@thincoder/core 0.10.7 → 0.10.9

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to the core package are documented here.
 Format: Keep a Changelog · 中文 · 号在发布时定（CalVer——见 `docs/RELEASE.md` §4）。
 
+## [Unreleased]
+
+## [0.10.9] — 2026-10-19
+
+### Removed
+
+- **`design-slots` 的 `reveal` 开关与掩蔽（token-visibility-simplify 批 2026-10-17）**：清点面改**直读**——逐槽行恒携 `designToken`（过期照列、`status` 自标态；记录畸形 ⇒ `—`）；删净 `reveal` 开关 / 掩蔽 / 一次一槽限制（用户裁定「没必要把 token 藏起来，agent 要就告诉他」）；签发链（mint / settle / TTL / persist）零改。
+
+## [0.10.8] — 2026-10-16
+
+> 0.10.7 → 0.10.8（月内 +1——发布时定号）
+
+### Added
+
+- **MCP 探活具名读数（#1431——2026-10-14 走查轮）**：`probeMcpServer` 返回值增 `tools`（工具名数组——原 `mcpTools` 到手即弃，控制台探活只见计数）；服务端页面随正（具名读数形，缺名回落计数形——零回归）。
+- **注入开关（#1420——injection-switches 批 2026-10-14）**：`agent.injectDocs` ∥ `agent.injectMemories` 两枚全局开关（DEFAULTS `true`；判据 `!== false`）；关 = 阻断三块自动注入（项目指令文件块 ∥ 文档检索块 ∥ 记忆检索块——检索调用不执行），不删数据；`settings` 工具 + CLI `/config` 热应用（写后下一次组装生效）；VSC/桌面设置界面各落两开关。
+- **SSH 会话工具（#1436——ssh-session 批 2026-10-14）**：`ssh` 工具（`connect`/`send`/`read`/`secret_input`/`close`/`list`——多往返会话、状态保持、设备提示符与分页驱动）；密钥 / agent 优先，需要密码走凭据弹窗（**值零入上下文**——`onSecretInput` 注入缝 + askpass 链）；**零第三方依赖**（系统 openssh + `ssh -tt` 远端 PTY + `SSH_ASKPASS`）；三端（CLI / VSC / 桌面）界面在位。
+- **`design-slots` 回收读口（#1384——design-token-recovery 批 2026-10-14）**：`designId` 过滤单槽（trim 精确匹配；未知 ⇒ 拒 + 列在场 id）∥ `reveal:true` 揭值（必携 `designId`；只揭活槽——过期/畸形槽掩蔽注因；`null` 视同缺省——零揭值不 fail-open）；`log.mjs` `SECRET_FORM` 增 token 值形（`uuid:epoch`）。
+- **产品内建 `doc_check` 工具（#1586——builtin-doc-check 批 2026-10-16）**：文档纪律机检内建为产品工具（只读 · 报告态 · **非门禁**）——起步两条判据：锚（档 token ± `§N` ⇒ 档缺 ∥ 节缺；行号不作节指）∥ 行宽（>300 字符；四类谓词 + 区带豁免）；声明面 = `PROJECT-MANIFEST.json` `checkConfig`（零硬编码路径）；项目自建脚本退出判据链。
+- **台账工具项目根读写同一推导（#1588——ledger-root-derivation 批 2026-10-16）**：`resolveLedgerRoot` 判据单源（自目标路径沿祖先链取最近「已注册」= 带档 ∨ 自身路径键控库在盘；工作区态不立为根）；族发现取祖先支；无根契约 = 读面空账 ∥ 写面抛（零落盘）；写面「抛错列候选」退场。
+
 ## [0.10.7] — 2026-10-14
 
 > 0.10.6 → 0.10.7（月内 +1——发布时定号）

package/advisor/compaction.mjs

@@ -10,7 +10,7 @@
  * advisor-loop-split 批：loop 的压缩检查点归位本档（`compactContextIfNeeded`——`context_limit` 尾串生成点同迁；时间线面 ⇒ `advisor/timeline.mjs`）。
  */
 
-import { providerSpec, outputReserve, usableWindow } from "../config.mjs" // 第 25 批：预算派生（与 loop.mjs:12 同源导入）；`outputReserve`/`usableWindow` = 2026-10-06 预留裁定（#975）
+import { providerSpec, outputReserve, usableWindow } from "../config.mjs" // 第 25 批：预算派生（与 loop.mjs 的 providerSpec 同源导入）；`outputReserve`/`usableWindow` = 2026-10-06 预留裁定（#975）
 // B4（群 B 批，ADVISOR-GUARDS.md §9——F32）：CJK 加权单源（provider/rate.mjs 叶子向无环）
 import { estimateText } from "../provider/rate.mjs"
 

package/advisor/run.mjs

@@ -37,7 +37,7 @@ export function resolveAdvisorProvider(agent) {
       // chat 前 `assertProviderModel` fail-fast（不静默）。
       const result = cfg.model ? { ...provider, model: cfg.model } : { ...provider, model: agent.provider?.model }
       // 台账 #329 / `MODEL-SPECS.md §15.4-3`：off 形须**活着到达载荷层**——载荷层 off 门首款 = `provider.thinking === null`
-      // （`thincoder-core/provider/core.mjs:213-219`）；归一为 `undefined` 会让该门永不开（effort 族 advisor
+      // （`thincoder-core/provider/core.mjs` 的 `chatImpl`）；归一为 `undefined` 会让该门永不开（effort 族 advisor
       // 关思考静默失效）。显式 off 同清**继承档**（渠条目自带 / 主 provider 的 `reasoningEffort` 不得随行——
       // 随行则显式档支先命中、off 意图作废）。`false`（非法原值）仍归一 `undefined`（零变）。
       if (cfg.thinking === null) {

package/agent/chat-call.mjs

@@ -5,6 +5,7 @@
  * 由 runAgent 的 catch/finally 收束。
  */
 import { chat } from "../provider/index.mjs"
+import { healImageRejection, clearImageFailStreak } from "./image-heal.mjs"
 
