micro-models-agent 0.51.1 → 0.52.0

package/dist/modules/providers/presets.js

@@ -0,0 +1,128 @@
+// src/modules/providers/presets.ts
+import { OpenAICompatProvider } from "../../llm/openai-compat";
+/** Build an OpenAI-compatible provider (default for most backends). */
+function openaiCompat(opts) {
+    const retry = (opts.retry ?? {
+        maxRetries: 3,
+        baseDelay: 1000,
+        maxDelay: 30000,
+    });
+    const rateLimits = opts.rateLimits;
+    return new OpenAICompatProvider({
+        model: opts.model,
+        baseUrl: opts.baseUrl,
+        apiKey: opts.apiKey,
+        contextWindow: opts.contextWindow,
+        retry,
+        rateLimits,
+        maxCompletionTokens: opts.maxCompletionTokens,
+    });
+}
+const OPENAI_COMPAT = {
+    type: "openai-compat",
+    label: "OpenAI-compatible (LM Studio, Ollama, vLLM, etc.)",
+    baseUrl: "",
+    capabilities: {
+        streaming: true,
+        tools: true,
+        vision: false,
+        reasoningEffort: false,
+        listModels: true,
+        requiresKey: false,
+        auth: "bearer",
+    },
+    create: openaiCompat,
+};
+const OPENROUTER = {
+    type: "openrouter",
+    label: "OpenRouter (openrouter.ai)",
+    baseUrl: "https://openrouter.ai/api/v1",
+    capabilities: {
+        streaming: true,
+        tools: true,
+        vision: true,
+        reasoningEffort: false,
+        listModels: true,
+        requiresKey: true,
+        auth: "bearer",
+    },
+    create: openaiCompat,
+};
+const OPENAI = {
+    type: "openai",
+    label: "OpenAI API",
+    baseUrl: "https://api.openai.com/v1",
+    capabilities: {
+        streaming: true,
+        tools: true,
+        vision: true,
+        reasoningEffort: true,
+        listModels: true,
+        requiresKey: true,
+        auth: "bearer",
+    },
+    create: openaiCompat,
+};
+const ANTHROPIC = {
+    type: "anthropic",
+    label: "Anthropic Claude",
+    baseUrl: "https://api.anthropic.com",
+    capabilities: {
+        streaming: false,
+        tools: false,
+        vision: true,
+        reasoningEffort: false,
+        listModels: false,
+        requiresKey: true,
+        auth: "header",
+    },
+    // The Anthropic messages API is NOT OpenAI-compatible. This preset is a
+    // placeholder until a real AnthropicProvider lands; the factory still uses
+    // the OpenAI-compatible code path today (broken), flagged via capabilities.
+    create: openaiCompat,
+};
+const OPENCODE_ZEN = {
+    type: "opencode-zen",
+    label: "OpenCode Zen (opencode.ai/zen)",
+    baseUrl: "https://opencode.ai/zen/v1",
+    capabilities: {
+        streaming: true,
+        tools: true,
+        vision: false,
+        reasoningEffort: false,
+        listModels: true,
+        requiresKey: false,
+        auth: "bearer",
+    },
+    create: openaiCompat,
+};
+const OPENCODE_GO = {
+    type: "opencode-go",
+    label: "OpenCode Go (opencode.ai/go)",
+    baseUrl: "https://opencode.ai/zen/go/v1",
+    capabilities: {
+        streaming: true,
+        tools: true,
+        vision: false,
+        reasoningEffort: false,
+        listModels: true,
+        requiresKey: false,
+        auth: "bearer",
+    },
+    create: openaiCompat,
+};
+/** All builtin provider presets. */
+export const BUILTIN_PROVIDERS = [
+    OPENAI_COMPAT,
+    OPENROUTER,
+    OPENAI,
+    ANTHROPIC,
+    OPENCODE_ZEN,
+    OPENCODE_GO,
+];
+/** Fixed base URLs for hosted providers (no port scan / model autodetect). */
+export const HOSTED_BASE_URLS = {};
+for (const spec of BUILTIN_PROVIDERS) {
+    if (spec.baseUrl)
+        HOSTED_BASE_URLS[spec.type] = spec.baseUrl;
+}

