@ridit/lens 0.3.5 → 0.3.6

package/dist/index.mjs

@@ -258398,6 +258398,12 @@ var require_asciichart = __commonJS((exports) => {
 });
 
 // src/utils/tools/registry.ts
+var INTENT_ALLOWED = {
+  readonly: ["read", "net"],
+  mutating: ["read", "net", "write", "delete", "shell"],
+  any: ["read", "net", "write", "delete", "shell"]
+};
+
 class ToolRegistry {
   tools = new Map;
   register(tool) {
@@ -258418,13 +258424,34 @@ class ToolRegistry {
   names() {
     return Array.from(this.tools.keys());
   }
-  buildSystemPromptSection() {
+  namesForIntent(intent) {
+    const allowed = new Set(INTENT_ALLOWED[intent]);
+    return Array.from(this.tools.values()).filter((t) => {
+      const tag = t.tag;
+      if (!tag)
+        return true;
+      return allowed.has(tag);
+    }).map((t) => t.name);
+  }
+  buildSystemPromptSection(intent = "any") {
+    const allowed = new Set(INTENT_ALLOWED[intent]);
+    const visible = Array.from(this.tools.values()).filter((t) => {
+      const tag = t.tag;
+      if (!tag)
+        return true;
+      return allowed.has(tag);
+    });
     const lines = [`## TOOLS
 `];
-    lines.push("You have exactly " + this.tools.size + ` tools. To use a tool you MUST wrap it in the exact XML tags shown below — no other format will work.
+    if (intent === "readonly") {
+      lines.push(`You have ${visible.length} tools available for this read-only request. ` + `Do NOT attempt to write, delete, or run shell commands — ` + `those tools are not available right now.
 `);
+    } else {
+      lines.push(`You have exactly ${visible.length} tools. To use a tool you MUST wrap it ` + `in the exact XML tags shown below — no other format will work.
+`);
+    }
     let i = 1;
-    for (const tool of this.tools.values()) {
+    for (const tool of visible) {
       lines.push(tool.systemPromptEntry(i++));
     }
     return lines.join(`
@@ -268627,25 +268654,25 @@ ${f.content.slice(0, 2000)}
 `);
   const tools = toolsSection ?? BUILTIN_TOOLS_SECTION;
   return `You are an expert software engineer assistant with access to the user's codebase and tools.
-
+ 
 ${tools}
-
+ 
 ## MEMORY OPERATIONS
-
+ 
 You can save and delete memories at any time by emitting these tags alongside your normal response.
 They are stripped before display — the user will not see the raw tags.
-
+ 
 ### memory-add — save something important to long-term memory for this repo
 <memory-add>User prefers TypeScript strict mode in all new files</memory-add>
-
+ 
 ### memory-delete — delete a memory by its ID (shown in brackets like [abc123])
 <memory-delete>abc123</memory-delete>
-
+ 
 Use memory-add when the user asks you to remember something, or when you learn something project-specific that would be useful in future sessions.
 Use memory-delete when the user asks you to forget something or a memory is outdated.
-
+ 
 ## RULES
-
+ 
 1. ONE tool per response — emit the XML tag, then stop. Never chain tools in one response except when scaffolding (see below).
 2. NEVER call a tool more than once for the same path in a session. If write-file or shell returned a result, it succeeded. Move on immediately.
 3. NEVER write the same file twice in one session. One write per file, period. If you already wrote it, it is done.
@@ -268663,15 +268690,15 @@ Use memory-delete when the user asks you to forget something or a memory is outd
 15. When explaining how to use a tool in text, use [tag] bracket notation — NEVER emit a real XML tool tag as part of an explanation.
 16. NEVER use markdown formatting in plain text responses — no bold, no headings, no bullet points. Only use fenced code blocks when showing actual code.
 17. When scaffolding multiple files, emit ONE write-file tag per response and wait for the result before writing the next file.
-
+ 
 ## ADDON FORMAT
-
+ 
 All addons use defineTool from @ridit/lens-sdk. The ONLY correct format is:
-
+ 
 \`\`\`js
 const { defineTool } = require("@ridit/lens-sdk");
 const { execSync } = require("child_process");
-
+ 
 defineTool({
   name: "tool-name",
   description: "what it does",
@@ -268687,23 +268714,23 @@ defineTool({
   },
 });
 \`\`\`
-
+ 
 NEVER use module.exports, registerTool, ctx.tools.shell, or any other format. See addons/run-tests.js for a full working example.
-
+ 
 ## SCAFFOLDING
-
+ 
 When creating multiple files, emit ONE write-file per response and wait for each result:
-
+ 
 <write-file>
 {"path": "myapp/package.json", "content": "..."}
 </write-file>
-
+ 
 Wait for result, then emit the next file. Never chain write-file tags when content is complex.
-
+ 
 ## CODEBASE
-
+ 
 ${fileList.length > 0 ? fileList : "(no files indexed)"}
-
+ 
 ${memorySummary}`;
 }
 var BUILTIN_TOOLS_SECTION = `## TOOLS
@@ -272908,6 +272935,7 @@ function parseArgs(body) {
 var gitStatusTool = {
   name: "git-status",
   description: "show working tree status",
+  tag: "git",
   safe: true,
   permissionLabel: "git status",
   systemPromptEntry: (i) => `### ${i}. git-status — show working tree status (staged, unstaged, untracked)
@@ -272925,6 +272953,7 @@ var gitStatusTool = {
 var gitLogTool = {
   name: "git-log",
   description: "show commit log",
+  tag: "git",
   safe: true,
   permissionLabel: "git log",
   systemPromptEntry: (i) => `### ${i}. git-log — show commit log with optional flags
@@ -272941,6 +272970,7 @@ var gitLogTool = {
 var gitDiffTool = {
   name: "git-diff",
   description: "show changes between commits, working tree, or staged files",
+  tag: "git",
   safe: true,
   permissionLabel: "git diff",
   systemPromptEntry: (i) => `### ${i}. git-diff — show changes
@@ -272958,6 +272988,7 @@ var gitDiffTool = {
 var gitShowTool = {
   name: "git-show",
   description: "show a commit's details and stat",
+  tag: "git",
   safe: true,
   permissionLabel: "git show",
   systemPromptEntry: (i) => `### ${i}. git-show — show a commit's details
@@ -272973,6 +273004,7 @@ var gitShowTool = {
 var gitBranchTool = {
   name: "git-branch",
   description: "list branches",
+  tag: "git",
   safe: true,
   permissionLabel: "git branch",
   systemPromptEntry: (i) => `### ${i}. git-branch — list branches
@@ -272989,6 +273021,7 @@ var gitBranchTool = {
 var gitRemoteTool = {
   name: "git-remote",
   description: "list or inspect remotes",
+  tag: "git",
   safe: true,
   permissionLabel: "git remote",
   systemPromptEntry: (i) => `### ${i}. git-remote — list remotes
@@ -273003,6 +273036,7 @@ var gitRemoteTool = {
 var gitTagTool = {
   name: "git-tag",
   description: "list tags",
+  tag: "git",
   safe: true,
   permissionLabel: "git tag",
   systemPromptEntry: (i) => `### ${i}. git-tag — list tags
@@ -273018,6 +273052,7 @@ var gitTagTool = {
 var gitBlameTool = {
   name: "git-blame",
   description: "show who last modified each line of a file",
+  tag: "git",
   safe: true,
   permissionLabel: "git blame",
   systemPromptEntry: (i) => `### ${i}. git-blame — show per-line authorship
@@ -273053,6 +273088,7 @@ var gitBlameTool = {
 var gitStashListTool = {
   name: "git-stash-list",
   description: "list stashed changes",
+  tag: "git",
   safe: true,
   permissionLabel: "git stash list",
   systemPromptEntry: (i) => `### ${i}. git-stash-list — list stashes
@@ -273067,6 +273103,7 @@ var gitStashListTool = {
 var gitAddTool = {
   name: "git-add",
   description: "stage files for commit",
+  tag: "git",
   safe: false,
   permissionLabel: "git add",
   systemPromptEntry: (i) => `### ${i}. git-add — stage files
@@ -273087,6 +273124,7 @@ var gitAddTool = {
 var gitCommitTool = {
   name: "git-commit",
   description: "commit staged changes with a message",
+  tag: "git",
   safe: false,
   permissionLabel: "git commit",
   systemPromptEntry: (i) => `### ${i}. git-commit — commit staged changes (stage with git-add first)
@@ -273107,6 +273145,7 @@ var gitCommitTool = {
 var gitCommitAmendTool = {
   name: "git-commit-amend",
   description: "amend the last commit message",
+  tag: "git",
   safe: false,
   permissionLabel: "git commit --amend",
   systemPromptEntry: (i) => `### ${i}. git-commit-amend — amend the last commit message
@@ -273127,6 +273166,7 @@ var gitCommitAmendTool = {
 var gitRevertTool = {
   name: "git-revert",
   description: "revert a commit by hash (creates a new revert commit, history preserved)",
+  tag: "git",
   safe: false,
   permissionLabel: "git revert",
   systemPromptEntry: (i) => `### ${i}. git-revert — revert a commit (safe, creates new commit)
@@ -273146,6 +273186,7 @@ var gitRevertTool = {
 var gitResetTool = {
   name: "git-reset",
   description: "reset HEAD or unstage files",
+  tag: "git",
   safe: false,
   permissionLabel: "git reset",
   systemPromptEntry: (i) => `### ${i}. git-reset — reset HEAD or unstage files
@@ -273166,6 +273207,7 @@ var gitResetTool = {
 var gitCheckoutTool = {
   name: "git-checkout",
   description: "switch branches or restore files",
+  tag: "git",
   safe: false,
   permissionLabel: "git checkout",
   systemPromptEntry: (i) => `### ${i}. git-checkout — switch branch or restore file
@@ -273186,6 +273228,7 @@ var gitCheckoutTool = {
 var gitSwitchTool = {
   name: "git-switch",
   description: "switch or create branches",
+  tag: "git",
   safe: false,
   permissionLabel: "git switch",
   systemPromptEntry: (i) => `### ${i}. git-switch — switch or create branches
@@ -273206,6 +273249,7 @@ var gitSwitchTool = {
 var gitMergeTool = {
   name: "git-merge",
   description: "merge a branch into the current branch",
+  tag: "git",
   safe: false,
   permissionLabel: "git merge",
   systemPromptEntry: (i) => `### ${i}. git-merge — merge a branch into HEAD
@@ -273225,6 +273269,7 @@ var gitMergeTool = {
 var gitPullTool = {
   name: "git-pull",
   description: "pull from remote",
+  tag: "git",
   safe: false,
   permissionLabel: "git pull",
   systemPromptEntry: (i) => `### ${i}. git-pull — pull from remote
@@ -273243,6 +273288,7 @@ var gitPullTool = {
 var gitPushTool = {
   name: "git-push",
   description: "push commits to remote",
+  tag: "git",
   safe: false,
   permissionLabel: "git push",
   systemPromptEntry: (i) => `### ${i}. git-push — push to remote
@@ -273262,6 +273308,7 @@ var gitPushTool = {
 var gitStashTool = {
   name: "git-stash",
   description: "stash or apply stashed changes",
+  tag: "git",
   safe: false,
   permissionLabel: "git stash",
   systemPromptEntry: (i) => `### ${i}. git-stash — stash/apply/pop/drop changes
@@ -273283,6 +273330,7 @@ var gitStashTool = {
 var gitBranchCreateTool = {
   name: "git-branch-create",
   description: "create a new branch without switching to it",
+  tag: "git",
   safe: false,
   permissionLabel: "git branch (create)",
   systemPromptEntry: (i) => `### ${i}. git-branch-create — create a branch
@@ -273302,6 +273350,7 @@ var gitBranchCreateTool = {
 var gitBranchDeleteTool = {
   name: "git-branch-delete",
   description: "delete a branch",
+  tag: "git",
   safe: false,
   permissionLabel: "git branch -d",
   systemPromptEntry: (i) => `### ${i}. git-branch-delete — delete a branch
@@ -273325,6 +273374,7 @@ var gitBranchDeleteTool = {
 var gitCherryPickTool = {
   name: "git-cherry-pick",
   description: "apply a specific commit from another branch",
+  tag: "git",
   safe: false,
   permissionLabel: "git cherry-pick",
   systemPromptEntry: (i) => `### ${i}. git-cherry-pick — apply a commit by hash
@@ -273344,6 +273394,7 @@ var gitCherryPickTool = {
 var gitTagCreateTool = {
   name: "git-tag-create",
   description: "create a lightweight or annotated tag",
+  tag: "git",
   safe: false,
   permissionLabel: "git tag (create)",
   systemPromptEntry: (i) => `### ${i}. git-tag-create — create a tag
@@ -273364,6 +273415,7 @@ var gitTagCreateTool = {
 var gitRestoreTool = {
   name: "git-restore",
   description: "discard working directory changes for a file (cannot be undone)",
+  tag: "git",
   safe: false,
   permissionLabel: "git restore",
   systemPromptEntry: (i) => `### ${i}. git-restore — discard changes in a file (irreversible)
@@ -273383,6 +273435,7 @@ var gitRestoreTool = {
 var gitCleanTool = {
   name: "git-clean",
   description: "remove untracked files (cannot be undone)",
+  tag: "git",
   safe: false,
   permissionLabel: "git clean",
   systemPromptEntry: (i) => `### ${i}. git-clean — remove untracked files (irreversible)
@@ -274736,6 +274789,43 @@ function TimelineRunner({
 // src/components/chat/hooks/useChat.ts
 var import_react48 = __toESM(require_react(), 1);
 var import_react49 = __toESM(require_react(), 1);
+
+// src/utils/intentClassifier.ts
+var READONLY_PATTERNS = [
+  /\b(list|ls|dir|show|display|print|dump)\b/i,
+  /\bwhat(('?s| is| are| does)\b| files| folder)/i,
+  /\b(folder|directory|file) (structure|tree|layout|contents?)\b/i,
+  /\bexplore\b/i,
+  /\b(read|open|view|look at|check out|inspect|peek)\b/i,
+  /\b(explain|describe|summarize|summarise|tell me about|walk me through)\b/i,
+  /\bhow does\b/i,
+  /\bwhat('?s| is) (in|inside|this|that|the)\b/i,
+  /\b(find|search|grep|locate|where is|where are)\b/i,
+  /\b(look for|scan|trace)\b/i,
+  /\bunderstand\b/i,
+  /\bshow me (how|what|where|why)\b/i
+];
+var MUTATING_PATTERNS = [
+  /\b(write|create|make|generate|add|build|scaffold|init|initialize|setup|set up)\b/i,
