thincoder 0.12.10 → 0.12.12

package/src/agent-tools/subagent.mjs

@@ -14,6 +14,48 @@ import { validateDesignToken } from "./advisor.mjs"
  * - parallel subagent calls via the parallel channel (parallel: true)
  * - non-recursive: child agents do not get the subagent tool (depth > 0 is not injected)
  */
+
+/**
+ * Effective subagent model override for a role (CLI parity shared with VS Code):
+ * priority — subagent tool `model` arg > config.agent.subagentModels[role] > config.agent.subagentModel > null (inherit parent).
+ */
+export function effectiveSubagentModel(parent, role, modelArg) {
+  if (modelArg) return modelArg
+  const cfg = parent.config?.agent ?? {}
+  return cfg.subagentModels?.[role] ?? cfg.subagentModel ?? null
+}
+
+/**
+ * Resolve the sub-agent's provider from a model override string (shared with the
+ * VS Code port). Forms accepted:
+ *   "provider:model"  → the named provider with the named model
+ *   "provider"        → the named provider's configured model
+ *   "model"           → same provider as the parent, different model
+ * null → parent's provider unchanged.
+ * API keys follow the config fallback order (provider.apiKey → THINCODER_API_KEY → provider-specific env).
+ */
+export function resolveChildProvider(parent, modelArg) {
+  if (!modelArg) return { ...parent.provider }
+  const providers = parent.config?.providersList ?? []
+  const withKey = (p) => {
+    if (p.apiKey?.trim()) return { ...p, apiKey: p.apiKey.trim() }
+    if (process.env.THINCODER_API_KEY) return { ...p, apiKey: process.env.THINCODER_API_KEY }
+    const envMap = { deepseek: "DEEPSEEK_API_KEY", openai: "OPENAI_API_KEY" }
+    const keyVar = envMap[p.name]
+    if (keyVar && process.env[keyVar]) return { ...p, apiKey: process.env[keyVar] }
+    return { ...p }
+  }
+  if (modelArg.includes(":")) {
+    const [pname, mname] = modelArg.split(":")
+    const p = providers.find((x) => x.name === pname)
+    if (!p) throw new Error(`subagent model: unknown provider "${pname}" (available: ${providers.map((x) => x.name).join(", ") || "none"})`)
+    return { ...withKey(p), model: mname || p.model }
+  }
+  const byName = providers.find((x) => x.name === modelArg)
+  if (byName) return withKey(byName)
+  return { ...parent.provider, model: modelArg }
+}
+
 export const subagentTool = {
   name: "subagent",
   description:
@@ -30,6 +72,7 @@ export const subagentTool = {
       task: { type: "string", description: "Self-contained task description for the sub-agent" },
       context: { type: "string", description: "Optional background the sub-agent needs (it cannot see this conversation)" },
       role: { type: "string", enum: ["explore", "plan", "coder", "eng-coder"], description: "Sub-agent role: 'explore' (read-only search/analysis), 'plan' (read-only implementation planning), 'coder' (full implementation), 'eng-coder' (engineering-mode coder — strict methodology, design-driven). ENUM IS OVERRIDDEN IN setup.mjs PER ENGINEERING MODE." },
+      model: { type: "string", description: "Provider/model override for this sub-agent: 'provider:model', a provider name from config, or a model name on the parent's provider. Defaults to the agent.subagentModel config, then the parent's provider. Useful for offloading heavy work to a cheaper model." },
       designToken: { type: "string", description: "Required when role='eng-coder': the token returned by advisor(type='design') after the design review passed. Without a valid token, eng-coder cannot modify files." },
     },
     required: ["task"],
@@ -49,6 +92,9 @@ export const subagentTool = {
       throw new Error("Engineering mode is not active — use role='coder' for implementation tasks.")
     }
 
