@lqc123qwe/car-runtime 1.5.0 → 1.7.0

package/test/s36-host-tool-surface.spec.ts

@@ -0,0 +1,250 @@
+/**
+ * 1.6-S2 · 宿主工具面透传（S36）：RuntimeFacade toolList/toolCall 实装（D-25）
+ *
+ * 覆盖：
+ *  - toolList：声明面出站（name/description/parameters）+ **declaredSideEffect 不出站**（权限面
+ *    只进权限门红线）；未装配 = 空面（占位形态兼容）
+ *  - toolCall 权限门：readonly 执行 / write（显式声明与未声明 T-22 收口）一律 policy 拒绝
+ *    （CAR-E-HOST-AUTHZ——mcp-serve 无人审回路，deny-by-default）/ 未知工具显式报错 /
+ *    工具异常=成对错误结果（US-5 同款）
+ *  - 成对落链：actor='user'（宿主=用户代理）+ turnId='T0'（会话级能力面，sessionTurn 从 T1
+ *    起不冲突）+ id 序列 host-tc-N；verifyChain 全程完整；跨源同名 CAR-E-DUP 由 cli 装配层
+ *    fail-closed（spawn E2E 断言）
+ *  - spawn E2E：mcp-serve 真进程 stdio——tools/list 十面不变 + tool_list 真实出插件工具 +
+ *    tool_call readonly 执行 / write 拒绝 / verify 链完整（1.6-GO-5 生产调用点核查）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { createRuntimeFacade } from '../src/host/facade.ts'
+import { HostGateway } from '../src/host/hostGateway.ts'
+import { HOST_MAPPINGS, deriveSessionId } from '../src/host/mappings.ts'
+import type { ToolReg } from '../src/load/loader.ts'
+
+const CLI = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'cli.ts')
+
+function makeTools(): Map<string, ToolReg> {
+  return new Map([
+    ['echo', {
+      name: 'echo', description: '回声工具', parameters: { type: 'object', properties: { text: { type: 'string' } } },
+      declaredSideEffect: 'readonly', run: async (args: Record<string, unknown>) => 'pong:' + String((args as { text?: string }).text ?? ''),
+    }],
+    ['write_file', { name: 'write_file', declaredSideEffect: 'write', run: async () => 'written' }],
+    ['stealth', { name: 'stealth', run: async () => 'undeclared' }], // 未声明 sideEffect——T-22 收口 write
+  ])
+}
+
+function gatewayWith(tools?: Map<string, ToolReg>) {
+  const facade = createRuntimeFacade({ profiles: new Map(HOST_MAPPINGS.map(h => [h.hostId, h])), ...(tools ? { tools } : {}) })
+  const gw = new HostGateway({ facade, audit: () => {} })
+  gw.registerHost({ hostId: 'claude-code', profile: HOST_MAPPINGS[0]!, transport: {} as never })
+  return { facade, gw }
+}
+
+test('S36: toolList 声明面出站——name/description/parameters 齐，declaredSideEffect 权限面不出站', async () => {
+  const { gw } = gatewayWith(makeTools())
+  await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-list' })
+  const r = await gw.handle('claude-code', 'tool_list', {})
+  assert.ok(r.ok)
+  const tools = (r.result as { tools: Array<Record<string, unknown>> }).tools
+  assert.equal(tools.length, 3)
+  const echo = tools.find(t => t.name === 'echo')!
+  assert.equal(echo.description, '回声工具')
+  assert.deepEqual(echo.parameters, { type: 'object', properties: { text: { type: 'string' } } })
+  assert.ok(tools.every(t => !('declaredSideEffect' in t)), '权限面不出站红线：sideEffect 信息不经宿主面外泄')
+  assert.ok(tools.every(t => !('run' in t)), '执行面不出站')
+})
+
+test('S36: toolList 未装配 = 空面（S12 占位形态兼容）', async () => {
+  const { gw } = gatewayWith()
+  await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-empty' })
+  const r = await gw.handle('claude-code', 'tool_list', {})
+  assert.ok(r.ok)
+  assert.deepEqual((r.result as { tools: unknown[] }).tools, [])
+})
+
+test('S36: toolCall readonly 执行——ok + 成对落链（actor=user/turnId=T0/id 序列）+ 链完整', async () => {
+  const { gw } = gatewayWith(makeTools())
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-exec' })).result as { sessionId: string }
+  // gateway.handle 把 facade 返回值包进 {ok:true, result:<facade envelope>}——双层 ok 语义
+  const r1 = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo', arguments: { text: 'hi' } })
+  assert.ok(r1.ok)
+  assert.deepEqual(r1.result, { ok: true, result: 'pong:hi' })
+  const r2 = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo', arguments: { text: 'again' } })
+  assert.deepEqual(r2.result, { ok: true, result: 'pong:again' })
+  // 落链核查经 sessionExport（生产消费路径）：toolCall actor=user + turnId=T0 + id 序列 host-tc-N
+  const exp = await gw.handle('claude-code', 'session_export', { sessionId })
+  const bundle = (exp.result as { bundle: { files: Array<{ name: string; content: string }> } }).bundle
+  const eventsFile = bundle.files.find(f => f.name.endsWith('events.jsonl'))!