+  /\b(new file|new folder|new component|new page|new route)\b/i,
+  /\b(edit|modify|update|change|refactor|rename|move|migrate)\b/i,
+  /\b(fix|patch|resolve|correct|debug|repair)\b/i,
+  /\b(implement|add .+ to|insert|inject|append|prepend)\b/i,
+  /\b(delete|remove|drop|clean ?up|purge|wipe)\b/i,
+  /\b(run|execute|install|deploy|build|test|start|launch|compile|lint|format)\b/i
+];
+function classifyIntent(userMessage) {
+  const text = userMessage.trim();
+  const mutatingScore = MUTATING_PATTERNS.filter((p) => p.test(text)).length;
+  const readonlyScore = READONLY_PATTERNS.filter((p) => p.test(text)).length;
+  if (mutatingScore === 0 && readonlyScore > 0)
+    return "readonly";
+  if (mutatingScore > 0)
+    return "mutating";
+  return "any";
+}
+
+// src/components/chat/hooks/useChat.ts
 function useChat(repoPath) {
   const [stage, setStage] = import_react48.useState({ type: "picking-provider" });
   const [committed, setCommitted] = import_react48.useState([]);
@@ -275052,8 +275142,13 @@ function useChat(repoPath) {
     }
     const abort = new AbortController;
     abortControllerRef.current = abort;
+    const intent = classifyIntent(text);
+    const scopedToolsSection = registry.buildSystemPromptSection(intent);
+    const scopedSystemPrompt = currentSystemPrompt.replace(/## TOOLS[\s\S]*?(?=\n## (?!TOOLS))/, scopedToolsSection + `
+
+`);
     setStage({ type: "thinking" });
-    callChat(currentProvider, currentSystemPrompt, nextAll, abort.signal).then((raw) => processResponse(raw, nextAll, abort.signal)).catch(handleError(nextAll));
+    callChat(currentProvider, scopedSystemPrompt, nextAll, abort.signal).then((raw) => processResponse(raw, nextAll, abort.signal)).catch(handleError(nextAll));
   };
   const handleProviderDone = (p) => {
     setProvider(p);
@@ -278000,6 +278095,17 @@ function CommitCommand({
     confirm
   }, undefined, false, undefined, this);
 }
+
+// node_modules/@ridit/lens-sdk/dist/index.mjs
+var TOOL_TAGS = {
+  read: "read",
+  net: "net",
+  write: "write",
+  delete: "delete",
+  shell: "shell",
+  git: "git",
+  find: "find"
+};
 // src/tools/view-image.ts
 import path26 from "path";
 import { existsSync as existsSync20, readFileSync as readFileSync14 } from "fs";
@@ -278571,6 +278677,7 @@ var fetchTool = {
   name: "fetch",
   description: "load a URL",
   safe: true,
+  tag: TOOL_TAGS.net,
   permissionLabel: "fetch",
   systemPromptEntry: (i) => `### ${i}. fetch — load a URL
 <fetch>https://example.com</fetch>`,
@@ -278592,6 +278699,7 @@ var shellTool = {
   name: "shell",
   description: "run a terminal command",
   safe: false,
+  tag: TOOL_TAGS.shell,
   permissionLabel: "run",
   systemPromptEntry: (i) => `### ${i}. shell — run a terminal command
 <shell>node -v</shell>`,
@@ -278606,6 +278714,7 @@ var readFileTool = {
   name: "read-file",
   description: "read a file from the repo",
   safe: true,
+  tag: TOOL_TAGS.read,
   permissionLabel: "read",
   systemPromptEntry: (i) => `### ${i}. read-file — read a file from the repo
 <read-file>src/foo.ts</read-file>`,
@@ -278619,6 +278728,7 @@ var readFileTool = {
 var readFolderTool = {
   name: "read-folder",
   description: "list contents of a folder (files + subfolders, one level deep)",
+  tag: TOOL_TAGS.read,
   safe: true,
   permissionLabel: "folder",
   systemPromptEntry: (i) => `### ${i}. read-folder — list contents of a folder (files + subfolders, one level deep)
@@ -278633,6 +278743,7 @@ var readFolderTool = {
 var grepTool = {
   name: "grep",
   description: "search for a pattern across files in the repo",
+  tag: TOOL_TAGS.find,
   safe: true,
   permissionLabel: "grep",
   systemPromptEntry: (i) => `### ${i}. grep — search for a pattern across files in the repo (cross-platform, no shell needed)
@@ -278656,6 +278767,7 @@ var grepTool = {
 var writeFileTool = {
   name: "write-file",
   description: "create or overwrite a file",
+  tag: TOOL_TAGS.write,
   safe: false,
   permissionLabel: "write",
   systemPromptEntry: (i) => `### ${i}. write-file — create or overwrite a file
@@ -278681,6 +278793,7 @@ var writeFileTool = {
 var deleteFileTool = {
   name: "delete-file",
   description: "permanently delete a single file",
+  tag: TOOL_TAGS.delete,
   safe: false,
   permissionLabel: "delete",
   systemPromptEntry: (i) => `### ${i}. delete-file — permanently delete a single file
@@ -278695,6 +278808,7 @@ var deleteFileTool = {
 var deleteFolderTool = {
   name: "delete-folder",
   description: "permanently delete a folder and all its contents",
+  tag: TOOL_TAGS.delete,
   safe: false,
   permissionLabel: "delete folder",
   systemPromptEntry: (i) => `### ${i}. delete-folder — permanently delete a folder and all its contents
@@ -278709,6 +278823,7 @@ var deleteFolderTool = {
 var openUrlTool = {
   name: "open-url",
   description: "open a URL in the user's default browser",
+  tag: TOOL_TAGS.net,
   safe: true,
   permissionLabel: "open",
   systemPromptEntry: (i) => `### ${i}. open-url — open a URL in the user's default browser
@@ -278720,6 +278835,7 @@ var openUrlTool = {
 var generatePdfTool = {
   name: "generate-pdf",
   description: "generate a PDF file from markdown-style content",
+  tag: TOOL_TAGS.write,
   safe: false,
   permissionLabel: "pdf",
   systemPromptEntry: (i) => `### ${i}. generate-pdf — generate a PDF file from markdown-style content
@@ -278745,6 +278861,7 @@ var generatePdfTool = {
 };
 var searchTool = {
   name: "search",
+  tag: TOOL_TAGS.net,
   description: "search the internet for anything you are unsure about",
   safe: true,
   permissionLabel: "search",
@@ -278767,6 +278884,7 @@ var searchTool = {
 var cloneTool = {
   name: "clone",
   description: "clone a GitHub repo so you can explore and discuss it",
+  tag: TOOL_TAGS.write,
   safe: false,
   permissionLabel: "clone",
   systemPromptEntry: (i) => `### ${i}. clone — clone a GitHub repo so you can explore and discuss it
@@ -278781,6 +278899,7 @@ var cloneTool = {
 var changesTool = {
   name: "changes",
   description: "propose code edits (shown as a diff for user approval)",
+  tag: TOOL_TAGS.write,
   safe: false,
   permissionLabel: "changes",
   systemPromptEntry: (i) => `### ${i}. changes — propose code edits (shown as a diff for user approval)
@@ -278803,6 +278922,7 @@ var changesTool = {
 var readFilesTool = {
   name: "read-files",
   description: "read multiple files from the repo at once",
+  tag: TOOL_TAGS.read,
   safe: true,
   permissionLabel: "read",
   systemPromptEntry: (i) => `### ${i}. read-files — read multiple files from the repo at once

