@tiagojct/subsub 0.15.0 → 0.17.0

package/dist/subsub.js

@@ -6,22 +6,21 @@
  *   and writes notes. Each mode can have its own model.
  * - An approval gate: every library change is previewed by the server (dry run)
  *   and shown to the user; nothing is applied without a yes.
- * - Profiles (reader, scholar, author, editor) set what Sub-Sub writes and which
- *   tools it offers; /profile changes it.
- * - Commands: /librarian, /researcher, /profile, /subsub, /history, /undo.
+ * - Commands: /librarian, /researcher, /read, /subsub, /history, /undo.
  * - Add-on: with "addons": ["starbuck"], Starbuck runs as a third server
  *   ("verify") for reference checks.
  *
  * The Python servers start in session_start (not in the factory) and stop in
  * session_shutdown. Tools are registered once and use the current bridge.
  */
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Bridge } from "./bridge.js";
-import { expand, findUv, FREE_MODELS, isProfile, loadConfig, parseEnvFile, saveConfig, serverCommand, starbuckCommand, starbuckEnabled, uiLanguage, who, } from "./config.js";
-import { profileList, profileSpec, promptBlocked } from "./profiles.js";
+import { expand, findUv, FREE_MODELS, loadConfig, parseEnvFile, serverCommand, starbuckCommand, starbuckEnabled, uiLanguage, who, } from "./config.js";
 import { coerceArgs, loosenArrays, resolvePathArgs } from "./args.js";
+import { aiStatement } from "./statement.js";
+import { PURPOSES, readArgs, readInstruction } from "./read.js";
 import { applyEdits, checkLiteratureNote, field, frontMatter, itemKeyOf, missingQuotes, quoteProblem, quotesIn } from "./notes.js";
 import { buildPolicy, isSecret, judgePath, normalizeToolPath, realish, within } from "./paths.js";
 import { describeArgs, formatPreview, isEmptyPreview } from "./preview.js";
@@ -113,8 +112,7 @@ export async function createSubsub(pi, deps = {}) {
     pi.registerFlag("researcher", { description: "Start Sub-Sub in the Researcher mode", type: "boolean", default: false });
     let mode = cfg.defaultMode;
     const benchRun = Boolean(process.env.SUBSUB_BENCH_OUT);
-    const toolOpts = () => ({ profile, bench: benchRun });
-    let profile = cfg.profile;
+    const toolOpts = () => ({ bench: benchRun });
     const user = who(cfg);
     /** True when started with the `subsub` command (not as a package inside plain pi). */
     const standalone = process.env.SUBSUB_CLI === "1";
@@ -141,8 +139,6 @@ export async function createSubsub(pi, deps = {}) {
         const down = bridge ? Object.keys(bridge.errors) : ["zotero", "scholar"];
         const state = {
             mode,
-            profile,
-            profileLabel: profileSpec(profile).label,
             model: ctx.model ? { provider: ctx.model.provider, id: ctx.model.id } : null,
             down,
             library,
@@ -204,7 +200,6 @@ export async function createSubsub(pi, deps = {}) {
                     return headerLines({
                         version,
                         mode,
-                        profile: profileSpec(profile).label,
                         model: modelId,
                         library,
                         quote,
@@ -225,7 +220,7 @@ export async function createSubsub(pi, deps = {}) {
     function status(ctx) {
         modelId = ctx.model ? `${ctx.model.id}` : "no model";
         const down = bridge ? Object.keys(bridge.errors) : ["zotero", "scholar"];
-        ctx.ui.setStatus("subsub", `Sub-Sub: ${mode} | ${profileSpec(profile).label} | ${modelId}${down.length ? ` | not running: ${down.join(", ")}` : ""}`);
+        ctx.ui.setStatus("subsub", `Sub-Sub: ${mode} | ${modelId}${down.length ? ` | not running: ${down.join(", ")}` : ""}`);
         if (standalone)
             ctx.ui.setTitle(`Sub-Sub: ${mode}`);
         headerTui?.requestRender();
@@ -281,7 +276,7 @@ export async function createSubsub(pi, deps = {}) {
             scheme ??= schemeFromAnsi(ctx.ui.theme.getFgAnsi("text"), ctx.ui.theme.name);
         applyTheme(ctx);
         await applyMode(ctx, restored ?? (pi.getFlag("librarian") ? "librarian" : pi.getFlag("researcher") ? "researcher" : cfg.defaultMode), false, !modelChosen);
-        logUsage(cfg.usageLog, { ev: "session", mode, profile, model: ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : undefined });
+        logUsage(cfg.usageLog, { ev: "session", mode, model: ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : undefined });
         if (lookOn(ctx)) {
             setHeader(ctx);
             void refreshLibrary();
@@ -306,6 +301,7 @@ export async function createSubsub(pi, deps = {}) {
     });
     /** Prompt commands for the Researcher; the Librarian has the library ones (tag-batch, clean-tags, import-queue). */
     const RESEARCH_PROMPTS = ["lit", "compare", "lit-note", "synthesis", "gaps", "manuscript", "verify", "review", "alert", "request-copy", "digest"];
+    const researcherOnly = (cmd) => L(`Sub-Sub: /${cmd} is part of the Researcher. Switch with /researcher.`, `Sub-Sub: /${cmd} faz parte do Investigador. Mude com /researcher.`);