package/dist/modules/providers/registry.js

@@ -0,0 +1,22 @@
+/**
+ * Single source of truth mapping provider `type` → factory + capabilities.
+ * Adding a provider = one `register()` call; no changes to the agent loop.
+ */
+export class ProviderRegistry {
+    specs = new Map();
+    register(spec) {
+        this.specs.set(spec.type, spec);
+    }
+    get(type) {
+        return this.specs.get(type);
+    }
+    has(type) {
+        return this.specs.has(type);
+    }
+    list() {
+        return [...this.specs.values()];
+    }
+    types() {
+        return [...this.specs.keys()];
+    }
+}

package/dist/modules/providers/types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/registry.js

@@ -2,6 +2,7 @@ export class ModuleRegistry {
     modules = new Map();
     register(mod) {
         this.modules.set(mod.name, mod);
+        return this;
     }
     get(name) {
         return this.modules.get(name);

package/dist/modules/security/command-validator.js

@@ -115,6 +115,20 @@ export function isCommandAllowed(command, securityConfig) {
             reason: `Shell wrapper "${baseForShellCheck}" is blocked — use the bash tool directly`,
         };
     }
+    // Interpreters with -c/-e execute arbitrary code and bypass the blacklist.
+    const INTERPRETER_FLAGS = /(?:^|\s)(?:bash|sh|zsh|dash|python|python3|node|bun|perl|ruby)\s+(?:-c|-e|--command|--eval)\b/;
+    if (INTERPRETER_FLAGS.test(trimmedCommand)) {
+        return { allowed: false, reason: "Interpreter -c/-e invocation is blocked" };
+    }
+    // Multi-line commands can hide blacklisted commands after a newline.
+    if (/\r?\n/.test(trimmedCommand)) {
+        return { allowed: false, reason: "Multi-line commands are blocked" };
+    }
+    // Chained commands bypass the base-command check (e.g. "echo hi; rm -rf /").
+    if (/[;&|]/.test(trimmedCommand) &&
+        /(^|[;&|\s])(rm|del|rd|dd|chmod|chown|wget|curl|nc|netcat|shutdown|reboot|mkfs|fdisk)\b/.test(trimmedCommand)) {
+        return { allowed: false, reason: "Command chaining to a dangerous command is blocked" };
+    }
     // Check dangerous operators FIRST — before parsing the base command.
     // e.g. "curl http://x | bash" must be caught even though curl isn't blacklisted.
     if (config.blockDangerousFlags) {

package/dist/modules/security/encryption.js

@@ -1,4 +1,4 @@
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { homedir } from "os";
 import { join } from "path";
 import { readFileSync, writeFileSync, existsSync, copyFileSync } from "fs";
@@ -33,10 +33,10 @@ export function getOrCreateEncryptionKey(config) {
             writeFileSync(keyPath, key.toString("base64"), { mode: 0o600 });
             return key;
         }
-        catch {
-            // If we can't write the key file, return the key anyway
-            // The caller can handle the error
-            return key;
+        catch (e) {
+            // If we can't persist the key, encrypted data would be unrecoverable
+            // on the next run — fail loudly instead of silently degrading.
+            throw new Error(`Cannot write encryption key to ${keyPath}: ${e instanceof Error ? e.message : String(e)}`);
         }
     }
     try {
@@ -102,7 +102,7 @@ export function decryptString(encryptedText, key) {
     hmac.update(iv);
     hmac.update(Buffer.from(encrypted, "base64"));
     const computedTag = hmac.digest();
-    if (!computedTag.equals(authTag)) {
+    if (computedTag.length !== authTag.length || !timingSafeEqual(computedTag, authTag)) {
         throw new Error("Authentication failed: invalid tag");
     }
     // Decrypt with AES-256-CBC

