dsh-deepseek-web-login 0.6.36 → 0.6.38

package/CHANGELOG.md

@@ -2,6 +2,138 @@
 
 本项目大致遵循语义化版本；日期为本地时间。
 
+## 0.6.38 — 2026-10-03
+
+工具调用协议从**裸 JSON** 改成**围栏包裹**（` ```dsh-tool `），根治"标记漏到正文"这一类问题。
+
+### 起因：用户拿 cuckoo 的分享页来对比
+
+用户问「为什么 cuckoo 不会出现 DSML 等内容，他不也是工具调用」。取它的分享页逐项统计：
+
+| | cuckoo | 我们（改之前） |
+|---|---|---|
+| 调用格式 | ` ```cuckoo ` **围栏代码块** | `{"tool_calls":[…]}` **裸 JSON** |
+| 页面里 `DSML` | **0** | 出现过 |
+| 页面里 `tool_calls` | **0** | 出现过 |
+| 页面里 `invoke` / `parameters` | **0** | 出现过 |
+
+**根因就在格式本身**：围栏**自带语法边界**，模型即使在围栏外多写一句废话也进不了正文；
+裸 JSON 没有边界 —— 模型在思考里写 JSON、或者在 JSON 前后多写一个字，整段直接成为正文。
+这也是为什么我们的规则 6 早就写着"禁止 XML 标记"却仍然漏：**禁令能约束内容，约束不了边界。**
+
+DSH 那侧**不用改**：我们把调用转成 `tool-call` 事件交给它，它只看事件、不看文本。
+
+### 改动
+
+**提示词**（两份，`TOOL_PROTOCOL_INSTRUCTIONS` 与串行版必须逐字一致）：
+
+- 示例与开头句改成 ` ```dsh-tool ` 包裹
+- rule 6 改为「必须用围栏包裹；不包裹的 JSON 与 XML 标记都会泄漏」
+
+**解析器**（`protocol.ts`）：
+
+- `stripCallFence()`：调用块前后**无条件**剥掉所有围栏（含 ```json 这类模型自选语言名）。
+  进入该函数的文本都已确定属于调用块，所以放宽是安全的。
+- `CALL_FENCE_OPEN_RE` + `sawCallFence`：在 `drain()` 里对**普通正文**判围栏。
+  ⚠️ 只认带 `dsh-tool` 的开栏，且**不**加"后面不是闭栏"的负向断言 ——
+  逐字符分块时开栏先到（JSON 还没来），那条断言会把它误判成闭栏而放行出去。
+- 闭栏只在本流见过开栏时才剥（`sawCallFence` 门控）。
+
+**没有动**：`extractBalancedJson` 要求 `{` 在开头这件事（靠捕获时先剥 head 解决）、
+DSH 侧的调用解析、裸 JSON 的支持路径（模型不听话时的兜底必须留着）。
+
+### 期间踩到的两个坑
+
+**① 放宽判据吃掉正常内容（真实回归）。** 一度无条件剥所有 ``` ⇒ `check-auto-continue` N03
+（正文里的 ```xml 示例）与 `check-tools-section` 各变红。曾试图用"独占一行的裸闭栏"补救，
+逐字符分块时闭栏还没成行、照样漏 user 的代码块。最终形态：**普通正文只认带 `dsh-tool` 的开栏**，
+闭栏靠 `sawCallFence` 配对。
+
+**② 围栏示例有体积成本。** `maxChars=5000` 的极小预算下，协议头占 3304/5000（66%），
+新增的围栏示例把工具定义挤掉了（`check-tools-section` 变红）。压掉 rule 6 与 rule 8 的冗余措辞后
+协议头 **2869 字符**（比改动前只多 55），工具定义恢复。`logic-test` 里加了一条上限断言
+（`< 3000`）防它悄悄涨回去。
+
+### 验证
+
+- `logic-test` 62 → **67 项**（5 条新围栏用例：整块/逐字符/按行三种分块 × 带散文、
+  正常代码块不许被剥、裸 JSON 兜底仍可用、协议指令必须要求围栏 + 体积上限）
+- `dev/probe-fenced-protocol.mjs`：7 种形态全部"调用提取成功 + 零泄漏"
+- DSML 矩阵 144/144 仍全拦得住
+- **四处变异手工确认打红**（脚本里的 `execFileSync` 在本机不可靠，变异写不进去 ⇒ 假"全绿"）：
+  开栏不扣留 → 2 红、flush 不剥闭栏 → 2 红、head 不剥围栏 → 1 红、`stripCallFence` 恒等 → 2 红
+- 又抓到一次**虚守卫**：提示词退回裸 JSON 时用例仍全绿（只查了 `includes('dsh-tool')`，
+  而围栏示例行里也有这个词）。补上"必须出现 `inside a fenced code block`"后变异正确打红。
+- `tsc` / smoke / 产物 / **64/64** 全过，真实留痕未污染
+
+## 0.6.37 — 2026-10-03
+
+修 DSML 标记泄漏：`dsml-` 连字符变体**带空格**时整块原样上屏（用户分享页现场）。
+
+### 现场
+
+用户对比 cuckoo（干净）与本插件的分享页，报告 DSML 漏到网页端。分享页原文：
+
+```
+<｜｜DSML｜｜ calls>
+<｜｜DSML｜｜ invoke name="pwsh">
+<｜｜DSML｜｜ parameter name="command" string="true">Get-Date -Format …</｜｜DSML｜｜ parameter>
+</｜｜DSML｜｜ invoke>
+</｜｜DSML｜｜ calls>
+```
+
+同时工具调用**确实执行了**（下一轮有 `[Tool Result for call_68d163…]`）—— 同一段标记
