@armadra/agent 0.6.8 → 0.7.1

package/CHANGELOG.md

@@ -5,6 +5,75 @@ English · [简体中文](CHANGELOG.zh-CN.md)
 > This file is in English starting with 0.6.0. Release notes for 0.1 through 0.5.1 are in Chinese in
 > [CHANGELOG.zh-CN.md](CHANGELOG.zh-CN.md). New entries go into both files.
 
+## 0.7.1 (2026-10-05)
+
+- **Windows: concurrent OAuth refresh**: while one ama process releases the `auth.json.lock`, another one opening it
+  got EPERM (the file is "delete pending" on NTFS) and failed the refresh; it now keeps waiting for the lock. Replacing
+  or reading `auth.json` while another process has it open retries briefly on EPERM / EACCES / EBUSY (Windows only).
+- **Checkpoints (shadow-git)**: the 3-second snapshot budget no longer includes creating the shadow repository the first
+  time (a dozen `git` processes, several seconds on Windows), which could downgrade a session to `tools` on its first turn.
+
+## 0.7.0 (2026-10-04)
+
+ACP completion: `ama --mode acp` as an agent for editors (Zed and other ACP clients) and `AcpClient` / `AcpDriver` as a
+client, checked in-repo against the official ACP v1 schema 1.24.1. Docs: docs/acp.md (English: docs/en/acp.md).
+
+- **No model, no exit**: without a model `ama --mode acp` no longer exits with code 4. It answers `initialize` (two
+  terminal auth methods when the client declares `clientCapabilities.auth.terminal`: their `args`,
+  `--acp-terminal-auth chatgpt` / `api-key`, are appended to the configured command as the spec says, and ama then runs
+  `ama auth login chatgpt` / `ama auth set` instead of ACP mode; the start-up `--auth-file` / profile `authFile` is passed on), answers session
+  methods with -32000 (the no-model guidance, `data.authMethods`) and retries start-up on them at most once per second;
+  once a model is available the same connection is handed to the normal ACP server (no new `initialize`). `authenticate`
+  answers -32602; closing stdin exits 0. stdout is taken over before start-up in ACP mode. `ama auth set` without a
+  provider on a TTY now lets you pick one with the arrow keys (non-TTY is still a usage error).
+- **Several sessions**: every ACP session stays open in memory (an empty one can be switched back to); one turn runs at
+  a time and `session/prompt` for another session is queued (FIFO) instead of failing busy. `session/new` / `load` /
+  `resume` / `list` / `set_mode` / `set_config_option` / `close` work while a turn runs. Permission modes are kept per
+  session and applied when its turn starts. `session/cancel` on a queued prompt answers `cancelled`. `session/list`
+  filters by `cwd`, pages 50 at a time with `nextCursor` (an invalid cursor is invalid params) and strips embedded
+  resources from titles; `session_info_update` (title, `updatedAt`) is sent at the end of each turn. A refusal (Anthropic
+  `stop_reason: "refusal"`, new `StopReason` value) answers `refusal`; elsewhere the message still ends as an error
+  (`stopReasonOf()` tells them apart; the fake provider script accepts `stopReason: "refusal"`). `mcpServers` /
+  `additionalDirectories` are ignored with one stderr line. **Behavior change**: after `session/close`, requests for
+  that id answer -32002 (it used to reopen); open it again with `session/load` / `session/resume`.
+- **Tool calls in detail**: `tool_call` carries `name`; each tool call inside a codemode script is listed as its own
+  `tool_call` (title prefixed `codemode › `, `_meta.ama.parentToolCallId` points at the outer call) and closes on its
+  own, and permission requests use the requesting call's id, so they no longer point at unknown ids. While a permission
+  request is open the call goes back to `pending`, then `in_progress` once allowed. `edit` / `write` fill the new
+  `ToolResult.fileChange` (raw before / after text with BOM and CRLF, `oldText: null` for a new file, omitted above
+  256 KiB per side; never persisted and stripped from RPC / stream-json events), and the completed update carries a
+  `diff` plus the first 4 KB of text, with `locations[].line` at the first changed line. Replayed tool results
+  (`session/load`) carry their first 4 KB of text (no diff). Permission modes get display names and localized
+  descriptions.
+- **Config options and command list**: session-open results carry `configOptions` — `mode` (the permission mode, the same state as `modes`; clients with config options such
+  as Zed ignore `modes`), `model` (grouped by provider,
+  values `provider/model-id`, the same "configured" view as the TUI `/model` picker: only providers with a key, an OAuth
+  login or local, `models.enabled` respected, `fake` hidden by the usual rule) and `thinking` (category `thought_level`,
+  only the levels the current model supports); no boolean options. `session/set_config_option`
+  switches them (unknown ids / values answer -32602) and model / thinking level changes send `config_option_update`.
+  After a session opens, `available_commands_update` lists skills as `skill:<name>` and prompt templates as `<name>`
+  (`argument-hint` as `input.hint`); built-in slash commands are not listed. Prompt templates in
+  `LoadedResources.prompts` now carry `description` / `argumentHint`.
+- **`$/cancel_request` both ways**: `JsonRpcPeer` takes `cancelRequests` (on for both ACP sides, off by default so the
+  Codex app-server wire is byte-for-byte unchanged): an aborted outgoing request notifies the peer, a peer-cancelled
+  incoming request aborts its `ctx.signal` and answers -32800. A prompt withdrawn with `$/cancel_request` stops the turn
+  and answers -32800; a permission request the agent no longer needs is withdrawn so the client can close its dialog.
+- **Client side (`task(agent="acp:…")`)**: `AcpClient` declares `clientCapabilities.session.configOptions: {}`; an agent
+  withdrawing a pending permission request closes the approval and answers `cancelled`. `AcpDriver` falls back to a
+  `mode`-category config option when an agent has no `modes`, reports -32000 as `agent_auth_required` listing the
+  agent's auth methods (terminal ones with the command to run), treats -32800 after a cancel as `cancelled`, and counts
+  `diff` paths in `filesTouched`. Docs: docs/agents.md.
+- **Types and tests**: the ACP types gain `authenticate`, `$/cancel_request`, -32800, terminal auth methods, client
+  `session` / `auth` capabilities, tool call `name` / `_meta`, `config_option_update` and `ACP_META_KEY` (exported from
+  `@armadra/agent/acp`); the prompt `usage` is marked UNSTABLE; select config options are either all flat or all grouped
+  (the fake agent's `model` option is now grouped). The fake ACP agent adds `--config-only`, `--auth-required` and
+  `[cancel-request]`. Every ACP line in the tests and golden recordings is validated against the bundled schema.
+- **Zed run-through fixes**: terminal auth `args` are now `--acp-terminal-auth chatgpt|api-key` because clients append them
+  to the configured command; config options gain `mode` (Zed ignores `modes` once `configOptions` exist); a session's own
+  mode changes are remembered for the queue; `session/load` / `resume` of an unknown UUID (an empty session that was never
+  written before ama restarted) opens a new empty session with that id instead of -32002; tool call ids that the upstream reuses in a later turn get a `#n`
+  suffix on the wire so they stay unique within the session (Zed merged them into one entry).
+
 ## 0.6.8 (2026-10-04)
 
