@shawnstack/quickforge 1.7.3 → 1.7.5

package/server/routes/workspace.mjs

@@ -1,7 +1,8 @@
 import { promises as fs } from 'node:fs'
 import path from 'node:path'
 import { spawn } from 'node:child_process'
-import { streamSimple } from '@earendil-works/pi-ai/compat'
+import { streamSimpleWithAiHttpLogging } from '../ai-http-logger.mjs'
+import { resolveModelBinding } from '../model-catalog.mjs'
 import { DEFAULT_AI_MAX_RETRIES } from '../ai-provider-options.mjs'
 import { sendJson, readJsonBody } from '../utils/response.mjs'
 import { projectContextFromId } from '../project-config.mjs'
@@ -17,6 +18,7 @@ import {
 
 const MAX_PREVIEW_BYTES = 50 * 1024 * 1024
 const MAX_STATIC_PREVIEW_BYTES = 50 * 1024 * 1024
+const DEFAULT_GIT_TIMEOUT_MS = 2 * 60 * 1000
 const MAX_GIT_LINE_COUNT_FILES = 100
 const MAX_GIT_LINE_COUNT_FILE_BYTES = 1024 * 1024
 const MAX_GIT_LINE_COUNT_TOTAL_BYTES = 10 * 1024 * 1024
@@ -29,7 +31,7 @@ const extensionLanguageMap = new Map([
   ['ts', 'typescript'], ['tsx', 'typescript'], ['js', 'javascript'], ['jsx', 'javascript'],
   ['mjs', 'javascript'], ['cjs', 'javascript'], ['json', 'json'], ['jsonc', 'json'],
   ['css', 'css'], ['scss', 'scss'], ['less', 'less'], ['html', 'html'], ['htm', 'html'],
-  ['md', 'markdown'], ['markdown', 'markdown'], ['py', 'python'], ['rb', 'ruby'], ['go', 'go'],
+  ['md', 'markdown'], ['mdx', 'markdown'], ['markdown', 'markdown'], ['py', 'python'], ['rb', 'ruby'], ['go', 'go'],
   ['rs', 'rust'], ['java', 'java'], ['c', 'c'], ['h', 'c'], ['cpp', 'cpp'], ['cc', 'cpp'],
   ['cxx', 'cpp'], ['hpp', 'cpp'], ['cs', 'csharp'], ['php', 'php'], ['swift', 'swift'],
   ['kt', 'kotlin'], ['kts', 'kotlin'], ['sh', 'shell'], ['bash', 'shell'], ['zsh', 'shell'],
@@ -76,20 +78,65 @@ async function projectContextFromUrl(url) {
   return projectContextFromId(projectId)
 }
 
-function git(args, cwd, options = {}) {
+function killProcessTree(child) {
+  if (!child?.pid) return
+  if (process.platform === 'win32') {
+    const killer = spawn('taskkill', ['/pid', String(child.pid), '/T', '/F'], {
+      stdio: 'ignore',
+      windowsHide: true,
+    })
+    killer.on('error', () => {
+      try { child.kill('SIGKILL') } catch { /* ignore */ }
+    })
+    return
+  }
+  try {
+    process.kill(-child.pid, 'SIGKILL')
+  } catch {
+    try { child.kill('SIGKILL') } catch { /* ignore */ }
+  }
+}
+
+export function git(args, cwd, options = {}) {
   return new Promise((resolve, reject) => {
+    const timeoutMs = Number.isFinite(options.timeoutMs) ? Math.max(1, options.timeoutMs) : DEFAULT_GIT_TIMEOUT_MS
     const child = spawn('git', args, {
       cwd,
       shell: false,
       windowsHide: true,
-      env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' },
+      detached: process.platform !== 'win32',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: {
+        ...process.env,
+        GIT_OPTIONAL_LOCKS: '0',
+        GIT_TERMINAL_PROMPT: '0',
+        GCM_INTERACTIVE: 'Never',
+      },
     })
     const stdout = []
     const stderr = []
+    let settled = false
+    const finish = (callback) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timeout)
+      callback()
+    }
+    const timeout = setTimeout(() => {
+      killProcessTree(child)
+      finish(() => {
+        const error = new Error(`git ${args.join(' ')} timed out after ${timeoutMs}ms`)
+        error.statusCode = 504
+        error.code = 'GIT_TIMEOUT'
+        reject(error)
+      })
+    }, timeoutMs)
+    timeout.unref?.()
+
     child.stdout.on('data', (chunk) => stdout.push(chunk))
     child.stderr.on('data', (chunk) => stderr.push(chunk))
-    child.once('error', reject)
-    child.once('close', (code) => {
+    child.once('error', (error) => finish(() => reject(error)))
+    child.once('close', (code) => finish(() => {
       const out = Buffer.concat(stdout)
       const err = Buffer.concat(stderr).toString('utf8').trim()
       if (code === 0 || options.allowFailure) {
@@ -99,7 +146,7 @@ function git(args, cwd, options = {}) {
         error.statusCode = 400
         reject(error)
       }
-    })
+    }))
   })
 }
 
