symbio 0.4.0 → 0.6.0

package/dist/server/tools.js

@@ -2,6 +2,8 @@
 // specific agent (identified by its session); coordinator-only tools refuse
 // other callers.
 import { describeTask, TASK_STATUSES } from "./plan.js";
+import { CONFIRMATIONS, listRules, saveArea, saveRule, saveSource, STATUSES } from "./rules.js";
+import { DEFAULT_IMAGE_SIZE, viewImage } from "./images.js";
 const str = (description) => ({ type: "string", description });
 function obj(properties, required = []) {
     return { type: "object", properties, required, additionalProperties: false };
@@ -328,20 +330,20 @@ const remoteUpload = {
     run: ({ connection, local_path, remote_path, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "remote_upload", connectionId: String(connection), localPath: String(local_path), remotePath: String(remote_path) }, String(reason)),
 };
 const gitFields = {
-    connection: str("GitHub connection name"),
-    remote: str("Remote name or https://github.com/… URL (default: origin)"),
+    connection: str("GitHub or Azure DevOps connection name"),
+    remote: str("Remote name or HTTPS URL (github.com, dev.azure.com) (default: origin)"),
     branch: str("Branch (default: your current branch)"),
     reason: reasonField,
 };
 const gitPush = {
     name: "git_push",
-    description: "Push committed work from your working folder to GitHub (the token is applied by Symbio; plain `git push` has no credentials).",
+    description: "Push committed work from your working folder to GitHub or Azure DevOps (the token is applied by Symbio; plain `git push` may have no credentials).",
     inputSchema: obj(gitFields, ["connection", "reason"]),
     run: ({ connection, remote, branch, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "git_push", connectionId: String(connection), remote: remote ? String(remote) : null, branch: branch ? String(branch) : null }, String(reason)),
 };
 const gitPull = {
     name: "git_pull",
-    description: "Pull from GitHub into your working folder (merge, no rebase).",
+    description: "Pull from GitHub or Azure DevOps into your working folder (merge, no rebase).",
     inputSchema: obj(gitFields, ["connection", "reason"]),
     run: ({ connection, remote, branch, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "git_pull", connectionId: String(connection), remote: remote ? String(remote) : null, branch: branch ? String(branch) : null }, String(reason)),
 };
@@ -352,18 +354,131 @@ const githubApi = {
         connection: str("GitHub connection name"),
         method: { type: "string", enum: ["GET", "POST", "PATCH", "PUT", "DELETE"] },
         path: str("API path, e.g. /user/repos"),
-        body: { type: "object", description: "JSON body for POST/PATCH/PUT" },
+        // Some endpoints take a list (e.g. Azure DevOps ref updates), others an object.
+        body: { anyOf: [{ type: "object" }, { type: "array" }], description: "JSON body for POST/PATCH/PUT (an object, or a list where the API expects one)" },
         reason: reasonField,
     }, ["connection", "method", "path", "reason"]),
     run: ({ connection, method, path, body, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "github_api", connectionId: String(connection), method: String(method), path: String(path), body }, String(reason)),
 };
+const azureDevopsApi = {
+    name: "azure_devops_api",
+    description: "Call the Azure DevOps REST API of the connection's organization. The path is relative to https://dev.azure.com/<organization>/ " +
+        "and api-version is added if missing. E.g. GET <project>/_apis/git/repositories to find a repository's id; " +
+        "POST <project>/_apis/git/repositories/<repo>/pullrequests with {sourceRefName: 'refs/heads/<branch>', targetRefName: " +
+        "'refs/heads/main', title, description} to open a pull request (push the branch first with git_push); " +
+        "GET <project>/_apis/git/repositories/<repo>/pullrequests?searchCriteria.status=active to list them. Read-only GET calls never need approval.",
+    inputSchema: obj({
+        connection: str("Azure DevOps connection name"),
+        method: { type: "string", enum: ["GET", "POST", "PATCH", "PUT", "DELETE"] },
+        path: str("Path inside the organization, e.g. MyProject/_apis/git/repositories"),
+        // Some endpoints take a list (e.g. Azure DevOps ref updates), others an object.
+        body: { anyOf: [{ type: "object" }, { type: "array" }], description: "JSON body for POST/PATCH/PUT (an object, or a list where the API expects one)" },
+        reason: reasonField,
+    }, ["connection", "method", "path", "reason"]),
+    run: ({ connection, method, path, body, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "azure_devops_api", connectionId: String(connection), method: String(method), path: String(path), body }, String(reason)),
+};
+// ---- rules register (only when the project keeps one)
+function registerOn(project) {
+    if (!project.rulesRegister)
+        throw new Error("This project doesn't keep a rules register (the human can turn it on in the project's Settings).");
+}
+// ---- images
+const viewImageTool = {
+    name: "view_image",
+    description: "Look at an image (png, jpg, gif, webp, bmp): returns a scaled-down copy, so it doesn't bloat your conversation. " +
+        "Reading image files directly is blocked: a full-size image stays in your conversation and is re-sent every turn. " +
+        "For details, ask for a crop: a region of the original, in its pixels, shown at full resolution.",
+    inputSchema: obj({
+        path: str("The image file (absolute, or relative to your folder)"),
