xibecode 0.6.2 → 0.7.3

package/dist/core/tools.js

@@ -7,7 +7,7 @@ import { MODE_CONFIG, isToolAllowed, isValidMode } from './modes.js';
 import { FileEditor } from './editor.js';
 import { GitUtils } from '../utils/git.js';
 import { TestRunnerDetector } from '../utils/testRunner.js';
-import { SafetyChecker } from '../utils/safety.js';
+import { SafetyChecker, sanitizePath, sanitizeUrl } from '../utils/safety.js';
 import { PluginManager } from './plugins.js';
 import { BrowserManager } from '../tools/browser.js';
 import * as os from 'os';
@@ -86,6 +86,8 @@ export class CodingToolExecutor {
     platform;
     dryRun;
     testCommandOverride;
+    /** Session-scoped tools synthesized by the agent (meta-agent). Execution is sandboxed via run_command. */
+    dynamicTools = new Map();
     /**
      * Creates a new CodingToolExecutor instance
      *
@@ -297,401 +299,426 @@ export class CodingToolExecutor {
                 riskAssessment.warnings.push(`Suggestion: ${suggestion}`);
             }
         }
-        switch (toolName) {
-            case 'read_file': {
-                if (!p.path || typeof p.path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: path (string). Example: {"path": "src/index.ts"}' };
-                }
-                return this.readFile(p.path, p.start_line, p.end_line);
+        try {
+            if (this.dynamicTools.has(toolName)) {
+                return this.runDynamicTool(toolName, p);
             }
-            case 'read_multiple_files': {
-                if (!Array.isArray(p.paths) || p.paths.length === 0) {
-                    return { error: true, success: false, message: 'Missing required parameter: paths (non-empty array of strings). Example: {"paths": ["file1.ts", "file2.ts"]}' };
+            switch (toolName) {
+                case 'read_file': {
+                    if (!p.path || typeof p.path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: path (string). Example: {"path": "src/index.ts"}' };
+                    }
+                    return this.readFile(p.path, p.start_line, p.end_line);
                 }
-                const validPaths = p.paths.filter((x) => typeof x === 'string');
-                if (validPaths.length === 0) {
-                    return { error: true, success: false, message: 'paths array must contain strings. Example: {"paths": ["file1.ts", "file2.ts"]}' };
+                case 'read_multiple_files': {
+                    if (!Array.isArray(p.paths) || p.paths.length === 0) {
+                        return { error: true, success: false, message: 'Missing required parameter: paths (non-empty array of strings). Example: {"paths": ["file1.ts", "file2.ts"]}' };
+                    }
+                    const validPaths = p.paths.filter((x) => typeof x === 'string');
+                    if (validPaths.length === 0) {
+                        return { error: true, success: false, message: 'paths array must contain strings. Example: {"paths": ["file1.ts", "file2.ts"]}' };
+                    }
+                    return this.readMultipleFiles(validPaths);
                 }
-                return this.readMultipleFiles(validPaths);
-            }
-            case 'write_file': {
-                if (!p.path || typeof p.path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                case 'write_file': {
+                    if (!p.path || typeof p.path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                    }
+                    if (typeof p.content !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: content (string)' };
+                    }
+                    return this.writeFile(p.path, p.content);
                 }
-                if (typeof p.content !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: content (string)' };
+                case 'edit_file': {
+                    if (!p.path || typeof p.path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                    }
+                    if (typeof p.search !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: search (string)' };
+                    }
+                    if (typeof p.replace !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: replace (string)' };
+                    }
+                    return this.editFile(p.path, p.search, p.replace, p.all);
                 }
-                return this.writeFile(p.path, p.content);
-            }
-            case 'edit_file': {
-                if (!p.path || typeof p.path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                case 'edit_lines': {
+                    if (!p.path || typeof p.path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                    }
+                    if (typeof p.start_line !== 'number' || typeof p.end_line !== 'number') {
+                        return { error: true, success: false, message: 'Missing required parameters: start_line, end_line (numbers)' };
+                    }
+                    if (typeof p.new_content !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: new_content (string)' };
+                    }
+                    return this.editLines(p.path, p.start_line, p.end_line, p.new_content);
                 }
-                if (typeof p.search !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: search (string)' };
+                case 'insert_at_line': {
+                    if (!p.path || typeof p.path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                    }
+                    if (typeof p.line !== 'number') {
+                        return { error: true, success: false, message: 'Missing required parameter: line (number)' };
+                    }
+                    return this.insertAtLine(p.path, p.line, p.content ?? '');
                 }
-                if (typeof p.replace !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: replace (string)' };
+                case 'verified_edit': {
+                    if (!p.path || typeof p.path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                    }
+                    if (typeof p.start_line !== 'number' || typeof p.end_line !== 'number') {