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ridit/lens",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Know Your Codebase.",
   "author": "Ridit Jangra <riditjangra09@gmail.com> (https://ridit.space)",
   "license": "MIT",
@@ -19,7 +19,7 @@
     "prepublishOnly": "npm run build && npm run tag"
   },
   "dependencies": {
-    "@ridit/lens-sdk": "0.1.6",
+    "@ridit/lens-sdk": "^0.2.0",
     "asciichart": "^1.5.25",
     "bun": "^1.3.11",
     "commander": "^14.0.3",

package/src/components/chat/hooks/useChat.ts

@@ -1,6 +1,7 @@
 import { useState, useRef } from "react";
 import React from "react";
 import type { Provider } from "../../../types/config";
+import { classifyIntent } from "../../../utils/intentClassifier";
 import type { Message, ChatStage } from "../../../types/chat";
 import {
   saveChat,
@@ -421,8 +422,16 @@ export function useChat(repoPath: string) {
     const abort = new AbortController();
     abortControllerRef.current = abort;
 
+    const intent = classifyIntent(text);
+    const scopedToolsSection = registry.buildSystemPromptSection(intent);
+
+    const scopedSystemPrompt = currentSystemPrompt.replace(
+      /## TOOLS[\s\S]*?(?=\n## (?!TOOLS))/,
+      scopedToolsSection + "\n\n",
+    );
+
     setStage({ type: "thinking" });
-    callChat(currentProvider, currentSystemPrompt, nextAll, abort.signal)
+    callChat(currentProvider, scopedSystemPrompt, nextAll, abort.signal)
       .then((raw: string) => processResponse(raw, nextAll, abort.signal))
       .catch(handleError(nextAll));
   };

package/src/prompts/system.ts

@@ -1,4 +1,5 @@
 import type { ImportantFile } from "../types/repo";
+import type { Intent } from "../utils/intentClassifier";
 
 export function buildSystemPrompt(
   files: ImportantFile[],
@@ -12,25 +13,25 @@ export function buildSystemPrompt(
   const tools = toolsSection ?? BUILTIN_TOOLS_SECTION;
 
