thincoder 0.12.43 → 0.12.44

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 本文件记录 ThinCoder CLI 的发布历史。格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.0.0/)，版本遵循[语义化版本](https://semver.org/lang/zh-CN/)。
 
+## [0.12.44] — 2026-08-25
+
+### Fixed
+
+- **安全修复：subagent 变形 role 绕过工程模式门禁**——`role="Coder"/" coder"` 等非精确字符串穿透两个模式门禁（精确比较），fallthrough 到全工具/无 overlay 子代理，绕过设计评审拿到完整写权限。修复：execute 入口 ROLES 白名单，未知 role 直接 throw（fail-closed）；防回归测试锁定 7 种变形值 × 两种模式
+- IK9UZ8 思考型模型标题生成（vscode 端同修对齐）
+- 文档状态/TODO 销账（24+13 处"待评审"→"已实现"；TODO 7 条已实现条目核对关闭）
+- TUI.md 章节号重编号（## 4-10 顺延，无重复）
+
+### Added
+
+- **ESLint 引入**（规则基线对齐 vscode 端）：lint script + 21 个 error 清零（死赋值/cause 补全）
+- **跨端同构模块语义锚点比对测试**：14 个跨仓库契约（advisor 收敛协议、蒸馏语义、64K 阈值）两端必须一致——单边漂移立即红
+- **RELEASE.md**：npm 发布流程 + 4 条踩坑记录（vsce 自动 bump、Open VSX 异步激活、ovsx 无 TTY 静默失败、prepublishOnly）
+
+### Docs
+
+- 文档债收口：6 处"待合并"全部处理（真碎片合并/归档/独立保留定性）
+
 ## [0.12.43] — 2026-08-25
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.12.43",
+  "version": "0.12.44",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",
@@ -32,8 +32,13 @@
   },
   "scripts": {
     "test": "node --test \"test/*.mjs\"",
-    "prepublishOnly": "node --test \"test/*.mjs\""
+    "prepublishOnly": "node --test \"test/*.mjs\"",
+    "lint": "eslint src"
   },
   "author": "liwei <liwei@51marine.com> (上海新舶)",
-  "license": "MIT"
+  "license": "MIT",
+  "devDependencies": {
+    "eslint": "^9.0.0",
+    "@eslint/js": "^9.0.0"
+  }
 }

package/src/advisor/repos.mjs

@@ -49,7 +49,7 @@ export function collectRepoSnapshots(repos, cwd) {
   const targets = repos.length > 0 ? repos : [cwd]
   const parts = []
   for (const repo of targets) {
-    let status = "", diff = ""
+    let status, diff
     try {
       status = execFileSync("git", ["status", "--porcelain"], {
         cwd: repo, encoding: "utf8", timeout: GIT_TIMEOUT, stdio: ["ignore", "pipe", "pipe"],
@@ -153,7 +153,7 @@ export function isDocOnlyChange(repos, cwd) {
   const targets = repos.length > 0 ? repos : [cwd]
   let sawChanges = false
   for (const repo of targets) {
-    let status = ""
+    let status
     try {
       status = execFileSync("git", ["status", "--porcelain"], {
         cwd: repo, encoding: "utf8", timeout: GIT_TIMEOUT, stdio: ["ignore", "pipe", "pipe"],

package/src/agent/dispatch.mjs

@@ -49,7 +49,7 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
   const prepared = []
   for (const toolCall of toolCalls) {
     const tool = toolByName.get(toolCall.name)
-    let args = {}
+    let args
     try {
       args = JSON.parse(toolCall.arguments || "{}")
     } catch {

package/src/agent-tools/subagent.mjs

@@ -77,6 +77,14 @@ export const subagentTool = {
     const parent = ctx.agent
     const role = args.role
 
+    // Role normalization + whitelist (2026-08-25, coder-leak fix): exact-string gates let
+    // variant roles ("Coder", " coder") bypass BOTH mode gates and fall through to
+    // full tools / no overlay — a full-write coder without design review. Schema enums are
+    // advisory; providers don't enforce them. Fail closed on unknown roles.
+    const ROLES = new Set(["explore", "plan", "coder", "eng-coder"])
+    if (!ROLES.has(role)) {
+      throw new Error(`Unknown subagent role: ${JSON.stringify(role)}. Valid roles: explore, plan, coder, eng-coder (exact spelling).`)
+    }
     // Role is mutually exclusive per mode: normal mode → "coder", engineering mode → "eng-coder"
     if (parent.config?.agent?.engineering && role === "coder") {
       throw new Error("Engineering mode: use role='eng-coder' for implementation tasks.")

package/src/config.mjs

@@ -235,7 +235,7 @@ export function loadConfig() {
     try {
       config = JSON.parse(readFileSync(configPath, "utf8"))
     } catch (error) {
-      throw new Error(`Config file is not valid JSON, check or delete it: ${configPath}\n  ${error.message}`)
+      throw new Error(`Config file is not valid JSON, check or delete it: ${configPath}\n  ${error.message}`, { cause: error })
     }
   }
 

package/src/git/checkpoint.mjs

@@ -29,7 +29,7 @@ function git(cwd, args, { allowFail = false } = {}) {
     return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim()
   } catch (error) {
     if (allowFail) return null
-    throw new Error(`git ${args.join(" ")} failed: ${error.stderr?.toString().trim() || error.message}`)
+    throw new Error(`git ${args.join(" ")} failed: ${error.stderr?.toString().trim() || error.message}`, { cause: error })
   }
 }
 
@@ -324,7 +324,7 @@ export async function listFileVersions(cwd, filePath) {
     } else if ((meta.tracked ?? []).includes(filePath) || (meta.untracked ?? []).includes(filePath)) {
       // Legacy snapshot (no per-file meta): fall back to stat-ing the copy
       const src = join((meta.tracked ?? []).includes(filePath) ? join(root, id, "files") : join(root, id, "untracked"), filePath)
-      let size = null, sha = null
+      let size, sha
       try {
         const buf = await readFile(src)
         size = buf.length

package/src/git/gitmem.mjs

@@ -55,14 +55,16 @@ export async function pullTeam(dir) {
       try { await git(dir, ["rebase", "--abort"]) } catch {
         abortFailed = true
       }
-      throw new Error(
+      const conflictError = new Error(
         `Team memory sync conflict: local and remote modified the same entry.\n` +
         `Please resolve manually in ${dir} with \`git pull\`, then re-run \`thincoder sync\`.\n` +
         (abortFailed
           ? `(WARNING: git rebase --abort also failed — the repo may be in a conflicted state. ` +
             `Run \`cd ${dir} && git rebase --abort\` manually to clean up.)`
           : `(The local repo has been restored to its pre-sync state — nothing was lost.)`),
+        { cause: error },
       )
+      throw conflictError
     }
     throw error
   }

package/src/memory/core.mjs

@@ -198,7 +198,7 @@ export async function putMarkdown(memory, { layer, dir, type, title, content, ta
  * vanished entries are removed from the index.
  */
 export async function syncDir(memory, { layer, dir }) {
-  let names = []
+  let names
   try {
     names = (await readdir(dir)).filter((n) => n.endsWith(".md"))
   } catch {

package/src/tools/file.mjs

@@ -261,7 +261,7 @@ export const insertAfterTool = {
       try {
         regex = new RegExp(args.after_regex)
       } catch (e) {
-        throw new Error(`after_regex /${args.after_regex}/ is not a valid JavaScript regex: ${e.message}`)
+        throw new Error(`after_regex /${args.after_regex}/ is not a valid JavaScript regex: ${e.message}`, { cause: e })
       }
       const matches = []
       for (let i = 0; i < lines.length; i++) {

package/src/tools/system.mjs

@@ -339,7 +339,7 @@ export const grepTool = {
       const pat = args.literal ? escapeRegExp(String(args.pattern)) : args.pattern
       regex = new RegExp(pat, args.ignoreCase ? "i" : "")
     } catch (e) {
-      throw new Error(`grep pattern /${args.pattern}/ is not a valid regex: ${e.message}`)
+      throw new Error(`grep pattern /${args.pattern}/ is not a valid regex: ${e.message}`, { cause: e })
     }
     const fileFilter = args.glob ? globToRegex(args.glob) : null
     const before = Math.max(0, Math.floor(args.before ?? 0))
@@ -439,7 +439,7 @@ export const lsTool = {
     try {
       entries = await readdir(abs, { withFileTypes: true })
     } catch (e) {
-      if (e.code === "ENOENT" || e.code === "ENOTDIR") throw new Error(`ls: ${args.path ?? "."} — ${e.code === "ENOTDIR" ? "not a directory" : "not found"}`)
+      if (e.code === "ENOENT" || e.code === "ENOTDIR") throw new Error(`ls: ${args.path ?? "."} — ${e.code === "ENOTDIR" ? "not a directory" : "not found"}`, { cause: e })
       throw e
     }
     const rows = await Promise.all(

package/src/tools/web.mjs

@@ -187,6 +187,6 @@ export const fetchTool = {
       const ct = headerOf(response, "content-type") ?? ""
       const body = await response.text()
       return ct.includes("text/html") ? truncate(htmlToText(body)) : truncate(body)
-    } catch (e) { throw new Error(`fetch failed: ${e.cause?.code ?? e.message}`) }
+    } catch (e) { throw new Error(`fetch failed: ${e.cause?.code ?? e.message}`, { cause: e }) }
   },
 }

package/src/tui/layout.mjs

@@ -61,7 +61,7 @@ export function computeLayout(state, { cols, rows }) {
   const pickerH = overlay ? Math.min(overlay.lines.length + 1, Math.max(6, rows - 12)) : 0
 
   // Todo
-  let visibleTasks = []
+  let visibleTasks
   if (state.tasks.length <= MAX_TASK_LINES) {
     visibleTasks = state.tasks
   } else {