codeply-cli 0.5.1 → 0.5.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Awais Siddique (Codeply)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/THIRD_PARTY_NOTICES.md

@@ -1,63 +1,65 @@
-# Third-party notices
-
-Parts of the Codeply engine (codeply-cli/lib) are adapted from the open-source projects below. Each adapted section is marked in the source with a comment naming the project.
-
-## opencode
-
-https://github.com/sst/opencode
-
-Used in: `lib/edit-engine.js` (fallback edit matchers), `lib/agent.mjs` (compaction summary template, instruction-file lookup order), `lib/snapshot.js` (hidden git snapshots for undo), `lib/arity.js` and `lib/arity-table.json` (command-name table for scoped approvals, copied from `permission/arity.ts`), `lib/ai.js` (retry-after handling), `lib/permissions.js` (rule evaluation approach), `lib/commands.js` (command file layout).
-
-```
-MIT License
-
-Copyright (c) 2025 opencode
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
-## Hermes Agent
-
-https://github.com/NousResearch/hermes-agent
-
-Used in: `lib/terminal-hints.js` (failed-command hints, masked-success check), `lib/agent.mjs` (stall nudges, loop and failure-streak guards, fallback summary), `lib/tools.mjs` (task list design).
-
-```
-MIT License
-
-Copyright (c) 2025 Nous Research
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
+# Third-party notices
+
+"OpenAI", "ChatGPT" and the OpenAI Blossom logo (`assets/brand/openai-blossom-*.svg` in the desktop app, shown next to "Continue with ChatGPT") are trademarks of OpenAI, used unmodified under OpenAI's brand guidelines (https://openai.com/brand). They are not covered by this project's MIT license, and their use does not imply endorsement by OpenAI.
+
+Parts of the Codeply engine (codeply-cli/lib) are adapted from the open-source projects below. Each adapted section is marked in the source with a comment naming the project.
+
+## opencode
+
+https://github.com/sst/opencode
+
+Used in: `lib/edit-engine.js` (fallback edit matchers), `lib/agent.mjs` (compaction summary template, instruction-file lookup order), `lib/snapshot.js` (hidden git snapshots for undo), `lib/arity.js` and `lib/arity-table.json` (command-name table for scoped approvals, copied from `permission/arity.ts`), `lib/ai.js` (retry-after handling), `lib/permissions.js` (rule evaluation approach), `lib/commands.js` (command file layout).
+
+```
+MIT License
+
+Copyright (c) 2025 opencode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## Hermes Agent
+
+https://github.com/NousResearch/hermes-agent
+
+Used in: `lib/terminal-hints.js` (failed-command hints, masked-success check), `lib/agent.mjs` (stall nudges, loop and failure-streak guards, fallback summary), `lib/tools.mjs` (task list design).
+
+```
+MIT License
+
+Copyright (c) 2025 Nous Research
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/bin/codeply.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 /**
  * Codeply CLI - apply an AI instruction to a file from the terminal.
  *

package/lib/agent.mjs

@@ -24,11 +24,12 @@ const mcpLib = require('./mcp.js');
 const skills = require('./skills.js');
 const plugins = require('./plugins.js');
 const rolesLib = require('./subagents.js');
+const reachLib = require('./reach.js');
 const config = require('./config.js');
 
 // Enough room for a real task plus its verification pass. /goal runs pass a
 // larger budget per iteration (see main.js).
-const MAX_STEPS = 40;
+const MAX_STEPS = 80;
 const MAX_MALFORMED_RETRIES = 3;
 // How much transcript (system prompt included) is sent per step before older
 // tool results get collapsed. The hosted proxy is a Supabase Edge Function
@@ -51,9 +52,10 @@ const FORMAT_CORRECTION =
   'closing tags complete:\n\n' +
   '<codeply:read_file>\n<path>run.html</path>\n</codeply:read_file>\n\n' +
   'Valid names: todo, ask_user, mcp, list_dir, read_file, write_file, edit_file, search, run, use_skill, list_skills, fetch_image, ' +
-  'browser_check, gmail_send, gmail_search, slack_post_message, vercel_deploy, supabase_create_project, ' +
+  'browser_check, gmail_send, gmail_search, gmail_draft, drafts_list, calendar_list, calendar_add, slack_post_message, vercel_deploy, supabase_create_project, ' +
   'supabase_delete_project, github_create_repo, design_reference_search, view_images, supabase_api, supabase_sql, vercel_api, ' +
-  'web_fetch, web_search, apply_patch, plan_exit, plan_enter, lsp.';
+  'web_fetch, web_search, image_search, reach_me, watch_email, apply_patch, plan_exit, plan_enter, lsp, publish_check, publish_connect, supabase_setup, supabase_schema, ' +
+  'publish_deploy, publish_github.';
 