 /** 流式输出门（§2.5 #78 并入——VSC 三态门，纯函数可直驱测试）：depth 0 恒通；
  *  consult 子代理豁免（其输出进会诊面板）；其余经 `streamOutput` 显式选择进入。 */
@@ -24,32 +25,36 @@ export async function callModelTurn(agent, {
     await classifyAndApply(agent, turn).catch(() => {})
   }
 
-  try {      response = await chat(agent.provider, {
-      messages, tools: toolSchemas,
-      // §2.5 #78 并入（VSC onToken 三态门）：depth 0 恒通；consult 子代理豁免（其输出进
-      // 会诊面板）；escalate 等经 opts.streamOutput 显式选择进入；其余子代理不流式。
-      onToken: streamOutputAllowed(depth, agent._role, streamOutput) ? callbacks.onToken : null,
-      onReasoning: callbacks.onReasoning,
-      onWait: callbacks.onWait,
-      signal,
-      streamRules: agent.config.agent?.streamRules ?? [],
-      firedPatterns: streamRuleFired,
-      // LOGGING（LOGGING.md）：llm:* 事件的语义上下文（stage=turn 主循环回合——含
-      // digest 消化轮 auto=true；child=子代理 id（spawn 时 stamp 于 child._logId））
-      // TRACES.md §6.1 D-TR4：轨迹元数据增补（role/depth/kind/session/cwd——trace-store 只读
-      // logCtx，签名不变）；kind：depth>0 = subagent（consult 孩子 = consult）——子代理
-      // 对回靠 role+depth+child id（children 无 _sessionStart——不经 depth-0 设置——
-      // session 字段对子代理轨迹为 null——见 trace-store/agent.mjs 注释）。
-      logCtx: {
-        stage: "turn", turn: turn + 1, auto: autoTurn, child: agent._logId,
-        role: agent._role ?? null,
-        depth,
-        kind: depth > 0 ? (agent._role === "consult" ? "consult" : "subagent") : "turn",
-        session: agent._sessionStart ?? null,
-        cwd: agent.cwd,
-        traces: agent.config?.traces?.enabled !== false,
-      },
-    })
+  // 发送选项（首送 ∥ §6.26 自愈重发共用——两送除 messages 外逐字同参）
+  const sendOpts = {
+    tools: toolSchemas,
+    // §2.5 #78 并入（VSC onToken 三态门）：depth 0 恒通；consult 子代理豁免（其输出进
+    // 会诊面板）；escalate 等经 opts.streamOutput 显式选择进入；其余子代理不流式。
+    onToken: streamOutputAllowed(depth, agent._role, streamOutput) ? callbacks.onToken : null,
+    onReasoning: callbacks.onReasoning,
+    onWait: callbacks.onWait,
+    signal,
+    streamRules: agent.config.agent?.streamRules ?? [],
+    firedPatterns: streamRuleFired,
+    // LOGGING（LOGGING.md）：llm:* 事件的语义上下文（stage=turn 主循环回合——含
+    // digest 消化轮 auto=true；child=子代理 id（spawn 时 stamp 于 child._logId））
+    // TRACES.md §6.1 D-TR4：轨迹元数据增补（role/depth/kind/session/cwd——trace-store 只读
+    // logCtx，签名不变）；kind：depth>0 = subagent（consult 孩子 = consult）——子代理
+    // 对回靠 role+depth+child id（children 无 _sessionStart——不经 depth-0 设置——
+    // session 字段对子代理轨迹为 null——见 trace-store/agent.mjs 注释）。
+    logCtx: {
+      stage: "turn", turn: turn + 1, auto: autoTurn, child: agent._logId,
+      role: agent._role ?? null,
+      depth,
+      kind: depth > 0 ? (agent._role === "consult" ? "consult" : "subagent") : "turn",
+      session: agent._sessionStart ?? null,
+      cwd: agent.cwd,
+      traces: agent.config?.traces?.enabled !== false,
+    },
+  }
+
+  try {
+    response = await chat(agent.provider, { messages, ...sendOpts })
   } catch (e) {
     // User interrupt (Ctrl+I): controller.abort({ interrupt: true, message }).
     // Inject into history; the outer loop recreates the controller and resumes.
@@ -61,8 +66,16 @@ export async function callModelTurn(agent, {
         agent.history.push({ role: "user", content: msg })
       }
     }
-    throw e
+    // §6.26 图片拒绝自愈（判定 ∥ 剥除 ∥ 注记 ∥ 记账 = agent/image-heal.mjs 单源）：
+    // 未愈 ⇒ 原错照抛（非图像错误零误伤）；已愈 ⇒ 载荷已修（历史无图 + 机读注记）单次重发。
+    const { healed } = healImageRejection(agent, e)
+    if (!healed) throw e
+    // 重建消息（§6.26 步 4——剥除后的 agent.history 含注记）：再发一次（非重试——同请求
+    // 重发对图像拒绝恒无效）；再败 ⇒ 本行抛新错（不循环、不二次剥除，历史保持已剥除态）。
+    response = await chat(agent.provider, { messages: [{ role: "system", content: systemPrompt }, ...agent.history], ...sendOpts })
   }
+  // §6.26 清零调用点（记账单源 = image-heal.mjs）：任一次成功调用清零（含自愈重发成功）
+  clearImageFailStreak(agent)
 
   return response
 }

package/agent/child-marks.mjs

@@ -8,7 +8,7 @@
  * 原样再导出 ⇒ 既有 import 面（核 agent-tools 族 / CLI `tool-events.mjs`）零改。
  *
  * 语义：消费端用 `includes()` 检出锚点 ⇒ 合成块头注记（"work may be partial"）——两端各一处：
- * CLI = `thincoder-cli/src/tui/tool-events.mjs:217`；端壳 = `thincoder-vscode/src/extension/
+ * CLI = `thincoder-cli/src/tui/tool-events.mjs` 的 `onToolResult`；端壳 = `thincoder-vscode/src/extension/
  * panel-callbacks.mjs`（onToolResult）。文案演进只改这里（与检测判据单源——消除文案/判据漂移面）。
  *
  * 零 import——任意层可引、无环。

