thincoder 0.12.2 → 0.12.4

package/src/tools/codemode.mjs

@@ -24,14 +24,17 @@
 import { Script, createContext } from "node:vm"
 import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSync } from "node:fs"
 import { join, dirname, relative, resolve } from "node:path"
-import { globToRegex, normalizeEOL, isPrivateHost } from "./shared.mjs"
+import { DESC, globToRegex, normalizeEOL, isPrivateHost } from "./shared.mjs"
 
 const MAX_OUTPUT = 50_000
 const MAX_SCRIPT = 50_000
 const DEFAULT_TIMEOUT = 30_000
 
-/** SSRF-safe fetch: only http/https, private IP rejection, 10s timeout. */
-async function sandboxFetch(url) {
+/** SSRF-safe fetch: only http/https, private IP rejection, 10s timeout.
+ *  Validation throws SYNCHRONOUSLY so the vm sandbox's try/catch can catch it —
+ *  an async throw here would become an unhandled rejection and crash the host process,
+ *  and the rejection message would never reach the model. */
+function sandboxFetch(url) {
   const parsed = new URL(url)
   if (!["http:", "https:"].includes(parsed.protocol)) {
     throw new Error(`CodeMode fetch: protocol not allowed: ${parsed.protocol}`)
@@ -40,6 +43,10 @@ async function sandboxFetch(url) {
   if (isPrivateHost(parsed.hostname)) {
     throw new Error(`CodeMode fetch: private/internal host not allowed: ${parsed.hostname}`)
   }
+  return doFetch(url)
+}
+
+async function doFetch(url) {
   const ctrl = new AbortController()
   const timer = setTimeout(() => ctrl.abort(), 10_000)
   try {
@@ -53,9 +60,7 @@ async function sandboxFetch(url) {
 
 export const codeModeTool = {
   name: "execute",
-  description:
-    "Execute sandboxed JavaScript code. Use this to compose multiple file operations into one call — " +
-    "read, write, glob, grep, and log results. No network or system access. Max 30s timeout, 50KB output.",
+  description: DESC("execute"),
   parameters: {
     type: "object",
     properties: {
@@ -96,6 +101,11 @@ export const codeModeTool = {
       return abs
     }
 
+    // Block dynamic imports: check for import() syntax before execution
+    if (/\bimport\s*\(/.test(code)) {
+      return "Error: dynamic import() is not allowed in CodeMode sandbox. Use the provided readFile/writeFile/glob/grep/fetch functions instead."
+    }
+
     const sandbox = createContext({
       readFile: (p) => {
         const abs = safePath(p)
@@ -149,14 +159,16 @@ export const codeModeTool = {
         }
       },
       fetch: sandboxFetch,
+      // Block process and require access
+      require: () => { throw new Error("require() is not available in CodeMode sandbox") },
+      process: undefined,
     })
 
     try {
-      const script = new Script(code, {
-        filename: "codemode.js",
-        timeout: timeoutMs,
-      })
-      script.runInContext(sandbox)
+      const script = new Script(code, { filename: "codemode.js" })
+      // timeout belongs on runInContext — the Script constructor ignores it,
+      // so passing it there let runaway scripts (while(true)) hang the process forever.
+      script.runInContext(sandbox, { timeout: timeoutMs })
       return output.join("\n") || "(no output)"
     } catch (err) {
       const out = output.join("\n")

package/src/tools/delete.md

@@ -2,6 +2,7 @@ Delete a file. Use when the agent created a temporary or junk file that should b
 
 Parameters:
 - path (required): File path, relative to cwd or absolute
+- force: Allow deleting git-tracked files (default false)
 
 Notes:
 - Untracked or non-git files are deleted immediately

package/src/tools/edit.md

@@ -15,6 +15,6 @@ Parameters:
 - replace_all: Replace all occurrences instead of just one (default false)
 
 Notes:
-- Prefer this over write for targeted edits — it's safer and keeps diffs small
+- Prefer this over write for targeted edits — it's safer and keeps changes targeted
 - If old_string matches zero times: error. If it matches multiple times without replace_all: error — add more surrounding context to make it unique
 - Never fabricate the old_string — copy it verbatim from the actual file using read first

package/src/tools/execute.md

@@ -0,0 +1,5 @@
+Execute sandboxed JavaScript code. Use this to compose multiple file operations into one call — read, write, glob, grep, and log results. No network or system access. Max 30s timeout, 50KB output.
+
+Parameters:
+- code (required): JavaScript code to execute in the sandbox. Use provided functions: readFile(path), writeFile(path, content), glob(pattern), grep(pattern, file), log(...args).
+- timeoutMs: Timeout in milliseconds (default 30000, max 60000)

