thincoder 0.12.48 → 0.12.50

package/CHANGELOG.md

@@ -2,8 +2,40 @@
 
 本文件记录 ThinCoder CLI 的发布历史。格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.0.0/)，版本遵循[语义化版本](https://semver.org/lang/zh-CN/)。
 
+## [0.12.50] — 2026-08-29
+
+### Changed
+
+- **engineering 与 advisor.guard 改为会话级（跨端污染修复）**：旧设计里 engineering 只存 config.json 全局（`agent.engineering`），CLI `/eng` 与 VS Code 面板都写它 → 两端互相翻转对方的工程模式（"VS Code 工程模式下模型仍委托 role='coder'"）。现事实源是当前会话槽位文件（`engineering` 字段 + `advisor.guard`），config.json 降为 CLI 兼容/可见性镜像（双写保留：slot 先、config 后，slot 失败不阻断）。改动：`/eng` toggle 双写 slot（`cmd-eng.mjs` persistEngineering）；`/advisor` guard 切换双写 slot（`cmd-advisor.mjs` persistGuard，model/thinking 仍 config-scoped）；`saveSession`/`applySession` 往返 slot 值（无字段旧槽位回退 config，兼容锁定）；启动恢复链 `bin/thincoder.mjs` applySession 时 slot 覆盖 config 播种值。权威文档：`docs/design/ENGINEERING-MODE.md` §5 重写
+- **METHODOLOGY 三缺口修复**（核对工程模式提示词时发现）：① 需求文档三层结构（总目标/功能用户故事/非功能标准）落地进 METHODOLOGY.md 与 methodology-template.md——engineering.md 的 "three layers per METHODOLOGY" 引用此前悬空；② engineering.md 交付评审补测试文档口径（METHODOLOGY 存在时每条用户故事须有测试用例覆盖正常/边界/异常，无覆盖=评审不通过）——与三文档硬流程对齐；③ METHODOLOGY.md 缺失警告点名后果（引用悬空+硬流程失效+恢复路径），不再静默降级
+- **工程模式 UI/交互决策全链路落档**（用户报告"agent 无视讨论过的 UI 设计"）：设计文档要素扩项——涉及界面时必须收录与用户达成的每条 UI/交互决策（布局/流程/控件行为/状态反馈），未定标 open 不静默发明；eng-coder 任务书必须复述这些决策（或指向设计文档具体章节）——子代理零上下文，留在聊天里的决策永远到不了它；`eng-coder.md` 执行侧闭合——缺失的界面决策停下报告，不自行发明。两端 prompts byte-identical；`ENGINEERING-MODE.md` §7 变更记录
+
+### Tests
+
+- 新增 `test/session-eng-advisor.test.mjs`：/eng 双写断言（slot+config）、applySession slot 恢复（true/false/显式 false 压过 config true）、旧槽位无字段回退 config 锁定、saveSession 每 turn 往返、/advisor guard 双写（model 等仍 config-scoped）
+
+## [0.12.49] — 2026-08-29
+
+### Added
+
+- **Qwen enable_thinking 全链路**（CLI + VS Code 0.8.4 双端 parity）：`resolveEnableThinking` 按"模型前缀 qwen*（排除 qwen3-coder*）+ 百炼域名"白名单注入 `enable_thinking`——`thinking === null` 即显式 off（区别于未设置=ON）；`/think off` 真正关闭百炼强制思考（真实端点冒烟验证：off 1.0s 无 reasoning / 档位有思考）；PROVIDER.md §12 权威文档
+
+### Fixed
+
+- **opencode 400 残余排查**：`stripLocalMessageFields` 补齐 provider 载荷净化（Gitee IKBGX4 follow-up，与 VS Code 端 parity 测试互锁）
+
+### Changed
+
+- **subagent 工具描述升级**：角色能力矩阵 + Mode filtering 段（修复 role 参数 description 被运行期覆盖点的死文本）；read_image 多模态模型清单修正（补 GLM-5.3-Flash、移除纯文本 Qwen3.7）
+
 ## [0.12.48] — 2026-08-28
 
