thincoder 0.12.52 → 0.12.54

package/src/prompts/discipline.md

@@ -19,9 +19,10 @@ UI & interface design:
 - A value with a FIXED set of choices (enum, level, mode, flag) must be OPTIONS — picker / menu / choices / buttons. Never free-text input.
 - Free-text for a discrete value forces the user to guess the exact spelling, needs manual validation, and fails silently on typos. This has happened repeatedly (e.g. reasoning-effort levels typed by hand).
 - Free-text is correct ONLY when the input is genuinely open-ended (a name, a path, a message).
+- **用户约定执行纪律（2026-08-31，两次违约教训）**：用户对交互/行为的约定以用户原话为准——实现时逐字对照，不得用"等效实现"替换约定本身（已发生：滚动→点击翻窗、滚动到头自动加载→PgUp 键触发）。已确认约定的简化/降级必须提前上报，不得包装成"升级路径"交付。注释里的 parity with X / 对齐 X 只描述来源，不代表 X 就是正确语义——以用户约定为唯一判据，实现后真机验证用户原话的每个承诺点。
 
 Tool routing — use the dedicated tool, not bash:
-- **git operations** → `git` tool (action=status/diff/log/show/add/commit/push/tag/branch/checkout/restore/stash/fetch/pull/reset/revert/merge/cherry-pick; `workdir` for sub-repos). Never run git via bash.
+- **git operations** → `git` tool (action=status/diff/log/show/add/commit/push/tag/branch/checkout/restore/stash/fetch/pull/reset/revert/merge/cherry-pick/ls-remote/clone/init/rebase/remote/clean/switch/apply/worktree/archive/blame/mv; `workdir` for sub-repos). Never run git via bash.
 - **JavaScript** → `execute` (inline code; or `scriptFile`+`nodeArgs` for `node <file>` / `node --test` / `node --check`). Never `bash node -e`.
 - **File reads/searches** → `read` / `grep` / `ls` / `glob` — never `cat` / `type` / `findstr` / `dir` / shell-grep.
 - **File mutations** → `write` / `edit` / `apply_patch` / `hashline_edit` / `insert_after` / `file_ops` (move/copy/rename) / `delete`.
@@ -29,6 +30,48 @@ Tool routing — use the dedicated tool, not bash:
 - Each tool's description carries a "Route to X instead of bash" mapping.
 - **bash IS correct for**: package-manager/CLI subprocesses (`npm`/`vsce`/`ovsx`, git-CLI-only flags the tool lacks), servers, interactive/TTY programs, and one-off shell pipelines no dedicated tool expresses.
 