package/src/tools/file.mjs

@@ -122,6 +122,7 @@ export const writeTool = {
     required: ["path", "content"],
   },
   readonly: false,
+  touchedPaths(args) { return args.path ? [args.path] : [] },
   async execute(args, ctx) {
     const abs = resolveInCwd(ctx, args.path)
     await mkdir(dirname(abs), { recursive: true })
@@ -149,6 +150,7 @@ export const editTool = {
     required: ["path", "old_string", "new_string"],
   },
   readonly: false,
+  touchedPaths(args) { return args.path ? [args.path] : [] },
   async execute(args, ctx) {
     const abs = resolveInCwd(ctx, args.path)
     if (!args.old_string) {
@@ -194,6 +196,7 @@ export const insertAfterTool = {
     required: ["path", "content"],
   },
   readonly: false,
+  touchedPaths(args) { return args.path ? [args.path] : [] },
   async execute(args, ctx) {
     const abs = resolveInCwd(ctx, args.path)
     const text = normalizeEOL(await readFile(abs, "utf8"))
@@ -257,6 +260,7 @@ export const hashlineEditTool = {
     required: ["path", "old_hashes", "new_content"],
   },
   readonly: false,
+  touchedPaths(args) { return args.path ? [args.path] : [] },
   async execute(args, ctx) {
     const abs = resolveInCwd(ctx, args.path)
     if (!args.old_hashes?.length) throw new Error("old_hashes must not be empty — read the file with hashes=true to get line hashes")

package/src/tools/git.md

@@ -0,0 +1,15 @@
+Run a git command. Use this to see uncommitted changes, staged changes, diff against a ref, recent commits, or manage checkpoints. Only works inside a git repository.
+- action='diff': Show unified diff — what changed since last commit. Set staged=true for staged-only diff, ref=<ref> to compare against a specific commit/branch, path=<dir> to scope to a file or directory.
+- action='status': Show working tree state — staged, unstaged, untracked files, and conflicts. Returns categorized lists.
+- action='log': Show recent commit history. Set count to limit, oneline=true for compact format, path=<file> to see history of one file.
+- action='checkpoint': Manage git-based snapshots. Use checkpointAction to choose: list (overview), create (snapshot now), rewind (restore snapshot by id), cat (read a file from a snapshot).
+
+Parameters:
+- action (required): diff / status / log / checkpoint
+- staged: (diff) Show staged changes instead of working tree
+- path: (diff/log/checkpoint:cat/checkpoint:rewind) File or directory to scope to
+- ref: (diff) Compare against this ref (default HEAD)
+- count: (log) Number of commits (default 10)
+- oneline: (log) One-line-per-commit format
+- checkpointAction: (checkpoint) list snapshots / create one / restore by id / read file from snapshot
+- checkpointId: (checkpoint) Snapshot id — required for rewind and cat; optional for list (shows file tree)

package/src/tools/git.mjs

@@ -9,12 +9,7 @@ import { join } from "node:path";
 
 export const gitTool = {
   name: "git",
-  description:
-    "Run a git command. Use this to see uncommitted changes, staged changes, diff against a ref, recent commits, or manage checkpoints. Only works inside a git repository.\n" +
-    "- action='diff': Show unified diff — what changed since last commit. Set staged=true for staged-only diff, ref=<ref> to compare against a specific commit/branch, path=<dir> to scope to a file or directory.\n" +
-    "- action='status': Show working tree state — staged, unstaged, untracked files, and conflicts. Returns categorized lists.\n" +
-    "- action='log': Show recent commit history. Set count to limit, oneline=true for compact format, path=<file> to see history of one file.\n" +
-    "- action='checkpoint': Manage git-based snapshots. Use checkpointAction to choose: list (overview), create (snapshot now), rewind (restore snapshot by id), cat (read a file from a snapshot).",
+  description: DESC("git"),
   parameters: {
     type: "object",
     properties: {

package/src/tools/lint.md

@@ -0,0 +1,8 @@
+Run the appropriate linter/checker for a file. Auto-detects based on file extension and project config.
+Without 'full', runs a fast node --check (JS/TS syntax only, catches parse errors in milliseconds).
+With 'full', runs the language-aware cascade: eslint → tsc –noEmit → node --check (JS/TS/TSX); ruff (Python); cargo check (Rust); go vet (Go).
+Use the fast default after every write/edit; use 'full' before declaring a task complete.
+
+Parameters:
+- path: File to check (default: most recently modified file)
+- full: Run the full language-aware cascade instead of just node --check (default false)

