symbio 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -5,6 +5,38 @@ versions follow [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.6.0]
+
+- Azure DevOps connections: add an organization with a personal access token in Settings; agents
+  push and pull through it (HTTPS remotes of that organization) and call its REST API with the new
+  `azure_devops_api` tool, e.g. to open pull requests. The token never reaches the agent and only
+  goes to the connection's own organization.
+- Credentials rule clarified: Symbio's own secrets stay off-limits to agents, but a project's own
+  credentials (connection strings, `.env`…) and ones the human gives may be used for the task;
+  agents must not copy them into anything committed or shared, and only read from systems the
+  human calls read-only or production. Agents had refused legitimate work (querying a database
+  with the app's connection string) under the old blanket rule.
+
+## [0.5.0]
+
+- Docs tab: a folder tree instead of a flat list; search across all docs (any case or accent) that
+  opens the doc at the matching line; links and paths in backticks that point to another doc open
+  it, with Back; an "On this page" outline for long docs; .txt sources shown with line numbers.
+- Rules register (optional, per project; on by default for new projects): agents record rules with
+  their sources, literal excerpts, who imposes them, confirmation and status through new tools, and
+  the Docs tab shows them as a filterable index grouped by area and stage. A citation opens its
+  source: a text doc at the cited line, a PDF in a new tab at the cited page.
+- Links in docs to PDFs and images open them in a new tab.
+- `view_image`: agents look at images through a scaled-down copy (or a full-resolution crop);
+  reading image files directly is refused with a message pointing to it, so images can't bloat a
+  conversation.
+- An agent whose conversation becomes too large to send ("Timed out reading request body", often
+  after reading full-size images) continues in a fresh session with a handoff note, instead of
+  Symbio trying every other model.
+- A helper's folder that was deleted outside Symbio is recreated from its branch (committed work
+  kept), and the human and the helper are told.
+- A project reopened from its folder takes the rules register choice made in the New project dialog.
+
 ## [0.4.0]
 
 - Helpers can work in the project folder itself instead of their own copy on a branch: what one

package/README.md

@@ -56,27 +56,36 @@ place. Here Symbio was restarted mid-task, and it told the helper to pick up whe
   existing folder before touching it, and proposes a plan of tasks for you to approve.
 - **Helpers that work in parallel without collisions.** Each helper gets its own git worktree and
   branch, and core reviews and merges their work. For step-by-step work (each step using the
-  previous one's files), helpers can share the project folder instead, with nothing to merge. Helpers are only created when work can really run in
-  parallel; one helper is the default.
+  previous one's files), helpers can share the project folder instead, with nothing to merge.
+  Helpers are only created when work can really run in parallel; one helper is the default.
 - **Agents talk to each other.** Messages go straight from agent to agent through Symbio, and
   delivering a message wakes the recipient. No copy-pasting between terminals.
 - **Shared assets with a gatekeeper.** Anything several agents could change (a file pattern, a
   database, a spreadsheet) can be declared a *shared asset*. Agents request it from core, wait for
   the grant and release it when done. Changes to an asset an agent wasn't granted are flagged at
   merge.
+- **Documentation you can find your way in.** core keeps the project's docs up to date, and the
+  Docs tab shows them as a folder tree with search across every doc, links between docs that open
+  in place, an outline of long docs, and plain-text sources (e-mails, transcripts) with line
+  numbers.
+- **A rules register (optional).** Agents record the project's rules (requirements, decisions,
+  constraints) with where each came from, a literal excerpt, who imposes it, how confirmed it is
+  and whether it's met. The Docs tab shows them as an index you can filter and search, with each
+  citation opening its source at the cited line.
 - **A live plan.** The Plan tab is an animated kanban that moves by itself as helpers pick up
   tasks, ask for review and get merged.
 - **You stay in control.** Questions, plan approvals, permission requests (like installing
   software) and deploy approvals collect in a **Needs you** inbox. Pause one team or everything at
   once.
-- **Connections without exposing secrets.** Give agents a GitHub account or an SSH server. They
-  ask Symbio to push, call the API or deploy, and Symbio does it with credentials the agents never
+- **Connections without exposing secrets.** Give agents a GitHub account, an Azure DevOps
+  organization or an SSH server. They ask Symbio to push, open pull requests, call the API or deploy, and Symbio does it with credentials the agents never
   see. Each connection can require your approval for every action.
 - **Resilient.** A supervisor restarts OpenCode if it crashes, a watchdog unsticks hung agents, and
   when a model fails (quota, outage) the agent switches to the next allowed model and carries on.
 - **Safety rails.** Agents can't kill processes by name (which would take down your terminals and
   editors), can't read your SSH keys or Symbio's secret store, and must ask before installing
-  software.
+  software. They look at images through scaled-down copies, so a few large pictures can't make a
+  conversation too big to send.
 