package/agent/dispatch-gates.mjs

@@ -11,6 +11,7 @@ import { writeFileSync, mkdirSync, existsSync } from "node:fs"
 import { join, resolve } from "node:path"
 import { homedir } from "node:os"
 import { toolTouchPaths } from "./helpers.mjs"
+import { redactArgs } from "../log.mjs" // #1432：args 落痕前过遮蔽链（单源 redactSecret 族；log.mjs 为叶——零环）
 // fix A（2026-09-07）：FILE_MUTATORS 的 mutation-seq 记账从
 // 批后提交（record-results noteMutations）移到执行成功即刻——唯一记账点（取代批后段
 // + agent.mjs 中断分支记账——不双计）——同消息 [写 + async advisor launch] 时 launch 前
@@ -32,10 +33,11 @@ export function logToolError(toolName, args, error) {
     const dir = join(ERRORS_DIR, ymd)
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
     const file = join(dir, `${ts}-${toolName.replace(/[/\\]/g, "_")}.log`)
+    const argsText = JSON.stringify(redactArgs(args), null, 2) // #1432：遮蔽先于截断（≤2000 截断零改）
     const entry = [
       `time: ${now.toISOString()}`,
       `tool: ${toolName}`,
-      `args: ${JSON.stringify(args, null, 2).slice(0, 2000)}${JSON.stringify(args, null, 2).length > 2000 ? "… (truncated)" : ""}`,
+      `args: ${argsText.slice(0, 2000)}${argsText.length > 2000 ? "… (truncated)" : ""}`,
       `error: ${error?.message ?? String(error)}`,
       error?.stack ? `stack:\n${error.stack}` : "",
     ].filter(Boolean).join("\n") + "\n"
@@ -60,8 +62,9 @@ export function logToolError(toolName, args, error) {
  * AGENT-LOOP-SUBAGENT.md §6.7.2 panel (round1 #5): view 面归只读类（同 status——planMode 放行、免
  * 审批、可批并行）；freeze 面归控制类（同 cancel——planMode 放行、免权限审批、
  * 批审批不入组、digest 内放行）。freeze 存在（非空 key）即控制类——否则只读类。
+ * #1178：泛化改名（原「子代理专用」谓词 ⇒ 通用动作级只读谓词——语义零改，旧标识符零余）——第二消费面 = agent/record-results.mjs 的 verify 失效链（动作级只读 ⇒ 不清 `_verifiedThisRun`）。
  */
-export function isSubagentReadonlyAction(toolName, args) {
+export function isReadonlyAction(toolName, args) {
   // §6 memory 工具面重构（MEMORY.md §6 D-M5）：memory search/list 是只读动作——与
   // subagent status 同分类（planMode 放行/免审批——Phase-2 批并行只认工具级
   // readonly/parallel，memory 无 parallel → 按非只读串行，见 MEMORY.md §6.4 实现注）。
@@ -92,7 +95,7 @@ export function isSubagentReadonlyAction(toolName, args) {
   if (action === "observe") return true
   // AGENT-LOOP-SUBAGENT.md §6.7.2 panel view 面（freeze 缺省/空 = 视图请求——readonly；非空 freeze 归控制类）
   if (action === "panel" && (args.freeze === undefined || args.freeze === null || String(args.freeze) === "")) return true
-  // DESIGN-TOKEN-SETTLEMENT.md §10 F-SL1（2026-10-07 批 ledger-tool）：design-slots = 只读清点
+  // DESIGN-TOKEN-SETTLEMENT.md §9 F-SL1（2026-10-07 批 ledger-tool）：design-slots = 只读清点
   // （同 status / observe——planMode 放行 / 免审批 / digest 放行；工程模式父侧门在执行器内）。
   if (action === "design-slots") return true
   return false
@@ -127,7 +130,7 @@ export function isSubagentEscalateAction(toolName, args) {
  *  由此保形；核内工具零钩子 ⇒ CLI ∕ desktop 逐字零变（`undefined ?? 核谓词`）。
  *  两谓词 = 上列两门禁位（planMode ∕ 权限短路）的公共输入（同址同用，防两处漂移）。 */
 export function readonlyActionOf(tool, toolName, args) {
-  return tool?.isReadonlyAction?.(args) ?? isSubagentReadonlyAction(toolName, args)
+  return tool?.isReadonlyAction?.(args) ?? isReadonlyAction(toolName, args)
 }
 export function controlActionOf(tool, toolName, args) {
   return tool?.isControlAction?.(args) ?? isSubagentControlAction(toolName, args)

package/agent/dispatch-run.mjs

@@ -105,6 +105,7 @@ export async function runPreparedItem(item, agent, depth, signal, callbacks) {
       _toolCallId: item.toolCall.id,
       onOutput: (chunk) => callbacks.onToolOutput?.(item.toolCall.name, chunk, item.toolCall.id),
       onQuestion: callbacks.onQuestion,
+      onSecretInput: callbacks.onSecretInput,
       onPermissionRequest: callbacks.onPermissionRequest,
     }
     try {