   return `You are an expert software engineer assistant with access to the user's codebase and tools.
-
+ 
 ${tools}
-
+ 
 ## MEMORY OPERATIONS
-
+ 
 You can save and delete memories at any time by emitting these tags alongside your normal response.
 They are stripped before display — the user will not see the raw tags.
-
+ 
 ### memory-add — save something important to long-term memory for this repo
 <memory-add>User prefers TypeScript strict mode in all new files</memory-add>
-
+ 
 ### memory-delete — delete a memory by its ID (shown in brackets like [abc123])
 <memory-delete>abc123</memory-delete>
-
+ 
 Use memory-add when the user asks you to remember something, or when you learn something project-specific that would be useful in future sessions.
 Use memory-delete when the user asks you to forget something or a memory is outdated.
-
+ 
 ## RULES
-
+ 
 1. ONE tool per response — emit the XML tag, then stop. Never chain tools in one response except when scaffolding (see below).
 2. NEVER call a tool more than once for the same path in a session. If write-file or shell returned a result, it succeeded. Move on immediately.
 3. NEVER write the same file twice in one session. One write per file, period. If you already wrote it, it is done.
@@ -48,15 +49,15 @@ Use memory-delete when the user asks you to forget something or a memory is outd
 15. When explaining how to use a tool in text, use [tag] bracket notation — NEVER emit a real XML tool tag as part of an explanation.
 16. NEVER use markdown formatting in plain text responses — no bold, no headings, no bullet points. Only use fenced code blocks when showing actual code.
 17. When scaffolding multiple files, emit ONE write-file tag per response and wait for the result before writing the next file.
-
+ 
 ## ADDON FORMAT
-
+ 
 All addons use defineTool from @ridit/lens-sdk. The ONLY correct format is:
-
+ 
 \`\`\`js
 const { defineTool } = require("@ridit/lens-sdk");
 const { execSync } = require("child_process");
-
+ 
 defineTool({
   name: "tool-name",
   description: "what it does",
@@ -72,26 +73,146 @@ defineTool({
   },
 });
 \`\`\`
-
+ 
 NEVER use module.exports, registerTool, ctx.tools.shell, or any other format. See addons/run-tests.js for a full working example.
-
+ 
 ## SCAFFOLDING
-
+ 
 When creating multiple files, emit ONE write-file per response and wait for each result:
-
+ 
 <write-file>
 {"path": "myapp/package.json", "content": "..."}
 </write-file>
-
+ 
 Wait for result, then emit the next file. Never chain write-file tags when content is complex.
-
+ 
 ## CODEBASE
-
+ 
 ${fileList.length > 0 ? fileList : "(no files indexed)"}
-
+ 
 ${memorySummary}`;
 }
 
+export function buildBuiltinToolsSection(intent: Intent = "any"): string {
+  const isReadonly = intent === "readonly";
+
+  const readTools = `### 1. fetch — load a URL
+<fetch>https://example.com</fetch>
+ 
+### 2. read-file — read a single file from the repo
+<read-file>src/foo.ts</read-file>
+ 
+### 3. read-files — read multiple files at once
+<read-files>
+["src/foo.ts", "src/bar.ts"]
+</read-files>
+ 
+### 4. read-folder — list contents of a folder (one level deep)
+<read-folder>src/components</read-folder>
+ 
+### 5. grep — search for a pattern across files
+<grep>
+{"pattern": "ChatRunner", "glob": "src/**/*.tsx"}
+</grep>
+ 
+### 6. search — search the internet
+<search>how to use React useEffect cleanup</search>`;
+
+  const writeTools = `### 7. shell — run a terminal command (NOT for filesystem inspection)
+<shell>node -v</shell>
+ 
+### 8. write-file — create or overwrite a file (COMPLETE content only)
+<write-file>
+{"path": "data/output.csv", "content": "col1,col2\\nval1,val2"}
+</write-file>
+ 
+### 9. delete-file — permanently delete a single file
+<delete-file>src/old-component.tsx</delete-file>
+ 
+### 10. delete-folder — permanently delete a folder and all its contents
+<delete-folder>src/legacy</delete-folder>
+ 
+### 11. open-url — open a URL in the user's default browser
+<open-url>https://github.com/owner/repo</open-url>
+ 
+### 12. generate-pdf — generate a PDF from markdown-style content
+<generate-pdf>
+{"path": "output/report.pdf", "content": "# Title\\n\\nBody text."}
+</generate-pdf>
+ 
+### 13. clone — clone a GitHub repo
+<clone>https://github.com/owner/repo</clone>
+ 
+### 14. changes — propose code edits shown as a diff for user approval
+<changes>
+{"summary": "what changed and why", "patches": [{"path": "src/foo.ts", "content": "COMPLETE file content", "isNew": false}]}
+</changes>`;
+
+  if (isReadonly) {
+    return `## TOOLS
+ 
+You have 6 tools available for this read-only request. Do NOT attempt to write, delete, or run shell commands — those tools are not available right now.
+ 
+${readTools}`;
+  }
+
+  return `## TOOLS
+ 
+You have exactly 14 tools. To use a tool you MUST wrap it in the exact XML tags shown below — no other format will work.
+ 
+### 1. fetch — load a URL
+<fetch>https://example.com</fetch>
+ 
+### 2. shell — run a terminal command (NOT for filesystem inspection)
+<shell>node -v</shell>
+ 
+### 3. read-file — read a single file from the repo
+<read-file>src/foo.ts</read-file>
+ 
+### 4. read-files — read multiple files at once
+<read-files>
+["src/foo.ts", "src/bar.ts"]
+</read-files>
+ 
+### 5. read-folder — list contents of a folder (one level deep)
+<read-folder>src/components</read-folder>
+ 
+### 6. grep — search for a pattern across files
+<grep>
+{"pattern": "ChatRunner", "glob": "src/**/*.tsx"}
+</grep>
+ 
+### 7. write-file — create or overwrite a file (COMPLETE content only)
+<write-file>
+{"path": "data/output.csv", "content": "col1,col2\\nval1,val2"}
+</write-file>
+ 
+### 8. delete-file — permanently delete a single file
+<delete-file>src/old-component.tsx</delete-file>
+ 
+### 9. delete-folder — permanently delete a folder and all its contents
+<delete-folder>src/legacy</delete-folder>
+ 
+### 10. open-url — open a URL in the user's default browser
+<open-url>https://github.com/owner/repo</open-url>
+ 
+### 11. generate-pdf — generate a PDF from markdown-style content
+<generate-pdf>
+{"path": "output/report.pdf", "content": "# Title\\n\\nBody text."}
+</generate-pdf>
+ 
+### 12. search — search the internet
+<search>how to use React useEffect cleanup</search>
+ 
+### 13. clone — clone a GitHub repo
+<clone>https://github.com/owner/repo</clone>
+ 
+### 14. changes — propose code edits shown as a diff for user approval
+<changes>
+{"summary": "what changed and why", "patches": [{"path": "src/foo.ts", "content": "COMPLETE file content", "isNew": false}]}
+</changes>`;
+}
+
 const BUILTIN_TOOLS_SECTION = `## TOOLS
 
 You have exactly fourteen tools. Use ONLY the XML tags shown below.