 ## Requirements
 
@@ -133,7 +142,7 @@ itself. Whoever gets in controls your agents, so keep the link and code to yours
    - **Folder:** browse for or paste a folder. An empty folder starts a new project; an existing
      one is studied first. Symbio offers to set up git if the folder doesn't have it.
    - **Setup:** choose where the project documentation goes (in the project, or private), and which
-     connections (GitHub, servers) the agents may use.
+     connections (GitHub, Azure DevOps, servers) the agents may use.
    - **Models:** pick the models agents may use, and the one core runs on (the crown).
 3. **Talk to core.** Describe what you want. core asks questions, proposes a plan, and waits for
    your approval in the **Plan** tab (it shows a *Review* badge).
@@ -150,7 +159,7 @@ itself. Whoever gets in controls your agents, so keep the link and code to yours
 | **core** | The project's lead agent. It plans, delegates, reviews and merges; it coordinates rather than doing the work itself. |
 | **Helper** | An agent core creates for a piece of work. It works in its own git worktree (branch `symbio/<name>`) or, if the project is set to, in the project folder itself. |
 | **Shared asset** | Something more than one agent could change. Access goes through core: request, grant, release. |
-| **Connection** | A GitHub account or SSH server agents can use through Symbio, without ever seeing its credentials. |
+| **Connection** | A GitHub account, Azure DevOps organization or SSH server agents can use through Symbio, without ever seeing its credentials. |
 | **Allowed models** | The models a project's agents may run on. If one fails, agents fall back to the next. |
 
 ## Where your data lives

package/dist/server/api.js

@@ -9,7 +9,8 @@ import { describeInspection, inspectFolder } from "./inspect.js";
 import { gitAvailable, initRepository } from "./git.js";
 import { pickFolder } from "./folder-picker.js";
 import { beginOauth, cancelOauth, completeOauth, connectWithKey, listProviders, oauthStatus, removeLogin } from "./providers.js";
-import { docsRoot, listDocs, readDoc, writeDoc } from "./docs.js";
+import { docsRoot, listDocs, rawDoc, readDoc, searchDocs, writeDoc } from "./docs.js";
+import { readRegister } from "./rules.js";
 import { PriceBook, projectUsage, resolvePrices } from "./costs.js";
 import { globalDir } from "./store.js";
 // Debug routes pass OpenCode responses through, which can contain provider keys.
@@ -269,6 +270,7 @@ export function createApi(store, runtime, team, connections) {
             allowedModels: allowed,
             coordinatorModel: body.coordinatorModel,
             docsLocation: body.docsLocation === "private" ? "private" : "project",
+            rulesRegister: body.rulesRegister === true,
             origin: inspection.empty ? "new" : "existing",
             inspectionSummary: describeInspection(inspection),
             connections: cleanLinks(body.connections),
@@ -291,6 +293,8 @@ export function createApi(store, runtime, team, connections) {
     api.patch("/projects/:id", async (c) => {
         const project = withProject(c.req.param("id"));
         const body = await c.req.json();
+        if (typeof body.rulesRegister === "boolean")
+            await team.setRulesRegister(project, body.rulesRegister);
         if (body.helperWorkspace === "own" || body.helperWorkspace === "shared")
             await team.setHelperWorkspace(project, body.helperWorkspace);
         if (body.name?.trim())
@@ -360,6 +364,34 @@ export function createApi(store, runtime, team, connections) {
         const project = withProject(c.req.param("id"));
         return c.json({ location: project.docsLocation, root: docsRoot(project), files: await listDocs(project) });
     });
+    api.get("/projects/:id/rules", async (c) => {
+        const project = withProject(c.req.param("id"));
+        return c.json({ enabled: !!project.rulesRegister, ...(await readRegister(project)) });
+    });
+    // Any file in the docs (a PDF cited by a rule, an image), read-only.
+    api.get("/projects/:id/docs/raw", async (c) => {
+        const project = withProject(c.req.param("id"));
+        try {
+            const file = await rawDoc(project, c.req.query("path") ?? "");
+            return new Response(new Uint8Array(file.data), {
+                headers: {
+                    "content-type": file.type,
+                    "content-disposition": `${file.inline ? "inline" : "attachment"}; filename*=UTF-8''${encodeURIComponent(file.name)}`,
+                    "x-content-type-options": "nosniff",
+                    "content-security-policy": "default-src 'none'; img-src 'self' blob: data:; style-src 'unsafe-inline'",
+                },
+            });
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                throw new HttpError(404, "file not found");
+            throw new HttpError(400, err.message);
+        }
+    });
+    api.get("/projects/:id/docs/search", async (c) => {
+        const project = withProject(c.req.param("id"));
+        return c.json(await searchDocs(project, (c.req.query("q") ?? "").slice(0, 200)));
+    });
     api.get("/projects/:id/docs/file", async (c) => {
         const project = withProject(c.req.param("id"));
         const rel = c.req.query("path") ?? "";

