thincoder 0.12.54 → 0.12.58

package/src/provider/google.mjs

@@ -6,6 +6,7 @@
 
 import { proxyFetch } from "../proxy.mjs"
 import { requestWithRetry } from "./retry.mjs"
+import { effectiveFetchTimeoutMs } from "./core.mjs"
 
 /** OpenAI 语义 tool_choice → Gemini FunctionCallingConfig（2026-08-31 能力层）。 */
 function mapFunctionCallingConfig(choice) {
@@ -100,7 +101,6 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
     body.toolConfig = { functionCallingConfig: mapFunctionCallingConfig(toolChoice) }
   }
 
-  const FETCH_TIMEOUT_MS = 600_000
   // Gemini uses API key as query parameter
   const url = `${provider.baseURL}/models/${provider.model}:streamGenerateContent?alt=sse&key=${encodeURIComponent(provider.apiKey)}`
 
@@ -118,10 +118,9 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(body),
-      signal: signal
-        ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
-        : AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      _headerTimeoutMs: FETCH_TIMEOUT_MS,
+      // 2026-09-01：同 core.mjs——绝对墙钟废除；响应头阶段 fetchTimeoutMs（600s 默认），body 阶段读侧 idle 管
+      signal,
+      _headerTimeoutMs: effectiveFetchTimeoutMs(provider),
       _bodyIdleMs: 120_000,
     }, provider.proxyUri),
     { signal, onWait, buildMessage: (status, text) => `Gemini API error ${status}: ${text}` },
@@ -194,32 +193,66 @@ async function parseGeminiStream(response, { onToken, onReasoning, signal }) {
   }
 
   if (!response.body) throw new Error("No stream response body")
-  for await (const chunk of response.body) {
-    if (signal?.aborted) {
-      const e = new DOMException("Aborted", "AbortError")
-      e.reason = signal.reason
-      throw e
-    }
-    buffer += decoder.decode(chunk, { stream: true })
-    // BOM 剥除（会诊 #12）：首个 chunk 可能带 \uFEFF，否则首个 data 事件静默丢失
-    if (buffer.charCodeAt(0) === 0xfeff) buffer = buffer.slice(1)
-    const lines = buffer.split("\n")
-    buffer = lines.pop()
+  // 2026-09-01 读侧 idle 超时（同 sse.mjs）：body 有数据流动即不超时；连续 120s 无新 chunk 判死
+  const READ_IDLE_MS = 120_000
+  let idleTimer = null
+  const armIdle = () => {
+    if (idleTimer) clearTimeout(idleTimer)
+    idleTimer = setTimeout(() => {
+      try { response.body?.destroy(new Error(`SSE idle timeout: no data for ${READ_IDLE_MS / 1000}s`)) } catch { /* already gone */ }
+    }, READ_IDLE_MS)
+    idleTimer.unref?.()
+  }
+  armIdle()
+  try {
+    for await (const chunk of response.body) {
+      armIdle()
+      if (signal?.aborted) {
+        const e = new DOMException("Aborted", "AbortError")
+        e.reason = signal.reason
+        throw e
+      }
+      buffer += decoder.decode(chunk, { stream: true })
+      // BOM 剥除（会诊 #12）：首个 chunk 可能带 \uFEFF，否则首个 data 事件静默丢失
+      if (buffer.charCodeAt(0) === 0xfeff) buffer = buffer.slice(1)
+      const lines = buffer.split("\n")
+      buffer = lines.pop()
 
-    for (const line of lines) {
+      for (const line of lines) {
+        if (!line.startsWith("data:")) continue
+        const data = line.slice(5).trim()
+        if (!data || data === "[DONE]") continue
+        processData(data)
+      }
+    }
+    buffer += decoder.decode()
+    for (const line of buffer.split("\n")) {
       if (!line.startsWith("data:")) continue
       const data = line.slice(5).trim()
       if (!data || data === "[DONE]") continue
       processData(data)
     }
-  }
-  buffer += decoder.decode()
-  for (const line of buffer.split("\n")) {
-    if (!line.startsWith("data:")) continue
-    const data = line.slice(5).trim()
-    if (!data || data === "[DONE]") continue
-    processData(data)
+  } catch (e) {
+    if (idleTimer) clearTimeout(idleTimer)
+    if (e.name === "AbortError" && signal?.reason?.interrupt) {
+      result.interrupted = true
+      result.interruptMessage = signal.reason.message
+      return result
+    }
+    if (hasPartial(e)) {
+      result.partial = true
+      result.networkError = e.message ?? String(e)
+      return result
+    }
+    throw e
+  } finally {
+    if (idleTimer) clearTimeout(idleTimer)
   }
 
