u

src/tools/javascript.js

@@ -116,9 +116,9 @@ function formatSandboxError(code, report) {
 
 /**
  * Creates the javascript_execute tool bound to the authenticated user and their company.
- * @param {{ googleAuthId: number, companyId: number }} ctx
+ * @param {{ googleAuthId: number }} ctx
  */
-export function createJavascriptExecuteTool({ googleAuthId, companyId }) {
+export function createJavascriptExecuteTool({ googleAuthId }) {
     return defineTool({
         name: 'javascript_execute',
         description:
@@ -130,10 +130,13 @@ export function createJavascriptExecuteTool({ googleAuthId, companyId }) {
             'To query the Dashback REST API from JavaScript: call `await fetch("/route")` (e.g. `const res = await fetch("/article/2"); const data = await res.json();`). ' +
             'Relative paths automatically resolve against Dashback and are authenticated with your user credentials. ' +
             'A virtual filesystem (fs / vfs) is available to store and retrieve artifacts (files, images, JSON data, buffers) across runs (e.g. `fs.writeFileSync("artifact.json", data)`). ' +
-'IMAGES WRITTEN TO THE VFS ARE DISPLAYED INLINE IN THE CHAT. After writing an image into the virtual filesystem (e.g. `fs.writeFileSync("artifacts/example.png", buf)` or `sharp(...).toFile("images/example.png")`), ' +
+'IMAGES WRITTEN TO THE VFS ARE DISPLAYED INLINE IN THE CHAT. After writing an image into the virtual filesystem (e.g. `fs.writeFileSync("artifacts/example.png", buf)`), ' +
         'reference the exact path you wrote with standard markdown `![title](artifacts/example.png)` and it renders as an image inline. ' +
    'Note the `image/` folder is reserved for database images and is read-only; write generated images anywhere else. ' +
       'Always embed images you generate this way so the user sees them. Other file types do not render inline. ' +
+            'For TEXT use the dedicated find_files / read_file / patch tools instead of hand-rolling fs calls — they validate paths and persist to the database. ' +
+            'Use this sandbox for BINARY work and computation: images, PDFs, buffers, charts, encoding. ' +
+            'To find or inspect images, use the search_images and analyze_image tools — they are not available inside the sandbox. ' +
             'The `sharp` image library is a pre-injected GLOBAL. ' +
             'Also global: `validateLabelObjects(objects)` and `validateLabelObject(object)` from react-canvas-label-editor. ' +
             'CRYPTO: only the WebCrypto global `crypto` is available. Node\'s `crypto` module is NOT installed, so ' +
@@ -154,7 +157,8 @@ export function createJavascriptExecuteTool({ googleAuthId, companyId }) {
                         'JavaScript source to run in a CommonJS wrapper. Set `module.exports` to return a value; ' +
                         'for async code assign the PROMISE, e.g. `module.exports = (async () => { ... })()`. ' +
                         'To query Dashback REST API: `const res = await fetch("/article/2"); const data = await res.json();`. ' +
-                        'To persist artifacts between runs: use `fs.writeFileSync("name.ext", data)` and `fs.readFileSync("name.ext")`. ' +
+                        'To persist BINARY artifacts between runs: use `fs.writeFileSync("name.ext", buffer)` and `fs.readFileSync("name.ext")`. ' +
+                        'For text files prefer the find_files / read_file / patch tools. ' +
        'Bare top-level `await` is a syntax error here — always wrap it in that async IIFE. ' +
      'Globals available: `fetch`, `console`, `fs`/`vfs`, `sharp`, `performance`, `URL`, `URLSearchParams`, `Headers`, ' +
     '`Request`, `Response`, `FormData`, `Blob`, `File`, `TextEncoder`, `TextDecoder`, `AbortController`, ' +
@@ -178,12 +182,12 @@ export function createJavascriptExecuteTool({ googleAuthId, companyId }) {
             const hardTimeout = Math.min(Math.max(1000, Number(timeout) || DEFAULT_TIMEOUT_MS), MAX_TIMEOUT_MS);
             const maxOutput = Math.max(1000, Number(max_output) || DEFAULT_MAX_OUTPUT);
 
-            const vfsRoot = await prepareVfs({ companyId, googleAuthId });
+            const vfsRoot = await prepareVfs({ googleAuthId });
             let report;
             try {
                 report = await runInWorker({ code, timeoutMs: hardTimeout, vfsRoot, googleAuthId });
             } finally {
-                await syncVfsToDb({ googleAuthId, companyId, vfsRoot });
+                await syncVfsToDb({ googleAuthId, vfsRoot });
             }
 
             if (report.timedOut) {