package/dist/server/connections.js

@@ -1,14 +1,22 @@
-// Global connections (set once in Settings, used by any project): GitHub accounts
-// and servers reachable over SSH. Public details live in ~/.symbio/connections.json;
-// secrets live in the encrypted vault and are never returned by the API.
+// Global connections (set once in Settings, used by any project): GitHub accounts,
+// Azure DevOps organizations and servers reachable over SSH. Public details live in
+// ~/.symbio/connections.json; secrets live in the encrypted vault and are never
+// returned by the API.
 import { promises as fs, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { SecretVault } from "./secrets.js";
 import { sshExec } from "./ssh.js";
 import { globalDir, newId } from "./store.js";
+/** Organization from what people paste: "org", https://dev.azure.com/org/…, https://org.visualstudio.com/…. */
+export function azureOrganization(value) {
+    const v = value.trim();
+    const m = /^https?:\/\/(?:[^@/]+@)?dev\.azure\.com\/([^/?#]+)/i.exec(v) ?? /^https?:\/\/(?:[^@/]+@)?([^./]+)\.visualstudio\.com/i.exec(v);
+    return decodeURIComponent(m ? m[1] : v.replace(/\/+$/, ""));
+}
 const SECRET_FIELDS = {
     github: ["token"],
+    azure: ["token"],
     server: ["privateKey", "passphrase", "password"],
 };
 export class Connections {
@@ -37,13 +45,15 @@ export class Connections {
         return { ...c, secrets };
     }
     async create(input) {
-        if (input.type !== "github" && input.type !== "server")
-            throw new Error("type must be github or server");
+        if (input.type !== "github" && input.type !== "azure" && input.type !== "server")
+            throw new Error("type must be github, azure or server");
         const now = Date.now();
         const base = { id: newId("con"), name: "", createdAt: now, updatedAt: now, lastTest: null };
         const conn = input.type === "github"
             ? { ...base, type: "github", account: null }
-            : { ...base, type: "server", host: "", port: 22, username: "", auth: "key", keyPath: null };
+            : input.type === "azure"
+                ? { ...base, type: "azure", organization: "", account: null }
+                : { ...base, type: "server", host: "", port: 22, username: "", auth: "key", keyPath: null };
         this.apply(conn, input);
         if (!conn.name)
             throw new Error("Give the connection a name.");
@@ -91,6 +101,14 @@ export class Connections {
                 conn.account = user.login;
                 result = { ok: true, message: `Signed in as ${user.login}${user.name ? ` (${user.name})` : ""}`, time: Date.now() };
             }
+            else if (conn.type === "azure") {
+                const data = await this.azureRequest(conn, "GET", "_apis/connectionData", undefined, "7.1-preview");
+                const user = data?.authenticatedUser;
+                conn.account = user?.providerDisplayName ?? user?.customDisplayName ?? null;
+                const projects = await this.azureRequest(conn, "GET", "_apis/projects").catch(() => null);
+                const count = Array.isArray(projects?.value) ? ` — ${projects.value.length} project(s) visible` : "";
+                result = { ok: true, message: `Signed in to ${conn.organization}${conn.account ? ` as ${conn.account}` : ""}${count}`, time: Date.now() };
+            }
             else {
                 const res = await sshExec(await this.sshTarget(conn), "uname -srm 2>/dev/null || ver", 30_000);
                 const out = (res.stdout || res.stderr).trim().split("\n")[0];
