praxis-agent 0.56.0 → 0.58.0

package/README.md

@@ -27,7 +27,7 @@ sessions, configuration, or compatibility directories.
 
 - macOS or Linux
 - Node.js 24 or newer
-- [`ripgrep`](https://github.com/BurntSushi/ripgrep) (`rg`) for the Grep tool
+- [`ripgrep`](https://github.com/BurntSushi/ripgrep) (`rg`) for the Grep and Glob tools
 - an API key and model ID for an Anthropic, OpenAI-compatible, or OpenAI
   Responses provider (the stable setup), or the explicitly enabled experimental
   ChatGPT-backed Codex subscription integration
@@ -173,8 +173,9 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   context budgets; print mode,
   structured JSON/JSONL, context compaction, tool loops, and bounded execution.
 - **Built-in tools** — read, write, edit, `ApplyPatch` for bounded ordered exact
-  multi-file replacements, glob, search, shell, notebook, PDF, image, web,
-  scheduled prompts, workflows, and worktrees.
+  multi-file replacements, configured plugin LSP navigation with fresh bounded
+  diagnostics after successful edits, glob, search, shell, notebook, PDF,
+  image, web, scheduled prompts, workflows, and worktrees.
 - **Shell lifecycle** — foreground Bash allows up to 10 minutes and carries a
   validated final working directory across calls in the same session without
   leaking state across sessions or overriding an explicit `/cd`.

package/dist/tools/claude-lsp-tool.d.ts

@@ -12,11 +12,14 @@ export declare class ClaudeLspToolManager {
         environment?: Readonly<Record<string, string | undefined>>;
     });
     registry(base: ToolRegistry): ToolRegistry;
+    private discardConnectionsOutside;
+    private runtimeCwd;
     private validatedFile;
     private candidates;
     private languageId;
     private connection;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
+    enrichMutationResult(call: ModelToolCall, context: ToolExecutionContext, result: ToolExecutionResult): Promise<ToolExecutionResult>;
     close(): Promise<void>;
 }
 //# sourceMappingURL=claude-lsp-tool.d.ts.map

package/dist/tools/claude-lsp-tool.js

@@ -1,16 +1,18 @@
 import { execFile, spawn, } from 'node:child_process';
 import { readFile, realpath, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { extname, resolve, sep } from 'node:path';
+import { extname, isAbsolute, relative, resolve, sep } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
 import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 import { redactSensitiveText, sanitizeChildEnvironment, sensitiveEnvironmentValues, } from '../platform/sensitive-data.js';
 import { formatClaudeLspResult } from './claude-lsp-formatters.js';
+import { formatDiagnostics, parsePublishDiagnostics, } from './lsp-diagnostics.js';
 const MAX_MESSAGE_BYTES = 8 * 1024 * 1024;
 const MAX_RESULT_CHARS = 512 * 1024;
 const MAX_FILE_BYTES = 10_000_000;
 const REQUEST_TIMEOUT_MS = 15_000;
+const DIAGNOSTICS_TIMEOUT_MS = 1_000;
 const execFileAsync = promisify(execFile);
 const NO_CALL_HIERARCHY = Symbol('no-call-hierarchy');
 function lspSensitiveValues(definition) {
@@ -224,6 +226,9 @@ class LspConnection {
     buffer = Buffer.alloc(0);
     pending = new Map();
     documents = new Map();
+    diagnosticSnapshots = new Map();
+    diagnosticWaiters = new Set();
+    diagnosticGeneration = 0;
     stderr = '';
     exited = false;
     initialized = false;
@@ -253,6 +258,20 @@ class LspConnection {
             this.cleanupPending(id, pending);
             pending.reject(error);
         }
+        for (const waiter of [...this.diagnosticWaiters])
+            this.settleDiagnosticWaiter(waiter, undefined, error);
+        this.diagnosticSnapshots.clear();
+    }
+    settleDiagnosticWaiter(waiter, diagnostics, error) {
+        if (!this.diagnosticWaiters.delete(waiter))
+            return;
+        clearTimeout(waiter.timer);
+        if (waiter.signal && waiter.abort)
+            waiter.signal.removeEventListener('abort', waiter.abort);
+        if (error)
+            waiter.reject(error);
+        else
+            waiter.resolve(diagnostics ?? []);
     }
     cleanupPending(id, pending) {
         clearTimeout(pending.timer);
@@ -306,6 +325,29 @@ class LspConnection {
         if (!message || typeof message !== 'object' || Array.isArray(message))
             return;
         const value = message;
+        const publication = parsePublishDiagnostics(message);
+        if (publication) {
+            const document = [...this.documents.values()].find((candidate) => candidate.uri === publication.uri);
+            if (!document)
+                return;
+            if (publication.version !== undefined &&
+                publication.version !== document.version)
+                return;
+            const generation = ++this.diagnosticGeneration;
+            this.diagnosticSnapshots.set(publication.uri, {
+                generation,
+                diagnostics: publication.diagnostics,
+            });
+            const snapshot = this.diagnosticSnapshots.get(publication.uri);
+            for (const waiter of [...this.diagnosticWaiters]) {
+                if (waiter.uri !== publication.uri ||
+                    !snapshot ||
+                    snapshot.generation <= waiter.afterGeneration)
+                    continue;
+                this.settleDiagnosticWaiter(waiter, snapshot.diagnostics);
+            }
+            return;
+        }
         if (value.id !== undefined && typeof value.method === 'string') {
             const result = value.method === 'workspace/configuration' &&
                 value.params &&
@@ -444,7 +486,7 @@ class LspConnection {
                     publishDiagnostics: {
                         relatedInformation: true,
                         tagSupport: { valueSet: [1, 2] },
-                        versionSupport: false,
+                        versionSupport: true,
                         codeDescriptionSupport: true,
                         dataSupport: false,
                     },
@@ -472,25 +514,82 @@ class LspConnection {
         }
         this.initialized = true;
     }
-    async openDocument(filePath, languageId) {
-        const text = await readFile(filePath, 'utf8');
+    synchronizeDocument(filePath, languageId, text) {
         const current = this.documents.get(filePath);
         const uri = pathToFileURL(filePath).href;
+        if (current?.text === text)
+            return false;
         if (!current) {
-            this.documents.set(filePath, { text, version: 1 });
+            this.documents.set(filePath, { text, version: 1, uri });
             this.notify('textDocument/didOpen', {
                 textDocument: { uri, languageId, version: 1, text },
             });
-            return;
         }
-        if (current.text === text)
-            return;
-        const version = current.version + 1;
-        this.documents.set(filePath, { text, version });
-        this.notify('textDocument/didChange', {
-            textDocument: { uri, version },
-            contentChanges: [{ text }],
+        else {
+            const version = current.version + 1;
+            this.documents.set(filePath, { text, version, uri });
+            this.notify('textDocument/didChange', {
+                textDocument: { uri, version },
+                contentChanges: [{ text }],
+            });
+        }
+        return true;
+    }
+    async openDocument(filePath, languageId) {
+        const text = await readFile(filePath, 'utf8');
+        this.synchronizeDocument(filePath, languageId, text);
+    }
