neoagent 2.5.2-beta.20 → 2.5.2-beta.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.5.2-beta.20",
+  "version": "2.5.2-beta.22",
   "description": "Proactive personal AI agent with no limits",
   "license": "AGPL-3.0-only",
   "main": "server/index.js",

package/server/public/.last_build_id

@@ -1 +1 @@
-efe2ad6d1aff0358de22202a239e2829
+7b68be842f70ebca5228682c4fe3dc90

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"77e2e94772b6eb43759e34ed1ad7da4674e19c
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "2093031085" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "1027370389" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });

package/server/public/main.dart.js

@@ -134794,7 +134794,7 @@ r===$&&A.b()
 p.push(A.jP(q,A.j9(!1,new A.a_(B.uG,A.d8(new A.cA(B.jt,new A.a7N(r,q),q),q,q),q),!1,B.H,!0),q,q,0,0,0,q))}r=!1
 if(!s.ay)if(!s.ch){r=s.e
 r===$&&A.b()
-r=B.b.u("mqgmwb41-5bb5db5").length!==0&&r.b}if(r){r=s.d
+r=B.b.u("mqgt278r-971ca3d").length!==0&&r.b}if(r){r=s.d
 r===$&&A.b()
 r=r.aP&&!r.ai?84:0
 s=s.e
@@ -140506,7 +140506,7 @@ $S:0}
 A.a_6.prototype={}
 A.SQ.prototype={
 nb(a){var s=this
-if(B.b.u("mqgmwb41-5bb5db5").length===0||s.a!=null)return
+if(B.b.u("mqgt278r-971ca3d").length===0||s.a!=null)return
 s.AU()
 s.a=A.on(B.RH,new A.bc8(s))},
 AU(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f
@@ -140524,7 +140524,7 @@ if(!t.f.b(k)){s=1
 break}i=J.a3(k,"buildId")
 h=i==null?null:B.b.u(J.p(i))
 j=h==null?"":h
-if(J.bi(j)===0||J.d(j,"mqgmwb41-5bb5db5")){s=1
+if(J.bi(j)===0||J.d(j,"mqgt278r-971ca3d")){s=1
 break}n.b=!0
 n.F()
 p=2
@@ -140541,7 +140541,7 @@ case 2:return A.i(o.at(-1),r)}})
 return A.k($async$AU,r)},
 vE(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f,e,d,c,b,a,a0,a1
 var $async$vE=A.h(function(a2,a3){if(a2===1){o.push(a3)
-s=p}for(;;)switch(s){case 0:if(B.b.u("mqgmwb41-5bb5db5").length===0||n.c){s=1
+s=p}for(;;)switch(s){case 0:if(B.b.u("mqgt278r-971ca3d").length===0||n.c){s=1
 break}n.c=!0
 n.F()
 p=4

package/server/services/ai/loop/conversation_loop.js

@@ -132,6 +132,8 @@ const {
   clampRunContext,
   joinSentMessages,
   buildBlankMessagingReplyPrompt,
+  buildMaxIterationWrapupPrompt,
+  buildProgressUpdatePrompt,
   buildDeterministicMessagingFallback,
   buildMessagingFailureScenario,
   buildDeterministicMessagingErrorReply,
@@ -246,6 +248,33 @@ function fingerprintOutput(toolName, result, toolArgs = {}) {
   return h >>> 0;
 }
 
