Merge branch 'main' into rajbos/fluency-shared-server

Resolve conflict in sharing-server/src/routes/dashboard.ts import line.
Both admin approaches coexist: inline admin section on /dashboard and
separate /admin route added by main.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: rajbos

.github/agents/tool-names.agent.md

@@ -124,6 +124,7 @@ When adding a new tool to `toolNames.json`, also determine if it belongs in `aut
 - The file is a plain JSON array of tool ID strings
 - Add new entries at the end of the array (before the closing `]`)
 - Keep related tool variants together (e.g., all variants of `read_file`)
+- **Case-insensitive deduplication**: Before adding a tool ID, check if a differently-cased variant (e.g., lowercase equivalent) is already in the array. If `grep` is already there, do **not** add `Grep`. Only add a capitalized variant if the lowercase form is absent.
 
 
 
@@ -134,6 +135,7 @@ When adding a new tool to `toolNames.json`, also determine if it belongs in `aut
 - Insert new MCP entries near existing entries with the same prefix
 - Insert new non-MCP entries alphabetically or near logically related tools
 - Never remove existing entries
+- **Case-insensitive deduplication**: Before adding a new tool ID, check whether a lowercase (or differently-cased) variant already exists. If `grep` is already mapped, do **not** add `Grep`. If `tool_search` is already mapped, do **not** add `ToolSearch`. The lookup code handles exact-match only, so capitalized variants do map differently — but if both would resolve to the *exact same friendly name*, skip the duplicate. Only add a capitalized variant when it has a meaningfully different name or the lowercase form does not exist at all.
 
 ### Validation
 

.github/workflows/actionlint.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 

.github/workflows/build.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+      uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
       with:
         egress-policy: audit
 

.github/workflows/check-models.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 

.github/workflows/check-toolnames.yml

@@ -18,7 +18,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 
@@ -90,12 +90,21 @@ jobs:
           
               already_added = []
               needs_adding = []
+              case_variants = []
           
               for tool in tools:
                   if tool in known_tools:
                       already_added.append((tool, known_tools[tool]))
                   else:
-                      needs_adding.append(tool)
+                      # Case-insensitive check: if a differently-cased variant already
+                      # exists with the same friendly name, flag it as a case variant
+                      # rather than a missing entry — it should NOT be added separately.
+                      lower_tool = tool.lower()
+                      case_match = next((k for k in known_tools if k.lower() == lower_tool), None)
+                      if case_match and known_tools[case_match] == known_tools.get(tool, known_tools[case_match]):
+                          case_variants.append((tool, case_match, known_tools[case_match]))
+                      else:
+                          needs_adding.append(tool)
           
               lines = ["## 🔍 Toolnames Checkup", ""]
               lines.append("Checked the tool names in this issue against `vscode-extension/src/toolNames.json` on the `main` branch:")
@@ -110,6 +119,18 @@ jobs:
                       lines.append(f"| `{tool}` | {friendly} |")
                   lines.append("")
           
+              if case_variants:
+                  lines.append("### ⚠️ Case variant of an existing entry — do not add")
+                  lines.append("")
+                  lines.append("These tool names differ only in capitalisation from an entry that is already mapped.")
+                  lines.append("**Do not add a separate entry** — the existing lowercase form covers this tool.")
+                  lines.append("")
+                  lines.append("| Tool Name (from issue) | Existing Entry | Friendly Name |")
+                  lines.append("| --- | --- | --- |")
+                  for tool, existing, friendly in case_variants:
+                      lines.append(f"| `{tool}` | `{existing}` | {friendly} |")
+                  lines.append("")
+          
               if needs_adding:
                   lines.append("### ❌ Not yet in `toolNames.json`")
                   lines.append("")
@@ -119,8 +140,10 @@ jobs:
                       lines.append(f"| `{tool}` |")
                   lines.append("")
           
-              if already_added and not needs_adding:
+              if already_added and not needs_adding and not case_variants:
                   lines.append("> **All tool names in this issue are already mapped.** This issue may be a duplicate — consider closing it.")
+              elif case_variants and not needs_adding:
+                  lines.append("> **All unmapped tool names are case variants of existing entries.** No new entries should be added. Consider closing this issue.")
               elif needs_adding:
                   lines.append(f"> **{len(needs_adding)} tool name(s) still need to be added.** Please use the `tool-names` custom agent or update `vscode-extension/src/toolNames.json` manually.")
           

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+      uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
       with:
         egress-policy: audit
 
@@ -113,7 +113,7 @@ jobs:
       vscode_src_changed: ${{ steps.detect.outputs.changed }}
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+      uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
       with:
         egress-policy: audit
 
@@ -143,7 +143,7 @@ jobs:
 
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+      uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
       with:
         egress-policy: audit
 
@@ -229,7 +229,7 @@ jobs:
 
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+      uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
       with:
         egress-policy: audit
 

.github/workflows/cli-build.yml

@@ -28,7 +28,7 @@ jobs:
       cli-relevant: ${{ github.event_name == 'push' || steps.filter.outputs.cli-relevant == 'true' }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 
@@ -61,7 +61,7 @@ jobs:
         node-version: 24
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 

.github/workflows/cli-publish.yml

@@ -44,7 +44,7 @@ jobs:
         working-directory: cli
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 

.github/workflows/codeql.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 

.github/workflows/copilot-setup-steps.yml

@@ -31,7 +31,7 @@ jobs:
     # If you do not check out your code, Copilot will do this for you.
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit