thincoder 0.12.53 → 0.12.58

package/src/config.mjs

@@ -78,8 +78,8 @@ export const DEFAULTS = {
 // Model capability table + spec lookup live in model-specs.mjs (2026-08-31
 // extract — config.mjs had grown past the 300-line advisory). Re-exported here
 // so the 23 existing importers keep their import paths.
-import { specForModel } from "./model-specs.mjs"
-export { specForModel }
+import { specForModel, providerSpec } from "./model-specs.mjs"
+export { specForModel, providerSpec }
 
 
 // Window utilization threshold: compacts at 60% context, reserving 40% headroom
@@ -87,10 +87,14 @@ export { specForModel }
 // memory/doc search results) which can consume 30-50K tokens each turn.
 const COMPACT_RATIO = 0.6
 
-/** Derive compaction threshold; explicit is the value explicitly set in config file (takes priority), otherwise auto-computed from model */
-export function resolveCompactThreshold(explicit, model) {
+/** Derive compaction threshold; explicit is the value explicitly set in config file (takes priority), otherwise auto-computed from model.
+ *  Second param accepts EITHER a model name string (pure spec lookup — legacy caller:
+ *  first-run wizard) OR a provider object (providerSpec — the providers[].context
+ *  override in K units is honored, PROVIDER.md §15 T-C2). */
+export function resolveCompactThreshold(explicit, modelOrProvider) {
   if (explicit != null) return { value: explicit, auto: false }
-  const spec = specForModel(model)
+  const provider = typeof modelOrProvider === "string" ? { model: modelOrProvider } : (modelOrProvider ?? {})
+  const spec = providerSpec(provider)
   const value = Math.floor(spec.context * COMPACT_RATIO)
   return { value, auto: true }
 }
@@ -125,6 +129,9 @@ export function resolveEnableThinking(provider, spec) {
   return undefined
 }
 
+/** Module-level one-time warn dedupe for invalid providers[].context (PROVIDER.md §15 D-C1). */
+const warnedContextProviders = new Set()
+
 /**
  * Find provider by name in providers[].
  * Throws if name is non-empty but not found — a typo in activeProvider silently falling to the first provider would use the wrong key on the wrong endpoint.
@@ -190,6 +197,19 @@ export function loadConfig() {
     embedding: { ...DEFAULTS.embedding, ...config.embedding },
   }
 
+  // providers[].context (K units, PROVIDER.md §15 D-C1): positive integer only — invalid
+  // values (0/negative/non-numeric) are IGNORED (spec value applies) with a ONE-TIME warn
+  // per provider name (module-level dedupe, same precedent as warnedModels in model-specs.mjs).
+  for (const p of merged.providers) {
+    if (p.context === undefined) continue
+    if (Number.isInteger(Number(p.context)) && Number(p.context) > 0) { p.context = Number(p.context); continue } // 数字字符串（"128"）归一为数字——两端语义统一（code review #1）
+    if (!warnedContextProviders.has(p.name ?? "(unnamed)")) {
+      warnedContextProviders.add(p.name ?? "(unnamed)")
+      console.warn(`[config] provider "${p.name}" context must be a positive integer in K units (e.g. 128 = 128K) — got ${JSON.stringify(p.context)} — ignored, using the model spec value`)
+    }
+    delete p.context
+  }
+
   // Consult/escalate pool validation (CLI parity with the plugin): up to 5 candidates.
   const cm = merged.agent.consultModels
   if (cm !== undefined && !Array.isArray(cm)) {
@@ -227,7 +247,16 @@ export function loadConfig() {
   merged.proxy = normalizeProxy(merged.proxy)
 
   // Get the currently active provider
-  const active = findProvider(merged.providers, merged.activeProvider)
+  // 2026-09-02 Q1（SESSION.md §8）：activeProvider 指向不存在的 provider 不再抛错——runtimeProvider
+  // 置空对象，由 make-agent.mjs assembleAgent 后的校验打 `_providerInvalid` 标记 → TUI 引导重选 /
+  // headless 报可读错误（原 findProvider throw 直接击穿 loadConfig → uncaughtException 退出）。
+  // findProvider 的 throw 契约保留（advisor/run.mjs 等直接调用方仍依赖）。
+  let active
+  try {
+    active = findProvider(merged.providers, merged.activeProvider)
+  } catch {
+    active = {}
+  }
 
   // Build runtime provider object (for agent.provider usage)
   const runtimeProvider = { ...active }
@@ -236,20 +265,103 @@ export function loadConfig() {
   if (merged.activeModel) runtimeProvider.model = merged.activeModel
   merged.activeModel = merged.activeModel || null  // normalize for agent.activeModel
 
-  // Compaction threshold follows the model
+  // Compaction threshold follows the model (provider-level context override honored — providerSpec)
   const explicitThreshold = config.agent?.compactThreshold
-  const { value, auto } = resolveCompactThreshold(explicitThreshold, runtimeProvider.model)
+  const { value, auto } = resolveCompactThreshold(explicitThreshold, runtimeProvider)
   merged.agent.compactThreshold = value
   merged.agent.compactThresholdAuto = auto
 
   // Write back to merged for convenient access by upper layers
   merged.provider = runtimeProvider
+  // fetch 超时可配置（2026-09-01：agent.fetchTimeoutMs——provider/core.mjs effectiveFetchTimeoutMs 消费）
+  runtimeProvider.fetchTimeoutMs = Number.isFinite(merged.agent?.fetchTimeoutMs) && merged.agent.fetchTimeoutMs > 0
+    ? merged.agent.fetchTimeoutMs : undefined
   merged.providersList = merged.providers
   merged.advisor = { ...merged.agent.advisor }  // promote for consistent access (decoupled copy)
 
   return merged
 }
 
+/**
+ * MCP.md §5 D-3 (2026-09-01): re-read config.json and replace ONLY the agent's mcp section
+ * — the agent 代配 closed loop (agent edits config.json with its edit tool, /mcp picks it
+ * up). Never touches other config sections (providers/activeProvider stay as loaded).
+ *
+ * Malformed disk config → memory state kept, { ok:false, error } returned (the /mcp menu
+ * shows "⚠ disk config unreadable"). Never throws.
+ *
+ * 对账 (reconciliation, MCP.md §5 D-3 / T23): returns which disk servers CHANGED
+ * (fingerprint differs) or are DELETED from disk while still connected — fingerprint =
+ * endpoint + token + headers/env key order. Existing connections are NOT torn down (an
+ * in-use server must not be dropped): a deleted-but-connected server KEEPS its memory
+ * entry (appended after the disk list) so the /mcp list can still show the row with the
+ * "⚠ disk changed" mark. A server that is merely NEW on disk is not drift. persistRaw
+ * write + reload is idempotent (fingerprints equal → no drift mark).
+ *
+ * @param path optional config path override (tests inject a tmp file; default configPath)
+ */
+export function reloadMcpFromDisk(agent, path) {
+  const memoryServers = Array.isArray(agent.config?.mcp?.servers) ? agent.config.mcp.servers : []
+  const fileExists = existsSync(path ?? configPath)
+  const diskMcp = readMcpSection(path)
+  if (!diskMcp.ok) return { ok: false, error: diskMcp.error, changedNames: [] }
+  // Missing/deleted config file → keep whichever mcp servers the session had (never
+  // silently drop user servers because the file vanished — same memory-keeps policy
+  // as the malformed-disk fallback).
+  let diskServers = diskMcp.servers
+  if (diskServers.length === 0 && !fileExists) diskServers = memoryServers
+  // Drift vs the RAW disk list: fingerprint-changed or deleted-from-disk (T23 ⚠ 标记依据)
+  const diskNames = new Set(diskServers.filter((s) => s?.name).map((s) => s.name))
+  const changedNames = diffMcpServers(memoryServers, diskServers)
+  // Connected servers deleted from disk stay in the list (memory copy) — T23: the row
+  // must remain visible (marked ⚠) and its live connection untouched. They are already
+  // in changedNames (absent from disk), and stay flagged on every reload until the user
+  // reconnects (re-persists them) or removes them — real drift, honestly reported.
+  const connectedNames = new Set((agent.tools ?? []).filter((t) => t?._mcpName).map((t) => t._mcpName))
+  const keptConnected = memoryServers.filter((s) => s?.name && connectedNames.has(s.name) && !diskNames.has(s.name))
+  const finalServers = [...diskServers, ...keptConnected]
+  agent.config ??= {}
+  agent.config.mcp = { ...agent.config.mcp, servers: finalServers }
+  return { ok: true, servers: finalServers, changedNames }
+}
+
+/** Disk read behind reloadMcpFromDisk — bounded, never throws. */
+function readMcpSection(path = configPath) {
+  try {
+    if (!existsSync(path)) return { ok: true, servers: [] }
+    const raw = JSON.parse(readFileSync(path, "utf8"))
+    const servers = raw?.mcp?.servers
+    if (servers !== undefined && !Array.isArray(servers)) return { ok: true, servers: [] }
+    return { ok: true, servers: Array.isArray(servers) ? servers : [] }
+  } catch (error) {
+    return { ok: false, error: error?.message ?? String(error) }
+  }
+}
+
+/** Fingerprint = endpoint + token + headers/env entries in key order (JSON.stringify
+ *  of a normalized subset — key order included, matching connectMcpServer's
+ *  configFingerprint semantics: any change the connect layer would see counts).
+ *  Drift = CHANGED (fingerprint differs) or DELETED (missing from disk) — a server
+ *  that is new on disk is not drift (no live connection to protect). */
+function diffMcpServers(memoryServers, diskServers) {
+  const memFp = new Map(memoryServers.filter((s) => s?.name).map((s) => [s.name, mcpFingerprint(s)]))
+  const diskFp = new Map(diskServers.filter((s) => s?.name).map((s) => [s.name, mcpFingerprint(s)]))
+  const changed = []
+  for (const [name, fp] of diskFp) if (memFp.has(name) && memFp.get(name) !== fp) changed.push(name)
+  for (const name of memFp.keys()) if (!diskFp.has(name)) changed.push(name)
+  return changed
+}
+
+function mcpFingerprint(s) {
+  return JSON.stringify([
+    s.wsUrl ?? s.url ?? s.command ?? null,
+    s.args ?? null,
+    s.token ?? null,
+    s.headers ?? null,
+    s.env ?? null,
+  ])
+}
+
 /**
  * Save configuration. Preserves providers list structure and activeProvider pointer.
  * providers[i].apiKey is only written when explicitly passed in (does not overwrite env-var-fallback keys).

package/src/context.mjs

@@ -11,7 +11,7 @@
 
 import { chat } from "./provider/index.mjs"
 import { estimateText } from "./provider/rate.mjs"
-import { specForModel } from "./config.mjs"
+import { providerSpec } from "./config.mjs"
 
 const IMAGE_TOKEN_ESTIMATE = 2000 // rough estimate for image content tokens (CLI legacy 256 underestimated real image costs, delaying compaction)
 
@@ -41,10 +41,11 @@ const KEEP_HEAD = 0 // No dedicated head: earliest messages may be a COMPLETED e
 // capped at 40% of history so small histories don't over-reserve. Window-adaptive
 // replaces the old fixed 10: on a 1M window, 10 messages is too thin for recent work.
 function keepTailSize(provider, historyLen) {
-  // provider is guaranteed at every call site (runAgent always builds one); specForModel
-  // degrades to DEFAULT_SPEC (128K) only if provider/model is somehow absent — acceptable
-  // because the 40% history cap still bounds the tail.
-  const ctxWindow = specForModel(provider?.model ?? "").context
+  // provider is guaranteed at every call site (runAgent always builds one); providerSpec
+  // degrades to DEFAULT_SPEC (128K) only if provider is somehow absent — acceptable
+  // because the 40% history cap still bounds the tail. providers[].context override
+  // (K units) is honored here (PROVIDER.md §15 T-C2: tail formula follows the window).
+  const ctxWindow = providerSpec(provider).context
   return Math.min(Math.max(10, Math.floor((ctxWindow / 100_000) * 30)), Math.floor(historyLen * 0.4))
 }
 
@@ -195,8 +196,10 @@ function applyCompression(agent, headEnd, tailStart, note) {
  * Automatically re-injects task list state after compaction.
  * @param {object} agent
  * @param {number} threshold - compaction threshold in tokens
- * @param {object} callbacks - { onToken, onReasoning, onCompress } — summary generation is SILENT
- *   (never forwards onToken/onReasoning: the compaction process is an internal mechanism, not a model reply)
+ * @param {object} callbacks - { onToken, onReasoning, onCompress, onCompressStart } — summary
+ *   generation is SILENT (never forwards onToken/onReasoning: the compaction process is an
+ *   internal mechanism, not a model reply); onCompressStart fires right before the summary call
+ *   (§7 D-C1, compression lifecycle visibility — panel start state)
  * @param {object} extras - { systemPrompt?, tools? } — estimated overhead for the pure-estimation
  *   path (no measured baseline); the measured path already includes system+tools in prompt_tokens.
  */
@@ -239,6 +242,11 @@ export async function compressIfNeeded(agent, threshold, callbacks, extras = {},
   // The summary is a plain-text task, no reasoning needed — passing thinking to the compaction provider wastes tokens.
   // Silent by design (D11): no onToken/onReasoning — the compaction process must not stream to the frontend.
   // signal propagates user cancellation (Ctrl+C) to the in-flight summary call.
+  // Compression visibility (CONTEXT-COMPACTION.md §7 D-C1/D-C2): the frontend learns the compression
+  // STARTED right before the LLM call ("Compressing context… / summarizing N messages" panel) — only
+  // the lifecycle is surfaced, never the summary body. N = the number of history messages being summarized.
+  callbacks?.onCompressStart?.({ messages: middle.length })
+  const startedAt = performance.now()
   const summary = await chat({ ...agent.provider, thinking: null, reasoningEffort: null }, {
     messages: [{ role: "user", content: SUMMARIZE_PROMPT + serialized }],
     signal,
@@ -246,6 +254,15 @@ export async function compressIfNeeded(agent, threshold, callbacks, extras = {},
 
