thincoder 0.12.52 → 0.12.54

package/CHANGELOG.md

@@ -1,4 +1,40 @@
+## [0.12.54] — 2026-09-01
+
+### Added
+
+- **Checkpoint 事故恢复闭环（CLI ↔ VS Code 两端）**：git 工具破坏性操作（checkout -- / restore / reset --hard / clean / rebase）前自动快照 + schema 描述含 rewind 恢复指引；`checkpointAction=list` 输出尾部提示行；**commit 后清空该项目 checkpoint**（commit = 安全点；懒兜底覆盖外部 git/IDE commit）；每 cwd 快照上限 100（最旧淘汰）；git 工具补齐 11 个 action（clone/init/rebase/remote/clean/switch/apply/worktree/archive/blame/mv）；`/restore` 改为两级 picker 逐文件恢复；bash guard 保留并对齐（宽匹配 + 全量副本 + rewind 指引，与 VS Code 同构）
+- **TUI 子 agent 运行中面板固定化**：运行中子 agent 活动从会话流内联改为固定底部面板（会话与 todo 之间，不随会话滚动）；完全自适应高度；默认折叠（头部 + tail 3，⏸ = 等待审批）；完成仍冻结进会话流（✓ 头可展开）
+- **TUI 渲染鲁棒性**：wrap-off 硬截断（Ambiguous 宽度字符防软折行污染）；启动/退出序列抽取（tui-lifecycle.mjs）
+
+### Changed
+
+- **跨端会话共享一致性（会诊 4 模型收敛）**：sessionStart 打点（跨端同槽不再 F2 互轮转）；F2 写前磁盘校验（同会话并发追加 → 轮转 .bak 保留）；legacy transient 双端过滤；contextHistory 机读线判定（length>0）；activeModel 双向；cwd 先行校验；newSession 死主清理落盘（deletions）
+- **checkpoint cwdHash 归一化**：`sha1(normalizeCwd(cwd)).slice(0,12)`——CLI/VS Code 快照跨端互通（存量旧路径孤儿化不迁移）
+
+### Fixed
+
+- **hex-escape 毒载荷 400**（deepseek-v4-flash 实测）：发送前统一中和字面 `\\x`/`\\u` 不足位序列（escape.mjs，VS Code 同构）
+
 ## [0.12.52] — 2026-08-31
+## [0.12.53] — 2026-08-31
+
+### Added
+
+- **TUI 展开块内滚动**（2026-08-31 用户需求）：折叠区块 60% 高度封顶保留，正文改为滚动视口——`state._foldScroll` 记每块窗口起点；**滚轮命中块内容行 → 块内 ±3 行**（未命中走会话滚动），▲/▼ 控制行点击翻窗（step=winH 快速跳转）；**穿出语义**：块顶滚上/块底滚下 → 交还会话滚动（会话顶懒加载可达）；锚定补偿：暂停流式跟随期间内容增长按 convLen 增量补偿 scroll（读的位置不漂移）。**滚动读全文、永不截断**
+- **流式跟随尾部**：`state._followTail` 默认 true——输出活动期间渲染前钉底；用户上滚（PgUp/滚轮）暂停跟随，PgDn/滚回底部/新提交消息恢复
+- **工具顺手度**（2026-08-31）：① insert_after 精确判定（本 session 写入记录受影响区，未受影响区直接插入不逼重 read、受影响区拒绝保护栏）；② edit 数组形态 `edits: [{path, old_string, new_string}, ...]` 一次多文件原子替换；③ dispatch 拦截工具执行期间 console.log/console.error 回显给模型（异常路径同样回显）；④ 写入工具返回带上下文窗口（edit/insert_after/hashline_edit 返回写入点 ±3 行带行号——模型自检行号语义，防"行号漂移死循环"）
+
+### Changed
+
+- **懒加载滚动到头自动加载**（2026-08-31 用户约定修复）：恢复会话向上滚动到会话顶部自动加载更早一页（原只挂 PgUp 键=违约）；`HISTORY_PAGE_MESSAGES` 50→20（单页更平顺，vscode parity）
+- **三层渲染缓存**（懒加载卡顿根治）：行级 wrapRowsCached + 段级 _lineSegCache（覆盖普通行/工具块/frozenSubTask/frozenAdvisor）——loadOlder 后 rebuild 111ms→5-8ms 平坦（不随已加载历史增长）
+- **折叠 key 身份化**（会诊三家共识）：`long-${i}`/`fold-${foldCounter++}`/`advisor-done-${i}` 位置键全部改 `_lineId` 派生（loadOlder unshift 后展开态/块内滚动 offset 不串位）
+- **视口数学单源** `convViewport`（渲染+鼠标命中共用）：短会话顶部补 pad 后命中整体偏移的存量 bug 修复（点击折叠头/滚轮落空或错行）
+
+### Fixed
+
+- **块内滚动穿出缺陷**：滚到块顶/块尾后滚轮永远命中该块、穿不出 → 会话顶/懒加载不可达（"经过展开块滚不到顶"）——显式边界判定穿出
+- **懒加载只挂 PgUp 键**（小键盘无 PgUp 用户等于无入口）——滚轮滚到会话顶同样触发
 
