thincoder 0.12.37 → 0.12.39

package/src/context.mjs

@@ -48,13 +48,14 @@ function keepTailSize(provider, historyLen) {
   return Math.min(Math.max(10, Math.floor((ctxWindow / 100_000) * 30)), Math.floor(historyLen * 0.4))
 }
 
-const SUMMARIZE_PROMPT = `You are a conversation compressor. Summarize the following agent work log into a compact summary for use as context in the ongoing conversation.
+export const SUMMARIZE_PROMPT = `You are a conversation compressor. Summarize the following agent work log into a compact summary for use as context in the ongoing conversation.
 Requirements:
 - Write in first person, present tense — these are "my" handover notes, continuing my own train of thought
 - Most important: preserve design decisions and their reasons — architecture choices, API contracts, naming conventions, trade-off rationale. These are the anchors the subsequent code must not deviate from
 - Distinguish COMPLETED vs IN-PROGRESS work: completed tasks get a ONE-LINE recap each (what was done, key outcome); spend the detail budget on unresolved issues, next steps, and the CURRENT task
 - The user's most recent request defines the current task — anchor on it. Earlier requests are likely already completed and only need the one-line recap; do NOT preserve them at full fidelity
-- Keep: files modified and why, unresolved issues, next steps
+- Explicitly list FILES CHANGED: every modified file path plus a one-line "why" — so post-compaction work can re-locate what was edited and where
+- Explicitly list UNRESOLVED ISSUES / TODOs: anything still open plus the next steps — so post-compaction recovery knows where to resume
 - Drop: pleasantries, repetition, fine-grained tool output details
 - Honestly mark uncertain items: anything not actually verified must say "unverified"; do not present guesses as facts
 - Use bullet-point output; aim for information completeness, not a hard word limit (old 500-char cap is deprecated; in a 1M-context era, err on the long side)
@@ -152,6 +153,15 @@ function applyCompression(agent, headEnd, tailStart, note) {
     { role: "assistant", content: "Understood. I'll continue from these notes, re-verifying anything transient." },
     ...tail,
   ]
+  // Compaction REBUILDS the machine line (head + note + "Understood" + tail), so the pre-compaction
+  // _runStartHistoryLen index is stale — a longer array shrank beneath it, and end-of-run exploration
+  // distillation would then silently skip or slice from the wrong offset. Reset the boundary to the
+  // verbatim tail start (head.length + 2: the note and the "Understood" placeholder sit between head
+  // and tail). Exploration before the tail was already covered by the compaction summary, so only the
+  // still-raw tail needs distilling. `head` is empty today (KEEP_HEAD = 0) — the formula stays
+  // correct if KEEP_HEAD ever grows. (shrinkOversized only truncates message bodies in place and
+  // leaves the array length unchanged, so this boundary stays valid there — no reset needed.)
+  agent._runStartHistoryLen = head.length + 2
   // Measured token baseline is invalidated along with old history (prompt_tokens were for pre-compaction context), fall back to estimation until next response
   agent._lastPromptTokens = null
   agent._usageAtLen = null
@@ -281,3 +291,139 @@ function shrinkOversized(agent, limit = OVERSIZE_CONTENT_LIMIT) {
   }
   return shrunk
 }
+
+// ─── End-of-run exploration distillation (AGENT-LOOP §13 + CONTEXT-COMPACTION §5, 2026-08-23) ───
+// The main agent's machine line is flooded by inline step-by-step exploration (read/grep/...).
+// At run end we distill THIS run's exploration tool-results into one semantic summary note that
+// replaces them in the machine line, while agent._fullHistory (the human line) stays untouched.
+
+/** Read-only knowledge tools counted as "exploration" (execute writes files → never exploration). */
+export const EXPLORE_TOOLS = new Set([
+  "read", "grep", "glob", "ls", "code_search", "doc_search", "repo_outline",
+])
+
+/** Summary prompt for turning a burst of exploration results into a semantic summary. */
+export const EXPLORE_SUMMARY_PROMPT = `You are distilling exploration tool results. Summarize the following read-only codebase exploration into a compact semantic summary for the main agent's own context.
+
+Requirements:
+- Capture WHAT was discovered, WHERE (which files / directories / symbols), and the KEY CONCLUSIONS — do not list tool calls mechanically
+- Keep actionable facts the main agent needs to continue: code locations, function names, file paths, structure, and open questions the exploration raised
+- Drop raw tool-output noise, repeated lines, and verbatim file dumps — keep only what must be remembered
+- Be honest: mark anything not actually verified as "unverified"; do not present guesses as facts
+- Use bullet points; aim for information completeness, not a hard word limit
+
+Exploration log:
+`
+
+/** tool_calls name across both stored shapes ({function:{name}} and flat {name}). */
+function toolCallName(tc) {
+  return tc?.function?.name ?? tc?.name ?? ""
+}
+
+/** Tool that produced a tool-result message (falls back to its owner assistant's tool_call). */
+function toolResultName(msg, ownerToolCalls) {
+  if (typeof msg?.name === "string" && msg.name) return msg.name
+  const owner = (ownerToolCalls ?? []).find((tc) => tc.id === msg?.tool_call_id)
+  return owner ? toolCallName(owner) : ""
+}
+
+/**
+ * Find the pure-exploration "assistant(tool_calls)→tool…" pair blocks added since `start`.
+ * A block is explorable only when EVERY tool call AND every tool result in it is an exploration
+ * tool — mixed blocks (read + edit in one turn) stay untouched, or we'd orphan the edit pairing.
+ */
+function findExplorationBlocks(history, start) {
+  const blocks = []
+  let i = start
+  while (i < history.length) {
+    const m = history[i]
+    if (m?.role === "assistant" && Array.isArray(m.tool_calls) && m.tool_calls.length > 0) {
+      let j = i + 1
+      while (j < history.length && history[j]?.role === "tool") j++
+      const toolMsgs = history.slice(i + 1, j)
+      const allCallsExplore = m.tool_calls.every((tc) => EXPLORE_TOOLS.has(toolCallName(tc)))
+      const allResultsExplore = toolMsgs.length > 0 && toolMsgs.every((t) => EXPLORE_TOOLS.has(toolResultName(t, m.tool_calls)))
+      if (allCallsExplore && allResultsExplore) {
+        blocks.push({ start: i, end: j, messages: history.slice(i, j), toolCount: toolMsgs.length })
+      }
+      i = j
+    } else {
+      i++
+    }
+  }
+  return blocks
+}
+
+/** Serialize a batch of exploration messages for the summary LLM (same shape as compaction serialization). */
+function serializeExplorationMessages(messages) {
+  const cap = 8000 // exploration results ARE the signal to distill — generous cap (quality-first, N1)
+  return messages
+    .map((m) => {
+      const toolNote = m.tool_calls ? ` [called tools: ${m.tool_calls.map(toolCallName).join(", ")}]` : ""
+      let text = ""
+      if (typeof m.content === "string") text = m.content
+      else if (Array.isArray(m.content)) text = m.content.filter((p) => p?.type === "text").map((p) => p.text ?? "").join(" ")
+      return `[${m.role}]${toolNote} ${text.slice(0, cap)}`
+    })
+    .join("\n")
+}
+
+/**
+ * Core (shared) distillation: replace this run's pure-exploration pair blocks with a single
+ * "[Exploration summary]" note placed where the first block was. Returns a NEW history array,
+ * or null when there is nothing to shrink (<3 exploration results / LLM failure). Pairing-safe:
+ * whole assistant→tool blocks are removed, so no orphan tool_calls/tool can survive.
+ */
+async function distillExplorations(history, start, provider, signal) {
+  if (!Array.isArray(history) || history.length - start < 2) return null
+  const blocks = findExplorationBlocks(history, start)
+  const resultCount = blocks.reduce((n, b) => n + b.toolCount, 0)
+  if (resultCount < 3) return null
+
+  const serialized = blocks.map((b) => serializeExplorationMessages(b.messages)).join("\n")
+
+  let summary
+  try {
+    // Silent by design (D11): thinking:null and no onToken/onReasoning — this internal
+    // distillation must not stream to the frontend. signal propagates user cancellation.
+    const resp = await chat({ ...provider, thinking: null, reasoningEffort: null }, {
+      messages: [{ role: "user", content: EXPLORE_SUMMARY_PROMPT + serialized }],
+      signal,
+    })
+    summary = resp?.content
+  } catch {
+    return null // N3: never block the run's return or lose history — original results stay
+  }
+  if (!summary) return null
+
+  const drop = new Set()
+  for (const b of blocks) for (let k = b.start; k < b.end; k++) drop.add(k)
+  const note = { role: "user", content: "[Exploration summary]\n" + summary }
+  const next = []
+  let inserted = false
+  for (let k = 0; k < history.length; k++) {
+    if (drop.has(k)) {
+      if (!inserted) { next.push(note); inserted = true }
+      continue
+    }
+    next.push(history[k])
+  }
+  return next
+}
+
+/**
+ * End-of-run exploration distillation (runAgent's final return). Shrinks the MACHINE line
+ * (agent.history) only; agent._fullHistory is never touched. Triggers when this run added ≥3
+ * exploration tool results; on LLM failure it silently keeps the original history (N3).
