refactor: update app specification generation and XML handling

- Enhanced instructions for generating app specifications to clarify XML output requirements.
- Updated permission mode in spec generation options to ensure read-only access.
- Improved logging to capture XML content extraction and handle potential issues with incomplete responses.
- Ensured that only valid XML is saved, avoiding conversational text from the response.

apps/server/src/lib/app-spec-format.ts

@@ -63,10 +63,11 @@ export function getAppSpecFormatInstruction(): string {
 ${APP_SPEC_XML_FORMAT}
 
 CRITICAL FORMATTING REQUIREMENTS:
+- Do NOT use the Write, Edit, or Bash tools to create files - just OUTPUT the XML in your response
 - Your ENTIRE response MUST be valid XML following the exact template structure above
 - Do NOT use markdown formatting (no # headers, no **bold**, no - lists, etc.)
 - Do NOT include any explanatory text, prefix, or suffix outside the XML tags
-- Do NOT include phrases like "Based on my analysis..." or "I'll create..." before the XML
+- Do NOT include phrases like "Based on my analysis...", "I'll create...", "Let me analyze..." before the XML
 - Do NOT include any text before <project_specification> or after </project_specification>
 - Your response must start IMMEDIATELY with <project_specification> with no preceding text
 - Your response must end IMMEDIATELY with </project_specification> with no following text

apps/server/src/lib/sdk-options.ts

@@ -164,6 +164,10 @@ export function createSpecGenerationOptions(
 ): Options {
   return {
     ...getBaseOptions(),
+    // Override permissionMode - spec generation only needs read-only tools
+    // Using "acceptEdits" can cause Claude to write files to unexpected locations
+    // See: https://github.com/AutoMaker-Org/automaker/issues/149
+    permissionMode: "default",
     model: getModelForUseCase("spec", config.model),
     maxTurns: MAX_TURNS.maximum,
     cwd: config.cwd,
@@ -186,6 +190,8 @@ export function createFeatureGenerationOptions(
 ): Options {
   return {
     ...getBaseOptions(),
+    // Override permissionMode - feature generation only needs read-only tools
+    permissionMode: "default",
     model: getModelForUseCase("features", config.model),
     maxTurns: MAX_TURNS.quick,
     cwd: config.cwd,