@shawnstack/quickforge 1.7.11 → 1.8.0

package/server/selected-capabilities.mjs

@@ -0,0 +1,76 @@
+export const MAX_SELECTED_CAPABILITIES = 4
+export const SELECTED_CAPABILITY_PLUGIN_NAME_MAX_LENGTH = 120
+export const SELECTED_CAPABILITY_NAME_MAX_LENGTH = 120
+export const SELECTED_CAPABILITY_LABEL_MAX_LENGTH = 160
+export const SELECTED_CAPABILITY_DESCRIPTION_MAX_LENGTH = 400
+export const SELECTED_CAPABILITIES_DETAILS_KEY = 'selectedCapabilities'
+
+const SELECTED_CAPABILITY_TYPES = new Set(['plugin', 'skill', 'tool', 'command'])
+
+function normalizedText(value, maxLength) {
+  if (typeof value !== 'string') return undefined
+  const normalized = value.trim().slice(0, maxLength)
+  return normalized || undefined
+}
+
+export function selectedCapabilityKey(capability) {
+  return `${capability.type}:${capability.pluginName}:${capability.name}`
+}
+
+export function normalizeSelectedCapabilities(value) {
+  if (!Array.isArray(value)) return []
+  const result = []
+  const seen = new Set()
+  for (const item of value) {
+    if (!item || typeof item !== 'object' || Array.isArray(item) || !SELECTED_CAPABILITY_TYPES.has(item.type)) continue
+    const pluginName = normalizedText(item.pluginName, SELECTED_CAPABILITY_PLUGIN_NAME_MAX_LENGTH)
+    const name = normalizedText(item.name, SELECTED_CAPABILITY_NAME_MAX_LENGTH)
+    const label = normalizedText(item.label, SELECTED_CAPABILITY_LABEL_MAX_LENGTH)
+    if (!pluginName || !name || !label) continue
+    const capability = { type: item.type, pluginName, name, label }
+    const description = normalizedText(item.description, SELECTED_CAPABILITY_DESCRIPTION_MAX_LENGTH)
+    if (description) capability.description = description
+    const key = selectedCapabilityKey(capability)
+    if (seen.has(key)) continue
+    seen.add(key)
+    result.push(capability)
+    if (result.length >= MAX_SELECTED_CAPABILITIES) break
+  }
+  return result
+}
+
+export function selectedCapabilitySnapshots(value) {
+  return normalizeSelectedCapabilities(value).map(({ type, pluginName, name, label }) => ({ type, pluginName, name, label }))
+}
+
+export function selectedCapabilitiesFromMessage(message) {
+  const details = message?.details
+  if (!details || typeof details !== 'object' || Array.isArray(details)) return []
+  return selectedCapabilitySnapshots(details[SELECTED_CAPABILITIES_DETAILS_KEY])
+}
+
+export function withCanonicalSelectedCapabilities(message, capabilities) {
+  if (!message || typeof message !== 'object') return message
+  const snapshots = selectedCapabilitySnapshots(capabilities)
+  const details = message.details && typeof message.details === 'object' && !Array.isArray(message.details)
+    ? message.details
+    : {}
+  const nextDetails = { ...details }
+  if (snapshots.length > 0) nextDetails[SELECTED_CAPABILITIES_DETAILS_KEY] = snapshots
+  else delete nextDetails[SELECTED_CAPABILITIES_DETAILS_KEY]
+  const next = { ...message }
+  if (Object.keys(nextDetails).length > 0) next.details = nextDetails
+  else delete next.details
+  return next
+}
+
+export function selectedCapabilityPrompt(capabilities) {
+  const normalized = normalizeSelectedCapabilities(capabilities)
+  if (normalized.length === 0) return null
+  const lines = normalized.map((capability) => {
+    const toolHint = capability.type === 'tool' ? ` Tool name: plugin__${capability.pluginName}__${capability.name}.` : ''
+    const description = capability.description ? ` Description: ${capability.description}` : ''
+    return `- ${capability.label} (${capability.type}, plugin: ${capability.pluginName}, name: ${capability.name}).${toolHint}${description}`
+  }).join('\n')
+  return `The user selected the following QuickForge plugin capability mentions for this turn. Treat them as an explicit preference for routing and context. Use the selected capability when relevant, but do not force it if it is unrelated to the actual request.\n\n${lines}`
+}

package/server/session-state-import.mjs

@@ -98,7 +98,12 @@ function normalizeSessionEntry(bucket, sessionId, rawState, rawMetadata, diagnos
 // Resilience: a failing entry (unreadable file, validation mismatch,
 // cross-bucket duplicate) never aborts the run — it is counted in `skipped`
 // and described in `diagnostics` so the operator can inspect and fix the
-// source tree, then simply re-run.
+// source tree, then simply re-run. The same holds one level up: an unreadable
+// or malformed sessions-metadata.json (the physical adapter only swallows
+// ENOENT — corrupt JSON, EACCES/EBUSY rethrow) degrades that bucket to empty
+// metadata instead of failing the import, and with it startup: body files
+// still import through deriveMetadata, only metadata-only entries are lost
+// (they carry no messages and are dropped by design anyway).
 export async function importSessionStateFromJson({ storage = null, logger = defaultLogger } = {}) {
   const storageModule = storage ?? await import('./storage.mjs')
   const fsAdapter = storageModule.createPhysicalSessionStateFsAdapter()
@@ -109,8 +114,20 @@ export async function importSessionStateFromJson({ storage = null, logger = defa
 