   return result
 }
+
+/** google.mjs 无 hasChoices 追踪——只有流中途死且已有内容才标 partial（同 sse.mjs 语义的简化版） */
+function hasPartial(e) {
+  return /ECONNRESET|terminated|idle timeout|network/i.test(e?.message ?? "")
+}

package/src/provider/normalize.mjs

@@ -5,8 +5,8 @@
  * pure functions sanitize the message array right before it hits the wire;
  * no dependency on chat()/retry logic. core.mjs re-exports them so
  * provider/index.mjs and tool-pairing.test.mjs keep their import paths.
+ * The caller passes the spec (providerSpec from core.mjs — provider-aware).
  */
-import { specForModel } from "../config.mjs"
 
 const RASTER_IMAGE_URL = /^data:image\/(png|jpe?g|gif|webp);base64,/
 

package/src/provider/rate.mjs

@@ -3,8 +3,6 @@
  * Sliding-window accounting; pre-check budget before sending requests; sleep until window frees space when over budget.
  */
 
-import { specForModel } from "../config.mjs"
-
 export const RETRYABLE_STATUS = new Set([408, 409, 425, 429, 500, 502, 503, 504])
 export const MAX_RETRIES = 3
 export const MAX_CONTINUATIONS = 3

package/src/provider/responses.mjs

@@ -12,11 +12,12 @@
  * 没有 "data: [DONE]"。
  */
 import { specForModel, isBailianHost } from "../config.mjs"
+import { effectiveFetchTimeoutMs } from "./core.mjs"
 import { proxyFetch } from "../proxy.mjs"
 import { requestWithRetry } from "./retry.mjs"
 import { rateGate, recordRate, estimateRequestTokens } from "./rate.mjs"
 
-const FETCH_TIMEOUT_MS = 600_000
+// 2026-09-01：FETCH_TIMEOUT_MS 常量退役（绝对墙钟废除）——经 core.mjs effectiveFetchTimeoutMs 共用
 
 /** 白名单：已实证 previous_response_id 的官方端（2026-08-31 真机验证：
  *  百炼 store:true 全链路 ✅；GLM（open.bigmodel.cn/api/v1）store:true 全链路 ✅）。 */
@@ -430,10 +431,8 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
         method: "POST",
         headers: { "Content-Type": "application/json", Authorization: `Bearer ${provider.apiKey}` },
         body: JSON.stringify(body),
-        signal: signal
-          ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
-          : AbortSignal.timeout(FETCH_TIMEOUT_MS),
-        _headerTimeoutMs: FETCH_TIMEOUT_MS,
+        signal,
+          _headerTimeoutMs: effectiveFetchTimeoutMs(provider),
         _bodyIdleMs: 120_000,
       }, provider.proxyUri),
       { signal, onWait, buildMessage: (status, text) => `Responses API error ${status}: ${text}` },
@@ -451,10 +450,8 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
         method: "POST",
         headers: { "Content-Type": "application/json", Authorization: `Bearer ${provider.apiKey}` },
         body: JSON.stringify(fullBody),
-        signal: signal
-          ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
-          : AbortSignal.timeout(FETCH_TIMEOUT_MS),
-        _headerTimeoutMs: FETCH_TIMEOUT_MS,
+        signal,
+          _headerTimeoutMs: effectiveFetchTimeoutMs(provider),
         _bodyIdleMs: 120_000,
       }, provider.proxyUri),
       { signal, onWait, buildMessage: (status, text) => `Responses API error ${status}: ${text}` },
@@ -471,10 +468,8 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
         method: "POST",
         headers: { "Content-Type": "application/json", Authorization: `Bearer ${provider.apiKey}` },
         body: JSON.stringify(fresh2.body),
-        signal: signal
-          ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
-          : AbortSignal.timeout(FETCH_TIMEOUT_MS),
-        _headerTimeoutMs: FETCH_TIMEOUT_MS,
+        signal,
+          _headerTimeoutMs: effectiveFetchTimeoutMs(provider),
         _bodyIdleMs: 120_000,
       }, provider.proxyUri),
       { signal, onWait, buildMessage: (status, text) => `Responses API error ${status}: ${text}` },