+### Fixed
+
+- **opencode/LiteLLM 严校验端点 400 "Extra inputs are not permitted"（Gitee IKBGX4）**：本地标记 `transient` 泄漏进发送载荷——`escapeMessages` 发送前剥离整消息本地字段（新增 `stripLocalMessageFields`），云端不再拒绝 `messages[i].transient`；VS Code 端口同修（provider.mjs 净化链，函数体 parity）
+- **Ctrl+I 注入框粘贴落主输入框（Gitee IKBU3J）**：`insertPastedText` 目标选择缺 `interruptPrompt` 分支——粘贴直接进 `state.input`、Esc 后残留主输入框；补分支（去换行，与按键路径同语义）
+- **/think 交互异常卡死 TUI（Gitee IKBNUI）**：命令 handler 异常（如 config 写盘失败）一路冒泡击穿 submit 主循环→面板卡死回不了输入框；`handleSlash` 包 try/catch，异常转错误行、UI 保持存活
+
 ### Changed
 
 - **系统提示词加两条约束**：①「先定正确再谈实现」——动手前先回答"正确应该是什么"（每个入口/视图/边界），再谈怎么实现，实现规模是"正确"的结果、不是决策标准；②「确认时暴露方案权衡」——确认理解时列出选的做法、为什么它对（绝不是"改动最小"）、考虑过但没选的替代方案。治"最小改动"偷懒病根

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.12.48",
+  "version": "0.12.50",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",

package/src/agent/setup.mjs

@@ -183,12 +183,12 @@ export async function prepareRun(agent, input, callbacks, {
   const subagentRoles = (depth === 0 && agent.config?.agent?.engineering)
     ? {
         enum: ["explore", "plan", "eng-coder"],
-        description: "Sub-agent role: 'explore' (read-only search/analysis), 'plan' (read-only implementation planning), 'eng-coder' (engineering coder — strict methodology, design-driven). 'coder' is disabled in engineering mode.",
+        description: "The sub-agent role — see the tool description for the role capability matrix. Exact spelling required.",
         suffix: " In engineering mode, use role='eng-coder' for implementation (coder is disabled).",
       }
     : {
         enum: ["explore", "plan", "coder"],
-        description: "Sub-agent role: 'explore' (read-only search/analysis), 'plan' (read-only implementation planning), or 'coder' (full implementation). 'eng-coder' is disabled in normal mode.",
+        description: "The sub-agent role — see the tool description for the role capability matrix. Exact spelling required.",
         suffix: "",
       }
   const filteredSubagent = depth === 0 ? {
@@ -252,12 +252,12 @@ export async function prepareRun(agent, input, callbacks, {
         warnings.push(`Engineering template (${agent._role === "eng-coder" ? "engineering-sub.md" : "engineering.md"}) not found — using degraded constraints.`)
       }
       if (engResult.methodologyMissing) {
-        warnings.push("METHODOLOGY.md not found — project-specific rules are absent.")
+        warnings.push("METHODOLOGY.md not found in the project root — no project methodology is loaded, so every 'per METHODOLOGY' reference in the engineering prompt is dangling and the three-document hard flow (requirements / design / test doc) is NOT enforced. Ask the user whether to create METHODOLOGY.md (scaffold available as src/prompts/methodology-template.md) before designing.")
       }
       if (warnings.length > 0) {
         agent.history.push({
           role: "user",
-          content: `[System reminder: ENGINEERING MODE is active but ${warnings.join(" ")} Create METHODOLOGY.md and ensure prompt templates exist for full enforcement, or disable engineering mode (/eng).]`,
+          content: `[System reminder: ENGINEERING MODE is active but ${warnings.join(" ")}]`,
         })
       }
     }