package/src/tools/git.ts

@@ -27,6 +27,7 @@ function parseArgs(body: string): GitArgs | null {
 export const gitStatusTool: Tool<GitArgs> = {
   name: "git-status",
   description: "show working tree status",
+  tag: "git",
   safe: true,
   permissionLabel: "git status",
   systemPromptEntry: (i) =>
@@ -45,6 +46,7 @@ export const gitStatusTool: Tool<GitArgs> = {
 export const gitLogTool: Tool<GitArgs> = {
   name: "git-log",
   description: "show commit log",
+  tag: "git",
   safe: true,
   permissionLabel: "git log",
   systemPromptEntry: (i) =>
@@ -60,6 +62,7 @@ export const gitLogTool: Tool<GitArgs> = {
 export const gitDiffTool: Tool<GitArgs> = {
   name: "git-diff",
   description: "show changes between commits, working tree, or staged files",
+  tag: "git",
   safe: true,
   permissionLabel: "git diff",
   systemPromptEntry: (i) =>
@@ -75,6 +78,7 @@ export const gitDiffTool: Tool<GitArgs> = {
 export const gitShowTool: Tool<GitArgs> = {
   name: "git-show",
   description: "show a commit's details and stat",
+  tag: "git",
   safe: true,
   permissionLabel: "git show",
   systemPromptEntry: (i) =>
@@ -90,6 +94,7 @@ export const gitShowTool: Tool<GitArgs> = {
 export const gitBranchTool: Tool<GitArgs> = {
   name: "git-branch",
   description: "list branches",
+  tag: "git",
   safe: true,
   permissionLabel: "git branch",
   systemPromptEntry: (i) =>
@@ -105,6 +110,7 @@ export const gitBranchTool: Tool<GitArgs> = {
 export const gitRemoteTool: Tool<GitArgs> = {
   name: "git-remote",
   description: "list or inspect remotes",
+  tag: "git",
   safe: true,
   permissionLabel: "git remote",
   systemPromptEntry: (i) =>
@@ -120,6 +126,7 @@ export const gitRemoteTool: Tool<GitArgs> = {
 export const gitTagTool: Tool<GitArgs> = {
   name: "git-tag",
   description: "list tags",
+  tag: "git",
   safe: true,
   permissionLabel: "git tag",
   systemPromptEntry: (i) =>
@@ -135,6 +142,7 @@ export const gitTagTool: Tool<GitArgs> = {
 export const gitBlameTool: Tool<GitArgs> = {
   name: "git-blame",
   description: "show who last modified each line of a file",
+  tag: "git",
   safe: true,
   permissionLabel: "git blame",
   systemPromptEntry: (i) =>
@@ -168,6 +176,7 @@ export const gitBlameTool: Tool<GitArgs> = {
 export const gitStashListTool: Tool<GitArgs> = {
   name: "git-stash-list",
   description: "list stashed changes",
+  tag: "git",
   safe: true,
   permissionLabel: "git stash list",
   systemPromptEntry: (i) =>
@@ -183,6 +192,7 @@ export const gitStashListTool: Tool<GitArgs> = {
 export const gitAddTool: Tool<GitArgs> = {
   name: "git-add",
   description: "stage files for commit",
+  tag: "git",
   safe: false,
   permissionLabel: "git add",
   systemPromptEntry: (i) =>
@@ -202,6 +212,7 @@ export const gitAddTool: Tool<GitArgs> = {
 export const gitCommitTool: Tool<GitArgs> = {
   name: "git-commit",
   description: "commit staged changes with a message",
+  tag: "git",
   safe: false,
   permissionLabel: "git commit",
   systemPromptEntry: (i) =>
@@ -222,6 +233,7 @@ export const gitCommitTool: Tool<GitArgs> = {
 export const gitCommitAmendTool: Tool<GitArgs> = {
   name: "git-commit-amend",
   description: "amend the last commit message",
+  tag: "git",
   safe: false,
   permissionLabel: "git commit --amend",
   systemPromptEntry: (i) =>
@@ -246,6 +258,7 @@ export const gitRevertTool: Tool<GitArgs> = {
   name: "git-revert",
   description:
     "revert a commit by hash (creates a new revert commit, history preserved)",
+  tag: "git",
   safe: false,
   permissionLabel: "git revert",
   systemPromptEntry: (i) =>
@@ -266,6 +279,7 @@ export const gitRevertTool: Tool<GitArgs> = {
 export const gitResetTool: Tool<GitArgs> = {
   name: "git-reset",
   description: "reset HEAD or unstage files",
+  tag: "git",
   safe: false,
   permissionLabel: "git reset",
   systemPromptEntry: (i) =>
@@ -285,6 +299,7 @@ export const gitResetTool: Tool<GitArgs> = {
 export const gitCheckoutTool: Tool<GitArgs> = {
   name: "git-checkout",
   description: "switch branches or restore files",
+  tag: "git",
   safe: false,
   permissionLabel: "git checkout",
   systemPromptEntry: (i) =>
@@ -305,6 +320,7 @@ export const gitCheckoutTool: Tool<GitArgs> = {
 export const gitSwitchTool: Tool<GitArgs> = {
   name: "git-switch",
   description: "switch or create branches",
+  tag: "git",
   safe: false,
   permissionLabel: "git switch",
   systemPromptEntry: (i) =>
@@ -325,6 +341,7 @@ export const gitSwitchTool: Tool<GitArgs> = {
 export const gitMergeTool: Tool<GitArgs> = {
   name: "git-merge",
   description: "merge a branch into the current branch",
+  tag: "git",
   safe: false,
   permissionLabel: "git merge",
   systemPromptEntry: (i) =>
@@ -345,6 +362,7 @@ export const gitMergeTool: Tool<GitArgs> = {
 export const gitPullTool: Tool<GitArgs> = {
   name: "git-pull",
   description: "pull from remote",
+  tag: "git",
   safe: false,
   permissionLabel: "git pull",
   systemPromptEntry: (i) =>
@@ -363,6 +381,7 @@ export const gitPullTool: Tool<GitArgs> = {
 export const gitPushTool: Tool<GitArgs> = {
   name: "git-push",
   description: "push commits to remote",
+  tag: "git",
   safe: false,
   permissionLabel: "git push",
   systemPromptEntry: (i) =>
@@ -381,6 +400,7 @@ export const gitPushTool: Tool<GitArgs> = {
 export const gitStashTool: Tool<GitArgs> = {
   name: "git-stash",
   description: "stash or apply stashed changes",
+  tag: "git",
   safe: false,
   permissionLabel: "git stash",
   systemPromptEntry: (i) =>
@@ -401,6 +421,7 @@ export const gitStashTool: Tool<GitArgs> = {
 export const gitBranchCreateTool: Tool<GitArgs> = {
   name: "git-branch-create",
   description: "create a new branch without switching to it",
+  tag: "git",
   safe: false,
   permissionLabel: "git branch (create)",
   systemPromptEntry: (i) =>
@@ -421,6 +442,7 @@ export const gitBranchCreateTool: Tool<GitArgs> = {
 export const gitBranchDeleteTool: Tool<GitArgs> = {
   name: "git-branch-delete",
   description: "delete a branch",
+  tag: "git",
   safe: false,
   permissionLabel: "git branch -d",
   systemPromptEntry: (i) =>
@@ -444,6 +466,7 @@ export const gitBranchDeleteTool: Tool<GitArgs> = {
 export const gitCherryPickTool: Tool<GitArgs> = {
   name: "git-cherry-pick",
   description: "apply a specific commit from another branch",
+  tag: "git",
   safe: false,
   permissionLabel: "git cherry-pick",
   systemPromptEntry: (i) =>
@@ -466,6 +489,7 @@ export const gitCherryPickTool: Tool<GitArgs> = {
 export const gitTagCreateTool: Tool<GitArgs> = {
   name: "git-tag-create",
   description: "create a lightweight or annotated tag",
+  tag: "git",
   safe: false,
   permissionLabel: "git tag (create)",
   systemPromptEntry: (i) =>
@@ -486,6 +510,7 @@ export const gitRestoreTool: Tool<GitArgs> = {
   name: "git-restore",
   description:
     "discard working directory changes for a file (cannot be undone)",
+  tag: "git",
   safe: false,
   permissionLabel: "git restore",
   systemPromptEntry: (i) =>
@@ -505,6 +530,7 @@ export const gitRestoreTool: Tool<GitArgs> = {
 export const gitCleanTool: Tool<GitArgs> = {
   name: "git-clean",
   description: "remove untracked files (cannot be undone)",
+  tag: "git",
   safe: false,
   permissionLabel: "git clean",
   systemPromptEntry: (i) =>

