thincoder 0.12.11 → 0.12.13

package/src/agent.mjs

@@ -13,7 +13,6 @@ import { executeToolCalls } from "./agent/dispatch.mjs"
 import { prepareRun } from "./agent/setup.mjs"
 import { injectPostTurn, STALL_WINDOW_SIZE, STALL_THRESHOLD, GOAL_BUDGET_WARN_RATIO } from "./agent/post-turn.mjs"
 import { handleCompletion } from "./agent/completion.mjs"
-import { isDocFile } from "./advisor/repos.mjs"
 import {
   escapeXml, tryCanonicalize, repairHistory, listWorkDir,
   readonlyToolNames, collectGitContext, loadProjectInstructions,
@@ -56,23 +55,8 @@ export const ENG_ON_REMINDER =
   "subagents only. Advisor calls are NOT per-turn-mandatory — call only at " +
   "flow nodes or when the user asks.]"
 
-/**
- * True when this run mutated at least one CODE file. Doc-only changes
- * (docs/, *.md, LICENSE…) must NOT trigger the advisor/verify guards — the
- * design phase edits docs/ and must not be pushed to a code review.
- * Mutations without a known path (tools outside FILE_MUTATORS) are treated as
- * code — cannot tell, so guard conservatively.
- * Product-code semantics match isProductCode: anything under src/ (incl.
- * src/prompts/*.md) is code; anything else that isn't a doc file is code.
- * NOTE: _touchedFiles stores ABSOLUTE paths (join(cwd, p)), so the src/ check
- * matches a path component (works for "src/..." and "D:\...\src\..." alike),
- * not a bare ^src prefix — the literal ^src[\\/] form would be dead code here.
- */
-export function hasCodeMutations(agent) {
-  const files = agent._touchedFiles ?? []
-  if (files.length === 0) return agent._mutatedThisRun
-  return files.some((p) => /(?:^|[\\/])src[\\/]/.test(p) || !isDocFile(p))
-}
+// Re-exported for API compatibility (single source of truth: advisor/repos.mjs)
+export { hasCodeMutations } from "./advisor/repos.mjs"
 
 /** Engineering-mode status injection — one reminder when engineering mode is ON. */
 function injectEngineeringReminder(agent) {
@@ -101,6 +85,7 @@ export function createAgent({
     _engDesignReviewed: false, // eng-coder: design review gate passed (hard gate in dispatch.mjs)
     _engDesignToken: null, // issued by advisor(type="design"); required to spawn eng-coder
     _touchedFiles: [], _verifyRetries: 0, _advisorRound: 0, _advisorSession: null,
+    _lastAdvisorOutput: null, // full review output from the most recent advisor call (convergence rounds inject it verbatim)
     _lastEngState: false,
     _pendingReminders: [],
     _pendingTimers: [],
@@ -165,7 +150,7 @@ export async function runAgent(agent, input, callbacks = {}, { depth = 0, signal
     const lastRole = agent.history.at(-1)?.role
     if (lastRole === "user" || lastRole === "tool") {
       try {
-        if (await compressIfNeeded(agent, threshold, callbacks, compactionOverhead)) {
+        if (await compressIfNeeded(agent, threshold, callbacks, compactionOverhead, signal)) {
           agent._compressFailures = 0
           agent._planReminderAtLen = 0 // After compression history shrinks, reset cadence so reminders resume
           recentCallSigs.length = 0 // After compression history is rebuilt, reset stall detection counter
@@ -220,8 +205,8 @@ export async function runAgent(agent, input, callbacks = {}, { depth = 0, signal
       await classifyAndApply(agent, turn).catch(() => {})
     }
 