 const TRUNCATION_CORRECTION =
   '[system] That reply got cut off partway through the action block - the tag syntax was fine, it simply ran out of ' +
@@ -144,7 +146,7 @@ const CLAIM_SHIPPED = new RegExp(
   `|\\b(?:is|are)\\s+now\\s+live\\s+(?:at|on)\\b`,
   'i',
 );
-const SHIP_TOOLS = new Set(['run', 'vercel_deploy', 'vercel_api', 'github_create_repo', 'supabase_api']);
+const SHIP_TOOLS = new Set(['run', 'vercel_deploy', 'vercel_api', 'github_create_repo', 'supabase_api', 'publish_deploy', 'publish_github']);
 
 const unbackedClaimCorrection = (what) =>
   `[system] Your last reply says you ${what}, but no tool that could have done that ran successfully this turn. ` +
@@ -178,7 +180,7 @@ const MAX_HALLUCINATION_RETRIES = 3;
 const MAX_VERIFY_NUDGES = 2;
 
 // Look-around blocks that may share one reply (see the loop).
-const BATCHABLE_TOOLS = new Set(['read_file', 'list_dir', 'search', 'web_fetch', 'web_search', 'lsp']);
+const BATCHABLE_TOOLS = new Set(['read_file', 'list_dir', 'search', 'web_fetch', 'web_search', 'image_search', 'lsp']);
 const MAX_BATCH = 4;
 
 // Identical call, identical arguments, this many times in a row = stuck.
@@ -251,12 +253,13 @@ const cycleNote = (period) =>
 // instead of being cut off mid-edit. Idea from Hermes Agent / opencode.
 const budgetCheckpointNote = (used, max) =>
   `[system] You have used ${used} of ${max} steps for this turn. Finish the change you are in the middle of, check it, ` +
-  'and wrap up with your summary. If the whole task cannot fit, get the current part to a working state and list what is left.';
+  'and wrap up with a short summary. If the whole task cannot fit, get the current part to a working state and name what is left in a line or two.';
 
 const FINAL_SUMMARY_PROMPT =
   '[system] The step budget for this turn is used up, so actions are switched off: do not write any action block, it ' +
-  'would be ignored. Reply with a short summary for the user: what you actually changed (only files a tool result ' +
-  'confirms), what you checked and the result, and what is left to do. Do not claim anything the tool results do not show.';
+  'would be ignored. Reply with a short note for the user: one sentence on where things stand, then at most 4 short ' +
+  'bullets on what you changed (only files a tool result confirms) and what is left. No headings, IDs or evidence ' +
+  'lists, and do not mention the step budget. Under about 100 words. Do not claim anything the tool results do not show.';
 
 // ─── Protocol ───────────────────────────────────────────────────────────────
 
@@ -264,7 +267,7 @@ const TOOL_TAG = /<codeply:([a-z_]+)>([\s\S]*?)<\/codeply:\1>/g;
 
 // Params whose value is a raw payload (file content, code blocks) and may
 // legitimately contain angle-bracket tags of its own.
-const CONTAINER_PARAMS = new Set(['content', 'search', 'replace', 'body', 'text', 'patch']);
+const CONTAINER_PARAMS = new Set(['content', 'search', 'replace', 'body', 'text', 'patch', 'sql']);
 
