thincoder 0.12.53 → 0.12.58

package/CHANGELOG.md

@@ -1,3 +1,77 @@
+## [0.12.58] — 2026-09-02
+
+### Changed
+
+- **开发体验三项（用户需求批 2026-09-02，两端）**：
+  ① **lint 零依赖化**（TOOLS.md §10.2）：eslint 全套删除（devDependencies + eslint.config.mjs + 级联分支），lint = `node scripts/check-syntax.mjs`（node --check 遍历 src/test/bin/scripts 含自检，零依赖）；CLI-LINT-REQUIREMENTS/TUNING.md 标记被取代；package-lock 再生（eslint 树移除）
+  ② **工具作用域限制全部移除**（§10.1）：resolveInCwd 去边界断言（信任模型 + 权限门禁为唯一防线，与 bash 一致）；git workdir / execute scriptFile / file_ops 目录限制一并移除；工具描述与提示词 "confined to workspace" 措辞清理（两端 byte-identical）
+  ③ **模型上下文长度可配置**（PROVIDER.md §15）：`providers[].context`（K 单位，如 128 = 128K）覆盖 MODEL_SPECS——providerSpec 拷贝覆盖不污染共享 spec；压缩阈值（auto ×0.6）/ TOKEN 窗口 / 状态栏显示 / advisor 预算全链路跟随；数字字符串（"128"）两端统一归一；非法值忽略 + 警告一次；CLI /model 管理流 + VS Code settings.json 配置界面
+
+## [0.12.57] — 2026-09-02
+
+### Added
+
+- **subagent 异步化：真后台并行**（AGENT-LOOP.md §15，两端）：subagent 工具加 `async: true`——spawn 立即返回 `{id, status:"running"}`，主会话可继续自己的回合；新增 `subagent_check` 工具（arrival order 先完成先取 / 带 id 等待 / n 递增校验防循环 / readonly）；**槽位队列**：并发上限 4，超限入队（position 可见），running 完成即腾槽补位（不拒绝、不分批）；回合收尾自动等待全部完成并注入报告（XML 转义 + 超长预览落盘）；Ctrl+C 清空不注入、ContinueError 状态保留；async 仅 depth-0、后台撞 turn-cap 自动拒绝继续
+- **approval 批确认**（AGENT-LOOP.md §16.1，两端）：同批多个非只读工具一次合并询问（approve all / one by one / deny；deny 全批拒绝无二次询问；无 handler 回退逐项；onPermissionRequest 签名不变）
+- **批量形态引导**（§16.2，数据驱动——真实使用 94.6% 单条 edit / apply_patch 0 次 / 35 例手工批量）：edit 描述强化 edits 数组原子批量、apply_patch 补多文件新建场景、system.md 并行条款扩展批量句（两端 byte-identical）
+
+### Changed
+
+- 工程模式并发纪律上限 3 → 4（engineering.md + ENGINEERING-MODE.md FR8/决策③ 三处同步）
+- VS Code 端同批对齐：escape v5 / UTF-16 安全截断 / 续写构造 / 压缩可见性（见 thincoder-vscode CHANGELOG 0.12.57）
+
+## [0.12.56] — 2026-09-02
+
+### Added
+
+- **上下文压缩面板 + 压缩失败可见性**（CONTEXT-COMPACTION.md §7）：压缩开始即弹"Compressing…"面板区块（复用子 agent 面板机制：耗时 ticker + summarizing N messages）→ 完成态 `Compressed: N tokens freed → summary (Xs)` 可折叠冻结；失败态显示错误文本，连续 3 次失败后 compressFallback 截断兜底并显示降级说明；摘要正文永不进面板/会话流；headless 回调缺省 no-op
+- **DeepSeek prefix 续写 400 止损**（PROVIDER.md §14）：续写请求精简历史（过滤 tool/assistant(tool_calls) 消息，保留 system + 最近 ≤8 条文本）——真机矩阵实证：thinking 模式 prefix 续写 + 工具链消息必 400（补不补 reasoning_content 分别报 Function call / reasoning_content 错误），纯文本历史 200；续写失败注入 `_warnings` 不再静默飞出；partial 模式不受影响
+- **会话恢复 provider/model 缺失 → 模型重选**（SESSION.md §8）：CLI 启动校验 provider/model/baseURL 缺失 → 不再崩溃退出；TUI 首帧弹模型选择（复用 picker），Esc 仍进 TUI + 提示行；headless 可读错误 + 退出码 1；判据仅空缺失（MODEL_SPECS 未知不判无效——自定义模型保护）
+- **MCP save&test 确认问句废除**（MCP.md §5 变更段）：探活成功直接保存（删 `Save? (Y/n)`）；探活失败报错回表单且无任何保存通道（save-anyway 整个废除）；取消仅剩表单 Esc
+- **搜索工具优先级条款**（PROMPT-DECOUPLING.md）：discipline.md + engineering.md 行为规则——有 MCP 搜索工具优先用 MCP、websearch 仅备用；websearch 连续 2 次垃圾即切；被墙站点走镜像路径；动手抓页面前先扫工具表（两端 prompts byte-identical）
+
+### Fixed
+
+- **hex-escape 400 真凶根治（escape.mjs v5）**：2026-09-02 实锤——`unexpected end of hex escape` 400 的毒源**不是字面 hex 转义序列**，而是 **doc_search 预览 slice 按 UTF-16 码元截断切断了 emoji 代理对**（🔴 → 孤立高代理 D83D）→ deepseek 严格 UTF-16 解码 400。两层修复：① 发送前净化（sanitizeLoneSurrogates：孤立代理 → U+FFFD，全字段）+ hex 转义 odd-run 修复（v1-v4 的 double/替换方向全错，本版为对象层面正解）；② 源头 UTF-16 安全截断（setup.mjs doc_search 预览 + helpers.mjs offloadToolResult 截断点落高代理时向前收一个码元）。验证：真实会话 953 条（含孤立代理）重放 400→200，带 thinking:enabled 6/6 全 200
+- **MCP 磁盘无 mcp 段时 remove/edit 崩溃**（code review #1/#2）：persistRaw 建段守卫（`raw.mcp ??=`）——磁盘 mcp 段被整体删除而连接保留（T23 场景）时，remove 不再 TypeError、edit 不再静默丢（"updated" 提示与落盘一致）
+
+## [0.12.55] — 2026-09-01
+
+### Added
+
