@shawnstack/quickforge 1.7.12 → 1.8.0

package/server/custom-commands.mjs

@@ -33,6 +33,12 @@ const builtinCommandCatalog = [
     argumentHint: '[scope]',
     permissionNote: 'no edits',
   },
+  {
+    name: 'commit',
+    description: 'Validate and commit the current task changes as one local commit.',
+    argumentHint: '[message]',
+    permissionNote: 'commands allowed; no edits or subagents',
+  },
   {
     name: 'summary',
     description: 'Create a new chat with this conversation summarized to reduce context usage.',
@@ -361,6 +367,29 @@ ${expandedBody}
 </custom_command_invocation>`
 }
 
+export function formatSkillCommandPrompt(name, task) {
+  const taskBlock = String(task || '').trim() || '(none — call activate_skill first, then ask the user what they would like to do)'
+  return `<skill_invocation name="${escapeXml(name)}" source="slash">
+This slash command applies only to the current user request. Follow it unless it conflicts with higher-priority system, safety, user, or project instructions.
+
+First call the activate_skill tool with name="${escapeXml(name)}", then carry out the task below following the skill's instructions.
+
+Task:
+${taskBlock}
+</skill_invocation>`
+}
+
+export function formatAgentCommandPrompt(name, task) {
+  return `<subagent_invocation name="${escapeXml(name)}" source="slash">
+This slash command applies only to the current user request. Follow it unless it conflicts with higher-priority system, safety, user, or project instructions.
+
+Call the run_subagent tool with subagent="${escapeXml(name)}" and the task below. Do not perform the task yourself unless the subagent is unavailable. When it completes, summarize its findings for the user.
+
+Task:
+${String(task || '').trim()}
+</subagent_invocation>`
+}
+
 function escapeXml(value) {
   return String(value ?? '')
     .replace(/&/g, '&amp;')
@@ -384,12 +413,21 @@ export function parseInternalCommandInvocation(message) {
   const reviewMatch = text.match(/^\/review(?:\s+([\s\S]*))?$/i)
   if (reviewMatch) return { type: 'review', args: (reviewMatch[1] || '').trim() }
 
+  const commitMatch = text.match(/^\/commit(?:\s+([\s\S]*))?$/i)
+  if (commitMatch) return { type: 'commit', args: (commitMatch[1] || '').trim() }
+
   const compactMatch = text.match(/^\/compact(?:\s+([\s\S]*))?$/i)
   if (compactMatch) return { type: 'compact', args: (compactMatch[1] || '').trim() }
 
   const summaryMatch = text.match(/^\/summary(?:\s+([\s\S]*))?$/i)
   if (summaryMatch) return { type: 'summary', args: (summaryMatch[1] || '').trim() }
 
+  const skillMatch = text.match(/^\/skill(?:\s+([\s\S]*))?$/i)
+  if (skillMatch) return { type: 'skill', args: (skillMatch[1] || '').trim() }
+
+  const agentMatch = text.match(/^\/agent(?:\s+([\s\S]*))?$/i)
+  if (agentMatch) return { type: 'agent', args: (agentMatch[1] || '').trim() }
+
   const createMatch = text.match(/^\/command\s+new\s+([A-Za-z0-9][A-Za-z0-9-]*)\s*$/i)
   if (createMatch) {
     const name = normalizeCommandName(createMatch[1])
@@ -429,6 +467,11 @@ export async function handleInternalCommand(invocation, workspaceRoot, commandDi
     return { review: true, args: invocation.args || '' }
   }
 
+  if (invocation.type === 'commit') {
+    if (!workspaceRoot) return 'Commit requires an active project chat.'
+    return { commit: true, args: invocation.args || '' }
+  }
+
   if (invocation.type === 'clear') {
     return { clear: true }
   }

package/server/index.mjs

@@ -475,7 +475,7 @@ async function handleApi(req, res, url, requestContext = {}) {
   }
 