 ### Fixed
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.12.52",
+  "version": "0.12.54",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",

package/src/acp.mjs

@@ -19,28 +19,15 @@ import { assembleAgent } from "./cli/make-agent.mjs"
 import { createAcpServer, ACP_ERRORS } from "./acp/transport.mjs"
 import { createAcpSession } from "./acp/session.mjs"
 import { replayHistory } from "./acp/bridge.mjs"
-import { listSlots, applySession, deleteSlot, sessionPath, normalizeCwd, isLegacyTransient } from "./session.mjs"
+import { listSlots, applySession, deleteSlot, normalizeCwd, loadSlotFile, slotOccupancy, loadManifest, saveManifest, getSessionId, newSession } from "./session.mjs"
 import { createCheckpoint, listCheckpoints, rewind, isGitRepo } from "./git/checkpoint.mjs"
 import { createMemory, list as memList, remove as memRemove } from "./memory.mjs"
 
 const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version
 
 /** Load a specific slot file (not the active one) — session/load by id.
- *  Same validation as loadSession: version 1/2, cwd match, legacy-transient
- *  filtering (pre-filtering slot files must not leak machine lines into replay). */
-function loadSlotFile(cwd, slot) {
-  const path = `${sessionPath(cwd)}.${slot}`
-  try {
-    const data = JSON.parse(readFileSync(path, "utf8"))
-    if (data?.version !== 1 && data?.version !== 2) return null
-    if (!Array.isArray(data.history)) return null
-    if (data.cwd && normalizeCwd(data.cwd).toLowerCase() !== normalizeCwd(cwd).toLowerCase()) return null
-    data.history = data.history.filter((m) => !isLegacyTransient(m))
-    return data
-  } catch {
-    return null
-  }
-}
+ *  2026-08-31 会诊 deepseek 🟡：改用 session.mjs 共享 loadSlotFile（校验/保现场/.tmp
+ *  回退与主路径一致）——本地实现此前无 .unreadable/.corrupted 保留。 */
 
 /**
  * Apply a session-level config option to the agent instance (memory only —
@@ -160,6 +147,11 @@ export function buildAcpHandlers({
           const id = String(nextId++)
           const session = await createSession({ id, notify: notifyRef.current, request: requestRef.current, log })
           // `id` is immutable after construction (baked into the callbacks) — never reassign.
+          // 2026-09-01 会诊 kimi/glm 🔴：立即认领独立槽（对齐 cmd-new）——否则首回合保存
+          // 走 _slot ??= activeSlot() → ensureActive 早退分支（slotSessions[active]===
+          // mySessionId 同进程恒真）→ 第二个会话拿到与第一个相同的槽号 → 双写同槽
+          // F2 互旋。getSessionId() 是进程级，_slot 是 agent 级——粒度错配必须在此切断。
+          session.agent._slot = newSession(getCwd())
           sessions.set(id, session)
           return { id, configOptions: [{ configId: "model" }, { configId: "thinking" }, { configId: "mode" }] }
         } catch (e) {
@@ -185,6 +177,7 @@ export function buildAcpHandlers({
       },
 
       "session/cancel": (params) => {
+        if (!authenticated) return { error: ACP_ERRORS.AUTH_REQUIRED } // 2026-08-31 advisor round2 🔵：与其他 handler 一致
         const found = findSession(params)
         if (found.error) return found
         found.session.cancel()
@@ -192,6 +185,7 @@ export function buildAcpHandlers({
       },
 