@@ -619,7 +666,7 @@ Unstaged diff:
 ${trimForPrompt(worktreeDiff)}`
 
   try {
-    const stream = streamSimple(
+    const stream = streamSimpleWithAiHttpLogging(
       model,
       {
         systemPrompt,
@@ -1034,9 +1081,10 @@ async function contextFromGitBody(req) {
   return { context: await projectContextFromId(projectId), body }
 }
 
-async function handleGitGenerateCommitMessage(req, res) {
+async function handleGitGenerateCommitMessage(req, res, requestContext = {}) {
   const { context, body } = await contextFromGitBody(req)
-  const message = await generateGitCommitMessage(context, body?.model, body?.thinkingLevel, Boolean(body?.includeUnstaged))
+  const binding = await resolveModelBinding(body, { context: requestContext, legacySnapshot: body?.model })
+  const message = await generateGitCommitMessage(context, binding.model, body?.thinkingLevel, Boolean(body?.includeUnstaged))
   sendJson(res, 200, { message })
 }
 
@@ -1100,7 +1148,7 @@ async function handleGitCommitAndPush(req, res) {
   sendJson(res, 200, await commitAndPushGitChanges(context, body?.message, Boolean(body?.includeUnstaged)))
 }
 
-export async function handleWorkspaceApi(req, res, url) {
+export async function handleWorkspaceApi(req, res, url, requestContext = {}) {
   if (req.method === 'GET' && url.pathname === '/api/workspace/tree') {
     await handleWorkspaceTree(req, res, url)
     return
@@ -1118,6 +1166,11 @@ export async function handleWorkspaceApi(req, res, url) {
     return
   }
   if (req.method === 'POST' && url.pathname === '/api/workspace/open-external') {
+    if (requestContext.isLocalRequest !== true) {
+      const error = new Error('Opening applications is only allowed from this computer')
+      error.statusCode = 403
+      throw error
+    }
     await handleWorkspaceOpenExternal(req, res)
     return
   }
@@ -1127,7 +1180,7 @@ export async function handleWorkspaceApi(req, res, url) {
   throw error
 }
 
-export async function handleGitApi(req, res, url) {
+export async function handleGitApi(req, res, url, requestContext = {}) {
   if (req.method === 'GET' && url.pathname === '/api/git/status') {
     await handleGitStatus(req, res, url)
     return
@@ -1153,7 +1206,7 @@ export async function handleGitApi(req, res, url) {
     return
   }
   if (req.method === 'POST' && url.pathname === '/api/git/generate-commit-message') {
-    await handleGitGenerateCommitMessage(req, res)
+    await handleGitGenerateCommitMessage(req, res, requestContext)
     return
   }
   if (req.method === 'POST' && url.pathname === '/api/git/stage') {

package/server/session-utils.mjs

@@ -1,4 +1,4 @@
-import { streamSimple } from '@earendil-works/pi-ai/compat'
+import { streamSimpleWithAiHttpLogging } from './ai-http-logger.mjs'
 import { DEFAULT_AI_MAX_RETRIES } from './ai-provider-options.mjs'
 import { buildInstructionsPayload, projectContextFromId } from './project-config.mjs'
 import { composeSystemPrompt } from './system-prompt.mjs'
@@ -88,7 +88,7 @@ export async function generateAiTitle(messages, model, thinkingLevel, getApiKey)
 