+    // Provider/model override: tool `model` arg > subagentModels[role] > subagentModel > parent provider
+    const childProvider = resolveChildProvider(parent, effectiveSubagentModel(parent, role, args.model))
+
     // eng-coder token gate: the design review must have passed and the caller must
     // present the exact token advisor issued — otherwise the child is not authorized to code.
     if (role === "eng-coder") {
@@ -97,7 +143,7 @@ export const subagentTool = {
       : parent.config
 
     const child = createAgent({
-      provider: parent.provider,
+      provider: childProvider,
       tools,
       config: childConfig,
       cwd: parent.cwd,
@@ -134,7 +180,7 @@ export const subagentTool = {
         ? (name, args) => ctx.callbacks.onToolCall(`${relayPrefix}${name}`, args)
         : null,
     }
-    const childRunOpts = { depth: (ctx.depth ?? 0) + 1, maxTurns: ctx.agent?.config?.agent?.subagentTurns ?? DEFAULT_SUBAGENT_TURNS }
+    const childRunOpts = buildChildRunOpts(ctx)
     let report = await runAgent(child, input, childOpts, childRunOpts)
 
     // Report too short = incomplete handoff: send back for expansion once (inspired by kimi-code's summaryPolicy: min 200 chars, retry 1 time).
@@ -157,6 +203,20 @@ export const subagentTool = {
   },
 }
 
+/**
+ * Child agent run options — the parent's abort signal MUST propagate to the
+ * child: without it, Ctrl+C aborts the parent's controller but the child keeps
+ * running its full turn budget (up to subagentTurns) while the parent awaits —
+ * the interrupt appears to do nothing.
+ */
+export function buildChildRunOpts(ctx) {
+  return {
+    depth: (ctx.depth ?? 0) + 1,
+    maxTurns: ctx.agent?.config?.agent?.subagentTurns ?? DEFAULT_SUBAGENT_TURNS,
+    signal: ctx.signal ?? null,
+  }
+}
+
 /**
  * Merge an eng-coder child's mutations into the parent agent's bookkeeping.
  * The parent must stay aware of delegated file changes: `_touchedFiles` enables
@@ -164,13 +224,20 @@ export const subagentTool = {
  * pushback for review. Prior verify/advisor state is invalidated because it
  * judged an older state.
  *
- * `_advisorRound` is reset to 0: merged code is new code that deserves a fresh
- * convergence budget. Mirrors the design-review reset semantics.
+ * `_advisorRound` is NOT reset: merged code enters the CURRENT convergence
+ * cycle. Resetting here would break the review→fix→re-review loop (the parent
+ * reviews, spawns an eng-coder to fix, merges, reviews again — every merge
+ * would restart at round 1 and the 5-round cap could never be reached).
+ * `_calledAdvisorThisRun` IS cleared so the merged code triggers a fresh
+ * advisor call (the guard demands review of new mutations).
  *
  * Returns true when mutations were merged (kept for future caller checks).
  */
 export function mergeChildMutations(parent, child) {
-  if (!child._mutatedThisRun) return false
+  // A child claiming mutations without any touched file is a misbehaving
+  // child (or a bookkeeping bug) — do not propagate an empty mutation claim
+  // to the parent's guard state.
+  if (!child._mutatedThisRun || !(child._touchedFiles?.length)) return false
   parent._mutatedThisRun = true
   for (const abs of child._touchedFiles ?? []) {
     if (!parent._touchedFiles.includes(abs)) parent._touchedFiles.push(abs)
@@ -180,10 +247,7 @@ export function mergeChildMutations(parent, child) {
     parent._verifiedThisRun = false
     parent._verifyPassed = undefined
   }
-  // Fresh code → fresh convergence budget + stale session cleanup.
-  // _advisorRound reset ensures new code gets a full round-1 review;
-  // _advisorSession prevents cross-contamination between reviews.
-  parent._advisorRound = 0
+  // Stale session cleanup only — the round counter survives (see above).
   parent._advisorSession = null
   return true
 }

package/src/agent.mjs

@@ -404,18 +404,18 @@ export async function runAgent(agent, input, callbacks = {}, { depth = 0, signal
         if (toolCall.name === "verify") agent._verifiedThisRun = true
         if (toolCall.name === "advisor") {
           agent._calledAdvisorThisRun = true
-          // Design reviews are a separate gate with no convergence protocol —
-          // they must not consume code-review rounds (MAX_ADVISOR_ROUNDS budget).
+          // All advisor calls (code and design) share the 5-round convergence
+          // budget — each advances _advisorRound toward MAX_ADVISOR_ROUNDS.
           // Always advance the round — the convergence protocol cares about
           // how many reviews have run (round 1→2→3→4→5), not how many succeeded.
           // A failed/interrupted review is still a review attempt and should use
           // the next round's prompt on retry.
           try {
-            const advArgs = JSON.parse(toolCall.arguments || "{}")
-            if (advArgs.type !== "design") agent._advisorRound++
+            JSON.parse(toolCall.arguments || "{}")
           } catch {
-            agent._advisorRound++
+            /* arguments unparseable — still counts as a review attempt */
           }
+          agent._advisorRound++
         }
         if (FILE_MUTATORS.has(toolCall.name)) {
           const args = JSON.parse(toolCall.arguments)

