deepccc 0.2.8 → 0.2.10

package/README.md

@@ -180,8 +180,9 @@ Provider 发送 `max_tokens`，使用模型服务端默认值。可通过 `DEEPC
 或命令行 `--max-output-tokens` 覆盖；只接受正整数。该限制会同时覆盖模型思考内容、
 工具参数和最终回答，设置过小可能导致工具调用或长回复被截断。
 
-`contextWindow` 是模型上下文窗口（token），默认 `1048576`（1M，DeepSeek V4 Pro/Flash
-原生规格）；上下文压缩阈值自动 = `contextWindow × 0.8`（超出即把较早消息压缩为摘要）。
+`contextWindow` 是模型上下文窗口（token），默认 `1048576`（1M，DeepSeek V4 Pro/Flash
+原生规格）；常规上下文压缩阈值自动 = `contextWindow × 0.8`。工具输入与结果另有独立预算：
+默认取 `min(64000, 常规压缩阈值 × 25%)`，超过后会提前压缩，避免长会话积累大量低信号工具输出。
 可通过 `DEEPCCC_CONTEXT_WINDOW` 环境变量覆盖。⚠️ 超过模型/服务端实际上限时请求会被
 API 拒绝（context length exceeded），实际窗口以模型与所用服务端为准（如 litellm 的
 `max_input_tokens`）。
@@ -324,7 +325,7 @@ deepccc-cli --dangerously-bypass-permissions
 
 交互模式下，每轮回复渲染为固定"过程区块"：状态行（压缩上下文中/生成回复中/完成/已停止/异常结束）+ 折叠工具行 + 原地更新正文，不滚屏刷 JSON。活动状态有心跳点号动画；完成/停止/异常后区块定型留在屏幕上。
 
-持久化上下文达到 token 阈值时，deepccc 会先按 token 预算保留最近消息，再压缩较早内容；超长历史消息、工具记录和压缩输入会被限长，避免单次摘要请求反复吞入巨量文本。一次压缩最多等待 5 分钟，超时或摘要失败会给出明确错误，不会自动重放用户请求。
+持久化上下文达到常规 token 阈值或独立工具预算时，deepccc 会先按预算保留最近消息，再压缩较早内容；工具历史使用标准结构化 tool-call/tool-result 消息重放，不会把内部 `[工具记录]` 文本重复送回模型。若模型仍输出伪工具记录，系统会丢弃并重试一次；重复失败时安全终止，避免把未执行命令当成真实结果。超长历史消息、工具记录和压缩输入会被限长，一次压缩最多等待 5 分钟。
 
 如果终端渲染出现异常，可以强制回退为纯文本流式输出：
 

package/dist/context.d.ts

@@ -1,7 +1,8 @@
+import type { ModelMessage } from "ai";
 export type BuiltinContextRole = "user" | "assistant";
 /**
- * 结构化工具调用存档（与 content 里的 [Tool transcript] 文本互为冗余视图）：
- * content 文本保持不变供模型消费；toolCalls 数组提供可检索、可回放的结构化数据。
+ * 结构化工具调用存档。content 只保存面向用户的回答正文；工具输入与结果
+ * 独立保存，供模型按标准 tool-call/tool-result 消息重放以及 UI 检索、回放。
  */
 export interface BuiltinContextToolCall {
     /** Provider tool-call id，用于 Web 在流式运行与持久化消息之间保持同一张工具卡状态。 */
@@ -33,7 +34,7 @@ export interface BuiltinContextMessage {
     content: string;
     /** 可选结构化工具调用记录（assistant 消息专用） */
     toolCalls?: BuiltinContextToolCall[];
-    /** 文本与工具事件的真实发生顺序，仅供 UI 回放；模型上下文仍使用 content。 */
+    /** 文本与工具事件的真实发生顺序，同时用于 UI 与模型的结构化历史重放。 */
     timeline?: BuiltinContextTimelineEntry[];
 }
 export interface BuiltinContextState {
@@ -71,6 +72,8 @@ export interface BuiltinContextOptions {
     contextWindow?: number;
     /** 直接指定压缩阈值（token），优先于 contextWindow 的 80% 派生。 */
     compactAtTokens?: number;
+    /** Independent budget for retained structured tool inputs/results. */
+    maxToolContextTokens?: number;
     keepRecentMessages?: number;
 }
 export declare const DEFAULT_BUILTIN_CONTEXT_DIR: string;
@@ -81,6 +84,7 @@ export declare const COMPACTION_THRESHOLD_RATIO = 0.8;
 /** 默认压缩阈值 = 1M × 0.8。 */
 export declare const DEFAULT_COMPACT_AT_TOKENS: number;
 export declare const DEFAULT_KEEP_RECENT_MESSAGES = 16;
+export declare const DEFAULT_MAX_TOOL_CONTEXT_TOKENS = 64000;
 export declare function normalizeBuiltinSessionId(value: string): string;
 export declare function defaultBuiltinSessionId(cwd?: string): string;
 export declare function newBuiltinSessionId(now?: Date, suffix?: string): string;
@@ -88,22 +92,18 @@ export declare function getBuiltinContextSession(sessionId: string, contextDir?:
 export declare function readBuiltinContextState(sessionId: string, contextDir?: string): BuiltinContextState | null;
 export declare function listBuiltinContextSessions(contextDir?: string): BuiltinContextSessionInfo[];
 export declare function latestBuiltinSessionForCwd(cwd: string, contextDir?: string): BuiltinContextSessionInfo | null;
-/**
- * 估算上下文的 token 数（用于决定何时压缩）。
- * 按字符类型加权，比旧版 chars/3 更接近真实：CJK 字符 ≈ 1 token/字，
- * 其他字符 ≈ 3.5 chars/token。避免中文长上下文被严重低估导致压缩过晚。
- */
+export declare function estimateBuiltinToolContextTokens(messages: readonly BuiltinContextMessage[]): number;
 export declare function estimateBuiltinContextTokens(summary: string, messages: readonly BuiltinContextMessage[]): number;
 export declare function serializeMessagesForSummary(messages: readonly BuiltinContextMessage[]): string;
 export declare const DEFAULT_PERSISTED_ASSISTANT_TEXT_CHARS = 32000;
 export declare const DEFAULT_PERSISTED_TOOL_TRANSCRIPT_CHARS = 24000;
 /**
- * 构造持久化的 assistant 消息：content 保持既有"正文 + [Tool transcript]"文本格式
- * （模型上下文行为不变），同时附加结构化 toolCalls 存档（供 session-search 等检索）。
+ * 构造持久化 assistant 消息。content 仅保存回答正文，工具事件保存在
+ * toolCalls/timeline，避免内部 transcript 语法回流并诱导模型伪造工具执行。
  */
 export declare function buildPersistedAssistantMessage(params: {
     fullText: string;
-    /** [Tool transcript] 的文本行（按原始流顺序，含 tool_call / tool_result / tool_error） */
+    /** @deprecated 兼容旧调用方；工具记录只从 toolCalls/timeline 持久化。 */
     transcriptLines: readonly string[];
     /** 结构化工具调用（按调用顺序）；有则写入消息的 toolCalls 字段 */
     toolCalls?: readonly BuiltinContextToolCall[];
@@ -118,6 +118,7 @@ export declare class BuiltinContextManager {
     readonly contextDir: string;
     readonly sessionId: string;
     readonly compactAtTokens: number;
+    readonly maxToolContextTokens: number;
     readonly keepRecentMessages: number;
     private readonly cwd?;
     private state;
@@ -128,7 +129,7 @@ export declare class BuiltinContextManager {
     get contextFilePath(): string;
     appendMessage(message: BuiltinContextMessage): void;
     setSummary(summary: string): void;
-    buildModelMessages(): BuiltinContextMessage[];
+    buildModelMessages(): ModelMessage[];
     planCompaction(): BuiltinCompactionPlan | null;
     applyCompaction(summary: string, plan: BuiltinCompactionPlan): void;
     reset(): void;

