thincoder 0.12.54 → 0.12.58

package/CHANGELOG.md

@@ -1,3 +1,59 @@
+## [0.12.58] — 2026-09-02
+
+### Changed
+
+- **开发体验三项（用户需求批 2026-09-02，两端）**：
+  ① **lint 零依赖化**（TOOLS.md §10.2）：eslint 全套删除（devDependencies + eslint.config.mjs + 级联分支），lint = `node scripts/check-syntax.mjs`（node --check 遍历 src/test/bin/scripts 含自检，零依赖）；CLI-LINT-REQUIREMENTS/TUNING.md 标记被取代；package-lock 再生（eslint 树移除）
+  ② **工具作用域限制全部移除**（§10.1）：resolveInCwd 去边界断言（信任模型 + 权限门禁为唯一防线，与 bash 一致）；git workdir / execute scriptFile / file_ops 目录限制一并移除；工具描述与提示词 "confined to workspace" 措辞清理（两端 byte-identical）
+  ③ **模型上下文长度可配置**（PROVIDER.md §15）：`providers[].context`（K 单位，如 128 = 128K）覆盖 MODEL_SPECS——providerSpec 拷贝覆盖不污染共享 spec；压缩阈值（auto ×0.6）/ TOKEN 窗口 / 状态栏显示 / advisor 预算全链路跟随；数字字符串（"128"）两端统一归一；非法值忽略 + 警告一次；CLI /model 管理流 + VS Code settings.json 配置界面
+
+## [0.12.57] — 2026-09-02
+
+### Added
+
+- **subagent 异步化：真后台并行**（AGENT-LOOP.md §15，两端）：subagent 工具加 `async: true`——spawn 立即返回 `{id, status:"running"}`，主会话可继续自己的回合；新增 `subagent_check` 工具（arrival order 先完成先取 / 带 id 等待 / n 递增校验防循环 / readonly）；**槽位队列**：并发上限 4，超限入队（position 可见），running 完成即腾槽补位（不拒绝、不分批）；回合收尾自动等待全部完成并注入报告（XML 转义 + 超长预览落盘）；Ctrl+C 清空不注入、ContinueError 状态保留；async 仅 depth-0、后台撞 turn-cap 自动拒绝继续
+- **approval 批确认**（AGENT-LOOP.md §16.1，两端）：同批多个非只读工具一次合并询问（approve all / one by one / deny；deny 全批拒绝无二次询问；无 handler 回退逐项；onPermissionRequest 签名不变）
+- **批量形态引导**（§16.2，数据驱动——真实使用 94.6% 单条 edit / apply_patch 0 次 / 35 例手工批量）：edit 描述强化 edits 数组原子批量、apply_patch 补多文件新建场景、system.md 并行条款扩展批量句（两端 byte-identical）
+
+### Changed
+
+- 工程模式并发纪律上限 3 → 4（engineering.md + ENGINEERING-MODE.md FR8/决策③ 三处同步）
+- VS Code 端同批对齐：escape v5 / UTF-16 安全截断 / 续写构造 / 压缩可见性（见 thincoder-vscode CHANGELOG 0.12.57）
+
+## [0.12.56] — 2026-09-02
+
+### Added
+
+- **上下文压缩面板 + 压缩失败可见性**（CONTEXT-COMPACTION.md §7）：压缩开始即弹"Compressing…"面板区块（复用子 agent 面板机制：耗时 ticker + summarizing N messages）→ 完成态 `Compressed: N tokens freed → summary (Xs)` 可折叠冻结；失败态显示错误文本，连续 3 次失败后 compressFallback 截断兜底并显示降级说明；摘要正文永不进面板/会话流；headless 回调缺省 no-op
+- **DeepSeek prefix 续写 400 止损**（PROVIDER.md §14）：续写请求精简历史（过滤 tool/assistant(tool_calls) 消息，保留 system + 最近 ≤8 条文本）——真机矩阵实证：thinking 模式 prefix 续写 + 工具链消息必 400（补不补 reasoning_content 分别报 Function call / reasoning_content 错误），纯文本历史 200；续写失败注入 `_warnings` 不再静默飞出；partial 模式不受影响