package/src/agent-tools/subagent.mjs

@@ -53,7 +53,13 @@ export const subagentTool = {
   name: "subagent",
   description:
     "Spawn a sub-agent to handle an independent subtask in an isolated context. The sub-agent returns only its final report. Spawn MULTIPLE subagents in the SAME response for parallel work—they run concurrently.\n" +
-    "Use role='explore' for codebase search/analysis (read-only, fast — specify thoroughness in the task: quick / medium / thorough (default medium)), role='plan' for read-only implementation planning (returns a step-by-step plan, never edits), role='coder' for self-contained implementation tasks. Do not give parallel subagents tasks that edit the same files.\n\n" +
+    "Why delegate? A sub-agent runs in its own isolated context — its reads, searches, tool calls and edits never enter your history or pollute your window; only its final report comes back. Delegation keeps your working context lean (you see the whole session, not the child's noise) and the child single-mindedly focused on one task. Parallel children run concurrently, saving wall-clock time. Every coder/eng-coder child carries its own verify + advisor self-review discipline — handed-off work is already verified before you read a word of it.\n\n" +
+    "Available roles (which roles are exposed depends on the active mode — see Mode filtering below):\n" +
+    "- explore — read-only search & analysis. Toolset: the read/search family (grep, read, glob, code_search, doc_search, repo_outline, lsp, tree...). Receives git context auto-injected (branch, recent commits, working-tree state) when the project is a git repo. Its report must list what it searched and what it did NOT find. Fast — specify thoroughness in the task: quick / medium / thorough (default medium).\n" +
+    "- plan — read-only implementation planning. Same read/search toolset; NEVER edits files. Returns a step-by-step plan for the parent to execute.\n" +
+    "- coder — full implementation. The parent's complete read/write/execute toolset plus verify and advisor for self-review. Its final report must include a delivery transparency table with one row per task requirement (Done / Simplified / Not done — no deferred column).\n" +
+    "- eng-coder — engineering-mode coder (available only in engineering mode, replacing coder). Same full toolset as coder plus the design-driven methodology overlay; REQUIRES a valid designToken arg obtained from a passed advisor(type='design') review.\n" +
+    "Mode filtering: normal mode exposes explore/plan/coder; engineering mode exposes explore/plan/eng-coder. The schema enum reflects the active mode.\n\n" +
     "Writing the prompt:\n" +
     "- The sub-agent starts with zero context — it has not seen this conversation. Brief it like a colleague who just walked into the room: state the goal, list what you already know, hand over the specifics.\n" +
     "- Put exact paths and commands in the prompt when you know them. The sub-agent should not search for things you already know.\n" +
@@ -64,7 +70,7 @@ export const subagentTool = {
     properties: {
       task: { type: "string", description: "Self-contained task description for the sub-agent" },
       context: { type: "string", description: "Optional background the sub-agent needs (it cannot see this conversation)" },
-      role: { type: "string", enum: ["explore", "plan", "coder", "eng-coder"], description: "Sub-agent role: 'explore' (read-only search/analysis), 'plan' (read-only implementation planning), 'coder' (full implementation), 'eng-coder' (engineering-mode coder — strict methodology, design-driven). ENUM IS OVERRIDDEN IN setup.mjs PER ENGINEERING MODE." },
+      role: { type: "string", enum: ["explore", "plan", "coder", "eng-coder"], description: "The sub-agent role — see the tool description for the role capability matrix. Exact spelling required." },
       model: { type: "string", description: "Provider/model override for this sub-agent: 'provider:model', a provider name from config, or a model name on the parent's provider. Defaults to the agent.subagentModel config, then the parent's provider. Useful for offloading heavy work to a cheaper model." },
       designToken: { type: "string", description: "Required when role='eng-coder': the token returned by advisor(type='design') after the design review passed. Without a valid token, eng-coder cannot modify files." },
     },

package/src/config.mjs

@@ -187,6 +187,36 @@ export function resolveCompactThreshold(explicit, model) {
   return { value, auto: true }
 }
 
