feat: confucius-aligned agent stack — economy mode, session memory, context pruning, self-correction

[Copilot]

Adds a layered set of cost-control and quality improvements to the XibeCode agent: economy mode (iteration caps + cheaper planning model), session memory, context pruning, plan-first execution, self-correction retries for run-pr, and security utilities for path/URL validation.

Description

Economy Mode & Multi-Model Routing

• New --cost-mode economy CLI flag (and config --set-cost-mode) caps agent iterations and routes planning steps to a cheaper model while reserving the full model for execution turns.
• economyMaxTokens config key exists; note: max_tokens in agent.ts is still hard-coded (8192/16000) — economy mode today reduces iterations, not per-request token budget.

Session Memory & Context Pruning

• Session memory persisted to disk; agent recalls prior task context across runs.
• context-pruner.ts scores and selects the most relevant files before building the context window, replacing coarse file inclusion.

Security Utilities (src/utils/safety.ts)

• sanitizePath(workingDir, filePath) — resolves and validates paths stay inside the working directory; rejects traversal attempts.
• sanitizeUrl(url) — blocks non-http(s) protocols and private/localhost destinations (SSRF mitigation for fetch_url).

Self-Correction Loop (run-pr)

• run-pr retries after test failures up to a configurable limit before giving up, allowing the agent to fix its own mistakes before surfacing an error.

Meta-Tool Synthesis (synthesize_tool)

• Dynamic tool registration at session scope via synthesize_tool. Known gap: synthesized tool names are not in TOOL_CATEGORIES, so isToolAllowed() rejects them before dispatch — needs permission-layer fix before this is functional.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)

Related Issues

Testing

• Unit tests pass (pnpm test)
• E2E tests pass (pnpm test:e2e)
• TypeScript compiles without errors (pnpm build)
• Manual testing performed

Checklist

• My code follows the project's coding style
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Screenshots (if applicable)

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[xibe-review]

Hey @Copilot! 👋

I'll go through the changes and help you out with an automated review! 🔍

Starting the review now...

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.