thincoder 0.9.0 → 0.10.0

package/README.md

@@ -205,6 +205,11 @@ Code conventions: pure `.mjs`, no semicolons, no npm dependencies allowed (inclu
 
 ## Changelog
 
+### 0.10.0 (2026-07)
+- **LSP tool** — `lsp` tool provides code intelligence via Language Server Protocol: go-to-definition, find-references, hover info, document symbols, diagnostics. Zero-dependency JSON-RPC 2.0 over stdio client. Lazy-starts language servers on first call. Configurable via `lsp.servers` in config.json (defaults: `typescript-language-server` for JS/TS, `pyright-langserver` for Python).
+- **Smart context: compaction checkpoint** — `compressIfNeeded` now auto-creates a git checkpoint before compaction. A checkpoint reference is injected after compaction so the model can reconstruct context from git diff + recent messages + task progress. Prevents information loss during long sessions.
+- **CodeMode: sandboxed JS execution** — `execute` tool backed by `vm.Script.runInNewContext`. Compose multiple file operations (read/write/glob/grep/log) into a single script, reducing API round-trips and keeping intermediate results out of context. Sandbox strips all Node APIs, limits output to 50KB, enforces 30s timeout, and blocks private IPs in fetch. Script size capped at 50KB.
+
 ### 0.9.0 (2026-07)
 - **Config JSON Schema** — `saveConfig` auto-injects `$schema` reference; `docs/schemas/config.schema.json` provides editor autocompletion/validation for all config fields including the new `hooks` section.
 - **Lifecycle Hooks** — `PreToolUse` / `PostToolUse` / `PostToolUseFailure` / `Notification` events. User-defined shell commands in config, with per-tool regex matching, timeout control, and `block`/`allow`/`notify` actions. Implemented in `src/hooks.mjs`, integrated into tool dispatch.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",

package/src/context.mjs

@@ -178,7 +178,25 @@ export async function compressIfNeeded(agent, threshold, callbacks) {
     onReasoning: callbacks?.onReasoning,
   })
 
+  // Auto-checkpoint before compaction: snapshot current state so the model can
+  // reconstruct context from git diff + recent messages + task progress later.
+  let cpId = null
+  try {
+    const { createCheckpoint } = await import("../git/checkpoint.mjs")
+    const cp = await createCheckpoint(agent.cwd)
+    cpId = cp?.id
+  } catch { /* checkpoint might fail — compaction itself should not be blocked */ }
+
   applyCompression(agent, split.headEnd, split.tailStart, COMPACTION_PREFIX + summary.content)
+
+  // Inject checkpoint reference after compaction so the model knows it can use /restore
+  if (cpId) {
+    agent.history.splice(split.headEnd, 0, {
+      role: "user",
+      content: `[System: context compacted. A checkpoint (id: ${cpId}) was auto-created before compaction. Use the checkpoint tool to review pre-compaction state if needed. File changes since then are tracked in git diff.]`,
+    })
+  }
+
   return true
 }
 