+    async refreshDiagnostics(filePath, languageId, signal) {
+        if (signal?.aborted)
+            return [];
+        const text = await readFile(filePath, 'utf8');
+        if (signal?.aborted)
+            return [];
+        const uri = pathToFileURL(filePath).href;
+        const current = this.documents.get(filePath);
+        if (current && current.text === text)
+            return [];
+        const afterGeneration = this.diagnosticSnapshots.get(uri)?.generation ?? 0;
+        let waiter;
+        const result = new Promise((resolveResult, rejectResult) => {
+            const entry = {
+                uri,
+                afterGeneration,
+                resolve: resolveResult,
+                reject: rejectResult,
+                timer: setTimeout(() => {
+                    this.settleDiagnosticWaiter(entry);
+                }, 1_000),
+                ...(signal ? { signal } : {}),
+            };
+            waiter = entry;
+            if (signal) {
+                entry.abort = () => {
+                    this.settleDiagnosticWaiter(entry, undefined, new Error('LSP diagnostics refresh cancelled'));
+                };
+                if (signal.aborted) {
+                    clearTimeout(entry.timer);
+                    resolveResult([]);
+                    return;
+                }
+                signal.addEventListener('abort', entry.abort, { once: true });
+            }
+            this.diagnosticWaiters.add(entry);
         });
+        if (signal?.aborted)
+            return result;
+        try {
+            this.synchronizeDocument(filePath, languageId, text);
+        }
+        catch (error) {
+            if (waiter) {
+                // The method throws the send failure directly. Resolve the detached
+                // waiter while cleaning it so it cannot become an unhandled rejection.
+                this.settleDiagnosticWaiter(waiter);
+            }
+            throw error;
+        }
+        return result.catch(() => []);
     }
     async execute(input, filePath, signal) {
         const uri = pathToFileURL(filePath).href;
@@ -527,6 +626,7 @@ class LspConnection {
     async close() {
         if (this.exited)
             return;
+        this.fail(new Error(`LSP server ${this.definition.name} is closing`));
         const exited = new Promise((resolveExit) => {
             this.child.once('close', () => resolveExit());
         });
@@ -567,6 +667,33 @@ export class ClaudeLspToolManager {
     registry(base) {
         return new ClaudeLspToolRegistry(base, this);
     }
+    async discardConnectionsOutside(runtimeCwd) {
+        const prefix = runtimeCwd === undefined ? undefined : `${runtimeCwd}\0`;
+        const staleKeys = new Set([
+            ...this.connections.keys(),
+            ...this.initializing.keys(),
+            ...this.restartCounts.keys(),
+        ].filter((key) => prefix === undefined || !key.startsWith(prefix)));
+        const staleConnections = [];
+        for (const key of staleKeys) {
+            const connection = this.connections.get(key);
+            if (connection)
+                staleConnections.push(connection);
+            this.connections.delete(key);
+            this.initializing.delete(key);
+            this.restartCounts.delete(key);
+        }
+        await Promise.allSettled(staleConnections.map((connection) => connection.close()));
+    }
+    async runtimeCwd() {
+        try {
+            return await realpath(this.options.cwdProvider());
+        }
+        catch (error) {
+            await this.discardConnectionsOutside();
+            throw error;
+        }
+    }
     async validatedFile(inputPath) {
         const cwd = this.options.cwdProvider();
         const expanded = inputPath === '~'
@@ -601,16 +728,23 @@ export class ClaudeLspToolManager {
         const extension = extname(filePath).toLowerCase();
         return (Object.entries(definition.extensionToLanguage).find(([candidate]) => candidate.toLowerCase() === extension)?.[1] ?? '');
     }
-    async connection(definition, signal) {
-        const runtimeCwd = await realpath(this.options.cwdProvider());
+    async connection(definition, signal, expectedCwd) {
+        const runtimeCwd = await this.runtimeCwd();
+        if (expectedCwd !== undefined && runtimeCwd !== expectedCwd) {
+            await this.discardConnectionsOutside(runtimeCwd);
+            throw new Error('LSP diagnostics cwd changed during collection');
+        }
+        if (signal?.aborted)
+            throw new Error('LSP connection cancelled');
         const serverCwd = await realpath(definition.workspaceFolder ?? runtimeCwd);
         const key = `${runtimeCwd}\0${definition.pluginName}\0${definition.name}`;
-        const stale = [...this.connections.entries()].filter(([candidate]) => !candidate.startsWith(`${runtimeCwd}\0`));
-        for (const [candidate, connection] of stale) {
-            this.connections.delete(candidate);
-            this.initializing.delete(candidate);
-            this.restartCounts.delete(candidate);
-            await connection.close();
+        await this.discardConnectionsOutside(runtimeCwd);
+        if (signal?.aborted)
+            throw new Error('LSP connection cancelled');
+        const confirmedCwd = await this.runtimeCwd();
+        if (expectedCwd !== undefined && confirmedCwd !== expectedCwd) {
+            await this.discardConnectionsOutside(confirmedCwd);
+            throw new Error('LSP diagnostics cwd changed during collection');
         }