 /** Tag payloads are written on their own lines; drop only that framing. */
 function trimFraming(value) {
@@ -320,8 +323,12 @@ const PARAMS = {
   list_skills: ['query'],
   fetch_image: ['url', 'path'],
   browser_check: ['url', 'wait', 'viewport'],
-  gmail_send: ['to', 'subject', 'body'],
+  gmail_send: ['to', 'subject', 'body', 'draft'],
   gmail_search: ['query'],
+  gmail_draft: ['to', 'subject', 'body'],
+  drafts_list: [],
+  calendar_list: ['from', 'to', 'max'],
+  calendar_add: ['title', 'start', 'end', 'description', 'location', 'reminders'],
   slack_post_message: ['channel', 'text'],
   vercel_deploy: ['path'],
   supabase_create_project: ['name'],
@@ -332,8 +339,17 @@ const PARAMS = {
   supabase_api: ['method', 'path', 'body'],
   supabase_sql: ['ref', 'query'],
   vercel_api: ['method', 'path', 'body'],
+  publish_check: ['path'],
+  publish_connect: ['service', 'reason'],
+  supabase_setup: ['project', 'name', 'region'],
+  supabase_schema: ['ref', 'sql', 'path'],
+  publish_deploy: ['path', 'name'],
+  publish_github: ['path', 'name', 'private'],
   web_fetch: ['url', 'format'],
   web_search: ['query', 'num'],
+  image_search: ['query', 'num'],
+  reach_me: ['how', 'message', 'at', 'bot'], // only when the host can reach the phone (lib/reach.js)
+  watch_email: ['from', 'how', 'note', 'repeat'],
   apply_patch: ['patch'],
   plan_exit: ['path'],
   plan_enter: ['reason'],
@@ -365,9 +381,19 @@ const NAME_ALIASES = {
   previewcheck: 'browser_check', browserpreview: 'browser_check', check: 'browser_check',
   gmail_send: 'gmail_send', gmailsend: 'gmail_send', sendemail: 'gmail_send', email: 'gmail_send', sendmail: 'gmail_send',
   gmail_search: 'gmail_search', gmailsearch: 'gmail_search', searchemail: 'gmail_search', searchgmail: 'gmail_search',
+  gmail_draft: 'gmail_draft', gmaildraft: 'gmail_draft', draftemail: 'gmail_draft', savedraft: 'gmail_draft', createdraft: 'gmail_draft',
+  drafts_list: 'drafts_list', draftslist: 'drafts_list', listdrafts: 'drafts_list', drafts: 'drafts_list',
+  calendar_list: 'calendar_list', calendarlist: 'calendar_list', listevents: 'calendar_list', calendar: 'calendar_list', events: 'calendar_list', getevents: 'calendar_list',
+  calendar_add: 'calendar_add', calendaradd: 'calendar_add', addevent: 'calendar_add', createevent: 'calendar_add', addtocalendar: 'calendar_add', newevent: 'calendar_add',
   slack_post_message: 'slack_post_message', slackpostmessage: 'slack_post_message',
   slackmessage: 'slack_post_message', slackpost: 'slack_post_message', postmessage: 'slack_post_message',
-  vercel_deploy: 'vercel_deploy', vercel: 'vercel_deploy', deploy: 'vercel_deploy', publish: 'vercel_deploy', vercelpublish: 'vercel_deploy',
+  vercel_deploy: 'vercel_deploy', vercel: 'vercel_deploy', vercelpublish: 'vercel_deploy',
+  publish_deploy: 'publish_deploy', publishdeploy: 'publish_deploy', deploy: 'publish_deploy', publish: 'publish_deploy',
+  publish_check: 'publish_check', publishcheck: 'publish_check',
+  publish_connect: 'publish_connect', publishconnect: 'publish_connect', connect: 'publish_connect',
+  supabase_setup: 'supabase_setup', supabasesetup: 'supabase_setup', setupdatabase: 'supabase_setup',
+  supabase_schema: 'supabase_schema', supabaseschema: 'supabase_schema', applyschema: 'supabase_schema',
+  publish_github: 'publish_github', publishgithub: 'publish_github',
   supabase_create_project: 'supabase_create_project', supabase: 'supabase_create_project', createproject: 'supabase_create_project',
   createdatabase: 'supabase_create_project', makedatabase: 'supabase_create_project', create_database: 'supabase_create_project',
   supabase_delete_project: 'supabase_delete_project', deletesupabaseproject: 'supabase_delete_project',
@@ -383,6 +409,9 @@ const NAME_ALIASES = {
   supabase_sql: 'supabase_sql', supabasesql: 'supabase_sql', sql: 'supabase_sql', runsql: 'supabase_sql',
   vercel_api: 'vercel_api', vercelapi: 'vercel_api',
   web_fetch: 'web_fetch', webfetch: 'web_fetch', fetchurl: 'web_fetch', fetch_url: 'web_fetch', fetchpage: 'web_fetch', openurl: 'web_fetch', readurl: 'web_fetch',
+  reach_me: 'reach_me', reachme: 'reach_me', call_me: 'reach_me', callme: 'reach_me', text_me: 'reach_me', textme: 'reach_me', notify_me: 'reach_me', notifyme: 'reach_me', call_user: 'reach_me',
+  watch_email: 'watch_email', watchemail: 'watch_email', email_alert: 'watch_email', alert_on_email: 'watch_email', watch_inbox: 'watch_email',
+  image_search: 'image_search', imagesearch: 'image_search', searchimages: 'image_search', search_images: 'image_search', googleimages: 'image_search',
   web_search: 'web_search', websearch: 'web_search', searchweb: 'web_search', search_web: 'web_search', googlesearch: 'web_search',
   apply_patch: 'apply_patch', applypatch: 'apply_patch', patch: 'apply_patch',
   plan_exit: 'plan_exit', planexit: 'plan_exit', exitplan: 'plan_exit', exit_plan: 'plan_exit',
@@ -441,7 +470,8 @@ function recoverCall(text) {
   else if (has('items')) name = 'todo';
   else if (has('question') && has('options')) name = 'ask_user';
   else if (has('server') && has('tool')) name = 'mcp';
-  else if (has('to') && has('subject')) name = 'gmail_send';
+  else if (has('to') && has('subject')) name = /<\/?\s*(?:codeply[:_-])?gmail_?draft/i.test(text) ? 'gmail_draft' : 'gmail_send';
+  else if (has('title') && has('start')) name = 'calendar_add';
   else if (has('channel') && has('text')) name = 'slack_post_message';
   else {
     const m = text.match(LOOSE_NAME_TAG);
@@ -781,8 +811,12 @@ match exactly one place.)
 <query>testing</query>
 </codeply:list_skills>
 