package/src/tools/codemode.mjs

@@ -0,0 +1,178 @@
+/**
+ * tools/codemode.mjs — CodeMode: sandboxed JS execution tool
+ *
+ * Gives the model an `execute` tool backed by Node.js vm.Script.runInNewContext.
+ * Multiple tool calls can be composed into a single script, reducing API round-trips
+ * and keeping large intermediate results out of context.
+ *
+ * Sandbox API (all sync, no callbacks):
+ *   readFile(path)      — read a file relative to cwd, return string
+ *   writeFile(path, c)  — write content to a file (auto-creates parent dirs)
+ *   glob(pattern)        — return array of matching paths
+ *   grep(pattern, file)  — return array of matching lines
+ *   log(...args)         — append to output buffer
+ *   fetch(url)           — HTTP GET, return string (SSRF-protected)
+ *
+ * Not available: require, import, process, child_process, setTimeout, any Node API.
+ *
+ * Limits:
+ *   timeout: 30s (configurable via timeoutMs param)
+ *   maxOutput: 50000 bytes
+ *   maxScriptSize: 50000 bytes
+ */
+
+import { Script, createContext } from "node:vm"
+import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSync } from "node:fs"
+import { join, dirname, relative, resolve } from "node:path"
+import { globToRegex, normalizeEOL } from "./shared.mjs"
+
+const MAX_OUTPUT = 50_000
+const MAX_SCRIPT = 50_000
+const DEFAULT_TIMEOUT = 30_000
+
+/** SSRF-safe fetch: only http/https, private IP rejection, 10s timeout */
+async function sandboxFetch(url) {
+  const parsed = new URL(url)
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new Error(`CodeMode fetch: protocol not allowed: ${parsed.protocol}`)
+  }
+  // Block private/internal IPs
+  const hostname = parsed.hostname.toLowerCase()
+  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" ||
+      hostname.startsWith("192.168.") || hostname.startsWith("10.") ||
+      hostname.startsWith("172.16.") || hostname.startsWith("172.17.") ||
+      hostname.startsWith("172.18.") || hostname.startsWith("172.19.") ||
+      hostname.startsWith("172.20.") || hostname.startsWith("172.21.") ||
+      hostname.startsWith("172.22.") || hostname.startsWith("172.23.") ||
+      hostname.startsWith("172.24.") || hostname.startsWith("172.25.") ||
+      hostname.startsWith("172.26.") || hostname.startsWith("172.27.") ||
+      hostname.startsWith("172.28.") || hostname.startsWith("172.29.") ||
+      hostname.startsWith("172.30.") || hostname.startsWith("172.31.") ||
+      hostname === "0.0.0.0" || hostname.endsWith(".local")) {
+    throw new Error(`CodeMode fetch: private/internal host not allowed: ${hostname}`)
+  }
+  const ctrl = new AbortController()
+  const timer = setTimeout(() => ctrl.abort(), 10_000)
+  try {
+    const res = await fetch(url, { signal: ctrl.signal })
+    const text = await res.text()
+    return text.slice(0, 100_000)
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+export const codeModeTool = {
+  name: "execute",
+  description:
+    "Execute sandboxed JavaScript code. Use this to compose multiple file operations into one call — " +
+    "read, write, glob, grep, and log results. No network or system access. Max 30s timeout, 50KB output.",
+  parameters: {
+    type: "object",
+    properties: {
+      code: {
+        type: "string",
+        description: "JavaScript code to execute in the sandbox. Use provided functions: readFile(path), writeFile(path, content), glob(pattern), grep(pattern, file), log(...args).",
+      },
+      timeoutMs: {
+        type: "integer",
+        description: `Timeout in milliseconds (default ${DEFAULT_TIMEOUT}, max 60000)`,
+      },
+    },
+    required: ["code"],
+  },
+  readonly: false,
+
+  async execute(args, ctx) {
+    const cwd = ctx.cwd
+    const code = args.code ?? ""
+
+    if (code.length > MAX_SCRIPT) {
+      return `Error: script too large (${code.length} > ${MAX_SCRIPT} bytes). Split into smaller scripts or use individual tools.`
+    }
+
+    const output = []
+    const timeoutMs = Math.min(args.timeoutMs ?? DEFAULT_TIMEOUT, 60_000)
+
+    // File path guard: ensure paths are within cwd
+    function safePath(p) {
+      if (typeof p !== "string") throw new Error(`Path must be a string, got ${typeof p}`)
+      // Normalize and resolve
+      const abs = resolve(cwd, p)
+      // Check containment
+      const rel = relative(cwd, abs)
+      if (rel.startsWith("..") || (rel.includes("..") && process.platform === "win32")) {
+        throw new Error(`Path traversal denied: ${p}`)
+      }
+      return abs
+    }
+
+    const sandbox = createContext({
+      readFile: (p) => {
+        const abs = safePath(p)
+        if (!existsSync(abs)) throw new Error(`File not found: ${p}`)
+        const st = statSync(abs)
+        if (st.size > 5_000_000) throw new Error(`File too large: ${p} (${Math.round(st.size / 1000000)}MB)`)
+        return normalizeEOL(readFileSync(abs, "utf8"))
+      },
+      writeFile: (p, content) => {
+        const abs = safePath(p)
+        mkdirSync(dirname(abs), { recursive: true })
+        writeFileSync(abs, String(content), "utf8")
+      },
+      glob: (pattern) => {
+        if (typeof pattern !== "string") throw new Error("glob pattern must be a string")
+        const regex = globToRegex(pattern)
+        const results = []
+        function walk(dir, rel) {
+          let entries
+          try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
+          for (const e of entries) {
+            if (e.name.startsWith(".") || e.name === "node_modules") continue
+            const relPath = rel ? `${rel}/${e.name}` : e.name
+            if (e.isDirectory()) { walk(join(dir, e.name), relPath) }
+            else if (regex.test(relPath)) results.push(relPath)
+          }
+        }
+        walk(cwd, "")
+        return results.slice(0, 200)
+      },
+      grep: (pattern, file) => {
+        if (typeof pattern !== "string") throw new Error("grep pattern must be a string")
+        if (typeof file !== "string") throw new Error("grep file must be a string")
+        const abs = safePath(file)
+        if (!existsSync(abs)) throw new Error(`File not found: ${file}`)
+        const content = normalizeEOL(readFileSync(abs, "utf8"))
+        const regex = new RegExp(pattern)
+        const lines = content.split("\n")
+        const matches = []
+        for (let i = 0; i < lines.length; i++) {
+          if (regex.test(lines[i])) matches.push(`${i + 1}: ${lines[i].slice(0, 200)}`)
+        }
+        return matches.slice(0, 100)
+      },
+      log: (...args) => {
+        const line = args.map((a) => typeof a === "object" ? JSON.stringify(a) : String(a)).join(" ")
+        output.push(line)
+        if (output.join("\n").length > MAX_OUTPUT) {
+          output.push("... (output truncated)")
+          throw new Error("CodeMode output limit exceeded")
+        }
+      },
+      fetch: sandboxFetch,
+    })
+
+    try {
+      const script = new Script(code, {
+        filename: "codemode.js",
+        timeout: timeoutMs,
+      })
+      script.runInContext(sandbox)
+      return output.join("\n") || "(no output)"
+    } catch (err) {
+      const out = output.join("\n")
+      const prefix = out ? `${out}\n\n` : ""
+      return `${prefix}Error: ${err.message}`
+    }
+  },
+}