package/src/config.mjs

@@ -43,6 +43,8 @@ const DEFAULTS = {
   agent: {
     maxTurns: 100,
     subagentTurns: 100,
+    subagentModel: null,  // default subagent model: "provider:model" | provider name | model name (parent provider); null = inherit parent provider
+    subagentModels: {},   // per-type override: { explore, plan, coder, "eng-coder" } — priority: subagent tool model arg > this[role] > subagentModel > parent provider
     goalTurns: 200,
     compactThreshold: 100000,
     verifyGuard: false,  // push model back to verify when files were mutated but verify not run (opt-in)
@@ -56,6 +58,7 @@ const DEFAULTS = {
     projectDir: ".thincoder/memory",
     team: null,
   },
+  shell: null,            // bash tool shell executable (e.g. "C:\\Program Files\\Git\\bin\\bash.exe" or "pwsh"); null = system default (cmd on Windows, /bin/sh elsewhere)
   embedding: {
     baseURL: "https://api.siliconflow.cn/v1",
     model: "BAAI/bge-m3",

package/src/prompts/advisor-round1.md

@@ -17,15 +17,21 @@ Budget rules:
 - **Batch everything**: multiple `read` calls in one reply, multiple `grep` calls in one reply. Serializing tool calls wastes your round budget.
 
 Rules:
-- First judge the task from the conversation background: if the changes are clearly non-code (documentation, comments, version bumps, config metadata) and cannot affect runtime behavior, reply immediately with the all-clear phrase — do NOT spend tool calls exploring.
+- First judge the task from the conversation background: if the changes are clearly non-code and cannot affect runtime behavior, reply immediately with the all-clear phrase — `"All clear — no code changes to review."` (the host recognizes it via the "all clear" / "no 🔴" / "review passed" / "no issues found" markers, matched case-insensitively) — do NOT spend tool calls exploring. This applies to static docs, README, and CHANGELOG files. Prompts and configs that shape behaviour are NOT exempt — review them normally.
+- **Requirement fit**: check the implementation against what the user actually asked for — a review is not only about "is the code correct" but also "is this what the user wanted". Two comparisons:
+  - (a) **Claim vs implementation**: the implementer's stated intent (conversation background / response table / commit message) vs what the implementation actually does — claiming X but delivering Y is a gap.
+  - (b) **Expectation vs shape**: explicit user expectations in the background vs the delivered shape — "asked for A, got B" (e.g. "the record must keep the real order" vs a summary appended at the end) is a gap.
+  - **Known limit**: the conversation background only includes the last 3 user–assistant exchanges — older user expectations may not be visible. (a) is the primary check (needs only recent context); (b) is best-effort — check what the background shows, do NOT treat an invisible expectation as a gap.
+  - **Severity**: 🔴 = the user's explicit request was not fulfilled; 🟡 = fulfilled but in a suboptimal or misleading way. Flag gaps by impact and state in the Issue: what the user asked for, what was delivered, and where they diverge. Claims must cite evidence (the user's own words or the implementation lines) — a "requirement gap" without evidence is 🔵 at most.
 - Reply in the same language as the conversation background.
 - Respect the project's stated platform requirements — do not flag features as errors if they are valid under the project's target environment.
 - Output a Markdown table. This table becomes the sole basis for convergence in later rounds — be thorough.
 | # | File | Severity | Issue | Suggestion |
 |---|------|----------|-------|------------|
-| 1 | src/x.mjs | 🔴 | ... | ... |
+| 1 | src/example.mjs | 🔴 | ... | ... |
 - Order by severity: 🔴 Critical · 🟡 Advisory · 🔵 Style.
 - For each issue state: which file, what the problem is, why it is a problem, how to fix it.
 - Cover everything now. Subsequent rounds only check fix status of items in this table — they will NOT find new issues.
 - Stop calling tools once you are ready to produce the review table.
+- **Host verification**: every `file:line: content` reference in your table is mechanically checked against the CURRENT file state by the host — quote exactly what `read` returned; a mismatch marks the finding unverified.
 - **Pass/fail**: if there are NO 🔴 (Critical) issues, the review passes. 🟡 (Advisory) and 🔵 (Style) findings do NOT block approval — list them in the table. If there is ANY 🔴 issue, list it and do not claim the review passed.