 - **ACP client: elicitation and session config options**: `AcpClient` takes an optional `onElicitation(params, signal)`;

package/CHANGELOG.zh-CN.md

@@ -4,6 +4,56 @@
 
 > 从 0.6.0 起 [CHANGELOG.md](CHANGELOG.md) 为英文，本文件保留中文记录（0.1–0.5.1 的完整历史在此）。新条目两份都要加。
 
+## 0.7.1（2026-10-05）
+
+- **Windows：并发刷新 OAuth**：一个 ama 进程刚释放 `auth.json.lock` 时，另一个进程打开它会报 EPERM（NTFS 上文件处于删除挂起），刷新
+  直接失败；现在当作锁被占用继续等。别的进程正打开 `auth.json` 时的覆盖 / 读取遇到 EPERM / EACCES / EBUSY 短暂重试（只在 Windows）。
+- **检查点（影子 git）**：3 秒的快照耗时上限不再算上第一次建影子仓库（十来个 `git` 子进程，Windows 上要好几秒），以前可能第一回合就把
+  会话降级为 `tools`。
+
+## 0.7.0（2026-10-04）
+
+ACP 补全：`ama --mode acp` 作为编辑器（Zed 等 ACP 客户端）的 Agent，`AcpClient` / `AcpDriver` 作为客户端，仓库内对照官方 ACP v1
+schema 1.24.1 逐条校验。文档：docs/acp.md（英文：docs/en/acp.md）。
+
+- **没有模型不退出**：`ama --mode acp` 没有模型时不再以退出码 4 结束，照常回 `initialize`（客户端声明
+  `clientCapabilities.auth.terminal` 时给两条 terminal 型认证方法：按规范其 `args`（`--acp-terminal-auth chatgpt` / `api-key`）
+  追加在配置好的启动命令后面，ama 见到后不进 ACP 模式、改跑 `ama auth login chatgpt` / `ama auth set`；启动时的
+  `--auth-file` / profile 的 `authFile` 一并带上），会话方法回 -32000（无模型引导，`data.authMethods`）并以至多每秒一次重试启动；
+  有了模型就把同一条连接交给正常的 ACP 服务端（不必重新 `initialize`）。`authenticate` 回 -32602；stdin 关闭退出 0。
+  ACP 模式在启动前就接管 stdout。`ama auth set` 不给供应商且在 TTY 下时可用方向键选择（非 TTY 仍是用法错误）。
+- **多会话**：每个 ACP 会话常驻内存（空会话切走再切回也在）；同一时刻只跑一个回合，对别的会话的 `session/prompt` 进先进先出队列，
+  不再报 busy；`session/new` / `load` / `resume` / `list` / `set_mode` / `set_config_option` / `close` 在运行中也可调。权限模式按会话记，
+  轮到它跑时再应用。排队中的提示收到 `session/cancel` 回 `cancelled`。`session/list` 按 `cwd` 过滤、每页 50 条带 `nextCursor`
+  （非法 cursor 为 invalid params），标题去掉嵌入资源块；每回合结束发 `session_info_update`（标题、`updatedAt`）。拒答（Anthropic
+  `stop_reason: "refusal"`，`StopReason` 新值）回 `refusal`，其它地方消息仍按出错收尾（以 `stopReasonOf()` 区分；假供应商脚本支持
+  `stopReason: "refusal"`）。`mcpServers` / `additionalDirectories` 忽略并在 stderr 记一行。**行为变化**：`session/close` 之后对该 id
+  的请求回 -32002（以前会重新打开），要再用先 `session/load` / `session/resume`。
+- **工具调用可视化**：`tool_call` 带 `name`；codemode 脚本里的每次内层调用单列为一条 `tool_call`（标题前缀 `codemode › `，
+  `_meta.ama.parentToolCallId` 指向外层调用）并各自收口，权限请求用发起调用的 id，不再指向未公布的 id。权限询问期间调用回到