+<codeply:image_search>
+<query>matcha tea ceremony</query>
+</codeply:image_search>
+
 <codeply:fetch_image>
-<url>https://loremflickr.com/1600/900/tea,leaves</url>
+<url>(an image URL from image_search)</url>
 <path>assets/hero.jpg</path>
 </codeply:fetch_image>
 
@@ -803,6 +837,39 @@ The email body, plain text.
 <query>from:someone@example.com is:unread</query>
 </codeply:gmail_search>
 
+<codeply:gmail_draft>
+<to>someone@example.com</to>
+<subject>Subject line</subject>
+<body>
+The email body, plain text.
+</body>
+</codeply:gmail_draft>
+
+(gmail_draft saves a draft and sends nothing: in Gmail's Drafts when Gmail is
+connected, otherwise in Codeply's own drafts. drafts_list lists Codeply's
+drafts; gmail_send with <draft>id</draft> sends one of them.)
+
+<codeply:drafts_list>
+</codeply:drafts_list>
+
+<codeply:calendar_list>
+<from>today</from>
+<to>2026-10-05</to>
+</codeply:calendar_list>
+
+<codeply:calendar_add>
+<title>Dentist</title>
+<start>2026-10-06T15:30</start>
+<end>2026-10-06T16:15</end>
+<location>Main St clinic</location>
+<reminders>30</reminders>
+</codeply:calendar_add>
+
+(Calendar times are the user's local time: 2026-10-06T15:30 for a time,
+2026-10-06 for a whole day; from/to also take today or tomorrow. calendar_list
+defaults to today. calendar_add puts a real event on the user's Google
+Calendar and asks first; reminders is minutes before, comma-separated.)
+
 <codeply:slack_post_message>
 <channel>general</channel>
 <text>
@@ -844,6 +911,38 @@ create table if not exists todos (id bigint generated always as identity primary
 <path>/v9/projects</path>
 </codeply:vercel_api>
 