@@ -129,6 +147,40 @@ export class Connections {
         }
         return target;
     }
+    /** Calls the Azure DevOps REST API of the connection's organization with its token. */
+    async azureRequest(conn, method, apiPath, body, apiVersion = "7.1") {
+        const rel = apiPath.trim().replace(/^\/+/, "");
+        if (/^[a-z]+:/i.test(rel))
+            throw new Error("Give a path inside the organization (e.g. MyProject/_apis/git/repositories), not a full URL.");
+        const url = new URL(`https://dev.azure.com/${encodeURIComponent(conn.organization)}/${rel}`);
+        if (!url.searchParams.has("api-version"))
+            url.searchParams.set("api-version", apiVersion);
+        const token = await this.githubToken(conn);
+        const res = await fetch(url, {
+            method,
+            redirect: "manual", // a sign-in redirect means the token was refused
+            headers: {
+                authorization: `Basic ${Buffer.from(`:${token}`).toString("base64")}`,
+                accept: "application/json",
+                "user-agent": "symbio",
+                ...(body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        const text = await res.text();
+        // A rejected token gets a sign-in page (203 or a redirect) rather than a 401.
+        const html = /^\s*</.test(text) || (res.headers.get("content-type") ?? "").includes("text/html");
+        if (res.status === 401 || res.status === 203 || (res.status >= 300 && res.status < 400) || (html && res.ok)) {
+            throw new Error(`Azure DevOps rejected the token for "${conn.organization}" (expired, revoked, or without access to this organization?)`);
+        }
+        const data = text ? safeJson(text) : null;
+        if (!res.ok) {
+            const msg = data?.message ?? res.statusText;
+            throw new Error(`Azure DevOps ${res.status}: ${msg}`);
+        }
+        return data;
+    }
+    /** The stored token of a GitHub or Azure DevOps connection. */
     async githubToken(conn) {
         const token = await this.vault.get(`${conn.id}:token`);
         if (!token)
@@ -159,6 +211,8 @@ export class Connections {
     apply(conn, input) {
         if (input.name !== undefined)
             conn.name = input.name.trim();
+        if (conn.type === "azure" && input.organization !== undefined)
+            conn.organization = azureOrganization(input.organization);
         if (conn.type === "server") {
             if (input.host !== undefined)
                 conn.host = input.host.trim();
@@ -173,6 +227,9 @@ export class Connections {
         }
     }
     validate(conn) {
+        if (conn.type === "azure" && !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$/.test(conn.organization)) {
+            throw new Error("Give the organization, e.g. \"contoso\" or https://dev.azure.com/contoso.");
+        }
         if (conn.type === "server") {
             if (!conn.host)
                 throw new Error("Host is required.");
@@ -189,7 +246,7 @@ export class Connections {
             if (typeof value === "string" && value.trim())
                 await this.vault.set(`${conn.id}:${field}`, value.trim());
         }
-        if (conn.type === "github" && !(await this.vault.has(`${conn.id}:token`)))
+        if ((conn.type === "github" || conn.type === "azure") && !(await this.vault.has(`${conn.id}:token`)))
             throw new Error("The token is required.");
         if (conn.type === "server") {
             if (conn.auth === "password" && !(await this.vault.has(`${conn.id}:password`)))

