docs: update AGENTS.md, CHANGELOG, CHEATSHEET with 20 native tools

AGENTS.md:
  - Added perf_tools.go to source layout
  - Expanded Tools section with categorized table of all 20 new tools
  - Added security invariants (O_NOFOLLOW, ClassifyPath, ClassifyURL)

CHANGELOG.md:
  - v0.38.2: batch_read, glob, file_info (first batch tools)
  - v0.39.0: 10 parallel/performance tools
  - v0.40.0: 5 more tools (sort, head_tail, base64, tr, word_count)
  - v0.40.1: security hardening (panic recovery, O_NOFOLLOW fixes, 60 tests)

CHEATSHEET.md:
  - Added Native Tools Reference: 5 tables covering File I/O, Data
    Processing, Multi-Pattern, Execution, and Agent Infrastructure

Author: molty3000

AGENTS.md

@@ -31,6 +31,7 @@ cmd/odek/
   subagent_tool.go            delegate_tasks built-in tool (sub-agent spawning)
   browser_tool.go             Built-in browser tool (HTTP fetch + headless navigation)
   file_tool.go                Built-in file tools (read_file, write_file, search_files, patch)
+  perf_tools.go               Performance/parallelism tools (batch_read, batch_patch, math_eval, diff, multi_grep, etc.)
   mcp.go                      MCP server implementation (stdio + SSE transport)
   wsapprover.go               WebSocket-based approval bridge
   ui/index.html               Single-page Web UI (~770 LOC, vanilla JS + CSS)
@@ -75,10 +76,23 @@ ReAct cycle: observe → think → act → repeat.
 - Max 90 iterations by default (`--max-iter`).
 
 ### 2. Tools
-Built-in: `read_file`, `write_file`, `search_files`, `patch`, `shell`, `browser`, `memory`, `clarify`, `delegate_tasks`, `send_message`.
+
+**Core** (always available):
+`read_file`, `write_file`, `search_files`, `patch`, `shell`, `browser`, `memory`, `clarify`, `delegate_tasks`, `send_message`
+
+**Performance/parallelism** (added v0.38-v0.40):
+| Category | Tools |
+|----------|-------|
+| Parallel batch | `batch_read` — N files in 1 call, `batch_patch` — N edits atomically, `parallel_shell` — N commands true-parallel, `http_batch` — N URLs parallel fetch |
+| Zero-fork data | `math_eval` — native arithmetic, `diff` — LCS diff, `json_query` — dot-path JSON, `tr` — text transform, `base64` — encode/decode |
+| File analysis | `glob` — fast glob find, `file_info` — stat metadata, `count_lines` — streaming line count, `word_count` — streaming word count, `checksum` — SHA256/SHA1/MD5, `sort` — sort lines, `head_tail` — first/last N lines |
+| Multi-pattern | `multi_grep` — N regex patterns parallel, `tree` — structured directory tree |
+
 All gated by the `danger` security classifier with three actions: allow, deny, prompt.
 - `shell`: Classifies commands into risk classes (safe, local_write, system_write, destructive, network_egress, code_execution, install, blocked).
 - `send_message`: Sends text/photo/document/voice to the Telegram chat with inline keyboard support.
+- All file tools: `O_NOFOLLOW` on opens, `danger.ClassifyPath` per path, atomic temp+rename for writes.
+- All network tools: `danger.ClassifyURL` per URL, configurable network egress gate.
 
 ### 3. Skills
 Trigger-matched `SKILL.md` files loaded on-demand via lazy injection. Auto-learns from patterns every session.