+/**
+ * Bailian (阿里云百炼) host check — enable_thinking is a Bailian-only extension parameter;
+ * sending it to other endpoints (kimi/glm/custom proxies) would pollute the request.
+ */
+export function isBailianHost(baseURL) {
+  return typeof baseURL === "string"
+    && (baseURL.includes("dashscope.aliyuncs.com") || baseURL.includes(".maas.aliyuncs.com"))
+}
+
+/**
+ * Resolve the Bailian `enable_thinking` switch for qwen hybrid-thinking models (PROVIDER.md §12).
+ * qwen3.x on Bailian defaults to thinking ON, so an explicit off must send enable_thinking:false
+ * or the server silently keeps thinking. Whitelist: model name starts with "qwen" (excluding the
+ * non-thinking qwen3-coder line) AND the provider points at a Bailian host.
+ *   provider.thinking === null → false     (explicit off: /think off, panel off — NF1 convention)
+ *   provider.reasoningEffort   → true      (effort tier implies thinking on; rides with reasoning_effort)
+ *   otherwise                  → undefined (field omitted — server default stays, no behavior change)
+ * NOTE: spec carries no model field today — the name comes from provider.model (spec?.model is
+ * a forward-compatible fallback). Keep the body byte-aligned with thincoder-vscode config.mjs
+ * (cross-repo parity test compares them).
+ */
+export function resolveEnableThinking(provider, spec) {
+  const model = (provider?.model ?? spec?.model ?? "").toLowerCase()
+  if (!model.startsWith("qwen") || model.startsWith("qwen3-coder")) return undefined
+  if (!isBailianHost(provider?.baseURL)) return undefined
+  if (provider.thinking === null) return false
+  if (provider.reasoningEffort) return true
+  return undefined
+}
+
 /**
  * Find provider by name in providers[].
  * Throws if name is non-empty but not found — a typo in activeProvider silently falling to the first provider would use the wrong key on the wrong endpoint.

package/src/escape.mjs

@@ -43,7 +43,20 @@ export function escapeMessageContent(message) {
   return message
 }
 
-/** 对整个 messages 数组逐条应用 escapeMessageContent。 */
+/** IKBGX4 (2026-08-28)：剥离仅本地使用的整消息标记字段（transient 等）——发送给 provider 前移除。
+ * 严格 OpenAI 兼容服务端（opencode/LiteLLM 等）会拒绝消息级未知 key
+ * （"Extra inputs are not permitted, field: 'messages[i].transient'"）。 */
+export function stripLocalMessageFields(messages) {
+  return messages.map((m) => {
+    if (m && typeof m === "object" && "transient" in m) {
+      const { transient, ...rest } = m
+      return rest
+    }
+    return m
+  })
+}
+
+/** 对整个 messages 数组逐条应用 escapeMessageContent（先剥离本地字段，再转义）。 */
 export function escapeMessages(messages) {
-  return messages.map(escapeMessageContent)
+  return stripLocalMessageFields(messages).map(escapeMessageContent)
 }

package/src/prompts/eng-coder.md

@@ -14,6 +14,7 @@ The parent agent ran an independent design review (`advisor` with `type="design"
 
 - Work independently. The parent only sees your final report.
 - Follow the design document. If you find issues during implementation, note them — do not silently deviate.
+- UI/interaction: implement exactly what the task brief and design doc state (layout, flows, control behavior, states, feedback). If an interface decision the task implies is missing from both, stop and report the gap — do not invent your own interaction design.
 - Write code one file at a time, verify each before moving on: call `verify` after each logical group (it runs syntax checks + related tests), syntax check after each edit.
 - Do not modify any file not listed in the design.
 - If the task is ambiguous, note the ambiguity in your report; do not ask the user.

package/src/prompts/engineering.md

@@ -35,7 +35,11 @@ subagents only.
      discipline.
 2. **Design.** Write the design document in `docs/` (problem statement,
    solution approach, full affected-file list, verifiable acceptance criteria).
-   Do NOT open any code file for editing before this document exists.
+   When the task involves a user interface, the design document MUST also
+   capture every UI/interaction decision agreed with the user — layout, flows,
+   control behavior, states and feedback — exactly as discussed; parts not yet
+   decided are marked open, never silently invented. Do NOT open any code file
+   for editing before this document exists.
 3. **Remind readiness — never self-initiate review.** Present the design
    summary and say it is ready for review, then WAIT. You do NOT call the
    advisor yourself — the initiation right belongs to the user: you prepare
@@ -59,15 +63,21 @@ subagents only.
 6. **Implement via eng-coder.** Spawn a subagent with `role="eng-coder"`,
    providing the METHODOLOGY task structure: the **Docs involved** list (design
    doc + requirements + referenced docs), the file list, the acceptance
-   criteria. Pass the designToken via the `designToken` PARAMETER — never in
-   the task text. The token is required — eng-coder cannot modify files
-   without it.
+   criteria. When the task has UI, the task text MUST restate the agreed
+   UI/interaction decisions (or point to the exact design-doc sections that
+   hold them) — an eng-coder has NO conversation context, so a decision that
+   lives only in the chat never reaches it. Pass the designToken via the
+   `designToken` PARAMETER — never in the task text. The token is required —
+   eng-coder cannot modify files without it.
 7. **Delivery review — automatic flow node.** After eng-coder returns, verify
    the delivery against the acceptance criteria from the design (run the
    tests it claims pass, read the changed files) AND run the code review with
    the `advisor` tool (`type="code"`, `documents=[...]` = the task's Docs
    involved list). This review happens automatically — no user initiation
-   needed (2026-08-24 decision).
+   needed (2026-08-24 decision). When METHODOLOGY.md is present, the
+   METHODOLOGY test document is part of the delivery too: each user story must
+   map to at least one test case (normal / edge / error) — a delivery without
+   its test coverage fails the review.
 8. **Verify.** Run `verify` — it must pass before you claim the task complete.
 