+                        return { error: true, success: false, message: 'Missing required parameters: start_line, end_line (numbers)' };
+                    }
+                    if (typeof p.old_content !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: old_content (string) - the content currently at those lines' };
+                    }
+                    if (typeof p.new_content !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: new_content (string)' };
+                    }
+                    return this.verifiedEditFile(p.path, p.start_line, p.end_line, p.old_content, p.new_content);
                 }
-                return this.editFile(p.path, p.search, p.replace, p.all);
-            }
-            case 'edit_lines': {
-                if (!p.path || typeof p.path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                case 'list_directory':
+                    return this.listDirectory(p.path || '.');
+                case 'search_files': {
+                    if (!p.pattern || typeof p.pattern !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: pattern (string). Example: {"pattern": "**/*.ts"}' };
+                    }
+                    return this.searchFiles(p.pattern, p.path);
                 }
-                if (typeof p.start_line !== 'number' || typeof p.end_line !== 'number') {
-                    return { error: true, success: false, message: 'Missing required parameters: start_line, end_line (numbers)' };
+                case 'run_command': {
+                    if (!p.command || typeof p.command !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: command (string)' };
+                    }
+                    return this.runCommand(p.command, p.cwd, p.input, p.timeout);
                 }
-                if (typeof p.new_content !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: new_content (string)' };
+                case 'create_directory': {
+                    if (!p.path || typeof p.path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                    }
+                    return this.createDirectory(p.path);
                 }
-                return this.editLines(p.path, p.start_line, p.end_line, p.new_content);
-            }
-            case 'insert_at_line': {
-                if (!p.path || typeof p.path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                case 'delete_file': {
+                    if (!p.path || typeof p.path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                    }
+                    return this.deleteFile(p.path);
                 }
-                if (typeof p.line !== 'number') {
-                    return { error: true, success: false, message: 'Missing required parameter: line (number)' };
+                case 'move_file': {
+                    if (!p.source || typeof p.source !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: source (string)' };
+                    }
+                    if (!p.destination || typeof p.destination !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: destination (string)' };
+                    }
+                    return this.moveFile(p.source, p.destination);
                 }
-                return this.insertAtLine(p.path, p.line, p.content ?? '');
-            }
-            case 'verified_edit': {
-                if (!p.path || typeof p.path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                case 'get_context': {
+                    if (!Array.isArray(p.files)) {
+                        return { error: true, success: false, message: 'Missing required parameter: files (array of strings)' };
+                    }
+                    return this.getContext(p.files.filter((f) => typeof f === 'string'));
                 }
-                if (typeof p.start_line !== 'number' || typeof p.end_line !== 'number') {
-                    return { error: true, success: false, message: 'Missing required parameters: start_line, end_line (numbers)' };
+                case 'revert_file': {
+                    if (!p.path || typeof p.path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                    }
+                    return this.revertFile(p.path, p.backup_index);
                 }
-                if (typeof p.old_content !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: old_content (string) - the content currently at those lines' };
+                case 'run_tests': {
+                    return this.runTests(p.command, p.cwd);
                 }
-                if (typeof p.new_content !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: new_content (string)' };
+                case 'get_test_status': {
+                    return this.getTestStatus();
                 }
-                return this.verifiedEditFile(p.path, p.start_line, p.end_line, p.old_content, p.new_content);
-            }
-            case 'list_directory':
-                return this.listDirectory(p.path || '.');
-            case 'search_files': {
-                if (!p.pattern || typeof p.pattern !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: pattern (string). Example: {"pattern": "**/*.ts"}' };
+                case 'get_git_status': {
+                    return this.getGitStatus();
                 }
-                return this.searchFiles(p.pattern, p.path);
-            }
-            case 'run_command': {
-                if (!p.command || typeof p.command !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: command (string)' };
+                case 'get_git_diff_summary': {
+                    return this.getGitDiffSummary(p.target);
                 }
-                return this.runCommand(p.command, p.cwd, p.input, p.timeout);
-            }
-            case 'create_directory': {
-                if (!p.path || typeof p.path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                case 'get_git_changed_files': {
+                    return this.getGitChangedFiles(p.target);
                 }
-                return this.createDirectory(p.path);
-            }
-            case 'delete_file': {
-                if (!p.path || typeof p.path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                case 'git_commit': {