package/src/prompts/advisor-round2.md

@@ -1,4 +1,4 @@
-You are a code review advisor.
+You are an independent review advisor.
 Verify the prior issue table (provided in the review context).
 You may note obvious new issues introduced by the fixes.
 You have read-only tools to explore the codebase.
@@ -7,8 +7,8 @@ You have a budget of 30 tool rounds (chat turns). Hard mechanical cap: 100 round
 Review workflow:
 1. The affected files are named in the prior issue table — read them in full. The prior issue table is HISTORY from a previous review, not current state.
 2. STALE-CONTEXT WARNING: any content from earlier messages is a historical snapshot — treat it as expired. Only fresh `read` results describe the current state.
-3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs unless a fix appears to contradict the task itself.
-4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** An empty `git diff` does NOT mean nothing changed: fixes may already be committed (`git log -3` shows recent commits) — `read` the files named in the prior table regardless of the diff. Batch independent tool calls in one reply.
+3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs unless a prior-table item names them or a fix appears to contradict the task itself.
+4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** Fixes may already be committed — `read` the files named in the prior table regardless. (Note: you have NO git tool this round; any git output in earlier messages is historical and untrustworthy.) Batch independent tool calls in one reply.
 5. Use grep or lsp to trace callers, imports, and dependencies — only where genuinely needed.
 6. Produce your review table.
 
@@ -19,7 +19,9 @@ Rules:
 - Primarily check fix status of items in the prior issue table.
 - For items marked "fixed": verify they were actually fixed.
 - For items marked "not an issue": evaluate whether the reasoning is sound.
-- Every "Unfixed" or "New" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may come from the stale prior table. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- Every "Unfixed" or "New" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may be fabricated or stale. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- **Host verification**: your `file:line: content` citations are mechanically checked against the CURRENT file state — quote exactly what `read` returned; a mismatch marks the finding unverified.
+- **Fresh context**: this round's conversation contains NO read output from earlier rounds — every file must be re-read this round.
 - You may flag obvious new problems — but only if clearly visible in the reviewed files and would cause crashes, data loss, or logic errors.
 - Do NOT nitpick style or naming.
 - Output a Markdown table listing all remaining problems (old or new):

package/src/prompts/advisor-round3.md

@@ -1,4 +1,4 @@
-You are a code review advisor.
+You are an independent review advisor.
 Strictly verify only the prior issue table (provided in the review context).
 Do NOT look for new issues.
 You have read-only tools to explore the codebase.
@@ -7,8 +7,8 @@ You have a budget of 30 tool rounds (chat turns). Hard mechanical cap: 100 round
 Review workflow:
 1. The affected files are named in the prior issue table — read them in full. The prior issue table is HISTORY from a previous review, not current state.
 2. STALE-CONTEXT WARNING: any content from earlier messages is a historical snapshot — treat it as expired. Only fresh `read` results describe the current state.
-3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs.
-4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** An empty `git diff` does NOT mean nothing changed: fixes may already be committed (`git log -3` shows recent commits) — `read` the files named in the prior table regardless of the diff. Batch independent tool calls in one reply.
+3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs unless a prior-table item names them or a fix appears to contradict the task itself.
+4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** Fixes may already be committed — `read` the files named in the prior table regardless. (Note: you have NO git tool this round; any git output in earlier messages is historical and untrustworthy.) Batch independent tool calls in one reply.
 5. Verify fix status of each item in the prior issue table.
 6. Produce your review table.
 