+ * `callbacks` is accepted for call-site parity with the other lifecycle hooks — the distillation
+ * is silent by design and never streams (D11).
+ */
+export async function summarizeRunExplorations(agent, callbacks, signal) {
+  const next = await distillExplorations(agent.history, agent._runStartHistoryLen ?? 0, agent.provider, signal)
+  if (!next) return
+  agent.history = next
+  // The machine line changed shape — the measured token baseline was for the pre-shrink context.
+  // Invalidate so the next compaction check re-estimates instead of over-counting stale history.
+  agent._lastPromptTokens = null
+  agent._usageAtLen = null
+}

package/src/prompts/discipline.md

@@ -1,10 +1,14 @@
 Workflow — match the process to the task:
-- Complex (3+ steps, new features): Requirements → Design → Development → Testing. Write a design doc. Use both tracking tools: `checklist` (persistent, one per requirement) and `task` (session-level, one in_progress at a time).
-- Medium (2-3 steps, refactoring): plan briefly, no design doc needed. Use `task` tool.
-- Small (typo, one-line fix): confirm understanding, change, verify. No design doc.
+- Read the relevant docs before changing code — at ANY tier: doc_search the topic, then locate the owning design doc via docs/design/README.md (the document map) and read it — plus AGENTS.md if present.
+- Use `task` to track work for EVERY tier — one item in_progress at a time.
+- Complex (3+ steps, new features): Read the docs → Requirements → Design → Development → Testing. Write a design doc. Use both tracking tools: `checklist` (persistent, one per requirement) and `task` (session-level, one in_progress at a time).
+- Medium (2-3 steps, refactoring): Read the docs → Plan → Change → update the owning doc if you spotted a gap — a decision not yet recorded, or a doc now contradicting the code. No design doc needed. Use `task` tool.
+- Small (typo, one-line fix): Read the docs → Change → Verify → update the owning doc if you spotted a gap — a decision not yet recorded, or a doc now contradicting the code. Use `task` tool. No design doc.
 - If unsure which tier, treat as complex. Under-planning costs more than over-planning.
+- Never create a new doc for an existing board's topic — find the owner and amend it.
 
 Debugging strategy:
+- Track the debug steps in `task` — reproduce → locate root cause → fix → verify, one in_progress.
 - Read the full error output — root cause is often at the end.
 - Verify against official docs before guessing.
 - Binary search: cut the problem in half, test which half has the fault.
@@ -24,4 +28,4 @@ Review discipline (standard mode only — engineering mode has its own review ti
 - **No "pre-existing" cop-out.** You own the whole code. "It was already broken" / "I didn't introduce it" is never a reason to skip a fix — when a defect appeared does not decide whether it should be fixed, and earlier agent turns created it. Rebut only on technical grounds, otherwise fix it.
 - **Do not bury 🔴.** A 🔴 you neither fix nor rebut blocks convergence. `Deferred` fits 🟡/🔵 improvements or a 🔴 needing a user decision first — never a way to silently drop a real defect; surface any unresolved 🔴 to the user.
 - Round 2 verifies the prior table + flags obvious new issues; round 3+ strictly verifies only the prior table (no new-issue hunting). Max 5 rounds total.
-- When the advisor reports all clear (no 🔴 remaining), run `verify`.
+- When the advisor reports all clear (no 🔴 remaining), run `verify`.

package/src/prompts/main.md

@@ -9,11 +9,13 @@ Explore the codebase read-only, design the architecture, present the plan. When
 For tasks that match the Coding discipline's "complex" tier, plan mode is your design step; for "medium" tasks it's optional but recommended.
 
 Delegate well — spawn subagents for independent subtasks.
+- Subagents run in an isolated context: their step-by-step read/grep never enters your history — only their final report comes back. Doing the same broad exploration inline floods your own window with noise and degrades your attention across turns.
 - Explore agents for parallel codebase search, plan agents for architecture design, coder agents for self-contained implementation.
 - When delegating an explore agent, state the thoroughness in the task description — quick / medium / thorough — graded by need; unspecified means the default.