   // Project workspace inspector routes
-  if (pathname === '/api/workspace/tree' || pathname === '/api/workspace/children' || pathname === '/api/workspace/search' || pathname === '/api/workspace/file' || pathname === '/api/workspace/resolve-path' || pathname === '/api/workspace/open-external' || pathname.startsWith('/api/workspace/preview/')) {
+  if (pathname === '/api/workspace/tree' || pathname === '/api/workspace/children' || pathname === '/api/workspace/search' || pathname === '/api/workspace/mention-children' || pathname === '/api/workspace/mention-search' || pathname === '/api/workspace/file' || pathname === '/api/workspace/resolve-path' || pathname === '/api/workspace/open-external' || pathname.startsWith('/api/workspace/preview/')) {
     await handleWorkspaceApi(req, res, url, requestContext)
     return
   }

package/server/project-config.mjs

@@ -304,14 +304,14 @@ export async function initializeActiveProject() {
   setWorkspaceRoot(defaultWorkspaceRoot)
 }
 
-export async function projectContextFromId(projectId) {
+export async function registeredProjectContextFromId(projectId) {
   const config = await readProjectConfig()
   const project = config.projects.find((item) => item.id === projectId)
   if (!project) {
-    // Unknown or removed project (e.g. a global conversation's synthetic id) —
-    // fall back to the default workspace so workspace/git REST endpoints keep
-    // working for global conversations.
-    return defaultGlobalWorkspaceContext()
+    const error = new Error('Unknown project')
+    error.statusCode = 404
+    error.errorCode = 'PROJECT_NOT_FOUND'
+    throw error
   }
 
   await assertDirectory(project.path)
@@ -319,6 +319,18 @@ export async function projectContextFromId(projectId) {
   return { project, workspaceRoot: path.resolve(project.path) }
 }
 
+export async function projectContextFromId(projectId) {
+  try {
+    return await registeredProjectContextFromId(projectId)
+  } catch (error) {
+    if (error?.errorCode !== 'PROJECT_NOT_FOUND') throw error
+    // Unknown or removed project (e.g. a global conversation's synthetic id) —
+    // fall back to the default workspace so workspace/git REST endpoints keep
+    // working for global conversations.
+    return defaultGlobalWorkspaceContext()
+  }
+}
+
 export async function readInstructionsFile(filePath) {
   const candidates = filePath.endsWith('AGENTS.md')
     ? [filePath, path.join(path.dirname(filePath), 'agents.md')]

package/server/routes/agent-profiles.mjs

@@ -43,6 +43,17 @@ import {
   updateBuiltinAgentOverrides,
   updateCustomAgentProfile,
 } from '../agent-profiles.mjs'
+import { projectContextFromId } from '../project-config.mjs'
+
+async function projectWorkspaceRoot(projectId) {
+  if (!projectId) return null
+  try {
+    const context = await projectContextFromId(projectId)
+    return context.workspaceRoot
+  } catch {
+    return null
+  }
+}
 
 function requestError(message, statusCode = 400) {
   const error = new Error(message)
@@ -158,7 +169,11 @@ export async function handleAgentProfilesApi(req, res, url, context = {}) {
   const parts = url.pathname.split('/').filter(Boolean)
 
   if (req.method === 'GET' && url.pathname === '/api/agent-profiles') {
-    const agents = await listAgentProfiles({ includeDisabled: true })
+    // Optional projectId makes project-level agent files (.claude/agents,
+    // .quickforge/agents) appear alongside built-in and user profiles; an
+    // unknown/absent projectId keeps the previous default behavior.
+    const workspaceRoot = await projectWorkspaceRoot(url.searchParams.get('projectId'))
+    const agents = await listAgentProfiles({ includeDisabled: true, ...(workspaceRoot ? { workspaceRoot } : {}) })
     sendJson(res, 200, { agents: agents.map(agentProfileSnapshot) })
     return
   }

package/server/routes/agent.mjs

@@ -92,7 +92,7 @@ export async function handleAgentApi(req, res, url, context = {}) {
       error.statusCode = 400
       throw error
     }
-    const result = await runPrompt(sessionId, message, body?.selectedCapabilities, body?.command, null, context)
+    const result = await runPrompt(sessionId, message, body?.selectedCapabilities, body?.command, null, context, body?.contextReferences)
     sendJson(res, 200, result)
     return
   }

package/server/routes/shared-conversation.mjs

@@ -58,7 +58,13 @@ function publicSharePayload(record) {
 function sanitizeMessage(message) {
   if (!message || typeof message !== 'object') return message
   if (message.role === 'system') return null
-  return message
+  if (!message.details || typeof message.details !== 'object' || Array.isArray(message.details)) return message
+  const details = { ...message.details }
+  delete details.contextReferences
+  const sanitized = { ...message }
+  if (Object.keys(details).length > 0) sanitized.details = details
+  else delete sanitized.details
+  return sanitized
 }
 