+                    if (!p.message || typeof p.message !== 'string')
+                        return { error: true, success: false, message: 'Missing message' };
+                    return this.gitCommit(p.message, p.agent_name);
                 }
-                return this.deleteFile(p.path);
-            }
-            case 'move_file': {
-                if (!p.source || typeof p.source !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: source (string)' };
+                case 'git_blame_ai': {
+                    if (!p.file_path || typeof p.file_path !== 'string')
+                        return { error: true, success: false, message: 'Missing file_path' };
+                    return this.gitBlameAi(p.file_path);
                 }
-                if (!p.destination || typeof p.destination !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: destination (string)' };
+                case 'create_git_checkpoint': {
+                    if (!p.message || typeof p.message !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: message (string)' };
+                    }
+                    return this.createGitCheckpoint(p.message, p.strategy);
                 }
-                return this.moveFile(p.source, p.destination);
-            }
-            case 'get_context': {
-                if (!Array.isArray(p.files)) {
-                    return { error: true, success: false, message: 'Missing required parameter: files (array of strings)' };
+                case 'revert_to_git_checkpoint': {
+                    if (!p.checkpoint_id || typeof p.checkpoint_id !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: checkpoint_id (string)' };
+                    }
+                    if (!p.confirm) {
+                        return { error: true, success: false, message: 'Revert requires explicit confirmation. Set confirm: true' };
+                    }
+                    return this.revertToGitCheckpoint(p.checkpoint_id, p.checkpoint_type, p.confirm);
                 }
-                return this.getContext(p.files.filter((f) => typeof f === 'string'));
-            }
-            case 'revert_file': {
-                if (!p.path || typeof p.path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: path (string)' };
+                case 'git_show_diff': {
+                    return this.gitShowDiff(p.file_path, p.target);
                 }
-                return this.revertFile(p.path, p.backup_index);
-            }
-            case 'run_tests': {
-                return this.runTests(p.command, p.cwd);
-            }
-            case 'get_test_status': {
-                return this.getTestStatus();
-            }
-            case 'get_git_status': {
-                return this.getGitStatus();
-            }
-            case 'get_git_diff_summary': {
-                return this.getGitDiffSummary(p.target);
-            }
-            case 'get_git_changed_files': {
-                return this.getGitChangedFiles(p.target);
-            }
-            case 'git_commit': {
-                if (!p.message || typeof p.message !== 'string')
-                    return { error: true, success: false, message: 'Missing message' };
-                return this.gitCommit(p.message, p.agent_name);
-            }
-            case 'git_blame_ai': {
-                if (!p.file_path || typeof p.file_path !== 'string')
-                    return { error: true, success: false, message: 'Missing file_path' };
-                return this.gitBlameAi(p.file_path);
-            }
-            case 'create_git_checkpoint': {
-                if (!p.message || typeof p.message !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: message (string)' };
+                case 'get_mcp_status': {
+                    return this.getMCPStatus();
                 }
-                return this.createGitCheckpoint(p.message, p.strategy);
-            }
-            case 'revert_to_git_checkpoint': {
-                if (!p.checkpoint_id || typeof p.checkpoint_id !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: checkpoint_id (string)' };
+                case 'grep_code': {
+                    if (!p.pattern || typeof p.pattern !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: pattern (string)' };
+                    }
+                    return this.grepCode(p.pattern, p.path, p.ignore_case, p.file_pattern, p.max_results);
                 }
-                if (!p.confirm) {
-                    return { error: true, success: false, message: 'Revert requires explicit confirmation. Set confirm: true' };
+                case 'web_search': {
+                    if (!p.query || typeof p.query !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: query (string)' };
+                    }
+                    return this.webSearch(p.query, p.max_results);
                 }
-                return this.revertToGitCheckpoint(p.checkpoint_id, p.checkpoint_type, p.confirm);
-            }
-            case 'git_show_diff': {
-                return this.gitShowDiff(p.file_path, p.target);
-            }
-            case 'get_mcp_status': {
-                return this.getMCPStatus();
-            }
-            case 'grep_code': {
-                if (!p.pattern || typeof p.pattern !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: pattern (string)' };
+                case 'fetch_url': {
+                    if (!p.url || typeof p.url !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: url (string)' };
+                    }
+                    return this.fetchUrl(p.url, p.max_length);
                 }
-                return this.grepCode(p.pattern, p.path, p.ignore_case, p.file_pattern, p.max_results);
-            }
-            case 'web_search': {
-                if (!p.query || typeof p.query !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: query (string)' };
+                case 'update_memory': {
+                    if (!p.content || typeof p.content !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: content (string)' };
+                    }
+                    return this.updateMemory(p.content, p.append);
                 }
-                return this.webSearch(p.query, p.max_results);
