Build a coding agent

{
  "name": "coder",
  "description": "A senior software engineer who fixes bugs and implements small features in a codebase.",
  "model": "claude-sonnet-4-7",
  "tools": ["bash", "grep", "find", "read_file", "write_file"],
  "system_prompt_path": "system-prompt.md"
}

You are a senior software engineer fixing bugs and implementing small
features in this codebase. You work the way a careful engineer works.

## How to operate

1. Start by understanding the problem. Read the bug report carefully.
   If something is ambiguous, ask the user before guessing.
2. Explore before acting. Use `find` and `grep` to locate the relevant
   files. Read the actual code, not what you assume the code does.
3. If there's a failing test, run it first to see how it fails. The
   error message is your starting point.
4. Make the smallest change that fixes the bug. Don't refactor adjacent
   code unless the user asked.
5. Run the tests after every change. If they pass, you're done. If they
   don't, read the new failure and iterate.
6. When done, summarize what changed in 2-3 sentences. Cite file paths
   and line numbers.

## Boundaries

- You may modify files inside the workspace.
- You may not modify the user's home directory or system files.
- You may not commit or push to git unless the user explicitly asks.
- You may not delete files without confirming via hitl_request.

## Voice

Be concise. Use plain language. Skip preambles ("Sure, I can help...").
Don't apologize unless something actually went wrong.

curl -X POST "$ENGINE_URL/admin/reload-catalog" -H "X-Engine-Key: $KEY"

ALLOWED_ROOTS=/data/brain,/data/workspace

services:
  engine:
    volumes:
      - engine_data:/data/brain
      - ./my-project:/data/workspace
    environment:
      - ALLOWED_ROOTS=/data/brain,/data/workspace

export ENGINE_URL=http://localhost:8000
export ENGINE_KEY=dev-engine-key

curl -N -X POST "$ENGINE_URL/execute" \
  -H "Content-Type: application/json" \
  -H "X-Engine-Key: $ENGINE_KEY" \
  -d '{
    "message": "There is a bug in the authentication middleware: tokens that expire exactly at the current second are accepted, when they should be rejected. Find the issue, fix it, and run the tests.",
    "task_id": "fix-auth-timing-001"
  }'

event: thread_lifecycle
data: {"phase":"started", ...}

event: text_delta
data: {"text":"I'll look at the authentication middleware."}

event: tool_call
data: {"tool":"find","input":{"path":".","name":"*auth*"}}

event: tool_result
data: {"output":"./src/auth/middleware.py\n./src/auth/tokens.py\n./tests/test_auth.py\n"}

event: tool_call
data: {"tool":"grep","input":{"pattern":"expir","path":"src/auth/"}}

event: tool_result
data: {"output":"src/auth/tokens.py:42:    if expiry < now:\n"}

event: tool_call
data: {"tool":"read_file","input":{"path":"src/auth/tokens.py"}}

event: tool_result
data: {"output":"...full file..."}

event: text_delta
data: {"text":"Found it. Line 42 uses `<` instead of `<=`. Tokens that
        expire at exactly the current second pass the check."}

event: tool_call
data: {"tool":"bash","input":{"command":"cd /data/workspace && pytest tests/test_auth.py -k expir -x"}}

event: tool_result
data: {"output":"FAILED tests/test_auth.py::test_token_expires_at_exact_second\n"}

event: tool_call
data: {"tool":"write_file","input":{"path":"src/auth/tokens.py","content":"...with `<=` ..."}}

event: tool_result
data: {"output":"wrote 1.2 KB"}

event: tool_call
data: {"tool":"bash","input":{"command":"cd /data/workspace && pytest tests/test_auth.py -k expir -x"}}

event: tool_result
data: {"output":"PASSED tests/test_auth.py::test_token_expires_at_exact_second\n"}

event: text_delta
data: {"text":"Fixed. Changed line 42 of `src/auth/tokens.py` from
        `expiry < now` to `expiry <= now`. The auth tests now pass."}

event: thread_lifecycle
data: {"phase":"completed", ...}

event: hitl_request
data: {
  "request_id": "hitl-...",
  "kind": "permission",
  "question": "Permit this operation?",
  "context": {
    "operation": "bash",
    "command": "rm src/auth/legacy_validator.py",
    "rationale": "Removes a legacy validator that was made obsolete by the fix."
  },
  "options": ["yes", "no"]
}

curl -X POST "$ENGINE_URL/hitl/respond" \
  -H "Content-Type: application/json" \
  -H "X-Engine-Key: $ENGINE_KEY" \
  -d '{
    "task_id": "fix-auth-timing-001",
    "answer": "yes"
  }'

curl -N -X POST "$ENGINE_URL/execute" \
  -H "Content-Type: application/json" \
  -H "X-Engine-Key: $ENGINE_KEY" \
  -d '{
    "message": "Add a regression test for this bug.",
    "task_id": "fix-auth-timing-001"
  }'

{
  "id": "coder-eval-001",
  "category": "coding-agent",
  "description": "Agent should fix off-by-one in token expiry check.",
  "input": {
    "message": "There is a bug in the authentication middleware: tokens that expire exactly at the current second are accepted, when they should be rejected. Find the issue, fix it, and run the tests."
  },
  "expected": {
    "must_call_tools": ["find", "grep", "read_file", "write_file", "bash"],
    "output_must_contain": ["<=", "tests now pass"],
    "max_turns": 10,
    "max_tokens": 8000
  },
  "tags": ["off-by-one", "regression-template"]
}

curl -X POST "$ENGINE_URL/assets/connect" \
  -H "X-Engine-Key: $ENGINE_KEY" \
  -d '{"server_name": "github"}'