package/src/tools/index.mjs

@@ -8,13 +8,15 @@ import { websearchTool, fetchTool } from "./web.mjs";
 import { gitDiffTool, gitStatusTool, gitLogTool, questionTool, checkpointTool } from "./git.mjs";
 import { checklistTool } from "./checklist.mjs";
 import { linterTool } from "./linter.mjs";
+import { lspTool } from "./lsp.mjs";
+import { codeModeTool } from "./codemode.mjs";
 
 export const builtinTools = [
   readTool, writeTool, editTool, insertAfterTool, hashlineEditTool, applyPatchTool,
   syntaxCheckTool, readImageTool, bashTool, globTool, grepTool,
   websearchTool, lsTool, fetchTool, deleteTool,
   gitDiffTool, gitStatusTool, gitLogTool, questionTool, checkpointTool,
-  checklistTool, linterTool,
+  checklistTool, linterTool, lspTool, codeModeTool,
 ];
 
 export {
@@ -22,5 +24,5 @@ export {
   syntaxCheckTool, readImageTool, bashTool, globTool, grepTool,
   websearchTool, lsTool, fetchTool, deleteTool,
   gitDiffTool, gitStatusTool, gitLogTool, questionTool, checkpointTool,
-  checklistTool, linterTool,
+  checklistTool, linterTool, lspTool, codeModeTool,
 };

