@lqc123qwe/car-runtime 1.4.0 → 1.6.0

package/test/s35-config-ts-zod.spec.ts

@@ -0,0 +1,145 @@
+/**
+ * 1.5-S3 · 配置完整形态（S35）：car.config.ts + zod（D-22）
+ *
+ * 覆盖：
+ *  - zod 校验层 JSON 键位兼容（存量锚点）：未知键 fail-visible（llm.temperature）/ 类型错
+ *    （llm.maxTokens 必须为正整数）/ sandbox 扁平渲染 / 坏 JSON / 顶层非对象
+ *  - car.config.ts 载体：发现序 ts > json（并存 = ts 胜出）/ 显式 --config *.ts /
+ *    未预热显式报错（禁静默回退 json）/ epoch 缓存击穿（热改重预热取新内容）
+ *  - TS 形态校验：缺 default export / 非 object default / 坏 TS（Node 不支持时引导文案）
+ *  - mcp url/headers 键位经 zod（s34 锚点：恰好其一 / http(s) URL / 通道专属键）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { loadCarConfig, warmCarConfig } from '../src/load/config.ts'
+import { mergeSignatureGate, mergeLlmConfig } from '../src/load/config.ts'
+
+function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), `car-s35-${name}-`))
+  try {
+    const r = fn(dir)
+    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
+    if (r instanceof Promise) return r.finally(cleanup)
+    cleanup()
+    return Promise.resolve()
+  } catch (e) {
+    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
+    throw e
+  }
+}
+
+// ==================== zod 校验层（JSON 键位兼容） ====================
+
+test('S35: zod 校验层——存量锚点全过（未知键/类型错/坏 JSON/顶层非对象/扁平渲染）', () => {
+  withTempDir('zod-compat', dir => {
+    // s31 锚点：未知键 llm.temperature / maxTokens 类型错
+    writeFileSync(join(dir, 'a.json'), JSON.stringify({ llm: { temperature: 0.7 } }))
+    assert.match(loadCarConfig({ explicitPath: join(dir, 'a.json') }).error!, /未知键 llm\.temperature/)
+    writeFileSync(join(dir, 'b.json'), JSON.stringify({ llm: { maxTokens: 1.5 } }))
+    assert.match(loadCarConfig({ explicitPath: join(dir, 'b.json') }).error!, /llm\.maxTokens 必须为正整数/)
+    // 坏 JSON / 顶层非对象（CAR-E-CONFIG 前缀）
+    writeFileSync(join(dir, 'c.json'), '{ sandbox: {')
+    assert.match(loadCarConfig({ explicitPath: join(dir, 'c.json') }).error!, /CAR-E-CONFIG/)
+    writeFileSync(join(dir, 'd.json'), '[]')
+    assert.match(loadCarConfig({ explicitPath: join(dir, 'd.json') }).error!, /CAR-E-CONFIG/)
+    // 未知顶层键 / 未知嵌套键（unrecognized_keys 渲染）
+    writeFileSync(join(dir, 'e.json'), JSON.stringify({ plugins: [] }))
+    assert.match(loadCarConfig({ explicitPath: join(dir, 'e.json') }).error!, /未知顶层键 "plugins"/)
+    writeFileSync(join(dir, 'f.json'), JSON.stringify({ sandbox: { unsigned: { allow: true, extra: 1 } } }))
+    assert.match(loadCarConfig({ explicitPath: join(dir, 'f.json') }).error!, /未知键 sandbox\.unsigned\.extra/)
+    // 有效配置：扁平渲染（mergeSignatureGate 消费形态不变，s26 锚点）
+    writeFileSync(join(dir, 'g.json'), JSON.stringify({ sandbox: { unsigned: { allow: true }, sig: { enforce: true, trustRoot: 'PUBKEY' } }, llm: { baseUrl: 'https://x/v1', model: 'm' } }))
+    const ok = loadCarConfig({ explicitPath: join(dir, 'g.json') })
+    assert.equal(ok.error, undefined)
+    assert.deepEqual(ok.config.sandbox, { unsignedAllow: true, sigEnforce: true, sigTrustRoot: 'PUBKEY' })
+    assert.deepEqual(ok.config.llm, { baseUrl: 'https://x/v1', model: 'm' })
+    // mcp url/headers 键位经 zod（s34 锚点）
+    writeFileSync(join(dir, 'h.json'), JSON.stringify({ mcp: { servers: { a: { command: 'node', url: 'https://x' } } } }))
+    assert.match(loadCarConfig({ explicitPath: join(dir, 'h.json') }).error!, /恰好其一/)
+    writeFileSync(join(dir, 'i.json'), JSON.stringify({ mcp: { servers: { a: { command: 'node', headers: { h: 'v' } } } } }))