       "session/close": (params) => {
+        if (!authenticated) return { error: ACP_ERRORS.AUTH_REQUIRED } // 2026-08-31 advisor round2 🔵：与其他 handler 一致
         const found = findSession(params)
         if (!found.error) {
           // Abort any in-flight turn first — the client is gone, the agent must
@@ -233,11 +227,33 @@ export function buildAcpHandlers({
           const id = String(nextId++)
           const session = await createSession({ id, notify: notifyRef.current, request: requestRef.current, log })
           applySession(session.agent, data)
+          // 2026-08-31 advisor round2 🟡：钉 _slot 前查活主——目标槽被另一活进程（CLI/另一
+          // IDE）占用时不得钉回（双方 sessionStart 一致 → F2 永不轮转 → 同槽 last-write-wins
+          // 静默互覆盖）。空闲则认领后钉回；占用则不钉 → 下次保存经 activeSlot 自然 fork
+          // 到新槽（与 switchToSlot 的"占用则 fork"语义对齐）。
+          const occ = slotOccupancy(getCwd(), slot)
+          // 2026-09-01 会诊 kimi/glm 🔴：同进程双会话同槽——slotOccupancy 排除本进程属主后，
+          // 同进程防护完全由 sameProcessPinned 承担：本进程另一 session 已钉该槽即视为占用
+          // （进程级属主无法区分 agent，双方 sessionStart 相同 → F2 永不触发 → 静默互覆盖）。
+          const sameProcessPinned = [...sessions.values()].some((s) => s.agent?._slot === slot)
+          if (!occ.occupied && !sameProcessPinned) {
+            const m = loadManifest(getCwd())
+            m.slotSessions ??= {}
+            m.slotSessions[slot] = getSessionId()
+            saveManifest(getCwd(), m)
+            session.agent._slot = slot
+          } else {
+            // 2026-09-01 advisor 🔴：占用时显式分配全新槽（fork）——原 `_slot = null` 的
+            // fork 会经 saveSession → activeSlot → ensureActive 分支1 早退（slotSessions
+            // [active] === mySessionId 同进程恒真）落回同进程 active 槽 → 两会话写同一槽
+            // 静默互覆盖。newSession 跳过活认领号/现存文件号，必定落到新槽。
+            session.agent._slot = newSession(getCwd())
+          }
           sessions.set(id, session)
           // Replay the human line (role → chunk mapping, design §4.5) so the
           // client renders the restored conversation.
           replayHistory({ sessionId: id, notify: notifyRef.current, history: data.history, log })
-          log(`session ${slot} loaded as session ${id} (${data.history?.length ?? 0} messages replayed)`)
+          log(`session ${slot} loaded as session ${id} (${data.history?.length ?? 0} messages replayed)${occ.occupied || sameProcessPinned ? ` — slot busy, forked to ${session.agent._slot}` : ""}`)
           return { id, cwd: getCwd(), configOptions: [{ configId: "model" }, { configId: "thinking" }, { configId: "mode" }] }
         } catch (e) {
           return { error: { code: ACP_ERRORS.INTERNAL.code, message: `failed to load session ${slot}: ${e.message}` } }
@@ -258,9 +274,25 @@ export function buildAcpHandlers({
           const id = String(nextId++)
           const session = await createSession({ id, notify: notifyRef.current, request: requestRef.current, log })
           applySession(session.agent, data)
+          // 2026-08-31 advisor round2 🟡：同 session/load——活主占用的槽不钉回（防同槽双写，
+          // 下次保存 fork 新槽）；空闲则认领后钉回。
+          const occ = slotOccupancy(getCwd(), slot)
+          // 2026-09-01 会诊 kimi/glm 🔴：同 session/load——同进程其他 session 已钉同槽视为占用 → fork
+          const sameProcessPinned = [...sessions.values()].some((s) => s.agent?._slot === slot)
+          if (!occ.occupied && !sameProcessPinned) {
+            const m = loadManifest(getCwd())
+            m.slotSessions ??= {}
+            m.slotSessions[slot] = getSessionId()
+            saveManifest(getCwd(), m)
+            session.agent._slot = slot
+          } else {
+            // 2026-09-01 advisor 🔴：同 load——显式 newSession fork（_slot=null 的 fork 会
+            // 落回同进程 active 槽 → 两会话写同一槽静默互覆盖）
+            session.agent._slot = newSession(getCwd())
+          }
           sessions.set(id, session)
           // resume: no history replay — the client keeps its own rendering.
-          log(`session ${slot} resumed as session ${id} (no replay)`)
+          log(`session ${slot} resumed as session ${id} (no replay)${occ.occupied || sameProcessPinned ? ` — slot busy, forked to ${session.agent._slot}` : ""}`)
           return { id, cwd: getCwd(), configOptions: [{ configId: "model" }, { configId: "thinking" }, { configId: "mode" }] }
         } catch (e) {
           return { error: { code: ACP_ERRORS.INTERNAL.code, message: `failed to resume session ${slot}: ${e.message}` } }
@@ -278,6 +310,16 @@ export function buildAcpHandlers({
         if (!deleteSlot(getCwd(), slot)) {
           return { error: { ...ACP_ERRORS.INVALID_PARAMS, message: `session ${slot} not found` } }
         }
+        // 2026-08-31 会诊 deepseek 🟡：被删槽的在存会话 _slot 仍钉着 → 下次保存会重建
+        // 文件并重注册（删后复活）。清空其 _slot，下次保存重新认领新槽。
+        // 2026-09-01 advisor round2 🔴：不能清 _slot 等下次保存——saveSession 走
+        // activeSlot → ensureActive 分支1 早退（slotSessions[active] === mySessionId 同
+        // 进程恒真）→ 落回同进程 active 槽（另一在存会话的槽）→ 两会话写同一槽静默
+        // 互覆盖（sessionStart 均 null → F2 永不轮转）。与 load/resume 同型修复：
+        // 立即 newSession 钉全新槽（跳过活认领号/现存文件号）。
+        for (const s of sessions.values()) {
+          if (s.agent?._slot === slot) s.agent._slot = newSession(getCwd())
+        }
         log(`session ${slot} archive deleted`)
         return {}
       },

package/src/advisor/run.mjs

@@ -7,6 +7,7 @@ import { findProvider, specForModel } from "../config.mjs"
 import { toOpenAISchema } from "../tools/index.mjs"
 import { prepareAdvisorMessages } from "../advisor.mjs"
 import { appendCitationReport } from "./citations.mjs"
+import { describeToolArgs } from "../tui/tool-args.mjs"
 
 const MAX_ADVISOR_TURNS = 100
 // Mechanical convergence cap: the protocol assumes up to 5 rounds suffice
@@ -97,16 +98,12 @@ function advisorToolsFor(agent) {
 // Test seam: the tool set is pure (agent.memory → code_search inclusion).
 export { advisorToolsFor as _advisorToolsFor }
 
-/** Compact one-line summary of tool args for panel progress lines.
- *  Picks the most identifying field; falls back to truncated JSON. */
-function summarizeToolArgs(args) {
-  // e.g. "read src/x.mjs", "grep foo src/", "ls docs" — action first when present
-  const parts = [args.action, args.path ?? args.pattern ?? args.command].filter((v) => v != null)
-  let s = parts.length > 0 ? parts.map(String).join(" ") : JSON.stringify(args)
-  s = s.replace(/\s+/g, " ").trim()
-  return s.length > 80 ? s.slice(0, 79) + "…" : s
-}
-
+/**
+ * Tool-call progress line summary delegates to the single source describeToolArgs
+ * (../tui/tool-args.mjs) — the same function main-agent tool blocks and subagent
+ * blocks use. 2026-08-31: replaced the local picker (action/path/pattern/command-only)
+ * so advisor progress lines show the quoted-path forms everywhere else.
+ */
 /**
  * Render the ordered review timeline — thinking / tool progress / final text
  * interleaved EXACTLY as emitted, so the persisted record shows the review
@@ -246,7 +243,8 @@ async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, c
         continue
       }
       
-      onTool(`\n→ ${tc.name} ${summarizeToolArgs(args)}\n`)
+      const argsLine = describeToolArgs(tc.name, args)
+      onTool(`\n→ ${tc.name}${argsLine ? " " + argsLine : ""}\n`)
       let result
       if (!tool) {
         result = `Error: unknown tool "${tc.name}". Available: ${[...toolByName.keys()].join(", ")}`