-    try {
-      response = await chat(agent.provider, {
+    if (process.env.ADVISOR_DEBUG) console.error("[chat-call]", JSON.stringify({ turn, histLen: agent.history.length, lastRole: agent.history.at(-1)?.role }))
+    try {      response = await chat(agent.provider, {
         messages, tools: toolSchemas,
         onToken: callbacks.onToken,
         onReasoning: callbacks.onReasoning,
@@ -389,13 +374,21 @@ export async function runAgent(agent, input, callbacks = {}, { depth = 0, signal
       pushReal(agent, { role: "tool", tool_call_id: toolCall.id, content: result })
       if (tool && ok) {
         if (FILE_MUTATORS.has(toolCall.name)) {
-          // Direct file edit — code was changed.
+          // Direct file edit — code was changed. The prior advisor review and
+          // verify are stale: a review that ran before the edit no longer
+          // covers the current file state.
           agent._mutatedThisRun = true
-        }
-        if (!tool.readonly && !tool.sideEffectExempt) {
-          // Any side-effect tool (bash, git, etc.) invalidates prior review/verify.
-          // Code may not have changed, but the environment did.
-          if (agent._calledAdvisorThisRun) agent._calledAdvisorThisRun = false
+          agent._calledAdvisorThisRun = false
+          agent._verifiedThisRun = false
+          agent._verifyPassed = undefined
+        } else if (!tool.readonly && !tool.sideEffectExempt) {
+          // Non-mutating side-effect tools (bash, git): do NOT invalidate the
+          // advisor review — a review is triggered by CODE MUTATIONS only
+          // (user decision 2026-08-08: the guard rule is "review after code
+          // changes", not "review after any environment change"; bash is
+          // barred from writing files, so it cannot change the reviewed code).
+          // Verify IS invalidated: its state snapshot (git diff, file list)
+          // may be stale after git/shell operations.
           if (agent._verifiedThisRun) {
             agent._verifiedThisRun = false
             agent._verifyPassed = undefined
@@ -404,18 +397,18 @@ export async function runAgent(agent, input, callbacks = {}, { depth = 0, signal
         if (toolCall.name === "verify") agent._verifiedThisRun = true
         if (toolCall.name === "advisor") {
           agent._calledAdvisorThisRun = true
-          // Design reviews are a separate gate with no convergence protocol —
-          // they must not consume code-review rounds (MAX_ADVISOR_ROUNDS budget).
+          // All advisor calls (code and design) share the 5-round convergence
+          // budget — each advances _advisorRound toward MAX_ADVISOR_ROUNDS.
           // Always advance the round — the convergence protocol cares about
           // how many reviews have run (round 1→2→3→4→5), not how many succeeded.
           // A failed/interrupted review is still a review attempt and should use
           // the next round's prompt on retry.
           try {
-            const advArgs = JSON.parse(toolCall.arguments || "{}")
-            if (advArgs.type !== "design") agent._advisorRound++
+            JSON.parse(toolCall.arguments || "{}")
           } catch {
-            agent._advisorRound++
+            /* arguments unparseable — still counts as a review attempt */
           }
+          agent._advisorRound++
         }
         if (FILE_MUTATORS.has(toolCall.name)) {
           const args = JSON.parse(toolCall.arguments)

package/src/config.mjs

@@ -139,9 +139,12 @@ const COMPACT_RATIO = 0.6
 
 /** Look up spec by model name prefix (case-insensitive), conservative default for unknown models */
 const warnedModels = new Set() // warn once per model name — specForModel is a hot path (every request)
+// Pre-sorted once at module scope — specForModel runs on every request (agent, provider core,
+// context, auto-think, TUI rendering); re-sorting per call was wasteful.
+const SORTED_SPECS = [...MODEL_SPECS].sort((a, b) => b[0].length - a[0].length)
 export function specForModel(model) {
   const m = (model ?? "").toLowerCase()
-  for (const [prefix, spec] of [...MODEL_SPECS].sort((a,b) => b[0].length - a[0].length)) {
+  for (const [prefix, spec] of SORTED_SPECS) {
     if (m.startsWith(prefix.toLowerCase())) return spec
   }
   // Unknown model: warn ONCE (not per request) so a typo'd ID or a missing alias surfaces
@@ -189,6 +192,8 @@ export function normalizeProxy(proxy) {
  * Load configuration.
  * Env var priority: THINCODER_ACTIVE_PROVIDER > config file activeProvider
  * THINCODER_API_KEY / THINCODER_BASE_URL / THINCODER_MODEL override the current active provider's corresponding fields
+ * THINCODER_ACTIVE_MODEL overrides the active model (wins over THINCODER_MODEL — see loadConfig)
+ * Provider-specific key fallbacks (when providers[] lacks a key): DEEPSEEK_API_KEY / OPENAI_API_KEY
  */
 export function loadConfig() {
   let config = {}
@@ -203,7 +208,7 @@ export function loadConfig() {
   const merged = {
     ...DEFAULTS,
     ...config,
-    providers: config.providers?.length ? config.providers : DEFAULTS.providers,
+    providers: Array.isArray(config.providers) && config.providers.length ? config.providers.map((p) => ({ ...p })) : DEFAULTS.providers.map((p) => ({ ...p })),
     activeProvider: config.activeProvider ?? DEFAULTS.activeProvider,
     agent: { ...DEFAULTS.agent, ...config.agent },
     memory: { ...DEFAULTS.memory, ...config.memory },
@@ -247,6 +252,8 @@ export function loadConfig() {
 
   // apiKey also falls back to env vars (when providers doesn't include a key)
   // Provider-specific env vars only apply to the matching provider name, preventing keys from leaking to wrong endpoints
+  // NOTE: only deepseek/openai have provider-specific fallbacks by design — the other presets
+  // intentionally rely on THINCODER_API_KEY or keys stored in config.json (no silent env pickup).
   if (!runtimeProvider.apiKey?.trim()) {
     const envMap = { deepseek: "DEEPSEEK_API_KEY", openai: "OPENAI_API_KEY" }
     const keyVar = envMap[merged.activeProvider]
@@ -278,9 +285,10 @@ export function loadConfig() {
  */
 export function saveConfig(config) {
   mkdirSync(configDir, { recursive: true })
-  // Inject $schema for editor autocompletion/validation (strip on load)
-  config.$schema = "https://thincoder.dev/schemas/config.json"
+  // Inject $schema for editor autocompletion/validation (strip on load) — write a copy,
+  // never mutate the caller's object.
+  const out = { ...config, $schema: "https://thincoder.dev/schemas/config.json" }
   // 0600: config.json contains API keys, must not be world-readable (POSIX; chmod is best-effort on Windows)
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", { encoding: "utf8", mode: 0o600 })
+  writeFileSync(configPath, JSON.stringify(out, null, 2) + "\n", { encoding: "utf8", mode: 0o600 })
   try { chmodSync(configPath, 0o600) } catch { /* may fail on Windows, ignore */ }
 }

package/src/context.mjs

@@ -2,7 +2,11 @@
  * context.mjs — Context management and compaction
  * When no measured token count is available, use estimation as fallback (ASCII/4 + non-ASCII/1, no tokenizer dependency).
  * When a measured value exists (response usage.prompt_tokens), trust it — estimation underestimates CJK by 3-4x and relying solely on it may never trigger compaction.
- * Compaction strategy: keep earliest 2 + latest N messages, summarize the middle into one via LLM (inspired by kimi-code, simplified).
+ * Compaction strategy: summarize everything before the tail into one LLM note, keep the latest N messages verbatim.
+ * NOTE: no dedicated head is kept (KEEP_HEAD = 0) — in multi-task sessions the earliest messages are
+ * typically a COMPLETED earlier task; preserving them verbatim anchored the model's attention on stale
+ * work after compaction. The earliest messages now go into the summary (which distinguishes completed
+ * vs in-progress work), so the post-compaction context anchors on the current task (recent tail) only.
  */
 
 import { chat } from "./provider/index.mjs"
@@ -30,11 +34,16 @@ export function estimateTokens(messages) {
   return tokens
 }
 
-const KEEP_HEAD = 2 // Keep the earliest user intent — must not lose it
+const KEEP_HEAD = 0 // No dedicated head: earliest messages may be a COMPLETED earlier task in multi-task
+// sessions — keeping them verbatim anchored attention on stale work. Everything before the tail is
+// summarized (the summary itself distinguishes completed vs in-progress work; see SUMMARIZE_PROMPT).
 // Tail size scales with the model context window (~30 messages per 100K tokens),
 // capped at 40% of history so small histories don't over-reserve. Window-adaptive
 // replaces the old fixed 10: on a 1M window, 10 messages is too thin for recent work.
 function keepTailSize(provider, historyLen) {
+  // provider is guaranteed at every call site (runAgent always builds one); specForModel
+  // degrades to DEFAULT_SPEC (128K) only if provider/model is somehow absent — acceptable
+  // because the 40% history cap still bounds the tail.
   const ctxWindow = specForModel(provider?.model ?? "").context
   return Math.min(Math.max(10, Math.floor((ctxWindow / 100_000) * 30)), Math.floor(historyLen * 0.4))
 }
@@ -43,7 +52,9 @@ const SUMMARIZE_PROMPT = `You are a conversation compressor. Summarize the follo
 Requirements:
 - Write in first person, present tense — these are "my" handover notes, continuing my own train of thought
 - Most important: preserve design decisions and their reasons — architecture choices, API contracts, naming conventions, trade-off rationale. These are the anchors the subsequent code must not deviate from
-- Keep: the user's original request, files modified and why, unresolved issues, next steps
+- Distinguish COMPLETED vs IN-PROGRESS work: completed tasks get a ONE-LINE recap each (what was done, key outcome); spend the detail budget on unresolved issues, next steps, and the CURRENT task
+- The user's most recent request defines the current task — anchor on it. Earlier requests are likely already completed and only need the one-line recap; do NOT preserve them at full fidelity
+- Keep: files modified and why, unresolved issues, next steps
 - Drop: pleasantries, repetition, fine-grained tool output details
 - Honestly mark uncertain items: anything not actually verified must say "unverified"; do not present guesses as facts
 - Use bullet-point output; aim for information completeness, not a hard word limit (old 500-char cap is deprecated; in a 1M-context era, err on the long side)
@@ -71,8 +82,8 @@ const FALLBACK_NOTE =
 