+<codeply:publish_check>
+</codeply:publish_check>
+
+<codeply:publish_connect>
+<service>supabase</service>
+<reason>The app has sign-up and saves notes, so it needs a database.</reason>
+</codeply:publish_connect>
+
+<codeply:supabase_setup>
+</codeply:supabase_setup>
+
+<codeply:supabase_schema>
+<sql>
+create table if not exists notes (id bigint generated always as identity primary key, user_id uuid references auth.users not null default auth.uid(), body text not null);
+create policy "own notes" on notes for all using (auth.uid() = user_id) with check (auth.uid() = user_id);
+</sql>
+</codeply:supabase_schema>
+
+<codeply:publish_github>
+</codeply:publish_github>
+
+<codeply:publish_deploy>
+</codeply:publish_deploy>
+
+(Publishing, only when the user asked to publish/deploy/put it live: use_skill
+publish-website first and follow it. publish_check reads the project;
+publish_connect pauses until the user connects a service in one click;
+supabase_setup picks or creates the Supabase project and writes its URL and anon
+key into the app; supabase_schema runs SQL after the user approves it, with RLS;
+publish_deploy asks about GitHub once, then deploys to Vercel and waits until it
+is live; publish_github creates or reuses the repo, pushes and links Vercel.)
+
 <codeply:design_reference_search>
 <term>to-do list</term>
 <category>productivity</category>
@@ -931,19 +1030,21 @@ RULES
   If an edit_file fails, its error shows the closest matching lines with numbers:
   copy from those instead of re-reading the whole file.
 - Before an action block write at most one short sentence (or nothing). Don't narrate plans, apologize, or restate what you just did; the user sees every action anyway. Save the explanation for your final answer.
+- Your final answer is a short note to a busy person, not a report. Open with the outcome in one plain sentence, then at most 3 to 5 short bullets: what changed, and anything that failed or is still left (one line each). No section headings like "What I changed" or "What I verified", no project refs, IDs, hashes, raw JSON, test account names or step-budget talk. Mention checks in a few words ("sign-in tested, works"), not as evidence lists. If work is left, end with one sentence offering the next step. Stay under about 120 words unless the user asked for detail.
 - Keep "search" as narrow as the change actually is. When removing something, search should span exactly the thing being removed - not "from here to the end of the file" just because that was easy to copy. A wider span deletes whatever sits between your intended target and wherever you stopped, silently, even when it renders fine and reports no errors. If two things need removing and something unrelated sits between them, that is two edit_file calls, not one wide one.
 - edit_file for changes to an existing file. write_file only for new files or a genuine full rewrite.
 - Prefer run for anything you can check mechanically.
 - run executes a real shell command on the user's own machine, in their own project directory, with their own git/gh credentials already configured - the exact same terminal they'd get typing it themselves. That includes git add, git commit, git push, gh pr create, npm install, or anything else. Never tell the user you don't have terminal or network access, or that you can't run a command - if it's a shell command, write a <codeply:run> action block and run it for real. Do not just describe what the command would do.
 - If a task needs a CLI that turns out not to be installed, install it yourself with the platform's own package manager (winget on Windows, brew on macOS, apt/apt-get on Linux) via run before falling back to a manual workaround - do not immediately hand the user a "go do this in a browser" set of steps just because a binary is missing; installing it is itself a shell command. The one thing you genuinely cannot do unattended is an interactive auth step a CLI requires after installing (e.g. gh auth login opening a browser for a device code) - if the install succeeds but the tool then reports it isn't authenticated, that specific login step is the only part to ask the user for, not the whole task.
+- PUBLISHING: never publish, deploy or create cloud resources unless the user asked for that in so many words (publish, deploy, put it live, ship it, host it). Building or fixing a site is not a request to publish it. When they do ask, use_skill 'publish-website' first and follow it: publish_check, decide yourself whether the app needs a database, publish_connect for any service that is not connected (it waits for the user, then you carry on without asking again), supabase_setup and supabase_schema when a database is needed, then publish_deploy (and publish_github when the user wants GitHub). Finish with the live URL from the publish_deploy result, never one you built yourself. Prefer these over vercel_deploy and supabase_create_project.