package/src/utils/intentClassifier.ts

@@ -0,0 +1,58 @@
+/**
+ * Classifies user message intent to scope which tools the LLM is allowed to use.
+ *
+ * readonly  → only read/search/fetch tools exposed (no write, delete, shell)
+ * mutating  → all tools exposed
+ * any       → all tools exposed (ambiguous / can't tell)
+ */
+export type Intent = "readonly" | "mutating" | "any";
+
+const READONLY_PATTERNS: RegExp[] = [
+  // listing / exploring
+  /\b(list|ls|dir|show|display|print|dump)\b/i,
+  /\bwhat(('?s| is| are| does)\b| files| folder)/i,
+  /\b(folder|directory|file) (structure|tree|layout|contents?)\b/i,
+  /\bexplore\b/i,
+
+  // reading / explaining
+  /\b(read|open|view|look at|check out|inspect|peek)\b/i,
+  /\b(explain|describe|summarize|summarise|tell me about|walk me through)\b/i,
+  /\bhow does\b/i,
+  /\bwhat('?s| is) (in|inside|this|that|the)\b/i,
+
+  // searching
+  /\b(find|search|grep|locate|where is|where are)\b/i,
+  /\b(look for|scan|trace)\b/i,
+
+  // understanding
+  /\bunderstand\b/i,
+  /\bshow me (how|what|where|why)\b/i,
+];
+
+const MUTATING_PATTERNS: RegExp[] = [
+  // writing
+  /\b(write|create|make|generate|add|build|scaffold|init|initialize|setup|set up)\b/i,
+  /\b(new file|new folder|new component|new page|new route)\b/i,
+
+  // editing
+  /\b(edit|modify|update|change|refactor|rename|move|migrate)\b/i,
+  /\b(fix|patch|resolve|correct|debug|repair)\b/i,
+  /\b(implement|add .+ to|insert|inject|append|prepend)\b/i,
+
+  // deleting
+  /\b(delete|remove|drop|clean ?up|purge|wipe)\b/i,
+
+  // running
+  /\b(run|execute|install|deploy|build|test|start|launch|compile|lint|format)\b/i,
+];
+
+export function classifyIntent(userMessage: string): Intent {
+  const text = userMessage.trim();
+
+  const mutatingScore = MUTATING_PATTERNS.filter((p) => p.test(text)).length;
+  const readonlyScore = READONLY_PATTERNS.filter((p) => p.test(text)).length;
+
+  if (mutatingScore === 0 && readonlyScore > 0) return "readonly";
+  if (mutatingScore > 0) return "mutating";
+  return "any";
+}

package/src/utils/tools/builtins.ts

@@ -1,4 +1,5 @@
 import type { Tool, ToolContext } from "@ridit/lens-sdk";
+import { TOOL_TAGS } from "@ridit/lens-sdk";
 import {
   fetchUrl,
   searchWeb,
@@ -23,6 +24,7 @@ export const fetchTool: Tool<string> = {
   name: "fetch",
   description: "load a URL",
   safe: true,
+  tag: TOOL_TAGS.net,
   permissionLabel: "fetch",
   systemPromptEntry: (i) =>
     `### ${i}. fetch — load a URL\n<fetch>https://example.com</fetch>`,
@@ -45,6 +47,7 @@ export const shellTool: Tool<string> = {
   name: "shell",
   description: "run a terminal command",
   safe: false,
+  tag: TOOL_TAGS.shell,
   permissionLabel: "run",
   systemPromptEntry: (i) =>
     `### ${i}. shell — run a terminal command\n<shell>node -v</shell>`,
@@ -60,6 +63,7 @@ export const readFileTool: Tool<string> = {
   name: "read-file",
   description: "read a file from the repo",
   safe: true,
+  tag: TOOL_TAGS.read,
   permissionLabel: "read",
   systemPromptEntry: (i) =>
     `### ${i}. read-file — read a file from the repo\n<read-file>src/foo.ts</read-file>`,
@@ -74,6 +78,7 @@ export const readFileTool: Tool<string> = {
 export const readFolderTool: Tool<string> = {
   name: "read-folder",
   description: "list contents of a folder (files + subfolders, one level deep)",
+  tag: TOOL_TAGS.read,
   safe: true,
   permissionLabel: "folder",
   systemPromptEntry: (i) =>
@@ -94,6 +99,7 @@ interface GrepInput {
 export const grepTool: Tool<GrepInput> = {
   name: "grep",
   description: "search for a pattern across files in the repo",
+  tag: TOOL_TAGS.find,
   safe: true,
   permissionLabel: "grep",
   systemPromptEntry: (i) =>
@@ -124,6 +130,7 @@ interface WriteFileInput {
 export const writeFileTool: Tool<WriteFileInput> = {
   name: "write-file",
   description: "create or overwrite a file",
+  tag: TOOL_TAGS.write,
   safe: false,
   permissionLabel: "write",
   systemPromptEntry: (i) =>
@@ -147,6 +154,7 @@ export const writeFileTool: Tool<WriteFileInput> = {
 export const deleteFileTool: Tool<string> = {
   name: "delete-file",
   description: "permanently delete a single file",
+  tag: TOOL_TAGS.delete,
   safe: false,
   permissionLabel: "delete",
   systemPromptEntry: (i) =>
@@ -162,6 +170,7 @@ export const deleteFileTool: Tool<string> = {
 export const deleteFolderTool: Tool<string> = {
   name: "delete-folder",
   description: "permanently delete a folder and all its contents",
+  tag: TOOL_TAGS.delete,
   safe: false,
   permissionLabel: "delete folder",
   systemPromptEntry: (i) =>
@@ -177,6 +186,7 @@ export const deleteFolderTool: Tool<string> = {
 export const openUrlTool: Tool<string> = {
   name: "open-url",
   description: "open a URL in the user's default browser",
+  tag: TOOL_TAGS.net,
   safe: true,
   permissionLabel: "open",
   systemPromptEntry: (i) =>
@@ -194,6 +204,7 @@ interface GeneratePdfInput {
 export const generatePdfTool: Tool<GeneratePdfInput> = {
   name: "generate-pdf",
   description: "generate a PDF file from markdown-style content",
+  tag: TOOL_TAGS.write,
   safe: false,
   permissionLabel: "pdf",
   systemPromptEntry: (i) =>
@@ -222,6 +233,7 @@ export const generatePdfTool: Tool<GeneratePdfInput> = {
 