 function sanitizeContextCompaction(compaction) {
@@ -369,6 +375,12 @@ export async function handleSharedConversationApi(req, res, url, context = {}) {
   if (req.method === 'POST' && action === 'message') {
     assertOperate(record)
     const body = await readJsonBody(req)
+    if (Array.isArray(body?.contextReferences) && body.contextReferences.length > 0) {
+      throw Object.assign(new Error('Shared conversations do not support file context references'), {
+        statusCode: 409,
+        errorCode: 'CONTEXT_REFERENCES_UNSUPPORTED_SHARED',
+      })
+    }
     await restoreAgent(record.sessionId)
     const result = await runPrompt(
       record.sessionId,

package/server/routes/skills.mjs

@@ -6,10 +6,14 @@ import {
   filterKnownProjectSkillNames,
   findGlobalSkill,
   findProjectSkill,
+  loadSelectedGlobalSkills,
+  loadSelectedProjectSkills,
+  mergeSkills,
   projectSkillSearchPaths,
   listGlobalSkillSummaries,
   listProjectSkillSummaries,
   skillSearchPaths,
+  summarizeSkills,
 } from '../skills.mjs'
 
 function getProject(config, projectId) {
@@ -46,6 +50,24 @@ export async function handleSkillsApi(req, res, url) {
   const scope = url.searchParams.get('scope') === 'global' ? 'global' : 'project'
 
   if (req.method === 'GET' && url.pathname === '/api/skills') {
+    if (url.searchParams.get('available') === 'true') {
+      // Merged view of what the current session can activate: global enabled
+      // skills always, plus project enabled skills (including plugin
+      // contributions) when a valid project is in scope. Mirrors the merge in
+      // loadSkillToolContext / activeSkillsForContext (project overrides global).
+      const project = projectId ? getProject(config, projectId) : null
+      const workspaceRoot = await projectWorkspaceRoot(project?.id)
+      const globalSkills = await loadSelectedGlobalSkills(selectedGlobalSkills(config))
+      const projectSkills = workspaceRoot
+        ? await loadSelectedProjectSkills(selectedSkillsForProject(project), workspaceRoot)
+        : []
+      sendJson(res, 200, {
+        available: true,
+        skills: summarizeSkills(mergeSkills(globalSkills, projectSkills)),
+      })
+      return
+    }
+
     if (scope === 'global') {
       sendJson(res, 200, {
         scope: 'global',

package/server/routes/workspace.mjs

@@ -5,7 +5,7 @@ import { streamSimpleWithAiHttpLogging } from '../ai-http-logger.mjs'
 import { resolveModelBinding } from '../model-catalog.mjs'
 import { DEFAULT_AI_MAX_RETRIES } from '../ai-provider-options.mjs'
 import { sendJson, readJsonBody } from '../utils/response.mjs'
-import { projectContextFromId } from '../project-config.mjs'
+import { projectContextFromId, registeredProjectContextFromId } from '../project-config.mjs'
 import { readStore } from '../storage.mjs'
 import { logger } from '../utils/logger.mjs'
 import { openPathInFileManager, openPathInIDEA, openPathInVSCode } from '../utils/platform.mjs'
@@ -29,6 +29,8 @@ const DEFAULT_CHILDREN_LIMIT = 200
 const MAX_CHILDREN_LIMIT = 500
 const DEFAULT_SEARCH_LIMIT = 100
 const MAX_SEARCH_LIMIT = 200
+const DEFAULT_MENTION_SEARCH_LIMIT = 20
+const MAX_MENTION_SEARCH_LIMIT = 50
 const MAX_SEARCH_VISITED_ENTRIES = 50000
 const SKIP_DIRS = new Set(['.git', 'node_modules'])
 
