thincoder 0.12.58 → 0.12.60

package/src/tools/ops.mjs

@@ -1,11 +1,14 @@
 /**
  * ops.mjs — operational tools: file_ops (move/copy/rename), process (list),
- * get_current_time. Each exists so the model reaches for a dedicated tool
- * instead of shelling out to `bash` for the same operation (parity with thinworker).
+ * get_current_time, wait_for (condition wait). Each exists so the model reaches
+ * for a dedicated tool instead of shelling out to `bash` for the same operation
+ * (parity with thinworker).
  */
 import { DESC, resolveInCwd, truncate } from "./shared.mjs"
 import { cp, rename, rm } from "node:fs/promises"
+import { existsSync } from "node:fs"
 import { execFileSync } from "node:child_process"
+import net from "node:net"
 
 // ─── file_ops ──────────────────────────────────────────────────
 
@@ -111,4 +114,173 @@ export const getCurrentTimeTool = {
     const days = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"]
     return `Date: ${now.toISOString()} (UTC)\nTimezone: ${tz}\nWeekday: ${days[now.getDay()]}\nLocal: ${now.toLocaleString()}`
   },
-}
+}
+
+// ─── wait_for ───────────────────────────────────────────────────
+
+/** wait_for bounds (TOOLS.md §16): a BUILT-IN ceiling replaces the unbounded
+ *  sleep-then-wait — timeout_ms defaults to 30s (config.json agent.waitForTimeoutMs
+ *  overrides), capped at WAIT_FOR_MAX_TIMEOUT_MS (600s — the execute-tool timeout
+ *  convention, Math.min(t, 600_000)); interval_ms defaults to 1s with a 100ms
+ *  floor so polling never busy-spins. */
+export const WAIT_FOR_DEFAULT_TIMEOUT_MS = 30_000
+export const WAIT_FOR_MAX_TIMEOUT_MS = 600_000
+export const WAIT_FOR_DEFAULT_INTERVAL_MS = 1_000
+export const WAIT_FOR_MIN_INTERVAL_MS = 100
+
+// Condition-source seam (§16 评审 #4): production uses the real evaluator
+// (evaluateWaitForCondition); tests inject a deterministic fake source via
+// setWaitForConditionSource (default null — production path unchanged).
+let injectedConditionSource = null
+export function setWaitForConditionSource(source) {
+  injectedConditionSource = typeof source === "function" ? source : null
+}
+
+/** Parse a wait_for condition into { kind, arg }. Unknown conditions are an
+ *  EXPLICIT error enumerating the supported forms (评审 #2 — never a silent
+ *  wait on a misspelled condition). */
+export function parseWaitForCondition(condition) {
+  const c = String(condition ?? "").trim()
+  let m
+  if (c === "advisor settled") return { kind: "advisor", arg: null }
+  if (c === "consult done") return { kind: "consult", arg: null }
+  if ((m = c.match(/^subagent id:\s*(\d+) done$/))) return { kind: "subagent", arg: String(Number(m[1])) }
+  if ((m = c.match(/^file exists:\s*(.+)$/))) return { kind: "file", arg: m[1].trim() }
+  if ((m = c.match(/^port open:\s*(\d+)$/))) return { kind: "port", arg: Number(m[1]) }
+  throw new Error(
+    `wait_for: unsupported condition "${c}" — supported: "advisor settled", "subagent id:N done", "consult done", "file exists:path", "port open:N"`,
+  )
+}
+
+/** Async-subagent pool of an agent — ctx.agent 可达性（评审 #1）：dispatch 把
+ *  agent 实例放进工具 ctx（agent/dispatch.mjs toolCtx.agent），池挂在 agent 上
+ *  （深度 0 的 VS Code 侧 agent._asyncSubagents 与 history._asyncSubagents 同
+ *  一 Map——见 agent.mjs；CLI 侧直接是 agent._asyncSubagents）。 */
+function asyncPool(agent) {
+  if (!agent) return new Map()
+  if (agent._asyncSubagents instanceof Map) return agent._asyncSubagents
+  return agent.history?._asyncSubagents instanceof Map ? agent.history._asyncSubagents : new Map()
+}
+
+/** "subagent id:N done" — the async entry for N settled (status done / done flag)
+ *  or already left the pool (moved to pending results / digested / never spawned —
+ *  nothing is left to wait on). Absent ids are done by vacuity: the model waits on
+ *  ids its own spawn ack just returned, so an id no longer in the pool means done.
+ *  Dual key lookup (2026-09-06 advisor #1): VS Code pool keys are the numeric
+ *  spawn-time id, the CLI keys them as String(id) — accept both. */
+function asyncEntryDone(agent, id) {
+  const pool = asyncPool(agent)
+  const key = String(id)
+  const entry = pool.get(key) ?? pool.get(Number(key)) ?? null
+  if (!entry) return true
+  return entry.done === true || entry.status === "done"
+}
+
+/** Any async entry matching pred that is still running/queued (not done). */
+function hasRunningAsync(agent, pred) {
+  for (const e of asyncPool(agent).values()) {
