From 965bd34adec58924579d8eebaf3b32887fec8403 Mon Sep 17 00:00:00 2001
From: seb <sebgreenbus@gmail.com>
Date: Tue, 6 Oct 2026 12:29:29 +0200
Subject: [PATCH] u

---
 src/tools/javascript.js | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/src/tools/javascript.js b/src/tools/javascript.js
index 8840a4b..9a95dfb 100644
--- a/src/tools/javascript.js
+++ b/src/tools/javascript.js
@@ -58,16 +58,16 @@ function runInWorker({ code, timeoutMs, vfsRoot, googleAuthId }) {
             // result made the sandbox appear to run for 0ms and return nothing.
             if (!msg || msg.__sandboxReport !== true) {
                 // Those loader notices fire many times per run, so warn ONCE per key rather
-    // than on every message — expected, benign noise while running under --watch.
-          for (const key of Object.keys(msg || {})) {
-            if (!WATCH_NOISE_WARNED.has(key)) {
-  WATCH_NOISE_WARNED.add(key);
-        console.warn(
-       `[javascript_execute] ignoring non-sandbox worker message "${key}" ` +
-      '(expected under `node --watch`; logged once per key).'
-       );
-        }
-            }
+                // than on every message — expected, benign noise while running under --watch.
+                for (const key of Object.keys(msg || {})) {
+                    if (!WATCH_NOISE_WARNED.has(key)) {
+                        WATCH_NOISE_WARNED.add(key);
+                        console.warn(
+                            `[javascript_execute] ignoring non-sandbox worker message "${key}" ` +
+                            '(expected under `node --watch`; logged once per key).'
+                        );
+                    }
+                }
                 return;
             }
             finish(msg);
@@ -122,11 +122,11 @@ export function createJavascriptExecuteTool({ googleAuthId }) {
     return defineTool({
         name: 'javascript_execute',
         description:
-            'Execute JS in isolated Node worker sandbox. Assign `module.exports` to return value (sync value or Promise; no bare top-level await — wrap async in IIFE: `module.exports = (async () => { ... })()`). ' +
+            'Execute JS in isolated worker sandbox. Assign `module.exports` to return value (sync value or Promise; wrap async in IIFE: `module.exports = (async () => { ... })()`). ' +
             'REST API: `await fetch("/path")` (authenticated). ' +
-            'VFS: `fs.readFileSync`/`writeFileSync` for binary artifacts/buffers/images (`image/` is read-only). ' +
-            'Embed generated images in markdown: `![alt](path)`. Use find_files/read_file/patch for text. ' +
-            'Globals: `fs`/`vfs`, `sharp`, WebCrypto `crypto` (`subtle`, `randomUUID`), web standard globals. Node built-ins unavailable (`require` fails).',
+            'VFS: directly use global `fs.readFileSync`/`writeFileSync` for binary artifacts/buffers/images (`image/` is read-only; paths must be relative paths, root is not allowed). ' +
+            'Embed generated images in markdown: `![alt](relative/path)`. Use find_files/read_file/patch for text. ' +
+            'All APIs are pre-injected globals: `fs`/`vfs` (virtual filesystem), `sharp` (image processing), WebCrypto `crypto` (`subtle`, `randomUUID`), and standard web globals. Do NOT use `require()` or `import` (disabled; all necessary APIs are already in global scope).',
         strict: false,
         parameters: {
             type: 'object',
@@ -135,7 +135,7 @@ export function createJavascriptExecuteTool({ googleAuthId }) {
             properties: {
                 code: {
                     type: 'string',
-                    description: 'CommonJS JS code. Assign result to `module.exports`. Async code must use IIFE.',
+                    description: 'JavaScript code. Assign result to `module.exports`. Async code must use IIFE. Do not use require() or import.',
                 },
                 timeout: {
                     type: 'number',