+    assert.match(loadCarConfig({ explicitPath: join(dir, 'i.json') }).error!, /headers 仅远程通道/)
+    writeFileSync(join(dir, 'j.json'), JSON.stringify({ mcp: { servers: { a: { url: 'https://x/mcp', headers: { authorization: 'Bearer ${T}' } } } } }))
+    const ok2 = loadCarConfig({ explicitPath: join(dir, 'j.json') })
+    assert.equal(ok2.error, undefined)
+    assert.deepEqual(ok2.config.mcp?.servers?.a, { url: 'https://x/mcp', headers: { authorization: 'Bearer ${T}' } })
+  })
+})
+
+// ==================== car.config.ts 载体 ====================
+
+test('S35: car.config.ts 载体——发现序 ts > json（并存 ts 胜出）+ 显式 --config *.ts + merge 全链', async () => {
+  await withTempDir('ts-carrier', async dir => {
+    writeFileSync(join(dir, 'car.config.ts'), `export default {\n  llm: { baseUrl: 'https://ts.example/v1', model: 'ts-model', maxTokens: 512 },\n  mcp: { servers: { remote: { url: 'https://mcp.example/mcp' } } },\n}\n`)
+    writeFileSync(join(dir, 'car.config.json'), JSON.stringify({ llm: { baseUrl: 'https://json.example/v1', model: 'json-model' } }))
+    await warmCarConfig({ cwd: dir })
+    const r = loadCarConfig({ cwd: dir })
+    assert.equal(r.error, undefined)
+    assert.match(r.path!, /car\.config\.ts$/, '发现序 ts > json：并存时 ts 胜出')
+    assert.equal(r.config.llm?.baseUrl, 'https://ts.example/v1')
+    assert.deepEqual(r.config.mcp?.servers?.remote, { url: 'https://mcp.example/mcp' }, 'ts 载体携带 1.5 新键位')
+    // merge 全链（D-16 优先级）不变
+    const merged = mergeLlmConfig({}, r.config)
+    assert.equal(merged.model, 'ts-model')
+    assert.equal(merged.maxTokens, 512)
+    // 显式 --config *.ts
+    await warmCarConfig({ explicitPath: join(dir, 'car.config.ts'), cwd: dir })
+    const r2 = loadCarConfig({ explicitPath: join(dir, 'car.config.ts'), cwd: dir })
+    assert.equal(r2.error, undefined)
+    assert.equal(r2.config.llm?.model, 'ts-model')
+    // 纯 json 目录不受影响（回归口径：无 ts 载体 = 原行为）
+    await withTempDir('json-only', async dir2 => {
+      writeFileSync(join(dir2, 'car.config.json'), JSON.stringify({ sandbox: { sig: { enforce: true } } }))
+      const r3 = loadCarConfig({ cwd: dir2 })
+      assert.equal(r3.error, undefined)
+      assert.equal(mergeSignatureGate({}, r3.config).mode, 'enforce')
+    })
+  })
+})
+
+test('S35: car.config.ts 未预热显式报错（禁静默回退 json）+ epoch 缓存击穿（热改重预热取新内容）', async () => {
+  await withTempDir('warm-protocol', async dir => {
+    writeFileSync(join(dir, 'car.config.ts'), `export default { llm: { model: 'v1' } }\n`)
+    writeFileSync(join(dir, 'car.config.json'), JSON.stringify({ llm: { model: 'json-fallback' } }))
+    // 未预热：显式报错（不静默回退 json——「配置写了但不生效」漂移面显式化）
+    const cold = loadCarConfig({ cwd: dir })
+    assert.match(cold.error!, /car\.config\.ts 未预热/)
+    assert.match(cold.error!, /warmCarConfig/)
+    // 预热后取 ts 内容
+    await warmCarConfig({ cwd: dir })
+    assert.equal(loadCarConfig({ cwd: dir }).config.llm?.model, 'v1')
+    // 热改：同路径重写 → 重预热（epoch 查询串击穿模块缓存）→ 新内容
+    writeFileSync(join(dir, 'car.config.ts'), `export default { llm: { model: 'v2' } }\n`)
+    await warmCarConfig({ cwd: dir })
+    assert.equal(loadCarConfig({ cwd: dir }).config.llm?.model, 'v2', 'epoch 击穿缓存')
+  })
+})
+
+test('S35: TS 形态校验——缺 default / 非 object default / 坏 TS fail-visible', async () => {
+  await withTempDir('ts-shape', async dir => {
+    writeFileSync(join(dir, 'car.config.ts'), `export const config = { llm: { model: 'x' } }\n`)
+    await warmCarConfig({ cwd: dir })
+    assert.match(loadCarConfig({ cwd: dir }).error!, /缺 default export/)
+
+    await withTempDir('ts-shape2', async dir2 => {
+      writeFileSync(join(dir2, 'car.config.ts'), `export default ['not', 'an', 'object']\n`)
+      await warmCarConfig({ cwd: dir2 })
+      assert.match(loadCarConfig({ cwd: dir2 }).error!, /default export 必须为对象/)
+    })
+
+    await withTempDir('ts-broken', async dir3 => {
+      writeFileSync(join(dir3, 'car.config.ts'), `export default { llm: ((( }\n`)
+      await warmCarConfig({ cwd: dir3 })
+      const r = loadCarConfig({ cwd: dir3 })
+      assert.match(r.error!, /CAR-E-CONFIG: car\.config\.ts 载入失败/)
+    })
+
+    await withTempDir('ts-zod-invalid', async dir4 => {
+      writeFileSync(join(dir4, 'car.config.ts'), `export default { llm: { temperature: 0.9 } }\n`)
+      await warmCarConfig({ cwd: dir4 })
+      assert.match(loadCarConfig({ cwd: dir4 }).error!, /未知键 llm\.temperature/, 'ts 载体与 json 同一 zod 校验层')
+    })
+  })
+})

package/test/s36-host-tool-surface.spec.ts

@@ -0,0 +1,250 @@
+/**
+ * 1.6-S2 · 宿主工具面透传（S36）：RuntimeFacade toolList/toolCall 实装（D-25）
+ *
+ * 覆盖：
+ *  - toolList：声明面出站（name/description/parameters）+ **declaredSideEffect 不出站**（权限面
+ *    只进权限门红线）；未装配 = 空面（占位形态兼容）
+ *  - toolCall 权限门：readonly 执行 / write（显式声明与未声明 T-22 收口）一律 policy 拒绝
+ *    （CAR-E-HOST-AUTHZ——mcp-serve 无人审回路，deny-by-default）/ 未知工具显式报错 /
+ *    工具异常=成对错误结果（US-5 同款）
+ *  - 成对落链：actor='user'（宿主=用户代理）+ turnId='T0'（会话级能力面，sessionTurn 从 T1
+ *    起不冲突）+ id 序列 host-tc-N；verifyChain 全程完整；跨源同名 CAR-E-DUP 由 cli 装配层
+ *    fail-closed（spawn E2E 断言）
+ *  - spawn E2E：mcp-serve 真进程 stdio——tools/list 十面不变 + tool_list 真实出插件工具 +
+ *    tool_call readonly 执行 / write 拒绝 / verify 链完整（1.6-GO-5 生产调用点核查）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { createRuntimeFacade } from '../src/host/facade.ts'
+import { HostGateway } from '../src/host/hostGateway.ts'
+import { HOST_MAPPINGS, deriveSessionId } from '../src/host/mappings.ts'
+import type { ToolReg } from '../src/load/loader.ts'
+
+const CLI = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'cli.ts')
+
+function makeTools(): Map<string, ToolReg> {
+  return new Map([
+    ['echo', {
+      name: 'echo', description: '回声工具', parameters: { type: 'object', properties: { text: { type: 'string' } } },
+      declaredSideEffect: 'readonly', run: async (args: Record<string, unknown>) => 'pong:' + String((args as { text?: string }).text ?? ''),
+    }],
+    ['write_file', { name: 'write_file', declaredSideEffect: 'write', run: async () => 'written' }],
+    ['stealth', { name: 'stealth', run: async () => 'undeclared' }], // 未声明 sideEffect——T-22 收口 write
+  ])
+}
+
+function gatewayWith(tools?: Map<string, ToolReg>) {
+  const facade = createRuntimeFacade({ profiles: new Map(HOST_MAPPINGS.map(h => [h.hostId, h])), ...(tools ? { tools } : {}) })
+  const gw = new HostGateway({ facade, audit: () => {} })
+  gw.registerHost({ hostId: 'claude-code', profile: HOST_MAPPINGS[0]!, transport: {} as never })
+  return { facade, gw }
+}
+
+test('S36: toolList 声明面出站——name/description/parameters 齐，declaredSideEffect 权限面不出站', async () => {
+  const { gw } = gatewayWith(makeTools())
+  await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-list' })
+  const r = await gw.handle('claude-code', 'tool_list', {})
+  assert.ok(r.ok)
+  const tools = (r.result as { tools: Array<Record<string, unknown>> }).tools
+  assert.equal(tools.length, 3)
+  const echo = tools.find(t => t.name === 'echo')!
+  assert.equal(echo.description, '回声工具')
+  assert.deepEqual(echo.parameters, { type: 'object', properties: { text: { type: 'string' } } })
+  assert.ok(tools.every(t => !('declaredSideEffect' in t)), '权限面不出站红线：sideEffect 信息不经宿主面外泄')
+  assert.ok(tools.every(t => !('run' in t)), '执行面不出站')
+})
+
+test('S36: toolList 未装配 = 空面（S12 占位形态兼容）', async () => {
+  const { gw } = gatewayWith()
+  await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-empty' })
+  const r = await gw.handle('claude-code', 'tool_list', {})
+  assert.ok(r.ok)
+  assert.deepEqual((r.result as { tools: unknown[] }).tools, [])
+})
+
+test('S36: toolCall readonly 执行——ok + 成对落链（actor=user/turnId=T0/id 序列）+ 链完整', async () => {
+  const { gw } = gatewayWith(makeTools())
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-exec' })).result as { sessionId: string }
+  // gateway.handle 把 facade 返回值包进 {ok:true, result:<facade envelope>}——双层 ok 语义
+  const r1 = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo', arguments: { text: 'hi' } })
+  assert.ok(r1.ok)
+  assert.deepEqual(r1.result, { ok: true, result: 'pong:hi' })
+  const r2 = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo', arguments: { text: 'again' } })
+  assert.deepEqual(r2.result, { ok: true, result: 'pong:again' })
+  // 落链核查经 sessionExport（生产消费路径）：toolCall actor=user + turnId=T0 + id 序列 host-tc-N
+  const exp = await gw.handle('claude-code', 'session_export', { sessionId })
+  const bundle = (exp.result as { bundle: { files: Array<{ name: string; content: string }> } }).bundle
+  const eventsFile = bundle.files.find(f => f.name.endsWith('events.jsonl'))!
+  const events = eventsFile.content.trim().split('\n').map(l => JSON.parse(l)) as Array<{ actor: string; kind: string; turnId: string; payload: { id?: string; tool?: string } }>
+  const calls = events.filter(e => e.kind === 'toolCall')
+  assert.equal(calls.length, 2)
+  assert.ok(calls.every(e => e.actor === 'user' && e.turnId === 'T0'), 'D-25：宿主=用户代理，会话级能力面落 T0（sessionTurn 从 T1 起不冲突）')
+  assert.deepEqual(calls.map(e => e.payload.id), ['host-tc-1', 'host-tc-2'])
+  const verify = await gw.handle('claude-code', 'session_verify', { sessionId })
+  assert.deepEqual((verify.result as { ok: boolean }).ok, true, '工具调用成对落链后哈希链完整')
+})
+
+test('S36: toolCall write 类 policy 拒绝（显式声明 + 未声明 T-22 收口双路径）+ 拒绝落链', async () => {
+  const { gw } = gatewayWith(makeTools())
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-deny' })).result as { sessionId: string }
+  const w = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'write_file' })
+  assert.ok(w.ok, 'handle 层 ok（facade 正常返回 envelope）')
+  assert.equal((w.result as { ok: boolean }).ok, false, 'facade 层 ok=false')
+  assert.match((w.result as { error?: string }).error!, /CAR-E-HOST-AUTHZ/)
+  const s = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'stealth' })
+  assert.equal((s.result as { ok: boolean }).ok, false, 'T-22：未声明 sideEffect 收口 write → 同样拒绝')
+  assert.match((s.result as { error?: string }).error!, /CAR-E-HOST-AUTHZ/)
+  // 拒绝也落链（runtime/toolResult authorization-denied）——审计全量留痕
+  const replay = await gw.handle('claude-code', 'session_replay', { sessionId })
+  const results = ((replay.result as { messages: Array<{ role: string; content?: unknown }> }).messages).filter(m => m.role === 'toolResult')
+  const denied = results.filter(m => (m.content as { error?: string }).error === 'authorization-denied')
+  assert.equal(denied.length, 2, '两次拒绝各落一条授权拒绝记录（单条即终态——D-23 不收敛）')
+  const verify = await gw.handle('claude-code', 'session_verify', { sessionId })
+  assert.deepEqual((verify.result as { ok: boolean }).ok, true)
+})
+
+test('S36: toolCall 未知工具显式报错 + 成对落链；工具异常=成对错误结果（US-5 同款）', async () => {
+  const tools = new Map<string, ToolReg>([['boom', { name: 'boom', declaredSideEffect: 'readonly', run: async () => { throw new Error('炸了') } }]])
+  const { gw } = gatewayWith(tools)
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-err' })).result as { sessionId: string }