+- **`/mcp` edit/add 统一字段 picker 表单（v2）+ agent 代配闭环**（docs/design/MCP.md §5，CLI-only）：① **edit = 字段选择表单**——picker 列可编辑字段行（`HTTP URL https://…` / `Token d90c26bb…` 打码 / `Headers 2 items`；stdio `Command/Args/Env`；name 不可改无行）+ 末行 `✓ Save & test`；选中字段只输入该字段新值（提示 `(current: …)`——空=不变、`-`=删可选字段、`k=`=删 header/env 项、required 字段拒绝 `-`）→ 回 picker 循环连改多字段（中间 Esc 回 picker 不丢已改值）；**废除逐字段预填重问**（改 token 不再被迫路过 URL/headers）；② **add 复用同一表单**——空 entry 起、必填字段 `(required)` 标注、Save 校验必填非空（未满足提示并停留表单不落盘）、headers/env 不选即跳过、add 的 name 可编辑（重复名检查）；③ **保存前预览 + 探活 + 字段级重试合一**——`showPreview`（token 遮蔽）→ `probeMcpServer` 零副作用探活（`✓ N tools, Xms` / `✗ 错误`）→ `Save? (Y/n)`；探活失败 → `Save anyway? (y/N)` 显式 y，否则**回同一字段表单**只重输失败字段复 probe（**独立 retry 路径废除**，不重启流程；save-anyway 显式 y 保留）；④ **表单文件拆分**——新增 `src/tui/cmd-mcp-form.mjs`（fieldPicker 机制独立文件；`cmd-mcp.mjs` 499→382 行，脱离 500 硬限压线）；⑤ **列表即菜单**——主菜单 = server 行（●/○ 连接态 + tool 数）+ `+ Add server` + `↻ Refresh` + 顶部 agent 代配提示行；选中行 → per-server 子菜单（Edit/Test/Reconnect/Remove），"先选操作再选 server"双弹层与 View list 废除；⑥ **磁盘重读**——`config.mjs` 新增 `reloadMcpFromDisk()`（菜单打开边界 + Refresh）：磁盘→内存仅替换 mcp 段；畸形 config.json 回退内存态 + `⚠ disk config unreadable` 提示行；disk 删除/变更的已连接 server 连接不断 + 行尾 `⚠ disk changed` 对账标记（persistRaw 落盘后重读幂等防环）；⑦ AI 生成降 transport picker 末位（生成的 entry 同走预览+探活确认环，失败回表单补齐/修正）；`/mcp edit|test|remove|connect <name>` 直达参数路径零改动
+- **MCP Streamable POST 误判修复 + `/mcp edit`/`/mcp test` + token 一等字段**（docs/design/MCP.md §4，两端落地）：① `httpTransport` 增 postOnly 标记——GET SSE 405 降级后的纯 POST 模式 `isAlive()` 不再因 `eventSource == null` 误判死（glm-websearch "reconnect failed after 4 attempts" 根因：降级后 isAlive 恒 false → ensureAlive 触发无意义重连循环；legacy SSE 流断仍正常 fireDead 重连不回归）；② `/mcp edit [name]`：逐字段预填重问（空输入保留 / `-` 删除可选字段 / `k=` 删除单个 header 项），persistRaw 原位替换保数组序，保存后自动重连（config 指纹含 token，变更自动关旧连接）；③ `/mcp test [name]`：probeMcpServer 一次性探活（initialize + tools/list 计时 → `OK — N tools, Xms` / 错误透传），零副作用（不进 session 表、不动 agent.tools、探完即关）；④ token 一等字段：config 增 `token` 字段，connect 链自动合成 `Authorization: Bearer <token>`（显式 headers 优先，不写回 config）；⑤ parseHeaders 改逗号分隔（`Authorization=Bearer abc, X-Foo=bar`——修复空格截断把 Bearer token 截成 "Bearer" 的缺陷）；⑥ VS Code 同构：http transport 同款修复 + probeMcpServer 镜像 + 面板 [Edit]/[Test] 按钮（同一表单编辑预填，token 字段 + 逗号分隔 headers 提示）+ **面板 [Reconnect] 死按钮修复**（webview 发的 `reconnectMcp` 消息在路由拆分时丢失 case，按钮此前无效）
+- **memory_delete 工具**（跨端）：三层记忆条目删除——personal 行级删（embedding/FTS 随行）、project/team 文件级删；scope 与 id 前缀匹配校验，非法 scope 明确报错
+
+### Changed
+
+- **multi-design 并行令牌（designId slots）**：eng-coder 子 agent 支持 `{designId, token}` 多槽并行 spawn——各设计独立令牌互不覆盖，复审不通过的设计不挤占既有槽（CLI 与 VS Code 镜像）
+
+### Fixed
+
+- **edit 数组形态同文件串行**：同一文件多条 edit 的 raw 域快照随条目推进，第二条不再漂移（编辑器 CRLF 路径 + 磁盘路径双修复）
+- **MCP tools/list 分页超时约束**（MCP.md §4 评审 #8）：每页同受 INIT_TIMEOUT_MS 约束——probe 延迟统计有界
+- **MCP 握手失败 transport 泄漏**（评审 #7）：GET SSE 降级成功但 POST initialize 失败时关闭 transport，不留悬挂流
+- **hex-escape 毒载荷 400 根治（escape.mjs v3）**：v2 的 lookbehind 单字符判定与 hex 窗口越界缺陷在长会话（讨论转义主题）下漏中和 → deepseek 等网关二次解析报 "unexpected end of hex escape"；v3 数反斜杠 run 奇偶 + 窗口越界修复（`\\x/\\u` 相邻双写）+ 孤立代理对（`\\uD83D` 无配对 strict JSON 解析拒绝）预 double；真实会话 74 处毒点全量中和为 0，11 个 case 锁定（含 v1 行为兼容回归）
+
+## [0.12.54] — 2026-09-01
+
+### Added
+
+- **Checkpoint 事故恢复闭环（CLI ↔ VS Code 两端）**：git 工具破坏性操作（checkout -- / restore / reset --hard / clean / rebase）前自动快照 + schema 描述含 rewind 恢复指引；`checkpointAction=list` 输出尾部提示行；**commit 后清空该项目 checkpoint**（commit = 安全点；懒兜底覆盖外部 git/IDE commit）；每 cwd 快照上限 100（最旧淘汰）；git 工具补齐 11 个 action（clone/init/rebase/remote/clean/switch/apply/worktree/archive/blame/mv）；`/restore` 改为两级 picker 逐文件恢复；bash guard 保留并对齐（宽匹配 + 全量副本 + rewind 指引，与 VS Code 同构）
+- **TUI 子 agent 运行中面板固定化**：运行中子 agent 活动从会话流内联改为固定底部面板（会话与 todo 之间，不随会话滚动）；完全自适应高度；默认折叠（头部 + tail 3，⏸ = 等待审批）；完成仍冻结进会话流（✓ 头可展开）
+- **TUI 渲染鲁棒性**：wrap-off 硬截断（Ambiguous 宽度字符防软折行污染）；启动/退出序列抽取（tui-lifecycle.mjs）
+
+### Changed
+
+- **跨端会话共享一致性（会诊 4 模型收敛）**：sessionStart 打点（跨端同槽不再 F2 互轮转）；F2 写前磁盘校验（同会话并发追加 → 轮转 .bak 保留）；legacy transient 双端过滤；contextHistory 机读线判定（length>0）；activeModel 双向；cwd 先行校验；newSession 死主清理落盘（deletions）
+- **checkpoint cwdHash 归一化**：`sha1(normalizeCwd(cwd)).slice(0,12)`——CLI/VS Code 快照跨端互通（存量旧路径孤儿化不迁移）
+- **操作并行化纪律提示词条款**（2026-09-01 用户需求）：system.md "How you work — while coding" 段在既有并行条款后追加 "Parallelize aggressively"——独立只读调用一次发起多个（执行器批并行）、多文件编辑用 `edits` 数组（原子一次往返）、独立子代理/独立子项目一次 spawn 多个（F7 触发条件：不共享待改文件 + 无交叉依赖 + 各自有独立测试）；明确不并行边界（同一文件写入/依赖链/bash 审批命令 = 审批风暴/同仓库并发 git/有状态操作）与收益判断（大操作并行、<1s 微操作不并行）。两端 system.md byte-identical，测试同步断言
+
+### Fixed
+
+- **hex-escape 毒载荷 400**（deepseek-v4-flash 实测）：发送前统一中和字面 `\\x`/`\\u` 不足位序列（escape.mjs，VS Code 同构）
+
 ## [0.12.52] — 2026-08-31
 ## [0.12.53] — 2026-08-31
 