package/dist/context.js

@@ -2,7 +2,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { hasMalformedToolProtocolText } from "./tool-protocol.js";
+import { hasImitatedToolTranscriptText, hasMalformedToolProtocolText, } from "./tool-protocol.js";
 export const DEFAULT_BUILTIN_CONTEXT_DIR = join(homedir(), ".deepccc", "sessions");
 /** 默认模型上下文窗口：1M（DeepSeek V4 Pro/Flash 原生规格）。 */
 export const DEFAULT_CONTEXT_WINDOW_TOKENS = 1_048_576;
@@ -15,6 +15,11 @@ const RECENT_CONTEXT_BUDGET_RATIO = 0.6;
 const MAX_COMPACTION_SUMMARY_CHARS = 8_000;
 const MAX_COMPACTION_MESSAGE_CHARS = 24_000;
 const MAX_COMPACTION_SOURCE_CHARS = 64_000;
+export const DEFAULT_MAX_TOOL_CONTEXT_TOKENS = 64_000;
+const TOOL_CONTEXT_BUDGET_RATIO = 0.25;
+const RECENT_TOOL_CONTEXT_BUDGET_RATIO = 0.6;
+const STORED_TOOL_TRANSCRIPT_MARKER = "\n\n[工具记录]\n";
+const QUARANTINED_PROTOCOL_REPLY = "[上一轮响应因工具协议异常已隔离，不能视为已执行；请根据后续用户消息继续。]";
 export function normalizeBuiltinSessionId(value) {
     return value.replace(/[^a-zA-Z0-9_.-]+/g, "_").replace(/^_+|_+$/g, "") || "default";
 }
@@ -209,8 +214,11 @@ export function latestBuiltinSessionForCwd(cwd, contextDir = DEFAULT_BUILTIN_CON
  * 按字符类型加权，比旧版 chars/3 更接近真实：CJK 字符 ≈ 1 token/字，
  * 其他字符 ≈ 3.5 chars/token。避免中文长上下文被严重低估导致压缩过晚。
  */
-export function estimateBuiltinContextTokens(summary, messages) {
-    const text = summary + messages.reduce((sum, m) => sum + `${m.role}\n${m.content}\n`, "");
+function stripStoredToolTranscript(content) {
+    const markerIndex = content.indexOf(STORED_TOOL_TRANSCRIPT_MARKER);
+    return markerIndex >= 0 ? content.slice(0, markerIndex) : content;
+}
+function estimateTextTokens(text) {
     let cjk = 0;
     for (const ch of text) {
         if (/[\u3400-\u4DBF\u4E00-\u9FFF\uF900-\uFAFF\u3000-\u303F\uFF00-\uFFEF]/.test(ch))
@@ -219,6 +227,30 @@ export function estimateBuiltinContextTokens(summary, messages) {
     const other = text.length - cjk;
     return Math.ceil(cjk + other / 3.5);
 }
+export function estimateBuiltinToolContextTokens(messages) {
+    let text = "";
+    for (const message of messages) {
+        if (message.role !== "assistant")
+            continue;
+        if (message.toolCalls?.length) {
+            for (const call of message.toolCalls) {
+                text += `${call.name}\n${call.input ?? ""}\n${call.output ?? ""}\n`;
+            }
+            continue;
+        }
+        for (const entry of message.timeline ?? []) {
+            if (entry.type === "tool_use")
+                text += `${entry.name}\n${entry.input ?? ""}\n`;
+            if (entry.type === "tool_result")
+                text += `${entry.name ?? ""}\n${entry.output ?? ""}\n`;
+        }
+    }
+    return estimateTextTokens(text);
+}
+export function estimateBuiltinContextTokens(summary, messages) {
+    const text = summary + messages.reduce((sum, message) => sum + `${message.role}\n${stripStoredToolTranscript(message.content)}\n`, "");
+    return estimateTextTokens(text) + estimateBuiltinToolContextTokens(messages);
+}
 export function serializeMessagesForSummary(messages) {
     return messages
         .map((message, index) => `### ${index + 1}. ${message.role}\n${message.content}`)
@@ -236,19 +268,34 @@ export const DEFAULT_PERSISTED_ASSISTANT_TEXT_CHARS = 32_000;
 export const DEFAULT_PERSISTED_TOOL_TRANSCRIPT_CHARS = 24_000;
 const ASSISTANT_TRUNCATED_MARKER = "...[助手回复已在上下文中截断]...";
 const TOOL_TRANSCRIPT_TRUNCATED_MARKER = "...[工具记录已截断]...";
+function truncateStructuredToolCalls(calls, maxChars) {
+    const payloads = calls.flatMap((call) => [call.input ?? "", call.output ?? ""]).filter(Boolean);
+    const total = payloads.reduce((sum, value) => sum + value.length, 0);
+    if (total <= maxChars)
+        return calls;