     // /tree moves to another branch: take that branch's mode (pi restores its model itself).
     pi.on("session_tree", async (_event, ctx) => {
         let m;
@@ -351,8 +347,7 @@ export async function createSubsub(pi, deps = {}) {
             pi.sendMessage({ customType: "subsub-resume", content: "The model provider's per-minute limit was reached and has now passed. Continue the task where you stopped; do not repeat finished steps.", display: false }, { triggerTurn: true });
         }, wait * 1000);
     });
-    // Prompt commands that the profile does not run (/lit for Reader, /review for Reader and Scholar).
-    // The input event comes before pi expands a prompt template.
+    // Research prompts in the Librarian. The input event comes before pi expands a prompt template.
     pi.on("input", async (event, ctx) => {
         if (resumeTimer)
             clearTimeout(resumeTimer);
@@ -363,21 +358,22 @@ export async function createSubsub(pi, deps = {}) {
         if (cmd !== "subsub-refresh")
             logUsage(cfg.usageLog, { ev: "ask", kind: cmd ? `/${cmd}` : "message", words: event.text.trim().split(/\s+/).filter(Boolean).length });
         if (mode === "librarian" && cmd && RESEARCH_PROMPTS.includes(cmd)) {
-            ctx.ui.notify(L(`Sub-Sub: /${cmd} is part of the Researcher. Switch with /researcher.`, `Sub-Sub: /${cmd} faz parte do Investigador. Mude com /researcher.`), "warning");
+            ctx.ui.notify(researcherOnly(cmd), "warning");
             return { action: "handled" };
         }
-        const why = promptBlocked(event.text, profile);
-        if (!why)
-            return { action: "continue" };
-        ctx.ui.notify(`Sub-Sub: ${why}`, "warning");
-        return { action: "handled" };
+        // shortcut: a notice for the habit of 0.16 and earlier; drop it a few versions on.
+        if (cmd === "profile") {
+            ctx.ui.notify(L("Sub-Sub no longer has profiles: every command is in the Researcher. To read a paper with guidance, type /read.", "O Sub-Sub já não tem perfis: todos os comandos estão no Investigador. Para ler um artigo com orientação, escreva /read."), "info");
+            return { action: "handled" };
+        }
+        return { action: "continue" };
     });
     pi.on("agent_start", async () => {
         turnStart = Date.now();
         turnTools = 0;
     });
     pi.on("before_agent_start", async (event, ctx) => ({
-        systemPrompt: `${event.systemPrompt}\n\n${systemAddition(mode, { ...cfg, profile }, ctx.cwd)}`,
+        systemPrompt: `${event.systemPrompt}\n\n${systemAddition(mode, cfg, ctx.cwd)}`,
     }));
     /** Model test (subsub-bench): record every change instead of asking, and apply none. */
     const benchOut = process.env.SUBSUB_BENCH_OUT ? expand(process.env.SUBSUB_BENCH_OUT) : undefined;
@@ -612,34 +608,10 @@ export async function createSubsub(pi, deps = {}) {
             ctx.ui.notify(L("Sub-Sub: Researcher mode. It searches, writes notes and also changes the library, with a preview.", "Sub-Sub: modo Investigador. Pesquisa, escreve notas e também altera a biblioteca, com pré-visualização."), "info");
         },
     });
-    pi.registerCommand("profile", {
-        description: "Sub-Sub: show or change the profile (reader, scholar, author, editor)",
-        handler: async (args, ctx) => {
-            const want = args.trim().toLowerCase();
-            if (!want) {
-                ctx.ui.notify(`Profile: ${profileSpec(profile).label}. To change it, type /profile <name>.\n${profileList(profile)}`, "info");
-                return;
-            }
-            if (!isProfile(want)) {
-                ctx.ui.notify(`Unknown profile "${want}". Choose one of:\n${profileList(profile)}`, "warning");
-                return;
-            }
-            profile = want;
-            let saved = "";
-            try {
-                saved = ` Saved in ${saveConfig({ profile })}.`;
-            }
-            catch (err) {
-                saved = ` Not saved: ${err.message}`;
-            }
-            await applyMode(ctx, mode, false, false);
-            ctx.ui.notify(`Sub-Sub: ${profileSpec(profile).label} profile (${profileSpec(profile).summary}).${saved}`, "info");
-        },
-    });
     pi.registerCommand("subsub", {
         description: "Sub-Sub: Zotero connection and library overview",
         handler: async (_args, ctx) => {
-            const lines = [`Mode: ${mode}. Profile: ${profileSpec(profile).label}. Model: ${ctx.model?.id ?? "none"}.`];
+            const lines = [`Mode: ${mode}. Model: ${ctx.model?.id ?? "none"}.`];
             if (!bridge) {
                 ctx.ui.notify(`${lines[0]}\nThe Zotero servers are not running. Try /reload.`, "warning");
                 return;
@@ -673,6 +645,89 @@ export async function createSubsub(pi, deps = {}) {
             await refreshLibrary();
         },
     });
+    // The web view's library search: the result goes to the page through a status, like the library counts.
+    pi.registerCommand("subsub-find", {
+        description: "Sub-Sub: search the library for the web view",
+        handler: async (args, ctx) => {
+            if (ctx.mode !== "rpc")
+                return;
+            const q = String(args ?? "").trim();
+            let out;
+            try {
+                const r = await current().call("zotero_find_items", { query: q, limit: 25 });
+                out = r.isError ? { error: r.text } : { items: r.data?.items ?? [] };
+            }
+            catch (err) {
+                out = { error: err.message };
+            }
+            ctx.ui.setStatus("subsub.find", JSON.stringify({ q, ...out }));
+        },
+    });
+    pi.registerCommand("ai-statement", {
+        description: "Sub-Sub: a draft statement on the use of AI for a manuscript (what journals ask for)",
+        handler: async (args, ctx) => {
+            const date = new Date().toISOString().slice(0, 10);
+            const text = aiStatement({ version: ownVersion(), models: cfg.models, uses: String(args ?? ""), date, starbuck: starbuckEnabled(cfg) });
+            const dir = join(cfg.vault ?? ctx.cwd, "Research");
+            let file = join(dir, `${date} AI use statement.md`);
+            for (let n = 2; existsSync(file); n++)
+                file = join(dir, `${date} AI use statement-${n}.md`);
+            try {
+                mkdirSync(dir, { recursive: true });
+                writeFileSync(file, text);
+            }
+            catch (err) {
+                ctx.ui.notify(`${text}\n${L("Could not save it", "Não foi possível guardar")}: ${err.message}`, "warning");
+                return;
+            }
+            ctx.ui.notify(L(`Sub-Sub: a draft statement on the use of AI is in ${file}. Complete the parts in brackets. To name the tasks, type /ai-statement followed by them, for example: /ai-statement literature searches and reading notes.`, `Sub-Sub: há um rascunho da declaração sobre o uso de IA em ${file}. Complete as partes entre parênteses retos. Para indicar as tarefas, escreva /ai-statement seguido delas, por exemplo: /ai-statement literature searches and reading notes.`), "info");
+        },
+    });
+    // A registered command runs before the input hook, so /read checks the mode itself.
+    pi.registerCommand("read", {
+        description: "Sub-Sub: read a paper with guidance; Sub-Sub finds the passages and asks, you write the answers. /read [background|fact|extract|critique] <citekey, DOI, PMID or title words>",
+        handler: async (args, ctx) => {
+            if (mode === "librarian")
+                return ctx.ui.notify(researcherOnly("read"), "warning");
+            let { purpose, ref } = readArgs(String(args ?? ""));
+            ref ||= (await ctx.ui.input(L("Which paper?", "Que artigo?"), L("citekey, DOI, PMID or title words", "citekey, DOI, PMID ou palavras do título")))?.trim() ?? "";
+            if (!ref)
+                return;
+            if (!purpose) {
+                const labels = Object.values(PURPOSES).map(([en, pt]) => L(en, pt));
+                purpose = Object.keys(PURPOSES)[labels.indexOf((await ctx.ui.select(L("Why are you reading it?", "Porque vai ler este artigo?"), labels)) ?? "")];
+                if (!purpose)
+                    return;
+            }
+            const req = { ref, purpose, date: new Date().toISOString().slice(0, 10) };
+            if (purpose === "fact") {
+                req.fact = (await ctx.ui.input(L("Which fact are you looking for?", "Que dado procura?")))?.trim();
+                if (!req.fact)
+                    return;
+            }
+            if (purpose === "extract") {
+                let sheets = [];
+                try {
+                    sheets = readdirSync(join(cfg.vault ?? ctx.cwd, "Research")).filter((f) => f.endsWith(" extraction.md")).sort();
+                }
+                catch {
+                    // No Research folder yet: the first sheet is a new one.
+                }
+                const fresh = L("New sheet", "Nova folha");
+                const pick = sheets.length ? await ctx.ui.select(L("Which extraction sheet?", "Que folha de extração?"), [...sheets, fresh]) : fresh;
+                if (!pick)
+                    return;
+                if (pick === fresh) {
+                    req.question = (await ctx.ui.input(L("The question of your review", "A pergunta da sua revisão")))?.trim();
+                    if (!req.question)
+                        return;
+                }
+                else
+                    req.sheet = `Research/${pick}`;
+            }
+            pi.sendUserMessage(readInstruction(req), ctx.isIdle() ? undefined : { deliverAs: "followUp" });
+        },
+    });
     pi.registerCommand("history", {
         description: "Sub-Sub: recent library changes",
         handler: async (_args, ctx) => {

package/dist/web.js

@@ -15,16 +15,17 @@
  */
 import { spawn } from "node:child_process";
 import { randomBytes, timingSafeEqual } from "node:crypto";
-import { createReadStream, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync, appendFileSync } from "node:fs";
+import { createReadStream, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync, appendFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { homedir } from "node:os";
-import { extname, join, normalize, resolve, sep } from "node:path";
+import { basename, dirname, extname, join, normalize, resolve, sep } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { agentDirFor, chooseCwd, PACKAGE_DIR, packageVersion } from "./cli.js";
 import { configPath, expand, loadConfig, RECOMMENDED_MODELS, readConfigFile, saveConfig, uiLanguage, withStarbuck } from "./config.js";
 import { TESTED_MODELS } from "./init.js";
 import { KEY_PROVIDERS, saveApiKey } from "./keys.js";
-import { obsidianRoot } from "./layout.js";
+import { NOTE_DIRS, obsidianRoot, SETTINGS_DIR } from "./layout.js";
+import { field, frontMatter } from "./notes.js";
 import { realish, within } from "./paths.js";
 export function parseWebArgs(args) {
     const o = { port: 0, open: true, librarian: false, here: false, idleMinutes: 10, piArgs: [] };
@@ -181,8 +182,43 @@ const TYPES = {
     ".png": "image/png",
     ".ico": "image/x-icon",
 };
+/** Files that the notes pane shows. */
+const NOTE_TYPES = new Set([".md", ".markdown"]);
 /** Files that the Open button may hand to the system (never programs or scripts). */
 export const OPENABLE = new Set([".md", ".markdown", ".txt", ".pdf", ".bib", ".csv", ".qmd"]);
+/** A file inside the working folder or the Sub-Sub folder, judged by its real path, so a link cannot point outside. */
+export function allowedFile(raw, cwd, vault) {
+    // expand() resolves against the process folder: use it for "~" only.
+    const target = resolve(cwd, raw.startsWith("~") ? expand(raw) : raw);
+    const real = realish(target);
+    const inside = within(real, realish(cwd)) || Boolean(vault && within(real, realish(vault)));
+    return inside && existsSync(target) && statSync(target).isFile() ? target : undefined;
+}
+/** The note a [[wikilink]] names: the first <folder>/<name>.md in the Sub-Sub folder, as Obsidian would find it. */
+export function wikilinkTarget(name, root) {
+    const file = name.endsWith(".md") ? name : `${name}.md`;
+    return ["", ...NOTE_DIRS, SETTINGS_DIR].map((d) => join(root, d, file)).find((f) => existsSync(f));
+}
+/** The notes in the Sub-Sub folders, newest first (dot folders such as Research/.plans left out). */
+export function listNotes(root, max = 300) {
+    const out = [];
+    for (const d of [...NOTE_DIRS, SETTINGS_DIR]) {
+        let names = [];
+        try {
+            names = readdirSync(join(root, d), { recursive: true });
+        }
+        catch {
+            continue;
+        }
+        for (const n of names) {
+            if (!n.endsWith(".md") || n.split(/[\\/]/).some((x) => x.startsWith(".")))
+                continue;
+            const path = join(root, d, n);
+            out.push({ path, rel: join(d, n), modified: statSync(path).mtimeMs });
+        }
+    }
+    return out.sort((a, b) => b.modified - a.modified).slice(0, max);
+}
 const CSP = [
     "default-src 'none'",
     "script-src 'self'",
@@ -194,6 +230,14 @@ const CSP = [
     "form-action 'none'",
     "frame-ancestors 'none'",
 ].join("; ");
+function readText(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
 function same(a, b) {
     const x = Buffer.from(a);
     const y = Buffer.from(b);
@@ -263,6 +307,7 @@ export async function startWeb(opts, env = process.env, log = () => { }) {
     const agentDir = agentDirFor(env, home);
     const cwd = chooseCwd(process.cwd(), home, cfg.vault, opts.here);
     const lang = uiLanguage(cfg.language);
+    const notesRoot = cfg.vault ?? cwd;
     const token = randomBytes(24).toString("base64url");