+  const events = eventsFile.content.trim().split('\n').map(l => JSON.parse(l)) as Array<{ actor: string; kind: string; turnId: string; payload: { id?: string; tool?: string } }>
+  const calls = events.filter(e => e.kind === 'toolCall')
+  assert.equal(calls.length, 2)
+  assert.ok(calls.every(e => e.actor === 'user' && e.turnId === 'T0'), 'D-25：宿主=用户代理，会话级能力面落 T0（sessionTurn 从 T1 起不冲突）')
+  assert.deepEqual(calls.map(e => e.payload.id), ['host-tc-1', 'host-tc-2'])
+  const verify = await gw.handle('claude-code', 'session_verify', { sessionId })
+  assert.deepEqual((verify.result as { ok: boolean }).ok, true, '工具调用成对落链后哈希链完整')
+})
+
+test('S36: toolCall write 类 policy 拒绝（显式声明 + 未声明 T-22 收口双路径）+ 拒绝落链', async () => {
+  const { gw } = gatewayWith(makeTools())
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-deny' })).result as { sessionId: string }
+  const w = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'write_file' })
+  assert.ok(w.ok, 'handle 层 ok（facade 正常返回 envelope）')
+  assert.equal((w.result as { ok: boolean }).ok, false, 'facade 层 ok=false')
+  assert.match((w.result as { error?: string }).error!, /CAR-E-HOST-AUTHZ/)
+  const s = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'stealth' })
+  assert.equal((s.result as { ok: boolean }).ok, false, 'T-22：未声明 sideEffect 收口 write → 同样拒绝')
+  assert.match((s.result as { error?: string }).error!, /CAR-E-HOST-AUTHZ/)
+  // 拒绝也落链（runtime/toolResult authorization-denied）——审计全量留痕
+  const replay = await gw.handle('claude-code', 'session_replay', { sessionId })
+  const results = ((replay.result as { messages: Array<{ role: string; content?: unknown }> }).messages).filter(m => m.role === 'toolResult')
+  const denied = results.filter(m => (m.content as { error?: string }).error === 'authorization-denied')
+  assert.equal(denied.length, 2, '两次拒绝各落一条授权拒绝记录（单条即终态——D-23 不收敛）')
+  const verify = await gw.handle('claude-code', 'session_verify', { sessionId })
+  assert.deepEqual((verify.result as { ok: boolean }).ok, true)
+})
+
+test('S36: toolCall 未知工具显式报错 + 成对落链；工具异常=成对错误结果（US-5 同款）', async () => {
+  const tools = new Map<string, ToolReg>([['boom', { name: 'boom', declaredSideEffect: 'readonly', run: async () => { throw new Error('炸了') } }]])
+  const { gw } = gatewayWith(tools)
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-err' })).result as { sessionId: string }
+  const unk = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'nope' })
+  assert.ok(unk.ok, 'handle 层正常返回')
+  assert.equal((unk.result as { ok: boolean }).ok, false, 'facade 层显式拒绝')
+  assert.match((unk.result as { error?: string }).error!, /unknown tool "nope"/)
+  const err = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'boom', arguments: {} })
+  assert.equal((err.result as { ok: boolean }).ok, false)
+  assert.match((err.result as { error?: string }).error!, /炸了/)
+  const replay = await gw.handle('claude-code', 'session_replay', { sessionId })
+  const results = ((replay.result as { messages: Array<{ role: string; content?: unknown }> }).messages).filter(m => m.role === 'toolResult')
+  assert.equal((results[0]!.content as { error?: string }).error, 'unknown tool "nope"')
+  assert.match((results[1]!.content as { error?: string }).error!, /炸了/, '工具异常=结果非中断（US-5/D5 语义同款）')
+})
+
+test('S36: 未装配 tool 面时 toolCall 显式报错（S13 静默占位退役——fail-visible）', async () => {
+  const { gw } = gatewayWith()
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-nobridge' })).result as { sessionId: string }
+  const r = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo' })
+  assert.equal(r.ok, false)
+  assert.match(r.error!, /tool 面未装配/)
+})
+
+// ==================== spawn E2E（生产调用点——1.6-GO-5） ====================
+
+function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), `car-s36-${name}-`))
+  try {
+    const r = fn(dir)
+    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
+    if (r instanceof Promise) return r.finally(cleanup)
+    cleanup()
+    return Promise.resolve()
+  } catch (e) {
+    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
+    throw e
+  }
+}
+
+function talk(requests: string[], plugin: string): Promise<{ outs: any[]; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--plugin', plugin], { stdio: ['pipe', 'pipe', 'pipe'] })
+    let out = ''
+    let err = ''
+    child.stdout.on('data', d => { out += d })
+    child.stderr.on('data', d => { err += d })
+    child.on('error', reject)
+    child.on('exit', () => {
+      try { resolve({ outs: out.split('\n').filter(Boolean).map(l => JSON.parse(l)), stderr: err }) } catch (e) { reject(e) }
+    })
+    for (const r of requests) child.stdin.write(r + '\n')
+    child.stdin.end()
+  })
+}
+
+test('S36: spawn E2E——mcp-serve 真进程 tool_list 透传插件工具面 + tool_call 执行/拒绝 + verify 链完整', async () => {
+  await withTempDir('e2e', async dir => {
+    const plugin = join(dir, 'p.ts')
+    writeFileSync(plugin, [
+      'export const manifest = { name: "s36p", version: "1.0.0" }',
+      'export default function apply(api) {',
+      '  api.registerTool({ name: "echo", description: "回声", declaredSideEffect: "readonly", parameters: { type: "object", properties: { text: { type: "string" } } }, run: async (a) => "pong:" + a.text })',
+      '  api.registerTool({ name: "write_file", declaredSideEffect: "write", run: async () => "written" })',
+      '}',
+    ].join('\n'))
+    // 派生 id 进程内预计算（确定性派生——session_start 返回必须一致）
+    const sid = deriveSessionId('claude-code', 's36-e2e')
+    const { outs } = await talk([
+      JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
+      JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e' } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'tool_list', arguments: {} } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 4, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'echo', arguments: { text: 'hi' } } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 5, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'write_file', arguments: {} } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 6, method: 'tools/call', params: { name: 'session_verify', arguments: { sessionId: sid } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 7, method: 'tools/call', params: { name: 'session_replay', arguments: { sessionId: sid } } }),
+    ], plugin)
+    assert.equal(outs[0].result.tools.length, 10, 'MCP tools/list 十面不变（宿主能力面与插件工具面分层）')
+    assert.equal(JSON.parse(outs[1].result.content[0].text).sessionId, sid, '确定性派生经真进程复核')
+    const listed = JSON.parse(outs[2].result.content[0].text) as { tools: Array<Record<string, unknown>> }
+    assert.deepEqual(listed.tools.map(t => t.name), ['echo', 'write_file'], 'tool_list 透传插件声明面')
+    assert.equal(listed.tools.find(t => t.name === 'echo')!.description, '回声')
+    assert.ok(listed.tools.every(t => !('declaredSideEffect' in t)), '权限面不出站经真进程协议面复核')
+    assert.deepEqual(JSON.parse(outs[3].result.content[0].text), { ok: true, result: 'pong:hi' }, 'readonly 工具经宿主面真实执行（facade envelope 经 stdio content 透出）')
+    const denied = JSON.parse(outs[4].result.content[0].text) as { ok: boolean; error?: string }
+    assert.equal(denied.ok, false, 'write 类工具 policy 拒绝（facade envelope——handle 层未抛错）')
+    assert.match(denied.error!, /CAR-E-HOST-AUTHZ/)
+    assert.equal(JSON.parse(outs[5].result.content[0].text).ok, true, '工具调用成对落链后哈希链完整')
+    const msgs = JSON.parse(outs[6].result.content[0].text).messages as Array<{ role: string; content?: unknown; toolCall?: unknown }>
+    assert.ok(msgs.some(m => m.role === 'assistant' && (m.toolCall as { tool?: string })?.tool === 'echo'), 'toolCall 落链经 replay 可见')
+    assert.deepEqual(msgs.filter(m => m.role === 'toolResult').map(m => m.content), [
+      { id: 'host-tc-1', result: 'pong:hi' },
+      { id: 'host-tc-2', error: 'authorization-denied', granted: false, mode: 'host-policy' },
+    ])
+  })
+})
+
+test('S36: spawn E2E——tool_call 带 sessionId 全链（readonly 执行 / write 拒绝 / verify 完整）', async () => {
+  await withTempDir('e2e2', async dir => {
+    const plugin = join(dir, 'p.ts')
+    writeFileSync(plugin, [
+      'export const manifest = { name: "s36p2", version: "1.0.0" }',
+      'export default function apply(api) {',
+      '  api.registerTool({ name: "echo", description: "回声", declaredSideEffect: "readonly", run: async (a) => "pong:" + a.text })',
+      '  api.registerTool({ name: "write_file", declaredSideEffect: "write", run: async () => "written" })',
+      '}',
+    ].join('\n'))
+    const start = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e2' } } })
+    const first = await talk([start], plugin)
+    const sid = JSON.parse(first.outs[0].result.content[0].text).sessionId as string
+    const { outs } = await talk([
+      JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e2' } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'echo', arguments: { text: 'hi' } } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'write_file', arguments: {} } } }),
+    ], plugin)
+    assert.deepEqual(JSON.parse(outs[1].result.content[0].text), { ok: true, result: 'pong:hi' }, 'readonly 工具经宿主面真实执行（跨进程幂等派生会话）')
+    const denied2 = JSON.parse(outs[2].result.content[0].text) as { ok: boolean; error?: string }
+    assert.equal(denied2.ok, false, 'write 类工具 policy 拒绝经真进程协议面可达')
+    assert.match(denied2.error!, /CAR-E-HOST-AUTHZ/)
+  })
+})
+
+test('S36: spawn E2E——跨源同名工具 CAR-E-DUP fail-closed 启动中止（exit 1）', async () => {
+  await withTempDir('e2e3', async dir => {
+    const pA = join(dir, 'a.ts')
+    const pB = join(dir, 'b.ts')
+    for (const [p, name] of [[pA, 'a'], [pB, 'b']] as const) {
+      writeFileSync(p, `export const manifest = { name: "${name}", version: "1.0.0" }\nexport default function apply(api) { api.registerTool({ name: "dup_tool", declaredSideEffect: "readonly", run: async () => "${name}" }) }\n`)
+    }
+    const code = await new Promise<number>(resolve => {
+      const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--plugin', pA, '--plugin', pB], { stdio: ['pipe', 'pipe', 'pipe'] })
+      let err = ''
+      child.stderr.on('data', d => { err += d })
+      child.on('exit', c => { resolve(c ?? -1) })
+      child.stdin.end()
+    })
+    assert.equal(code, 1, '禁静默覆盖：fail-closed 启动中止（1.4-S1 跨源同名纪律同款）')
+  })
+})

package/test/s37-projection-dedupe.spec.ts

@@ -0,0 +1,161 @@
+/**
+ * 1.6-S1 · 投影收敛（S37）：deriveMessages 同 id toolResult last-wins（D-23）
+ *
+ * 覆盖：
+ *  - runTurn confirm 全链：写类工具 granted 流——事件面两条 toolResult（runtime 授权 + plugin 执行，
+ *    M4 既有语义不动 = 审计全量留痕），投影单条且内容 = 执行结果；N1 快照一致性由构造保持
+ *  - denied 流：授权拒绝单条保留（唯一结果，原样投影）
+ *  - readonly 工具：单 plugin toolResult（无收敛对象——回归）
+ *  - id 缺席不收敛：无 id 载荷原样投影（golden ④ 投影语义兼容）；id 与无 id 混存互不影响
+ *  - 适配器出站体（1.6-GO-5 生产调用点核查）：收敛投影经 openai-compat / anthropic 双适配器
+ *    出站体无重复 tool 消息 / tool_result 块（真实 provider 重复 id 拒绝面出清）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { SessionLog } from '../src/session/log.ts'
+import { runTurn, type ModelStep } from '../src/loop/stop.ts'
+import { createOpenAICompatAdapter, createAnthropicAdapter } from '../src/runtime-core/llm.ts'
+
+const dataLine = (obj: unknown) => `data: ${JSON.stringify(obj)}\n\n`
+const openaiSse = (finish: string) =>
+  dataLine({ choices: [{ delta: {}, finish_reason: finish }] }) + 'data: [DONE]\n\n'
+const sseResponse = (text: string) => {
+  const enc = new TextEncoder()
+  return new Response(new ReadableStream<Uint8Array>({ start(c) { c.enqueue(enc.encode(text)); c.close() } }),
+    { status: 200, headers: { 'content-type': 'text/event-stream' } })
+}
+const anthropicSse = (events: object[]) => events.map(dataLine).join('')
+const ANTHROPIC_STOP = [
+  { type: 'message_start', message: { role: 'assistant' } },
+  { type: 'message_delta', delta: { stop_reason: 'end_turn' } },
+  { type: 'message_stop' },
+]
+
+/** chatStep 消息映射同款复刻（deriveMessages → LlmRequest.messages 的唯一路径） */
+function toLlmMessages(log: SessionLog) {
+  return log.deriveMessages().map(m => ({
+    role: m.role as 'system' | 'user' | 'assistant' | 'toolResult',
+    content: (m as unknown as { toolCall?: unknown }).toolCall !== undefined
+      ? { toolCall: (m as unknown as { toolCall: unknown }).toolCall }
+      : m.content,
+  }))
+}
+
+test('S37: 写类工具 granted 流——事件面两条 toolResult（M4 语义不动），投影单条且为执行结果 + N1 一致', async () => {
+  const log = new SessionLog('s37-granted')
+  const steps: ModelStep[] = [
+    { stopReason: 'toolUse', toolCalls: [{ id: 'tc1', tool: 'save_note', args: { text: 'hi' } }] },
+    { stopReason: 'stop' },
+  ]
+  const r = await runTurn({
+    log, turnId: 'T1',
+    model: async () => steps.shift()!,
+    tools: new Map([['save_note', { declaredSideEffect: 'write', run: async () => '已保存' }]]),
+    preset: { mode: 'confirm', authorize: async () => true },
+  })
+  assert.equal(r.reason, 'completed')
+  // 事件面不动：授权决策（runtime）+ 执行结果（plugin）两条都落链（审计全量留痕）
+  const resultEvents = log.events.filter(e => e.kind === 'toolResult')
+  assert.equal(resultEvents.length, 2, 'M4 既有语义冻结：runtime 授权记录 + plugin 执行结果均落链')
+  assert.equal(resultEvents[0]!.actor, 'runtime')
+  assert.equal(resultEvents[1]!.actor, 'plugin')
+  // 投影收敛：同 id last-wins，模型可见流单条且为执行结果
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 1, 'D-23：授权中间记录不再进模型可见流')
+  assert.deepEqual(proj[0]!.content, { id: 'tc1', result: '已保存' })
+  // N1 快照一致性（runTurn 每步 snapshotModelRequest；收敛激活下重算同函数构造一致）
+  assert.deepEqual(log.assertModelVisibleLogged(), { ok: true })
+})
+
+test('S37: denied 流——授权拒绝单条保留（唯一结果原样投影）', async () => {
+  const log = new SessionLog('s37-denied')
+  const steps: ModelStep[] = [
+    { stopReason: 'toolUse', toolCalls: [{ id: 'tc2', tool: 'save_note', args: {} } ] },
+    { stopReason: 'stop' },
+  ]
+  await runTurn({
+    log, turnId: 'T1',
+    model: async () => steps.shift()!,
+    tools: new Map([['save_note', { declaredSideEffect: 'write', run: async () => '不应执行' }]]),
+    preset: { mode: 'confirm', authorize: async () => false },
+  })
+  assert.equal(log.events.filter(e => e.kind === 'toolResult').length, 1, '拒绝即终态：仅 runtime 授权拒绝事件')
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 1, '唯一结果原样保留（不误收敛）')
+  assert.equal((proj[0]!.content as { error?: string }).error, 'authorization-denied')
+})
+
+test('S37: readonly 工具单条 toolResult 无收敛对象（回归）', async () => {
+  const log = new SessionLog('s37-readonly')
+  const steps: ModelStep[] = [
+    { stopReason: 'toolUse', toolCalls: [{ id: 'tc3', tool: 'echo', args: {} }] },
+    { stopReason: 'stop' },
+  ]
+  await runTurn({
+    log, turnId: 'T1',
+    model: async () => steps.shift()!,
+    tools: new Map([['echo', { declaredSideEffect: 'readonly', run: async () => 'pong' }]]),
+    preset: { mode: 'readonly' },
+  })
+  assert.equal(log.events.filter(e => e.kind === 'toolResult').length, 1)
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 1)
+  assert.deepEqual(proj[0]!.content, { id: 'tc3', result: 'pong' })
+})
+
+test('S37: id 缺席不收敛——无 id 载荷原样投影（golden ④ 兼容），id 与无 id 混存互不影响', () => {
+  const log = new SessionLog('s37-idless')
+  log.append('runtime', 'toolResult', 'T1', { ok: 1 })
+  log.append('runtime', 'toolResult', 'T1', { ok: 2 })
+  log.append('plugin', 'toolResult', 'T1', { id: 'tc9', error: 'authorization-denied', granted: true })
+  log.append('plugin', 'toolResult', 'T1', { id: 'tc9', result: 'final' })
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 3, '无 id 两条原样保留 + 同 id 收敛为最后一条')
+  assert.deepEqual(proj[0]!.content, { ok: 1 })
+  assert.deepEqual(proj[1]!.content, { ok: 2 })
+  assert.deepEqual(proj[2]!.content, { id: 'tc9', result: 'final' })
+  // 前缀投影（upTo）语义：前缀内 last-wins 独立成立
+  const half = log.deriveMessages(3).filter(m => m.role === 'toolResult')
+  assert.equal(half.length, 3, '前缀 [0,3)：无 id 两条 + tc9 授权记录（前缀内 tc9 授权记录即终态）')
+  assert.deepEqual(half[2]!.content, { id: 'tc9', error: 'authorization-denied', granted: true })
+})
+
+test('S37: openai-compat 出站体——收敛后单 tool 消息（重复 tool_call_id 出清）', async () => {
+  const log = new SessionLog('s37-openai')
+  log.append('user', 'user', 'T1', '查天气')
+  log.append('model', 'toolCall', 'T1', { id: 'tc1', tool: 'weather', args: { city: '北京' } })
+  log.append('runtime', 'toolResult', 'T1', { id: 'tc1', error: 'authorization-denied', granted: true, mode: 'confirm' })
+  log.append('plugin', 'toolResult', 'T1', { id: 'tc1', result: '晴 25 度' })
+  const seen: RequestInit[] = []
+  const adapter = createOpenAICompatAdapter({
+    baseUrl: 'https://api.test',
+    fetchImpl: (async (_u: string | URL, init?: RequestInit) => { seen.push(init!); return sseResponse(openaiSse('stop')) }) as typeof fetch,
+  })
+  for await (const _ of adapter.chat({ model: 'm', messages: toLlmMessages(log), tools: [] })) void _
+  const body = JSON.parse(seen[0]!.body as string)
+  const toolMsgs = body.messages.filter((m: { role: string }) => m.role === 'tool')
+  assert.equal(toolMsgs.length, 1, '1.6-GO-5：出站体单 tool 消息（收敛前为两条）')
+  assert.equal(toolMsgs[0].tool_call_id, 'tc1')
+  assert.equal(toolMsgs[0].content, JSON.stringify('晴 25 度'), '内容 = 执行结果（非授权中间记录）')
+})
+
+test('S37: anthropic 出站体——收敛后单 tool_result 块（重复 tool_use_id 400 面出清）', async () => {
+  const log = new SessionLog('s37-anthropic')
+  log.append('user', 'user', 'T1', '查天气')
+  log.append('model', 'toolCall', 'T1', { id: 'toolu_1', tool: 'weather', args: { city: '北京' } })
+  log.append('runtime', 'toolResult', 'T1', { id: 'toolu_1', error: 'authorization-denied', granted: true, mode: 'confirm' })
+  log.append('plugin', 'toolResult', 'T1', { id: 'toolu_1', result: '晴 25 度' })
+  const seen: RequestInit[] = []
+  const adapter = createAnthropicAdapter({
+    baseUrl: 'https://api.test',
+    fetchImpl: (async (_u: string | URL, init?: RequestInit) => { seen.push(init!); return sseResponse(anthropicSse(ANTHROPIC_STOP)) }) as typeof fetch,
+  })
+  for await (const _ of adapter.chat({ model: 'm', messages: toLlmMessages(log), tools: [] })) void _
+  const body = JSON.parse(seen[0]!.body as string)
+  const blocks = body.messages.flatMap((m: { content: unknown }) =>
+    Array.isArray(m.content) ? m.content : []).filter((b: { type: string }) => b.type === 'tool_result')
+  assert.equal(blocks.length, 1, '1.6-GO-5：出站体单 tool_result 块（重复 tool_use_id 会被 provider 400）')
+  assert.equal(blocks[0].tool_use_id, 'toolu_1')
+  assert.equal(blocks[0].content, JSON.stringify('晴 25 度'))
+  assert.ok(!('is_error' in blocks[0]), '执行结果非错误形态')
+})

package/test/s38-config-jiti.spec.ts

@@ -0,0 +1,116 @@
+/**
+ * 1.6-S3 · jiti 载体（S38）：car.config.ts 经 jiti 自包含转译（D-24）
+ *
+ * 覆盖：
+ *  - 非可擦除语法（enum）真载——1.5 D-22 原生类型剥离不可表达的 transform-only 形态，
+ *    erasable-only 预检登记项随之出清（被取代）
+ *  - strip-only spawn 差分（1.6-GO-5 生产调用点）：`--experimental-strip-types`（无 transform）
+ *    下 enum 配置经 jiti 真载成功 + 原生 import 同文件失败（负控——证明语法确属非可擦除、
+ *    jiti 是载体）；同进程实测首载时延（登记口径，无硬门禁，CI 宽上界防抖）
+ *  - CLI 真路径：car run 于 enum 配置目录——配置经 jiti 装载生效（CAR-E-LLM-CONFIG 引导 =
+ *    配置解析通过、模型未配；若配置载体失败应为 CAR-E-CONFIG）
+ *  - s35 存量零改动全量回归 = 载体迁移验收线（interoptDefault 显式关：jiti 缺省 true 会把
+ *    无 default 模块的 exports 整体当 default，「缺 default export」校验即失效）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { warmCarConfig, loadCarConfig } from '../src/load/config.ts'
+
+const CLI = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'cli.ts')
+const SRC_CONFIG = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'load', 'config.ts')
+
+function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), `car-s38-${name}-`))
+  try {
+    const r = fn(dir)
+    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
+    if (r instanceof Promise) return r.finally(cleanup)
+    cleanup()
+    return Promise.resolve()
+  } catch (e) {
+    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
+    throw e
+  }
+}
+
+test('S38: 非可擦除语法（enum）经 jiti 真载——D-22 原生类型剥离不可表达形态', async () => {
+  await withTempDir('enum', async dir => {
+    writeFileSync(join(dir, 'car.config.ts'), [
+      `export enum LlmMode { full = 'full-model' }`,
+      `export default { llm: { model: LlmMode.full } }`,
+    ].join('\n'))
+    await warmCarConfig({ cwd: dir })
+    const r = loadCarConfig({ cwd: dir })
+    assert.equal(r.error, undefined)
+    assert.equal(r.config.llm?.model, 'full-model', 'enum 值经 jiti 转译进配置')
+  })
+})
+
+test('S38: strip-only spawn 差分——原生 import enum 载体失败（负控）+ jiti 真载成功 + 首载时延实测', async () => {
+  await withTempDir('strip', async dir => {
+    const configPath = join(dir, 'car.config.ts')
+    writeFileSync(configPath, [
+      `export enum LlmMode { full = 'strip-model' }`,
+      `export default { llm: { model: LlmMode.full } }`,
+    ].join('\n'))
+    // 夹具自身仅可擦除语法（strip-only 可载）；非可擦除只出现在被测配置里
+    const fixture = join(dir, 'fixture.ts')
+    writeFileSync(fixture, [
+      `import { warmCarConfig, loadCarConfig } from ${JSON.stringify(pathToFileURL(SRC_CONFIG).href)}`,
+      `import { pathToFileURL as toURL } from 'node:url'`,
+      `const configPath = process.argv[2]!`,
+      `let nativeError = ''`,
+      `try { await import(toURL(configPath).href) } catch (e) { nativeError = String((e as Error).message) }`,
+      `if (!nativeError) { console.log('NATIVE_UNEXPECTEDLY_OK'); process.exit(1) }`,
+      `const t0 = performance.now()`,
+      `await warmCarConfig({ explicitPath: configPath })`,
+      `const elapsed = Math.round(performance.now() - t0)`,
+      `const r = loadCarConfig({ explicitPath: configPath })`,
+      `if (r.error) { console.log('JITI_FAIL ' + r.error); process.exit(1) }`,
+      `console.log('OK model=' + r.config.llm?.model + ' firstLoadMs=' + elapsed + ' nativeRejected=' + nativeError.slice(0, 60).replace(/\\n/g, ' '))`,
+    ].join('\n'))
+    // --experimental-strip-types：仅类型剥离无转译（22.19+ 可用；enum 属 transform-only 形态）
+    const { code, stdout } = await new Promise<{ code: number | null; stdout: string }>(resolve => {
+      const child = spawn(process.execPath, ['--experimental-strip-types', fixture, configPath], { stdio: ['ignore', 'pipe', 'pipe'] })
+      let out = ''
+      child.stdout.on('data', d => { out += d })
+      child.on('exit', c => resolve({ code: c, stdout: out }))
+    })
+    assert.equal(code, 0, 'strip-only 环境下 jiti 真载 enum 配置')
+    const m = /OK model=(\S+) firstLoadMs=(\d+) nativeRejected=(.+)/.exec(stdout.trim())!
+    assert.equal(m[1], 'strip-model')
+    assert.ok(m[2] !== undefined, '首载时延实测出值')
+    console.log(`    [登记] car.config.ts jiti 首载时延（spawn 冷启，本机实跑）：${m[2]} ms`)
+    assert.ok(Number(m[2]) < 15_000, '首载时延宽上界（CI 防抖；真实数值进收口报告）')
+    assert.ok(m[3]!.length > 0, '负控：原生 import 对非可擦除语法显式失败——jiti 是载体而非原生剥离')
+  })
+})
+
+test('S38: CLI 真路径——car run 于 enum 配置目录：配置经 jiti 装载生效（模型未配引导而非配置报错）', async () => {
+  await withTempDir('cli', async dir => {
+    writeFileSync(join(dir, 'car.config.ts'), [
+      `export enum LlmMode { full = 'full-model' }`,
+      `export default { llm: { model: LlmMode.full } }`,
+    ].join('\n'))
+    const plugin = join(dir, 'noop.ts')
+    writeFileSync(plugin, [
+      `export const manifest = { name: "s38p", version: "1.0.0" }`,
+      `export default function apply(api) { api.registerTool({ name: "noop", declaredSideEffect: "readonly", run: async () => "ok" }) }`,
+    ].join('\n'))
+    const { code, output } = await new Promise<{ code: number | null; output: string }>(resolve => {
+      const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'run', plugin], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] })
+      let out = ''
+      child.stdout.on('data', d => { out += d })
+      child.stderr.on('data', d => { out += d })
+      child.on('exit', c => resolve({ code: c, output: out }))
+    })
+    assert.equal(code, 2, 'D-13：无凭据/端点 → exit 2 显式引导')
+    assert.match(output, /CAR-E-LLM-CONFIG/, '配置经 jiti 解析通过（enum 值进 llm.model）走到模型就绪检查')
+    assert.doesNotMatch(output, /CAR-E-CONFIG/, '配置载体本身零错误')
+  })
+})

package/test/s39-otlp-span-semantics.spec.ts

@@ -0,0 +1,100 @@
+/**
+ * 1.7-S1 · OTLP span 语义标准化（D-26）：exception 标准事件 + status / addEvent 标准 events 编码
+ *
+ * 覆盖（1.7-迭代规划 TELE-1；1.4 遗留「遥测 OTLP 增强」出清主体）：
+ *  - recordException → OTel 规范形态：span event（name='exception'，exception.type/exception.message
+ *    事件属性 + timeUnixNano）+ span status → STATUS_CODE_ERROR——替换 1.1 起「仅 exception.message
+ *    属性 + 恒 UNSET」非标准形态；stacktrace 缺省不出站（D-26 口径：防路径/源码面外泄）
+ *  - addEvent → 标准 events 数组编码（name + 原形态属性 + 时刻）——替换 `event.<name>` JSON 属性串
+ *  - 出站体加法字段：无事件 span 不出 events 键（空形态合法）；正常 span 恒 STATUS_CODE_UNSET（行为不变面）
+ *  - noop 门面零出站不变（默认关三原则；s29/s32 回归由全量保证）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { createTelemetryFacade } from '../src/runtime-core/telemetry.ts'