package/src/tools/linter.mjs

@@ -5,11 +5,7 @@ import { join, relative } from "node:path"
 
 export const lintTool = {
   name: "lint",
-  description:
-    "Run the appropriate linter/checker for a file. Auto-detects based on file extension and project config.\n" +
-    "Without 'full', runs a fast node --check (JS/TS syntax only, catches parse errors in milliseconds).\n" +
-    "With 'full', runs the language-aware cascade: eslint → tsc –noEmit → node --check (JS/TS/TSX); ruff (Python); cargo check (Rust); go vet (Go).\n" +
-    "Use the fast default after every write/edit; use 'full' before declaring a task complete.",
+  description: DESC("lint"),
   parameters: {
     type: "object",
     properties: {

package/src/tools/lsp.md

@@ -0,0 +1,7 @@
+LSP code intelligence: go to definition, find references, hover info, document symbols, diagnostics. Use this to understand code structure without grep-guessing function locations or type shapes.
+
+Parameters:
+- subcommand (required): LSP operation — "definition" | "references" | "hover" | "symbols" | "diagnostics"
+- uri (required): Target file path (relative to project root)
+- line: 1-based line number (for definition/references/hover)
+- character: 1-based character offset (for definition/references/hover)

package/src/tools/lsp.mjs

@@ -17,6 +17,7 @@
 import { spawn } from "node:child_process"
 import { existsSync, readFileSync } from "node:fs"
 import { join, extname } from "node:path"
+import { DESC } from "./shared.mjs"
 
 // ---- JSON-RPC transport over stdio ----
 
@@ -184,9 +185,7 @@ async function ensureOpen(proc, uri, ext) {
 
 export const lspTool = {
   name: "lsp",
-  description:
-    "LSP code intelligence: go to definition, find references, hover info, document symbols, diagnostics. " +
-    "Use this to understand code structure without grep-guessing function locations or type shapes.",
+  description: DESC("lsp"),
   parameters: {
     type: "object",
     properties: {
@@ -240,7 +239,7 @@ export const lspTool = {
             textDocument: { uri },
             position: { line: args.line - 1, character: args.character - 1 },
           }, 10)
-          if (!res?.result) return "No definition found."
+          if (!res?.result) return "(no definition found)"
           const locs = Array.isArray(res.result) ? res.result : [res.result]
           return locs.map((l) => {
             const path = l.uri.replace(/^file:\/\/\//, "").replace(/%3A/, ":")
@@ -255,7 +254,7 @@ export const lspTool = {
             position: { line: args.line - 1, character: args.character - 1 },
             context: { includeDeclaration: false },
           }, 10)
-          if (!res?.result?.length) return "No references found."
+          if (!res?.result?.length) return "(no references found)"
           return res.result.slice(0, 50).map((l) => {
             const path = l.uri.replace(/^file:\/\/\//, "").replace(/%3A/, ":")
             return `${path}:${l.range.start.line + 1}:${l.range.start.character + 1}`
@@ -268,7 +267,7 @@ export const lspTool = {
             textDocument: { uri },
             position: { line: args.line - 1, character: args.character - 1 },
           }, 10)
-          if (!res?.result?.contents) return "No hover info available."
+          if (!res?.result?.contents) return "(no hover info)"
           const contents = res.result.contents
           if (typeof contents === "string") return contents
           if (Array.isArray(contents)) return contents.map((c) => typeof c === "string" ? c : c.value).join("\n")
@@ -280,7 +279,7 @@ export const lspTool = {
           const res = await request(proc, "textDocument/documentSymbol", {
             textDocument: { uri },
           }, 10)
-          if (!res?.result?.length) return "No symbols found."
+          if (!res?.result?.length) return "(no symbols found)"
           function render(nodes, depth) {
             const lines = []
             for (const n of nodes) {
@@ -295,7 +294,7 @@ export const lspTool = {
 
         case "diagnostics": {
           const diags = proc._diagnostics?.[uri]
-          if (!diags?.length) return "No diagnostics."
+          if (!diags?.length) return "(no diagnostics)"
           return diags.slice(0, 30).map((d) => {
             const sev = { 1: "ERROR", 2: "WARN", 3: "INFO", 4: "HINT" }[d.severity] || "?"
             return `L${d.range.start.line + 1}: ${sev}: ${d.message}${d.code ? ` [${d.code}]` : ""}`
@@ -306,7 +305,7 @@ export const lspTool = {
           return `Unknown subcommand: ${args.subcommand}`
       }
     } catch (err) {
-      return `LSP error: ${err.message}`
+      return `lsp error: ${err.message}`
     }
   },
 }

package/src/tools/patch.mjs

@@ -159,36 +159,7 @@ export const applyPatchTool = {
   },
 }
 
-// ---------------------------------------------------------------- syntax_check
 