+  `pending`，允许后再 `in_progress`。`edit` / `write` 填新的 `ToolResult.fileChange`（改前 / 改后的磁盘原文，BOM 与 CRLF 原样，
+  新文件 `oldText: null`，单侧超过 256 KiB 不填；不落盘，RPC / stream-json 事件里去掉），完成更新带 `diff` 与前 4 KB 文本，
+  `locations[].line` 为首个改动行。`session/load` 回放的工具结果带前 4 KB 文本（无 diff）。权限模式带显示名与随界面语言的说明。
+- **配置项与命令表**：开会话答复带 `configOptions`——`mode`（权限模式，与 `modes` 同一状态；有配置项的客户端如 Zed 不再看 `modes`）、`model`（按供应商分组，值 `provider/model-id`，与 TUI `/model` 的「已配置」
+  视图同一口径：只列有 key、OAuth 已登录或本地的供应商，遵守 `models.enabled`，`fake` 按既有规则藏起）与 `thinking`（category
+  `thought_level`，只列当前模型支持的级别）；没有 boolean 项。`session/set_config_option` 切换（未知 id / 值回
+  -32602），模型 / 思考级别变化发 `config_option_update`。会话打开后发 `available_commands_update`：Skill 列为 `skill:<名字>`，提示模板
+  列为 `<名字>`（`argument-hint` 作 `input.hint`），不列内置斜杠命令。`LoadedResources.prompts` 的提示模板多带 `description` /
+  `argumentHint`。
+- **双向 `$/cancel_request`**：`JsonRpcPeer` 新选项 `cancelRequests`（ACP 两侧开，缺省关闭，Codex app-server 线路逐字节不变）：本端
+  abort 的出站请求会通知对端，对端撤回的入站请求 abort 其 `ctx.signal` 并回 -32800。以 `$/cancel_request` 撤回的 prompt 停止回合并答
+  -32800；不再需要的权限请求由 Agent 撤回，客户端可以关掉对话框。
+- **客户端侧（`task(agent="acp:…")`）**：`AcpClient` 声明 `clientCapabilities.session.configOptions: {}`；Agent 撤回挂起的权限请求时
+  审批关掉、答 `cancelled`。`AcpDriver` 在 Agent 没有 `modes` 时退到 category `mode` 的配置项，-32000 报 `agent_auth_required` 并列出
+  Agent 的认证方法（terminal 型附命令），取消后的 -32800 视为 `cancelled`，`diff` 的路径计入 `filesTouched`。文档：docs/agents.md。
+- **类型与测试**：ACP 类型补 `authenticate`、`$/cancel_request`、-32800、terminal 型认证方法、客户端 `session` / `auth` 能力、
+  tool call 的 `name` / `_meta`、`config_option_update` 与 `ACP_META_KEY`（`@armadra/agent/acp` 导出）；回合 `usage` 注明 UNSTABLE；
+  select 配置项的选项须全部平铺或全部分组（假 Agent 的 `model` 项改为分组）。假 ACP Agent 加 `--config-only`、`--auth-required` 与
+  `[cancel-request]`。测试与黄金记录里的每条 ACP 线路都按随仓库的 schema 校验。
+- **Zed 实测修正**：terminal 认证的 `args` 改为 `--acp-terminal-auth chatgpt|api-key`（客户端是追加到启动命令后面）；配置项补 `mode`（有
+  `configOptions` 时 Zed 不看 `modes`）；会话自己换的模式记进排队重放；`session/load` / `resume` 找不到的 UUID（重启前从未落盘的空会话）按原 id
+  新建空会话，不再 -32002；上游在后续回合复用的工具调用 id 在线上加 `#n` 后缀，保持会话内唯一（Zed 曾把它们合成一条）。
+
 ## 0.6.8（2026-10-04）
 