+**Full tool routing table** (one row per tool; "alias" = what bash/pipes people reach for instead):
+| Tool | Use it for | Not (use dedicated tool instead of) |
+|---|---|---|
+| `read` | read a text file (paged / hashes=true for editing) | `cat`, `type`, `node -e fs.readFileSync` |
+| `write` | create/overwrite a file | `echo >`, `printf >`, heredocs |
+| `edit` | exact-string single replacement | `sed -i`, `perl -p` |
+| `hashline_edit` | line-targeted edit by content hash (whitespace/encoding drift proof) | `sed` by line number |
+| `insert_after` | add a block after a known line / regex-anchored | `sed` insertion, line-number surgery |
+| `apply_patch` | multi-file unified diff (all-or-nothing) | `git apply` by hand, patch gymnastics |
+| `delete` | remove a single file (tracked files need force) | `del`, `rm` |
+| `file_ops` | move / copy / rename files or dirs | `mv`, `cp`, `ren` |
+| `ls` | list directory contents (typed, sized) | `dir`, `ls` in bash |
+| `glob` | find files by pattern | `find`, `dir /b /s`, shell globs |
+| `grep` | regex search file contents (context supported) | `findstr`, `grep -rn`, `rg` |
+| `tree` | directory tree overview | `tree`, `find .` |
+| `repo_outline` | module dependency / symbol map | ad-hoc scripts |
+| `code_search` | natural-language code search | grep gymnastics |
+| `doc_search` | search project docs (design/AGENTS) | `findstr` in docs |
+| `read_image` | view an image (vision models) | external viewers |
+| `execute` | run JS inline / scriptFile (+ nodeArgs for `node --test`/`--check`) | `bash node -e`, `node <script>` via bash |
+| `bash` | npm/vsce/CLI subprocess, servers, TTY programs, one-off pipelines no tool expresses | always; see allowed list above |
+| `git` | ALL git ops (status/diff/log/show/add/commit/push/tag/branch/checkout/restore/stash/fetch/pull/reset/revert/merge/cherry-pick/ls-remote/clone/init/rebase/remote/clean/switch/apply/worktree/archive/blame/mv) | `git` in bash |
+| `process` | list running processes | `tasklist`, `ps`, `wmic` |
+| `get_current_time` | current date/time | `date` |
+| `timer` | thinking budget / wait reminder | `sleep`, `timeout` (for real waits) |
+| `lint` | lint / syntax check after edits (full=true for cascade) | ad-hoc eslint runs |
+| `verify` | pre-completion self-check (syntax/tests/diff/checklist) | manual diff/test runs |
+| `task` / `checklist` | session-level tasks / persistent requirements tracking | README-style todo lists |
+| `goal` | long-running autonomous goal (machine-checkable criteria) | prose promises |
+| `plan` / `eng` | plan mode / engineering mode entry-exit | none (mode transitions only here) |
+| `skill` | load project skills (.thincoder/skills/) | re-inventing workflows |
+| `question` | ask the user (ambiguity, design decisions) | guessing |
+| `advisor` | independent review of code/design | self-review only |
+| `subagent` | delegate subtasks to isolated contexts | inlining exploration |
+| `consult_start` / `consult_check` / `consult_stop` | parallel multi-model consultation | single-model guessing |
+| `escalate` | fly in a stronger model for hard implementation | burning attempts |
+| `memory_put` / `memory_search` | long-term knowledge save/search | session notes |
+| `checkpoint` | git snapshots / rewind safety | manual branches |
+| `fetch` | fetch a URL (explicit proxy per target; config proxy NOT auto-applied) | `curl` |
+| `websearch` | Bing search (weak for technical; MCP search tool first) | `curl` scraping |
+| `glm-websearch_web_search_prime` | technical lookups (primary when available) | Bing fallback loop |
+
 Review discipline (standard mode only — engineering mode has its own review timing rules):
 - **Advisor:** call after changing code. Must provide scope: `paths` (files/dirs to review) or `documents` (context).
 - **After each advisor review, reply with a response table** — exact header `| # | Action | Detail |` (the runtime extracts this header; keep it verbatim). One row per issue; `#` = the advisor's issue number (`Orig#` on rounds 2+).

package/src/provider/anthropic.mjs

@@ -6,9 +6,21 @@
 
 import { specForModel } from "../config.mjs"
 import { proxyFetch } from "../proxy.mjs"
+import { requestWithRetry } from "./retry.mjs"
 
 const ANTHROPIC_VERSION = "2023-06-01"
 
+/** OpenAI 语义 tool_choice → Anthropic tool_choice（2026-08-31 能力层）。
+ *  传入值形态：undefined | "auto" | "required" | "none" | {type:"function",function:{name}} */
+function mapToolChoice(choice) {
+  if (choice === "auto") return { type: "auto" }
+  if (choice === "required") return { type: "any" }
+  if (choice === "none") return { type: "none" }
+  if (choice && typeof choice === "object" && choice.function?.name) return { type: "tool", name: choice.function.name }
+  throw new Error(`Invalid tool_choice for Anthropic format: ${JSON.stringify(choice).slice(0, 120)}`)
+}
+
+
 /** Convert OpenAI-format tools to Anthropic format */
 export function normalizeTools(tools) {
   return (tools || []).map((t) => ({
@@ -18,8 +30,11 @@ export function normalizeTools(tools) {
   }))
 }
 
-/** Build and send an Anthropic chat request. Returns the same shape as core.mjs chat. */
-export async function chat(provider, { messages, tools, onToken, onReasoning, signal }) {
+/** Build and send an Anthropic chat request. Returns the same shape as core.mjs chat.
+ *  2026-08-31 会诊 #6：接入 rateGate/recordRate + 429 Retry-After 单次重试
+ *  （原实现完全绕过 TPM/RPM 闸门与记账——用户配了 tpm 以为受控实际不受控）。
+ *  注：5xx/网络退避重试未与 OpenAI 格式对齐（三 transport 共用那步工作量大，见报告）。 */
+export async function chat(provider, { messages, tools, onToken, onReasoning, onWait, signal, toolChoice, parallelToolCalls }) {
   // Extract system message(s) — Anthropic uses top-level `system` field
   const systemMessages = []
   const chatMessages = []
@@ -40,6 +55,9 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, si
   }
   if (systemMessages.length > 0) body.system = systemMessages.join("\n\n")
   if (tools?.length) body.tools = tools
+  // 2026-08-31：tool_choice 能力层——OpenAI 语义映射到 Anthropic tool_choice
+  // （auto→{type:"auto"} / required→{type:"any"} / none→{type:"none"} / 具体函数→{type:"tool",name}）
+  if (toolChoice !== undefined) body.tool_choice = mapToolChoice(toolChoice)
   if (provider.temperature != null) {
     let t = provider.temperature
     // Anthropic API hard limit is 0-1; models without a declared tempRange still get clamped
@@ -59,23 +77,37 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, si
   // Active signal check
   if (signal?.aborted) throw Object.assign(new DOMException("Aborted", "AbortError"), { reason: signal.reason })
 
