@cjhyy/code-shell-core 0.5.0-rc.2 → 0.6.0-rc.2

package/dist/tool-system/builtin/read.js

@@ -4,7 +4,7 @@
 import { readFile, stat } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { fileCache } from "./file-cache.js";
-import { enforcePathPolicy } from "../path-policy.js";
+import { toLf } from "./eol.js";
 export const readToolDef = {
     name: "Read",
     description: "Read a file from the local filesystem. Returns the file content with line numbers. " +
@@ -31,13 +31,6 @@ export async function readTool(args, ctx) {
     const filePath = args.file_path;
     if (!filePath)
         return "Error: file_path is required";
-    // Path policy: in-workspace reads pass through; sensitive paths (~/.ssh,
-    // .env, etc.) and outside-workspace reads are refused with an explanatory
-    // error. existsSync check stays AFTER the policy gate — we don't want to
-    // probe sensitive paths' existence as a side-channel.
-    const blocked = enforcePathPolicy(filePath, "read", ctx?.cwd);
-    if (blocked)
-        return blocked;
     if (!existsSync(filePath))
         return `Error: File not found: ${filePath}`;
     try {
@@ -54,10 +47,17 @@ export async function readTool(args, ctx) {
             content = await readFile(filePath, "utf-8");
             fileCache.set(filePath, content, fileInfo.mtimeMs);
         }
-        const lines = content.split("\n");
+        // Split on LF after normalizing CRLF → LF so a Windows (CRLF) file doesn't
+        // render a trailing ^M on every line. Display-only; the file isn't written.
+        const lines = toLf(content).split("\n");
         const totalLines = lines.length;
         const offset = Math.max(1, args.offset || 1);
-        const limit = args.limit || 2000;
+        // A non-positive limit (a misbehaving caller passing 0 / -5 / NaN) falls back
+        // to the default page size — NOT through to `lines.slice(start, start+limit)`
+        // with a NEGATIVE end, which JS reads as "all but the last N" and would
+        // silently return the wrong window. `|| 2000` only caught 0/NaN, not negatives.
+        const rawLimit = args.limit;
+        const limit = typeof rawLimit === "number" && rawLimit > 0 ? rawLimit : 2000;
         const end = Math.min(totalLines, offset - 1 + limit);
         const selected = lines.slice(offset - 1, end);
         let numbered = selected.map((line, i) => `${offset + i}\t${line}`).join("\n");

package/dist/tool-system/builtin/repl.js

@@ -34,7 +34,10 @@ const REPL_MAX_BUFFER = 1024 * 1024;
 export async function replTool(args, ctx) {
     const language = args.language;
     const code = args.code;
-    const timeout = args.timeout ?? 30_000;
+    // `??` only catches null/undefined — a non-positive timeout (0/-5) would slip
+    // through to setTimeout (clamped to 0 → near-instant kill). Floor to default.
+    const rawTimeout = args.timeout;
+    const timeout = typeof rawTimeout === "number" && rawTimeout > 0 ? rawTimeout : 30_000;
     // A4: child process runs in the Engine's cwd, not the host process cwd.
     const cwd = ctx?.cwd ?? process.cwd();
     if (!code.trim()) {

package/dist/tool-system/builtin/skill.js

@@ -42,6 +42,14 @@ export async function skillTool(args, ctx) {
     // ordering is observable but not load-bearing.
     const disabledSkills = ctx?.disabledSkills;
     const disabledPlugins = ctx?.disabledPlugins;
+    const skillAllowlist = ctx?.skillAllowlist;
+    // Sub-agent skill isolation: when this agent has an allowlist, a skill
+    // outside it must be refused — even invoking it by exact name. The scan
+    // below also drops it, but an explicit message beats a misleading "not
+    // found" for a skill that exists in the project but isn't this agent's.
+    if (skillAllowlist !== undefined && !skillAllowlist.includes(skillName)) {
+        return `Skill "${skillName}" is not available to this sub-agent. This agent's role restricts it to: ${skillAllowlist.length > 0 ? skillAllowlist.join(", ") : "(no skills)"}.`;
+    }
     if (disabledSkills && disabledSkills.includes(skillName)) {
         return `Skill "${skillName}" is disabled. Enable it in Customize or remove it from settings.disabledSkills.`;
     }
@@ -58,6 +66,7 @@ export async function skillTool(args, ctx) {
     const skills = scanSkills(ctx?.cwd ?? process.cwd(), {
         disabledSkills,
         disabledPlugins,
+        skillAllowlist,
     });
     const found = skills.find((s) => s.name === skillName);
     if (!found) {

package/dist/tool-system/builtin/sleep.js

@@ -3,8 +3,9 @@
  */
 export const sleepToolDef = {
     name: "Sleep",
-    description: "Pause execution for a specified number of seconds. " +
-        "Useful for polling workflows or waiting for external processes. " +
+    description: "Pause execution for a brief, deterministic wait (e.g. letting a just-started service settle for a few seconds). " +
+        "Do NOT use Sleep to poll for or wait on background work (background shells, async sub-agents, video generation): " +
+        "the system wakes you automatically when that work completes — just end your turn instead of looping Sleep. " +
         "Maximum duration is 300 seconds (5 minutes).",
     inputSchema: {
         type: "object",

package/dist/tool-system/builtin/tool-search.js

@@ -31,20 +31,38 @@ export async function toolSearchTool(args, ctx) {
         return "Error: query is required";
     if (!ctx?.toolRegistry)
         return "Error: ToolSearch is not configured (no registry in ctx)";
-    const maxResults = Math.min(args.max_results || 5, 20);
+    // Floor to default on non-positive: a negative max_results would reach
+    // `.slice(0, maxResults)` with a negative end (= all but the last N), silently
+    // returning the wrong tool set. `|| 5` only caught 0/NaN, not negatives.
+    const rawMax = args.max_results;
+    const maxResults = Math.min(typeof rawMax === "number" && rawMax > 0 ? rawMax : 5, 20);
+    // The tool registry is worker-SHARED (B1): it holds MCP tools registered by
+    // every session, including servers another project enabled. ToolSearch is a
+    // side door around the per-turn toolDefs filter — without this gate it would
+    // surface (and let the model `select:` into) MCP tools from a server THIS
+    // session never enabled, which is exactly the chrome-devtools-in-writeflow
+    // leak. Mirror the engine's toolDefs visibility: keep an MCP tool only when
+    // its server is in this session's allowedMcpServers. Undefined set = no
+    // gating (sub-agents / hosts that don't populate it).
+    const visible = (tool) => {
+        if (tool.source !== "mcp")
+            return true;
+        const allowed = ctx.allowedMcpServers;
+        return !allowed || allowed.has(tool.serverName ?? "");
+    };
     // "select:Name1,Name2" → exact match
     if (query.startsWith("select:")) {
         const names = query.slice(7).split(",").map((n) => n.trim());
-        return matchExact(ctx.toolRegistry, names);
+        return matchExact(ctx.toolRegistry, names, visible);
     }
     // Keyword search
-    return searchByKeyword(ctx.toolRegistry, query, maxResults);
+    return searchByKeyword(ctx.toolRegistry, query, maxResults, visible);
 }
-function matchExact(registry, names) {
+function matchExact(registry, names, visible) {
     const results = [];
     for (const name of names) {
         const tool = registry.getTool(name);
-        if (tool) {
+        if (tool && visible(tool)) {
             results.push(formatTool(tool));
         }
         else {
@@ -53,8 +71,8 @@ function matchExact(registry, names) {
     }
     return results.join("\n\n---\n\n");
 }
-function searchByKeyword(registry, query, maxResults) {
-    const allTools = registry.listToolsDetailed();
+function searchByKeyword(registry, query, maxResults, visible) {
+    const allTools = registry.listToolsDetailed().filter(visible);
     const queryLower = query.toLowerCase();
     const keywords = queryLower.split(/\s+/);
     // Score each tool

package/dist/tool-system/builtin/video-providers.d.ts

@@ -0,0 +1,154 @@
+/**
+ * VideoProvider — adapter interface for text-to-video generation (TODO 7.1).
+ *
+ * Unlike images (one request → bytes), video generation is asynchronous and
+ * long: SUBMIT a job → POLL its status until it finishes → DOWNLOAD the bytes.
+ * The interface captures exactly those three steps so the GenerateVideo tool's
+ * background polling loop is provider-agnostic, and concrete adapters
+ * (Seedance/Kling — filled in once their private API docs are available) only
+ * implement submit/poll/download.
+ *
+ * Credentials are resolved by the tool layer from settings; adapters are pure
+ * "creds + request → job lifecycle". `fetch` is injected for testability.
+ */
+export interface VideoProviderCreds {
+    baseUrl: string;
+    apiKey: string;
+}
+export interface VideoSubmitRequest {
+    prompt: string;
+    model: string;
+    creds: VideoProviderCreds;
+    /** Single image URL (http/https) — image-to-video. Back-compat. */
+    image?: string;
+    /** Multiple image URLs — ≥2 triggers reference-to-video. Takes precedence over `image`. */
+    images?: string[];
+    /** Reference/continuation video URLs (http/https) — passed through to fal's `video_urls`. Reference them in the prompt as @Video1/@Video2. Forces reference-to-video. */
+    videos?: string[];
+    signal?: AbortSignal;
+}
+export type VideoSubmitResult = {
+    ok: true;
+    jobId: string;
+} | {
+    ok: false;
+    error: string;
+};
+export type VideoPollResult = {
+    ok: true;
+    status: "running";
+} | {
+    ok: true;
+    status: "succeeded";
+} | {
+    ok: true;
+    status: "failed";
+    error: string;
+} | {
+    ok: false;
+    error: string;
+};
+export type VideoDownloadResult = {
+    ok: true;
+    bytes: Uint8Array;
+    ext: string;
+    url?: string;
+} | {
+    ok: false;
+    error: string;
+};
+export interface VideoProvider {
+    readonly kind: string;
+    submit(req: VideoSubmitRequest): Promise<VideoSubmitResult>;
+    poll(req: {
+        jobId: string;
+        creds: VideoProviderCreds;
+        signal?: AbortSignal;
+    }): Promise<VideoPollResult>;
+    download(req: {
+        jobId: string;
+        creds: VideoProviderCreds;
+        signal?: AbortSignal;
+    }): Promise<VideoDownloadResult>;
+}
+/**
+ * Deterministic in-memory adapter for tests and local dev — no network. Models
+ * the three-step lifecycle: submit mints a job; poll returns `running` for the
+ * first N calls then `succeeded` (or `failed` after M); download returns the
+ * configured bytes. Lets the GenerateVideo background loop be tested end-to-end
+ * before any real (Seedance/Kling) adapter exists.
+ */
+export declare class FakeVideoProvider implements VideoProvider {
+    private readonly opts;
+    readonly kind = "fake";
+    private polls;
+    private counter;
+    constructor(opts?: {
+        succeedAfterPolls?: number;
+        failAfterPolls?: number;
+        failMessage?: string;
+        bytes?: string;
+    });
+    submit(_req: VideoSubmitRequest): Promise<VideoSubmitResult>;
+    poll(req: {
+        jobId: string;
+        creds?: VideoProviderCreds;
+        signal?: AbortSignal;
+    }): Promise<VideoPollResult>;
+    download(_req: {
+        jobId: string;
+        creds?: VideoProviderCreds;
+        signal?: AbortSignal;
+    }): Promise<VideoDownloadResult>;
+}
+/**
+ * fal.ai video adapter — submit/poll/download against the fal queue API
+ * (https://queue.fal.run). model id selects the underlying model
+ * (e.g. fal-ai/kling-video/v3/pro/text-to-video). When `image` is present we
+ * switch a `...text-to-video` model to `...image-to-video` and send image_url,
+ * so callers only need to pass an image to get i2v.
+ *
+ * IMPORTANT: fal's status/result URLs use a model-FAMILY prefix
+ * (`fal-ai/kling-video/requests/<id>`), NOT the full submit path
+ * (`.../v3/pro/text-to-video/requests/<id>` → HTTP 405). So we never
+ * reconstruct those URLs; we encode the `status_url` + `response_url` that
+ * submit returns into the jobId (`<status_url>|<response_url>`) and use them
+ * verbatim in poll/download. Verified against the live API 2026-06-10.
+ */
+export declare class FalVideoProvider implements VideoProvider {
+    private readonly fetchImpl;
+    readonly kind = "fal";
+    constructor(fetchImpl?: typeof fetch);
+    /** Effective image list: images[] wins; else single image; else []. */
+    private imageList;
+    /**
+     * Does this model family support reference-to-video (multi-image)? Verified
+     * 2026-06-10 against the live API: Seedance has it; Kling does NOT (routing a
+     * Kling model to `.../reference-to-video` 404s at result fetch). Keep this a
+     * conservative allowlist — only families confirmed to expose the endpoint.
+     */
+    private supportsReference;
+    /** Route model suffix by image count: 0→text, 1→image, ≥2→reference. */
+    private resolveModel;
+    /** jobId = `${statusUrl}|${responseUrl}` (fal returns both from submit). */
+    private split;
+    submit(req: VideoSubmitRequest): Promise<VideoSubmitResult>;
+    poll(req: {
+        jobId: string;
+        creds: VideoProviderCreds;
+        signal?: AbortSignal;
+    }): Promise<VideoPollResult>;
+    download(req: {
+        jobId: string;
+        creds: VideoProviderCreds;
+        signal?: AbortSignal;
+    }): Promise<VideoDownloadResult>;
+}
+/** Default model per video provider kind (filled in with real adapters). */
+export declare const DEFAULT_VIDEO_MODEL: Record<string, string>;
+/**
+ * Registry of video-provider adapters, keyed by `kind`. Only `fake` exists
+ * today (test/dev). Real adapters (seedance, kling) are intentionally absent
+ * until their private API contracts are confirmed — see TODO 7.1 块3.
+ */
+export declare function getVideoProvider(kind: string, fetchImpl?: typeof fetch): VideoProvider | null;

package/dist/tool-system/builtin/video-providers.js

@@ -0,0 +1,235 @@
+/**
+ * VideoProvider — adapter interface for text-to-video generation (TODO 7.1).
+ *
+ * Unlike images (one request → bytes), video generation is asynchronous and
+ * long: SUBMIT a job → POLL its status until it finishes → DOWNLOAD the bytes.
+ * The interface captures exactly those three steps so the GenerateVideo tool's
+ * background polling loop is provider-agnostic, and concrete adapters
+ * (Seedance/Kling — filled in once their private API docs are available) only
+ * implement submit/poll/download.
+ *
+ * Credentials are resolved by the tool layer from settings; adapters are pure
+ * "creds + request → job lifecycle". `fetch` is injected for testability.
+ */
+/**
+ * Deterministic in-memory adapter for tests and local dev — no network. Models
+ * the three-step lifecycle: submit mints a job; poll returns `running` for the
+ * first N calls then `succeeded` (or `failed` after M); download returns the
+ * configured bytes. Lets the GenerateVideo background loop be tested end-to-end
+ * before any real (Seedance/Kling) adapter exists.
+ */
+export class FakeVideoProvider {
+    opts;
+    kind = "fake";
+    polls = new Map();
+    counter = 0;
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    async submit(_req) {
+        this.counter += 1;
+        const jobId = `fakejob-${this.counter}`;
+        this.polls.set(jobId, 0);
+        return { ok: true, jobId };
+    }
+    async poll(req) {
+        const n = this.polls.get(req.jobId) ?? 0;
+        this.polls.set(req.jobId, n + 1);
+        if (this.opts.failAfterPolls !== undefined && n >= this.opts.failAfterPolls) {
+            return { ok: true, status: "failed", error: this.opts.failMessage ?? "job failed" };
+        }
+        if (this.opts.succeedAfterPolls !== undefined && n >= this.opts.succeedAfterPolls) {
+            return { ok: true, status: "succeeded" };
+        }
+        return { ok: true, status: "running" };
+    }
+    async download(_req) {
+        return { ok: true, bytes: Buffer.from(this.opts.bytes ?? "FAKE_VIDEO"), ext: "mp4" };
+    }
+}
+/**
+ * fal.ai video adapter — submit/poll/download against the fal queue API
+ * (https://queue.fal.run). model id selects the underlying model
+ * (e.g. fal-ai/kling-video/v3/pro/text-to-video). When `image` is present we
+ * switch a `...text-to-video` model to `...image-to-video` and send image_url,
+ * so callers only need to pass an image to get i2v.
+ *
+ * IMPORTANT: fal's status/result URLs use a model-FAMILY prefix
+ * (`fal-ai/kling-video/requests/<id>`), NOT the full submit path
+ * (`.../v3/pro/text-to-video/requests/<id>` → HTTP 405). So we never
+ * reconstruct those URLs; we encode the `status_url` + `response_url` that
+ * submit returns into the jobId (`<status_url>|<response_url>`) and use them
+ * verbatim in poll/download. Verified against the live API 2026-06-10.
+ */
+export class FalVideoProvider {
+    fetchImpl;
+    kind = "fal";
+    constructor(fetchImpl = fetch) {
+        this.fetchImpl = fetchImpl;
+    }
+    /** Effective image list: images[] wins; else single image; else []. */
+    imageList(req) {
+        if (req.images && req.images.length)
+            return req.images;
+        if (req.image)
+            return [req.image];
+        return [];
+    }
+    /**
+     * Does this model family support reference-to-video (multi-image)? Verified
+     * 2026-06-10 against the live API: Seedance has it; Kling does NOT (routing a
+     * Kling model to `.../reference-to-video` 404s at result fetch). Keep this a
