thincoder 0.8.13 → 0.10.0

package/README.md

@@ -205,6 +205,22 @@ Code conventions: pure `.mjs`, no semicolons, no npm dependencies allowed (inclu
 
 ## Changelog
 
+### 0.10.0 (2026-07)
+- **LSP tool** — `lsp` tool provides code intelligence via Language Server Protocol: go-to-definition, find-references, hover info, document symbols, diagnostics. Zero-dependency JSON-RPC 2.0 over stdio client. Lazy-starts language servers on first call. Configurable via `lsp.servers` in config.json (defaults: `typescript-language-server` for JS/TS, `pyright-langserver` for Python).
+- **Smart context: compaction checkpoint** — `compressIfNeeded` now auto-creates a git checkpoint before compaction. A checkpoint reference is injected after compaction so the model can reconstruct context from git diff + recent messages + task progress. Prevents information loss during long sessions.
+- **CodeMode: sandboxed JS execution** — `execute` tool backed by `vm.Script.runInNewContext`. Compose multiple file operations (read/write/glob/grep/log) into a single script, reducing API round-trips and keeping intermediate results out of context. Sandbox strips all Node APIs, limits output to 50KB, enforces 30s timeout, and blocks private IPs in fetch. Script size capped at 50KB.
+
+### 0.9.0 (2026-07)
+- **Config JSON Schema** — `saveConfig` auto-injects `$schema` reference; `docs/schemas/config.schema.json` provides editor autocompletion/validation for all config fields including the new `hooks` section.
+- **Lifecycle Hooks** — `PreToolUse` / `PostToolUse` / `PostToolUseFailure` / `Notification` events. User-defined shell commands in config, with per-tool regex matching, timeout control, and `block`/`allow`/`notify` actions. Implemented in `src/hooks.mjs`, integrated into tool dispatch.
+- **Built-in Skills (5)** — `pdf-create`, `xlsx-create`, `frontend-design`, `code-review`, `api-design` ship with the installation. Each is a standalone markdown instruction file using zero-dependency approaches (Chrome headless for PDF, PowerShell for Excel, etc.).
+- **Conversation message folding** — Long tool result blocks (>8 consecutive dim lines) auto-collapse to first 2 lines + "… N more lines — Enter to expand". `/fold on|off` toggles globally.
+- **Tree-shaped tasks** — `checklist` tool now supports hierarchical task IDs (`T1`, `T1.1`, `T1.2.1`) with auto-assigned numbering. `add` accepts `parent` parameter for subtree positioning. Indentation-based persistence in `checklist.md`.
+- **AI-native MCP config** — `/mcp add` picker now includes "Describe with AI" option. Describe a server in natural language → model generates config JSON → preview + confirm → save and connect.
+- **Goal judge model** — `goal complete` now runs an independent LLM check: goal criteria + recent agent activity → judge model verifies YES/NO. Prevents false completion claims during autonomous work.
+- **`/undo` command** — Tracks up to 50 write/edit/delete operations in `agent._undoStack`. `/undo` opens a picker showing each operation's file and original content size. Select to revert.
+- **Roadmap**: LSP tool, intelligent context management (checkpoint-based reconstruction), and CodeMode sandboxed JS are planned for 0.10.0.
+
 ### 0.8.13 (2026-07)
 - **TUI: incremental rendering** — panel-level cache (`panelCache`) with sync-update bracketing (`DECSET 2026`). Only redraws changed panels, eliminating flicker. `saveCursor`/`restoreCursor` for efficient cursor positioning. Panel order reorganized: `header → conversation → subagent → output → todo → picker → permission → queue → input → status`.
 - **Ctrl+I inject resume** — Ctrl+I (or Tab during processing) now properly interrupts, injects the message, and *resumes* the agent loop. Controller is recreated after abort. Added active signal check in SSE read loop for faster abort on Windows.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.8.13",
+  "version": "0.10.0",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",

package/src/agent/dispatch.mjs

@@ -2,6 +2,8 @@
  * agent/dispatch.mjs — two-phase tool call execution
  */
 import { offloadToolResult } from "./helpers.mjs"
+import { runHooks } from "../hooks.mjs"
+import { snapshotForUndo } from "../tui/cmd-undo.mjs"
 import { writeFileSync, mkdirSync, existsSync } from "node:fs"
 import { join } from "node:path"
 import { homedir } from "node:os"
@@ -80,6 +82,13 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
     }
 
     callbacks.onToolCall?.(toolCall.name, args)
+
+    // PreToolUse hooks: allow user scripts to gate tool execution
+    if (!(await runHooks("PreToolUse", { agent, toolName: toolCall.name, toolArgs: args }))) {
+      prepared.push({ toolCall, tool, denied: true, reason: "blocked by PreToolUse hook" })
+      continue
+    }
+
     prepared.push({ toolCall, tool, args })
   }
 
@@ -91,11 +100,17 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
         ? "Error: plan mode is active — only read-only tools are allowed. Exit plan mode first."
         : item.reason === "denied by user"
           ? "Error: permission denied by user"
-          : "Error: no permission handler configured — this tool requires user approval but the current context doesn't support interaction (e.g. subagent or non-TUI mode)"
+          : item.reason === "blocked by PreToolUse hook"
+            ? "Error: blocked by PreToolUse hook"
+            : "Error: no permission handler configured — this tool requires user approval but the current context doesn't support interaction (e.g. subagent or non-TUI mode)"
       return { ...item, result: reason, ok: false }
     }
     try {
-      if (item.tool.outputPanel) callbacks.setupOutputPanel?.(item.toolCall.name)
+      // Snapshot for undo before side-effect tools
+      if (item.tool?.outputPanel) callbacks.setupOutputPanel?.(item.toolCall.name)
+      if (!item.tool?.readonly && item.args) {
+        snapshotForUndo(agent, item.toolCall.name, item.args, agent.cwd)
+      }
       const rawResult = await item.tool.execute(item.args, {
         cwd: agent.cwd,
         agent,
@@ -110,10 +125,13 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       const raw = String(rawResult)
       const result = item.toolCall.name === "read_image" ? raw : await offloadToolResult(raw, item.toolCall.id)
       callbacks.onToolResult?.(item.toolCall.name, result)
+      // PostToolUse hooks: fire-and-forget (result not awaited on hook failure)
+      runHooks("PostToolUse", { agent, toolName: item.toolCall.name, toolArgs: item.args, result: raw }).catch(() => {})
       return { ...item, result, ok: true }
     } catch (error) {
       // Persist to ~/.thincoder/tool-errors/ for post-mortem; only pass message to the model (stack traces confuse LLMs and may leak paths)
       logToolError(item.toolCall.name, item.args, error)
+      runHooks("PostToolUseFailure", { agent, toolName: item.toolCall.name, toolArgs: item.args, error }).catch(() => {})
       return { ...item, result: `Error: ${error.message}`, ok: false }
     }
   }