package/dist/modules/security/network-validator.js

@@ -1,4 +1,14 @@
 import { sanitizeLogMessage } from "./data-sanitizer";
+/**
+ * Check if a hostname is a private/link-local address (SSRF protection).
+ */
+export function isIpPrivate(hostname) {
+    const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    return (/^(localhost|127\.0\.0\.1|0\.0\.0\.0|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.)/.test(h) ||
+        h === "::1" ||
+        /^(fc|fd)/.test(h) ||
+        (h.includes(":") && h.startsWith("fe80")));
+}
 /**
  * Check if a URL is allowed based on security configuration
  */
@@ -10,6 +20,13 @@ export function isUrlAllowed(url, securityConfig) {
     try {
         const urlObj = new URL(url);
         const domain = urlObj.hostname.toLowerCase();
+        const scheme = urlObj.protocol.toLowerCase();
+        if (scheme !== "http:" && scheme !== "https:") {
+            return { allowed: false, reason: `Scheme "${scheme}" is not allowed` };
+        }
+        if (isIpPrivate(domain)) {
+            return { allowed: false, reason: `Private address "${domain}" is blocked (SSRF)` };
+        }
         // Check denied domains first
         if (securityConfig.deniedDomains?.length) {
             for (const deniedDomain of securityConfig.deniedDomains) {

package/dist/modules/security/path-validator.js

@@ -1,4 +1,5 @@
 import { resolve, normalize } from "path";
+import { isInsideDir, matchesScopeEntry } from "../../tools/path-utils";
 /**
  * Check if a path is within the allowed scope
  * This combines global security settings with per-tool scope
@@ -6,8 +7,9 @@ import { resolve, normalize } from "path";
 export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
     const baseResolved = resolve(baseDir);
     const targetResolved = resolve(baseDir, normalize(targetPath));
-    // First, check that path is within baseDir
-    if (!targetResolved.startsWith(baseResolved)) {
+    // First, check that path is within baseDir (separator- and case-safe: a
+    // sibling directory sharing the prefix must not pass).
+    if (!isInsideDir(targetResolved, baseResolved)) {
         return {
             allowed: false,
             reason: "Path is outside the base working directory",
@@ -17,8 +19,8 @@ export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
     if (!securityConfig?.enabled) {
         // Still enforce subagent scope if present
         if (scope) {
-            const isReadScope = scope.read_only_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
-            const isWriteScope = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+            const isReadScope = scope.read_only_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
+            const isWriteScope = scope.allowed_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
             if (isWriteScope)
                 return { allowed: true };
             if (isReadScope)
@@ -61,8 +63,8 @@ export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
     if (!scope) {
         return { allowed: true };
     }
-    const isRead = scope.read_only_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
-    const isWrite = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+    const isRead = scope.read_only_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
+    const isWrite = scope.allowed_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
     if (isWrite)
         return { allowed: true };
     if (isRead)
@@ -78,8 +80,9 @@ export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
 export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
     const baseResolved = resolve(baseDir);
     const targetResolved = resolve(baseDir, normalize(targetPath));
-    // First, check that path is within baseDir
-    if (!targetResolved.startsWith(baseResolved)) {
+    // First, check that path is within baseDir (separator- and case-safe: a
+    // sibling directory sharing the prefix must not pass).
+    if (!isInsideDir(targetResolved, baseResolved)) {
         return {
             allowed: false,
             reason: "Path is outside the base working directory",
@@ -89,7 +92,7 @@ export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
     if (!securityConfig?.enabled) {
         // Still enforce subagent scope if present
         if (scope) {
-            const isWriteScope = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+            const isWriteScope = scope.allowed_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
             if (isWriteScope)
                 return { allowed: true };
             return {
@@ -130,7 +133,7 @@ export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
     if (!scope) {
         return { allowed: true };
     }
-    const isWrite = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+    const isWrite = scope.allowed_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
     if (isWrite)
         return { allowed: true };
     return {
@@ -149,16 +152,7 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
     if (pattern.endsWith("/")) {
         const dirPattern = pattern.slice(0, -1);
         const resolvedDirPattern = resolve(baseDir, dirPattern);
-        // Exact match
-        if (resolvedTargetPath === resolvedDirPattern) {
-            return true;
-        }
-        // Check if target is inside the directory
-        if (resolvedTargetPath.startsWith(resolvedDirPattern + "/") ||
-            resolvedTargetPath.startsWith(resolvedDirPattern + "\\")) {
-            return true;
-        }
-        return false;
+        return isInsideDir(resolvedTargetPath, resolvedDirPattern);
     }
     // Handle **/* pattern (recursive)
     if (pattern.includes("**/")) {
@@ -166,8 +160,7 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
         const prefix = parts[0];
         const suffix = parts[1];
         const resolvedPrefix = resolve(baseDir, prefix);
-        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") &&
-            !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
+        if (!isInsideDir(resolvedTargetPath, resolvedPrefix)) {
             return false;
         }
         const remainingPath = resolvedTargetPath.slice(resolvedPrefix.length);
@@ -183,8 +176,7 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
         const prefix = parts[0];
         const suffix = parts[1];
         const resolvedPrefix = resolve(baseDir, prefix);
-        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") &&
-            !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
+        if (!isInsideDir(resolvedTargetPath, resolvedPrefix)) {
             return false;
         }
         if (!suffix) {
@@ -202,6 +194,10 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
         const relativePath = resolvedTargetPath.slice(resolvedBaseDir.length + 1).replace(/\\/g, "/");
         return regex.test(relativePath);
     }
-    // Exact match
-    return resolvedTargetPath === resolve(baseDir, pattern);
+    // Exact match (case-insensitive on win32, where the FS is case-insensitive)
+    const exactTarget = resolve(baseDir, pattern);
+    if (process.platform === "win32") {
+        return resolvedTargetPath.toLowerCase() === exactTarget.toLowerCase();
+    }
+    return resolvedTargetPath === exactTarget;
 }