+    if (pred(e) && !(e.done === true || e.status === "done")) return true
+  }
+  return false
+}
+
+/** "consult done" — every consult session has drained (pending 0) or was
+ *  explicitly stopped (its children were aborted). No sessions → true (vacuously). */
+function consultAllDone(agent) {
+  const sessions = agent?._consultSessions
+  if (!sessions || sessions.size === 0) return true
+  for (const s of sessions.values()) {
+    if (!s.stopped && (s.pending ?? 0) > 0) return false
+  }
+  return true
+}
+
+/** "port open:N" — 127.0.0.1 probe with a short connect timeout (never hangs a poll). */
+function portOpenProbe(port) {
+  return new Promise((resolve) => {
+    const socket = net.connect({ host: "127.0.0.1", port, timeout: 400 })
+    let settled = false
+    const finish = (v) => {
+      if (settled) return
+      settled = true
+      socket.destroy()
+      resolve(v)
+    }
+    socket.once("connect", () => finish(true))
+    socket.once("error", () => finish(false))
+    socket.once("timeout", () => finish(false))
+  })
+}
+
+/** Real condition evaluator (production path) — returns a boolean; throws on an
+ *  unsupported condition string. Polling is async (await setTimeout) — the event
+ *  loop keeps running so background async work (subagents/consult) can settle
+ *  between polls (评审 #1 — no blocking spin). */
+export async function evaluateWaitForCondition(condition, ctx) {
+  const parsed = parseWaitForCondition(condition)
+  const agent = ctx?.agent
+  switch (parsed.kind) {
+    case "advisor":
+      // Advisor reviews run as blocking tool calls (runAdvisorReview) or as
+      // advisor-role async children — "settled" = no advisor-role entry still
+      // running/queued in the async pool.
+      return !hasRunningAsync(agent, (e) => e.role === "advisor")
+    case "subagent":
+      return asyncEntryDone(agent, parsed.arg)
+    case "consult":
+      return consultAllDone(agent)
+    case "file":
+      return existsSync(resolveInCwd(ctx, parsed.arg))
+    case "port":
+      return await portOpenProbe(parsed.arg)
+    default:
+      return false
+  }
+}
+
+async function evalConditionSource(condition, ctx) {
+  if (injectedConditionSource) return injectedConditionSource(condition, ctx)
+  return evaluateWaitForCondition(condition, ctx)
+}
+
+export const waitForTool = {
+  name: "wait_for",
+  description: DESC("wait_for"),
+  parameters: {
+    type: "object",
+    properties: {
+      condition: { type: "string", description: 'Condition expression — "advisor settled", "subagent id:N done", "consult done", "file exists:path", "port open:N"' },
+      interval_ms: { type: "integer", description: "Poll interval in ms (default 1000, floor 100)" },
+      timeout_ms: { type: "integer", description: "Overall timeout in ms (default 30000, cap 600000; config.json agent.waitForTimeoutMs overrides the default)" },
+    },
+    required: ["condition"],
+  },
+  readonly: true,
+  async execute(args, ctx = {}) {
+    const condition = typeof args?.condition === "string" ? args.condition.trim() : ""
+    if (!condition) return "Error: condition is required"
+    const intervalMs = Math.max(WAIT_FOR_MIN_INTERVAL_MS, Math.floor(args?.interval_ms ?? WAIT_FOR_DEFAULT_INTERVAL_MS))
+    const cfgTimeout = ctx?.agent?.config?.agent?.waitForTimeoutMs
+    const base = Number.isFinite(args?.timeout_ms)
+      ? args.timeout_ms
+      : Number.isFinite(cfgTimeout) && cfgTimeout > 0 ? cfgTimeout : WAIT_FOR_DEFAULT_TIMEOUT_MS
+    const timeoutMs = Math.min(Math.max(1, Math.floor(base)), WAIT_FOR_MAX_TIMEOUT_MS)
+    const started = Date.now()
+    let polls = 0
+    for (;;) {
+      // Cancel/interrupt-safe exit（T-W7）：Ctrl+C / 定向 abort 传播——不吞信号、
+      // 不把用户停变成工具错误（dispatch 对 aborted signal 原样再抛）。
+      if (ctx.signal?.aborted) throw new Error("wait_for: interrupted by abort signal")
+      polls++
+      const ok = await evalConditionSource(condition, ctx)
+      if (ok === true) {
+        return `wait_for: condition satisfied after ${Date.now() - started}ms (${polls} check${polls === 1 ? "" : "s"}): "${condition}"`
+      }
+      const remaining = started + timeoutMs - Date.now()
+      if (remaining <= 0) {
+        return `wait_for: timed out after ${timeoutMs}ms waiting for "${condition}" (${polls} checks — condition never became true)`
+      }
+      await new Promise((r) => setTimeout(r, Math.min(intervalMs, remaining)))
+    }
+  },
+}