package/agent/family-tools.mjs

@@ -2,7 +2,7 @@
  * agent/family-tools.mjs — 家族矩阵单源（`assembleFamilyTools`）。
  *
  * 批次 `docs/batches/2026-09-15-vsc-tool-table-dup.md` §2.3A：家族矩阵（哪个运行面得哪些
- * 家族工具）自 CLI 侧 `agent/setup.mjs:173-293`（as-of 迁出前坐标）整体迁出——CLI 与 VSC 同调同一份实现
+ * 家族工具）自 CLI 侧 `agent/setup.mjs` 的 `assembleFamilyTools`（as-of 迁出前坐标）整体迁出——CLI 与 VSC 同调同一份实现
  * （消灭「同一角色矩阵两份实现」= 本批缺陷的类根因）；端差（VSC 装饰链 / settings 追加 /
  * consult 池来源）经 `decorate` 注入——**不传 = 核默认形态**（CLI = 迁出前逐字）。
  *
@@ -26,7 +26,7 @@ export async function assembleFamilyTools({
   decorate = null,       // object   端差面：{ subagent?, consultStart?, consultStop?, settings? }
 } = {}) {
   // CORE-UNIFICATION TOOLS #83：consult 家族随统一登记册自 `../agent-tools.mjs` 取用（单一来源）
-  const { planTool, subagentTool, taskTool, skillTool, goalTool, verifyTool, recentChangesTool, timerTool, advisorTool, engTool, readHistoryTool, contextTool, batchTool, manifestTool, consultStartTool, consultStopTool, parentChannelTool } = await import("../agent-tools.mjs")
+  const { planTool, subagentTool, taskTool, skillTool, goalTool, verifyTool, recentChangesTool, timerTool, advisorTool, engTool, readHistoryTool, contextTool, batchTool, manifestTool, consultStartTool, consultStopTool, parentChannelTool, docCheckTool } = await import("../agent-tools.mjs")
   // 台账统一入口（2026-10-05 统一入口批——台账 #923）：全量变体 = depth-0 段 ∥ 只读变体 = 全部
   // depth>0 段。动态 import——ledger 链静态达 node:sqlite（W8 契约②）；两变体同名单对象、schema 窄化。
   const { ledgerTool, ledgerReadTool } = await import("../ledger.mjs")
@@ -125,8 +125,8 @@ export async function assembleFamilyTools({
           ...subagentTool,
           name: "subagent",
           description: designer
-            ? "Spawn a read-only `explore` sub-agent to SURVEY the current state for the design: it reads code / docs / existing designs and reports evidence with file:line. BLOCKING ONLY (no async) and action:'spawn' ONLY — the survey channel is read-only; escalate/status/cancel/panel/consume-design/observe/send are not available. Survey budget: ≤6 explore spawns per batch — the main agent's survey result is reference only; do your own."
-            : "Spawn a read-only `explore` sub-agent to AUDIT your delivery against the design: it compares the delivered code with the design for divergence — partially implemented acceptance criteria, silent simplifications, doc drift, changes outside the approved file list. BLOCKING ONLY (no async — the audit report decides your next protocol step). action:'spawn' ONLY — the audit channel is a read-only spawn; escalate/status/cancel/panel/consume-design/observe/send are not available. The audit task book is appended MECHANICALLY — your own spawn task (docs involved / acceptance criteria / file list) plus the files you actually touched; never hand the audit a self-written file list (a self-report could omit exactly the out-of-scope file it must catch).",
+            ? "Spawn a read-only `explore` sub-agent to SURVEY the current state for the design: it reads code / docs / existing designs and reports evidence with file:line. BLOCKING ONLY (no async) and action:'spawn' ONLY — the survey channel is read-only; escalate/status/cancel/panel/consume-design/observe/send are not available. Survey budget: ≤6 explore spawns per batch — the main agent's survey result is reference only; do your own. The spawn carries the five task-book parameters (four core: goal / knownFacts / acceptance / reportFormat + `scope`); a task-only spawn is refused."
+            : "Spawn a read-only `explore` sub-agent to AUDIT your delivery against the design: it compares the delivered code with the design for divergence — partially implemented acceptance criteria, silent simplifications, doc drift, changes outside the approved file list. BLOCKING ONLY (no async — the audit report decides your next protocol step). action:'spawn' ONLY — the audit channel is a read-only spawn; escalate/status/cancel/panel/consume-design/observe/send are not available. The audit task book is appended MECHANICALLY — your own spawn task (docs involved / acceptance criteria / file list) plus the files you actually touched; never hand the audit a self-written file list (a self-report could omit exactly the out-of-scope file it must catch). The spawn carries the five task-book parameters (four core: goal / knownFacts / acceptance / reportFormat + `scope`); a task-only spawn is refused.",
           parameters: { ...subagentTool.parameters, properties: props },
         }
       })()
@@ -151,6 +151,9 @@ export async function assembleFamilyTools({
       // manifest 工具（`MANIFEST.md` §2.10 · 2026-10-08 · 台账 #1098）：主 agent 读写出口——
       // **两模式同挂**（需求未设模式门）；子代理各段零挂（未装配 = 权限面第一道）。
       manifestTool,
+      // 文档纪律机检（`DOC-DISCIPLINE.md` §3.20 条目 S）：只读报告态——depth-0 主 agent 段；
+      // 写文档 / 设计档的角色段（eng-coder / eng-designer）另挂（见下两分支）。
+      docCheckTool,
       // 端差（decorate.settings——VSC depth-0 主 agent 面；缺省不追加）：核默认形态里
       // settings 住**基础集**（`tools/index.mjs` `assembleBuiltinTools`），端侧自持清单
       // 无该面 ⇒ 端以 decorate 补位（收敛通道 = 将来去 decorate 项即归核位）。
@@ -175,12 +178,14 @@ export async function assembleFamilyTools({
     // SUBAGENT-UPSTREAM-CHANNEL（AGENT-LOOP-UPSTREAM.md §6.27.4 装配接线）：子代理上行通道
     // （`notify_parent`）随 depth>0 段**前置**——4 处携带 = eng-coder / eng-designer / coder / 兜底段
     // （未列名 depth>0 role 落同一兜底段 ⇒ 亦装配；语义 =「depth>0 且非 consult 皆装配」）；
-    // 计数口径：`consult` 分支不入 ⇒ 「5 个插入点」读法已作废（实读 `thincoder-core/agent/family-tools.mjs:165-169`）。
+    // 计数口径：`consult` 分支不入 ⇒ 「5 个插入点」读法已作废（实读本档 eng 两分支的 `batch` 挂载段）。
     // consult 段不入（其角色语义 = 父发起的一次性会诊，父在其 settle 前不期望中途对话）。
     // 台账只读变体（query / count）——全部 depth>0 角色段（含 consult ∕ 兜底；写三 schema 级不可达）；
     // 团队台账只读变体（team-ledger 批）同律。
-    : engChildRole === "eng-coder" ? [parentChannelTool, ledgerReadTool, teamLedgerReadTool, advisorTool, verifyTool, batchTool(batchDoc), ...(engChildSubagent ? [engChildSubagent] : [])]
-    : engChildRole === "eng-designer" ? [parentChannelTool, ledgerReadTool, teamLedgerReadTool, batchTool(batchDoc), ...(engChildSubagent ? [engChildSubagent] : [])]
+    : engChildRole === "eng-coder" ? [parentChannelTool, ledgerReadTool, teamLedgerReadTool, advisorTool, verifyTool, batchTool(batchDoc), docCheckTool,
+      ...(engChildSubagent ? [engChildSubagent] : [])]
+    : engChildRole === "eng-designer" ? [parentChannelTool, ledgerReadTool, teamLedgerReadTool, batchTool(batchDoc), docCheckTool,
+      ...(engChildSubagent ? [engChildSubagent] : [])]
     : role === "coder" ? [parentChannelTool, ledgerReadTool, teamLedgerReadTool, verifyTool, advisorTool, ...(batchDoc ? [batchTool(batchDoc)] : [])]
     : role === "consult" ? [recentChangesTool, ledgerReadTool, teamLedgerReadTool]
     : [parentChannelTool, ledgerReadTool, teamLedgerReadTool]
@@ -191,7 +196,7 @@ export async function assembleFamilyTools({
   // execute 层另有机械拒兜底，见 `agent-tools/task.mjs`）。
   // 工程模式固定段 = plan / task 皆**不入表**；普通模式固定段逐字不变（FR31 边界 / F10 边界）。
   // 判据 = 单一模式位 `engineering`（不带深度分支——子代理面随同排除，role enum
-  // `:44-49` + spawn 门 / task execute 门已同向）。
+  // `subagentRoles` + spawn 门 / task execute 门已同向）。
   return engineering
     ? [timerTool, ...depthOnly]
     : [taskTool, planTool, timerTool, ...depthOnly]

package/agent/helpers.mjs

@@ -370,12 +370,14 @@ export function readonlyToolNames(tools) {
 }
 
 /** Depth>0 tool exclusions — subagents never get the interactive main-session tools (`question`:
- *  no user to ask; the routing guidance already lives in every persona file). Single source for
- *  the repo: the shell-side depth>0 filter consumes this set (design = TOOLS.md §6.16 / D-TO11). */
-export const SUBAGENT_TOOL_EXCLUSIONS = new Set(["question"])
+ *  no user to ask; `ssh`: the credential window is a user-facing event AND the session pool
+ *  belongs to the main session — no UI at depth>0 and no session to hand back; the routing
+ *  guidance already lives in every persona file). Single source for the repo: the shell-side
+ *  depth>0 filter consumes this set (design = TOOLS.md §6.16 / D-TO11 + §6.22). */
+export const SUBAGENT_TOOL_EXCLUSIONS = new Set(["question", "ssh"])
 
 /** Apply the depth>0 exclusion set — always returns a NEW array (parent table untouched).
- *  #9（TOOLS.md §6.19）：`bash` 的 `async` 参仅 depth-0——子代副本删参（照 `family-tools.mjs:98`
+ *  #9（TOOLS.md §6.19）：`bash` 的 `async` 参仅 depth-0——子代副本删参（照 `family-tools.mjs` 的 `engChildSubagent`
  *  先例；返回值仍恒新数组、未命中条目原对象直传）。运行期第二道在 `tools/bash.mjs` execute
  *  （照 `read_image`「schema 门 + 运行期第二道」双线先例）；批 browser-async-fix（#1045）同线
  *  扩至 `browser` 的 `async` 参（运行期第二道在 `tools/browser.mjs` execute）。 */
@@ -449,14 +451,14 @@ export const AUTO_TURN_DIGEST_DOMAIN =
 /** Engineering-mode auto-turn digest domain variant (mode = `agent.config.agent.engineering`;
  *  clause 2 drops the task-tool pointer — F10: the task tool is disabled in engineering mode,
  *  the batch record + ledger are the tracking authority). Single line, verbatim from the
- *  design doc (TOOLS.md §6.15.3); mechanism = AGENT-LOOP-ASYNC-POOL.md §6.8. Content authority = parent side. */
+ *  design doc (TOOLS.md §6.15.3); mechanism = AGENT-LOOP-ASYNC-POOL.md §6.8. Content basis = the mechanism doc; landing = eng-coder. */
 export const AUTO_TURN_DIGEST_DOMAIN_ENG =
   "[System reminder: auto-turn — background async subagents finished while there was no user message, and this turn runs automatically to digest their reports (the finished-report reminders above). No one is waiting for this reply, so organize only: 1) summarize each finished report's key points into this conversation for the user to read later; 2) (engineering mode: the task tool is disabled — no task-list update is expected this turn; the batch record + ledger are the tracking authority and are updated in real user turns); 3) write decision points with a suggested next step as text — do not execute it. FORBIDDEN this turn (mechanically enforced): modifying files, bash/execute/verify, spawning subagents, asking questions — those need a real user message. End the turn once the summaries are written.]"
 