+既被执行、又漏到正文，所以不是"认不出"，是"没走进捕获态"。
+
+### 根因
+
+`DSML_PREFIX`（竖线段，可选）与 `(?:dsml-)?`（连字符段，可选）是**两个各自独立**的可选片段。
+`<dsml- calls>`（连字符后带一个空格）两边都匹配不上 ⇒ 不进捕获态 ⇒ 整块当正文。
+
+144 组合矩阵（前缀 6 种 × 形态 4 种 × 分块 3 种 × 通道 2 条）实测：修复前 **54 个组合泄漏**，
+其中 `dsml-` 两个变体**全部 24 个组合**整块上屏，正文与思考通道都一样。
+
+### 为什么一直没暴露
+
+现有用例只写了**无空格**形态（`check-dsml-stray.mjs` / `logic-test.mjs` 都是 `<dsml-calls>`）——
+**测的形态和现场形态不是同一个**。与「0.6.28 思考分支一句 `continue` 跳过全部四道网」同类：
+判据只覆盖了一种规范写法，现场是另一种。
+
+### 修法
+
+- 前缀两种变体合并成**一个可选组** `DSML_PREFIX_BODY`，`dsml-` 后面**允许空白**。
+- `normalizeDsml` 的两个 `dsml-` 替换同样吃空白（否则归一化后仍剩 `< calls>`，后面全失败）。
+- `XML_MARKER_STARTERS` 补 `dsml- tool_calls` / `dsml- invoke` / `dsml- calls`
+  （hold-back 判据是逐字符比对 starter 前缀，少列一种跨包就判不出）。
+- `findXmlToolCallEnd` 里那条闭合正则**只认半角单竖线** `(?:\|\s*DSML\s*\|\s*)?`，
+  而现场是全角 `｜｜` ⇒ 裸 invoke 块的收尾会落到"当正文吐出"分支。改用共用片段。
+- `stripStrayToolMarkup` 的包裹标签前缀改为**可选**（裸 `<calls>` / `</calls>` 此前只剥闭合，
+  开启标签整行残留）。
+
+### 踩到并修掉的第二个坑：可选性不能写在片段里
+
+修完第一处，`logic-test` 立刻红：`在 HTML 里 <invoke> 不是一个标准标签` 被吞。
+
+原因是我把"前缀可选"实现成 `(?:${DSML_PREFIX})?${DSML_HYPHEN}` —— 两个**各自**可选的片段串起来，
+整组仍可为空 ⇒ "无前缀也匹配 invoke" ⇒ 正文里正常讨论的标签被吞。**连踩两次**才想清楚：
+可选性只能写在**整个片段的外层**，两个变体必须放进同一个交替里。
+
+所以引入了 `DSML_PREFIX_ONLY`（不带 `?`）专供 `invoke` 使用：包裹标签是 DSML 私有标记，
+剥它零风险；`invoke` 是通用 XML 标签，正文里真的会被讨论，必须要求带前缀。
+
+### 用例
+
+- `check-dsml-stray` 18 → **40 项**：前缀矩阵（7 种前缀 × 配平/截断/逐字符）+ 一条**反向**用例
+  （正文里正常讨论 `<invoke>` 不被误吞）。
+- `dev/probe-dsml-matrix.mjs`：144 组合探针，判为泄漏时**打印上屏原文**。
+  ⚠️ 写探针时我连栽两次假结论（把 `ReasoningSanitizer.push` 的字符串返回值当对象用；
+  模板拼接出错造出双份后缀），两次都是"只报结论不打证据"。**探针必须能自证。**
+- 变异验证：①去掉 `dsml-` 的空白容忍 → 7 条红；②`invoke` 前缀改回可选 → 新用例 +
+  `logic-test` 各 1 条红。两个方向都有守卫。
+- 产物断言修了一条：原正则绑死了旧的双可选结构（正是本次修掉的错误结构），改成守意图。
+
+`tsc` / smoke / 产物 / **64/64** 全过，矩阵 144 组合全拦得住，真实留痕未污染。
+
 ## 0.6.36 — 2026-10-02
 
 **把"提示词里到底有什么"变成可查的事实（诊断），并顺带给出这次现场的完整核对结论。**

package/lib/index.js

@@ -1449,22 +1449,24 @@ const HEAD_RATIO = .62;
 const PROTOCOL_SLACK_CHARS = 96;
 const TOOL_PROTOCOL_INSTRUCTIONS = `# Tool Calling Protocol
 
-You can call tools to complete the user's task. When you need a tool, output ONLY a single JSON object, with no other text before or after it:
+You can call tools to complete the user's task. When you need a tool, output a single JSON object inside a fenced code block, with no other text before or after it:
 
+\`\`\`dsh-tool
 {"tool_calls":[{"name":"<tool-name>","arguments":{<json-arguments>}}]}
+\`\`\`
 
 Rules:
 1. Put every tool you want to run in the "tool_calls" array (usually exactly one; a batch is allowed).
-2. Stop immediately after that JSON object. The runner executes the call(s) and returns the results to you as the next message.