   applyCompression(agent, split.headEnd, split.tailStart, COMPACTION_PREFIX + summary.content)
 
+  // Completion info for the compression panel (D-C2): tokens freed = the pre-compression prompt
+  // estimate (`tokens` — the value that tripped the threshold, incl. system/tools overhead on the
+  // pure-estimation path) minus the post-compression estimate on the same basis. Elapsed = the
+  // summary call + splice duration. agent.mjs forwards this to onCompress unchanged.
+  agent._lastCompressInfo = {
+    mode: "summary",
+    tokensFreed: Math.max(0, Math.round(tokens - (estimateTokens(agent.history) + overhead))),
+    elapsedMs: performance.now() - startedAt,
+  }
   return true
 }
 
@@ -257,7 +274,11 @@ export function compressFallback(agent) {
   const keepTail = keepTailSize(agent.provider, agent.history.length)
   const split = splitHistory(agent.history, keepTail)
   if (!split) return false
+  const tailMessages = agent.history.length - split.tailStart
   applyCompression(agent, split.headEnd, split.tailStart, FALLBACK_NOTE)
+  // Fallback completion info (D-C2): mode marks the deterministic-truncation path — the panel
+  // shows the degradation note ("truncated to N messages") ONLY after 3 consecutive failures.
+  agent._lastCompressInfo = { mode: "fallback", tailMessages }
   return true
 }
 

package/src/escape.mjs

@@ -1,36 +1,99 @@
 /**
- * escape.mjs — 中和 OpenAI 兼容服务端在 message content 内做的非标二次转义解析。
+ * escape.mjs — 中和 OpenAI 兼容服务端在 message content 内做的非标二次转义解析 + 孤立代理净化。
  *
- * 某些服务端（Kimi 等）会把 content 里的字面 "\x" / "\u" 当作 hex escape 再解释一遍，
- * 遇到 "\x" 后不足 2 个 hex（或 "\u" 后不足 4 个 hex）时服务端报
- * "unexpected end of hex escape" → 400（首次观察于 2026-08-06，见 advisor.mjs 历史）。
+ * 两个独立毒源（均真机实证）：
  *
- * 对策：把这类"一旦被服务端二次展开就会非法"的字面序列提前 double 成 "\\x" / "\\u"，
- * 服务端二次解析后还原为字面量；合法完整的 "\xNN" / "\uNNNN" 原样放过（它们能展开成
- * 一个字节/码点）。JSON.stringify 层面的反斜杠转义由发送方负责，本模块不碰。
+ * ① 字面 hex 转义二次解析（2026-08-06 Kimi 首观察）：Kimi/deepseek 等网关会把 content 里的字面
+ *    "\x5Cx" / "\x5Cu" 当作 hex escape 再解释一遍，不足位时 400（"unexpected end of hex escape"）。
+ *    对策：不足位序列前 double 反斜杠（\\x5CxNN 形态还原为字面量）；合法完整序列放行。
+ *    Known limitation（2026-09-01 v3 修复）：反斜杠 run ≥3 时（如 "\\\x5Cu" 三反斜杠+u）v1 的
+ *    lookbehind 只看前 1 字符会整体放行，但二次解析按配对消费后尾部的 \x5Cu 仍裸露 → 炸。
+ *    修复：按 run 奇偶判断——run 为奇数时尾部的 \x5Cu/\x5Cx 裸露（需 double），偶数已配对（放行）。
+ *
+ * ② 孤立 UTF-16 代理对（2026-09-02 deepseek 真机实锤）：content 里的**真实孤立代理字符**
+ *    （高代理 U+D800-DBFF 无低代理跟随，或低代理 U+DC00-DFFF 无高代理前置）——JSON.stringify
+ *    输出 \ud83d（合法 JSON），但 deepseek 解析器严格 UTF-16 解码，孤立代理 → 400
+ *    （"unexpected end of hex escape" / "lone leading surrogate in hex escape"）。
+ *    来源实证：doc_search 结果预览 `slice(0, N)` 按 UTF-16 码元截断，emoji 🔴（代理对）恰在
+ *    截断边界被切成孤立高代理 → 注入 system reminder → 每轮发送 → deepseek 400。
+ *    对策：发送前把孤立代理替换为  U+FFFD（任何来源安全兜底）；源头截断点另修 UTF-16 安全切。
  */
 