 - **ACP 客户端：elicitation 与会话配置项**：`AcpClient` 可选构造参数 `onElicitation(params, signal)`，给了才在 `initialize`

package/README.md

@@ -172,7 +172,7 @@ await session.dispose();
 | Entry point          | Use                                                               | Docs                                       |
 | -------------------- | ----------------------------------------------------------------- | ------------------------------------------ |
 | `ama --mode rpc`     | JSONL over stdio for hosts; types in `@armadra/agent/rpc`         | [docs/en/rpc.md](docs/en/rpc.md)           |
-| `ama --mode acp`     | ACP agent for editors and Armadra; client in `@armadra/agent/acp` | [docs/acp.md](docs/acp.md) (Chinese)       |
+| `ama --mode acp`     | ACP agent for editors and Armadra; client in `@armadra/agent/acp` | [docs/en/acp.md](docs/en/acp.md)           |
 | `--profile <file>`   | Host adapter: canvas tools, approvals, injected messages, status  | [docs/en/host-api.md](docs/en/host-api.md) |
 | `@armadra/agent/tui` | The terminal component library                                    | [docs/en/tui.md](docs/en/tui.md)           |
 
@@ -218,7 +218,7 @@ Common flags: `--model`, `--thinking`, `--permission-mode`, `--allow` / `--deny`
 
 ## Documentation
 
-Six user docs have English versions; the rest are in Chinese.
+Seven docs have English versions; the rest are in Chinese.
 
 **User docs**
 
@@ -231,7 +231,8 @@ Six user docs have English versions; the rest are in Chinese.
 **Integration docs**
 
 - [RPC protocol](docs/en/rpc.md) ([中文](docs/rpc.md)), [Host adapter API](docs/en/host-api.md) ([中文](docs/host-api.md))
-- [ACP](docs/acp.md), [Session file format](docs/session-format.md) (Chinese)
+- [ACP](docs/en/acp.md) ([中文](docs/acp.md)): `ama --mode acp`, sessions, tool calls, sign-in, deviations, the ACP client
+- [Session file format](docs/session-format.md) (Chinese)
 
 **Design and research** (Chinese)
 

package/README.zh-CN.md

@@ -229,7 +229,7 @@ Armadra 用 `ama --profile <路径>` 加 `coordinator` 预设启动 ama：协调
 **集成文档**
 