   try {
     const apiKey = getApiKey ? await getApiKey(model.provider) : undefined
-    const stream = streamSimple(
+    const stream = streamSimpleWithAiHttpLogging(
       model,
       {
         systemPrompt: '你是对话标题生成器。请用和用户相同的语言，根据对话主题生成 3 到 5 个词的短标题。只输出标题，不要解释，不要标点。',

package/server/share-store.mjs

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto'
+import { EventEmitter } from 'node:events'
 import { promises as fs } from 'node:fs'
 import path from 'node:path'
 import { ensureStorage, storageDir } from './storage.mjs'
@@ -10,6 +11,25 @@ const SHARES_DIR = path.join(storageDir, 'shares')
 const SHARES_FILE = path.join(SHARES_DIR, 'conversation-shares.json')
 const writeQueueName = 'conversation-shares'
 const writeQueues = new Map()
+const shareLifecycleEvents = new EventEmitter()
+shareLifecycleEvents.setMaxListeners(0)
+
+export function onConversationShareInvalidated(listener) {
+  shareLifecycleEvents.on('invalidated', listener)
+  return () => shareLifecycleEvents.removeListener('invalidated', listener)
+}
+
+function emitConversationShareInvalidated(shareId, reason) {
+  shareLifecycleEvents.emit('invalidated', { shareId, reason })
+}
+
+function clearShareTokens(record) {
+  record.authVersion = (record.authVersion || 1) + 1
+  record.tokens = []
+  record.tokenHash = undefined
+  record.tokenIssuedAt = undefined
+  record.tokenExpiresAt = undefined
+}
 
 function enqueueWrite(queueName, operation) {
   const previous = writeQueues.get(queueName) || Promise.resolve()
@@ -64,6 +84,7 @@ function publicShareRecord(record) {
     accessCount: record.accessCount || 0,
     lastAccessedAt: record.lastAccessedAt,
     hasPassword: Boolean(record.passwordHash),
+    allowCloudUsage: record.allowCloudUsage === true,
   }
 }
 
@@ -195,6 +216,7 @@ export async function createConversationShare({
   permission,
   password,
   expiresAt,
+  allowCloudUsage = false,
   titleSnapshot,
   scope,
   projectId,
@@ -233,14 +255,13 @@ export async function createConversationShare({
     }
 
     for (const stale of existingRecords.filter((record) => record?.id !== existing?.id)) {
+      const newlySuperseded = !stale.supersededAt
       stale.supersededAt = stale.supersededAt || now
       stale.revokedAt = stale.revokedAt || now
       stale.updatedAt = now
-      stale.tokens = []
-      stale.tokenHash = undefined
-      stale.tokenIssuedAt = undefined
-      stale.tokenExpiresAt = undefined
+      clearShareTokens(stale)
       data[stale.id] = stale
+      if (newlySuperseded) emitConversationShareInvalidated(stale.id, 'superseded')
     }
 
     if (existing?.id) {
@@ -251,6 +272,7 @@ export async function createConversationShare({
         updatedAt: now,
         supersededAt: undefined,
         expiresAt: expiresAt || undefined,
+        allowCloudUsage: permission === 'operate' && allowCloudUsage === true,
         revokedAt: undefined,
         titleSnapshot: titleSnapshot || existing.titleSnapshot || 'New chat',
         scope: scope === 'project' ? 'project' : 'global',
@@ -264,19 +286,20 @@ export async function createConversationShare({
         tokenExpiresAt: existing.tokenExpiresAt,
       }
       if (passwordProvided) {
-        record.authVersion = (existing.authVersion || 1) + 1
-        record.tokens = []
-        record.tokenHash = undefined
-        record.tokenIssuedAt = undefined
-        record.tokenExpiresAt = undefined
+        clearShareTokens(record)
       }
       if (passwordProvided && !passwordInfo.passwordHash) {
         record.passwordHash = undefined
         record.passwordSalt = undefined
         record.passwordVersion = undefined
       }
+      const lifecycleChanged = Boolean(existing.revokedAt)
+        || String(existing.expiresAt || '') !== String(record.expiresAt || '')
+        || existing.allowCloudUsage === true !== (record.allowCloudUsage === true)
+        || (passwordProvided && existing.authVersion !== record.authVersion)
       data[record.id] = record
       await writeShareStoreFile(data)
+      if (lifecycleChanged) emitConversationShareInvalidated(record.id, 'updated')
       return publicShareRecord(record)
     }
 