-            }
-            case 'fetch_url': {
-                if (!p.url || typeof p.url !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: url (string)' };
+                case 'remember_lesson': {
+                    if (!this.memory) {
+                        return { error: true, success: false, message: 'Memory system is not initialized.' };
+                    }
+                    if (!p.trigger || typeof p.trigger !== 'string')
+                        return { error: true, success: false, message: 'Missing trigger' };
+                    if (!p.action || typeof p.action !== 'string')
+                        return { error: true, success: false, message: 'Missing action' };
+                    if (!p.outcome || typeof p.outcome !== 'string')
+                        return { error: true, success: false, message: 'Missing outcome' };
+                    await this.memory.addMemory(p.trigger, p.action, p.outcome, p.tags || []);
+                    return { success: true, message: 'Lesson learned and saved to neural memory.' };
+                }
+                case 'take_screenshot': {
+                    if (!p.url || typeof p.url !== 'string')
+                        return { error: true, success: false, message: 'Missing url' };
+                    if (!p.path || typeof p.path !== 'string')
+                        return { error: true, success: false, message: 'Missing path' };
+                    return this.browserManager.takeScreenshot(p.url, p.path, p.fullPage !== false);
+                }
+                case 'get_console_logs': {
+                    if (!p.url || typeof p.url !== 'string')
+                        return { error: true, success: false, message: 'Missing url' };
+                    return this.browserManager.getConsoleLogs(p.url);
+                }
+                case 'run_visual_test': {
+                    if (!p.url || typeof p.url !== 'string')
+                        return { error: true, success: false, message: 'Missing url' };
+                    if (!p.baseline_path || typeof p.baseline_path !== 'string')
+                        return { error: true, success: false, message: 'Missing baseline_path' };
+                    const outputDir = p.output_dir || '.playwright-baselines';
+                    return this.browserManager.runVisualTest(p.url, this.resolvePath(p.baseline_path), this.resolvePath(outputDir));
+                }
+                case 'check_accessibility': {
+                    if (!p.url || typeof p.url !== 'string')
+                        return { error: true, success: false, message: 'Missing url' };
+                    return this.browserManager.checkAccessibility(p.url);
+                }
+                case 'measure_performance': {
+                    if (!p.url || typeof p.url !== 'string')
+                        return { error: true, success: false, message: 'Missing url' };
+                    return this.browserManager.measurePerformance(p.url);
+                }
+                case 'test_responsive': {
+                    if (!p.url || typeof p.url !== 'string')
+                        return { error: true, success: false, message: 'Missing url' };
+                    const outputDir = p.output_dir || '.responsive-screenshots';
+                    return this.browserManager.testResponsive(p.url, this.resolvePath(outputDir), p.viewports);
+                }
+                case 'capture_network': {
+                    if (!p.url || typeof p.url !== 'string')
+                        return { error: true, success: false, message: 'Missing url' };
+                    return this.browserManager.captureNetworkRequests(p.url);
+                }
+                case 'run_playwright_test': {
+                    if (!p.test_path || typeof p.test_path !== 'string')
+                        return { error: true, success: false, message: 'Missing test_path' };
+                    return this.browserManager.runPlaywrightTest(this.resolvePath(p.test_path), {
+                        headed: p.headed,
+                        browser: p.browser,
+                        timeout: p.timeout,
+                    });
                 }
-                return this.fetchUrl(p.url, p.max_length);
-            }
-            case 'update_memory': {
-                if (!p.content || typeof p.content !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: content (string)' };
+                case 'search_skills_sh': {
+                    if (!p.query || typeof p.query !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: query (string)' };
+                    }
+                    return this.searchSkillsSh(p.query);
                 }
-                return this.updateMemory(p.content, p.append);
-            }
-            case 'remember_lesson': {
-                if (!this.memory) {
-                    return { error: true, success: false, message: 'Memory system is not initialized.' };
-                }
-                if (!p.trigger || typeof p.trigger !== 'string')
-                    return { error: true, success: false, message: 'Missing trigger' };
-                if (!p.action || typeof p.action !== 'string')
-                    return { error: true, success: false, message: 'Missing action' };
-                if (!p.outcome || typeof p.outcome !== 'string')
-                    return { error: true, success: false, message: 'Missing outcome' };
-                await this.memory.addMemory(p.trigger, p.action, p.outcome, p.tags || []);
-                return { success: true, message: 'Lesson learned and saved to neural memory.' };
-            }
-            case 'take_screenshot': {
-                if (!p.url || typeof p.url !== 'string')
-                    return { error: true, success: false, message: 'Missing url' };
-                if (!p.path || typeof p.path !== 'string')
-                    return { error: true, success: false, message: 'Missing path' };
-                return this.browserManager.takeScreenshot(p.url, p.path, p.fullPage !== false);
-            }
-            case 'get_console_logs': {
-                if (!p.url || typeof p.url !== 'string')