 - [RPC 协议](docs/rpc.md)（[English](docs/en/rpc.md)）、[宿主适配器 API](docs/host-api.md)（[English](docs/en/host-api.md)）
-- [ACP](docs/acp.md)、[会话文件格式](docs/session-format.md)
+- [ACP](docs/acp.md)（[English](docs/en/acp.md)）、[会话文件格式](docs/session-format.md)
 
 **设计与研究**
 

package/dist/acp.d.ts

@@ -8,11 +8,11 @@
  */
 export type * from "./drivers/types.js";
 export type * from "./drivers/acp/types.js";
-export { ACP_METHODS, ACP_PROTOCOL_VERSION, RPC_ERRORS } from "./drivers/acp/types.js";
+export { ACP_META_KEY, ACP_METHODS, ACP_PROTOCOL_VERSION, RPC_ERRORS, } from "./drivers/acp/types.js";
 export { WRITE_CHUNK_BYTES, createLineReader, writeChunked, type LineReader, } from "./modes/rpc/jsonl.js";
 export { JsonRpcPeer, RpcError, type IncomingRequestContext, type JsonRpcPeerOptions, type RpcId, } from "./drivers/jsonrpc.js";
 export { AcpClient, unattendedOutcome, type AcpClientHandlers, type AcpClientOptions, } from "./drivers/acp/client.js";
 export { AcpDriver } from "./drivers/acp/driver.js";
 export { runFakeAcpAgent, type FakeAcpAgentOptions } from "./drivers/acp/testing/fake-agent.js";
-/** 假 ACP Agent 的可执行入口（`node <path> [--minimal]`）；只在已编译的包里存在。 */
+/** 假 ACP Agent 的可执行入口（`node <path> [--minimal] [--config-options] [--config-only] [--auth-required]`）；只在已编译的包里存在。 */
 export declare function fakeAcpAgentPath(): string;

package/dist/acp.js

@@ -7,13 +7,13 @@
  * - 假 ACP Agent（进程内 `runFakeAcpAgent`，或 `fakeAcpAgentPath()` 起子进程），用于黄金记录。
  */
 import { fileURLToPath } from "node:url";
-export { ACP_METHODS, ACP_PROTOCOL_VERSION, RPC_ERRORS } from "./drivers/acp/types.js";
+export { ACP_META_KEY, ACP_METHODS, ACP_PROTOCOL_VERSION, RPC_ERRORS, } from "./drivers/acp/types.js";
 export { WRITE_CHUNK_BYTES, createLineReader, writeChunked, } from "./modes/rpc/jsonl.js";
 export { JsonRpcPeer, RpcError, } from "./drivers/jsonrpc.js";
 export { AcpClient, unattendedOutcome, } from "./drivers/acp/client.js";
 export { AcpDriver } from "./drivers/acp/driver.js";
 export { runFakeAcpAgent } from "./drivers/acp/testing/fake-agent.js";
-/** 假 ACP Agent 的可执行入口（`node <path> [--minimal]`）；只在已编译的包里存在。 */
+/** 假 ACP Agent 的可执行入口（`node <path> [--minimal] [--config-options] [--config-only] [--auth-required]`）；只在已编译的包里存在。 */
 export function fakeAcpAgentPath() {
     return fileURLToPath(new URL("./drivers/acp/testing/fake-agent-main.js", import.meta.url));
 }