@@ -292,6 +315,7 @@ export async function createConversationShare({
       updatedAt: now,
       supersededAt: undefined,
       expiresAt: expiresAt || undefined,
+      allowCloudUsage: permission === 'operate' && allowCloudUsage === true,
       revokedAt: undefined,
       titleSnapshot: titleSnapshot || 'New chat',
       scope: scope === 'project' ? 'project' : 'global',
@@ -335,18 +359,149 @@ export async function revokeConversationShare(shareId) {
       error.statusCode = 404
       throw error
     }
+    const wasActive = !record.revokedAt
     record.revokedAt = record.revokedAt || new Date().toISOString()
     record.updatedAt = record.revokedAt
-    record.tokens = []
-    record.tokenHash = undefined
-    record.tokenIssuedAt = undefined
-    record.tokenExpiresAt = undefined
+    clearShareTokens(record)
+    data[shareId] = record
+    await writeShareStoreFile(data)
+    if (wasActive) emitConversationShareInvalidated(shareId, 'revoked')
+    return publicShareRecord(record)
+  })
+}
+
+export async function restoreConversationShare(shareId, expiresAt) {
+  assertSafeShareId(shareId)
+  if (expiresAt && (Number.isNaN(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now())) {
+    const error = new Error('Expiration time must be in the future')
+    error.statusCode = 400
+    throw error
+  }
+  return enqueueWrite(writeQueueName, async () => {
+    const data = await readShareStoreFile()
+    const record = data[shareId]
+    if (!record) {
+      const error = new Error('Share not found')
+      error.statusCode = 404
+      throw error
+    }
+    if (record.supersededAt) {
+      const error = new Error('Superseded shares cannot be restored')
+      error.statusCode = 409
+      throw error
+    }
+    record.revokedAt = undefined
+    record.expiresAt = expiresAt || undefined
+    record.updatedAt = new Date().toISOString()
+    clearShareTokens(record)
     data[shareId] = record
     await writeShareStoreFile(data)
     return publicShareRecord(record)
   })
 }
 