-  const response = await proxyFetch(`${provider.baseURL}/messages`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(body),
-    signal: signal
-      ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
-      : AbortSignal.timeout(FETCH_TIMEOUT_MS),
-  }, provider.proxyUri)
-
-  if (!response.ok) {
-    const text = await response.text().catch(() => "")
-    throw new Error(`Anthropic API error ${response.status}: ${text}`)
-  }
+  // 会诊 #6：TPM/RPM 闸门 + 记账（rate.mjs 与 OpenAI 格式共用同一窗口）
+  const { rateGate, recordRate } = await import("./rate.mjs")
+  const estimated = await (async () => {
+    const { estimateRequestTokens } = await import("./rate.mjs")
+    return estimateRequestTokens(body)
+  })()
+  await rateGate(provider, estimated, onWait, signal)
+
+  // 2026-08-31：4xx/5xx/网络与 OpenAI 格式统一退避重试链（原仅 429 Retry-After 单次重试，
+  // 5xx 直接抛——DeepSeek/Claude 排队 503 时其他格式可自动恢复，这里语义割裂）
+  const response = await requestWithRetry(
+    () => proxyFetch(`${provider.baseURL}/messages`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+      signal: signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
+        : AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      _headerTimeoutMs: FETCH_TIMEOUT_MS,
+      _bodyIdleMs: 120_000,
+    }, provider.proxyUri),
+    { signal, onWait, buildMessage: (status, text) => `Anthropic API error ${status}: ${text}` },
+  )
 
   const result = await parseAnthropicStream(response, { onToken, onReasoning, signal })
+  recordRate(provider, estimated, result.usage)
+  return finishAnthropic(result)
+}
 
-  // Convert Anthropic usage format to OpenAI-compatible
+/** Convert the parsed stream to the core.mjs result shape (usage → OpenAI-compatible). */
+function finishAnthropic(result) {
   const usage = result.usage
   if (usage) {
     return {
@@ -91,7 +123,6 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, si
       toolCalls: result.toolCalls,
     }
   }
-
   return { content: result.content, reasoning: result.reasoning, toolCalls: result.toolCalls }
 }
 
@@ -157,6 +188,8 @@ async function parseAnthropicStream(response, { onToken, onReasoning, signal })
       throw e
     }
     buffer += decoder.decode(chunk, { stream: true })
+    // BOM 剥除（会诊 #12）：首个 chunk 可能带 \uFEFF，否则 message_start 事件被静默丢失（含 usage）
+    if (buffer.charCodeAt(0) === 0xfeff) buffer = buffer.slice(1)
     const lines = buffer.split("\n")
     buffer = lines.pop()
 
@@ -167,7 +200,7 @@ async function parseAnthropicStream(response, { onToken, onReasoning, signal })
         currentData = ""
       } else if (line.startsWith("data: ")) {
         currentData = line.slice(6).trim()
-      } else if (line === "") {
+      } else if (line === "" || line === "\r") { // CRLF 空行是 "\r"（会诊 #13）
         if (currentEvent) processEvent(currentEvent, currentData)
         currentEvent = ""
         currentData = ""

package/src/provider/core.mjs

@@ -17,6 +17,27 @@ import {
 
 const FETCH_TIMEOUT_MS = 600_000
 
+/** 可中断 sleep（2026-08-31 会诊 #5）：退避/Retry-After/overload 等待期间 Ctrl+C 应
+ *  立即生效——原来最长睡 60s 无响应。内部走 _rateHooks.sleep（测试替换点）。 */
+function abortDOM(signal) {
+  const e = new DOMException("The operation was aborted", "AbortError")
+  e.reason = signal.reason
+  return e
+}
+
+async function sleepInterruptible(ms, signal) {
+  if (!signal) return _rateHooks.sleep(ms)
+  if (signal.aborted) throw abortDOM(signal)
+  return new Promise((resolve, reject) => {
+    const onAbort = () => { signal.removeEventListener("abort", onAbort); reject(abortDOM(signal)) }
+    signal.addEventListener("abort", onAbort, { once: true })
+    _rateHooks.sleep(ms).then(
+      () => { signal.removeEventListener("abort", onAbort); resolve() },
+      (e) => { signal.removeEventListener("abort", onAbort); reject(e) },
+    )
+  })
+}
+
 /** Create a validated provider config object from raw config */
 export function createProvider(config) {
   if (!config?.baseURL) throw new Error("provider config: baseURL is required — configure providers in ~/.thincoder/config.json")
@@ -40,11 +61,12 @@ export function createProvider(config) {
 }
 