         const initializing = this.initializing.get(key);
         if (initializing)
@@ -657,7 +791,7 @@ export class ClaudeLspToolManager {
     async execute(call, context) {
         try {
             const input = inputFrom(call.input);
-            const cwd = await realpath(this.options.cwdProvider());
+            const cwd = await this.runtimeCwd();
             const { filePath, canonicalPath, size } = await this.validatedFile(input.filePath);
             if (size > MAX_FILE_BYTES) {
                 return {
@@ -710,6 +844,96 @@ export class ClaudeLspToolManager {
             };
         }
     }
+    async enrichMutationResult(call, context, result) {
+        if (result.isError || (call.name !== 'Edit' && call.name !== 'ApplyPatch'))
+            return result;
+        if (context.signal?.aborted)
+            return result;
+        const deadline = new AbortController();
+        let resolveInterrupted;
+        const interrupted = new Promise((resolveResult) => {
+            resolveInterrupted = resolveResult;
+        });
+        const abort = () => {
+            deadline.abort();
+            resolveInterrupted?.(result);
+        };
+        context.signal?.addEventListener('abort', abort, { once: true });
+        const timer = setTimeout(() => abort(), DIAGNOSTICS_TIMEOUT_MS);
+        const attempt = (async () => {
+            const cwd = await this.runtimeCwd();
+            await this.discardConnectionsOutside(cwd);
+            const sameCwd = async () => {
+                try {
+                    const runtimeCwd = await this.runtimeCwd();
+                    if (runtimeCwd === cwd)
+                        return true;
+                    await this.discardConnectionsOutside(runtimeCwd);
+                }
+                catch {
+                    // runtimeCwd() already discarded connection-local state.
+                }
+                return false;
+            };
+            if (deadline.signal.aborted || !(await sameCwd()))
+                return result;
+            const requested = call.name === 'Edit'
+                ? [call.input.file_path]
+                : Array.isArray(call.input.edits)
+                    ? call.input.edits.map((edit) => edit?.file_path)
+                    : [];
+            const targets = new Set();
+            for (const value of requested) {
+                if (typeof value !== 'string' || deadline.signal.aborted)
+                    continue;
+                try {
+                    const canonical = await realpath(resolve(cwd, value));
+                    if (deadline.signal.aborted || !(await sameCwd()))
+                        continue;
+                    const relativePath = relative(cwd, canonical);
+                    if (relativePath === '..' ||
+                        relativePath.startsWith(`..${sep}`) ||
+                        isAbsolute(relativePath) ||
+                        !(await stat(canonical)).isFile())
+                        continue;
+                    targets.add(canonical);
+                }
+                catch {
+                    // Successful mutations must remain successful when enrichment cannot inspect a target.
+                }
+            }
+            const records = [];
+            await Promise.all([...targets].flatMap((filePath) => this.candidates(filePath).map(async (definition) => {
+                if (deadline.signal.aborted)
+                    return;
+                try {
+                    const connection = await this.connection(definition, deadline.signal, cwd);
+                    if (deadline.signal.aborted || !(await sameCwd()))
+                        return;
+                    const current = await connection.refreshDiagnostics(filePath, this.languageId(definition, filePath), deadline.signal);
+                    if (deadline.signal.aborted || !(await sameCwd()))
+                        return;
+                    records.push(...current);
+                }
+                catch {
+                    // Diagnostics are best effort and never change mutation semantics.
+                }
+            })));
+            if (records.length === 0 || deadline.signal.aborted || !(await sameCwd()))
+                return result;
+            const block = formatDiagnostics(records, cwd, this.options.servers.flatMap((definition) => lspSensitiveValues(definition)));
+            return block
+                ? { ...result, content: `${result.content}\n${block}` }
+                : result;
+        })().catch(() => result);
+        try {
+            return await Promise.race([attempt, interrupted]);
+        }
+        finally {
+            clearTimeout(timer);
+            context.signal?.removeEventListener('abort', abort);
+        }
+    }
     async close() {
         const connections = [...this.connections.values()];
         this.connections.clear();
@@ -742,10 +966,11 @@ class ClaudeLspToolRegistry {
             ? Promise.resolve(call)
             : this.base.prepare(call, context);
     }
-    execute(call, context) {
-        return call.name === 'LSP'
-            ? this.manager.execute(call, context)
-            : this.base.execute(call, context);
+    async execute(call, context) {
+        if (call.name === 'LSP')
+            return this.manager.execute(call, context);
+        const result = await this.base.execute(call, context);
+        return this.manager.enrichMutationResult(call, context, result);
     }
 }
 //# sourceMappingURL=claude-lsp-tool.js.map

