jsonlEvents") {
+				changed = true;
+				continue;
+			}
 			const newV = await truncateForPersistence(v, k);
 			result[k] = newV;
 			if (newV !== v) changed = true;

package/src/core/settings-manager.ts

@@ -12,6 +12,7 @@ export interface CompactionSettings {
 }
 
 export interface BranchSummarySettings {
+	enabled?: boolean; // default: false (prompt user to summarize when leaving branch)
 	reserveTokens?: number; // default: 16384 (tokens reserved for prompt + LLM response)
 }
 
@@ -61,10 +62,22 @@ export interface ExaSettings {
 	enableWebsets?: boolean; // default: false
 }
 
+export type WebSearchProviderOption = "auto" | "exa" | "perplexity" | "anthropic";
+export type ImageProviderOption = "auto" | "gemini" | "openrouter";
+
+export interface ProviderSettings {
+	webSearch?: WebSearchProviderOption; // default: "auto" (exa > perplexity > anthropic)
+	image?: ImageProviderOption; // default: "auto" (openrouter > gemini)
+}
+
 export interface BashInterceptorSettings {
 	enabled?: boolean; // default: false (blocks shell commands that have dedicated tools)
 }
 
+export interface GitSettings {
+	enabled?: boolean; // default: false (structured git tool; use bash for git commands when disabled)
+}
+
 export interface MCPSettings {
 	enableProjectConfig?: boolean; // default: true (load .mcp.json from project root)
 }
@@ -166,11 +179,13 @@ export interface Settings {
 	enabledModels?: string[]; // Model patterns for cycling (same format as --models CLI flag)
 	exa?: ExaSettings;
 	bashInterceptor?: BashInterceptorSettings;
+	git?: GitSettings;
 	mcp?: MCPSettings;
 	lsp?: LspSettings;
 	edit?: EditSettings;
 	ttsr?: TtsrSettings;
 	voice?: VoiceSettings;
+	providers?: ProviderSettings;
 	disabledProviders?: string[]; // Discovery provider IDs that are disabled
 	disabledExtensions?: string[]; // Individual extension IDs that are disabled (e.g., "skill:commit")
 	statusLine?: StatusLineSettings; // Status line configuration
@@ -432,8 +447,21 @@ export class SettingsManager {
 		};
 	}
 
-	getBranchSummarySettings(): { reserveTokens: number } {
+	getBranchSummaryEnabled(): boolean {
+		return this.settings.branchSummary?.enabled ?? false;
+	}
+
+	setBranchSummaryEnabled(enabled: boolean): void {
+		if (!this.globalSettings.branchSummary) {
+			this.globalSettings.branchSummary = {};
+		}
+		this.globalSettings.branchSummary.enabled = enabled;
+		this.save();
+	}
+
+	getBranchSummarySettings(): { enabled: boolean; reserveTokens: number } {
 		return {
+			enabled: this.getBranchSummaryEnabled(),
 			reserveTokens: this.settings.branchSummary?.reserveTokens ?? 16384,
 		};
 	}
@@ -626,6 +654,31 @@ export class SettingsManager {
 		this.save();
 	}
 
+	// Provider settings
+	getWebSearchProvider(): WebSearchProviderOption {
+		return this.settings.providers?.webSearch ?? "auto";
+	}
+
+	setWebSearchProvider(provider: WebSearchProviderOption): void {
+		if (!this.globalSettings.providers) {
+			this.globalSettings.providers = {};
+		}
+		this.globalSettings.providers.webSearch = provider;
+		this.save();
+	}
+
+	getImageProvider(): ImageProviderOption {
+		return this.settings.providers?.image ?? "auto";
+	}
+
+	setImageProvider(provider: ImageProviderOption): void {
+		if (!this.globalSettings.providers) {
+			this.globalSettings.providers = {};
+		}
+		this.globalSettings.providers.image = provider;
+		this.save();
+	}
+
 	getBashInterceptorEnabled(): boolean {
 		return this.settings.bashInterceptor?.enabled ?? false;
 	}
@@ -638,6 +691,18 @@ export class SettingsManager {
 		this.save();
 	}
 