package/dist/ai/apis/shared.d.ts

@@ -8,7 +8,7 @@
  * - 流式期间 `arguments` 随增量更新为「到目前为止」的部分对象。
  */
 import type { AssistantEventStreamImpl } from "../event-stream.js";
-import type { AssistantMessage, Model, StreamOptions, TextBlock, ThinkingBlock, ToolCallBlock } from "../types.js";
+import type { AssistantMessage, Model, StopReason, StreamOptions, TextBlock, ThinkingBlock, ToolCallBlock } from "../types.js";
 export declare function createOutput(model: Model): AssistantMessage;
 /** 缺 key 时同步抛 `AmaError{code:"no_api_key"}`（§3.1 流契约唯一的同步异常）。 */
 export declare function requireApiKey(model: Model, options: StreamOptions): void;
@@ -49,6 +49,12 @@ export declare const STREAM_ENDED_MESSAGE = "Stream ended before completion";
 export declare function finishDone(stream: AssistantEventStreamImpl, tracker: BlockTracker, model: Model, reason: "stop" | "length" | "toolUse"): void;
 /** 出错或中止：关块、写 errorMessage、发 error（signal 已中止 → aborted）。 */
 export declare function finishError(stream: AssistantEventStreamImpl, tracker: BlockTracker, model: Model, error: unknown, signal: AbortSignal): void;
+/**
+ * 供应商以安全理由拒答（Anthropic `stop_reason: "refusal"`，docs/acp-plan.md D12）：消息照旧以
+ * `error` 收尾（TUI / print / 重试的口径不变），`rawStopReason` 记原值；需要区分的消费者（ACP 的
+ * `refusal` 停止原因）用 {@link stopReasonOf}。这是 `refusal` 的唯一映射处。[ACP-B]
+ */
+export declare function stopReasonOf(message: Pick<AssistantMessage, "stopReason" | "rawStopReason">): StopReason;
 /** 内部用：可携带供应商原始 stop reason 的错误（content_filter、refusal 等）。 */
 export declare class ProviderStopError extends Error {
     constructor(message: string);

package/dist/ai/apis/shared.js

@@ -170,6 +170,16 @@ export function finishError(stream, tracker, model, error, signal) {
     finalizeUsage(model, output.usage);
     stream.push({ type: "error", reason: aborted ? "aborted" : "error", message: output });
 }
+/**
+ * 供应商以安全理由拒答（Anthropic `stop_reason: "refusal"`，docs/acp-plan.md D12）：消息照旧以
+ * `error` 收尾（TUI / print / 重试的口径不变），`rawStopReason` 记原值；需要区分的消费者（ACP 的
+ * `refusal` 停止原因）用 {@link stopReasonOf}。这是 `refusal` 的唯一映射处。[ACP-B]
+ */
+export function stopReasonOf(message) {
+    return message.stopReason === "error" && message.rawStopReason === "refusal"
+        ? "refusal"
+        : message.stopReason;
+}
 /** 内部用：可携带供应商原始 stop reason 的错误（content_filter、refusal 等）。 */
 export class ProviderStopError extends Error {
     constructor(message) {

package/dist/ai/fake/fake-provider.js

@@ -15,7 +15,7 @@
  */
 import { appendFileSync } from "node:fs";
 import { AssistantEventStreamImpl } from "../event-stream.js";
-import { BlockTracker, createOutput, finishDone, finishError } from "../apis/shared.js";
+import { BlockTracker, ProviderStopError, createOutput, finishDone, finishError, } from "../apis/shared.js";
 import { contentText, normalizeContext } from "../context.js";
 import { describeFakeError, loadFakeScript, parseFakeScript, } from "./fake-script.js";
 export const FAKE_PROVIDER_ID = "fake";
@@ -222,6 +222,10 @@ export class FakeProvider {
             usage.cacheWrite = response.usage?.cacheWrite ?? 0;
             if (error)
                 throw new Error(error.message);
+            if (response.stopReason === "refusal") {
+                tracker.output.rawStopReason = "refusal";
+                throw new ProviderStopError("The model refused to respond (refusal)");
+            }
             const reason = response.stopReason ?? (tracker.hasToolCalls ? "toolUse" : "stop");
             finishDone(stream, tracker, model, reason);
         }

package/dist/ai/fake/fake-script.d.ts

@@ -46,8 +46,11 @@ export interface FakeResponse {
     /** 依次产出的块；与 `text` 简写二选一（都给时 text 在后）。 */
     steps?: FakeStep[];
     text?: string;
-    /** 缺省：有工具调用 → toolUse，否则 stop。 */
-    stopReason?: "stop" | "length" | "toolUse";
+    /**
+     * 缺省：有工具调用 → toolUse，否则 stop。`refusal` 模拟 Anthropic 的拒答：产出完 steps 后以
+     * error 收尾、`rawStopReason: "refusal"`（与真实协议同形）。
+     */
+    stopReason?: "stop" | "length" | "toolUse" | "refusal";
     usage?: Partial<Pick<Usage, "input" | "output" | "cacheRead" | "cacheWrite">>;
     error?: FakeError;
     /** start 之前的延迟（毫秒，可被 abort 打断）。 */