package/dist/modules/session/store.js

@@ -34,7 +34,7 @@ export class SessionStore {
         return this.encryptor?.isEnabled() ?? false;
     }
     init() {
-        mkdirSync(this.baseDir, { recursive: true });
+        mkdirSync(this.baseDir, { recursive: true, mode: 0o700 });
     }
     sessionDir(id) {
         return join(this.baseDir, id);
@@ -54,13 +54,13 @@ export class SessionStore {
     saveMeta(id, meta) {
         this._metaCache.set(id, meta);
         const dir = this.sessionDir(id);
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
         const content = JSON.stringify(meta, null, 2);
         if (this.encryptor) {
-            writeFileSync(this.metaPath(id), this.encryptor.encryptFileContent(content), "utf-8");
+            writeFileSync(this.metaPath(id), this.encryptor.encryptFileContent(content), { encoding: "utf-8", mode: 0o600 });
         }
         else {
-            writeFileSync(this.metaPath(id), content, "utf-8");
+            writeFileSync(this.metaPath(id), content, { encoding: "utf-8", mode: 0o600 });
         }
     }
     loadMeta(id) {
@@ -83,13 +83,13 @@ export class SessionStore {
     }
     appendMessage(id, msg) {
         const dir = this.sessionDir(id);
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
         const line = JSON.stringify(msg);
         if (this.encryptor?.isEnabled()) {
-            appendFileSync(this.historyPath(id), this.encryptor.encryptFileContent(line) + "\n", "utf-8");
+            appendFileSync(this.historyPath(id), this.encryptor.encryptFileContent(line) + "\n", { encoding: "utf-8", mode: 0o600 });
         }
         else {
-            appendFileSync(this.historyPath(id), line + "\n", "utf-8");
+            appendFileSync(this.historyPath(id), line + "\n", { encoding: "utf-8", mode: 0o600 });
         }
         const meta = this.loadMeta(id);
         if (meta) {
@@ -135,13 +135,13 @@ export class SessionStore {
     }
     appendSessionLog(id, entry) {
         const dir = this.sessionDir(id);
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
         const line = JSON.stringify(entry);
         if (this.encryptor?.isEnabled()) {
-            appendFileSync(this.sessionLogPath(id), this.encryptor.encryptFileContent(line) + "\n", "utf-8");
+            appendFileSync(this.sessionLogPath(id), this.encryptor.encryptFileContent(line) + "\n", { encoding: "utf-8", mode: 0o600 });
         }
         else {
-            appendFileSync(this.sessionLogPath(id), line + "\n", "utf-8");
+            appendFileSync(this.sessionLogPath(id), line + "\n", { encoding: "utf-8", mode: 0o600 });
         }
     }
     loadSessionLog(id) {