   for await (const rawBucket of fsAdapter.listBuckets()) {
     const bucket = normalizeBucket(rawBucket)
-    const metadata = await fsAdapter.readMetadataBucket(rawBucket)
-    if (!isPlainObject(metadata)) throw new TypeError('Session bucket stores must be objects')
+    let metadata = {}
+    try {
+      const rawMetadata = await fsAdapter.readMetadataBucket(rawBucket)
+      if (!isPlainObject(rawMetadata)) throw new TypeError('Session bucket stores must be objects')
+      metadata = rawMetadata
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error)
+      diagnostics.push({ kind: 'metadata-bucket-error', scope: bucket.scope, projectId: bucket.projectId, message })
+      logger.warn('Session metadata bucket unreadable; importing with body-derived metadata', {
+        scope: bucket.scope,
+        projectId: bucket.projectId,
+        message,
+      })
+    }
     const fileIds = new Set()
     for await (const sessionId of fsAdapter.listSessionFiles(rawBucket)) fileIds.add(sessionId)
     const ids = [...new Set([...fileIds, ...Object.keys(metadata)])].sort((left, right) => left.localeCompare(right))

package/server/skills.mjs

@@ -392,7 +392,7 @@ function searchDirsForList(value) {
   return value.length === 1 ? value[0] : value.slice()
 }
 
-function summarizeSkills(skills) {
+export function summarizeSkills(skills) {
   return skills.map(({ instructions: _instructions, rootDir: _rootDir, location: _location, ...summary }) => summary)
 }
 

package/server/system-prompt.mjs

@@ -2,8 +2,7 @@ export const BASE_SYSTEM_PROMPT = `You are a pragmatic coding assistant.
 
 For project tasks:
 - Do not assume requirements. If ambiguous, state assumptions or ask.
-- Prefer the simplest solution that satisfies the request.
-- Make surgical changes only. Do not refactor unrelated code.
+- Do not refactor unrelated code.
 - Match existing style.
 - When content has room for visual explanation, first consider whether an SVG diagram can improve understanding.
 - For multi-step work, use a brief plan.
@@ -11,7 +10,6 @@ For project tasks:
 - Before taking action, confirm with the user.
 - Unless the change is trivial and localized to an already-known file, use Explore first for read-only repository research before implementation decisions; prefer Explore for file discovery, source location, broad searches, call-chain lookup, pattern lookup, impact analysis, and locating related tests, docs, wiki pages, or build scripts.
 - For complex multi-step work, use General only for bounded assistance; the parent assistant remains responsible for final decisions, minimal edits, and verification.
-- Make minimal, focused changes.
 - Prefer dedicated workspace tools for reading, editing, and searching files.
 - If dedicated tools are unavailable or insufficient, use the shell/command tool.
 - Use Python through the shell for reliable scripting, data processing, or file transformations.

package/server/tools/definitions.mjs

@@ -54,8 +54,26 @@ export const globalMemoryTool = {
   executionMode: 'sequential',
 }
 
+export const askUserTool = {
+  name: 'ask_user',
+  label: 'Ask user',
+  description: 'Ask the user one or more questions (up to 4) and wait for their answers before continuing. Use this when you need the user to choose between approaches, confirm a direction, or supply information you cannot infer. Questions should be self-contained; each question offers 2-4 options and the user may answer with free-form text instead. All questions are answered together, then the run resumes.',
+  parameters: Type.Object({
+    questions: Type.Array(Type.Object({
+      question: Type.String({ description: 'Complete, self-contained question text.' }),
+      options: Type.Optional(Type.Array(Type.Object({
+        label: Type.String({ description: 'Concise option label.' }),
+        description: Type.Optional(Type.String({ description: 'Optional one-line explanation of the trade-off.' })),
+      }), { maxItems: 4, description: '2-4 mutually exclusive options.' })),
+      multiSelect: Type.Optional(Type.Boolean({ description: 'Allow selecting multiple options.', default: false })),
+      allowCustom: Type.Optional(Type.Boolean({ description: 'Allow a free-form answer instead of the options.', default: true })),
+    }), { minItems: 1, maxItems: 4, description: 'Questions asked together in one card; the user answers all of them in one pass.' }),
+  }),
+}
+
 export const workspaceTools = [
   subagentTool,
+  askUserTool,
   {
     name: 'read_file',
     label: 'Read file',
@@ -116,16 +134,6 @@ export const workspaceTools = [
     }),
     executionMode: 'sequential',
   },
-  {
-    name: 'generate_image',
-    label: 'Generate image',
-    description: 'Generate images with the configured OpenRouter provider and save them as assets owned by the current conversation. Use this when the user explicitly asks for a generated bitmap image. The operation may incur provider charges.',
-    parameters: Type.Object({
-      prompt: Type.String({ description: 'Detailed image-generation prompt.' }),
-      model: Type.Optional(Type.String({ description: 'Optional OpenRouter image model ID. Defaults to google/gemini-2.5-flash-image.' })),
-    }),
-    executionMode: 'sequential',
-  },
   {
     name: 'present_files',
     label: 'Present files',

package/server/tools/index.mjs

@@ -486,7 +486,7 @@ export async function toolGrepFiles(params, context, runtime = {}) {
 }
 
 // --- write_file ---
-export async function toolWriteFile(params, context) {
+export async function toolWriteFile(params, context, runtime = {}) {
   const file = resolveWorkspacePath(params?.path, context)
   await assertSafeWorkspacePath(file, context, { forWrite: true })
 
@@ -502,6 +502,12 @@ export async function toolWriteFile(params, context) {
   }
   const diff = createTextDiff(oldText, content, relativePath, { oldExists: existed })
 
+  // 写盘前先发一次 partial update，让前端在 running 阶段就能滚动显示 ±行数。
+  runtime.onUpdate?.({
+    content: [{ type: 'text', text: `${existed ? 'Writing' : 'Creating'} ${relativePath} (+${diff.addedLines} -${diff.removedLines})` }],
+    details: { running: true, path: relativePath, project: context?.project, diff: { addedLines: diff.addedLines, removedLines: diff.removedLines } },
+  })
+
   await fs.mkdir(path.dirname(file), { recursive: true })
   await fs.writeFile(file, content, 'utf8')
 
@@ -536,7 +542,7 @@ function convertToLineEnding(text, ending) {
   return ending === '\r\n' ? normalized.replaceAll('\n', '\r\n') : normalized
 }
 
-export async function toolEditFile(params, context) {
+export async function toolEditFile(params, context, runtime = {}) {
   const file = resolveWorkspacePath(params?.path, context)
   await assertSafeWorkspacePath(file, context)
 
@@ -560,6 +566,12 @@ export async function toolEditFile(params, context) {
   const relativePath = toWorkspaceRelative(file, context)
   const diff = createTextDiff(text, nextText, relativePath)
 
+  // 写盘前先发一次 partial update，让前端在 running 阶段就能滚动显示 ±行数。
+  runtime.onUpdate?.({
+    content: [{ type: 'text', text: `Editing ${relativePath} (+${diff.addedLines} -${diff.removedLines})` }],
+    details: { running: true, path: relativePath, project: context?.project, diff: { addedLines: diff.addedLines, removedLines: diff.removedLines } },
+  })
+
   await fs.writeFile(file, nextText, 'utf8')
 
   return {

package/server/utils/workspace.mjs

@@ -41,7 +41,7 @@ export function toWorkspaceRelative(fullPath, context) {
 
 export function isSensitiveWorkspacePath(fullPath, context) {
   const relative = toWorkspaceRelative(fullPath, context)
-  const parts = relative.split('/')
+  const parts = relative.split('/').map((part) => part.toLocaleLowerCase())
   const name = parts.at(-1) || ''
   return (
     parts.includes('.git') ||
@@ -61,6 +61,13 @@ export function isSensitiveWorkspacePath(fullPath, context) {
   )
 }
 
+function sensitivePathError(fullPath, context) {
+  return Object.assign(new Error(`Access to sensitive path is blocked: ${toWorkspaceRelative(fullPath, context)}`), {
+    statusCode: 403,
+    errorCode: 'WORKSPACE_SENSITIVE_PATH',
+  })
+}
+
 async function realpathNearestExistingParent(inputPath) {
   let current = path.resolve(inputPath)
   while (true) {
@@ -77,9 +84,7 @@ async function realpathNearestExistingParent(inputPath) {
 
 async function assertSafeWorkspacePathWithRoot(fullPath, context, workspaceReal, options = {}) {
   if (!options.allowSensitive && isSensitiveWorkspacePath(fullPath, context)) {
-    const error = new Error(`Access to sensitive path is blocked: ${toWorkspaceRelative(fullPath, context)}`)
-    error.statusCode = 403
-    throw error
+    throw sensitivePathError(fullPath, context)
   }
 
   let targetReal
@@ -98,8 +103,12 @@ async function assertSafeWorkspacePathWithRoot(fullPath, context, workspaceReal,
   if (!isInside(workspaceReal, targetReal)) {
     const error = new Error(`Path resolves outside the selected project: ${toWorkspaceRelative(fullPath, context)}`)
     error.statusCode = 403
+    error.errorCode = 'WORKSPACE_PATH_ESCAPE'
     throw error
   }
+  if (!options.allowSensitive && isSensitiveWorkspacePath(targetReal, { workspaceRoot: workspaceReal })) {
+    throw sensitivePathError(fullPath, context)
+  }
 }
 
 export async function createWorkspacePathValidator(context) {