package/bin/thincoder.mjs

@@ -17,7 +17,7 @@ import { join } from "node:path"
 import { runAgent } from "../src/agent.mjs"
 import { loadConfig, configPath } from "../src/config.mjs"
 import { createMemory, syncDir } from "../src/memory.mjs"
-import { assembleAgent, teamConfig, gitAuthor } from "../src/cli/make-agent.mjs"
+import { assembleAgent, teamConfig, gitAuthor, validateProvider } from "../src/cli/make-agent.mjs"
 import { memoryCommand } from "../src/cli/memory-command.mjs"
 import { setupWizard } from "../src/cli/setup-wizard.mjs"
 import { summarize, askPermission } from "../src/cli/permission.mjs"
@@ -79,6 +79,13 @@ switch (command) {
     }
 
     const agent = await assembleAgent()
+    // SESSION.md §8 D-S4（F4）：headless 无 TUI —— 可读错误 + 退出码 1，不弹 UI、不崩溃
+    if (agent._providerInvalid) {
+      const prov = agent.activeProvider || "(未设置)"
+      console.error(`[error] 未配置有效 provider（activeProvider "${prov}"：${agent._providerInvalidReason}）。请运行 thincoder 进入 TUI 重新选择，或编辑 ${configPath}`)
+      exitSoon(1)
+      break
+    }
     if (!agent.provider.apiKey) {
       if (!process.stdin.isTTY) {
         console.error(noKeyMessage())
@@ -219,6 +226,9 @@ switch (command) {
   case "tui":
   case undefined: {
     const agent = await assembleAgent()
+    // SESSION.md §8 D-S1：TUI 路径在 startTUI 前清空无效 provider——空 provider 不流入 runAgent
+    // （崩溃源：chat() 缺 model → 网关 400 或 fetch("undefined/...") TypeError）
+    if (agent._providerInvalid) agent.provider = null
     const config = loadConfig()
     // 恢复上次的会话（同一项目目录）；provider 按保存的名字切回（用户上次可能换过模型）
     const { loadSession, applySession } = await import("../src/session.mjs")
@@ -226,11 +236,15 @@ switch (command) {
     if (restored) {
       const switched = applySession(agent, restored)
       if (switched && agent.config?.agent?.compactThresholdAuto) {
-        // 压缩阈值跟模型走（与 TUI 切换 provider 时的处理一致）
+        // 压缩阈值跟模型走（与 TUI 切换 provider 时的处理一致）；传 provider 对象——
+        // providers[].context 覆盖生效（PROVIDER.md §15 T-C2）
         const { resolveCompactThreshold } = await import("../src/config.mjs")
-        agent.config.agent.compactThreshold = resolveCompactThreshold(null, agent.provider.model).value
+        agent.config.agent.compactThreshold = resolveCompactThreshold(null, agent.provider).value
       }
     }
+    // D-S3 优先级补全：applySession 可能已用会话中的有效 provider 修复（config 无效 + 会话有效）——
+    // 修复后复验清除标记，仅当两者都无效才弹重选（validateProvider 幂等）
+    if (agent._providerInvalid) validateProvider(agent)
     // MCP 连接失败在 TUI alt-buffer 下 stderr 不可见，注入为下一条 user 消息后的提醒
     if (agent._mcpWarnings?.length) {
       agent._pendingReminders = agent._pendingReminders ?? []

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.12.53",
+  "version": "0.12.58",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",
@@ -33,13 +33,9 @@
   "scripts": {
     "test": "node --test \"test/*.test.mjs\"",
     "prepublishOnly": "npm run lint && node --test \"test/*.mjs\"",
-    "lint": "eslint src test",
+    "lint": "node scripts/check-syntax.mjs",
     "test:full": "node test/run-full.mjs"
   },
   "author": "liwei <liwei@51marine.com> (上海新舶)",
-  "license": "MIT",
-  "devDependencies": {
-    "eslint": "^9.0.0",
-    "@eslint/js": "^9.0.0"
-  }
+  "license": "MIT"
 }

package/src/acp/bridge.mjs

@@ -73,7 +73,7 @@ export function buildAcpCallbacks({ sessionId, notify, request, log = () => {} }
       // D7 (AGENT-LOOP.md §7.2): strip ⟦ev⟧ event tokens (bare or prefixed variants) —
       // they carry RS control characters and are a TUI display signal; structured ACP
       // mapping (tool_call_update) is tracked separately in docs/TODO.md.
-  // eslint-disable-next-line no-control-regex -- 有意为之：控制字符协议/转义序列剥离正则（ANSI/⟦ev⟧/SGR/history 双线分隔）
+  // 有意为之：控制字符协议/转义序列剥离正则（ANSI/⟦ev⟧/SGR/history 双线分隔）
       if (/^(?:[\w-]+#\d+\/)?⟦ev⟧(?:turn|approval)\x1e/.test(text)) return
       update("agent_message_chunk", { content: { type: "text", text } })
     },

package/src/acp.mjs

@@ -19,28 +19,15 @@ import { assembleAgent } from "./cli/make-agent.mjs"
 import { createAcpServer, ACP_ERRORS } from "./acp/transport.mjs"
 import { createAcpSession } from "./acp/session.mjs"
 import { replayHistory } from "./acp/bridge.mjs"
-import { listSlots, applySession, deleteSlot, sessionPath, normalizeCwd, isLegacyTransient } from "./session.mjs"
+import { listSlots, applySession, deleteSlot, normalizeCwd, loadSlotFile, slotOccupancy, loadManifest, saveManifest, getSessionId, newSession } from "./session.mjs"
 import { createCheckpoint, listCheckpoints, rewind, isGitRepo } from "./git/checkpoint.mjs"
 import { createMemory, list as memList, remove as memRemove } from "./memory.mjs"
 
 const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version
 
 /** Load a specific slot file (not the active one) — session/load by id.
- *  Same validation as loadSession: version 1/2, cwd match, legacy-transient
- *  filtering (pre-filtering slot files must not leak machine lines into replay). */
-function loadSlotFile(cwd, slot) {
-  const path = `${sessionPath(cwd)}.${slot}`
-  try {
-    const data = JSON.parse(readFileSync(path, "utf8"))
-    if (data?.version !== 1 && data?.version !== 2) return null
-    if (!Array.isArray(data.history)) return null
-    if (data.cwd && normalizeCwd(data.cwd).toLowerCase() !== normalizeCwd(cwd).toLowerCase()) return null
-    data.history = data.history.filter((m) => !isLegacyTransient(m))
-    return data
-  } catch {
-    return null
-  }
-}
+ *  2026-08-31 会诊 deepseek 🟡：改用 session.mjs 共享 loadSlotFile（校验/保现场/.tmp
+ *  回退与主路径一致）——本地实现此前无 .unreadable/.corrupted 保留。 */
 
 /**
  * Apply a session-level config option to the agent instance (memory only —
@@ -160,6 +147,11 @@ export function buildAcpHandlers({
           const id = String(nextId++)
           const session = await createSession({ id, notify: notifyRef.current, request: requestRef.current, log })
           // `id` is immutable after construction (baked into the callbacks) — never reassign.
+          // 2026-09-01 会诊 kimi/glm 🔴：立即认领独立槽（对齐 cmd-new）——否则首回合保存
+          // 走 _slot ??= activeSlot() → ensureActive 早退分支（slotSessions[active]===
+          // mySessionId 同进程恒真）→ 第二个会话拿到与第一个相同的槽号 → 双写同槽
+          // F2 互旋。getSessionId() 是进程级，_slot 是 agent 级——粒度错配必须在此切断。
+          session.agent._slot = newSession(getCwd())
           sessions.set(id, session)
           return { id, configOptions: [{ configId: "model" }, { configId: "thinking" }, { configId: "mode" }] }
         } catch (e) {
@@ -185,6 +177,7 @@ export function buildAcpHandlers({
       },
 
       "session/cancel": (params) => {
+        if (!authenticated) return { error: ACP_ERRORS.AUTH_REQUIRED } // 2026-08-31 advisor round2 🔵：与其他 handler 一致
         const found = findSession(params)
         if (found.error) return found
         found.session.cancel()
@@ -192,6 +185,7 @@ export function buildAcpHandlers({
       },
 
       "session/close": (params) => {
+        if (!authenticated) return { error: ACP_ERRORS.AUTH_REQUIRED } // 2026-08-31 advisor round2 🔵：与其他 handler 一致
         const found = findSession(params)
         if (!found.error) {
           // Abort any in-flight turn first — the client is gone, the agent must
@@ -233,11 +227,33 @@ export function buildAcpHandlers({
           const id = String(nextId++)
           const session = await createSession({ id, notify: notifyRef.current, request: requestRef.current, log })
           applySession(session.agent, data)
+          // 2026-08-31 advisor round2 🟡：钉 _slot 前查活主——目标槽被另一活进程（CLI/另一
+          // IDE）占用时不得钉回（双方 sessionStart 一致 → F2 永不轮转 → 同槽 last-write-wins
+          // 静默互覆盖）。空闲则认领后钉回；占用则不钉 → 下次保存经 activeSlot 自然 fork
+          // 到新槽（与 switchToSlot 的"占用则 fork"语义对齐）。
+          const occ = slotOccupancy(getCwd(), slot)
+          // 2026-09-01 会诊 kimi/glm 🔴：同进程双会话同槽——slotOccupancy 排除本进程属主后，
+          // 同进程防护完全由 sameProcessPinned 承担：本进程另一 session 已钉该槽即视为占用
+          // （进程级属主无法区分 agent，双方 sessionStart 相同 → F2 永不触发 → 静默互覆盖）。
+          const sameProcessPinned = [...sessions.values()].some((s) => s.agent?._slot === slot)
+          if (!occ.occupied && !sameProcessPinned) {
+            const m = loadManifest(getCwd())
+            m.slotSessions ??= {}
+            m.slotSessions[slot] = getSessionId()
+            saveManifest(getCwd(), m)
+            session.agent._slot = slot
+          } else {
+            // 2026-09-01 advisor 🔴：占用时显式分配全新槽（fork）——原 `_slot = null` 的
+            // fork 会经 saveSession → activeSlot → ensureActive 分支1 早退（slotSessions
+            // [active] === mySessionId 同进程恒真）落回同进程 active 槽 → 两会话写同一槽
+            // 静默互覆盖。newSession 跳过活认领号/现存文件号，必定落到新槽。
+            session.agent._slot = newSession(getCwd())
+          }
           sessions.set(id, session)
           // Replay the human line (role → chunk mapping, design §4.5) so the
           // client renders the restored conversation.
           replayHistory({ sessionId: id, notify: notifyRef.current, history: data.history, log })
-          log(`session ${slot} loaded as session ${id} (${data.history?.length ?? 0} messages replayed)`)
+          log(`session ${slot} loaded as session ${id} (${data.history?.length ?? 0} messages replayed)${occ.occupied || sameProcessPinned ? ` — slot busy, forked to ${session.agent._slot}` : ""}`)
           return { id, cwd: getCwd(), configOptions: [{ configId: "model" }, { configId: "thinking" }, { configId: "mode" }] }
         } catch (e) {
           return { error: { code: ACP_ERRORS.INTERNAL.code, message: `failed to load session ${slot}: ${e.message}` } }
@@ -258,9 +274,25 @@ export function buildAcpHandlers({
           const id = String(nextId++)
           const session = await createSession({ id, notify: notifyRef.current, request: requestRef.current, log })
           applySession(session.agent, data)
+          // 2026-08-31 advisor round2 🟡：同 session/load——活主占用的槽不钉回（防同槽双写，
+          // 下次保存 fork 新槽）；空闲则认领后钉回。
+          const occ = slotOccupancy(getCwd(), slot)
+          // 2026-09-01 会诊 kimi/glm 🔴：同 session/load——同进程其他 session 已钉同槽视为占用 → fork
+          const sameProcessPinned = [...sessions.values()].some((s) => s.agent?._slot === slot)
+          if (!occ.occupied && !sameProcessPinned) {
+            const m = loadManifest(getCwd())
+            m.slotSessions ??= {}
+            m.slotSessions[slot] = getSessionId()
+            saveManifest(getCwd(), m)
+            session.agent._slot = slot
+          } else {
+            // 2026-09-01 advisor 🔴：同 load——显式 newSession fork（_slot=null 的 fork 会
+            // 落回同进程 active 槽 → 两会话写同一槽静默互覆盖）
+            session.agent._slot = newSession(getCwd())
+          }
           sessions.set(id, session)
           // resume: no history replay — the client keeps its own rendering.
-          log(`session ${slot} resumed as session ${id} (no replay)`)
+          log(`session ${slot} resumed as session ${id} (no replay)${occ.occupied || sameProcessPinned ? ` — slot busy, forked to ${session.agent._slot}` : ""}`)
           return { id, cwd: getCwd(), configOptions: [{ configId: "model" }, { configId: "thinking" }, { configId: "mode" }] }
         } catch (e) {
           return { error: { code: ACP_ERRORS.INTERNAL.code, message: `failed to resume session ${slot}: ${e.message}` } }
@@ -278,6 +310,16 @@ export function buildAcpHandlers({
         if (!deleteSlot(getCwd(), slot)) {
           return { error: { ...ACP_ERRORS.INVALID_PARAMS, message: `session ${slot} not found` } }
         }
+        // 2026-08-31 会诊 deepseek 🟡：被删槽的在存会话 _slot 仍钉着 → 下次保存会重建
+        // 文件并重注册（删后复活）。清空其 _slot，下次保存重新认领新槽。
+        // 2026-09-01 advisor round2 🔴：不能清 _slot 等下次保存——saveSession 走
+        // activeSlot → ensureActive 分支1 早退（slotSessions[active] === mySessionId 同
+        // 进程恒真）→ 落回同进程 active 槽（另一在存会话的槽）→ 两会话写同一槽静默
+        // 互覆盖（sessionStart 均 null → F2 永不轮转）。与 load/resume 同型修复：
+        // 立即 newSession 钉全新槽（跳过活认领号/现存文件号）。
+        for (const s of sessions.values()) {
+          if (s.agent?._slot === slot) s.agent._slot = newSession(getCwd())
+        }
         log(`session ${slot} archive deleted`)
         return {}
       },

package/src/advisor/messages.mjs

@@ -5,7 +5,7 @@
  */
 import { readFileSync, existsSync } from "node:fs"
 import { resolve, join, relative, dirname, sep } from "node:path"
-import { specForModel } from "../config.mjs"
+import { providerSpec } from "../config.mjs"
 import { findReviewRepos, collectRepoSnapshots, collectChangedFiles } from "./repos.mjs"
 import { buildConvergenceBody, buildConvergenceInstructions } from "./convergence.mjs"
 import { loadAdvisorMd, extractConversationBackground, extractAgentResponseTable } from "./history.mjs"
@@ -90,7 +90,9 @@ function injectProjectGuide(agent, parts, scopeFiles = []) {
   }
   // readFileSync succeeded — compute the budget OUTSIDE the try so a spec
   // lookup failure can never masquerade as "no AGENTS.md".
-  const ctx = specForModel(agent.provider?.model ?? "").context
+  // providerSpec: the project-guide budget follows the provider-level context
+  // override (PROVIDER.md §15 — advisor messages budget is context-based).
+  const ctx = providerSpec(agent.provider).context
   const cap = Math.max(PROJECT_GUIDE_MIN, Math.floor(ctx * PROJECT_GUIDE_FRACTION))
   const shown = text.length <= cap
     ? text