+export async function updateConversationShareExpiration(shareId, expiresAt) {
+  assertSafeShareId(shareId)
+  if (expiresAt && (Number.isNaN(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now())) {
+    const error = new Error('Expiration time must be in the future')
+    error.statusCode = 400
+    throw error
+  }
+  return enqueueWrite(writeQueueName, async () => {
+    const data = await readShareStoreFile()
+    const record = data[shareId]
+    if (!record) {
+      const error = new Error('Share not found')
+      error.statusCode = 404
+      throw error
+    }
+    if (record.supersededAt) {
+      const error = new Error('Superseded shares cannot be updated')
+      error.statusCode = 409
+      throw error
+    }
+    assertShareActive(record)
+    record.expiresAt = expiresAt || undefined
+    record.updatedAt = new Date().toISOString()
+    data[shareId] = record
+    await writeShareStoreFile(data)
+    emitConversationShareInvalidated(shareId, 'updated')
+    return publicShareRecord(record)
+  })
+}
+
+export async function updateConversationShare(shareId, { permission, password, expiresAt, allowCloudUsage } = {}) {
+  assertSafeShareId(shareId)
+  const passwordProvided = typeof password === 'string'
+  const normalizedPassword = passwordProvided ? password.trim() : undefined
+  if (expiresAt && (Number.isNaN(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now())) {
+    const error = new Error('Expiration time must be in the future')
+    error.statusCode = 400
+    throw error
+  }
+  const passwordInfo = passwordProvided ? await hashSharePassword(normalizedPassword) : {}
+  return enqueueWrite(writeQueueName, async () => {
+    const data = await readShareStoreFile()
+    const record = data[shareId]
+    if (!record) {
+      const error = new Error('Share not found')
+      error.statusCode = 404
+      throw error
+    }
+    if (record.supersededAt) {
+      const error = new Error('Superseded shares cannot be updated')
+      error.statusCode = 409
+      throw error
+    }
+    assertShareActive(record)
+    const nextPermission = permission === undefined ? record.permission : permission
+    assertValidPermission(nextPermission)
+    const willHavePassword = passwordProvided ? Boolean(normalizedPassword) : Boolean(record.passwordHash)
+    if (nextPermission === 'operate' && !willHavePassword) {
+      const error = new Error('Editable shares require a non-empty password')
+      error.statusCode = 400
+      throw error
+    }
+    const nextAllowCloudUsage = nextPermission === 'operate'
+      && (allowCloudUsage === undefined ? record.allowCloudUsage === true : allowCloudUsage === true)
+    const lifecycleChanged = nextPermission !== record.permission
+      || nextAllowCloudUsage !== (record.allowCloudUsage === true)
+      || (expiresAt !== undefined && String(record.expiresAt || '') !== String(expiresAt || ''))
+      || passwordProvided
+    if (passwordProvided) {
+      record.passwordHash = passwordInfo.passwordHash
+      record.passwordSalt = passwordInfo.passwordSalt
+      record.passwordVersion = passwordInfo.passwordVersion
+      clearShareTokens(record)
+    }
+    record.permission = nextPermission
+    record.allowCloudUsage = nextAllowCloudUsage
+    if (expiresAt !== undefined) record.expiresAt = expiresAt || undefined
+    record.updatedAt = new Date().toISOString()
+    data[shareId] = record
+    await writeShareStoreFile(data)
+    if (lifecycleChanged) emitConversationShareInvalidated(shareId, 'updated')
+    return publicShareRecord(record)
+  })
+}
+
+export async function deleteConversationShare(shareId) {
+  assertSafeShareId(shareId)
+  return enqueueWrite(writeQueueName, async () => {
+    const data = await readShareStoreFile()
+    const record = data[shareId]
+    if (!record) {
+      const error = new Error('Share not found')
+      error.statusCode = 404
+      throw error
+    }
+    delete data[shareId]
+    await writeShareStoreFile(data)
+    emitConversationShareInvalidated(shareId, 'deleted')
+    return publicShareRecord(record)
+  })
+}
+
 export async function issueConversationShareToken(shareId) {
   assertSafeShareId(shareId)
   return enqueueWrite(writeQueueName, async () => {

package/server/skills.mjs

@@ -1,16 +1,21 @@
 import { existsSync, promises as fs } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
-import { dataDir } from './storage.mjs'
+import { fileURLToPath } from 'node:url'
+import { atomicProjectConfigUpdate, configDir, dataDir } from './storage.mjs'
 import { getEnabledPluginSkillSources } from './plugins/registry.mjs'
 import { logger } from './utils/logger.mjs'
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const bundledSkillsDir = path.resolve(__dirname, '..', 'skills')
 const userSkillsDir = path.join(dataDir, 'skills')
 const sharedUserSkillsDir = path.join(os.homedir(), '.agents', 'skills')
 const claudeUserSkillsDir = path.join(os.homedir(), '.claude', 'skills')
 const opencodeUserSkillsDir = path.join(os.homedir(), '.opencode', 'skills')
+const defaultSkillsMarkerFile = path.join(configDir, '.default-skills-v1')
+const defaultGlobalSkillNames = ['skill-creator']
 const defaultEntry = 'SKILL.md'
-const resourceDirs = ['scripts', 'references', 'assets']
+const resourceDirs = ['scripts', 'references', 'assets', 'agents', 'eval-viewer']
 const maxResourceFiles = 200
 
 function isValidSkillName(value) {
@@ -421,7 +426,7 @@ export function mergeSkills(...skillLists) {
 }
 
 export const skillSearchPaths = {
-  global: searchDirsForList([claudeUserSkillsDir, opencodeUserSkillsDir, sharedUserSkillsDir, userSkillsDir]),
+  global: searchDirsForList([bundledSkillsDir, claudeUserSkillsDir, opencodeUserSkillsDir, sharedUserSkillsDir, userSkillsDir]),
   project: ['<project>/.claude/skills', '<project>/.opencode/skills', '<project>/.agents/skills', '<project>/.quickforge/skills'],
 }
 