package/dist/server/docs.js

@@ -44,13 +44,60 @@ export async function listDocs(project) {
 export async function readDoc(project, rel) {
     return fs.readFile(resolveDoc(project, rel), "utf8");
 }
+const MAX_MATCHES = 300;
+const MAX_SEARCH_BYTES = 2_000_000; // per file; larger files are skipped
+/** Case- and accent-insensitive, so "regra" also finds "Regra" and "regrá". */
+const fold = (s) => s.normalize("NFD").replace(/\p{Diacritic}/gu, "").toLowerCase();
+/** Lines containing every word of the query, across all docs. */
+export async function searchDocs(project, query) {
+    const words = fold(query).split(/\s+/).filter(Boolean);
+    if (!words.length)
+        return { matches: [], truncated: false };
+    const matches = [];
+    for (const file of await listDocs(project)) {
+        if (file.size > MAX_SEARCH_BYTES)
+            continue;
+        const lines = (await readDoc(project, file.path).catch(() => "")).split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const hay = fold(lines[i]);
+            if (!words.every((w) => hay.includes(w)))
+                continue;
+            matches.push({ path: file.path, line: i + 1, text: lines[i].trim().slice(0, 300) });
+            if (matches.length >= MAX_MATCHES)
+                return { matches, truncated: true };
+        }
+    }
+    return { matches, truncated: false };
+}
 export async function writeDoc(project, rel, content) {
     const abs = resolveDoc(project, rel);
     await fs.mkdir(path.dirname(abs), { recursive: true });
     await fs.writeFile(abs, content);
 }
+/**
+ * Any file in the docs locations, read-only, with how to send it: sources cited by the rules
+ * register are often PDFs or images. Shown inline only for types a browser displays safely
+ * (no HTML or SVG, which could run scripts); everything else is a download.
+ */
+export async function rawDoc(project, rel) {
+    const abs = resolveDoc(project, rel, true);
+    const ext = path.extname(abs).toLowerCase();
+    const inline = RAW_INLINE[ext];
+    return { data: await fs.readFile(abs), type: inline ?? "application/octet-stream", inline: !!inline, name: path.basename(abs) };
+}
+const RAW_INLINE = {
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".txt": "text/plain; charset=utf-8",
+    ".md": "text/plain; charset=utf-8",
+    ".csv": "text/plain; charset=utf-8",
+};
 /** Validates a doc path against the allowed locations. Throws on anything else. */
-function resolveDoc(project, rel) {
+function resolveDoc(project, rel, anyType = false) {
     const root = docsRoot(project);
     const normalized = rel.replace(/\\/g, "/").replace(/^\/+/, "");
     const abs = path.resolve(root, normalized);
@@ -59,7 +106,7 @@ function resolveDoc(project, rel) {
     const allowed = project.docsLocation === "private"
         ? insideRoot
         : insideRoot && (relBack === "AGENTS.md" || relBack.startsWith("docs/"));
-    if (!allowed || !TEXT_EXT.has(path.extname(abs).toLowerCase())) {
+    if (!allowed || (!anyType && !TEXT_EXT.has(path.extname(abs).toLowerCase()))) {
         throw new Error(`Not a docs file: ${rel}`);
     }
     // A symlink inside the docs could point at any file (an SSH key, say); compare real