package/src/advisor/run.mjs

@@ -3,7 +3,7 @@
  * Message building lives in advisor.mjs.
  */
 import { chat } from "../provider/core.mjs"
-import { findProvider, specForModel } from "../config.mjs"
+import { findProvider, providerSpec } from "../config.mjs"
 import { toOpenAISchema } from "../tools/index.mjs"
 import { prepareAdvisorMessages } from "../advisor.mjs"
 import { appendCitationReport } from "./citations.mjs"
@@ -221,7 +221,7 @@ async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, c
         id: tc.id, type: "function",
         function: { name: tc.name, arguments: tc.arguments },
       })),
-      ...(response.reasoning && specForModel(provider.model).reasoningEcho === "required"
+      ...(response.reasoning && providerSpec(provider).reasoningEcho === "required"
         ? { reasoning_content: response.reasoning }
         : {}),
     })

package/src/agent/dispatch.mjs

@@ -46,7 +46,12 @@ function logToolError(toolName, args, error) {
  */
 export async function executeToolCalls(agent, toolByName, toolCalls, callbacks, depth = 0, signal) {
   // ---- Phase 1: serial preparation ----
+  // Pre-gates run per tool (parse/planMode/engineering gates); non-readonly tools
+  // that REACH the permission stage are collected into one batch — a single merged
+  // ask covers the whole toolCalls array (§16 D-B1, "approve all / one by one /
+  // deny"). Tools stopped by a pre-gate never join the batch (review #7).
   const prepared = []
+  const permPending = [] // { toolCall, tool, args } — reached the permission stage
   for (const toolCall of toolCalls) {
     const tool = toolByName.get(toolCall.name)
     let args
@@ -106,39 +111,74 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       }
     }
 
-    if (!tool.readonly) {
-      // autoApprove short-circuit: skip prompt when agent is already marked for auto-approval
-      const allowed = agent.autoApprove
-        ? true
-        : callbacks.onPermissionRequest
-          ? await (async () => {
-              // D2 (AGENT-LOOP.md §7.2): announce the wait BEFORE prompting — the TUI
-              // subagent block header flips to "等待审批" so a waiting child is visibly
-              // different from a stalled one. Depth>0 only (the parent TUI shows its own
-              // permission panel). turn n/max = the child's live turn counters.
-              if (depth > 0) {
-                callbacks.onToken?.(`⟦ev⟧approval\x1e${agent._currentTurn ?? 0}\x1e${agent._maxTurns ?? 0}\x1eapproval\x1e${String(toolCall.name).slice(0, 40)}`)
-              }
-              return await callbacks.onPermissionRequest(toolCall.name, args)
-            })()
-          : false
-      if (!allowed) {
-        prepared.push({ toolCall, tool, denied: true, reason: callbacks.onPermissionRequest ? "denied by user" : "no permission handler" })
+    // Readonly tools (and autoApprove — the short-circuit, unchanged for the
+    // whole batch too) skip the permission stage entirely.
+    if (tool.readonly || agent.autoApprove) {
+      if (!(await runHooks("PreToolUse", { agent, toolName: toolCall.name, toolArgs: args }))) {
+        prepared.push({ toolCall, tool, denied: true, reason: "blocked by PreToolUse hook" })
         continue
       }
-    }
-
-    // PreToolUse hooks: allow user scripts to gate tool execution
-    if (!(await runHooks("PreToolUse", { agent, toolName: toolCall.name, toolArgs: args }))) {
-      prepared.push({ toolCall, tool, denied: true, reason: "blocked by PreToolUse hook" })
+      // Panel area abolished — all tools now stream inline via onToolOutput.
+      callbacks.onToolCall?.(toolCall.name, args, toolCall.id)
+      prepared.push({ toolCall, tool, args })
       continue
     }
+    permPending.push({ toolCall, tool, args })
+  }
 
-    // Panel area abolished — all tools now stream inline via onToolOutput.
+  // ---- Permission stage: one merged ask for the whole batch (§16 D-B1) ----
+  // >1 non-readonly tools in the same toolCalls array → a single
+  // onBatchPermissionRequest({ tools, count }) ask; verdicts:
+  //   "approveAll" → batch-scope allowance (autoApprove style, NOT persistent)
+  //   "deny"       → the whole batch is rejected, no second ask
+  //   "oneByOne" (or anything else / no handler) → the existing per-item
+  //     onPermissionRequest channel, signature unchanged (NF-B1: ACP bridge /
+  //     headless / old versions without the new callback are never harmed).
+  if (permPending.length > 0) {
+    let batchAllowed = null // true = approveAll, false = deny, null = per-item fallback
+    if (permPending.length > 1 && callbacks.onBatchPermissionRequest) {
+      const verdict = await callbacks.onBatchPermissionRequest({
+        tools: permPending.map((p) => ({ name: p.toolCall.name, args: p.args })),
+        count: permPending.length,
+      })
+      if (verdict === "approveAll") batchAllowed = true
+      else if (verdict === "deny") batchAllowed = false
+      // anything else (oneByOne/unknown) → fall through to the per-item channel
+    }
+    for (const p of permPending) {
+      let allowed
+      if (batchAllowed === true) allowed = true
+      else if (batchAllowed === false) allowed = false
+      else if (callbacks.onPermissionRequest) {
+        allowed = await (async () => {
+          // D2 (AGENT-LOOP.md §7.2): announce the wait BEFORE prompting — the TUI
+          // subagent block header flips to "等待审批" so a waiting child is visibly
+          // different from a stalled one. Depth>0 only (the parent TUI shows its own
+          // permission panel). turn n/max = the child's live turn counters.
+          if (depth > 0) {
+            callbacks.onToken?.(`⟦ev⟧approval\x1e${agent._currentTurn ?? 0}\x1e${agent._maxTurns ?? 0}\x1eapproval\x1e${String(p.toolCall.name).slice(0, 40)}`)
+          }
+          return await callbacks.onPermissionRequest(p.toolCall.name, p.args)
+        })()
+      } else allowed = false
+      if (!allowed) {
+        prepared.push({
+          toolCall: p.toolCall, tool: p.tool, denied: true,
+          reason: (callbacks.onPermissionRequest || batchAllowed === false) ? "denied by user" : "no permission handler",
+        })
+        continue
+      }
 