-export const syntaxCheckTool = {
-  name: "syntax_check",
-  description: DESC("syntax_check"),
-  parameters: {
-    type: "object",
-    properties: {
-      path: { type: "string", description: "File path (.js/.mjs/.cjs only)" },
-    },
-    required: ["path"],
-  },
-  readonly: true,
-  execute(args, ctx) {
-    const abs = resolveInCwd(ctx, args.path)
-    if (!/\.(?:[mc]?js)$/.test(abs)) {
-      return `syntax_check only supports .js/.mjs/.cjs files; ${args.path} skipped.`
-    }
-    try {
-      execFileSync(process.execPath, ["--check", abs], {
-        cwd: ctx.cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"],
-      })
-      return `Syntax OK: ${args.path}`
-    } catch (e) {
-      // node --check writes errors to stderr
-      const msg = (e.stderr || e.stdout || e.message || "").trim()
-      return `Syntax error in ${args.path}:\n${msg || "(unknown)"}`
-    }
-  },
-}
 
 // ---------------------------------------------------------------- bash
 
@@ -204,6 +175,7 @@ export const deleteTool = {
     required: ["path"],
   },
   readonly: false,
+  touchedPaths(args) { return args.path ? [args.path] : [] },
   async execute(args, ctx) {
     const abs = resolveInCwd(ctx, args.path)
     let s

package/src/tools/read_image.md

@@ -1,3 +1,7 @@
 Read an image file and return it as multimodal content visible to the model. Use this to view screenshots, UI mockups, diagrams, or any visual content. The model only sees images through this tool — it cannot "see" files directly. Supports png, jpg, gif, webp, bmp, svg. The image is base64-encoded and included in the response. Large images (>20MB) are rejected.
 
-Note: this tool only works with models that support vision/image input (Kimi K3, Qwen3.7, MiniMax M3). Pure text models (DeepSeek V4, GLM-5) will receive an error.
+Parameters:
+- path (required): Path to image file (relative to cwd or absolute). Supports png, jpg, gif, webp, bmp, svg.
+
+Notes:
+- This tool only works with models that support vision/image input (Kimi K3, Qwen3.7, MiniMax M3). Pure text models (DeepSeek V4, GLM-5) will receive an error.

package/src/tools/system.mjs

@@ -378,7 +378,7 @@ export const lsTool = {
       }),
     )
     rows.sort((a, b) => (a.dir === b.dir ? a.name.localeCompare(b.name) : a.dir ? -1 : 1))
-    if (rows.length === 0) return "(empty directory)"
+    if (rows.length === 0) return "(no entries)"
     const out = rows.map((r) => `${r.dir ? "d" : "-"}  ${r.name.padEnd(40)} ${String(r.size).padStart(10)}  ${r.mtime}`)
     return truncate(out.join("\n"))
   },

package/src/tools/web.mjs

@@ -77,12 +77,12 @@ export const websearchTool = {
       const engine = ENGINES.find(e => e.name === args.engine)
       if (!engine) return `Unknown engine '${args.engine}'. Available: ${ENGINE_NAMES.join(", ")}`
       const fetched = await fetchEngine(engine, args.query, page, ctx)
-      if (!fetched || fetched.results.length === 0) return `(no results from ${engine.label})`
-      return truncate(fetched.results.slice(0, limit).map((r, i) => `${i + 1}. ${r.title}\n   ${r.href}\n   ${r.snippet}`).join("\n\n"))
+      if (!fetched || fetched.results.length === 0) return "(no results)"
+      return truncate(fetched.results.slice(0, limit).map((r, i) => `${i + 1}. [${engine.label}] ${r.title}\n   ${r.href}\n   ${r.snippet}`).join("\n\n"))
     }
     const promises = ENGINES.map(e => fetchEngine(e, args.query, 1, ctx))
     const fetched = (await Promise.all(promises)).filter(Boolean)
-    if (fetched.length === 0) return "(no results — all search engines failed)"
+    if (fetched.length === 0) return "(no results)"
     const merged = [], indexes = fetched.map(() => 0)
     let done = false
     while (!done && merged.length < limit) {