 ## Work Loop (every user message)
@@ -136,6 +146,11 @@ cannot enumerate. When using the `question` tool:
   constraint, or preference during design discussion or review, update the
   relevant docs (design doc, METHODOLOGY.md, ENGINEERING-MODE.md) right away —
   do not wait to be asked. A decision that isn't in a doc didn't land.
+- **UI/interaction decisions ride the full chain**: every UI/interaction
+  decision agreed with the user MUST land in the design document AND be
+  restated in the eng-coder task (or pointer to its exact design-doc section).
+  "Discussed but not written down" is the most common reason an implementation
+  ignores what the user asked for — the subagent never saw the discussion.
 - Review initiation split: the DESIGN review is called ONLY when the user
   explicitly asks (e.g. "评审吧") — remind them when the design is ready,
   never fire it yourself; each round of findings goes back to the user for

package/src/prompts/methodology-template.md

@@ -8,10 +8,15 @@
 
 Every task follows four steps, no skipping:
 
-1. **Requirements** — Discuss and document what's needed. Use user stories: **As a [role], I want [feature], so that [goal]**. Describe who / what / why — never how. After confirming requirements, create a checklist entry for each one. No checklist entry means the requirement hasn't landed yet.
-2. **Design** — Write a design document covering approach, architecture, and implementation plan. Design is approved before coding starts.
+1. **Requirements** — Discuss and document what's needed, then write the requirements doc organized in **three layers**:
+   - **Overall goal** — one sentence: what problem does this task solve, for whom;
+   - **Functional user stories** — individually acceptable, format: **As a [role], I want [feature], so that [goal]**. Describe who / what / why — never how;
+   - **Non-functional standards** — performance, security, compatibility, usability constraints, each with how it will be measured.
+
+   Requirements are DONE when all three layers are concrete enough to design against (the user confirms, or the answers stop changing the requirement). After confirming, create a checklist entry for each story. No checklist entry means the requirement hasn't landed yet.
+2. **Design** — Write a design document: problem statement, approach and rationale, full affected-file list, and verifiable acceptance criteria (each criterion traces back to a user story). Design is approved before coding starts.
 3. **Implementation** — Write the code.
-4. **Testing** — Verify. Each user story maps to at least one test case covering normal path, edge cases, and error conditions. Describe what to test, what input to give, and what output to expect.
+4. **Testing** — Verify with a test document: each user story maps to at least one test case covering normal path, edge cases, and error conditions. Describe what to test, what input to give, and what output to expect.
 
 These four steps are not "best practice" — they are hard process. Three documents required: **requirements doc**, **design doc**, **test doc**. Skipping to step 3 and writing code first is wrong nine times out of ten.
 