@@ -444,6 +449,7 @@ async function loadPluginSkills(workspaceRoot) {
 
 export async function loadGlobalSkills() {
   return loadSkillsFromSources([
+    { dir: bundledSkillsDir, name: 'builtin' },
     { dir: claudeUserSkillsDir, name: 'user-claude' },
     { dir: opencodeUserSkillsDir, name: 'user-opencode' },
     { dir: sharedUserSkillsDir, name: 'user-shared' },
@@ -451,6 +457,27 @@ export async function loadGlobalSkills() {
   ])
 }
 
+export async function ensureDefaultGlobalSkills() {
+  if (existsSync(defaultSkillsMarkerFile)) return false
+
+  const known = new Set((await loadGlobalSkills()).map((skill) => skill.name))
+  const defaults = defaultGlobalSkillNames.filter((name) => known.has(name))
+  if (defaults.length === 0) return false
+
+  await atomicProjectConfigUpdate((config) => {
+    config.globalSkills = normalizeSkillNames([
+      ...(Array.isArray(config.globalSkills) ? config.globalSkills : []),
+      ...defaults,
+    ])
+    return config
+  })
+  await fs.mkdir(configDir, { recursive: true })
+  await fs.writeFile(defaultSkillsMarkerFile, `${new Date().toISOString()}\n`, { flag: 'wx' }).catch((error) => {
+    if (error?.code !== 'EEXIST') throw error
+  })
+  return true
+}
+
 export async function loadProjectSkills(workspaceRoot) {
   const pluginSkills = await loadPluginSkills(workspaceRoot)
   const projectSkills = await loadSkillsFromSources([

package/server/storage.mjs

@@ -618,10 +618,16 @@ export async function atomicSessionValueUpdate(sessionId, updateFn) {
 export async function deleteSessionValue(sessionId) {
   return enqueueWrite('sessions', async () => {
     const bucket = await findSessionBucket(sessionId)
-    if (!bucket) return
+    if (!bucket) {
+      const { deleteCloudChatIdempotencySession } = await import('./cloud/chat-idempotency-store.mjs')
+      await deleteCloudChatIdempotencySession(sessionId)
+      return
+    }
     await fs.rm(sessionDataFile(sessionId, bucket), { force: true })
     const { deleteSessionAssets } = await import('./session-assets.mjs')
     await deleteSessionAssets(bucket, sessionId)
+    const { deleteCloudChatIdempotencySession } = await import('./cloud/chat-idempotency-store.mjs')
+    await deleteCloudChatIdempotencySession(sessionId)
     sessionBucketIndex.delete(sessionId)
   })
 }

package/server/subagents.mjs

@@ -32,7 +32,7 @@ export const subagentDefinitions = [
     model: { mode: 'inherit' },
     lifecycle: 'builtin',
     allowFileMutations: true,
-    maxRuntimeMs: 30 * 60 * 1000,
+    maxRuntimeMs: 60 * 60 * 1000,
     maxToolCalls: 300,
     systemPrompt: `You are General, a general-purpose subagent for bounded complex multi-step implementation tasks and broader independent work. You may inspect, edit, write files, and run commands using the built-in workspace tools when needed. You do not have MCP tools or Agent Skills. Prefer Explore for focused read-only repository discovery, source search, call-chain lookup, tests/docs discovery, and impact analysis. Make focused, minimal changes that satisfy the delegated task, and verify your changes when appropriate.`,
   },
@@ -46,9 +46,9 @@ export const subagentDefinitions = [
     model: { mode: 'inherit' },
     lifecycle: 'builtin',
     allowFileMutations: false,
-    maxRuntimeMs: 30 * 60 * 1000,
+    maxRuntimeMs: 60 * 60 * 1000,
     maxToolCalls: 300,
-    systemPrompt: `You are Explore, the preferred read-only repository exploration subagent. Use read_file, grep_files, and safe read-only run_command calls to locate files, inspect project structure, search source, trace call chains, find related tests/docs/wiki pages, run diagnostics, identify patterns, assess impact, and answer focused questions before non-trivial implementation. You cannot modify files.`,
+    systemPrompt: `You are Explore, the preferred read-only repository research subagent. Investigate the delegated question using read_file, grep_files, and safe read-only run_command calls, and report only findings grounded in repository evidence. Do not design solutions or propose implementation, architecture, refactoring, or code changes. Cite relevant file paths, symbols, and line ranges when practical. Clearly separate verified facts, reasonable inferences, and unknowns, and never present an inference as a verified fact. Unless the parent Agent explicitly requests them, do not provide an implementation plan, recommendations, or suggested next steps. You cannot modify files.`,
   },
 ]
 