+// Concise list of files/targets the run has already read or searched, so the
+// analysis-paralysis nudge can name them and tell the model not to re-read them.
+function summarizeReadTargets(toolExecutions = []) {
+  const targets = [];
+  const seen = new Set();
+  for (const item of toolExecutions) {
+    if (!item || item.stateChanged) continue; // only read-only steps
+    const input = item.input || {};
+    let target = '';
+    if (typeof input.path === 'string' && input.path.trim()) {
+      target = input.path.trim();
+    } else if (typeof input.command === 'string') {
+      const files = input.command.match(/[\w./-]+\.(?:js|ts|tsx|jsx|py|dart|json|md|kt|c|h|ya?ml|sql|txt|sh)\b/g);
+      if (files && files.length) target = [...new Set(files)].slice(0, 2).join(', ');
+    } else if (typeof input.query === 'string' && input.query.trim()) {
+      target = `search:${input.query.trim().slice(0, 30)}`;
+    }
+    if (!target) continue;
+    const key = target.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    targets.push(target);
+    if (targets.length >= 8) break;
+  }
+  return targets.join('; ');
+}
+
 function cloneInterimHistory(history = []) {
   if (!Array.isArray(history)) return [];
   return history.map((item) => ({
@@ -775,6 +804,56 @@ async function runConversation(engine, userId, userMessage, options = {}, _model
   let compactionMetrics = [];
   let analysis = null;
   let plan = null;
+
+  // Model-authored progress updates: the messaging supervisor calls this to get a
+  // dynamic "what I'm doing right now" line instead of a hard-coded string. It runs
+  // a tiny tool-less model call over the current run activity. `provider`/`model` are
+  // `let` (closure tracks fallbacks) and `toolExecutions` is push-only.
+  if (triggerSource === 'messaging') {
+    const runMetaForCompose = engine.getRunMeta(runId);
+    if (runMetaForCompose) {
+      runMetaForCompose.composeProgressUpdate = async ({ stalled = false } = {}) => {
+        try {
+          const rm = engine.getRunMeta(runId);
+          const ledger = rm?.progressLedger || {};
+          // Real, specific evidence (actual commands + their output) so the update is
+          // grounded in what happened, not invented. Bare tool names make a weak model
+          // confabulate generic activity ("running the build", "training").
+          const recent = summarizeToolExecutions(toolExecutions, 5) || '(no tool activity yet)';
+          const priorUpdate = String(rm?.lastInterimMessage || '').trim();
+          const contextBlock = [
+            buildProgressUpdatePrompt(),
+            stalled ? 'This step has been running a while with no new progress; reassure the user you are still on it.' : '',
+            '',
+            `Original request: ${summarizeForLog(userMessage, 320)}`,
+            `Doing now: ${ledger.currentTool ? `using ${ledger.currentTool}` : (ledger.currentPhase || 'thinking')}`,
+            `Actual recent tool activity (newest last) — describe ONLY this, do not extrapolate:\n${recent}`,
+            priorUpdate ? `Your previous update (say something different): ${summarizeForLog(priorUpdate, 160)}` : '',
+          ].filter(Boolean).join('\n');
+          // Reuse the run's real system prompt so the update follows the same voice and
+          // formatting guidelines as every other message (single source of truth).
+          const sysContent = [systemPrompt?.stable, systemPrompt?.dynamic].filter(Boolean).join('\n\n')
+            || 'You are a helpful assistant.';
+          const resp = await withModelCallTimeout(
+            provider.chat(
+              [
+                { role: 'system', content: sysContent },
+                { role: 'user', content: contextBlock },
+              ],
+              [],
+              { model, reasoningEffort: engine.getReasoningEffort(providerName, options) },
+            ),
+            options,
+            'Progress update compose',
+          );
+          return sanitizeModelOutput(resp.content || '', { model });
+        } catch (composeErr) {
+          console.warn(`[Run ${shortenRunId(runId)}] progress_update_compose failed: ${summarizeForLog(composeErr?.message || composeErr, 140)}`);
+          return '';
+        }
+      };
+    }
+  }
   let verification = null;
   let deliverableWorkflow = null;
   let deliverablePlan = null;
@@ -1073,9 +1152,17 @@ async function runConversation(engine, userId, userMessage, options = {}, _model
         const readOnlyCount = engine.getRunMeta(runId)?.consecutiveReadOnlyIterations || 0;
         if (readOnlyCount >= 3) {
           const urgency = readOnlyCount >= 6 ? 'CRITICAL' : 'ACTION REQUIRED';
+          const alreadyRead = summarizeReadTargets(toolExecutions);
           messages.push({
             role: 'system',
-            content: `${urgency} — ${readOnlyCount} consecutive read-only turns: You have been gathering information for ${readOnlyCount} turns without implementation progress such as writing, editing, creating a branch, running verification, or delivering a final/blocker. Switch method now: establish or reuse a writable checkout, create a task branch, edit files, run verification, open/update a PR, or call task_complete with the real blocker. If the user has been waiting, send one concise interim update, but that does not satisfy the method switch. Do not do more remote tree/list/content scraping first. Do not assume tool results exist at /tmp paths unless a tool explicitly returned that readable path.`,
+            content: [
+              `${urgency} — ${readOnlyCount} consecutive read-only turns with no concrete action.`,
+              alreadyRead
+                ? `You have ALREADY read/searched: ${alreadyRead}. Their output is in this conversation above — do not read or search them again; re-reading what you already have is the main way runs stall.`
+                : 'Do not re-read or re-search anything already in this conversation.',
+              'Act on what you already know now: edit files, run a state-changing command, create the branch/PR, or send the result.',
+              'If you genuinely cannot proceed, call task_complete with your best answer or a concrete blocker. Deciding to finish is a valid action; continuing to gather is not.',
+            ].join(' '),
           });
         }
       }
@@ -1847,6 +1934,54 @@ async function runConversation(engine, userId, userMessage, options = {}, _model
     const messagingSent = runMeta?.messagingSent || false;
     const lastToolWasMessaging = runMeta?.lastToolName === 'send_message' || runMeta?.lastToolName === 'make_call';
 