-- Delegate breadth-first exploration; do precision edits yourself.
+- Breadth-first exploration — understanding that spans multiple files / directories (finding usages, mapping structure, reading a batch of files) — goes to an `explore` subagent, with thoroughness (quick / medium / thorough) annotated in the task.
+- Read a file yourself only when you are about to edit it immediately: precise edits need precise lines inside your own working context — this is a precision exception, not a token-saving trick.
 - Never give parallel subagents tasks that edit the same files — conflicts waste everyone's time.
-- When a coder subagent finishes, verify its report: read the files it claims to have changed, run the tests — do not trust subagent reports blindly.
+- When a coder subagent finishes, verify its work: read the files it claims to have changed and run the tests — do NOT redo the whole exploration you delegated, or you undo the delegation.
 - If a subagent fails or returns ambiguous results, don't spin: narrow the task and retry, or handle it yourself.
 - Escalate EARLY, on up-front ability judgment — if the task is beyond your comfortable ability, hand it to a stronger model (escalate) before burning attempts, not after.
 - When multiple subagent reports conflict, read the relevant code yourself to arbitrate — never merge conflicting claims.

package/src/tools/bash.md

@@ -11,6 +11,7 @@ Execute a shell command and return stdout+stderr. Use for running commands, buil
 Parameters:
 - command (required): Shell command to execute
 - timeout: Timeout in milliseconds (default 120000, max ~300000)
+- filter: Optional — a regex; only output lines matching it are returned (case-insensitive). Use instead of hand-writing a pipe into `findstr`/`grep`.
 
 Output format:
 ```

package/src/tools/codemode.mjs

@@ -1,65 +1,123 @@
 /**
  * tools/codemode.mjs — CodeMode: JavaScript execution tool
  *
- * Gives the model an `execute` tool backed by Node.js vm.Script.runInNewContext.
- * Multiple tool calls can be composed into a single script, reducing API round-trips
- * and keeping large intermediate results out of context.
+ * Gives the model an `execute` tool that runs JS in a child `node
+ * --input-type=module --eval` process — NOT the in-process vm sandbox it used
+ * to be. The vm route could not support dynamic `import()` (needs the
+ * --experimental-vm-modules flag) or await it, which pushed every real JS run
+ * back to `bash node -e`. A child node process gives top-level await, dynamic
+ * `import()` of the project's own .mjs modules, native `console`/`fetch`, AND a
+ * killable timeout (an in-process infinite loop would freeze the CLI; a child
+ * process is killed like bash).
  *
- * Sandbox API:
- *   readFile(path)      — read a file relative to cwd, return string
- *   writeFile(path, c)  — write content to a file (auto-creates parent dirs)
- *   glob(pattern)        — return array of matching paths
- *   grep(pattern, file)  — return array of matching lines
- *   log(...args)         — append to output buffer
- *   fetch(url)           — HTTP GET, return string
+ * The child `import()`-s exec-prelude.mjs first for readFile/writeFile/glob/grep/
+ * log/require (paths confined to the workspace root). Full Node via require()/
+ * process/import() is available — same boundary as bash, no fake sandbox.
  *
- * Full Node access via require()/process — no fake sandbox. The bash tool can
- * already reach any Node API, so blocking require here only misled the model
- * about its real capability boundary (project philosophy: no command-level
- * sandbox; transparency + trust + audit).
- *
- * Limits (engineering guards, not security):
- *   timeout: 30s (configurable via timeoutMs param)
- *   maxOutput: 50000 bytes
- *   maxScriptSize: 50000 bytes
- *   file paths confined to cwd (accidental out-of-workspace writes)
+ * Parameters:
+ *   code       — JS to run (top-level await and import() supported)
+ *   workdir    — run in this sub-directory (confined to the workspace)
+ *   filter     — return only output lines matching this regex (case-insensitive)
+ *   timeoutMs  — timeout (default 30s, max 60s)
  */
+import { spawn } from "node:child_process"
+import { dirname, resolve, relative, isAbsolute, sep } from "node:path"
+import { fileURLToPath, pathToFileURL } from "node:url"
+import { DESC } from "./shared.mjs"
 
-import { Script, createContext } from "node:vm"
-import { createRequire } from "node:module"
-import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSync } from "node:fs"
-import { join, dirname, relative, resolve } from "node:path"
-import { DESC, globToRegex, normalizeEOL } from "./shared.mjs"
-
-const MAX_OUTPUT = 50_000
 const MAX_SCRIPT = 50_000
+const MAX_OUTPUT = 50_000
 const DEFAULT_TIMEOUT = 30_000
 
-/** fetch: only http/https (protocol guard kept; no private-host rejection — the
- *  bash tool can reach anything anyway, so the SSRF check was a fake boundary).
- *  Validation throws SYNCHRONOUSLY so the vm sandbox's try/catch can catch it —
- *  an async throw here would become an unhandled rejection and crash the host process,
- *  and the rejection message would never reach the model. */
-function sandboxFetch(url) {
-  const parsed = new URL(url)
-  if (!["http:", "https:"].includes(parsed.protocol)) {
-    throw new Error(`CodeMode fetch: protocol not allowed: ${parsed.protocol}`)
-  }
-  return doFetch(url)
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const PRELUDE_URL = pathToFileURL(resolve(__dirname, "exec-prelude.mjs")).href
+
+/** True when `abs` is inside `root` (handles `..` and cross-drive, which
+ *  relative() returns as an absolute path on Windows). */
+function isInside(root, abs) {
+  const rel = relative(root, abs)
+  if (isAbsolute(rel)) return false
+  return rel !== ".." && !rel.startsWith(".." + sep)
+}
+
+/** Resolve workdir relative to cwd, asserting it stays within the workspace. */
+function resolveBaseDir(cwd, workdir) {
+  if (!workdir || typeof workdir !== "string") return cwd
+  const abs = resolve(cwd, workdir)
+  if (!isInside(cwd, abs)) throw new Error(`workdir escapes the workspace: ${workdir}`)
+  return abs
 }
 
-async function doFetch(url) {
-  const ctrl = new AbortController()
-  const timer = setTimeout(() => ctrl.abort(), 10_000)
+/** Keep only output lines matching a regex (execute filter, case-insensitive). */
+function applyFilter(output, filter) {
   try {
-    const res = await fetch(url, { signal: ctrl.signal })
-    const text = await res.text()
-    return text.slice(0, 100_000)
-  } finally {
-    clearTimeout(timer)
+    const re = new RegExp(filter, "i")
+    const lines = output.split("\n").filter((l) => re.test(l))
+    return lines.length ? lines.join("\n") : `(no output lines matched filter "${filter}")`
+  } catch (e) {
+    return `Error: filter regex invalid: ${e.message}`
   }
 }
 
+/** Spawn node, run code + prelude, capture stdout/stderr, enforce timeout/abort.
+ *  Resolves { text, ok } — ok=false on non-zero exit / timeout / abort. */
+function runNodeEval(code, baseDir, root, timeoutMs, signal) {
+  return new Promise((resolvePromise) => {
+    const src = `await import(${JSON.stringify(PRELUDE_URL)});\n${code}`
+    const child = spawn(process.execPath, ["--input-type=module", "--eval", src], {
+      cwd: baseDir,
+      env: { ...process.env, THINCODER_EXEC_ROOT: root },
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+    })
+
+    let outBuf = "", errBuf = "", truncated = false, settled = false, mode = null
+    let timer = null, kickTimer = null
+
+    const settle = (text, ok) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      clearTimeout(kickTimer)
+      if (signal) signal.removeEventListener("abort", onAbort)
+      resolvePromise({ text, ok })
+    }
+    // SIGKILL (not SIGTERM) so a signal-trapping script can't dodge the watchdog.
+    const kill = () => { try { child.kill("SIGKILL") } catch { /* already gone */ } }
+    // After kill, wait for "close" (child fully reaped) before settling — settling
+    // early races the caller deleting the cwd dir while the child still holds it.
+    const armKick = () => { kickTimer = setTimeout(() => settle(mode === "abort" ? "(stopped)" : `Error: script timed out after ${timeoutMs}ms`, false), 3000) }
+    const onAbort = () => { if (mode) return; mode = "abort"; kill(); armKick() }
+
+    timer = setTimeout(() => { if (!mode) { mode = "timeout"; kill(); armKick() } }, timeoutMs)
+
+    if (signal) {
+      if (signal.aborted) onAbort()
+      else signal.addEventListener("abort", onAbort, { once: true })
+    }
+
+    const cap = (buf, d) => {
+      if (buf.length < MAX_OUTPUT) return buf + d
+      if (!truncated) { truncated = true; return buf + "\n...[output truncated]" }
+      return buf
+    }
+    child.stdout.on("data", (d) => { outBuf = cap(outBuf, d.toString()) })
+    child.stderr.on("data", (d) => { errBuf = cap(errBuf, d.toString()) })
+    child.on("error", (e) => settle(`Error: failed to start node: ${e.message}`, false))
+    child.on("close", (code) => {
+      if (mode === "abort") return settle("(stopped)", false)
+      if (mode === "timeout") return settle(`Error: script timed out after ${timeoutMs}ms`, false)
+      const out = outBuf.trimEnd()
+      const err = errBuf.trim()
+      if (code === 0) {
+        settle(out || "(no output)", true)
+      } else {
+        settle(err ? (out ? `${out}\n\n[stderr]:\n${err}` : err) : `${out}\n(exit code ${code})`.trim(), false)
+      }
+    })
+  })
+}
+
 export const codeModeTool = {
   name: "execute",
   description: DESC("execute"),
@@ -68,10 +126,20 @@ export const codeModeTool = {
     properties: {
       code: {
         type: "string",
-        description: "JavaScript code to execute. Use provided functions: readFile(path), writeFile(path, content), glob(pattern), grep(pattern, file), log(...args). require()/process/Node modules are available.",
+        description: "JavaScript code to execute (top-level await and dynamic import() supported). Use provided globals: readFile/writeFile/glob/grep/log, plus native require/process/console/fetch/import.",
+      },
+      workdir: {
+        type: "string",
+        description: "Run in this directory (relative to cwd, confined to the workspace; default cwd)",
+      },
+      filter: {
+        type: "string",
+        description: "Optional: only return output lines matching this regex (case-insensitive)",
       },
       timeoutMs: {
         type: "integer",
+        minimum: 1,
+        maximum: 60000,
         description: `Timeout in milliseconds (default ${DEFAULT_TIMEOUT}, max 60000)`,
       },
     },
@@ -80,97 +148,20 @@ export const codeModeTool = {
   readonly: false,
 
   async execute(args, ctx) {
-    const cwd = ctx.cwd
     const code = args.code ?? ""
-
     if (code.length > MAX_SCRIPT) {
       return `Error: script too large (${code.length} > ${MAX_SCRIPT} bytes). Split into smaller scripts or use individual tools.`
     }
+    let baseDir
+    try { baseDir = resolveBaseDir(ctx.cwd, args.workdir) }
+    catch (e) { return `Error: ${e.message}` }
 
-    const output = []
-    const timeoutMs = Math.min(args.timeoutMs ?? DEFAULT_TIMEOUT, 60_000)
-
-    // File path guard: ensure paths are within cwd (accidental out-of-workspace writes)
-    function safePath(p) {
-      if (typeof p !== "string") throw new Error(`Path must be a string, got ${typeof p}`)
-      const abs = resolve(cwd, p)
-      const rel = relative(cwd, abs)
-      if (rel.startsWith("..") || (rel.includes("..") && process.platform === "win32")) {
-        throw new Error(`Path traversal denied: ${p}`)
-      }
-      return abs
-    }
+    const t = Number(args.timeoutMs)
+    const timeoutMs = Number.isFinite(t) && t > 0 ? Math.min(t, 60_000) : DEFAULT_TIMEOUT
 
-    const sandbox = createContext({
-      readFile: (p) => {
-        const abs = safePath(p)
-        if (!existsSync(abs)) throw new Error(`File not found: ${p}`)
-        const st = statSync(abs)
-        if (st.size > 5_000_000) throw new Error(`File too large: ${p} (${Math.round(st.size / 1000000)}MB)`)
-        return normalizeEOL(readFileSync(abs, "utf8"))
-      },
-      writeFile: (p, content) => {
-        const abs = safePath(p)
-        mkdirSync(dirname(abs), { recursive: true })
-        writeFileSync(abs, String(content), "utf8")
-      },
-      glob: (pattern) => {
-        if (typeof pattern !== "string") throw new Error("glob pattern must be a string")
-        const regex = globToRegex(pattern)
-        const results = []
-        function walk(dir, rel) {
-          let entries
-          try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
-          for (const e of entries) {
-            if (e.name.startsWith(".") || e.name === "node_modules") continue
-            const relPath = rel ? `${rel}/${e.name}` : e.name
-            if (e.isDirectory()) { walk(join(dir, e.name), relPath) }
-            else if (regex.test(relPath)) results.push(relPath)
-          }
-        }
-        walk(cwd, "")
-        return results.slice(0, 200)
-      },
-      grep: (pattern, file) => {
-        if (typeof pattern !== "string") throw new Error("grep pattern must be a string")
-        if (typeof file !== "string") throw new Error("grep file must be a string")
-        const abs = safePath(file)
-        if (!existsSync(abs)) throw new Error(`File not found: ${file}`)
-        const content = normalizeEOL(readFileSync(abs, "utf8"))
-        const regex = new RegExp(pattern)
-        const lines = content.split("\n")
-        const matches = []
-        for (let i = 0; i < lines.length; i++) {
-          if (regex.test(lines[i])) matches.push(`${i + 1}: ${lines[i].slice(0, 200)}`)
-        }
-        return matches.slice(0, 100)
-      },
-      log: (...args) => {
-        const line = args.map((a) => typeof a === "object" ? JSON.stringify(a) : String(a)).join(" ")
-        output.push(line)
-        if (output.join("\n").length > MAX_OUTPUT) {
-          output.push("... (output truncated)")
-          throw new Error("CodeMode output limit exceeded")
-        }
-      },
-      fetch: sandboxFetch,
-      // Full Node access — no fake sandbox (bash can reach it anyway).
-      require: createRequire(join(cwd, "__codemode__.js")),
-      process,
-      setTimeout,
-      clearTimeout,
-    })
-
-    try {
-      const script = new Script(code, { filename: "codemode.js" })
-      // timeout belongs on runInContext — the Script constructor ignores it,
-      // so passing it there let runaway scripts (while(true)) hang the process forever.
-      script.runInContext(sandbox, { timeout: timeoutMs })
-      return output.join("\n") || "(no output)"
-    } catch (err) {
-      const out = output.join("\n")
-      const prefix = out ? `${out}\n\n` : ""
-      return `${prefix}Error: ${err.message}`
-    }
+    const { text, ok } = await runNodeEval(code, baseDir, ctx.cwd, timeoutMs, ctx.signal)
+    // Only filter successful output — never swallow an error report behind a filter.
+    if (!ok) return text
+    return args.filter ? applyFilter(text, args.filter) : text
   },
-}
+}

package/src/tools/exec-prelude.mjs

@@ -0,0 +1,84 @@
+/**
+ * exec-prelude.mjs — sandbox API injected into `execute`'s child process.
+ *
+ * The `execute` tool spawns `node --input-type=module --eval` and `import()`-s
+ * this file first, so the user's code gets readFile/writeFile/glob/grep/log/require
+ * without hand-writing fs boilerplate. Confines file paths to the workspace root
+ * (THINCODER_EXEC_ROOT, default cwd) — an orthopedic guard, NOT a sandbox:
+ * require()/process/import()/fetch() are full Node, the same boundary as bash
+ * (project philosophy: no fake sandbox; transparency + audit).
+ */
+import { createRequire } from "node:module"
+import { readFileSync, writeFileSync, existsSync, statSync, mkdirSync, readdirSync } from "node:fs"
+import { resolve, relative, dirname, join, isAbsolute, sep } from "node:path"
+
+const require = createRequire(join(process.cwd(), "__exec__.js"))
+const root = process.env.THINCODER_EXEC_ROOT || process.cwd()
+
+/** Resolve a path against the working dir, asserting it stays within the workspace root. */
+function safe(p) {
+  if (typeof p !== "string") throw new Error(`Path must be a string, got ${typeof p}`)
+  const abs = resolve(process.cwd(), p)
+  const rel = relative(root, abs)
+  // isAbsolute(rel) covers cross-drive (relative() returns an absolute path then)
+  if (isAbsolute(rel) || rel === ".." || rel.startsWith(".." + sep)) {
+    throw new Error(`Path traversal denied: ${p}`)
+  }
+  return abs
+}
+
+function globToRegex(pattern) {
+  const DS = "\u0001", DP = "\u0002"
+  const escaped = pattern
+    .replace(/\*\*\//g, DS).replace(/\*\*/g, DP)
+    .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+    .replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")
+    .replace(new RegExp(DS, "g"), "(?:.+/)?").replace(new RegExp(DP, "g"), ".*")
+  return new RegExp(`^${escaped}$`)
+}
+
+globalThis.require = require
+globalThis.readFile = (p) => {
+  const abs = safe(p)
+  if (!existsSync(abs)) throw new Error(`File not found: ${p}`)
+  if (statSync(abs).size > 5_000_000) throw new Error(`File too large: ${p}`)
+  return readFileSync(abs, "utf8").replace(/\r\n/g, "\n")
+}
+globalThis.writeFile = (p, content) => {
+  const abs = safe(p)
+  mkdirSync(dirname(abs), { recursive: true })
+  writeFileSync(abs, String(content), "utf8")
+}
+globalThis.glob = (pattern) => {
+  if (typeof pattern !== "string") throw new Error("glob pattern must be a string")
+  const re = globToRegex(pattern)
+  const out = []
+  function walk(dir, rel) {
+    let entries
+    try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
+    for (const e of entries) {
+      if (e.name.startsWith(".") || e.name === "node_modules") continue
+      const rp = rel ? `${rel}/${e.name}` : e.name
+      if (e.isDirectory()) walk(join(dir, e.name), rp)
+      else if (re.test(rp)) out.push(rp)
+    }
+  }
+  walk(process.cwd(), "")
+  const capped = out.slice(0, 200)
+  if (out.length > 200) capped.push(`... (${out.length - 200} more)`)
+  return capped
+}
+globalThis.grep = (pattern, file) => {
+  if (typeof pattern !== "string") throw new Error("grep pattern must be a string")
+  if (typeof file !== "string") throw new Error("grep file must be a string")
+  const abs = safe(file)
+  if (!existsSync(abs)) throw new Error(`File not found: ${file}`)
+  const re = new RegExp(pattern)
+  const lines = readFileSync(abs, "utf8").replace(/\r\n/g, "\n").split("\n")
+  const m = []
+  for (let i = 0; i < lines.length; i++) if (re.test(lines[i])) m.push(`${i + 1}: ${lines[i].slice(0, 200)}`)
+  const capped = m.slice(0, 100)
+  if (m.length > 100) capped.push(`... (${m.length - 100} more)`)
+  return capped
+}
+globalThis.log = (...a) => console.log(a.map((x) => (x && typeof x === "object" ? JSON.stringify(x) : String(x))).join(" "))

package/src/tools/execute.md

@@ -1,5 +1,17 @@
-Execute JavaScript code with full Node access. Use this to compose multiple file operations into one call — read, write, glob, grep, log, or require() any module. Max 30s timeout, 50KB output.
+Execute JavaScript code with full Node access. Runs in a real `node` process with top-level `await` and dynamic `import()` — so you can load and call the project's own `.mjs` modules directly. Use this to compose multiple operations into one call — read, write, glob, grep, log, import, or require() — without shelling out to `bash node -e`.
+
+**Route to execute instead of bash:**
+- `node -e "…"` → execute (top-level await + import() + console all work)
 
 Parameters:
-- code (required): JavaScript code to execute. Use provided functions: readFile(path), writeFile(path, content), glob(pattern), grep(pattern, file), log(...args). require()/process/Node modules are available.
+- code (required): JavaScript to run. Top-level `await` and `import('./x.mjs')` are supported. Globals: readFile(path), writeFile(path, content), glob(pattern), grep(pattern, file), log(...args) — plus native require/process/console/fetch/import.
+- workdir: run in this directory (relative to cwd, confined to the workspace; default cwd)
+- filter: optional — only return output lines matching this regex (case-insensitive)
 - timeoutMs: Timeout in milliseconds (default 30000, max 60000)
+
+Notes:
+- `console.log(...)` and `log(...)` both print to the result; objects are JSON-stringified by `log`.
+- File paths are confined to the workspace root (`..` traversal is denied) — but `require`/`process`/`import()` are full Node, same boundary as bash.
+- A non-zero exit / thrown exception returns the stderr (error + stack) as the result.
+- Output capped at ~50KB; use `writeFile` to a file if you need more.
+- Use `write`/`edit`/`apply_patch` for source edits and `bash` for subprocess/CLI runs (`npm test`, `node --test`, servers) — execute is for in-process JS, not spawning programs.

package/src/tools/file_ops.md

@@ -0,0 +1,16 @@
+Move, copy, or rename a file/directory.
+
+**Route to file_ops instead of bash:**
+- `mv a b` → file_ops action=move
+- `cp a b` / `copy` → file_ops action=copy
+- `ren a b` / `rename a b` → file_ops action=rename
+
+Parameters:
+- action (required): move | copy | rename
+- source (required): source path, relative to cwd or absolute
+- dest (required): destination path
+
+Notes:
+- Paths are confined to the working directory (same safety as write/edit) — bash has NO directory confinement.
+- `dest` is overwritten if it already exists. `copy` is recursive for directories.
+- To create a directory, use `write` (creates parent dirs) or `bash mkdir`.