 /**
  * Split history into head / middle (to be summarized) / tail; return null if no middle to compress.
- * The head boundary must avoid orphan tool_calls: when an assistant message has tool_calls, all its tool responses must stay in head,
- * otherwise compressing them to plain text violates the protocol (tool_calls must be followed by tool messages).
+ * head is normally empty (KEEP_HEAD = 0 — earliest messages go into the summary); the
+ * tool_calls-extension logic below is defensive for future KEEP_HEAD > 0.
  * The tail boundary must include any assistant whose tool results are in the tail — if the assistant is in the middle,
  * the summary swallows it, leaving orphan tool results → protocol 400.
  */
@@ -101,7 +112,10 @@ function splitHistory(history, keepTail) {
   }
 
   // skip orphan tool messages at the new tail boundary (tool whose assistant was pulled in above)
-  while (tailStart > headEnd && history[tailStart].role === "tool") {
+  // NOTE: single-assistant assumption — the backwards scan pulls the nearest owner only; in
+  // practice a tail spans at most one assistant→tools cycle (parallel calls share one assistant).
+  // Bounds-guarded so an all-tool tail cannot push tailStart past history.length.
+  while (tailStart < history.length && tailStart > headEnd && history[tailStart].role === "tool") {
     tailStart++
   }
   if (tailStart <= headEnd) return null
@@ -127,6 +141,9 @@ export function pushReal(agent, msg) {
 function applyCompression(agent, headEnd, tailStart, note) {
   // _fullHistory already holds every real message (written at the source via pushReal),
   // so compaction only shrinks the machine line — nothing to preserve here.
+  // head is normally empty (KEEP_HEAD = 0) — the summary note becomes the first message,
+  // which is exactly the intent: post-compaction context anchors on the current task, not on
+  // possibly-completed earlier requests.
   const head = agent.history.slice(0, headEnd)
   const tail = agent.history.slice(tailStart)
   agent.history = [
@@ -173,7 +190,7 @@ function applyCompression(agent, headEnd, tailStart, note) {
  * @param {object} extras - { systemPrompt?, tools? } — estimated overhead for the pure-estimation
  *   path (no measured baseline); the measured path already includes system+tools in prompt_tokens.
  */
-export async function compressIfNeeded(agent, threshold, callbacks, extras = {}) {
+export async function compressIfNeeded(agent, threshold, callbacks, extras = {}, signal) {
   const history = agent.history
   // Prefer the real baseline: the last response's prompt_tokens is the measured value for the full context (system+tools+history).
   // Subsequent appended messages use estimation as increment; when no measured value exists (first turn / after restore / right after compaction), fall back to pure estimation
@@ -200,15 +217,21 @@ export async function compressIfNeeded(agent, threshold, callbacks, extras = {})
       const toolNote = m.tool_calls ? ` [called tools: ${m.tool_calls.map((t) => t.function.name).join(", ")}]` : ""
       // user messages get a wider cap (8000): cutting off a long user-pasted requirement loses original intent; tool/assistant capped at 2000 is enough
       const cap = m.role === "user" ? 8000 : 2000
-      const content = typeof m.content === "string" ? m.content.slice(0, cap) : ""
-      return `[${m.role}]${toolNote} ${content}`
+      // Multimodal messages (array content): extract the TEXT parts — the image itself can't be
+      // summarized, but any accompanying text (e.g. "看这张图" + image) must not be silently lost
+      let text = ""
+      if (typeof m.content === "string") text = m.content
+      else if (Array.isArray(m.content)) text = m.content.filter((p) => p?.type === "text").map((p) => p.text ?? "").join(" ")
+      return `[${m.role}]${toolNote} ${text.slice(0, cap)}`
     })
     .join("\n")
 
   // The summary is a plain-text task, no reasoning needed — passing thinking to the compaction provider wastes tokens.
   // Silent by design (D11): no onToken/onReasoning — the compaction process must not stream to the frontend.
+  // signal propagates user cancellation (Ctrl+C) to the in-flight summary call.
   const summary = await chat({ ...agent.provider, thinking: null, reasoningEffort: null }, {
     messages: [{ role: "user", content: SUMMARIZE_PROMPT + serialized }],
+    signal,
   })
 
   applyCompression(agent, split.headEnd, split.tailStart, COMPACTION_PREFIX + summary.content)

package/src/prompts/advisor-round1.md

@@ -5,7 +5,7 @@ You have a budget of 30 tool rounds (chat turns) — plan your exploration accor
 