-/** 中和单段文本里的非法字面转义序列。 */
+/** 中和非法字面 hex 转义序列（毒源①）。 */
 export function escapeLiteralEscapes(text) {
   text = String(text ?? "")
-  return text
-    // (?<!\\) — 只有单个反斜杠才处理（"\\x" 已经是 double 的，必须原样放过）
-    // 前瞻：\x 后至少 2 个 hex 视为合法（服务端只展开前两个），只有不足 2 个的才 double
-    .replace(/(?<!\\)\\(x)(?![0-9a-fA-F]{2})/g, "\\\\$1")
-    .replace(/(?<!\\)\\(u)(?![0-9a-fA-F]{4})/g, "\\\\$1")
+  let out = ""
+  let i = 0
+  const n = text.length
+  while (i < n) {
+    const ch = text[i]
+    if (ch !== "\\") { out += ch; i++; continue }
+    // 数反斜杠 run 长度
+    let run = 0
+    while (i + run < n && text[i + run] === "\\") run++
+    const next = text[i + run]
+    if ((next === "x" || next === "u") && run % 2 === 1) {
+      // run 奇数 → 二次解析配对消费后尾部 \x5Cx/\x5Cu 裸露——hex 不足则网关炸 → 前插反斜杠 double
+      const need = next === "u" ? 4 : 2
+      const after = text.slice(i + run + 1, i + run + 1 + need)
+      if (!new RegExp(`^[0-9a-fA-F]{${need}}$`).test(after)) {
+        out += "\\".repeat(run + 1) + next
+        i += run + 1
+        continue
+      }
+      // 合法完整：输出全序列并跳过（hex 尾不重新扫描）
+      out += text.slice(i, i + run + 1 + need)
+      i += run + 1 + need
+      continue
+    }
+    out += "\\".repeat(run)
+    i += run
+  }
+  return out
+}
+
+/** 净化孤立 UTF-16 代理对（毒源②）：高代理无低代理跟随 / 低代理无高代理前置 → 替换为 。 */
+export function sanitizeLoneSurrogates(text) {
+  text = String(text ?? "")
+  let out = ""
+  let i = 0
+  const n = text.length
+  while (i < n) {
+    const cp = text.charCodeAt(i)
+    if (cp >= 0xd800 && cp <= 0xdbff) {
+      const next = text.charCodeAt(i + 1)
+      if (next >= 0xdc00 && next <= 0xdfff) { out += text[i] + text[i + 1]; i += 2; continue }
+      out += ""; i++; continue // 孤立高代理
+    }
+    if (cp >= 0xdc00 && cp <= 0xdfff) { out += ""; i++; continue } // 孤立低代理
+    out += text[i]; i++
+  }
+  return out
+}
+
+/** 发送前文本净化总入口：hex 转义中和 + 孤立代理净化。 */
+export function sanitizeText(text) {
+  return sanitizeLoneSurrogates(escapeLiteralEscapes(text))
 }
 