package/src/tools/patch.mjs

@@ -15,8 +15,23 @@ import { relative, dirname } from "node:path";
 /**
  * Parse a unified diff: returns [{ path, isNew, hunks: [{ ops: [{type:" "|"-"|"+", text}] }] }]
  * Consume hunk lines by the line counts in the @@ header — LLMs often strip context blank lines to pure empty lines,
- * so we use counts rather than first characters to determine hunk boundaries
+ * so we use counts rather than first characters to determine hunk boundaries.
+ * APPLY-PATCH.md §3: a bare "@@" header (no coordinates) is accepted — the hunk body runs until the next hunk/file header
+ * ("@@" / "--- " / "+++ " / "diff " / "index "), purely located by its ops.
  */
+/**
+ * P15.10（2026-09-05 用户裁定——「符合模型直觉」）：文件头判定——
+ * 完整头（`--- x` 后随 `+++ `）任意老路径形态均认（git 规范）；
+ * 容缺头（`+++ b/<path>` 配对行省略——模型单文件补丁自然形态）仅认 a//b/ 前缀——
+ * newPath 推导 = oldPath；`/dev/null` 容缺仍拒（新文件名从 --- 侧不可推导——parsePatch 内特报）；
+ * 其他 `--- x` = 普通删行内容（行首标记 - + 内容 `-- x`）——不是文件头——hunk 体不得误断。
+ */
+function isFileHeader(line, nextLine) {
+  if (!line.startsWith("--- ")) return false
+  if (nextLine?.startsWith("+++ ")) return true
+  return /^[ab]\//.test(line.slice(4).trim())
+}
+
 function parsePatch(patch) {
   // Patch text often comes from CRLF terminals/model output; trailing \r mixed into hunk content breaks context matching, strip uniformly
   const lines = patch.replace(/\r(?=\n|$)/g, "").split("\n")
@@ -29,18 +44,69 @@ function parsePatch(patch) {
     if (line.startsWith("--- ")) {
       const oldPath = line.slice(4).trim()
       const plus = lines[i + 1]
-      if (!plus?.startsWith("+++ ")) throw new Error(`Malformed patch: expected "+++" line after "${line}"`)
-      const newPath = plus.slice(4).trim()
-      if (newPath === "/dev/null") throw new Error("Deleting files via patch is not supported — use the delete tool")
-      cur = { path: stripPrefix(newPath), isNew: oldPath === "/dev/null", hunks: [] }
-      files.push(cur)
-      i += 2
-      continue
+      if (plus?.startsWith("+++ ")) {
+        const newPath = plus.slice(4).trim()
+        if (newPath === "/dev/null") throw new Error("Deleting files via patch is not supported — use the delete tool")
+        cur = { path: stripPrefix(newPath), isNew: oldPath === "/dev/null", hunks: [] }
+        files.push(cur)
+        i += 2
+        continue
+      }
+      // P15.10：容缺头——`--- a/<path>`（或 b/ 前缀）后直接跟 hunk = 对同路径的修改。
+      if (/^[ab]\//.test(oldPath)) {
+        cur = { path: stripPrefix(oldPath), isNew: false, hunks: [] }
+        files.push(cur)
+        i += 1
+        continue
+      }
+      if (oldPath === "/dev/null") {
+        throw new Error(`"--- /dev/null" needs a "+++ b/<path>" line naming the new file — the --- side does not carry the file name`)
+      }
+      throw new Error(`Malformed patch: expected "+++" line after "${line}"`)
     }
     if (line.startsWith("@@")) {
       if (!cur) throw new Error("Malformed patch: hunk header before any file header")
       const m = line.match(/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/)
-      if (!m) throw new Error(`Malformed patch: bad hunk header "${line}" (need @@ -old,count +new,count @@)`)
+      if (!m) {
+        // APPLY-PATCH.md §3：坐标裸 "@@" 头——hunk 完全靠操作行定位。
+        // 无行数可用：操作行以 " " / "-" / "+" 开头（空行宽容为上下文行），
+        // 直到下一个 hunk 头 / 文件头 "@@"/"--- "/"+++ "/"diff "/"index " 为止。
+        if (!/^@@(?: @@)?\s*$/.test(line)) {
+          throw new Error(`Malformed patch: bad hunk header "${line}" (need @@ -old,count +new,count @@ or bare @@)`)
+        }
+        const hunk = { ops: [] }
+        i++
+        while (i < lines.length) {
+          const hl = lines[i]
+          if (hl.startsWith("@") || isFileHeader(hl, lines[i + 1]) || hl.startsWith("+++ ") || hl.startsWith("diff ") || hl.startsWith("index ")) break
+          if (hl.startsWith("\\")) { i++; continue } // ""
+          // 宽容空行=上下文行——但 patch 文本末尾（或 hunk 之间/文件头之前）的 "" 是
+          // 分隔产物而非内容：仅当后继仍是操作行时才当作上下文消费。
+          // 复评 #1（2026-09-04）：文件头 "--- "/"+++ " 以 -/+ 开头会被 op 前缀判定误收——
+          // 文件头前的分隔空行不得吞成幽灵上下文行（会把 - 锚序列尾部拼上 ""——跨文件
+          // 零上下文 hunk 因此误报 not-found）。
+          const next = lines[i + 1]
+          if (hl === "" && (next == null || !/^[ +\-\\]/.test(next) || isFileHeader(next, lines[i + 2]) || next.startsWith("+++ "))) break
+          const tag = hl === "" ? " " : hl[0]
+          if (tag !== " " && tag !== "-" && tag !== "+") break // metadata / file section end
+          hunk.ops.push({ type: tag, text: hl === "" ? "" : hl.slice(1) })
+          i++
+        }
+        if (hunk.ops.length === 0) throw new Error(`Malformed patch: empty coordinate-less hunk "${line.trim()}"`)
+        const ctxCount = hunk.ops.filter((o) => o.type === " ").length
+        // §3 (APPLY-PATCH.md——2026-09-04)：context<2 且含 ≥1 个 - 行 → 接受——定位锚 = hunk 内
+        // 匹配行序列（空格上下文行 + - 行——按出现序）连续——唯一匹配即应用（applyHunks 既有锚匹配域——
+        // 多匹配 / not-found 语义不变）。0 上下文与 1 上下文同待遇（评审 #4a）。
+        // 纯 +（无 - 锚）且 context<2 仍拒——插入位置不可判——报错引导加锚（NF15.8c）。
+        const removedCount = hunk.ops.filter((o) => o.type === "-").length
+        if (ctxCount < 2 && removedCount === 0) {
+          throw new Error(
+            `Coordinate-less hunk ${cur.hunks.length + 1} in ${cur.path} has ${ctxCount} context line(s) — add more context lines`,
+          )
+        }
+        cur.hunks.push(hunk)
+        continue
+      }
       let oldNeed = m[1] == null ? 1 : Number(m[1])
       let newNeed = m[2] == null ? 1 : Number(m[2])
       const hunk = { ops: [] }
@@ -62,8 +128,10 @@ function parsePatch(patch) {
     }
     i++ // skip diff --git / index / blank lines and other metadata
   }
-  if (files.length === 0) throw new Error("No file changes found in patch (need --- / +++ headers)")
-  return files
+  // P15.10：容缺/完整空段头（头后无任何 hunk）过滤——不虚报 touchedPaths、不触发无谓 read+write
+  const withHunks = files.filter((f) => f.hunks.length > 0)
+  if (withHunks.length === 0) throw new Error("No file changes found in patch (need --- / +++ headers)")
+  return withHunks
 }
 