@@ -82,7 +82,7 @@ capabilityPolicy: ${definition.capabilityPolicy || 'review-only'}
 tools: ${definition.allowedTools.join(', ')}
 model:
   mode: inherit
-max-runtime-ms: ${definition.maxRuntimeMs || 30 * 60 * 1000}
+max-runtime-ms: ${definition.maxRuntimeMs || 60 * 60 * 1000}
 max-tool-calls: ${definition.maxToolCalls || 300}
 ---
 ${body}

package/server/terminal/terminal-manager.mjs

@@ -7,8 +7,7 @@ import { logger } from '../utils/logger.mjs'
 const require = createRequire(import.meta.url)
 const MAX_SESSIONS = Math.max(1, Number(process.env.QUICKFORGE_MAX_TERMINALS || 6))
 const TERMINAL_DISABLED = process.env.QUICKFORGE_TERMINAL === '0'
-const RECONNECT_GRACE_MS = Number(process.env.QUICKFORGE_TERMINAL_RECONNECT_MS || 5 * 60 * 1000)
-const IDLE_TIMEOUT_MS = Number(process.env.QUICKFORGE_TERMINAL_IDLE_MS || 30 * 60 * 1000)
+const RECONNECT_GRACE_MS = Number(process.env.QUICKFORGE_TERMINAL_RECONNECT_MS || 30 * 60 * 1000)
 
 const sessions = new Map()
 let cleanupTimer = null
@@ -85,8 +84,7 @@ function scheduleCleanup() {
     const now = Date.now()
     for (const session of sessions.values()) {
       const disconnectedTooLong = session.clients.size === 0 && now - session.disconnectedAt > RECONNECT_GRACE_MS
-      const idleTooLong = now - session.touchedAt > IDLE_TIMEOUT_MS
-      if (session.exited || disconnectedTooLong || idleTooLong) {
+      if (session.exited || disconnectedTooLong) {
         destroyTerminalSession(session.id)
       }
     }

package/server/tools/definitions.mjs

@@ -111,7 +111,7 @@ export const workspaceTools = [
     description: 'Run a shell command in the project bound to this chat. Use this for lint, build, tests, git status, and diagnostics.',
     parameters: Type.Object({
       command: Type.String({ description: 'Command to execute in the workspace.' }),
-      timeoutMs: Type.Optional(Type.Number({ description: 'Command timeout in milliseconds. Defaults to 30 minutes and is clamped to the supported range.', default: 1800000 })),
+      timeoutMs: Type.Optional(Type.Number({ description: 'Command timeout in milliseconds. Defaults to 1 hour and is clamped to the supported range.', default: 3600000 })),
       description: Type.Optional(Type.String({ description: 'Short explanation of why this command is being run.' })),
     }),
     executionMode: 'sequential',
@@ -129,7 +129,7 @@ export const workspaceTools = [
   {
     name: 'present_files',
     label: 'Present files',
-    description: 'Show one or more AI-produced artifact files to the user. Use this after creating or editing user-facing files such as HTML pages, SVG/images, Markdown documents, or other deliverables. HTML files will be previewed directly in the artifact preview panel.',
+    description: 'Present one or more AI-produced artifact files only when the user is likely to benefit from inspecting the actual deliverable directly. Use it for visual outputs, reports, documents, generated assets, or when the user explicitly asks to view or review a file. Source code and configuration files should only be presented when they are themselves the requested deliverable or the user asks to inspect them. Do not present routine implementation changes, test files, supporting code, or large sets of modified files merely because they were edited. Prefer a small, relevant selection. HTML and supported images open in Browser; Markdown, code, configuration, and text files open in Reader. Unsupported files remain available in the artifact list.',
     parameters: Type.Object({
       files: Type.Array(Type.Union([
         Type.String({ description: 'File path relative to the workspace root.' }),
@@ -138,7 +138,7 @@ export const workspaceTools = [
           title: Type.Optional(Type.String({ description: 'Optional display title.' })),
           description: Type.Optional(Type.String({ description: 'Optional short description shown in artifact lists.' })),
           kind: Type.Optional(Type.String({ description: 'Optional file kind hint, such as html, image, markdown, or code.' })),
-          preview: Type.Optional(Type.Boolean({ description: 'Whether this file should be opened as the default preview.' })),
+          preview: Type.Optional(Type.Boolean({ description: 'Whether this file may be opened automatically. Set false to list it without opening it.' })),
         }),
       ]), { description: 'Artifact files to present.' }),
       defaultPreview: Type.Optional(Type.String({ description: 'File path to open as the default preview when multiple files are presented.' })),

package/server/tools/index.mjs

@@ -624,10 +624,12 @@ export async function toolReadSkillResource(params, context) {
 // --- present_files ---
 function inferPresentedFileKind(relativePath) {
   const lower = String(relativePath || '').toLowerCase()
+  const fileName = lower.replace(/\\/g, '/').split('/').pop() || lower
   if (lower.endsWith('.html') || lower.endsWith('.htm')) return 'html'
-  if (/\.(svg|png|jpe?g|webp|gif|bmp|ico)$/.test(lower)) return 'image'
-  if (lower.endsWith('.md') || lower.endsWith('.mdx')) return 'markdown'
-  if (/\.(ts|tsx|js|jsx|mjs|cjs|css|scss|less|json|jsonc|txt|xml|yml|yaml|toml|ini|py|rb|go|rs|java|c|h|cpp|hpp|cs|php|sh|bash|zsh|ps1)$/.test(lower)) return 'code'
+  if (/\.(svg|png|jpe?g|webp|gif|ico)$/.test(lower)) return 'image'
+  if (/\.(md|mdx|markdown)$/.test(lower)) return 'markdown'
+  if (fileName === 'dockerfile' || fileName.endsWith('.dockerfile') || fileName === 'makefile') return 'code'
+  if (/\.(ts|tsx|js|jsx|mjs|cjs|css|scss|less|json|jsonc|txt|csv|tsv|log|sql|xml|yml|yaml|toml|ini|py|rb|go|rs|java|swift|kt|kts|c|h|cpp|hpp|cs|php|sh|bash|zsh|ps1)$/.test(lower)) return 'code'
   return 'unknown'
 }
 
@@ -707,9 +709,9 @@ export async function toolPresentFiles(params, context) {
 }
 
 // --- run_command ---
-const DEFAULT_RUN_COMMAND_TIMEOUT_MS = 30 * 60 * 1000
+const DEFAULT_RUN_COMMAND_TIMEOUT_MS = 60 * 60 * 1000
 const MIN_RUN_COMMAND_TIMEOUT_MS = 1000
-const MAX_RUN_COMMAND_TIMEOUT_MS = 30 * 60 * 1000
+const MAX_RUN_COMMAND_TIMEOUT_MS = 60 * 60 * 1000
 const COMMAND_PREVIEW_LINES = 200
 const COMMAND_PREVIEW_TOTAL_CHARS = 10000
 

package/server/utils/network.mjs

@@ -8,6 +8,15 @@ export function isPrivateIpv4(hostname) {
   return a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168)
 }
 
+export function isTailscaleAddress(address) {
+  if (!address) return false
+  const normalized = String(address).replace(/^::ffff:/i, '')
+  if (!/^\d{1,3}(?:\.\d{1,3}){3}$/.test(normalized)) return false
+  const parts = normalized.split('.').map((part) => Number(part))
+  if (parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return false
+  return parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127
+}
+
 export function isLoopbackAddress(address) {
   if (!address) return false
   const normalized = address.replace(/^::ffff:/, '')