 Review workflow:
 1. The files to review are listed in the review scope. Read them in full. The review scope defines exactly which files to inspect.
-2. Read AGENTS.md / design docs once if present, to understand project conventions, version requirements, and architecture decisions.
+2. **READ THE PROJECT GUIDE FIRST** — the `## Project Guide (AGENTS.md)` section in the review context maps the project's structure and tells you where its requirements/design documents live. Read the requirements documents it points to (whatever the guide names — no fixed file names are assumed). **The user's requirements live in those documents; the conversation background is only a supplement.** If the guide says none exist, judge from the conversation background and say so explicitly if requirements are unclear.
 3. Read the specified files for full context. **Batch independent `read` calls in a SINGLE reply** — do not read files one at a time. Each round-trip counts against your limit.
 4. Use grep or lsp to trace callers, imports, and dependencies — only where genuinely needed.
 5. Produce your review table.
@@ -17,15 +17,21 @@ Budget rules:
 - **Batch everything**: multiple `read` calls in one reply, multiple `grep` calls in one reply. Serializing tool calls wastes your round budget.
 
 Rules:
-- First judge the task from the conversation background: if the changes are clearly non-code (documentation, comments, version bumps, config metadata) and cannot affect runtime behavior, reply immediately with the all-clear phrase — do NOT spend tool calls exploring.
+- First judge the task from the conversation background: if the changes are clearly non-code and cannot affect runtime behavior, reply immediately with the all-clear phrase — `"All clear — no code changes to review."` (the host recognizes it via the "all clear" / "no 🔴" / "review passed" / "no issues found" markers, matched case-insensitively) — do NOT spend tool calls exploring. This applies to static docs, README, and CHANGELOG files. Prompts and configs that shape behaviour are NOT exempt — review them normally.
+- **Requirement fit**: check the implementation against what the user actually asked for — a review is not only about "is the code correct" but also "is this what the user wanted". Two comparisons:
+  - (a) **Claim vs implementation**: the implementer's stated intent (conversation background / response table / commit message) vs what the implementation actually does — claiming X but delivering Y is a gap.
+  - (b) **Expectation vs shape**: the requirements documents named by the Project Guide (AGENTS.md) and explicit user expectations vs the delivered shape — "asked for A, got B" (e.g. "the record must keep the real order" vs a summary appended at the end) is a gap. **The requirements documents are the primary reference — read them (workflow step 2) before judging fit; do not judge against expectations you cannot see.**
+  - **Known limit**: the conversation background only includes the last 3 user–assistant exchanges — older user expectations may not be visible, which is why the requirements documents are the primary reference. (a) is the primary check (needs only recent context); (b) is best-effort — check what the docs/background show, do NOT treat an invisible expectation as a gap.
+  - **Severity**: 🔴 = the user's explicit request was not fulfilled; 🟡 = fulfilled but in a suboptimal or misleading way. Flag gaps by impact and state in the Issue: what the user asked for, what was delivered, and where they diverge. Claims must cite evidence (the user's own words or the implementation lines) — a "requirement gap" without evidence is 🔵 at most.
 - Reply in the same language as the conversation background.
 - Respect the project's stated platform requirements — do not flag features as errors if they are valid under the project's target environment.
 - Output a Markdown table. This table becomes the sole basis for convergence in later rounds — be thorough.
 | # | File | Severity | Issue | Suggestion |
 |---|------|----------|-------|------------|
-| 1 | src/x.mjs | 🔴 | ... | ... |
+| 1 | src/example.mjs | 🔴 | ... | ... |
 - Order by severity: 🔴 Critical · 🟡 Advisory · 🔵 Style.
 - For each issue state: which file, what the problem is, why it is a problem, how to fix it.
 - Cover everything now. Subsequent rounds only check fix status of items in this table — they will NOT find new issues.
 - Stop calling tools once you are ready to produce the review table.
+- **Host verification**: every `file:line: content` reference in your table is mechanically checked against the CURRENT file state by the host — quote exactly what `read` returned; a mismatch marks the finding unverified.
 - **Pass/fail**: if there are NO 🔴 (Critical) issues, the review passes. 🟡 (Advisory) and 🔵 (Style) findings do NOT block approval — list them in the table. If there is ANY 🔴 issue, list it and do not claim the review passed.

package/src/prompts/advisor-round2.md

@@ -1,25 +1,27 @@
-You are a code review advisor.
-Verify the prior issue table (provided in the review context).
+You are an independent review advisor.
+Verify the prior review output (provided in the review context).
 You may note obvious new issues introduced by the fixes.
 You have read-only tools to explore the codebase.
 You have a budget of 30 tool rounds (chat turns). Hard mechanical cap: 100 rounds.
 
 Review workflow:
-1. The affected files are named in the prior issue table — read them in full. The prior issue table is HISTORY from a previous review, not current state.
+1. The prior review output above is the COMPLETE output of the last review — read it and understand every issue it raises. The affected files are named in it — read them in full. The prior review output is HISTORY from a previous review, not current state.
 2. STALE-CONTEXT WARNING: any content from earlier messages is a historical snapshot — treat it as expired. Only fresh `read` results describe the current state.
-3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs unless a fix appears to contradict the task itself.
-4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** An empty `git diff` does NOT mean nothing changed: fixes may already be committed (`git log -3` shows recent commits) — `read` the files named in the prior table regardless of the diff. Batch independent tool calls in one reply.
+3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs unless a prior-review item names them or a fix appears to contradict the task itself.
+4. **ALWAYS verify current file content with `read` before judging an item as fixed or unfixed — never decide based on the prior review output alone.** Fixes may already be committed — `read` the files named there regardless. (Note: you have NO git tool this round; any git output in earlier messages is historical and untrustworthy.) Batch independent tool calls in one reply.
 5. Use grep or lsp to trace callers, imports, and dependencies — only where genuinely needed.
 6. Produce your review table.
 
-Budget: read only the files named in the prior-table items. If at 15 rounds you have not yet verified all items, wrap up.
+Budget: read only the files named in the prior-review items. If at 15 rounds you have not yet verified all items, wrap up.
 
 Rules:
 - Respect the project's stated platform requirements — do not flag features as errors if they are valid under the project's target environment.
-- Primarily check fix status of items in the prior issue table.
+- Primarily check fix status of items in the prior review output.
 - For items marked "fixed": verify they were actually fixed.
 - For items marked "not an issue": evaluate whether the reasoning is sound.
-- Every "Unfixed" or "New" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may come from the stale prior table. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- Every "Unfixed" or "New" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may be fabricated or stale. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- **Host verification**: your `file:line: content` citations are mechanically checked against the CURRENT file state — quote exactly what `read` returned; a mismatch marks the finding unverified.
+- **Fresh context**: this round's conversation contains NO read output from earlier rounds — every file must be re-read this round.
 - You may flag obvious new problems — but only if clearly visible in the reviewed files and would cause crashes, data loss, or logic errors.
 - Do NOT nitpick style or naming.
 - Output a Markdown table listing all remaining problems (old or new):

package/src/prompts/advisor-round3.md

@@ -1,29 +1,29 @@
-You are a code review advisor.
-Strictly verify only the prior issue table (provided in the review context).
-Do NOT look for new issues.
+You are an independent review advisor.
+Strictly verify only the prior review output (provided in the review context).
 You have read-only tools to explore the codebase.
 You have a budget of 30 tool rounds (chat turns). Hard mechanical cap: 100 rounds.
 
 Review workflow:
-1. The affected files are named in the prior issue table — read them in full. The prior issue table is HISTORY from a previous review, not current state.
+1. The prior review output above is the COMPLETE output of the last review — read it and understand every issue it raises. The affected files are named in it — read them in full. The prior review output is HISTORY from a previous review, not current state.
 2. STALE-CONTEXT WARNING: any content from earlier messages is a historical snapshot — treat it as expired. Only fresh `read` results describe the current state.
-3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs.
-4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** An empty `git diff` does NOT mean nothing changed: fixes may already be committed (`git log -3` shows recent commits) — `read` the files named in the prior table regardless of the diff. Batch independent tool calls in one reply.
-5. Verify fix status of each item in the prior issue table.
+3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs unless a prior-review item names them.
+4. **ALWAYS verify current file content with `read` before judging an item as fixed or unfixed — never decide based on the prior review output alone.** Fixes may already be committed — `read` the files named there regardless. (Note: you have NO git tool this round; any git output in earlier messages is historical and untrustworthy.) Batch independent tool calls in one reply.
+5. Use grep or lsp to trace callers, imports, and dependencies — only where genuinely needed.
 6. Produce your review table.
 
-Budget: read only the files named in the prior-table items. If at 15 rounds you have not yet verified all items, wrap up.
+Budget: read only the files named in the prior-review items. If at 15 rounds you have not yet verified all items, wrap up.
 
 Rules:
 - Respect the project's stated platform requirements — do not flag features as errors if they are valid under the project's target environment.
-- Only check fix status of items in the prior issue table.
-- For items marked "fixed": verify they were actually fixed.
-- For items marked "not an issue": evaluate whether the reasoning is sound.
-- Every "Unfixed" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may come from the stale prior table. Findings without a fresh quoted line are treated as unverified and will not be accepted.
-- Output a Markdown table. Only list items that still have problems:
+- Only check fix status of items in the prior review output.
+- Every "Unfixed" or "New" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may be fabricated or stale. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- **Host verification**: your `file:line: content` citations are mechanically checked against the CURRENT file state — quote exactly what `read` returned; a mismatch marks the finding unverified.
+- **Fresh context**: this round's conversation contains NO read output from earlier rounds — every file must be re-read this round.
+- Do NOT look for new issues. This round exists ONLY to verify that the items from the prior review output are resolved.
+- Do NOT nitpick style or naming.
+- Output a Markdown table listing all remaining problems:
 | # | Orig# | File | Severity | Status | Notes |
 |---|-------|------|----------|--------|-------|
 | 1 | 3     | src/x.mjs | 🔴 | Unfixed | ... |
-| 2 | 5     | src/y.mjs | 🟡 | Reasoning invalid | ... |
 - If all 🔴 issues are resolved and remaining items are only 🟡/🔵, the review passes (🟡/🔵 do not block approval). If any 🔴 issue persists, do not claim it passed.
 - Stop calling tools once you are ready to produce the review table.

package/src/prompts/discipline.md

@@ -12,4 +12,4 @@ Debugging strategy:
 - Don't get stuck reading code — write tests, add logs. Trust the runtime over your theories.
 
 Review discipline (standard mode only — engineering mode has its own review timing rules):
-- **Advisor:** call after changing code. Must provide scope: `paths` (files/dirs to review) or `documents` (context). Response table: `| # | Action | Detail |`. Round 2 verifies prior table.
+- **Advisor:** call after changing code. Must provide scope: `paths` (files/dirs to review) or `documents` (context). Response table: `| # | Action | Detail |`. Round 2 verifies the prior issue table + flags obvious new issues; round 3+ strictly verifies only the prior issue table (no new-issue hunting). Max 5 rounds total.

package/src/session.mjs

@@ -282,6 +282,22 @@ export function switchToSlot(cwd, slot) {
   return loadSession(cwd)
 }
 
+/** Delete a slot: remove its file and manifest entry. Deleting the active slot
+ *  resets the manifest active pointer (the next claim re-creates one). */
+export function deleteSlot(cwd, slot) {
+  const n = Number(slot)
+  if (!Number.isInteger(n) || n < 1) return false
+  const m = loadManifest(cwd)
+  if (!m.slots[n]) return false
+  delete m.slots[n]
+  delete m.slotSessions?.[n] // orphan session-id entries bloat the manifest forever
+  try { unlinkSync(slotPath(cwd, n)) } catch { /* missing file is fine */ }
+  if (m.active === n) delete m.active
+  saveManifest(cwd, m)
+  return true
+}
+
+
 // ========== legacy transient prefix cleanup ==========
 
 const LEGACY_TRANSIENT_PREFIXES = [
@@ -297,6 +313,8 @@ function isLegacyTransient(m) {
   )
 }
 
+export { isLegacyTransient }
+
 // ========== core read/write ==========
 
 /** Save agent state and display lines to the active slot file (atomic write) */
@@ -396,6 +414,7 @@ export function applySession(agent, data) {
   // (possibly compacted) machine line. Restore each line from its own source — the machine
   // context keeps its compaction savings across resume. Legacy files without contextHistory
   // fall back to seeding the machine line from the full history (it re-compacts when needed).
+  agent.config ??= {} // ACP test mocks may omit config; be defensive like the ??= below
   const full = Array.isArray(data.history) ? data.history : []
   const machine = Array.isArray(data.contextHistory) ? data.contextHistory : full
   agent._fullHistory = [...full]

package/src/tools/file.mjs

@@ -20,6 +20,19 @@ import { join, relative, dirname } from "node:path";
 const MAX_FILE_READ_BYTES = 10_000_000
 const MAX_IMAGE_BYTES = 15_000_000
 