-    callbacks.onToolCall?.(toolCall.name, args, toolCall.id)
+      // PreToolUse hooks: allow user scripts to gate tool execution
+      if (!(await runHooks("PreToolUse", { agent, toolName: p.toolCall.name, toolArgs: p.args }))) {
+        prepared.push({ toolCall: p.toolCall, tool: p.tool, denied: true, reason: "blocked by PreToolUse hook" })
+        continue
+      }
 
-    prepared.push({ toolCall, tool, args })
+      // Panel area abolished — all tools now stream inline via onToolOutput.
+      callbacks.onToolCall?.(p.toolCall.name, p.args, p.toolCall.id)
+      prepared.push({ toolCall: p.toolCall, tool: p.tool, args: p.args })
+    }
   }
 
   // ---- Phase 2: order-preserving execution ----

package/src/agent/helpers.mjs

@@ -35,6 +35,17 @@ export const REPORT_CONTINUATION =
 const TOOL_RESULT_OFFLOAD_LIMIT = 64 * 1024 // 65536 chars — offload only above 64K (2026-08-24)
 const TOOL_RESULT_PREVIEW = 64 * 1024 // chars shown inline when offloaded (aligns with CLI/VS Code webview)
 
+/** UTF-16 安全截断（2026-09-02 deepseek 400 根因）：slice(0, N) 按码元切会把 emoji 代理对切成孤立
+ *  高代理（如 🔴=U+D83D+DD34 只剩 D83D）——deepseek 解析器严格 UTF-16 报 400
+ *  "unexpected end of hex escape"。截断点落在高代理上时向前收一个码元。
+ *  与 setup.mjs 的 safeSliceUTF16 同语义（两处独立实现——escape.mjs 的 sanitizeLoneSurrogates 是发送兜底，此处是源头）。 */
+function safeSliceUTF16(text, max) {
+  if (text.length <= max) return text
+  const cp = text.charCodeAt(max - 1)
+  if (cp >= 0xd800 && cp <= 0xdbff) return text.slice(0, max - 1)
+  return text.slice(0, max)
+}
+
 /** Offload-dir write-time self-cleanup retention window (2026-08-21): files older than 3 days are deleted on the next offload. */
 export const TMP_RETENTION_MS = 3 * 24 * 3600 * 1000
 
@@ -87,12 +98,12 @@ export async function offloadToolResult(text, callId, dir = join(configDir, "too
     const file = join(dir, `${Date.now()}-${String(callId).replace(/[^a-zA-Z0-9_-]/g, "_")}.log`)
     await writeFile(file, text, "utf8")
     return (
-      text.slice(0, TOOL_RESULT_PREVIEW) +
+      safeSliceUTF16(text, TOOL_RESULT_PREVIEW) +
       `\n\n[... output too large (${text.length} chars total), full content saved to: ${file}\n` +
       `Page through it with the read tool (offset/limit) or sed -n 'START,ENDp' — do NOT re-run the tool blindly.]`
     )
   } catch {
-    return text.slice(0, TOOL_RESULT_OFFLOAD_LIMIT) + `\n\n[... truncated: ${text.length} chars total, offload to disk failed]`
+    return safeSliceUTF16(text, TOOL_RESULT_OFFLOAD_LIMIT) + `\n\n[... truncated: ${text.length} chars total, offload to disk failed]`
   }
 }
 

package/src/agent/setup.mjs

@@ -22,6 +22,17 @@ import { fileURLToPath } from "node:url"
 const DEFAULT_COMPACT_THRESHOLD = 100_000
 const DOC_SEARCH_LIMIT = 5
 const DOC_CHUNK_PREVIEW_LEN = 300
+/** UTF-16 安全截断（2026-09-02 deepseek 400 根因）：slice(0, N) 按码元切会把 emoji 代理对切成孤立
+ *  高代理（如 🔴=U+D83D+DD34 只剩 D83D）——deepseek 解析器严格 UTF-16 报 400
+ *  "unexpected end of hex escape"。截断点落在高代理上时向前收一个码元。 */
+function safeSliceUTF16(text, max) {
+  if (text.length <= max) return text
+  const end = max
+  // 截断点恰在高代理（D800-DBFF）上 → 收到高代理之前（不带它）
+  const cp = text.charCodeAt(end - 1)
+  if (cp >= 0xd800 && cp <= 0xdbff) return text.slice(0, end - 1)
+  return text.slice(0, end)
+}
 const MEMORY_SEARCH_LIMIT = 3
 
 /** Build engineering-mode system prompt by reading METHODOLOGY.md and wrapping it in the engineering template */
@@ -114,7 +125,7 @@ export async function prepareRun(agent, input, callbacks, {
           role: "user",
           content:
             `[Relevant documentation${more}:\n` +
-            docs.map((d) => `- ${d.path}${d.heading ? " > " + d.heading : ""}: <untrusted_doc_chunk>${escapeXml(d.content.slice(0, DOC_CHUNK_PREVIEW_LEN))}</untrusted_doc_chunk>`).join("\n") +
+            docs.map((d) => `- ${d.path}${d.heading ? " > " + d.heading : ""}: <untrusted_doc_chunk>${escapeXml(safeSliceUTF16(d.content, DOC_CHUNK_PREVIEW_LEN))}</untrusted_doc_chunk>`).join("\n") +
             "]",
           transient: true,
         })
@@ -148,7 +159,8 @@ export async function prepareRun(agent, input, callbacks, {
     pushReal(agent, { role: "user", content: input })
   }
   // Time grounding for EVERY agent depth AND every resume, pushed LAST (after the user
-  // input): transient, dropped on persist, fresh at every run start — including resumes
+  // input): transient on the HUMAN line — dropped on persist; on the MACHINE line — kept
+  // (byte-identical resume for the provider prefix cache, 2026-08-16), fresh at every run start
   // (an interrupt-continuation must know NOW, not the pre-interrupt time; 2026-08-16).
   // Tail position keeps the second-precision content out of any prefix — caches stay hit.
   agent.history.push({
@@ -168,6 +180,7 @@ export async function prepareRun(agent, input, callbacks, {
   // eng-coder subagents get advisor for mandatory design review before coding
   const { planTool, subagentTool, taskTool, skillTool, goalTool, verifyTool, recentChangesTool, timerTool, advisorTool, engTool } = await import("../agent-tools.mjs")
   const { consultStartTool, consultCheckTool, consultStopTool } = await import("../agent-tools/consult.mjs")
+  const { subagentCheckTool } = await import("../agent-tools/subagent-check.mjs")
   const { escalateTool } = await import("../agent-tools/escalate.mjs")
   const { CONSULT_BASE } = await import("../agent.mjs")
   // withPool: decorate consult_start/escalate descriptions with the CURRENT candidate pool
@@ -211,7 +224,7 @@ export async function prepareRun(agent, input, callbacks, {
   const consultTools = consultModels.length
     ? [withPool(consultStartTool), consultCheckTool, consultStopTool, ...(engineering ? [] : [withPool(escalateTool)])]
     : []
-  const depthOnly = depth === 0 ? [filteredSubagent, skillTool, goalTool, engTool, verifyTool, recentChangesTool, advisorTool, ...consultTools]
+  const depthOnly = depth === 0 ? [filteredSubagent, subagentCheckTool, skillTool, goalTool, engTool, verifyTool, recentChangesTool, advisorTool, ...consultTools]
     // Write-permission coder sub-agents (subagent role="coder" + escalate): the
     // system prompt names verify (system.md) and advisor (discipline.md) — without them an
     // escalate hit "unknown tool" and fell back to bash node --check / npm test to