package/src/tools/lsp.mjs

@@ -0,0 +1,317 @@
+/**
+ * tools/lsp.mjs — LSP (Language Server Protocol) code intelligence tool
+ * Zero-dependency JSON-RPC 2.0 over stdio client.
+ *
+ * Provides: go-to-definition, find-references, hover info, document symbols, diagnostics.
+ * Lazy-starts language servers on first call. Configurable via config.json lsp.servers.
+ *
+ * Config format:
+ *   "lsp": {
+ *     "servers": {
+ *       "typescript": { "command": "typescript-language-server", "args": ["--stdio"] },
+ *       "python": { "command": "pyright-langserver", "args": ["--stdio"] }
+ *     }
+ *   }
+ */
+
+import { spawn } from "node:child_process"
+import { existsSync, readFileSync } from "node:fs"
+import { join, extname } from "node:path"
+
+// ---- JSON-RPC transport over stdio ----
+
+/** Send a JSON-RPC request to the server via stdin */
+function send(proc, message) {
+  const body = JSON.stringify(message)
+  const header = `Content-Length: ${Buffer.byteLength(body)}\r\n\r\n`
+  proc.stdin.write(header + body)
+}
+
+/** Read one JSON-RPC message from stdout. Returns parsed JSON, or null on EOF. */
+function readMessage(proc) {
+  return new Promise((resolve) => {
+    let header = ""
+    let contentLength = -1
+
+    const onData = (chunk) => {
+      if (contentLength < 0) {
+        header += chunk.toString()
+        const match = header.match(/Content-Length: (\d+)\r\n\r\n/)
+        if (match) {
+          contentLength = parseInt(match[1])
+          const bodyStart = header.indexOf("\r\n\r\n") + 4
+          const remaining = header.slice(bodyStart)
+          header = ""
+          if (remaining.length >= contentLength) {
+            proc.stdout.removeListener("data", onData)
+            try { resolve(JSON.parse(remaining.slice(0, contentLength))) } catch { resolve(null) }
+            return
+          }
+          // Need more data — leave remaining in a buffer-like state
+          proc.stdout.removeListener("data", onData)
+          readBody(proc, remaining, contentLength).then(resolve)
+        }
+      }
+    }
+
+    proc.stdout.on("data", onData)
+  })
+}
+
+function readBody(proc, buf, targetLen) {
+  return new Promise((resolve) => {
+    const onData = (chunk) => {
+      buf += chunk.toString()
+      if (buf.length >= targetLen) {
+        proc.stdout.removeListener("data", onData)
+        try { resolve(JSON.parse(buf.slice(0, targetLen))) } catch { resolve(null) }
+      }
+    }
+    proc.stdout.on("data", onData)
+  })
+}
+
+/** Send a request and wait for the matching response */
+async function request(proc, method, params, id) {
+  send(proc, { jsonrpc: "2.0", id, method, params })
+  while (true) {
+    const msg = await readMessage(proc)
+    if (!msg) return null
+    if (msg.id === id) return msg
+    // Store notifications for later retrieval (diagnostics)
+    if (msg.method === "textDocument/publishDiagnostics") {
+      proc._diagnostics = proc._diagnostics || {}
+      proc._diagnostics[msg.params.uri] = msg.params.diagnostics
+    }
+  }
+}
+
+/** Send a notification (no response expected) */
+function notify(proc, method, params) {
+  send(proc, { jsonrpc: "2.0", method, params })
+}
+
+// ---- Language server process management ----
+
+const servers = new Map() // ext → { proc, rootUri, ready }
+
+/** Convert file path to file:// URI */
+function toUri(absPath) {
+  return "file:///" + absPath.replace(/\\/g, "/").replace(/^([A-Z]):/, (_, d) => d.toLowerCase() + "%3A")
+}
+
+/** Resolve which language server to use for a file extension */
+function resolveServerConfig(config, ext) {
+  const map = {
+    ".js": "typescript", ".mjs": "typescript", ".cjs": "typescript",
+    ".ts": "typescript", ".tsx": "typescript", ".mts": "typescript", ".cts": "typescript",
+    ".py": "python", ".pyi": "python",
+    ".rs": "rust",
+    ".go": "go",
+  }
+  const key = map[ext] || ext.slice(1)
+  const servers = config?.lsp?.servers ?? {}