-                    return { error: true, success: false, message: 'Missing url' };
-                return this.browserManager.getConsoleLogs(p.url);
-            }
-            case 'run_visual_test': {
-                if (!p.url || typeof p.url !== 'string')
-                    return { error: true, success: false, message: 'Missing url' };
-                if (!p.baseline_path || typeof p.baseline_path !== 'string')
-                    return { error: true, success: false, message: 'Missing baseline_path' };
-                const outputDir = p.output_dir || '.playwright-baselines';
-                return this.browserManager.runVisualTest(p.url, this.resolvePath(p.baseline_path), this.resolvePath(outputDir));
-            }
-            case 'check_accessibility': {
-                if (!p.url || typeof p.url !== 'string')
-                    return { error: true, success: false, message: 'Missing url' };
-                return this.browserManager.checkAccessibility(p.url);
-            }
-            case 'measure_performance': {
-                if (!p.url || typeof p.url !== 'string')
-                    return { error: true, success: false, message: 'Missing url' };
-                return this.browserManager.measurePerformance(p.url);
-            }
-            case 'test_responsive': {
-                if (!p.url || typeof p.url !== 'string')
-                    return { error: true, success: false, message: 'Missing url' };
-                const outputDir = p.output_dir || '.responsive-screenshots';
-                return this.browserManager.testResponsive(p.url, this.resolvePath(outputDir), p.viewports);
-            }
-            case 'capture_network': {
-                if (!p.url || typeof p.url !== 'string')
-                    return { error: true, success: false, message: 'Missing url' };
-                return this.browserManager.captureNetworkRequests(p.url);
-            }
-            case 'run_playwright_test': {
-                if (!p.test_path || typeof p.test_path !== 'string')
-                    return { error: true, success: false, message: 'Missing test_path' };
-                return this.browserManager.runPlaywrightTest(this.resolvePath(p.test_path), {
-                    headed: p.headed,
-                    browser: p.browser,
-                    timeout: p.timeout,
-                });
-            }
-            case 'search_skills_sh': {
-                if (!p.query || typeof p.query !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: query (string)' };
+                case 'install_skill_from_skills_sh': {
+                    if (!p.skill_id || typeof p.skill_id !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: skill_id (string)' };
+                    }
+                    return this.installSkillFromSkillsSh(p.skill_id);
                 }
-                return this.searchSkillsSh(p.query);
-            }
-            case 'install_skill_from_skills_sh': {
-                if (!p.skill_id || typeof p.skill_id !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: skill_id (string)' };
+                // AI Test Generation Tools
+                case 'generate_tests': {
+                    if (!p.file_path || typeof p.file_path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: file_path (string)' };
+                    }
+                    return this.generateTests(p.file_path, {
+                        framework: p.framework,
+                        outputDir: p.output_dir,
+                        includeEdgeCases: p.include_edge_cases,
+                        includeMocks: p.include_mocks,
+                        maxTestsPerFunction: p.max_tests_per_function,
+                    }, p.write_file);
+                }
+                case 'preview_app': {
+                    if (!p.url || typeof p.url !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: url (string)' };
+                    }
+                    return this.visualFeedback.capture(p.url, { fullPage: p.full_page });
                 }
-                return this.installSkillFromSkillsSh(p.skill_id);
-            }
-            // AI Test Generation Tools
-            case 'generate_tests': {
-                if (!p.file_path || typeof p.file_path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: file_path (string)' };
-                }
-                return this.generateTests(p.file_path, {
-                    framework: p.framework,
-                    outputDir: p.output_dir,
-                    includeEdgeCases: p.include_edge_cases,
-                    includeMocks: p.include_mocks,
-                    maxTestsPerFunction: p.max_tests_per_function,
-                }, p.write_file);
-            }
-            case 'preview_app': {
-                if (!p.url || typeof p.url !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: url (string)' };
+                case 'mine_project_patterns': {
+                    const patterns = await this.patternMiner.mine();
+                    if (patterns.length === 0) {
+                        return { success: true, message: 'No significant repeated patterns found in the project.' };
+                    }
+                    // Format for AI consumption
+                    const summary = patterns.map(p => `Pattern: ${p.description}\n` +
+                        `- Occurrences: ${p.frequency}\n` +
+                        `- Locations: ${p.chunks.map(c => `${path.relative(this.workingDir, c.filePath)}:${c.startLine}`).join(', ')}\n` +
+                        `- Example Code:\n\`\`\`typescript\n${p.chunks[0].content}\n\`\`\`\n`).join('\n---\n\n');
+                    return {
+                        success: true,
+                        message: `Found ${patterns.length} pattern clusters.`,
+                        patterns: summary
+                    };
                 }
-                return this.visualFeedback.capture(p.url, { fullPage: p.full_page });
-            }
-            case 'mine_project_patterns': {
-                const patterns = await this.patternMiner.mine();
-                if (patterns.length === 0) {
-                    return { success: true, message: 'No significant repeated patterns found in the project.' };