 /** Up-stream wake-turn domain (AGENT-LOOP-UPSTREAM.md §6.27.12.8): a running subagent sent
  *  an in-flight message and is waiting for the reply — the digest domain's "No one is waiting
  *  for this reply" is the opposite of the truth, so the wake turn gets its own text.
- *  Verbatim from the design doc (single line — no newlines). Content authority = parent side. */
+ *  Verbatim from the design doc (single line — no newlines). Content basis = the mechanism doc; landing = eng-coder. */
 export const UPSTREAM_TURN_DOMAIN =
   "[System reminder: auto-turn — a running subagent sent you an in-flight message (shown below). No user message is waiting. Decide it now and reply with subagent action:'send' (id + message) — the child consumes the reply at its next turn boundary and keeps working on the unaffected parts; if the message needs no answer, say so in one line and move on. If finished subagent reports are also present above, summarize them as usual in the same turn. Do not start new work: FORBIDDEN this turn (mechanically enforced): modifying files, bash/execute/verify, spawning subagents, asking questions — those need a real user message. End the turn once the reply is sent.]"
 
@@ -464,16 +466,16 @@ export const UPSTREAM_TURN_DOMAIN =
  *  expired while the session was idle and the end's latch opened this turn automatically —
  *  neither the digest domain ("no one is waiting", organize-only) nor the up-stream domain
  *  (a subagent waiting for a reply) fits: the timer's own semantics is "act on what the
- *  timer was for". Verbatim from the parent-side final text (single line — no newlines).
- *  Content authority = parent side. */
+ *  timer was for". Verbatim from the mechanism doc (single line — no newlines).
+ *  Content basis = the mechanism doc; landing = eng-coder. */
 export const TIMER_TURN_DOMAIN =
   "[System reminder: auto-turn — a timer you set earlier has expired (reminder above). No user message is waiting. Act on what the timer was for now: pull the data or run the check rather than continuing to reason in the abstract. Stay within the work that was in flight when the timer was set; do not open unrelated new work. Wrap up as soon as the action is done or blocked.]"
 
 /** Digest-accounting requirement line (AGENT-LOOP-ASYNC-POOL.md §6.31.3 · batch digest-accounting ·
  *  2026-10-05)：消化轮账目要求——两档同发（手动 / AUTO）；manual 域文本只覆盖手动档 ⇒ 要求行
  *  独立常量承载，避免 AUTO 轮无要求。`<ids>` = 未销账 id 清单占位（动态拼 = digest-account.mjs
- *  `digestAccountRequirement`）；注入面 = transient（机器线独有）。Verbatim from the parent-side
- *  final text (single line — no newlines); content authority = parent side. */
+ *  `digestAccountRequirement`）；注入面 = transient（机器线独有）。Verbatim from the mechanism doc
+ *  (single line — no newlines). Content basis = the mechanism doc; landing = eng-coder. */
 export const DIGEST_ACCOUNT_DOMAIN =
   "[System reminder: digest accounting — for every report listed below as not yet accounted, emit exactly one line: \"[digest-ack #<id>] digested — <key points>\" (handled) or \"[digest-ack #<id>] deferred — <reason>\" (not handled). Not yet accounted: <ids>. Do not omit any.]"
 

package/agent/image-heal.mjs

@@ -0,0 +1,65 @@
+/**
+ * agent/image-heal.mjs — 图片拒绝自愈（PROVIDER.md §6.26；批 image-history-400 · 台账 #1450）。
+ *
+ * 判定（T1 图像语义 400 ∥ T2 同态重复）→ 全剥历史图（copy-on-write，人读线 `_fullHistory`
+ * 零损）→ 机读注记 → `_imageFailStreak` 记账（单源本档）。返回 `{ healed, dropped }`；零抛
+ * （失败面不阻断回合驱动——落账为尽力面）。重发（一次，非重试）与「再败照抛」归
+ * agent/chat-call.mjs catch 支；清零接口 = clearImageFailStreak（调用点 = chat-call 成功路径）。
+ */
+import { looksLikeImageRejection } from "../provider/errors.mjs"
+import { stripRejectedImages } from "../provider/normalize.mjs"
+import { logEvent } from "../log.mjs"
+
+/** 机读注记（§6.26 逐字；N = 剥除数）。 */
+const healNote = (n) =>
+  `[System reminder: the provider rejected the image payload (HTTP 4xx) — ${n} image(s) were dropped from the context so the session can continue; the request was re-sent. Re-read a downscaled copy with read_image if still needed, and tell the user which image(s) were dropped.]`
+
+/** 状态码提取（§6.26——技法同 T2 族：`LLM API error 4xx:` 构造位文本取码；非该族 ⇒ 0）。 */
+function statusCodeOf(text) {
+  const m = String(text ?? "").match(/LLM API error (\d{3}):/)
+  return m ? Number(m[1]) : 0
+}
+
+/** 历史 image part 计数（T1/T2 的「史含图」判据 + dropped 取数）。 */
+function countImageParts(messages) {
+  let n = 0
+  if (!Array.isArray(messages)) return 0
+  for (const m of messages) {
+    if (!Array.isArray(m?.content)) continue
+    for (const p of m.content) if (p?.type === "image_url") n++
+  }
+  return n
+}
+
+/** 成功路径清零（§6.26——清零调用点 = chat-call.mjs；Abort 豁免 ∥ 失败不清零）。 */
+export function clearImageFailStreak(agent) {
+  if (agent) agent._imageFailStreak = 0
+}
+
+/**
+ * 判定 ∥ 剥除 ∥ 注记 ∥ streak 记账（§6.26 机制 1–3。判定先后：T2 读本回合自增前值）。
+ * @returns {{ healed: boolean, dropped: number }}
+ */
+export function healImageRejection(agent, error) {
+  try {
+    // Abort 类失败豁免：既不自增也不清零（中断不是「被拒」——重启后原样重发）
+    if (!agent || error?.name === "AbortError") return { healed: false, dropped: 0 }
+    const message = String(error?.message ?? "")
+    const code = statusCodeOf(message)
+    const is4xxNon429 = code >= 400 && code < 500 && code !== 429 // 429 归 provider 重试族
+    const prev = Number(agent._imageFailStreak) || 0
+    if (is4xxNon429) agent._imageFailStreak = prev + 1 // 自增（T2 判据读上值——见上方调用序）
+    const dropped = countImageParts(agent.history)
+    if (dropped === 0) return { healed: false, dropped: 0 } // 剥除后自熄面：两判据皆需「史含图」
+    const t1 = code === 400 && looksLikeImageRejection(message) // 图像语义 400（HTTP 400 合取）
+    const t2 = is4xxNon429 && prev >= 1 // 结构兜底：上一回合同类失败（防网关文案不在词表内）
+    if (!t1 && !t2) return { healed: false, dropped: 0 }
+    // 全剥（历史本体持久修正——后续回合不再重发毒图）+ 机读注记（模型知晓 + 复合指令）
+    agent.history = stripRejectedImages(agent.history)
+    agent.history.push({ role: "user", content: healNote(dropped) })
+    logEvent("llm:image-heal", { dropped, streak: agent._imageFailStreak, model: agent.provider?.model })
+    return { healed: true, dropped }
+  } catch {
+    return { healed: false, dropped: 0 } // §6.26 零抛：失败面不阻断回合驱动
+  }
+}