package/dist/tools/approve.js

@@ -2,6 +2,7 @@ import { t } from "../i18n/index";
 import { askChoice } from "./user-input";
 export const approveTool = {
     name: "approve",
+    icon: "🙋",
     description: "Request user approval for an action. The user picks Yes or No from a menu.",
     tags: ["core"],
     interactive: true,

package/dist/tools/attach-image.js

@@ -5,6 +5,7 @@ import { loadFileAsDataUrl, loadUrlAsDataUrl, readClipboardImage, bufferToDataUr
 import { logSecurityBlock } from "../modules/security/audit-log";
 export const attachImageTool = {
     name: "attach_image",
+    icon: "🖼️",
     description: "Attach an image to the conversation from a file path, URL, or clipboard. The image will be included in the next message sent to the model. Supports PNG, JPEG, GIF, WebP.",
     tags: ["vision", "image"],
     parameters: {
@@ -36,6 +37,17 @@ export const attachImageTool = {
                 dataUrl = result.dataUrl;
             }
             else if (source.startsWith("http://") || source.startsWith("https://")) {
+                // Security: validate URL against the network policy (SSRF).
+                const { isUrlAllowed } = await import("../modules/security/network-validator");
+                const { getSessionSecurityConfig } = await import("../modules/security/session-isolation");
+                const networkConfig = ctx.sessionContext
+                    ? getSessionSecurityConfig(ctx.config, ctx.sessionContext).network
+                    : ctx.config?.security?.network;
+                const urlCheck = isUrlAllowed(source, networkConfig);
+                if (!urlCheck.allowed) {
+                    logSecurityBlock(ctx.sessionId, "network_request", urlCheck.reason ?? "attach_image URL blocked", source);
+                    return { success: false, output: `[SECURITY BLOCKED] ${urlCheck.reason}` };
+                }
                 const result = await loadUrlAsDataUrl(source);
                 dataUrl = result.dataUrl;
             }