package/src/provider/sse.mjs

@@ -165,8 +165,23 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
   }
 
   if (!response.body) throw new Error("No stream response body")
+  // 2026-09-01 读侧 idle 超时（根因修复）：原实现靠 fetch 层的 600s 绝对墙钟兜底——长上下文子代理
+  // 单次生成（或上游排队）超 10 分钟即被腰斩（"The operation was aborted due to timeout" 直透）。
+  // 现改为：读侧空闲超时——body 只要有数据流动就永不超时，连续 READ_IDLE_MS 无新 chunk 才判死。
+  // 直连 fetch 与 proxyFetch 统一走这里（proxy 的 _bodyIdleMs 语义与之等价，双保险）。
+  const READ_IDLE_MS = 120_000
+  let idleTimer = null
+  const armIdle = () => {
+    if (idleTimer) clearTimeout(idleTimer)
+    idleTimer = setTimeout(() => {
+      try { response.body?.destroy(new Error(`SSE idle timeout: no data for ${READ_IDLE_MS / 1000}s`)) } catch { /* already gone */ }
+    }, READ_IDLE_MS)
+    idleTimer.unref?.()
+  }
+  armIdle()
   try {
     for await (const chunk of response.body) {
+      armIdle()
       if (signal?.aborted) {
         const e = new DOMException("The operation was aborted", "AbortError")
         e.reason = signal.reason
@@ -189,6 +204,7 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
               result.ruleTriggered = true
               result.ruleMessage = rule.message
               result.ruleName = rule.name
+              if (idleTimer) clearTimeout(idleTimer)
               return result
             }
             const existing = result._warnings ??= []
@@ -202,9 +218,11 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
     buffer += decoder.decode()
     processLines(buffer.split("\n"))
   } catch (e) {
+    if (idleTimer) clearTimeout(idleTimer)
     if (e.name === "AbortError" && signal?.reason?.interrupt) {
       result.interrupted = true
       result.interruptMessage = signal.reason.message
+      if (idleTimer) clearTimeout(idleTimer)
       return result
     }
     // 2026-08-31 会诊 #2（流中断丢全部已收内容）：网络级失败（ECONNRESET / 半截 EOF /
@@ -223,6 +241,8 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
     throw e
   }
 
+  if (idleTimer) clearTimeout(idleTimer)
+
   if (!hasChoices) {
     // Stream started as SSE but no choices were parsed — unusual. Include status for debugging.
     const raw = buffer.trim()

package/src/session.mjs

@@ -116,6 +116,12 @@ export function saveSession(agent) {
     autoApprove: agent.autoApprove ?? false,
     engineering: agent.config?.agent?.engineering ?? false,
     engDesignToken: agent._engDesignToken ?? null,
+    // Multi-design slots ride the same round-trip (2026-09-01 audit #1): Map → {designId: token}
+    // (JSON-safe). Empty/absent Map → undefined → the key is dropped by JSON.stringify, so a
+    // cleared session writes NO field instead of resurrecting slots from the previous save.
+    engDesignTokens: agent._engDesignTokens instanceof Map && agent._engDesignTokens.size > 0
+      ? Object.fromEntries(agent._engDesignTokens)
+      : undefined,
     goal: agent.goal ?? null,
     advisor: agent.config?.advisor ?? null,
     pendingReminders: agent._pendingReminders ?? [],
@@ -315,6 +321,14 @@ export function applySession(agent, data) {
   agent._pendingReminders = data.pendingReminders ?? []
   agent._sessionStart = data.sessionStart ?? null
   agent._engDesignToken = data.engDesignToken ?? null
+  // Multi-design slots restore from the {designId: token} object (2026-09-01 audit #1). A legacy
+  // slot without the field restores NO Map (fresh state) — never resurrect slots the writer did
+  // not have. Expired tokens are rejected downstream by validateDesignToken (fail-closed, TTL).
+  if (data.engDesignTokens && typeof data.engDesignTokens === "object" && !Array.isArray(data.engDesignTokens)) {
+    agent._engDesignTokens = new Map(Object.entries(data.engDesignTokens))
+  } else {
+    delete agent._engDesignTokens
+  }
   // engineering is session-level (2026-08-29): the slot value is the CLI session's authority
   // — config.json is only the initial default / cross-end mirror. A legacy slot without the
   // field keeps whatever config.json seeded (unchanged behavior).
@@ -429,6 +443,7 @@ export function resetSessionState(agent) {
   agent.tasks = []
   agent._sessionStart = null
   agent._engDesignToken = null
+  agent._engDesignTokens = new Map() // multi-design slots die with the session (2026-09-01 fix #2)
   agent._compressFailures = 0
   agent._verifyRetries = 0
   agent._verifyPassed = undefined

package/src/tools/apply_patch.md

@@ -1,5 +1,7 @@
 Apply a unified diff to one or more files, atomically: if any hunk fails to apply, nothing is written.
 