package/agent/light-round.mjs

@@ -6,7 +6,7 @@
  *   ② 该指针指向的轮次批档：`§1` 状态行 = 「进行中」（判定器单源 = `readBatchStatusLine`）。
  * 查找面（纯向下）= 会话锚 + 其直接子目录一层（候选枚举单源 = `ledgerChildren`——与族发现同级判据
  * 同源；不递归 ∥ 不取同胞）：逐候选查行 ∥ 以各候选为基解析指针（台账写门同式）。歧义候选
- * （`projectRootView` 判 `ambiguous`——如工作区锚自身）⇒ 跳过该候选、照查其余（既定观察态，非读错）；
+ * （`projectRootView` 判 `workspace`——如工作区锚自身）⇒ 跳过该候选、照查其余（既定观察态，非读错）；
  * 候选读错 ∥ 不可判 ⇒ 停本候选（总判不因他候选读错而失——开路凭据仍是「两件校验全过」）。
  * 语义：开门动作 ≡ 开轮两件落盘（「启动即挂账」本体——无独立于账的开门面）；单件不放行
  * （轮档独在 ∥ 行独在 ∥ 无标记 ∥ 行非在途 ∥ 指针失据 ∥ 档已收口 ⇒ 皆 false）；收口即自闭
@@ -38,9 +38,9 @@ export async function lightRoundOpen(agent) {
     // 候选面 = 锚自身 + 直接子目录一层（纯向下；子项枚举单源 = `ledgerChildren`）。
     const candidates = [anchor, ...ledgerChildren(anchor).map((p) => p.root)]
     for (const cand of candidates) {
-      // 歧义候选（≥2 候选项目——`projectRootView`）⇒ 跳过、照查其余（歧义锚不充当项目 = AC-M2-19 同判；
-      // `openLedger` 歧义拒 = AC-M2-17——既定观察态，非读错）。
-      if (projectRootView(cand).state === "ambiguous") continue
+      // 工作区候选（下辖 ≥2 项目——`projectRootView`）⇒ 跳过、照查其余（工作区锚不充当项目 = AC-M2-19 同判；
+      // 该态判据 = 根推导单源「已注册」的库臂排除（键控库在盘 ≠ 可作项目）——既定观察态，非读错）。
+      if (projectRootView(cand).state === "workspace") continue
       let rows
       try { rows = ledgerQuery({ cwd: cand, status: "在途" }) } catch { continue } // 候选读错 ⇒ 停本候选
       if (!Array.isArray(rows) || rows.length === 0) continue

package/agent/live-beat.mjs

@@ -1,14 +1,14 @@
 /**
  * agent/live-beat.mjs — 存活投影心跳（拍间隔 ∕ 单拍 ∕ 起 ∕ 停 —— 幂等 · 清点）——「桌面处理流 · VSC 对齐」批 R6 上提产物。
  *
- * 上提源（迁移前坐标）= VSC `thincoder-vscode/src/extension/panel-messages.mjs:45`（`LIVE_HEARTBEAT_MS = 2000`）
- * `:50`（单拍 `liveHeartbeatBeat`）`:62-75`（起 ∕ 停 `startLiveHeartbeat` ∕ `stopLiveHeartbeat`）；
+ * 上提源（迁移前坐标）= VSC `thincoder-vscode/src/extension/panel-messages.mjs`（`LIVE_HEARTBEAT_MS = 2000`）
+ * （单拍 `liveHeartbeatBeat`）·（起 ∕ 停 `startLiveHeartbeat` ∕ `stopLiveHeartbeat`）；
  * 桌面先例 = `thincoder-desktop/src/main/subagent-face.mjs`（拍体逐键清点）。**纯搬 + 转口，零语义改**：
  * 拍间隔 ∕ 单拍 ∕ 起停 ∕ 幂等 ∕ 清点入核。两处 VSC 端面判据**随拍体留端**（非本档语义）：
  * 「未就绪不拍」前置（`panel._wvReady`）与拍日志（`ev:subreassert`）。
  *
  * 拍体（`beat` 注入）= 各端存活再断言本体：VSC = `reassertLiveChildren(panel)`（`thincoder-vscode/src/
- * extension/suspension.mjs:148` 投影面）；桌面 = 逐键 `bridge(key).reassertLive(agent)`（只发在飞实例）。
+ * extension/suspension.mjs` 的 `reassertLiveChildren` 投影面）；桌面 = 逐键 `bridge(key).reassertLive(agent)`（只发在飞实例）。
  * 回值 = 本拍投递条数（**清点**读数 —— 拍体自清点，本档原样透传）。
  * **`setInterval` ∕ `unref` 转注入缝**：`timer(fn, ms) ⇒ handle` ∕ `clear(handle)` 由调用方注入
  * （缺省 = 平台 `setInterval` ∕ `clearInterval`；句柄 `unref` = 可选面 —— 在场即调，不阻进程退出）。
@@ -16,7 +16,7 @@
  * 迁移轮改指本档（2026-09-29，双写窗口收口；两处 VSC 端面判据随拍体留端）。
  */
 