package/src/agent-tools/goal.mjs

@@ -52,8 +52,45 @@ export const goalTool = {
       if (agent._mutatedThisRun && !agent._verifiedThisRun) {
         return "Error: files were modified but verify has not run. Run the check your criteria names AND the verify tool before marking the goal complete — false completion is the worst outcome of autonomous work."
       }
+
+      // Independent judge: verify the goal was actually achieved
+      // Only applies when the agent is at depth 0 (not a subagent) and has history to review
+      if (ctx.depth === 0 && agent.history.length > 2) {
+        try {
+          // Extract recent activity: last 4 assistant messages (summarizing what was done)
+          const recent = agent.history.filter(m => m.role === "assistant").slice(-4)
+          const activity = recent.map(m => (m.content ?? "").slice(0, 500)).join("\n---\n")
+          const { chat } = await import("../provider/index.mjs")
+          const judgeRes = await chat(agent.provider, {
+            messages: [{
+              role: "user",
+              content: `You are an independent goal judge. Evaluate whether this goal has been achieved based on the agent's activity.
+
+Goal: ${agent.goal.objective}
+Success criteria: ${agent.goal.criteria}
+
+Recent agent activity:
+${activity || "(no activity recorded)"}
+
+Has this goal been achieved? Answer ONLY "YES" or "NO" followed by a one-sentence reason.`,
+            }],
+            tools: [],
+            signal: AbortSignal.timeout(10_000),
+          })
+          const verdict = (judgeRes.content ?? "").trim()
+          if (verdict.toUpperCase().startsWith("NO")) {
+            return `Goal NOT complete (judge says NO): ${verdict.slice(2).trim()}\n\nContinue working or report blocked if this is a true impasse.`
+          }
+          if (!verdict.toUpperCase().startsWith("YES")) {
+            return `Goal completion unverified — judge response ambiguous: "${verdict.slice(0, 200)}". Re-check your criteria and try again with clear evidence.`
+          }
+        } catch {
+          // Judge unavailable — allow completion but note it
+        }
+      }
+
       agent.goal.status = "complete"
-      return `Goal marked complete: ${agent.goal.objective}\nIn your next message, summarize the evidence (what check ran, what it showed) — the user should be able to audit this claim.`
+      return `Goal verified complete ✓: ${agent.goal.objective}\nIn your next message, summarize the evidence (what check ran, what it showed) — the user should be able to audit this claim.`
     }
     if (args.action === "blocked") {
       if (!args.reason) return "Error: 'reason' required for 'blocked' action."

package/src/config.mjs

@@ -218,6 +218,8 @@ export function loadConfig() {
  */
 export function saveConfig(config) {
   mkdirSync(configDir, { recursive: true })
+  // Inject $schema for editor autocompletion/validation (strip on load)
+  config.$schema = "https://thincoder.dev/schemas/config.json"
   // 0600: config.json contains API keys, must not be world-readable (POSIX; chmod is best-effort on Windows)
   writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", { encoding: "utf8", mode: 0o600 })
   try { chmodSync(configPath, 0o600) } catch { /* may fail on Windows, ignore */ }

package/src/context.mjs

@@ -178,7 +178,25 @@ export async function compressIfNeeded(agent, threshold, callbacks) {
     onReasoning: callbacks?.onReasoning,
   })
 
+  // Auto-checkpoint before compaction: snapshot current state so the model can
+  // reconstruct context from git diff + recent messages + task progress later.
+  let cpId = null
+  try {
+    const { createCheckpoint } = await import("../git/checkpoint.mjs")
+    const cp = await createCheckpoint(agent.cwd)
+    cpId = cp?.id
+  } catch { /* checkpoint might fail — compaction itself should not be blocked */ }
+
   applyCompression(agent, split.headEnd, split.tailStart, COMPACTION_PREFIX + summary.content)
+
+  // Inject checkpoint reference after compaction so the model knows it can use /restore
+  if (cpId) {
+    agent.history.splice(split.headEnd, 0, {
+      role: "user",
+      content: `[System: context compacted. A checkpoint (id: ${cpId}) was auto-created before compaction. Use the checkpoint tool to review pre-compaction state if needed. File changes since then are tracked in git diff.]`,
+    })
+  }
+
   return true
 }
 

package/src/hooks.mjs

@@ -0,0 +1,93 @@
+/**
+ * hooks.mjs — Lifecycle hook engine
+ *
+ * Hooks are user-defined shell commands executed at key agent lifecycle points.
+ * Configured in ~/.thincoder/config.json under "hooks".
+ *
+ * Event types:
+ *   PreToolUse          — before each tool call (can block execution)
+ *   PostToolUse         — after successful tool execution
+ *   PostToolUseFailure  — after failed tool execution
+ *   Notification        — generic notification (triggered by agent)
+ *
+ * Each hook: { matcher?, command, args?, timeout?, action? }
+ *   matcher: regex against tool name (default: match all)
+ *   command: executable path/name
+ *   args: optional CLI args; without args, stdin receives JSON payload
+ *   timeout: ms (default 10000)
+ *   action: "allow" | "block" | "notify" (default "notify")
+ *
+ * "block" hooks: exit code 0 = allow, non-zero = block.
+ * "allow"/"notify": exit code ignored.
+ */
+
+import { spawn } from "node:child_process"
+
+/** @param {string} event @param {object} ctx @returns {Promise<boolean>} false if blocked */
+export async function runHooks(event, ctx) {
+  const hooks = ctx.agent?.config?.hooks?.[event]
+  if (!hooks?.length) return true
+
+  for (const hook of hooks) {
+    if (hook.matcher) {
+      try {
+        if (!new RegExp(hook.matcher).test(ctx.toolName ?? "")) continue
+      } catch { /* invalid regex → skip */ }
+    }
+
+    const allowed = await runOneHook(event, hook, ctx)
+    if (hook.action === "block" && !allowed) return false
+  }
+  return true
+}
+
+async function runOneHook(event, hook, ctx) {
+  const payload = JSON.stringify({
+    event,
+    toolName: ctx.toolName ?? null,
+    toolArgs: ctx.toolArgs ?? null,
+    result: ctx.result ?? null,
+    error: ctx.error?.message ?? null,
+    timestamp: new Date().toISOString(),
+  })
+
+  return new Promise((resolve) => {
+    const timeout = hook.timeout ?? 10_000
+    let settled = false
+    const done = (code) => {
+      if (settled) return
+      settled = true
+      resolve(code === 0)
+    }
+
+    let proc
+    try {
+      if (hook.args?.length) {
+        proc = spawn(hook.command, hook.args, {
+          stdio: ["pipe", "ignore", "ignore"],
+          timeout,
+          windowsHide: true,
+        })
+      } else {
+        proc = spawn(hook.command, [], {
+          stdio: ["pipe", "ignore", "ignore"],
+          timeout,
+          windowsHide: true,
+        })
+      }
+    } catch {
+      // command not found or spawn failure — don't block, don't crash
+      return resolve(true)
+    }
+
+    proc.on("error", () => done(0))     // spawn failure → allow
+    proc.on("close", (code) => done(code ?? 0))
+    proc.on("exit", (code) => done(code ?? 0))
+
+    // Send payload via stdin
+    try { proc.stdin?.end(payload) } catch { /* */ }
+
+    // Timeout guard
+    setTimeout(() => done(0), timeout + 1000)
+  })
+}

package/src/tools/checklist.md

@@ -1,7 +1,10 @@
 Manage the task checklist in .thincoder/checklist.md. Use at these points: after requirements are confirmed — add one entry per requirement point; when starting work — mark in_progress; when verified complete — mark done. Checklist entries map to requirement/design points — project-level tracking across sessions. For in-session subtask breakdown of a single checklist item, use the `task` tool instead. Completed items are auto-archived to .thincoder/checklist-done.md.
 