package/src/agent/dispatch.mjs

@@ -156,6 +156,13 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
             : "Error: no permission handler configured — this tool requires user approval but the current context doesn't support interaction (e.g. subagent or non-TUI mode)"
       return { ...item, result: reason, ok: false }
     }
+    // 2026-08-31 工具顺手度（用户批准"做吧"）：dispatch 拦截工具执行期间的
+    // console.log/console.error——工具的探查/调试输出（原本只到终端、模型看不到）
+    // 收集后附在工具结果后回显给模型。bash 工具的输出走子进程回显（onOutput），
+    // 不走 dispatch console——拦截安全。嵌套 dispatch（subagent）各自拦截/恢复，
+    // 捕获分离（父恢复原始后子的拦截期间父捕获停止、子恢复后父继续）——正确。
+    // 声明在 try 之外：catch 块（异常路径）也要访问（报错前的探查输出回显）。
+    const capturedConsole = []
     try {
       // Snapshot for undo before side-effect tools (setupOutputPanel already fired in Phase 1)
       if (!item.tool?.readonly && item.args) {
@@ -170,26 +177,40 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
           return { ...item, result: routed.result, ok: true }
         }
       }
-      const rawResult = await item.tool.execute(item.args, {
-        cwd: agent.cwd,
-        agent,
-        depth,
-        signal,
-        callbacks,
-        onOutput: (chunk) => callbacks.onToolOutput?.(item.toolCall.name, chunk, item.toolCall.id),
-        onQuestion: callbacks.onQuestion,
-        onPermissionRequest: callbacks.onPermissionRequest,
-      })
+      const origConsoleLog = console.log
+      const origConsoleErr = console.error
+      console.log = (...a) => capturedConsole.push(a.map(String).join(" "))
+      console.error = (...a) => capturedConsole.push("[err] " + a.map(String).join(" "))
+      let rawResult
+      try {
+        rawResult = await item.tool.execute(item.args, {
+          cwd: agent.cwd,
+          agent,
+          depth,
+          signal,
+          callbacks,
+          onOutput: (chunk) => callbacks.onToolOutput?.(item.toolCall.name, chunk, item.toolCall.id),
+          onQuestion: callbacks.onQuestion,
+          onPermissionRequest: callbacks.onPermissionRequest,
+        })
+      } finally {
+        console.log = origConsoleLog
+        console.error = origConsoleErr
+      }
       if (rawResult === undefined) throw new Error(`Tool "${item.toolCall.name}" returned undefined — all tools must return a string value`)
       const raw = String(rawResult)
       // Multimodal tools keep the raw result (base64 images ride the multimodal
     // channel); everything else offloads oversized text to disk. Flag-driven, not
     // name-driven (consult P3, 2026-08-30).
     const result = item.tool?.multimodal ? raw : await offloadToolResult(raw, item.toolCall.id)
-      callbacks.onToolResult?.(item.toolCall.name, result, item.toolCall.id)
+      // 2026-08-31：工具执行期间捕获的 console 输出附在结果后回显（模型视野）
+      const resultWithConsole = capturedConsole.length > 0
+        ? `${result}\n[console during ${item.toolCall.name}]\n${capturedConsole.join("\n")}`
+        : result
+      callbacks.onToolResult?.(item.toolCall.name, resultWithConsole, item.toolCall.id)
       // PostToolUse hooks: fire-and-forget (result not awaited on hook failure)
       runHooks("PostToolUse", { agent, toolName: item.toolCall.name, toolArgs: item.args, result: raw }).catch(() => {})
-      return { ...item, result, ok: true }
+      return { ...item, result: resultWithConsole, ok: true }
     } catch (error) {
       // Persist to ~/.thincoder/tool-errors/ for post-mortem; only pass message to the model (stack traces confuse LLMs and may leak paths)
       logToolError(item.toolCall.name, item.args, error)
@@ -205,7 +226,11 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       if (item.args.pattern) ctxParts.push(`pattern=${item.args.pattern}`)
       if (item.args.command) ctxParts.push(`cmd=${item.args.command.slice(0, 80)}`)
       const ctx = ctxParts.length > 0 ? ` [${ctxParts.join(", ")}]` : ""
-      return { ...item, result: `Error: ${error.message}${ctx}`, ok: false }
+      // 2026-08-31：异常路径同样回显捕获的 console（工具报错前的探查输出最有价值）
+      const consolePart = capturedConsole.length > 0
+        ? `\n[console during ${item.toolCall.name}]\n${capturedConsole.join("\n")}`
+        : ""
+      return { ...item, result: `Error: ${error.message}${ctx}${consolePart}`, ok: false }
     }
   }
 