package/dist/tools/bash.js

@@ -298,6 +298,8 @@ export function emptyCliRunHint(command, output, code) {
  * the same failing `npx`/`bunx`/`npm run` command).
  */
 const NPM_EXEC_RE = /could not determine executable to run/i;
+/** process-management tools hidden behind enable_tools (tag "shell"). */
+const HIDDEN_PROCESS_TOOLS = ["process_list", "process_log", "process_kill"];
 export function npmExecHint(output) {
     if (NPM_EXEC_RE.test(output)) {
         return `${output}\n\nHint: ${t("exec.npm_exec_hint")}`;
@@ -306,6 +308,7 @@ export function npmExecHint(output) {
 }
 export const bashTool = {
     name: "bash",
+    icon: "💻",
     description: "Execute a shell command and return its output. Use for running tests, build, git, and shell operations. Commands that are still running after a few seconds are automatically moved to the background and return a process id — manage them with process_list, process_log, process_kill. Set background=true to return a process id immediately for commands you know are long-running (dev servers, watchers).\n\nWindows notes: the shell is cmd.exe — PowerShell cmdlets (Write-Host, Get-Content, Select-String, Out-File) and bash heredocs (cat << EOF) do NOT work there. Use the read_file/write_file tools instead of cat/echo redirection. Sequential commands: use && (a leading ; is auto-converted to &).",
     tags: ["shell", "code"],
     parameters: {
@@ -340,6 +343,19 @@ export const bashTool = {
             };
         }
         const command = adaptCommandForWindows(originalCommand);
+        // Hidden-tool discovery (ses_mt4fn58c): with tool-set narrowing the
+        // process_* tools are invisible to the model, so running them through
+        // cmd.exe only yields "is not recognized" — three wasted attempts in
+        // that session. Point the model at enable_tools. (k=v forms are handled
+        // by the redirect above and reach the real tool.)
+        const baseCmd = originalCommand.trim().split(/\s+/)[0];
+        if (HIDDEN_PROCESS_TOOLS.includes(baseCmd) &&
+            ctx.toolExecutor?.hasTool?.(baseCmd)) {
+            return {
+                success: false,
+                output: t("exec.hidden_tool_hint", { tool: baseCmd }),
+            };
+        }
         // echo/printf redirection to a file is unreliable in cmd.exe (single
         // quotes don't group, multi-line commands split, embedded double quotes
         // break the command). Steer the model to write_file instead — it
@@ -359,7 +375,10 @@ export const bashTool = {
         const fullSecurityConfig = ctx.sessionContext
             ? getSessionSecurityConfig(appConfig, ctx.sessionContext)
             : appConfig.security || DEFAULT_SECURITY_CONFIG;
-        const securityConfig = fullSecurityConfig.bash || DEFAULT_SECURITY_CONFIG.bash;
+        // Master switch off → all sub-modules off, even when defaults are enabled.
+        const securityConfig = fullSecurityConfig.enabled === false
+            ? { ...(fullSecurityConfig.bash || DEFAULT_SECURITY_CONFIG.bash), enabled: false }
+            : fullSecurityConfig.bash || DEFAULT_SECURITY_CONFIG.bash;
         const validation = isCommandAllowed(command, securityConfig);
         if (!validation.allowed) {
             // Log security block
@@ -405,11 +424,15 @@ export const bashTool = {
                 const testRun = detectTestResults(output);
                 if (testRun && testRun.failed > 0) {
                     output =
-                        `[test-runner] ${testRun.framework}: ${testRun.failed} test(s) FAILING, ${testRun.passed} passing — do NOT mark verification steps as done while tests fail. Investigate the failures, fix the code, then re-run the tests.\n\n` +
-                            output;
+                        t("exec.test_runner_fail", {
+                            framework: testRun.framework,
+                            failed: String(testRun.failed),
+                            passed: String(testRun.passed),
+                        }) +
+                            `\n\n${output}`;
                 }
                 else if (testRun && testRun.failed === 0 && testRun.passed > 0) {
-                    output = `[test-runner] ${testRun.framework}: all ${testRun.passed} test(s) passing.\n\n${output}`;
+                    output = `${t("exec.test_runner_pass", { framework: testRun.framework, passed: String(testRun.passed) })}\n\n${output}`;
                 }
                 if (!output && code !== 0) {
                     output = `(exit code ${code})`;

package/dist/tools/browser.js

@@ -34,6 +34,7 @@ export function formatScreenshotResult(snapshot, screenshot, supportsVision) {
 export function createBrowserTool() {
     return {
         name: "browser",
+        icon: "🌐",
         tags: ["browser", "vision"],
         description: [
             "Control a headless browser. Navigate pages, click elements, type text, scroll, take screenshots.",

package/dist/tools/chunk-query.js

@@ -5,6 +5,7 @@ import { isPathInScope } from "./scope-check";
 import { runChunkQuery } from "../modules/context/chunk-query";
 export const chunkQueryTool = {
     name: "chunk_query",
+    icon: "🧩",
     description: "Answer a query over a large text (file or inline) by splitting it into chunks and querying the model per chunk in parallel, then optionally synthesizing a final answer. Use when the input is too large for the context window.",
     tags: ["research", "code"],
     /** Multiple LLM calls (parallel chunk queries + synthesis) need a longer budget. */

package/dist/tools/create-dir.js

@@ -6,6 +6,7 @@ import { getSessionSecurityConfig } from "../modules/security/session-isolation"
 import { safeResolvePath } from "./path-utils";
 export const createDirTool = {
     name: "create_dir",
+    icon: "📁",
     description: "Create a directory (and any intermediate directories).",
     tags: ["file"],
     parameters: {

package/dist/tools/delete-file.js

@@ -7,6 +7,7 @@ import { generateDeleteDiff } from "../ui/diff";
 import { safeResolvePath } from "./path-utils";
 export const deleteFileTool = {
     name: "delete_file",
+    icon: "🗑️",
     description: "Delete a file from the filesystem.",
     tags: ["file"],
     parameters: {