     const webDir = join(PACKAGE_DIR, "web");
     const bin = join(PACKAGE_DIR, "bin", "subsub.js");
@@ -274,6 +319,7 @@ export async function startWeb(opts, env = process.env, log = () => { }) {
     const clients = new Set();
     const dialogs = new Map();
     let subsubState = null;
+    let lastFind = null;
     let busy = false;
     let lastSeen = Date.now();
     let restarting = false;
@@ -310,6 +356,14 @@ export async function startWeb(opts, env = process.env, log = () => { }) {
                 }
                 broadcast({ type: "subsub_state", state: subsubState });
             }
+            else if (ev.method === "setStatus" && ev.statusKey === "subsub.find") {
+                try {
+                    lastFind = ev.statusText ? JSON.parse(ev.statusText) : null;
+                }
+                catch {
+                    lastFind = null;
+                }
+            }
             else if (ev.method === "notify") {
                 broadcast(ev);
             }
@@ -353,13 +407,22 @@ export async function startWeb(opts, env = process.env, log = () => { }) {
             out.session = await agent.request({ type: "get_state" });
             lastSession = out.session.sessionFile ?? lastSession;
             out.messages = (await agent.request({ type: "get_messages" })).messages;
-            out.commands = (await agent.request({ type: "get_commands" })).commands;
+            const commands = (await agent.request({ type: "get_commands" })).commands;
+            // RPC has no argument hints: read them from the prompt files.
+            out.commands = commands.map((c) => {
+                const front = c.source === "prompt" && c.sourceInfo?.path ? frontMatter(readText(c.sourceInfo.path)) : undefined;
+                const hint = front && field(front, "argument-hint");
+                return hint ? { ...c, hint } : c;
+            });
         }
         catch (err) {
             out.error = err.message;
         }
         return out;
     }
+    async function currentSession() {
+        return (await agent.request({ type: "get_state" })).sessionFile;
+    }
     async function sessions() {
         const { SessionManager } = await import("@earendil-works/pi-coding-agent");
         const list = await SessionManager.list(cwd);
@@ -493,7 +556,8 @@ export async function startWeb(opts, env = process.env, log = () => { }) {
                     if (!message)
                         return send(res, 400, { error: "empty message" });
                     try {
-                        await agent.request({ type: "prompt", message, ...(busy ? { streamingBehavior: "followUp" } : {}) });
+                        // A command answers only after its dialogs close (/read, /undo), so wait longer than the default.
+                        await agent.request({ type: "prompt", message, ...(busy ? { streamingBehavior: "followUp" } : {}) }, 60 * 60_000);
                     }
                     catch (err) {
                         // No provider yet: the page opens the model dialog instead of showing pi's text.
@@ -599,14 +663,63 @@ export async function startWeb(opts, env = process.env, log = () => { }) {
                             saveConfig({ models: TESTED_MODELS, model: undefined }, env);
                     });
                 }
+                case "GET /api/notes":
+                    return send(res, 200, { root: notesRoot, notes: listNotes(notesRoot) });
+                case "GET /api/note": {
+                    const raw = url.searchParams.get("path") ?? "";
+                    const wiki = !/[\\/]/.test(raw) && !/\.\w+$/.test(raw) ? wikilinkTarget(raw, notesRoot) : undefined;
+                    // A relative path is tried in the working folder, then in the Sub-Sub folder (Literature/x.md).
+                    const file = allowedFile(wiki ?? raw, cwd, cfg.vault) ?? allowedFile(raw, notesRoot, cfg.vault);
+                    if (!file)