package/src/agent/setup.mjs

@@ -148,7 +148,8 @@ export async function prepareRun(agent, input, callbacks, {
     pushReal(agent, { role: "user", content: input })
   }
   // Time grounding for EVERY agent depth AND every resume, pushed LAST (after the user
-  // input): transient, dropped on persist, fresh at every run start — including resumes
+  // input): transient on the HUMAN line — dropped on persist; on the MACHINE line — kept
+  // (byte-identical resume for the provider prefix cache, 2026-08-16), fresh at every run start
   // (an interrupt-continuation must know NOW, not the pre-interrupt time; 2026-08-16).
   // Tail position keeps the second-precision content out of any prefix — caches stay hit.
   agent.history.push({

package/src/agent.mjs

@@ -10,6 +10,7 @@ import { join, dirname } from "node:path"
 import { fileURLToPath } from "node:url"
 import { executeToolCalls } from "./agent/dispatch.mjs"
 import { recordToolResults } from "./agent/record-results.mjs"
+import { FILE_MUTATORS } from "./agent/helpers.mjs"
 import { prepareRun } from "./agent/setup.mjs"
 import { injectPostTurn } from "./agent/post-turn.mjs"
 import { handleCompletion } from "./agent/completion.mjs"
@@ -256,6 +257,20 @@ export async function runAgent(agent, input, callbacks = {}, { depth = 0, signal
       throw e
     }
 
+    // 内置工具（Responses web_search）结果本地化：服务端已执行——入历史为 tool 消息，
+    // 模型下一轮可见；全量回传时 transport 依 tool_call_id 前缀还原 web_search_call item。
+    // 注意：服务端 item id 是 msg_xxx 非 web_search_call_ 前缀——必须合成前缀（toItems 识别锚点），
+    // 原始 id 存入 content（真机冒烟 2026-08-31：直接用 msg_xxx 会被转成 function_call_output
+    // 与服务端不配对，属蒙对）。
+    for (const btr of response.builtinToolResults ?? []) {
+      if (!btr?.id) continue
+      pushReal(agent, {
+        role: "tool",
+        tool_call_id: `web_search_call_${btr.id}`,
+        content: JSON.stringify({ id: btr.id, query: btr.query ?? "", sources: btr.sources ?? [], status: btr.status ?? "completed" }),
+      })
+    }
+
     // Stream rule triggered mid-generation (action: "abort"): halt current output,
     // inject rule's message as a reminder, and retry from the same context.
     if (response.ruleTriggered) {
@@ -357,6 +372,25 @@ export async function runAgent(agent, input, callbacks = {}, { depth = 0, signal
     // Ctrl+I interrupt during tool execution: skip committing partial results —
     // the tool failure messages would mislead the model. Inject the interrupt and retry.
     if (signal?.reason?.interrupt) {
+      // 中断变更记账（2026-08-31 评审 #4）：此分支的工具已全部执行完成（磁盘已变，execute 已完成），
+      // 真实结果按语义不进历史（placeholder 替代）——但变更必须记账：否则 guard 看到
+      // "本轮未改代码" 放行，评审/verify 门禁被绕过（文件改了却没评审）。
+      for (const { toolCall, ok } of results) {
+        const tool = toolByName.get(toolCall.name)
+        if (!ok || !tool || !FILE_MUTATORS.has(toolCall.name)) continue
+        agent._mutatedThisRun = true
+        agent._calledAdvisorThisRun = false
+        agent._verifiedThisRun = false
+        agent._verifyPassed = undefined
+        try {
+          const args = JSON.parse(toolCall.arguments)
+          const paths = tool.touchedPaths ? tool.touchedPaths(args) : [args.path]
+          for (const p of paths) {
+            const abs = join(agent.cwd, p)
+            if (!agent._touchedFiles.includes(abs)) agent._touchedFiles.push(abs)
+          }
+        } catch { /* 畸形 args 不影响记账（touchedFiles 尽力而为） */ }
+      }
       // The assistant tool_calls were already committed above (L347) — a strict
       // provider 400s on dangling tool_calls, so synthesize placeholder tool
       // results BEFORE the interrupt message (tool result must immediately

