@thincoder/core 0.9.5 → 0.10.1

package/tools/edit-diff.mjs

@@ -372,7 +372,7 @@ export async function runSingleEdit(args, ctx) {
     op: "write",
     record: { type: "edit", startLine: out.editStartLine, shift: out.lineShift },
   })
-  const diff = gitDiffOne(ctx.cwd, abs)
+  const diff = await gitDiffOne(ctx.cwd, abs)
   const baseResult = out.deleted
     ? `Deleted ${deleteTarget(out)} of ${args.path}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
     : `Edited ${args.path}: replaced ${out.occurrences} occurrence(s)${out.note ? ` — ${out.note}` : ""}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
@@ -387,29 +387,10 @@ export async function runSingleEdit(args, ctx) {
   })
 }
 
-// ─── edit 回执形态注入缝（#69——「回执形态按端注入」，形态参 §2.13.5 注入缝）──────────
 /**
- * 回执组装注入位（**缺省不覆盖** = CLI 回执形态（base + 写入点上下文）——零行为变；
- * 端装配层可覆盖为本端回执形态）。核内零端名分支（契约 5——本档只认 `format` 函数名）。
- * 契约：`format(fields) → string | null | undefined | Promise<同>`——null / undefined =
- * 未处理 ⇒ 回默认回执；其余返回值即该条回执。
- */
-let injectedReceipt = null
-export function configureEditReceipt(impl) {
-  injectedReceipt = impl && typeof impl.format === "function" ? impl : null
-}
-/** 撤销注入（测试与端装配生命周期用——缺省态 = CLI 回执）。 */
-export function resetEditReceipt() { injectedReceipt = null }
-
-/**
- * edit 回执组装单点（单形态 / 数组形态共用——#69）：先组默认回执（base + 写入点上下文），
- * 注入面命中 ⇒ 以其 format(fields) 返回值为准（`fields.default` = 默认回执原文，供端侧改写）。
+ * edit 回执组装单点（单形态 / 数组形态共用）：`base` + 写入点上下文——唯一形态
+ * （#69 注入面已退场；余字段为调用面统一形，不参与组装）。
  */
 export async function composeEditReceipt(fields) {
-  const defaultText = await appendWriteContext(fields.abs, fields.writeLine, fields.base)
-  if (injectedReceipt) {
-    const out = await injectedReceipt.format({ ...fields, default: defaultText })
-    if (out !== null && out !== undefined) return String(out)
-  }
-  return defaultText
+  return await appendWriteContext(fields.abs, fields.writeLine, fields.base)
 }

package/tools/exec-run.mjs

@@ -14,10 +14,17 @@
  *   · `run(cmd, args, opts) → Promise<string> | string`——成功给 stdout；
  *   · 失败以 Error reject——`.stdout` / `.stderr` / `.code` 与 `execFileSync` 错误同形
  *     （端侧现形 = 宿主 `runInterruptible`）；
- *   · `opts = { cwd?, timeout?, signal? }`——**默认径忽略 signal**（execFileSync 不可中断，
- *     与现行 CLI 行为逐字同）；注入径自决（如 abort ⇒ 树杀）。
+ *   · `opts = { cwd?, timeout?, signal?, env? }`——**默认径忽略 signal**（execFileSync 不可中断，
+ *     与现行 CLI 行为逐字同）；`env` 缺省（undefined）不设 = 继承（逐字零变），给定则透传
+ *     （Electron 宿主旗标径 = TOOLS.md §6.18）；注入径自决（如 abort ⇒ 树杀）。
+ *
+ * **可中断执行器上提（R3 · 桌面功能对位批 · #523②）**：`runInterruptible` 自端侧现形
+ * （`thincoder-vscode/src/tools/shared.mjs`）**纯搬**落核（零语义改 —— KD-T2）；两端改指核件
+ * （VSC `configureExecRun({ run: runInterruptible })` 同轮改指；桌面 `src/main/exec-run.mjs` 消费）。
+ * 树杀 = 本仓 `tools/process-tree.mjs` 单源（`killProcessTree` —— 转口，零第二实现）。
  */
-import { execFileSync } from "node:child_process"
+import { execFileSync, spawn } from "node:child_process"
+import { killProcessTree } from "./process-tree.mjs"
 
 let injected = null
 
@@ -29,10 +36,11 @@ export function configureExecRun(impl) {
 /** 撤销注入（测试与端装配生命周期用——缺省态 = execFileSync 默认径）。 */
 export function resetExecRun() { injected = null }
 
-/** 默认径（CLI 语义——utf8 + timeout + stdio ignore/pipe/pipe；cwd 未给则不设）。 */
+/** 默认径（CLI 语义——utf8 + timeout + stdio ignore/pipe/pipe；cwd ∕ env 未给则不设）。 */
 function defaultRun(cmd, args, opts) {
   const options = { encoding: "utf8", timeout: opts.timeout, stdio: ["ignore", "pipe", "pipe"] }
   if (opts.cwd !== undefined) options.cwd = opts.cwd
+  if (opts.env !== undefined) options.env = opts.env
   return execFileSync(cmd, args, options)
 }
 
@@ -41,3 +49,93 @@ export async function runCommand(cmd, args, opts = {}) {
   if (injected) return await injected.run(cmd, args, opts)
   return defaultRun(cmd, args, opts)
 }
+
+/**
+ * 可中断执行器（**上提件** —— 端侧 `configureExecRun` 供值；原住 `thincoder-vscode/src/tools/shared.mjs`，
+ * 逐字搬运 —— R3 · #523②）：`spawn`（非 `execSync` —— 同步执行阻塞事件循环：长 lint ∕ verify 期间
+ * Stop 点击连“送达”都做不到）跑命令，abort ∕ timeout ⇒ 整树杀（本档 `killProcessTree` 单源）。
+ *
+ * 成功 → resolve stdout 串（与 `execFileSync` 调用点兼容）。
+ * 非零退出 ∕ spawn 失败 ∕ 超时 ∕ 中止 → reject 携 `.stdout` / `.stderr` / `.code`（同 `execFileSync` 错误形）。
+ */
+export function runInterruptible(cmd, args, opts = {}) {
+  const { cwd, timeout, signal, env } = opts
+  return new Promise((resolve, reject) => {
+    let child
+    try {
+      child = spawn(cmd, args, {
+        cwd, env: env ?? process.env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true,
+        // First-line abort guard: Node kills the direct child on signal abort.
+        ...(signal ? { signal } : {}),
+      })
+    } catch (e) {
+      reject(e)
+      return
+    }
+    let stdout = "", stderr = "", settled = false, timer = null, kickTimer = null, mode = null
+
+    const KICK_MS = 3000
+    const finish = (err, out) => {
+      if (settled) return
+      settled = true
+      if (timer) clearTimeout(timer)
+      if (kickTimer) clearTimeout(kickTimer)
+      signal?.removeEventListener("abort", onAbort)
+      if (err) {
+        err.stdout = stdout
+        err.stderr = stderr
+        reject(err)
+      } else {
+        resolve(out)
+      }
+    }
+    // Kill the whole tree on abort/timeout — grandchildren (npm test's children)
+    // must die too, or they keep the stdout/stderr pipes and "close" never fires.
+    const killTree = () => { try { killProcessTree(child) } catch { /* already gone */ } }
+    // Kick-clockback: settle even if "close" never arrives (a grandchild that
+    // mocks kill signal, or a wedged pipe). Prevents a hang + leaked pipes.
+    const armKick = (err) => {
+      if (kickTimer) return
+      kickTimer = setTimeout(() => finish(err), KICK_MS)
+    }
+
+    const onAbort = () => {
+      if (mode) return
+      mode = "abort"
+      const e = new Error("aborted by user (Stop)")
+      e.name = "AbortError"
+      killTree()
+      armKick(e)
+    }
+
+    if (timeout) {
+      timer = setTimeout(() => {
+        if (mode) return
+        mode = "timeout"
+        const e = new Error(`timed out after ${timeout}ms`)
+        e.name = "TimeoutError"
+        killTree()
+        armKick(e)
+      }, timeout)
+    }
+
+    child.stdout?.on("data", (d) => { stdout += d })
+    child.stderr?.on("data", (d) => { stderr += d })
+    child.on("error", (e) => { if (e.name === "AbortError") return; finish(e) })
+    child.on("close", (code) => {
+      if (mode === "abort") { const e = new Error("aborted by user (Stop)"); e.name = "AbortError"; return finish(e) }
+      if (mode === "timeout") { const e = new Error(`timed out after ${timeout}ms`); e.name = "TimeoutError"; return finish(e) }
+      if (code === 0) finish(null, stdout)
+      else {
+        const e = new Error(`command failed with exit code ${code}`)
+        e.code = code
+        finish(e)
+      }
+    })
+
+    if (signal) {
+      if (signal.aborted) { onAbort(); return }
+      signal.addEventListener("abort", onAbort, { once: true })
+    }
+  })
+}

package/tools/execute.mjs

@@ -28,13 +28,14 @@ import { spawn } from "node:child_process"
 import { resolve } from "node:path"
 import { DESC } from "./shared.mjs"
 import { killProcessTree } from "./process-tree.mjs"
+import { nodeChildEnv } from "./node-child.mjs"
 
 const MAX_SCRIPT = 50_000
 const MAX_OUTPUT = 50_000
 const DEFAULT_TIMEOUT = 30_000
 
 /**
- * 超时错误文本——带重试引导（TOOLS.md §14.1 D14.1.2——"下一跳"）：数字 = 实际生效的
+ * 超时错误文本——带重试引导（"下一跳"）：数字 = 实际生效的
  * timeoutMs（Math.min(t, 600_000) 或默认 30s）——上限 600000 与 schema/头注/execute.md 一致。
  */
 const timeoutErrorText = (timeoutMs) =>
@@ -83,6 +84,8 @@ function runNode(childArgs, baseDir, timeoutMs, signal) {
   return new Promise((resolvePromise) => {
     const child = spawn(process.execPath, childArgs, {
       cwd: baseDir,
+      // TOOLS.md §6.18：Electron 宿主 execPath 属 Electron 族二进制——补旗标按 node 语义启动
+      env: nodeChildEnv(),
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
       // POSIX detached → 子进程为组首——killProcessTree 的 -pid 组杀可达孙进程（win 用
@@ -223,7 +226,7 @@ export const executeTool = {
       if (code.length > MAX_SCRIPT) {
         return `Error: script too large (${code.length} > ${MAX_SCRIPT} bytes). Split into smaller scripts or use individual tools.`
       }
-      // inline mode: pure node ESM — no prelude, nothing injected (TOOLS.md §12).
+      // inline mode: pure node ESM — no prelude, nothing injected.
       childArgs = ["--input-type=module", "--eval", code]
     }
 

package/tools/file.mjs

@@ -19,7 +19,7 @@ import { runSingleEdit } from "./edit-diff.mjs";
 import { writeThroughPath, clearDirty, clearLastWrite, lastWriteOf, isDirty } from "./write-path.mjs";
 import { specForModel } from "../config.mjs";
 import { createHash } from "node:crypto";
-import { mkdir, readFile, stat, unlink } from "node:fs/promises";
+import { mkdir, readFile, stat } from "node:fs/promises";
 import { join, relative, dirname } from "node:path";
 
 const MAX_FILE_READ_BYTES = 10_000_000
@@ -178,11 +178,6 @@ export const readImageTool = {
       text: `[read_image: ${args.path} (${mime}, ${bytes} bytes)]`,
       images: [{ type: "image_url", image_url: { url: `data:${mime};base64,${b64}` } }],
     })
-    // Paste-created temp files: delete after use, no litter
-    const basename = abs.includes("/") ? abs.slice(abs.lastIndexOf("/") + 1) : abs.slice(abs.lastIndexOf("\\") + 1)
-    if (basename.startsWith(".thincoder-paste-")) {
-      try { await unlink(abs) } catch { /* can't delete, so be it */ }
-    }
     return result
   },
 }
@@ -214,7 +209,7 @@ export const writeTool = {
     const content = eol === "\r\n" ? normalizeEOL(args.content).replace(/\n/g, "\r\n") : args.content
     // 单一写路径点：默认 = writeFile + 记账；端侧注入 ⇒ 编辑器径（§2.13.5）。
     await writeThroughPath(abs, content, { op: "write", record: { type: "write", startLine: 1, shift: 0 } }) // 全文重写——全文件受影响
-    const diff = gitDiffOne(ctx.cwd, abs)
+    const diff = await gitDiffOne(ctx.cwd, abs)
     return `Wrote ${args.content.length} chars to ${args.path}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
 }
@@ -365,7 +360,7 @@ export const insertAfterTool = {
       op: "write",
       record: { type: "insert", startLine: targetLine, shift: normalizeEOL(args.content).split("\n").length },
     })
-    const diff = gitDiffOne(ctx.cwd, abs)
+    const diff = await gitDiffOne(ctx.cwd, abs)
     const baseResult = `Inserted after line ${targetLine} in ${args.path}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
     return await appendWriteContext(abs, targetLine + 1, baseResult)
   },
@@ -460,7 +455,7 @@ export const hashlineEditTool = {
       op: "write",
       record: { type: "edit", startLine: pos + 1, shift: newLines.length - target.length },
     })
-    const diff = gitDiffOne(ctx.cwd, abs)
+    const diff = await gitDiffOne(ctx.cwd, abs)
     const baseResult = `Edited ${args.path}: replaced ${target.length} line(s) at L${pos + 1} with ${newLines.length} line(s)${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}${corrupted ? `\n${FFFD_WARNING}` : ""}`
     return await appendWriteContext(abs, pos + 1, baseResult)
   },

package/tools/git-run.mjs

@@ -33,7 +33,7 @@ export const GIT_NET_TIMEOUT_MS = 300_000
 /** 网路面五动作（300s 档——合法耗时可远超本地；依据 = 需求档 §4.7 TTY-DRIVE N3 候选参照值）。 */
 const GIT_NET_ACTIONS = new Set(["push", "fetch", "pull", "clone", "ls-remote"])
 
-/** 测试态缝（模块级 · 缺省 null = 生产零行为变——先例 `manifest.mjs:40-41` · `session-gc.mjs:136`）。
+/** 测试态缝（模块级 · 缺省 null = 生产零行为变——先例 `manifest-discovery.mjs:15-20` · `session-gc.mjs:186`）。
  *  用例 `finally` 复位；不经用户参数面（边界：不新增参数 / 用户选项）。 */
 let gitTimeoutOverride = null
 export function _setGitTimeoutForTest(ms) { gitTimeoutOverride = ms }

package/tools/git.mjs

@@ -26,9 +26,6 @@ async function runGitRaw(cwd, cmdArgs, config = []) {
   }
 }
 
-
-
-
 /** Resolve workdir relative to cwd — no boundary assertion
  *  (§10.1 2026-09-02: workspace confinement removed; git itself is not
  *  directory-limited — same boundary as bash). */
@@ -53,22 +50,6 @@ function ambiguousRepoMessage(candidates, cwd, matched) {
   return `${head} — pass workdir to run git in the intended one (no silent pick):\n` + candidates.map((c) => `- ${c}`).join("\n")
 }
 
-// ─── 审批门注入缝（#59——「只读判定 / 审批门按端注入」，形态参 §2.13.5 注入缝）────────
-/**
- * 审批门注入位（**缺省不覆盖** = 无审批面：全部动作照常执行——CLI 语义，零行为变；端装配层
- * 可覆盖为本端审批 / 只读判定。核内零端名分支（契约 5——本档只认 `gate` 函数名）。
- * 契约：`gate(args, ctx) → string | null | Promise<同>`——非空字符串 = 拒执行（该串原样作为
- * 工具结果返回）；null / undefined / 其他值 = 放行。每个 execute 恰问一次（workdir 归一后）。
- */
-let injectedApproval = null
-export function configureGitApproval(impl) {
-  injectedApproval = impl && typeof impl.gate === "function" ? impl.gate : null
-}
-/** 撤销注入（测试与端装配生命周期用——缺省态 = 无审批门）。 */
-export function resetGitApproval() { injectedApproval = null }
-
-
-
 export const gitTool = {
   name: "git",
   description: DESC("git"),
@@ -127,11 +108,6 @@ export const gitTool = {
         repoNote = `(repo: ${discovered.root})`
       }
     }
-    // #59：审批门（端注入面）——缺省无门（CLI 语义）；非空字符串返回 ⇒ 拒执行（拒串原样、不加注记）。
-    if (injectedApproval) {
-      const refusal = await injectedApproval(args, ctx)
-      if (typeof refusal === "string" && refusal.length > 0) return refusal
-    }
     const out = await gitActionCore.dispatch(args, ctx)
     return repoNote ? `${repoNote}\n${out}` : out
   },

package/tools/index.mjs

@@ -68,7 +68,8 @@ export async function assembleBuiltinTools({ memory, cwd, projectDir = null, aut
     ...memoryTools(memory, { cwd, projectDir, author, team }),
     codeSearchTool(memory),
     docSearchTool(memory),
-    repoOutlineTool(memory.db, cwd),
+    // memory 缺位容错：组装期零解引用（memory?.db）；缺位不抛（懒失败留执行期——与 memory ∕ code_search ∕ doc_search 同族，dispatch 收成 Error 回模型）；有 memory 逐字零变
+    repoOutlineTool(memory?.db, cwd),
     settingsTool(),
     peerInstancesTool,
     // 台账查询命令族（M2 设计 §2.2 命令面接线——查询命令全角色面；写命令住 family-tools depthOnly 分支）

package/tools/linter.mjs

@@ -4,6 +4,7 @@ import { DESC, resolveInCwd } from "./shared.mjs"
 import { runCommand } from "./exec-run.mjs"
 import { existsSync } from "node:fs"
 import { join } from "node:path"
+import { nodeChildEnv } from "./node-child.mjs"
 
 export const lintTool = {
   name: "lint",
@@ -47,7 +48,7 @@ async function nodeCheckResult(abs, signal) {
     return `lint (check): only JS/TS-family files supported for fast syntax check; use full=true for other languages. Path: ${abs}`
   }
   try {
-    await runCommand(process.execPath, ["--check", abs], { timeout: 10000, signal })
+    await runCommand(process.execPath, ["--check", abs], { timeout: 10000, signal, env: nodeChildEnv() })
     return `Syntax OK: ${abs}`
   } catch (e) {
     const msg = (e.stderr || e.stdout || e.message || "").trim()

package/tools/node-child.mjs

@@ -0,0 +1,21 @@
+/**
+ * tools/node-child.mjs — node 语义子进程启动单源（TOOLS.md §6.18 · D-TO14 · 台账 #602）。
+ *
+ * 缺口：核内 spawn `process.execPath` 的隐含前提 = 「execPath 为 node」。桌面宿主主进程 =
+ * `electron.exe` ⇒ execPath 属 Electron 族二进制——子进程按 Electron 应用启动、不执行代码
+ * （execute 悬挂至超时）。本档 = 那一跳：Electron 宿主补 `ELECTRON_RUN_AS_NODE: "1"`，
+ * 同一二进制以 node 语义启动。
+ *
+ * 判据 = `process.versions.electron`（运行时能力探测——非端名分支）：三端同判据、同式执行；
+ * 已处 node 模式的 Electron 宿主（VS Code 扩展宿主——env 携旗标）为同值幂等。
+ * 消费 = `execute.runNode` spawn 选项 ∕ `lint` 快路径（经 `exec-run` `opts.env` 透传）。
+ */
+
+/**
+ * node 语义子进程 env：Electron 宿主 ⇒ `{ ...base, ELECTRON_RUN_AS_NODE: "1" }` 副本
+ * （不改父进程 env）；否则原样返回 `base`（同引用——与 spawn 缺省继承逐字等价，零行为变）。
+ * 第二参 = 判据注入（机检用——先例 `_setGitTimeoutForTest` 族）。
+ */
+export function nodeChildEnv(base = process.env, isElectron = !!process.versions.electron) {
+  return isElectron ? { ...base, ELECTRON_RUN_AS_NODE: "1" } : base
+}

package/tools/ops.mjs

@@ -1,8 +1,10 @@
 /**
- * ops.mjs — operational tools: file_ops (move/copy/rename), process (list),
+ * ops.mjs — operational tools: file_ops (move/copy/rename), process (list/kill),
  * get_current_time, wait_for (condition wait). Each exists so the model reaches
  * for a dedicated tool instead of shelling out to `bash` for the same operation
  * (parity with thinworker).
+ * #9：process 收编 `kill`（靶 = pid ∥ 后台 bash 任务 id——欠面收正：原须绕 bash taskkill）；
+ * wait_for 条件族 +`bash id:N done`。list ∥ 既有条件面零变。
  */
 import { DESC, resolveInCwd, truncate } from "./shared.mjs"
 // 单一写路径点（编辑器编辑径注入缝——CORE-UNIFICATION §2.13.5）：路径操作也经它落盘
@@ -51,11 +53,21 @@ export const processTool = {
   parameters: {
     type: "object",
     properties: {
-      name: { type: "string", description: "Optional name substring filter (case-insensitive)" },
+      action: { type: "string", enum: ["list", "kill"], description: "list (default) — show running processes; kill — terminate a process tree (target: pid) or a background bash task (target: id)" },
+      name: { type: "string", description: "Optional name substring filter for list (case-insensitive)" },
+      pid: { type: "number", description: "kill target: process id — the whole tree is terminated (taskkill /T /F on win32; POSIX group kill)" },
+      id: { type: "number", description: "kill target: background bash task id (bash#N from the bash async ack)" },
     },
   },
-  readonly: true,
-  async execute({ name }, ctx) {
+  // #9：动作分级——list 保持只读分类（dispatch-gates `isSubagentReadonlyAction`：planMode 放行/
+  // 免审批）；kill 是破坏性动作（审批门）。`parallel` 保既有调度形（list 恒可批并行）。
+  readonly: false,
+  parallel: true,
+  async execute(args = {}, ctx = {}) {
+    const action = args?.action ?? "list"
+    if (action === "kill") return await executeKill(args, ctx)
+    if (action !== "list") return `Error: action must be list | kill (got "${action}")`
+    const { name } = args
     const filter = typeof name === "string" && name.trim() ? name.trim().toLowerCase() : null
     let rows
     try {
@@ -69,6 +81,24 @@ export const processTool = {
   },
 }
 
+/** #9 kill 执行体（靶 = pid ∥ 后台任务 id 二选一；两靶皆树杀）。动态 import（W8 契约②：
+ *  agent-tools 链静态达 node:sqlite——端壳静态闭包须保持零命中）。 */
+async function executeKill({ pid, id }, ctx) {
+  const hasPid = pid !== undefined && pid !== null && String(pid).trim() !== ""
+  const hasId = id !== undefined && id !== null && String(id).trim() !== ""
+  if (hasPid === hasId) {
+    return "Error: kill requires exactly one target — pid (process id) or id (background bash task id)"
+  }
+  const { killBgTask, killBgPid } = await import("../agent-tools/bash-async.mjs")
+  if (hasPid) {
+    if (!killBgPid(pid)) return `Error: kill pid: "${String(pid)}" is not a valid process id`
+    return `killed process tree ${Number(pid)} (taskkill /T /F on win32; POSIX group kill)`
+  }
+  const res = killBgTask(ctx?.agent, id)
+  if (res.status === "error") return `Error: ${res.error}`
+  return `killed background bash#${res.id} — its process tree was terminated; no digest will arrive${res.logPath ? ` — log so far: ${res.logPath}` : ""}`
+}
+
 function listWindows() {
   // tasklist /FO CSV /NH → lines: "name.exe","1234","Console","1","12,345 K"
   const out = execFileSync("tasklist", ["/FO", "CSV", "/NH"], { encoding: "utf8", timeout: 10000 })
@@ -112,7 +142,7 @@ export const getCurrentTimeTool = {
 
 // ─── wait_for ───────────────────────────────────────────────────
 
-/** wait_for bounds (TOOLS.md §16): a BUILT-IN ceiling replaces the unbounded
+/** wait_for bounds: a BUILT-IN ceiling replaces the unbounded
  *  sleep-then-wait — timeout_ms defaults to 30s (config.json agent.waitForTimeoutMs
  *  overrides), capped at WAIT_FOR_MAX_TIMEOUT_MS (600s — the execute-tool timeout
  *  convention, Math.min(t, 600_000)); interval_ms defaults to 1s with a 100ms
@@ -122,7 +152,7 @@ export const WAIT_FOR_MAX_TIMEOUT_MS = 600_000
 export const WAIT_FOR_DEFAULT_INTERVAL_MS = 1_000
 export const WAIT_FOR_MIN_INTERVAL_MS = 100
 
-// Condition-source seam (§16 评审 #4): production uses the real evaluator
+// Condition-source seam (评审 #4): production uses the real evaluator
 // (evaluateWaitForCondition); tests inject a deterministic fake source via
 // setWaitForConditionSource (default null — production path unchanged).
 let injectedConditionSource = null
@@ -139,10 +169,11 @@ export function parseWaitForCondition(condition) {
   if (c === "advisor settled") return { kind: "advisor", arg: null }
   if (c === "consult done") return { kind: "consult", arg: null }
   if ((m = c.match(/^subagent id:\s*(\d+) done$/))) return { kind: "subagent", arg: String(Number(m[1])) }
+  if ((m = c.match(/^bash id:\s*(\d+) done$/))) return { kind: "bash", arg: String(Number(m[1])) }
   if ((m = c.match(/^file exists:\s*(.+)$/))) return { kind: "file", arg: m[1].trim() }
   if ((m = c.match(/^port open:\s*(\d+)$/))) return { kind: "port", arg: Number(m[1]) }
   throw new Error(
-    `wait_for: unsupported condition "${c}" — supported: "advisor settled", "subagent id:N done", "consult done", "file exists:path", "port open:N"`,
+    `wait_for: unsupported condition "${c}" — supported: "advisor settled", "subagent id:N done", "consult done", "bash id:N done", "file exists:path", "port open:N"`,
   )
 }
 
@@ -170,7 +201,7 @@ function asyncEntryDone(agent, id) {
   return entry.done === true || entry.status === "done"
 }
 
-/** 评审池双载体（第 10 批 §18.3 #2）：agent ∪ history——未初始化的载体不进集合。 */
+/** 评审池双载体（第 10 批 AGENT-LOOP-ASYNC-POOL.md §6.11 #2）：agent ∪ history——未初始化的载体不进集合。 */
 function advisorPools(agent) {
   return [agent?._asyncAdvisors, agent?.history?._asyncAdvisors].filter((m) => m instanceof Map)
 }
@@ -183,8 +214,8 @@ function hasRunningIn(pool, pred) {
   return false
 }
 
-/** "advisor settled" 真判据（第 10 批 §18.3 #2 修正）：**评审池真实态**——双载体
- *  （agent._asyncAdvisors ∪ history._asyncAdvisors）无 running/queued 条目（与 §11.2 的
+/** "advisor settled" 真判据（第 10 批 AGENT-LOOP-ASYNC-POOL.md §6.11 #2 修正）：**评审池真实态**——双载体
+ *  （agent._asyncAdvisors ∪ history._asyncAdvisors）无 running/queued 条目（与 AGENT-LOOP-ASYNC-POOL.md §6.10 的
  *  未决评审判定 advisorReviewPending 同源语义）。修前读**子代理池**的 role==="advisor"
  *  条目——评审条目只在 _asyncAdvisors → 恒无命中 → 恒真 0ms 秒过（用户实证）。 */
 function advisorSettled(agent) {
@@ -228,12 +259,18 @@ export async function evaluateWaitForCondition(condition, ctx) {
   const agent = ctx?.agent
   switch (parsed.kind) {
     case "advisor":
-      // 第 10 批修正（§18.3 #2——修前恒真 0ms 秒过）：判据 = 评审池真实态（双载体）——
-      // 不再读子代理池的 role==="advisor" 条目（该池永无此类条目）；语义与 §11.2 未决
+      // 第 10 批修正（AGENT-LOOP-ASYNC-POOL.md §6.11 #2——修前恒真 0ms 秒过）：判据 = 评审池真实态（双载体）——
+      // 不再读子代理池的 role==="advisor" 条目（该池永无此类条目）；语义与 §6.10 未决
       // 评审判定同源（advisorReviewPending）。
       return advisorSettled(agent)
     case "subagent":
       return asyncEntryDone(agent, parsed.arg)
+    case "bash": {
+      // #9：后台 bash 任务判据（池内 done ∥ 出池即 done——`bash-async.mjs` 单点）。
+      // 动态 import（W8 契约②：agent-tools 链静态达 node:sqlite——端壳静态闭包零命中）。
+      const { bgTaskDone } = await import("../agent-tools/bash-async.mjs")
+      return bgTaskDone(agent, parsed.arg)
+    }
     case "consult":
       return consultAllDone(agent)
     case "file":
@@ -256,7 +293,7 @@ export const waitForTool = {
   parameters: {
     type: "object",
     properties: {
-      condition: { type: "string", description: 'Condition expression — "advisor settled", "subagent id:N done", "consult done", "file exists:path", "port open:N"' },
+      condition: { type: "string", description: 'Condition expression — "advisor settled", "subagent id:N done", "consult done", "bash id:N done", "file exists:path", "port open:N"' },
       interval_ms: { type: "integer", description: "Poll interval in ms (default 1000, floor 100)" },
       timeout_ms: { type: "integer", description: "Overall timeout in ms (default 30000, cap 600000; config.json agent.waitForTimeoutMs overrides the default)" },
     },

package/tools/patch.mjs

@@ -7,7 +7,7 @@ import {
   majorityEol
 } from "./shared.mjs";
 import { writeThroughPath, TMP_SUFFIX, markDirty } from "./write-path.mjs";
-import { execFileSync } from "node:child_process";
+import { spawnGit } from "./git-run.mjs";
 import { mkdir, readFile, lstat, unlink } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { relative, dirname } from "node:path";
@@ -275,7 +275,9 @@ export const deleteTool = {
     const rel = relative(ctx.cwd, abs).replace(/\\/g, "/")
     let tracked = false
     try {
-      execFileSync("git", ["ls-files", "--error-unmatch", "--", rel], { cwd: ctx.cwd, stdio: "ignore" })
+      // #208①（2026-09-25）：表外同步 spawn 收口——探针转 `spawnGit` 单点（GIT_ENV 加固 + 超时 + 树杀）；
+      // 失败语义零变（未跟踪 / 非仓 ⇒ tracked 保持 false）。
+      await spawnGit(ctx.cwd, ["ls-files", "--error-unmatch", "--", rel])
       tracked = true
     } catch {
       // untracked / non-git repo

package/tools/repomap.mjs

@@ -6,7 +6,8 @@
 import { existsSync } from "node:fs"
 import { readFile, stat } from "node:fs/promises"
 import { join } from "node:path"
-import { normalizeEOL } from "./shared.mjs"
+import { DESC, normalizeEOL } from "./shared.mjs" // #15 描述外置：文本单点 = tool-docs/repo_outline.md（DESC 单解析面）
+import { INDEX_ORIGIN_ROW_WARN } from "../memory/schema.mjs" // §6.14 B4 文件数上界（WARN 值复用）
 
 /** Extract JS/TS file import paths (normalize by stripping .ts/.js/.mjs suffixes) */
 function parseImports(lines, ext) {
@@ -111,13 +112,22 @@ function normalizeExt(p) {
   return p.replace(/\.(m?js|jsx|tsx?)$/i, "")
 }
 
+/** B4 越界提示行（跳过大纲构建；指路 = 声明 ∕ 剪枝）——两入口（buildSummary ∕ buildOutline）同文；
+ *  `origin` 给出时才缀「for this origin」（repo_outline 工具缝不传 origin——跨 origin 行不假称本 origin）。 */
+function outlineOverLimit(origin = null) {
+  return `(code index too large for an outline: > ${INDEX_ORIGIN_ROW_WARN} files${origin ? " for this origin" : ""} — declare index.excludePaths in PROJECT-MANIFEST.json, or prune: thincoder memory sweep --origin <o> --path <sub>)`
+}
+
 /**
  * Internal: scan all files, build forward dependency graph + reverse reference graph.
  * Returns { deps, importers, fileCount } shared by buildOutline / buildSummary.
  */
-async function _buildDepGraph(db, cwd) {
-  const allFiles = db.prepare(`SELECT DISTINCT path FROM code_chunks ORDER BY path`).all().map((r) => r.path)
+async function _buildDepGraph(db, cwd, { origin = null } = {}) {
+  // §6.14 B4：origin 限定 + 文件数上界（文件行 `LIMIT = WARN+1` 形——越界不构建大纲，返回信号）
+  const limit = INDEX_ORIGIN_ROW_WARN + 1
+  const allFiles = db.prepare(`SELECT DISTINCT path FROM code_chunks ${origin ? "WHERE origin = ? " : ""}ORDER BY path LIMIT ${limit}`).all(...(origin ? [origin] : [])).map((r) => r.path)
   if (allFiles.length === 0) return null
+  if (allFiles.length >= limit) return { overLimit: true, fileCount: allFiles.length }
 
   const deps = new Map()      // path → { imports: Set, exports: Set, size: number, dir: string }
   const importers = new Map() // importee → Set<importer>
@@ -182,8 +192,9 @@ async function _buildDepGraph(db, cwd) {
  *  3. Entry points (files with no importers — startup/top-level entry points)
  * Output is naturally bounded (~1000-2000 chars), no more OUTLINE_INJECT_MAX hard truncation.
  */
-export async function buildSummary(db, cwd) {
-  const graph = await _buildDepGraph(db, cwd)
+export async function buildSummary(db, cwd, { origin = null } = {}) {
+  const graph = await _buildDepGraph(db, cwd, { origin })
+  if (graph?.overLimit) return outlineOverLimit(origin)
   if (!graph) return "(no indexed source files; run codeSync or /reindex first)"
   const { deps, importers, fileCount } = graph
 
@@ -257,8 +268,9 @@ export async function buildSummary(db, cwd) {
 }
 
 /** Get known file list from code_chunks (reuse index), parse by path to generate outline text */
-export async function buildOutline(db, cwd, focusPath) {
-  const graph = await _buildDepGraph(db, cwd)
+export async function buildOutline(db, cwd, focusPath, { origin = null } = {}) {
+  const graph = await _buildDepGraph(db, cwd, { origin })
+  if (graph?.overLimit) return outlineOverLimit(origin)
   if (!graph) return "(no indexed source files; run codeSync or /reindex first)"
   const { deps, importers } = graph
 
@@ -296,8 +308,7 @@ export async function buildOutline(db, cwd, focusPath) {
 export function repoOutlineTool(db, cwd) {
   return {
     name: "repo_outline",
-    description:
-      "Show the project's file dependency outline: which files import/export from which, and what symbols they export. Use when you need to understand the project structure, find where a function is defined, or see what files depend on a module. Pass a path to focus on a single file's relationships. Find code by keyword or snippet with code_search.",
+    description: DESC("repo_outline"), // #15 外置：文本单点 = tool-docs/repo_outline.md（工具名逐字对核）
     parameters: {
       type: "object",
       properties: {

package/tools/shared.mjs

@@ -3,7 +3,7 @@
  * Imported by tools/file.mjs / system.mjs / web.mjs / git.mjs
  */
 
-import { spawn, execFileSync, execFile } from "node:child_process"
+import { execFile } from "node:child_process"
 import { readFileSync, existsSync, realpathSync, readdirSync, statSync, openSync, readSync, closeSync } from "node:fs"
 import { dirname, join, resolve } from "node:path"
 import { fileURLToPath } from "node:url"
@@ -217,12 +217,14 @@ export function makeDecoder() {
   }
 }
 
-/** Single-file git diff. Silently returns empty on failure. Large diffs that exceed maxBuffer are truncated rather than swallowed. */
-export function gitDiffOne(cwd, abs) {
+/** Single-file git diff. Silently returns empty on failure. Large diffs that exceed maxBuffer are truncated rather than swallowed.
+ *  #208①（2026-09-25）：体转 async 薄壳委托 `spawnGit` 单点（GIT_ENV 加固 + 两档超时 + 树杀 + 非阻塞）；
+ *  形保真 = trim / 200 行截断 / 10MB 溢出取部分输出 / 失败静默回 `""`（调用面 5 处 `await` 化）。 */
+export async function gitDiffOne(cwd, abs) {
   try {
-    const diff = execFileSync("git", ["--no-pager", "diff", "--no-color", "--", abs], {
-      cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 10 * 1024 * 1024,
-    }).trim()
+    const diff = (await spawnGit(cwd, ["--no-pager", "diff", "--no-color", "--", abs], {
+      maxBuffer: 10 * 1024 * 1024,
+    })).trim()
     if (!diff) return ""
     const lines = diff.split("\n")
     if (lines.length <= 200) return diff

package/tools/web.mjs

@@ -1,10 +1,11 @@
 import { DESC, truncate, stripTags, htmlToText, isPrivateHost } from "./shared.mjs";
 import { URL } from "node:url";
 import { proxyFetch } from "../proxy.mjs";
+import { resolveEnvRefs } from "../env-ref.mjs";
 
 export const UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
 const FETCH_TIMEOUT = 15_000
-// §14 D-TF3：网络失败错误文本追加 proxy 提示——纯文本提示，不自动路由（2026-08-31 裁定：proxy 显式传不自动应用）
+// D-TF3：网络失败错误文本追加 proxy 提示——纯文本提示，不自动路由（2026-08-31 裁定：proxy 显式传不自动应用）
 const PROXY_HINT = "network failure — retry with proxy: 'http://host:port' if the target is blocked"
 
 // ── Web search (Bing; direct by default, through proxy when configured and web toggle on) ──
@@ -46,7 +47,9 @@ const ENGINE_NAMES = ENGINES.map(e => e.name)
  *  { engine, results } or null to fall back to Bing HTML scraping.
  *  proxyUri: explicit per-call proxy (args.proxy) — never the config.json one. */
 async function fetchTavily(query, limit, ctx, proxyUri) {
-  const apiKey = ctx?.agent?.config?.websearch?.apiKey
+  // #57（provider-config-family 批）：值位 `${env:VAR}` 消费侧解析（CONFIG.md §6.3）——未设 ∕ 空串 ∕
+  // 畸形 ⇒ 抛错（不静默字面透传）；未配置 key 仍走 Bing 回落。
+  const apiKey = resolveEnvRefs(ctx?.agent?.config?.websearch?.apiKey)
   if (!apiKey) return null
   const ctrl = new AbortController()
   const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT)