@kiturone/kapibala 0.0.3 → 0.0.4

package/dist/index.cjs

@@ -33,6 +33,7 @@ __export(index_exports, {
   AbortError: () => AbortError,
   AgentLoop: () => AgentLoop,
   AgentSession: () => AgentSession,
+  AnthropicProvider: () => AnthropicProvider,
   ContextBudgetError: () => ContextBudgetError,
   ContextManager: () => ContextManager,
   ContextOverflowError: () => ContextOverflowError,
@@ -45,6 +46,7 @@ __export(index_exports, {
   KapibalaError: () => KapibalaError,
   ModelError: () => ModelError,
   OpenAICompatibleProvider: () => OpenAICompatibleProvider,
+  OpenAIResponsesProvider: () => OpenAIResponsesProvider,
   PathSandbox: () => PathSandbox,
   PermissionPolicy: () => PermissionPolicy,
   PromptAssembler: () => PromptAssembler,
@@ -64,6 +66,7 @@ __export(index_exports, {
   ToolRegistry: () => ToolRegistry,
   TransportError: () => TransportError,
   UnicodeTokenEstimator: () => UnicodeTokenEstimator,
+  assembleCanonicalToolResults: () => assembleCanonicalToolResults,
   builtinTools: () => builtinTools,
   classifyBashOutput: () => classifyBashOutput,
   cleanupCommandResults: () => cleanupCommandResults,
@@ -103,6 +106,7 @@ __export(index_exports, {
   supportsSessionState: () => supportsSessionState,
   toToolDefinition: () => toToolDefinition,
   truncateToolOutput: () => truncateToolOutput,
+  validateModelBinding: () => validateModelBinding,
   validatePermissionRules: () => validatePermissionRules,
   validateSummary: () => validateSummary,
   visibleTools: () => visibleTools,
@@ -125,10 +129,341 @@ function isThinkingBlock(block) {
 }
 
 // src/context/history.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 
-// src/types/identity.ts
+// src/models/protocol-state.ts
 var import_node_crypto = require("crypto");
+
+// src/errors/index.ts
+function sanitizeModelErrorMessage(value) {
+  return value.replace(
+    /\b(?:Authorization|Proxy-Authorization)\s*:\s*(?:Bearer|Basic)\s+[^\s,;"']+/gi,
+    "Authorization: [redacted]"
+  ).replace(/\b(?:Cookie|Set-Cookie)\s*:[^\r\n]*/gi, "Cookie: [redacted]").replace(/\p{Cc}/gu, " ").replace(/\bBearer\s+[^\s,;"']+/gi, "Bearer [redacted]").replace(/\b(?:sk|api|key)-[A-Za-z0-9_-]{5,}/g, "[redacted]").replace(
+    /((?:api[_-]?key|access[_-]?token|token|password|secret|authorization|cookie)["']?\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s,;&]+)/gi,
+    "$1[redacted]"
+  ).replace(/https?:\/\/[^\s<>"']+/gi, (raw) => {
+    try {
+      const url = new URL(raw);
+      if (url.username || url.password) {
+        url.username = "redacted";
+        url.password = "redacted";
+      }
+      if (url.search) url.search = "?redacted";
+      if (url.hash) url.hash = "#redacted";
+      return url.toString();
+    } catch {
+      return "[redacted URL]";
+    }
+  }).slice(0, 600);
+}
+function safeErrorIdentifier(value) {
+  return value && /^[A-Za-z0-9_.:-]{1,80}$/.test(value) && !/^(?:sk|api|key)-/i.test(value) ? value : void 0;
+}
+function classifyModelError(options) {
+  const codes = [options.providerCode, options.providerType, options.code];
+  if (codes.some(
+    (c) => [
+      "context_length_exceeded",
+      "context_window_exceeded",
+      "max_context_length_exceeded",
+      "MODEL_CONTEXT_EXCEEDED"
+    ].includes(c ?? "")
+  ))
+    return "context";
+  if (codes.some(
+    (c) => [
+      "insufficient_quota",
+      "insufficient_balance",
+      "quota_exceeded",
+      "billing_hard_limit_reached"
+    ].includes(c ?? "")
+  ) || options.status === 402)
+    return "quota";
+  if (codes.some(
+    (c) => ["invalid_api_key", "authentication_error", "permission_error"].includes(c ?? "")
+  ) || options.status === 401 || options.status === 403)
+    return "authentication";
+  if (codes.some((c) => ["rate_limit_exceeded", "rate_limit_error"].includes(c ?? "")) || options.status === 429)
+    return "rate_limit";
+  if (options.status === 408 || /TIMEOUT|ETIMEDOUT/.test(options.transportCode ?? ""))
+    return "timeout";
+  if (options.transportCode || options.code === "MODEL_STREAM_INTERRUPTED" || options.stage === "connect")
+    return "network";
+  if (codes.some(
+    (c) => ["server_error", "overloaded_error", "api_error", "internal_server_error"].includes(c ?? "")
+  ) || options.status && options.status >= 500)
+    return "service";
+  if (codes.some((c) => ["invalid_request_error", "invalid_argument"].includes(c ?? "")))
+    return "invalid_request";
+  if (options.status && options.status >= 400) return "invalid_request";
+  if (options.code === "MODEL_STREAM_INCOMPLETE" || options.code === "MODEL_INVALID_RESPONSE")
+    return "invalid_response";
+  return "unknown";
+}
+var MODEL_ERROR_ADVICE = {
+  authentication: "\u68C0\u67E5 API Key\u3001\u6A21\u578B\u6743\u9650\u53CA\u7AEF\u70B9\u914D\u7F6E\u540E\u91CD\u8BD5\u3002",
+  quota: "\u68C0\u67E5\u8D26\u6237\u4F59\u989D\u6216\u914D\u989D\u540E\u91CD\u8BD5\u3002",
+  rate_limit: "\u7A0D\u540E\u91CD\u8BD5\uFF0C\u6216\u964D\u4F4E\u8BF7\u6C42\u9891\u7387\u3002",
+  context: "\u9009\u62E9\u66F4\u5927\u4E0A\u4E0B\u6587\u7A97\u53E3\u3001\u538B\u7F29\u5386\u53F2\u6216\u62C6\u5206\u4EFB\u52A1\u540E\u91CD\u8BD5\u3002",
+  service: "\u670D\u52A1\u6682\u65F6\u5F02\u5E38\uFF0C\u53EF\u7A0D\u540E\u5728\u5F53\u524D\u4F1A\u8BDD\u91CD\u8BD5\u3002",
+  network: "\u68C0\u67E5\u7F51\u7EDC\u3001\u4EE3\u7406\u548C\u7AEF\u70B9\uFF1B\u8FDE\u63A5\u6062\u590D\u540E\u53EF\u5728\u5F53\u524D\u4F1A\u8BDD\u91CD\u8BD5\u3002",
+  timeout: "\u68C0\u67E5\u7F51\u7EDC\u53CA\u670D\u52A1\u54CD\u5E94\u60C5\u51B5\uFF0C\u7A0D\u540E\u91CD\u8BD5\u3002",
+  invalid_request: "\u68C0\u67E5\u6A21\u578B\u4E0E\u7AEF\u70B9\u7684\u534F\u8BAE\u517C\u5BB9\u6027\u53CA\u8BF7\u6C42\u914D\u7F6E\u3002",
+  invalid_response: "\u54CD\u5E94\u4E0D\u5B8C\u6574\u6216\u683C\u5F0F\u5F02\u5E38\uFF0C\u53EF\u5728\u5F53\u524D\u4F1A\u8BDD\u91CD\u8BD5\u5E76\u68C0\u67E5\u7AEF\u70B9\u534F\u8BAE\u517C\u5BB9\u6027\u3002",
+  unknown: "\u539F\u56E0\u672A\u786E\u8BA4\uFF0C\u8BF7\u7ED3\u5408\u9519\u8BEF\u7801\u548C\u8FD0\u884C\u65E5\u5FD7\u68C0\u67E5\u3002"
+};
+function describeModelError(error, context = {}) {
+  return {
+    category: error.category,
+    code: error.code,
+    message: sanitizeModelErrorMessage(error.message),
+    status: error.status,
+    providerCode: error.providerCode,
+    providerType: error.providerType,
+    transportCode: error.transportCode,
+    stage: error.stage,
+    retryPolicy: error.retryPolicy,
+    suggestion: MODEL_ERROR_ADVICE[error.category],
+    modelId: context.modelId ? sanitizeModelErrorMessage(context.modelId) : void 0,
+    provider: context.provider ? sanitizeModelErrorMessage(context.provider) : void 0,
+    operation: context.operation,
+    modelRole: context.modelRole
+  };
+}
+var KapibalaError = class extends Error {
+  code;
+  retryPolicy;
+  safeMessage;
+  constructor(message, options) {
+    super(message);
+    this.name = "KapibalaError";
+    this.code = options?.code ?? "INTERNAL_ERROR";
+    this.retryPolicy = options?.retryPolicy ?? "never";
+    this.safeMessage = options?.safeMessage ?? "Operation failed";
+  }
+};
+var ModelError = class extends KapibalaError {
+  status;
+  /** 属于可退避重试的瞬态类别（限流/服务/超时/网络）；不等于自动重试授权。 */
+  retryable;
+  /** 可选的受控底层连接错误码，不包含原始传输异常文本。 */
+  transportCode;
+  providerCode;
+  providerType;
+  stage;
+  category;
+  /** 构建模型错误，清理服务端原因并按明确状态/错误码分类；重试策略仅为建议，不授权重放。 */
+  constructor(message, options = {}) {
+    const category = classifyModelError(options);
+    const actionRequired = ["authentication", "quota", "context", "invalid_request"].includes(
+      category
+    );
+    const retryable = options.retryable ?? ["rate_limit", "service", "timeout", "network"].includes(category);
+    super(sanitizeModelErrorMessage(message), {
+      code: safeErrorIdentifier(options.code) ?? (category === "unknown" ? "MODEL_ERROR" : `MODEL_${category.toUpperCase()}`),
+      retryPolicy: actionRequired ? "after_user_action" : retryable ? "backoff" : "never",
+      safeMessage: sanitizeModelErrorMessage(message)
+    });
+    this.name = "ModelError";
+    this.status = options?.status;
+    this.transportCode = safeErrorIdentifier(options.transportCode);
+    this.providerCode = safeErrorIdentifier(options.providerCode);
+    this.providerType = safeErrorIdentifier(options.providerType);
+    this.stage = options.stage;
+    this.category = category;
+    this.retryable = retryable;
+  }
+};
+var ContextOverflowError = class extends ModelError {
+  /** 保留明确上下文错误的脱敏服务端原因；只允许尚无输出的请求进入一次预算处理。 */
+  constructor(status, details = {}) {
+    super(details.message ?? "Model context window exceeded", {
+      ...details,
+      status,
+      retryable: false,
+      code: "MODEL_CONTEXT_EXCEEDED"
+    });
+    this.name = "ContextOverflowError";
+  }
+};
+var TransportError = class extends KapibalaError {
+  retryable;
+  constructor(message, retryable = true) {
+    super(message);
+    this.name = "TransportError";
+    this.retryable = retryable;
+  }
+};
+var ToolError = class extends KapibalaError {
+  constructor(message) {
+    super(message, {
+      code: "TOOL_ERROR",
+      retryPolicy: "never",
+      safeMessage: "Tool execution failed"
+    });
+    this.name = "ToolError";
+  }
+};
+var ToolNotFound = class extends KapibalaError {
+  toolName;
+  availableTools;
+  constructor(toolName, availableTools = []) {
+    super(`Tool '${toolName}' not found. Available tools: ${availableTools.join(", ") || "none"}`, {
+      code: "TOOL_NOT_FOUND",
+      retryPolicy: "never",
+      safeMessage: "Requested tool is unavailable"
+    });
+    this.name = "ToolNotFound";
+    this.toolName = toolName;
+    this.availableTools = availableTools;
+  }
+};
+var AbortError = class extends KapibalaError {
+  constructor(message = "Execution aborted by user") {
+    super(message, {
+      code: "ABORTED",
+      retryPolicy: "after_user_action",
+      safeMessage: "Operation cancelled"
+    });
+    this.name = "AbortError";
+  }
+};
+var FatalError = class extends KapibalaError {
+  constructor(message) {
+    super(message);
+    this.name = "FatalError";
+  }
+};
+var SessionBusyError = class extends KapibalaError {
+  constructor(operation) {
+    super(`Session is already running; cannot ${operation}`);
+    this.name = "SessionBusyError";
+  }
+};
+var ContextBudgetError = class extends KapibalaError {
+  constructor(usedTokens, inputBudget) {
+    super(
+      `Context input requires approximately ${usedTokens} tokens; budget is ${inputBudget}. Choose a larger context window or start a smaller task.`,
+      {
+        code: "CONTEXT_BUDGET_EXCEEDED",
+        retryPolicy: "after_user_action",
+        safeMessage: "\u4E0A\u4E0B\u6587\u9884\u7B97\u4E0D\u8DB3\uFF0C\u8BF7\u9009\u62E9\u66F4\u5927\u7A97\u53E3\u6216\u62C6\u5206\u4EFB\u52A1\u3002"
+      }
+    );
+    this.usedTokens = usedTokens;
+    this.inputBudget = inputBudget;
+    this.name = "ContextBudgetError";
+  }
+  usedTokens;
+  inputBudget;
+};
+var ContextStorageError = class extends KapibalaError {
+  constructor(message) {
+    super(message, {
+      code: "CONTEXT_STORAGE_ERROR",
+      retryPolicy: "after_user_action",
+      safeMessage: "\u4E0A\u4E0B\u6587\u72B6\u6001\u4FDD\u5B58\u5931\u8D25\uFF0C\u5019\u9009\u672A\u751F\u6548\u3002"
+    });
+    this.name = "ContextStorageError";
+  }
+};
+
+// src/models/protocol-state.ts
+function invalidState() {
+  throw new ModelError("Invalid protocol state or provenance", {
+    code: "MODEL_INVALID_RESPONSE",
+    stage: "request",
+    retryable: false
+  });
+}
+function endpointScope(target) {
+  return (0, import_node_crypto.createHash)("sha256").update(`${target.baseURL.replace(/\/+$/, "")}\0${target.workspaceId ?? ""}`).digest("hex");
+}
+function createProtocolOrigin(target, context) {
+  return {
+    version: 1,
+    protocol: target.protocol,
+    modelName: target.modelName,
+    modelId: context?.modelId,
+    runId: context?.runId ?? `unmanaged-${(0, import_node_crypto.randomUUID)()}`,
+    endpointScope: endpointScope(target)
+  };
+}
+function validOrigin(value) {
+  if (!value || typeof value !== "object") return false;
+  const origin = value;
+  return origin.version === 1 && ["anthropic", "openai-responses"].includes(origin.protocol) && typeof origin.modelName === "string" && !!origin.modelName && typeof origin.runId === "string" && !!origin.runId && typeof origin.endpointScope === "string" && /^[a-f0-9]{64}$/.test(origin.endpointScope) && (origin.modelId === void 0 || typeof origin.modelId === "string");
+}
+function sameProtocolModel(origin, target) {
+  return validOrigin(origin) && origin.protocol === target.protocol && origin.modelName === target.modelName && origin.endpointScope === endpointScope(target);
+}
+function privateReplayAllowed(origin, target, context) {
+  return !!origin && !!context?.runId && sameProtocolModel(origin, target) && origin.runId === context.runId && origin.modelId === context.modelId;
+}
+var validatedBlocks = /* @__PURE__ */ new WeakMap();
+var validatedContents = /* @__PURE__ */ new WeakMap();
+function validateProtocolContent(content) {
+  if (validatedContents.get(content)) return;
+  for (const block of content) {
+    if (!block || typeof block !== "object") invalidState();
+    if (validatedBlocks.get(block)) continue;
+    if ("origin" in block && block.origin !== void 0 && !validOrigin(block.origin))
+      invalidState();
+    if ("protocolMeta" in block && block.protocolMeta !== void 0) {
+      const meta = block.protocolMeta;
+      if (!meta || !validOrigin(meta.origin) || !Number.isSafeInteger(meta.itemIndex) || meta.itemIndex < 0 || meta.itemId !== void 0 && (typeof meta.itemId !== "string" || !meta.itemId) || meta.contentIndex !== void 0 && (!Number.isSafeInteger(meta.contentIndex) || meta.contentIndex < 0) || meta.phase !== void 0 && !["commentary", "final_answer"].includes(meta.phase) || meta.contentType !== void 0 && !["output_text", "refusal"].includes(meta.contentType) || meta.arguments !== void 0 && typeof meta.arguments !== "string")
+        invalidState();
+    }
+    if (block.type === "provider_state") {
+      const item = block.item;
+      if (!validOrigin(block.origin) || block.origin.protocol !== "openai-responses" || !item || item.type !== "reasoning" || typeof item.id !== "string" || !item.id || !Array.isArray(item.summary) || item.summary.some((s) => !s || s.type !== "summary_text" || typeof s.text !== "string") || item.encrypted_content !== void 0 && typeof item.encrypted_content !== "string" || item.status !== void 0 && !["completed", "in_progress", "incomplete"].includes(item.status))
+        invalidState();
+      try {
+        if (JSON.stringify(item).length > 16 * 1024 * 1024) invalidState();
+      } catch {
+        invalidState();
+      }
+    }
+    validatedBlocks.set(block, true);
+  }
+  validatedContents.set(content, true);
+}
+function projectProtocolHistory(messages, target, context) {
+  return messages.map((message) => {
+    validateProtocolContent(message.content);
+    const copy = structuredClone(message);
+    copy.content = copy.content.flatMap((block) => {
+      if (block.type === "provider_state")
+        return privateReplayAllowed(block.origin, target, context) && (block.item.status === void 0 || block.item.status === "completed") ? [block] : [];
+      if (block.type === "redacted_thinking")
+        return privateReplayAllowed(block.origin, target, context) ? [block] : [];
+      if (block.type === "thinking") {
+        if (privateReplayAllowed(block.origin, target, context)) return [block];
+        if (!block.origin && target.protocol === "openai-compatible") return [block];
+        return block.thinking ? [{ type: "text", text: block.thinking }] : [];
+      }
+      if ((block.type === "text" || block.type === "tool_use") && block.protocolMeta && !sameProtocolModel(block.protocolMeta.origin, target))
+        block.protocolMeta = void 0;
+      return [block];
+    });
+    return copy;
+  });
+}
+function summarySafeMessage(message) {
+  const copy = structuredClone(message);
+  copy.content = copy.content.flatMap((block) => {
+    if (block.type === "provider_state" || block.type === "redacted_thinking") return [];
+    if (block.type === "thinking")
+      return block.thinking ? [{ type: "text", text: block.thinking }] : [];
+    if (block.type === "text" || block.type === "tool_use") block.protocolMeta = void 0;
+    return [block];
+  });
+  return copy;
+}
+
+// src/types/identity.ts
+var import_node_crypto2 = require("crypto");
 var lastTime = 0;
 var sequence = 0n;
 var sequenceMask = (1n << 74n) - 1n;
@@ -136,7 +471,7 @@ function createMessageId() {
   const now = Date.now();
   if (now > lastTime) {
     lastTime = now;
-    sequence = BigInt(`0x${(0, import_node_crypto.randomBytes)(10).toString("hex")}`) & sequenceMask;
+    sequence = BigInt(`0x${(0, import_node_crypto2.randomBytes)(10).toString("hex")}`) & sequenceMask;
   } else if (sequence === sequenceMask) {
     lastTime++;
     sequence = 0n;
@@ -149,9 +484,10 @@ function createMessageId() {
 
 // src/context/history.ts
 function identifyHistory(messages, source) {
+  for (const message of messages) validateProtocolContent(message.content);
   return messages.map((message, position) => ({
     ...structuredClone(message),
-    id: message.id ?? `legacy-${(0, import_node_crypto2.createHash)("sha256").update(`${source}\0${position}\0${JSON.stringify(message)}`).digest("hex")}`
+    id: message.id ?? `legacy-${(0, import_node_crypto3.createHash)("sha256").update(`${source}\0${position}\0${JSON.stringify(message)}`).digest("hex")}`
   }));
 }
 function normalizeHistory(input) {
@@ -160,7 +496,7 @@ function normalizeHistory(input) {
   const calls = /* @__PURE__ */ new Set();
   const push = (message, sources) => {
     const last = result.messages.at(-1);
-    const pure = (m) => m.content.every((b) => b.type === "text");
+    const pure = (m) => m.content.every((b) => b.type === "text" && !b.protocolMeta);
     if (last && !last.contextSummary && !message.contextSummary && last.role === message.role && ["user", "assistant"].includes(message.role) && pure(last) && pure(message)) {
       last.content.push(...message.content);
       result.sources.at(-1).push(...sources);
@@ -251,8 +587,10 @@ function indexInteractions(input, terminals = []) {
     const last = group.at(-1);
     const normalized = normalizeHistory(group);
     if (last.role === "assistant" && (!last.state || last.state === "completed") && last.content.every(
-      (b) => b.type === "text" || b.type === "thinking" || b.type === "redacted_thinking"
-    ) && last.content.some((b) => b.type === "text" && b.text.trim()) && !normalized.repairs.length)
+      (b) => b.type === "text" || b.type === "thinking" || b.type === "redacted_thinking" || b.type === "provider_state"
+    ) && last.content.some(
+      (b) => b.type === "text" && b.text.trim() && b.protocolMeta?.phase !== "commentary"
+    ) && !normalized.repairs.length)
       boundary.status = "completed";
   }
   const successIndex = interactions.map((i) => i.status).lastIndexOf("completed");
@@ -376,6 +714,7 @@ var SessionStore = class _SessionStore {
   }
   /** 消息级持久化，补稳定身份并保留所有终态字段，成功后方可进入下一次写入。 */
   async append(message) {
+    validateProtocolContent(message.content);
     const payload = { ...structuredClone(message), id: message.id ?? createMessageId() };
     await this.enqueue("message", payload);
     message.id ??= payload.id;
@@ -549,6 +888,7 @@ var SessionStore = class _SessionStore {
         if (messages.has(record.payload.id))
           throw new Error(`Duplicate message ID: ${record.payload.id}`);
         messages.add(record.payload.id);
+        validateProtocolContent(record.payload.content);
       }
       if (record.type === "header" && records.length)
         throw new Error("Session corrupt: repeated header");
@@ -570,7 +910,7 @@ var SessionStore = class _SessionStore {
 };
 
 // src/context/session-lock.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_node_fs3 = __toESM(require("fs"), 1);
 var import_node_path2 = __toESM(require("path"), 1);
 var SessionLock = class _SessionLock {
@@ -587,7 +927,7 @@ var SessionLock = class _SessionLock {
     import_node_fs3.default.mkdirSync(import_node_path2.default.dirname(lockPath), { recursive: true });
     const recovery = `${lockPath}.recovery`;
     _SessionLock.ensureNoLiveRecovery(recovery);
-    const owner = { nonce: (0, import_node_crypto3.randomUUID)(), pid: process.pid, createdAt: Date.now() };
+    const owner = { nonce: (0, import_node_crypto4.randomUUID)(), pid: process.pid, createdAt: Date.now() };
     let createdDir = false;
     try {
       import_node_fs3.default.mkdirSync(lockPath);
@@ -610,7 +950,7 @@ var SessionLock = class _SessionLock {
         if (current?.nonce !== stale.nonce || current.pid !== stale.pid || !_SessionLock.isDead(current.pid)) {
           throw new Error("Session locked: owner changed");
         }
-        const quarantine = `${lockPath}.stale-${(0, import_node_crypto3.randomUUID)()}`;
+        const quarantine = `${lockPath}.stale-${(0, import_node_crypto4.randomUUID)()}`;
         import_node_fs3.default.renameSync(lockPath, quarantine);
         let freshDir = false;
         try {
@@ -708,7 +1048,7 @@ var SessionLock = class _SessionLock {
 
 // src/context/session-manager.ts
 var import_node_child_process = require("child_process");
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var import_node_fs4 = __toESM(require("fs"), 1);
 var import_node_os = __toESM(require("os"), 1);
 var import_node_path3 = __toESM(require("path"), 1);
@@ -738,7 +1078,7 @@ function resolveSessionProject(cwd) {
   return {
     projectRoot: root,
     cwd: realCwd,
-    projectKey: (0, import_node_crypto4.createHash)("sha256").update(normalized).digest("hex"),
+    projectKey: (0, import_node_crypto5.createHash)("sha256").update(normalized).digest("hex"),
     gitBranch,
     gitWorktree
   };
@@ -890,7 +1230,7 @@ var SessionManager = class {
       if (!import_node_fs4.default.existsSync(source)) continue;
       const before = import_node_fs4.default.statSync(source);
       const bytes = import_node_fs4.default.readFileSync(source);
-      const identity = (0, import_node_crypto4.createHash)("sha256").update(import_node_fs4.default.realpathSync.native(source)).update("\0").update(bytes).digest("hex");
+      const identity = (0, import_node_crypto5.createHash)("sha256").update(import_node_fs4.default.realpathSync.native(source)).update("\0").update(bytes).digest("hex");
       const importLock = await SessionLock.acquire(
         import_node_path3.default.join(this.directory, `import-${identity}.lock`)
       );
@@ -1118,389 +1458,189 @@ var SessionManager = class {
     const id = import_node_path3.default.basename(file, ".jsonl").split("_").at(-1);
     return import_node_path3.default.join(import_node_path3.default.dirname(file), `${id}.meta.json`);
   }
-  lockPath(id) {
-    return import_node_path3.default.join(this.directory, `${id}.lock`);
-  }
-  report(message) {
-    try {
-      this.diagnostic?.(message);
-    } catch {
-    }
-  }
-};
-
-// src/context/budget.ts
-var import_node_crypto5 = require("crypto");
-
-// src/models/router.ts
-var DEFAULT_CONTEXT_WINDOW_TOKENS = 1e6;
-function resolveContextWindow(value) {
-  if (value === void 0) {
-    return { tokens: DEFAULT_CONTEXT_WINDOW_TOKENS, estimated: true };
-  }
-  let tokens;
-  if (typeof value === "number") {
-    tokens = value;
-  } else {
-    const match = /^([0-9]+(?:\.[0-9]+)?)([km])$/i.exec(value.trim());
-    const unit = match?.[2]?.toLowerCase();
-    const fractionDigits = match?.[1]?.split(".")[1]?.length ?? 0;
-    const maxFractionDigits = unit === "m" ? 6 : 3;
-    if (!match || fractionDigits > maxFractionDigits) {
-      throw new RangeError(
-        `Invalid contextWindow '${value}': expected a positive integer or K/M value`
-      );
-    }
-    const multiplier = unit === "m" ? 1e6 : 1e3;
-    tokens = Number(match[1]) * multiplier;
-  }
-  if (!Number.isSafeInteger(tokens) || tokens <= 0) {
-    throw new RangeError(
-      `Invalid contextWindow '${value}': token count must be a positive integer`
-    );
-  }
-  return { tokens, estimated: false };
-}
-var SimpleModelRouter = class {
-  providers = /* @__PURE__ */ new Map();
-  profiles = /* @__PURE__ */ new Map();
-  defaultRole = "default";
-  constructor(defaultProfile, defaultProvider) {
-    this.setRole("default", defaultProfile, defaultProvider);
-  }
-  setRole(role, profile, provider) {
-    this.profiles.set(role, profile);
-    this.providers.set(role, provider);
-  }
-  resolve(role = "default") {
-    return this.providers.get(role) ?? this.providers.get("default");
-  }
-  getProfile(role = "default") {
-    return this.profiles.get(role) ?? this.profiles.get("default");
-  }
-};
-
-// src/context/budget.ts
-function createContextBudget(window) {
-  const resolved = resolveContextWindow(window);
-  const contextWindow = resolved.estimated ? 32e3 : resolved.tokens;
-  const outputReserve = Math.min(4096, Math.floor(contextWindow * 0.125));
-  const safetyReserve = Math.max(128, Math.ceil(contextWindow * 0.05));
-  const inputBudget = contextWindow - outputReserve - safetyReserve;
-  const trigger = Math.floor(inputBudget * 0.85);
-  const target = Math.floor(inputBudget * 0.65);
-  if (!(0 < target && target < trigger && trigger < inputBudget && outputReserve > 0))
-    throw new Error("Invalid context budget: model window is too small");
-  return {
-    contextWindow,
-    estimatedWindow: resolved.estimated,
-    outputReserve,
-    safetyReserve,
-    inputBudget,
-    trigger,
-    target
-  };
-}
-function stableSerialize(value) {
-  const visit = (v) => {
-    if (Array.isArray(v)) return v.map(visit);
-    if (v && typeof v === "object")
-      return Object.fromEntries(
-        Object.entries(v).filter(([, val]) => val !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, val]) => [key, visit(val)])
-      );
-    return v;
-  };
-  return JSON.stringify(visit(value));
-}
-function requestFingerprint(request, modelFingerprint = "") {
-  return (0, import_node_crypto5.createHash)("sha256").update(
-    stableSerialize({
-      modelFingerprint,
-      systemPrompt: request.systemPrompt,
-      messages: request.messages,
-      tools: request.tools,
-      maxTokens: request.maxTokens,
-      temperature: request.temperature
-    })
-  ).digest("hex");
-}
-var UnicodeTokenEstimator = class {
-  calibration = /* @__PURE__ */ new Map();
-  /** 计算系统、工具、历史和协议开销，返回估算/校准来源，保持请求不变。 */
-  estimate(request, modelFingerprint = "") {
-    const count = (text) => {
-      let ascii = 0;
-      let unicode = 0;
-      for (const char of text) {
-        if (char.codePointAt(0) < 128) ascii++;
-        else unicode++;
-      }
-      return Math.ceil(ascii / 4) + unicode;
-    };
-    const system = count(request.systemPrompt ?? "");
-    const tools = request.tools?.length ? count(stableSerialize(request.tools)) + request.tools.length * 8 : 0;
-    const history = request.messages.reduce(
-      (total, message) => total + count(stableSerialize(message.content)) + 6,
-      0
-    );
-    const overhead = 12;
-    const factor = this.calibration.get(requestFingerprint(request, modelFingerprint)) ?? 1;
-    return {
-      total: Math.ceil((system + tools + history + overhead) * factor),
-      system: Math.ceil(system * factor),
-      tools: Math.ceil(tools * factor),
-      history: Math.ceil(history * factor),
-      overhead: Math.ceil(overhead * factor),
-      source: factor === 1 ? "estimated" : "calibrated"
-    };
-  }
-  /** 仅接受真实正整数 prompt usage，校准不会降低原保守估算；缓存最多 64 个最终请求。 */
-  observe(request, actualPromptTokens, modelFingerprint = "") {
-    if (!Number.isSafeInteger(actualPromptTokens) || actualPromptTokens <= 0) return;
-    const key = requestFingerprint(request, modelFingerprint);
-    this.calibration.delete(key);
-    const baseline = this.estimate(request, modelFingerprint).total;
-    this.calibration.set(key, Math.max(1, actualPromptTokens / baseline));
-    if (this.calibration.size > 64) this.calibration.delete(this.calibration.keys().next().value);
+  lockPath(id) {
+    return import_node_path3.default.join(this.directory, `${id}.lock`);
+  }
+  report(message) {
+    try {
+      this.diagnostic?.(message);
+    } catch {
+    }
   }
 };
 
-// src/context/manager.ts
+// src/context/budget.ts
 var import_node_crypto6 = require("crypto");
 
-// src/errors/index.ts
-function sanitizeModelErrorMessage(value) {
-  return value.replace(
-    /\b(?:Authorization|Proxy-Authorization)\s*:\s*(?:Bearer|Basic)\s+[^\s,;"']+/gi,
-    "Authorization: [redacted]"
-  ).replace(/\b(?:Cookie|Set-Cookie)\s*:[^\r\n]*/gi, "Cookie: [redacted]").replace(/\p{Cc}/gu, " ").replace(/\bBearer\s+[^\s,;"']+/gi, "Bearer [redacted]").replace(/\b(?:sk|api|key)-[A-Za-z0-9_-]{5,}/g, "[redacted]").replace(
-    /((?:api[_-]?key|access[_-]?token|token|password|secret|authorization|cookie)["']?\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s,;&]+)/gi,
-    "$1[redacted]"
-  ).replace(/https?:\/\/[^\s<>"']+/gi, (raw) => {
-    try {
-      const url = new URL(raw);
-      if (url.username || url.password) {
-        url.username = "redacted";
-        url.password = "redacted";
-      }
-      if (url.search) url.search = "?redacted";
-      if (url.hash) url.hash = "#redacted";
-      return url.toString();
-    } catch {
-      return "[redacted URL]";
+// src/models/router.ts
+var DEFAULT_CONTEXT_WINDOW_TOKENS = 1e6;
+function resolveContextWindow(value) {
+  if (value === void 0) {
+    return { tokens: DEFAULT_CONTEXT_WINDOW_TOKENS, estimated: true };
+  }
+  let tokens;
+  if (typeof value === "number") {
+    tokens = value;
+  } else {
+    const match = /^([0-9]+(?:\.[0-9]+)?)([km])$/i.exec(value.trim());
+    const unit = match?.[2]?.toLowerCase();
+    const fractionDigits = match?.[1]?.split(".")[1]?.length ?? 0;
+    const maxFractionDigits = unit === "m" ? 6 : 3;
+    if (!match || fractionDigits > maxFractionDigits) {
+      throw new RangeError(
+        `Invalid contextWindow '${value}': expected a positive integer or K/M value`
+      );
     }
-  }).slice(0, 600);
-}
-function safeErrorIdentifier(value) {
-  return value && /^[A-Za-z0-9_.:-]{1,80}$/.test(value) && !/^(?:sk|api|key)-/i.test(value) ? value : void 0;
-}
-function classifyModelError(options) {
-  const codes = [options.providerCode, options.providerType, options.code];
-  if (codes.some(
-    (c) => [
-      "context_length_exceeded",
-      "context_window_exceeded",
-      "max_context_length_exceeded",
-      "MODEL_CONTEXT_EXCEEDED"
-    ].includes(c ?? "")
-  ))
-    return "context";
-  if (codes.some(
-    (c) => [
-      "insufficient_quota",
-      "insufficient_balance",
-      "quota_exceeded",
-      "billing_hard_limit_reached"
-    ].includes(c ?? "")
-  ) || options.status === 402)
-    return "quota";
-  if (codes.some(
-    (c) => ["invalid_api_key", "authentication_error", "permission_error"].includes(c ?? "")
-  ) || options.status === 401 || options.status === 403)
-    return "authentication";
-  if (codes.some((c) => ["rate_limit_exceeded", "rate_limit_error"].includes(c ?? "")) || options.status === 429)
-    return "rate_limit";
-  if (options.status === 408 || /TIMEOUT|ETIMEDOUT/.test(options.transportCode ?? ""))
-    return "timeout";
-  if (options.transportCode || options.code === "MODEL_STREAM_INTERRUPTED" || options.stage === "connect")
-    return "network";
-  if (codes.some(
-    (c) => ["server_error", "overloaded_error", "api_error", "internal_server_error"].includes(c ?? "")
-  ) || options.status && options.status >= 500)
-    return "service";
-  if (codes.some((c) => ["invalid_request_error", "invalid_argument"].includes(c ?? "")))
-    return "invalid_request";
-  if (options.status && options.status >= 400) return "invalid_request";
-  if (options.code === "MODEL_STREAM_INCOMPLETE" || options.code === "MODEL_INVALID_RESPONSE")
-    return "invalid_response";
-  return "unknown";
-}
-var MODEL_ERROR_ADVICE = {
-  authentication: "\u68C0\u67E5 API Key\u3001\u6A21\u578B\u6743\u9650\u53CA\u7AEF\u70B9\u914D\u7F6E\u540E\u91CD\u8BD5\u3002",
-  quota: "\u68C0\u67E5\u8D26\u6237\u4F59\u989D\u6216\u914D\u989D\u540E\u91CD\u8BD5\u3002",
-  rate_limit: "\u7A0D\u540E\u91CD\u8BD5\uFF0C\u6216\u964D\u4F4E\u8BF7\u6C42\u9891\u7387\u3002",
-  context: "\u9009\u62E9\u66F4\u5927\u4E0A\u4E0B\u6587\u7A97\u53E3\u3001\u538B\u7F29\u5386\u53F2\u6216\u62C6\u5206\u4EFB\u52A1\u540E\u91CD\u8BD5\u3002",
-  service: "\u670D\u52A1\u6682\u65F6\u5F02\u5E38\uFF0C\u53EF\u7A0D\u540E\u5728\u5F53\u524D\u4F1A\u8BDD\u91CD\u8BD5\u3002",
-  network: "\u68C0\u67E5\u7F51\u7EDC\u3001\u4EE3\u7406\u548C\u7AEF\u70B9\uFF1B\u8FDE\u63A5\u6062\u590D\u540E\u53EF\u5728\u5F53\u524D\u4F1A\u8BDD\u91CD\u8BD5\u3002",
-  timeout: "\u68C0\u67E5\u7F51\u7EDC\u53CA\u670D\u52A1\u54CD\u5E94\u60C5\u51B5\uFF0C\u7A0D\u540E\u91CD\u8BD5\u3002",
-  invalid_request: "\u68C0\u67E5\u6A21\u578B\u4E0E\u7AEF\u70B9\u7684\u534F\u8BAE\u517C\u5BB9\u6027\u53CA\u8BF7\u6C42\u914D\u7F6E\u3002",
-  invalid_response: "\u54CD\u5E94\u4E0D\u5B8C\u6574\u6216\u683C\u5F0F\u5F02\u5E38\uFF0C\u53EF\u5728\u5F53\u524D\u4F1A\u8BDD\u91CD\u8BD5\u5E76\u68C0\u67E5\u7AEF\u70B9\u534F\u8BAE\u517C\u5BB9\u6027\u3002",
-  unknown: "\u539F\u56E0\u672A\u786E\u8BA4\uFF0C\u8BF7\u7ED3\u5408\u9519\u8BEF\u7801\u548C\u8FD0\u884C\u65E5\u5FD7\u68C0\u67E5\u3002"
-};
-function describeModelError(error, context = {}) {
-  return {
-    category: error.category,
-    code: error.code,
-    message: sanitizeModelErrorMessage(error.message),
-    status: error.status,
-    providerCode: error.providerCode,
-    providerType: error.providerType,
-    transportCode: error.transportCode,
-    stage: error.stage,
-    retryPolicy: error.retryPolicy,
-    suggestion: MODEL_ERROR_ADVICE[error.category],
-    modelId: context.modelId ? sanitizeModelErrorMessage(context.modelId) : void 0,
-    provider: context.provider ? sanitizeModelErrorMessage(context.provider) : void 0,
-    operation: context.operation
-  };
-}
-var KapibalaError = class extends Error {
-  code;
-  retryPolicy;
-  safeMessage;
-  constructor(message, options) {
-    super(message);
-    this.name = "KapibalaError";
-    this.code = options?.code ?? "INTERNAL_ERROR";
-    this.retryPolicy = options?.retryPolicy ?? "never";
-    this.safeMessage = options?.safeMessage ?? "Operation failed";
+    const multiplier = unit === "m" ? 1e6 : 1e3;
+    tokens = Number(match[1]) * multiplier;
   }
-};
-var ModelError = class extends KapibalaError {
-  status;
-  retryable;
-  /** 可选的受控底层连接错误码，不包含原始传输异常文本。 */
-  transportCode;
-  providerCode;
-  providerType;
-  stage;
-  category;
-  /** 构建模型错误，清理服务端原因并按明确状态/错误码分类；重试策略仅为建议，不授权重放。 */
-  constructor(message, options = {}) {
-    const category = classifyModelError(options);
-    const actionRequired = ["authentication", "quota", "context", "invalid_request"].includes(
-      category
+  if (!Number.isSafeInteger(tokens) || tokens <= 0) {
+    throw new RangeError(
+      `Invalid contextWindow '${value}': token count must be a positive integer`
     );
-    const retryable = options.retryable ?? ["rate_limit", "service", "timeout", "network"].includes(category);
-    super(sanitizeModelErrorMessage(message), {
-      code: safeErrorIdentifier(options.code) ?? (category === "unknown" ? "MODEL_ERROR" : `MODEL_${category.toUpperCase()}`),
-      retryPolicy: actionRequired ? "after_user_action" : retryable ? "backoff" : "never",
-      safeMessage: sanitizeModelErrorMessage(message)
-    });
-    this.name = "ModelError";
-    this.status = options?.status;
-    this.transportCode = safeErrorIdentifier(options.transportCode);
-    this.providerCode = safeErrorIdentifier(options.providerCode);
-    this.providerType = safeErrorIdentifier(options.providerType);
-    this.stage = options.stage;
-    this.category = category;
-    this.retryable = retryable;
   }
-};
-var ContextOverflowError = class extends ModelError {
-  /** 保留明确上下文错误的脱敏服务端原因；只允许尚无输出的请求进入一次预算处理。 */
-  constructor(status, details = {}) {
-    super(details.message ?? "Model context window exceeded", {
-      ...details,
-      status,
-      retryable: false,
-      code: "MODEL_CONTEXT_EXCEEDED"
+  return { tokens, estimated: false };
+}
+function validateModelBinding(profile, provider) {
+  const binding = provider.binding;
+  if (binding && (binding.protocol !== profile.provider || binding.modelName !== profile.modelName || binding.baseURL.replace(/\/+$/, "") !== profile.baseURL.replace(/\/+$/, "") || binding.workspaceId !== profile.anthropicWorkspaceId)) {
+    throw new ModelError("Model profile and provider binding do not match", {
+      stage: "request",
+      retryable: false
     });
-    this.name = "ContextOverflowError";
   }
-};
-var TransportError = class extends KapibalaError {
-  retryable;
-  constructor(message, retryable = true) {
-    super(message);
-    this.name = "TransportError";
-    this.retryable = retryable;
+}
+var SimpleModelRouter = class {
+  providers = /* @__PURE__ */ new Map();
+  profiles = /* @__PURE__ */ new Map();
+  defaultRole = "default";
+  constructor(defaultProfile, defaultProvider) {
+    this.setRole("default", defaultProfile, defaultProvider);
   }
-};
-var ToolError = class extends KapibalaError {
-  constructor(message) {
-    super(message, {
-      code: "TOOL_ERROR",
-      retryPolicy: "never",
-      safeMessage: "Tool execution failed"
-    });
-    this.name = "ToolError";
+  /** 校验配对后同时替换两者并保存配置副本，校验失败不污染既有绑定。 */
+  setRole(role, profile, provider) {
+    validateModelBinding(profile, provider);
+    this.profiles.set(role, structuredClone(profile));
+    this.providers.set(role, provider);
   }
-};
-var ToolNotFound = class extends KapibalaError {
-  toolName;
-  availableTools;
-  constructor(toolName, availableTools = []) {
-    super(`Tool '${toolName}' not found. Available tools: ${availableTools.join(", ") || "none"}`, {
-      code: "TOOL_NOT_FOUND",
-      retryPolicy: "never",
-      safeMessage: "Requested tool is unavailable"
-    });
-    this.name = "ToolNotFound";
-    this.toolName = toolName;
-    this.availableTools = availableTools;
+  /** 显式场景要求存在绑定；只有普通查询和摘要允许既有默认回退。 */
+  getBinding(role = "default", strict = false) {
+    if (strict && (!this.profiles.has(role) || !this.providers.has(role)))
+      throw new ModelError(`Model role '${role}' is not configured`, {
+        stage: "request",
+        retryable: false
+      });
+    return { profile: structuredClone(this.getProfile(role)), provider: this.resolve(role) };
+  }
+  resolve(role = "default") {
+    return this.providers.get(role) ?? this.providers.get("default");
+  }
+  /** 返回指定角色或默认模型的独立副本，调用方不能改写在途绑定。 */
+  getProfile(role = "default") {
+    return structuredClone(this.profiles.get(role) ?? this.profiles.get("default"));
   }
 };
-var AbortError = class extends KapibalaError {
-  constructor(message = "Execution aborted by user") {
-    super(message, {
-      code: "ABORTED",
-      retryPolicy: "after_user_action",
-      safeMessage: "Operation cancelled"
+
+// src/types/serialization.ts
+function stableSerialize(value) {
+  const visit = (v) => {
+    if (Array.isArray(v)) return v.map(visit);
+    if (v && typeof v === "object")
+      return Object.fromEntries(
+        Object.entries(v).filter(([, val]) => val !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, val]) => [key, visit(val)])
+      );
+    return v;
+  };
+  return JSON.stringify(visit(value));
+}
+
+// src/context/budget.ts
+function createContextBudget(window, maxOutputTokens = 4096) {
+  if (!Number.isSafeInteger(maxOutputTokens) || maxOutputTokens <= 0)
+    throw new ModelError("Invalid output token budget: expected a positive safe integer", {
+      code: "MODEL_INVALID_REQUEST",
+      stage: "request",
+      retryable: false
+    });
+  const resolved = resolveContextWindow(window);
+  const contextWindow = resolved.estimated ? 32e3 : resolved.tokens;
+  const outputReserve = Math.min(maxOutputTokens, Math.floor(contextWindow * 0.125));
+  const safetyReserve = Math.max(128, Math.ceil(contextWindow * 0.05));
+  const inputBudget = contextWindow - outputReserve - safetyReserve;
+  const trigger = Math.floor(inputBudget * 0.85);
+  const target = Math.floor(inputBudget * 0.65);
+  if (!(0 < target && target < trigger && trigger < inputBudget && outputReserve > 0))
+    throw new ModelError("Invalid context budget: model window is too small", {
+      code: "MODEL_INVALID_REQUEST",
+      stage: "request",
+      retryable: false
     });
-    this.name = "AbortError";
-  }
-};
-var FatalError = class extends KapibalaError {
-  constructor(message) {
-    super(message);
-    this.name = "FatalError";
-  }
-};
-var SessionBusyError = class extends KapibalaError {
-  constructor(operation) {
-    super(`Session is already running; cannot ${operation}`);
-    this.name = "SessionBusyError";
-  }
-};
-var ContextBudgetError = class extends KapibalaError {
-  constructor(usedTokens, inputBudget) {
-    super(
-      `Context input requires approximately ${usedTokens} tokens; budget is ${inputBudget}. Choose a larger context window or start a smaller task.`,
-      {
-        code: "CONTEXT_BUDGET_EXCEEDED",
-        retryPolicy: "after_user_action",
-        safeMessage: "\u4E0A\u4E0B\u6587\u9884\u7B97\u4E0D\u8DB3\uFF0C\u8BF7\u9009\u62E9\u66F4\u5927\u7A97\u53E3\u6216\u62C6\u5206\u4EFB\u52A1\u3002"
+  return {
+    contextWindow,
+    estimatedWindow: resolved.estimated,
+    outputReserve,
+    safetyReserve,
+    inputBudget,
+    trigger,
+    target
+  };
+}
+function requestFingerprint(request, modelFingerprint = "") {
+  return (0, import_node_crypto6.createHash)("sha256").update(
+    stableSerialize({
+      modelFingerprint,
+      systemPrompt: request.systemPrompt,
+      messages: request.messages,
+      tools: request.tools,
+      maxTokens: request.maxTokens,
+      temperature: request.temperature
+    })
+  ).digest("hex");
+}
+var UnicodeTokenEstimator = class {
+  calibration = /* @__PURE__ */ new Map();
+  /** 计算系统、工具、历史和协议开销，返回估算/校准来源，保持请求不变。 */
+  estimate(request, modelFingerprint = "") {
+    const count = (text) => {
+      let ascii = 0;
+      let unicode = 0;
+      for (const char of text) {
+        if (char.codePointAt(0) < 128) ascii++;
+        else unicode++;
       }
+      return Math.ceil(ascii / 4) + unicode;
+    };
+    const system = count(request.systemPrompt ?? "");
+    const tools = request.tools?.length ? count(stableSerialize(request.tools)) + request.tools.length * 8 : 0;
+    const history = request.messages.reduce(
+      (total, message) => total + count(stableSerialize(message.content)) + 6,
+      0
     );
-    this.usedTokens = usedTokens;
-    this.inputBudget = inputBudget;
-    this.name = "ContextBudgetError";
+    const overhead = 12;
+    const factor = this.calibration.get(requestFingerprint(request, modelFingerprint)) ?? 1;
+    return {
+      total: Math.ceil((system + tools + history + overhead) * factor),
+      system: Math.ceil(system * factor),
+      tools: Math.ceil(tools * factor),
+      history: Math.ceil(history * factor),
+      overhead: Math.ceil(overhead * factor),
+      source: factor === 1 ? "estimated" : "calibrated"
+    };
   }
-  usedTokens;
-  inputBudget;
-};
-var ContextStorageError = class extends KapibalaError {
-  constructor(message) {
-    super(message, {
-      code: "CONTEXT_STORAGE_ERROR",
-      retryPolicy: "after_user_action",
-      safeMessage: "\u4E0A\u4E0B\u6587\u72B6\u6001\u4FDD\u5B58\u5931\u8D25\uFF0C\u5019\u9009\u672A\u751F\u6548\u3002"
-    });
-    this.name = "ContextStorageError";
+  /** 仅接受真实正整数 prompt usage，校准不会降低原保守估算；缓存最多 64 个最终请求。 */
+  observe(request, actualPromptTokens, modelFingerprint = "") {
+    if (!Number.isSafeInteger(actualPromptTokens) || actualPromptTokens <= 0) return;
+    const key = requestFingerprint(request, modelFingerprint);
+    this.calibration.delete(key);
+    const baseline = this.estimate(request, modelFingerprint).total;
+    this.calibration.set(key, Math.max(1, actualPromptTokens / baseline));
+    if (this.calibration.size > 64) this.calibration.delete(this.calibration.keys().next().value);
   }
 };
 