package/src/agent/spawn-child.mjs

@@ -51,7 +51,9 @@ export function makeRelay(parent, label, emit, model) {
 // Single source for the event grammar branch lists (consult P3, 2026-08-30):
 // stripEventToken (display) and stripEventTokensForCapture (capture) shared them
 // literally — extending the event set meant touching both regexes.
-const EVENT_PHASE = "turn|approval"
+// "done" = §15 D-A3 async-child completion event (emitted by the parent's
+// turn-end collection, not by children — listed so the grammar stays honest).
+const EVENT_PHASE = "turn|approval|done"
 const EVENT_TYPE = "llm|tool|approval|done"
 const WELL_FORMED_EVENT = new RegExp(`^${EVENT_SENTINEL}(${EVENT_PHASE})${RS}[^${RS}]*${RS}[^${RS}]*${RS}(${EVENT_TYPE})${RS}`)
 export function stripEventToken(text) {

package/src/agent-tools/advisor.mjs

@@ -130,7 +130,12 @@ export const advisorTool = {
     // Generate the design token BEFORE the review and inject it into the advisor's prompt.
     // The advisor (LLM) decides pass/fail itself and echoes the token only on approval —
     // the gate is a mechanical string match, not fragile semantics parsing.
+    // A random designId is minted for EVERY design-review call (2026-09-01 multi-design
+    // slots): on pass the token is stored in parent._engDesignTokens keyed by this id and
+    // the id is echoed to the parent; on failure the id is dropped — never stored, so it
+    // cannot clobber any other design's slot. Not a document anchor (rejected 2026-08-31).
     const designToken = reviewType === "design" ? generateDesignToken(agent) : null
+    const designId = reviewType === "design" ? randomUUID() : null
     const result = await runAdvisorReview(agent, reviewType, {
       onOutput: ctx.onOutput,
       signal: ctx.signal,
@@ -144,6 +149,11 @@ export const advisorTool = {
       if (designToken && result && tokenPattern.test(result)) {
         // Advisor echoed the token → review passed. Issue it to the parent for eng-coder.
         // (session cleanup for design reviews is owned by runAdvisorReview)
+        // Multi-design slots (2026-09-01): store under this review's designId; the single
+        // `_engDesignToken` mirror stays for the legacy boolean gates (dispatch "has token",
+        // session persistence) — key decision ② of ENGINEERING-MODE.md §7 2026-09-01.
+        agent._engDesignTokens ??= new Map()
+        agent._engDesignTokens.set(designId, designToken)
         agent._engDesignToken = designToken
         // Unlock the dispatch design gate (dispatch.mjs) for eng-coder SELF-review:
         // an eng-coder whose own design review passed may write files without the
@@ -156,16 +166,16 @@ export const advisorTool = {
         if (agent._role === "eng-coder") agent._engDesignReviewed = true
         // Strip the bracketed token so only ONE unambiguous format (plain UUID) reaches the main agent
         const cleanResult = result.replace(makeDesignTokenRegex(designToken, "g"), "").trim()
-        return `${cleanResult}\n\nApproved. Pass this exact token to eng-coder (designToken parameter): ${designToken}`
+        // designId rides the Approved block (review #1): the parent needs it to aim the FIRST
+        // eng-coder spawn when several designs live in the same session.
+        return `${cleanResult}\n\nApproved. Pass this exact token to eng-coder (designToken parameter): ${designToken}\ndesignId: ${designId} (pass as the designId parameter when spawning eng-coder; optional while this session holds a single design)`
       }
-      // Review failed (or advisor chose not to pass) → invalidate any previously-issued token.
-      // Guards (v2 2026-08-25): result === null means the review was SKIPPED (advisor disabled /
-      // not engineering mode) — must not revoke. An error reply (own "Advisor:" prefix — the
-      // error-return convention of runAdvisorReview) is a provider crash/timeout artifact, not
-      // a completed verdict — a network glitch must not revoke unrelated standing tokens.
-      // Only a COMPLETED review that did not pass revokes.
-      const isCompletedReview = result !== null && !result.startsWith("Advisor:")
-      if (isCompletedReview) agent._engDesignToken = null
+      // Review failed (or advisor chose not to pass) → do NOT touch ANY slot (方案 ②, review #2:
+      // a failed RE-review leaves the previously approved token alive until TTL; the failed call's
+      // own designId was never stored, so there is nothing to clear). Isolation (2026-08-30,
+      // extended to the multi-slot Map 2026-09-01): a network glitch must not clear / other
+      // designs' slots must not be affected — only a COMPLETED non-passing review lands here,
+      // and it revokes nothing.
       // Strip every dead token occurrence from the raw output so the main agent can't grab an invalid one
       if (result) {
         const stripped = result.replace(makeDesignTokenRegex(designToken, "g"), "").trim()