@@ -897,7 +899,7 @@ async function handleWorkspaceChildren(req, res, url) {
 export async function readValidatedWorkspaceSearchDirectory(directory, validateWorkspacePath, visitedDirectories, io = {}) {
   const realpath = io.realpath || fs.realpath
   const readdir = io.readdir || fs.readdir
-  await validateWorkspacePath(directory, { allowSensitive: true })
+  await validateWorkspacePath(directory, { allowSensitive: io.allowSensitive !== false })
   const directoryReal = await realpath(directory)
   const directoryKey = process.platform === 'win32' ? directoryReal.toLocaleLowerCase() : directoryReal
   if (visitedDirectories.has(directoryKey)) return null
@@ -973,6 +975,160 @@ async function handleWorkspaceSearch(req, res, url) {
   }))
 }
 
+function mentionSearchRank(entry, normalizedQuery) {
+  const name = entry.name.toLocaleLowerCase()
+  const relativePath = entry.path.toLocaleLowerCase()
+  if (name === normalizedQuery) return 0
+  if (name.startsWith(normalizedQuery)) return 1
+  if (name.includes(normalizedQuery)) return 2
+  return relativePath.startsWith(normalizedQuery) ? 3 : 4
+}
+
+function compareMentionSearchEntries(left, right, normalizedQuery) {
+  return mentionSearchRank(left, normalizedQuery) - mentionSearchRank(right, normalizedQuery)
+    || left.path.localeCompare(right.path, undefined, { sensitivity: 'base' })
+    || left.path.localeCompare(right.path, undefined, { sensitivity: 'variant' })
+    || (left.path < right.path ? -1 : left.path > right.path ? 1 : 0)
+}
+
+async function mentionSearchEntryFromDirent(directory, dirent, context, validateWorkspacePath) {
+  if (dirent.isDirectory() && SKIP_DIRS.has(dirent.name)) return null
+  const fullPath = path.join(directory, dirent.name)
+  const relativePath = toWorkspaceRelative(fullPath, context)
+  try {
+    await validateWorkspacePath(fullPath)
+    const stat = await fs.stat(fullPath)
+    if (stat.isDirectory()) {
+      if (SKIP_DIRS.has(dirent.name)) return null
+      if (dirent.isSymbolicLink()) {
+        const workspaceReal = await fs.realpath(context.workspaceRoot)
+        const targetPaths = [
+          [workspaceReal, await fs.realpath(fullPath)],
+          [context.workspaceRoot, path.resolve(directory, await fs.readlink(fullPath))],
+        ]
+        if (targetPaths.some(([root, target]) => path.relative(root, target).split(path.sep).some((part) => SKIP_DIRS.has(part)))) return null
+      }
+      return { name: dirent.name, path: relativePath, type: 'directory', fullPath }
+    }
+    if (stat.isFile()) return { name: dirent.name, path: relativePath, type: 'file' }
+  } catch {
+    // Sensitive, external, broken, or inaccessible entries are omitted.
+  }
+  return null
+}
+
+async function readMentionWorkspaceDirectory(context, relativePath) {
+  const requestedPath = relativePath?.trim() || '.'
+  const directory = resolveWorkspacePath(requestedPath, context)
+  const validateWorkspacePath = await createWorkspacePathValidator(context)
+  await validateWorkspacePath(directory)
+  const stat = await fs.stat(directory)
+  if (!stat.isDirectory()) {
+    const error = new Error('Path is not a directory')
+    error.statusCode = 400
+    throw error
+  }
+  return { directory, requestedPath: toWorkspaceRelative(directory, context), validateWorkspacePath }
+}
+
+export async function listWorkspaceMentionChildren(context, relativePath = '.') {
+  const { directory, requestedPath, validateWorkspacePath } = await readMentionWorkspaceDirectory(context, relativePath)
+  const dirents = await fs.readdir(directory, { withFileTypes: true })
+  const entries = []
+  for (const dirent of dirents) {
+    const entry = await mentionSearchEntryFromDirent(directory, dirent, context, validateWorkspacePath)
+    if (!entry) continue
+    entries.push({ name: entry.name, path: entry.path, type: entry.type })
+  }
+  entries.sort(compareWorkspaceEntries)
+  return {
+    root: context.project.name,
+    path: requestedPath,
+    entries,
+  }
+}
+