+	getGitToolEnabled(): boolean {
+		return this.settings.git?.enabled ?? false;
+	}
+
+	setGitToolEnabled(enabled: boolean): void {
+		if (!this.globalSettings.git) {
+			this.globalSettings.git = {};
+		}
+		this.globalSettings.git.enabled = enabled;
+		this.save();
+	}
+
 	getMCPProjectConfigEnabled(): boolean {
 		return this.settings.mcp?.enableProjectConfig ?? true;
 	}

package/src/core/slash-commands.ts

@@ -54,20 +54,27 @@ export function parseCommandArgs(argsString: string): string[] {
 
 /**
  * Substitute argument placeholders in command content
- * Supports $1, $2, ... for positional args and $@ for all args
+ * Supports $1, $2, ... for positional args, $@ and $ARGUMENTS for all args
  */
 export function substituteArgs(content: string, args: string[]): string {
 	let result = content;
 
-	// Replace $@ with all args joined
-	result = result.replace(/\$@/g, args.join(" "));
-
-	// Replace $1, $2, etc. with positional args
+	// Replace $1, $2, etc. with positional args FIRST (before wildcards)
+	// This prevents wildcard replacement values containing $<digit> patterns from being re-substituted
 	result = result.replace(/\$(\d+)/g, (_, num) => {
 		const index = parseInt(num, 10) - 1;
 		return args[index] ?? "";
 	});
 
+	// Pre-compute all args joined
+	const allArgs = args.join(" ");
+
+	// Replace $ARGUMENTS with all args joined (aligns with Claude, Codex)
+	result = result.replace(/\$ARGUMENTS/g, allArgs);
+
+	// Replace $@ with all args joined
+	result = result.replace(/\$@/g, allArgs);
+
 	return result;
 }
 

package/src/core/system-prompt.ts

@@ -69,11 +69,12 @@ ${commitsText}`;
 const toolDescriptions: Record<ToolName, string> = {
 	ask: "Ask user for input or clarification",
 	read: "Read file contents",
-	bash: "Execute bash commands (git, npm, docker, etc.)",
+	bash: "Execute bash commands (npm, docker, etc.)",
 	edit: "Make surgical edits to files (find exact text and replace)",
 	write: "Create or overwrite files",
 	grep: "Search file contents for patterns (respects .gitignore)",
 	find: "Find files by glob pattern (respects .gitignore)",
+	git: "Structured Git operations with safety guards (status, diff, log, commit, push, pr, etc.)",
 	ls: "List directory contents",
 	lsp: "PREFERRED for semantic code queries: go-to-definition, find-all-references, hover (type info), call hierarchy. Returns precise, deterministic results. Use BEFORE grep for symbol lookups.",
 	notebook: "Edit Jupyter notebook cells",
@@ -99,9 +100,10 @@ function generateAntiBashRules(tools: ToolName[]): string | null {
 	const hasLs = tools.includes("ls");
 	const hasEdit = tools.includes("edit");
 	const hasLsp = tools.includes("lsp");
+	const hasGit = tools.includes("git");
 
 	// Only show rules if we have specialized tools that should be preferred
-	const hasSpecializedTools = hasRead || hasGrep || hasFind || hasLs || hasEdit;
+	const hasSpecializedTools = hasRead || hasGrep || hasFind || hasLs || hasEdit || hasGit;
 	if (!hasSpecializedTools) return null;
 
 	const lines: string[] = [];
@@ -114,6 +116,7 @@ function generateAntiBashRules(tools: ToolName[]): string | null {
 	if (hasFind) lines.push("- **File finding**: Use `find` instead of find/fd/locate");
 	if (hasLs) lines.push("- **Directory listing**: Use `ls` instead of bash ls");
 	if (hasEdit) lines.push("- **File editing**: Use `edit` instead of sed/awk/perl -pi/echo >/cat <<EOF");
+	if (hasGit) lines.push("- **Git operations**: Use `git` tool instead of bash git commands");
 