-/** 对单条消息的 content 应用 escapeLiteralEscapes（支持字符串或 OpenAI 多模态 part 数组）。 */
+/** 对单条消息的 content 应用 sanitizeText（支持字符串或 OpenAI 多模态 part 数组）。
+ *  2026-08-31 会诊 F5：deepseek-v4-flash 网关对 tool_calls[].function.arguments 与
+ *  reasoning_content 做同样的非标二次转义解析（字面 \\x5Cx/\\x5Cu 经工具参数/思考回传 → 400，
+ *  列号确定性复现 = 毒序列在 content 之外）——这两个字符串字段同样需要中和。 */
 export function escapeMessageContent(message) {
   const content = message?.content
+  let changed = false
+  let next = message
   if (typeof content === "string") {
-    return { ...message, content: escapeLiteralEscapes(content) }
-  }
-  if (Array.isArray(content)) {
-    let changed = false
+    const escaped = sanitizeText(content)
+    if (escaped !== content) {
+      next = { ...next, content: escaped }
+      changed = true
+    }
+  } else if (Array.isArray(content)) {
     const parts = content.map((p) => {
       if (p && typeof p === "object" && p.type === "text" && typeof p.text === "string") {
-        const escaped = escapeLiteralEscapes(p.text)
+        const escaped = sanitizeText(p.text)
         if (escaped !== p.text) {
           changed = true
           return { ...p, text: escaped }
@@ -38,9 +101,34 @@ export function escapeMessageContent(message) {
       }
       return p
     })
-    return changed ? { ...message, content: parts } : message
+    if (changed) next = { ...next, content: parts }
+  }
+  if (Array.isArray(next.tool_calls)) {
+    let tcChanged = false
+    const tool_calls = next.tool_calls.map((tc) => {
+      const args = tc?.function?.arguments
+      if (typeof args === "string") {
+        const escaped = sanitizeText(args)
+        if (escaped !== args) {
+          tcChanged = true
+          return { ...tc, function: { ...tc.function, arguments: escaped } }
+        }
+      }
+      return tc
+    })
+    if (tcChanged) {
+      next = { ...next, tool_calls }
+      changed = true
+    }
   }
-  return message
+  if (typeof next.reasoning_content === "string") {
+    const escaped = sanitizeText(next.reasoning_content)
+    if (escaped !== next.reasoning_content) {
+      next = { ...next, reasoning_content: escaped }
+      changed = true
+    }
+  }
+  return changed ? next : message
 }
 
 /** IKBGX4 (2026-08-28)：剥离仅本地使用的整消息标记字段（transient 等）——发送给 provider 前移除。
@@ -59,4 +147,4 @@ export function stripLocalMessageFields(messages) {
 /** 对整个 messages 数组逐条应用 escapeMessageContent（先剥离本地字段，再转义）。 */
 export function escapeMessages(messages) {
   return stripLocalMessageFields(messages).map(escapeMessageContent)
-}
+}

package/src/git/checkpoint.mjs

@@ -16,7 +16,7 @@ import { configDir } from "../config.mjs"
 
 const CWD_HASH_LEN = 12
 
-const MAX_CHECKPOINTS = 20
+const MAX_CHECKPOINTS = 100
 
 /** Files larger than this are NOT copied (sqlite db, bundles…) — they are recorded as skipped. */
 const MAX_FILE_BYTES = 5 * 1024 * 1024
@@ -33,8 +33,16 @@ function git(cwd, args, { allowFail = false } = {}) {
   }
 }
 
+/** Normalize cwd for hashing: uppercase the Windows drive letter so the VS Code
+ *  extension's uri.fsPath (lowercased) produces the SAME cwdHash12 as the CLI's
+ *  process.cwd() — cross-end snapshot sharing (CHECKPOINT.md F5/T7) depends on this
+ *  contract. Same normalization as session storage (session-slots.mjs normalizeCwd). */
+function normalizeCwd(cwd) {
+  return cwd.replace(/^([a-z]):/, (_, d) => d.toUpperCase() + ":")
+}
+
 function checkpointRoot(cwd) {
-  const hash = createHash("sha1").update(cwd).digest("hex").slice(0, CWD_HASH_LEN)
+  const hash = createHash("sha1").update(normalizeCwd(cwd)).digest("hex").slice(0, CWD_HASH_LEN)
   return join(configDir, "checkpoints", hash)
 }
 
@@ -412,11 +420,29 @@ export async function catFile(cwd, id, filePath) {
   }
 }
 
-/** Keep only the most recent MAX_CHECKPOINTS */
-async function pruneCheckpoints(cwd) {
+/** F6: delete ALL checkpoints for a cwd — commit = new safety baseline. Best-effort:
+ *  a missing dir is a no-op; deletion failures propagate so the git tool's commit case
+ *  can report "(checkpoint cleanup skipped: …)" without blocking the commit result. */
+export async function deleteCheckpointsForCwd(cwd) {
+  await rm(checkpointRoot(cwd), { recursive: true, force: true })
+}
+
+/** NF6: keep only the most recent `count` snapshots — oldest removed first (id sort =
+ *  timestamp prefix, so ascending order IS oldest-first). Returns how many were deleted
+ *  (0 when the cwd has no checkpoint dir). */
+export async function deleteCheckpointsOlderThan(cwd, count) {
   const root = checkpointRoot(cwd)
-  const ids = (await readdir(root)).sort()
-  while (ids.length > MAX_CHECKPOINTS) {
+  let ids
+  try { ids = (await readdir(root)).sort() } catch { return 0 }
+  let removed = 0
+  while (ids.length > count) {
     await rm(join(root, ids.shift()), { recursive: true, force: true })
+    removed++
   }
+  return removed
+}
+
+/** Keep only the most recent MAX_CHECKPOINTS (NF6 cap — runs at the end of every create) */
+async function pruneCheckpoints(cwd) {
+  await deleteCheckpointsOlderThan(cwd, MAX_CHECKPOINTS)
 }