+    const sharedBudget = Math.max(0, maxChars - payloads.length);
+    const truncatePayload = (value) => {
+        if (value === undefined || value.length === 0)
+            return value;
+        const budget = 1 + Math.floor(sharedBudget * value.length / Math.max(1, total));
+        return truncateMiddle(value, budget, TOOL_TRANSCRIPT_TRUNCATED_MARKER);
+    };
+    return calls.map((call) => ({
+        ...call,
+        ...(call.input !== undefined ? { input: truncatePayload(call.input) } : {}),
+        ...(call.output !== undefined ? { output: truncatePayload(call.output) } : {}),
+    }));
+}
 /**
- * 构造持久化的 assistant 消息：content 保持既有"正文 + [Tool transcript]"文本格式
- * （模型上下文行为不变），同时附加结构化 toolCalls 存档（供 session-search 等检索）。
+ * 构造持久化 assistant 消息。content 仅保存回答正文，工具事件保存在
+ * toolCalls/timeline，避免内部 transcript 语法回流并诱导模型伪造工具执行。
  */
 export function buildPersistedAssistantMessage(params) {
     const maxAssistantChars = params.maxAssistantChars ?? DEFAULT_PERSISTED_ASSISTANT_TEXT_CHARS;
     const maxTranscriptChars = params.maxTranscriptChars ?? DEFAULT_PERSISTED_TOOL_TRANSCRIPT_CHARS;
     const persistedAssistantText = truncateMiddle(params.fullText, maxAssistantChars, ASSISTANT_TRUNCATED_MARKER);
-    const content = params.transcriptLines.length > 0
-        ? `${persistedAssistantText}\n\n[工具记录]\n${truncateMiddle(params.transcriptLines.join("\n"), maxTranscriptChars, TOOL_TRANSCRIPT_TRUNCATED_MARKER)}`
-        : persistedAssistantText;
-    const message = { role: "assistant", content };
-    const toolCalls = normalizeToolCalls(params.toolCalls);
+    const message = { role: "assistant", content: persistedAssistantText };
+    const toolCalls = truncateStructuredToolCalls(normalizeToolCalls(params.toolCalls), maxTranscriptChars);
     if (toolCalls.length > 0)
         message.toolCalls = toolCalls;
     const timeline = truncatePersistedTimeline(normalizeTimeline(params.timeline));
@@ -299,6 +346,127 @@ function truncatePersistedTimeline(entries) {
         return entry;
     });
 }
+function parseToolInput(value) {
+    if (!value?.trim())
+        return {};
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return { raw: value };
+    }
+}
+function parseToolOutput(value) {
+    if (!value?.trim())
+        return { type: "text", value: "" };
+    try {
+        return { type: "json", value: JSON.parse(value) };
+    }
+    catch {
+        return { type: "text", value };
+    }
+}
+function replayStructuredAssistantMessage(message, messageIndex) {
+    const plainText = stripStoredToolTranscript(message.content);
+    const hasStructuredTools = Boolean(message.toolCalls?.length
+        || message.timeline?.some((entry) => entry.type === "tool_use" || entry.type === "tool_result"));
+    if (!hasStructuredTools)
+        return [{ role: "assistant", content: plainText }];
+    const timeline = message.timeline?.length
+        ? message.timeline
+        : [
+            ...(message.toolCalls ?? []).map((call, callIndex) => ({
+                type: "tool_use",
+                id: call.id ?? `context-tool-${messageIndex}-${callIndex}`,
+                name: call.name,
+                ...(call.input !== undefined ? { input: call.input } : {}),
+            })),
+            ...(message.toolCalls ?? []).map((call, callIndex) => ({
+                type: "tool_result",
+                tool_use_id: call.id ?? `context-tool-${messageIndex}-${callIndex}`,
+                name: call.name,
+                ...(call.output !== undefined ? { output: call.output } : {}),
+                ...(call.is_error !== undefined ? { is_error: call.is_error } : {}),
+            })),
+            ...(plainText ? [{ type: "text", text: plainText }] : []),
+        ];
+    const messages = [];
+    let assistantParts = [];
+    let toolParts = [];
+    const pendingCalls = new Map();
+    const knownNames = new Map();
+    const emittedCallIds = new Set();
+    const flushAssistant = () => {
+        if (!assistantParts.length)
+            return;
+        messages.push({ role: "assistant", content: assistantParts });
+        assistantParts = [];
+    };
+    const completeToolStep = () => {
+        // OpenAI/LiteLLM requires every tool message to immediately follow the
+        // assistant message that declared all matching tool_calls for that step.
+        flushAssistant();
+        for (const [toolCallId, toolName] of pendingCalls) {
+            toolParts.push({
+                type: "tool-result",
+                toolCallId,
+                toolName,
+                output: { type: "text", value: "[tool execution interrupted; result unavailable]" },
+            });
+        }
+        pendingCalls.clear();
+        if (!toolParts.length)
+            return;
+        messages.push({ role: "tool", content: toolParts });
+        toolParts = [];
+    };
+    for (const entry of timeline) {
+        if (entry.type === "text") {
+            if (pendingCalls.size > 0 || toolParts.length > 0)
+                completeToolStep();
+            const previous = assistantParts[assistantParts.length - 1];
+            if (previous?.type === "text")
+                previous.text += entry.text;
+            else if (entry.text)
+                assistantParts.push({ type: "text", text: entry.text });
+        }
+        else if (entry.type === "tool_use") {
+            // Consecutive tool calls belong to one assistant step. Only close the
+            // previous step after at least one result has arrived.
+            if (toolParts.length > 0)
+                completeToolStep();
+            knownNames.set(entry.id, entry.name);
+            pendingCalls.set(entry.id, entry.name);
+            emittedCallIds.add(entry.id);
+            assistantParts.push({
+                type: "tool-call",
+                toolCallId: entry.id,
+                toolName: entry.name,
+                input: parseToolInput(entry.input),
+            });
+        }
+        else {
+            if (!emittedCallIds.has(entry.tool_use_id))
+                continue;
+            const toolName = entry.name ?? knownNames.get(entry.tool_use_id);
+            if (!toolName)
+                continue;
+            flushAssistant();
+            pendingCalls.delete(entry.tool_use_id);
+            toolParts.push({
+                type: "tool-result",
+                toolCallId: entry.tool_use_id,
+                toolName,
+                output: parseToolOutput(entry.output),
+            });
+        }
+    }
+    if (pendingCalls.size > 0 || toolParts.length > 0)
+        completeToolStep();
+    else
+        flushAssistant();
+    return messages;
+}
 function serializeMessagesForCompaction(messages) {
     const sections = [];
     let remaining = MAX_COMPACTION_SOURCE_CHARS;
@@ -339,6 +507,7 @@ export class BuiltinContextManager {
     contextDir;
     sessionId;
     compactAtTokens;
+    maxToolContextTokens;
     keepRecentMessages;
     cwd;
     state;
@@ -349,6 +518,8 @@ export class BuiltinContextManager {
         this.cwd = options.cwd;
         this.compactAtTokens = options.compactAtTokens
             ?? Math.floor((options.contextWindow ?? DEFAULT_CONTEXT_WINDOW_TOKENS) * COMPACTION_THRESHOLD_RATIO);
+        this.maxToolContextTokens = Math.max(1, options.maxToolContextTokens
+            ?? Math.min(DEFAULT_MAX_TOOL_CONTEXT_TOKENS, Math.floor(this.compactAtTokens * TOOL_CONTEXT_BUDGET_RATIO)));
         this.keepRecentMessages = Math.max(1, options.keepRecentMessages ?? DEFAULT_KEEP_RECENT_MESSAGES);
         this.state = this.load();
     }
@@ -388,7 +559,12 @@ export class BuiltinContextManager {
         // Keep malformed provider output on disk for diagnosis, but quarantine it
         // from future prompts so one protocol failure cannot teach the model to
         // repeat the same invalid tool syntax on every later turn.
-        messages.push(...this.modelSafeMessages());
+        for (const [index, message] of this.modelSafeMessages().entries()) {
+            if (message.role === "user")
+                messages.push({ role: "user", content: message.content });
+            else
+                messages.push(...replayStructuredAssistantMessage(message, index));
+        }
         return messages;
     }
     planCompaction() {
@@ -396,16 +572,19 @@ export class BuiltinContextManager {
         // leaks here too, otherwise a later summary could reintroduce the bad syntax.
         const messages = this.modelSafeMessages();
         const estimated = estimateBuiltinContextTokens(this.state.summary, messages);
-        if (estimated <= this.compactAtTokens)
+        const toolEstimated = estimateBuiltinToolContextTokens(messages);
+        if (estimated <= this.compactAtTokens && toolEstimated <= this.maxToolContextTokens)
             return null;
         if (messages.length <= 1)
             return null;
         const earliestAllowed = Math.max(0, messages.length - this.keepRecentMessages);
         const recentTokenBudget = Math.max(1, Math.floor(this.compactAtTokens * RECENT_CONTEXT_BUDGET_RATIO));
+        const recentToolBudget = Math.max(1, Math.floor(this.maxToolContextTokens * RECENT_TOOL_CONTEXT_BUDGET_RATIO));
         let splitAt = messages.length - 1;
         for (let index = messages.length - 2; index >= earliestAllowed; index -= 1) {
             const candidate = messages.slice(index);
-            if (estimateBuiltinContextTokens("", candidate) > recentTokenBudget)
+            if (estimateBuiltinContextTokens("", candidate) > recentTokenBudget
+                || estimateBuiltinToolContextTokens(candidate) > recentToolBudget)
                 break;
             splitAt = index;
         }
@@ -416,8 +595,8 @@ export class BuiltinContextManager {
             splitAt = 1;
         return {
             previousSummary: this.state.summary,
-            oldMessages: this.state.messages.slice(0, splitAt),
-            recentMessages: this.state.messages.slice(splitAt),
+            oldMessages: messages.slice(0, splitAt),
+            recentMessages: messages.slice(splitAt),
         };
     }
     applyCompaction(summary, plan) {
@@ -441,7 +620,17 @@ export class BuiltinContextManager {
         renameSync(tmp, this.contextFilePath);
     }
     modelSafeMessages() {
-        return this.state.messages.filter((message) => message.role !== "assistant" || !hasMalformedToolProtocolText(message.content));
+        return this.state.messages.map((message) => {
+            if (message.role !== "assistant")
+                return message;
+            const hasStructuredTools = Boolean(message.toolCalls?.length
+                || message.timeline?.some((entry) => entry.type === "tool_use" || entry.type === "tool_result"));
+            const copiedStoredTranscript = hasImitatedToolTranscriptText(message.content) && hasStructuredTools;
+            if (hasMalformedToolProtocolText(message.content) && !copiedStoredTranscript) {
+                return { role: "assistant", content: QUARANTINED_PROTOCOL_REPLY };
+            }
+            return { ...message, content: stripStoredToolTranscript(message.content) };
+        });
     }
     load() {
         if (!this.persist || !existsSync(this.contextFilePath))

package/dist/index.d.ts

@@ -55,6 +55,8 @@ export interface ChatSessionOptions {
     sessionId?: string;
     /** Compact older context when the rough token estimate exceeds this value. */
     compactAtTokens?: number;
+    /** Independent retained-tool budget; defaults to min(64K, compaction threshold x 25%). */
+    maxToolContextTokens?: number;
     /**
      * 模型上下文窗口（token），默认 1048576（1M）。压缩阈值自动 = contextWindow × 0.8；
      * 显式 compactAtTokens 优先于该派生值。

package/dist/index.js

@@ -5,7 +5,7 @@
  */
 import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
 import { createAnthropic } from "@ai-sdk/anthropic";
-import { generateText, isLoopFinished, stepCountIs, streamText } from "ai";
+import { generateText, isLoopFinished, stepCountIs, streamText, } from "ai";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
@@ -144,7 +144,7 @@ function addAnthropicToolJsonCompatibilityNote(messages) {
     // 部分 Anthropic→OpenAI/Ark 转换器会用 response_format=json_object
     // 实现工具调用，却只在 messages 中校验 JSON 关键词、不读取顶层 system。
     // 这里仅声明工具参数的编码方式，并明确不要求普通最终回复输出 JSON。
-    return messages.map((message, index) => (index === lastUserIndex
+    return messages.map((message, index) => (index === lastUserIndex && message.role === "user" && typeof message.content === "string"
         ? {
             ...message,
             content: `${message.content}\n\n${ANTHROPIC_TOOL_JSON_COMPATIBILITY_NOTE}`,
@@ -161,11 +161,13 @@ function addAnthropicToolJsonCompatibilityNote(messages) {
 function maybeAppendCompactionRecoveryHint(messages, summary, rawLogsEnabled, sessionId) {
     if (!summary.trim())
         return messages;
-    const summaryIndex = messages.findIndex((message) => message.role === "user" && message.content.startsWith("以下是更早的对话摘要"));
+    const summaryIndex = messages.findIndex((message) => message.role === "user"
+        && typeof message.content === "string"
+        && message.content.startsWith("以下是更早的对话摘要"));
     if (summaryIndex < 0)
         return messages;
     const hint = rawLogsEnabled ? buildCompactionRecoveryHint(sessionId) : COMPACTION_RECOVERY_HINT_DISABLED;
-    return messages.map((message, index) => (index === summaryIndex
+    return messages.map((message, index) => (index === summaryIndex && message.role === "user" && typeof message.content === "string"
         ? { ...message, content: `${message.content}\n\n${hint}` }
         : message));
 }
@@ -353,6 +355,7 @@ export class ChatSession {
             cwd: this.cwd,
             contextWindow: options.contextWindow ?? appConfig.contextWindow,
             compactAtTokens: options.compactAtTokens,
+            maxToolContextTokens: options.maxToolContextTokens,
             keepRecentMessages: options.keepRecentMessages,
         });
         this.permissionGate = new PermissionGate(this.permissionMode, this.permissionResolver);
@@ -559,7 +562,7 @@ export class ChatSession {
                     }
                 }
                 if (hasMalformedToolProtocolText(fullText)) {
-                    console.warn(`[DeepCCC] malformed DSML tool output detected for ${this.context.sessionId} `
+                    console.warn(`[DeepCCC] malformed tool protocol text detected for ${this.context.sessionId} `
                         + `(attempt ${attempt + 1}/2, structuredToolCalls=${toolCallOrder.length})`);
                     rawLog?.writeLine(safeRawStreamJson({
                         type: "deepccc_tool_protocol_recovery",
@@ -572,8 +575,8 @@ export class ChatSession {
                         continue;
                     }
                     throw new Error(toolCallOrder.length > 0
-                        ? "工具调用协议异常：检测到混合的结构化与 DSML 文本调用，为避免重复执行工具，本轮已安全终止"
-                        : "工具调用协议异常：模型重试后仍输出了无效的 DSML 工具调用");
+                        ? "工具调用协议异常：检测到混合的结构化调用与伪造工具文本，为避免重复执行工具，本轮已安全终止"
+                        : "工具调用协议异常：模型重试后仍输出了无效或伪造的工具调用文本");
                 }
                 completed = true;
                 const collectedToolCalls = toolCallOrder

package/dist/tool-protocol.d.ts

@@ -1,2 +1,8 @@
+/**
+ * Detects a model copying DeepCCC's persisted/debug transcript syntax into
+ * normal assistant text. Both the dedicated header and an event line are
+ * required so documentation and ordinary discussion remain valid.
+ */
+export declare function hasImitatedToolTranscriptText(text: string): boolean;
 export declare function hasMalformedToolProtocolText(text: string): boolean;
 export declare const TOOL_PROTOCOL_RECOVERY_PROMPT: string;

package/dist/tool-protocol.js

@@ -6,12 +6,23 @@
 const MALFORMED_DSML_TRAILER = /<\/[|｜]{2}DSML[|｜]{2}(?:parameter|invoke)>\s*$/iu;
 const RENDERED_TOOL_CALL = /\[调用\s+[A-Za-z_][\w.-]*\]/u;
 const DSML_INVOKE_TAG = /<[|｜]{2}DSML[|｜]{2}invoke\b/iu;
+const TOOL_TRANSCRIPT_HEADER = /(?:^|\n)\s*\[工具记录\]\s*(?:\n|$)/u;
+const TOOL_TRANSCRIPT_EVENT = /(?:^|\n)\s*tool_(?:call|result|error)\s+[A-Za-z_][\w.-]*\s*:/u;
+/**
+ * Detects a model copying DeepCCC's persisted/debug transcript syntax into
+ * normal assistant text. Both the dedicated header and an event line are
+ * required so documentation and ordinary discussion remain valid.
+ */
+export function hasImitatedToolTranscriptText(text) {
+    return TOOL_TRANSCRIPT_HEADER.test(text) && TOOL_TRANSCRIPT_EVENT.test(text);
+}
 export function hasMalformedToolProtocolText(text) {
-    return MALFORMED_DSML_TRAILER.test(text)
+    const malformedDsml = MALFORMED_DSML_TRAILER.test(text)
         && (RENDERED_TOOL_CALL.test(text) || DSML_INVOKE_TAG.test(text));
+    return malformedDsml || hasImitatedToolTranscriptText(text);
 }
 export const TOOL_PROTOCOL_RECOVERY_PROMPT = [
     "[系统恢复提示] 上一次响应泄漏了内部工具调用协议，因此已被丢弃。",
-    "请重新完成当前用户请求。需要调用工具时，只能使用 API 提供的结构化工具调用；不要把 DSML 或工具参数作为普通文本输出。",
-    "不要提及本恢复提示，也不要假装工具已经执行。",
+    "请重新完成当前用户请求。需要调用工具时，只能使用 API 提供的结构化工具调用；不要把 DSML、[工具调用]、[工具记录] 或工具参数作为普通文本输出。",
+    "不要提及本恢复提示，不要伪造工具已执行，也不要根据未执行的命令声称得到了结果。",
 ].join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepccc",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "A lightweight coding agent with OpenAI-compatible and Anthropic Messages API support.",
   "license": "Apache-2.0",
   "keywords": [