+**Use it for whole-file and multi-file changes:** creating MULTIPLE new files at once (`--- /dev/null` header per file), whole-file replacement, and cross-file refactors — one unified-diff call covers the whole change. A batched call is one permission ask and one turn instead of N separate calls.
+
 Parameters:
 - patch (required): Unified diff text. One `--- a/path` / `+++ b/path` header pair per file, then `@@ -old,count +new,count @@` hunks. Use `--- /dev/null` to create a new file.
 

package/src/tools/bash.md

@@ -33,5 +33,5 @@ Notes:
 - Never use bash to read, copy, or transmit secret files (.env, keys, tokens)
 - Do NOT run destructive commands (rm -rf, force-push, drop table) without explicit user confirmation
 - After commands that change files (git checkout, npm install, etc.), repo_outline and code_search may be stale — re-run them to get current results.
-- Prefer read/glob/grep/ls for file operations inside the project — bash has no directory confinement.
-- NEVER use bash to write or modify files (echo/sed/printf > file, cat << EOF, etc.). Use write/edit/insert_after/apply_patch instead — they handle encoding, escaping, and directory confinement correctly.
+- Prefer read/glob/grep/ls for file operations inside the project — file tools and bash reach the same paths (no directory restriction).
+- NEVER use bash to write or modify files (echo/sed/printf > file, cat << EOF, etc.). Use write/edit/insert_after/apply_patch instead — they handle encoding, escaping, and EOL conventions correctly.

package/src/tools/edit-batch.mjs

@@ -0,0 +1,104 @@
+/**
+ * edit-batch.mjs — edit 工具的数组形态（edits: [...]）：一次多文件原子替换。
+ * （2026-08-31 工具顺手度 §9 ②；2026-09-01 缺陷修复"同文件多条串行累积"。）
+ * 从 file.mjs 拆出（500 行硬限，先例 git-ext.mjs）——纯移动，零行为变化。
+ *
+ * 语义：同一 path 的多条编辑按序**串行累积应用**——第 n 条基于前 n-1 条已应用后的
+ * 累积内容做匹配与替换；跨 path 条目互不影响（并行原子语义）；任一条失败 →
+ * 全不写（原子性保留）。
+ */
+import { readFile, writeFile } from "node:fs/promises"
+import { resolveInCwd, normalizeEOL, joinWithEol, gitDiffOne, autoSyntaxCheck } from "./shared.mjs"
+// file.mjs ↔ edit-batch.mjs 循环引用：两侧导入的都是函数声明（提升初始化），
+// 仅在调用期使用——ESM 循环下安全（无模块求值期取值）。
+import { recordWrite, appendWriteContext } from "./file.mjs"
+
+/**
+ * Apply the `edits` array form: multi-file atomic replacement. Throws on any
+ * failure (atomic — nothing written). Returns the per-entry result text (joined).
+ */
+export async function applyEditBatch(args, ctx) {
+  if (!Array.isArray(args.edits) || args.edits.length === 0) {
+    throw new Error("edits must be a non-empty array of {path, old_string, new_string}")
+  }
+  if (args.path || args.old_string !== undefined || args.new_string !== undefined) {
+    throw new Error("edits array is mutually exclusive with path/old_string/new_string")
+  }
+  // 原子：先全量检查（所有文件的替换都可执行）——任一失败全不写。
+  // 2026-09-01 缺陷修复（TOOLS.md §9 ②"同文件多条规则"）：同一 path 的多条编辑
+  // 按序**串行累积应用**——第 n 条基于前 n-1 条已应用后的累积内容做匹配与替换
+  // （原实现每条都基于盘上原始内容计算、写盘循环后置，同文件后者覆盖前者 →
+  // 除最后一条外全部静默丢失）；跨 path 条目互不影响（并行原子语义不变）。
+  const groups = new Map() // abs → 每文件一条流水线
+  for (const e of args.edits) {
+    if (!e.path) throw new Error("each edit must have a path")
+    if (!e.old_string) throw new Error(`edit for ${e.path}: old_string must not be empty`)
+    if (typeof e.new_string !== "string") {
+      throw new Error(
+        `edit for ${e.path}: new_string must be a string` +
+        `${e.new_string === undefined ? " (missing)" : ` (got ${typeof e.new_string})`}`,
+      )
+    }
+    const abs = resolveInCwd(ctx, e.path)
+    let g = groups.get(abs)
+    if (!g) {
+      const raw = await readFile(abs, "utf8")
+      g = { abs, path: e.path, raw, content: normalizeEOL(raw), edits: [] }
+      groups.set(abs, g)
+    }
+    g.edits.push(e)
+  }
+  const prepared = [] // 顺序 = args.edits 顺序（回显按条）；recordWrite 每组一条合并快照
+  for (const g of groups.values()) {
+    g.netShift = 0 // 组内行数差累积（合并快照的 shift = 全组净漂移）
+    for (const e of g.edits) {
+      const content = g.content
+      const occurrences = content.split(e.old_string).length - 1
+      if (occurrences === 0) {
+        throw new Error(
+          `edit aborted (atomic — no files written): old_string not found in ${g.path}\n` +
+          `  searched: "${e.old_string.slice(0, 100).split("\n")[0]}${e.old_string.length > 100 ? "…" : ""}"`
+        )
+      }
+      if (occurrences > 1 && !e.replace_all) {
+        throw new Error(
+          `edit aborted (atomic — no files written): old_string matches ${occurrences} times in ${g.path}; ` +
+          `provide more context or set replace_all`
+        )
+      }
+      const matchIdx = content.indexOf(e.old_string)
+      const editStartLine = matchIdx >= 0 ? content.slice(0, matchIdx).split("\n").length : 1
+      const lineShift = e.new_string.split("\n").length - e.old_string.split("\n").length
+      const updated = e.replace_all
+        ? content.split(e.old_string).join(e.new_string)
+        : content.replace(e.old_string, () => e.new_string)
+      prepared.push({
+        g,
+        editStartLine, // 基于累积内容计算——已天然计入前面条目的行偏移，不再累加
+        lineShift,
+        occurrences: e.replace_all ? occurrences : 1,
+      })
+      g.content = updated // 串行累积：下一条基于本条应用后的内容
+      g.netShift += lineShift
+    }
+  }
+  // 全部检查通过——每文件一次写盘（同文件多条：写入串行累积后的最终内容）；
+  // recordWrite 每组一条合并快照：startLine = 组内**所有**编辑受影响行的最小值
+  // （#2，2026-09-01 交付评审尾巴——原实现取首条 = 调用序第一条，逆序条目时
+  // 护栏下界过高、受影响区内的 insert_after 被放行），shift = 全组行数差累积
+  // ——受影响区护栏覆盖组内所有编辑
+  for (const g of groups.values()) {
+    const startLine = Math.min(...prepared.filter((p) => p.g === g).map((p) => p.editStartLine))
+    await writeFile(g.abs, joinWithEol(normalizeEOL(g.content).split("\n"), g.raw), "utf8")
+    recordWrite(g.abs, { type: "edit", startLine, shift: g.netShift })
+  }
+  const results = []
+  for (const p of prepared) {
+    // #4（2026-09-01 交付评审尾巴）：与单文件路径对齐——每条结果附 git diff +
+    // autoSyntaxCheck（同文件多条会重复 diff/检查，换取格式一致、实现零分支）
+    const diff = gitDiffOne(ctx.cwd, p.g.abs)
+    const base = `Edited ${p.g.path}: replaced ${p.occurrences} occurrence(s)${diff ? "\n" + diff : ""}${await autoSyntaxCheck(p.g.abs)}`
+    results.push(await appendWriteContext(p.g.abs, p.editStartLine, base))
+  }
+  return results.join("\n")
+}