package/src/provider/core.mjs

@@ -4,7 +4,7 @@
  * SSE parsing → provider/sse.mjs
  */
 
-import { specForModel } from "../config.mjs"
+import { specForModel, resolveEnableThinking } from "../config.mjs"
 import { proxyFetch } from "../proxy.mjs"
 import { escapeMessages } from "../escape.mjs"
 import { readSSE } from "./sse.mjs"
@@ -104,6 +104,11 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
     }
     body.reasoning_effort = provider.reasoningEffort
   }
+  // enable_thinking — Bailian hybrid-thinking switch (PROVIDER.md §12): qwen3.x defaults to
+  // thinking ON, so an explicit off must send enable_thinking:false or the server keeps thinking.
+  // NOT gated by isRouter: the whitelist keys on model prefix + Bailian host, not the model-ID slash.
+  const enableThinking = resolveEnableThinking(provider, spec)
+  if (enableThinking !== undefined) body.enable_thinking = enableThinking
   if (tools?.length) body.tools = tools
 
   const estimated = estimateRequestTokens(body)

package/src/session.mjs

@@ -44,6 +44,7 @@ export function sessionPath(cwd) {
 }
 
 function slotPath(cwd, n) { return sessionPath(cwd) + "." + n }
+export { slotPath }
 function manifestPath(cwd) { return sessionPath(cwd) + ".manifest" }
 
 /** Path to the active slot's file */
@@ -417,6 +418,13 @@ export function applySession(agent, data) {
   agent._pendingReminders = data.pendingReminders ?? []
   agent._sessionStart = data.sessionStart ?? null
   agent._engDesignToken = data.engDesignToken ?? null
+  // engineering is session-level (2026-08-29): the slot value is the CLI session's authority
+  // — config.json is only the initial default / cross-end mirror. A legacy slot without the
+  // field keeps whatever config.json seeded (unchanged behavior).
+  if (data.engineering !== undefined) {
+    agent.config.agent ??= {}
+    agent.config.agent.engineering = data.engineering === true
+  }
   if (data.advisor) {
     agent.config.advisor = { ...data.advisor }
   }

package/src/tui/clipboard.mjs

@@ -84,6 +84,12 @@ export function insertPastedText(state, rawText) {
     q.answer = (q.answer ?? "") + rawText.replace(/[\r\n]+/g, "")
     return
   }
+  // IKBU3J (2026-08-28)：Ctrl+I 注入框激活时，粘贴进注入文本（与按键路径同语义：去换行保单行），
+  // 不得落入主输入框——此前缺失该分支导致粘贴进 state.input、Esc 后残留主输入框。
+  if (state.interruptPrompt) {
+    state.interruptPrompt.text += rawText.replace(/[\r\n]+/g, "")
+    return
+  }
   const text = rawText.replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/\t/g, "  ")
   const chars = [...text]
   state.input.splice(state.cursor, 0, ...chars)

package/src/tui/cmd-advisor.mjs

@@ -1,7 +1,10 @@
 /** /advisor command: configure review model/thinking and toggle the review guard.
  *  Interactive loop UX — stays in menu after each action, Esc to exit.
  *  ctx: { agent, showPicker, pushLine, pushLabel, persistRaw } */
+import { readFileSync } from "node:fs"
 import { ansi, C } from "./ansi.mjs"
+import { activeSlot, slotPath } from "../session.mjs"
+import { writeSessionFile } from "./cmd-eng.mjs"
 
 export async function handleAdvisorCommand(ctx) {
   const { agent, showPicker, pushLine, pushLabel } = ctx
@@ -19,6 +22,21 @@ export async function handleAdvisorCommand(ctx) {
     }
   }
 
+  // Guard-only dual write (2026-08-29 — advisor.guard is session-level): the guard goes into
+  // the CURRENT session slot first (shared with VS Code), the config.json mirror follows.
+  // Other advisor keys (model/thinking/effort/timeout) stay config-scoped — persist() only.
+  const persistGuard = async () => {
+    try {
+      const p = slotPath(agent.cwd, activeSlot(agent.cwd))
+      const data = JSON.parse(readFileSync(p, "utf8"))
+      if (data && typeof data === "object" && Array.isArray(data.history)) {
+        data.advisor = { ...(typeof data.advisor === "object" && data.advisor !== null ? data.advisor : {}), guard: cfg.guard === true }
+        writeSessionFile(p, data)
+      }
+    } catch { /* slot missing/unreadable — config mirror still written */ }
+    await persist()
+  }
+
   // Lazy model cache — fetched once per /advisor session
   let modelCache = null
 