+    // Hermes _handle_max_iterations: if the run exhausted its step budget without a
+    // judged completion, the model's last text is usually a mid-thought fragment
+    // ("let me inline everything:"). Do one tool-less wrap-up call so the user gets a
+    // real final answer instead of that fragment.
+    const budgetExhaustedWithoutCompletion = triggerSource === 'messaging'
+      && !directAnswerEligible
+      && !messagingSent
+      && !runMeta?.terminalInterim
+      && iteration >= maxIterations;
+    if (budgetExhaustedWithoutCompletion) {
+      console.warn(`[Run ${shortenRunId(runId)}] max_iteration_wrapup model=${model} iteration=${iteration}/${maxIterations}`);
+      try {
+        const wrapResponse = await withModelCallTimeout(
+          provider.chat(
+            sanitizeConversationMessages([
+              ...messages,
+              { role: 'system', content: buildMaxIterationWrapupPrompt(options?.source || null) },
+            ]),
+            [],
+            { model, reasoningEffort: engine.getReasoningEffort(providerName, options) },
+          ),
+          options,
+          'Max-iteration wrap-up',
+        );
+        totalTokens += wrapResponse.usage?.totalTokens || 0;
+        const wrapText = sanitizeModelOutput(wrapResponse.content || '', { model });
+        // On budget exhaustion the model's last text is an untrustworthy mid-thought
+        // fragment. Replace it with the wrap-up answer, or a clean deterministic
+        // fallback if the wrap-up came back empty — never deliver the fragment.
+        const usableWrap = normalizeOutgoingMessage(wrapText, options?.source || null);
+        lastContent = usableWrap
+          ? wrapText
+          : buildDeterministicMessagingFallback({ failedStepCount, stepIndex, toolExecutions });
+        messages.push({ role: 'assistant', content: lastContent });
+        if (conversationId) {
+          db.prepare('INSERT INTO conversation_messages (conversation_id, role, content, tokens) VALUES (?, ?, ?, ?)')
+            .run(conversationId, 'assistant', lastContent, usableWrap ? (wrapResponse.usage?.totalTokens || 0) : 0);
+        }
+        engine.recordRunEvent(userId, runId, 'max_iteration_wrapup_delivered', {
+          iteration, maxIterations, stepIndex, source: usableWrap ? 'model' : 'deterministic',
+        }, { agentId });
+      } catch (wrapErr) {
+        console.warn(`[Run ${shortenRunId(runId)}] max_iteration_wrapup failed: ${summarizeForLog(wrapErr?.message || wrapErr, 180)}`);
+        lastContent = buildDeterministicMessagingFallback({ failedStepCount, stepIndex, toolExecutions });
+        messages.push({ role: 'assistant', content: lastContent });
+      }
+    }
+
     if (triggerSource === 'messaging' && !normalizeOutgoingMessage(lastContent, options?.source || null) && !messagingSent) {
       // Simplified blank reply recovery: one model call with direct instruction,
       // then fall back to a deterministic message. No multi-attempt LLM loop.
@@ -1877,48 +2012,24 @@ async function runConversation(engine, userId, userMessage, options = {}, _model