 /** Send a streaming chat completion request with automatic continuation on truncation */
-export async function chat(provider, { messages, tools, onToken, onReasoning, onWait, signal, streamRules, firedPatterns }) {
+export async function chat(provider, { messages, tools, onToken, onReasoning, onWait, signal, streamRules, firedPatterns, toolChoice, parallelToolCalls }) {
   // Sanitize BEFORE format dispatch — image poisoning bricks anthropic/google sessions
   // the same way it bricks OpenAI-format ones (all raster-only).
   const spec = specForModel(provider.model)
   messages = stripImagesForTextModel(messages, spec)
+  const _debugBeforeLen = process.env.THIN_DEBUG_BODY ? JSON.stringify(messages).length : 0
 
   // Format dispatch: delegate to non-OpenAI transports
   if (provider.format === "anthropic") {
@@ -53,7 +75,7 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
     const result = await anthropicChat(provider, {
       messages,
       tools: tools?.length ? normalizeTools(tools) : null,
-      onToken, onReasoning, signal,
+      onToken, onReasoning, onWait, signal, toolChoice,
     })
     return result
   }
@@ -63,16 +85,31 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
     const result = await geminiChat(provider, {
       messages,
       tools: tools?.length ? normalizeTools(tools) : null,
-      onToken, onReasoning, signal,
+      onToken, onReasoning, onWait, signal, toolChoice,
     })
     return result
   }
+  if (provider.format === "responses") {
+    // 2026-08-31：Responses API transport（PROVIDER.md §13）——双轨链在 transport 内部
+    // 自行管理（provider._responsesChain），agent 层零改动。
+    // round3 #3：配对归一化必须在此分派前（压缩/中断遗留的孤儿 tool 消息发向严格服务端会 400）
+    messages = normalizeToolPairing(messages)
+    const { chat: responsesChat } = await import("./responses.mjs")
+    return responsesChat(provider, {
+      messages,
+      tools,
+      onToken, onReasoning, onWait, signal, toolChoice,
+    })
+  }
 
   messages = normalizeToolPairing(messages)
   // 中和服务端的非标二次转义：会话里若出现字面 "\x"/"\u"（如讨论转义、grep 到含
   // 转义的代码），Kimi 等会把它们当 hex escape 再解析 → "unexpected end of hex escape" 400。
   // 发送前统一 double 掉会形成非法转义的序列（合法 \xNN/\uNNNN 不受影响）。
   messages = escapeMessages(messages)
+  if (process.env.THIN_DEBUG_BODY) {
+    console.error(`[debug-body] escape: ${_debugBeforeLen} -> ${JSON.stringify(messages).length} chars, ${messages.length} msgs (provider=${provider.name}, model=${provider.model})`)
+  }
   // Compile string-pattern rules to RegExp at call time
   const rules = compileStreamRules(streamRules)
   const body = {
@@ -110,6 +147,10 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
   const enableThinking = resolveEnableThinking(provider, spec)
   if (enableThinking !== undefined) body.enable_thinking = enableThinking
   if (tools?.length) body.tools = tools
+  // 2026-08-31：tool_choice 能力层（透传 OpenAI 语义）；
+  // parallel_tool_calls 仅显式 true 时发送（默认不发=不改变现有行为）
+  if (toolChoice !== undefined) body.tool_choice = toolChoice
+  if (parallelToolCalls === true) body.parallel_tool_calls = true
 
   const estimated = estimateRequestTokens(body)
   await rateGate(provider, estimated, onWait, signal)
@@ -118,16 +159,19 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
   const result = await readSSE(response, { onToken, onReasoning, rules, signal, firedPatterns })
   recordRate(provider, estimated, result.usage)
 
-  // Stream rule triggered or user interrupted mid-generation — return partial result
+  // Stream rule triggered, user interrupted, or network partial — return immediately.
+  // 2026-08-31 会诊 #2：partial（网络错误中断但已有内容）与 interrupted 同级透传，
+  // 不再让上层把已收内容当整轮失败重试（重试从零开始浪费已流出的成本）。
   if (result.ruleTriggered) return result
   if (result.interrupted) return result
+  if (result.partial) return result
 
   // Retry on transient server overload (DeepSeek: insufficient_system_resource)
   const MAX_OVERLOAD_RETRIES = 1
   for (let r = 0; result.finishReason === "insufficient_system_resource" && r <= MAX_OVERLOAD_RETRIES; r++) {
     if (r > 0) {
       onWait?.({ phase: "overloaded", seconds: 3 })
-      await _rateHooks.sleep(3000)
+      await sleepInterruptible(3000, signal)
     }
     const retryResponse = await requestWithRetry(provider, body, signal, onWait)
     const retryResult = await readSSE(retryResponse, { onToken, onReasoning })
@@ -136,13 +180,7 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
       // Merge any partial content from the failed attempt (streaming already showed it)
       result.content += retryResult.content
       result.reasoning += retryResult.reasoning ?? ""
-      for (const tc of retryResult.toolCalls ?? []) {
-        const idx = tc.index ?? result.toolCalls.length
-        const s = (result.toolCalls[idx] ??= { id: "", name: "", arguments: "" })
-        if (tc.id) s.id = tc.id
-        s.name += tc.name ?? ""
-        s.arguments += tc.arguments ?? ""
-      }
+      mergeRetryToolCalls(result, retryResult.toolCalls)
       result.finishReason = retryResult.finishReason
       if (retryResult.usage) result.usage = retryResult.usage
       break
@@ -172,13 +210,7 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
     })
     result.content += continued.content
     result.reasoning += continued.reasoning ?? ""
-    for (const tc of continued.toolCalls ?? []) {
-      const idx = tc.index ?? result.toolCalls.length
-      const s = (result.toolCalls[idx] ??= { id: "", name: "", arguments: "" })
-      if (tc.id) s.id = tc.id
-      s.name += tc.name ?? ""
-      s.arguments += tc.arguments ?? ""
-    }
+    mergeRetryToolCalls(result, continued.toolCalls)
     result.finishReason = continued.finishReason
     if (continued.usage) {
       const sum = (k) => (result.usage?.[k] ?? 0) + (continued.usage[k] ?? 0)
@@ -210,28 +242,98 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
 // their import paths.
 import { stripImagesForTextModel, normalizeToolPairing } from "./normalize.mjs"
 export { stripImagesForTextModel, normalizeToolPairing }
+/** Merge tool calls from a retry/continuation into the accumulated result.
+ *  2026-08-31 会诊 #7/#17：readSSE 输出的 tc 已 finalize（无 index 字段），
+ *  原实现恒 append（重试里 provider 重发完整 tc → tool 名 "get_weatherget_weather"、
+ *  arguments 重复）。改按 id 定位已有槽位、无 id 才追加；name 只设一次。 */
+function mergeRetryToolCalls(result, toolCalls) {
+  for (const tc of toolCalls ?? []) {
+    if (!tc) continue
+    let s
+    if (tc.id) {
+      s = result.toolCalls.find((x) => x && x.id === tc.id)
+    }
+    if (!s) {
+      // 无 id（synthetic call_N 在重试间不稳定）或未命中：按 name 找同 slot（重试语义
+      // 是"同一批工具调用重新执行"，同名合并最稳）；仍找不到才追加。
+      s = tc.name ? result.toolCalls.find((x) => x && x.name === tc.name) : undefined
+    }
+    if (!s) {
+      s = { id: "", name: "", arguments: "" }
+      result.toolCalls.push(s)
+    }
+    if (tc.id && !s.id) s.id = tc.id
+    if (tc.name && !s.name) s.name = tc.name
+    s.arguments += tc.arguments ?? ""
+  }
+}
+
 /** List available model IDs from the provider's /models endpoint */
 export async function listModels(provider, { signal } = {}) {
-  const response = await fetch(`${provider.baseURL}/models`, {
+  // 2026-08-31 会诊 #10：与 chat 路径对齐——走 proxyUri、加 15s 超时、JSON 解析兜底
+  // （原实现直连 fetch 无超时无代理，慢/被墙域名的 /models 会挂死 UI）
+  const url = `${provider.baseURL}/models`
+  const opts = {
     headers: { ...(provider.headers ?? {}), Authorization: `Bearer ${provider.apiKey}` },
-    signal,
-  })
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000),
+    _headerTimeoutMs: 15_000,
+    _bodyIdleMs: 15_000,
+  }
+  const response = await (provider.proxyUri ? proxyFetch(url, opts, provider.proxyUri) : fetch(url, opts))
   if (!response.ok) {
     const text = await response.text().catch(() => "")
     throw new Error(`GET /models failed ${response.status}: ${text}`)
   }
-  const data = await response.json()
-  return (data.data ?? []).map((m) => m.id).filter(Boolean).sort()
+  const data = await response.json().catch(() => null)
+  return (data?.data ?? []).map((m) => m.id).filter(Boolean).sort()
 }
 
 async function requestWithRetry(provider, body, signal, onWait) {
+  // THIN_DEBUG_BODY=1：发送前诊断——复现网关侧 "unexpected end of hex escape" 400 时
+  // 定位真实载荷里的毒序列（2026-08-31 slot 3 deepseek-v4-flash）。模拟网关最宽松的
+  // 爆炸条件：任何字面 "\u"/"\x" 后不足位（不看前置反斜杠）。
+  if (process.env.THIN_DEBUG_BODY) {
+    try {
+      const msgs = body?.messages ?? []
+      const raw = JSON.stringify(body)
+      const hits = []
+      for (let i = 0; i < msgs.length; i++) {
+        const m = msgs[i] ?? {}
+        const fields = []
+        if (typeof m.content === "string") fields.push(["content", m.content])
+        else if (Array.isArray(m.content)) m.content.forEach((p, pi) => { if (p && typeof p.text === "string") fields.push([`content[${pi}]`, p.text]) })
+        if (typeof m.reasoning_content === "string") fields.push(["reasoning_content", m.reasoning_content])
+        if (Array.isArray(m.tool_calls)) m.tool_calls.forEach((tc, ti) => { if (tc && typeof tc.arguments === "string") fields.push([`tool_calls[${ti}].arguments`, tc.arguments]) })
+        if (typeof m.name === "string") fields.push(["name", m.name])
+        for (const [f, t] of fields) {
+          const re = /\\[xu]/g
+          let mm
+          while ((mm = re.exec(t))) {
+            const c = t[mm.index + 1]
+            const need = c === "u" ? 4 : 2
+            const after = t.slice(mm.index + 2, mm.index + 2 + need)
+            if (!new RegExp(`^[0-9a-fA-F]{${need}}$`).test(after)) {
+              hits.push({ i, role: m.role, field: f, ctx: t.slice(Math.max(0, mm.index - 40), mm.index + 12) })
+            }
+          }
+        }
+      }
+      console.error(`[debug-body] messages=${msgs.length} bodyLen=${raw.length} suspicious=${hits.length}`)
+      for (const h of hits.slice(0, 20)) console.error("[debug-body] hit", JSON.stringify(h))
+      if (!hits.length && msgs[1151]) {
+        console.error("[debug-body] no suspicious hit; messages[1151] =", JSON.stringify({ role: msgs[1151].role, contentLen: msgs[1151].content?.length, contentHead: String(msgs[1151].content).slice(0, 150) }))
+      }
+    } catch (e) {
+      console.error("[debug-body] diag failed:", e.message)
+    }
+  }
   let lastError
   let lastStatus = 0
   let lastWas429 = false
   let rateLimitHits = 0
   const totalAttempts = MAX_RETRIES + 1
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-    if (attempt > 0 && !lastWas429) await _rateHooks.sleep(2 ** (attempt - 1) * 1000)
+    if (attempt > 0 && !lastWas429) await sleepInterruptible(2 ** (attempt - 1) * 1000, signal)
     lastWas429 = false
 
     let response
@@ -246,6 +348,10 @@ async function requestWithRetry(provider, body, signal, onWait) {
         },
         body: JSON.stringify(body),
         signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)]) : AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        // 2026-08-31 会诊 #4：代理路径响应头超时对齐直连语义（原 15s 与直连 600s 割裂，
+        // DeepSeek 排队 TTFB>15s 即误报）— 仅 _ 前缀内部字段，proxyFetch 消费
+        _headerTimeoutMs: FETCH_TIMEOUT_MS,
+        _bodyIdleMs: 120_000,
       }
       response = provider.proxyUri
         ? await proxyFetch(url, opts, provider.proxyUri)
@@ -260,10 +366,10 @@ async function requestWithRetry(provider, body, signal, onWait) {
 
