Replace unsafe string concatenation patterns using strcpy/strcat with explicit memcpy calls and proper null-termination in bash_repair.c, context_manager.c, context_summarizer.c, and db.c. Add missing null-pointer checks for strdup results in bash_executor.c. Introduce atomic_int for spinner_running flag in http_client.c. Add consecutive_tool_error_iterations field to agent struct and refactor agent heartbeat/token tracking to use messages_get_db instead of db_open. Remove r_config_get_max_tokens declaration from r_config.h. Add json_repair.c to Makefile build sources and include db.h in messages.h with new messages_get_db function declaration.
Implement spawn_tracker module to enforce recursive agent spawning limits via R_MAX_SPAWN_DEPTH and R_MAX_TOTAL_SPAWNS environment variables, replacing the previous max_subagents parameter in tool_agent.c. Add tool_deepsearch.c implementing an iterative multi-query research algorithm with configurable system message, and register the new source files in Makefile build targets.
- Add agent_set_is_subagent and agent_set_tool_registry to agent API for subagent support
- Add timeout_seconds parameter to r_bash_execute to prevent hanging processes
- Refactor context_manager truncation logic with dynamic ratio-based truncation and total size calculation
- Add messages_to_json_string helper and r_config_get_max_tokens accessor
- Introduce tool_registry_get_specialized for type-filtered tool registries
- Add completion_phrases and passive_phrases detection to agent completion logic
- Suppress spinner in http_client when stderr is not a TTY
- Add comprehensive agent_benchmark.py with TestCase framework and logging