+                        return send(res, 404, { error: "not found in the Sub-Sub folder" });
+                    if (!NOTE_TYPES.has(extname(file).toLowerCase()))
+                        return send(res, 415, { error: "not a note" });
+                    if (statSync(file).size > 2_000_000)
+                        return send(res, 413, { error: "too large to show" });
+                    return send(res, 200, { path: file, name: basename(file), text: readFileSync(file, "utf8") });
+                }
+                case "GET /api/library": {
+                    const q = (url.searchParams.get("q") ?? "").replace(/\s+/g, " ").trim().slice(0, 200);
+                    if (!q)
+                        return send(res, 200, { q, items: [] });
+                    await agent.request({ type: "prompt", message: `/subsub-find ${q}` });
+                    return send(res, 200, lastFind?.q === q ? lastFind : { q, items: [] });
+                }
+                case "POST /api/session/name": {
+                    const body = await readJson(req);
+                    const name = String(body.name ?? "").replace(/\s+/g, " ").trim();
+                    if (!name || name.length > 120)
+                        return send(res, 400, { error: "a name of 1 to 120 characters" });
+                    const known = (await sessions());
+                    if (!known.some((x) => x.path === body.path))
+                        return send(res, 404, { error: "no such session" });
+                    if (body.path === (await currentSession()))
+                        await agent.request({ type: "set_session_name", name });
+                    else {
+                        const { SessionManager } = await import("@earendil-works/pi-coding-agent");
+                        SessionManager.open(String(body.path)).appendSessionInfo(name);
+                    }
+                    return send(res, 200, { ok: true });
+                }
+                case "POST /api/session/trash": {
+                    const body = await readJson(req);
+                    const known = (await sessions());
+                    if (!known.some((x) => x.path === body.path))
+                        return send(res, 404, { error: "no such session" });
+                    if (body.path === (await currentSession()))
+                        return send(res, 409, { error: "the open conversation" });
+                    // Nothing is deleted: the file moves to a trash folder next to the agent folder.
+                    const trash = join(dirname(agentDir), "trash");
+                    mkdirSync(trash, { recursive: true });
+                    renameSync(String(body.path), join(trash, basename(String(body.path))));
+                    return send(res, 200, { ok: true });
+                }
                 case "POST /api/open": {
                     const body = await readJson(req);
-                    const target = resolve(cwd, expand(String(body.path ?? "")));
                     const vault = cfg.vault;
                     // Judge the real file, so a link inside the Sub-Sub folder cannot open a document outside it.
-                    const real = realish(target);
-                    const inside = within(real, realish(cwd)) || Boolean(vault && within(real, realish(vault)));
-                    if (!inside || !existsSync(target))
+                    const target = allowedFile(String(body.path ?? ""), cwd, vault);
+                    if (!target)
                         return send(res, 404, { error: "not found in the Sub-Sub folder" });
                     // Documents only: a file that the model wrote must never be run.
                     if (!OPENABLE.has(extname(target).toLowerCase()))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiagojct/subsub",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Sub-Sub: a research assistant that works from your own Zotero library, in the browser or the terminal, built on pi",
   "type": "module",
   "license": "MIT",