         console.warn(`[Run ${shortenRunId(runId)}] blank_reply_recovery failed: ${summarizeForLog(recoverErr?.message || recoverErr, 180)}`);
       }
       totalTokens += recoveredTokens;
-      if (!normalizeOutgoingMessage(lastContent, options?.source || null)) {
+      // The loop has already exited, so we cannot keep working: deliver the model's
+      // own wrap-up (it summarizes what it tried / where it got blocked from the run
+      // evidence) instead of second-guessing it into a generic blob. Only fall back to
+      // a deterministic message when the model returned nothing usable.
+      const recoveredVisible = Boolean(normalizeOutgoingMessage(lastContent, options?.source || null));
+      if (!recoveredVisible) {
         lastContent = buildDeterministicMessagingFallback({ failedStepCount, stepIndex, toolExecutions });
       }
       if (normalizeOutgoingMessage(lastContent, options?.source || null)) {
-        const recoveryDecision = await engine.decideLoopState({
-          provider,
-          providerName,
-          model,
-          messages,
-          analysis,
-          plan,
-          tools,
-          toolExecutions,
-          lastReply: lastContent,
-          iteration,
-          maxIterations,
-          options: { ...options, triggerSource, runId, userId, agentId },
-          messagingSent: false,
-        });
-        totalTokens += recoveryDecision.usage || 0;
-        engine.recordRunEvent(userId, runId, 'blank_reply_recovery_checked', {
-          status: recoveryDecision.decision.status,
-          reason: recoveryDecision.decision.reason,
+        engine.recordRunEvent(userId, runId, 'blank_reply_recovery_delivered', {
+          source: recoveredVisible ? 'model' : 'deterministic',
+          stepIndex,
+          failedStepCount,
         }, { agentId });
-        if (recoveryDecision.decision.status === 'continue') {
-          engine.recordRunEvent(userId, runId, 'blank_reply_recovery_blocker_used', {
-            reason: recoveryDecision.decision.reason,
-            stepIndex,
-            failedStepCount,
-          }, { agentId });
-          lastContent = buildDeterministicMessagingFallback({ failedStepCount, stepIndex, toolExecutions });
-          messages.push({ role: 'assistant', content: lastContent });
-          if (conversationId) {
-            db.prepare('INSERT INTO conversation_messages (conversation_id, role, content, tokens) VALUES (?, ?, ?, ?)')
-              .run(conversationId, 'assistant', lastContent, 0);
-          }
-        } else {
-          messages.push({ role: 'assistant', content: lastContent });
-          if (conversationId) {
-            db.prepare('INSERT INTO conversation_messages (conversation_id, role, content, tokens) VALUES (?, ?, ?, ?)')
-              .run(conversationId, 'assistant', lastContent, recoveredTokens);
-          }
+        messages.push({ role: 'assistant', content: lastContent });
+        if (conversationId) {
+          db.prepare('INSERT INTO conversation_messages (conversation_id, role, content, tokens) VALUES (?, ?, ?, ?)')
+            .run(conversationId, 'assistant', lastContent, recoveredVisible ? recoveredTokens : 0);
         }
       }
     }