@@ -133,9 +151,9 @@ export async function handleAdvisorCommand(ctx) {
 
     if (choice.action === "guard") {
       cfg.guard = !(cfg.guard === true)
-      await persist().catch(err => pushLine(`[error] ${err.message}`, C.error))
+      await persistGuard().catch(err => pushLine(`[error] ${err.message}`, C.error))
       pushLabel("❯ Advisor", ansi.bold + C.tool)
-      pushLine(`Advisor: ${cfg.guard === true ? "on" : "off"}`, C.tool)
+      pushLine(`Advisor: ${cfg.guard === true ? "on" : "off"} (session)`, C.tool)
       continue
     }
 

package/src/tui/cmd-eng.mjs

@@ -1,14 +1,29 @@
 /** /eng command: toggle engineering mode.
  *  Requires METHODOLOGY.md in project root. Offers to create one if missing.
  *  ctx: { agent, pushLine, pushLabel, persistRaw, showPicker } */
-import { existsSync, copyFileSync } from "node:fs"
-import { join } from "node:path"
+import { existsSync, copyFileSync, readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync } from "node:fs"
+import { join, dirname } from "node:path"
 import { fileURLToPath } from "node:url"
 import { ansi, C } from "./ansi.mjs"
+import { activeSlot, slotPath } from "../session.mjs"
 
 const templateDir = join(fileURLToPath(import.meta.url), "..", "..", "prompts")
 import { ENG_OFF_REMINDER } from "../agent.mjs"
 
+/** Atomic slot write (same shape as session.mjs writeSessionFile — kept local to avoid a
+ *  private-import; cmd-advisor's guard toggle shares this helper). */
+export function writeSessionFile(p, data) {
+  mkdirSync(dirname(p), { recursive: true })
+  const tmp = `${p}.tmp`
+  writeFileSync(tmp, JSON.stringify(data), "utf8")
+  try {
+    renameSync(tmp, p)
+  } catch {
+    try { unlinkSync(p) } catch {}
+    try { renameSync(tmp, p) } catch { writeFileSync(p, readFileSync(tmp, "utf8"), "utf8") }
+  }
+}
+
 export async function handleEngCommand(ctx) {
   const { agent, pushLine, pushLabel, persistRaw, showPicker } = ctx
   agent.config.agent ??= {}
@@ -40,13 +55,35 @@ export async function handleEngCommand(ctx) {
     agent._pendingReminders = agent._pendingReminders ?? []
     agent._pendingReminders.push(ENG_OFF_REMINDER)
   }
-  await persistRaw((raw) => {
-    raw.agent ??= {}
-    raw.agent.engineering = agent.config.agent.engineering
-  })
+  await persistEngineering(ctx, agent)
   pushLabel("❯ Eng", ansi.bold + C.tool)
-  pushLine(`Engineering mode: ${agent.config.agent.engineering ? "ON" : "OFF"}`, C.tool)
+  pushLine(`Engineering mode: ${agent.config.agent.engineering ? "ON" : "OFF"} (session)`, C.tool)
   if (agent.config.agent.engineering) {
     pushLine(`  → strictly following ${methodologyPath}`, C.dim)
   }
 }
+
+/**
+ * Dual persistence (2026-08-29 — engineering is session-level): write the flipped flag into
+ * the CURRENT session slot first (slot authority — shared with VS Code, per-session), then
+ * the config.json mirror (CLI visibility/compat; no longer the cross-session source of truth).
+ * The in-memory agent.config.agent.engineering (already flipped) stays the live authority for
+ * this process; saveSession also round-trips it on every turn-end write.
+ */
+async function persistEngineering(ctx, agent) {
+  const slot = activeSlot(agent.cwd)
+  try {
+    const p = slotPath(agent.cwd, slot)
+    const data = JSON.parse(readFileSync(p, "utf8"))
+    if (data && typeof data === "object" && Array.isArray(data.history)) {
+      data.engineering = agent.config.agent.engineering
+      writeSessionFile(p, data)
+    }
+  } catch { /* slot missing/unreadable — config mirror still written */ }
+  if (ctx.persistRaw) {
+    await ctx.persistRaw((raw) => {
+      raw.agent ??= {}
+      raw.agent.engineering = agent.config.agent.engineering
+    })
+  }
+}