+- **会话恢复 provider/model 缺失 → 模型重选**（SESSION.md §8）：CLI 启动校验 provider/model/baseURL 缺失 → 不再崩溃退出；TUI 首帧弹模型选择（复用 picker），Esc 仍进 TUI + 提示行；headless 可读错误 + 退出码 1；判据仅空缺失（MODEL_SPECS 未知不判无效——自定义模型保护）
+- **MCP save&test 确认问句废除**（MCP.md §5 变更段）：探活成功直接保存（删 `Save? (Y/n)`）；探活失败报错回表单且无任何保存通道（save-anyway 整个废除）；取消仅剩表单 Esc
+- **搜索工具优先级条款**（PROMPT-DECOUPLING.md）：discipline.md + engineering.md 行为规则——有 MCP 搜索工具优先用 MCP、websearch 仅备用；websearch 连续 2 次垃圾即切；被墙站点走镜像路径；动手抓页面前先扫工具表（两端 prompts byte-identical）
+
+### Fixed
+
+- **hex-escape 400 真凶根治（escape.mjs v5）**：2026-09-02 实锤——`unexpected end of hex escape` 400 的毒源**不是字面 hex 转义序列**，而是 **doc_search 预览 slice 按 UTF-16 码元截断切断了 emoji 代理对**（🔴 → 孤立高代理 D83D）→ deepseek 严格 UTF-16 解码 400。两层修复：① 发送前净化（sanitizeLoneSurrogates：孤立代理 → U+FFFD，全字段）+ hex 转义 odd-run 修复（v1-v4 的 double/替换方向全错，本版为对象层面正解）；② 源头 UTF-16 安全截断（setup.mjs doc_search 预览 + helpers.mjs offloadToolResult 截断点落高代理时向前收一个码元）。验证：真实会话 953 条（含孤立代理）重放 400→200，带 thinking:enabled 6/6 全 200
+- **MCP 磁盘无 mcp 段时 remove/edit 崩溃**（code review #1/#2）：persistRaw 建段守卫（`raw.mcp ??=`）——磁盘 mcp 段被整体删除而连接保留（T23 场景）时，remove 不再 TypeError、edit 不再静默丢（"updated" 提示与落盘一致）
+
+## [0.12.55] — 2026-09-01
+
+### Added
+
+- **`/mcp` edit/add 统一字段 picker 表单（v2）+ agent 代配闭环**（docs/design/MCP.md §5，CLI-only）：① **edit = 字段选择表单**——picker 列可编辑字段行（`HTTP URL https://…` / `Token d90c26bb…` 打码 / `Headers 2 items`；stdio `Command/Args/Env`；name 不可改无行）+ 末行 `✓ Save & test`；选中字段只输入该字段新值（提示 `(current: …)`——空=不变、`-`=删可选字段、`k=`=删 header/env 项、required 字段拒绝 `-`）→ 回 picker 循环连改多字段（中间 Esc 回 picker 不丢已改值）；**废除逐字段预填重问**（改 token 不再被迫路过 URL/headers）；② **add 复用同一表单**——空 entry 起、必填字段 `(required)` 标注、Save 校验必填非空（未满足提示并停留表单不落盘）、headers/env 不选即跳过、add 的 name 可编辑（重复名检查）；③ **保存前预览 + 探活 + 字段级重试合一**——`showPreview`（token 遮蔽）→ `probeMcpServer` 零副作用探活（`✓ N tools, Xms` / `✗ 错误`）→ `Save? (Y/n)`；探活失败 → `Save anyway? (y/N)` 显式 y，否则**回同一字段表单**只重输失败字段复 probe（**独立 retry 路径废除**，不重启流程；save-anyway 显式 y 保留）；④ **表单文件拆分**——新增 `src/tui/cmd-mcp-form.mjs`（fieldPicker 机制独立文件；`cmd-mcp.mjs` 499→382 行，脱离 500 硬限压线）；⑤ **列表即菜单**——主菜单 = server 行（●/○ 连接态 + tool 数）+ `+ Add server` + `↻ Refresh` + 顶部 agent 代配提示行；选中行 → per-server 