 	lines.push("\n### Tool Preference (highest → lowest priority)");
 	const ladder: string[] = [];
@@ -122,7 +125,8 @@ function generateAntiBashRules(tools: ToolName[]): string | null {
 	if (hasFind) ladder.push("find (locate files by pattern)");
 	if (hasRead) ladder.push("read (view file contents)");
 	if (hasEdit) ladder.push("edit (precise text replacement)");
-	ladder.push("bash (ONLY for git, npm, docker, make, cargo, etc.)");
+	if (hasGit) ladder.push("git (structured git operations with safety guards)");
+	ladder.push(`bash (ONLY for ${hasGit ? "" : "git, "}npm, docker, make, cargo, etc.)`);
 	lines.push(ladder.map((t, i) => `${i + 1}. ${t}`).join("\n"));
 
 	// Add LSP guidance if available
@@ -137,6 +141,26 @@ function generateAntiBashRules(tools: ToolName[]): string | null {
 		lines.push("- **Find symbol across codebase** → `lsp workspace_symbols`\n");
 	}
 
+	// Add Git guidance if available
+	if (hasGit) {
+		lines.push("\n### Git Tool — Preferred for Git Operations");
+		lines.push("Use `git` instead of bash git when you need:");
+		lines.push(
+			"- **Status/diff/log**: `git { operation: 'status' }`, `git { operation: 'diff' }`, `git { operation: 'log' }`",
+		);
+		lines.push(
+			"- **Commit workflow**: `git { operation: 'add', paths: [...] }` then `git { operation: 'commit', message: '...' }`",
+		);
+		lines.push("- **Branching**: `git { operation: 'branch', action: 'create', name: '...' }`");
+		lines.push("- **GitHub PRs**: `git { operation: 'pr', action: 'create', title: '...', body: '...' }`");
+		lines.push(
+			"- **GitHub Issues**: `git { operation: 'issue', action: 'list' }` or `{ operation: 'issue', number: 123 }`",
+		);
+		lines.push(
+			"The git tool provides typed output, safety guards, and a clean API for all git and GitHub operations.\n",
+		);
+	}
+
 	// Add search-first protocol
 	if (hasGrep || hasFind) {
 		lines.push("\n### Search-First Protocol");
@@ -232,10 +256,10 @@ export function loadSystemPromptFiles(options: LoadContextFilesOptions = {}): st
 export interface BuildSystemPromptOptions {
 	/** Custom system prompt (replaces default). */
 	customPrompt?: string;
-	/** Tools to include in prompt. Default: [read, bash, edit, write] */
-	selectedTools?: ToolName[];
-	/** Extra tool descriptions to include in prompt (non built-in tools). */
-	extraToolDescriptions?: Array<{ name: string; description: string }>;
+	/** Tools to include in prompt. */
+	tools?: Map<string, { description: string; label: string }>;
+	/** Tool names to include in prompt. */
+	toolNames?: string[];
 	/** Text to append to system prompt. */
 	appendSystemPrompt?: string;
 	/** Skills settings for discovery. */
@@ -247,21 +271,21 @@ export interface BuildSystemPromptOptions {
 	/** Pre-loaded skills (skips discovery if provided). */
 	skills?: Skill[];
 	/** Pre-loaded rulebook rules (rules with descriptions, excluding TTSR and always-apply). */
-	rulebookRules?: Rule[];
+	rules?: Rule[];
 }
 