+// ────────────────────────────────────────
+// Dirty-file tracking (read-before-insert guard)
+// ────────────────────────────────────────
+// insert_after anchors on LINE NUMBERS — the most drift-prone addressing.
+// Every write tool marks the file dirty; insert_after refuses to run on a
+// dirty file until the agent reads it again (fresh line numbers). This turns
+// the "read after edit" discipline into a structural guarantee: a stale
+// after_line can never silently land in the wrong place again.
+const dirtyPaths = new Set()
+export function markDirty(abs) { dirtyPaths.add(abs) }
+export function clearDirty(abs) { dirtyPaths.delete(abs) }
+export function isDirty(abs) { return dirtyPaths.has(abs) }
+
 export const readTool = {
   name: "read",
   description: DESC("read"),
@@ -41,6 +54,8 @@ export const readTool = {
     const st = await stat(abs).catch(() => null)
     if (st && st.size > MAX_FILE_READ_BYTES) throw new Error(`File too large (${Math.round(st.size / 1_000_000)}MB > 10MB limit). Use bash with head/tail or grep for targeted extraction.`)
     const content = normalizeEOL(await readFile(abs, "utf8"))
+    // A read refreshes the agent's view — line numbers are fresh again.
+    clearDirty(abs)
     const lines = content.split("\n")
     const offset = Math.max(1, args.offset ?? 1)
     const limit = Math.min(args.limit ?? MAX_READ_LINES, MAX_READ_LINES)
@@ -129,6 +144,7 @@ export const writeTool = {
     const st = await stat(abs).catch(() => null)
     if (st?.isDirectory()) throw new Error(`Path is a directory: ${args.path}`)
     await writeFile(abs, args.content, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Wrote ${args.content.length} chars to ${args.path}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
@@ -175,6 +191,7 @@ export const editTool = {
       // Functional replacement: avoid $-substitution patterns in new_string (match string / backreference) being expanded
       : content.replace(args.old_string, () => args.new_string)
     await writeFile(abs, updated, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Edited ${args.path}: replaced ${args.replace_all ? occurrences : 1} occurrence(s)${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
@@ -199,6 +216,17 @@ export const insertAfterTool = {
   touchedPaths(args) { return args.path ? [args.path] : [] },
   async execute(args, ctx) {
     const abs = resolveInCwd(ctx, args.path)
+    // Read-before-insert guard: after_line anchors are line numbers, and any
+    // write since the last read made them stale. Refuse instead of silently
+    // inserting at a drifted position (the failure mode that corrupted test
+    // structure repeatedly). after_regex callers get the same gate — a stale
+    // target line is just as wrong, and the rule is simpler to reason about.
+    if (isDirty(abs)) {
+      throw new Error(
+        `${args.path} was modified since your last read — line numbers may be stale.\n` +
+        `Read the file again (read tool) to refresh line numbers, then retry insert_after.`
+      )
+    }
     const text = normalizeEOL(await readFile(abs, "utf8"))
     const lines = text.split("\n")
 
@@ -232,6 +260,7 @@ export const insertAfterTool = {
     lines.splice(targetLine, 0, args.content)
     const updated = lines.join("\n")
     await writeFile(abs, updated, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Inserted after line ${targetLine} in ${args.path}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
@@ -317,6 +346,7 @@ export const hashlineEditTool = {
     lines.splice(pos, target.length, ...newLines)
     const updated = lines.join("\n")
     await writeFile(abs, updated, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Edited ${args.path}: replaced ${target.length} line(s) at L${pos + 1} with ${newLines.length} line(s)${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },

package/src/tools/insert_after.md

@@ -11,3 +11,4 @@ Notes:
 - Use this instead of `edit` when you're adding a new function, import, or block — no need to fabricate surrounding context for exact matching.
 - The inserted content becomes its own line; it's equivalent to `lines.splice(targetLine, 0, content)`.
 - Returns a diff of the change.
+- **Read-before-insert guard**: if the file was modified by any write tool (write/edit/insert_after/hashline_edit/apply_patch/delete) since your last `read`, this tool REFUSES with an error — line numbers may be stale. Read the file again, then retry. This prevents after_line from silently landing at a drifted position.

package/src/tools/patch.mjs

@@ -3,6 +3,7 @@ import {
   autoSyntaxCheck,
   resolveInCwd
 } from "./shared.mjs";
+import { markDirty } from "./file.mjs";
 import { execFileSync } from "node:child_process";
 import { mkdir } from "node:fs/promises";
 import { readFile } from "node:fs/promises";
@@ -150,6 +151,8 @@ export const applyPatchTool = {
       throw renameError
     }
     const summary = planned.map((p) => `  ${p.isNew ? "created " : "modified"} ${p.path}`).join("\n")
+    // Mark every touched file dirty — insert_after must not run on stale line numbers.
+    for (const p of planned) markDirty(p.abs)
     const syntaxChecks = await Promise.all(planned.map(async (p) => {
       const r = await autoSyntaxCheck(p.abs)
       return r ? `${p.path}:${r.replace("Syntax: ", "")}` : ""
@@ -197,6 +200,7 @@ export const deleteTool = {
     }
     if (tracked && !args.force) throw new Error(`"${args.path}" is git-tracked. Set force=true to delete anyway.`)
     await unlink(abs)
+    markDirty(abs)
     return `Deleted ${args.path}`
   },
 }