 export const searchTool: Tool<string> = {
   name: "search",
+  tag: TOOL_TAGS.net,
   description: "search the internet for anything you are unsure about",
   safe: true,
   permissionLabel: "search",
@@ -245,6 +257,7 @@ export const searchTool: Tool<string> = {
 export const cloneTool: Tool<string> = {
   name: "clone",
   description: "clone a GitHub repo so you can explore and discuss it",
+  tag: TOOL_TAGS.write,
   safe: false,
   permissionLabel: "clone",
   systemPromptEntry: (i) =>
@@ -265,6 +278,7 @@ export interface ChangesInput {
 export const changesTool: Tool<ChangesInput> = {
   name: "changes",
   description: "propose code edits (shown as a diff for user approval)",
+  tag: TOOL_TAGS.write,
   safe: false,
   permissionLabel: "changes",
   systemPromptEntry: (i) =>
@@ -290,6 +304,7 @@ interface ReadFilesInput {
 export const readFilesTool: Tool<ReadFilesInput> = {
   name: "read-files",
   description: "read multiple files from the repo at once",
+  tag: TOOL_TAGS.read,
   safe: true,
   permissionLabel: "read",
   systemPromptEntry: (i) =>

package/src/utils/tools/registry.ts

@@ -1,4 +1,23 @@
-import type { Tool } from "@ridit/lens-sdk";
+import type { Tool, ToolTag } from "@ridit/lens-sdk";
+import type { Intent } from "../intentClassifier";
+
+/**
+ * Broad capability category for a tool.
+ * Used to filter the system prompt based on classified user intent.
+ *
+ * "read"   — safe, purely observational (read-file, read-folder, grep, etc.)
+ * "net"    — outbound network (fetch, search, clone, open-url)
+ * "write"  — creates or overwrites file content (write-file, changes, generate-pdf)
+ * "delete" — destructive removal (delete-file, delete-folder)
+ * "shell"  — arbitrary shell execution
+ */
+
+/** Tools allowed for each intent level */
+const INTENT_ALLOWED: Record<Intent, ToolTag[]> = {
+  readonly: ["read", "net"],
+  mutating: ["read", "net", "write", "delete", "shell"],
+  any: ["read", "net", "write", "delete", "shell"],
+};
 
 class ToolRegistry {
   private tools = new Map<string, Tool<unknown>>();
@@ -27,17 +46,54 @@ class ToolRegistry {
   }
 
   /**
-   * Build the TOOLS section of the system prompt from all registered tools.
+   * Returns tool names that are allowed for the given intent.
+   * Falls back to all names when a tool has no tag (legacy / addons).
+   */
+  namesForIntent(intent: Intent): string[] {
+    const allowed = new Set(INTENT_ALLOWED[intent]);
+    return Array.from(this.tools.values())
+      .filter((t) => {
+        const tag = (t as any).tag as ToolTag | undefined;
+        // No tag = addon / unknown → always allow (conservative)
+        if (!tag) return true;
+        return allowed.has(tag);
+      })
+      .map((t) => t.name);
+  }
+
+  /**
+   * Build the TOOLS section of the system prompt from all registered tools,
+   * optionally scoped to a specific intent.
+   *
+   * When intent is "readonly", write/delete/shell tools are omitted entirely
+   * so the LLM never sees them and can't hallucinate calls to them.
    */
-  buildSystemPromptSection(): string {
+  buildSystemPromptSection(intent: Intent = "any"): string {
+    const allowed = new Set(INTENT_ALLOWED[intent]);
+
+    const visible = Array.from(this.tools.values()).filter((t) => {
+      const tag = (t as any).tag as ToolTag | undefined;
+      if (!tag) return true; // addon without tag → always show
+      return allowed.has(tag);
+    });
+
     const lines: string[] = ["## TOOLS\n"];
-    lines.push(
-      "You have exactly " +
-        this.tools.size +
-        " tools. To use a tool you MUST wrap it in the exact XML tags shown below — no other format will work.\n",
-    );
+
+    if (intent === "readonly") {
+      lines.push(
+        `You have ${visible.length} tools available for this read-only request. ` +
+          `Do NOT attempt to write, delete, or run shell commands — ` +
+          `those tools are not available right now.\n`,
+      );
+    } else {
+      lines.push(
+        `You have exactly ${visible.length} tools. To use a tool you MUST wrap it ` +
+          `in the exact XML tags shown below — no other format will work.\n`,
+      );
+    }
+
     let i = 1;
-    for (const tool of this.tools.values()) {
+    for (const tool of visible) {
       lines.push(tool.systemPromptEntry(i++));
     }
     return lines.join("\n");