package/src/mcp/transport-http.mjs

@@ -9,6 +9,9 @@ export function httpTransport(baseURL, extraHeaders = {}) {
   let sessionId = null
   let closed = false
   let eventSource = null
+  // 2026-09-01 MCP.md §4 D-1：GET SSE 不可用（405/不支持）降级后的纯 POST 模式标记。
+  // POST-only server（如 glm-websearch）无流可断：isAlive 不得因 eventSource == null 判死。
+  let postOnly = false
   let abortController = null
   let postUrl = url
   let legacySSE = false
@@ -232,5 +235,14 @@ export function httpTransport(baseURL, extraHeaders = {}) {
     pending.clear()
   }
 
-  return { send, notify, close, openSSE, url, headers: extraHeaders, isAlive: () => !closed && eventSource != null, onDead }
+  /** D-1：openSSE 降级（GET 405/不支持）后由 connect 链调用——标记纯 Streamable POST 模式 */
+  const markPostOnly = () => { postOnly = true }
+
+  return {
+    send, notify, close, openSSE, url, headers: extraHeaders,
+    // F1：POST-only 降级（postOnly）与 legacy SSE 流（eventSource）都算活连接——
+    // 不得因 eventSource == null 误判死（glm-websearch "reconnect failed" 根因）。
+    isAlive: () => !closed && (eventSource != null || postOnly),
+    onDead, markPostOnly,
+  }
 }

package/src/mcp.mjs

@@ -7,6 +7,12 @@ import { stdioTransport } from "./mcp/transport-stdio.mjs"
 import { httpTransport } from "./mcp/transport-http.mjs"
 import { wsTransport } from "./mcp/transport-ws.mjs"
 
+/** F6/D-5：config.token → `Authorization: Bearer <token>` 合成（仅当 headers 未显式给
+ *  Authorization——显式优先，向后兼容）。合成发生在传给 transport 前，不写回 config。 */
+export function withBearerToken(config) {
+  if (!config?.token || config.headers?.Authorization) return config
+  return { ...config, headers: { ...config.headers, Authorization: `Bearer ${config.token}` } }
+}
 
 /** Race a pending MCP request against an abort signal — a hung MCP server must not
  *  hold the turn hostage. signal absent → passthrough. */
@@ -31,8 +37,9 @@ async function sendWithSignal(promise, signal) {
 
 /** 2026-08-31 MCP 会诊 P5：CLI session 注册表（serverName → session）。
  *  session.state.transport 可变（重连替换）；buildTools 的 execute 动态取
- *  session.state.transport——server 崩溃后无需重建 agent.tools 即自愈。 */
-const _sessions = new Map()
+ *  session.state.transport——server 崩溃后无需重建 agent.tools 即自愈。
+ *  2026-09-01 MCP.md §4：导出给 /mcp test 的零副作用断言用（probe 后 _sessions 不增）。 */
+export const _sessions = new Map()
 /** 退避重连进行中（serverName → promise）——与 vscode 语义对齐；延迟表见 _mcpHooks。 */
 const _reconnecting = new Map()
 
@@ -44,7 +51,8 @@ export const _mcpHooks = {
 }
 
 /** 按 config 创建并完成握手的 transport（findTransportConfig 与 vscode 对齐）。 */
-async function createConnectedTransport(config, serverName) {
+async function createConnectedTransport(rawConfig, serverName) {
+  const config = withBearerToken(rawConfig) // F6/D-5：token 合成（不写回原 config）
   let transport
   if (config.wsUrl) {
     transport = wsTransport(config.wsUrl, config.headers ?? {})
@@ -54,7 +62,10 @@ async function createConnectedTransport(config, serverName) {
     try {
       await transport.openSSE()
     } catch {
-      // Server doesn't support GET SSE — degrade to pure Streamable HTTP POST mode
+      // Server doesn't support GET SSE — degrade to pure Streamable HTTP POST mode.
+      // MCP.md §4 D-1：显式标记 postOnly——POST-only server（glm-websearch 类）isAlive
+      // 不得因 eventSource == null 误判死（否则 ensureAlive 触发无意义重连循环）。
+      transport.markPostOnly()
     }
   } else {
     transport = stdioTransport(config.command, config.args ?? [], config.env)
@@ -63,6 +74,25 @@ async function createConnectedTransport(config, serverName) {
   return { transport, mcpTools }
 }
 
