feat: add remote URL attachment support and project editing endpoint

README.md

@@ -56,7 +56,7 @@ devplacepy/
 | `/news` | Developer news listing, detail page with comments |
 | `/posts` | Post detail, creation |
 | `/comments` | Comment creation, deletion |
-| `/projects` | Project listing, creation, and per-project visibility toggles: `POST /projects/{slug}/private` (owner-only visibility) and `POST /projects/{slug}/readonly` (immutable files) |
+| `/projects` | Project listing, creation, owner editing (`POST /projects/edit/{slug}`), and per-project visibility toggles: `POST /projects/{slug}/private` (owner-only visibility) and `POST /projects/{slug}/readonly` (immutable files) |
 | `/projects/{slug}/files` | Per-project filesystem: directory and file CRUD, upload, inline editing, and line-range operations (`lines` read, `replace-lines`, `insert-lines`, `delete-lines`, `append`) for surgical edits to large text files (public read, owner write; all writes refused while the project is read-only) |
 | `/zips` | Zip job status (`/zips/{uid}`) and archive download (`/zips/{uid}/download`); archives are queued via `/projects/{slug}/zip` and `/projects/{slug}/files/zip` |
 | `/forks` | Fork job status (`/forks/{uid}`); forks are queued via `/projects/{slug}/fork`. Any signed-in user can fork a project they can view into a new project they own; once the job finishes the response carries the new project URL |
@@ -410,12 +410,20 @@ Configuration on the Services tab:
 | `devii_rsearch_url` | `https://rsearch.app.molodetz.nl` | Base URL of the web search service those tools call |
 | `devii_rsearch_timeout` | `300` | Read timeout (seconds) for `rsearch_*` calls; web-grounded answers can take minutes; minimum five minutes |
 
-Beyond the platform tools, Devii has external **web search** tools - `rsearch` (web/image
-search), `rsearch_answer` (a web-grounded AI answer with sources), `rsearch_chat` (direct AI
-chat), and `rsearch_describe_image` (vision). These reach an external public service rather
-than this platform, so platform tools are always preferred; Devii uses them only when the user
-explicitly asks to search the web or an outside source. They are gated by `devii_rsearch_enabled`
-and the service URL is configurable via `devii_rsearch_url`.
+Beyond the platform tools, Devii has external **web** tools. `fetch_url` reads a web page;
+`http_request` makes an arbitrary HTTP call (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS) to any
+external REST/JSON API with custom headers and a JSON, form, or raw body, returning the full
+response (non-2xx is returned rather than raised so API errors are readable). Both carry an SSRF
+guard (private and loopback addresses are refused) and a size cap. `attach_url` downloads a public
+URL on the server and stores it as a real attachment through the same pipeline as a direct upload,
+returning a uid Devii then passes in `attachment_uids` when creating a post, project, gist, comment,
+bug, or message - so a user can ask Devii to attach an image straight from the internet. Devii also
+has external **web search** tools - `rsearch` (web/image search), `rsearch_answer` (a web-grounded
+AI answer with sources), `rsearch_chat` (direct AI chat), and `rsearch_describe_image` (vision).
+These reach an external public service rather than this platform, so platform tools are always
+preferred; Devii uses them only when the user explicitly asks to search the web or an outside
+source. They are gated by `devii_rsearch_enabled` and the service URL is configurable via
+`devii_rsearch_url`.
 
 A `devii` console script ships the same agent as an interactive terminal: