chainlesschain 0.162.125 → 0.162.127

package/src/repl/agent-repl.js

@@ -29,6 +29,11 @@ import {
   analyzeContinuation,
   joinContinuation,
 } from "../lib/repl-multiline.js";
+import {
+  classifyDenial,
+  recordDenial,
+  formatDenials,
+} from "../lib/repl-denials.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   createSession,
@@ -118,6 +123,14 @@ let _settingsHooks = null;
 // `!command` auto-triggers an assistant response to its output. undefined =
 // unset → defaults OFF (opt-in) in shouldRespondToBashCommands.
 let _respondToBash;
+// .claude/settings.json `autoMode.classifyAllShell` (Claude-Code 2.1.193): route
+// the built-in verification allowlist through the shell-policy classifier (→
+// ApprovalGate confirm) instead of fast-pathing it. false = unset → off.
+let _classifyAllShell = false;
+// Bounded log of tool calls the agent was BLOCKED from running this session
+// (shell-policy / ApprovalGate / settings rule / hook). Surfaced by
+// `/permissions denials` (Claude-Code 2.1.193 "recent denials"). In-memory only.
+const _recentDenials = [];
 
 /**
  * Fire settings.json Notification hooks (observe-only) — the agent needs the
@@ -180,13 +193,17 @@ async function executeTool(name, args) {
     permissionRules: _permissionRules,
     permissionConfirm: _permissionConfirm,
     settingsHooks: _settingsHooks,
+    classifyAllShell: _classifyAllShell,
   });
 }
 
 /**
  * Agentic loop — wraps agent-core's async generator with REPL display output.
+ * Exported so its event-translation contract (checkpoint-mark accuracy for
+ * `/rewind`, content/usage extraction, forced-off in-loop compaction) is
+ * unit-testable via the `options._coreLoop` injection seam.
  */
-async function agentLoop(messages, options) {
+export async function agentLoop(messages, options) {
   // Resume-degenerate role merge (Claude Code 2.1.187 parity), gated by the
   // one-shot `mergeRoles` flag so it fires only on the first model call after
   // resuming a session whose prior run produced no assistant response. Collapse
@@ -212,12 +229,19 @@ async function agentLoop(messages, options) {
           `\n  ⚠️  ${info.message || `已从 "${info.from}" 切换到 "${info.to}"`}\n`,
         ),
       ));
-  // The REPL runs its own auto-compaction (after each turn, with metrics +
-  // persisted compact events), so opt out of the agent loop's in-loop
-  // compaction to avoid compacting the same history twice.
-  for await (const event of coreAgentLoop(messages, {
-    autoCompact: false,
+  // `_coreLoop` is an injectable seam (defaults to agent-core's loop) so the
+  // wrapper's event translation can be unit-tested without a live model.
+  const runCoreLoop = options._coreLoop || coreAgentLoop;
+  // The tool-result event carries no args; remember the last tool-executing
+  // pair so a recorded denial can show what was attempted (/permissions denials).
+  let _lastExec = null;
+  for await (const event of runCoreLoop(messages, {
     ...options,
+    // FORCE in-loop compaction off — the REPL runs its OWN post-turn compaction
+    // (with metrics + persisted compact events), so letting agent-core compact
+    // too would trim the same history twice. Placed AFTER the spread so a
+    // caller's options.autoCompact can never silently re-enable the double pass.
+    autoCompact: false,
     onProviderFallback,
   })) {
     if (event.type === "checkpoint") {
@@ -236,6 +260,7 @@ async function agentLoop(messages, options) {
         chalk.gray(`  ⎌ checkpoint ${event.id} (before ${event.tool})\n`),
       );
     } else if (event.type === "tool-executing") {
+      _lastExec = { tool: event.tool, args: event.args };
       process.stdout.write(
         chalk.gray(
           `  [${event.tool}] ${formatToolArgs(event.tool, event.args)}\n`,
@@ -246,6 +271,24 @@ async function agentLoop(messages, options) {
         process.stdout.write(
           chalk.red(`  Error: ${event.error || event.result?.error}\n`),
         );
+        // Record policy denials (not plain tool failures) into the caller's
+        // denial log for review via `/permissions denials` (Claude-Code 2.1.193
+        // recent denials). Caller passes the session log (mirrors checkpointMarks)
+        // so the wrapper stays unit-testable.
+        if (Array.isArray(options.denialLog)) {
+          const denial = classifyDenial({
+            tool: event.tool,
+            result: event.result,
+            error: event.error,
+            argsSummary:
+              _lastExec && _lastExec.tool === event.tool
+                ? formatToolArgs(event.tool, _lastExec.args)
+                : "",
+          });
+          if (denial) {
+            recordDenial(options.denialLog, { ...denial, at: Date.now() });
+          }
+        }
         // Parity with Desktop AIChatPage's `Switch to Trusted` button:
         // when the deny came from ApprovalGate (not shell-policy), surface
         // the exact CLI command the user can run to relax the per-session
@@ -503,6 +546,11 @@ export async function startAgentRepl(options = {}) {
     _respondToBash = readBooleanSetting("respondToBashCommands", {
       cwd: process.cwd(),
     });
+    // Claude-Code 2.1.193 autoMode.classifyAllShell (default OFF when unset).
+    _classifyAllShell =
+      readBooleanSetting("autoMode.classifyAllShell", {
+        cwd: process.cwd(),
+      }) === true;
     const total =
       loaded.rules.allow.length +
       loaded.rules.ask.length +
@@ -538,12 +586,21 @@ export async function startAgentRepl(options = {}) {
   // PostToolUse). The interactive _permissionConfirm above doubles as the
   // confirmer for a hook `ask` decision.
   try {
-    const { loadHooks } = await import("../lib/settings-hooks.cjs");
+    const { loadHooks, projectHookTrustNotice } =
+      await import("../lib/settings-hooks.cjs");
     const loaded = loadHooks({ cwd: process.cwd() });
     _settingsHooks =
       loaded.hooks && Object.keys(loaded.hooks).length > 0
         ? loaded.hooks
         : null;
+    // First-run trust notice for an untrusted/cloned repo's shell-running
+    // hooks (Claude-Code 2.1.195 parity). Best-effort, stderr-only.
+    try {
+      const notice = projectHookTrustNotice({ cwd: process.cwd() });
+      if (notice) process.stderr.write(notice + "\n");
+    } catch {
+      /* trust notice is best-effort */
+    }
   } catch (_err) {
     _settingsHooks = null;
   }
@@ -1482,7 +1539,7 @@ export async function startAgentRepl(options = {}) {
         `  ${chalk.cyan("/cost")}       Session token spend + estimated $ (per model & category)`,
       );
       logger.log(
-        `  ${chalk.cyan("/permissions")} Allow/ask/deny rules; set/cycle tier (/permissions <tier> · Shift+Tab cycles)`,
+        `  ${chalk.cyan("/permissions")} Allow/ask/deny rules; set/cycle tier (/permissions <tier> · Shift+Tab); /permissions denials to review blocked calls`,
       );
       logger.log(
         `  ${chalk.cyan("/export")}     Save this conversation to a Markdown file (/export [path])`,
@@ -3034,6 +3091,13 @@ export async function startAgentRepl(options = {}) {
     // parity): what the agent runs unprompted, asks about, or is blocked from.
     if (trimmed === "/permissions" || trimmed.startsWith("/permissions ")) {
       const arg = trimmed.slice("/permissions".length).trim();
+      if (arg === "denials" || arg === "denied") {
+        // Review what the agent was BLOCKED from running this session
+        // (Claude-Code 2.1.193 "recent denials").
+        logger.log(formatDenials(_recentDenials));
+        prompt();
+        return;
+      }
       if (arg) {
         // Set this session's approval tier mid-session (Claude-Code
         // permission-mode / Shift+Tab parity; mirrors `cc session policy --set`).
@@ -3079,6 +3143,13 @@ export async function startAgentRepl(options = {}) {
           "  Set tier mid-session: /permissions <strict|trusted|autopilot>",
         ),
       );
+      if (_recentDenials.length) {
+        logger.log(
+          chalk.gray(
+            `  ${_recentDenials.length} tool call(s) denied this session — /permissions denials to review`,
+          ),
+        );
+      }
       prompt();
       return;
     }
@@ -3511,11 +3582,13 @@ export async function startAgentRepl(options = {}) {
         autoCheckpoint,
         checkpointSession: sessionId,
         checkpointMarks: _checkpointMarks,
+        denialLog: _recentDenials,
         prepareCall,
         approvalGate: _approvalGate,
         permissionRules: _permissionRules,
         permissionConfirm: _permissionConfirm,
         settingsHooks: _settingsHooks,
+        classifyAllShell: _classifyAllShell,
         // Interactive session: gate run_code through the ApprovalGate (like
         // run_shell) so a strict tier prompts before arbitrary code runs.
         interactiveApproval: true,

package/src/runtime/__tests__/message-roles.test.js

@@ -51,13 +51,38 @@ describe("mergeConsecutiveMessages", () => {
     // A multi-tool turn produces back-to-back `tool` results — folding them
     // would drop tool_call_ids and corrupt the tool-call pairing.
     const msgs = [
-      { role: "assistant", content: "", tool_calls: [{ id: "a" }, { id: "b" }] },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [{ id: "a" }, { id: "b" }],
+      },
       { role: "tool", content: "r1", tool_call_id: "a" },
       { role: "tool", content: "r2", tool_call_id: "b" },
     ];
     expect(mergeConsecutiveMessages(msgs)).toEqual(msgs);
   });
 
+  it("never merges a structured assistant tool-call turn (tool_calls preserved)", () => {
+    // Two consecutive assistants where the SECOND carries tool_calls — folding
+    // would drop them (orphaning the result) and the strict API would 400.
+    const msgs = [
+      { role: "assistant", content: "let me check" },
+      { role: "assistant", content: "", tool_calls: [{ id: "c1" }] },
+      { role: "tool", content: "result", tool_call_id: "c1" },
+    ];
+    expect(mergeConsecutiveMessages(msgs)).toEqual(msgs);
+  });
+
+  it("never folds two consecutive assistants when the FIRST has tool_calls", () => {
+    // e.g. after a compaction dropped the tool results — merging would mutate
+    // the structured turn's content and keep its now-unanswered tool_calls.
+    const msgs = [
+      { role: "assistant", content: "", tool_calls: [{ id: "a" }] },
+      { role: "assistant", content: "fallback text" },
+    ];
+    expect(mergeConsecutiveMessages(msgs)).toEqual(msgs);
+  });
+
   it("never merges system messages (leading base + context pair kept distinct)", () => {
     const msgs = [
       { role: "system", content: "base" },
@@ -202,14 +227,22 @@ describe("collapseConsecutiveMessagesInPlace", () => {
     const messages = [
       { role: "user", content: "u1" },
       { role: "user", content: "u2" },
-      { role: "assistant", content: "", tool_calls: [{ id: "a" }, { id: "b" }] },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [{ id: "a" }, { id: "b" }],
+      },
       { role: "tool", content: "r1", tool_call_id: "a" },
       { role: "tool", content: "r2", tool_call_id: "b" },
     ];
     expect(collapseConsecutiveMessagesInPlace(messages)).toBe(true);
     expect(messages).toEqual([
       { role: "user", content: "u1\n\nu2" },
-      { role: "assistant", content: "", tool_calls: [{ id: "a" }, { id: "b" }] },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [{ id: "a" }, { id: "b" }],
+      },
       { role: "tool", content: "r1", tool_call_id: "a" },
       { role: "tool", content: "r2", tool_call_id: "b" },
     ]);

package/src/runtime/agent-core.js

@@ -43,10 +43,11 @@ import {
 import { createToolContext } from "../tools/tool-context.js";
 import { createToolTelemetryRecord } from "../tools/tool-telemetry.js";
 import { isAbortError, throwIfAborted } from "../lib/abort-utils.js";
+import { buildSearchCommand } from "../lib/search-command.js";
 import {
   isRetryableStreamError,
-  STREAM_RETRY_MAX,
   STREAM_RETRY_BASE_MS,
+  resolveStreamRetryMax,
 } from "../lib/stream-retry.js";
 import {
   annotateLines,
@@ -755,6 +756,27 @@ export function tokenizeShellWords(input) {
   return args;
 }
 
+/**
+ * Literal string edit shared by the edit_file preview + execution paths.
+ * Uses split/join so `old_string` and `new_string` are treated as LITERAL text
+ * (no regex / `$&` / `$1` pattern interpretation — a plain `String.replace`
+ * with a string pattern still expands `$` sequences in the replacement).
+ * Returns the occurrence count so the caller can require a UNIQUE match
+ * (Claude-Code Edit parity): replacing the first of several identical strings
+ * silently edits the wrong place.
+ *
+ * @returns {{ count:number, newContent:string }}
+ */
+function applyLiteralEdit(content, oldStr, newStr, replaceAll) {
+  const parts = content.split(oldStr);
+  const count = parts.length - 1;
+  if (count === 0) return { count: 0, newContent: content };
+  const newContent = replaceAll
+    ? parts.join(newStr)
+    : parts[0] + newStr + parts.slice(1).join(oldStr); // first occurrence only
+  return { count, newContent };
+}
+
 /**
  * Compute the content an edit tool WOULD write, without writing it — the
  * left/right sides for an IDE diff review. Mirrors the corresponding
@@ -781,15 +803,22 @@ export function computeProposedEdit(name, args = {}, cwd = process.cwd()) {
       const content = fs.readFileSync(filePath, "utf8");
       if (
         typeof args.old_string !== "string" ||
-        !content.includes(args.old_string)
+        args.old_string === "" ||
+        typeof args.new_string !== "string"
       ) {
         return null;
       }
-      return {
-        filePath,
-        newContent: content.replace(args.old_string, () => args.new_string),
-        originalText: content,
-      };
+      const replaceAll = args.replace_all === true;
+      const { count, newContent } = applyLiteralEdit(
+        content,
+        args.old_string,
+        args.new_string,
+        replaceAll,
+      );
+      // No match, or a non-unique match without replace_all → the edit will be
+      // rejected, so show no (misleading) diff and let the tool report it.
+      if (count === 0 || (count > 1 && !replaceAll)) return null;
+      return { filePath, newContent, originalText: content };
     }
     if (name === "edit_file_hashed") {
       if (!fs.existsSync(filePath)) return null;
@@ -965,7 +994,7 @@ export async function executeTool(name, args, context = {}) {
   // 1. settings deny
   if (settingsVerdict.decision === "deny") {
     return {
-      error: `[Permission] Tool "${name}" denied by settings rule: ${settingsVerdict.rule}`,
+      error: `[Permission] Tool "${name}" denied by settings rule: ${settingsVerdict.rule}. This is a configured policy — retrying won't help; tell the user if the task genuinely needs it.`,
       policy: { decision: "deny", rule: settingsVerdict.rule, via: "settings" },
     };
   }
@@ -1037,7 +1066,7 @@ export async function executeTool(name, args, context = {}) {
         : false;
     if (!ok) {
       return {
-        error: `[Permission] Tool "${name}" requires confirmation (settings rule: ${settingsVerdict.rule}) — denied.`,
+        error: `[Permission] Tool "${name}" requires confirmation (settings rule: ${settingsVerdict.rule}) but this run is non-interactive — denied. Do not retry; tell the user this action needs their approval.`,
         policy: {
           decision: "ask",
           rule: settingsVerdict.rule,
@@ -1594,6 +1623,47 @@ export function renderNotebook(text) {
   return lines.join("\n");
 }
 
+/**
+ * Ingest the raw stdout of a search_files command into the shared hit
+ * accumulator: split into lines, dedup via `seen`, redact credential-file
+ * content hits, label multi-root results, and stop at the hit cap. Pure aside
+ * from mutating the passed-in `seen`/`hits`/`redactedCreds` collectors.
+ *
+ * Shared by the success path AND the maxBuffer-overflow salvage path: a search
+ * on a large tree (especially Windows, where `findstr`/`dir /s` have no `head`
+ * cap) can exceed execSync's maxBuffer and throw ENOBUFS — but the error still
+ * carries the first maxBuffer of matches in `err.stdout`, so the same ingest is
+ * run on it instead of dropping every match as a false "no matches".
+ *
+ * @param {string} output  raw command stdout (or a truncated partial)
+ * @param {object} ctx  { isContent, root, multiRoot, seen, hits, redactedCreds,
+ *                        credentialFileReason, limit? }
+ */
+export function _ingestSearchOutput(output, ctx) {
+  const limit = ctx.limit ?? 20;
+  for (const line of String(output || "")
+    .trim()
+    .split("\n")) {
+    const v = line.trim();
+    if (!v || ctx.seen.has(v)) continue;
+    if (ctx.isContent) {
+      // content hit is `file:line:text` (findstr /n) or a bare filename
+      // (grep -l); pull the source file and redact credential matches.
+      const src = v.match(/^(.+?):\d+:/)?.[1] ?? v;
+      if (ctx.credentialFileReason(src)) {
+        ctx.redactedCreds.add(src.replace(/\\/g, "/"));
+        ctx.seen.add(v);
+        continue;
+      }
+    }
+    // Qualify with the root so multi-root results stay unambiguous.
+    const labeled = ctx.multiRoot ? `${ctx.root}: ${v}` : v;
+    ctx.seen.add(v);
+    ctx.hits.push(labeled);
+    if (ctx.hits.length >= limit) return;
+  }
+}
+
 /**
  * Inner tool execution — no hooks, no plan-mode checks.
  */
@@ -1612,6 +1682,7 @@ async function executeToolInner(
     mcpClient,
     llmOptions,
     shellPolicyOverrides,
+    classifyAllShell = false,
     approvalGate,
     shellConfirm,
     additionalDirectories,
@@ -1663,6 +1734,13 @@ async function executeToolInner(
       if (!fs.existsSync(filePath)) {
         return attachDescriptor({ error: `File not found: ${filePath}` });
       }
+      // A clear, self-correcting error beats the cryptic "EISDIR: illegal
+      // operation on a directory" that readFileSync throws on a directory.
+      if (fs.statSync(filePath).isDirectory()) {
+        return attachDescriptor({
+          error: `Path is a directory, not a file: ${filePath}. Use list_dir to see its contents.`,
+        });
+      }
       const content = fs.readFileSync(filePath, "utf8");
       // Jupyter notebooks: render a compact cell listing (index/id/type/source,
       // outputs summarized) so the model can find cells for notebook_edit
@@ -1763,20 +1841,40 @@ async function executeToolInner(
       if (!fs.existsSync(filePath)) {
         return attachDescriptor({ error: `File not found: ${filePath}` });
       }
-      const content = fs.readFileSync(filePath, "utf8");
-      if (!content.includes(args.old_string)) {
-        return attachDescriptor({ error: "old_string not found in file" });
+      if (typeof args.old_string !== "string" || args.old_string === "") {
+        return attachDescriptor({
+          error: "old_string must be a non-empty string",
+        });
+      }
+      if (typeof args.new_string !== "string") {
+        return attachDescriptor({ error: "new_string must be a string" });
       }
-      const newContent = content.replace(
+      const content = fs.readFileSync(filePath, "utf8");
+      const replaceAll = args.replace_all === true;
+      const { count, newContent } = applyLiteralEdit(
+        content,
         args.old_string,
-        () => args.new_string,
+        args.new_string,
+        replaceAll,
       );
+      if (count === 0) {
+        return attachDescriptor({ error: "old_string not found in file" });
+      }
+      // Require a UNIQUE match (Claude-Code Edit parity) — replacing the first
+      // of several identical strings silently edits the wrong occurrence.
+      if (count > 1 && !replaceAll) {
+        return attachDescriptor({
+          error: `old_string is not unique — it appears ${count} times. Add surrounding context so it matches exactly one occurrence, or pass replace_all:true to change all of them.`,
+          occurrences: count,
+        });
+      }
       const wrote = writeFileVerified(filePath, newContent);
       if (wrote.error) return attachDescriptor({ error: wrote.error });
       return attachDescriptor({
         success: true,
         path: filePath,
         size: wrote.size,
+        replaced: replaceAll ? count : 1,
       });
     }
 
@@ -1831,9 +1929,12 @@ async function executeToolInner(
     }
 
     case "run_shell": {
-      const shellPolicyOpts = shellPolicyOverrides
-        ? { overrideRuleIds: shellPolicyOverrides }
-        : {};
+      const shellPolicyOpts = {
+        ...(shellPolicyOverrides
+          ? { overrideRuleIds: shellPolicyOverrides }
+          : {}),
+        ...(classifyAllShell ? { classifyAllShell: true } : {}),
+      };
       const override = getRuntimeToolDescriptorByCommand(args.command);
       let shellPolicy;
       let approvalOutcome = null;
@@ -1857,12 +1958,18 @@ async function executeToolInner(
           policy: gated.policy,
         };
         if (!gated.allowed) {
+          // Make a policy denial ACTIONABLE for the model (Claude-Code 2.1.193
+          // "denial reasons to transcripts"): tell it this won't change on
+          // retry and to involve the user, so it stops re-issuing the same
+          // blocked command (which otherwise just burns turns + tokens).
+          const tierLabel =
+            typeof gated.policy === "string" ? `"${gated.policy}" ` : "";
           return attachDescriptor(
             {
               error:
                 gated.via === "shell-policy"
-                  ? `[Shell Policy] ${gated.reason}`
-                  : `[ApprovalGate] command denied (${gated.via})`,
+                  ? `[Shell Policy] ${gated.reason} This command is blocked by policy and will not run — do not retry it; find another approach.`
+                  : `[ApprovalGate] command denied by the ${tierLabel}approval policy (via ${gated.via}). Retrying the same command will not help — it needs user approval. Tell the user (they can run it themselves, approve it, or relax the policy) and continue with other work.`,
               shellCommandPolicy: shellPolicy,
               approval: approvalOutcome,
             },
@@ -1874,7 +1981,7 @@ async function executeToolInner(
         if (!shellPolicy.allowed) {
           return attachDescriptor(
             {
-              error: `[Shell Policy] ${shellPolicy.reason}`,
+              error: `[Shell Policy] ${shellPolicy.reason} This command is blocked by policy and will not run — do not retry it; find another approach.`,
               shellCommandPolicy: shellPolicy,
             },
             override || runtimeDescriptor,
@@ -2137,12 +2244,17 @@ async function executeToolInner(
           args: { language: args.language },
         });
         if (gate.decision !== APPROVAL_DECISION.ALLOW) {
+          // Actionable denial (matches run_shell, Claude-Code 2.1.193): tell the
+          // model retrying won't help and to involve the user.
+          const tierLabel =
+            typeof gate.policy === "string" ? `"${gate.policy}" ` : "";
           return attachDescriptor({
-            error: `[ApprovalGate] run_code denied (${gate.via})`,
+            error: `[ApprovalGate] run_code denied by the ${tierLabel}approval policy (via ${gate.via}). Retrying won't help — running arbitrary code needs user approval. Tell the user (they can approve it or relax the policy) and continue with other work.`,
             approval: {
               decision: gate.decision,
               via: gate.via,
               riskLevel: "high",
+              policy: gate.policy,
             },
           });
         }
@@ -2303,13 +2415,14 @@ async function executeToolInner(
         ? [path.resolve(cwd, args.directory)]
         : [cwd, ...extraRoots];
       const isContent = Boolean(args.content_search);
-      const cmd = isContent
-        ? process.platform === "win32"
-          ? `findstr /s /i /n "${args.pattern}" *`
-          : `grep -r -l -i "${args.pattern}" . --include="*" 2>/dev/null | head -20`
-        : process.platform === "win32"
-          ? `dir /s /b *${args.pattern}* 2>NUL`
-          : `find . -name "*${args.pattern}*" -type f 2>/dev/null | head -20`;
+      // Pattern is model/user-supplied and flows into a shell — build the
+      // command with it SAFELY quoted (see search-command.js). Raw interpolation
+      // here was a command-injection bypass of the run_shell guards.
+      const built = buildSearchCommand({ pattern: args.pattern, isContent });
+      if (built.error) {
+        return attachDescriptor({ error: built.error });
+      }
+      const cmd = built.cmd;
 
       // Credential guard (Claude-Code 2.1.189 parity): a CONTENT search must not
       // become a side channel that exfils secrets the read_file / run_shell
@@ -2326,34 +2439,34 @@ async function executeToolInner(
       const redactedCreds = new Set();
       for (const root of roots) {
         if (hits.length >= 20) break;
+        const ictx = {
+          isContent,
+          root,
+          multiRoot: roots.length > 1,
+          seen,
+          hits,
+          redactedCreds,
+          credentialFileReason,
+        };
         try {
           if (!fs.existsSync(root)) continue;
           const output = execSync(cmd, {
             cwd: root,
             encoding: "utf8",
             timeout: 10000,
+            // Windows `findstr`/`dir /s` have no `head` cap (unlike the POSIX
+            // `| head -20`), so a large tree can blow past execSync's 1 MB
+            // default and throw ENOBUFS. Give it real headroom AND salvage the
+            // partial below — otherwise a busy repo silently reports "no matches".
+            maxBuffer: 8 * 1024 * 1024,
           });
-          for (const line of output.trim().split("\n")) {
-            const v = line.trim();
-            if (!v || seen.has(v)) continue;
-            if (isContent) {
-              // content hit is `file:line:text` (findstr /n) or a bare filename
-              // (grep -l); pull the source file and redact credential matches.
-              const src = v.match(/^(.+?):\d+:/)?.[1] ?? v;
-              if (credentialFileReason(src)) {
-                redactedCreds.add(src.replace(/\\/g, "/"));
-                seen.add(v);
-                continue;
-              }
-            }
-            // Qualify with the root so multi-root results stay unambiguous.
-            const labeled = roots.length > 1 ? `${root}: ${v}` : v;
-            seen.add(v);
-            hits.push(labeled);
-            if (hits.length >= 20) break;
-          }
-        } catch {
-          // No matches in this root — continue to the next.
+          _ingestSearchOutput(output, ictx);
+        } catch (err) {
+          // A maxBuffer overflow still carries the first 8 MB of matches in
+          // err.stdout — ingest those rather than dropping every hit as a false
+          // "No matches found". A genuine no-match / command failure leaves
+          // err.stdout empty, so hits stay unchanged (same as before).
+          if (err && err.stdout) _ingestSearchOutput(err.stdout, ictx);
         }
       }
 
@@ -2376,6 +2489,12 @@ async function executeToolInner(
       if (!fs.existsSync(dirPath)) {
         return attachDescriptor({ error: `Directory not found: ${dirPath}` });
       }
+      // Clear error instead of the cryptic "ENOTDIR" readdirSync throws on a file.
+      if (!fs.statSync(dirPath).isDirectory()) {
+        return attachDescriptor({
+          error: `Path is a file, not a directory: ${dirPath}. Use read_file to read it.`,
+        });
+      }
       const entries = fs.readdirSync(dirPath, { withFileTypes: true });
       return attachDescriptor({
         entries: entries.map((e) => ({
@@ -3685,7 +3804,9 @@ const _STREAM_STALL = Symbol("stream-stall");
  * @param {object} opts  { signal?, retries?, baseDelayMs?, onRetry?, sleep? }
  */
 export async function _retryStreamingChat(streamFn, opts = {}) {
-  const retries = opts.retries ?? STREAM_RETRY_MAX;
+  // Default budget honors CC_MAX_RETRIES / CLAUDE_CODE_MAX_RETRIES (capped 15);
+  // an explicit opts.retries still wins (tests / callers that pin it).
+  const retries = opts.retries ?? resolveStreamRetryMax();
   const base = opts.baseDelayMs ?? STREAM_RETRY_BASE_MS;
   const signal = opts.signal;
   const sleep = opts.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -4501,6 +4622,10 @@ export async function* agentLoop(messages, options) {
     parentMessages: messages, // pass parent messages for sub-agent auto-condensation
     interaction: options.interaction || null,
     shellPolicyOverrides: options.shellPolicyOverrides || null,
+    // autoMode.classifyAllShell (Claude-Code 2.1.193): when true, the built-in
+    // verification allowlist (npm test / rg / …) is classified through the
+    // ApprovalGate instead of fast-pathed, so no shell command auto-runs.
+    classifyAllShell: options.classifyAllShell || false,
     approvalGate: options.approvalGate || null,
     shellConfirm: options.shellConfirm || null,
     // Interactive sessions (the REPL) set this so run_code is gated through the

package/src/runtime/coding-agent-contract-shared.cjs

@@ -141,19 +141,26 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
     title: "Edit File",
     kind: "filesystem",
     tier: "mvp",
-    description: "Replace a specific string in a file with new content",
+    description:
+      "Replace a string in a file. old_string must match EXACTLY ONE place — include enough surrounding context to make it unique, or the edit is rejected. Pass replace_all:true to change every occurrence instead.",
     inputSchema: {
       type: "object",
       properties: {
         path: { type: "string", description: "File path" },
         old_string: {
           type: "string",
-          description: "Exact string to find and replace",
+          description:
+            "Exact string to replace; must be unique in the file unless replace_all is true",
         },
         new_string: {
           type: "string",
           description: "Replacement string",
         },
+        replace_all: {
+          type: "boolean",
+          description:
+            "Replace every occurrence of old_string instead of requiring a unique match (default false)",
+        },
       },
       required: ["path", "old_string", "new_string"],
     },