+        max_size: { type: "integer", description: `Longest side of the copy in pixels (default ${DEFAULT_IMAGE_SIZE}, at most 2048)` },
+        crop: obj({ left: { type: "integer" }, top: { type: "integer" }, width: { type: "integer" }, height: { type: "integer" } }, ["left", "top", "width", "height"]),
+    }, ["path"]),
+    run: (args, { agent }) => viewImage(agent.directory, args),
+};
+const listRulesTool = {
+    name: "list_rules",
+    description: "The project's rules register: its areas, sources and rules (id, status, confirmation, text, sources). Filter to keep it short.",
+    inputSchema: obj({
+        query: str("Words to look for in the id, text, current state or citations"),
+        area: str("Only this area (its prefix, e.g. 'AP')"),
+        status: { type: "string", enum: [...STATUSES] },
+    }),
+    async run(args, { project }) {
+        registerOn(project);
+        return listRules(project, args);
+    },
+};
+const saveRuleTool = {
+    name: "save_rule",
+    description: "Add a rule to the register, or update one (give its id; only the fields you pass change). A new rule gets the next id in its " +
+        "area. State only what the sources say; if nothing backs it yet, add it without citations (it shows as unsourced) rather than " +
+        "inventing a source. Citations quote the source literally.",
+    inputSchema: obj({
+        id: str("To update an existing rule, e.g. 'AP-031'. Leave out to add a new one."),
+        area: str("Area prefix (define areas with save_rule_area)"),
+        stage: str("Stage id within the area (e.g. 'B')"),
+        text: str("What the rule says (Markdown)"),
+        action: str("What the work does about it, e.g. 'blocks submission', 'warning only', 'none'"),
+        citations: {
+            type: "array",
+            description: "Where it comes from. Each: source code (define sources with save_rule_source), location (p.20, l.10…), literal excerpt.",
+            items: obj({ source: str("Source code, e.g. 'MA'"), location: str("Where in the source"), excerpt: str("The source's words, copied literally") }, ["source"]),
+        },
+        imposed_by: str("Who imposes it (an authority code)"),
+        confirmation: { type: "string", enum: [...CONFIRMATIONS], description: "found = extracted, nobody checked; checked-by-agent; checked-by-human; contested" },
+        status: { type: "string", enum: [...STATUSES], description: "Is it met by the work today?" },
+        current: str("How things are today, especially where they differ from the rule"),
+        check: str("How to check that it's met"),
+        superseded_by: str("Id of the rule that replaced this one (the old rule stays for the record)"),
+    }, []),
+    async run(args, { project, agent }) {
+        registerOn(project);
+        return saveRule(project, args, agent.name);
+    },
+};
+const saveRuleAreaTool = {
+    name: "save_rule_area",
+    description: "Define or update an area of the rules register (a part of the project with its own rule ids) and its stages, in order.",
+    inputSchema: obj({
+        id: str("Short prefix for its rule ids, e.g. 'AP' → AP-001. Must differ from every source code."),
+        name: str("Name, e.g. 'Student — Submission'"),
+        group: str("Optional larger group it belongs to"),
+        description: str("What it covers"),
+        stages: { type: "array", items: obj({ id: str("e.g. 'A'"), name: str("e.g. 'Access'") }, ["name"]), description: "Its steps or sections, in order" },
+    }, ["id", "name"]),
+    async run(args, { project }) {
+        registerOn(project);
+        return saveArea(project, args);
+    },
+};
+const saveRuleSourceTool = {
+    name: "save_rule_source",
+    description: "Define or update a source rules are cited from (a document, a meeting, a decision), with the file when there is one.",
+    inputSchema: obj({
+        id: str("Short code used in citations, e.g. 'MA' or 'D38'. Must differ from every area prefix."),
+        name: str("e.g. 'Student manual 2026'"),
+        file: str("The file, relative to the project folder (so the human can open it at the cited place)"),
+        authority: str("Code of who stands behind it, e.g. 'EC'"),
+        authority_name: str("Name of that authority, the first time you use its code"),
+    }, ["id", "name"]),
+    async run(args, { project }) {
+        registerOn(project);
+        return saveSource(project, args);
+    },
+};
 const COMMON = [
+    viewImageTool,
+    listRulesTool,
+    saveRuleTool,
+    saveRuleAreaTool,
+    saveRuleSourceTool,
     listConnections,
     remoteExec,
     remoteUpload,
     gitPush,
     gitPull,
     githubApi,
+    azureDevopsApi,
     sendMessage,
     askHuman,
     listTeam,
@@ -416,12 +531,15 @@ function withInbox(tool) {
             }
             const arrived = await ctx.team.takeInbox(ctx.agent).catch(() => []);
             if (arrived.length === 0) {
-                if (result.startsWith("Error: "))
+                if (typeof result === "string" && result.startsWith("Error: "))
                     throw new Error(result.slice(7));
                 return result;
             }
+            const inbox = `📬 Messages that arrived while you were working (already delivered — they won't be repeated):\n\n${arrived.join("\n\n---\n\n")}`;
+            if (typeof result !== "string")
+                return { content: [...result.content, { type: "text", text: inbox }] };
             const header = tool === checkMessages ? "" : `${result}\n\n`;
-            return `${header}📬 Messages that arrived while you were working (already delivered — they won't be repeated):\n\n${arrived.join("\n\n---\n\n")}`;
+            return `${header}${inbox}`;
         },
     };
 }