 - Deploying to Vercel, creating a Supabase project, or creating a new GitHub repo and pushing to it are NOT CLI tasks here - do not install or shell out to the vercel CLI, the supabase CLI, or gh repo create for these. Use vercel_deploy, supabase_create_project, and github_create_repo instead: they call the connected account directly (once the user has connected it from Connect Apps), with no separate CLI login step and no "go create an empty repo on github.com first." If one reports its integration isn't connected, say so plainly and point the user to Connect Apps (account menu) - do not fall back to the CLI/manual route as a workaround, and do not install the vercel/supabase CLI to route around a missing connection.
 - FULL SUPABASE ACCESS: when Supabase is connected (see CONNECTED SERVICES), supabase_api reaches the entire Supabase Management API (https://api.supabase.com, paths start with /v1/) - list projects (GET /v1/projects), read API keys (GET /v1/projects/{ref}/api-keys?reveal=true), manage auth config, storage buckets, edge functions, secrets, branches, and more. supabase_sql runs SQL directly against a project's Postgres database - create and alter tables, write RLS policies, seed data, inspect schemas (select from information_schema). Always look up the real project ref first (GET /v1/projects) instead of guessing it. Read requests run immediately; changes ask the user first. Enable RLS and add policies on any table that holds user data.
 - FULL VERCEL ACCESS: when Vercel is connected, vercel_api reaches the entire Vercel REST API (https://api.vercel.com, paths start with a version like /v9/) - projects (GET /v9/projects), deployments and their status/logs (GET /v6/deployments, GET /v13/deployments/{id}, GET /v3/deployments/{id}/events), env vars (/v10/projects/{id}/env), domains (/v10/projects/{id}/domains). The team id is added for you. Use vercel_deploy to ship a folder, then vercel_api to confirm the deployment reached READY and to read its build logs if it failed - do not report a deployment as live until you've seen it succeed.
 - Tool results are the only source of truth about what happened. A failed result (non-2xx status, non-zero exit code, "did not apply") means it did not happen - never describe it as done.
 - Creating a remote repo, pushing code, enabling Pages, or deploying anything are exactly the kind of claim covered by "never report success you did not verify" above - and the easiest one to get wrong, because each step's own command can silently no-op or partially fail while a LATER step still appears to succeed. Concretely: run whoami equivalents (gh api user, gh auth status) to get the real signed-in username BEFORE building any URL with it - never guess a username from the OS account name, the folder name, or anything the user said earlier that could be stale; after gh repo create or git push, treat the command's own exit code and printed output as the only source of truth for whether it worked, not your prior turn's summary of what you intended to do - a command you ran two turns ago having succeeded is not evidence this turn's retry did too; and never hand the user a repository/deployment URL you have not just confirmed resolves (curl -I it, or read it back from the command's own output) - a plausible-looking URL built from a guessed username/slug is a fabrication even if the pattern is usually right.
-- gmail_send and slack_post_message send a real email or a real Slack message the moment they run - there is no draft state, no "preview" mode. Only use them when the user actually asked for that email/message to go out, never speculatively, never as a way to "show" them what it would say. If gmail_search or a prior message makes clear Gmail/Slack isn't connected, say so plainly and stop - do not retry hoping it connects itself, and do not claim you sent something when the tool reported it wasn't connected.
+- gmail_send and slack_post_message send a real email or a real Slack message the moment they run - there is no "preview" mode. Only use them when the user actually asked for that email/message to go out, never speculatively, never as a way to "show" them what it would say. When the user wants an email written but not sent yet, use gmail_draft instead. The user sees the email on an editable card before it goes out and may change it: the tool result says what was really sent or saved, so report that, not your original wording. calendar_add likewise puts a real event on the user's Google Calendar: only when they asked for it, with times in their local time; check calendar_list first when they ask what is on their calendar or whether a time is free. If gmail_search or a prior message makes clear Gmail/Slack isn't connected, say so plainly and stop - do not retry hoping it connects itself, and do not claim you sent something when the tool reported it wasn't connected.
 - vercel_deploy, supabase_create_project, supabase_delete_project, and github_create_repo are the same category as gmail_send/slack_post_message above: real, immediate action the moment they run - a live production deployment, a newly provisioned cloud database with its own bill, a brand-new repository pushed with the user's code. Only use them when the user actually asked for that outcome, never speculatively "to check if it would work." If one reports its integration isn't connected, say so plainly and stop rather than retrying or working around it. supabase_delete_project is the sharpest of these - it permanently destroys a database with no undo - so only reach for it when the user has clearly asked to delete or remove a specific project, never as cleanup for something that merely looks unused.