+  const unk = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'nope' })
+  assert.ok(unk.ok, 'handle 层正常返回')
+  assert.equal((unk.result as { ok: boolean }).ok, false, 'facade 层显式拒绝')
+  assert.match((unk.result as { error?: string }).error!, /unknown tool "nope"/)
+  const err = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'boom', arguments: {} })
+  assert.equal((err.result as { ok: boolean }).ok, false)
+  assert.match((err.result as { error?: string }).error!, /炸了/)
+  const replay = await gw.handle('claude-code', 'session_replay', { sessionId })
+  const results = ((replay.result as { messages: Array<{ role: string; content?: unknown }> }).messages).filter(m => m.role === 'toolResult')
+  assert.equal((results[0]!.content as { error?: string }).error, 'unknown tool "nope"')
+  assert.match((results[1]!.content as { error?: string }).error!, /炸了/, '工具异常=结果非中断（US-5/D5 语义同款）')
+})
+
+test('S36: 未装配 tool 面时 toolCall 显式报错（S13 静默占位退役——fail-visible）', async () => {
+  const { gw } = gatewayWith()
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-nobridge' })).result as { sessionId: string }
+  const r = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo' })
+  assert.equal(r.ok, false)
+  assert.match(r.error!, /tool 面未装配/)
+})
+
+// ==================== spawn E2E（生产调用点——1.6-GO-5） ====================
+
+function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), `car-s36-${name}-`))
+  try {
+    const r = fn(dir)
+    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
+    if (r instanceof Promise) return r.finally(cleanup)
+    cleanup()
+    return Promise.resolve()
+  } catch (e) {
+    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
+    throw e
+  }
+}
+
+function talk(requests: string[], plugin: string): Promise<{ outs: any[]; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--plugin', plugin], { stdio: ['pipe', 'pipe', 'pipe'] })
+    let out = ''
+    let err = ''
+    child.stdout.on('data', d => { out += d })
+    child.stderr.on('data', d => { err += d })
+    child.on('error', reject)
+    child.on('exit', () => {
+      try { resolve({ outs: out.split('\n').filter(Boolean).map(l => JSON.parse(l)), stderr: err }) } catch (e) { reject(e) }
+    })
+    for (const r of requests) child.stdin.write(r + '\n')
+    child.stdin.end()
+  })
+}
+
+test('S36: spawn E2E——mcp-serve 真进程 tool_list 透传插件工具面 + tool_call 执行/拒绝 + verify 链完整', async () => {
+  await withTempDir('e2e', async dir => {
+    const plugin = join(dir, 'p.ts')
+    writeFileSync(plugin, [
+      'export const manifest = { name: "s36p", version: "1.0.0" }',
+      'export default function apply(api) {',
+      '  api.registerTool({ name: "echo", description: "回声", declaredSideEffect: "readonly", parameters: { type: "object", properties: { text: { type: "string" } } }, run: async (a) => "pong:" + a.text })',
+      '  api.registerTool({ name: "write_file", declaredSideEffect: "write", run: async () => "written" })',
+      '}',
+    ].join('\n'))
+    // 派生 id 进程内预计算（确定性派生——session_start 返回必须一致）
+    const sid = deriveSessionId('claude-code', 's36-e2e')
+    const { outs } = await talk([
+      JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
+      JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e' } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'tool_list', arguments: {} } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 4, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'echo', arguments: { text: 'hi' } } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 5, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'write_file', arguments: {} } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 6, method: 'tools/call', params: { name: 'session_verify', arguments: { sessionId: sid } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 7, method: 'tools/call', params: { name: 'session_replay', arguments: { sessionId: sid } } }),
+    ], plugin)
+    assert.equal(outs[0].result.tools.length, 10, 'MCP tools/list 十面不变（宿主能力面与插件工具面分层）')
+    assert.equal(JSON.parse(outs[1].result.content[0].text).sessionId, sid, '确定性派生经真进程复核')
+    const listed = JSON.parse(outs[2].result.content[0].text) as { tools: Array<Record<string, unknown>> }
+    assert.deepEqual(listed.tools.map(t => t.name), ['echo', 'write_file'], 'tool_list 透传插件声明面')
+    assert.equal(listed.tools.find(t => t.name === 'echo')!.description, '回声')
+    assert.ok(listed.tools.every(t => !('declaredSideEffect' in t)), '权限面不出站经真进程协议面复核')
+    assert.deepEqual(JSON.parse(outs[3].result.content[0].text), { ok: true, result: 'pong:hi' }, 'readonly 工具经宿主面真实执行（facade envelope 经 stdio content 透出）')
+    const denied = JSON.parse(outs[4].result.content[0].text) as { ok: boolean; error?: string }
+    assert.equal(denied.ok, false, 'write 类工具 policy 拒绝（facade envelope——handle 层未抛错）')
+    assert.match(denied.error!, /CAR-E-HOST-AUTHZ/)
+    assert.equal(JSON.parse(outs[5].result.content[0].text).ok, true, '工具调用成对落链后哈希链完整')
+    const msgs = JSON.parse(outs[6].result.content[0].text).messages as Array<{ role: string; content?: unknown; toolCall?: unknown }>
+    assert.ok(msgs.some(m => m.role === 'assistant' && (m.toolCall as { tool?: string })?.tool === 'echo'), 'toolCall 落链经 replay 可见')
+    assert.deepEqual(msgs.filter(m => m.role === 'toolResult').map(m => m.content), [
+      { id: 'host-tc-1', result: 'pong:hi' },
+      { id: 'host-tc-2', error: 'authorization-denied', granted: false, mode: 'host-policy' },
+    ])
+  })
+})
+
+test('S36: spawn E2E——tool_call 带 sessionId 全链（readonly 执行 / write 拒绝 / verify 完整）', async () => {
+  await withTempDir('e2e2', async dir => {
+    const plugin = join(dir, 'p.ts')
+    writeFileSync(plugin, [
+      'export const manifest = { name: "s36p2", version: "1.0.0" }',
+      'export default function apply(api) {',
+      '  api.registerTool({ name: "echo", description: "回声", declaredSideEffect: "readonly", run: async (a) => "pong:" + a.text })',
+      '  api.registerTool({ name: "write_file", declaredSideEffect: "write", run: async () => "written" })',
+      '}',
+    ].join('\n'))
+    const start = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e2' } } })
+    const first = await talk([start], plugin)
+    const sid = JSON.parse(first.outs[0].result.content[0].text).sessionId as string
+    const { outs } = await talk([
+      JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e2' } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'echo', arguments: { text: 'hi' } } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'write_file', arguments: {} } } }),
+    ], plugin)
+    assert.deepEqual(JSON.parse(outs[1].result.content[0].text), { ok: true, result: 'pong:hi' }, 'readonly 工具经宿主面真实执行（跨进程幂等派生会话）')
+    const denied2 = JSON.parse(outs[2].result.content[0].text) as { ok: boolean; error?: string }
+    assert.equal(denied2.ok, false, 'write 类工具 policy 拒绝经真进程协议面可达')
+    assert.match(denied2.error!, /CAR-E-HOST-AUTHZ/)
+  })
+})
+
+test('S36: spawn E2E——跨源同名工具 CAR-E-DUP fail-closed 启动中止（exit 1）', async () => {
+  await withTempDir('e2e3', async dir => {
+    const pA = join(dir, 'a.ts')
+    const pB = join(dir, 'b.ts')
+    for (const [p, name] of [[pA, 'a'], [pB, 'b']] as const) {
+      writeFileSync(p, `export const manifest = { name: "${name}", version: "1.0.0" }\nexport default function apply(api) { api.registerTool({ name: "dup_tool", declaredSideEffect: "readonly", run: async () => "${name}" }) }\n`)
+    }
+    const code = await new Promise<number>(resolve => {
+      const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--plugin', pA, '--plugin', pB], { stdio: ['pipe', 'pipe', 'pipe'] })
+      let err = ''
+      child.stderr.on('data', d => { err += d })
+      child.on('exit', c => { resolve(c ?? -1) })
+      child.stdin.end()
+    })
+    assert.equal(code, 1, '禁静默覆盖：fail-closed 启动中止（1.4-S1 跨源同名纪律同款）')
+  })
+})

package/test/s37-projection-dedupe.spec.ts

@@ -0,0 +1,161 @@
+/**
+ * 1.6-S1 · 投影收敛（S37）：deriveMessages 同 id toolResult last-wins（D-23）
+ *
+ * 覆盖：
+ *  - runTurn confirm 全链：写类工具 granted 流——事件面两条 toolResult（runtime 授权 + plugin 执行，
+ *    M4 既有语义不动 = 审计全量留痕），投影单条且内容 = 执行结果；N1 快照一致性由构造保持
+ *  - denied 流：授权拒绝单条保留（唯一结果，原样投影）
+ *  - readonly 工具：单 plugin toolResult（无收敛对象——回归）
+ *  - id 缺席不收敛：无 id 载荷原样投影（golden ④ 投影语义兼容）；id 与无 id 混存互不影响
+ *  - 适配器出站体（1.6-GO-5 生产调用点核查）：收敛投影经 openai-compat / anthropic 双适配器
+ *    出站体无重复 tool 消息 / tool_result 块（真实 provider 重复 id 拒绝面出清）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { SessionLog } from '../src/session/log.ts'
+import { runTurn, type ModelStep } from '../src/loop/stop.ts'
+import { createOpenAICompatAdapter, createAnthropicAdapter } from '../src/runtime-core/llm.ts'
+
+const dataLine = (obj: unknown) => `data: ${JSON.stringify(obj)}\n\n`
+const openaiSse = (finish: string) =>
+  dataLine({ choices: [{ delta: {}, finish_reason: finish }] }) + 'data: [DONE]\n\n'
+const sseResponse = (text: string) => {
+  const enc = new TextEncoder()
+  return new Response(new ReadableStream<Uint8Array>({ start(c) { c.enqueue(enc.encode(text)); c.close() } }),
+    { status: 200, headers: { 'content-type': 'text/event-stream' } })
+}
+const anthropicSse = (events: object[]) => events.map(dataLine).join('')
+const ANTHROPIC_STOP = [
+  { type: 'message_start', message: { role: 'assistant' } },
+  { type: 'message_delta', delta: { stop_reason: 'end_turn' } },
+  { type: 'message_stop' },
+]
+
+/** chatStep 消息映射同款复刻（deriveMessages → LlmRequest.messages 的唯一路径） */
+function toLlmMessages(log: SessionLog) {
+  return log.deriveMessages().map(m => ({
+    role: m.role as 'system' | 'user' | 'assistant' | 'toolResult',
+    content: (m as unknown as { toolCall?: unknown }).toolCall !== undefined
+      ? { toolCall: (m as unknown as { toolCall: unknown }).toolCall }
+      : m.content,
+  }))
+}
+
+test('S37: 写类工具 granted 流——事件面两条 toolResult（M4 语义不动），投影单条且为执行结果 + N1 一致', async () => {
+  const log = new SessionLog('s37-granted')
+  const steps: ModelStep[] = [
+    { stopReason: 'toolUse', toolCalls: [{ id: 'tc1', tool: 'save_note', args: { text: 'hi' } }] },
+    { stopReason: 'stop' },
+  ]
+  const r = await runTurn({
+    log, turnId: 'T1',
+    model: async () => steps.shift()!,
+    tools: new Map([['save_note', { declaredSideEffect: 'write', run: async () => '已保存' }]]),
+    preset: { mode: 'confirm', authorize: async () => true },
+  })
+  assert.equal(r.reason, 'completed')
+  // 事件面不动：授权决策（runtime）+ 执行结果（plugin）两条都落链（审计全量留痕）
+  const resultEvents = log.events.filter(e => e.kind === 'toolResult')
+  assert.equal(resultEvents.length, 2, 'M4 既有语义冻结：runtime 授权记录 + plugin 执行结果均落链')
+  assert.equal(resultEvents[0]!.actor, 'runtime')
+  assert.equal(resultEvents[1]!.actor, 'plugin')
+  // 投影收敛：同 id last-wins，模型可见流单条且为执行结果
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 1, 'D-23：授权中间记录不再进模型可见流')
+  assert.deepEqual(proj[0]!.content, { id: 'tc1', result: '已保存' })
+  // N1 快照一致性（runTurn 每步 snapshotModelRequest；收敛激活下重算同函数构造一致）
+  assert.deepEqual(log.assertModelVisibleLogged(), { ok: true })
+})
+
+test('S37: denied 流——授权拒绝单条保留（唯一结果原样投影）', async () => {
+  const log = new SessionLog('s37-denied')
+  const steps: ModelStep[] = [
+    { stopReason: 'toolUse', toolCalls: [{ id: 'tc2', tool: 'save_note', args: {} } ] },
+    { stopReason: 'stop' },
+  ]
+  await runTurn({
+    log, turnId: 'T1',
+    model: async () => steps.shift()!,
+    tools: new Map([['save_note', { declaredSideEffect: 'write', run: async () => '不应执行' }]]),
+    preset: { mode: 'confirm', authorize: async () => false },
+  })
+  assert.equal(log.events.filter(e => e.kind === 'toolResult').length, 1, '拒绝即终态：仅 runtime 授权拒绝事件')
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 1, '唯一结果原样保留（不误收敛）')
+  assert.equal((proj[0]!.content as { error?: string }).error, 'authorization-denied')
+})
+
+test('S37: readonly 工具单条 toolResult 无收敛对象（回归）', async () => {
+  const log = new SessionLog('s37-readonly')
+  const steps: ModelStep[] = [
+    { stopReason: 'toolUse', toolCalls: [{ id: 'tc3', tool: 'echo', args: {} }] },
+    { stopReason: 'stop' },
+  ]
+  await runTurn({
+    log, turnId: 'T1',
+    model: async () => steps.shift()!,
+    tools: new Map([['echo', { declaredSideEffect: 'readonly', run: async () => 'pong' }]]),
+    preset: { mode: 'readonly' },
+  })
+  assert.equal(log.events.filter(e => e.kind === 'toolResult').length, 1)
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 1)
+  assert.deepEqual(proj[0]!.content, { id: 'tc3', result: 'pong' })
+})
+
+test('S37: id 缺席不收敛——无 id 载荷原样投影（golden ④ 兼容），id 与无 id 混存互不影响', () => {
+  const log = new SessionLog('s37-idless')
+  log.append('runtime', 'toolResult', 'T1', { ok: 1 })
+  log.append('runtime', 'toolResult', 'T1', { ok: 2 })
+  log.append('plugin', 'toolResult', 'T1', { id: 'tc9', error: 'authorization-denied', granted: true })
+  log.append('plugin', 'toolResult', 'T1', { id: 'tc9', result: 'final' })
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 3, '无 id 两条原样保留 + 同 id 收敛为最后一条')
+  assert.deepEqual(proj[0]!.content, { ok: 1 })
+  assert.deepEqual(proj[1]!.content, { ok: 2 })
+  assert.deepEqual(proj[2]!.content, { id: 'tc9', result: 'final' })
+  // 前缀投影（upTo）语义：前缀内 last-wins 独立成立
+  const half = log.deriveMessages(3).filter(m => m.role === 'toolResult')
+  assert.equal(half.length, 3, '前缀 [0,3)：无 id 两条 + tc9 授权记录（前缀内 tc9 授权记录即终态）')
+  assert.deepEqual(half[2]!.content, { id: 'tc9', error: 'authorization-denied', granted: true })
+})
+
+test('S37: openai-compat 出站体——收敛后单 tool 消息（重复 tool_call_id 出清）', async () => {
+  const log = new SessionLog('s37-openai')
+  log.append('user', 'user', 'T1', '查天气')
+  log.append('model', 'toolCall', 'T1', { id: 'tc1', tool: 'weather', args: { city: '北京' } })
+  log.append('runtime', 'toolResult', 'T1', { id: 'tc1', error: 'authorization-denied', granted: true, mode: 'confirm' })
+  log.append('plugin', 'toolResult', 'T1', { id: 'tc1', result: '晴 25 度' })
+  const seen: RequestInit[] = []
+  const adapter = createOpenAICompatAdapter({
+    baseUrl: 'https://api.test',
+    fetchImpl: (async (_u: string | URL, init?: RequestInit) => { seen.push(init!); return sseResponse(openaiSse('stop')) }) as typeof fetch,
+  })
+  for await (const _ of adapter.chat({ model: 'm', messages: toLlmMessages(log), tools: [] })) void _
+  const body = JSON.parse(seen[0]!.body as string)
+  const toolMsgs = body.messages.filter((m: { role: string }) => m.role === 'tool')
+  assert.equal(toolMsgs.length, 1, '1.6-GO-5：出站体单 tool 消息（收敛前为两条）')
+  assert.equal(toolMsgs[0].tool_call_id, 'tc1')
+  assert.equal(toolMsgs[0].content, JSON.stringify('晴 25 度'), '内容 = 执行结果（非授权中间记录）')
+})
+
+test('S37: anthropic 出站体——收敛后单 tool_result 块（重复 tool_use_id 400 面出清）', async () => {
+  const log = new SessionLog('s37-anthropic')
+  log.append('user', 'user', 'T1', '查天气')
+  log.append('model', 'toolCall', 'T1', { id: 'toolu_1', tool: 'weather', args: { city: '北京' } })
+  log.append('runtime', 'toolResult', 'T1', { id: 'toolu_1', error: 'authorization-denied', granted: true, mode: 'confirm' })
+  log.append('plugin', 'toolResult', 'T1', { id: 'toolu_1', result: '晴 25 度' })
+  const seen: RequestInit[] = []
+  const adapter = createAnthropicAdapter({
+    baseUrl: 'https://api.test',
+    fetchImpl: (async (_u: string | URL, init?: RequestInit) => { seen.push(init!); return sseResponse(anthropicSse(ANTHROPIC_STOP)) }) as typeof fetch,
+  })
+  for await (const _ of adapter.chat({ model: 'm', messages: toLlmMessages(log), tools: [] })) void _
+  const body = JSON.parse(seen[0]!.body as string)
+  const blocks = body.messages.flatMap((m: { content: unknown }) =>
+    Array.isArray(m.content) ? m.content : []).filter((b: { type: string }) => b.type === 'tool_result')
+  assert.equal(blocks.length, 1, '1.6-GO-5：出站体单 tool_result 块（重复 tool_use_id 会被 provider 400）')
+  assert.equal(blocks[0].tool_use_id, 'toolu_1')
+  assert.equal(blocks[0].content, JSON.stringify('晴 25 度'))
+  assert.ok(!('is_error' in blocks[0]), '执行结果非错误形态')
+})