package/dist/tools/glob.d.ts

@@ -1,9 +1,37 @@
-export interface GlobFilesOptions {
+import { type ProcessResult } from '../platform/bounded-process-runner.js';
+export interface GlobSearchRequest {
     root: string;
     displayRoot: string;
     absoluteRoot: string;
     pattern: string;
     signal?: AbortSignal;
 }
-export declare function globFiles(options: GlobFilesOptions): Promise<string>;
+export interface GlobSearchResult {
+    content: string;
+    isError: boolean;
+}
+export interface GlobSearch {
+    search(request: GlobSearchRequest): Promise<GlobSearchResult>;
+}
+export interface RipgrepGlobSearchOptions {
+    cwd: string;
+    timeoutMs: number;
+    environment?: Readonly<Record<string, string>>;
+    runner?: {
+        run(options: {
+            command: string;
+            args: readonly string[];
+            cwd?: string;
+            timeoutMs: number;
+            signal?: AbortSignal;
+            env?: Readonly<Record<string, string>>;
+        }): Promise<ProcessResult>;
+    };
+}
+export declare class RipgrepGlobSearch implements GlobSearch {
+    private readonly options;
+    private readonly runner;
+    constructor(options: RipgrepGlobSearchOptions);
+    search(request: GlobSearchRequest): Promise<GlobSearchResult>;
+}
 //# sourceMappingURL=glob.d.ts.map