package/dist/server/guard.js

@@ -99,16 +99,37 @@ const SECRET_SHELL = [
     "*.symbio*backups*",
     "*opencode*auth.json*",
 ];
+// Images read with the read tool go into the conversation at full size and are re-sent every
+// turn; a few large ones made a conversation too big to send at all. Agents look at images
+// through Symbio's view_image tool instead, which scales them down. These reads are "ask", not
+// "deny", only so the refusal can carry a message: Symbio rejects them itself, at once, telling
+// the agent to use view_image (a bare deny just says "Permission denied", and a model gave up).
+// Patterns are case-sensitive, hence both spellings.
+export const IMAGE_EXTENSIONS = ["png", "jpg", "jpeg", "gif", "webp", "bmp"];
+const IMAGE_PATHS = IMAGE_EXTENSIONS.flatMap((ext) => [`*.${ext}`, `*.${ext.toUpperCase()}`]);
+/** A read Symbio refuses on the agent's behalf (an image file), with what to do instead. */
+export function imageReadRefusal(action, resources) {
+    if (action !== "read" || !resources.length || !resources.every((r) => IMAGE_PATHS.some((p) => wildcardMatch(p, r))))
+        return null;
+    return ("Symbio blocks reading image files directly: a full-size image stays in your conversation and is sent again on every " +
+        `turn. Use Symbio's view_image tool instead (in code mode: tools.symbio.view_image({ path: ${JSON.stringify(resources[0])} })); ` +
+        "it returns a scaled-down copy, and a crop shows details at full resolution.");
+}
 const rules = (action, effect, patterns) => patterns.map((resource) => ({ action, resource, effect }));
 // Any matching deny blocks a call; otherwise any ask prompts. Deny rules come last
 // so they also win under "last match wins".
 export const AGENT_PERMISSIONS = [
     ...rules("shell", "ask", INSTALL_PATTERNS),
+    ...rules("read", "ask", IMAGE_PATHS), // refused by Symbio with a message (imageReadRefusal)
     ...rules("shell", "deny", KILL_PATTERNS),
     ...rules("shell", "deny", SECRET_SHELL),
     ...rules("read", "deny", SECRET_PATHS),
     ...rules("edit", "deny", SECRET_PATHS),
 ];
+/** Whether a path is one agents may never read (keys, Symbio's secrets…), for Symbio's own file tools. */
+export function isSecretPath(file) {
+    return SECRET_PATHS.some((p) => wildcardMatch(p, file));
+}
 /** Text for agent briefs explaining the rule and the alternative. */
 export const PROCESS_RULES = `- Never kill processes by name or PID (taskkill, Stop-Process, kill, pkill…):
   other programs on this machine — the human's terminals and editors, other

package/dist/server/images.js

@@ -0,0 +1,54 @@
+// view_image: agents look at images through scaled-down copies. A full-size image read into a
+// conversation stays there and is re-sent every turn; a few large ones made a conversation too
+// big to send at all. A crop shows one region at full resolution when details matter.
+import { existsSync, promises as fs } from "node:fs";
+import path from "node:path";
+import sharp from "sharp";
+import { IMAGE_EXTENSIONS, isSecretPath } from "./guard.js";
+export const DEFAULT_IMAGE_SIZE = 1024;
+const MAX_IMAGE_SIZE = 2048;
+const MAX_BYTES = 1_500_000; // what we send back, after scaling
+export async function viewImage(folder, input) {
+    const given = String(input.path ?? "").trim();
+    if (!given)
+        throw new Error("Give the image's path.");
+    const file = path.resolve(folder, given);
+    const ext = path.extname(file).slice(1).toLowerCase();
+    if (!IMAGE_EXTENSIONS.includes(ext))
+        throw new Error(`Not an image (${IMAGE_EXTENSIONS.join(", ")}): ${given}`);
+    if (isSecretPath(file))
+        throw new Error(`Not allowed: ${given}`);
+    if (!existsSync(file))
+        throw new Error(`No such file: ${file}`);
+    const size = Math.min(MAX_IMAGE_SIZE, Math.max(64, Math.round(Number(input.max_size) || DEFAULT_IMAGE_SIZE)));
+    let image = sharp(await fs.readFile(file), { animated: false }).rotate(); // apply EXIF orientation
+    const meta = await image.metadata();
+    const width = meta.autoOrient?.width ?? meta.width ?? 0;
+    const height = meta.autoOrient?.height ?? meta.height ?? 0;
+    if (!width || !height)
+        throw new Error(`Couldn't read the image: ${given}`);
+    let note = `${given}: ${width}×${height} px`;
+    const crop = input.crop;
+    if (crop && typeof crop === "object") {
+        const left = Math.max(0, Math.floor(Number(crop.left) || 0));
+        const top = Math.max(0, Math.floor(Number(crop.top) || 0));
+        const w = Math.min(width - left, Math.floor(Number(crop.width) || 0));
+        const h = Math.min(height - top, Math.floor(Number(crop.height) || 0));
+        if (w <= 0 || h <= 0)
+            throw new Error(`The crop must lie inside the ${width}×${height} image (left, top, width, height in pixels).`);
+        image = image.extract({ left, top, width: w, height: h });
+        note += `, region ${w}×${h} at (${left}, ${top})`;
+    }
+    image = image.resize({ width: size, height: size, fit: "inside", withoutEnlargement: true });
+    // JPEG keeps it small; flatten transparency onto white so it stays readable.
+    let quality = 82;
+    let out = await image.clone().flatten({ background: "#ffffff" }).jpeg({ quality }).toBuffer({ resolveWithObject: true });
+    while (out.data.length > MAX_BYTES && quality > 40) {
+        quality -= 15;
+        out = await image.clone().flatten({ background: "#ffffff" }).jpeg({ quality }).toBuffer({ resolveWithObject: true });
+    }
+    note += `, shown at ${out.info.width}×${out.info.height}.`;
+    if (!crop && (out.info.width < width || out.info.height < height))
+        note += " For details, ask for a crop (a region in the original's pixels), shown at full resolution.";
+    return { content: [{ type: "text", text: note }, { type: "image", data: out.data.toString("base64"), mimeType: "image/jpeg" }] };
+}