package/prompts/lit.md

@@ -54,6 +54,7 @@ Write one note: `Research/<date> <slug>.md` in the Sub-Sub folder. Do not overwr
 title: "<question>"
 date: <YYYY-MM-DD>
 type: literature-review
+review_type: AI-assisted rapid review (not a systematic review)
 question: "<question in one sentence>"
 searches: ["<phrasing 1>", "<phrasing 2>", "<phrasing 3>"]
 sources_found: <number of unique works>
@@ -78,15 +79,18 @@ reference_check: "<path of the Starbuck report, or none>"
 ## Methods
 (where you searched, the phrasings, the pre-screen terms, the screening counts, the gap searches, what you included and left out, and why)
 
+## What this review is
+(copy this paragraph as it is) An AI-assisted rapid review: one AI screener, no second reviewer, no registered protocol and no formal risk-of-bias assessment (such as RoB 2 or ROBINS-I). Use it to scope a question, to write a background section or as a first search. For a systematic review, use the searches and the screening log as a starting point, then screen in duplicate, assess the risk of bias and report to PRISMA.
+
 ## Sources
 1. [@citekey] for library items; for other works: Authors, year, title, journal. doi:... (not in library)
 ```
 
 If a step fails (a service does not answer, a full text cannot be read), do not stop. Finish the note, mark the step "BLOCKED: <what failed>", and set verification: BLOCKED.
 
-## In the Reader profile: a reading list
+## A reading list
 
-When the profile is Reader, do sections 1, 2, 4 and 5 as written, but do not synthesise (skip section 3). Write the note with `type: reading-list` and this body in place of Answer, Agreement, Disagreement and Open questions:
+When the user asks for a reading list (for example `/lit reading list: <topic>`, in any language), do sections 1, 2, 4 and 5 as written, but do not synthesise (skip section 3). Write the note with `type: reading-list` and this body in place of Answer, Agreement, Disagreement and Open questions:
 
 ```markdown
 ## How to read this list

package/roles/researcher.md

@@ -94,12 +94,14 @@ If zotero_get_vocabulary has no topic/ tags, propose topics before tagging: read
 - For a synthesis of a tag ("what does my library say about X"): find the items with zotero_find_items tags=["topic/x"] and include every one. The table has one row per item; if you leave an item out, say which and why.
 - Say for each item whether you used the full text or the abstract. Never state a number or a claim that is not in what you read.
 
-## Manuscripts (Author and Editor profiles)
+## Manuscripts
 
 1. scholar_check_manuscript on the file.
 2. Propose fixes for missing keys. Do not edit the manuscript text without approval.
 3. scholar_export_bibliography to the file named in the YAML header, or references.json next to the manuscript.
 
+Draft text for {{user}}'s manuscripts or theses only when {{user}} asks. Cite library items as [@citekey], use only claims from sources you read, and mark drafted text clearly so that {{user}} can check it. Never draft text for an assignment (coursework that {{user}} hands in for a grade), even when asked: say so, and offer /read, quotes and questions instead.
+
 ## Reference checks (Starbuck, when the verify_ tools are available)
 
 - verify_check_manuscript checks that each cited work exists, matches its citation and was not retracted. Use it on {{user}}'s manuscripts and on your own reports before you deliver them.

package/src/bench.ts

@@ -901,7 +901,7 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
 			const cf = join(cfgDir, `${j.code}.json`);
 			// A bare name is an OpenCode Go model; provider/id (google/gemini-..., openrouter/x/y:free) is any provider.
 			const spec = j.model.includes("/") ? j.model : `opencode-go/${j.model}`;
-			writeFileSync(cf, JSON.stringify({ ...userCfg, profile: "editor", models: { librarian: spec, researcher: spec }, model: undefined, libraryChanges: undefined }));
+			writeFileSync(cf, JSON.stringify({ ...userCfg, profile: undefined, models: { librarian: spec, researcher: spec }, model: undefined, libraryChanges: undefined }));
 			const s = await runOne({ ...j, prompt, out, cwd: cfg.vault!, configFile: cf, timeoutSec });
 			n++;
 			console.log(`${n}/${jobs.length}  ${j.code}  ${j.task}  ${s.seconds}s  ${s.error ?? (s.settled ? "done" : "?")}`);

package/src/cli.ts

@@ -140,7 +140,7 @@ Usage:
   subsub                 Start Sub-Sub in the terminal
   subsub --librarian     Start in the Librarian, which only manages the library
   subsub web             Open Sub-Sub in the browser
-  subsub init            Set up or change the settings (folder, tag list, profile, models)
+  subsub init            Set up or change the settings (folder, tag list, models)
   subsub doctor          Check the set-up; each line marked FIX says what to do
   subsub usage           The pilot's usage log (if turned on): a summary and where the file is
   subsub shortcut        Add a Sub-Sub shortcut (--remove takes it away)
@@ -152,7 +152,7 @@ Options:
   --here                 Work in the current folder, not in the Sub-Sub folder
 