+Items support tree hierarchy via indentation (2 spaces per level) and auto-assigned IDs (T1, T1.1, T1.2.1). Use the `parent` parameter to add a child under an existing task.
+
 Parameters:
 - action: "add" | "mark" | "list"
 - item: text for new item (with "add")
-- index: 1-based index (with "mark")
+- index: 1-based index (with "mark")  
 - status: "pending" | "in_progress" | "done" (with "mark")
+- parent: parent task ID for hierarchical tasks, e.g. "T1" (with "add")

package/src/tools/checklist.mjs

@@ -8,38 +8,109 @@ const DONE = "checklist-done.md"
 function checklistPath(cwd) { return join(cwd, ".thincoder", CHECKLIST) }
 function donePath(cwd) { return join(cwd, ".thincoder", DONE) }
 
-/** Parse checklist file into array of { index, status, text } */
+/**
+ * Parse checklist file into tree-structured items.
+ * Indentation (2 spaces per level) determines parent-child relationships.
+ * Each item: { id, index, depth, status, text, children[] }
+ * "index" is the 1-based position in the flat markdown list.
+ */
 function parse(filePath) {
   if (!existsSync(filePath)) return []
   const lines = readFileSync(filePath, "utf-8").split("\n")
   const items = []
-  let idx = 0
+  let flatIdx = 0
+  const stack = [{ children: items, depth: -1 }] // virtual root
+
   for (const line of lines) {
-    const m = line.match(/^- \[(.)\] (.+)$/)
-    if (m) {
-      idx++
-      const raw = m[1]
-      const status = raw === "x" ? "done" : raw === "~" ? "in_progress" : "pending"
-      items.push({ index: idx, status, text: m[2].trim() })
+    const m = line.match(/^(\s*)- \[(.)\] (.+)$/)
+    if (!m) continue
+    flatIdx++
+    const indent = m[1]
+    const depth = Math.floor(indent.length / 2) // 2 spaces = 1 level
+    const raw = m[2]
+    const status = raw === "x" ? "done" : raw === "~" ? "in_progress" : "pending"
+    const text = m[3].trim()
+
+    // Extract explicit ID if present (e.g. "T1:", "T1.1:")
+    const idMatch = text.match(/^(T[\d.]+):/)
+    const node = {
+      id: idMatch ? idMatch[1] : null,
+      index: flatIdx,
+      depth,
+      status,
+      text,
+      children: [],
     }
+
+    // Find parent by popping stack until we find a node at depth-1
+    while (stack.length > 1 && stack.at(-1).depth >= depth) stack.pop()
+    const parent = stack.at(-1)
+    parent.children.push(node)
+    // Auto-assign ID if not explicit
+    if (!node.id) {
+      const siblingCount = parent.children.length
+      const base = parent.id ? `${parent.id}` : "T"
+      if (parent.id) {
+        node.id = `${base}.${siblingCount}`
+      } else {
+        // Root level: T1, T2, T3...
+        let rootIdx = 0
+        for (const c of items) {
+          if (c.id?.match(/^T\d+$/)) rootIdx = Math.max(rootIdx, parseInt(c.id.slice(1)))
+        }
+        node.id = `T${rootIdx + 1}`
+      }
+    }
+    stack.push({ children: node.children, depth, id: node.id })
   }
   return items
 }
 
-/** Write items back to file */
-function write(filePath, items) {
-  mkdirSync(dirname(filePath), { recursive: true })
+/** Write items back to file, preserving tree structure */
+function write(filePath, items, _depth = 0) {
+  if (_depth === 0) mkdirSync(dirname(filePath), { recursive: true })
   const lines = []
+  const indent = "  ".repeat(_depth)
   for (const item of items) {
     const mark = item.status === "done" ? "x" : item.status === "in_progress" ? "~" : " "
-    lines.push(`- [${mark}] ${item.text}`)
+    const label = item.id ? `${item.id}: ${item.text}` : item.text
+    lines.push(`${indent}- [${mark}] ${label}`)
+    if (item.children?.length) {
+      lines.push(...write(filePath, item.children, _depth + 1).split("\n").filter(Boolean))
+    }
+  }
+  if (_depth === 0) {
+    writeFileSync(filePath, lines.join("\n") + "\n")
+    return ""
+  }
+  return lines.join("\n")
+}
+
+/** Find a node by ID in the tree */
+function findById(items, id) {
+  for (const item of items) {
+    if (item.id === id) return { parent: items, item, idx: items.indexOf(item) }
+    if (item.children?.length) {
+      const found = findById(item.children, id)
+      if (found) return found
+    }
   }
-  writeFileSync(filePath, lines.join("\n") + "\n")
+  return null
+}
+
+/** Flatten tree for mark action (index-based) */
+function flatten(items, out = []) {
+  for (const item of items) {
+    out.push(item)
+    if (item.children?.length) flatten(item.children, out)
+  }
+  return out
 }
 
 /** Parse pending items only (for context injection) */
 export function pendingItems(cwd) {
-  return parse(checklistPath(cwd)).filter(i => i.status !== "done")
+  const flat = flatten(parse(checklistPath(cwd)))
+  return flat.filter(i => i.status !== "done")
 }
 