+async function handleWorkspaceMentionChildren(req, res, url) {
+  const projectId = url.searchParams.get('projectId')
+  if (!projectId) {
+    const error = new Error('projectId is required')
+    error.statusCode = 400
+    throw error
+  }
+  const context = await registeredProjectContextFromId(projectId)
+  sendJson(res, 200, await listWorkspaceMentionChildren(context, url.searchParams.get('path') || '.'))
+}
+
+export async function searchWorkspaceMentions(context, rawQuery, options = {}) {
+  const query = typeof rawQuery === 'string' ? rawQuery.trim() : ''
+  if (query.length < 2) {
+    const error = new Error('query must contain at least 2 characters')
+    error.statusCode = 400
+    throw error
+  }
+  const limit = parseBoundedLimit(options.limit ?? null, DEFAULT_MENTION_SEARCH_LIMIT, MAX_MENTION_SEARCH_LIMIT)
+  const validateWorkspacePath = await createWorkspacePathValidator(context)
+  await validateWorkspacePath(context.workspaceRoot)
+  const normalizedQuery = query.toLocaleLowerCase()
+  const results = []
+  const pending = [context.workspaceRoot]
+  const visitedDirectories = new Set()
+  let visited = 0
+  let traversalTruncated = false
+
+  while (pending.length > 0 && !traversalTruncated) {
+    const directory = pending.pop()
+    let validated
+    try {
+      validated = await readValidatedWorkspaceSearchDirectory(directory, validateWorkspacePath, visitedDirectories, { allowSensitive: false })
+    } catch {
+      continue
+    }
+    if (!validated) continue
+    const { dirents } = validated
+    dirents.sort((left, right) => left.name.localeCompare(right.name, undefined, { sensitivity: 'base' })
+      || left.name.localeCompare(right.name, undefined, { sensitivity: 'variant' })
+      || (left.name < right.name ? -1 : left.name > right.name ? 1 : 0))
+    const childDirectories = []
+    for (const dirent of dirents) {
+      if (visited >= MAX_SEARCH_VISITED_ENTRIES) {
+        traversalTruncated = true
+        break
+      }
+      visited += 1
+      const entry = await mentionSearchEntryFromDirent(directory, dirent, context, validateWorkspacePath)
+      if (!entry) continue
+      if (entry.type === 'directory') {
+        childDirectories.push(entry.fullPath)
+      } else if (entry.path.toLocaleLowerCase().includes(normalizedQuery) || entry.name.toLocaleLowerCase().includes(normalizedQuery)) {
+        results.push(entry)
+      }
+    }
+    for (let index = childDirectories.length - 1; index >= 0; index -= 1) pending.push(childDirectories[index])
+  }
+
+  results.sort((left, right) => compareMentionSearchEntries(left, right, normalizedQuery))
+  return {
+    root: context.project.name,
+    query,
+    entries: results.slice(0, limit),
+    truncated: traversalTruncated || results.length > limit,
+  }
+}
+
+async function handleWorkspaceMentionSearch(req, res, url) {
+  const projectId = url.searchParams.get('projectId')
+  if (!projectId) {
+    const error = new Error('projectId is required')
+    error.statusCode = 400
+    throw error
+  }
+  const context = await registeredProjectContextFromId(projectId)
+  sendJson(res, 200, await searchWorkspaceMentions(context, url.searchParams.get('query') || '', {
+    limit: url.searchParams.get('limit'),
+  }))
+}
+
 async function handleWorkspaceFile(req, res, url) {
   const context = await projectContextFromUrl(url)
   const relativePath = url.searchParams.get('path') || ''
@@ -1414,6 +1570,14 @@ export async function handleWorkspaceApi(req, res, url, requestContext = {}) {
     await handleWorkspaceSearch(req, res, url)
     return
   }
+  if (req.method === 'GET' && url.pathname === '/api/workspace/mention-children') {
+    await handleWorkspaceMentionChildren(req, res, url)
+    return
+  }
+  if (req.method === 'GET' && url.pathname === '/api/workspace/mention-search') {
+    await handleWorkspaceMentionSearch(req, res, url)
+    return
+  }
   if (req.method === 'GET' && url.pathname === '/api/workspace/file') {
     await handleWorkspaceFile(req, res, url)
     return