package/src/tui/cmd-think.mjs

@@ -42,8 +42,10 @@ export async function handleThinkCommand(ctx, args = []) {
   let mainIdx = 0
   for (;;) {
     const autoOn = agent.config?.agent?.autoThink === true
+    // thinking:null 是显式 off 标记（NF1 约定）——不得落入"未设置即 ON"的默认显示（评审 #3）。
+    // 用 !== null 而非 != null：undefined（从未设置）须保持既有 ON 显示（qwen3.x 服务端默认开思考）。
     const thinkingEnabled = cur.thinking?.type === thinkOnValue
-      || (cur.thinking?.type === undefined && !isCustomThink)
+      || (cur.thinking !== null && cur.thinking?.type === undefined && !isCustomThink)
 
     const entries = [
       { type: "header", text: `Auto: ${autoOn ? "ON" : "OFF"} | Thinking: ${thinkingEnabled ? "ON" : "OFF"} | Effort: ${cur.reasoningEffort || "—"}` },
@@ -92,17 +94,29 @@ async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCus
     const cfg = agent.config.agent ??= {}
     cfg.autoThink = !cfg.autoThink
     if (cfg.autoThink) {
+      // 开 auto = 要思考：清显式 off 标记（thinking:null，NF1 约定；交付评审 #1）——残留 null
+      // 会让 auto 每轮写入的 reasoning_effort 与 enable_thinking:false 矛盾同发（F2 违约）。
+      // 仅清 null：thinking-type 模型的 {type:"disabled"} 不在评审 #1 范围，保持既有语义。
+      if (cur.thinking === null) { delete cur.thinking; await syncProviderField("thinking", undefined) }
       delete cur.reasoningEffort
       await syncProviderField("reasoningEffort", undefined)
     }
   } else if (e.action === "effort") {
+    // 选档位 = 要思考：清显式 off 标记（thinking:null，NF1 约定；交付评审 #1）——残留 null 会让
+    // enable_thinking:false 与 reasoning_effort 矛盾同发（F2 违约）。仅清 null（同上注释）。
+    if (cur.thinking === null) { delete cur.thinking; await syncProviderField("thinking", undefined) }
     cur.reasoningEffort = e.level
     await syncProviderField("reasoningEffort", e.level)
   } else {
     const enable = e.action === "on"
     if (isEffortOnly) {
-      if (!enable) delete cur.reasoningEffort
-      else if (!cur.reasoningEffort) cur.reasoningEffort = "high"
+      // Explicit off persists thinking:null (NF1 convention — distinguishable from autoThink's
+      // delete/undefined); "on" deletes the marker so enable_thinking maps from effort again.
+      if (!enable) { cur.thinking = null; delete cur.reasoningEffort }
+      // "on" 默认 effort 取 spec 枚举首值（交付评审 #2）：硬编码 "high" 对 qwen3.8-max
+      // （enum xhigh/medium/low）无效，会被 core.mjs 枚举校验 throw（400 前置）
+      else { delete cur.thinking; if (!cur.reasoningEffort) cur.reasoningEffort = spec.reasoningEffortEnum?.[0] ?? "high" }
+      await syncProviderField("thinking", cur.thinking)
       if (!enable) await syncProviderField("reasoningEffort", undefined)
       else await syncProviderField("reasoningEffort", cur.reasoningEffort)
     } else {

package/src/tui/slash-commands.mjs

@@ -114,7 +114,14 @@ export function createSlashCommands(ctx) {
     const resolved = SLASH_ALIASES[cmd] ?? cmd
     const handler = HANDLERS[resolved]
     if (handler) {
-      await handler(handlerCtx, args)
+      // IKBNUI (2026-08-28)：命令 handler 抛出的异常必须被拦截成错误行，不得击穿 TUI 主循环——
+      // 此前 /think 交互循环里 config 写盘失败会一路冒泡（submit 无 catch）导致面板卡死、回不了输入框。
+      // 调用点（index.mjs submit 路径）统一在 handleSlash 返回后 render，UI 保持存活。
+      try {
+        await handler(handlerCtx, args)
+      } catch (e) {
+        ctx.pushLine(`[error] ${e?.message ?? String(e)}`, C.error)
+      }
       return
     }
     ctx.pushLine(`Unknown command: ${rawCmd} (/help for available commands)`, C.error)