package/dist/tools/glob.js

@@ -1,88 +1,97 @@
-import { lstat, opendir } from 'node:fs/promises';
 import { isAbsolute, join, resolve, sep } from 'node:path';
 import { minimatch } from 'minimatch';
+import { BoundedProcessRunner, joinedProcessOutput, } from '../platform/bounded-process-runner.js';
 const MAX_RESULTS = 100;
+const MAX_ENUMERATION_BYTES = 2 * 1024 * 1024;
+function portable(value) {
+    return sep === '/' ? value : value.split(sep).join('/');
+}
 function abortError() {
     return new DOMException('Tool execution aborted', 'AbortError');
 }
-function portablePath(path) {
-    return sep === '/' ? path : path.split(sep).join('/');
-}
-function compareMatches(left, right) {
-    return left.mtimeMs - right.mtimeMs || left.order - right.order;
-}
-function insertOldest(matches, candidate) {
-    let low = 0;
-    let high = matches.length;
-    while (low < high) {
-        const middle = Math.floor((low + high) / 2);
-        const current = matches[middle];
-        if (current && compareMatches(current, candidate) <= 0)
-            low = middle + 1;
-        else
-            high = middle;
+export class RipgrepGlobSearch {
+    options;
+    runner;
+    constructor(options) {
+        this.options = options;
+        this.runner =
+            options.runner ??
+                new BoundedProcessRunner({
+                    cwd: options.cwd,
+                    maxOutputBytes: MAX_ENUMERATION_BYTES,
+                });
     }
-    matches.splice(low, 0, candidate);
-    if (matches.length > MAX_RESULTS)
-        matches.pop();
-}
-export async function globFiles(options) {
-    const pattern = portablePath(options.pattern);
-    const absolutePattern = isAbsolute(options.pattern);
-    const matchBase = !absolutePattern && !pattern.includes('/');
-    const matches = [];
-    const directories = [''];
-    let matchCount = 0;
-    let order = 0;
-    while (directories.length > 0) {
-        if (options.signal?.aborted)
+    async search(request) {
+        if (request.signal?.aborted)
             throw abortError();
-        const relativeDirectory = directories.pop() ?? '';
-        const directory = await opendir(join(options.root, relativeDirectory));
-        for await (const entry of directory) {
-            if (options.signal?.aborted)
-                throw abortError();
-            const relativePath = join(relativeDirectory, entry.name);
-            if (entry.isDirectory()) {
-                directories.push(relativePath);
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            const portableRelativePath = portablePath(relativePath);
-            const absolutePath = portablePath(resolve(options.absoluteRoot, relativePath));
-            if (pattern !== '' &&
-                !minimatch(absolutePattern ? absolutePath : portableRelativePath, pattern, { dot: true, matchBase, noext: true })) {
-                continue;
-            }
-            let metadata;
-            try {
-                metadata = await lstat(join(options.root, relativePath));
-            }
-            catch (error) {
-                if (error.code === 'ENOENT')
-                    continue;
-                throw error;
-            }
-            if (!metadata.isFile())
-                continue;
-            const displayPath = absolutePattern
-                ? absolutePath
-                : portablePath(join(options.displayRoot, relativePath));
-            insertOldest(matches, {
-                path: displayPath,
-                mtimeMs: metadata.mtimeMs,
-                order,
+        const hidden = this.options.environment?.CLAUDE_CODE_GLOB_HIDDEN !== 'false';
+        const noIgnore = this.options.environment?.CLAUDE_CODE_GLOB_NO_IGNORE !== 'false';
+        let result;
+        try {
+            result = await this.runner.run({
+                command: 'rg',
+                args: [
+                    '--files',
+                    '--null',
+                    '--sort',
+                    'modified',
+                    ...(hidden ? ['--hidden'] : []),
+                    ...(noIgnore ? ['--no-ignore'] : []),
+                ],
+                cwd: request.root,
+                timeoutMs: this.options.timeoutMs,
+                ...(request.signal ? { signal: request.signal } : {}),
+                ...(this.options.environment ? { env: this.options.environment } : {}),
             });
-            matchCount += 1;
-            order += 1;
         }
+        catch (error) {
+            if (error instanceof Error && error.name === 'AbortError')
+                throw error;
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`Glob enumeration failed: ${message}`);
+        }
+        if (result.timedOut)
+            return {
+                content: `Search timed out after ${this.options.timeoutMs}ms`,
+                isError: true,
+            };
+        if (result.truncated)
+            throw new Error('Glob enumeration failed: output truncated');
+        if (result.code !== 0) {
+            if (result.code === 1 && !result.stdout && !result.stderr)
+                return { content: 'No files found', isError: false };
+            const output = joinedProcessOutput(result);
+            throw new Error(`Glob enumeration failed with exit code ${result.code}${output ? `: ${output}` : ''}`);
+        }
+        const pattern = portable(request.pattern);
+        const absolutePattern = isAbsolute(request.pattern);
+        const matchBase = !absolutePattern && !pattern.includes('/');
+        const paths = result.stdout.split('\0').filter(Boolean);
+        const matched = paths.filter((path) => {
+            const relativePath = portable(path);
+            const absolutePath = portable(resolve(request.absoluteRoot, relativePath));
+            return (pattern === '' ||
+                minimatch(absolutePattern ? absolutePath : relativePath, pattern, {
+                    dot: true,
+                    matchBase,
+                    noext: true,
+                }));
+        });
+        if (matched.length === 0)
+            return { content: 'No files found', isError: false };
+        const display = matched.slice(0, MAX_RESULTS).map((path) => {
+            const relativePath = portable(path);
+            if (absolutePattern)
+                return portable(resolve(request.absoluteRoot, relativePath));
+            return portable(join(request.displayRoot, relativePath));
+        });
+        const content = display.join('\n');
+        return {
+            content: matched.length > MAX_RESULTS
+                ? `${content}\n(Showing 100 of ${matched.length} matching files; ${matched.length - 100} more are not listed. Narrow the pattern or path to see the rest.)`
+                : content,
+            isError: false,
+        };
     }
-    if (matchCount === 0)
-        return 'No files found';
-    const content = matches.map((match) => match.path).join('\n');
-    return matchCount > MAX_RESULTS
-        ? `${content}\n(Showing ${MAX_RESULTS} of ${matchCount} matching files; ${matchCount - MAX_RESULTS} more are not listed. Narrow the pattern or path to see the rest.)`
-        : content;
 }
 //# sourceMappingURL=glob.js.map