-/** 拍间隔（毫秒）——单源（VSC 同值 `panel-messages.mjs:45`）：起拍即按此周期。 */
+/** 拍间隔（毫秒）——单源（VSC 同值 `panel-messages.mjs` 的 `LIVE_HEARTBEAT_MS`）：起拍即按此周期。 */
 export const LIVE_HEARTBEAT_MS = 2000
 
 /**

package/agent/post-turn.mjs

@@ -10,6 +10,31 @@ export const STALL_WINDOW_SIZE = 5
 export const STALL_THRESHOLD = 3
 export const GOAL_BUDGET_WARN_RATIO = 0.75
 
+// 设计轮轮数注入阈值（AGENT-LOOP.md §6.6「设计轮轮数注入」· 台账 #1661）：
+// 5 = 在 persona 判定点（过 7 轮未落盘 ⇒ 降级）之前 3 轮给出计数；8 = 与 persona 同一判定点；
+// 15 = persona 的首版预算（注入串里的 15 一律由它插值——改常量即改注入文本，不另留字面）。
+export const DESIGN_TURN_NOTICE_AT = 5
+export const DESIGN_TURN_SKELETON_AT = 8
+export const DESIGN_FIRST_VERSION_TURNS = 15
+
+/**
+ * 设计轮轮数提醒（纯函数——注入串 | `null`；判据源 = 链内累计轮号 + 本设计轮是否落过盘）。
+ * 逐字注入形 = `AGENT-LOOP.md` §6.6「注入形逐字」；角色表当前一行（`eng-designer`），
+ * `eng-coder` 零注入（其零落笔面另由零落笔看门狗兜）。
+ * @param {{role?:string|null, turn?:number, wrote?:boolean}} o `turn` = 链内累计轮号（1 起）
+ * @returns {string|null}
+ */
+export function designTurnReminder({ role, turn, wrote } = {}) {
+  if (role !== "eng-designer") return null
+  const used = Number(turn ?? 0)
+  if (!Number.isFinite(used) || used < DESIGN_TURN_NOTICE_AT) return null
+  const budget = DESIGN_FIRST_VERSION_TURNS
+  if (used >= DESIGN_TURN_SKELETON_AT && !wrote) {
+    return `[System reminder: design round turn ${used}/${budget} — nothing has been written to disk yet. The 7-turn mark has passed with nothing landed: degrade the delivery NOW — write the skeleton (design doc + batch record §2) plus an unresolved list, then refine in place.]`
+  }
+  return `[System reminder: design round turn ${used}/${budget} — ${wrote ? "something has been written to disk" : "nothing has been written to disk yet"}. First version budget is ${budget} turns; past 7 turns with nothing landed the rule is a skeleton + unresolved list.]`
+}
+
 /**
  * Inject all post-turn events into agent history.
  * Must be called after every tool-execution turn within runAgent's loop.
@@ -66,5 +91,14 @@ export function injectPostTurn(agent, results, recentCallSigs, callbacks, turn,
     })
   }
 
+  // 设计轮轮数注入（AGENT-LOOP.md §6.6 · 台账 #1661）：轮号取 `_currentTurn`（链内累计、续跑不重置），
+  // 写入痕迹取 `_touchedFiles`（在 resume 保留集内 ⇒ 续跑段沿用前段痕迹）；段内 `turn` 形参不参与判据。
+  const designReminder = designTurnReminder({
+    role: agent._role,
+    turn: agent._currentTurn ?? 0,
+    wrote: (agent._touchedFiles ?? []).length > 0,
+  })
+  if (designReminder) agent.history.push({ role: "user", content: designReminder })
+
   callbacks.onTurnEnd?.(agent, turn)
 }

package/agent/record-results.mjs

@@ -32,9 +32,16 @@ import { advisorRuns, stripApprovedSuffix } from "../agent-tools/advisor-async.m
 import { looksLikeReviewOutput, advisorIncompleteMarker } from "../advisor/run.mjs"
 // #949（评审 history 串台面）：同步面投递水印单点（叶档——零环）。
 import { noteReviewDelivered } from "../agent-tools/review-facts.mjs"
+// #1178：动作级只读分类（settings get ∥ manifest read 类）不失效 verify——谓词单源 = dispatch-gates。
+import { isReadonlyAction } from "./dispatch-gates.mjs"
 
 let _reindexFile = null
 
+/** 动作级只读分类的入参（畸形 ⇒ null——谓词自守；解析口径同 dispatch 相位一）。 */
+function actionArgsOf(toolCall) {
+  try { return JSON.parse(toolCall.arguments || "{}") } catch { return null }
+}
+
 export async function recordToolResults(agent, toolByName, results) {
   // Multimodal user messages (injected images / not-injected reminders) must NOT be pushed
   // between tool results of parallel calls — strict providers (DeepSeek) 400 when a tool
@@ -88,7 +95,7 @@ export async function recordToolResults(agent, toolByName, results) {
         agent._calledAdvisorThisRun = false
         agent._verifiedThisRun = false
         agent._verifyPassed = undefined
-      } else if (!tool.readonly && !tool.sideEffectExempt) {
+      } else if (!tool.readonly && !isReadonlyAction(toolCall.name, actionArgsOf(toolCall)) && !tool.sideEffectExempt) {
         // Non-mutating side-effect tools (bash, git): do NOT invalidate the
         // advisor review — a review is triggered by CODE MUTATIONS only
         // (user decision 2026-08-08: the guard rule is "review after code
@@ -96,6 +103,7 @@ export async function recordToolResults(agent, toolByName, results) {
         // barred from writing files, so it cannot change the reviewed code).
         // Verify IS invalidated: its state snapshot (git diff, file list)
         // may be stale after git/shell operations.
+        // #1178：动作级只读（settings get ∥ manifest read 一类）非侧效——verify 保持有效。
         if (agent._verifiedThisRun) {
           agent._verifiedThisRun = false
           agent._verifyPassed = undefined