     const text = await response.text().catch(() => "")
     let message = `LLM API error ${response.status}: ${text}`
-    // Kimi has TWO separate platforms with non-interchangeable keys (IK5VGJ):
-    // Moonshot (api.moonshot.cn, sk-...) vs Kimi For Coding (api.kimi.com/coding/v1, sk-kimi-...).
-    // A 401 on either endpoint is usually a wrong-platform key — say so instead of a bare 401.
-    if (response.status === 401) {
+    // 401 双平台提示 + 诊断回显（2026-08-31 会诊 #15）：
+    // Kimi 双平台 key 不互通的提示保留；通用加 baseURL host + key 前 6 位掩码，
+    // 帮用户快速分辨"配错平台还是配错账号"。
+    if (response.status === 401 || response.status === 403) {
       const key = String(provider.apiKey ?? "").trim()
       const base = String(provider.baseURL ?? "").toLowerCase()
       const kimiCodeKey = /^sk-kimi-/i.test(key)
@@ -271,20 +377,20 @@ async function requestWithRetry(provider, body, signal, onWait) {
       if (kimiCodeKey || kimiCodeUrl) {
         message += " — tip: Kimi has two separate platforms with NON-interchangeable API keys: Moonshot (api.moonshot.cn/v1, sk-...) and Kimi For Coding (api.kimi.com/coding/v1, sk-kimi-...). Your key or baseURL looks mismatched — check which platform issued it."
       }
+      const host = (() => { try { return new URL(provider.baseURL).host } catch { return provider.baseURL ?? "(unknown)" } })()
+      const masked = key.length > 8 ? key.slice(0, 6) + "…" + key.slice(-4) : (key ? key.slice(0, 4) + "…" : "(empty)")
+      message += ` [auth diag: baseURL=${host} key=${masked} status=${response.status}]`
     }
     lastStatus = response.status
     if (isNonRetryableError(response.status, text)) throw new Error(message)
     if (response.status === 429) {
-      const retryAfter = Number(response.headers.get("retry-after"))
-      const waitMs =
-        Number.isFinite(retryAfter) && retryAfter > 0
-          ? retryAfter * 1000
-          : RATE_LIMIT_BACKOFF_MS[Math.min(rateLimitHits++, RATE_LIMIT_BACKOFF_MS.length - 1)]
+      const waitMs = parseRetryAfter(response.headers.get("retry-after"), rateLimitHits)
+      rateLimitHits++
       lastError = new Error(message)
       lastWas429 = true
       if (attempt < MAX_RETRIES) {
         onWait?.({ phase: "retry", seconds: Math.ceil(waitMs / 1000) })
-        await _rateHooks.sleep(waitMs)
+        await sleepInterruptible(waitMs, signal)
       }
       continue
     }
@@ -299,7 +405,28 @@ async function requestWithRetry(provider, body, signal, onWait) {
     : lastStatus >= 500 ? "Server error persisted"
     : lastStatus > 0 ? "Request failed"
     : "Network error"
-  throw new Error(`${verb} after ${totalAttempts} attempts${lastStatus ? ` (${lastStatus})` : ""}: ${lastError?.message ?? "unknown"}`)
+  // 会诊 #8：undici "fetch failed" 真因（ENOTFOUND/TLS/DNS/代理）藏在 error.cause —
+  // 拼进去，全链路同一文案不再掩盖根因
+  const causeText = lastError?.cause
+    ? ` (${lastError.cause.code ?? lastError.cause.message ?? String(lastError.cause)})`
+    : ""
+  throw new Error(`${verb} after ${totalAttempts} attempts${lastStatus ? ` (${lastStatus})` : ""}: ${lastError?.message ?? "unknown"}${causeText}`)
+}
+
+/** Parse Retry-After: 秒数 or HTTP-date；上限 300s（会诊 #11）— 异常头不得让 CLI 睡数小时。
+ *  header 缺失/非法时退回指数退避表（rateLimitHits 计数取档）。 */
+export function parseRetryAfter(header, rateLimitHits = 0) {
+  const fallback = RATE_LIMIT_BACKOFF_MS[Math.min(rateLimitHits, RATE_LIMIT_BACKOFF_MS.length - 1)]
+  if (header == null) return fallback
+  let waitMs = 0
+  const numeric = Number(header.trim())
+  if (Number.isFinite(numeric) && numeric >= 0) waitMs = numeric * 1000
+  else {
+    const date = Date.parse(header.trim())
+    if (Number.isFinite(date)) waitMs = Math.max(0, date - Date.now())
+  }
+  if (waitMs <= 0) return fallback
+  return Math.min(waitMs, 300_000)
 }
 
