minimal-agent 0.11.0 → 0.12.0

package/src/loop.js

@@ -40,11 +40,26 @@ import { ALL_TOOLS, executeTool as defaultExecuteTool, getToolByName, getToolGat
 import { configService } from './config/configService.js';
 import { capabilityForToolName } from './tools/capabilities.js';
 import { createEffectiveToolSet } from './tools/effectiveToolSet.js';
+import { hydrateSessionWorktree } from './tools/worktree/sessionWorktree.js';
 import { capabilitiesForTools, enabledPolicyIds, } from './prompts/policyRegistry.js';
 import { EvidenceLedger } from './harness/evidenceLedger.js';
 import { StallGuard } from './harness/stallGuard.js';
 import { validateFinalClaims } from './harness/claimValidation.js';
 import { createAgentRuntimeContext, } from './runtime/agentRuntimeContext.js';
+const DELIVERY_ARTIFACT = '(?:文件|合同|文档|表格|报告|图片|图像|海报|幻灯片|PPT|PDF|代码|脚本|压缩包|网页|页面|HTML|DOCX|XLSX|CSV|ZIP)';
+const DELIVERY_ACTION = '(?:发|发送|交付|提交|给|传|制作|生成|创建|导出|输出|修改|更新|完成)';
+const ENGLISH_DELIVERY_ARTIFACT = '(?:file|document|report|spreadsheet|workbook|slides?|presentation|pdf|image|code|script|archive|zip|html|webpage|website)';
+const ENGLISH_DELIVERY_ACTION = '(?:send|deliver|submit|provide|create|generate|export|update|modify|finish|produce)';
+/** Whether this turn explicitly asks for a concrete artifact that should be formally delivered. */
+export function expectsFormalDelivery(input) {
+    const compact = input.replace(/\s+/g, '');
+    const chinese = new RegExp(`${DELIVERY_ACTION}(?:给)?我?.{0,24}${DELIVERY_ARTIFACT}|${DELIVERY_ARTIFACT}.{0,24}${DELIVERY_ACTION}(?:给)?我?`, 'i');
+    const english = new RegExp(`\\b${ENGLISH_DELIVERY_ACTION}\\b.{0,80}\\b${ENGLISH_DELIVERY_ARTIFACT}\\b|\\b${ENGLISH_DELIVERY_ARTIFACT}\\b.{0,80}\\b${ENGLISH_DELIVERY_ACTION}\\b`, 'i');
+    return chinese.test(compact) || english.test(input);
+}
+const DELIVERY_CORRECTION_REMINDER = `The user requested a concrete final deliverable, but no successful PresentResult call has been made.
+Do not repeat the answer or mention a path only. Call PresentResult now with the actual final files and/or final http(s) links.
+Submit only final outputs, never temporary scripts, unpacked assets, caches, or reference sources. If no valid result exists, explain that honestly without inventing one.`;
 /**
  * 每轮 LLM 请求都会带上工具 schema，但 countMessagesTokens 只数历史消息、
  * 漏了这部分 → 系统性低估。autoCompact 判定阈值时加上它才准。
@@ -123,7 +138,7 @@ export async function* runQuery(userInput, options) {
     // DI fallback：测试可传 stub，生产走真实模块单例
     const chatFn = options.chat ?? defaultChat;
     const executeToolFn = options.executeTool ?? defaultExecuteTool;
-    const explicitFileDeliveryRequested = /(?:发|发送|交付|提交|给|传)(?:给)?我.{0,24}(?:文件|合同|文档|表格|报告|图片|压缩包)|(?:文件|合同|文档|表格|报告|图片|压缩包).{0,24}(?:发|发送|交付|提交|给|传)(?:给)?我/.test(userInput.replace(/\s+/g, ''));
+    const explicitFileDeliveryRequested = expectsFormalDelivery(userInput);
     const transientFor = (tools) => {
         const opaque = options.transientContext?.trim() ?? '';
         const bundle = options.transientBundle;
@@ -143,7 +158,14 @@ export async function* runQuery(userInput, options) {
     };
     let resultPresented = false;
     let presentedResultUnverified = false;
+    let deliveryCorrectionAttempted = false;
     const subagents = await configService.subagents();
+    await hydrateSessionWorktree({
+        sessionState,
+        workspaceId: runtimeContext.workspaceId,
+        sessionId: runtimeContext.sessionId,
+        cwd: runtimeContext.cwd,
+    });
     const toolCallContext = {
         history,
         sessionState,
@@ -183,6 +205,10 @@ export async function* runQuery(userInput, options) {
         requiredNames: options.requiredTools,
     });
     const activeTools = effectiveToolSet.tools;
+    const formalDeliveryRequired = explicitFileDeliveryRequested
+        && runtimeContext.profile === 'main'
+        && runtimeContext.surface !== 'workflow'
+        && effectiveToolSet.names.has('PresentResult');
     let currentEffectiveToolSet = effectiveToolSet;
     let lastRequestTransientContext = [options.transientBundle?.text, options.transientContext]
         .filter(Boolean).join('\n\n');
@@ -298,7 +324,10 @@ export async function* runQuery(userInput, options) {
         }