子菜单（Edit/Test/Reconnect/Remove），"先选操作再选 server"双弹层与 View list 废除；⑥ **磁盘重读**——`config.mjs` 新增 `reloadMcpFromDisk()`（菜单打开边界 + Refresh）：磁盘→内存仅替换 mcp 段；畸形 config.json 回退内存态 + `⚠ disk config unreadable` 提示行；disk 删除/变更的已连接 server 连接不断 + 行尾 `⚠ disk changed` 对账标记（persistRaw 落盘后重读幂等防环）；⑦ AI 生成降 transport picker 末位（生成的 entry 同走预览+探活确认环，失败回表单补齐/修正）；`/mcp edit|test|remove|connect <name>` 直达参数路径零改动
+- **MCP Streamable POST 误判修复 + `/mcp edit`/`/mcp test` + token 一等字段**（docs/design/MCP.md §4，两端落地）：① `httpTransport` 增 postOnly 标记——GET SSE 405 降级后的纯 POST 模式 `isAlive()` 不再因 `eventSource == null` 误判死（glm-websearch "reconnect failed after 4 attempts" 根因：降级后 isAlive 恒 false → ensureAlive 触发无意义重连循环；legacy SSE 流断仍正常 fireDead 重连不回归）；② `/mcp edit [name]`：逐字段预填重问（空输入保留 / `-` 删除可选字段 / `k=` 删除单个 header 项），persistRaw 原位替换保数组序，保存后自动重连（config 指纹含 token，变更自动关旧连接）；③ `/mcp test [name]`：probeMcpServer 一次性探活（initialize + tools/list 计时 → `OK — N tools, Xms` / 错误透传），零副作用（不进 session 表、不动 agent.tools、探完即关）；④ token 一等字段：config 增 `token` 字段，connect 链自动合成 `Authorization: Bearer <token>`（显式 headers 优先，不写回 config）；⑤ parseHeaders 改逗号分隔（`Authorization=Bearer abc, X-Foo=bar`——修复空格截断把 Bearer token 截成 "Bearer" 的缺陷）；⑥ VS Code 同构：http transport 同款修复 + probeMcpServer 镜像 + 面板 [Edit]/[Test] 按钮（同一表单编辑预填，token 字段 + 逗号分隔 headers 提示）+ **面板 [Reconnect] 死按钮修复**（webview 发的 `reconnectMcp` 消息在路由拆分时丢失 case，按钮此前无效）
+- **memory_delete 工具**（跨端）：三层记忆条目删除——personal 行级删（embedding/FTS 随行）、project/team 文件级删；scope 与 id 前缀匹配校验，非法 scope 明确报错
+
+### Changed
+
+- **multi-design 并行令牌（designId slots）**：eng-coder 子 agent 支持 `{designId, token}` 多槽并行 spawn——各设计独立令牌互不覆盖，复审不通过的设计不挤占既有槽（CLI 与 VS Code 镜像）
+
+### Fixed
+
+- **edit 数组形态同文件串行**：同一文件多条 edit 的 raw 域快照随条目推进，第二条不再漂移（编辑器 CRLF 路径 + 磁盘路径双修复）
+- **MCP tools/list 分页超时约束**（MCP.md §4 评审 #8）：每页同受 INIT_TIMEOUT_MS 约束——probe 延迟统计有界
+- **MCP 握手失败 transport 泄漏**（评审 #7）：GET SSE 降级成功但 POST initialize 失败时关闭 transport，不留悬挂流
+- **hex-escape 毒载荷 400 根治（escape.mjs v3）**：v2 的 lookbehind 单字符判定与 hex 窗口越界缺陷在长会话（讨论转义主题）下漏中和 → deepseek 等网关二次解析报 "unexpected end of hex escape"；v3 数反斜杠 run 奇偶 + 窗口越界修复（`\\x/\\u` 相邻双写）+ 孤立代理对（`\\uD83D` 无配对 strict JSON 解析拒绝）预 double；真实会话 74 处毒点全量中和为 0，11 个 case 锁定（含 v1 行为兼容回归）
+
 ## [0.12.54] — 2026-09-01
 