 /**

package/src/provider/google.mjs

@@ -5,6 +5,17 @@
  */
 
 import { proxyFetch } from "../proxy.mjs"
+import { requestWithRetry } from "./retry.mjs"
+
+/** OpenAI 语义 tool_choice → Gemini FunctionCallingConfig（2026-08-31 能力层）。 */
+function mapFunctionCallingConfig(choice) {
+  if (choice === "auto") return { mode: "AUTO" }
+  if (choice === "required") return { mode: "ANY" }
+  if (choice === "none") return { mode: "NONE" }
+  if (choice && typeof choice === "object" && choice.function?.name) return { mode: "ANY", allowedFunctionNames: [choice.function.name] }
+  throw new Error(`Invalid tool_choice for Gemini format: ${JSON.stringify(choice).slice(0, 120)}`)
+}
+
 
 /** Convert OpenAI-format tools to Gemini format */
 export function normalizeTools(tools) {
@@ -59,8 +70,9 @@ export function convertMessages(messages) {
   return contents
 }
 
-/** Build and send a Gemini chat request. Returns the same shape as core.mjs chat. */
-export async function chat(provider, { messages, tools, onToken, onReasoning, signal }) {
+/** Build and send a Gemini chat request. Returns the same shape as core.mjs chat.
+ *  2026-08-31 会诊 #6：接入 rateGate/recordRate（原实现完全绕过 TPM/RPM 闸门）。 */
+export async function chat(provider, { messages, tools, onToken, onReasoning, onWait, signal, toolChoice }) {
   const systemMessages = messages.filter((m) => m.role === "system")
   const contents = convertMessages(messages)
 
@@ -83,6 +95,10 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, si
     }
   }
   if (tools?.length) body.tools = tools
+  // 2026-08-31：tool_choice 能力层 → Gemini toolConfig.functionCallingConfig
+  if (toolChoice !== undefined) {
+    body.toolConfig = { functionCallingConfig: mapFunctionCallingConfig(toolChoice) }
+  }
 
   const FETCH_TIMEOUT_MS = 600_000
   // Gemini uses API key as query parameter
@@ -90,21 +106,29 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, si
 
   if (signal?.aborted) throw Object.assign(new DOMException("Aborted", "AbortError"), { reason: signal.reason })
 
-  const response = await proxyFetch(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-    signal: signal
-      ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
-      : AbortSignal.timeout(FETCH_TIMEOUT_MS),
-  }, provider.proxyUri)
-
-  if (!response.ok) {
-    const text = await response.text().catch(() => "")
-    throw new Error(`Gemini API error ${response.status}: ${text}`)
-  }
+  // 会诊 #6：TPM/RPM 闸门 + 记账
+  const { rateGate, recordRate, estimateRequestTokens } = await import("./rate.mjs")
+  const estimated = estimateRequestTokens({ messages })
+  await rateGate(provider, estimated, onWait, signal)
+
+  // 2026-08-31：5xx/网络与 OpenAI 格式统一退避重试链（原完全无重试——Gemini 高峰
+  // 503 直接抛错崩溃整个 turn）
+  const response = await requestWithRetry(
+    () => proxyFetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
+        : AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      _headerTimeoutMs: FETCH_TIMEOUT_MS,
+      _bodyIdleMs: 120_000,
+    }, provider.proxyUri),
+    { signal, onWait, buildMessage: (status, text) => `Gemini API error ${status}: ${text}` },
+  )
 
   const result = await parseGeminiStream(response, { onToken, onReasoning, signal })
+  recordRate(provider, estimated, result.usage)
 
   const usage = result.usage
   if (usage) {
@@ -177,6 +201,8 @@ async function parseGeminiStream(response, { onToken, onReasoning, signal }) {
       throw e
     }
     buffer += decoder.decode(chunk, { stream: true })
+    // BOM 剥除（会诊 #12）：首个 chunk 可能带 \uFEFF，否则首个 data 事件静默丢失
+    if (buffer.charCodeAt(0) === 0xfeff) buffer = buffer.slice(1)
     const lines = buffer.split("\n")
     buffer = lines.pop()
 

package/src/provider/rate.mjs

@@ -52,6 +52,11 @@ export function estimateRequestTokens(body) {
 
 /** Gate: sleep until window frees space when over budget */
 export async function rateGate(provider, estimated, onWait, signal) {
+  // 2026-08-31 会诊 #16：单请求估算已超 tpm 时原实现静默放行（必然撞服务端 429）。
+  // 保持放行（tpm 置 null 防止 overTokens 恒正值死等），但明确告警让上层/用户知情。
+  if (provider.tpm != null && estimated > provider.tpm) {
+    onWait?.({ phase: "warn", message: `estimated ${estimated} tokens > tpm ${provider.tpm} — request proceeds and may hit a server 429` })
+  }
   const tpm = provider.tpm != null && estimated <= provider.tpm ? provider.tpm : null
   const rpm = provider.rpm ?? null
   if (tpm == null && rpm == null) return