+/** F4/D-2：一次性探活——createConnectedTransport（initialize + tools/list）+ 计时。
+ *  零副作用：不进 _sessions、不动 agent.tools、无 onDead 挂钩；finally close
+ *  （closed=true 使 onDead 重连不会触发）。initialize 与 tools/list 同受
+ *  INIT_TIMEOUT_MS 约束（见 doInitialize）。不复用 connectMcpServer（避免污染
+ *  session 幂等表）。 */
+export async function probeMcpServer(config) {
+  const start = Date.now()
+  let transport
+  let mcpTools
+  try {
+    ;({ transport, mcpTools } = await createConnectedTransport(config, config.name ?? config.command ?? config.url ?? config.wsUrl))
+    return { ok: true, toolCount: mcpTools.length, latencyMs: Date.now() - start }
+  } catch (error) {
+    return { ok: false, error: error?.message ?? String(error) }
+  } finally {
+    try { transport?.close() } catch { /* ignore */ }
+  }
+}
+
 /** onDead → 后台退避重连；成功替换 session.state.transport（tools 闭包动态引用，
  *  agent.tools 无需重建）；失败静默（下次 execute 前置检查再试）。 */
 function scheduleReconnect(name, config) {
@@ -173,10 +203,14 @@ async function doInitialize(transport, _name) {
 
   // 2026-08-31 MCP 会诊 P6：tools/list 分页被忽略（nextCursor 多页工具静默丢失）——
   // 循环跟随 cursor 直到 server 不再返回（上限 20 页防死循环）。
+  // MCP.md §4 评审 #8：每页同受 INIT_TIMEOUT_MS 约束（否则 probe 的延迟统计无界）。
   const tools = []
   let cursor
   for (let page = 0; page < 20; page++) {
-    const toolsResp = await transport.send("tools/list", cursor ? { cursor } : {})
+    const toolsResp = await withTimeout(
+      transport.send("tools/list", cursor ? { cursor } : {}),
+      INIT_TIMEOUT_MS,
+    )
     if (toolsResp.error) throw new Error(`tools/list failed: ${toolsResp.error.message}`)
     tools.push(...(toolsResp.result?.tools ?? []))
     cursor = toolsResp.result?.nextCursor
@@ -192,7 +226,9 @@ export async function connectMcpServer(config) {
   if (!config || (!config.command && !config.url && !config.wsUrl))
     throw new Error(`MCP server "${config?.name ?? ""}": needs either 'wsUrl' (websocket), 'command' (stdio), or 'url' (http)`)
   const name = config.name ?? config.command ?? config.url ?? config.wsUrl
-  const configFingerprint = JSON.stringify([config.command ?? null, config.args ?? null, config.url ?? null, config.wsUrl ?? null, config.env ?? null, config.headers ?? null])
+  // MCP.md §4 D-5：fingerprint 计入 token 字段——/mcp edit 改 token → 指纹变更 →
+  // 旧连接主动关闭重建（T13）。
+  const configFingerprint = JSON.stringify([config.command ?? null, config.args ?? null, config.url ?? null, config.wsUrl ?? null, config.env ?? null, config.headers ?? null, config.token ?? null])
 
   const existing = _sessions.get(name)
   if (existing && !existing.closed) {
@@ -208,7 +244,16 @@ export async function connectMcpServer(config) {
     }
   }
 
-  const { transport, mcpTools } = await createConnectedTransport(config, name)
+  let transport
+  let mcpTools
+  try {
+    ;({ transport, mcpTools } = await createConnectedTransport(config, name))
+  } catch (error) {
+    // MCP.md §4 评审 #7：握手失败不泄漏 transport（GET SSE 降级成功但 POST initialize
+    // 失败时，openSSE 若开了流会留一个悬挂的 reader/请求）。
+    try { transport?.close() } catch { /* ignore */ }
+    throw error
+  }
   const session = {
     config, configFingerprint,
     state: { transport, tools: null },