+     * conservative allowlist — only families confirmed to expose the endpoint.
+     */
+    supportsReference(model) {
+        return /seedance/i.test(model);
+    }
+    /** Route model suffix by image count: 0→text, 1→image, ≥2→reference. */
+    resolveModel(model, imageCount) {
+        const target = imageCount >= 2 ? "reference-to-video" : imageCount === 1 ? "image-to-video" : null;
+        if (target && /(text|image|reference)-to-video$/.test(model)) {
+            return model.replace(/(text|image|reference)-to-video$/, target);
+        }
+        return model;
+    }
+    /** jobId = `${statusUrl}|${responseUrl}` (fal returns both from submit). */
+    split(jobId) {
+        const idx = jobId.indexOf("|");
+        if (idx < 0)
+            return { statusUrl: jobId, responseUrl: jobId };
+        return { statusUrl: jobId.slice(0, idx), responseUrl: jobId.slice(idx + 1) };
+    }
+    async submit(req) {
+        const base = req.creds.baseUrl.replace(/\/+$/, "");
+        const imgs = this.imageList(req);
+        const vids = req.videos ?? [];
+        // Multi-image OR any reference video needs the reference-to-video endpoint,
+        // which only some families (Seedance) expose. Routing e.g. Kling there
+        // 404s at result fetch — fail fast with a clear message instead.
+        const needsReference = imgs.length >= 2 || vids.length > 0;
+        if (needsReference && !this.supportsReference(req.model)) {
+            return {
+                ok: false,
+                error: `model "${req.model}" does not support reference-to-video (multiple images or reference videos). Use a Seedance model, or pass a single image / no video.`,
+            };
+        }
+        // imageCount alone can't express "reference needed"; bump to 2 when a video
+        // forces the reference endpoint so resolveModel picks reference-to-video.
+        const refImageCount = needsReference ? Math.max(imgs.length, 2) : imgs.length;
+        const model = this.resolveModel(req.model, refImageCount);
+        const body = { prompt: req.prompt };
+        if (imgs.length >= 2)
+            body.image_urls = imgs;
+        else if (imgs.length === 1)
+            body.image_url = imgs[0];
+        if (vids.length > 0)
+            body.video_urls = vids;
+        try {
+            const r = await this.fetchImpl(`${base}/${model}`, {
+                method: "POST",
+                headers: { Authorization: `Key ${req.creds.apiKey}`, "Content-Type": "application/json" },
+                body: JSON.stringify(body),
+                signal: req.signal,
+            });
+            if (!r.ok) {
+                const t = await r.text().catch(() => "");
+                return { ok: false, error: `fal submit failed: HTTP ${r.status} ${t}`.trim() };
+            }
+            const j = (await r.json());
+            if (!j.request_id)
+                return { ok: false, error: "fal submit: no request_id in response" };
+            // Prefer the URLs fal hands back; fall back to family-prefix reconstruction
+            // only if they're absent (defensive — live API always returns them).
+            const statusUrl = j.status_url ?? "";
+            const responseUrl = j.response_url ?? "";
+            if (!statusUrl || !responseUrl) {
+                return { ok: false, error: "fal submit: missing status_url/response_url" };
+            }
+            return { ok: true, jobId: `${statusUrl}|${responseUrl}` };
+        }
+        catch (err) {
+            return { ok: false, error: `fal submit error: ${err.message}` };