+  return servers[key] || null
+}
+
+/** Start or reuse a language server for the given file */
+async function getServer(cwd, filePath, config) {
+  const ext = extname(filePath).toLowerCase()
+  const srvConfig = resolveServerConfig(config, ext)
+  if (!srvConfig) return null
+
+  const abs = join(cwd, ...filePath.split("/"))
+  if (!existsSync(abs)) return null
+
+  const rootUri = toUri(cwd)
+  const key = `${ext}:${cwd}`
+  let entry = servers.get(key)
+
+  if (entry && entry.ready) return entry
+
+  // Start new server
+  const proc = spawn(srvConfig.command, srvConfig.args || [], {
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true,
+  })
+
+  proc.stderr.on("data", () => {}) // suppress stderr noise
+
+  entry = { proc, rootUri, ready: false }
+  servers.set(key, entry)
+
+  // Initialize handshake
+  const initResult = await request(proc, "initialize", {
+    processId: null,
+    rootUri,
+    capabilities: {
+      textDocument: {
+        definition: { linkSupport: false },
+        references: {},
+        hover: { contentFormat: ["plaintext"] },
+        documentSymbol: { hierarchicalDocumentSymbolSupport: true },
+      },
+    },
+    workspace: {},
+  }, 1)
+
+  if (!initResult) {
+    proc.kill()
+    servers.delete(key)
+    return null
+  }
+
+  notify(proc, "initialized", {})
+  entry.ready = true
+  return entry
+}
+
+/** Notify the server that a file is open (required before queries) */
+async function ensureOpen(proc, uri, ext) {
+  const langMap = { ".js": "javascript", ".mjs": "javascript", ".cjs": "javascript", ".ts": "typescript", ".tsx": "typescript", ".mts": "typescript", ".cts": "typescript", ".py": "python", ".rs": "rust", ".go": "go" }
+  const languageId = langMap[ext] || ext.slice(1)
+  notify(proc, "textDocument/didOpen", {
+    textDocument: {
+      uri,
+      languageId,
+      version: 1,
+      text: readFileSync(uri.replace(/^file:\/\/\//, "").replace(/%3A/, ":").replace(/\//g, "\\"), "utf8"),
+    },
+  })
+}
+
+// ---- Tool definition ----
+
+export const lspTool = {
+  name: "lsp",
+  description:
+    "LSP code intelligence: go to definition, find references, hover info, document symbols, diagnostics. " +
+    "Use this to understand code structure without grep-guessing function locations or type shapes.",
+  parameters: {
+    type: "object",
+    properties: {
+      subcommand: {
+        type: "string",
+        enum: ["definition", "references", "hover", "symbols", "diagnostics"],
+        description: "LSP operation to perform",
+      },
+      uri: {
+        type: "string",
+        description: "Target file path (relative to project root)",
+      },
+      line: {
+        type: "integer",
+        description: "1-based line number (for definition/references/hover)",
+      },
+      character: {
+        type: "integer",
+        description: "1-based character offset (for definition/references/hover)",
+      },
+    },
+    required: ["subcommand", "uri"],
+  },
+  readonly: true,
+
+  async execute(args, ctx) {
+    const config = ctx.agent?.config ?? {}
+    const cwd = ctx.cwd
+    const filePath = args.uri
+
+    try {
+      const entry = await getServer(cwd, filePath, config)
+      if (!entry) {
+        const ext = extname(filePath).toLowerCase()
+        return `No LSP server configured for "${ext}" files. Add one to config.json:\n"lsp": { "servers": { "${ext.slice(1)}": { "command": "...", "args": ["--stdio"] } } }`
+      }
+
+      const { proc } = entry
+      const abs = join(cwd, ...filePath.split("/"))
+      const uri = toUri(abs)
+      const ext = extname(filePath).toLowerCase()
+      await ensureOpen(proc, uri, ext)
+
+      // Wait briefly for diagnostics to arrive
+      await new Promise((r) => setTimeout(r, 300))
+
+      switch (args.subcommand) {
+        case "definition": {
+          if (!args.line || !args.character) return "Error: line and character required for definition"