 ### Added
@@ -10,6 +66,7 @@
 
 - **跨端会话共享一致性（会诊 4 模型收敛）**：sessionStart 打点（跨端同槽不再 F2 互轮转）；F2 写前磁盘校验（同会话并发追加 → 轮转 .bak 保留）；legacy transient 双端过滤；contextHistory 机读线判定（length>0）；activeModel 双向；cwd 先行校验；newSession 死主清理落盘（deletions）
 - **checkpoint cwdHash 归一化**：`sha1(normalizeCwd(cwd)).slice(0,12)`——CLI/VS Code 快照跨端互通（存量旧路径孤儿化不迁移）
+- **操作并行化纪律提示词条款**（2026-09-01 用户需求）：system.md "How you work — while coding" 段在既有并行条款后追加 "Parallelize aggressively"——独立只读调用一次发起多个（执行器批并行）、多文件编辑用 `edits` 数组（原子一次往返）、独立子代理/独立子项目一次 spawn 多个（F7 触发条件：不共享待改文件 + 无交叉依赖 + 各自有独立测试）；明确不并行边界（同一文件写入/依赖链/bash 审批命令 = 审批风暴/同仓库并发 git/有状态操作）与收益判断（大操作并行、<1s 微操作不并行）。两端 system.md byte-identical，测试同步断言
 
 ### Fixed
 

package/bin/thincoder.mjs

@@ -17,7 +17,7 @@ import { join } from "node:path"
 import { runAgent } from "../src/agent.mjs"
 import { loadConfig, configPath } from "../src/config.mjs"
 import { createMemory, syncDir } from "../src/memory.mjs"
-import { assembleAgent, teamConfig, gitAuthor } from "../src/cli/make-agent.mjs"
+import { assembleAgent, teamConfig, gitAuthor, validateProvider } from "../src/cli/make-agent.mjs"
 import { memoryCommand } from "../src/cli/memory-command.mjs"
 import { setupWizard } from "../src/cli/setup-wizard.mjs"
 import { summarize, askPermission } from "../src/cli/permission.mjs"
@@ -79,6 +79,13 @@ switch (command) {
     }
 
     const agent = await assembleAgent()
+    // SESSION.md §8 D-S4（F4）：headless 无 TUI —— 可读错误 + 退出码 1，不弹 UI、不崩溃
+    if (agent._providerInvalid) {
+      const prov = agent.activeProvider || "(未设置)"
+      console.error(`[error] 未配置有效 provider（activeProvider "${prov}"：${agent._providerInvalidReason}）。请运行 thincoder 进入 TUI 重新选择，或编辑 ${configPath}`)
+      exitSoon(1)
+      break
+    }
     if (!agent.provider.apiKey) {
       if (!process.stdin.isTTY) {
         console.error(noKeyMessage())
@@ -219,6 +226,9 @@ switch (command) {
   case "tui":
   case undefined: {
     const agent = await assembleAgent()
+    // SESSION.md §8 D-S1：TUI 路径在 startTUI 前清空无效 provider——空 provider 不流入 runAgent
+    // （崩溃源：chat() 缺 model → 网关 400 或 fetch("undefined/...") TypeError）
+    if (agent._providerInvalid) agent.provider = null
     const config = loadConfig()
     // 恢复上次的会话（同一项目目录）；provider 按保存的名字切回（用户上次可能换过模型）
     const { loadSession, applySession } = await import("../src/session.mjs")
@@ -226,11 +236,15 @@ switch (command) {
     if (restored) {
       const switched = applySession(agent, restored)
       if (switched && agent.config?.agent?.compactThresholdAuto) {
-        // 压缩阈值跟模型走（与 TUI 切换 provider 时的处理一致）
+        // 压缩阈值跟模型走（与 TUI 切换 provider 时的处理一致）；传 provider 对象——
+        // providers[].context 覆盖生效（PROVIDER.md §15 T-C2）
         const { resolveCompactThreshold } = await import("../src/config.mjs")
-        agent.config.agent.compactThreshold = resolveCompactThreshold(null, agent.provider.model).value
+        agent.config.agent.compactThreshold = resolveCompactThreshold(null, agent.provider).value
       }
     }
+    // D-S3 优先级补全：applySession 可能已用会话中的有效 provider 修复（config 无效 + 会话有效）——
+    // 修复后复验清除标记，仅当两者都无效才弹重选（validateProvider 幂等）
+    if (agent._providerInvalid) validateProvider(agent)
     // MCP 连接失败在 TUI alt-buffer 下 stderr 不可见，注入为下一条 user 消息后的提醒
     if (agent._mcpWarnings?.length) {
       agent._pendingReminders = agent._pendingReminders ?? []