package/dist/server/mcp.js

@@ -58,8 +58,8 @@ async function handleOne(req, token, resolve) {
             if (caller.ctx == null)
                 return fail(-32001, "could not identify the calling agent");
             try {
-                const text = await tool.run(req.params?.arguments ?? {}, caller.ctx);
-                return reply({ content: [{ type: "text", text }] });
+                const result = await tool.run(req.params?.arguments ?? {}, caller.ctx);
+                return reply({ content: typeof result === "string" ? [{ type: "text", text: result }] : result.content });
             }
             catch (err) {
                 // Tool errors go back to the model as a result, so it can react.

package/dist/server/prompts.js

@@ -4,6 +4,13 @@ import { existsSync } from "node:fs";
 import path from "node:path";
 import { docsPaths } from "./docs.js";
 import { PROCESS_RULES } from "./guard.js";
+// Seen live: a coordinator read eight 2–4 MB images, its conversation reached 25 MB and the
+// provider gave up receiving it ("Timed out reading request body"), whatever the model.
+const KEEP_CONVERSATION_SMALL = `- Keep your conversation small: whatever you read stays in it and is sent to
+  the model again on every turn, until it becomes too large to send. Look at
+  images with Symbio's \`view_image\` tool (a scaled-down copy; ask for a crop to
+  see details) — reading image files directly is blocked. For a big file, read
+  the part you need. Reviewing many images is work for a helper.`;
 // OpenCode's code mode posts "tool catalog changed" notices that list only its own tools and
 // say the catalog is complete; Symbio's tools still work (seen live: a coordinator kept using
 // them after such a notice, another gave up without trying).
@@ -69,6 +76,8 @@ ${onboarding(project)}
 
 ${docsSection(project)}
 
+${rulesSection(project, "coordinator")}
+
 ## Your team tools (from the "symbio" tool server)
 
 - \`submit_plan\`, \`add_task\`, \`list_tasks\` — the plan. Tasks are for helpers;
@@ -133,6 +142,7 @@ ${connectionsSection(connections)}
 - Never start long-running processes (servers, watchers, anything that doesn't
   exit on its own) in the foreground.
 ${PROCESS_RULES}
+${KEEP_CONVERSATION_SMALL}
 `;
 }
 /** Where helpers work, for the coordinator's tool list. */
@@ -176,6 +186,43 @@ The folder already has content. Before planning anything:
 
 Respect what is there: follow existing conventions and guidance files.`;
 }
+/** The rules register, when the project keeps one. */
+function rulesSection(project, role) {
+    if (!project.rulesRegister)
+        return "";
+    const common = `## The rules register
+
+This project keeps a register of its rules: anything the work must respect (a
+requirement, a decision, a constraint, a style rule), each with where it came
+from and whether it's met. The human reads it in Symbio's Docs tab. Use the
+tools \`list_rules\`, \`save_rule\`, \`save_rule_area\` and \`save_rule_source\`; never
+edit the register file directly.
+
+- **Only what the sources say.** A rule's text states what its source says.
+  Cite the source with its location and a literal excerpt. If nothing backs a
+  rule yet, record it without citations (it shows as unsourced) — never invent a
+  source, date or person.
+- **Confirmation:** \`found\` (extracted, nobody checked), \`checked-by-agent\`
+  (you compared text, location and excerpt against the source), \`checked-by-human\`
+  (only when the human says so), \`contested\` (a source contradicts it; ask).
+- **Status:** whether the work meets it today: \`done\`, \`partial\`, \`missing\`,
+  \`not-applicable\`. When the work differs from the rule, say so in \`current\`
+  (start with "Diverges:").
+- **Stable ids.** A rule keeps its id forever; a rule that changes is superseded
+  by a new one (\`superseded_by\`), and the old one stays for the record.
+- **Rules first.** A change of behavior that comes from a new decision is recorded
+  as a rule (with that decision as its source) before the work changes.`;
+    return role === "coordinator"
+        ? `${common}
+- **Keep it current without stopping the work.** Record rules as they come up:
+  in the human's answers, documents and meetings, and in what helpers find.
+  Ask helpers to update the rules their task touches (status, current state).
+  Areas group rules by part of the project, with stages in order; sources get
+  short codes and their file, so the human can open the cited place.`
+        : `${common}
+- When your task touches a rule, update its \`status\` and \`current\` once you're
+  done. A rule you discover goes in as \`found\`; tell the coordinator.`;
+}
 function docsSection(project) {
     const { entry, folder } = docsPaths(project);
     if (project.docsLocation === "private") {
@@ -248,6 +295,8 @@ documents, data, configuration, external systems). Before changing one:
 