package/src/tools/edit.md

@@ -8,11 +8,14 @@ Edit a file by exact string replacement. old_string must match exactly once unle
 - Rewrite an entire file → `write`
 - Rename a symbol project-wide → `lsp` or `grep` first to map every caller
 
+**Batch multiple edits into ONE call via the `edits` array** (preferred over N single edit calls): multiple changes to the SAME file go into one `edits` array (entries are applied serially, each based on the previous one's result); independent changes across MULTIPLE files also go into the same `edits` array — one call, atomic (any failure writes nothing). A batched call is one permission ask, one undo unit, and one turn instead of N.
+
 Parameters:
 - path (required): File path
 - old_string (required): Exact text to find and replace
 - new_string (required): Replacement text
 - replace_all: Replace all occurrences instead of just one (default false)
+- edits: Array of {path, old_string, new_string, replace_all?} entries — batch form; mutually exclusive with path/old_string/new_string
 
 Notes:
 - Prefer this over write for targeted edits — it's safer and keeps changes targeted

package/src/tools/execute.md

@@ -1,4 +1,4 @@
-Execute JavaScript — either inline `code` or a workspace `scriptFile`. Runs in a real `node` process with top-level `await` and dynamic `import()`. Use inline `code` to compose multiple operations into one call — read, write, glob, grep, log, import, or require() — without shelling out to `bash node -e`.
+Execute JavaScript — either inline `code` or a `scriptFile`. Runs in a real `node` process with top-level `await` and dynamic `import()`. Use inline `code` to compose multiple operations into one call — read, write, glob, grep, log, import, or require() — without shelling out to `bash node -e`.
 