package/server/services/ai/loop/messaging_delivery.js

@@ -42,6 +42,12 @@ function requireSuccessfulMessagingDelivery(result, label = 'Messaging delivery'
   throw error;
 }
 
+// Harness-driven progress: the originating chat must see autonomous updates during
+// long runs even when a weak model never calls send_interim_update itself. The
+// supervisor paces this call (FIRST/REPEAT thresholds + a repeat guard). The update
+// text is always authored by the run's own agent loop (composeProgressUpdate); we
+// never emit a hard-coded status line. If the loop can't compose one this tick, we
+// skip the visible send and only nudge the model, then try again next tick.
 async function sendRuntimeMessagingHeartbeat(engine, runId, options = {}) {
   const runMeta = engine.getRunMeta(runId);
   if (!runMeta || runMeta.aborted) return { sent: false, skipped: true };
@@ -54,6 +60,46 @@ async function sendRuntimeMessagingHeartbeat(engine, runId, options = {}) {
   engine.updateRunProgress(runId, { heartbeatCount });
 
   const ledger = runMeta.progressLedger || {};
+  const { platform, chatId } = runMeta.messagingContext || {};
+
+  if (engine.messagingManager && !runMeta.terminalInterim && platform && chatId
+    && typeof runMeta.composeProgressUpdate === 'function') {
+    let statusMsg = '';
+    try {
+      const composed = await runMeta.composeProgressUpdate({ stalled: options.stalled === true });
+      if (normalizeOutgoingMessage(composed, platform)) statusMsg = String(composed).trim();
+    } catch { /* no dynamic update available this tick */ }
+    if (statusMsg) try {
+      const delivery = await engine.messagingManager.sendMessage(runMeta.userId, platform, chatId, statusMsg, {
+        runId,
+        agentId: runMeta.agentId,
+      });
+      if (delivery?.success === true && delivery?.suppressed !== true) {
+        const nowIso = isoNow();
+        runMeta.progressLedger = { ...ledger, lastUserVisibleUpdateAt: nowIso };
+        runMeta.lastInterimMessage = statusMsg;
+        engine.updateRunProgress(runId, { lastUserVisibleUpdateAt: nowIso });
+        engine.recordRunEvent(runMeta.userId, runId, 'progress_heartbeat_sent', {
+          stalled: options.stalled === true,
+          currentTool: ledger.currentTool || null,
+          currentStep: ledger.currentStep || null,
+          phase: ledger.currentPhase || 'idle',
+          userVisible: true,
+          createdAt,
+        }, { agentId: runMeta.agentId });
+        // Still nudge the model so its next turn can deliver a richer, real update.
+        engine.enqueueSystemSteering(
+          runId,
+          buildProgressNudge({ stalled: options.stalled === true }),
+          { reason: options.stalled === true ? 'stalled_progress_check' : 'progress_check' },
+        );
+        return { sent: true, heartbeat: true };
+      }
+    } catch (err) {
+      console.warn('[Engine] Progress heartbeat send failed:', err?.message || err);
+    }
+  }
+
   engine.recordRunEvent(runMeta.userId, runId, 'progress_heartbeat_sent', {
     stalled: options.stalled === true,
     currentTool: ledger.currentTool || null,

package/server/services/ai/loop/progress_monitor.js

@@ -1,8 +1,8 @@
 'use strict';
 
-const FIRST_UPDATE_MS = 60 * 1000;
-const REPEAT_UPDATE_MS = 90 * 1000;
-const STALL_MS = 240 * 1000;
+const FIRST_UPDATE_MS = 35 * 1000;
+const REPEAT_UPDATE_MS = 75 * 1000;
+const STALL_MS = 150 * 1000;
 const TICK_MS = 15 * 1000;
 