@@ -19,7 +19,9 @@ Rules:
 - Only check fix status of items in the prior issue table.
 - For items marked "fixed": verify they were actually fixed.
 - For items marked "not an issue": evaluate whether the reasoning is sound.
-- Every "Unfixed" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may come from the stale prior table. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- Every "Unfixed" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may be fabricated or stale. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- **Host verification**: your `file:line: content` citations are mechanically checked against the CURRENT file state — quote exactly what `read` returned; a mismatch marks the finding unverified.
+- **Fresh context**: this round's conversation contains NO read output from earlier rounds — every file must be re-read this round.
 - Output a Markdown table. Only list items that still have problems:
 | # | Orig# | File | Severity | Status | Notes |
 |---|-------|------|----------|--------|-------|

package/src/prompts/discipline.md

@@ -12,4 +12,4 @@ Debugging strategy:
 - Don't get stuck reading code — write tests, add logs. Trust the runtime over your theories.
 
 Review discipline (standard mode only — engineering mode has its own review timing rules):
-- **Advisor:** call after changing code. Must provide scope: `paths` (files/dirs to review) or `documents` (context). Response table: `| # | Action | Detail |`. Round 2 verifies prior table.
+- **Advisor:** call after changing code. Must provide scope: `paths` (files/dirs to review) or `documents` (context). Response table: `| # | Action | Detail |`. Round 2 verifies the prior issue table + flags obvious new issues; round 3+ strictly verifies only the prior issue table (no new-issue hunting). Max 5 rounds total.

package/src/session.mjs

@@ -282,6 +282,22 @@ export function switchToSlot(cwd, slot) {
   return loadSession(cwd)
 }
 
+/** Delete a slot: remove its file and manifest entry. Deleting the active slot
+ *  resets the manifest active pointer (the next claim re-creates one). */
+export function deleteSlot(cwd, slot) {
+  const n = Number(slot)
+  if (!Number.isInteger(n) || n < 1) return false
+  const m = loadManifest(cwd)
+  if (!m.slots[n]) return false
+  delete m.slots[n]
+  delete m.slotSessions?.[n] // orphan session-id entries bloat the manifest forever
+  try { unlinkSync(slotPath(cwd, n)) } catch { /* missing file is fine */ }
+  if (m.active === n) delete m.active
+  saveManifest(cwd, m)
+  return true
+}
+
+
 // ========== legacy transient prefix cleanup ==========
 
 const LEGACY_TRANSIENT_PREFIXES = [
@@ -297,6 +313,8 @@ function isLegacyTransient(m) {
   )
 }
 
+export { isLegacyTransient }
+
 // ========== core read/write ==========
 
 /** Save agent state and display lines to the active slot file (atomic write) */
@@ -396,6 +414,7 @@ export function applySession(agent, data) {
   // (possibly compacted) machine line. Restore each line from its own source — the machine
   // context keeps its compaction savings across resume. Legacy files without contextHistory
   // fall back to seeding the machine line from the full history (it re-compacts when needed).
+  agent.config ??= {} // ACP test mocks may omit config; be defensive like the ??= below
   const full = Array.isArray(data.history) ? data.history : []
   const machine = Array.isArray(data.contextHistory) ? data.contextHistory : full
   agent._fullHistory = [...full]

package/src/tools/file.mjs

@@ -20,6 +20,19 @@ import { join, relative, dirname } from "node:path";
 const MAX_FILE_READ_BYTES = 10_000_000
 const MAX_IMAGE_BYTES = 15_000_000
 
+// ────────────────────────────────────────
+// Dirty-file tracking (read-before-insert guard)
+// ────────────────────────────────────────
+// insert_after anchors on LINE NUMBERS — the most drift-prone addressing.
+// Every write tool marks the file dirty; insert_after refuses to run on a
+// dirty file until the agent reads it again (fresh line numbers). This turns
+// the "read after edit" discipline into a structural guarantee: a stale
+// after_line can never silently land in the wrong place again.
+const dirtyPaths = new Set()
+export function markDirty(abs) { dirtyPaths.add(abs) }
+export function clearDirty(abs) { dirtyPaths.delete(abs) }
+export function isDirty(abs) { return dirtyPaths.has(abs) }
+
 export const readTool = {
   name: "read",
   description: DESC("read"),
@@ -41,6 +54,8 @@ export const readTool = {
     const st = await stat(abs).catch(() => null)
     if (st && st.size > MAX_FILE_READ_BYTES) throw new Error(`File too large (${Math.round(st.size / 1_000_000)}MB > 10MB limit). Use bash with head/tail or grep for targeted extraction.`)
     const content = normalizeEOL(await readFile(abs, "utf8"))
+    // A read refreshes the agent's view — line numbers are fresh again.
+    clearDirty(abs)
     const lines = content.split("\n")
     const offset = Math.max(1, args.offset ?? 1)
     const limit = Math.min(args.limit ?? MAX_READ_LINES, MAX_READ_LINES)
@@ -129,6 +144,7 @@ export const writeTool = {
     const st = await stat(abs).catch(() => null)
     if (st?.isDirectory()) throw new Error(`Path is a directory: ${args.path}`)
     await writeFile(abs, args.content, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Wrote ${args.content.length} chars to ${args.path}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
@@ -175,6 +191,7 @@ export const editTool = {
       // Functional replacement: avoid $-substitution patterns in new_string (match string / backreference) being expanded
       : content.replace(args.old_string, () => args.new_string)
     await writeFile(abs, updated, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Edited ${args.path}: replaced ${args.replace_all ? occurrences : 1} occurrence(s)${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
@@ -199,6 +216,17 @@ export const insertAfterTool = {
   touchedPaths(args) { return args.path ? [args.path] : [] },
   async execute(args, ctx) {
     const abs = resolveInCwd(ctx, args.path)
+    // Read-before-insert guard: after_line anchors are line numbers, and any
+    // write since the last read made them stale. Refuse instead of silently
+    // inserting at a drifted position (the failure mode that corrupted test
+    // structure repeatedly). after_regex callers get the same gate — a stale
+    // target line is just as wrong, and the rule is simpler to reason about.
+    if (isDirty(abs)) {
+      throw new Error(
+        `${args.path} was modified since your last read — line numbers may be stale.\n` +
+        `Read the file again (read tool) to refresh line numbers, then retry insert_after.`
+      )
+    }
     const text = normalizeEOL(await readFile(abs, "utf8"))
     const lines = text.split("\n")
 
@@ -232,6 +260,7 @@ export const insertAfterTool = {
     lines.splice(targetLine, 0, args.content)
     const updated = lines.join("\n")
     await writeFile(abs, updated, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Inserted after line ${targetLine} in ${args.path}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
@@ -317,6 +346,7 @@ export const hashlineEditTool = {
     lines.splice(pos, target.length, ...newLines)
     const updated = lines.join("\n")
     await writeFile(abs, updated, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Edited ${args.path}: replaced ${target.length} line(s) at L${pos + 1} with ${newLines.length} line(s)${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },

package/src/tools/insert_after.md

@@ -11,3 +11,4 @@ Notes:
 - Use this instead of `edit` when you're adding a new function, import, or block — no need to fabricate surrounding context for exact matching.
 - The inserted content becomes its own line; it's equivalent to `lines.splice(targetLine, 0, content)`.
 - Returns a diff of the change.
+- **Read-before-insert guard**: if the file was modified by any write tool (write/edit/insert_after/hashline_edit/apply_patch/delete) since your last `read`, this tool REFUSES with an error — line numbers may be stale. Read the file again, then retry. This prevents after_line from silently landing at a drifted position.

package/src/tools/patch.mjs

@@ -3,6 +3,7 @@ import {
   autoSyntaxCheck,
   resolveInCwd
 } from "./shared.mjs";
+import { markDirty } from "./file.mjs";
 import { execFileSync } from "node:child_process";
 import { mkdir } from "node:fs/promises";
 import { readFile } from "node:fs/promises";
@@ -150,6 +151,8 @@ export const applyPatchTool = {
       throw renameError
     }
     const summary = planned.map((p) => `  ${p.isNew ? "created " : "modified"} ${p.path}`).join("\n")
+    // Mark every touched file dirty — insert_after must not run on stale line numbers.
+    for (const p of planned) markDirty(p.abs)
     const syntaxChecks = await Promise.all(planned.map(async (p) => {
       const r = await autoSyntaxCheck(p.abs)
       return r ? `${p.path}:${r.replace("Syntax: ", "")}` : ""
@@ -197,6 +200,7 @@ export const deleteTool = {
     }
     if (tracked && !args.force) throw new Error(`"${args.path}" is git-tracked. Set force=true to delete anyway.`)
     await unlink(abs)
+    markDirty(abs)
     return `Deleted ${args.path}`
   },
 }