 /** Apply hunks sequentially onto an in-memory line array; any failure throws (caller guarantees nothing is written to disk). Ignores trailing \r when comparing; context lines retain original bytes */
@@ -84,7 +152,10 @@ function applyHunks(fileLines, hunks, eol, path) {
       const preview = oldSeq.slice(0, 3).join(" ⏎ ")
       throw new Error(`Hunk ${h + 1} in ${path} does not apply — context not found: "${preview}${oldSeq.length > 3 ? "…" : ""}". Read the file first and regenerate the patch from actual content.`)
     }
-    if (matches.length > 1) throw new Error(`Hunk ${h + 1} in ${path} matches ${matches.length} locations — add more context lines to make it unique`)
+    if (matches.length > 1) {
+      const preview = oldSeq.slice(0, 3).join(" ⏎ ")
+      throw new Error(`Hunk ${h + 1} in ${path} matches ${matches.length} locations — add more context lines to make it unique. Anchor: "${preview}${oldSeq.length > 3 ? "…" : ""}"`)
+    }
     const pos = matches[0]
     const out = []
     let src = pos
@@ -103,7 +174,7 @@ export const applyPatchTool = {
   parameters: {
     type: "object",
     properties: {
-      patch: { type: "string", description: "Unified diff. May span multiple files (multiple --- / +++ header pairs — including creating MULTIPLE new files via --- /dev/null); --- / +++ headers per file, @@ -old,count +new,count @@ hunks." },
+      patch: { type: "string", description: "Unified diff. May span multiple files (multiple --- / +++ header pairs — including creating MULTIPLE new files via --- /dev/null); --- / +++ headers per file, @@ -old,count +new,count @@ hunks (a bare @@ header is also accepted — coordinate-less hunks are located by their anchor lines: context lines plus the removed (-) lines, matched as a contiguous sequence — a unique match applies; a zero/one-context hunk is accepted only when it removes (-) at least one line and that anchor sequence is unique, while anchor-free pure-+ (insert) hunks need at least 2 context lines). The +++ b/<path> pair may be omitted for existing files — a lone --- a/<path> (or --- b/<path>) header followed directly by hunks applies to that path (new files still need --- /dev/null + +++ b/<path>)." },
     },
     required: ["patch"],
   },