-                }
-                // Format for AI consumption
-                const summary = patterns.map(p => `Pattern: ${p.description}\n` +
-                    `- Occurrences: ${p.frequency}\n` +
-                    `- Locations: ${p.chunks.map(c => `${path.relative(this.workingDir, c.filePath)}:${c.startLine}`).join(', ')}\n` +
-                    `- Example Code:\n\`\`\`typescript\n${p.chunks[0].content}\n\`\`\`\n`).join('\n---\n\n');
-                return {
-                    success: true,
-                    message: `Found ${patterns.length} pattern clusters.`,
-                    patterns: summary
-                };
-            }
-            case 'start_background_task': {
-                if (!p.prompt || typeof p.prompt !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: prompt (string)' };
+                case 'start_background_task': {
+                    if (!p.prompt || typeof p.prompt !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: prompt (string)' };
+                    }
+                    const taskId = await this.backgroundAgent.startTask(p.prompt);
+                    return { success: true, message: `Background task started with ID: ${taskId}`, task_id: taskId };
                 }
-                const taskId = await this.backgroundAgent.startTask(p.prompt);
-                return { success: true, message: `Background task started with ID: ${taskId}`, task_id: taskId };
-            }
-            case 'list_background_tasks': {
-                const tasks = await this.backgroundAgent.listTasks();
-                const summary = tasks.map(t => `ID: ${t.id} | Status: ${t.status} | Started: ${new Date(t.startTime).toISOString()} | Prompt: "${t.prompt.substring(0, 50)}..."`).join('\n');
-                return { success: true, message: `Active Tasks:\n${summary || 'No active tasks.'}` };
-            }
-            case 'check_background_task': {
-                if (!p.task_id || typeof p.task_id !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: task_id (string)' };
+                case 'list_background_tasks': {
+                    const tasks = await this.backgroundAgent.listTasks();
+                    const summary = tasks.map(t => `ID: ${t.id} | Status: ${t.status} | Started: ${new Date(t.startTime).toISOString()} | Prompt: "${t.prompt.substring(0, 50)}..."`).join('\n');
+                    return { success: true, message: `Active Tasks:\n${summary || 'No active tasks.'}` };
                 }
-                const logs = await this.backgroundAgent.getTaskLogs(p.task_id);
-                return { success: true, logs };
-            }
-            case 'start_background_task': {
-                if (!p.prompt || typeof p.prompt !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: prompt (string)' };
+                case 'check_background_task': {
+                    if (!p.task_id || typeof p.task_id !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: task_id (string)' };
+                    }
+                    const logs = await this.backgroundAgent.getTaskLogs(p.task_id);
+                    return { success: true, logs };
                 }
-                const taskId = await this.backgroundAgent.startTask(p.prompt);
-                return { success: true, message: `Background task started with ID: ${taskId}`, task_id: taskId };
-            }
-            case 'list_background_tasks': {
-                const tasks = await this.backgroundAgent.listTasks();
-                const summary = tasks.map(t => `ID: ${t.id} | Status: ${t.status} | Started: ${new Date(t.startTime).toISOString()} | Prompt: "${t.prompt.substring(0, 50)}..."`).join('\n');
-                return { success: true, message: `Active Tasks:\n${summary || 'No active tasks.'}` };
-            }
-            case 'check_background_task': {
-                if (!p.task_id || typeof p.task_id !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: task_id (string)' };
+                case 'start_background_task': {
+                    if (!p.prompt || typeof p.prompt !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: prompt (string)' };
+                    }
+                    const taskId = await this.backgroundAgent.startTask(p.prompt);
+                    return { success: true, message: `Background task started with ID: ${taskId}`, task_id: taskId };
                 }
-                const logs = await this.backgroundAgent.getTaskLogs(p.task_id);
-                return { success: true, logs };
-            }
-            case 'search_code_graph': {
-                if (!p.query || typeof p.query !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: query (symbol name)' };
+                case 'list_background_tasks': {
+                    const tasks = await this.backgroundAgent.listTasks();
+                    const summary = tasks.map(t => `ID: ${t.id} | Status: ${t.status} | Started: ${new Date(t.startTime).toISOString()} | Prompt: "${t.prompt.substring(0, 50)}..."`).join('\n');
+                    return { success: true, message: `Active Tasks:\n${summary || 'No active tasks.'}` };
                 }
-                const results = await this.codeGraph.findReferences(p.query);
-                return { success: true, message: results };
-            }
-            case 'analyze_code_for_tests': {
-                if (!p.file_path || typeof p.file_path !== 'string') {
-                    return { error: true, success: false, message: 'Missing required parameter: file_path (string)' };
+                case 'check_background_task': {
+                    if (!p.task_id || typeof p.task_id !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: task_id (string)' };
+                    }
+                    const logs = await this.backgroundAgent.getTaskLogs(p.task_id);
+                    return { success: true, logs };
                 }
-                return this.analyzeCodeForTests(p.file_path);
-            }
-            case 'resolve_merge_conflicts': {
-                const files = await this.conflictSolver.findConflictingFiles();
-                if (files.length === 0) {