 export const checklistTool = {
@@ -66,6 +137,10 @@ export const checklistTool = {
         enum: ["pending", "in_progress", "done"],
         description: "New status (required for mark)"
       },
+      parent: {
+        type: "string",
+        description: "Parent task ID for tree-structured tasks (e.g. 'T1')"
+      },
     },
     required: ["action"],
   },
@@ -75,9 +150,33 @@ export const checklistTool = {
       case "add": {
         if (!args.item || typeof args.item !== "string") return "Error: 'item' is required for add"
         const items = parse(checklistPath(ctx.cwd))
-        items.push({ index: items.length + 1, status: "pending", text: args.item })
+
+        let target = items
+        let parentId = null
+        if (args.parent) {
+          const found = findById(items, args.parent)
+          if (!found) return `Error: parent '${args.parent}' not found. Use 'list' to see all task IDs.`
+          target = found.item.children
+          parentId = found.item.id
+        }
+
+        // Auto-assign ID
+        let id
+        if (parentId) {
+          id = `${parentId}.${target.length + 1}`
+        } else {
+          let maxIdx = 0
+          for (const c of items) {
+            const m = c.id?.match(/^T(\d+)$/)
+            if (m) maxIdx = Math.max(maxIdx, parseInt(m[1]))
+          }
+          id = `T${maxIdx + 1}`
+        }
+
+        const node = { id, index: 0, depth: parentId ? 1 : 0, status: "pending", text: args.item, children: [] }
+        target.push(node)
         write(checklistPath(ctx.cwd), items)
-        return `Added: [ ] ${args.item}`
+        return `Added: [ ] ${id}: ${args.item}${parentId ? ` (under ${parentId})` : ""}`
       }
       case "mark": {
         if (args.index == null) return "Error: 'index' is required for mark"
@@ -85,8 +184,9 @@ export const checklistTool = {
         if (!status || !["pending", "in_progress", "done"].includes(status)) return "Error: 'status' is required (pending|in_progress|done)"
         const cp = checklistPath(ctx.cwd)
         const items = parse(cp)
-        if (args.index < 1 || args.index > items.length) return `Error: index ${args.index} out of range (1-${items.length})`
-        const item = items[args.index - 1]
+        const flat = flatten(items)
+        if (args.index < 1 || args.index > flat.length) return `Error: index ${args.index} out of range (1-${flat.length})`
+        const item = flat[args.index - 1]
         const old = item.status
         if (old === status) return `Already ${status}: ${item.text}`
         item.status = status
@@ -94,18 +194,30 @@ export const checklistTool = {
           // Move to done file
           const dp = donePath(ctx.cwd)
           const doneItems = parse(dp)
-          doneItems.push(item)
+          doneItems.push({ id: item.id, index: 0, depth: 0, status: "done", text: item.text, children: [] })
           write(dp, doneItems)
-          items.splice(args.index - 1, 1)
+          // Remove from tree
+          const found = findById(items, item.id)
+          if (found) found.parent.splice(found.idx, 1)
         }
         write(cp, items)
-        return `Marked #${args.index} ${old} → ${status}: ${item.text}`
+        return `Marked #${args.index} ${old} → ${status}: ${item.id}: ${item.text}`
       }
       case "list": {
         const items = parse(checklistPath(ctx.cwd))
         if (items.length === 0) return "(checklist is empty)"
         const marks = { pending: " ", in_progress: "~", done: "x" }
-        return items.map(i => `- [${marks[i.status]}] ${i.text}`).join("\n")
+        const lines = []
+        function render(nodes, depth) {
+          const indent = "  ".repeat(depth)
+          for (const n of nodes) {
+            const idTag = n.id ? `${n.id}: ` : ""
+            lines.push(`${indent}- [${marks[n.status]}] ${idTag}${n.text}`)
+            if (n.children?.length) render(n.children, depth + 1)
+          }
+        }
+        render(items, 0)
+        return lines.join("\n")
       }
       default:
         return `Error: unknown action '${args.action}'`

package/src/tools/codemode.mjs

@@ -0,0 +1,178 @@
+/**
+ * tools/codemode.mjs — CodeMode: sandboxed JS execution tool
+ *
+ * Gives the model an `execute` tool backed by Node.js vm.Script.runInNewContext.
+ * Multiple tool calls can be composed into a single script, reducing API round-trips
+ * and keeping large intermediate results out of context.
+ *
+ * Sandbox API (all sync, no callbacks):
+ *   readFile(path)      — read a file relative to cwd, return string
+ *   writeFile(path, c)  — write content to a file (auto-creates parent dirs)
+ *   glob(pattern)        — return array of matching paths
+ *   grep(pattern, file)  — return array of matching lines
+ *   log(...args)         — append to output buffer
+ *   fetch(url)           — HTTP GET, return string (SSRF-protected)
+ *
+ * Not available: require, import, process, child_process, setTimeout, any Node API.
+ *
+ * Limits:
+ *   timeout: 30s (configurable via timeoutMs param)
+ *   maxOutput: 50000 bytes
+ *   maxScriptSize: 50000 bytes
+ */
+
+import { Script, createContext } from "node:vm"
+import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSync } from "node:fs"
+import { join, dirname, relative, resolve } from "node:path"
+import { globToRegex, normalizeEOL } from "./shared.mjs"
+
+const MAX_OUTPUT = 50_000
+const MAX_SCRIPT = 50_000
+const DEFAULT_TIMEOUT = 30_000
+
+/** SSRF-safe fetch: only http/https, private IP rejection, 10s timeout */
+async function sandboxFetch(url) {
+  const parsed = new URL(url)
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new Error(`CodeMode fetch: protocol not allowed: ${parsed.protocol}`)
+  }
+  // Block private/internal IPs
+  const hostname = parsed.hostname.toLowerCase()
+  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" ||
+      hostname.startsWith("192.168.") || hostname.startsWith("10.") ||
+      hostname.startsWith("172.16.") || hostname.startsWith("172.17.") ||
+      hostname.startsWith("172.18.") || hostname.startsWith("172.19.") ||
+      hostname.startsWith("172.20.") || hostname.startsWith("172.21.") ||
+      hostname.startsWith("172.22.") || hostname.startsWith("172.23.") ||
+      hostname.startsWith("172.24.") || hostname.startsWith("172.25.") ||
+      hostname.startsWith("172.26.") || hostname.startsWith("172.27.") ||
+      hostname.startsWith("172.28.") || hostname.startsWith("172.29.") ||
+      hostname.startsWith("172.30.") || hostname.startsWith("172.31.") ||
+      hostname === "0.0.0.0" || hostname.endsWith(".local")) {
+    throw new Error(`CodeMode fetch: private/internal host not allowed: ${hostname}`)
+  }
+  const ctrl = new AbortController()
+  const timer = setTimeout(() => ctrl.abort(), 10_000)
+  try {
+    const res = await fetch(url, { signal: ctrl.signal })
+    const text = await res.text()
+    return text.slice(0, 100_000)
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+export const codeModeTool = {
+  name: "execute",
+  description:
+    "Execute sandboxed JavaScript code. Use this to compose multiple file operations into one call — " +
+    "read, write, glob, grep, and log results. No network or system access. Max 30s timeout, 50KB output.",
+  parameters: {
+    type: "object",
+    properties: {
+      code: {
+        type: "string",
+        description: "JavaScript code to execute in the sandbox. Use provided functions: readFile(path), writeFile(path, content), glob(pattern), grep(pattern, file), log(...args).",
+      },
+      timeoutMs: {
+        type: "integer",
+        description: `Timeout in milliseconds (default ${DEFAULT_TIMEOUT}, max 60000)`,
+      },
+    },
+    required: ["code"],
+  },
+  readonly: false,
+
+  async execute(args, ctx) {
+    const cwd = ctx.cwd
+    const code = args.code ?? ""
+
+    if (code.length > MAX_SCRIPT) {
+      return `Error: script too large (${code.length} > ${MAX_SCRIPT} bytes). Split into smaller scripts or use individual tools.`
+    }
+
+    const output = []
+    const timeoutMs = Math.min(args.timeoutMs ?? DEFAULT_TIMEOUT, 60_000)
+
+    // File path guard: ensure paths are within cwd
+    function safePath(p) {
+      if (typeof p !== "string") throw new Error(`Path must be a string, got ${typeof p}`)
+      // Normalize and resolve
+      const abs = resolve(cwd, p)
+      // Check containment
+      const rel = relative(cwd, abs)
+      if (rel.startsWith("..") || (rel.includes("..") && process.platform === "win32")) {
+        throw new Error(`Path traversal denied: ${p}`)
+      }
+      return abs
+    }
+
+    const sandbox = createContext({
+      readFile: (p) => {
+        const abs = safePath(p)
+        if (!existsSync(abs)) throw new Error(`File not found: ${p}`)
+        const st = statSync(abs)
+        if (st.size > 5_000_000) throw new Error(`File too large: ${p} (${Math.round(st.size / 1000000)}MB)`)
+        return normalizeEOL(readFileSync(abs, "utf8"))
+      },
+      writeFile: (p, content) => {
+        const abs = safePath(p)
+        mkdirSync(dirname(abs), { recursive: true })
+        writeFileSync(abs, String(content), "utf8")
+      },
+      glob: (pattern) => {
+        if (typeof pattern !== "string") throw new Error("glob pattern must be a string")
+        const regex = globToRegex(pattern)
+        const results = []
+        function walk(dir, rel) {
+          let entries
+          try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
+          for (const e of entries) {
+            if (e.name.startsWith(".") || e.name === "node_modules") continue
+            const relPath = rel ? `${rel}/${e.name}` : e.name
+            if (e.isDirectory()) { walk(join(dir, e.name), relPath) }
+            else if (regex.test(relPath)) results.push(relPath)
+          }
+        }
+        walk(cwd, "")
+        return results.slice(0, 200)
+      },
+      grep: (pattern, file) => {
+        if (typeof pattern !== "string") throw new Error("grep pattern must be a string")
+        if (typeof file !== "string") throw new Error("grep file must be a string")
+        const abs = safePath(file)
+        if (!existsSync(abs)) throw new Error(`File not found: ${file}`)
+        const content = normalizeEOL(readFileSync(abs, "utf8"))
+        const regex = new RegExp(pattern)
+        const lines = content.split("\n")
+        const matches = []
+        for (let i = 0; i < lines.length; i++) {
+          if (regex.test(lines[i])) matches.push(`${i + 1}: ${lines[i].slice(0, 200)}`)
+        }
+        return matches.slice(0, 100)
+      },
+      log: (...args) => {
+        const line = args.map((a) => typeof a === "object" ? JSON.stringify(a) : String(a)).join(" ")
+        output.push(line)
+        if (output.join("\n").length > MAX_OUTPUT) {
+          output.push("... (output truncated)")
+          throw new Error("CodeMode output limit exceeded")
+        }
+      },
+      fetch: sandboxFetch,
+    })
+
+    try {
+      const script = new Script(code, {
+        filename: "codemode.js",
+        timeout: timeoutMs,
+      })
+      script.runInContext(sandbox)
+      return output.join("\n") || "(no output)"
+    } catch (err) {
+      const out = output.join("\n")
+      const prefix = out ? `${out}\n\n` : ""
+      return `${prefix}Error: ${err.message}`
+    }
+  },
+}