package/dist/tools/local-tools.d.ts

@@ -1,4 +1,5 @@
 import type { ModelToolCall, ModelToolDefinition, ToolExecutionContext, ToolExecutionResult, ToolRegistry } from '../core/runtime.js';
+import { type GlobSearch } from './glob.js';
 import type { DataPlane } from '../persistence/data-plane.js';
 export interface LocalToolRegistryOptions {
     cwd: string;
@@ -17,6 +18,7 @@ export interface LocalToolRegistryOptions {
     sandbox?: BashSandboxRuntime;
     homeDirectory?: string;
     configRoot?: string;
+    globSearch?: GlobSearch;
 }
 export interface BashSandboxRuntime {
     shouldUseSandbox(input: {
@@ -46,6 +48,7 @@ export declare class LocalToolRegistry implements ToolRegistry {
     private readonly maxShellTimeoutMs;
     private readonly maxSearchTimeoutMs;
     private readonly processRunner;
+    private readonly globSearch;
     private readonly enableReportFindings;
     private readonly environment;
     private readonly sessionEnvironment;
@@ -55,6 +58,7 @@ export declare class LocalToolRegistry implements ToolRegistry {
     private readonly sessionCwds;
     private readonly protectedWriteReason;
     private readonly mutationTargetExisted;
+    private readonly preparedGlobRoots;
     constructor(options: LocalToolRegistryOptions);
     private assertProtectedWritePath;
     private assertProtectedBashCommand;

package/dist/tools/local-tools.js

@@ -7,7 +7,7 @@ import sharp from 'sharp';
 import { countTokens } from '@anthropic-ai/tokenizer';
 import { commandShell, commandShellArguments, } from '../platform/command-shell.js';
 import { BoundedProcessRunner, joinedProcessOutput, } from '../platform/bounded-process-runner.js';
-import { globFiles } from './glob.js';
+import { RipgrepGlobSearch } from './glob.js';
 import { countLineChanges } from './line-changes.js';
 import { editNotebook, formatNotebookForRead } from './notebook.js';
 import { openPdf } from './pdf.js';
@@ -537,6 +537,7 @@ export class LocalToolRegistry {
     maxShellTimeoutMs;
     maxSearchTimeoutMs;
     processRunner;
+    globSearch;
     enableReportFindings;
     environment;
     sessionEnvironment;
@@ -546,6 +547,7 @@ export class LocalToolRegistry {
     sessionCwds = new Map();
     protectedWriteReason;
     mutationTargetExisted = new WeakMap();
+    preparedGlobRoots = new WeakMap();
     constructor(options) {
         this.cwd = resolve(options.cwd);
         this.cwdProvider = options.cwdProvider;
@@ -576,6 +578,13 @@ export class LocalToolRegistry {
             cwd: this.cwd,
             maxOutputBytes: this.maxOutputBytes,
         });
+        this.globSearch =
+            options.globSearch ??
+                new RipgrepGlobSearch({
+                    cwd: this.cwd,
+                    timeoutMs: this.maxSearchTimeoutMs,
+                    ...(this.environment ? { environment: this.environment } : {}),
+                });
     }
     assertProtectedWritePath(filePath) {
         const reason = this.protectedWriteReason(filePath);
@@ -805,14 +814,16 @@ export class LocalToolRegistry {
             case 'Glob': {
                 const pathInput = call.input.path;
                 const requestedPath = pathInput === undefined ? '.' : stringInput(call.input, 'path');
-                await this.globRoot(requestedPath, context);
-                return {
+                const root = await this.globRoot(requestedPath, context);
+                const prepared = {
                     ...call,
                     input: {
                         pattern: stringInput(call.input, 'pattern', true),
                         ...(pathInput === undefined ? {} : { path: requestedPath }),
                     },
                 };
+                this.preparedGlobRoots.set(prepared, root);
+                return prepared;
             }
             case 'Grep': {
                 const glob = optionalString(call.input, 'glob');
@@ -857,6 +868,11 @@ export class LocalToolRegistry {
         if (JSON.stringify(prepared.input) !== JSON.stringify(call.input)) {
             throw new Error('Tool input changed after permission approval');
         }
+        const approvedGlobRoot = this.preparedGlobRoots.get(call);
+        if (approvedGlobRoot !== undefined &&
+            this.preparedGlobRoots.get(prepared) !== approvedGlobRoot) {
+            throw new Error('Tool input changed after permission approval');
+        }
         const executionTargetExisted = this.mutationTargetExisted.get(prepared);
         if (approvedTargetExisted !== undefined &&
             executionTargetExisted !== approvedTargetExisted) {
@@ -1466,37 +1482,21 @@ export class LocalToolRegistry {
     }
     async glob(call, context) {
         const requestedPath = call.input.path === undefined ? '.' : stringInput(call.input, 'path');
-        const root = await this.globRoot(requestedPath, context);
-        const timeoutSignal = AbortSignal.timeout(this.maxSearchTimeoutMs);
-        const searchSignal = context.signal
-            ? AbortSignal.any([context.signal, timeoutSignal])
-            : timeoutSignal;
-        try {
-            const content = await globFiles({
-                root,
-                displayRoot: call.input.path === undefined ? '.' : requestedPath,
-                absoluteRoot: isAbsolute(requestedPath)
-                    ? resolve(requestedPath)
-                    : resolve(this.currentCwd(context), requestedPath),
-                pattern: stringInput(call.input, 'pattern', true),
-                signal: searchSignal,
-            });
-            return {
-                content: truncateOutput(content, this.maxOutputBytes),
-                isError: false,
-            };
-        }
-        catch (error) {
-            if (context.signal?.aborted)
-                throw abortError();
-            if (timeoutSignal.aborted) {
-                return {
-                    content: `Search timed out after ${this.maxSearchTimeoutMs}ms`,
-                    isError: true,
-                };
-            }
-            throw error;
-        }
+        const root = this.preparedGlobRoots.get(call) ??
+            (await this.globRoot(requestedPath, context));
+        const result = await this.globSearch.search({
+            root,
+            displayRoot: call.input.path === undefined ? '.' : requestedPath,
+            absoluteRoot: isAbsolute(requestedPath)
+                ? resolve(requestedPath)
+                : resolve(this.currentCwd(context), requestedPath),
+            pattern: stringInput(call.input, 'pattern', true),
+            ...(context.signal ? { signal: context.signal } : {}),
+        });
+        return {
+            content: truncateOutput(result.content, this.maxOutputBytes),
+            isError: result.isError,
+        };
     }
     async grep(call, context) {
         const workspaceRoot = await realpath(this.currentCwd(context));

