@cjhyy/code-shell-core 0.5.0-rc.1 → 0.6.0-rc.1

package/dist/llm/reasoning-setting.d.ts

@@ -0,0 +1,51 @@
+/**
+ * ReasoningSetting — the rich, normalized reasoning/thinking config that
+ * replaces the old binary `thinking: "enabled"|"disabled"`.
+ *
+ *  - off    : no thinking (openai-effort → disabledEffort; deepseek → type:disabled; openrouter → exclude)
+ *  - on     : binary "thinking on" for deepseek-thinking / zai (no effort levels)
+ *  - effort : openai-effort / openrouter — pick a level
+ *  - budget : anthropic-budget — explicit thinking token budget
+ *
+ * `normalizeReasoning` accepts the legacy "enabled"/"disabled" strings so any
+ * lingering caller/config still works (mapped to on/off).
+ */
+import { z } from "zod";
+import type { ReasoningEffort } from "./capabilities/types.js";
+export declare const REASONING_EFFORTS: readonly ["minimal", "low", "medium", "high", "xhigh"];
+export declare const ReasoningSettingSchema: z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+    mode: z.ZodLiteral<"off">;
+}, "strip", z.ZodTypeAny, {
+    mode: "off";
+}, {
+    mode: "off";
+}>, z.ZodObject<{
+    mode: z.ZodLiteral<"on">;
+}, "strip", z.ZodTypeAny, {
+    mode: "on";
+}, {
+    mode: "on";
+}>, z.ZodObject<{
+    mode: z.ZodLiteral<"effort">;
+    effort: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    mode: "effort";
+    effort: string;
+}, {
+    mode: "effort";
+    effort: string;
+}>, z.ZodObject<{
+    mode: z.ZodLiteral<"budget">;
+    budgetTokens: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    mode: "budget";
+    budgetTokens: number;
+}, {
+    mode: "budget";
+    budgetTokens: number;
+}>]>;
+export type ReasoningSetting = z.infer<typeof ReasoningSettingSchema>;
+/** Coerce legacy "enabled"/"disabled" or an object into a ReasoningSetting. */
+export declare function normalizeReasoning(raw: ReasoningSetting | "enabled" | "disabled" | undefined): ReasoningSetting | undefined;
+/** Effort to send when a model wants "thinking on" but the user picked no level. */
+export declare const DEFAULT_EFFORT: ReasoningEffort;

package/dist/llm/reasoning-setting.js

@@ -0,0 +1,40 @@
+/**
+ * ReasoningSetting — the rich, normalized reasoning/thinking config that
+ * replaces the old binary `thinking: "enabled"|"disabled"`.
+ *
+ *  - off    : no thinking (openai-effort → disabledEffort; deepseek → type:disabled; openrouter → exclude)
+ *  - on     : binary "thinking on" for deepseek-thinking / zai (no effort levels)
+ *  - effort : openai-effort / openrouter — pick a level
+ *  - budget : anthropic-budget — explicit thinking token budget
+ *
+ * `normalizeReasoning` accepts the legacy "enabled"/"disabled" strings so any
+ * lingering caller/config still works (mapped to on/off).
+ */
+import { z } from "zod";
+// Recommended effort levels — used to render UI dropdowns and as capability
+// hints. NOT a hard schema constraint: effort is a free-form, catalog-driven
+// param (a model's real ladder is declared by its catalog ParamSpec, and models
+// gain/rename levels over time — e.g. gpt-5.5 added "xhigh", some models accept
+// "max"). The settings schema validates the *shape* (mode/field names), not the
+// *value*; pinning effort to a closed enum here made one unknown level
+// (a connection's paramValues.reasoning flowing through the legacy models[]
+// bridge) throw in validateSettings and take the whole app down on boot.
+export const REASONING_EFFORTS = ["minimal", "low", "medium", "high", "xhigh"];
+export const ReasoningSettingSchema = z.discriminatedUnion("mode", [
+    z.object({ mode: z.literal("off") }),
+    z.object({ mode: z.literal("on") }),
+    z.object({ mode: z.literal("effort"), effort: z.string().min(1) }),
+    z.object({ mode: z.literal("budget"), budgetTokens: z.number().int().positive() }),
+]);
+/** Coerce legacy "enabled"/"disabled" or an object into a ReasoningSetting. */
+export function normalizeReasoning(raw) {
+    if (raw == null)
+        return undefined;
+    if (raw === "enabled")
+        return { mode: "on" };
+    if (raw === "disabled")
+        return { mode: "off" };
+    return raw;
+}
+/** Effort to send when a model wants "thinking on" but the user picked no level. */
+export const DEFAULT_EFFORT = "medium";

package/dist/llm/stop-reason.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Shared stop-reason helpers.
+ *
+ * Providers report "the response was cut off at the output-token cap" with
+ * different finish/stop-reason strings:
+ *   - OpenAI / OpenAI-compat:  finish_reason "length"
+ *   - Anthropic:               stop_reason  "max_tokens"
+ *
+ * The turn loop uses this to decide whether to run a max-output
+ * continuation, so the check must accept both spellings.
+ */
+/** True when the stop reason indicates the model hit its output-token cap. */
+export declare function isTruncatedStop(stopReason: string | undefined): boolean;

package/dist/llm/stop-reason.js

@@ -0,0 +1,21 @@
+/**
+ * Shared stop-reason helpers.
+ *
+ * Providers report "the response was cut off at the output-token cap" with
+ * different finish/stop-reason strings:
+ *   - OpenAI / OpenAI-compat:  finish_reason "length"
+ *   - Anthropic:               stop_reason  "max_tokens"
+ *
+ * The turn loop uses this to decide whether to run a max-output
+ * continuation, so the check must accept both spellings.
+ */
+const TRUNCATED_STOP_REASONS = new Set([
+    "length", // OpenAI / OpenAI-compatible
+    "max_tokens", // Anthropic
+]);
+/** True when the stop reason indicates the model hit its output-token cap. */
+export function isTruncatedStop(stopReason) {
+    if (!stopReason)
+        return false;
+    return TRUNCATED_STOP_REASONS.has(stopReason);
+}

package/dist/llm/stream-watchdog.js

@@ -64,7 +64,11 @@ export function createStreamWatchdog(opts) {
 }
 /** Environment-driven defaults. Read once at import time is fine — these never change inside a process. */
 export const STREAM_WATCHDOG_CONFIG = {
-    enabled: process.env.CODESHELL_ENABLE_STREAM_WATCHDOG === "1",
+    // ON by default — a streamed response that connects then stalls mid-flight
+    // would otherwise hang until the SDK's (unreliable-for-half-dead-sockets)
+    // timeout, which we observed take 15–33 min in practice. Opt OUT with
+    // CODESHELL_ENABLE_STREAM_WATCHDOG=0 (rollback knob).
+    enabled: process.env.CODESHELL_ENABLE_STREAM_WATCHDOG !== "0",
     idleTimeoutMs: parseInt(process.env.CODESHELL_STREAM_IDLE_TIMEOUT_MS || "", 10) || 90_000,
     retries: parseInt(process.env.CODESHELL_STREAM_WATCHDOG_RETRIES || "", 10) || 2,
 };

package/dist/llm/strip-vision.d.ts

@@ -0,0 +1,32 @@
+/**
+ * History-image stripping for non-vision models.
+ *
+ * Why this exists: the vision gate in `Engine.run` only rejects *new* image
+ * attachments on the current turn. But a conversation can accumulate image
+ * content blocks while a vision-capable model is active, then the user
+ * switches to a non-vision model (e.g. DeepSeek) mid-session. Those
+ * *historical* image blocks are still in the transcript and get re-serialized
+ * on every subsequent request — OpenAI-compat backends 400 with
+ * `unknown variant 'image_url', expected 'text'`, which then falls back out
+ * of streaming and degrades the turn.
+ *
+ * Fix: when the active model has `supportsVision: false`, replace each
+ * message's image blocks with a single text placeholder before the request
+ * is built. The transcript/store is untouched — only the outgoing copy is
+ * sanitized — so switching back to a vision model still sees the images.
+ *
+ * Pure function, no I/O. Tested in `strip-vision.test.ts`.
+ */
+import type { Message } from "../types.js";
+/** Text we substitute for an elided image block. Surfaced to the model so it
+ *  knows an image *was* here (vs silently vanishing the context). */
+export declare const VISION_PLACEHOLDER = "[\u56FE\u7247\u5DF2\u7701\u7565:\u5F53\u524D\u6A21\u578B\u4E0D\u652F\u6301\u89C6\u89C9\u8F93\u5165]";
+/**
+ * Return a copy of `messages` with image content blocks replaced by a text
+ * placeholder, but only when `supportsVision` is false.
+ *
+ * Identity-preserving: when vision is supported, or no message carries an
+ * image, the original array (and untouched message objects) are returned as-is
+ * so callers pay nothing on the common path.
+ */
+export declare function stripVisionFromHistory(messages: Message[], supportsVision: boolean): Message[];

package/dist/llm/strip-vision.js

@@ -0,0 +1,94 @@
+/**
+ * History-image stripping for non-vision models.
+ *
+ * Why this exists: the vision gate in `Engine.run` only rejects *new* image
+ * attachments on the current turn. But a conversation can accumulate image
+ * content blocks while a vision-capable model is active, then the user
+ * switches to a non-vision model (e.g. DeepSeek) mid-session. Those
+ * *historical* image blocks are still in the transcript and get re-serialized
+ * on every subsequent request — OpenAI-compat backends 400 with
+ * `unknown variant 'image_url', expected 'text'`, which then falls back out
+ * of streaming and degrades the turn.
+ *
+ * Fix: when the active model has `supportsVision: false`, replace each
+ * message's image blocks with a single text placeholder before the request
+ * is built. The transcript/store is untouched — only the outgoing copy is
+ * sanitized — so switching back to a vision model still sees the images.
+ *
+ * Pure function, no I/O. Tested in `strip-vision.test.ts`.
+ */
+/** Text we substitute for an elided image block. Surfaced to the model so it
+ *  knows an image *was* here (vs silently vanishing the context). */
+export const VISION_PLACEHOLDER = "[图片已省略:当前模型不支持视觉输入]";
+/**
+ * Return a copy of `messages` with image content blocks replaced by a text
+ * placeholder, but only when `supportsVision` is false.
+ *
+ * Identity-preserving: when vision is supported, or no message carries an
+ * image, the original array (and untouched message objects) are returned as-is
+ * so callers pay nothing on the common path.
+ */
+export function stripVisionFromHistory(messages, supportsVision) {
+    if (supportsVision)
+        return messages;
+    let changed = false;
+    const out = messages.map((msg) => {
+        if (typeof msg.content === "string")
+            return msg;
+        // Need to process if there's a top-level image, OR a tool_result whose
+        // own content array carries a nested image (view_image-produced screenshots
+        // live in `tool_result.content: ContentBlock[]`).
+        if (!msg.content.some(needsStrip))
+            return msg;
+        changed = true;
+        const rebuilt = [];
+        let placeholderInserted = false;
+        for (const block of msg.content) {
+            if (block.type === "image") {
+                // Collapse runs of images into a single placeholder per message —
+                // five screenshots don't need five identical notes.
+                if (!placeholderInserted) {
+                    rebuilt.push({ type: "text", text: VISION_PLACEHOLDER });
+                    placeholderInserted = true;
+                }
+                continue;
+            }
+            if (block.type === "tool_result" &&
+                Array.isArray(block.content) &&
+                block.content.some((b) => b.type === "image")) {
+                rebuilt.push({ ...block, content: stripImageBlocks(block.content) });
+                continue;
+            }
+            rebuilt.push(block);
+        }
+        return { ...msg, content: rebuilt };
+    });
+    return changed ? out : messages;
+}
+/** True if this block holds an image we must elide — either it *is* an image,
+ *  or it's a tool_result whose nested content array contains one. */
+function needsStrip(block) {
+    if (block.type === "image")
+        return true;
+    return (block.type === "tool_result" &&
+        Array.isArray(block.content) &&
+        block.content.some((b) => b.type === "image"));
+}
+/** Replace image blocks in a ContentBlock[] with a single text placeholder
+ *  (consecutive/multiple images collapse to one), preserving other blocks.
+ *  Used for both the message top level and nested tool_result.content. */
+function stripImageBlocks(blocks) {
+    const rebuilt = [];
+    let placeholderInserted = false;
+    for (const block of blocks) {
+        if (block.type === "image") {
+            if (!placeholderInserted) {
+                rebuilt.push({ type: "text", text: VISION_PLACEHOLDER });
+                placeholderInserted = true;
+            }
+            continue;
+        }
+        rebuilt.push(block);
+    }
+    return rebuilt;
+}