+        }
+    }
+    async poll(req) {
+        const { statusUrl } = this.split(req.jobId);
+        try {
+            const r = await this.fetchImpl(statusUrl, {
+                method: "GET",
+                headers: { Authorization: `Key ${req.creds.apiKey}` },
+                signal: req.signal,
+            });
+            // fal returns 200/202 for valid in-progress/queued states; only treat a
+            // hard client/server error (4xx except 202, 5xx) as a transport failure.
+            if (!r.ok && r.status !== 202) {
+                const t = await r.text().catch(() => "");
+                return { ok: false, error: `fal status failed: HTTP ${r.status} ${t}`.trim() };
+            }
+            const j = (await r.json());
+            switch (j.status) {
+                case "IN_QUEUE":
+                case "IN_PROGRESS":
+                    return { ok: true, status: "running" };
+                case "COMPLETED":
+                    return { ok: true, status: "succeeded" };
+                default:
+                    return { ok: true, status: "failed", error: `fal status: ${j.status ?? "unknown"}` };
+            }
+        }
+        catch (err) {
+            return { ok: false, error: `fal poll error: ${err.message}` };
+        }
+    }
+    async download(req) {
+        const { responseUrl } = this.split(req.jobId);
+        try {
+            // hop 1: result JSON
+            const r = await this.fetchImpl(responseUrl, {
+                method: "GET",
+                headers: { Authorization: `Key ${req.creds.apiKey}` },
+                signal: req.signal,
+            });
+            if (!r.ok) {
+                const t = await r.text().catch(() => "");
+                return { ok: false, error: `fal result failed: HTTP ${r.status} ${t}`.trim() };
+            }
+            const j = (await r.json());
+            const videoUrl = j.video?.url;
+            if (!videoUrl)
+                return { ok: false, error: "fal result: no video.url" };
+            // hop 2: video bytes
+            const vr = await this.fetchImpl(videoUrl, { method: "GET", signal: req.signal });
+            if (!vr.ok) {
+                return { ok: false, error: `fal video download failed: HTTP ${vr.status}` };
+            }
+            const buf = new Uint8Array(await vr.arrayBuffer());
+            const m = /\.([a-z0-9]{2,4})(?:\?|$)/i.exec(videoUrl);
+            const ext = m ? m[1].toLowerCase() : "mp4";
+            // Surface the fal-hosted URL so the model can reuse it for video extension
+            // (videos[] → video_urls) without re-uploading. Note: signed/expiring.
+            return { ok: true, bytes: buf, ext, url: videoUrl };
+        }
+        catch (err) {
+            return { ok: false, error: `fal download error: ${err.message}` };
+        }
+    }
+}
+/** Default model per video provider kind (filled in with real adapters). */
+export const DEFAULT_VIDEO_MODEL = {
+    fal: "fal-ai/kling-video/v3/pro/text-to-video",
+};
+/**
+ * Registry of video-provider adapters, keyed by `kind`. Only `fake` exists
+ * today (test/dev). Real adapters (seedance, kling) are intentionally absent
+ * until their private API contracts are confirmed — see TODO 7.1 块3.
+ */
+export function getVideoProvider(kind, fetchImpl = fetch) {
+    switch (kind) {
+        case "fake":
+            return new FakeVideoProvider({ succeedAfterPolls: 0 });
+        case "fal":
+            return new FalVideoProvider(fetchImpl);
+        default:
+            return null;
+    }
+}