package/server/selected-capabilities.mjs

@@ -0,0 +1,76 @@
+export const MAX_SELECTED_CAPABILITIES = 4
+export const SELECTED_CAPABILITY_PLUGIN_NAME_MAX_LENGTH = 120
+export const SELECTED_CAPABILITY_NAME_MAX_LENGTH = 120
+export const SELECTED_CAPABILITY_LABEL_MAX_LENGTH = 160
+export const SELECTED_CAPABILITY_DESCRIPTION_MAX_LENGTH = 400
+export const SELECTED_CAPABILITIES_DETAILS_KEY = 'selectedCapabilities'
+
+const SELECTED_CAPABILITY_TYPES = new Set(['plugin', 'skill', 'tool', 'command'])
+
+function normalizedText(value, maxLength) {
+  if (typeof value !== 'string') return undefined
+  const normalized = value.trim().slice(0, maxLength)
+  return normalized || undefined
+}
+
+export function selectedCapabilityKey(capability) {
+  return `${capability.type}:${capability.pluginName}:${capability.name}`
+}
+
+export function normalizeSelectedCapabilities(value) {
+  if (!Array.isArray(value)) return []
+  const result = []
+  const seen = new Set()
+  for (const item of value) {
+    if (!item || typeof item !== 'object' || Array.isArray(item) || !SELECTED_CAPABILITY_TYPES.has(item.type)) continue
+    const pluginName = normalizedText(item.pluginName, SELECTED_CAPABILITY_PLUGIN_NAME_MAX_LENGTH)
+    const name = normalizedText(item.name, SELECTED_CAPABILITY_NAME_MAX_LENGTH)
+    const label = normalizedText(item.label, SELECTED_CAPABILITY_LABEL_MAX_LENGTH)
+    if (!pluginName || !name || !label) continue
+    const capability = { type: item.type, pluginName, name, label }
+    const description = normalizedText(item.description, SELECTED_CAPABILITY_DESCRIPTION_MAX_LENGTH)
+    if (description) capability.description = description
+    const key = selectedCapabilityKey(capability)
+    if (seen.has(key)) continue
+    seen.add(key)
+    result.push(capability)
+    if (result.length >= MAX_SELECTED_CAPABILITIES) break
+  }
+  return result
+}
+
+export function selectedCapabilitySnapshots(value) {
+  return normalizeSelectedCapabilities(value).map(({ type, pluginName, name, label }) => ({ type, pluginName, name, label }))
+}
+
+export function selectedCapabilitiesFromMessage(message) {
+  const details = message?.details
+  if (!details || typeof details !== 'object' || Array.isArray(details)) return []
+  return selectedCapabilitySnapshots(details[SELECTED_CAPABILITIES_DETAILS_KEY])
+}
+
+export function withCanonicalSelectedCapabilities(message, capabilities) {
+  if (!message || typeof message !== 'object') return message
+  const snapshots = selectedCapabilitySnapshots(capabilities)
+  const details = message.details && typeof message.details === 'object' && !Array.isArray(message.details)
+    ? message.details
+    : {}
+  const nextDetails = { ...details }
+  if (snapshots.length > 0) nextDetails[SELECTED_CAPABILITIES_DETAILS_KEY] = snapshots
+  else delete nextDetails[SELECTED_CAPABILITIES_DETAILS_KEY]
+  const next = { ...message }
+  if (Object.keys(nextDetails).length > 0) next.details = nextDetails
+  else delete next.details
+  return next
+}
+
+export function selectedCapabilityPrompt(capabilities) {
+  const normalized = normalizeSelectedCapabilities(capabilities)
+  if (normalized.length === 0) return null
+  const lines = normalized.map((capability) => {
+    const toolHint = capability.type === 'tool' ? ` Tool name: plugin__${capability.pluginName}__${capability.name}.` : ''
+    const description = capability.description ? ` Description: ${capability.description}` : ''
+    return `- ${capability.label} (${capability.type}, plugin: ${capability.pluginName}, name: ${capability.name}).${toolHint}${description}`
+  }).join('\n')
+  return `The user selected the following QuickForge plugin capability mentions for this turn. Treat them as an explicit preference for routing and context. Use the selected capability when relevant, but do not force it if it is unrelated to the actual request.\n\n${lines}`
+}

package/server/skills.mjs

@@ -392,7 +392,7 @@ function searchDirsForList(value) {
   return value.length === 1 ? value[0] : value.slice()
 }
 
-function summarizeSkills(skills) {
+export function summarizeSkills(skills) {
   return skills.map(({ instructions: _instructions, rootDir: _rootDir, location: _location, ...summary }) => summary)
 }
 

package/server/system-prompt.mjs

@@ -2,8 +2,7 @@ export const BASE_SYSTEM_PROMPT = `You are a pragmatic coding assistant.
 