 If you are unsure whether something is shared, ask the coordinator.
 
+${rulesSection(project, "worker")}
+
 ## Tools (from the "symbio" tool server)
 
 \`send_message\`, \`ask_human\`, \`list_team\`, \`list_assets\`, \`request_asset\`,
@@ -278,6 +327,7 @@ ${connectionsSection(connections)}
 - Never start long-running processes (servers, watchers, anything that doesn't
   exit on its own) in the foreground.
 ${PROCESS_RULES}
+${KEEP_CONVERSATION_SMALL}
 `;
 }
 /** First turn, sent by Symbio right after the coordinator is created, so it speaks first. */
@@ -287,15 +337,33 @@ export function kickoffMessage(project) {
         : "Symbio: the project was just created on a folder that already has content (see the folder summary in your instructions). Greet the human briefly, mention in one or two sentences what you can see at a glance, and offer to study the folder before planning.";
 }
 function connectionsSection(connections) {
-    return `## Connections (GitHub, servers)
+    return `## Connections (GitHub, Azure DevOps, servers)
 
 ${connections || "None."}
 
-Use connections only through Symbio's tools: \`list_connections\`, \`git_push\`,
-\`git_pull\`, \`github_api\` (GitHub) and \`remote_exec\`, \`remote_upload\` (servers).
-Symbio performs the action with the stored credentials — you never see them.
-Never ask for credentials, never write secrets into files or commands, and never
-look for them on this machine. Remote commands must be non-interactive. Always
-give a clear \`reason\`: when a connection needs approval, the human decides based
-on it, and the result arrives later as a message.`;
+Use connections only through Symbio's tools: \`list_connections\`; \`git_push\`,
+\`git_pull\` (GitHub or Azure DevOps); \`github_api\` (GitHub); \`azure_devops_api\`
+(Azure DevOps: pull requests, repositories, branches); \`remote_exec\`,
+\`remote_upload\` (servers). Symbio performs the action with the stored
+credentials — you never see them. To open a pull request: push the branch with
+\`git_push\`, then create it with \`github_api\` or \`azure_devops_api\`.
+Remote commands must be non-interactive. Always give a clear \`reason\`: when a
+connection needs approval, the human decides based on it, and the result
+arrives later as a message.
+
+## Credentials
+
+- **Symbio's secrets are off-limits:** its vault and connections, SSH keys, its
+  UI key. Use connections only through the tools above; never try to read them.
+- **The project's own credentials** (in its config files: connection strings,
+  \`.env\`, \`Web.config\`, \`appsettings.json\`…) and **credentials the human gives
+  you** may be used for the task, e.g. connecting to a database the work needs.
+  A developer on this project would use them too; don't refuse a task over that.
+- **Don't spread them:** never put a credential into anything that is committed
+  or shared — new files in the project, docs, the rules register, the plan,
+  messages to other agents — and don't print it in your answers. Prefer
+  commands that read it from the config file over pasting it into a command line.
+- **Respect the environment:** if the human says a system is a read-only mirror
+  or production, only read from it; changing production needs the human's
+  explicit OK.`;
 }