package/src/tools/index.mjs

@@ -8,13 +8,15 @@ import { websearchTool, fetchTool } from "./web.mjs";
 import { gitDiffTool, gitStatusTool, gitLogTool, questionTool, checkpointTool } from "./git.mjs";
 import { checklistTool } from "./checklist.mjs";
 import { linterTool } from "./linter.mjs";
+import { lspTool } from "./lsp.mjs";
+import { codeModeTool } from "./codemode.mjs";
 
 export const builtinTools = [
   readTool, writeTool, editTool, insertAfterTool, hashlineEditTool, applyPatchTool,
   syntaxCheckTool, readImageTool, bashTool, globTool, grepTool,
   websearchTool, lsTool, fetchTool, deleteTool,
   gitDiffTool, gitStatusTool, gitLogTool, questionTool, checkpointTool,
-  checklistTool, linterTool,
+  checklistTool, linterTool, lspTool, codeModeTool,
 ];
 
 export {
@@ -22,5 +24,5 @@ export {
   syntaxCheckTool, readImageTool, bashTool, globTool, grepTool,
   websearchTool, lsTool, fetchTool, deleteTool,
   gitDiffTool, gitStatusTool, gitLogTool, questionTool, checkpointTool,
-  checklistTool, linterTool,
+  checklistTool, linterTool, lspTool, codeModeTool,
 };

package/src/tools/lsp.mjs

@@ -0,0 +1,317 @@
+/**
+ * tools/lsp.mjs — LSP (Language Server Protocol) code intelligence tool
+ * Zero-dependency JSON-RPC 2.0 over stdio client.
+ *
+ * Provides: go-to-definition, find-references, hover info, document symbols, diagnostics.
+ * Lazy-starts language servers on first call. Configurable via config.json lsp.servers.
+ *
+ * Config format:
+ *   "lsp": {
+ *     "servers": {
+ *       "typescript": { "command": "typescript-language-server", "args": ["--stdio"] },
+ *       "python": { "command": "pyright-langserver", "args": ["--stdio"] }
+ *     }
+ *   }
+ */
+
+import { spawn } from "node:child_process"
+import { existsSync, readFileSync } from "node:fs"
+import { join, extname } from "node:path"
+
+// ---- JSON-RPC transport over stdio ----
+
+/** Send a JSON-RPC request to the server via stdin */
+function send(proc, message) {
+  const body = JSON.stringify(message)
+  const header = `Content-Length: ${Buffer.byteLength(body)}\r\n\r\n`
+  proc.stdin.write(header + body)
+}
+
+/** Read one JSON-RPC message from stdout. Returns parsed JSON, or null on EOF. */
+function readMessage(proc) {
+  return new Promise((resolve) => {
+    let header = ""
+    let contentLength = -1
+
+    const onData = (chunk) => {
+      if (contentLength < 0) {
+        header += chunk.toString()
+        const match = header.match(/Content-Length: (\d+)\r\n\r\n/)
+        if (match) {
+          contentLength = parseInt(match[1])
+          const bodyStart = header.indexOf("\r\n\r\n") + 4
+          const remaining = header.slice(bodyStart)
+          header = ""
+          if (remaining.length >= contentLength) {
+            proc.stdout.removeListener("data", onData)
+            try { resolve(JSON.parse(remaining.slice(0, contentLength))) } catch { resolve(null) }
+            return
+          }
+          // Need more data — leave remaining in a buffer-like state
+          proc.stdout.removeListener("data", onData)
+          readBody(proc, remaining, contentLength).then(resolve)
+        }
+      }
+    }
+
+    proc.stdout.on("data", onData)
+  })
+}
+
+function readBody(proc, buf, targetLen) {
+  return new Promise((resolve) => {
+    const onData = (chunk) => {
+      buf += chunk.toString()
+      if (buf.length >= targetLen) {
+        proc.stdout.removeListener("data", onData)
+        try { resolve(JSON.parse(buf.slice(0, targetLen))) } catch { resolve(null) }
+      }
+    }
+    proc.stdout.on("data", onData)
+  })
+}
+
+/** Send a request and wait for the matching response */
+async function request(proc, method, params, id) {
+  send(proc, { jsonrpc: "2.0", id, method, params })
+  while (true) {
+    const msg = await readMessage(proc)
+    if (!msg) return null
+    if (msg.id === id) return msg
+    // Store notifications for later retrieval (diagnostics)
+    if (msg.method === "textDocument/publishDiagnostics") {
+      proc._diagnostics = proc._diagnostics || {}
+      proc._diagnostics[msg.params.uri] = msg.params.diagnostics
+    }
+  }
+}
+
+/** Send a notification (no response expected) */
+function notify(proc, method, params) {
+  send(proc, { jsonrpc: "2.0", method, params })
+}
+
+// ---- Language server process management ----
+
+const servers = new Map() // ext → { proc, rootUri, ready }
+
+/** Convert file path to file:// URI */
+function toUri(absPath) {
+  return "file:///" + absPath.replace(/\\/g, "/").replace(/^([A-Z]):/, (_, d) => d.toLowerCase() + "%3A")
+}
+
+/** Resolve which language server to use for a file extension */
+function resolveServerConfig(config, ext) {
+  const map = {
+    ".js": "typescript", ".mjs": "typescript", ".cjs": "typescript",
+    ".ts": "typescript", ".tsx": "typescript", ".mts": "typescript", ".cts": "typescript",
+    ".py": "python", ".pyi": "python",
+    ".rs": "rust",
+    ".go": "go",
+  }
+  const key = map[ext] || ext.slice(1)
+  const servers = config?.lsp?.servers ?? {}
+  return servers[key] || null
+}
+
+/** Start or reuse a language server for the given file */
+async function getServer(cwd, filePath, config) {
+  const ext = extname(filePath).toLowerCase()
+  const srvConfig = resolveServerConfig(config, ext)
+  if (!srvConfig) return null
+
+  const abs = join(cwd, ...filePath.split("/"))
+  if (!existsSync(abs)) return null
+
+  const rootUri = toUri(cwd)
+  const key = `${ext}:${cwd}`
+  let entry = servers.get(key)
+
+  if (entry && entry.ready) return entry
+
+  // Start new server
+  const proc = spawn(srvConfig.command, srvConfig.args || [], {
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true,
+  })
+
+  proc.stderr.on("data", () => {}) // suppress stderr noise
+
+  entry = { proc, rootUri, ready: false }
+  servers.set(key, entry)
+
+  // Initialize handshake
+  const initResult = await request(proc, "initialize", {
+    processId: null,
+    rootUri,
+    capabilities: {
+      textDocument: {
+        definition: { linkSupport: false },
+        references: {},
+        hover: { contentFormat: ["plaintext"] },
+        documentSymbol: { hierarchicalDocumentSymbolSupport: true },
+      },
+    },
+    workspace: {},
+  }, 1)
+
+  if (!initResult) {
+    proc.kill()
+    servers.delete(key)
+    return null
+  }
+
+  notify(proc, "initialized", {})
+  entry.ready = true
+  return entry
+}
+
+/** Notify the server that a file is open (required before queries) */
+async function ensureOpen(proc, uri, ext) {
+  const langMap = { ".js": "javascript", ".mjs": "javascript", ".cjs": "javascript", ".ts": "typescript", ".tsx": "typescript", ".mts": "typescript", ".cts": "typescript", ".py": "python", ".rs": "rust", ".go": "go" }
+  const languageId = langMap[ext] || ext.slice(1)
+  notify(proc, "textDocument/didOpen", {
+    textDocument: {
+      uri,
+      languageId,
+      version: 1,
+      text: readFileSync(uri.replace(/^file:\/\/\//, "").replace(/%3A/, ":").replace(/\//g, "\\"), "utf8"),
+    },
+  })
+}
+
+// ---- Tool definition ----
+
+export const lspTool = {
+  name: "lsp",
+  description:
+    "LSP code intelligence: go to definition, find references, hover info, document symbols, diagnostics. " +
+    "Use this to understand code structure without grep-guessing function locations or type shapes.",
+  parameters: {
+    type: "object",
+    properties: {
+      subcommand: {
+        type: "string",
+        enum: ["definition", "references", "hover", "symbols", "diagnostics"],
+        description: "LSP operation to perform",
+      },
+      uri: {
+        type: "string",
+        description: "Target file path (relative to project root)",
+      },
+      line: {
+        type: "integer",
+        description: "1-based line number (for definition/references/hover)",
+      },
+      character: {
+        type: "integer",
+        description: "1-based character offset (for definition/references/hover)",
+      },
+    },
+    required: ["subcommand", "uri"],
+  },
+  readonly: true,
+
+  async execute(args, ctx) {
+    const config = ctx.agent?.config ?? {}
+    const cwd = ctx.cwd
+    const filePath = args.uri
+
+    try {
+      const entry = await getServer(cwd, filePath, config)
+      if (!entry) {
+        const ext = extname(filePath).toLowerCase()
+        return `No LSP server configured for "${ext}" files. Add one to config.json:\n"lsp": { "servers": { "${ext.slice(1)}": { "command": "...", "args": ["--stdio"] } } }`
+      }
+
+      const { proc } = entry
+      const abs = join(cwd, ...filePath.split("/"))
+      const uri = toUri(abs)
+      const ext = extname(filePath).toLowerCase()
+      await ensureOpen(proc, uri, ext)
+
+      // Wait briefly for diagnostics to arrive
+      await new Promise((r) => setTimeout(r, 300))
+
+      switch (args.subcommand) {
+        case "definition": {
+          if (!args.line || !args.character) return "Error: line and character required for definition"
+          const res = await request(proc, "textDocument/definition", {
+            textDocument: { uri },
+            position: { line: args.line - 1, character: args.character - 1 },
+          }, 10)
+          if (!res?.result) return "No definition found."
+          const locs = Array.isArray(res.result) ? res.result : [res.result]
+          return locs.map((l) => {
+            const path = l.uri.replace(/^file:\/\/\//, "").replace(/%3A/, ":")
+            return `${path}:${l.range.start.line + 1}:${l.range.start.character + 1}`
+          }).join("\n")
+        }
+
+        case "references": {
+          if (!args.line || !args.character) return "Error: line and character required for references"
+          const res = await request(proc, "textDocument/references", {
+            textDocument: { uri },
+            position: { line: args.line - 1, character: args.character - 1 },
+            context: { includeDeclaration: false },
+          }, 10)
+          if (!res?.result?.length) return "No references found."
+          return res.result.slice(0, 50).map((l) => {
+            const path = l.uri.replace(/^file:\/\/\//, "").replace(/%3A/, ":")
+            return `${path}:${l.range.start.line + 1}:${l.range.start.character + 1}`
+          }).join("\n") + (res.result.length > 50 ? `\n... and ${res.result.length - 50} more` : "")
+        }
+
+        case "hover": {
+          if (!args.line || !args.character) return "Error: line and character required for hover"
+          const res = await request(proc, "textDocument/hover", {
+            textDocument: { uri },
+            position: { line: args.line - 1, character: args.character - 1 },
+          }, 10)
+          if (!res?.result?.contents) return "No hover info available."
+          const contents = res.result.contents
+          if (typeof contents === "string") return contents
+          if (Array.isArray(contents)) return contents.map((c) => typeof c === "string" ? c : c.value).join("\n")
+          if (contents.value) return contents.value
+          return JSON.stringify(contents)
+        }
+
+        case "symbols": {
+          const res = await request(proc, "textDocument/documentSymbol", {
+            textDocument: { uri },
+          }, 10)
+          if (!res?.result?.length) return "No symbols found."
+          function render(nodes, depth) {
+            const lines = []
+            for (const n of nodes) {
+              const kind = n.kind != null ? ` [${symbolKind(n.kind)}]` : ""
+              lines.push(`${"  ".repeat(depth)}${n.name}${kind} — L${n.range.start.line + 1}`)
+              if (n.children?.length) lines.push(...render(n.children, depth + 1))
+            }
+            return lines
+          }
+          return render(res.result, 0).join("\n")
+        }
+
+        case "diagnostics": {
+          const diags = proc._diagnostics?.[uri]
+          if (!diags?.length) return "No diagnostics."
+          return diags.slice(0, 30).map((d) => {
+            const sev = { 1: "ERROR", 2: "WARN", 3: "INFO", 4: "HINT" }[d.severity] || "?"
+            return `L${d.range.start.line + 1}: ${sev}: ${d.message}${d.code ? ` [${d.code}]` : ""}`
+          }).join("\n") + (diags.length > 30 ? `\n... and ${diags.length - 30} more` : "")
+        }
+
+        default:
+          return `Unknown subcommand: ${args.subcommand}`
+      }
+    } catch (err) {
+      return `LSP error: ${err.message}`
+    }
+  },
+}
+
+function symbolKind(k) {
+  const kinds = { 1: "file", 2: "module", 3: "namespace", 4: "package", 5: "class", 6: "method", 7: "property", 8: "field", 9: "constructor", 10: "enum", 11: "interface", 12: "function", 13: "variable", 14: "constant", 15: "string", 16: "number", 17: "boolean", 18: "array", 19: "object", 20: "key", 21: "null", 22: "enumMember", 23: "struct", 24: "event", 25: "operator", 26: "typeParameter" }
+  return kinds[k] || `kind-${k}`
+}

package/src/tui/ansi.mjs

@@ -38,4 +38,5 @@ export const C = {
   dim: ansi.gray,
   warn: ansi.fg(3),
   advisor: `${ESC}[92m`,  // bright green — visible on dark backgrounds
+  fold: `${ESC}[2m${ESC}[37m`,   // dim white — fold hints
 }

package/src/tui/cmd-fold.mjs

@@ -0,0 +1,21 @@
+/**
+ * cmd-fold.mjs — /fold command: toggle conversation result folding
+ */
+import { C } from "./ansi.mjs"
+
+export async function handleFoldCommand(ctx) {
+  const { state } = ctx
+  const text = state.input.join("").trim()
+  const arg = text.split(/\s+/)[1]
+  if (arg === "on") {
+    state.foldEnabled = true
+    ctx.pushLine("Folding: on (long tool results are collapsed)", C.dim)
+  } else if (arg === "off") {
+    state.foldEnabled = false
+    ctx.pushLine("Folding: off (all results shown in full)", C.dim)
+  } else {
+    state.foldEnabled = !state.foldEnabled
+    ctx.pushLine(`Folding: ${state.foldEnabled ? "on" : "off"}`, C.dim)
+  }
+  ctx.render()
+}

package/src/tui/cmd-mcp.mjs

@@ -124,12 +124,53 @@ export async function handleMcpCommand(ctx) {
         openPicker({
           title: "MCP Transport",
           entries: [
-            { type: "header", text: "Select server transport" },
+            { type: "header", text: "Select transport or use AI assist" },
+            { type: "item", text: "🤖 Describe with AI — natural language → config", action: "ai" },
             { type: "item", text: "HTTP (https://…)", action: "http" },
             { type: "item", text: "WebSocket (ws://…)", action: "ws" },
             { type: "item", text: "stdio (local command)", action: "stdio" },
           ],
           onSelect: async (te) => {
+            if (te.action === "ai") {
+              const description = await askQuestion("Describe the MCP server you want to add (e.g. 'a filesystem server that gives access to /tmp'):")
+              if (!description) return
+              pushLine("[mcp] Generating config from description...", C.dim)
+              try {
+                const { chat } = await import("../provider/index.mjs")
+                const res = await chat(agent.provider, {
+                  messages: [{
+                    role: "user",
+                    content: `Generate an MCP server configuration JSON from this description. Return ONLY the JSON object, no explanation.
+
+Description: "${description}"
+
+The JSON should have these fields:
+- name: a short identifier
+- One of: url (HTTP), wsUrl (WebSocket), or command + args (stdio)
+- headers: optional key-value object
+
+Example HTTP: {"name":"filesystem","url":"https://example.com/mcp","headers":{"Authorization":"Bearer xxx"}}
+Example stdio: {"name":"filesystem","command":"npx","args":["-y","@modelcontextprotocol/server-filesystem","/tmp"]}
+
+Return ONLY the JSON object:`,
+                  }],
+                  tools: [],
+                  signal: AbortSignal.timeout(15_000),
+                })
+                const jsonMatch = (res.content ?? "").match(/\{[\s\S]*\}/)
+                if (!jsonMatch) { pushLine("[mcp] AI response not valid JSON", C.error); return }
+                const srv = JSON.parse(jsonMatch[0])
+                if (!srv.name) { pushLine("[mcp] AI response missing 'name' field", C.error); return }
+                // Show preview and confirm
+                pushLine(`[mcp] Generated config: ${JSON.stringify(srv)}`, C.tool)
+                const confirm = await askQuestion("Add this server? (y/n):")
+                if (confirm?.toLowerCase() !== "y") { pushLine("[mcp] Cancelled", C.dim); return }
+                await addAndConnect(ctx, srv)
+              } catch (err) {
+                pushLine(`[mcp] AI generation failed: ${err.message}`, C.error)
+              }
+              return
+            }
             const name = await askQuestion("Server name:")
             if (!name) return
             const existing = (agent.config?.mcp?.servers ?? []).find((s) => s.name === name)