package/src/tools/question.md

@@ -7,5 +7,9 @@ Parameters:
 Notes:
 - The agent loop pauses until the user answers
 - The answer is injected as the next user message
+- Returns the user's answer — the chosen option or free text — as the next message; the loop resumes when it arrives.
 - Use sparingly — prefer making reasonable decisions when possible
-- After receiving an answer about a design convention, tool preference, or recurring pattern: save it with memory_put. This prevents asking the same question in future sessions — the user shouldn't have to repeat their preferences.
+- Ask ONE question per call — never bundle multiple sub-questions into one question string; ask the next one after the answer arrives.
+- Keep the question text short — one or two sentences. Background, context, and analysis belong in your normal reply text, NOT in the question.
+- Routine confirmations (confirm gates) belong in your plain reply text — the user answers in their next message. Use this tool ONLY when you need the user's decision or input to proceed.
+- After receiving an answer about a design convention, tool preference, or recurring pattern: save it with the memory tool (action: put). This prevents asking the same question in future sessions — the user shouldn't have to repeat their preferences.

package/src/tools/repomap.mjs

@@ -297,7 +297,7 @@ export function repoOutlineTool(db, cwd) {
   return {
     name: "repo_outline",
     description:
-      "Show the project's file dependency outline: which files import/export from which, and what symbols they export. Use when you need to understand the project structure, find where a function is defined, or see what files depend on a module. Pass a path to focus on a single file's relationships.",
+      "Show the project's file dependency outline: which files import/export from which, and what symbols they export. Use when you need to understand the project structure, find where a function is defined, or see what files depend on a module. Pass a path to focus on a single file's relationships. Find code by keyword or snippet with code_search.",
     parameters: {
       type: "object",
       properties: {

package/src/tools/shared.mjs

@@ -296,8 +296,8 @@ export function shellSegments(command) {
 
 /**
  * Blank out quoted regions (single/double/backtick) with spaces, preserving length.
- * Lets safety checks ignore shell metacharacters inside quoted script bodies —
- * e.g. `node -e "if (a > b) …"` comparisons are not redirections.
+ * Lets detectDanger ignore shell metacharacters inside quoted script bodies —
+ * e.g. `node -e "if (a > b) …"` comparisons are not danger signals.
  */
 function blankQuoted(command) {
   let out = ""
@@ -308,8 +308,8 @@ function blankQuoted(command) {
       if (ch === "\\" && quote !== "'") { out += " "; i++; out += " "; continue }
       if (ch === quote) { quote = null; out += " "; continue }
       // Backticks are COMMAND SUBSTITUTION — the content executes, so it must
-      // stay visible to the redirection check (echo `cat > /tmp/x` writes a
-      // file). Only ' and " are literal regions.
+      // stay visible to detectDanger (echo `cat > /tmp/x` still runs). Only '
+      // and " are literal regions.
       out += quote === "`" ? ch : " "
     } else if (ch === "'" || ch === '"' || ch === "`") {
       quote = ch
@@ -321,14 +321,6 @@ function blankQuoted(command) {
   return out
 }
 