package/dist/tool-system/builtin/web-fetch.js

@@ -176,7 +176,12 @@ export async function webFetchTool(args) {
     catch {
         return `Error: invalid URL "${url}"`;
     }
-    const maxLength = Math.min(args.max_length || DEFAULT_MAX, MAX_OUTPUT);
+    // A non-positive max_length must NOT reach `text.slice(0, maxLength)` below
+    // with a negative end — JS reads that as "all but the last N", silently
+    // returning the WRONG bytes (+ a misleading "truncated" suffix). `|| DEFAULT`
+    // only caught 0/NaN, not negatives. Floor to the default page size first.
+    const rawMaxLength = args.max_length;
+    const maxLength = Math.min(typeof rawMaxLength === "number" && rawMaxLength > 0 ? rawMaxLength : DEFAULT_MAX, MAX_OUTPUT);
     const rawHeaders = args.headers ?? {};
     const baseHeaders = {
         "User-Agent": "Mozilla/5.0 (compatible; code-shell/0.1; +https://github.com/nicepkg/code-shell)",
@@ -192,7 +197,12 @@ export async function webFetchTool(args) {
     // host, and DNS-resolved IPs against the block lists. fetch() runs
     // with redirect: "manual" so the runtime cannot silently follow a
     // redirect into private/loopback/metadata space.
+    // Combine the 30s fetch timeout with the run's abort signal (registry injects
+    // __signal) so a user Stop cancels an in-flight fetch promptly, not only on
+    // the 30s timeout. Timeout alone was the previous behavior.
     const timeoutSignal = AbortSignal.timeout(30_000);
+    const userSignal = args.__signal;
+    const fetchSignal = userSignal ? AbortSignal.any([userSignal, timeoutSignal]) : timeoutSignal;
     let currentUrl = parsed;
     let currentHeaders = { ...baseHeaders };
     const originalOrigin = parsed;
@@ -206,7 +216,7 @@ export async function webFetchTool(args) {
             const res = await fetch(currentUrl, {
                 headers: currentHeaders,
                 redirect: "manual",
-                signal: timeoutSignal,
+                signal: fetchSignal,
             });
             // Not a redirect: return body (or HTTP error).
             if (res.status < 300 || res.status >= 400 || !res.headers.get("location")) {