package/dist/llm/token-counter.js

@@ -18,9 +18,16 @@ async function getEncoder() {
 }
 let encoderSync = null;
 // Kick off the import so synchronous callers can use it on the next tick.
-// First call still falls back to a length estimate.
-void getEncoder().then((fn) => {
+// First call still falls back to a length estimate. The .catch keeps a failed
+// import (corrupt node_modules / packaging error) from becoming an unhandled
+// rejection — the chars/4 fallback below IS the intended degradation, so a
+// load failure should stay silent, not surface as a process-level warning/crash.
+void getEncoder()
+    .then((fn) => {
     encoderSync = fn;
+})
+    .catch(() => {
+    /* encoder unavailable — count() falls back to the length estimate */
 });
 /**
  * Count tokens in `text`. Synchronous. If the encoder isn't loaded yet,

package/dist/llm/types.d.ts

@@ -20,18 +20,21 @@ export interface CreateMessageOptions {
      */
     recordUsage?: boolean;
     /**
-     * DeepSeek V4 thinking-mode switch. "enabled" is the endpoint default;
-     * "disabled" turns reasoning off (faster, cheaper, no `reasoning_content`
-     * on the reply). Ignored by every provider except DeepSeek V4 — the OpenAI
-     * SDK forwards unknown top-level fields verbatim, so it's harmless on
-     * other compatible endpoints.
+     * Reasoning/thinking setting for this call. Overrides LLMConfig.reasoning.
+     * Rich shape ({mode:"off"|"on"} | {mode:"effort",effort} |
+     * {mode:"budget",budgetTokens}) — translated to the per-vendor wire form by
+     * the client's capability layer.
      */
-    thinking?: "enabled" | "disabled";
+    reasoning?: import("./reasoning-setting.js").ReasoningSetting;
 }
 export interface LLMUsageTracker {
     records: TokenUsage[];
     totalPromptTokens: number;
     totalCompletionTokens: number;
     totalTokens: number;
+    /** Sum of cache-read tokens across responses (0 when no provider reported any). */
+    totalCacheReadTokens: number;
+    /** Sum of cache-creation tokens across responses. */
+    totalCacheCreationTokens: number;
     requestCount: number;
 }

package/dist/logging/logger.js

@@ -25,6 +25,7 @@ import { appendFileSync, mkdirSync, existsSync, readdirSync, unlinkSync, readFil
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { redactSecrets } from "./sanitize-messages.js";
 const LEVEL_ORDER = {
     debug: 0,
     info: 1,
@@ -246,7 +247,14 @@ class Logger {
     recordError(msg, data) {
         if (inMemoryErrors.length >= MAX_IN_MEMORY_ERRORS)
             inMemoryErrors.shift();
-        inMemoryErrors.push({ msg, t: new Date().toISOString(), data });
+        // Scrub secrets out of msg + data before parking the entry in the in-
+        // memory ring. The ring is exposed via diagnostics endpoints, so
+        // anything that survives here is reachable by protocol clients.
+        inMemoryErrors.push({
+            msg: redactSecrets(msg),
+            t: new Date().toISOString(),
+            data: data ? redactSecrets(data) : undefined,
+        });
     }
     write(level, msg, data) {
         if (!this.enabled)
@@ -262,7 +270,13 @@ class Logger {
                 return;
         }
         const t = new Date().toISOString();
-        const entry = { t, l: level, msg, ...this.context };
+        // Scrub msg + data before the entry is built. msg is a plain string so
+        // only bearer-tokens / URL secret query params can hide there; data is
+        // arbitrary so it gets the full recursive walk. Done at the boundary so
+        // every level/category sink shares the same redaction rules.
+        const safeMsg = redactSecrets(msg);
+        const safeData = data ? redactSecrets(data) : undefined;
+        const entry = { t, l: level, msg: safeMsg, ...this.context };
         if (cat && !entry.cat)
             entry.cat = cat;
         // Stamp the current process-wide session id unless this logger's
@@ -270,8 +284,8 @@ class Logger {
         // children created before Engine.run() still pick up the real sid.
         if (entry.sid === undefined)
             entry.sid = getCurrentSid();
-        if (data)
-            entry.d = data;
+        if (safeData)
+            entry.d = safeData;
         const line = JSON.stringify(entry) + "\n";
         if (this.stderrEcho) {
             process.stderr.write(line);

package/dist/logging/sanitize-messages.d.ts

@@ -32,6 +32,16 @@ export declare function sanitizeContent(content: Message["content"]): Message["c
  * path for the overwhelmingly common pure-text case).
  */
 export declare function sanitizeMessages(messages: readonly Message[]): Message[];
+/**
+ * Recursively walk a value and return a *new* value with secret-looking
+ * fields replaced by "[redacted]". Used by the logger (so anything ending up
+ * in `entry.d` is scrubbed) and by diagnostics / in-memory error capture.
+ *
+ * Pure / no I/O. Does not mutate the input — important because the same
+ * object may also be on its way to a transcript or UI stream where the
+ * unredacted form is correct.
+ */
+export declare function redactSecrets<T>(value: T, depth?: number): T;
 /**
  * Sanitize a free-form task string before logging.
  *

package/dist/logging/sanitize-messages.js

@@ -129,6 +129,118 @@ export function sanitizeMessages(messages) {
     }
     return touched ? out : messages;
 }
+// ─────────────────────────────────────────────────────────────────────
+// Secret redaction
+// ─────────────────────────────────────────────────────────────────────
+//
+// Beyond image payloads, log/diagnostics entries can carry API keys,
+// authorization headers, provider tokens, and similar secrets via
+// `data` blobs (settings dumps, provider configs, error responses, …).
+// These walkers redact secrets *in place on a deep clone* so the caller
+// can still log "useful shape, scrubbed values".
+const SECRET_KEY_RE = /(^|[._-])(api[_-]?key|authorization|x[_-]api[_-]key|bearer[_-]?token|access[_-]?token|refresh[_-]?token|session[_-]?token|token|secret|password|client[_-]?secret|cookie)($|[._-])/i;
+// Header containers whose VALUES are all header values — any of them can carry
+// a bespoke auth token under a non-secret-looking key name (e.g.
+// `x-custom-auth`), which SECRET_KEY_RE alone would miss. Treat the whole
+// container as sensitive: every non-empty value inside is redacted.
+const HEADERS_CONTAINER_RE = /^(httpHeaders|headers|defaultHeaders|envHeaders)$/;
+/** Redact all non-empty string/scalar values of a headers container object. */
+function redactHeaderValues(headers) {
+    const out = {};
+    for (const [hName, hVal] of Object.entries(headers)) {
+        // Preserve present-vs-absent for empty/null, redact everything else.
+        if (hVal === null || hVal === undefined || hVal === "")
+            out[hName] = hVal;
+        else
+            out[hName] = REDACTED;
+    }
+    return out;
+}
+const BEARER_RE = /\bBearer\s+[A-Za-z0-9._\-+/=~]{8,}/g;
+// URL query parameters that look like credentials. Conservative — only
+// trigger on a small named set so a normal `?id=…&q=…` URL passes through.
+const URL_SECRET_QS_RE = /([?&](?:key|api_key|apikey|access_token|token|auth|sig|signature)=)[^&#\s]+/gi;
+const REDACTED = "[redacted]";
+const MAX_DEPTH = 10;
+function isSecretKey(key) {
+    return SECRET_KEY_RE.test(key);
+}
+/** Scrub bare `Bearer <token>` and credential-looking URL query params from a string. */
+function redactSecretsInString(s) {
+    let out = s;
+    if (BEARER_RE.test(out))
+        out = out.replace(BEARER_RE, "Bearer [redacted]");
+    if (URL_SECRET_QS_RE.test(out))
+        out = out.replace(URL_SECRET_QS_RE, "$1[redacted]");
+    return out;
+}
+/**
+ * Recursively walk a value and return a *new* value with secret-looking
+ * fields replaced by "[redacted]". Used by the logger (so anything ending up
+ * in `entry.d` is scrubbed) and by diagnostics / in-memory error capture.
+ *
+ * Pure / no I/O. Does not mutate the input — important because the same
+ * object may also be on its way to a transcript or UI stream where the
+ * unredacted form is correct.
+ */
+export function redactSecrets(value, depth = 0) {
+    if (value === null || value === undefined)
+        return value;
+    if (depth > MAX_DEPTH)
+        return value;
+    const t = typeof value;
+    if (t === "string")
+        return redactSecretsInString(value);
+    if (t === "number" || t === "boolean" || t === "bigint" || t === "symbol")
+        return value;
+    if (t === "function")
+        return value;
+    if (Array.isArray(value)) {
+        return value.map((v) => redactSecrets(v, depth + 1));
+    }
+    // Error objects: preserve name/message/stack shape but redact within.
+    if (value instanceof Error) {
+        const clone = {
+            name: value.name,
+            message: redactSecretsInString(value.message),
+            ...(value.stack ? { stack: redactSecretsInString(value.stack) } : {}),
+        };
+        // Some libraries attach extra properties (`.response`, `.config`, …) —
+        // walk them as well.
+        for (const key of Object.keys(value)) {
+            if (key === "name" || key === "message" || key === "stack")
+                continue;
+            const v = value[key];
+            clone[key] = isSecretKey(key) ? REDACTED : redactSecrets(v, depth + 1);
+        }
+        return clone;
+    }
+    if (t === "object") {
+        const obj = value;
+        const out = {};
+        for (const [k, v] of Object.entries(obj)) {
+            if (isSecretKey(k)) {
+                // Preserve presence (null/undefined stay as-is so consumers can
+                // still distinguish "key present" vs "key absent"; non-empty values
+                // collapse to [redacted]).
+                if (v === null || v === undefined || v === "")
+                    out[k] = v;
+                else
+                    out[k] = REDACTED;
+            }
+            else if (HEADERS_CONTAINER_RE.test(k) && v && typeof v === "object" && !Array.isArray(v)) {
+                // Blanket-redact header values regardless of the inner header name, so a
+                // custom `x-custom-auth` doesn't leak in cleartext.
+                out[k] = redactHeaderValues(v);
+            }
+            else {
+                out[k] = redactSecrets(v, depth + 1);
+            }
+        }
+        return out;
+    }
+    return value;
+}
 /**
  * Sanitize a free-form task string before logging.
  *

package/dist/lsp/client.js

@@ -10,7 +10,12 @@ export class LSPClient extends EventEmitter {
     process;
     nextId = 1;
     pending = new Map();
-    buffer = "";
+    // The LSP framing uses byte-counted Content-Length, so we buffer bytes,
+    // not characters. Joining chunks as strings (`data.toString()` + string
+    // concat) can split a multibyte UTF-8 codepoint across chunks and de-
+    // synchronize against Content-Length. Stay in Buffer-land until we've
+    // sliced out exactly the right body length.
+    buffer = Buffer.alloc(0);
     contentLength = -1;
     initialized = false;
     constructor(command, args = [], cwd) {
@@ -24,7 +29,7 @@ export class LSPClient extends EventEmitter {
             cwd: this.cwd,
             stdio: ["pipe", "pipe", "pipe"],
         });
-        this.process.stdout?.on("data", (data) => this.handleData(data.toString()));
+        this.process.stdout?.on("data", (data) => this.handleData(data));
         this.process.stderr?.on("data", (_data) => {
             // LSP servers often log to stderr — ignore
         });
@@ -116,26 +121,41 @@ export class LSPClient extends EventEmitter {
         return this.process !== undefined && !this.process.killed;
     }
     handleData(data) {
-        this.buffer += data;
+        // Append the new chunk as bytes. Buffer.concat avoids the UTF-8
+        // boundary corruption that string concatenation produces — a
+        // multibyte codepoint split across two TCP/pipe chunks decodes to
+        // U+FFFD, mangles the buffer length count, and breaks framing.
+        this.buffer = Buffer.concat([this.buffer, data]);
         while (true) {
             if (this.contentLength < 0) {
+                // Search for the header terminator in bytes, not chars.
                 const headerEnd = this.buffer.indexOf("\r\n\r\n");
                 if (headerEnd < 0)
                     break;
-                const header = this.buffer.slice(0, headerEnd);
+                // Headers are ASCII per spec, so toString("ascii") is safe and
+                // avoids paying for a UTF-8 decode on the framing band.
+                const header = this.buffer.slice(0, headerEnd).toString("ascii");
                 const match = header.match(/Content-Length:\s*(\d+)/i);
                 if (!match) {
-                    this.buffer = this.buffer.slice(headerEnd + 4);
+                    this.buffer = this.buffer.subarray(headerEnd + 4);
                     continue;
                 }
                 this.contentLength = parseInt(match[1], 10);
-                this.buffer = this.buffer.slice(headerEnd + 4);
+                this.buffer = this.buffer.subarray(headerEnd + 4);
             }
+            // Content-Length is a BYTE count — compare against the buffer's
+            // byte length, not its character length. Pre-fix this compared
+            // string lengths; with multibyte responses (e.g. CJK identifiers,
+            // emoji in diagnostics) we'd block waiting for bytes that had
+            // already arrived.
             if (this.buffer.length < this.contentLength)
                 break;
-            const content = this.buffer.slice(0, this.contentLength);
-            this.buffer = this.buffer.slice(this.contentLength);
+            const bodyBytes = this.buffer.subarray(0, this.contentLength);
+            this.buffer = this.buffer.subarray(this.contentLength);
             this.contentLength = -1;
+            // Decode the full body in one shot — at this point we have the
+            // exact byte count, so the UTF-8 boundary issue is fully gone.
+            const content = bodyBytes.toString("utf8");
             try {
                 const message = JSON.parse(content);
                 if ("id" in message && this.pending.has(message.id)) {

package/dist/lsp/manager.d.ts

@@ -33,8 +33,8 @@ export declare class LSPServerManager {
      * Shutdown all servers.
      */
     shutdownAll(): Promise<void>;
-    private isCommandAvailable;
 }
+export declare function isCommandAvailable(command: string, env?: NodeJS.ProcessEnv): boolean;
 export declare function initializeLSPManager(cwd: string): LSPServerManager;
 export declare function getLSPManager(): LSPServerManager | undefined;
 export {};