 **Route to execute instead of bash:**
 - `node -e "…"` → execute (inline code; top-level await + import() + console all work)
@@ -7,15 +7,15 @@ Execute JavaScript — either inline `code` or a workspace `scriptFile`. Runs in
 
 Parameters:
 - code: JavaScript to run inline. Top-level `await` and `import('./x.mjs')` are supported. Globals: readFile(path), writeFile(path, content), glob(pattern), grep(pattern, file), log(...args) — plus native require/process/console/fetch/import. Use this OR scriptFile.
-- scriptFile: run a workspace .mjs/.js file with node (self-contained — no prelude; the file imports what it needs). Path relative to workdir, confined to the workspace. Use this OR code.
+- scriptFile: run a .mjs/.js file with node (self-contained — no prelude; the file imports what it needs). Path relative to workdir — no directory restriction. Use this OR code.
 - nodeArgs: (scriptFile) extra node flags before the script, e.g. ["--test"], ["--check"]. Eval-like flags (--eval/--input-type/--inspect) are rejected.
-- workdir: run in this directory (relative to cwd, confined to the workspace; default cwd)
+- workdir: run in this directory (relative to cwd — no directory restriction; default cwd)
 - filter: optional — only return output lines matching this regex (case-insensitive)
 - timeoutMs: Timeout in milliseconds (default 30000, max 600000 — covers slow `node --test` suites and long package scripts)
 
 Notes:
 - `console.log(...)` and `log(...)` both print to the result; objects are JSON-stringified by `log`.
-- File paths are confined to the workspace root (`..` traversal is denied) — but `require`/`process`/`import()` are full Node, same boundary as bash.
+- The prelude's readFile/writeFile/glob/grep helpers resolve paths against the working directory (helper-only guard — `require`/`process`/`import()` are full Node, same boundary as bash).
 - A non-zero exit / thrown exception returns the stderr (error + stack) as the result.
 - Output capped at ~50KB; use `writeFile` to a file if you need more.
 - Use `write`/`edit`/`apply_patch` for source edits. Still use `bash` for package-manager/CLI subprocesses (`npm test`/`npm publish`/`vsce`), servers, and interactive/TTY programs — execute covers in-process JS and `node <script>`/`node --test`/`node --check`, not arbitrary CLI or long-running programs.

package/src/tools/execute.mjs

@@ -11,19 +11,20 @@
  * process is killed like bash).
  *
  * The child `import()`-s exec-prelude.mjs first for readFile/writeFile/glob/grep/
- * log/require (paths confined to the workspace root). Full Node via require()/
- * process/import() is available — same boundary as bash, no fake sandbox.
+ * log/require (helper paths resolve against the working directory — orthopedic
+ * guard, not a sandbox). Full Node via require()/process/import() is available —
+ * same boundary as bash, no fake sandbox.
  *
  * Parameters:
  *   code       — JS to run inline (top-level await and import() supported). Use this OR scriptFile.
- *   scriptFile — run a workspace .mjs/.js file with node (self-contained, no prelude). Use this OR code.
+ *   scriptFile — run a .mjs/.js file with node (self-contained, no prelude). Use this OR code.
  *   nodeArgs   — (scriptFile) extra node flags before the script (e.g. --test, --check); eval-like flags rejected
- *   workdir    — run in this sub-directory (confined to the workspace)
+ *   workdir    — run in this sub-directory (no directory restriction)
  *   filter     — return only output lines matching this regex (case-insensitive)
  *   timeoutMs  — timeout (default 30s, max 60s)
  */
 import { spawn } from "node:child_process"
-import { dirname, resolve, relative, isAbsolute, sep } from "node:path"
+import { dirname, resolve } from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
 import { DESC } from "./shared.mjs"
 
@@ -34,20 +35,12 @@ const DEFAULT_TIMEOUT = 30_000
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const PRELUDE_URL = pathToFileURL(resolve(__dirname, "exec-prelude.mjs")).href
 
-/** True when `abs` is inside `root` (handles `..` and cross-drive, which
- *  relative() returns as an absolute path on Windows). */
-function isInside(root, abs) {
-  const rel = relative(root, abs)
-  if (isAbsolute(rel)) return false
-  return rel !== ".." && !rel.startsWith(".." + sep)
-}
-
-/** Resolve workdir relative to cwd, asserting it stays within the workspace. */
+/** Resolve workdir relative to cwd — no boundary assertion
+ *  (§10.1 2026-09-02: workspace confinement removed; the child node process is
+ *  not directory-limited — same boundary as bash). */
 function resolveBaseDir(cwd, workdir) {
   if (!workdir || typeof workdir !== "string") return cwd
-  const abs = resolve(cwd, workdir)
-  if (!isInside(cwd, abs)) throw new Error(`workdir escapes the workspace: ${workdir}`)
-  return abs
+  return resolve(cwd, workdir)
 }
 