package/dist/server/updates.js

@@ -58,6 +58,39 @@ export const AGENT_UPDATES = [
             "with search({ namespace: \"symbio\" }). Never conclude they're gone without calling one; if a call really fails, tell the " +
             "human what the error said.",
     },
+    {
+        id: "2026-11-05-rules-register",
+        text: "Rules register: a project can keep a register of its rules (requirements, decisions, constraints), each with its source, " +
+            "a literal excerpt, who imposes it, how confirmed it is and whether the work meets it; the human browses it in the Docs tab. " +
+            "It's on only when the human turns it on in the project's Settings (new projects have it on by default); then your " +
+            "instructions explain the tools (list_rules, save_rule, save_rule_area, save_rule_source). Until then, nothing changes.",
+    },
+    {
+        id: "2026-11-05-conversation-size",
+        text: "Keep conversations small: whatever an agent reads stays in its conversation and is sent to the model again every turn. " +
+            "Reading several full-size images made a coordinator's conversation too large to send at all (\"Timed out reading request " +
+            "body\"), whatever the model. So reading image files directly is now refused: look at images with the new view_image tool " +
+            "(a scaled-down copy; ask for a crop to see details at full resolution). Read only the part of a big file you need, and " +
+            "leave reviewing many images to a helper. If a conversation still becomes too large, Symbio moves that agent to a fresh " +
+            "session with a handoff note instead of trying other models.",
+    },
+    {
+        id: "2026-11-06-credentials",
+        text: "Credentials, clarified: the old rule \"never look for credentials or put secrets in commands\" was meant for Symbio's own " +
+            "secrets (its vault, connections, SSH keys), and it stopped agents from doing legitimate work. Now: Symbio's secrets stay " +
+            "off-limits (use connections only through the tools). The project's own credentials (connection strings, .env, Web.config…) " +
+            "and credentials the human gives you may be used for the task, e.g. querying a database the work needs. Don't spread them: " +
+            "never put one into anything committed or shared (new files, docs, the rules register, the plan, messages to other agents), " +
+            "and prefer commands that read it from the config file. If the human says a system is a read-only mirror or production, only " +
+            "read from it unless they explicitly OK changes. If you refused such a task before, you can do it now.",
+    },
+    {
+        id: "2026-11-06-azure-devops",
+        text: "Azure DevOps connections: the human can now add an Azure DevOps organization (with a personal access token) in Settings and " +
+            "enable it per project. git_push and git_pull work with it (HTTPS remotes of that organization; SSH remotes must be switched to " +
+            "HTTPS), and the new azure_devops_api tool calls its REST API, e.g. to open a pull request after pushing the branch. Reading " +
+            "(GET) never needs approval. If a push or a pull request failed for lack of credentials, ask the human to add the connection.",
+    },
 ];
 /** Entries a project hasn't been told about yet. */
 export function unseenUpdates(seen) {

package/dist/server/workspaces.js

@@ -115,6 +115,20 @@ export async function restoreWorkspace(project, agent) {
     await git(project.directory, "worktree", "add", agent.directory, agent.branch);
     return { directory: agent.directory, branch: agent.branch, base, reset: true };
 }
+/**
+ * An active helper's folder that disappeared (deleted outside Symbio): recreate it from its
+ * branch, which keeps everything it committed. Unlike restoreWorkspace, the branch is never
+ * moved. Returns false when there was nothing to do.
+ */
+export async function reattachWorkspace(project, agent) {
+    if (!agent.branch || existsSync(agent.directory) || !(await isGitRepo(project.directory)))
+        return false;
+    await git(project.directory, "worktree", "prune").catch(() => { });
+    const branchExists = await git(project.directory, "rev-parse", "--verify", "--quiet", agent.branch).then(() => true, () => false);
+    await fs.mkdir(path.dirname(agent.directory), { recursive: true });
+    await git(project.directory, "worktree", "add", ...(branchExists ? [agent.directory, agent.branch] : ["-b", agent.branch, agent.directory, "HEAD"]));
+    return true;
+}
 export async function removeWorkspace(project, agent) {
     if (!agent.branch)
         return;