 /** Build the system prompt with tools, guidelines, and context */
 export function buildSystemPrompt(options: BuildSystemPromptOptions = {}): string {
 	const {
 		customPrompt,
-		selectedTools,
-		extraToolDescriptions = [],
+		tools,
 		appendSystemPrompt,
 		skillsSettings,
+		toolNames,
 		cwd,
 		contextFiles: providedContextFiles,
 		skills: providedSkills,
-		rulebookRules,
+		rules: rulebookRules,
 	} = options;
 	const resolvedCwd = cwd ?? process.cwd();
 	const resolvedCustomPrompt = resolvePromptInput(customPrompt, "system prompt");
@@ -287,6 +311,9 @@ export function buildSystemPrompt(options: BuildSystemPromptOptions = {}): strin
 	// Resolve context files: use provided or discover
 	const contextFiles = providedContextFiles ?? loadProjectContextFiles({ cwd: resolvedCwd });
 
+	// Build tools list based on selected tools
+	const toolsList = toolNames?.map((name) => `- ${name}: ${toolDescriptions[name as ToolName]}`).join("\n") ?? "";
+
 	// Resolve skills: use provided or discover
 	const skills =
 		providedSkills ??
@@ -311,9 +338,11 @@ export function buildSystemPrompt(options: BuildSystemPromptOptions = {}): strin
 		}
 
 		// Append custom tool descriptions if provided
-		if (extraToolDescriptions.length > 0) {
-			prompt += "\n\n# Additional Tools\n\n";
-			prompt += extraToolDescriptions.map((tool) => `- ${tool.name}: ${tool.description}`).join("\n");
+		if (tools && tools.size > 0) {
+			prompt += "\n\n# Tools\n\n";
+			prompt += Array.from(tools.entries())
+				.map(([name, { description }]) => `- ${name}: ${description}`)
+				.join("\n");
 		}
 
 		// Append git context if in a git repo
@@ -323,8 +352,7 @@ export function buildSystemPrompt(options: BuildSystemPromptOptions = {}): strin
 		}
 
 		// Append skills section (only if read tool is available)
-		const customPromptHasRead = !selectedTools || selectedTools.includes("read");
-		if (customPromptHasRead && skills.length > 0) {
+		if (tools?.has("read") && skills.length > 0) {
 			prompt += formatSkillsForPrompt(skills);
 		}
 
@@ -345,25 +373,16 @@ export function buildSystemPrompt(options: BuildSystemPromptOptions = {}): strin
 	const docsPath = getDocsPath();
 	const examplesPath = getExamplesPath();
 
-	// Build tools list based on selected tools
-	const tools = selectedTools || (["read", "bash", "edit", "write"] as ToolName[]);
-	const builtInToolsList = tools.map((t) => `- ${t}: ${toolDescriptions[t]}`).join("\n");
-	const extraToolsList =
-		extraToolDescriptions.length > 0
-			? extraToolDescriptions.map((tool) => `- ${tool.name}: ${tool.description}`).join("\n")
-			: "";
-	const toolsList = [builtInToolsList, extraToolsList].filter(Boolean).join("\n");
-
 	// Generate anti-bash rules (returns null if not applicable)
-	const antiBashSection = generateAntiBashRules(tools);
+	const antiBashSection = generateAntiBashRules(Array.from(tools?.keys() ?? []));
 
 	// Build guidelines based on which tools are actually available
 	const guidelinesList: string[] = [];
 
-	const hasBash = tools.includes("bash");
-	const hasEdit = tools.includes("edit");
-	const hasWrite = tools.includes("write");
-	const hasRead = tools.includes("read");
+	const hasBash = tools?.has("bash");
+	const hasEdit = tools?.has("edit");
+	const hasWrite = tools?.has("write");
+	const hasRead = tools?.has("read");
 
 	// Read-only mode notice (no bash, edit, or write)
 	if (!hasBash && !hasEdit && !hasWrite) {
@@ -430,12 +449,6 @@ export function buildSystemPrompt(options: BuildSystemPromptOptions = {}): strin
 		}
 	}
 
-	// Append custom tool descriptions if provided
-	if (extraToolDescriptions.length > 0) {
-		prompt += "\n\n# Additional Tools\n\n";
-		prompt += extraToolDescriptions.map((tool) => `- ${tool.name}: ${tool.description}`).join("\n");
-	}
-
 	// Append git context if in a git repo
 	const gitContext = loadGitContext(resolvedCwd);
 	if (gitContext) {

package/src/core/title-generator.ts

@@ -2,8 +2,8 @@
  * Generate session titles using a smol, fast model.
  */
 
-import type { Model } from "@oh-my-pi/pi-ai";
-import { completeSimple } from "@oh-my-pi/pi-ai";
+import type { Model } from "@mariozechner/pi-ai";
+import { completeSimple } from "@mariozechner/pi-ai";
 import titleSystemPrompt from "../prompts/title-system.md" with { type: "text" };
 import { logger } from "./logger";
 import type { ModelRegistry } from "./model-registry";

package/src/core/tools/ask.ts

@@ -16,9 +16,14 @@
  */
 
 import type { AgentTool, AgentToolContext, AgentToolUpdateCallback } from "@oh-my-pi/pi-agent-core";
+import type { Component } from "@oh-my-pi/pi-tui";
+import { Text } from "@oh-my-pi/pi-tui";
 import { Type } from "@sinclair/typebox";
-import { theme } from "../../modes/interactive/theme/theme";
+import { type Theme, theme } from "../../modes/interactive/theme/theme";
 import askDescription from "../../prompts/tools/ask.md" with { type: "text" };
+import type { RenderResultOptions } from "../custom-tools/types";
+import type { ToolSession } from "./index";
+import { formatErrorMessage, formatMeta } from "./render-utils";
 
 // =============================================================================
 // Types
@@ -63,7 +68,10 @@ function getDoneOptionLabel(): string {
 // Tool Implementation
 // =============================================================================
 
-export function createAskTool(_cwd: string): AgentTool<typeof askSchema, AskToolDetails> {
+export function createAskTool(session: ToolSession): null | AgentTool<typeof askSchema, AskToolDetails> {
+	if (!session.hasUI) {
+		return null;
+	}
 	return {
 		name: "ask",
 		label: "Ask",
@@ -189,5 +197,91 @@ export function createAskTool(_cwd: string): AgentTool<typeof askSchema, AskTool
 	};
 }
 