-                    return { success: true, message: 'No merge conflicts found in the project.' };
-                }
-                // If specific file requested, use it; otherwise default to first
-                const targetFile = (p.file_path && typeof p.file_path === 'string') ? p.file_path : files[0];
-                // Ensure target is in the list or we try to parse it anyway
-                const conflictData = await this.conflictSolver.parseConflicts(targetFile);
-                if (!conflictData) {
-                    return { success: false, message: `Could not parse conflicts in ${targetFile}. Markers might be missing or malformed.`, other_files: files };
+                case 'search_code_graph': {
+                    if (!p.query || typeof p.query !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: query (symbol name)' };
+                    }
+                    const results = await this.codeGraph.findReferences(p.query);
+                    return { success: true, message: results };
                 }
-                return {
-                    success: true,
-                    message: `Found ${files.length} conflicting files. Showing conflicts for: ${targetFile}`,
-                    conflicts: conflictData.conflicts.map(c => ({
-                        id: c.index,
-                        lines: `${c.startLine}-${c.endLine}`,
-                        ours: c.ours,
-                        theirs: c.theirs,
-                        base: c.base
-                    })),
-                    other_conflicting_files: files.filter(f => f !== targetFile)
-                };
-            }
-            case 'delegate_subtask': {
-                if (!p.task || typeof p.task !== 'string')
-                    return { error: true, success: false, message: 'Missing task' };
-                if (!p.worker_type || typeof p.worker_type !== 'string')
-                    return { error: true, success: false, message: 'Missing worker_type (agent mode)' };
-                if (!isValidMode(p.worker_type)) {
-                    return { error: true, success: false, message: `Invalid worker_type: ${p.worker_type}. Must be a valid AgentMode.` };
-                }
-                const result = await this.swarmOrchestrator.delegateSubtask(p.worker_type, p.task);
-                return {
-                    success: result.success,
-                    result: result.result,
-                    status: result.status,
-                    worker: p.worker_type
-                };
+                case 'analyze_code_for_tests': {
+                    if (!p.file_path || typeof p.file_path !== 'string') {
+                        return { error: true, success: false, message: 'Missing required parameter: file_path (string)' };
+                    }
+                    return this.analyzeCodeForTests(p.file_path);
+                }
+                case 'resolve_merge_conflicts': {
+                    const files = await this.conflictSolver.findConflictingFiles();
+                    if (files.length === 0) {
+                        return { success: true, message: 'No merge conflicts found in the project.' };
+                    }
+                    // If specific file requested, use it; otherwise default to first
+                    const targetFile = (p.file_path && typeof p.file_path === 'string') ? p.file_path : files[0];
+                    // Ensure target is in the list or we try to parse it anyway
+                    const conflictData = await this.conflictSolver.parseConflicts(targetFile);
+                    if (!conflictData) {
+                        return { success: false, message: `Could not parse conflicts in ${targetFile}. Markers might be missing or malformed.`, other_files: files };
+                    }
+                    return {
+                        success: true,
+                        message: `Found ${files.length} conflicting files. Showing conflicts for: ${targetFile}`,
+                        conflicts: conflictData.conflicts.map(c => ({
+                            id: c.index,
+                            lines: `${c.startLine}-${c.endLine}`,
+                            ours: c.ours,
+                            theirs: c.theirs,
+                            base: c.base
+                        })),
+                        other_conflicting_files: files.filter(f => f !== targetFile)
+                    };
+                }
+                case 'delegate_subtask': {
+                    if (!p.task || typeof p.task !== 'string')
+                        return { error: true, success: false, message: 'Missing task' };
+                    if (!p.worker_type || typeof p.worker_type !== 'string')
+                        return { error: true, success: false, message: 'Missing worker_type (agent mode)' };
+                    if (!isValidMode(p.worker_type)) {
+                        return { error: true, success: false, message: `Invalid worker_type: ${p.worker_type}. Must be a valid AgentMode.` };
+                    }
+                    const result = await this.swarmOrchestrator.delegateSubtask(p.worker_type, p.task);
+                    return {
+                        success: result.success,
+                        result: result.result,
+                        status: result.status,
+                        worker: p.worker_type
+                    };
+                }
+                case 'synthesize_tool': {
+                    const name = typeof p.name === 'string' ? p.name.trim() : '';
+                    const description = typeof p.description === 'string' ? p.description.trim() : '';
+                    const script = typeof p.script === 'string' ? p.script.trim() : '';
+                    if (!name || !script) {
+                        return { error: true, success: false, message: 'Missing required parameters: name (string), script (string). description is optional.' };
+                    }
+                    if (!/^[a-z][a-z0-9_]*$/.test(name)) {
+                        return { error: true, success: false, message: 'Tool name must be lowercase letters, numbers, underscores only (e.g. my_helper).' };
+                    }