-/** Detect shell output/input redirection (> >> < followed by filename) outside quoted regions.
- *  Backtick contents count (command substitution executes); fd-prefixed forms
- *  (2> file, 1>> file) count too. */
-export function hasFileRedirection(command) {
-  const bare = blankQuoted(command)
-  return /(^|[\s;&|0-9])>{1,2}\s*\S/.test(bare) || /(^|[\s;&|0-9])<\s*\S/.test(bare)
-}
-
 /**
  * Whether a single command segment is destructive — ALWAYS FALSE (deliberate).
  *
@@ -371,19 +363,20 @@ export function detectDanger(command) {
 }
 
 
-/** Convert glob pattern to regex */
-export function globToRegex(pattern) {
-  // Sentinel chars: \u0001/\u0002 never appear in real glob patterns (they
-  // come from model output or the filesystem) — safe as **/ and ** placeholders.
-  const DS = "\u0001", DP = "\u0002"
-  const escaped = pattern
-    .replace(/\*\*\//g, DS).replace(/\*\*/g, DP)
-    .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-    .replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")
-    .replace(new RegExp(DS, "g"), "(?:.+/)?")
-    .replace(new RegExp(DP, "g"), ".*")
-  return new RegExp(`^${escaped}$`)
-}
+/** Glob dialect (TOOLS.md §17) lives in glob-dialect.mjs — single authority for
+ *  brace expansion / exclusion / explicit syntax errors (extracted 2026-09-06 —
+ *  advisor #5: shared.mjs exceeded 500 lines). Re-exported so existing importers
+ *  (system.mjs tools, ls filter, tests) keep their import paths unchanged. */
+export {
+  globToRegex,
+  splitGlobPatterns,
+  compileGlobMatchers,
+  GLOB_EXTGLOB_ERROR,
+  GLOB_EMPTY_BRACE_ERROR,
+  GLOB_UNCLOSED_BRACE_ERROR,
+  GLOB_NESTED_BRACE_ERROR,
+} from "./glob-dialect.mjs"
+
 
 /** Decode a numeric HTML entity to its code point — invalid/out-of-range
  *  values (e.g. &#999999999999;) must not throw RangeError; keep the source

package/src/tools/system.mjs

@@ -6,8 +6,9 @@ import {
   BASH_TIMEOUT_MS,
   IGNORED_DIRS,
   resolveInCwd,
-  hasFileRedirection,
   globToRegex,
+  splitGlobPatterns,
+  compileGlobMatchers,
   normalizeEOL,
 } from "./shared.mjs";
 import { spawn, execFileSync } from "node:child_process";
@@ -51,20 +52,6 @@ function posixSyntaxHint(command) {
 // bash — command execution with safety gates
 // ====================================================================
 
-/**
- * Pre-execution safety checks for bash commands.
- * Layers: file redirection (guides toward structured tools, not a security gate).
- * Destructive commands (rm -rf, DROP TABLE, ...) are deliberately NOT rejected:
- * a determined model bypasses text matching anyway — real security is at the
- * tool approval layer plus snapshot backups (gitGuardSnapshot / checkpoint).
- * Git destructive ops: snapshot-then-proceed, never block.
- */
-function checkBashSafety(command, cwd) {
-  if (hasFileRedirection(command)) {
-    throw new Error("File redirection via bash is not allowed — use the write/edit/insert_after tools instead")
-  }
-}
-
 /**
  * Build environment for child process.
  * Passes through all parent env vars, with non-interactive overrides (EDITOR/PAGER/TERM).
@@ -113,11 +100,12 @@ function killProcessTree(child) {
  * cannot help (it was taken before the code was written); only a snapshot taken
  * immediately before the destructive command can.
  *
- * This is layer 1 (defense in depth): a WIDE match that snapshots before the command
- * runs. Layer 2 (checkBashSafety) then rejects the command when uncommitted changes
- * exist — but a rejection alone is not enough: the model may retry a variant that
- * slips through the exact matcher (e.g. `git checkout HEAD -- .`), or run git outside
- * the bash tool. The snapshot taken here survives all of those paths.
+ * This is the defense-in-depth guard: a WIDE match that snapshots before the command
+ * runs — the command itself is NEVER blocked (a determined model bypasses text
+ * matching anyway; the real gate is the approval layer). A snapshot alone is not
+ * enough: the model may retry a variant that slips through the exact matcher
+ * (e.g. `git checkout HEAD -- .`), or run git outside the bash tool. The snapshot
+ * taken here survives all of those paths.
  *
  * Matching is intentionally WIDE (false positives are harmless — one extra snapshot;
  * a missed match is a data-loss disaster).
@@ -159,6 +147,11 @@ function runBash(command, cwd, { timeout, signal, onOutput, shell }) {
       detached: process.platform !== "win32",
       stdio: ["ignore", "pipe", "pipe"],
       env: buildBashEnv(),
+      // 双保险（2026-09-05——裸 spawn 无 signal 教训：abort 只靠 killTree 手动杀——taskkill
+      // best-effort 可能失败/竞态）——Node signal option = 第一道（abort 时自动杀**直接**子
+      // 进程——cmd——语义保证）；killTree 仍是必需兜底（孙进程握管道使 close 不触发——见
+      // L191 注释——spawn 级 kill 不达孙进程）
+      ...(signal ? { signal } : {}),
     })
 
     const killTree = () => killProcessTree(child)
@@ -195,10 +188,18 @@ function runBash(command, cwd, { timeout, signal, onOutput, shell }) {
       settled = true
       clearTimeout(timer)
       clearTimeout(graceTimer)
+      // 2026-09-05（advisor 🟡#2）：收尾移除 abort 监听器——ctx.signal 为长生命周期对象，
+      // 残留 once 监听器每次 bash 调用累积（闭包持有 child/输出缓冲直到 abort 才释放）
+      if (signal) signal.removeEventListener("abort", killTree)
       resolve(result)
     }
 
     child.on("error", (error) => {
+      // signal 双保险（2026-09-05）：abort 时 Node signal option 杀直接子进程 → 本事件
+      // 以 AbortError 先触发——**跳过 finish**（不 settled）——exit 事件随后必到（实证
+      // 2ms 内）走 L195 分支带已收集输出收尾（user interrupted——不丢 partial）；
+      // 非 abort 的真 spawn 错误（command not found 等）保持原分支
+      if (error.name === "AbortError") return
       finish(truncate(`Command failed: ${error.message}\n[stdout]:\n${outBuf || "(empty)"}`))
     })
 
@@ -266,7 +267,6 @@ export const bashTool = {
     // guard anyway. Instead: snapshot every uncommitted file first, then ALLOW
     // the command. The snapshot makes the rollback reversible (defense in depth:
     // the wide matcher also covers variants like `git checkout HEAD -- .`).
-    checkBashSafety(args.command, ctx.cwd)
     const guard = await gitGuardSnapshot(args.command, ctx.cwd)
     const result = await runBash(args.command, ctx.cwd, {
       timeout: args.timeout ?? BASH_TIMEOUT_MS,
@@ -289,7 +289,7 @@ export const globTool = {
   parameters: {
     type: "object",
     properties: {
-      pattern: { type: "string", description: "Glob pattern" },
+      pattern: { type: "string", description: "Glob pattern — supports **, *, ?, [..], {a,b} braces, and space-separated exclusion (\"**/*.js !test/**\")" },
       path: { type: "string", description: "Directory to search in (default cwd)" },
     },
     required: ["pattern"],
@@ -297,10 +297,19 @@ export const globTool = {
   readonly: true,
   async execute(args, ctx) {
     const base = resolveInCwd(ctx, args.path ?? ".")
-    const regex = globToRegex(args.pattern)
+    // §17 调用侧拆分（评审 #5 职责分层）：空格分隔 include !exclude 多模式在这里拆；
+    // globToRegex 只收单个模式（数组由 compileGlobMatchers 收）。
+    let match
+    try {
+      const parts = splitGlobPatterns(args.pattern)
+      if (parts.length === 0) return "Error: pattern is required"
+      match = compileGlobMatchers(parts).test
+    } catch (e) {
+      return `glob error: invalid pattern "${args.pattern}": ${e.message}`
+    }
     const results = []
     for await (const relPath of walkFiles(base)) {
-      if (regex.test(relPath)) {
+      if (match(relPath)) {
         results.push(relPath)
         if (results.length >= 1000) break
       }
@@ -343,7 +352,7 @@ export const grepTool = {
     properties: {
       pattern: { type: "string", description: "Regular expression, or a literal string when literal=true" },
       path: { type: "string", description: "Directory or file to search (default cwd)" },
-      glob: { type: "string", description: "Only search files matching this glob (e.g. '*.mjs')" },
+      glob: { type: "string", description: "Only search files matching this glob — supports **, *, ?, [..], {a,b} braces and space-separated exclusion (\"**/*.js !test/**\")" },
       ignoreCase: { type: "boolean", description: "Case-insensitive match (default false)" },
       literal: { type: "boolean", description: "Literal string match — no regex interpretation (default false)" },
       before: { type: "integer", description: "Lines of context to show before each match (grep -B). Default 0" },
@@ -361,7 +370,16 @@ export const grepTool = {
     } catch (e) {
       throw new Error(`grep pattern /${args.pattern}/ is not a valid regex: ${e.message}`, { cause: e })
     }
-    const fileFilter = args.glob ? globToRegex(args.glob) : null
+    // §17 调用侧拆分：glob 参数支持空格分隔 include !exclude 多模式（include/exclude 求交）。
+    let fileTest = null
+    if (args.glob) {
+      try {
+        const parts = splitGlobPatterns(args.glob)
+        if (parts.length > 0) fileTest = compileGlobMatchers(parts).test
+      } catch (e) {
+        throw new Error(`grep glob /${args.glob}/ is invalid: ${e.message}`, { cause: e })
+      }
+    }
     const before = Math.max(0, Math.floor(args.before ?? 0))
     const after = Math.max(0, Math.floor(args.after ?? 0))
     const wantCtx = before > 0 || after > 0
@@ -388,13 +406,15 @@ export const grepTool = {
       }
     }
 
-    async function walk(target) {
+    async function walk(target, rel) {
       if (hits.length >= 200) return
       // Use lstat to avoid following symlinks — prevents ./evil → /etc from making grep scan the entire system
       let s
       try { s = await lstat(target) } catch { return }
       if (!s.isDirectory()) {
-        if (!fileFilter || fileFilter.test(target.split(/[\\/]/).pop())) await search(target)
+        // rel 为相对搜索基的路径（排除前缀如 !test/** 必须按目录路径作用——不能用裸文件名）；
+        // 单文件目标（path 指向文件）时 rel 为空 → 退化为按文件名过滤（既有语义）。
+        if (!fileTest || fileTest(rel || target.split(/[\\/]/).pop())) await search(target)
         return
       }
       let entries
@@ -405,11 +425,11 @@ export const grepTool = {
       }
       for (const e of entries) {
         if (e.isDirectory() && IGNORED_DIRS.has(e.name)) continue
-        await walk(join(target, e.name))
+        await walk(join(target, e.name), rel ? `${rel}/${e.name}` : e.name)
       }
     }
 
-    await walk(base)
+    await walk(base, "")
     if (hits.length === 0) return "(no matches)"
 
     // No context: keep original path:line: content format

package/src/tools/tree.md

@@ -10,4 +10,5 @@ Parameters:
 Notes:
 - Capped at 200 entries.
 - Directories end with `/`; tree-drawing uses `├──`/`└──`/`│`.
-- Use depth for a shallow overview; use `ls` for one directory, `glob` for a specific file pattern.
+- Use depth for a shallow overview; use `ls` for one directory, `glob` for a specific file pattern.
+- Returns the directory text tree — directories first (`dir/`), files after, both sorted, capped at 200 entries.

package/src/tools/wait_for.md

@@ -0,0 +1,22 @@
+Wait until a condition becomes true — polls the condition every interval_ms and returns as soon as it holds or the timeout_ms ceiling passes. Use it ONLY for genuinely asynchronous waits: an async subagent/consult still settling, a file appearing, a port opening. Synchronous tools (advisor, blocking subagent spawn) return when done — waiting after them is NOT needed and wastes time.
+
+Parameters:
+- condition (required): a semantic condition expression:
+  - `advisor settled` — an in-flight advisor review session has finished (async advisor-role children settled)
+  - `subagent id:N done` — async subagent N (the id your async spawn ack returned) has settled
+  - `consult done` — every consult_start session has drained
+  - `file exists:path` — the file at path exists (path relative to cwd)
+  - `port open:N` — something is listening on 127.0.0.1 port N
+  - The agent-internal conditions (advisor / subagent / consult) apply to ASYNC sessions only — a synchronous call already completed before it returned and has nothing to wait for. An unknown condition is an explicit error (`wait_for: unsupported condition "..."` — the supported forms are listed above), never a silent wait.
+- interval_ms: poll interval (default 1000, floor 100 — polling never busy-spins)
+- timeout_ms: overall ceiling (default 30000; config.json `agent.waitForTimeoutMs` overrides the default; hard cap 600000 like the execute tool)
+
+Returns:
+- `wait_for: condition satisfied after Nms (N checks): "<condition>"` — condition held
+- `wait_for: timed out after Nms waiting for "<condition>" ...` — ceiling passed with the condition still false (never burns beyond the ceiling)
+- interrupts (Ctrl+C / cancel) exit immediately; malformed conditions and unsupported syntax error out explicitly
+
+Notes:
+- Read-only and non-destructive — it only observes (agent pools, the filesystem, a local port probe).
+- Blocking by design — call it ALONE in a turn, not batched with calls that depend on its result.
+- Do not use it to wait after synchronous tools (advisor / blocking subagent spawn / verify return only when done).