+
+const okRes = () => ({ ok: true, status: 200 }) as unknown as Response
+
+function capture() {
+  const bodies: any[] = []
+  const f = createTelemetryFacade({ endpoint: 'https://otel' }, {
+    fetchImpl: (async (_u: string | URL, init?: RequestInit) => { bodies.push(JSON.parse(String(init?.body))); return okRes() }) as typeof fetch,
+  })
+  return { f, bodies }
+}
+
+const spansOf = (bodies: any[]) => bodies.filter(b => b.scopeSpans).flatMap(b => b.scopeSpans[0].spans)
+
+test('S39: recordException → 标准 exception 事件 + STATUS_CODE_ERROR（stacktrace 不出站）', async () => {
+  const { f, bodies } = capture()
+  const s = f.getTracer().startSpan('car.step', { attributes: { 'car.step': 1 } })
+  s.recordException(new TypeError('boom'))
+  s.end('error')
+  await f.flush()
+  const span = spansOf(bodies)[0]
+  assert.equal(span.status.code, 'STATUS_CODE_ERROR', 'recordException → status ERROR（1.7 前恒 UNSET）')
+  assert.ok(Array.isArray(span.events) && span.events.length === 1, 'exception 为 span event')
+  const ev = span.events[0]
+  assert.equal(ev.name, 'exception')
+  assert.ok(ev.timeUnixNano, '事件时刻出站')
+  const attrs = Object.fromEntries(ev.attributes.map((a: any) => [a.key, a.value.stringValue]))
+  assert.equal(attrs['exception.type'], 'TypeError', 'err.name → exception.type')
+  assert.equal(attrs['exception.message'], 'boom', 'err.message → exception.message')
+  const allKeys = [...span.attributes, ...span.events.flatMap((e: any) => e.attributes)].map((a: any) => a.key)
+  assert.equal(allKeys.some((k: string) => /stack/i.test(k)), false, 'stacktrace 缺省不出站（D-26）')
+  assert.equal(allKeys.includes('exception.message') && span.attributes.some((a: any) => a.key === 'exception.message'), false,
+    'exception.message 不再落于 span attributes（1.1 非标准形态退役）')
+})
+
+test('S39: recordException 非 Error 值兜底——type=Error / message=String(err)', async () => {
+  const { f, bodies } = capture()
+  const s = f.getTracer().startSpan('car.step')
+  s.recordException('plain failure')
+  s.end('error')
+  await f.flush()
+  const ev = spansOf(bodies)[0].events[0]
+  const attrs = Object.fromEntries(ev.attributes.map((a: any) => [a.key, a.value.stringValue]))
+  assert.deepEqual(attrs, { 'exception.type': 'Error', 'exception.message': 'plain failure' })
+})
+
+test('S39: addEvent → 标准 events 编码（原形态属性 + 时刻；attributes 不再承载事件）', async () => {
+  const { f, bodies } = capture()
+  const s = f.getTracer().startSpan('car.turn')
+  s.addEvent('cache-hit', { key: 'x', n: 1, flag: true })
+  s.end('completed')
+  await f.flush()
+  const span = spansOf(bodies)[0]
+  assert.equal(span.status.code, 'STATUS_CODE_UNSET', '正常 span 恒 UNSET（行为不变面）')
+  assert.equal(span.events.length, 1)
+  const ev = span.events[0]
+  assert.equal(ev.name, 'cache-hit')
+  assert.ok(ev.timeUnixNano)
+  const map = Object.fromEntries(ev.attributes.map((a: any) => [a.key, a.value]))
+  assert.deepEqual(map, { key: { stringValue: 'x' }, n: { doubleValue: 1 }, flag: { boolValue: true } },
+    '原形态属性出站（1.7 前为 event.<name>=JSON 串）')
+  const attrKeys = span.attributes.map((a: any) => a.key)
+  assert.equal(attrKeys.includes('event.cache-hit'), false, 'attributes 不再承载事件（非标准形态退役）')
+})
+
+test('S39: 无事件 span 不出 events 键（出站体加法字段——空形态合法）', async () => {
+  const { f, bodies } = capture()
+  f.getTracer().startSpan('plain').end()
+  await f.flush()
+  const span = spansOf(bodies)[0]
+  assert.equal('events' in span, false, '无事件不出 events 键')
+  assert.equal(span.status.code, 'STATUS_CODE_UNSET')
+})
+
+test('S39: 多事件按序出站（exception 与 addEvent 混排——事件数组保序）', async () => {
+  const { f, bodies } = capture()
+  const s = f.getTracer().startSpan('car.step')
+  s.addEvent('retry')
+  s.recordException(new Error('net'))
+  s.addEvent('fallback')
+  s.end('completed')
+  await f.flush()
+  const names = spansOf(bodies)[0].events.map((e: any) => e.name)
+  assert.deepEqual(names, ['retry', 'exception', 'fallback'])
+  // exception 事件混排下 status 仍 ERROR
+  assert.equal(spansOf(bodies)[0].status.code, 'STATUS_CODE_ERROR')
+})