package/dist/tools/download-file.js

@@ -12,6 +12,7 @@ import { safeResolvePath } from "./path-utils";
 export const MAX_DOWNLOAD_BYTES = 100 * 1024 * 1024;
 export const downloadFileTool = {
     name: "download_file",
+    icon: "⬇️",
     description: "Download a file (image, archive, binary, font, etc.) from a URL and save it to disk. Returns only the path, size and content type — read the saved file with read_file/attach_image afterwards. Use this for binary files; web_fetch/web_browse return text only and cannot save bytes.",
     tags: ["file", "research"],
     parameters: {

package/dist/tools/edit-file.js

@@ -8,6 +8,7 @@ import { generateDiff } from "../ui/diff";
 import { safeResolvePath } from "./path-utils";
 export const editFileTool = {
     name: "edit_file",
+    icon: "✏️",
     description: "Find and replace text in an existing file. Uses exact string match (not regex).",
     tags: ["file", "code"],
     parameters: {
@@ -53,7 +54,7 @@ export const editFileTool = {
         if (!content.includes(oldStr)) {
             return {
                 success: false,
-                output: t("file.string_not_found", { str: oldStr }),
+                output: t("file.string_not_found", { str: oldStr, path }),
             };
         }
         const updated = content.replace(oldStr, newStr);

package/dist/tools/enable-tools.js

@@ -9,6 +9,7 @@ import { t } from "../i18n/index";
  */
 export const enableToolsTool = {
     name: "enable_tools",
+    icon: "🔌",
     description: "Enable hidden tool categories for the current session. Only the essential tools (file/code/shell) are active by default. Call this with the tags you need and they become available from the next turn. Available tags: file, code, shell, research, browser, vision, image, memory, core. Returns the newly available tools. To run a task in a separate context instead, use subagent with tool_tags.",
     alwaysOn: true,
     parameters: {

package/dist/tools/executor.js

@@ -114,13 +114,23 @@ export class ToolExecutor {
                 toolCallId: call.id,
             };
         }
-        for (const plugin of this.pluginManager.getAllPlugins()) {
-            if (plugin.onAfterTool) {
-                try {
-                    await plugin.onAfterTool(this.ctx, call, result);
-                }
-                catch (e) {
-                    this.ctx.logger.warn(`Plugin onAfterTool error: ${e.message}`);
+        // After an abort the tool's work is discarded (the agent loop breaks
+        // without rendering or logging it), so skip the slow post-tool plugins
+        // (LSP checks, lint, tsc) entirely. When the abort lands mid-plugin the
+        // signal in the hook context lets the plugin kill its child processes.
+        if (signal?.aborted) {
+            this.ctx.logger.debug(`Tool ${call.name}: abort, skipping onAfterTool plugins`);
+        }
+        else {
+            const pluginCtx = signal ? { ...this.ctx, signal } : this.ctx;
+            for (const plugin of this.pluginManager.getAllPlugins()) {
+                if (plugin.onAfterTool) {
+                    try {
+                        await plugin.onAfterTool(pluginCtx, call, result);
+                    }
+                    catch (e) {
+                        this.ctx.logger.warn(`Plugin onAfterTool error: ${e.message}`);
+                    }
                 }
             }
         }

package/dist/tools/file-info.js

@@ -4,6 +4,7 @@ import { isPathInScope } from "../modules/security/path-validator";
 import { safeResolvePath } from "./path-utils";
 export const fileInfoTool = {
     name: "file_info",
+    icon: "ℹ️",
     description: "Get metadata about a file or directory (size, creation date, modification date).",
     tags: ["file"],
     boundedOutput: true,

package/dist/tools/glob-tool.js

@@ -3,6 +3,7 @@ import { t } from "../i18n/index";
 import { MAX_PREVIEW_LINES } from "./preview";
 export const globTool = {
     name: "glob",
+    icon: "🔎",
     description: `Search for files matching a glob pattern. Shows up to ${MAX_PREVIEW_LINES} results by default. Uses standard glob syntax (e.g., **/*.ts, src/**/*.test.ts).`,
     tags: ["file", "code", "research"],
     parameters: {