package/src/cli/make-agent.mjs

@@ -60,11 +60,17 @@ export async function assembleAgent() {
     if (existsSync(mcpJsonPath)) {
       const mcpJson = JSON.parse(readFileSync(mcpJsonPath, "utf8"))
       if (mcpJson.mcpServers && typeof mcpJson.mcpServers === "object") {
-        const configNames = new Set(mcpServers.map((s) => s.name))
-        for (const [name, server] of Object.entries(mcpJson.mcpServers)) {
-          if (configNames.has(name)) continue // config.json takes priority
-          if (!server || typeof server !== "object") continue
-          mcpServers.push({ name, ...server })
+        // 2026-08-31 MCP 会诊 #10：数组型 mcpServers 不是规范形态——Object.entries 会产出
+        // "0"/"1" 数字名（变成工具前缀 "0_tool"），必须跳过；server 条目嵌套数组同理。
+        if (Array.isArray(mcpJson.mcpServers)) {
+          console.error("[mcp] .mcp.json: mcpServers must be a plain object, got array — skipped")
+        } else {
+          const configNames = new Set(mcpServers.map((s) => s.name))
+          for (const [name, server] of Object.entries(mcpJson.mcpServers)) {
+            if (configNames.has(name)) continue // config.json takes priority
+            if (!server || typeof server !== "object" || Array.isArray(server)) continue
+            mcpServers.push({ name, ...server })
+          }
         }
       }
     }

package/src/escape.mjs

@@ -10,7 +10,10 @@
  * 一个字节/码点）。JSON.stringify 层面的反斜杠转义由发送方负责，本模块不碰。
  */
 
-/** 中和单段文本里的非法字面转义序列。 */
+/** 中和单段文本里的非法字面转义序列。
+ *  Known limitation (documented, accepted, VS Code port parity): an ODD backslash
+ *  run of 3+ (e.g. "\\\x") leaves the trailing "\x" un-doubled — vanishingly rare
+ *  in real conversation text (no such hit in the 2026-08-31 repro session). */
 export function escapeLiteralEscapes(text) {
   text = String(text ?? "")
   return text
@@ -20,14 +23,21 @@ export function escapeLiteralEscapes(text) {
     .replace(/(?<!\\)\\(u)(?![0-9a-fA-F]{4})/g, "\\\\$1")
 }
 
-/** 对单条消息的 content 应用 escapeLiteralEscapes（支持字符串或 OpenAI 多模态 part 数组）。 */
+/** 对单条消息的 content 应用 escapeLiteralEscapes（支持字符串或 OpenAI 多模态 part 数组）。
+ *  2026-08-31 会诊 F5：deepseek-v4-flash 网关对 tool_calls[].function.arguments 与
+ *  reasoning_content 做同样的非标二次转义解析（字面 \x/\u 经工具参数/思考回传 → 400，
+ *  列号确定性复现 = 毒序列在 content 之外）——这两个字符串字段同样需要中和。 */
 export function escapeMessageContent(message) {
   const content = message?.content
+  let changed = false
+  let next = message
   if (typeof content === "string") {
-    return { ...message, content: escapeLiteralEscapes(content) }
-  }
-  if (Array.isArray(content)) {
-    let changed = false
+    const escaped = escapeLiteralEscapes(content)
+    if (escaped !== content) {
+      next = { ...next, content: escaped }
+      changed = true
+    }
+  } else if (Array.isArray(content)) {
     const parts = content.map((p) => {
       if (p && typeof p === "object" && p.type === "text" && typeof p.text === "string") {
         const escaped = escapeLiteralEscapes(p.text)
@@ -38,9 +48,34 @@ export function escapeMessageContent(message) {
       }
       return p
     })
-    return changed ? { ...message, content: parts } : message
+    if (changed) next = { ...next, content: parts }
+  }
+  if (Array.isArray(next.tool_calls)) {
+    let tcChanged = false
+    const tool_calls = next.tool_calls.map((tc) => {
+      const args = tc?.function?.arguments
+      if (typeof args === "string") {
+        const escaped = escapeLiteralEscapes(args)
+        if (escaped !== args) {
+          tcChanged = true
+          return { ...tc, function: { ...tc.function, arguments: escaped } }
+        }
+      }
+      return tc
+    })
+    if (tcChanged) {
+      next = { ...next, tool_calls }
+      changed = true
+    }
+  }
+  if (typeof next.reasoning_content === "string") {
+    const escaped = escapeLiteralEscapes(next.reasoning_content)
+    if (escaped !== next.reasoning_content) {
+      next = { ...next, reasoning_content: escaped }
+      changed = true
+    }
   }
-  return message
+  return changed ? next : message
 }
 