-- Every image in generated markup must be a local file, downloaded with fetch_image. NEVER write an <img> or CSS background-image pointing straight at loremflickr.com, picsum.photos, or any other live generator URL - those are redirect services that return a DIFFERENT random photo on every single request, so the page shows a different (sometimes completely unrelated) image on every reload, every redeploy, every visitor. Always fetch_image the URL to a real path under assets/ first, then reference that local path in the markup. If the user hasn't given you specific photos and the site needs placeholder imagery, fetch_image from https://loremflickr.com/<width>/<height>/<keyword1>,<keyword2> - it pulls a real tagged photo matching those keywords, no API key needed. Pick keywords that actually describe THAT section's subject (a tea shop's hero: 'tea,leaves' or 'matcha,ceremony', not generic filler) - never use a source that returns fully random, unrelated stock photos (e.g. picsum.photos) on a themed site; a beach or a crowd photo under a tea brand's "Our Heritage" section is worse than no image. If a downloaded placeholder turns out to be a broken/static-noise "no match" image or is visibly unrelated to its section once you look at the page, delete it and fetch_image again with more specific keywords - do not leave a wrong or corrupted image in place.
+- Images: build without photos first. Most pages look great with type, color, layout, CSS shapes, icons and inline SVG, so do that unless the design truly needs a photo (a restaurant's food, a product shot, a portfolio). Never ask the user for images or how imagery should work; decide yourself. When a photo is genuinely needed, find a real one with image_search (it searches the whole web like Google Images), pick the result that fits that exact section, and download it with fetch_image to a path under assets/. Every image in the markup must be that local file: never point an <img> or CSS background at a remote URL, and never use loremflickr, picsum or other random-photo services. If a downloaded image turns out broken or unrelated once you look at the page, delete it and pick another result.
 - If a SKILLS entry below is a clear match for the task, use_skill it before starting - its instructions take priority over your own default approach for that kind of work. Do not use_skill speculatively; only when a listed skill actually matches what you are about to do. A name under LIKELY RELEVANT TO THIS REQUEST, if that section is present, was matched against your actual request from the full library - treat it exactly the same way: use_skill it before starting unless it's obviously a false match, do not silently ignore it in favor of guessing your own approach.
 - EXCEPTION - this one is not speculative: if the task is to build or restyle any page a human will look at in a browser (a landing page, a small-business site, a portfolio, a dashboard, any HTML/CSS/UI), use_skill 'premium-web-design' before writing markup, even if the brief sounds tiny or mundane ("a site for a tea shop"). A plain-sounding brief is not permission for a flat, default-Bootstrap-looking result - Codeply's bar is that every generated page reads as deliberately designed. Skip this only if the user explicitly asked for something minimal/utilitarian/no-frills.
 - EXCEPTION - this one is MANDATORY, not speculative, and comes before you write any markup for that same kind of task (a page or app screen a human will look at): call design_reference_search on the core screen(s) the app needs (an onboarding flow, a checkout, a settings screen, a to-do list's main view - whatever the brief actually calls for) before designing it from memory. It is a local library (no external account, no login, no network dependency) so it is always available - do not skip this step, and do not substitute your own guess at what that kind of screen "usually" looks like. Real shipped apps solve layout/hierarchy/empty-state problems in ways worth matching, not just imitating the vibe of. Only if it reports the library itself is missing on this machine should you say that plainly to the user once and continue from your own judgment.
@@ -1054,9 +1155,9 @@ function connectedServicesSection() {
   describe('supabase', 'Supabase', 'full Management API via supabase_api, SQL via supabase_sql');
   describe('vercel', 'Vercel', [vercelUser, 'full REST API via vercel_api'].filter(Boolean).join(' - '));
   describe('github', 'GitHub', githubUser);
-  describe('gmail', 'Gmail', gmailUser);
+  describe('gmail', 'Gmail and Google Calendar', [gmailUser, 'drafts via gmail_draft, calendar via calendar_list/calendar_add'].filter(Boolean).join(' - '));
   describe('slack', 'Slack', '');
-  return `CONNECTED SERVICES\n${lines.join('\n')}\nA service marked "not connected" cannot be used - tell the user to connect it from Connect Apps rather than attempting it.`;
+  return `CONNECTED SERVICES\n${lines.join('\n')}\nA service marked "not connected" cannot be used - tell the user to connect it from Connect Apps rather than attempting it. While publishing, call publish_connect instead: it lets the user connect in one click and waits.`;
 }
 
 const ROLE_INTRO = (role) =>
@@ -1328,7 +1429,7 @@ const NO_NATIVE_TOOLS_REMINDER =
 // unless their entry says toolMode: 'text', or CODEPLY_TOOLS=text is set.
 // A model that rejects tools is remembered for the rest of the session.
 const nativeUnsupported = new Set();
-const MUTATING_ACTIONS = new Set(['write_file', 'edit_file', 'apply_patch', 'fetch_image', 'gmail_send', 'slack_post_message', 'vercel_deploy', 'supabase_create_project', 'supabase_delete_project', 'github_create_repo']);
+const MUTATING_ACTIONS = new Set(['write_file', 'edit_file', 'apply_patch', 'fetch_image', 'gmail_send', 'gmail_draft', 'calendar_add', 'slack_post_message', 'vercel_deploy', 'supabase_create_project', 'supabase_delete_project', 'github_create_repo', 'supabase_setup', 'supabase_schema', 'publish_deploy', 'publish_github']);
 
 /**
  * Native function names for MCP tools (mcp__server__tool, within the 64-char
@@ -1396,6 +1497,13 @@ function withoutEmDashes(text) {
 
 // ─── Loop ───────────────────────────────────────────────────────────────────
 
+// Thinking models (DeepSeek V4 and later) refuse the next step of a tool run
+// unless each assistant turn carries its own reasoning back. ai.js only sends
+// the field to providers that want it.
+function withReasoning(msg, reasoning) {
+  return reasoning && reasoning.trim() ? { ...msg, reasoning_content: reasoning } : msg;
+}
+
 /**
  * Run one user turn to completion.
  *
@@ -1428,7 +1536,7 @@ function withoutEmDashes(text) {
  *                                  "claims an edit it didn't make this turn" check is skipped.
  * @yields {{type:string, ...}} text | reasoning | tool_start | tool_end | done | error | aborted
  */
-export async function* runAgent({ userMessage, history, mode, cwd, approve, browser, images, signal, route, roleId, goal, maxSteps, verifyOnly, botPrompt, askBot }) {
+export async function* runAgent({ userMessage, history, mode, cwd, approve, browser, images, signal, route, roleId, goal, maxSteps, verifyOnly, botPrompt, askBot, botId }) {
   let readOnly = READ_ONLY_MODES.has(mode);
   const stepBudget = Math.max(1, maxSteps || MAX_STEPS);
   // OpenAI-shaped content array only when there's actually an image to carry -
@@ -1456,6 +1564,7 @@ export async function* runAgent({ userMessage, history, mode, cwd, approve, brow
       if (n === 'plan_exit') return m === 'Plan';
       if (n === 'plan_enter') return m === 'Build';
       if (n === 'ask_bot') return typeof askBot === 'function';
+      if (n === 'reach_me' || n === 'watch_email') return reachLib.available();
       if (ro && MUTATING_ACTIONS.has(n)) return m === 'Plan' && (n === 'write_file' || n === 'edit_file');
       return true;
     });
@@ -1469,7 +1578,8 @@ export async function* runAgent({ userMessage, history, mode, cwd, approve, brow
   ];
 
   // fileState: path -> mtime when this turn last read/wrote it (see tools.mjs).
-  const ctx = { cwd, approve, browser, signal, mode, route, fileState: new Map(), ask: typeof approve?.ask === 'function' ? approve.ask : null, askBot: typeof askBot === 'function' ? askBot : null };
+  // userMessage lets the publish tools refuse when nobody asked to publish.
+  const ctx = { cwd, approve, browser, signal, mode, route, userMessage, fileState: new Map(), ask: typeof approve?.ask === 'function' ? approve.ask : null, askBot: typeof askBot === 'function' ? askBot : null, botId: botId || null };
   const recentCallKeys = [];      // executed calls, in order, for the stuck-loop guard
   const lastResultFor = new Map(); // call key -> its most recent result
   const transcript = [{ role: 'user', content: userMessage }];
@@ -1573,7 +1683,6 @@ export async function* runAgent({ userMessage, history, mode, cwd, approve, brow
       // wrong entries now. They are only shortcuts; starting them over is safe.
       servedCalls.clear();
       readIndexByPath.clear();
-      yield { type: 'notice', level: 'info', text: 'Summarized earlier steps of this task to make room.' };
       outgoing = trimTranscript(messages, budget);
     }
     if (outgoing !== messages) {
@@ -1621,7 +1730,7 @@ export async function* runAgent({ userMessage, history, mode, cwd, approve, brow
     // `reply` and not shown inline - so the UI can offer it as an optional,
     // collapsed "thought for Xs" the user opens on demand instead of dumping
     // raw reasoning into the chat unconditionally.
-    const reasoning = result.data?.choices?.[0]?.message?.reasoning || '';
+    const reasoning = result.data?.choices?.[0]?.message?.reasoning || result.data?.choices?.[0]?.message?.reasoning_content || '';
     if (reasoning.trim()) {
       yield { type: 'reasoning', text: reasoning.trim(), ms: stepMs };
     }
@@ -1633,7 +1742,7 @@ export async function* runAgent({ userMessage, history, mode, cwd, approve, brow
       const conv = toolCallsToTags(reply, replyMsg.tool_calls, PARAMS, mcpNames.fromNative);
       reply = conv.text;
       if (conv.problems.length && !reply.includes('<codeply:')) {
-        messages.push({ role: 'assistant', content: reply || '(tool call)' });
+        messages.push(withReasoning({ role: 'assistant', content: reply || '(tool call)' }, reasoning));
         messages.push({ role: 'user', content: `[system] Your tool call could not be run: ${conv.problems.join('; ')}. Call one of the provided tools with valid arguments.` });
         continue;
       }
@@ -1664,7 +1773,7 @@ export async function* runAgent({ userMessage, history, mode, cwd, approve, brow
     // was written blind, before any result, and leaving it in the history
     // teaches the model to treat its own guesses as things that happened.
     const lastEnd = toRun.length ? toRun[toRun.length - 1].end : undefined;
-    messages.push({ role: 'assistant', content: typeof lastEnd === 'number' ? reply.slice(0, lastEnd) : reply });
+    messages.push(withReasoning({ role: 'assistant', content: typeof lastEnd === 'number' ? reply.slice(0, lastEnd) : reply }, reasoning));
 
     if (calls.length === 0) {
       // Protocol debris first: a truncated or malformed reply's raw text is