+2. Stop immediately after the closing fence. The runner executes the call(s) and returns the results to you as the next message.
 3. Never fabricate, guess, or simulate tool output — always wait for the real result.
 4. When no tool is needed, answer normally in plain text and do NOT emit that JSON.
 5. "arguments" must be valid JSON (double-quoted strings, no trailing commas). When a value is a Windows path, escape backslashes as \\\\ (e.g. "C:\\\\Users\\\\me"); an unescaped single backslash makes the whole object unparsable. Close every brace: the call object and its "arguments" object each need their OWN closing "}" — one missing "}" makes the whole batch unparsable and the call will be discarded.
 5b. Two things break the JSON most often — check them before you emit:
    (a) QUOTES INSIDE A VALUE. A shell/PowerShell command very often contains double quotes, e.g. Get-ChildItem "$env:USERPROFILE\\.dsh". Every such inner double quote MUST be escaped as \\" inside the JSON string. An unescaped one ends the string early and discards the whole call.
    (b) LINE BREAKS INSIDE A VALUE. Never put a real line break inside a string; write \\n instead. When a command needs several statements, join them with ";" on ONE line, or use \\n escapes — do not paste them as actual newlines. Prefer single quotes inside commands to reduce escaping.
-6. Do NOT use XML/HTML-like markup for tool calls: no angle-bracket wrapper tags (no <tool_calls>, <invoke>, <parameter>), and none of the private delimiter-prefixed variants some DeepSeek surfaces use. The JSON object above is the ONLY accepted format. Markup is not just ignored — it leaks into the visible transcript (and into the web conversation) as broken output.
+6. Always wrap the JSON in a \`\`\`dsh-tool fence (see the example above). Do NOT use XML/HTML-like markup instead: no angle-bracket wrapper tags (no <tool_calls>, <invoke>, <parameter>), nor the private delimiter-prefixed variants some DeepSeek surfaces use. An unfenced object or any such markup leaks into the visible transcript and into the web conversation.
 7. Always answer in the same language the user writes in (these instructions are English only for precision; the JSON itself is language-neutral).
-8. NEVER reproduce the transcript. Do not restate previous turns, "[Tool Result …]" blocks, tool output, or the current prompt. Emit ONLY the calls you want to run right now. A payload that replays earlier calls or embeds tool results is discarded and costs a retry — measured case: a model emitted 15 replayed calls inside one 8152-char payload, and every one of them had to be thrown away.
+8. NEVER reproduce the transcript. Do not restate previous turns, "[Tool Result …]" blocks, tool output, or the current prompt. Emit ONLY the calls you want to run right now. A payload that replays earlier calls or embeds tool results is discarded and costs a retry.
 9. Keep each batch SMALL — at most 3 calls, and prefer exactly 1. If you need more, send them in successive steps. Long payloads are the ones that most often come out malformed.
 10. Each call must be able to run on its own: no shared shell variables across calls, no dependence on another call in the same batch.`;
 /**
@@ -1482,22 +1484,24 @@ Rules:
 */
 const SERIAL_TOOL_PROTOCOL_INSTRUCTIONS = `# Tool Calling Protocol
 
-You can call tools to complete the user's task. When you need a tool, output ONLY a single JSON object, with no other text before or after it:
+You can call tools to complete the user's task. When you need a tool, output a single JSON object inside a fenced code block, with no other text before or after it:
 
+\`\`\`dsh-tool
 {"tool_calls":[{"name":"<tool-name>","arguments":{<json-arguments>}}]}
+\`\`\`
 
 Rules:
 1. Put exactly ONE tool in the "tool_calls" array — one call per message, never a batch.
-2. Stop immediately after that JSON object. The runner executes the call and returns the result to you as the next message.
+2. Stop immediately after the closing fence. The runner executes the call and returns the result to you as the next message.
 3. Never fabricate, guess, or simulate tool output — always wait for the real result.
 4. When no tool is needed, answer normally in plain text and do NOT emit that JSON.
 5. "arguments" must be valid JSON (double-quoted strings, no trailing commas). When a value is a Windows path, escape backslashes as \\\\ (e.g. "C:\\\\Users\\\\me"); an unescaped single backslash makes the whole object unparsable. Close every brace: the call object and its "arguments" object each need their OWN closing "}" — one missing "}" makes the whole batch unparsable and the call will be discarded.
 5b. Two things break the JSON most often — check them before you emit:
    (a) QUOTES INSIDE A VALUE. A shell/PowerShell command very often contains double quotes, e.g. Get-ChildItem "$env:USERPROFILE\\.dsh". Every such inner double quote MUST be escaped as \\" inside the JSON string. An unescaped one ends the string early and discards the whole call.
    (b) LINE BREAKS INSIDE A VALUE. Never put a real line break inside a string; write \\n instead. When a command needs several statements, join them with ";" on ONE line, or use \\n escapes — do not paste them as actual newlines. Prefer single quotes inside commands to reduce escaping.
-6. Do NOT use XML/HTML-like markup for tool calls: no angle-bracket wrapper tags (no <tool_calls>, <invoke>, <parameter>), and none of the private delimiter-prefixed variants some DeepSeek surfaces use. The JSON object above is the ONLY accepted format. Markup is not just ignored — it leaks into the visible transcript (and into the web conversation) as broken output.
+6. Always wrap the JSON in a \`\`\`dsh-tool fence (see the example above). Do NOT use XML/HTML-like markup instead: no angle-bracket wrapper tags (no <tool_calls>, <invoke>, <parameter>), nor the private delimiter-prefixed variants some DeepSeek surfaces use. An unfenced object or any such markup leaks into the visible transcript and into the web conversation.
 7. Always answer in the same language the user writes in (these instructions are English only for precision; the JSON itself is language-neutral).
-8. NEVER reproduce the transcript. Do not restate previous turns, "[Tool Result …]" blocks, tool output, or the current prompt. Emit ONLY the calls you want to run right now. A payload that replays earlier calls or embeds tool results is discarded and costs a retry — measured case: a model emitted 15 replayed calls inside one 8152-char payload, and every one of them had to be thrown away.
+8. NEVER reproduce the transcript. Do not restate previous turns, "[Tool Result …]" blocks, tool output, or the current prompt. Emit ONLY the calls you want to run right now. A payload that replays earlier calls or embeds tool results is discarded and costs a retry.
 9. Do NOT batch. Emit one call, stop, and wait for its real result before you decide the next step. Needing several tools means several successive messages, one call each — the user has turned batching off for this session, so a multi-call array works against them.
 10. Unlike a batch, a call here MAY build on the previous step's result — read what came back and use it. That is the point of one-at-a-time. But never invent a result you have not received.`;
 /**
@@ -1984,19 +1988,59 @@ const MARKER_RE = /\{\s*"tool_calls?"\s*:/;
 * 却撞上第二个 `｜` → 整个标记认不出来 → 不进捕获态 → 原样进正文 → GUI 渲染成乱码。
 * 现在竖线按 `+` 容忍（含全角/半角混用），并把 `calls` 也列入包裹标签名。
 */
-const DSML_PREFIX = "(?:[|｜]+\\s*DSML\\s*[|｜]+\\s*)?";
 const WRAPPER_NAMES = "tool_calls|tool_call|function_calls|calls";
-const XML_STARTER_RE = new RegExp(`<\\s*${DSML_PREFIX}(?:dsml-)?(${WRAPPER_NAMES}|invoke)\\b`, "i");
-/** 代码围栏收尾（模型常把调用块放进 ``` 里）。 */
-const FENCE_TAIL_RE = /\n?[ \t]*```[a-zA-Z0-9]*[ \t]*\n?$/;
+/**
+* DSML 前缀（竖线段**或** `dsml-` 连字符段），**整组可选**。
+*
+* 🔴 2026-10-03 修掉一个连踩两次的坑：此前是两个**各自独立**的可选片段
+* （`DSML_PREFIX` 自带 `?`，再串一个 `(?:dsml-)?`）。写成 `A? B? invoke` 时，
+* `A?` 里的 `?` 会让**整组都能为空** ⇒ "无前缀也匹配 invoke" ⇒ 正文里正常讨论的
+* `<invoke>` 被吞（logic-test 守着这条）。**可选性只能写在整个片段的外层**，
+* 两个变体必须放进同一个交替里。现在 `stripStrayToolMarkup` 里 `invoke` 用的就是这个
+* 片段的**非可选**写法 `DSML_PREFIX_ONLY`。
+*
+* 另修：`dsml-` 与标签名之间**允许空白**（`<dsml- calls>`）。旧写法只认 `<dsml-calls>`，
+* 而模型两种都吐 ⇒ 带空格那种整块原样上屏（144 组合矩阵里 24 个泄漏）。
+* ⚠️ 之所以一直没暴露：现有用例只写了无空格形态（`check-dsml-stray.mjs` / `logic-test.mjs`）——
+* **测的形态和现场形态不是同一个**。与「0.6.28 思考分支跳过全部四道网」同类。
+*/
+const DSML_PREFIX_BODY = "[|｜]+\\s*DSML\\s*[|｜]+\\s*|\\s*dsml-\\s*";
+/** 整组可选（前缀可有可无）。 */
+const DSML_PREFIX = `(?:${DSML_PREFIX_BODY})?`;
+/** 整组**必需**（给"必须有前缀才剥"的场合用，如 `invoke`）。 */
+const DSML_PREFIX_ONLY = `(?:${DSML_PREFIX_BODY})`;
+const XML_STARTER_RE = new RegExp(`<\\s*${DSML_PREFIX}(${WRAPPER_NAMES}|invoke)\\b`, "i");
 const FENCE_HEAD_RE = /^[ \t]*\n?```[ \t]*\n?/;
+/** 捕获态里出现的围栏（含语言名、不要求行首）。 */
+const FENCE_ANY_HEAD_RE = /\n?[ \t]*```[ \t]*[a-zA-Z0-9_-]*[ \t]*\n?/;
+const CALL_FENCE_OPEN_RE = new RegExp(`\`\`\`[ \\t]*dsh-tool[ \\t]*\\n?`, "i");
+/**
+* 闭栏（可能带语言名）。**只在 sawCallFence 为真时使用** ——
+* 那表示开栏已经被剥掉，这个闭栏必定是调用块的另一半。
+*
+* ⚠️ 闭栏**不能**在 `drain()` 里按"位置"裸判（`/\n?```…$/` 那种）：用户正常回答里的
+* 代码块闭栏也会命中，逐字符分块时必现（`check-auto-continue` N03 抓到过）。
+*/
+const CALL_FENCE_TAIL_RE = /\n?[ \t]*```[ \t]*(?:[a-zA-Z0-9_-]*)[ \t]*\n?$/;
+/**
+* 剥掉**属于调用块**的围栏（0.6.38）。
+*
+* ⚠️ 这里可以**无条件剥所有围栏**（包括裸 ``` 和 ```json）：进入本函数的文本都已经
+* 确定属于一个调用块 —— 捕获态的 buffer，或紧跟其后残留的部分。
+* 那个"不要误伤用户代码块"的约束在**别处**（`drain()` 里对**普通正文**的判据），
+* 那里用 `CALL_FENCE_OPEN_RE` + `sawCallFence` 把关。
+* 模型也常用 ```json 包裹调用（`logic-test` 有用例守着），那些围栏同样该剥。
+*/
+function stripCallFence(text) {
+	return text.replace(/```[ \t]*[a-zA-Z0-9_-]*[ \t]*\n?/g, "");
+}
 /**
 * 开/收标签前缀（宽容写法）。严格解析与宽容解析**必须共用同一套**，否则会出现
 * 「findXmlToolCallEnd 认得出收尾、parseXmlToolCalls 认不出 invoke」→ 整块被降级成正文泄漏。
 * 覆盖：`< invoke`（标签名带空白）、单/重复竖线的 DSML 前缀（含全角）、`<dsml-invoke>`。
 */
-const TAG_OPEN_PREFIX = `<\\s*${DSML_PREFIX}(?:dsml-)?`;
-const TAG_CLOSE_PREFIX = `<\\/\\s*${DSML_PREFIX}(?:dsml-)?`;
+const TAG_OPEN_PREFIX = `<\\s*${DSML_PREFIX}`;
+const TAG_CLOSE_PREFIX = `<\\/\\s*${DSML_PREFIX}`;
 const XML_CLOSE_NAMES = `parameter|invoke|${WRAPPER_NAMES}`;
 /**
 * 归一化 DSML 噪声 → 标准标签。
@@ -2004,7 +2048,7 @@ const XML_CLOSE_NAMES = `parameter|invoke|${WRAPPER_NAMES}`;
 * 让标签名紧跟在 `<` 之后（`<` + 前缀 + ` ` + `invoke` → `<invoke`）。
 */
 function normalizeDsml(text) {
-	return text.replace(new RegExp(`<(/?)${DSML_PREFIX}`, "gi"), "<$1").replace(/<\s*dsml-/gi, "<").replace(/<\/\s*dsml-/gi, "</");
+	return text.replace(new RegExp(`<(/?)${DSML_PREFIX}`, "gi"), "<$1").replace(/<\s*dsml-\s*/gi, "<").replace(/<\/\s*dsml-\s*/gi, "</");
 }
 /**
 * JSON 调用标记前缀（用于跨包 hold-back 判断）。
@@ -2014,7 +2058,13 @@ function normalizeDsml(text) {
 * → 整个 JSON 泄漏成正文。修复见 partialMarkerSuffixLength。
 */
 const JSON_MARKER_STARTERS = ["{\"tool_calls\"", "{\"tool_call\""];
-/** XML 标记前缀（用于跨包 hold-back 判断）。`calls` 是实测出现的退化包裹名。 */
+/**
+* XML 标记前缀（用于跨包 hold-back 判断）。`calls` 是实测出现的退化包裹名。
+*
+* ⚠️ `dsml-` 连字符条目必须同时列**带空格**形态（`<dsml- calls>`）：hold-back 判据是
+* "逐字符比对 starter 前缀"，少列一种 ⇒ 跨包切分时判不出前缀 ⇒ 半截标记当正文吐出。
+* 这条与 dsml- 前缀的修复是同一根因（2026-10-03）。
+*/
 const XML_MARKER_STARTERS = [
 	"<tool_calls",
 	"<tool_call",
@@ -2022,7 +2072,10 @@ const XML_MARKER_STARTERS = [
 	"<calls",
 	"<invoke",
 	"<dsml-tool_calls",
-	"<dsml-invoke"
+	"<dsml-invoke",
+	"<dsml- tool_calls",
+	"<dsml- invoke",
+	"<dsml- calls"
 ];
 /**
 * 判断 text 末尾是否是（可能的）标记前缀 —— 决定是否 hold back。
@@ -2600,7 +2653,7 @@ function parseToolCallJson(json) {
 * 注意：不配平的截断仍由 structuralRepairCandidates 的安全闸门拒绝（宁可不执行半条命令）。
 */
 function parseSalvagedToolCallJson(buffer) {
-	const text = buffer.replace(FENCE_HEAD_RE, "");
+	const text = buffer.replace(FENCE_ANY_HEAD_RE, "").replace(/^\s+/, "");
 	const direct = parseToolCallJson(text);
 	if (direct) return direct;
 	const balanced = extractBalancedJson(text);
@@ -2615,12 +2668,12 @@ function parseSalvagedToolCallJson(buffer) {
 */
 function findXmlToolCallEnd(buffer) {
 	const text = buffer;
-	const wrapper = new RegExp(`<\\s*${DSML_PREFIX}(?:dsml-)?(${WRAPPER_NAMES})\\b`, "i").exec(text);
+	const wrapper = new RegExp(`<\\s*${DSML_PREFIX}(${WRAPPER_NAMES})\\b`, "i").exec(text);
 	const startsWithWrapper = wrapper !== null && wrapper.index === 0;
-	const isInvokeStart = (value) => new RegExp(`^\\s*<\\s*${DSML_PREFIX}(?:dsml-)?invoke\\b`, "i").test(value);
+	const isInvokeStart = (value) => new RegExp(`^\\s*<\\s*${DSML_PREFIX}invoke\\b`, "i").test(value);
 	if (startsWithWrapper) {
 		const tag = wrapper[1].toLowerCase();
-		const match = new RegExp(`<\\/\\s*${DSML_PREFIX}(?:dsml-)?${tag}\\s*>`, "i").exec(text);
+		const match = new RegExp(`<\\/\\s*${DSML_PREFIX}${tag}\\s*>`, "i").exec(text);
 		return match ? match.index + match[0].length : -1;
 	}
 	if (!isInvokeStart(text)) return -1;
@@ -2628,12 +2681,12 @@ function findXmlToolCallEnd(buffer) {
 	for (;;) {
 		const slice = text.slice(cursor);
 		if (!isInvokeStart(slice)) return cursor > 0 ? cursor : -1;
-		const match = /<\/\s*(?:\|\s*DSML\s*\|\s*)?(?:dsml-)?invoke\s*>/i.exec(slice);
+		const match = new RegExp(`<\\/\\s*${DSML_PREFIX}invoke\\s*>`, "i").exec(slice);
 		if (!match) return -1;
 		cursor += match.index + match[0].length;
 		const rest = text.slice(cursor);
 		if (isInvokeStart(rest)) continue;
-		const stray = new RegExp(`^\\s*<\\/\\s*${DSML_PREFIX}(?:dsml-)?(?:${WRAPPER_NAMES})\\s*>`, "i").exec(rest);
+		const stray = new RegExp(`^\\s*<\\/\\s*${DSML_PREFIX}(?:${WRAPPER_NAMES})\\s*>`, "i").exec(rest);
 		if (stray) return cursor + stray[0].length;
 		const tail = rest.trim();
 		if (tail.startsWith("<") && /^<\/?\s*[|｜]?\s*[A-Za-z]{0,14}$/.test(tail)) return -1;
@@ -2660,7 +2713,7 @@ function findXmlToolCallEnd(buffer) {
 function stripStrayToolMarkup(text) {
 	if (!text) return text;
 	if (!/voke\s*>|calls?\s*>|tool_calls?\s*>|function_calls?\s*>|DSML/i.test(text)) return text;
-	return text.replace(new RegExp(`<\\/?\\s*(?:(?:[|｜]+\\s*DSML\\s*[|｜]+\\s*)|dsml-)(?:dsml-)?(?:${WRAPPER_NAMES}|invoke)\\s*>`, "gi"), "").replace(new RegExp(`<\\/\\s*(?:[|｜]+\\s*DSML\\s*[|｜]+\\s*)?(?:dsml-)?(?:${WRAPPER_NAMES}|invoke)\\s*>`, "gi"), "").replace(/<\/\s+(?:tool_calls?|function_calls|calls|invoke)\s*>/gi, "").replace(/(^|\n)[ \t]*(?:in)?voke\s*>\s*(?=\n|$)/gi, "$1");
+	return text.replace(new RegExp(`<\\/?\\s*(?:${DSML_PREFIX_ONLY})?(?:${WRAPPER_NAMES})\\s*>|<\\/?\\s*${DSML_PREFIX_ONLY}invoke\\s*>`, "gi"), "").replace(new RegExp(`(^|\\n)[ \\t]*<\\/?[ \\t]+(?:${WRAPPER_NAMES})[ \\t]*>[ \\t]*(?=\\n|$)`, "gi"), "$1").replace(/(^|\n)[ \t]*(?:in)?voke\s*>\s*(?=\n|$)/gi, "$1");
 }
 /**
 * 流式工具调用过滤器。
@@ -2674,6 +2727,14 @@ var ToolCallStreamFilter = class {
 	capture = null;
 	abandoned = null;
 	knownTools;
+	/**
+	* 本次流里**我们剥掉过一个调用围栏的开栏**（0.6.38）。
+	*
+	* ⇒ 之后出现的闭栏必定是同一个调用块的收尾，可以安全剥掉。
+	* ⚠️ 有了这个标记才敢剥闭栏：否则"正文里正常的代码块"会被误伤
+	* （`check-auto-continue` N03 / `check-tools-section` 各有用例守着）。
+	*/
+	sawCallFence = false;
 	constructor(knownTools) {
 		this.knownTools = knownTools;
 	}
@@ -2708,7 +2769,8 @@ var ToolCallStreamFilter = class {
 			else out.text += stripStrayToolMarkup(captured.buffer);
 			this.capture = null;
 		}
-		out.text += stripStrayToolMarkup(this.pending);
+		const tailText = stripStrayToolMarkup(this.pending);
+		out.text += this.sawCallFence ? tailText.replace(CALL_FENCE_TAIL_RE, "") : tailText;
 		this.pending = "";
 		if (this.abandoned) out.rejected = this.abandoned;
 		return out;
@@ -2742,7 +2804,7 @@ var ToolCallStreamFilter = class {
 					};
 					else out.text += stripStrayToolMarkup(block);
 					this.capture = null;
-					this.pending = captured.buffer.slice(end).replace(FENCE_HEAD_RE, "") + this.pending;
+					this.pending = stripCallFence(captured.buffer.slice(end)) + this.pending;
 					continue;
 				}
 				const balanced = extractBalancedJson(captured.buffer);
@@ -2762,7 +2824,7 @@ var ToolCallStreamFilter = class {
 				if (calls) {
 					out.calls.push(...calls);
 					this.capture = null;
-					this.pending = captured.buffer.slice(balanced.end).replace(FENCE_HEAD_RE, "") + this.pending;
+					this.pending = stripCallFence(captured.buffer.slice(balanced.end)) + this.pending;
 					continue;
 				}
 				const head = captured.buffer.slice(0, balanced.end);
@@ -2783,9 +2845,9 @@ var ToolCallStreamFilter = class {
 			const useXml = xmlIndex !== -1 && (jsonIndex === -1 || xmlIndex < jsonIndex);
 			const index = useXml ? xmlIndex : jsonIndex;
 			if (index !== -1) {
-				let head = this.pending.slice(0, index);
-				const fence = FENCE_TAIL_RE.exec(head);
-				if (fence) head = head.slice(0, fence.index);
+				const rawHead = this.pending.slice(0, index);
+				const head = stripCallFence(rawHead);
+				if (head !== rawHead) this.sawCallFence = true;
 				out.text += head;
 				this.capture = {
 					mode: useXml ? "xml" : "json",
@@ -2795,6 +2857,13 @@ var ToolCallStreamFilter = class {
 				continue;
 			}
 			this.pending = stripStrayToolMarkup(this.pending);
+			const ownFence = CALL_FENCE_OPEN_RE.exec(this.pending);
+			if (ownFence) {
+				this.sawCallFence = true;
+				out.text += this.pending.slice(0, ownFence.index);
+				this.pending = this.pending.slice(ownFence.index);
+				return;
+			}
 			if (this.pending.length <= HOLD_BACK_CHARS) return;
 			const hold = partialMarkerSuffixLength(this.pending);
 			if (hold > 0) {
@@ -2802,6 +2871,11 @@ var ToolCallStreamFilter = class {
 				this.pending = this.pending.slice(this.pending.length - hold);
 				return;
 			}
+			if (this.sawCallFence && this.pending.includes("```")) {
+				out.text += this.pending.replace(CALL_FENCE_TAIL_RE, "");
+				this.pending = "";
+				return;
+			}
 			out.text += this.pending;
 			this.pending = "";
 			return;
@@ -10454,7 +10528,7 @@ async function checkForUpdate(current, fetchImpl) {
 * 兜底常量与 package.json 的一致性由 `tests/check-smoke.mjs` 守着，不会漂。
 */
 /** 与 package.json 保持一致的兜底版本（由测试保证不会漂）。 */
-const FALLBACK_VERSION = "0.6.36";
+const FALLBACK_VERSION = "0.6.38";
 let cached;
 /** 本插件版本（如 `0.1.26`）。 */
 function pluginVersion() {