         // 2. 自动压缩（判据 = max(上一轮真实 usage, 历史估算 + 工具 schema)，
         //    阈值 provider 无关、按 contextWindow × compactRatio 比例触发）
-        let requestTransientContext = transientFor(activeTools);
+        let requestTransientContext = [
+            transientFor(activeTools),
+            deliveryCorrectionAttempted && !resultPresented ? DELIVERY_CORRECTION_REMINDER : '',
+        ].filter(Boolean).join('\n\n');
         lastRequestTransientContext = requestTransientContext;
         const preCompactBudget = buildContextBudgetPlan({
             provider,
@@ -374,9 +403,11 @@ export async function* runQuery(userInput, options) {
                     /* snip 也失败 → 真的只能硬上 */
                 }
                 if (!recovered) {
+                    // 事件是 provider 原始报错唯一该去的地方：只到 stderr / UI，不进 history、
+                    // 不落盘、不会在后续轮次重新发给模型（compact.ts 里那条降级消息因此保持无错误体）。
                     yield {
                         type: 'error',
-                        error: '自动压缩失败，规则式截断也未能释放空间；已继续尝试回答。',
+                        error: `自动压缩失败，规则式截断也未能释放空间；已继续尝试回答：${e.message}`,
                         code: 'compact_failed',
                     };
                 }
@@ -384,7 +415,10 @@ export async function* runQuery(userInput, options) {
         }
         // Re-open transient capacity after compaction. If the compacted tail is still
         // too large, trim old history before sacrificing any model-visible ability.
-        requestTransientContext = transientFor(activeTools);
+        requestTransientContext = [
+            transientFor(activeTools),
+            deliveryCorrectionAttempted && !resultPresented ? DELIVERY_CORRECTION_REMINDER : '',
+        ].filter(Boolean).join('\n\n');
         lastRequestTransientContext = requestTransientContext;
         let postCompactBudget = buildContextBudgetPlan({
             provider,
@@ -409,7 +443,10 @@ export async function* runQuery(userInput, options) {
                     messagesRemoved: snipped.messagesRemoved,
                     tokensFreed: snipped.tokensFreed,
                 };
-                requestTransientContext = transientFor(activeTools);
+                requestTransientContext = [
+                    transientFor(activeTools),
+                    deliveryCorrectionAttempted && !resultPresented ? DELIVERY_CORRECTION_REMINDER : '',
+                ].filter(Boolean).join('\n\n');
                 lastRequestTransientContext = requestTransientContext;
                 postCompactBudget = buildContextBudgetPlan({
                     provider,
@@ -612,6 +649,16 @@ export async function* runQuery(userInput, options) {
         yield { type: 'assistant_message', message: assistantMsg };
         // 4. 没有工具调用 → 整轮交互结束
         if (toolCallsByIndex.length === 0) {
+            // A model occasionally writes a path/link in prose and stops without formally
+            // presenting it. Give it one model-only corrective pass; the reminder is
+            // transient and therefore never pollutes persisted conversation history.
+            if (formalDeliveryRequired
+                && !resultPresented
+                && !deliveryCorrectionAttempted
+                && turn < maxTurns) {
+                deliveryCorrectionAttempted = true;
+                continue;
+            }
             // R2：最终回答被 provider 因 max_tokens 截断（finish_reason='length'）时，
             // 不能静默当正常 end_turn 收尾 —— 否则 -p 宿主会拿到半截答案却以为成功。
             // 走通用 warning（text/json 都落 stderr，不污染 json 那一行 stdout 契约）。
@@ -651,7 +698,7 @@ export async function* runQuery(userInput, options) {
                     : {}),
                 promptCacheUsage: lastPromptCacheUsage,
             };
-            if (explicitFileDeliveryRequested && !resultPresented) {
+            if (formalDeliveryRequired && !resultPresented) {
                 const warning = '交付未完成：用户明确要求提供文件，但本轮没有成功提交可打开的文件结果。';
                 yield { type: 'warning', message: warning };
                 yield { type: 'turn_done', completionStatus: 'delivery_incomplete', warning };
@@ -687,6 +734,17 @@ export async function* runQuery(userInput, options) {
         // 执行单个 tool call → WorkerOutcome（内部吞掉 abort/异常，永不 reject）。
         const runOne = async (tc, reportProgress) => {
             try {
+                if (stallGuard.shouldReject(tc)) {
+                    return {
+                        tc,
+                        result: {
+                            ok: false,
+                            error: '检测到同一工具和参数已连续两次返回相同失败；第三次调用已在执行前拒绝，请改变输入或改用其他路径。',
+                            recovery: 'change-input',
+                            sensitivity: 'public',
+                        },
+                    };
+                }
                 // The model-visible catalog and the execution boundary are the same set.
                 // A provider may still emit a stale or fabricated tool call; return a
                 // recoverable result so the model can choose an available path.
@@ -711,7 +769,7 @@ export async function* runQuery(userInput, options) {
                 if (effectiveToolGate) {
                     let decision;
                     try {
-                        const gateDetails = getToolGateDetails(tc.function.name, tc.function.arguments, { ...toolCallContext, toolCallId: tc.id, reportProgress });
+                        const gateDetails = getToolGateDetails(tc.function.name, tc.function.arguments, { ...toolCallContext, cwd: sessionState?.activeWorktree?.path ?? toolCallContext.cwd, toolCallId: tc.id, reportProgress });
                         decision = await effectiveToolGate({
                             name: tc.function.name,
                             argsJson: tc.function.arguments,
@@ -730,7 +788,27 @@ export async function* runQuery(userInput, options) {
                 options.onToolStart?.(tc.function.name, tc.id);
                 // 浅拷贝填入本次调用的 toolCallId：进度按调用实例路由（并行同名工具不串扰）。
                 // advisorCalls/agentCalls 是共享对象引用，计数仍全轮共享，不受拷贝影响。
-                const result = await executeToolFn(tc.function.name, tc.function.arguments, signal, { ...toolCallContext, toolCallId: tc.id, reportProgress });
+                let result = await executeToolFn(tc.function.name, tc.function.arguments, signal, { ...toolCallContext, cwd: sessionState?.activeWorktree?.path ?? toolCallContext.cwd, toolCallId: tc.id, reportProgress });
+                if (tc.function.name === 'PresentResult'
+                    && result.ok
+                    && result.metadata?.kind === 'result_manifest'
+                    && options.commitFormalDelivery) {
+                    try {
+                        await options.commitFormalDelivery({
+                            toolCallId: tc.id,
+                            turnId: userMessage.id ?? options.userMessageId ?? 'turn:unknown',
+                            manifest: result.metadata.manifest,
+                        });
+                    }
+                    catch (error) {
+                        result = {
+                            ok: false,
+                            error: `正式交付未能可靠保存：${error.message}`,
+                            recovery: 'retry',
+                            sensitivity: 'local',
+                        };
+                    }
+                }
                 options.onToolEnd?.(tc.id, false);
                 return { tc, result };
             }
@@ -871,9 +949,15 @@ export async function* runQuery(userInput, options) {
         // If the third identical observation is also the configured final turn, retain the
         // established max_turns termination contract. The stall guard is valuable only when
         // it can stop a failing path before the caller's explicit turn budget does.
-        const stall = turn + 1 < maxTurns
-            ? stallGuard.observe(settled.map((item) => item.tc), settled.map((item) => item.result), assistantText)
-            : { stalled: false };
+        const preemptedRepeatedFailure = settled.some(({ result }) => !result.ok && result.error.includes('第三次调用已在执行前拒绝'));
+        const stall = preemptedRepeatedFailure
+            ? ({
+                stalled: true,
+                reason: 'repeated_failure',
+            })
+            : turn + 1 < maxTurns
+                ? stallGuard.observe(settled.map((item) => item.tc), settled.map((item) => item.result), assistantText)
+                : { stalled: false };
         if (stall.stalled) {
             const message = stall.reason === 'repeated_failure'
                 ? '检测到同一工具以相同参数连续返回相同失败，已停止重复重试。'

package/src/loop.ts

@@ -53,6 +53,7 @@ import {
 } from './tools/index.js';
 import type { ToolGate } from './toolGate.js';
 import type {
+  DeliverableManifest,
   ImageDetail,
   ImageInputSpec,
   LoopEvent,
@@ -66,6 +67,7 @@ import type {
 import { configService } from './config/configService.js';
 import { capabilityForToolName } from './tools/capabilities.js';
 import { createEffectiveToolSet } from './tools/effectiveToolSet.js';
+import { hydrateSessionWorktree } from './tools/worktree/sessionWorktree.js';
 import {
   capabilitiesForTools,
   enabledPolicyIds,
@@ -78,6 +80,29 @@ import {
   type AgentRuntimeContext,
 } from './runtime/agentRuntimeContext.js';
 
+const DELIVERY_ARTIFACT = '(?:文件|合同|文档|表格|报告|图片|图像|海报|幻灯片|PPT|PDF|代码|脚本|压缩包|网页|页面|HTML|DOCX|XLSX|CSV|ZIP)';
+const DELIVERY_ACTION = '(?:发|发送|交付|提交|给|传|制作|生成|创建|导出|输出|修改|更新|完成)';
+const ENGLISH_DELIVERY_ARTIFACT = '(?:file|document|report|spreadsheet|workbook|slides?|presentation|pdf|image|code|script|archive|zip|html|webpage|website)';
+const ENGLISH_DELIVERY_ACTION = '(?:send|deliver|submit|provide|create|generate|export|update|modify|finish|produce)';
+
+/** Whether this turn explicitly asks for a concrete artifact that should be formally delivered. */
+export function expectsFormalDelivery(input: string): boolean {
+  const compact = input.replace(/\s+/g, '');
+  const chinese = new RegExp(
+    `${DELIVERY_ACTION}(?:给)?我?.{0,24}${DELIVERY_ARTIFACT}|${DELIVERY_ARTIFACT}.{0,24}${DELIVERY_ACTION}(?:给)?我?`,
+    'i',
+  );
+  const english = new RegExp(
+    `\\b${ENGLISH_DELIVERY_ACTION}\\b.{0,80}\\b${ENGLISH_DELIVERY_ARTIFACT}\\b|\\b${ENGLISH_DELIVERY_ARTIFACT}\\b.{0,80}\\b${ENGLISH_DELIVERY_ACTION}\\b`,
+    'i',
+  );
+  return chinese.test(compact) || english.test(input);
+}
+
+const DELIVERY_CORRECTION_REMINDER = `The user requested a concrete final deliverable, but no successful PresentResult call has been made.
+Do not repeat the answer or mention a path only. Call PresentResult now with the actual final files and/or final http(s) links.
+Submit only final outputs, never temporary scripts, unpacked assets, caches, or reference sources. If no valid result exists, explain that honestly without inventing one.`;
+
 /**
  * 每轮 LLM 请求都会带上工具 schema，但 countMessagesTokens 只数历史消息、
  * 漏了这部分 → 系统性低估。autoCompact 判定阈值时加上它才准。
@@ -189,6 +214,17 @@ export interface RunQueryOptions {
     signal?: AbortSignal,
     ctx?: ToolCallContext,
   ) => Promise<ToolResult>;
+  /**
+   * Trusted host persistence boundary for formal results. It runs after
+   * PresentResult validates the files but before tool_end is published or the
+   * result is appended to history. Throwing turns the tool call into a failure,
+   * so a UI can never display an uncommitted delivery as durable.
+   */
+  commitFormalDelivery?: (input: {
+    toolCallId: string;
+    turnId: string;
+    manifest: DeliverableManifest;
+  }) => Promise<void>;
   /**
    * 工具执行闸门（通用机制，见 src/toolGate.ts）：loop 在执行每个工具前
    * await 它拿放行/拒绝；拒绝时把 reason 当 tool_result 回填。内核零策略——审批语义
@@ -264,10 +300,7 @@ export async function* runQuery(
   // DI fallback：测试可传 stub，生产走真实模块单例
   const chatFn = options.chat ?? defaultChat;
   const executeToolFn = options.executeTool ?? defaultExecuteTool;
-  const explicitFileDeliveryRequested =
-    /(?:发|发送|交付|提交|给|传)(?:给)?我.{0,24}(?:文件|合同|文档|表格|报告|图片|压缩包)|(?:文件|合同|文档|表格|报告|图片|压缩包).{0,24}(?:发|发送|交付|提交|给|传)(?:给)?我/.test(
-      userInput.replace(/\s+/g, ''),
-    );
+  const explicitFileDeliveryRequested = expectsFormalDelivery(userInput);
 
   const transientFor = (tools: readonly Tool[]): string => {
     const opaque = options.transientContext?.trim() ?? '';
@@ -290,7 +323,14 @@ export async function* runQuery(
   };
   let resultPresented = false;
   let presentedResultUnverified = false;
+  let deliveryCorrectionAttempted = false;
   const subagents = await configService.subagents();
+  await hydrateSessionWorktree({
+    sessionState,
+    workspaceId: runtimeContext.workspaceId,
+    sessionId: runtimeContext.sessionId,
+    cwd: runtimeContext.cwd,
+  });
   const toolCallContext: ToolCallContext = {
     history,
     sessionState,
@@ -333,6 +373,10 @@ export async function* runQuery(
     requiredNames: options.requiredTools,
   });
   const activeTools = effectiveToolSet.tools;
+  const formalDeliveryRequired = explicitFileDeliveryRequested
+    && runtimeContext.profile === 'main'
+    && runtimeContext.surface !== 'workflow'
+    && effectiveToolSet.names.has('PresentResult');
   let currentEffectiveToolSet = effectiveToolSet;
   let lastRequestTransientContext = [options.transientBundle?.text, options.transientContext]
     .filter(Boolean).join('\n\n');
@@ -455,7 +499,10 @@ export async function* runQuery(
 
     // 2. 自动压缩（判据 = max(上一轮真实 usage, 历史估算 + 工具 schema)，
     //    阈值 provider 无关、按 contextWindow × compactRatio 比例触发）
-    let requestTransientContext = transientFor(activeTools);
+    let requestTransientContext = [
+      transientFor(activeTools),
+      deliveryCorrectionAttempted && !resultPresented ? DELIVERY_CORRECTION_REMINDER : '',
+    ].filter(Boolean).join('\n\n');
     lastRequestTransientContext = requestTransientContext;
     const preCompactBudget = buildContextBudgetPlan({
       provider,
@@ -528,9 +575,11 @@ export async function* runQuery(
           /* snip 也失败 → 真的只能硬上 */
         }
         if (!recovered) {
+          // 事件是 provider 原始报错唯一该去的地方：只到 stderr / UI，不进 history、
+          // 不落盘、不会在后续轮次重新发给模型（compact.ts 里那条降级消息因此保持无错误体）。
           yield {
             type: 'error',
-            error: '自动压缩失败，规则式截断也未能释放空间；已继续尝试回答。',
+            error: `自动压缩失败，规则式截断也未能释放空间；已继续尝试回答：${(e as Error).message}`,
             code: 'compact_failed',
           };
         }
@@ -539,7 +588,10 @@ export async function* runQuery(
 
     // Re-open transient capacity after compaction. If the compacted tail is still
     // too large, trim old history before sacrificing any model-visible ability.
-    requestTransientContext = transientFor(activeTools);
+    requestTransientContext = [
+      transientFor(activeTools),
+      deliveryCorrectionAttempted && !resultPresented ? DELIVERY_CORRECTION_REMINDER : '',
+    ].filter(Boolean).join('\n\n');
     lastRequestTransientContext = requestTransientContext;
     let postCompactBudget = buildContextBudgetPlan({
       provider,
@@ -564,7 +616,10 @@ export async function* runQuery(
           messagesRemoved: snipped.messagesRemoved,
           tokensFreed: snipped.tokensFreed,
         };
-        requestTransientContext = transientFor(activeTools);
+        requestTransientContext = [
+          transientFor(activeTools),
+          deliveryCorrectionAttempted && !resultPresented ? DELIVERY_CORRECTION_REMINDER : '',
+        ].filter(Boolean).join('\n\n');
         lastRequestTransientContext = requestTransientContext;
         postCompactBudget = buildContextBudgetPlan({
           provider,
@@ -775,6 +830,18 @@ export async function* runQuery(
 
     // 4. 没有工具调用 → 整轮交互结束
     if (toolCallsByIndex.length === 0) {
+      // A model occasionally writes a path/link in prose and stops without formally
+      // presenting it. Give it one model-only corrective pass; the reminder is
+      // transient and therefore never pollutes persisted conversation history.
+      if (
+        formalDeliveryRequired
+        && !resultPresented
+        && !deliveryCorrectionAttempted
+        && turn < maxTurns
+      ) {
+        deliveryCorrectionAttempted = true;
+        continue;
+      }
       // R2：最终回答被 provider 因 max_tokens 截断（finish_reason='length'）时，
       // 不能静默当正常 end_turn 收尾 —— 否则 -p 宿主会拿到半截答案却以为成功。
       // 走通用 warning（text/json 都落 stderr，不污染 json 那一行 stdout 契约）。
@@ -817,7 +884,7 @@ export async function* runQuery(
           : {}),
         promptCacheUsage: lastPromptCacheUsage,
       };
-      if (explicitFileDeliveryRequested && !resultPresented) {
+      if (formalDeliveryRequired && !resultPresented) {
         const warning = '交付未完成：用户明确要求提供文件，但本轮没有成功提交可打开的文件结果。';
         yield { type: 'warning', message: warning };
         yield { type: 'turn_done', completionStatus: 'delivery_incomplete', warning };
@@ -860,6 +927,18 @@ export async function* runQuery(
       reportProgress?: (message: string, detail?: import('./types.js').ToolProgressDetail) => void,
     ): Promise<WorkerOutcome> => {
       try {
+        if (stallGuard.shouldReject(tc)) {
+          return {
+            tc,
+            result: {
+              ok: false as const,
+              error:
+                '检测到同一工具和参数已连续两次返回相同失败；第三次调用已在执行前拒绝，请改变输入或改用其他路径。',
+              recovery: 'change-input',
+              sensitivity: 'public',
+            },
+          };
+        }
         // The model-visible catalog and the execution boundary are the same set.
         // A provider may still emit a stale or fabricated tool call; return a
         // recoverable result so the model can choose an available path.
@@ -887,7 +966,7 @@ export async function* runQuery(
             const gateDetails = getToolGateDetails(
               tc.function.name,
               tc.function.arguments,
-              { ...toolCallContext, toolCallId: tc.id, reportProgress },
+              { ...toolCallContext, cwd: sessionState?.activeWorktree?.path ?? toolCallContext.cwd, toolCallId: tc.id, reportProgress },
             );
             decision = await effectiveToolGate(
               {
@@ -909,12 +988,33 @@ export async function* runQuery(
         options.onToolStart?.(tc.function.name, tc.id);
         // 浅拷贝填入本次调用的 toolCallId：进度按调用实例路由（并行同名工具不串扰）。
         // advisorCalls/agentCalls 是共享对象引用，计数仍全轮共享，不受拷贝影响。
-        const result = await executeToolFn(
+        let result = await executeToolFn(
           tc.function.name,
           tc.function.arguments,
           signal,
-          { ...toolCallContext, toolCallId: tc.id, reportProgress },
+          { ...toolCallContext, cwd: sessionState?.activeWorktree?.path ?? toolCallContext.cwd, toolCallId: tc.id, reportProgress },
         );
+        if (
+          tc.function.name === 'PresentResult'
+          && result.ok
+          && result.metadata?.kind === 'result_manifest'
+          && options.commitFormalDelivery
+        ) {
+          try {
+            await options.commitFormalDelivery({
+              toolCallId: tc.id,
+              turnId: userMessage.id ?? options.userMessageId ?? 'turn:unknown',
+              manifest: result.metadata.manifest,
+            });
+          } catch (error) {
+            result = {
+              ok: false,
+              error: `正式交付未能可靠保存：${(error as Error).message}`,
+              recovery: 'retry',
+              sensitivity: 'local',
+            };
+          }
+        }
         options.onToolEnd?.(tc.id, false);
         return { tc, result };
       } catch (e) {
@@ -1065,13 +1165,22 @@ export async function* runQuery(
     // If the third identical observation is also the configured final turn, retain the
     // established max_turns termination contract. The stall guard is valuable only when
     // it can stop a failing path before the caller's explicit turn budget does.
-    const stall = turn + 1 < maxTurns
-      ? stallGuard.observe(
+    const preemptedRepeatedFailure = settled.some(
+      ({ result }) =>
+        !result.ok && result.error.includes('第三次调用已在执行前拒绝'),
+    );
+    const stall = preemptedRepeatedFailure
+      ? ({
+          stalled: true as const,
+          reason: 'repeated_failure' as const,
+        })
+      : turn + 1 < maxTurns
+        ? stallGuard.observe(
         settled.map((item) => item.tc),
         settled.map((item) => item.result),
         assistantText,
-      )
-      : { stalled: false as const };
+          )
+        : { stalled: false as const };
     if (stall.stalled) {
       const message = stall.reason === 'repeated_failure'
         ? '检测到同一工具以相同参数连续返回相同失败，已停止重复重试。'