 For project tasks:
 - Do not assume requirements. If ambiguous, state assumptions or ask.
-- Prefer the simplest solution that satisfies the request.
-- Make surgical changes only. Do not refactor unrelated code.
+- Do not refactor unrelated code.
 - Match existing style.
 - When content has room for visual explanation, first consider whether an SVG diagram can improve understanding.
 - For multi-step work, use a brief plan.
@@ -11,7 +10,6 @@ For project tasks:
 - Before taking action, confirm with the user.
 - Unless the change is trivial and localized to an already-known file, use Explore first for read-only repository research before implementation decisions; prefer Explore for file discovery, source location, broad searches, call-chain lookup, pattern lookup, impact analysis, and locating related tests, docs, wiki pages, or build scripts.
 - For complex multi-step work, use General only for bounded assistance; the parent assistant remains responsible for final decisions, minimal edits, and verification.
-- Make minimal, focused changes.
 - Prefer dedicated workspace tools for reading, editing, and searching files.
 - If dedicated tools are unavailable or insufficient, use the shell/command tool.
 - Use Python through the shell for reliable scripting, data processing, or file transformations.

package/server/tools/definitions.mjs

@@ -134,16 +134,6 @@ export const workspaceTools = [
     }),
     executionMode: 'sequential',
   },
-  {
-    name: 'generate_image',
-    label: 'Generate image',
-    description: 'Generate images with the configured OpenRouter provider and save them as assets owned by the current conversation. Use this when the user explicitly asks for a generated bitmap image. The operation may incur provider charges.',
-    parameters: Type.Object({
-      prompt: Type.String({ description: 'Detailed image-generation prompt.' }),
-      model: Type.Optional(Type.String({ description: 'Optional OpenRouter image model ID. Defaults to google/gemini-2.5-flash-image.' })),
-    }),
-    executionMode: 'sequential',
-  },
   {
     name: 'present_files',
     label: 'Present files',

package/server/utils/workspace.mjs

@@ -41,7 +41,7 @@ export function toWorkspaceRelative(fullPath, context) {
 
 export function isSensitiveWorkspacePath(fullPath, context) {
   const relative = toWorkspaceRelative(fullPath, context)
-  const parts = relative.split('/')
+  const parts = relative.split('/').map((part) => part.toLocaleLowerCase())
   const name = parts.at(-1) || ''
   return (
     parts.includes('.git') ||
@@ -61,6 +61,13 @@ export function isSensitiveWorkspacePath(fullPath, context) {
   )
 }
 
+function sensitivePathError(fullPath, context) {
+  return Object.assign(new Error(`Access to sensitive path is blocked: ${toWorkspaceRelative(fullPath, context)}`), {
+    statusCode: 403,
+    errorCode: 'WORKSPACE_SENSITIVE_PATH',
+  })
+}
+
 async function realpathNearestExistingParent(inputPath) {
   let current = path.resolve(inputPath)
   while (true) {
@@ -77,9 +84,7 @@ async function realpathNearestExistingParent(inputPath) {
 
 async function assertSafeWorkspacePathWithRoot(fullPath, context, workspaceReal, options = {}) {
   if (!options.allowSensitive && isSensitiveWorkspacePath(fullPath, context)) {
-    const error = new Error(`Access to sensitive path is blocked: ${toWorkspaceRelative(fullPath, context)}`)
-    error.statusCode = 403
-    throw error
+    throw sensitivePathError(fullPath, context)
   }
 
   let targetReal
@@ -98,8 +103,12 @@ async function assertSafeWorkspacePathWithRoot(fullPath, context, workspaceReal,
   if (!isInside(workspaceReal, targetReal)) {
     const error = new Error(`Path resolves outside the selected project: ${toWorkspaceRelative(fullPath, context)}`)
     error.statusCode = 403
+    error.errorCode = 'WORKSPACE_PATH_ESCAPE'
     throw error
   }
+  if (!options.allowSensitive && isSensitiveWorkspacePath(targetReal, { workspaceRoot: workspaceReal })) {
+    throw sensitivePathError(fullPath, context)
+  }
 }
 
 export async function createWorkspacePathValidator(context) {