package/src/tui/cmd-undo.mjs

@@ -0,0 +1,91 @@
+/**
+ * cmd-undo.mjs — /undo command: revert recent file modifications
+ *
+ * Tracks write/edit/delete/hashline_edit/apply_patch operations in agent._undoStack.
+ * /undo opens a picker to select and revert an operation.
+ */
+
+import { existsSync, writeFileSync, unlinkSync, readFileSync } from "node:fs"
+import { join } from "node:path"
+import { ansi, C } from "./ansi.mjs"
+
+const MAX_UNDO = 50
+
+/**
+ * Snapshot a file before a side-effect tool modifies it.
+ * Called from dispatch.mjs before each write/edit/delete/apply_patch/hashline_edit.
+ */
+export function snapshotForUndo(agent, toolName, args, cwd) {
+  if (!agent._undoStack) agent._undoStack = []
+  const path = args.path ?? args.file
+  if (!path || typeof path !== "string") return
+
+  const abs = join(cwd, ...path.split("/"))
+  let backup = null
+  try {
+    if (existsSync(abs)) {
+      backup = readFileSync(abs, "utf8")
+    }
+  } catch {
+    // can't read — maybe binary, skip
+    return
+  }
+
+  agent._undoStack.push({
+    tool: toolName,
+    path,
+    backup,
+    timestamp: Date.now(),
+  })
+  if (agent._undoStack.length > MAX_UNDO) agent._undoStack.shift()
+}
+
+export async function handleUndoCommand(ctx) {
+  const { agent, pushLine, openPicker } = ctx
+  const stack = agent._undoStack ?? []
+
+  if (stack.length === 0) {
+    pushLine("[undo] Nothing to undo — no file modifications tracked yet.", C.dim)
+    return
+  }
+
+  const entries = [
+    { type: "header", text: `${stack.length} operation(s) available to undo (most recent first)` },
+    ...stack.map((item, i) => {
+      const relIdx = stack.length - i
+      const time = new Date(item.timestamp).toLocaleTimeString()
+      const preview = item.backup === null
+        ? "(was created — undo will delete)"
+        : `(${item.backup.split("\n").length} lines — undo will restore)`
+      return {
+        type: "item",
+        text: `#${relIdx} ${item.tool}: ${item.path} ${preview} — ${time}`,
+        idx: i,
+      }
+    }),
+  ]
+
+  openPicker({
+    title: "Undo",
+    entries,
+    onSelect: async (e) => {
+      const item = stack[e.idx]
+      const abs = join(agent.cwd, ...item.path.split("/"))
+
+      try {
+        if (item.backup === null) {
+          // File was created — undo deletes it
+          if (existsSync(abs)) unlinkSync(abs)
+        } else {
+          // File was modified — undo restores original
+          writeFileSync(abs, item.backup, "utf8")
+        }
+        // Remove this and all newer entries (can't undo out of order)
+        stack.splice(e.idx)
+        pushLine(`[undo] Reverted: ${item.tool} ${item.path}`, C.tool)
+      } catch (err) {
+        pushLine(`[undo] Failed to revert ${item.path}: ${err.message}`, C.error)
+      }
+    },
+  })
+}

package/src/tui/index.mjs

@@ -80,6 +80,8 @@ export async function startTUI(agent, opts = {}) {
     status: "Ready",
     queue: [], // queued messages while processing: [{ text }], auto-dequeued when current turn finishes
     interruptPrompt: null, // Ctrl+I interrupt message input: { text: "" } or null
+    expandedBlocks: new Set(), // block hashes that are expanded (Enter toggles)
+    foldEnabled: true, // global fold toggle — /fold on|off
   }
 
   // On session restore, if all tasks are completed, auto-collapse the todo panel (match runtime behavior)

package/src/tui/render-frame.mjs

@@ -51,7 +51,7 @@ export function renderHeader(agent, cols) {
  */
 export function convCacheKey(state) {
   const lastLine = state.lines.length > 0 ? state.lines[state.lines.length - 1] : null
-  return `${state.lines.length}|${lastLine?.text.length ?? 0}|${state.streaming.length}|${state.reasoning.length}|${Object.keys(state.toolStreams).length}`
+  return `${state.lines.length}|${lastLine?.text.length ?? 0}|${state.streaming.length}|${state.reasoning.length}|${Object.keys(state.toolStreams).length}|${state.foldEnabled !== false ? "f" : "u"}`
 }
 
 /** Conversation panel (scrollable, variable height). Returns exactly `visibleH` lines. */
@@ -311,10 +311,12 @@ function buildConvLines(state, cols) {
   for (const l of state.lines) {
     for (const line of formatTables(sanitizeDisplay(l.text), cols - 1)) {
       for (const wrapped of wrapText(line, cols - 1)) {
-        convLines.push({ text: wrapped, color: l.color })
+        convLines.push({ text: wrapped, color: l.color, _foldId: l._foldId })
       }
     }
   }
+  // Messages after the conversation (streaming / thinking / tool output):
+  // appended after history lines so they appear at the bottom.
   if (state.reasoning) {
     for (const wrapped of wrapText(sanitizeDisplay(state.reasoning), cols - 1)) {
       convLines.push({ text: wrapped, color: C.reason })
@@ -334,8 +336,37 @@ function buildConvLines(state, cols) {
       convLines.push({ text: wrapped, color: C.dim })
     }
   }
-  _convCache = { key, cols, lines: convLines }
-  return convLines
+
+  // ---- Fold long blocks (> 8 consecutive dim lines) ----
+  const FOLD_LINES = 8
+  let foldCounter = 0
+  const folded = []
+  let i = 0
+  while (i < convLines.length) {
+    const line = convLines[i]
+    // Only fold dim-colored lines (tool results, subagent previews)
+    if (line.color === C.dim) {
+      let j = i
+      while (j < convLines.length && convLines[j].color === C.dim) j++
+      const blockLen = j - i
+      if (blockLen > FOLD_LINES) {
+        const foldKey = `fold-${foldCounter++}`
+        if (state.foldEnabled !== false && !state.expandedBlocks?.has(foldKey)) {
+          // Show first 2 lines + fold hint
+          folded.push(convLines[i])
+          if (blockLen > 2) folded.push(convLines[i + 1])
+          folded.push({ text: `  … ${blockLen - 2} more lines — Enter to expand`, color: C.fold, _foldToggle: foldKey })
+          i = j
+          continue
+        }
+      }
+    }
+    folded.push(line)
+    i++
+  }
+
+  _convCache = { key, cols, lines: folded }
+  return folded
 }
 
 function inputBoxStyle(state) {

package/src/tui/slash-commands.mjs

@@ -28,6 +28,8 @@ import { handleConfigCommand } from "./cmd-config.mjs"
 import { handleExtractCommand } from "./cmd-extract.mjs"
 import { handleHelpCommand } from "./cmd-help.mjs"
 import { handleUpgradeCommand } from "./cmd-upgrade.mjs"
+import { handleFoldCommand } from "./cmd-fold.mjs"
+import { handleUndoCommand } from "./cmd-undo.mjs"
 
 export const SLASH_COMMANDS = [
   { name: "/plan", group: "Agent", desc: "toggle plan mode (design first, then implement)" },
@@ -38,6 +40,7 @@ export const SLASH_COMMANDS = [
   { name: "/think", group: "Agent", desc: "thinking mode & reasoning effort" },
   { name: "/config", group: "Agent", desc: "config management (embedding / agent)" },
   { name: "/upgrade", group: "System", desc: "check for updates & upgrade" },
+  { name: "/fold", group: "System", desc: "toggle result folding on/off" },
   { name: "/new", group: "Session", desc: "new session (old one archived to slot)" },
   { name: "/session", group: "Session", desc: "list/switch archived sessions" },
   { name: "/clear", group: "Session", desc: "clear screen" },
@@ -47,6 +50,7 @@ export const SLASH_COMMANDS = [
   { name: "/mcp", group: "Project", desc: "manage MCP servers" },
   { name: "/reindex", group: "Project", desc: "rebuild memory index" },
   { name: "/restore", group: "Project", desc: "restore checkpoint" },
+  { name: "/undo", group: "Project", desc: "undo recent file modifications" },
   { name: "/exit", group: "System", desc: "exit" },
   { name: "/help", group: "System", desc: "this list" },
 ]
@@ -70,6 +74,8 @@ const HANDLERS = {
   "/model": handleModelCommand,
   "/config": handleConfigCommand,
   "/upgrade": handleUpgradeCommand,
+  "/fold": handleFoldCommand,
+  "/undo": handleUndoCommand,
   "/extract": handleExtractCommand,
   "/help": handleHelpCommand,
 }