-/** Default ask tool using process.cwd() - for backwards compatibility (no UI) */
-export const askTool = createAskTool(process.cwd());
+/** Default ask tool - returns null when no UI */
+export const askTool = createAskTool({
+	cwd: process.cwd(),
+	hasUI: false,
+	rulebookRules: [],
+	getSessionFile: () => null,
+	getSessionSpawns: () => "*",
+});
+
+// =============================================================================
+// TUI Renderer
+// =============================================================================
+
+interface AskRenderArgs {
+	question: string;
+	options?: Array<{ label: string }>;
+	multi?: boolean;
+}
+
+export const askToolRenderer = {
+	renderCall(args: AskRenderArgs, uiTheme: Theme): Component {
+		if (!args.question) {
+			return new Text(formatErrorMessage("No question provided", uiTheme), 0, 0);
+		}
+
+		const label = uiTheme.fg("toolTitle", uiTheme.bold("Ask"));
+		let text = `${label} ${uiTheme.fg("accent", args.question)}`;
+
+		const meta: string[] = [];
+		if (args.multi) meta.push("multi");
+		if (args.options?.length) meta.push(`options:${args.options.length}`);
+		text += formatMeta(meta, uiTheme);
+
+		if (args.options?.length) {
+			for (let i = 0; i < args.options.length; i++) {
+				const opt = args.options[i];
+				const isLast = i === args.options.length - 1;
+				const branch = isLast ? uiTheme.tree.last : uiTheme.tree.branch;
+				text += `\n ${uiTheme.fg("dim", branch)} ${uiTheme.fg("dim", uiTheme.checkbox.unchecked)} ${uiTheme.fg("muted", opt.label)}`;
+			}
+		}
+
+		return new Text(text, 0, 0);
+	},
+
+	renderResult(
+		result: { content: Array<{ type: string; text?: string }>; details?: AskToolDetails },
+		_opts: RenderResultOptions,
+		uiTheme: Theme,
+	): Component {
+		const { details } = result;
+		if (!details) {
+			const txt = result.content[0];
+			return new Text(txt?.type === "text" && txt.text ? txt.text : "", 0, 0);
+		}
+
+		const hasSelection = details.customInput || details.selectedOptions.length > 0;
+		const statusIcon = hasSelection
+			? uiTheme.styledSymbol("status.success", "success")
+			: uiTheme.styledSymbol("status.warning", "warning");
+
+		let text = `${statusIcon} ${uiTheme.fg("accent", details.question)}`;
+
+		if (details.customInput) {
+			text += `\n ${uiTheme.fg("dim", uiTheme.tree.last)} ${uiTheme.styledSymbol(
+				"status.success",
+				"success",
+			)} ${uiTheme.fg("toolOutput", details.customInput)}`;
+		} else if (details.selectedOptions.length > 0) {
+			const selected = details.selectedOptions;
+			for (let i = 0; i < selected.length; i++) {
+				const isLast = i === selected.length - 1;
+				const branch = isLast ? uiTheme.tree.last : uiTheme.tree.branch;
+				text += `\n ${uiTheme.fg("dim", branch)} ${uiTheme.fg(
+					"success",
+					uiTheme.checkbox.checked,
+				)} ${uiTheme.fg("toolOutput", selected[i])}`;
+			}
+		} else {
+			text += `\n ${uiTheme.fg("dim", uiTheme.tree.last)} ${uiTheme.styledSymbol(
+				"status.warning",
+				"warning",
+			)} ${uiTheme.fg("warning", "Cancelled")}`;
+		}
+
+		return new Text(text, 0, 0);
+	},
+};

package/src/core/tools/bash-interceptor.ts

@@ -36,6 +36,13 @@ const forbiddenPatterns: Array<{
 		tool: "grep",
 		message: "Use the `grep` tool instead of grep/rg. It respects .gitignore and provides structured output.",
 	},
+	// Git operations
+	{
+		pattern: /^\s*git(\s+|$)/,
+		tool: "git",
+		message:
+			"Use the `git` tool instead of running git in bash. It provides structured output and safety confirmations.",
+	},
 	// File finding
 	{
 		pattern: /^\s*(find|fd|locate)\s+.*(-name|-iname|-type|--type|-glob)/,
@@ -73,13 +80,13 @@ const forbiddenPatterns: Array<{
  * @param availableTools Set of tool names that are available
  * @returns InterceptionResult indicating if the command should be blocked
  */
-export function checkBashInterception(command: string, availableTools: Set<string>): InterceptionResult {
+export function checkBashInterception(command: string, availableTools: string[]): InterceptionResult {
 	// Normalize command for pattern matching
 	const normalizedCommand = command.trim();
 
 	for (const { pattern, tool, message } of forbiddenPatterns) {
 		// Only block if the suggested tool is actually available
-		if (!availableTools.has(tool)) {
+		if (!availableTools.includes(tool)) {
 			continue;
 		}
 
@@ -99,8 +106,8 @@ export function checkBashInterception(command: string, availableTools: Set<strin
  * Check if a command is a simple directory listing that should use `ls` tool.
  * Only applies to bare `ls` without complex flags.
  */
-export function checkSimpleLsInterception(command: string, availableTools: Set<string>): InterceptionResult {
-	if (!availableTools.has("ls")) {
+export function checkSimpleLsInterception(command: string, availableTools: string[]): InterceptionResult {
+	if (!availableTools.includes("ls")) {
 		return { block: false };
 	}