P0 (data corruption / dead-on-install / documented-usage traps):
- edit_file: replace via a function so $$/$&/$' in new_string are
  written literally instead of corrupting the file
- CLI: realpath argv[1] before comparing to import.meta.url — npm bin
  symlinks made the installed command silently do nothing
- Agent.chat: finally-backfill tool replies when a consumer abandons
  the generator (for-await break poisoned the history permanently)
- SSE body phase: abort now cancels the reader (unblocks reads and
  closes the connection) and each read races an idle timer, so a
  stalled stream errors instead of hanging the turn forever

P1 (hangs / silently wrong):
- bash kill: SIGTERM now escalates to SIGKILL after a 5s grace, so a
  TERM-trapping child can't wedge the REPL; timer cleared on exit
- tools: makeAllTools() factory — a second Agent no longer re-points
  the first Agent's shared SubAgentTool at itself
- context: compression LLM calls take the turn's AbortSignal
- llm: tool-call arguments parsing coerces null/array/scalar to {}
- context: layer-0 truncation for a single message that alone exceeds
  the window (was an unrecoverable 413 loop)
- glob: strip leading ./ and support [ch]/[!x] character classes
  (both silently matched nothing)
- cwd: tracked cwd moved to paths.ts so every tool resolves relative
  paths against it, and cd parsing follows ;/|| chains too

Adds 11 regression tests (54 total pass).

…asses

- rounds() awaits stream.return() and sseEvents awaits reader.cancel():
  for-await's break waits on the return() chain, so teardown now
  completes before break returns, and a throwing inner finally surfaces
  as a handled rejection instead of an unhandled one. The regression
  test asserts closure immediately after break, no sleep.
- Character classes now follow Python fnmatch semantics on the edges:
  ^ is a literal member (only ! negates), ] right after [ or [! is a
  literal member, and an invalid range like [z-a] matches nothing
  instead of throwing. The doc comment states the supported subset
  explicitly — no claim of a full glob dialect.

…onesty

- kill goes straight to SIGKILL on the whole process group: Python's
  subprocess.run timeout behavior (kill outright), hardened from the
  direct child to the group. The TERM->timer->KILL machinery is gone.
- remove the oversized-input pre-check: it judged user input by an
  estimate and could refuse legitimate messages; the provider's own
  context error is the honest answer.
- /tokens prints 'unknown' when the provider has never reported usage,
  instead of dressing unknown up as 0 (usageSeen on LLMClient).
- write the token-accounting principle into context.ts, document the
  no-usage degradation on observe(), compress the sseEvents comments.