 function isoNow() {

package/server/services/ai/loopPolicy.js

@@ -14,15 +14,24 @@
  * numbers only fire when something goes wrong.
  */
 
-const DEFAULT_MAX_ITERATIONS = 40;
-const DEFAULT_WIDGET_MAX_ITERATIONS = 30;
-const DEFAULT_PLAN_EXECUTE_MAX_ITERATIONS = 80;
-const DEFAULT_COMPACTION_THRESHOLD = 0.60;
+// The iteration count is intentionally NOT a real limit: the agent runs until it
+// signals completion (task_complete / judged terminal), an external blocker, or a
+// genuine stuck-state guard fires (consecutive tool failures, repetition guard,
+// model-failure recoveries). This number only exists so arithmetic/logging have a
+// finite sentinel; it is set far above any real task length so it never cuts a run.
+const UNLIMITED_ITERATIONS = 1_000_000;
+
+const DEFAULT_MAX_ITERATIONS = UNLIMITED_ITERATIONS;
+const DEFAULT_WIDGET_MAX_ITERATIONS = UNLIMITED_ITERATIONS;
+const DEFAULT_PLAN_EXECUTE_MAX_ITERATIONS = UNLIMITED_ITERATIONS;
+// Less aggressive than 0.60 so the model retains file contents it already read for
+// longer, instead of losing them to compaction and re-reading the same files.
+const DEFAULT_COMPACTION_THRESHOLD = 0.80;
 const DEFAULT_MAX_CONSECUTIVE_TOOL_FAILURES = 5;
 const DEFAULT_MAX_MODEL_FAILURE_RECOVERIES = 3;
 
-// Hard ceilings — protect against runaway config values
-const MAX_ALLOWED_ITERATIONS = 200;
+// Hard ceiling — only guards against absurd/overflow config values, not task length.
+const MAX_ALLOWED_ITERATIONS = UNLIMITED_ITERATIONS;
 const MAX_ALLOWED_TOOL_FAILURES = 50;
 const MAX_ALLOWED_MODEL_RECOVERIES = 10;
 const MAX_ALLOWED_BUDGET_CHARS = 500_000;

package/server/services/ai/messagingFallback.js

@@ -49,6 +49,25 @@ function buildBlankMessagingReplyPrompt(attempt, platform = null) {
   return `Your previous reply was empty. Return one non-empty message now. Do not call tools. If needed, apologize briefly and explain the blocker in one sentence. Use the run evidence already in the conversation instead of asking the user to restate the task. Do not promise future work unless that work already happened in this run or will happen automatically before this reply is sent.\n\n${formattingGuide}`;
 }
 
+function buildProgressUpdatePrompt() {
+  // Intentionally carries NO voice/formatting rules of its own: this prompt runs with
+  // the run's real system prompt as context, so the update inherits the same voice and
+  // formatting guidelines as every other message and stays maintainable in one place.
+  return [
+    'You are mid-task and working autonomously while the user waits.',
+    'Send ONE brief progress ping saying what you are doing right now, grounded ONLY in the actual recent tool activity below.',
+    'Describe what the evidence literally shows (e.g. reading files, searching the repo, cloning, editing). Do NOT invent or guess steps, and never mention builds, compiling, gradle, tests, training, models, evaluation, pipelines, batch jobs, or deployments unless they actually appear in the activity.',
+    'This is not the final answer: do not claim the task is done and do not summarize results.',
+    'No greeting, no question, no sign-off; vary the wording from your previous update.',
+    'Follow your normal voice and formatting rules. Output only the message text.',
+  ].join(' ');
+}
+
+function buildMaxIterationWrapupPrompt(platform = null) {
+  const formattingGuide = buildPlatformFormattingGuide(platform);
+  return `You have reached the step limit for this run, so this is your final turn. Stop here and do NOT call any tools. Write the single best, most complete answer you can for the user from the work already done in this conversation: lead with the concrete results and what you accomplished, then clearly name anything you could not finish and the specific blocker. Do not output a half-finished thought, a plan for what to do next, or a "let me…" fragment, this message is the final reply. Do not promise future work unless it already happened in this run.\n\n${formattingGuide}`;
+}
+
 function parseToolExecutionSummary(item) {
   if (!item?.summary) return null;
   try {
@@ -216,6 +235,8 @@ module.exports = {
   joinSentMessages,
   normalizeInterimText,
   buildBlankMessagingReplyPrompt,
+  buildMaxIterationWrapupPrompt,
+  buildProgressUpdatePrompt,
   parseToolExecutionSummary,
   toolWorkDescription,
   summarizeRecentWork,

package/server/services/ai/taskAnalysis.js

@@ -82,6 +82,7 @@ const VERIFIER_PROMPT_INSTRUCTIONS = [
 const EXECUTION_GUIDANCE_ACTION_LINES = [
   'Act end-to-end. Run independent searches or inspections in parallel when possible. Prefer native integration tools and structured APIs over browser automation or shell scraping. Use exact IDs and required parameters; list or search first when you do not have them.',
   'For GitHub issue implementation or PR work, fetch the issue once, then establish or reuse a writable local checkout, create a task branch, inspect/edit/test locally, and push/open the PR. Use direct GitHub file mutation tools only as a fallback when a local checkout is unavailable.',
+  'Your shell (execute_command) starts in your workspace, and the file tools (read_file, write_file, list_directory, search_files) operate on that same workspace. Clone or create files into the current directory and then inspect or edit them with either the shell or the file tools interchangeably. Clone a repo once and reuse it; do not re-clone or re-list the same tree.',
   'Tool results are already present in the conversation as tool output. Do not assume a tool result was persisted to a readable /tmp path unless that exact path was explicitly returned by the tool result.',
   'Use send_interim_update sparingly when a short real update or question would help.',
   'When you must ask for missing required user input, ask once, then wait for the reply instead of re-asking in the same run.',

package/server/services/runtime/docker-vm-manager.js

@@ -1,11 +1,25 @@
 'use strict';
 
 const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
 const http = require('http');
 const net = require('net');
+const { AGENT_DATA_DIR } = require('../../../runtime/paths');
+const { sanitizeWorkspaceKey } = require('../workspace/manager');
 
 const CONTAINER_IMAGE = 'mcr.microsoft.com/playwright:v1.44.0-focal';
 const CONTAINER_LABEL = 'neoagent.managed=1';
+// The per-user host workspace is bind-mounted here so the shell (execute_command)
+// and the workspace file tools (read_file/write_file/list_directory/search_files)
+// operate on the SAME files. The guest agent defaults its shell cwd to this path.
+const GUEST_WORKSPACE = '/workspace';
+
+// Host path of a user's workspace — must match WorkspaceManager's layout exactly
+// (AGENT_DATA_DIR/workspaces/<sanitized key>) so both sides see one directory.
+function hostWorkspaceDir(key) {
+  return path.join(AGENT_DATA_DIR, 'workspaces', sanitizeWorkspaceKey(key));
+}
 
 // ─── Guest agent ─────────────────────────────────────────────────────────────
 // Injected into every container. Pure Node.js — only built-in modules + playwright
@@ -104,7 +118,7 @@ const server = http.createServer(async (req, res) => {
     if (req.method === 'POST' && url === '/exec') {
       const timeoutMs = Math.min(Number(b.timeout) || 15 * 60 * 1000, 20 * 60 * 1000);
       const child = spawn('sh', ['-c', b.command || 'true'], {
-        cwd: b.cwd || '/tmp',
+        cwd: b.cwd || '/workspace',
         env: { ...process.env, ...b.env },
       });
       const pid = child.pid;
@@ -325,6 +339,10 @@ class DockerVMManager {
     const port = await findAvailablePort();
     console.log(`[DockerVM:${this.profile}] Starting container for user ${key} on port ${port}`);
 
+    // Bind-mount the user's host workspace so shell and file tools share one place.
+    const workspaceDir = hostWorkspaceDir(key);
+    try { fs.mkdirSync(workspaceDir, { recursive: true }); } catch { /* best effort */ }
+
     const containerId = docker([
       'run', '-d',
       '--memory', `${this.memoryMb}m`,
@@ -334,6 +352,8 @@ class DockerVMManager {
       ...(this.guestToken ? ['-e', `NEOAGENT_VM_GUEST_TOKEN=${this.guestToken}`] : []),
       '--shm-size=2g',
       '--security-opt', 'no-new-privileges',
+      '-v', `${workspaceDir}:${GUEST_WORKSPACE}`,
+      '-w', GUEST_WORKSPACE,
       '--label', CONTAINER_LABEL,
       '--label', `neoagent.profile=${this.profile}`,
       '--label', `neoagent.user=${key}`,

package/server/services/workspace/manager.js

@@ -414,4 +414,5 @@ class WorkspaceManager {
 
 module.exports = {
   WorkspaceManager,
+  sanitizeWorkspaceKey,
 };