package/dist/tools/lsp-diagnostics.d.ts

@@ -0,0 +1,20 @@
+export type DiagnosticSeverity = 'error' | 'warning' | 'information' | 'hint';
+export interface LspDiagnosticRecord {
+    canonicalPath: string;
+    line: number;
+    column: number;
+    severity: DiagnosticSeverity;
+    code: string;
+    message: string;
+}
+export interface LspDiagnosticsPublication {
+    uri: string;
+    filePath: string;
+    version?: number;
+    diagnostics: readonly LspDiagnosticRecord[];
+}
+/** Parse one strict, id-less LSP publishDiagnostics notification. */
+export declare function parsePublishDiagnostics(value: unknown): LspDiagnosticsPublication | null;
+/** Format diagnostics as one bounded provider-visible block. */
+export declare function formatDiagnostics(diagnostics: readonly LspDiagnosticRecord[], cwd: string, sensitiveValues?: readonly string[]): string | null;
+//# sourceMappingURL=lsp-diagnostics.d.ts.map

package/dist/tools/lsp-diagnostics.js

@@ -0,0 +1,173 @@
+import { relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { redactSensitiveText } from '../platform/sensitive-data.js';
+const severityNames = {
+    1: 'error',
+    2: 'warning',
+    3: 'information',
+    4: 'hint',
+};
+const severityRank = {
+    error: 0,
+    warning: 1,
+    information: 2,
+    hint: 3,
+};
+function safeInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+}
+function recordObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function localFilePath(uri) {
+    if (typeof uri !== 'string')
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== 'file:' || parsed.search || parsed.hash)
+        return null;
+    try {
+        return fileURLToPath(parsed);
+    }
+    catch {
+        return null;
+    }
+}
+/** Parse one strict, id-less LSP publishDiagnostics notification. */
+export function parsePublishDiagnostics(value) {
+    try {
+        if (!recordObject(value) || value.jsonrpc !== '2.0')
+            return null;
+        if (value.id !== undefined ||
+            value.method !== 'textDocument/publishDiagnostics')
+            return null;
+        if (!recordObject(value.params))
+            return null;
+        const params = value.params;
+        const uri = params.uri;
+        const rawPath = localFilePath(uri);
+        if (!rawPath || typeof uri !== 'string')
+            return null;
+        const filePath = rawPath;
+        const version = params.version;
+        if (version !== undefined && !safeInteger(version))
+            return null;
+        if (!Array.isArray(params.diagnostics))
+            return null;
+        const diagnostics = [];
+        for (const value of params.diagnostics) {
+            if (!recordObject(value) || typeof value.message !== 'string')
+                return null;
+            if (!recordObject(value.range))
+                return null;
+            const range = value.range;
+            if (!recordObject(range.start) || !recordObject(range.end))
+                return null;
+            const start = range.start;
+            const end = range.end;
+            if (!safeInteger(start.line) ||
+                !safeInteger(start.character) ||
+                !safeInteger(end.line) ||
+                !safeInteger(end.character) ||
+                end.line < start.line ||
+                (end.line === start.line && end.character < start.character))
+                return null;
+            const severity = value.severity;
+            if (severity !== undefined &&
+                (!safeInteger(severity) || severity < 1 || severity > 4))
+                return null;
+            const code = value.code;
+            if (code !== undefined &&
+                !(typeof code === 'string' ||
+                    (typeof code === 'number' && Number.isFinite(code))))
+                return null;
+            diagnostics.push({
+                canonicalPath: filePath,
+                line: start.line + 1,
+                column: start.character + 1,
+                severity: severityNames[severity ?? 1] ?? 'error',
+                code: code === undefined ? '' : String(code),
+                message: value.message,
+            });
+        }
+        return {
+            uri,
+            filePath,
+            ...(version === undefined ? {} : { version }),
+            diagnostics,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function compareText(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+function sanitize(value, sensitiveValues) {
+    const redacted = redactSensitiveText(value, sensitiveValues);
+    let controlsCollapsed = '';
+    let inControls = false;
+    for (const character of redacted) {
+        const code = character.codePointAt(0) ?? 0;
+        const control = code <= 0x1f ||
+            (code >= 0x7f && code <= 0x9f) ||
+            code === 0x2028 ||
+            code === 0x2029;
+        if (control) {
+            if (!inControls)
+                controlsCollapsed += ' ';
+            inControls = true;
+        }
+        else {
+            controlsCollapsed += character;
+            inControls = false;
+        }
+    }
+    return controlsCollapsed.replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+}
+function relativePath(path, cwd) {
+    return relative(cwd, path).replaceAll('\\', '/').replace(/^\.\//u, '');
+}
+function compareRecords(a, b, cwd) {
+    const aPath = relativePath(a.canonicalPath, cwd);
+    const bPath = relativePath(b.canonicalPath, cwd);
+    return (compareText(aPath, bPath) ||
+        a.line - b.line ||
+        a.column - b.column ||
+        severityRank[a.severity] - severityRank[b.severity] ||
+        compareText(a.code, b.code) ||
+        compareText(a.message, b.message));
+}
+/** Format diagnostics as one bounded provider-visible block. */
+export function formatDiagnostics(diagnostics, cwd, sensitiveValues = []) {
+    if (diagnostics.length === 0)
+        return null;
+    const sorted = [...diagnostics].sort((a, b) => compareRecords(a, b, cwd));
+    const marker = '… diagnostics truncated';
+    const lines = [];
+    let truncated = sorted.length > 8;
+    for (const diagnostic of sorted.slice(0, 8)) {
+        const code = sanitize(diagnostic.code, sensitiveValues);
+        const message = sanitize(diagnostic.message, sensitiveValues);
+        const line = `${sanitize(relativePath(diagnostic.canonicalPath, cwd), sensitiveValues)}:${diagnostic.line}:${diagnostic.column} ${sanitize(diagnostic.severity, sensitiveValues)}${code ? ` ${code}` : ''} ${message}`;
+        const candidate = `<diagnostics>\n${[...lines, line].join('\n')}\n</diagnostics>`;
+        if (Buffer.byteLength(candidate, 'utf8') > 4096) {
+            truncated = true;
+            break;
+        }
+        lines.push(line);
+    }
+    if (truncated) {
+        while (Buffer.byteLength(`<diagnostics>\n${[...lines, marker].join('\n')}\n</diagnostics>`, 'utf8') > 4096)
+            lines.pop();
+        lines.push(marker);
+    }
+    return `<diagnostics>\n${lines.join('\n')}\n</diagnostics>`;
+}
+//# sourceMappingURL=lsp-diagnostics.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",
@@ -62,7 +62,7 @@
     "verify:ci-coverage": "node scripts/verify-ci-coverage.mjs",
     "verify:fixture-contracts": "node scripts/verify-fixture-contracts.mjs",
     "test:fixtures": "node scripts/run-fixture-contracts.mjs",
-    "test:eval:baseline": "vitest run src/evals/coding-baseline.test.ts src/evals/project-eval-comparison.test.ts src/evals/apply-patch-admission.test.ts"
+    "test:eval:baseline": "vitest run src/evals/coding-baseline.test.ts src/evals/project-eval-comparison.test.ts src/evals/apply-patch-admission.test.ts src/evals/lsp-diagnostics-admission.test.ts src/evals/glob-ripgrep-admission.test.ts"
   },
   "engines": {
     "node": ">=24"