package/src/main.js

@@ -4,6 +4,7 @@ import { render } from 'ink';
 import { existsSync, mkdirSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { resolve } from 'node:path';
+import { installTerminalCapture } from './tools/terminal/terminalCapture.js';
 const require = createRequire(import.meta.url);
 const pkg = (() => {
     if (typeof __GREEN_BUILD_VERSION__ === 'string') {
@@ -193,8 +194,14 @@ async function main() {
     // TUI 交互模式：优先读 JSON 配置（home → exe 同级），没有再用 env 兜底；
     // 都没有则 Root 渲染首次配置菜单。
     const initialProvider = await loadProviderLayered();
+    const uninstallTerminalCapture = installTerminalCapture();
     const { waitUntilExit } = render(_jsx(Root, { initialProvider: initialProvider }));
-    await waitUntilExit();
+    try {
+        await waitUntilExit();
+    }
+    finally {
+        uninstallTerminalCapture();
+    }
 }
 /**
  * 启动时构造 history：用当前 cwd / 工具的最新 system prompt，

package/src/main.tsx

@@ -27,6 +27,7 @@ import { render } from 'ink';
 import { existsSync, mkdirSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { resolve } from 'node:path';
+import { installTerminalCapture } from './tools/terminal/terminalCapture.js';
 
 const require = createRequire(import.meta.url);
 
@@ -243,8 +244,13 @@ async function main(): Promise<void> {
   // TUI 交互模式：优先读 JSON 配置（home → exe 同级），没有再用 env 兜底；
   // 都没有则 Root 渲染首次配置菜单。
   const initialProvider = await loadProviderLayered();
+  const uninstallTerminalCapture = installTerminalCapture();
   const { waitUntilExit } = render(<Root initialProvider={initialProvider} />);
-  await waitUntilExit();
+  try {
+    await waitUntilExit();
+  } finally {
+    uninstallTerminalCapture();
+  }
 }
 
 /**

package/src/memory/constants.js

@@ -18,7 +18,17 @@ export const DEFAULT_REVIEW_WINDOWS = {
     project: 90,
     decision: 180,
 };
+/** 会话原文默认保留 90 天 / 单工作区 500MB，两者取先到者。 */
+export const DEFAULT_RETENTION = {
+    episodeDays: 90,
+    episodeMaxMegabytes: 500,
+};
+export const MEMORY_RETENTION_DAYS_MIN = 1;
+export const MEMORY_RETENTION_DAYS_MAX = 3_650;
+export const MEMORY_RETENTION_MB_MIN = 16;
+export const MEMORY_RETENTION_MB_MAX = 20_480;
 export const DEFAULT_SETTINGS = {
     autoRemember: true,
     reviewAfterDays: DEFAULT_REVIEW_WINDOWS,
+    retention: DEFAULT_RETENTION,
 };

package/src/memory/constants.ts

@@ -1,5 +1,6 @@
 import type {
   MemoryCategory,
+  MemoryRetention,
   MemoryReviewWindows,
   MemorySettings,
 } from './types.js';
@@ -31,7 +32,19 @@ export const DEFAULT_REVIEW_WINDOWS: MemoryReviewWindows = {
   decision: 180,
 };
 
+/** 会话原文默认保留 90 天 / 单工作区 500MB，两者取先到者。 */
+export const DEFAULT_RETENTION: MemoryRetention = {
+  episodeDays: 90,
+  episodeMaxMegabytes: 500,
+};
+
+export const MEMORY_RETENTION_DAYS_MIN = 1;
+export const MEMORY_RETENTION_DAYS_MAX = 3_650;
+export const MEMORY_RETENTION_MB_MIN = 16;
+export const MEMORY_RETENTION_MB_MAX = 20_480;
+
 export const DEFAULT_SETTINGS: MemorySettings = {
   autoRemember: true,
   reviewAfterDays: DEFAULT_REVIEW_WINDOWS,
+  retention: DEFAULT_RETENTION,
 };