+          const res = await request(proc, "textDocument/definition", {
+            textDocument: { uri },
+            position: { line: args.line - 1, character: args.character - 1 },
+          }, 10)
+          if (!res?.result) return "No definition found."
+          const locs = Array.isArray(res.result) ? res.result : [res.result]
+          return locs.map((l) => {
+            const path = l.uri.replace(/^file:\/\/\//, "").replace(/%3A/, ":")
+            return `${path}:${l.range.start.line + 1}:${l.range.start.character + 1}`
+          }).join("\n")
+        }
+
+        case "references": {
+          if (!args.line || !args.character) return "Error: line and character required for references"
+          const res = await request(proc, "textDocument/references", {
+            textDocument: { uri },
+            position: { line: args.line - 1, character: args.character - 1 },
+            context: { includeDeclaration: false },
+          }, 10)
+          if (!res?.result?.length) return "No references found."
+          return res.result.slice(0, 50).map((l) => {
+            const path = l.uri.replace(/^file:\/\/\//, "").replace(/%3A/, ":")
+            return `${path}:${l.range.start.line + 1}:${l.range.start.character + 1}`
+          }).join("\n") + (res.result.length > 50 ? `\n... and ${res.result.length - 50} more` : "")
+        }
+
+        case "hover": {
+          if (!args.line || !args.character) return "Error: line and character required for hover"
+          const res = await request(proc, "textDocument/hover", {
+            textDocument: { uri },
+            position: { line: args.line - 1, character: args.character - 1 },
+          }, 10)
+          if (!res?.result?.contents) return "No hover info available."
+          const contents = res.result.contents
+          if (typeof contents === "string") return contents
+          if (Array.isArray(contents)) return contents.map((c) => typeof c === "string" ? c : c.value).join("\n")
+          if (contents.value) return contents.value
+          return JSON.stringify(contents)
+        }
+
+        case "symbols": {
+          const res = await request(proc, "textDocument/documentSymbol", {
+            textDocument: { uri },
+          }, 10)
+          if (!res?.result?.length) return "No symbols found."
+          function render(nodes, depth) {
+            const lines = []
+            for (const n of nodes) {
+              const kind = n.kind != null ? ` [${symbolKind(n.kind)}]` : ""
+              lines.push(`${"  ".repeat(depth)}${n.name}${kind} — L${n.range.start.line + 1}`)
+              if (n.children?.length) lines.push(...render(n.children, depth + 1))
+            }
+            return lines
+          }
+          return render(res.result, 0).join("\n")
+        }
+
+        case "diagnostics": {
+          const diags = proc._diagnostics?.[uri]
+          if (!diags?.length) return "No diagnostics."
+          return diags.slice(0, 30).map((d) => {
+            const sev = { 1: "ERROR", 2: "WARN", 3: "INFO", 4: "HINT" }[d.severity] || "?"
+            return `L${d.range.start.line + 1}: ${sev}: ${d.message}${d.code ? ` [${d.code}]` : ""}`
+          }).join("\n") + (diags.length > 30 ? `\n... and ${diags.length - 30} more` : "")
+        }
+
+        default:
+          return `Unknown subcommand: ${args.subcommand}`
+      }
+    } catch (err) {
+      return `LSP error: ${err.message}`
+    }
+  },
+}
+
+function symbolKind(k) {
+  const kinds = { 1: "file", 2: "module", 3: "namespace", 4: "package", 5: "class", 6: "method", 7: "property", 8: "field", 9: "constructor", 10: "enum", 11: "interface", 12: "function", 13: "variable", 14: "constant", 15: "string", 16: "number", 17: "boolean", 18: "array", 19: "object", 20: "key", 21: "null", 22: "enumMember", 23: "struct", 24: "event", 25: "operator", 26: "typeParameter" }
+  return kinds[k] || `kind-${k}`
+}