+// src/context/manager.ts
+var import_node_crypto7 = require("crypto");
+
 // src/context/summary.ts
 var import_node_path4 = __toESM(require("path"), 1);
 function truncateToolOutput(text, maximum = 2e3) {
@@ -1618,6 +1758,7 @@ var SummaryService = class {
   /**
    * 按完整用户交互分批，以旧摘要和新增原始前缀取材；中间结果只是局部候选，不激活。
    * 单个不可拆分输入超预算、无终态、截断或非法来源均失败，取消先关闭 Provider 迭代。
+   * 摘要输出独立限制为 4096，并受 Profile 更低覆盖及窗口约束；非法 Profile 预算先失败。
    */
   async generate(history, previous, signal) {
     if (!history.length) throw new Error("No eligible summary prefix");
@@ -1630,7 +1771,11 @@ var SummaryService = class {
     try {
       const profile = this.options.router.getProfile("summary");
       const provider = this.options.router.resolve("summary");
-      const budget = createContextBudget(profile.contextWindow);
+      const profileBudget = createContextBudget(profile.contextWindow, profile.maxOutputTokens);
+      const budget = createContextBudget(
+        profile.contextWindow,
+        Math.min(4096, profileBudget.outputReserve)
+      );
       const allSources = /* @__PURE__ */ new Set([
         ...history.map((m) => m.id),
         ...previous?.summary.references ?? []
@@ -1640,7 +1785,7 @@ var SummaryService = class {
       for (const message of history) {
         if (!units.length || message.role === "user" && (!message.interactionId || message.interactionId !== units.at(-1)[0].interactionId))
           units.push([]);
-        units.at(-1).push(structuredClone(message));
+        units.at(-1).push(summarySafeMessage(message));
       }
       let rolling = previous?.summary;
       let calls = 0;
@@ -1672,7 +1817,8 @@ var SummaryService = class {
         tools: [],
         maxTokens: budget.outputReserve,
         signal: controller.signal,
-        temperature: 0
+        // 原生模型使用自己的采样默认，摘要目的不强制沿用旧 Chat 的采样参数。
+        ...profile.provider === "openai-compatible" ? { temperature: 0 } : {}
       });
       while (position < units.length) {
         if (controller.signal.aborted) throw new AbortError();
@@ -1706,6 +1852,11 @@ var SummaryService = class {
               stopped = true;
               finishReason = event.finishReason;
               attemptUsage = event.usage;
+              if (event.finalContent?.some((block) => block.type === "tool_use"))
+                throw new Error("Summary unexpectedly attempted a tool call");
+              if (event.refusal) throw new Error("Summary model refused the request");
+              if (event.finalContent)
+                text = event.finalContent.filter((block) => block.type === "text").map((block) => block.text).join("");
             }
           }
         } finally {
@@ -1746,7 +1897,13 @@ var SummaryService = class {
 
 // src/context/manager.ts
 var POLICY_VERSION = 1;
-var digest = (value) => (0, import_node_crypto6.createHash)("sha256").update(stableSerialize(value)).digest("hex");
+var digest = (value) => (0, import_node_crypto7.createHash)("sha256").update(stableSerialize(value)).digest("hex");
+function createRequestBudget(profile, request) {
+  const profileBudget = createContextBudget(profile.contextWindow, profile.maxOutputTokens);
+  if (request.maxTokens === void 0) return profileBudget;
+  const requestBudget = createContextBudget(profile.contextWindow, request.maxTokens);
+  return requestBudget.outputReserve < profileBudget.outputReserve ? requestBudget : profileBudget;
+}
 function summaryFailureCode(error) {
   if (error instanceof ModelError) return error.code;
   if (error instanceof SyntaxError) return "SUMMARY_INVALID_JSON";
@@ -1853,28 +2010,39 @@ var ContextManager = class {
     this.terminals.push(terminal);
   }
   /**
-   * 最终 Hook 之后统一预算；输出 reserve 同时约束实际 maxTokens，超限零 Provider 调用。
+   * 最终 Hook 之后统一预算；Profile 与请求的更低覆盖同时约束输出预留和实际 maxTokens。
+   * 非法输出配置或输入超限在 Provider 调用前失败；不使用固定 4096 覆盖原生模型上限。
+   * 签名或加密续答可禁止压缩；此时仍估算并拒绝超预算请求，不剪裁历史或调用摘要网络。
+   * @param allowCompaction 是否允许当前请求剪裁/摘要；冻结私有续答前缀时传 false。
    * @returns 语义事件及准备完成的请求，不改变持久历史。
    */
-  async *prepare(history, request, profile, runId, reason = "threshold") {
-    const budget = createContextBudget(profile.contextWindow);
-    if (request.maxTokens !== void 0 && (!Number.isSafeInteger(request.maxTokens) || request.maxTokens <= 0))
-      throw new Error("Invalid output token budget");
+  async *prepare(history, request, profile, runId, reason = "threshold", allowCompaction = true) {
+    const budget = createRequestBudget(profile, request);
     let prepared = {
       ...request,
-      maxTokens: Math.min(request.maxTokens ?? budget.outputReserve, budget.outputReserve)
+      maxTokens: budget.outputReserve
     };
     const estimate = (req) => this.estimator.estimate(req, `${profile.id}:${profile.modelName}`);
-    const base = this.project(history);
-    const index = indexInteractions(history, this.terminals);
-    const protectedIds = new Set(index.protectedMessageIds);
+    const base = projectProtocolHistory(
+      this.project(history),
+      {
+        protocol: profile.provider,
+        modelName: profile.modelName,
+        baseURL: profile.baseURL,
+        workspaceId: profile.anthropicWorkspaceId
+      },
+      request.context
+    );
+    const index2 = indexInteractions(history, this.terminals);
+    const protectedIds = new Set(index2.protectedMessageIds);
     const coveredPosition = this.checkpoint ? history.findIndex((m) => m.id === this.checkpoint.coveredEndMessageId) : -1;
     const eligibleIds = /* @__PURE__ */ new Set();
-    const baseSources = normalizeHistory(history.slice(coveredPosition + 1)).sources;
-    const baseRaw = normalizeHistory(history.slice(coveredPosition + 1)).messages;
+    const normalizedBase = normalizeHistory(history.slice(coveredPosition + 1));
+    const baseSources = normalizedBase.sources;
+    const baseRaw = normalizedBase.messages;
     const knownOrder = prepared.messages.filter((m) => base.some((original) => original.id === m.id)).map((m) => m.id);
     const orderValid = stableSerialize(knownOrder) === stableSerialize(base.map((m) => m.id));
-    for (const interaction of index.interactions) {
+    for (const interaction of index2.interactions) {
       if (interaction.messageIds.every(
         (id) => history.findIndex((m) => m.id === id) <= coveredPosition
       ))
@@ -1903,7 +2071,7 @@ var ContextManager = class {
       messages: prepared.messages.filter((m) => !m.id || !eligibleViewIds.has(m.id))
     };
     const protectedEstimate = estimate(protectedRequest);
-    this.publishSnapshot(history, prepared, profile, budget, index.protectedMessageIds);
+    this.publishSnapshot(history, prepared, profile, budget, index2.protectedMessageIds);
     if (protectedEstimate.total > budget.inputBudget) {
       yield {
         type: "context_budget_exceeded",
@@ -1923,7 +2091,8 @@ var ContextManager = class {
         modelName: summaryProfile.modelName,
         provider: summaryProfile.provider,
         baseURL: summaryProfile.baseURL,
-        contextWindow: summaryProfile.contextWindow
+        contextWindow: summaryProfile.contextWindow,
+        maxOutputTokens: summaryProfile.maxOutputTokens
       },
       policy: POLICY_VERSION
     });
@@ -1935,7 +2104,7 @@ var ContextManager = class {
       persistence: this.persistence === "disk" ? "disk" : "memory"
     };
     const prefix = history.filter((m) => eligibleIds.has(m.id));
-    if (prefix.length && this.persistence !== "unsupported" && (reason !== "threshold" || estimate(prepared).total >= budget.trigger)) {
+    if (allowCompaction && prefix.length && this.persistence !== "unsupported" && (reason !== "threshold" || estimate(prepared).total >= budget.trigger)) {
       if (reason === "threshold") {
         const targets = this.pruningTargets(history, eligibleIds, prepared);
         if (targets.length) {
@@ -1959,7 +2128,7 @@ var ContextManager = class {
             await this.commit("context_pruned", { ...record });
             this.pruning.push(record);
             prepared = candidate;
-            this.publishSnapshot(history, prepared, profile, budget, index.protectedMessageIds);
+            this.publishSnapshot(history, prepared, profile, budget, index2.protectedMessageIds);
             yield {
               type: "compaction_finish",
               ...eventBase,
@@ -2038,7 +2207,7 @@ var ContextManager = class {
           this.failure = { epoch, consecutiveFailures: 0 };
           this.summaryCount++;
           prepared = candidate;
-          this.publishSnapshot(history, prepared, profile, budget, index.protectedMessageIds);
+          this.publishSnapshot(history, prepared, profile, budget, index2.protectedMessageIds);
           yield {
             type: "compaction_finish",
             ...eventBase,
@@ -2060,7 +2229,7 @@ var ContextManager = class {
           };
           await this.commit("compaction_state", { ...failed });
           this.failure = failed;
-          this.publishSnapshot(history, prepared, profile, budget, index.protectedMessageIds);
+          this.publishSnapshot(history, prepared, profile, budget, index2.protectedMessageIds);
           yield {
             type: "compaction_failed",
             ...eventBase,
@@ -2080,7 +2249,7 @@ var ContextManager = class {
       }
     }
     const final = estimate(prepared);
-    this.publishSnapshot(history, prepared, profile, budget, index.protectedMessageIds);
+    this.publishSnapshot(history, prepared, profile, budget, index2.protectedMessageIds);
     if (final.total > budget.inputBudget) {
       yield {
         type: "context_budget_exceeded",
@@ -2105,13 +2274,16 @@ var ContextManager = class {
   getSnapshot() {
     return this.snapshot ? structuredClone(this.snapshot) : void 0;
   }
-  /** 从当前静态投影估算，不执行 Hook/Provider 或更新状态；恢复后即可查看检查点。 */
+  /**
+   * 从当前静态投影估算，不执行 Hook/Provider 或更新状态；恢复后即可查看检查点。
+   * 输出预留与准备请求使用同一 Profile/请求覆盖规则；非法覆盖也在只读检查时失败。
+   */
   inspect(history, request, profile) {
-    const budget = createContextBudget(profile.contextWindow);
+    const budget = createRequestBudget(profile, request);
     return {
       ...this.buildSnapshot(
         history,
-        request,
+        { ...request, maxTokens: budget.outputReserve },
         profile,
         budget,
         indexInteractions(history, this.terminals).protectedMessageIds
@@ -2192,14 +2364,14 @@ ${renderFileDetails(checkpoint.details)}`
       const previousEnd = this.checkpoint ? history.findIndex((m) => m.id === this.checkpoint.coveredEndMessageId) : -1;
       if (checkpoint.policyVersion !== POLICY_VERSION || typeof checkpoint.id !== "string" || !checkpoint.id || checkpoint.previousCheckpointId !== (this.checkpoint?.id ?? null) || end <= previousEnd || history[end + 1]?.id !== checkpoint.firstKeptMessageId || digest(history.slice(0, end + 1)) !== checkpoint.sourceDigest)
         return false;
-      const index = indexInteractions(history, this.terminals);
-      if (history.slice(0, end + 1).some((m) => index.protectedMessageIds.includes(m.id)))
+      const index2 = indexInteractions(history, this.terminals);
+      if (history.slice(0, end + 1).some((m) => index2.protectedMessageIds.includes(m.id)))
         return false;
-      if (!index.interactions.some(
+      if (!index2.interactions.some(
         (i) => this.isClosedInteraction(history, i) && i.messageIds.at(-1) === checkpoint.coveredEndMessageId
       ))
         return false;
-      if (index.interactions.filter(
+      if (index2.interactions.filter(
         (interaction) => interaction.messageIds.some(
           (id) => history.findIndex((message) => message.id === id) <= end
         )
@@ -2274,15 +2446,15 @@ ${renderFileDetails(checkpoint.details)}`
     try {
       if (pruning.policyVersion !== POLICY_VERSION || typeof pruning.id !== "string" || !pruning.id || !Array.isArray(pruning.targets) || pruning.baseCheckpointId !== (this.checkpoint?.id ?? null) || pruning.previousPruningId !== (this.pruning.at(-1)?.id ?? null))
         return false;
-      const index = indexInteractions(history, this.terminals);
-      const protectedIds = new Set(index.protectedMessageIds);
+      const index2 = indexInteractions(history, this.terminals);
+      const protectedIds = new Set(index2.protectedMessageIds);
       return pruning.targets.length > 0 && pruning.targets.every((target) => {
         const message = history.find((m) => m.id === target.messageId);
         const result = message?.content.find(
           (b) => b.type === "tool_result" && b.toolUseId === target.toolCallId
         );
         const call = history.flatMap((m) => m.role === "assistant" ? m.content : []).find((b) => b.type === "tool_use" && b.id === target.toolCallId);
-        return !!message && !protectedIds.has(message.id) && index.interactions.some(
+        return !!message && !protectedIds.has(message.id) && index2.interactions.some(
           (i) => i.status === "completed" && i.messageIds.includes(message.id)
         ) && !!result && result.type === "tool_result" && !result.isError && !result.errorCode && !!call && call.type === "tool_use" && call.source === "builtin" && ["read_file", "glob", "grep"].includes(call.name) && this.options.builtInToolNames?.().has(call.name) && typeof target.description === "string" && Array.from(target.description).length <= 1e3 && digest({ call, result }) === target.sourceDigest;
       });
@@ -2310,7 +2482,7 @@ ${renderFileDetails(checkpoint.details)}`
 };
 
 // src/extensibility/logging/index.ts
-var import_node_crypto7 = require("crypto");
+var import_node_crypto8 = require("crypto");
 var SAFE_FIELDS = /* @__PURE__ */ new Set([
   "mode",
   "toolName",
@@ -2374,7 +2546,7 @@ function projectSafeFields(fields) {
   return safe;
 }
 function createLogId() {
-  return (0, import_node_crypto7.randomUUID)();
+  return (0, import_node_crypto8.randomUUID)();
 }
 function commandAuditSummary(command) {
   const parts = command.trim().split(/\s+/).filter(Boolean);
@@ -2392,14 +2564,14 @@ function commandAuditSummary(command) {
     "get-content"
   ])).has(first) ? first : void 0;
   return {
-    commandDigest: (0, import_node_crypto7.createHash)("sha256").update(command, "utf8").digest("hex"),
+    commandDigest: (0, import_node_crypto8.createHash)("sha256").update(command, "utf8").digest("hex"),
     commandPreview: category ? `${category} (${Math.max(0, parts.length - 1)} args)` : "[redacted]",
     commandLength: Buffer.byteLength(command, "utf8"),
     argumentCount: Math.max(0, parts.length - 1)
   };
 }
 function executionFingerprint(input) {
-  return (0, import_node_crypto7.createHash)("sha256").update(
+  return (0, import_node_crypto8.createHash)("sha256").update(
     JSON.stringify([
       input.command,
       input.shell,
@@ -2496,6 +2668,7 @@ var FileLogSink = class {
     if (!import_node_fs5.default.existsSync(this.directory)) return 0;
     return import_node_fs5.default.readdirSync(this.directory).filter((name) => this.isOwnedFile(name)).reduce((total, name) => total + import_node_fs5.default.statSync(import_node_path5.default.join(this.directory, name)).size, 0);
   }
+  /** 优先写入当天未满的最后一个序号文件，超限或无同名文件时开下一个序号。 */
   chooseFile(date, bytes) {
     const names = import_node_fs5.default.readdirSync(this.directory).filter((name) => name.startsWith(`${this.prefix}-${date}-`) && this.isOwnedFile(name)).sort();
     const lastName = names.at(-1);
@@ -2509,6 +2682,7 @@ var FileLogSink = class {
       `${this.prefix}-${date}-${String(next).padStart(3, "0")}.jsonl`
     );
   }
+  /** 按文件名中的日期删除早于保留期的自有文件；删除依据文件名而非文件 mtime。 */
   cleanupExpired(currentDate) {
     const current = Date.parse(`${currentDate}T00:00:00.000Z`);
     const cutoff = current - (this.retentionDays ?? 0) * 864e5;
@@ -2598,9 +2772,19 @@ var import_node_path6 = __toESM(require("path"), 1);
 var MAX_FILE_BYTES = 32 * 1024;
 var MAX_TOTAL_BYTES = 128 * 1024;
 var MAX_LEVELS = 16;
+function canonicalizeOptionalFile(file) {
+  try {
+    return import_node_fs6.default.realpathSync.native(file);
+  } catch {
+    return import_node_path6.default.resolve(file);
+  }
+}
 function loadInstructions(options) {
-  const root = import_node_fs6.default.realpathSync(options.projectRoot);
-  const cwd = import_node_fs6.default.realpathSync(options.cwd);
+  const root = import_node_fs6.default.realpathSync.native(options.projectRoot);
+  const cwd = import_node_fs6.default.realpathSync.native(options.cwd);
+  const userFile = canonicalizeOptionalFile(
+    options.userFile ?? import_node_path6.default.join(import_node_os3.default.homedir(), ".kapibala", "AGENTS.md")
+  );
   const relative = import_node_path6.default.relative(root, cwd);
   if (relative === ".." || relative.startsWith(`..${import_node_path6.default.sep}`) || import_node_path6.default.isAbsolute(relative)) {
     throw new Error("Instruction cwd is outside project root");
@@ -2608,7 +2792,6 @@ function loadInstructions(options) {
   const segments = relative ? relative.split(import_node_path6.default.sep) : [];
   if (segments.length + 1 > MAX_LEVELS)
     throw new Error(`Instruction directory chain exceeds ${MAX_LEVELS} levels`);
-  const userFile = options.userFile ?? import_node_path6.default.join(import_node_os3.default.homedir(), ".kapibala", "AGENTS.md");
   const candidates = [userFile];
   let directory = root;
   candidates.push(import_node_path6.default.join(directory, "AGENTS.md"));
@@ -2664,7 +2847,7 @@ function loadInstructions(options) {
 
 // src/capabilities/shell/detect.ts
 var import_node_child_process2 = require("child_process");
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var import_node_fs7 = __toESM(require("fs"), 1);
 var import_node_os4 = __toESM(require("os"), 1);
 var import_node_path7 = __toESM(require("path"), 1);
@@ -2722,7 +2905,7 @@ function buildEnvironment(executable, kind, cwd) {
     kind,
     executable,
     cwd,
-    executableDigest: (0, import_node_crypto8.createHash)("sha256").update(JSON.stringify([executable, stat.size, stat.mtimeMs])).digest("hex")
+    executableDigest: (0, import_node_crypto9.createHash)("sha256").update(JSON.stringify([executable, stat.size, stat.mtimeMs])).digest("hex")
   };
 }
 function candidatesFor(kind, platform, pathEnv) {
@@ -2792,7 +2975,7 @@ function detectShell(options) {
 
 // src/capabilities/shell/tool.ts
 var import_node_child_process3 = require("child_process");
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 var import_node_fs8 = __toESM(require("fs"), 1);
 var import_node_path8 = __toESM(require("path"), 1);
 var import_node_string_decoder = require("string_decoder");
@@ -2882,7 +3065,7 @@ function directScriptDigest(command, kind, cwd) {
     if (relative.startsWith("..") || import_node_path8.default.isAbsolute(relative)) return void 0;
     const stat = import_node_fs8.default.statSync(script);
     if (!stat.isFile() || stat.size > 1024 * 1024) return void 0;
-    return (0, import_node_crypto9.createHash)("sha256").update(script).update("\0").update(import_node_fs8.default.readFileSync(script)).digest("hex");
+    return (0, import_node_crypto10.createHash)("sha256").update(script).update("\0").update(import_node_fs8.default.readFileSync(script)).digest("hex");
   } catch {
     return void 0;
   }
@@ -2912,7 +3095,7 @@ function createNativeBashGroup(environment) {
   let accepted = false;
   const group = {
     environment,
-    token: (0, import_node_crypto9.randomUUID)(),
+    token: (0, import_node_crypto10.randomUUID)(),
     ready: new Promise((resolve) => {
       resolveReady = resolve;
     }),
@@ -3061,7 +3244,7 @@ function cleanupCommandResults(rootDir, now = Date.now()) {
     if (stat.mtimeMs < cutoff) import_node_fs8.default.unlinkSync(file);
     else retained.push(line);
   }
-  const replacement = import_node_path8.default.join(directory, `.managed-results-${(0, import_node_crypto9.randomUUID)()}.tmp`);
+  const replacement = import_node_path8.default.join(directory, `.managed-results-${(0, import_node_crypto10.randomUUID)()}.tmp`);
   import_node_fs8.default.writeFileSync(replacement, retained.length ? `${retained.join("\n")}
 ` : "", { mode: 384 });
   import_node_fs8.default.renameSync(replacement, manifest);
@@ -3103,8 +3286,8 @@ function createRunCommandTool(environment) {
       const timeoutMs = effectiveTimeout(input);
       const scriptDigest = directScriptDigest(input.command, environment.kind, cwd);
       const stat = import_node_fs8.default.statSync(environment.executable);
-      const executableDigest = (0, import_node_crypto9.createHash)("sha256").update(JSON.stringify([environment.executable, stat.size, stat.mtimeMs])).digest("hex");
-      const environmentDigest = (0, import_node_crypto9.createHash)("sha256").update(JSON.stringify(limitedEnvironment(environment.kind))).digest("hex");
+      const executableDigest = (0, import_node_crypto10.createHash)("sha256").update(JSON.stringify([environment.executable, stat.size, stat.mtimeMs])).digest("hex");
+      const environmentDigest = (0, import_node_crypto10.createHash)("sha256").update(JSON.stringify(limitedEnvironment(environment.kind))).digest("hex");
       return {
         command: input.command,
         interpreter: environment.kind,
@@ -3167,7 +3350,7 @@ ${input.command}` : input.command;
         if (outputBytes > INLINE_LIMIT && descriptor === void 0) {
           const directory = resultDirectory(ctx.rootDir);
           import_node_fs8.default.mkdirSync(directory, { recursive: true, mode: 448 });
-          outputFile = import_node_path8.default.join(directory, `run-${(0, import_node_crypto9.randomUUID)()}.txt`);
+          outputFile = import_node_path8.default.join(directory, `run-${(0, import_node_crypto10.randomUUID)()}.txt`);
           descriptor = import_node_fs8.default.openSync(outputFile, "wx", 384);
           recordManagedResult(directory, outputFile, descriptor);
           const prefix = Buffer.concat(inline);
@@ -3439,8 +3622,8 @@ var CAPABILITIES = /* @__PURE__ */ new Set([
   "agent:spawn"
 ]);
 function validatePermissionRules(rules) {
-  for (const [index, rule] of rules.entries()) {
-    const ruleNumber = index + 1;
+  for (const [index2, rule] of rules.entries()) {
+    const ruleNumber = index2 + 1;
     if (!["allow", "ask", "deny"].includes(rule.action)) {
       throw new Error(`Permission rule ${ruleNumber}: invalid action`);
     }
@@ -3469,6 +3652,11 @@ function samePath(a, b) {
   return process.platform === "win32" ? na.toLowerCase() === nb.toLowerCase() : na === nb;
 }
 var PermissionPolicy = class {
+  /**
+   * 裁决顺序固定：硬限制 → Plan 收窄 → deny 规则 → 会话缓存拒绝 → ask 规则 →
+   * 会话缓存允许 → allow 规则（run_command 必须带 shell 范围，工具级 allow 不能放行命令）
+   * → 模式默认。同一输入总是得到同一裁决，不读取任何外部状态。
+   */
   decide(request) {
     if (request.hardDenied) return { decision: "deny", source: "hard_limit" };
     if (request.mode === "Plan" && (request.dangerous || request.capabilities.length === 0 || request.capabilities.some((capability) => capability !== "fs:read"))) {
@@ -3523,7 +3711,7 @@ function visibleTools(tools, mode, rules = []) {
 }
 
 // src/capabilities/security/approval.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 function stableJsonStringify(value) {
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value);
@@ -3538,7 +3726,7 @@ function stableJsonStringify(value) {
 var SessionApprovalCache = class {
   choices = /* @__PURE__ */ new Map();
   key(request) {
-    return (0, import_node_crypto10.createHash)("sha256").update(
+    return (0, import_node_crypto11.createHash)("sha256").update(
       stableJsonStringify([
         request.toolName,
         [...request.capabilities].sort(),
@@ -3597,6 +3785,7 @@ var ToolRegistry = class {
   get(name) {
     return this.tools.get(name);
   }
+  /** 未命中时抛 ToolNotFound，并携带当前全部可用名称辅助模型自纠。 */
   resolve(name) {
     const tool = this.tools.get(name);
     if (!tool) {
@@ -3995,15 +4184,21 @@ var builtinTools = [readFileTool, writeFileTool, editFileTool, globTool, grepToo
 // src/extensibility/hooks/registry.ts
 var HookRegistry = class {
   hooks = {};
+  /** 注册到指定切点；不查重，触发顺序即注册顺序。 */
   on(point, handler) {
     if (!this.hooks[point]) {
       this.hooks[point] = [];
     }
     this.hooks[point].push(handler);
   }
+  /** 返回该切点的处理器列表（无注册时为空数组）；数组为内部引用，调用方不应修改。 */
   get(point) {
     return this.hooks[point] ?? [];
   }
+  /**
+   * 串行 await 通知型切点的全部处理器；任一抛错立即中断并向调用方传播。
+   * 需要返回值的 model:before / tool:before 不经 emit，由执行方自行遍历。
+   */
   async emit(point, ctx, ...args) {
     const handlers = this.get(point);
     for (const handler of handlers) {
@@ -4013,7 +4208,7 @@ var HookRegistry = class {
 };
 
 // src/runtime/executor/index.ts
-var import_node_crypto11 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var import_node_path12 = __toESM(require("path"), 1);
 var DEFAULT_TOOL_TIMEOUT_MS = 12e4;
 var ToolExecutor = class {
@@ -4052,6 +4247,7 @@ var ToolExecutor = class {
   cancel() {
     this.cancellation.abort();
   }
+  /** 串行执行全部调用并返回与入参顺序一致的结果；某个结果要求用户介入后，其余调用直接拒绝。 */
   async runAll(calls, onProgress) {
     const results = [];
     let requiresUserAction = false;
@@ -4102,8 +4298,168 @@ var ToolExecutor = class {
     }
     if (forcedDeny) {
       try {
-        await audit("tool.decided", { decision: "deny", decisionSource: "prior_user_action" });
-        await audit("tool.finished", { status: "skipped", errorCode: "SKIPPED_AFTER_USER_ACTION" });
+        await audit("tool.decided", { decision: "deny", decisionSource: "prior_user_action" });
+        await audit("tool.finished", { status: "skipped", errorCode: "SKIPPED_AFTER_USER_ACTION" });
+      } catch {
+        return failure(
+          "Audit unavailable; tool was not started",
+          "AUDIT_UNAVAILABLE",
+          "after_user_action"
+        );
+      }
+      return failure(
+        "Earlier tool call requires user action",
+        "SKIPPED_AFTER_USER_ACTION",
+        "after_user_action"
+      );
+    }
+    const hookCtx = { signal: this.signal, logger: this.logger };
+    let currentInput = call.input;
+    try {
+      for (const hook of this.hooks.get("tool:before")) {
+        const decision = await hook(hookCtx, { id: call.id, name: call.name, input: currentInput });
+        if (decision.action === "modify") currentInput = decision.input;
+        if (decision.action === "skip") {
+          await audit("tool.decided", { decision: "deny", decisionSource: "hook" });
+          await audit("tool.finished", { status: "skipped" });
+          return {
+            type: "tool_result",
+            toolUseId: call.id,
+            content: decision.result,
+            isError: decision.isError ?? false,
+            durationMs: Math.max(0, Date.now() - startedAt)
+          };
+        }
+      }
+    } catch {
+      try {
+        await audit("tool.decided", { decision: "deny", decisionSource: "hook" });
+        await audit("tool.finished", { status: "failed" });
+      } catch {
+      }
+      return failure("Tool preparation failed", "HOOK_ERROR");
+    }
+    let tool;
+    try {
+      tool = this.tools.resolve(call.name);
+    } catch (error) {
+      const known = error instanceof KapibalaError ? error : void 0;
+      try {
+        await audit("tool.decided", { decision: "deny", decisionSource: "unavailable" });
+        await audit("tool.finished", { status: "failed" });
+      } catch {
+      }
+      return failure(
+        known?.safeMessage ?? "Requested tool is unavailable",
+        known?.code ?? "TOOL_NOT_FOUND"
+      );
+    }
+    try {
+      return await this.executeResolved(
+        call,
+        currentInput,
+        tool,
+        startedAt,
+        audit,
+        failure,
+        hookCtx,
+        onProgress
+      );
+    } catch {
+      try {
+        await audit("tool.finished", { status: "unknown", errorCode: "OUTCOME_UNKNOWN" });
+      } catch {
+      }
+      return failure(
+        "Tool outcome is unknown after an executor failure",
+        "OUTCOME_UNKNOWN",
+        "after_user_action"
+      );
+    }
+  }
+  async executeResolved(call, currentInput, tool, startedAt, audit, failure, hookCtx, onProgress) {
+    let shell;
+    try {
+      shell = tool.approvalScope?.(currentInput, this.rootDir);
+    } catch {
+      try {
+        await audit("tool.decided", { decision: "deny", decisionSource: "invalid_target" });
+        await audit("tool.finished", { status: "failed", errorCode: "INVALID_TARGET" });
+      } catch {
+      }
+      return failure("Invalid tool execution target", "INVALID_TARGET");
+    }
+    let auditFields = {};
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const request = {
+        toolName: call.name,
+        capabilities: tool.metadata?.permissions ?? [],
+        input: currentInput,
+        rootDir: this.rootDir,
+        ...shell ? { shell } : {},
+        // 解释器内建查询与内容已绑定摘要的工作区直引脚本可确认不受外部脚本变更影响，
+        // 允许会话级批准；其余 shell 命令仅允许单次批准。
+        sessionAllowed: !shell || /^(?:pwd|get-location)$/i.test(shell.command.trim()) || shell.scriptDigest !== void 0
+      };
+      const repeatKey = (0, import_node_crypto12.createHash)("sha256").update(stableJsonStringify([call.name, currentInput])).digest("hex");
+      if (this.neverFailures.has(repeatKey)) {
+        try {
+          await audit("tool.decided", { decision: "deny", decisionSource: "repeat_block" });
+          await audit("tool.finished", { status: "blocked", errorCode: "REPEAT_BLOCKED" });
+        } catch {
+          return failure(
+            "Audit unavailable; tool was not started",
+            "AUDIT_UNAVAILABLE",
+            "after_user_action"
+          );
+        }
+        return failure(
+          "Identical failed tool call cannot be repeated in this run",
+          "REPEAT_BLOCKED"
+        );
+      }
+      const cached = this.approvalCache.get(request);
+      const decision = this.policy.decide({
+        mode: typeof this.mode === "function" ? this.mode() : this.mode,
+        toolName: call.name,
+        capabilities: request.capabilities,
+        dangerous: tool.metadata?.dangerous,
+        cachedApproval: cached === "allow",
+        cachedDenial: cached === "deny",
+        rules: this.permissionRules,
+        ...shell ? { shell } : {}
+      });
+      let permitted = decision.decision === "allow";
+      let source = decision.source;
+      let approvalChoice;
+      if (decision.decision === "ask") {
+        let choice = "deny_once";
+        try {
+          choice = await this.approvalChannel?.requestApproval(request, this.signal) ?? "deny_once";
+        } catch {
+          choice = "cancel";
+        }
+        approvalChoice = choice;
+        if (choice === "allow_session" && request.sessionAllowed)
+          this.approvalCache.set(request, "allow");
+        if (choice === "deny_session") this.approvalCache.set(request, "deny");
+        permitted = choice === "allow_once" || choice === "allow_session" && request.sessionAllowed;
+        source = this.approvalChannel ? "human" : "non_interactive";
+      }
+      auditFields = shell ? {
+        shell: shell.interpreter,
+        cwdDigest: (0, import_node_crypto12.createHash)("sha256").update(shell.cwd).digest("hex"),
+        executableDigest: shell.executableDigest,
+        executionFingerprint: shell.executionFingerprint,
+        ...commandAuditSummary(shell.command)
+      } : {};
+      try {
+        await audit("tool.decided", {
+          decision: permitted ? "allow" : "deny",
+          decisionSource: source,
+          ...approvalChoice ? { approvalChoice } : {},
+          ...auditFields
+        });
       } catch {
         return failure(
           "Audit unavailable; tool was not started",
@@ -4111,716 +4467,1669 @@ var ToolExecutor = class {
           "after_user_action"
         );
       }
+      if (!permitted || this.signal?.aborted) {
+        const code = this.signal?.aborted ? "ABORTED" : "PERMISSION_DENIED";
+        try {
+          await audit("tool.finished", { status: "denied", errorCode: code });
+        } catch {
+          return failure("Audit result unavailable", "AUDIT_UNAVAILABLE", "after_user_action");
+        }
+        return failure(
+          this.signal?.aborted ? "Operation cancelled" : "Tool permission denied",
+          code,
+          "after_user_action"
+        );
+      }
+      if (shell) {
+        try {
+          const next = tool.approvalScope?.(currentInput, this.rootDir);
+          if (next?.executionFingerprint !== shell.executionFingerprint) {
+            if (attempt === 0 && next) {
+              try {
+                await audit("tool.target_changed", { status: "redeciding" });
+              } catch {
+                return failure(
+                  "Audit unavailable; tool was not started",
+                  "AUDIT_UNAVAILABLE",
+                  "after_user_action"
+                );
+              }
+              shell = next;
+              continue;
+            }
+            await audit("tool.finished", { status: "target_changed", errorCode: "TARGET_CHANGED" });
+            return failure(
+              "Execution target changed after approval",
+              "TARGET_CHANGED",
+              "after_user_action"
+            );
+          }
+        } catch {
+          return failure(
+            "Execution target changed after approval",
+            "TARGET_CHANGED",
+            "after_user_action"
+          );
+        }
+      }
+      break;
+    }
+    try {
+      await audit("tool.started", { status: "started", ...auditFields });
+    } catch {
       return failure(
-        "Earlier tool call requires user action",
-        "SKIPPED_AFTER_USER_ACTION",
+        "Audit unavailable; tool was not started",
+        "AUDIT_UNAVAILABLE",
         "after_user_action"
       );
     }
-    const hookCtx = { signal: this.signal, logger: this.logger };
-    let currentInput = call.input;
+    let outputStr;
+    let isError = false;
+    let errorCode;
+    let retryPolicy;
     try {
-      for (const hook of this.hooks.get("tool:before")) {
-        const decision = await hook(hookCtx, { id: call.id, name: call.name, input: currentInput });
-        if (decision.action === "modify") currentInput = decision.input;
-        if (decision.action === "skip") {
-          await audit("tool.decided", { decision: "deny", decisionSource: "hook" });
-          await audit("tool.finished", { status: "skipped" });
-          return {
-            type: "tool_result",
-            toolUseId: call.id,
-            content: decision.result,
-            isError: decision.isError ?? false,
-            durationMs: Math.max(0, Date.now() - startedAt)
-          };
-        }
+      const executionController = new AbortController();
+      const abortFromSession = () => executionController.abort();
+      if (this.signal?.aborted) {
+        executionController.abort();
+      } else {
+        this.signal?.addEventListener("abort", abortFromSession, { once: true });
       }
-    } catch {
+      const toolCtx = {
+        rootDir: this.rootDir,
+        signal: executionController.signal,
+        logger: this.logger,
+        onProgress: (progress) => onProgress?.({ id: call.id, name: call.name, ...progress }),
+        ...shell ? {
+          onProcessSpawned: () => audit("process.spawned", { status: "spawned", ...auditFields })
+        } : {}
+      };
       try {
-        await audit("tool.decided", { decision: "deny", decisionSource: "hook" });
-        await audit("tool.finished", { status: "failed" });
-      } catch {
+        const rawResult = tool.metadata?.managesTimeout ? await tool.execute(currentInput, toolCtx) : await this.withTimeout(
+          tool.execute(currentInput, toolCtx),
+          call.name,
+          executionController
+        );
+        outputStr = typeof rawResult === "string" ? rawResult : JSON.stringify(rawResult, null, 2);
+        if (call.name === "run_command" && typeof rawResult === "object" && rawResult !== null && "exitCode" in rawResult && rawResult.exitCode !== 0) {
+          isError = true;
+          errorCode = "COMMAND_EXIT_NONZERO";
+          retryPolicy = "never";
+        }
+      } finally {
+        this.signal?.removeEventListener("abort", abortFromSession);
       }
-      return failure("Tool preparation failed", "HOOK_ERROR");
+    } catch (err) {
+      isError = true;
+      const known = err instanceof KapibalaError ? err : void 0;
+      outputStr = known?.safeMessage ?? "Tool execution failed";
+      errorCode = known?.code ?? "TOOL_FAILED";
+      retryPolicy = known?.retryPolicy ?? "never";
+    }
+    const resultBlock = {
+      type: "tool_result",
+      toolUseId: call.id,
+      content: outputStr,
+      isError,
+      ...errorCode ? { errorCode, retryPolicy } : {}
+    };
+    if (resultBlock.isError && resultBlock.errorCode) {
+      resultBlock.content = JSON.stringify({
+        code: resultBlock.errorCode,
+        retryPolicy: resultBlock.retryPolicy,
+        message: outputStr
+      });
     }
-    let tool;
     try {
-      tool = this.tools.resolve(call.name);
+      for (const hook of this.hooks.get("tool:after")) {
+        await hook(
+          hookCtx,
+          { id: call.id, name: call.name, input: currentInput },
+          { output: outputStr, isError }
+        );
+      }
+    } catch {
+      resultBlock.content = JSON.stringify({
+        code: "HOOK_ERROR",
+        retryPolicy: "after_user_action",
+        message: "Tool finished but result processing failed"
+      });
+      resultBlock.isError = true;
+      resultBlock.errorCode = "HOOK_ERROR";
+      resultBlock.retryPolicy = "after_user_action";
+    }
+    resultBlock.durationMs = Math.max(0, Date.now() - startedAt);
+    if (resultBlock.isError && resultBlock.retryPolicy === "never") {
+      this.neverFailures.add(
+        (0, import_node_crypto12.createHash)("sha256").update(stableJsonStringify([call.name, currentInput])).digest("hex")
+      );
+    }
+    try {
+      await audit("tool.finished", {
+        status: resultBlock.isError ? "failed" : "completed",
+        ...resultBlock.errorCode ? { errorCode: resultBlock.errorCode } : {},
+        durationMs: resultBlock.durationMs
+      });
+    } catch {
+      return failure(
+        "Tool outcome is unknown because the audit result could not be written",
+        "OUTCOME_UNKNOWN",
+        "after_user_action"
+      );
+    }
+    return resultBlock;
+  }
+  /**
+   * 给工具执行加超时护栏：Promise.race 在超时后reject，循环拿到 isError 结果继续运转，
+   * 不会因某个异步工具(如未来接入的网络/exec 工具)挂起而永久卡死。
+   *
+   * 局限：同步 CPU 密集型实现会阻塞事件循环，timer 同样无法触发；
+   * 因此内置工具仍需避免执行用户可控的同步高复杂度计算。
+   */
+  withTimeout(promise, toolName, executionController) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        const error = new KapibalaError(
+          `Tool '${toolName}' timed out after ${this.toolTimeoutMs}ms`,
+          {
+            code: "OUTCOME_UNKNOWN",
+            retryPolicy: "after_user_action",
+            safeMessage: "Tool timed out; completion of side effects is unknown"
+          }
+        );
+        reject(error);
+        executionController.abort(error);
+      }, this.toolTimeoutMs);
+    });
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+  }
+};
+
+// src/models/index.ts
+function assembleCanonicalToolResults(results) {
+  return results.map((result) => ({
+    role: "tool",
+    content: [structuredClone(result)],
+    timestamp: Date.now()
+  }));
+}
+
+// src/models/transport/http.ts
+function safeTransportCode(error) {
+  const codes = /* @__PURE__ */ new Set([
+    "UND_ERR_SOCKET",
+    "UND_ERR_BODY_TIMEOUT",
+    "UND_ERR_HEADERS_TIMEOUT",
+    "UND_ERR_CONNECT_TIMEOUT",
+    "ECONNRESET",
+    "ETIMEDOUT",
+    "ECONNREFUSED",
+    "ENOTFOUND",
+    "EAI_AGAIN"
+  ]);
+  let current = error;
+  for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
+    const value = current;
+    if (typeof value.code === "string" && codes.has(value.code)) return value.code;
+    current = value.cause;
+  }
+}
+function isContextOverflow(error, protocol) {
+  if (!error || typeof error !== "object") return false;
+  const detail = error;
+  if (["context_length_exceeded", "context_window_exceeded", "max_context_length_exceeded"].includes(
+    String(detail.code)
+  ))
+    return true;
+  return protocol === "anthropic" && detail.type === "invalid_request_error" && typeof detail.message === "string" && detail.message.length <= 160 && /^prompt is too long(?:: [0-9]+ tokens > [0-9]+ maximum)?$/.test(detail.message);
+}
+async function openModelResponse(options) {
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  if (options.signal?.aborted) abort();
+  else options.signal?.addEventListener("abort", abort, { once: true });
+  const timeout = options.connectTimeoutMs ?? 6e4;
+  const timer = setTimeout(abort, timeout);
+  const close = () => {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", abort);
+    controller.abort();
+  };
+  try {
+    let response;
+    try {
+      response = await fetch(options.url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...options.headers },
+        body: JSON.stringify(options.payload),
+        signal: controller.signal
+      });
     } catch (error) {
-      const known = error instanceof KapibalaError ? error : void 0;
+      if (options.signal?.aborted) throw error;
+      throw new ModelError(
+        controller.signal.aborted ? "Model connection timed out" : "Model connection failed",
+        {
+          stage: "connect",
+          status: controller.signal.aborted ? 408 : void 0,
+          transportCode: safeTransportCode(error)
+        }
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+    if (!response.ok) {
+      let detail;
       try {
-        await audit("tool.decided", { decision: "deny", decisionSource: "unavailable" });
-        await audit("tool.finished", { status: "failed" });
+        detail = JSON.parse(await response.text())?.error;
       } catch {
       }
-      return failure(
-        known?.safeMessage ?? "Requested tool is unavailable",
-        known?.code ?? "TOOL_NOT_FOUND"
-      );
+      const errorOptions = {
+        status: response.status,
+        stage: "response",
+        providerCode: typeof detail?.code === "string" ? detail.code : void 0,
+        providerType: typeof detail?.type === "string" ? detail.type : void 0
+      };
+      if ([400, 413, 422].includes(response.status) && isContextOverflow(detail, options.protocol))
+        throw new ContextOverflowError(response.status, errorOptions);
+      throw new ModelError(`Model API request failed (${response.status})`, errorOptions);
+    }
+    if (!response.body)
+      throw new ModelError("Model response body is missing", {
+        code: "MODEL_INVALID_RESPONSE",
+        stage: "response"
+      });
+    return { response, close };
+  } catch (error) {
+    close();
+    throw error;
+  }
+}
+function parseWireEvent(data) {
+  try {
+    const value = JSON.parse(data);
+    if (value && typeof value === "object" && !Array.isArray(value)) return value;
+  } catch {
+  }
+  throw new ModelError("Model response contained an invalid JSON event", {
+    code: "MODEL_INVALID_RESPONSE",
+    stage: "stream",
+    retryable: false
+  });
+}
+function parseToolArguments(argumentsText) {
+  try {
+    const value = argumentsText.trim() ? JSON.parse(argumentsText) : {};
+    if (value && typeof value === "object" && !Array.isArray(value)) return value;
+  } catch {
+  }
+  throw new ModelError("Invalid model tool arguments", {
+    code: "MODEL_INVALID_RESPONSE",
+    stage: "stream",
+    retryable: false
+  });
+}
+
+// src/models/transport/sse.ts
+async function* parseSSEFrames(stream) {
+  const reader = stream.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let buffer = "";
+  let data = [];
+  let event = "message";
+  let frameLength = 0;
+  const feed = (line) => {
+    if (!line) {
+      const frame = data.length ? { event, data: data.join("\n") } : void 0;
+      data = [];
+      event = "message";
+      frameLength = 0;
+      return frame;
+    }
+    if (line.startsWith(":")) return;
+    const colon = line.indexOf(":");
+    const field = colon < 0 ? line : line.slice(0, colon);
+    let value = colon < 0 ? "" : line.slice(colon + 1);
+    if (value.startsWith(" ")) value = value.slice(1);
+    if (field === "data") {
+      data.push(value);
+      frameLength += value.length;
+    } else if (field === "event") event = value || "message";
+    if (frameLength > 16 * 1024 * 1024)
+      throw new ModelError("Model SSE frame exceeds the supported size", {
+        code: "MODEL_INVALID_RESPONSE",
+        stage: "stream",
+        retryable: false
+      });
+  };
+  try {
+    let ended = false;
+    while (!ended) {
+      const next = await reader.read();
+      ended = next.done;
+      buffer += next.done ? decoder.decode() : decoder.decode(next.value, { stream: true });
+      while (true) {
+        const index2 = buffer.search(/[\r\n]/);
+        if (index2 < 0 || !ended && buffer[index2] === "\r" && index2 === buffer.length - 1) break;
+        const line = buffer.slice(0, index2);
+        const width = buffer[index2] === "\r" && buffer[index2 + 1] === "\n" ? 2 : 1;
+        buffer = buffer.slice(index2 + width);
+        const frame = feed(line);
+        if (frame) yield frame;
+      }
+      if (buffer.length > 16 * 1024 * 1024)
+        throw new ModelError("Model SSE line exceeds the supported size", {
+          code: "MODEL_INVALID_RESPONSE",
+          stage: "stream",
+          retryable: false
+        });
     }
+    if (buffer) feed(buffer);
+    const tail = feed("");
+    if (tail) yield tail;
+  } finally {
     try {
-      return await this.executeResolved(
-        call,
-        currentInput,
-        tool,
-        startedAt,
-        audit,
-        failure,
-        hookCtx,
-        onProgress
-      );
+      await reader.cancel();
     } catch {
-      try {
-        await audit("tool.finished", { status: "unknown", errorCode: "OUTCOME_UNKNOWN" });
-      } catch {
-      }
-      return failure(
-        "Tool outcome is unknown after an executor failure",
-        "OUTCOME_UNKNOWN",
-        "after_user_action"
-      );
     }
+    reader.releaseLock();
   }
-  async executeResolved(call, currentInput, tool, startedAt, audit, failure, hookCtx, onProgress) {
-    let shell;
+}
+
+// src/models/openai-compatible/index.ts
+var DEFAULT_CONNECT_TIMEOUT_MS = 6e4;
+function invalidResponse(message) {
+  return new ModelError(message, {
+    code: "MODEL_INVALID_RESPONSE",
+    stage: "stream",
+    retryable: false
+  });
+}
+var OpenAICompatibleProvider = class {
+  name = "openai-compatible";
+  baseURL;
+  apiKey;
+  /** 未提供凭据时由 Session 在记录用户消息前拒绝请求。 */
+  get credentialsReady() {
+    return Boolean(this.apiKey.trim());
+  }
+  modelName;
+  supportsThinking;
+  replayReasoningContent;
+  connectTimeoutMs;
+  chatCapabilities;
+  /** 暴露实际请求目标供原子绑定校验，不包含凭据。 */
+  get binding() {
+    return {
+      protocol: "openai-compatible",
+      baseURL: this.baseURL,
+      modelName: this.modelName
+    };
+  }
+  /**
+   * 初始化 Chat 协议适配；显式端点能力优先，思考回传独立于模型 supportsThinking 标签。
+   * @param options 请求目标、凭据和能力配置；缺省只有 DeepSeek 官方端点回传可见思考。
+   */
+  constructor(options) {
+    this.baseURL = options.baseURL.replace(/\/+$/, "");
+    this.apiKey = options.apiKey;
+    this.modelName = options.modelName;
+    this.supportsThinking = options.supportsThinking ?? false;
+    this.chatCapabilities = Object.freeze({ ...options.chatCapabilities });
+    this.replayReasoningContent = this.chatCapabilities.replayReasoningContent ?? options.replayReasoningContent ?? new URL(this.baseURL).hostname === "api.deepseek.com";
+    this.connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+  }
+  /**
+   * 发送 Chat 流式请求；默认同时要求合法 finish_reason 和 DONE，只有显式例外允许完整 EOF。
+   * 全部工具的 ID、名称和对象参数在任何完成事件之前校验；截断、过滤或中断不交付工具。
+   * @param req canonical 历史、工具、预算与取消信号；能力覆盖来自端点配置。
+   * @returns 文本、可见思考和工具增量，完整响应最后产生 message_stop。
+   * @throws ModelError 响应缺少合法终态、工具身份或完整对象参数时失败，不自动重放请求。
+   */
+  async *create(req) {
+    const url = `${this.baseURL}/chat/completions`;
+    const wireMessages = this.translateMessagesToWire(req.messages, req.systemPrompt);
+    const wireTools = req.tools && req.tools.length > 0 ? req.tools.map((t) => ({
+      type: "function",
+      function: {
+        name: t.name,
+        description: t.description,
+        parameters: t.parameters
+      }
+    })) : void 0;
+    const payload = {
+      model: this.modelName,
+      messages: wireMessages,
+      stream: true
+    };
+    if (this.chatCapabilities.supportsStreamingUsage !== false)
+      payload.stream_options = { include_usage: true };
+    if (this.chatCapabilities.supportsTemperature !== false)
+      payload.temperature = req.temperature ?? 0.7;
+    if (wireTools) {
+      payload.tools = wireTools;
+    }
+    if (req.maxTokens) {
+      payload[this.chatCapabilities.maxTokensField ?? "max_tokens"] = req.maxTokens;
+    }
+    let response;
+    const timeoutController = new AbortController();
+    const timeoutTimer = setTimeout(() => timeoutController.abort(), this.connectTimeoutMs);
+    const onOuterAbort = () => timeoutController.abort();
+    if (req.signal?.aborted) {
+      timeoutController.abort();
+    } else {
+      req.signal?.addEventListener("abort", onOuterAbort, { once: true });
+    }
     try {
-      shell = tool.approvalScope?.(currentInput, this.rootDir);
-    } catch {
       try {
-        await audit("tool.decided", { decision: "deny", decisionSource: "invalid_target" });
-        await audit("tool.finished", { status: "failed", errorCode: "INVALID_TARGET" });
-      } catch {
+        response = await fetch(url, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${this.apiKey}`
+          },
+          body: JSON.stringify(payload),
+          signal: timeoutController.signal
+        });
+      } catch (err) {
+        if (req.signal?.aborted) {
+          throw err;
+        }
+        if (timeoutController.signal.aborted) {
+          throw new ModelError(`Connection to ${url} timed out after ${this.connectTimeoutMs}ms`, {
+            status: 408,
+            retryable: true,
+            stage: "connect"
+          });
+        }
+        throw new ModelError(`Failed to connect to ${url}: ${err.message}`, {
+          transportCode: safeTransportCode(err),
+          stage: "connect"
+        });
+      } finally {
+        clearTimeout(timeoutTimer);
       }
-      return failure("Invalid tool execution target", "INVALID_TARGET");
-    }
-    let auditFields = {};
-    for (let attempt = 0; attempt < 2; attempt++) {
-      const request = {
-        toolName: call.name,
-        capabilities: tool.metadata?.permissions ?? [],
-        input: currentInput,
-        rootDir: this.rootDir,
-        ...shell ? { shell } : {},
-        // 只有无参数的解释器内建查询能确认不依赖外部脚本；其余命令仅允许单次批准。
-        sessionAllowed: !shell || /^(?:pwd|get-location)$/i.test(shell.command.trim()) || shell.scriptDigest !== void 0
-      };
-      const repeatKey = (0, import_node_crypto11.createHash)("sha256").update(stableJsonStringify([call.name, currentInput])).digest("hex");
-      if (this.neverFailures.has(repeatKey)) {
+      if (!response.ok) {
+        const errorText = await response.text();
+        let errorDetails;
+        let errorMsg = `API request failed with status ${response.status}: ${response.statusText}`;
         try {
-          await audit("tool.decided", { decision: "deny", decisionSource: "repeat_block" });
-          await audit("tool.finished", { status: "blocked", errorCode: "REPEAT_BLOCKED" });
+          const errorJson = JSON.parse(errorText);
+          errorDetails = errorJson.error;
+          if (typeof errorJson.error?.message === "string") {
+            errorMsg = errorJson.error.message;
+          }
         } catch {
-          return failure(
-            "Audit unavailable; tool was not started",
-            "AUDIT_UNAVAILABLE",
-            "after_user_action"
-          );
+          if (errorText) errorMsg += ` - ${errorText.slice(0, 300)}`;
         }
-        return failure(
-          "Identical failed tool call cannot be repeated in this run",
-          "REPEAT_BLOCKED"
-        );
+        const details = errorDetails;
+        const options = {
+          status: response.status,
+          providerCode: typeof details?.code === "string" ? details.code : void 0,
+          providerType: typeof details?.type === "string" ? details.type : void 0,
+          stage: "response"
+        };
+        if ([400, 413, 422].includes(response.status) && isContextOverflow(errorDetails))
+          throw new ContextOverflowError(response.status, { ...options, message: errorMsg });
+        throw new ModelError(errorMsg, options);
       }
-      const cached = this.approvalCache.get(request);
-      const decision = this.policy.decide({
-        mode: typeof this.mode === "function" ? this.mode() : this.mode,
-        toolName: call.name,
-        capabilities: request.capabilities,
-        dangerous: tool.metadata?.dangerous,
-        cachedApproval: cached === "allow",
-        cachedDenial: cached === "deny",
-        rules: this.permissionRules,
-        ...shell ? { shell } : {}
-      });
-      let permitted = decision.decision === "allow";
-      let source = decision.source;
-      let approvalChoice;
-      if (decision.decision === "ask") {
-        let choice = "deny_once";
+      if (!response.body) {
+        throw new ModelError("Response body is null", {
+          code: "MODEL_INVALID_RESPONSE",
+          stage: "response"
+        });
+      }
+      const pendingToolCalls = /* @__PURE__ */ new Map();
+      let usage;
+      let finishReason;
+      let streamDone = false;
+      const requestStartTime = Date.now();
+      let ttftMs;
+      for await (const frame of parseSSEFrames(response.body)) {
+        if (req.signal?.aborted) return;
+        const chunk = frame.data;
+        if (chunk.trim() === "[DONE]") {
+          streamDone = true;
+          break;
+        }
+        if (!chunk) continue;
+        let json;
         try {
-          choice = await this.approvalChannel?.requestApproval(request, this.signal) ?? "deny_once";
+          json = JSON.parse(chunk);
         } catch {
-          choice = "cancel";
+          throw new ModelError("Model response contained invalid JSON", {
+            code: "MODEL_INVALID_RESPONSE",
+            stage: "stream",
+            retryable: false
+          });
+        }
+        if (!json || typeof json !== "object" || Array.isArray(json))
+          throw new ModelError("Model response contained an invalid event", {
+            code: "MODEL_INVALID_RESPONSE",
+            stage: "stream",
+            retryable: false
+          });
+        const wireError = json.error ?? (frame.event === "error" ? json : void 0);
+        if (wireError) {
+          const message = typeof wireError.message === "string" ? wireError.message : "Model API stream error";
+          const details = [wireError.type, wireError.code].filter((value) => typeof value === "string" && value.length > 0).join(", ");
+          const options = {
+            providerCode: typeof wireError.code === "string" ? wireError.code : void 0,
+            providerType: typeof wireError.type === "string" ? wireError.type : void 0,
+            stage: "stream"
+          };
+          if (isContextOverflow(wireError))
+            throw new ContextOverflowError(void 0, { ...options, message });
+          throw new ModelError(details ? `${message} (${details})` : message, options);
+        }
+        if (json.usage) {
+          usage = {
+            promptTokens: json.usage.prompt_tokens ?? 0,
+            completionTokens: json.usage.completion_tokens ?? 0,
+            totalTokens: json.usage.total_tokens ?? 0
+          };
+          const cached = json.usage.prompt_tokens_details?.cached_tokens ?? json.usage.prompt_cache_hit_tokens;
+          if (Number.isSafeInteger(cached) && cached >= 0) usage.cachedPromptTokens = cached;
+        }
+        const choice = json.choices?.[0];
+        if (!choice) continue;
+        if (finishReason !== void 0)
+          throw invalidResponse("Model response contained a choice after its terminal state");
+        if (choice.finish_reason !== void 0 && choice.finish_reason !== null) {
+          if (typeof choice.finish_reason !== "string")
+            throw invalidResponse("Model response contained an invalid finish reason");
+          finishReason = choice.finish_reason;
+        }
+        const delta = choice.delta;
+        if (!delta) continue;
+        if (typeof delta !== "object" || Array.isArray(delta))
+          throw invalidResponse("Model response contained an invalid delta");
+        if (delta.function_call)
+          throw invalidResponse("Model response used an unsupported legacy function call");
+        for (const field of ["content", "reasoning_content"])
+          if (delta[field] != null && typeof delta[field] !== "string")
+            throw invalidResponse("Model response contained an invalid text delta");
+        if (delta.tool_calls != null && !Array.isArray(delta.tool_calls))
+          throw invalidResponse("Model response contained invalid tool calls");
+        if ((delta.content || delta.reasoning_content || delta.tool_calls && delta.tool_calls.length > 0) && ttftMs === void 0) {
+          ttftMs = Date.now() - requestStartTime;
         }
-        approvalChoice = choice;
-        if (choice === "allow_session" && request.sessionAllowed)
-          this.approvalCache.set(request, "allow");
-        if (choice === "deny_session") this.approvalCache.set(request, "deny");
-        permitted = choice === "allow_once" || choice === "allow_session" && request.sessionAllowed;
-        source = this.approvalChannel ? "human" : "non_interactive";
-      }
-      auditFields = shell ? {
-        shell: shell.interpreter,
-        cwdDigest: (0, import_node_crypto11.createHash)("sha256").update(shell.cwd).digest("hex"),
-        executableDigest: shell.executableDigest,
-        executionFingerprint: shell.executionFingerprint,
-        ...commandAuditSummary(shell.command)
-      } : {};
-      try {
-        await audit("tool.decided", {
-          decision: permitted ? "allow" : "deny",
-          decisionSource: source,
-          ...approvalChoice ? { approvalChoice } : {},
-          ...auditFields
-        });
-      } catch {
-        return failure(
-          "Audit unavailable; tool was not started",
-          "AUDIT_UNAVAILABLE",
-          "after_user_action"
-        );
-      }
-      if (!permitted || this.signal?.aborted) {
-        const code = this.signal?.aborted ? "ABORTED" : "PERMISSION_DENIED";
-        try {
-          await audit("tool.finished", { status: "denied", errorCode: code });
-        } catch {
-          return failure("Audit result unavailable", "AUDIT_UNAVAILABLE", "after_user_action");
+        if (delta.content) {
+          yield { type: "text_delta", text: delta.content };
         }
-        return failure(
-          this.signal?.aborted ? "Operation cancelled" : "Tool permission denied",
-          code,
-          "after_user_action"
-        );
-      }
-      if (shell) {
-        try {
-          const next = tool.approvalScope?.(currentInput, this.rootDir);
-          if (next?.executionFingerprint !== shell.executionFingerprint) {
-            if (attempt === 0 && next) {
-              try {
-                await audit("tool.target_changed", { status: "redeciding" });
-              } catch {
-                return failure(
-                  "Audit unavailable; tool was not started",
-                  "AUDIT_UNAVAILABLE",
-                  "after_user_action"
+        if (delta.reasoning_content) {
+          yield { type: "thinking_delta", thinking: delta.reasoning_content };
+        }
+        if (delta.tool_calls && Array.isArray(delta.tool_calls)) {
+          for (const tc of delta.tool_calls) {
+            if (!tc || typeof tc !== "object" || !Number.isSafeInteger(tc.index) || tc.index < 0)
+              throw invalidResponse("Model response contained an invalid tool index");
+            if (tc.type != null && tc.type !== "function")
+              throw invalidResponse("Model response contained an unsupported tool type");
+            const index2 = tc.index;
+            let entry = pendingToolCalls.get(index2);
+            if (!entry) {
+              entry = {
+                id: "",
+                name: "",
+                argumentChunks: [],
+                emittedChunks: 0,
+                started: false
+              };
+              pendingToolCalls.set(index2, entry);
+            }
+            for (const [field, value] of [
+              ["id", tc.id],
+              ["name", tc.function?.name]
+            ]) {
+              if (value === void 0 || value === null) continue;
+              if (typeof value !== "string" || !value.trim() || entry[field] && entry[field] !== value)
+                throw invalidResponse(
+                  "Model response contained an invalid or changed tool identity"
                 );
-              }
-              shell = next;
-              continue;
+              entry[field] = value;
+            }
+            if (tc.function?.arguments !== void 0) {
+              if (typeof tc.function.arguments !== "string")
+                throw invalidResponse("Model response contained an invalid tool argument delta");
+              if (tc.function.arguments) entry.argumentChunks.push(tc.function.arguments);
+            }
+            if (entry.id && entry.name && !entry.started) {
+              entry.started = true;
+              yield { type: "tool_call_start", id: entry.id, name: entry.name };
+            }
+            while (entry.started && entry.emittedChunks < entry.argumentChunks.length) {
+              yield {
+                type: "tool_call_delta",
+                id: entry.id,
+                argumentChunk: entry.argumentChunks[entry.emittedChunks++]
+              };
             }
-            await audit("tool.finished", { status: "target_changed", errorCode: "TARGET_CHANGED" });
-            return failure(
-              "Execution target changed after approval",
-              "TARGET_CHANGED",
-              "after_user_action"
-            );
           }
-        } catch {
-          return failure(
-            "Execution target changed after approval",
-            "TARGET_CHANGED",
-            "after_user_action"
-          );
-        }
-      }
-      break;
-    }
-    try {
-      await audit("tool.started", { status: "started", ...auditFields });
-    } catch {
-      return failure(
-        "Audit unavailable; tool was not started",
-        "AUDIT_UNAVAILABLE",
-        "after_user_action"
-      );
-    }
-    let outputStr;
-    let isError = false;
-    let errorCode;
-    let retryPolicy;
-    try {
-      const executionController = new AbortController();
-      const abortFromSession = () => executionController.abort();
-      if (this.signal?.aborted) {
-        executionController.abort();
-      } else {
-        this.signal?.addEventListener("abort", abortFromSession, { once: true });
-      }
-      const toolCtx = {
-        rootDir: this.rootDir,
-        signal: executionController.signal,
-        logger: this.logger,
-        onProgress: (progress) => onProgress?.({ id: call.id, name: call.name, ...progress }),
-        ...shell ? {
-          onProcessSpawned: () => audit("process.spawned", { status: "spawned", ...auditFields })
-        } : {}
-      };
-      try {
-        const rawResult = tool.metadata?.managesTimeout ? await tool.execute(currentInput, toolCtx) : await this.withTimeout(
-          tool.execute(currentInput, toolCtx),
-          call.name,
-          executionController
-        );
-        outputStr = typeof rawResult === "string" ? rawResult : JSON.stringify(rawResult, null, 2);
-        if (call.name === "run_command" && typeof rawResult === "object" && rawResult !== null && "exitCode" in rawResult && rawResult.exitCode !== 0) {
-          isError = true;
-          errorCode = "COMMAND_EXIT_NONZERO";
-          retryPolicy = "never";
         }
-      } finally {
-        this.signal?.removeEventListener("abort", abortFromSession);
-      }
-    } catch (err) {
-      isError = true;
-      const known = err instanceof KapibalaError ? err : void 0;
-      outputStr = known?.safeMessage ?? "Tool execution failed";
-      errorCode = known?.code ?? "TOOL_FAILED";
-      retryPolicy = known?.retryPolicy ?? "never";
-    }
-    const resultBlock = {
-      type: "tool_result",
-      toolUseId: call.id,
-      content: outputStr,
-      isError,
-      ...errorCode ? { errorCode, retryPolicy } : {}
-    };
-    if (resultBlock.isError && resultBlock.errorCode) {
-      resultBlock.content = JSON.stringify({
-        code: resultBlock.errorCode,
-        retryPolicy: resultBlock.retryPolicy,
-        message: outputStr
-      });
-    }
-    try {
-      for (const hook of this.hooks.get("tool:after")) {
-        await hook(
-          hookCtx,
-          { id: call.id, name: call.name, input: currentInput },
-          { output: outputStr, isError }
-        );
       }
-    } catch {
-      resultBlock.content = JSON.stringify({
-        code: "HOOK_ERROR",
-        retryPolicy: "after_user_action",
-        message: "Tool finished but result processing failed"
-      });
-      resultBlock.isError = true;
-      resultBlock.errorCode = "HOOK_ERROR";
-      resultBlock.retryPolicy = "after_user_action";
-    }
-    resultBlock.durationMs = Math.max(0, Date.now() - startedAt);
-    if (resultBlock.isError && resultBlock.retryPolicy === "never") {
-      this.neverFailures.add(
-        (0, import_node_crypto11.createHash)("sha256").update(stableJsonStringify([call.name, currentInput])).digest("hex")
-      );
-    }
-    try {
-      await audit("tool.finished", {
-        status: resultBlock.isError ? "failed" : "completed",
-        ...resultBlock.errorCode ? { errorCode: resultBlock.errorCode } : {},
-        durationMs: resultBlock.durationMs
+      if (req.signal?.aborted) return;
+      if (finishReason === void 0 || !streamDone && this.chatCapabilities.requiresDone !== false)
+        throw new ModelError("Model response stream ended without a completion marker", {
+          retryable: false,
+          code: "MODEL_STREAM_INCOMPLETE",
+          stage: "stream"
+        });
+      if (finishReason !== "stop" && finishReason !== "tool_calls" && finishReason !== "length")
+        throw invalidResponse("Model response contained an unsupported or filtered finish reason");
+      if (pendingToolCalls.size > 0 && !["tool_calls", "length"].includes(finishReason))
+        throw invalidResponse("Model response finish reason did not match its tool calls");
+      if (pendingToolCalls.size === 0 && finishReason === "tool_calls")
+        throw invalidResponse("Model response finish reason did not match its tool calls");
+      const ids = /* @__PURE__ */ new Set();
+      const completedTools = [...pendingToolCalls.values()].map((tc) => {
+        if (!tc.id || !tc.name || ids.has(tc.id))
+          throw invalidResponse("Model response contained missing or duplicate tool identities");
+        ids.add(tc.id);
+        return {
+          type: "tool_call_finish",
+          id: tc.id,
+          name: tc.name,
+          input: parseToolArguments(tc.argumentChunks.join(""))
+        };
       });
-    } catch {
-      return failure(
-        "Tool outcome is unknown because the audit result could not be written",
-        "OUTCOME_UNKNOWN",
-        "after_user_action"
+      for (const tool of completedTools) yield tool;
+      const durationMs = Date.now() - requestStartTime;
+      yield { type: "message_stop", usage, ttftMs, durationMs, finishReason };
+    } catch (error) {
+      if (error instanceof ModelError || req.signal?.aborted) throw error;
+      const transportCode = safeTransportCode(error);
+      throw new ModelError(
+        `Model response stream failed${transportCode ? ` (${transportCode})` : ""}`,
+        {
+          retryable: false,
+          code: "MODEL_STREAM_INTERRUPTED",
+          transportCode,
+          stage: "stream"
+        }
       );
+    } finally {
+      req.signal?.removeEventListener("abort", onOuterAbort);
+      timeoutController.abort();
     }
-    return resultBlock;
   }
   /**
-   * 给工具执行加超时护栏：Promise.race 在超时后reject，循环拿到 isError 结果继续运转，
-   * 不会因某个异步工具(如未来接入的网络/exec 工具)挂起而永久卡死。
-   *
-   * 局限：同步 CPU 密集型实现会阻塞事件循环，timer 同样无法触发；
-   * 因此内置工具仍需避免执行用户可控的同步高复杂度计算。
+   * 将工具结果装配为 canonical tool 消息，wire 角色仅在下一请求投影时转换。
+   * @param results 已完成的工具结果，保持调用 ID 与内容，不重放工具。
+   * @returns 逐条克隆的 canonical tool 消息，允许消息级落盘。
    */
-  withTimeout(promise, toolName, executionController) {
-    let timer;
-    const timeout = new Promise((_, reject) => {
-      timer = setTimeout(() => {
-        const error = new KapibalaError(
-          `Tool '${toolName}' timed out after ${this.toolTimeoutMs}ms`,
-          {
-            code: "OUTCOME_UNKNOWN",
-            retryPolicy: "after_user_action",
-            safeMessage: "Tool timed out; completion of side effects is unknown"
+  assembleToolResults(results) {
+    return assembleCanonicalToolResults(results);
+  }
+  /**
+   * 将历史投影为 Chat 消息；合并连续 user，剔除空 assistant，保持工具调用与结果身份。
+   * 仅显式允许的端点回传可见思考；签名、脱敏思考和原生私有 Item 不适用于 Chat。
+   * @param messages canonical 历史；只投影文本、可选可见思考和工具语义。
+   * @param systemPrompt 可选全局提示词，去除首尾空白后作为首条 system。
+   * @returns 与输入历史独立的 Chat wire 消息数组。
+   */
+  translateMessagesToWire(messages, systemPrompt) {
+    const wire = [];
+    if (systemPrompt?.trim()) {
+      wire.push({ role: "system", content: systemPrompt.trim() });
+    }
+    for (const msg of messages) {
+      if (msg.role === "system") {
+        const text = msg.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+        if (text) wire.push({ role: "system", content: text });
+      } else if (msg.role === "user") {
+        const text = msg.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+        const previous = wire[wire.length - 1];
+        if (previous?.role === "user" && typeof previous.content === "string") {
+          previous.content = [previous.content, text].filter(Boolean).join("\n\n");
+        } else {
+          wire.push({ role: "user", content: text });
+        }
+      } else if (msg.role === "assistant") {
+        const text = msg.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+        const toolCalls = [];
+        for (const block of msg.content) {
+          if (block.type === "tool_use") {
+            toolCalls.push({
+              id: block.id,
+              type: "function",
+              function: {
+                name: block.name,
+                arguments: JSON.stringify(block.input)
+              }
+            });
           }
-        );
-        reject(error);
-        executionController.abort(error);
-      }, this.toolTimeoutMs);
-    });
-    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
-  }
-};
-
-// src/models/openai-compatible/sse.ts
-async function* parseSSEStream(stream, onDone) {
-  const reader = stream.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split(/\r?\n/);
-      buffer = lines.pop() ?? "";
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith(":")) {
-          continue;
         }
-        if (trimmed.startsWith("data:")) {
-          const dataContent = trimmed.slice(5).trim();
-          if (dataContent === "[DONE]") {
-            onDone?.();
-            return;
+        if (!text && toolCalls.length === 0) continue;
+        wire.push({
+          role: "assistant",
+          content: text || (this.replayReasoningContent ? "" : null),
+          ...this.replayReasoningContent ? {
+            reasoning_content: msg.content.filter((block) => block.type === "thinking").map((block) => block.thinking).join("")
+          } : {},
+          tool_calls: toolCalls.length > 0 ? toolCalls : void 0
+        });
+      } else if (msg.role === "tool") {
+        for (const block of msg.content) {
+          if (block.type === "tool_result") {
+            wire.push({
+              role: "tool",
+              tool_call_id: block.toolUseId,
+              content: block.content
+            });
           }
-          yield dataContent;
         }
       }
     }
-    if (buffer.trim().startsWith("data:")) {
-      const dataContent = buffer.trim().slice(5).trim();
-      if (dataContent !== "[DONE]") {
-        yield dataContent;
-      } else onDone?.();
-    }
-  } finally {
-    try {
-      await reader.cancel();
-    } finally {
-      reader.releaseLock();
-    }
+    return wire;
   }
-}
+};
 