 /** Keep only output lines matching a regex (execute filter, case-insensitive). */
@@ -143,7 +136,7 @@ export const executeTool = {
       },
       scriptFile: {
         type: "string",
-        description: "Run a workspace .mjs/.js file with node (self-contained, no prelude). Path relative to workdir, confined to the workspace. Use this OR code. For `node <script>` / `node --test <file>` / `node --check <file>`.",
+        description: "Run a .mjs/.js file with node (self-contained, no prelude). Path relative to workdir — no directory restriction. Use this OR code. For `node <script>` / `node --test <file>` / `node --check <file>`.",
       },
       nodeArgs: {
         type: "array",
@@ -152,7 +145,7 @@ export const executeTool = {
       },
       workdir: {
         type: "string",
-        description: "Run in this directory (relative to cwd, confined to the workspace; default cwd)",
+        description: "Run in this directory (relative to cwd — no directory restriction; default cwd)",
       },
       filter: {
         type: "string",
@@ -180,10 +173,9 @@ export const executeTool = {
     let childArgs
     if (args.scriptFile) {
       if (args.code?.trim()) return "Error: pass code OR scriptFile, not both"
-      // scriptFile mode: run a workspace .mjs/.js file with node [nodeArgs...]. Self-contained —
-      // no prelude (a real node process imports what it needs). Confined to the workspace.
+      // scriptFile mode: run a .mjs/.js file with node [nodeArgs...]. Self-contained —
+      // no prelude (a real node process imports what it needs). No directory restriction.
       const scriptAbs = resolve(baseDir, args.scriptFile)
-      if (!isInside(ctx.cwd, scriptAbs)) return `Error: scriptFile escapes the workspace: ${args.scriptFile}`
       let nodeArgs
       try { nodeArgs = validateNodeArgs(args.nodeArgs) }
       catch (e) { return `Error: ${e.message}` }

package/src/tools/file.mjs

@@ -13,13 +13,10 @@ import {
   findCandidates,
   FFFD_WARNING,
 } from "./shared.mjs";
+import { applyEditBatch } from "./edit-batch.mjs";
 import { specForModel } from "../config.mjs";
 import { createHash } from "node:crypto";
-import { mkdir } from "node:fs/promises";
-import { readFile } from "node:fs/promises";
-import { stat } from "node:fs/promises";
-import { writeFile } from "node:fs/promises";
-import { unlink } from "node:fs/promises";
+import { mkdir, readFile, stat, writeFile, unlink } from "node:fs/promises";
 import { join, relative, dirname } from "node:path";
 