 /** IKBGX4 (2026-08-28)：剥离仅本地使用的整消息标记字段（transient 等）——发送给 provider 前移除。

package/src/git/checkpoint.mjs

@@ -16,7 +16,7 @@ import { configDir } from "../config.mjs"
 
 const CWD_HASH_LEN = 12
 
-const MAX_CHECKPOINTS = 20
+const MAX_CHECKPOINTS = 100
 
 /** Files larger than this are NOT copied (sqlite db, bundles…) — they are recorded as skipped. */
 const MAX_FILE_BYTES = 5 * 1024 * 1024
@@ -33,8 +33,16 @@ function git(cwd, args, { allowFail = false } = {}) {
   }
 }
 
+/** Normalize cwd for hashing: uppercase the Windows drive letter so the VS Code
+ *  extension's uri.fsPath (lowercased) produces the SAME cwdHash12 as the CLI's
+ *  process.cwd() — cross-end snapshot sharing (CHECKPOINT.md F5/T7) depends on this
+ *  contract. Same normalization as session storage (session-slots.mjs normalizeCwd). */
+function normalizeCwd(cwd) {
+  return cwd.replace(/^([a-z]):/, (_, d) => d.toUpperCase() + ":")
+}
+
 function checkpointRoot(cwd) {
-  const hash = createHash("sha1").update(cwd).digest("hex").slice(0, CWD_HASH_LEN)
+  const hash = createHash("sha1").update(normalizeCwd(cwd)).digest("hex").slice(0, CWD_HASH_LEN)
   return join(configDir, "checkpoints", hash)
 }
 
@@ -412,11 +420,29 @@ export async function catFile(cwd, id, filePath) {
   }
 }
 
-/** Keep only the most recent MAX_CHECKPOINTS */
-async function pruneCheckpoints(cwd) {
+/** F6: delete ALL checkpoints for a cwd — commit = new safety baseline. Best-effort:
+ *  a missing dir is a no-op; deletion failures propagate so the git tool's commit case
+ *  can report "(checkpoint cleanup skipped: …)" without blocking the commit result. */
+export async function deleteCheckpointsForCwd(cwd) {
+  await rm(checkpointRoot(cwd), { recursive: true, force: true })
+}
+
+/** NF6: keep only the most recent `count` snapshots — oldest removed first (id sort =
+ *  timestamp prefix, so ascending order IS oldest-first). Returns how many were deleted
+ *  (0 when the cwd has no checkpoint dir). */
+export async function deleteCheckpointsOlderThan(cwd, count) {
   const root = checkpointRoot(cwd)
-  const ids = (await readdir(root)).sort()
-  while (ids.length > MAX_CHECKPOINTS) {
+  let ids
+  try { ids = (await readdir(root)).sort() } catch { return 0 }
+  let removed = 0
+  while (ids.length > count) {
     await rm(join(root, ids.shift()), { recursive: true, force: true })
+    removed++
   }
+  return removed
+}
+
+/** Keep only the most recent MAX_CHECKPOINTS (NF6 cap — runs at the end of every create) */
+async function pruneCheckpoints(cwd) {
+  await deleteCheckpointsOlderThan(cwd, MAX_CHECKPOINTS)
 }

package/src/mcp/helpers.mjs

@@ -27,13 +27,22 @@ export function quoteArg(s) {
   return /[\s"]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s
 }
 
-/** Append a Bearer token as a query parameter to a WebSocket URL */
+/** Convert an Authorization Bearer token into a WebSocket subprotocol.
+ *  2026-08-31 MCP 会诊 #10：原实现把 token 塞进 URL query——代理/网关日志会泄露凭证，
+ *  且无标准依据。Node 内置 WebSocket（undici）无法自定义请求头，MCP 生态的标准替代
+ *  通道是 subprotocol（`bearer.<token>`）。用户 URL 自带的 query token 不动（兼容）。
+ *  @returns {{ url: string, protocols: string[] }} — protocols 为空数组表示无认证。 */
 export function withAuthToken(wsUrl, authorization) {
-  if (!authorization) return wsUrl
+  if (!authorization) return { url: wsUrl, protocols: [] }
   const token = authorization.replace(/^Bearer\s+/i, "")
-  const u = new URL(wsUrl)
-  u.searchParams.set("token", token)
-  return u.href
+  let u
+  try {
+    u = new URL(wsUrl)
+  } catch {
+    throw new Error(`Invalid WebSocket URL: ${String(wsUrl).slice(0, 120)}`)
+  }
+  // subprotocol 不进入 URL/日志，token 不再注入 query
+  return { url: u.href, protocols: [`bearer.${token}`] }
 }
 
 /** Sanitize a tool name: replace non-alphanumeric chars with underscores, cap at 64 chars */