-// src/models/openai-compatible/index.ts
-var DEFAULT_CONNECT_TIMEOUT_MS = 6e4;
-function safeTransportCode(error) {
-  const allowed = /* @__PURE__ */ new Set([
-    "UND_ERR_SOCKET",
-    "UND_ERR_BODY_TIMEOUT",
-    "UND_ERR_HEADERS_TIMEOUT",
-    "UND_ERR_CONNECT_TIMEOUT",
-    "ECONNRESET",
-    "ETIMEDOUT",
-    "ECONNREFUSED",
-    "ENOTFOUND",
-    "EAI_AGAIN"
-  ]);
-  let current = error;
-  for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
-    const candidate = current;
-    if (typeof candidate.code === "string" && allowed.has(candidate.code)) return candidate.code;
-    current = candidate.cause;
-  }
-  return void 0;
+// src/models/anthropic/index.ts
+var import_node_crypto13 = require("crypto");
+function invalidResponse2() {
+  throw new ModelError("Invalid Anthropic response state", {
+    code: "MODEL_INVALID_RESPONSE",
+    stage: "stream",
+    retryable: false
+  });
 }
-function isContextOverflow(error) {
-  if (!error || typeof error !== "object") return false;
-  const code = error.code;
-  return code === "context_length_exceeded" || code === "context_window_exceeded" || code === "max_context_length_exceeded";
+function wireToolId(id) {
+  if (typeof id !== "string" || !id)
+    throw new ModelError("Invalid tool history identity", {
+      code: "MODEL_INVALID_RESPONSE",
+      stage: "request",
+      retryable: false
+    });
+  return /^[A-Za-z0-9_-]{1,64}$/.test(id) ? id : `call_${(0, import_node_crypto13.createHash)("sha256").update(id).digest("hex").slice(0, 48)}`;
 }
-var OpenAICompatibleProvider = class {
-  name = "openai-compatible";
+var AnthropicProvider = class {
+  name = "anthropic";
   baseURL;
-  apiKey;
   modelName;
-  supportsThinking;
-  replayReasoningContent;
+  workspaceId;
   connectTimeoutMs;
-  /** 初始化协议适配；思考历史回传独立于模型能力标签，仅对兼容端点启用。 */
+  apiKey;
+  /** 表明该适配器已装载非空凭据，不暴露凭据内容。 */
+  get credentialsReady() {
+    return Boolean(this.apiKey.trim());
+  }
+  /** 暴露不含凭据的请求目标；用于宿主校验 Profile 与 Provider 的原子绑定。 */
+  get binding() {
+    return {
+      protocol: "anthropic",
+      baseURL: this.baseURL,
+      modelName: this.modelName,
+      workspaceId: this.workspaceId
+    };
+  }
+  /** 初始化连接；无效 URL/凭据/超时在请求前失败，错误不回显配置值。 */
   constructor(options) {
+    try {
+      const url = new URL(options.baseURL);
+      if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+        throw new Error();
+      if (!options.modelName?.trim() || !options.apiKey?.trim() || /[\r\n]/.test(options.apiKey) || options.workspaceId !== void 0 && (!options.workspaceId.trim() || /[\r\n]/.test(options.workspaceId)) || options.connectTimeoutMs !== void 0 && (!Number.isSafeInteger(options.connectTimeoutMs) || options.connectTimeoutMs <= 0))
+        throw new Error();
+    } catch {
+      throw new ModelError("Invalid Anthropic connection configuration", {
+        code: "MODEL_INVALID_REQUEST",
+        stage: "request",
+        retryable: false
+      });
+    }
     this.baseURL = options.baseURL.replace(/\/+$/, "");
-    this.apiKey = options.apiKey;
     this.modelName = options.modelName;
-    this.supportsThinking = options.supportsThinking ?? false;
-    this.replayReasoningContent = options.replayReasoningContent ?? new URL(this.baseURL).hostname === "api.deepseek.com";
-    this.connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+    this.apiKey = options.apiKey;
+    this.workspaceId = options.workspaceId;
+    this.connectTimeoutMs = options.connectTimeoutMs ?? 6e4;
+  }
+  /** 装配统一 tool 历史；Messages 的 user/tool_result 转换只作用于请求视图。 */
+  assembleToolResults(results) {
+    return assembleCanonicalToolResults(results);
   }
-  /** 发送流式请求，兼容端点原样回传思考历史；中断仅报告错误，不自动重放工具或请求。 */
+  /**
+   * 发送 Messages 流并按索引组装完整内容；增量仅供展示，终态提供有序落盘来源。
+   * maxTokens 包含思考消耗，缺省为 4096；缺终态、坏参数与服务端流错误均抛错。
+   * pause_turn 表示服务端工具暂停；当前不支持其续答，明确失败而非报告完成或调度客户端工具。
+   * 同 run/模型/端点的来源校验允许私有续答；来源不匹配的可见思考降为普通文字。
+   * 取消或消费者提前结束会等待 reader 清理并解除 HTTP 取消监听，不自动重发请求。
+   */
   async *create(req) {
-    const url = `${this.baseURL}/chat/completions`;
-    const wireMessages = this.translateMessagesToWire(req.messages, req.systemPrompt);
-    const wireTools = req.tools && req.tools.length > 0 ? req.tools.map((t) => ({
-      type: "function",
-      function: {
-        name: t.name,
-        description: t.description,
-        parameters: t.parameters
+    if (req.signal?.aborted) throw new AbortError();
+    const payload = this.createPayload(req);
+    const origin = createProtocolOrigin(this.binding, req.context);
+    const startedAt = Date.now();
+    const opened = await openModelResponse({
+      protocol: "anthropic",
+      url: `${this.baseURL}/messages`,
+      headers: {
+        // 官方 API 以 x-api-key 为标准鉴权头，部分网关只识别 Bearer；两者同时发送以覆盖两类端点。
+        "x-api-key": this.apiKey,
+        Authorization: `Bearer ${this.apiKey}`,
+        "anthropic-version": "2023-06-01",
+        ...this.workspaceId ? { "anthropic-workspace-id": this.workspaceId } : {}
+      },
+      payload,
+      signal: req.signal,
+      connectTimeoutMs: this.connectTimeoutMs
+    });
+    const blocks = [];
+    const toolIds = /* @__PURE__ */ new Set();
+    let activeIndex;
+    let messageId = "";
+    let messageStarted = false;
+    let messageDeltaStarted = false;
+    let messageStopped = false;
+    let finishReason;
+    let refusal = false;
+    let ttftMs;
+    const counters = {};
+    const updateUsage = (value) => {
+      if (value === void 0) return;
+      if (!value || typeof value !== "object" || Array.isArray(value)) invalidResponse2();
+      const usage = value;
+      for (const key of [
+        "input_tokens",
+        "output_tokens",
+        "cache_read_input_tokens",
+        "cache_creation_input_tokens"
+      ]) {
+        if (usage[key] === void 0) continue;
+        if (!Number.isSafeInteger(usage[key]) || usage[key] < 0 || counters[key] !== void 0 && usage[key] < counters[key])
+          invalidResponse2();
+        counters[key] = usage[key];
       }
-    })) : void 0;
-    const payload = {
-      model: this.modelName,
-      messages: wireMessages,
-      stream: true,
-      stream_options: { include_usage: true },
-      temperature: req.temperature ?? 0.7
     };
-    if (wireTools) {
-      payload.tools = wireTools;
-    }
-    if (req.maxTokens) {
-      payload.max_tokens = req.maxTokens;
-    }
-    let response;
-    const timeoutController = new AbortController();
-    const timeoutTimer = setTimeout(() => timeoutController.abort(), this.connectTimeoutMs);
-    const onOuterAbort = () => timeoutController.abort();
-    if (req.signal?.aborted) {
-      timeoutController.abort();
-    } else {
-      req.signal?.addEventListener("abort", onOuterAbort, { once: true });
-    }
     try {
-      try {
-        response = await fetch(url, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${this.apiKey}`
-          },
-          body: JSON.stringify(payload),
-          signal: timeoutController.signal
-        });
-      } catch (err) {
-        if (req.signal?.aborted) {
-          throw err;
+      for await (const frame of parseSSEFrames(opened.response.body)) {
+        if (req.signal?.aborted) throw new AbortError();
+        const value = parseWireEvent(frame.data);
+        if (typeof value.type !== "string" || !value.type) invalidResponse2();
+        if (frame.event !== "message" && frame.event !== value.type) invalidResponse2();
+        if (value.type === "ping") continue;
+        if (value.type === "error") {
+          const detail = value.error;
+          const options = {
+            stage: "stream",
+            providerCode: typeof detail?.code === "string" ? detail.code : void 0,
+            providerType: typeof detail?.type === "string" ? detail.type : void 0
+          };
+          if (isContextOverflow(detail, "anthropic"))
+            throw new ContextOverflowError(void 0, options);
+          throw new ModelError("Anthropic stream failed", options);
         }
-        if (timeoutController.signal.aborted) {
-          throw new ModelError(`Connection to ${url} timed out after ${this.connectTimeoutMs}ms`, {
-            status: 408,
-            retryable: true,
-            stage: "connect"
-          });
+        if (value.type === "message_start") {
+          if (messageStarted || !value.message || value.message.role !== "assistant" || typeof value.message.id !== "string" || !value.message.id || !Array.isArray(value.message.content) || value.message.content.length)
+            invalidResponse2();
+          messageStarted = true;
+          messageId = value.message.id;
+          updateUsage(value.message.usage);
+          continue;
         }
-        throw new ModelError(`Failed to connect to ${url}: ${err.message}`, {
-          transportCode: safeTransportCode(err),
-          stage: "connect"
-        });
-      } finally {
-        clearTimeout(timeoutTimer);
-      }
-      if (!response.ok) {
-        const errorText = await response.text();
-        let errorDetails;
-        let errorMsg = `API request failed with status ${response.status}: ${response.statusText}`;
-        try {
-          const errorJson = JSON.parse(errorText);
-          errorDetails = errorJson.error;
-          if (typeof errorJson.error?.message === "string") {
-            errorMsg = errorJson.error.message;
+        if (!messageStarted || messageStopped) invalidResponse2();
+        if (value.type === "content_block_start") {
+          if (messageDeltaStarted || activeIndex !== void 0 || value.index !== blocks.length)
+            invalidResponse2();
+          const block = value.content_block;
+          if (!block || typeof block !== "object") invalidResponse2();
+          let content;
+          if (block.type === "text" && typeof block.text === "string")
+            content = { type: "text", text: block.text };
+          else if (block.type === "thinking" && typeof block.thinking === "string" && (block.signature === void 0 || typeof block.signature === "string"))
+            content = {
+              type: "thinking",
+              thinking: block.thinking,
+              ...block.signature ? { signature: block.signature } : {},
+              origin
+            };
+          else if (block.type === "redacted_thinking" && typeof block.data === "string" && block.data)
+            content = { type: "redacted_thinking", data: block.data, origin };
+          else if (block.type === "tool_use" && typeof block.id === "string" && block.id && typeof block.name === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(block.name) && block.input && typeof block.input === "object" && !Array.isArray(block.input)) {
+            if (toolIds.has(block.id)) invalidResponse2();
+            toolIds.add(block.id);
+            content = {
+              type: "tool_use",
+              id: block.id,
+              name: block.name,
+              input: structuredClone(block.input)
+            };
+          } else invalidResponse2();
+          const blockId = `${messageId}:${value.index}`;
+          blocks.push({ content, argumentText: "", blockId, stopped: false });
+          activeIndex = value.index;
+          ttftMs ??= Date.now() - startedAt;
+          if (content.type === "thinking") {
+            yield { type: "thinking_block_start", blockId };
+            if (content.thinking)
+              yield { type: "thinking_delta", thinking: content.thinking, blockId };
+          } else if (content.type === "text" && content.text)
+            yield { type: "text_delta", text: content.text };
+          else if (content.type === "tool_use")
+            yield { type: "tool_call_start", id: content.id, name: content.name };
+          continue;
+        }
+        if (value.type === "content_block_delta" || value.type === "content_block_stop") {
+          if (messageDeltaStarted || !Number.isSafeInteger(value.index) || value.index !== activeIndex)
+            invalidResponse2();
+          const entry = blocks[value.index];
+          if (!entry || entry.stopped) invalidResponse2();
+          const content = entry.content;
+          if (value.type === "content_block_stop") {
+            if (content.type === "tool_use") {
+              if (entry.argumentText) content.input = parseToolArguments(entry.argumentText);
+              yield {
+                type: "tool_call_finish",
+                id: content.id,
+                name: content.name,
+                input: structuredClone(content.input)
+              };
+            } else if (content.type === "thinking") {
+              if (!content.signature) invalidResponse2();
+              yield { type: "thinking_block_stop", blockId: entry.blockId };
+            }
+            entry.stopped = true;
+            activeIndex = void 0;
+            continue;
           }
-        } catch {
-          if (errorText) errorMsg += ` - ${errorText.slice(0, 300)}`;
+          const change = value.delta;
+          if (!change || typeof change !== "object") invalidResponse2();
+          if (content.type === "text" && change.type === "text_delta" && typeof change.text === "string") {
+            content.text += change.text;
+            if (change.text) yield { type: "text_delta", text: change.text };
+          } else if (content.type === "thinking" && change.type === "thinking_delta" && typeof change.thinking === "string") {
+            if (content.signature) invalidResponse2();
+            content.thinking += change.thinking;
+            if (change.thinking)
+              yield { type: "thinking_delta", thinking: change.thinking, blockId: entry.blockId };
+          } else if (content.type === "thinking" && change.type === "signature_delta" && typeof change.signature === "string")
+            content.signature = (content.signature ?? "") + change.signature;
+          else if (content.type === "tool_use" && change.type === "input_json_delta" && typeof change.partial_json === "string") {
+            if (Object.keys(content.input).length) invalidResponse2();
+            entry.argumentText += change.partial_json;
+            if (entry.argumentText.length > 16 * 1024 * 1024) invalidResponse2();
+            yield { type: "tool_call_delta", id: content.id, argumentChunk: change.partial_json };
+          } else invalidResponse2();
+          continue;
         }
-        const details = errorDetails;
-        const options = {
-          status: response.status,
-          providerCode: typeof details?.code === "string" ? details.code : void 0,
-          providerType: typeof details?.type === "string" ? details.type : void 0,
-          stage: "response"
+        if (value.type === "message_delta") {
+          if (activeIndex !== void 0 || !value.delta || typeof value.delta !== "object")
+            invalidResponse2();
+          messageDeltaStarted = true;
+          updateUsage(value.usage);
+          const reason = value.delta.stop_reason;
+          if (reason === void 0 || reason === null) continue;
+          if (finishReason !== void 0) invalidResponse2();
+          if (reason === "end_turn" || reason === "stop_sequence") finishReason = "stop";
+          else if (reason === "tool_use") finishReason = "tool_calls";
+          else if (reason === "max_tokens" || reason === "model_context_window_exceeded")
+            finishReason = "length";
+          else if (reason === "refusal") {
+            finishReason = "content_filter";
+            refusal = true;
+          } else if (reason === "pause_turn") {
+            throw new ModelError(
+              "Anthropic paused a server-tool turn; continuation is unsupported",
+              {
+                code: "MODEL_INVALID_RESPONSE",
+                stage: "stream",
+                retryable: false,
+                providerCode: "pause_turn"
+              }
+            );
+          } else
+            throw new ModelError("Anthropic returned an unsupported stop_reason", {
+              stage: "stream",
+              retryable: false,
+              providerCode: typeof reason === "string" ? reason : void 0
+            });
+          continue;
+        }
+        if (value.type === "message_stop") {
+          if (!messageDeltaStarted || !finishReason || activeIndex !== void 0 || blocks.some((block) => !block.stopped) || finishReason === "tool_calls" && !toolIds.size || finishReason === "stop" && toolIds.size)
+            invalidResponse2();
+          messageStopped = true;
+          break;
+        }
+      }
+      if (req.signal?.aborted) throw new AbortError();
+      if (!messageStopped)
+        throw new ModelError("Anthropic stream ended before message_stop", {
+          code: "MODEL_STREAM_INCOMPLETE",
+          stage: "stream",
+          retryable: false
+        });
+      let usage;
+      if (counters.input_tokens !== void 0 && counters.output_tokens !== void 0) {
+        const promptTokens = counters.input_tokens + (counters.cache_read_input_tokens ?? 0) + (counters.cache_creation_input_tokens ?? 0);
+        usage = {
+          promptTokens,
+          completionTokens: counters.output_tokens,
+          totalTokens: promptTokens + counters.output_tokens,
+          ...counters.cache_read_input_tokens !== void 0 ? { cachedPromptTokens: counters.cache_read_input_tokens } : {}
         };
-        if ([400, 413, 422].includes(response.status) && isContextOverflow(errorDetails))
-          throw new ContextOverflowError(response.status, { ...options, message: errorMsg });
-        throw new ModelError(errorMsg, options);
       }
-      if (!response.body) {
-        throw new ModelError("Response body is null", {
-          code: "MODEL_INVALID_RESPONSE",
-          stage: "response"
+      yield {
+        type: "message_stop",
+        finishReason,
+        finalContent: blocks.map((block) => block.content),
+        ...usage ? { usage } : {},
+        ...refusal ? { refusal } : {},
+        ttftMs,
+        durationMs: Date.now() - startedAt
+      };
+    } catch (error) {
+      if (req.signal?.aborted) throw new AbortError();
+      if (error instanceof ModelError || error instanceof AbortError) throw error;
+      throw new ModelError("Anthropic response stream interrupted", {
+        code: "MODEL_STREAM_INTERRUPTED",
+        stage: "stream",
+        transportCode: safeTransportCode(error)
+      });
+    } finally {
+      opened.close();
+    }
+  }
+  /**
+   * 投影 system、普通内容与工具结果；连续结果合并为下一 user 内容并置于文字之前。
+   * 私有块由共享来源规则筛选，原始消息和工具 ID 不被改写；不发送能力标签推测的思考参数。
+   */
+  createPayload(req) {
+    const maxTokens = req.maxTokens ?? 4096;
+    if (!Number.isSafeInteger(maxTokens) || maxTokens <= 0)
+      throw new ModelError("Invalid Anthropic output token budget", {
+        code: "MODEL_INVALID_REQUEST",
+        stage: "request",
+        retryable: false
+      });
+    const messages = [];
+    const system = req.systemPrompt ? [req.systemPrompt] : [];
+    for (const message of projectProtocolHistory(req.messages, this.binding, req.context)) {
+      if (message.role === "system") {
+        for (const block of message.content) if (block.type === "text") system.push(block.text);
+        continue;
+      }
+      const content = [];
+      for (const block of message.content) {
+        if (block.type === "text") content.push({ type: "text", text: block.text });
+        else if (block.type === "tool_use")
+          content.push({
+            type: "tool_use",
+            id: wireToolId(block.id),
+            name: block.name,
+            input: block.input
+          });
+        else if (block.type === "tool_result")
+          content.push({
+            type: "tool_result",
+            tool_use_id: wireToolId(block.toolUseId),
+            content: block.content,
+            ...block.isError !== void 0 ? { is_error: block.isError } : {}
+          });
+        else if (block.type === "thinking") {
+          if (!block.signature)
+            throw new ModelError("Invalid Anthropic thinking history", {
+              code: "MODEL_INVALID_RESPONSE",
+              stage: "request",
+              retryable: false
+            });
+          content.push({ type: "thinking", thinking: block.thinking, signature: block.signature });
+        } else if (block.type === "redacted_thinking")
+          content.push({ type: "redacted_thinking", data: block.data });
+      }
+      if (!content.length) continue;
+      const role = message.role === "assistant" ? "assistant" : "user";
+      const previous = messages.at(-1);
+      if (role === "user" && previous?.role === "user") {
+        const all = [...previous.content, ...content];
+        previous.content = [
+          ...all.filter((block) => block.type === "tool_result"),
+          ...all.filter((block) => block.type !== "tool_result")
+        ];
+      } else messages.push({ role, content });
+    }
+    return {
+      model: this.modelName,
+      messages,
+      stream: true,
+      max_tokens: maxTokens,
+      ...system.length ? { system: system.join("\n\n") } : {},
+      ...req.temperature !== void 0 ? { temperature: req.temperature } : {},
+      ...req.tools?.length ? {
+        tools: req.tools.map((tool) => ({
+          name: tool.name,
+          description: tool.description,
+          input_schema: tool.parameters
+        }))
+      } : {}
+    };
+  }
+};
+
+// src/models/openai-responses/index.ts
+var import_node_crypto14 = require("crypto");
+function invalid(message = "Invalid Responses output Item") {
+  throw new ModelError(message, {
+    code: "MODEL_INVALID_RESPONSE",
+    stage: "stream",
+    retryable: false
+  });
+}
+function nonempty(value) {
+  return typeof value === "string" && !!value.trim();
+}
+function index(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function wireCallId(id) {
+  if (typeof id !== "string" || !id)
+    throw new ModelError("Invalid tool history identity", {
+      code: "MODEL_INVALID_RESPONSE",
+      stage: "request",
+      retryable: false
+    });
+  return /^[A-Za-z0-9_-]{1,64}$/.test(id) ? id : `call_${(0, import_node_crypto14.createHash)("sha256").update(id).digest("hex").slice(0, 48)}`;
+}
+function validateItem(item, final) {
+  if (!item || typeof item !== "object" || !nonempty(item.id)) invalid();
+  if (!["message", "function_call", "reasoning"].includes(item.type))
+    invalid("Unsupported Responses output Item");
+  if (final && (item.type !== "reasoning" || item.status !== void 0) && item.status !== "completed")
+    invalid("Responses output Item is not complete");
+  if (item.type === "message") {
+    if (item.role !== "assistant" || !Array.isArray(item.content) || item.phase != null && !["commentary", "final_answer"].includes(item.phase))
+      invalid();
+    for (const part of item.content) {
+      if (!part || !["output_text", "refusal"].includes(part.type) || typeof (part.type === "refusal" ? part.refusal : part.text) !== "string")
+        invalid("Unsupported Responses message content");
+    }
+  } else if (item.type === "function_call") {
+    if (!nonempty(item.call_id) || !nonempty(item.name) || typeof item.arguments !== "string")
+      invalid();
+    if (final) {
+      if (!item.arguments.trim()) invalid("Responses function arguments are missing");
+      parseToolArguments(item.arguments);
+    }
+  } else if (!Array.isArray(item.summary) || item.summary.some(
+    (part) => !part || part.type !== "summary_text" || typeof part.text !== "string"
+  ) || item.encrypted_content != null && typeof item.encrypted_content !== "string")
+    invalid();
+}
+function itemIdentity(item) {
+  const common = { type: item.type, id: item.id, status: item.status };
+  if (item.type === "message")
+    return JSON.stringify({
+      ...common,
+      role: item.role,
+      phase: item.phase ?? void 0,
+      content: item.content.map((part) => ({
+        type: part.type,
+        value: part.type === "refusal" ? part.refusal : part.text
+      }))
+    });
+  if (item.type === "function_call")
+    return JSON.stringify({
+      ...common,
+      call_id: item.call_id,
+      name: item.name,
+      arguments: item.arguments
+    });
+  return JSON.stringify({
+    ...common,
+    encrypted_content: item.encrypted_content ?? void 0,
+    summary: item.summary.map((part) => ({ type: part.type, text: part.text }))
+  });
+}
+function toCanonical(output, origin) {
+  const content = [];
+  const itemIds = /* @__PURE__ */ new Set();
+  const callIds = /* @__PURE__ */ new Set();
+  let refusal = false;
+  let finalAnswer = false;
+  for (const [itemIndex, item] of output.entries()) {
+    validateItem(item, true);
+    if (itemIds.has(item.id)) invalid("Duplicate Responses Item identity");
+    itemIds.add(item.id);
+    if (item.type === "function_call") {
+      if (callIds.has(item.call_id)) invalid("Duplicate Responses function call identity");
+      callIds.add(item.call_id);
+      content.push({
+        type: "tool_use",
+        id: item.call_id,
+        name: item.name,
+        input: parseToolArguments(item.arguments),
+        protocolMeta: { origin, itemIndex, itemId: item.id, arguments: item.arguments }
+      });
+    } else if (item.type === "reasoning") {
+      content.push({
+        type: "provider_state",
+        origin,
+        item: {
+          type: "reasoning",
+          id: item.id,
+          summary: item.summary.map((part) => ({
+            type: "summary_text",
+            text: part.text
+          })),
+          ...item.encrypted_content != null ? { encrypted_content: item.encrypted_content } : {},
+          ...item.status !== void 0 ? { status: item.status } : {}
+        }
+      });
+    } else {
+      if (!item.content.length)
+        content.push({
+          type: "text",
+          text: "",
+          protocolMeta: {
+            origin,
+            itemIndex,
+            itemId: item.id,
+            ...item.phase ? { phase: item.phase } : {}
+          }
+        });
+      for (const [contentIndex, part] of item.content.entries()) {
+        const text = part.type === "refusal" ? part.refusal : part.text;
+        refusal ||= part.type === "refusal";
+        finalAnswer ||= !!text.trim() && item.phase !== "commentary";
+        content.push({
+          type: "text",
+          text,
+          protocolMeta: {
+            origin,
+            itemIndex,
+            itemId: item.id,
+            contentIndex,
+            contentType: part.type,
+            ...item.phase ? { phase: item.phase } : {}
+          }
+        });
+      }
+    }
+  }
+  if (refusal && callIds.size) invalid("Responses refusal cannot contain executable functions");
+  if (!callIds.size && !finalAnswer && !(refusal && content.some((block) => block.type === "text" && !!block.text.trim())))
+    invalid("Responses completed without a final answer or function call");
+  validateProtocolContent(content);
+  return { content, refusal, toolCalls: callIds.size > 0 };
+}
+function toInput(messages) {
+  const input = [];
+  for (const message of messages) {
+    let group;
+    let groupKey;
+    const canReplayState = message.role === "assistant" && message.content.some((block) => block.type === "tool_use");
+    for (const block of message.content) {
+      if (block.type === "provider_state") {
+        group = void 0;
+        if (canReplayState) input.push(structuredClone(block.item));
+      } else if (block.type === "tool_use") {
+        group = void 0;
+        const argumentsText = block.protocolMeta?.arguments ?? JSON.stringify(block.input);
+        const parsed = parseToolArguments(argumentsText);
+        if (JSON.stringify(parsed) !== JSON.stringify(block.input))
+          invalid("Responses historical function arguments do not match canonical input");
+        input.push({
+          type: "function_call",
+          ...block.protocolMeta?.itemId ? { id: block.protocolMeta.itemId } : {},
+          call_id: wireCallId(block.id),
+          name: block.name,
+          arguments: argumentsText,
+          ...block.protocolMeta ? { status: "completed" } : {}
         });
+      } else if (block.type === "tool_result") {
+        group = void 0;
+        input.push({
+          type: "function_call_output",
+          call_id: wireCallId(block.toolUseId),
+          output: block.content
+        });
+      } else if (block.type === "text" || block.type === "thinking") {
+        const text = block.type === "text" ? block.text : block.thinking;
+        const meta = block.type === "text" ? block.protocolMeta : void 0;
+        if (!text && !meta) continue;
+        const key = meta ? `${meta.origin.runId}:${meta.itemIndex}:${meta.itemId ?? ""}` : "ordinary";
+        if (!group || key !== groupKey) {
+          const sourced = message.role === "assistant" && !!meta;
+          group = {
+            ...sourced ? {
+              type: "message",
+              ...meta.itemId ? { id: meta.itemId } : {},
+              status: "completed",
+              ...meta.phase ? { phase: meta.phase } : {}
+            } : {},
+            role: message.role,
+            content: []
+          };
+          groupKey = key;
+          input.push(group);
+        }
+        if (!text && meta && meta.contentIndex === void 0) continue;
+        const type = message.role === "assistant" ? meta?.contentType ?? "output_text" : "input_text";
+        group.content.push(
+          type === "refusal" ? { type, refusal: text } : { type, text, ...type === "output_text" ? { annotations: [] } : {} }
+        );
       }
-      const pendingToolCalls = /* @__PURE__ */ new Map();
-      let usage;
-      let finishReason;
-      let streamDone = false;
-      const requestStartTime = Date.now();
-      let ttftMs;
-      for await (const chunk of parseSSEStream(response.body, () => {
-        streamDone = true;
-      })) {
-        if (req.signal?.aborted) return;
-        if (!chunk) continue;
-        let json;
-        try {
-          json = JSON.parse(chunk);
-        } catch {
-          throw new ModelError("Model response contained invalid JSON", {
-            code: "MODEL_INVALID_RESPONSE",
+    }
+  }
+  return input;
+}
+var OpenAIResponsesProvider = class {
+  name = "openai-responses";
+  binding;
+  options;
+  /** 表明该适配器已装载非空凭据，不暴露凭据内容。 */
+  get credentialsReady() {
+    return Boolean(this.options.apiKey.trim());
+  }
+  /** 绑定明确模型与端点；不从模型名推断协议，也不在失败后自动切换协议。非法配置在请求前失败。 */
+  constructor(options) {
+    try {
+      const url = new URL(options.baseURL);
+      if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+        throw new Error();
+      if (!options.modelName?.trim() || !options.apiKey?.trim() || /[\r\n]/.test(options.apiKey) || options.connectTimeoutMs !== void 0 && (!Number.isSafeInteger(options.connectTimeoutMs) || options.connectTimeoutMs <= 0))
+        throw new Error();
+    } catch {
+      throw new ModelError("Invalid Responses connection configuration", {
+        code: "MODEL_INVALID_REQUEST",
+        stage: "request",
+        retryable: false
+      });
+    }
+    this.options = { ...options, baseURL: options.baseURL.replace(/\/+$/, "") };
+    this.binding = Object.freeze({
+      protocol: "openai-responses",
+      modelName: options.modelName,
+      baseURL: this.options.baseURL
+    });
+  }
+  /** 消费完整 Responses 流，增量仅用于展示；终态与全部 Item 合法后才交付工具完成和最终内容。 */
+  async *create(request) {
+    const started = Date.now();
+    let firstToken;
+    const origin = createProtocolOrigin(this.binding, request.context);
+    const projected = projectProtocolHistory(request.messages, this.binding, request.context);
+    const input = toInput(normalizeHistory(projected).messages);
+    const payload = {
+      model: this.options.modelName,
+      stream: true,
+      store: false,
+      input,
+      include: ["reasoning.encrypted_content"]
+    };
+    if (request.systemPrompt) payload.instructions = request.systemPrompt;
+    if (request.maxTokens !== void 0) {
+      if (!Number.isSafeInteger(request.maxTokens) || request.maxTokens <= 0)
+        throw new ModelError("Invalid Responses output budget", {
+          stage: "request",
+          retryable: false
+        });
+      payload.max_output_tokens = request.maxTokens;
+    }
+    if (request.temperature !== void 0 && !this.options.supportsThinking)
+      payload.temperature = request.temperature;
+    if (request.tools?.length)
+      payload.tools = request.tools.map((tool) => ({
+        type: "function",
+        name: tool.name,
+        description: tool.description,
+        parameters: structuredClone(tool.parameters),
+        strict: false
+      }));
+    const { response, close } = await openModelResponse({
+      url: `${this.options.baseURL}/responses`,
+      headers: { Authorization: `Bearer ${this.options.apiKey}` },
+      payload,
+      signal: request.signal,
+      connectTimeoutMs: this.options.connectTimeoutMs
+    });
+    const items = /* @__PURE__ */ new Map();
+    const summariesOpen = /* @__PURE__ */ new Set();
+    let terminal;
+    const target = (event) => {
+      if (!index(event.output_index)) invalid();
+      const item = items.get(event.output_index);
+      if (!item || item.done || event.item_id !== item.item.id)
+        invalid("Responses event Item identity or lifecycle mismatch");
+      return item;
+    };
+    try {
+      for await (const frame of parseSSEFrames(response.body)) {
+        if (frame.event === "ping" && !frame.data.trim()) continue;
+        const event = parseWireEvent(frame.data);
+        if (typeof event.type !== "string" || frame.event !== "message" && frame.event !== event.type)
+          invalid("Responses event type mismatch");
+        if (event.type === "error" || event.error) this.throwWireError(event.error ?? event);
+        if (event.type === "response.failed") this.throwWireError(event.response?.error ?? {});
+        if (event.type === "response.incomplete")
+          throw new ModelError("Responses generation was incomplete", {
+            code: "MODEL_STREAM_INCOMPLETE",
             stage: "stream",
-            retryable: false
+            retryable: false,
+            providerCode: event.response?.incomplete_details?.reason
           });
+        if (event.type === "response.completed") {
+          if (event.response?.status !== "completed" || !Array.isArray(event.response.output))
+            invalid("Invalid Responses terminal event");
+          terminal = event.response;
+          break;
         }
-        if (!json || typeof json !== "object" || Array.isArray(json))
-          throw new ModelError("Model response contained an invalid event", {
-            code: "MODEL_INVALID_RESPONSE",
-            stage: "stream",
-            retryable: false
-          });
-        if (json.error) {
-          const message = typeof json.error.message === "string" ? json.error.message : "Model API stream error";
-          const details = [json.error.type, json.error.code].filter((value) => typeof value === "string" && value.length > 0).join(", ");
-          const options = {
-            providerCode: typeof json.error.code === "string" ? json.error.code : void 0,
-            providerType: typeof json.error.type === "string" ? json.error.type : void 0,
-            stage: "stream"
-          };
-          if (isContextOverflow(json.error))
-            throw new ContextOverflowError(void 0, { ...options, message });
-          throw new ModelError(details ? `${message} (${details})` : message, options);
+        if (event.type === "response.output_item.added" || event.type === "response.output_item.done") {
+          if (!index(event.output_index)) invalid();
+          validateItem(event.item, event.type.endsWith(".done"));
+          const existing = items.get(event.output_index);
+          if (event.type.endsWith(".added")) {
+            if (existing || [...items.values()].some((item) => item.item.id === event.item.id))
+              invalid("Duplicate Responses streaming Item");
+            items.set(event.output_index, {
+              item: event.item,
+              arguments: "",
+              text: /* @__PURE__ */ new Map(),
+              summaries: /* @__PURE__ */ new Map()
+            });
+            if (event.item.type === "function_call")
+              yield { type: "tool_call_start", id: event.item.call_id, name: event.item.name };
+          } else {
+            if (existing?.done || existing && (existing.item.id !== event.item.id || existing.item.type !== event.item.type || event.item.type === "function_call" && (existing.item.call_id !== event.item.call_id || existing.item.name !== event.item.name)))
+              invalid("Responses completed Item identity mismatch");
+            const item = existing ?? {
+              item: event.item,
+              arguments: "",
+              text: /* @__PURE__ */ new Map(),
+              summaries: /* @__PURE__ */ new Map()
+            };
+            item.done = event.item;
+            items.set(event.output_index, item);
+          }
+          continue;
         }
-        if (json.usage) {
-          usage = {
-            promptTokens: json.usage.prompt_tokens ?? 0,
-            completionTokens: json.usage.completion_tokens ?? 0,
-            totalTokens: json.usage.total_tokens ?? 0
-          };
-          const cached = json.usage.prompt_tokens_details?.cached_tokens ?? json.usage.prompt_cache_hit_tokens;
-          if (Number.isSafeInteger(cached) && cached >= 0) usage.cachedPromptTokens = cached;
+        if (event.type === "response.output_text.delta" || event.type === "response.refusal.delta") {
+          const item = target(event);
+          if (item.item.type !== "message" || !index(event.content_index) || typeof event.delta !== "string" || item.textDone?.has(event.content_index))
+            invalid();
+          const type = event.type === "response.refusal.delta" ? "refusal" : "output_text";
+          const part = item.text.get(event.content_index) ?? { type, value: "" };
+          if (part.type !== type) invalid();
+          part.value += event.delta;
+          item.text.set(event.content_index, part);
+          firstToken ??= Date.now();
+          yield { type: "text_delta", text: event.delta };
+          continue;
         }
-        const choice = json.choices?.[0];
-        if (!choice) continue;
-        if (typeof choice.finish_reason === "string") finishReason = choice.finish_reason;
-        const delta = choice.delta;
-        if (!delta) continue;
-        if ((delta.content || delta.reasoning_content || delta.tool_calls && delta.tool_calls.length > 0) && ttftMs === void 0) {
-          ttftMs = Date.now() - requestStartTime;
+        if (event.type === "response.output_text.done" || event.type === "response.refusal.done") {
+          const item = target(event);
+          const type = event.type === "response.refusal.done" ? "refusal" : "output_text";
+          const value = type === "refusal" ? event.refusal : event.text;
+          if (item.item.type !== "message" || !index(event.content_index) || typeof value !== "string" || item.textDone?.has(event.content_index))
+            invalid();
+          const part = item.text.get(event.content_index);
+          if (part && (part.type !== type || part.value !== value))
+            invalid("Responses completed text does not match its deltas");
+          item.text.set(event.content_index, { type, value });
+          item.textDone ??= /* @__PURE__ */ new Set();
+          item.textDone.add(event.content_index);
+          if (!part && value) yield { type: "text_delta", text: value };
+          continue;
         }
-        if (delta.content) {
-          yield { type: "text_delta", text: delta.content };
+        if (event.type === "response.content_part.added" || event.type === "response.content_part.done") {
+          const item = target(event);
+          const part = event.part;
+          if (item.item.type !== "message" || !index(event.content_index) || !part || !["output_text", "refusal"].includes(part.type) || typeof (part.type === "refusal" ? part.refusal : part.text) !== "string")
+            invalid("Unsupported Responses message content");
+          if (event.type.endsWith(".done")) {
+            const streamed = item.text.get(event.content_index);
+            if (streamed && (streamed.type !== part.type || streamed.value !== (part.type === "refusal" ? part.refusal : part.text)))
+              invalid("Responses content part does not match streamed text");
+          }
+          continue;
         }
-        if (delta.reasoning_content) {
-          yield { type: "thinking_delta", thinking: delta.reasoning_content };
+        if (event.type === "response.function_call_arguments.delta" || event.type === "response.function_call_arguments.done") {
+          const item = target(event);
+          if (item.item.type !== "function_call" || item.argumentDone !== void 0) invalid();
+          if (event.type.endsWith(".delta")) {
+            if (typeof event.delta !== "string") invalid();
+            item.arguments += event.delta;
+            yield { type: "tool_call_delta", id: item.item.call_id, argumentChunk: event.delta };
+          } else {
+            if (typeof event.arguments !== "string" || item.arguments && item.arguments !== event.arguments)
+              invalid("Responses function arguments changed after streaming");
+            item.argumentDone = event.arguments;
+          }
+          continue;
         }
-        if (delta.tool_calls && Array.isArray(delta.tool_calls)) {
-          for (const tc of delta.tool_calls) {
-            const index = tc.index ?? 0;
-            let entry = pendingToolCalls.get(index);
-            if (!entry) {
-              entry = {
-                id: tc.id ?? `call_${Date.now()}_${index}`,
-                name: tc.function?.name ?? "",
-                argumentChunks: []
-              };
-              pendingToolCalls.set(index, entry);
-              yield { type: "tool_call_start", id: entry.id, name: entry.name };
-            }
-            if (tc.function?.name && !entry.name) {
-              entry.name = tc.function.name;
-            }
-            if (tc.function?.arguments) {
-              entry.argumentChunks.push(tc.function.arguments);
-              yield {
-                type: "tool_call_delta",
-                id: entry.id,
-                argumentChunk: tc.function.arguments
-              };
+        if (event.type === "response.reasoning_summary_text.delta" || event.type === "response.reasoning_summary_text.done") {
+          const item = target(event);
+          if (item.item.type !== "reasoning" || !index(event.summary_index)) invalid();
+          const blockId = `${item.item.id}:${event.summary_index}`;
+          const old = item.summaries.get(event.summary_index) ?? "";
+          if (event.type.endsWith(".delta")) {
+            if (typeof event.delta !== "string") invalid();
+            if (!summariesOpen.has(blockId)) {
+              summariesOpen.add(blockId);
+              yield { type: "thinking_block_start", blockId };
             }
+            item.summaries.set(event.summary_index, old + event.delta);
+            firstToken ??= Date.now();
+            yield { type: "thinking_delta", blockId, thinking: event.delta };
+          } else {
+            if (typeof event.text !== "string" || old && old !== event.text) invalid();
+            item.summaries.set(event.summary_index, event.text);
+            if (summariesOpen.delete(blockId)) yield { type: "thinking_block_stop", blockId };
           }
+          continue;
         }
+        if ([
+          "response.created",
+          "response.in_progress",
+          "response.queued",
+          "response.output_text.annotation.added",
+          "response.reasoning_summary_part.added",
+          "response.reasoning_summary_part.done"
+        ].includes(event.type))
+          continue;
+        invalid("Unsupported Responses stream event");
       }
-      if (!streamDone && finishReason === void 0)
-        throw new ModelError("Model response stream ended without a completion marker", {
-          retryable: false,
+      if (!terminal)
+        throw new ModelError("Responses stream ended without completion", {
           code: "MODEL_STREAM_INCOMPLETE",
-          stage: "stream"
+          stage: "stream",
+          retryable: false
         });
-      for (const [, tc] of pendingToolCalls.entries()) {
-        const fullArgs = tc.argumentChunks.join("");
-        let parsedInput = {};
-        let parseError;
-        try {
-          parsedInput = fullArgs.trim() ? JSON.parse(fullArgs) : {};
-        } catch {
-          parsedInput = { _raw: fullArgs };
-          parseError = true;
+      const final = toCanonical(terminal.output, origin);
+      const usage = this.toUsage(terminal.usage);
+      for (const [outputIndex, item] of items) {
+        const ended = terminal.output[outputIndex];
+        if (!item.done || !ended || itemIdentity(item.done) !== itemIdentity(ended))
+          invalid("Responses final Items do not match completed stream Items");
+        if (ended.type === "function_call" && (item.arguments && item.arguments !== ended.arguments || item.argumentDone !== void 0 && item.argumentDone !== ended.arguments))
+          invalid("Responses final function arguments do not match stream");
+        for (const [contentIndex, part] of item.text) {
+          const endedPart = ended.content?.[contentIndex];
+          if (endedPart?.type !== part.type || (part.type === "refusal" ? endedPart.refusal : endedPart.text) !== part.value)
+            invalid("Responses final text does not match stream");
         }
-        yield {
-          type: "tool_call_finish",
-          id: tc.id,
-          name: tc.name,
-          input: parsedInput,
-          parseError
-        };
+        for (const [summaryIndex, summary] of item.summaries)
+          if (ended.summary?.[summaryIndex]?.text !== summary)
+            invalid("Responses final summary does not match stream");
       }
-      const durationMs = Date.now() - requestStartTime;
-      yield { type: "message_stop", usage, ttftMs, durationMs, finishReason };
+      for (const blockId of summariesOpen) yield { type: "thinking_block_stop", blockId };
+      for (const [outputIndex, item] of terminal.output.entries()) {
+        if (item.type === "message")
+          for (const [contentIndex, part] of item.content.entries()) {
+            if (!items.get(outputIndex)?.text.has(contentIndex))
+              yield {
+                type: "text_delta",
+                text: part.type === "refusal" ? part.refusal : part.text
+              };
+          }
+        else if (item.type === "reasoning")
+          for (const [summaryIndex, part] of item.summary.entries()) {
+            if (!items.get(outputIndex)?.summaries.has(summaryIndex) && part.text) {
+              const blockId = `${item.id}:${summaryIndex}`;
+              yield { type: "thinking_block_start", blockId };
+              yield { type: "thinking_delta", blockId, thinking: part.text };
+              yield { type: "thinking_block_stop", blockId };
+            }
+          }
+        else if (item.type === "function_call")
+          yield {
+            type: "tool_call_finish",
+            id: item.call_id,
+            name: item.name,
+            input: parseToolArguments(item.arguments)
+          };
+      }
+      yield {
+        type: "message_stop",
+        finishReason: final.toolCalls ? "tool_calls" : "stop",
+        finalContent: final.content,
+        ...final.refusal ? { refusal: true } : {},
+        ...usage ? { usage } : {},
+        ...firstToken !== void 0 ? { ttftMs: firstToken - started } : {},
+        durationMs: Date.now() - started
+      };
     } catch (error) {
-      if (error instanceof ModelError || req.signal?.aborted) throw error;
-      const transportCode = safeTransportCode(error);
-      throw new ModelError(
-        `Model response stream failed${transportCode ? ` (${transportCode})` : ""}`,
-        {
-          retryable: false,
-          code: "MODEL_STREAM_INTERRUPTED",
-          transportCode,
-          stage: "stream"
-        }
-      );
+      if (error instanceof ModelError || request.signal?.aborted) throw error;
+      throw new ModelError("Responses stream was interrupted", {
+        code: "MODEL_STREAM_INTERRUPTED",
+        stage: "stream",
+        retryable: false,
+        transportCode: safeTransportCode(error)
+      });
     } finally {
-      req.signal?.removeEventListener("abort", onOuterAbort);
+      close();
     }
   }
+  /** 保持消息级 canonical tool 落盘，Responses function_call_output 仅存在于请求投影。 */
   assembleToolResults(results) {
-    return results.map((r) => ({
-      role: "tool",
-      content: [r],
-      timestamp: Date.now()
-    }));
+    return assembleCanonicalToolResults(results);
   }
-  /** 将历史投影为协议消息；兼容端点完整回传思考片段，普通端点不发送该扩展字段。 */
-  translateMessagesToWire(messages, systemPrompt) {
-    const wire = [];
-    if (systemPrompt?.trim()) {
-      wire.push({ role: "system", content: systemPrompt.trim() });
-    }
-    for (const msg of messages) {
-      if (msg.role === "system") {
-        const text = msg.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
-        if (text) wire.push({ role: "system", content: text });
-      } else if (msg.role === "user") {
-        const text = msg.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
-        const previous = wire[wire.length - 1];
-        if (previous?.role === "user" && typeof previous.content === "string") {
-          previous.content = [previous.content, text].filter(Boolean).join("\n\n");
-        } else {
-          wire.push({ role: "user", content: text });
-        }
-      } else if (msg.role === "assistant") {
-        const text = msg.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
-        const toolCalls = [];
-        for (const block of msg.content) {
-          if (block.type === "tool_use") {
-            toolCalls.push({
-              id: block.id,
-              type: "function",
-              function: {
-                name: block.name,
-                arguments: JSON.stringify(block.input)
-              }
-            });
-          }
-        }
-        if (!text && toolCalls.length === 0) continue;
-        wire.push({
-          role: "assistant",
-          content: text || (this.replayReasoningContent ? "" : null),
-          ...this.replayReasoningContent ? {
-            reasoning_content: msg.content.filter((block) => block.type === "thinking").map((block) => block.thinking).join("")
-          } : {},
-          tool_calls: toolCalls.length > 0 ? toolCalls : void 0
-        });
-      } else if (msg.role === "tool") {
-        for (const block of msg.content) {
-          if (block.type === "tool_result") {
-            wire.push({
-              role: "tool",
-              tool_call_id: block.toolUseId,
-              content: block.content
-            });
-          }
-        }
-      }
-    }
-    return wire;
+  /** 服务端错误仅保留明确标识，不回显请求、输出正文、签名或加密 reasoning。 */
+  throwWireError(error) {
+    const detail = {
+      stage: "stream",
+      retryable: false,
+      providerCode: typeof error.code === "string" ? error.code : void 0,
+      providerType: typeof error.type === "string" && error.type !== "error" ? error.type : void 0
+    };
+    if (isContextOverflow(error)) throw new ContextOverflowError(400, detail);
+    throw new ModelError("Responses API reported an error", detail);
+  }
+  /** 只接受真实且合法的计数；缺失 usage 保持未知，推理 token 已包含在 output_tokens 中。 */
+  toUsage(value) {
+    if (value === void 0 || value === null) return void 0;
+    if (![value.input_tokens, value.output_tokens, value.total_tokens].every(index))
+      invalid("Invalid Responses usage");
+    const cached = value.input_tokens_details?.cached_tokens;
+    if (cached !== void 0 && (!index(cached) || cached > value.input_tokens))
+      invalid("Invalid Responses cached usage");
+    return {
+      promptTokens: value.input_tokens,
+      completionTokens: value.output_tokens,
+      totalTokens: value.total_tokens,
+      ...cached !== void 0 ? { cachedPromptTokens: cached } : {}
+    };
   }
 };
 
@@ -4836,7 +6145,9 @@ var JSONLMessageStore = class {
       import_node_fs11.default.mkdirSync(dir, { recursive: true });
     }
   }
+  /** 校验协议内容后追加一行 JSON；不补身份、不查重、不 fsync。 */
   async append(message) {
+    validateProtocolContent(message.content);
     const record = {
       ts: message.timestamp ?? Date.now(),
       role: message.role,
@@ -4848,6 +6159,7 @@ var JSONLMessageStore = class {
     import_node_fs11.default.appendFileSync(this.filePath, `${JSON.stringify(record)}
 `, "utf-8");
   }
+  /** 读取全部消息；半截损坏行忽略，悬挂 tool_use 就地补 OUTCOME_UNKNOWN 结果。 */
   async load() {
     if (!import_node_fs11.default.existsSync(this.filePath)) {
       return [];
@@ -4861,6 +6173,7 @@ var JSONLMessageStore = class {
       try {
         const record = JSON.parse(trimmed);
         if (record.role && record.content) {
+          validateProtocolContent(record.content);
           messages.push({
             role: record.role,
             content: record.content,
@@ -4870,12 +6183,14 @@ var JSONLMessageStore = class {
             state: record.state
           });
         }
-      } catch {
+      } catch (error) {
+        if (error instanceof ModelError) throw error;
       }
     }
     this.healDanglingToolCalls(messages);
     return messages;
   }
+  /** 删除整个文件；文件不存在时静默成功。 */
   async clear() {
     if (import_node_fs11.default.existsSync(this.filePath)) {
       import_node_fs11.default.unlinkSync(this.filePath);
@@ -4956,6 +6271,7 @@ var PromptAssembler = class {
     this.instructionSources = options.instructionSources ?? [];
     this.visibleTools = options.visibleTools;
   }
+  /** 按固定层级拼装系统提示词；同一选项集总是产出相同文本，便于审计与缓存。 */
   assemble() {
     const sections = [];
     sections.push(this.getL1Behavior());
@@ -4969,7 +6285,7 @@ var PromptAssembler = class {
     if (this.instructionSources.length > 0) {
       sections.push(
         `# L4 Project Instructions
-${this.instructionSources.map((source, index) => `## ${index + 1}. ${source.path}
+${this.instructionSources.map((source, index2) => `## ${index2 + 1}. ${source.path}
 ${source.content}`).join("\n\n")}`
       );
     }
@@ -5009,6 +6325,7 @@ Follow these key behavioral rules:
 var AgentLoop = class {
   interactionId;
   modelId;
+  modelRole;
   projectHistory;
   prepareRequest;
   onUsage;
@@ -5028,6 +6345,7 @@ var AgentLoop = class {
   constructor(options) {
     this.interactionId = options.interactionId;
     this.modelId = options.modelId;
+    this.modelRole = options.modelRole;
     this.projectHistory = options.projectHistory;
     this.prepareRequest = options.prepareRequest;
     this.onUsage = options.onUsage;
@@ -5045,6 +6363,14 @@ var AgentLoop = class {
     this.getMode = options.getMode ?? (() => "Approval");
     this.permissionRules = options.permissionRules ?? [];
   }
+  /**
+   * 执行一次交互并流式产出事件。
+   *
+   * 语义要点：
+   * - message_stop 携带完整 canonical 消息，是唯一落盘来源；text / thinking 增量仅供展示。
+   * - 模型失败以 error + turn_finish 事件收尾并结束 run（不抛出）；用户中止抛 AbortError。
+   * - turn_start / turn_finish 严格配对，错误、熔断与步数耗尽路径均保证收口。
+   */
   async *run(history) {
     let step = 0;
     let consecutiveErrors = 0;
@@ -5063,7 +6389,8 @@ var AgentLoop = class {
         tools: visibleTools(this.tools.list(), this.getMode(), this.permissionRules).map(
           toToolDefinition
         ),
-        signal: this.signal
+        signal: this.signal,
+        context: this.runId ? { runId: this.runId, modelId: this.modelId } : void 0
       };
       const beforeModelHooks = this.hooks.get("model:before");
       const hookCtx = { signal: this.signal };
@@ -5083,6 +6410,10 @@ var AgentLoop = class {
       let accumulatedText = "";
       let accumulatedThinking = "";
       const toolCalls = [];
+      let finalContent;
+      let responseStopped = false;
+      let invalidToolArguments = false;
+      let refused = false;
       let turnUsage;
       let finishReason;
       let turnTtftMs;
@@ -5121,7 +6452,12 @@ var AgentLoop = class {
           try {
             for await (const event of this.provider.create(request)) {
               if (this.signal?.aborted) throw new AbortError();
-              if (event.type === "text_delta" || event.type === "thinking_delta" || event.type === "tool_call_start" || event.type === "tool_call_delta" || event.type === "tool_call_finish")
+              if (responseStopped)
+                throw new ModelError("Model emitted output after its stop event", {
+                  stage: "stream",
+                  retryable: false
+                });
+              if (event.type === "text_delta" || event.type === "thinking_delta" || event.type === "thinking_block_start" || event.type === "thinking_block_stop" || event.type === "message_stop" || event.type === "tool_call_start" || event.type === "tool_call_delta" || event.type === "tool_call_finish")
                 outputSeen = true;
               if (!firstTokenReceived && (event.type === "text_delta" || event.type === "thinking_delta" || event.type === "tool_call_start")) {
                 firstTokenReceived = true;
@@ -5142,8 +6478,11 @@ var AgentLoop = class {
                 yield { type: "text_delta", text: event.text };
               } else if (event.type === "thinking_delta") {
                 accumulatedThinking += event.thinking;
-                yield { type: "thinking_delta", thinking: event.thinking };
+                yield event;
+              } else if (event.type === "thinking_block_start" || event.type === "thinking_block_stop") {
+                yield event;
               } else if (event.type === "tool_call_finish") {
+                invalidToolArguments ||= event.parseError === true;
                 const toolUse = {
                   type: "tool_use",
                   id: event.id,
@@ -5153,6 +6492,10 @@ var AgentLoop = class {
                 };
                 toolCalls.push(toolUse);
               } else if (event.type === "message_stop") {
+                if (responseStopped) throw new ModelError("Duplicate response stop event");
+                responseStopped = true;
+                finalContent = event.finalContent ? structuredClone(event.finalContent) : void 0;
+                refused = event.refusal === true;
                 finishReason = event.finishReason;
                 turnUsage = event.usage;
                 if (event.usage)
@@ -5167,7 +6510,38 @@ var AgentLoop = class {
               }
             }
             if (this.signal?.aborted) throw new AbortError();
-            if (toolCalls.length && finishReason === "length")
+            if (!responseStopped)
+              throw new ModelError("Model response ended without a stop event", {
+                code: "MODEL_STREAM_INCOMPLETE",
+                stage: "stream",
+                retryable: false
+              });
+            if (finishReason !== void 0 && !["stop", "tool_calls", "length", "end_turn", "tool_use"].includes(finishReason))
+              throw new ModelError("Model response has an invalid stop reason", {
+                stage: "stream",
+                retryable: false
+              });
+            if (finalContent) {
+              validateProtocolContent(finalContent);
+              if (finalContent.some((block) => block.type === "tool_result"))
+                throw new ModelError("Assistant response cannot supply tool results", {
+                  stage: "stream",
+                  retryable: false
+                });
+              toolCalls.length = 0;
+              for (const block of finalContent)
+                if (block.type === "tool_use") {
+                  block.source = this.tools.get(block.name)?.metadata?.source;
+                  toolCalls.push(block);
+                }
+              accumulatedText = finalContent.filter((block) => block.type === "text").map((block) => block.text).join("");
+            }
+            if (finishReason !== void 0 && (["tool_calls", "tool_use"].includes(finishReason) && !toolCalls.length || ["stop", "end_turn"].includes(finishReason) && toolCalls.length))
+              throw new ModelError("Model stop reason does not match its tool content", {
+                stage: "stream",
+                retryable: false
+              });
+            if (invalidToolArguments || finishReason === "content_filter" || toolCalls.length && (finishReason === "length" || refused))
               throw new ModelError("Model tool call was truncated; no tools executed", {
                 code: "MODEL_INVALID_RESPONSE",
                 stage: "stream",
@@ -5179,7 +6553,13 @@ var AgentLoop = class {
               )
             );
             for (const call of toolCalls) {
-              if (!call.id || knownCalls.has(call.id))
+              if (!call.name?.trim() || !call.input || typeof call.input !== "object" || Array.isArray(call.input))
+                throw new ModelError("Invalid tool call arguments or name; no tools executed", {
+                  code: "MODEL_INVALID_RESPONSE",
+                  stage: "stream",
+                  retryable: false
+                });
+              if (!call.id?.trim() || knownCalls.has(call.id))
                 throw new ModelError("Duplicate tool call ID; no tools executed");
               knownCalls.add(call.id);
             }
@@ -5236,7 +6616,12 @@ var AgentLoop = class {
           error: modelError,
           modelError: describeModelError(
             modelError instanceof ModelError ? modelError : new ModelError(modelError.message, { stage: "request" }),
-            { modelId: this.modelId, provider: this.provider.name, operation: "primary" }
+            {
+              modelId: this.modelId,
+              modelRole: this.modelRole,
+              provider: this.provider.name,
+              operation: "primary"
+            }
           )
         };
         yield {
@@ -5273,16 +6658,14 @@ var AgentLoop = class {
           metadata: { usage: turnUsage, ttftMs: turnTtftMs }
         }
       };
-      const contentBlocks = [];
-      if (accumulatedThinking) {
+      const contentBlocks = finalContent ?? [];
+      if (!finalContent && accumulatedThinking) {
         contentBlocks.push({ type: "thinking", thinking: accumulatedThinking });
       }
-      if (accumulatedText) {
+      if (!finalContent && accumulatedText) {
         contentBlocks.push({ type: "text", text: accumulatedText });
       }
-      for (const tc of toolCalls) {
-        contentBlocks.push(tc);
-      }
+      if (!finalContent) contentBlocks.push(...toolCalls);
       const assistantMessage = {
         id: createMessageId(),
         interactionId: this.interactionId,
@@ -5291,7 +6674,49 @@ var AgentLoop = class {
         content: contentBlocks,
         timestamp: Date.now()
       };
+      validateProtocolContent(assistantMessage.content);
+      const originalContent = stableSerialize(assistantMessage.content);
+      const identity = stableSerialize({ ...assistantMessage, content: void 0 });
+      const originalTools = stableSerialize(
+        assistantMessage.content.filter(
+          (block) => block.type === "tool_use" || block.type === "tool_result"
+        )
+      );
+      const privateOutput = assistantMessage.content.some(
+        (block) => block.type === "provider_state" || block.type === "redacted_thinking" || block.type === "thinking" && Boolean(block.origin || block.signature)
+      );
       await this.hooks.emit("model:after", hookCtx, { message: assistantMessage });
+      if (identity !== stableSerialize({ ...assistantMessage, content: void 0 }))
+        throw new ModelError("Hook changed assistant message identity", {
+          stage: "request",
+          retryable: false
+        });
+      if (originalTools !== stableSerialize(
+        assistantMessage.content.filter(
+          (block) => block.type === "tool_use" || block.type === "tool_result"
+        )
+      ))
+        throw new ModelError("Hook changed validated tool model output", {
+          stage: "request",
+          retryable: false
+        });
+      if (originalContent !== stableSerialize(assistantMessage.content)) {
+        if (privateOutput || assistantMessage.content.some(
+          (block) => block.type === "provider_state" || block.type === "redacted_thinking" || block.type === "thinking" && Boolean(block.origin || block.signature)
+        ))
+          throw new ModelError("Hook changed signed or private model output", {
+            stage: "request",
+            retryable: false
+          });
+        if (toolCalls.length)
+          throw new ModelError("Hook changed validated tool model output", {
+            stage: "request",
+            retryable: false
+          });
+        for (const block of assistantMessage.content)
+          if (block.type === "text" || block.type === "tool_use") block.protocolMeta = void 0;
+      }
+      validateProtocolContent(assistantMessage.content);
       if (toolCalls.length === 0) {
         history.push(assistantMessage);
         yield {
@@ -5548,6 +6973,9 @@ var AgentSession = class {
   cleanupPromise;
   sessionEndFinished = false;
   activeRun = false;
+  primaryRole = "default";
+  lastPrimaryProfile;
+  lastPrimaryProvider;
   plugins = [];
   constructor(config) {
     this.persistentId = config.conversationId ?? createMessageId();
@@ -5585,6 +7013,7 @@ var AgentSession = class {
     this.auditRecoveryDirectory = config.auditRecoveryDirectory ?? sinks?.auditSink.directory;
     this.context = this.createContextManager();
   }
+  /** 幂等初始化：恢复审计残留、指令快照与持久历史，校验会话身份并回放 usage。 */
   async init() {
     if (this.initialized) return;
     if (this.auditRecoveryDirectory) {
@@ -5643,6 +7072,7 @@ var AgentSession = class {
     });
     this.initialized = true;
   }
+  /** 挂载插件并执行 setup；销毁后或运行中拒绝，setup 失败的插件不进入已装列表。 */
   async use(plugin) {
     if (this.destroyed) {
       throw new Error(`Cannot mount plugin '${plugin.name}': session already destroyed`);
@@ -5656,23 +7086,68 @@ var AgentSession = class {
     });
     this.plugins.push(plugin);
   }
+  /**
+   * 空闲时原子替换角色的模型绑定；本方法不改变当前角色或工具权限。
+   * @param profile 模型协议、请求目标和输出预算。
+   * @param role 被配置的主任务或摘要角色。
+   * @param provider 与目标匹配的适配器；省略时只允许复用相同目标。
+   * @throws {ModelError} 协议、模型、端点或 workspace 与适配器错配，旧绑定保留。
+   * @throws {SessionBusyError} 正在执行或清理当前任务。
+   */
   switchModel(profile, role = "default", provider) {
     this.assertIdle("switch models");
     resolveContextWindow(profile.contextWindow);
+    createContextBudget(profile.contextWindow, profile.maxOutputTokens);
     if (!provider) {
+      const current = this.router.getProfile(role);
+      if (current.provider !== profile.provider || current.modelName !== profile.modelName || current.baseURL.replace(/\/+$/, "") !== profile.baseURL.replace(/\/+$/, "") || current.anthropicWorkspaceId !== profile.anthropicWorkspaceId)
+        throw new ModelError("Changing a model binding requires a matching provider", {
+          stage: "request",
+          retryable: false
+        });
       provider = this.router.resolve(role);
     }
     this.router.setRole(role, profile, provider);
+    this.lastPrimaryProfile = void 0;
+    this.lastPrimaryProvider = void 0;
     this.context.invalidate();
     this.logger?.(`Switched model for role [${role}] to ${profile.name} (${profile.modelName})`);
   }
-  getActiveProfile(role = "default") {
+  /** 查询指定绑定或当前明确选择的主任务模型，返回独立配置副本。 */
+  getActiveProfile(role = this.primaryRole) {
     return this.router.getProfile(role);
   }
+  /** 空闲时显式选择场景；缺少映射或凭据时拒绝，不回退默认模型、不修改权限。 */
+  selectModelRole(role) {
+    this.assertIdle("select model role");
+    this.resolvePrimaryBinding(role);
+    this.primaryRole = role;
+    this.lastPrimaryProfile = void 0;
+    this.lastPrimaryProvider = void 0;
+    this.context.invalidate();
+  }
+  /** 返回本进程明确选择的场景，历史恢复不改变此状态。 */
+  getModelRole() {
+    return this.primaryRole;
+  }
+  /** 严格解析主任务快照，在输入落盘与网络调用之前检查角色、凭据与预算。 */
+  resolvePrimaryBinding(role) {
+    if (!["default", "planning", "execution", "fast"].includes(role))
+      throw new ModelError("Invalid primary model role", { stage: "request", retryable: false });
+    const binding = this.router.getBinding(role, true);
+    createContextBudget(binding.profile.contextWindow, binding.profile.maxOutputTokens);
+    if (binding.provider.credentialsReady === false)
+      throw new ModelError(`Model role '${role}' requires credentials`, {
+        stage: "request",
+        retryable: false
+      });
+    return binding;
+  }
   /** 只在空闲时切换本次会话模式；宿主负责 FullAccess 的显式选择交互。 */
   switchMode(mode) {
     this.assertIdle("switch permission mode");
     this.mode = mode;
+    this.context.invalidate();
   }
   getMode() {
     return this.mode;
@@ -5696,7 +7171,11 @@ var AgentSession = class {
   /** 查询最近最终请求的预算快照，尚未准备请求时返回 undefined。 */
   getContextSnapshot() {
     const snapshot = this.context.getSnapshot();
-    if (snapshot || !this.initialized) return snapshot;
+    const profile = this.lastPrimaryProfile ?? this.getActiveProfile();
+    if (snapshot && !snapshot.stale && snapshot.modelId === profile.id || !this.initialized)
+      return snapshot;
+    const provider = this.lastPrimaryProvider ?? this.router.resolve(this.primaryRole);
+    const history = this.context.project(this.history);
     const assembler = new PromptAssembler({
       rootDir: this.rootDir,
       tools: this.tools,
@@ -5708,14 +7187,14 @@ var AgentSession = class {
       this.history,
       {
         systemPrompt: assembler.assemble(),
-        messages: this.context.project(this.history),
+        messages: provider.binding ? projectProtocolHistory(history, provider.binding) : history,
         tools: visibleTools(this.tools.list(), this.mode, this.permissionRules).map((t) => ({
           name: t.name,
           description: t.description,
           parameters: t.parameters
         }))
       },
-      this.router.getProfile("default")
+      profile
     );
   }
   /** 执行中止后的工具/摘要与存储收口期间仍返回 true。 */
@@ -5732,11 +7211,11 @@ var AgentSession = class {
       contextSnapshot: this.getContextSnapshot(),
       totalTurns: this.totalTurns,
       totalTokens: { ...this.usageStats },
-      activeModel: this.router.getProfile("default").name,
+      activeModel: (this.lastPrimaryProfile ?? this.getActiveProfile()).name,
       loadedToolsCount: this.tools.list().length,
       lastMetrics: this.lastMetrics,
       lastRunMetrics: this.lastRunMetrics,
-      contextUsage: this.lastRunMetrics?.contextUsage ?? this.createContextUsage()
+      contextUsage: this.lastPrimaryProfile ? this.lastRunMetrics?.contextUsage ?? this.createContextUsage() : this.createContextUsage()
     });
   }
   /** 返回最近请求指标的独立副本；尚无完成请求时返回 undefined。 */
@@ -5747,6 +7226,7 @@ var AgentSession = class {
   getLastRunMetrics() {
     return this.lastRunMetrics ? structuredClone(this.lastRunMetrics) : void 0;
   }
+  /** 空闲时清空存储与全部内存状态；conversationId 不变，恢复语义等同全新会话。 */
   async reset() {
     this.assertIdle("reset session");
     if (this.store) await this.store.clear();
@@ -5756,6 +7236,8 @@ var AgentSession = class {
     this.usageStats = { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
     this.lastMetrics = void 0;
     this.lastRunMetrics = void 0;
+    this.lastPrimaryProfile = void 0;
+    this.lastPrimaryProvider = void 0;
     this.accountedAttempts.clear();
     this.usageKnown = true;
     this.summaryAttempts.clear();
@@ -5771,20 +7253,24 @@ var AgentSession = class {
    * {@link SessionEvent}，分别完成展示、交互和中止控制。
    *
    * @param userInput 用户本轮输入。
-   * @param options 可选的中止信号。
+   * @param options 可选中止信号与显式主任务角色；角色在整个工具任务内固定。
    * @returns 文本、思考、工具、指标和错误等结构化事件的异步流。
    * @throws {SessionBusyError} 当前会话已有正在执行的 run 时抛出。
+   * @throws {ModelError} 显式角色缺少绑定或凭据时，在输入落盘和网络调用前抛出。
    */
   run(userInput, options) {
     return cancellableGenerator(
-      (signal) => this.runOperation(userInput, { signal }),
+      (signal) => this.runOperation(userInput, { signal, role: options?.role }),
       options?.signal
     );
   }
   /** 单次任务执行主体；调用方 return 的中止与 finally 清理由外层统一协调。 */
   async *runOperation(userInput, options) {
     this.assertIdle("start another run");
-    resolveContextWindow(this.router.getProfile("default").contextWindow);
+    const role = options?.role ?? this.primaryRole;
+    const { profile, provider } = this.resolvePrimaryBinding(role);
+    this.lastPrimaryProfile = profile;
+    this.lastPrimaryProvider = provider;
     this.activeRun = true;
     const runId = createLogId();
     const runStartTime = Date.now();
@@ -5838,7 +7324,8 @@ var AgentSession = class {
         level: "info",
         event: "run.started",
         sessionId: this.sessionId,
-        runId
+        runId,
+        fields: { modelId: profile.id, modelRole: role }
       });
       try {
         this.instructionSnapshot = loadInstructions({
@@ -5864,7 +7351,8 @@ var AgentSession = class {
           runId,
           runtimeSessionId: this.sessionId,
           gitBranch: currentProject.gitWorktree ? currentProject.gitBranch : this.gitBranch,
-          modelId: this.router.getProfile("default").id
+          modelId: profile.id,
+          modelRole: role
         });
       }
       runStarted = true;
@@ -5888,6 +7376,8 @@ var AgentSession = class {
         visibleTools: visibleTools(this.tools.list(), this.mode, this.permissionRules)
       });
       const assembledSystemPrompt = promptAssembler.assemble();
+      let previousRequest;
+      let environmentAnchorId = userMessage.id;
       const executor = new ToolExecutor({
         tools: this.tools,
         hooks: this.hooks,
@@ -5904,12 +7394,20 @@ var AgentSession = class {
       });
       const loop = new AgentLoop({
         interactionId: runId,
-        modelId: this.router.getProfile("default").id,
+        modelId: profile.id,
+        modelRole: role,
         projectHistory: (history) => this.context.project(history),
         prepareRequest: (request, history, reason) => {
           const dynamicId = `environment-${runId}`;
           const messages = request.messages.filter((message) => message.id !== dynamicId);
-          messages.push({
+          let anchor = messages.findIndex(
+            (message) => message.id === environmentAnchorId || message.interactionId === runId && message.role === "user"
+          );
+          if (anchor < 0 && !previousRequest) {
+            anchor = messages.map((message) => message.role).lastIndexOf("user");
+            if (anchor >= 0) environmentAnchorId = messages[anchor].id;
+          }
+          messages.splice(anchor < 0 ? messages.length : anchor + 1, 0, {
             id: dynamicId,
             role: "user",
             content: [
@@ -5920,16 +7418,82 @@ var AgentSession = class {
             ],
             timestamp: runStartTime
           });
-          const context = this.context;
-          const preparation = context.prepare(
-            history,
-            { ...request, messages },
-            this.router.getProfile("default"),
+          const nativeBinding = provider.binding;
+          const projected = nativeBinding ? projectProtocolHistory(messages, nativeBinding, { runId, modelId: profile.id }) : structuredClone(messages);
+          const sourceView = nativeBinding ? projectProtocolHistory(this.context.project(history), nativeBinding, {
             runId,
-            reason
+            modelId: profile.id
+          }) : this.context.project(history);
+          for (const message of projected) {
+            const original = sourceView.find((source) => source.id === message.id);
+            const privateBag = /* @__PURE__ */ new Map();
+            const blockBag = /* @__PURE__ */ new Map();
+            for (const block of original?.content ?? []) {
+              const serialized = stableSerialize(block);
+              if (block.type === "provider_state" || block.type === "redacted_thinking" || block.type === "thinking" && block.origin)
+                privateBag.set(serialized, (privateBag.get(serialized) ?? 0) + 1);
+              blockBag.set(serialized, (blockBag.get(serialized) ?? 0) + 1);
+            }
+            const take = (bag, serialized) => {
+              const count = bag.get(serialized) ?? 0;
+              if (!count) return false;
+              if (count === 1) bag.delete(serialized);
+              else bag.set(serialized, count - 1);
+              return true;
+            };
+            for (const block of message.content) {
+              if (block.type === "provider_state" || block.type === "redacted_thinking" || block.type === "thinking" && block.origin) {
+                if (!original || !take(privateBag, stableSerialize(block)))
+                  throw new ModelError("Hook changed signed or private request provenance", {
+                    stage: "request",
+                    retryable: false
+                  });
+              }
+              if (block.type !== "text" && block.type !== "tool_use") continue;
+              if (block.protocolMeta && !take(blockBag, stableSerialize(block)))
+                block.protocolMeta = void 0;
+            }
+          }
+          const frozen = Boolean(
+            previousRequest && history.some(
+              (message) => message.interactionId === runId && message.content.some(
+                (block) => block.type === "provider_state" || block.type === "redacted_thinking" || block.type === "thinking" && Boolean(block.signature && block.origin?.runId === runId)
+              )
+            )
           );
+          const candidate = {
+            ...request,
+            messages: projected,
+            context: { runId, modelId: profile.id },
+            signal: options?.signal
+          };
+          if (frozen) {
+            const generated = nativeBinding ? projectProtocolHistory(
+              this.context.project(history).filter(
+                (message) => message.interactionId === runId && message.role !== "user"
+              ),
+              nativeBinding,
+              candidate.context
+            ) : [];
+            for (const original of generated) {
+              const matches = candidate.messages.filter((message) => message.id === original.id);
+              if (matches.length !== 1 || stableSerialize(matches[0]) !== stableSerialize(original))
+                throw new ModelError("Signed continuation prefix or tool chain changed", {
+                  stage: "request",
+                  retryable: false
+                });
+            }
+          }
+          if (frozen && previousRequest && (stableSerialize(candidate.messages.slice(0, previousRequest.messages.length)) !== stableSerialize(previousRequest.messages) || candidate.systemPrompt !== previousRequest.systemPrompt || stableSerialize(candidate.tools) !== stableSerialize(previousRequest.tools)))
+            throw new ModelError("Signed continuation prefix changed", {
+              stage: "request",
+              retryable: false
+            });
+          const context = this.context;
+          const preparation = context.prepare(history, candidate, profile, runId, reason, !frozen);
           return (async function* () {
             const prepared = yield* preparation;
+            previousRequest = structuredClone({ ...prepared, signal: void 0 });
             lastPromptTokens = void 0;
             lastEstimatedPromptTokens = context.getSnapshot()?.estimate.total;
             return prepared;
@@ -5942,13 +7506,14 @@ var AgentSession = class {
             await this.store.appendRecord("usage", {
               attemptId,
               role: "primary",
-              modelId: this.router.getProfile("default").id,
+              modelId: profile.id,
+              modelRole: role,
               usage: { ...usage }
             });
           this.accountUsage(attemptId, usage);
-          this.context.observe(request, usage, this.router.getProfile("default"));
+          this.context.observe(request, usage, profile);
         },
-        provider: this.router.resolve("default"),
+        provider,
         executor,
         tools: this.tools,
         hooks: this.hooks,
@@ -6002,8 +7567,9 @@ var AgentSession = class {
             runStatus = "failed";
             modelFailure = event.modelError ?? (event.error instanceof ModelError ? describeModelError(event.error, {
               operation: "primary",
-              modelId: this.router.getProfile("default").id,
-              provider: this.router.resolve("default").name
+              modelId: profile.id,
+              modelRole: role,
+              provider: provider.name
             }) : void 0);
           }
           if (event.type === "message_stop" && event.message.content.some((block) => block.type === "tool_use")) {
@@ -6076,8 +7642,9 @@ var AgentSession = class {
       if (error instanceof ModelError)
         modelFailure = describeModelError(error, {
           operation: "primary",
-          modelId: this.router.getProfile("default").id,
-          provider: this.router.resolve("default").name
+          modelId: profile.id,
+          modelRole: role,
+          provider: provider.name
         });
       const status = error instanceof AbortError || options?.signal?.aborted ? "aborted" : "failed";
       const metrics = finalizeRun(status);
@@ -6115,6 +7682,7 @@ var AgentSession = class {
       }
     }
   }
+  /** 幂等销毁：卸载插件后发出 session:end；运行中拒绝，teardown 失败聚合抛出且不完成销毁。 */
   async destroy() {
     if (this.destroyed) return;
     if (this.activeRun) throw new SessionBusyError("destroy session");
@@ -6153,7 +7721,9 @@ var AgentSession = class {
    * run 累计 promptTokens 会重复计算每一步都重发的历史，不能用于窗口占用率。
    */
   createContextUsage(usedTokens, estimatedUsage = false) {
-    const contextWindow = resolveContextWindow(this.router.getProfile("default").contextWindow);
+    const contextWindow = resolveContextWindow(
+      (this.lastPrimaryProfile ?? this.getActiveProfile()).contextWindow
+    );
     return {
       usedTokens,
       limitTokens: contextWindow.tokens,
@@ -6202,12 +7772,19 @@ var AgentSession = class {
   compact(options) {
     return cancellableGenerator((signal) => this.compactOperation({ signal }), options?.signal);
   }
-  /** 手动压缩执行主体，接收由消费者生命周期拥有的中止信号。 */
+  /** 手动压缩按主任务协议投影旧历史，不复用旧 run 私有状态；原始历史与落盘内容保持不变。 */
   async *compactOperation(options) {
     this.assertIdle("compact context");
     this.activeRun = true;
     try {
       if (!this.initialized) await this.init();
+      const profile = this.lastPrimaryProfile ?? this.getActiveProfile();
+      const messages = projectProtocolHistory(this.context.project(this.history), {
+        protocol: profile.provider,
+        modelName: profile.modelName,
+        baseURL: profile.baseURL,
+        workspaceId: profile.anthropicWorkspaceId
+      });
       const assembler = new PromptAssembler({
         rootDir: this.rootDir,
         tools: this.tools,
@@ -6219,7 +7796,7 @@ var AgentSession = class {
         this.history,
         {
           systemPrompt: assembler.assemble(),
-          messages: this.context.project(this.history),
+          messages,
           signal: options?.signal,
           tools: visibleTools(this.tools.list(), this.mode, this.permissionRules).map((t) => ({
             name: t.name,
@@ -6227,7 +7804,7 @@ var AgentSession = class {
             parameters: t.parameters
           }))
         },
-        this.router.getProfile("default"),
+        profile,
         void 0,
         "manual"
       )) {
@@ -6238,7 +7815,7 @@ var AgentSession = class {
       this.activeRun = false;
     }
   }
-  /** 以模型 attempt 身份幂等累加真实消耗；非法或缺失 usage 保持未知。 */
+  /** 压缩与预算超限事件写入操作日志并携带 runId；其他事件不落日志。 */
   async logContextEvent(event, runId) {
     if (event.type !== "compaction_start" && event.type !== "compaction_finish" && event.type !== "compaction_failed" && event.type !== "context_budget_exceeded")
       return;
@@ -6281,6 +7858,7 @@ var AgentSession = class {
     if (!this.store) return;
     for (const message of messages) await this.store.append(message);
   }
+  /** 中止时为缓冲 assistant 的每个 tool_use 生成 OUTCOME_UNKNOWN 结果并入历史，保持事务闭合。 */
   closeInterruptedToolCalls(assistantEvent, error) {
     const message = {
       id: createMessageId(),
@@ -6302,6 +7880,7 @@ var AgentSession = class {
     this.history.push(message);
     return [message];
   }
+  /** 收集历史中紧跟该 assistant 的连续 tool 消息；仅当覆盖全部 tool_use 时视为已闭合。 */
   findClosedToolMessages(assistantEvent) {
     const assistantIndex = this.history.lastIndexOf(assistantEvent.message);
     if (assistantIndex < 0) return [];
@@ -6309,8 +7888,8 @@ var AgentSession = class {
       assistantEvent.message.content.filter((block) => block.type === "tool_use").map((toolUse) => toolUse.id)
     );
     const messages = [];
-    for (let index = assistantIndex + 1; index < this.history.length; index++) {
-      const message = this.history[index];
+    for (let index2 = assistantIndex + 1; index2 < this.history.length; index2++) {
+      const message = this.history[index2];
       if (message.role !== "tool") break;
       messages.push(message);
       for (const block of message.content) {
@@ -6325,6 +7904,7 @@ var AgentSession = class {
   AbortError,
   AgentLoop,
   AgentSession,
+  AnthropicProvider,
   ContextBudgetError,
   ContextManager,
   ContextOverflowError,
@@ -6337,6 +7917,7 @@ var AgentSession = class {
   KapibalaError,
   ModelError,
   OpenAICompatibleProvider,
+  OpenAIResponsesProvider,
   PathSandbox,
   PermissionPolicy,
   PromptAssembler,
@@ -6356,6 +7937,7 @@ var AgentSession = class {
   ToolRegistry,
   TransportError,
   UnicodeTokenEstimator,
+  assembleCanonicalToolResults,
   builtinTools,
   classifyBashOutput,
   cleanupCommandResults,
@@ -6395,6 +7977,7 @@ var AgentSession = class {
   supportsSessionState,
   toToolDefinition,
   truncateToolOutput,
+  validateModelBinding,
   validatePermissionRules,
   validateSummary,
   visibleTools,