 In Sub-Sub, type /subsub for the state, /researcher or /librarian to switch modes,
-/profile to change the profile, /undo to undo the last change, and / for all commands.
+/read to read a paper with guidance, /undo to undo the last change, and / for all commands.
 Sub-Sub runs on pi: pi's options (for example --model, --resume) also work.
 
 Docs: https://subsub.tiagojacinto.eu`;

package/src/config.ts

@@ -3,7 +3,6 @@
  * (~/.config/subsub/config.json, or SUBSUB_CONFIG) overrides it.
  *
  * {
- *   "profile": "scholar",
  *   "userName": "Ana", "about": "a master's student in health informatics", "language": "English",
  *   "vault": "~/Documents/Sub-Sub",
  *   "models": { "librarian": "opencode-go/mimo-v2.6-flash", "researcher": "opencode-go/mimo-v2.6-pro" },
@@ -61,8 +60,6 @@ export const RECOMMENDED_MODELS: Array<{ spec: string; modes: Mode[]; why: "test
 export function uiLanguage(language: string | undefined): "pt" | "en" {
 	return /portug|^pt\b|^pt-/i.test(language ?? "") ? "pt" : "en";
 }
-export type Profile = "reader" | "scholar" | "author" | "editor";
-export const PROFILES: Profile[] = ["reader", "scholar", "author", "editor"];
 
 /** The Zotero server release that this Sub-Sub version runs when there is no local server folder. */
 export const SERVER_VERSION = "0.5.5";
@@ -72,10 +69,8 @@ export const STARBUCK_VERSION = "0.2.0";
 export const STARBUCK_SOURCE = `starbuck==${STARBUCK_VERSION}`;
 
 export interface SubsubConfig {
-	/** The settings file (written by `subsub init` and `/profile`). */
+	/** The settings file (written by `subsub init`). */
 	configFile: string;
-	/** How much Sub-Sub does for the user: reader, scholar, author or editor. */
-	profile: Profile;
 	/** How the prompts name the user ("the user" when not set). */
 	userName?: string;
 	/** One line about the user, e.g. "a master's student in health informatics". */
@@ -157,10 +152,6 @@ export function saveConfig(patch: Record<string, unknown>, env: NodeJS.ProcessEn
 	return file;
 }
 
-export function isProfile(x: unknown): x is Profile {
-	return typeof x === "string" && (PROFILES as string[]).includes(x);
-}
-
 export function loadConfig(env: NodeJS.ProcessEnv = process.env): SubsubConfig {
 	const home = env.HOME;
 	const file = configPath(env);
@@ -194,7 +185,6 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): SubsubConfig {
 	const themes = user.themes === false ? false : typeof user.themes === "string" ? user.themes : user.themes?.researcher;
 	return {
 		configFile: file,
-		profile: isProfile(user.profile) ? user.profile : "scholar",
 		userName: typeof user.userName === "string" && user.userName.trim() ? user.userName.trim() : undefined,
 		about: typeof user.about === "string" && user.about.trim() ? user.about.trim() : undefined,
 		language: typeof user.language === "string" && user.language.trim() ? user.language.trim() : "English",

package/src/doctor.ts

@@ -23,7 +23,6 @@ import {
 	refreshedArgs,
 } from "./config.ts";
 import { isObsidianVault, LEGACY_SETTINGS_DIR, SETTINGS_FILES, settingsFile } from "./layout.ts";
-import { profileSpec } from "./profiles.ts";
 
 export interface Check {
 	name: string;
@@ -79,7 +78,7 @@ export function runChecks(
 	);
 	out.push(
 		existsSync(cfg.configFile)
-			? { name: "Settings", ok: true, detail: `${cfg.configFile}, profile ${profileSpec(cfg.profile).label}, replies in ${cfg.language}` }
+			? { name: "Settings", ok: true, detail: `${cfg.configFile}, replies in ${cfg.language}` }
 			: { name: "Settings", ok: false, detail: `no ${cfg.configFile}`, fix: "Type subsub init." },
 	);