docs/CHANGELOG.md

@@ -1,5 +1,84 @@
 # Changelog
 
+## v0.40.1 (2026-05-24) — Security Hardening
+
+### Panic Recovery
+- Added `safeCall()` helper and `defer recover()` to all parallel goroutines and
+  file-processing helpers (`countFile`, `searchPattern`, `hashFile`, `readPreview`,
+  `countWords`) — a panic in any goroutine is caught and returned as an error entry
+  instead of crashing the process or hanging the semaphore drain
+
+### O_NOFOLLOW Hardening
+- Fixed `diff`, `tr`, `base64` tools — replaced 5 `os.ReadFile` calls with
+  `readFileNoFollow()` which opens with `O_NOFOLLOW` (previously followed symlinks)
+
+### Tests
+- 60 new test cases covering symlink rejection, empty files, binary files,
+  max limit enforcement, missing required fields, invalid JSON (all 15 tools),
+  division by zero, chain transforms, and danger config deny enforcement
+
+---
+
+## v0.40.0 (2026-05-24) — 5 More Native Perf Tools
+
+### New Tools
+
+| Tool | What it does | Fork replaced |
+|------|-------------|---------------|
+| `sort` | Sort lines asc/desc, unique, numeric, case-insensitive, multi-file merge | `sort`, `sort -u`, `sort -n` |
+| `head_tail` | First/last N lines, streaming (stops at N), parallel multi-file | `head -n`, `tail -n` |
+| `base64` | Encode files/strings, decode strings | `base64` |
+| `tr` | Case conversion, char replacement, string substitution, delete. Chainable | `tr`, `sed` (simple) |
+| `word_count` | Words+lines+chars+bytes streaming, parallel multi-file, aggregate totals | `wc` |
+
+### Stats
+- 1,009 lines added, 17 new tests, 0 new dependencies (stdlib: `encoding/base64`, `sort`)
+
+---
+
+## v0.39.0 (2026-05-24) — 10 New Parallelism/Performance Tools
+
+### New Tools
+
+| # | Tool | Parallel | Fork saved |
+|---|------|----------|------------|
+| 1 | `batch_patch` | N edits / 1 call, early-stop | N `sed`/`patch` → 1 |
+| 2 | `parallel_shell` | N commands / pool(4), timeout | N serial → parallel |
+| 3 | `http_batch` | N URLs / pool(4), 30s timeout | N `curl` → 1 call |
+| 4 | `math_eval` | N/A — go/parser AST walk | `bc`, `expr`, `python -c` |
+| 5 | `diff` | N/A — LCS line diff | `diff` fork |
+| 6 | `count_lines` | N files / pool(4), streaming | `wc -l` |
+| 7 | `multi_grep` | N patterns / pool(4), parallel walk | N `grep` → 1 call |
+| 8 | `json_query` | N/A — dot-path with array indexing | `jq`, `python -c` |
+| 9 | `tree` | N/A — recursive structured listing | `find`, `tree`, `ls -R` |
+| 10 | `checksum` | N files / pool(4), crypto stdlib | `sha256sum`, `md5sum` |
+
+### Security
+- All tools gate through `danger.ClassifyPath`/`ClassifyURL` + `CheckOperation`
+- All file opens use `O_NOFOLLOW` (anti-symlink)
+- All registered in `classifyToolCall()` for batch approval gate
+- `parallel_shell` individually classifies each command through the danger classifier
+
+### Stats
+- 2,126 lines added across 4 files (perf_tools.go 1,472 + test 640 + main.go 10 + loop.go 7)
+- 25 new tests, 0 new dependencies
+- Binary stays at ~12MB
+
+---
+
+## v0.38.2 (2026-05-24) — batch_read, glob, file_info
+
+### New Tools
+- **`batch_read`** — read N files in parallel goroutines, returns all content/errors in one call. Fixes fast_read benchmark (was 23%, 163s across 10 serial iterations)
+- **`glob`** — file finding by glob pattern. `filepath.Glob` for simple patterns (zero-walk), fallback to `filepath.Walk` for recursive
+- **`file_info`** — file metadata via Lstat: size, mod_time (ISO8601), mode, is_dir, is_symlink, is_regular
+
+### Security
+- Same `danger.ClassifyPath` + `CheckOperation` + `O_NOFOLLOW` as all existing tools
+- 14 new tests, 0 new dependencies
+
+---
+
 ## v0.37.0 (2026-05-23) — AIEB v2.0 Benchmark: 80.3%
 
 ### Code Generation Discipline

docs/CHEATSHEET.md

@@ -209,3 +209,55 @@ odek mcp                                    # stdio transport
 - **One loop, one interface** — tool implementers write `func Call(args string) (string, error)`
 - **File-based config** — no YAML, no DSL, no schema generation
 - **Sandbox is opt-in** — no container runtime required for basic operation
+
+## Native Tools Reference
+
+### File I/O (zero-fork, O_NOFOLLOW gated)
+| Tool | Description |
+|------|-------------|
+| `read_file` | Read with line numbers, offset/limit pagination |
+| `write_file` | Atomic temp+rename write, path confinement |
+| `patch` | Find-and-replace with unified diff output |
+| `batch_read` | Read N files in parallel, one call |
+| `batch_patch` | Apply N edits atomically across files |
+| `glob` | Find files by glob pattern |
+| `file_info` | Stat metadata (size, mod_time, mode, type) |
+| `sort` | Sort lines asc/desc/unique/numeric/case-insensitive |
+| `head_tail` | First/last N lines, streaming, parallel |
+| `search_files` | Regex content search or glob file find |
+
+### Data Processing (in-process, no shell fork)
+| Tool | Description |
+|------|-------------|
+| `math_eval` | Arithmetic via go/parser AST (`42*17+256/10 = 97`) |
+| `diff` | LCS structured line diff |
+| `json_query` | Dot-path query with array indexing (`users[0].name`) |
+| `tr` | Text transform: upper/lower/char/string/delete |
+| `base64` | Encode files/strings, decode base64 |
+| `count_lines` | Streaming line/byte count, parallel files |
+| `word_count` | Streaming word/line/char/byte count |
+| `checksum` | SHA-256, SHA-1, MD5 hashing |
+| `tree` | Structured directory tree listing |
+
+### Multi-Pattern (parallel goroutine search)
+| Tool | Description |
+|------|-------------|
+| `multi_grep` | Search N regex patterns in parallel |
+| `search_files` | Single-pattern content/file search |
+
+### Execution (shell replacement)
+| Tool | Description |
+|------|-------------|
+| `shell` | Single command, danger-classified |
+| `parallel_shell` | N commands, true parallel, per-cmd timeout |
+| `http_batch` | N URLs parallel fetch (no HTML parse) |
+| `browser` | HTTP fetch + regex HTML extraction |
+
+### Agent Infrastructure
+| Tool | Description |
+|------|-------------|
+| `delegate_tasks` | Spawn sub-agent OS processes |
+| `memory` | Persistent fact CRUD with cosine-merge |
+| `clarify` | Ask the user for clarification |
+| `send_message` | Send text/photo/document to Telegram |
+| `skill_load/list/save/patch/delete` | Skill CRUD |