package/dist/ai/fake/fake-script.js

@@ -66,8 +66,12 @@ function checkResponse(value, path) {
         fail(`${path}.text`, "must be a string");
     }
     const stop = value["stopReason"];
-    if (stop !== undefined && stop !== "stop" && stop !== "length" && stop !== "toolUse") {
-        fail(`${path}.stopReason`, "must be stop / length / toolUse");
+    if (stop !== undefined &&
+        stop !== "stop" &&
+        stop !== "length" &&
+        stop !== "toolUse" &&
+        stop !== "refusal") {
+        fail(`${path}.stopReason`, "must be stop / length / toolUse / refusal");
     }
     const error = value["error"];
     if (error !== undefined) {

package/dist/ai/types.d.ts

@@ -118,7 +118,8 @@ export interface Usage {
     /** [W6-C0] 订阅计费（ChatGPT 登录，W6-O）：`cost` 为 0，统计单列「订阅」不折算美元。 */
     billing?: "subscription";
 }
-export type StopReason = "stop" | "length" | "toolUse" | "aborted" | "error";
+/** `refusal`：供应商以安全理由拒答（目前只有 Anthropic 的 `stop_reason: "refusal"` 会映射到它）。 */
+export type StopReason = "stop" | "length" | "toolUse" | "aborted" | "error" | "refusal";
 /** 工具声明（发给供应商的形状）。 */
 export interface ToolDecl {
     name: string;

package/dist/auth/oauth/token-store.d.ts

@@ -6,6 +6,8 @@
  * - 写：读-改-写 `auth.json` 整个文件，经 `writeAuthFile`（同目录临时文件 0600 → rename → chmod），其它条目原样保留；
  * - 锁：`<auth.json>.lock`，`open(O_CREAT|O_EXCL)`（flag `wx`）写 `{ pid, at }`；等待 ≤ 15 s；锁文件超过 60 s 且
  *   pid 已死视为陈旧，删除后重试。取锁后由调用方**重读文件**再决定要不要刷新。
+ * - Windows：锁文件删除挂起时 `open(wx)` 报 EPERM / EACCES，按「被占用」继续等；读 / rename 的同类瞬时错误
+ *   短暂重试（`config/fs-retry.ts`）。
  */
 import { type OAuthAuthEntry } from "../../config/types-w6.js";
 export declare const LOCK_WAIT_MS = 15000;

package/dist/auth/oauth/token-store.js

@@ -6,10 +6,13 @@
  * - 写：读-改-写 `auth.json` 整个文件，经 `writeAuthFile`（同目录临时文件 0600 → rename → chmod），其它条目原样保留；
  * - 锁：`<auth.json>.lock`，`open(O_CREAT|O_EXCL)`（flag `wx`）写 `{ pid, at }`；等待 ≤ 15 s；锁文件超过 60 s 且
  *   pid 已死视为陈旧，删除后重试。取锁后由调用方**重读文件**再决定要不要刷新。
+ * - Windows：锁文件删除挂起时 `open(wx)` 报 EPERM / EACCES，按「被占用」继续等；读 / rename 的同类瞬时错误
+ *   短暂重试（`config/fs-retry.ts`）。
  */
 import { closeSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeSync, } from "node:fs";
 import { dirname } from "node:path";
 import { writeAuthFile } from "../../config/auth-file.js";
+import { isTransientFsError, retryTransientFs } from "../../config/fs-retry.js";
 import { CONFIG_FILE_VERSION } from "../../config/types.js";
 import { isOAuthEntry } from "../../config/types-w6.js";
 import { AmaError } from "../../errors.js";
@@ -18,7 +21,7 @@ export const LOCK_STALE_MS = 60_000;
 const LOCK_POLL_MS = 50;
 function readRaw(path) {
     try {
-        const value = JSON.parse(readFileSync(path, "utf8"));
+        const value = JSON.parse(retryTransientFs(() => readFileSync(path, "utf8")));
         return typeof value === "object" && value !== null && typeof value.providers === "object"
             ? value
             : undefined;
@@ -85,7 +88,9 @@ function tryAcquire(path) {
         return true;
     }
     catch (error) {
-        if (error.code === "EEXIST")
+        const code = error.code;
+        // Windows：上一个持锁进程刚删掉锁文件（删除挂起）时 open(wx) 报 EPERM / EACCES——同样是「被占用」
+        if (code === "EEXIST" || isTransientFsError(code))
             return false;
         throw error;
     }