 const MAX_FILE_READ_BYTES = 10_000_000
@@ -54,8 +51,9 @@ export function clearLastWrite(abs) { lastWrites.delete(abs) }
  *  模型拿到的不只是"inserted at L395"，而是"L395 这行是什么内容"——下次再操作时
  *  能自检"我的行号 vs 实际内容"是否匹配，匹配不上 = 行号漂了，先 read——
  *  死循环就断了（根因：模型对行号锚点的"新鲜度"没有感知——数字本身不携带语义）。
- *  write 全文重写跳过（无行号锚点——模型刚写的知道内容）。 */
-async function appendWriteContext(abs, writeLine, baseResult) {
+ *  write 全文重写跳过（无行号锚点——模型刚写的知道内容）。
+ *  edit-batch.mjs（数组形态）复用——导出仅供内部模块，非公共 API。 */
+export async function appendWriteContext(abs, writeLine, baseResult) {
   const content = normalizeEOL(await readFile(abs, "utf8"))
   const lines = content.split("\n")
   const start = Math.max(1, writeLine - 3)
@@ -77,7 +75,7 @@ export const readTool = {
       path: { type: "string", description: "File path (relative to cwd or absolute)" },
       offset: { type: "number", description: "1-based line number to start from" },
       limit: { type: "number", description: `Max lines to return (default ${MAX_READ_LINES})` },
-      allowExternal: { type: "boolean", description: "Allow reading files outside the working directory. Only set true when the user explicitly provided an external path — never use this to explore beyond cwd on your own." },
+      allowExternal: { type: "boolean", description: "No-op retained for API compatibility — path resolution no longer asserts a working-directory boundary (all paths resolve relative to cwd)." },
       hashes: { type: "boolean", description: "Include SHA256 line hashes for hash-based editing (default false). Use when you plan to edit the file with hashline_edit." },
     },
     required: ["path"],
@@ -222,7 +220,7 @@ export const editTool = {
       replace_all: { type: "boolean", description: "Replace all occurrences (default false)" },
       edits: {
         type: "array",
-        description: "2026-08-31 工具顺手度：一次多文件原子替换——任一失败全不写（先全量检查所有替换可执行）。与 path/old_string/new_string 互斥。",
+        description: "Batch form — multiple edits in ONE call, atomic (any failure writes nothing; same-file entries apply serially, each based on the previous result). Use it for multiple changes to the same file AND for independent changes across multiple files — prefer one batched call over N single edits. Mutually exclusive with path/old_string/new_string.",
         items: {
           type: "object",
           properties: {
@@ -244,58 +242,22 @@ export const editTool = {
   },
   async execute(args, ctx) {
     // 2026-08-31 工具顺手度（用户批准）：数组形态——一次多文件原子替换
-    if (args.edits) {
-      if (!Array.isArray(args.edits) || args.edits.length === 0) {
-        throw new Error("edits must be a non-empty array of {path, old_string, new_string}")
-      }
-      if (args.path || args.old_string !== undefined || args.new_string !== undefined) {
-        throw new Error("edits array is mutually exclusive with path/old_string/new_string")
-      }
-      // 原子：先全量 read+match 检查（所有文件都能替换）——任一失败全不写
-      const prepared = []
-      for (const e of args.edits) {
-        if (!e.path) throw new Error("each edit must have a path")
-        if (!e.old_string) throw new Error(`edit for ${e.path}: old_string must not be empty`)
-        const abs = resolveInCwd(ctx, e.path)
-        const raw = await readFile(abs, "utf8")
-        const content = normalizeEOL(raw)
-        const occurrences = content.split(e.old_string).length - 1
-        if (occurrences === 0) {
-          throw new Error(
-            `edit aborted (atomic — no files written): old_string not found in ${e.path}\n` +
-            `  searched: "${e.old_string.slice(0, 100).split("\n")[0]}${e.old_string.length > 100 ? "…" : ""}"`
-          )
-        }
-        if (occurrences > 1 && !e.replace_all) {
-          throw new Error(
-            `edit aborted (atomic — no files written): old_string matches ${occurrences} times in ${e.path}; ` +
-            `provide more context or set replace_all`
-          )
-        }
-        const updated = e.replace_all
-          ? content.split(e.old_string).join(e.new_string)
-          : content.replace(e.old_string, () => e.new_string)
-        const matchIdx = content.indexOf(e.old_string)
-        const editStartLine = matchIdx >= 0 ? content.slice(0, matchIdx).split("\n").length : 1
-        const lineShift = e.new_string.split("\n").length - e.old_string.split("\n").length
-        prepared.push({ abs, path: e.path, raw, updated, editStartLine, lineShift, occurrences: e.replace_all ? occurrences : 1 })
-      }
-      // 全部检查通过——逐个写
-      const results = []
-      for (const p of prepared) {
-        await writeFile(p.abs, joinWithEol(normalizeEOL(p.updated).split("\n"), p.raw), "utf8")
-        recordWrite(p.abs, { type: "edit", startLine: p.editStartLine, shift: p.lineShift })
-        const withCtx = await appendWriteContext(p.abs, p.editStartLine, `Edited ${p.path}: replaced ${p.occurrences} occurrence(s)`)
-        results.push(withCtx)
-      }
-      return results.join("\n")
-    }
+    // （应用逻辑在 edit-batch.mjs——2026-09-01 拆出，500 行硬限，先例 git-ext.mjs）
+    if (args.edits) return applyEditBatch(args, ctx)
 
     // 单文件（现状路径）
     const abs = resolveInCwd(ctx, args.path)
     if (!args.old_string) {
       throw new Error("old_string must not be empty (empty string matches everywhere and would corrupt the file)")
     }
+    // #5（2026-09-01 交付评审尾巴）：new_string 非字符串（含 undefined）在写盘前拒绝——
+    // 原缺陷：replace 回调返回 undefined 被字符串化成 "undefined" 写入盘，随后
+    // args.new_string.split 才 TypeError——文件已损坏 + 错误信息不知所云。
+    if (typeof args.new_string !== "string") {
+      throw new Error(
+        `new_string must be a string${args.new_string === undefined ? " (missing)" : ` (got ${typeof args.new_string})`} — nothing written`,
+      )
+    }
     const raw = await readFile(abs, "utf8")
     const content = normalizeEOL(raw)
     const occurrences = content.split(args.old_string).length - 1