package/dist/tool-system/builtin/web-search.js

@@ -119,23 +119,34 @@ export async function webSearchTool(args, ctx) {
     const query = args.query;
     if (!query)
         return "Error: query is required";
-    const numResults = Math.min(args.num_results || 10, 20);
+    // Floor to default on non-positive: a negative num_results would reach
+    // `results.slice(0, num)` with a negative end (= all but the last N), silently
+    // returning the wrong result set. `|| 10` only caught 0/NaN, not negatives.
+    const rawNum = args.num_results;
+    const numResults = Math.min(typeof rawNum === "number" && rawNum > 0 ? rawNum : 10, 20);
     // Use the run's cwd (e.g. an automation job's project dir) so per-project
     // settings resolve correctly; falls back to process.cwd() when absent.
     const config = resolveSearchConfig(ctx?.cwd);
     if (config.source === "none") {
         return "Error: No search provider configured. Open desktop 设置 → 连接 to add credentials, or set SERPER_API_KEY / TAVILY_API_KEY / SEARXNG_URL.";
     }
+    // A search provider's fetch had NO timeout and NO abort wiring — a hung/slow
+    // provider blocked the tool indefinitely and a user Stop couldn't cancel it.
+    // Give every provider call a 20s timeout, combined with the run's abort
+    // signal (registry injects __signal) so Stop is prompt.
+    const userSignal = args.__signal;
+    const timeoutSignal = AbortSignal.timeout(20_000);
+    const signal = userSignal ? AbortSignal.any([userSignal, timeoutSignal]) : timeoutSignal;
     try {
         let results;
         if (config.provider === "serper" && config.apiKey) {
-            results = await searchSerper(query, numResults, config.apiKey);
+            results = await searchSerper(query, numResults, config.apiKey, signal);
         }
         else if (config.provider === "tavily" && config.apiKey) {
-            results = await searchTavily(query, numResults, config.apiKey);
+            results = await searchTavily(query, numResults, config.apiKey, signal);
         }
         else if (config.provider === "searxng" && config.baseUrl) {
-            results = await searchSearXNG(query, numResults, config.baseUrl);
+            results = await searchSearXNG(query, numResults, config.baseUrl, signal);
         }
         else {
             return `Error: provider "${config.provider}" missing ${config.provider === "searxng" ? "base URL" : "API key"}`;
@@ -150,7 +161,7 @@ export async function webSearchTool(args, ctx) {
         return `Search error: ${err.message}`;
     }
 }
-async function searchSerper(query, num, apiKey) {
+async function searchSerper(query, num, apiKey, signal) {
     const res = await fetch("https://google.serper.dev/search", {
         method: "POST",
         headers: {
@@ -158,6 +169,7 @@ async function searchSerper(query, num, apiKey) {
             "Content-Type": "application/json",
         },
         body: JSON.stringify({ q: query, num }),
+        signal,
     });
     if (!res.ok)
         throw new Error(`Serper API error: ${res.status} ${res.statusText}`);
@@ -168,7 +180,7 @@ async function searchSerper(query, num, apiKey) {
         snippet: item.snippet ?? "",
     }));
 }
-async function searchTavily(query, num, apiKey) {
+async function searchTavily(query, num, apiKey, signal) {
     const res = await fetch("https://api.tavily.com/search", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -178,6 +190,7 @@ async function searchTavily(query, num, apiKey) {
             max_results: num,
             include_answer: false,
         }),
+        signal,
     });
     if (!res.ok)
         throw new Error(`Tavily API error: ${res.status} ${res.statusText}`);
@@ -188,13 +201,14 @@ async function searchTavily(query, num, apiKey) {
         snippet: item.content ?? "",
     }));
 }
-async function searchSearXNG(query, num, baseUrl) {
+async function searchSearXNG(query, num, baseUrl, signal) {
     const url = new URL("/search", baseUrl);
     url.searchParams.set("q", query);
     url.searchParams.set("format", "json");
     url.searchParams.set("pageno", "1");
     const res = await fetch(url.toString(), {
         headers: { Accept: "application/json" },
+        signal,
     });
     if (!res.ok)
         throw new Error(`SearXNG error: ${res.status} ${res.statusText}`);