+                    const reserved = new Set(['read_file', 'write_file', 'run_command', 'synthesize_tool', 'get_context']);
+                    if (reserved.has(name)) {
+                        return { error: true, success: false, message: `Cannot override built-in tool: ${name}` };
+                    }
+                    this.dynamicTools.set(name, { description: description || name, script });
+                    return { success: true, message: `Tool "${name}" registered. You can call it with the same name. Execution is sandboxed.` };
+                }
+                default:
+                    return { error: true, success: false, message: `Unknown tool: ${toolName}. Available tools: read_file, read_multiple_files, write_file, edit_file, edit_lines, insert_at_line, verified_edit, list_directory, search_files, run_command, create_directory, delete_file, move_file, get_context, revert_file, run_tests, get_test_status, get_git_status, get_git_diff_summary, get_git_changed_files, create_git_checkpoint, revert_to_git_checkpoint, git_show_diff, get_mcp_status, grep_code, web_search, fetch_url, remember_lesson, synthesize_tool, take_screenshot, get_console_logs, run_visual_test, check_accessibility, measure_performance, test_responsive, capture_network, run_playwright_test, search_skills_sh, install_skill_from_skills_sh, preview_app, delegate_subtask` };
             }
-            default:
-                return { error: true, success: false, message: `Unknown tool: ${toolName}. Available tools: read_file, read_multiple_files, write_file, edit_file, edit_lines, insert_at_line, verified_edit, list_directory, search_files, run_command, create_directory, delete_file, move_file, get_context, revert_file, run_tests, get_test_status, get_git_status, get_git_diff_summary, get_git_changed_files, create_git_checkpoint, revert_to_git_checkpoint, git_show_diff, get_mcp_status, grep_code, web_search, fetch_url, remember_lesson, take_screenshot, get_console_logs, run_visual_test, check_accessibility, measure_performance, test_responsive, capture_network, run_playwright_test, search_skills_sh, install_skill_from_skills_sh, preview_app, delegate_subtask` };
+        }
+        catch (err) {
+            return { error: true, success: false, message: err?.message ?? String(err) };
         }
     }
     /**
@@ -1335,6 +1362,19 @@ export class CodingToolExecutor {
                     required: ['trigger', 'action', 'outcome']
                 }
             },
+            {
+                name: 'synthesize_tool',
+                description: 'Register a new session-scoped tool (meta-agent). Use when you need a reusable script for repeated operations or after repeated failures. The script runs in the same sandbox as run_command. Name must be lowercase with underscores (e.g. my_helper).',
+                input_schema: {
+                    type: 'object',
+                    properties: {
+                        name: { type: 'string', description: 'Tool name (lowercase, letters/numbers/underscores only)' },
+                        description: { type: 'string', description: 'Short description of what the tool does' },
+                        script: { type: 'string', description: 'Shell command or script to run when the tool is invoked (e.g. "grep -r pattern src/")' }
+                    },
+                    required: ['name', 'script']
+                }
+            },
             {
                 name: 'take_screenshot',
                 description: 'Take a screenshot of a web page. Useful for verifying UI appearance or capturing the state of a web app.',
@@ -1576,7 +1616,12 @@ export class CodingToolExecutor {
         }
         // Merge plugin tools
         const pluginTools = this.pluginManager.getPluginTools();
-        return [...coreTools, ...mcpTools, ...pluginTools];
+        const dynamicToolDefs = Array.from(this.dynamicTools.entries()).map(([name, def]) => ({
+            name,
+            description: `[Session tool] ${def.description}`,
+            input_schema: { type: 'object', properties: {} },
+        }));
+        return [...coreTools, ...dynamicToolDefs, ...mcpTools, ...pluginTools];
     }
     /**
      * Resolve relative file path to absolute path
@@ -1587,7 +1632,10 @@ export class CodingToolExecutor {
      * @internal
      */
     resolvePath(filePath) {
-        return path.resolve(this.workingDir, filePath);
+        const result = sanitizePath(this.workingDir, filePath);
+        if (!result.ok)
+            throw new Error(result.message);
+        return result.path;
     }
     /**
      * Read file contents
@@ -1901,6 +1949,12 @@ export class CodingToolExecutor {
      * @risk-level High
      * @since 0.1.0
      */
+    async runDynamicTool(toolName, _input) {
+        const def = this.dynamicTools.get(toolName);
+        if (!def)
+            return { error: true, success: false, message: `Dynamic tool "${toolName}" not found` };
+        return this.runCommand(def.script, this.workingDir, undefined, 60);
+    }
     async runCommand(command, cwd, input, timeout) {
         const workDir = cwd ? this.resolvePath(cwd) : this.workingDir;
         const timeoutMs = (timeout || 120) * 1000;
@@ -2584,8 +2638,12 @@ export class CodingToolExecutor {
     }
     // ── fetch_url: read any URL as text ────────────────────────
     async fetchUrl(url, maxLength = 20000) {
+        const urlResult = sanitizeUrl(url.trim());
+        if (!urlResult.ok) {
+            return { error: true, success: false, message: urlResult.message };
+        }
         try {
-            const response = await fetch(url, {
+            const response = await fetch(urlResult.url, {
                 headers: {
                     'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
                     'Accept': 'text/html,application/xhtml+xml,text/plain,application/json',
@@ -2628,7 +2686,7 @@ export class CodingToolExecutor {
             const content = truncated ? text.slice(0, maxLength) + '\n... [truncated]' : text;
             return {
                 success: true,
-                url,
+                url: urlResult.url,
                 contentType: contentType.split(';')[0],
                 length: text.length,
                 truncated,