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.12.54",
+  "version": "0.12.58",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",
@@ -33,13 +33,9 @@
   "scripts": {
     "test": "node --test \"test/*.test.mjs\"",
     "prepublishOnly": "npm run lint && node --test \"test/*.mjs\"",
-    "lint": "eslint src test",
+    "lint": "node scripts/check-syntax.mjs",
     "test:full": "node test/run-full.mjs"
   },
   "author": "liwei <liwei@51marine.com> (上海新舶)",
-  "license": "MIT",
-  "devDependencies": {
-    "eslint": "^9.0.0",
-    "@eslint/js": "^9.0.0"
-  }
+  "license": "MIT"
 }

package/src/acp/bridge.mjs

@@ -73,7 +73,7 @@ export function buildAcpCallbacks({ sessionId, notify, request, log = () => {} }
       // D7 (AGENT-LOOP.md §7.2): strip ⟦ev⟧ event tokens (bare or prefixed variants) —
       // they carry RS control characters and are a TUI display signal; structured ACP
       // mapping (tool_call_update) is tracked separately in docs/TODO.md.
-  // eslint-disable-next-line no-control-regex -- 有意为之：控制字符协议/转义序列剥离正则（ANSI/⟦ev⟧/SGR/history 双线分隔）
+  // 有意为之：控制字符协议/转义序列剥离正则（ANSI/⟦ev⟧/SGR/history 双线分隔）
       if (/^(?:[\w-]+#\d+\/)?⟦ev⟧(?:turn|approval)\x1e/.test(text)) return
       update("agent_message_chunk", { content: { type: "text", text } })
     },

package/src/advisor/messages.mjs

@@ -5,7 +5,7 @@
  */
 import { readFileSync, existsSync } from "node:fs"
 import { resolve, join, relative, dirname, sep } from "node:path"
-import { specForModel } from "../config.mjs"
+import { providerSpec } from "../config.mjs"
 import { findReviewRepos, collectRepoSnapshots, collectChangedFiles } from "./repos.mjs"
 import { buildConvergenceBody, buildConvergenceInstructions } from "./convergence.mjs"
 import { loadAdvisorMd, extractConversationBackground, extractAgentResponseTable } from "./history.mjs"
@@ -90,7 +90,9 @@ function injectProjectGuide(agent, parts, scopeFiles = []) {
   }
   // readFileSync succeeded — compute the budget OUTSIDE the try so a spec
   // lookup failure can never masquerade as "no AGENTS.md".
-  const ctx = specForModel(agent.provider?.model ?? "").context
+  // providerSpec: the project-guide budget follows the provider-level context
+  // override (PROVIDER.md §15 — advisor messages budget is context-based).
+  const ctx = providerSpec(agent.provider).context
   const cap = Math.max(PROJECT_GUIDE_MIN, Math.floor(ctx * PROJECT_GUIDE_FRACTION))
   const shown = text.length <= cap
     ? text

package/src/advisor/run.mjs

@@ -3,7 +3,7 @@
  * Message building lives in advisor.mjs.
  */
 import { chat } from "../provider/core.mjs"
-import { findProvider, specForModel } from "../config.mjs"
+import { findProvider, providerSpec } from "../config.mjs"
 import { toOpenAISchema } from "../tools/index.mjs"
 import { prepareAdvisorMessages } from "../advisor.mjs"
 import { appendCitationReport } from "./citations.mjs"
@@ -221,7 +221,7 @@ async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, c
         id: tc.id, type: "function",
         function: { name: tc.name, arguments: tc.arguments },
       })),
-      ...(response.reasoning && specForModel(provider.model).reasoningEcho === "required"
+      ...(response.reasoning && providerSpec(provider).reasoningEcho === "required"
         ? { reasoning_content: response.reasoning }
         : {}),
     })

package/src/agent/dispatch.mjs

@@ -46,7 +46,12 @@ function logToolError(toolName, args, error) {
  */
 export async function executeToolCalls(agent, toolByName, toolCalls, callbacks, depth = 0, signal) {
   // ---- Phase 1: serial preparation ----
+  // Pre-gates run per tool (parse/planMode/engineering gates); non-readonly tools
+  // that REACH the permission stage are collected into one batch — a single merged
+  // ask covers the whole toolCalls array (§16 D-B1, "approve all / one by one /
+  // deny"). Tools stopped by a pre-gate never join the batch (review #7).
   const prepared = []
+  const permPending = [] // { toolCall, tool, args } — reached the permission stage
   for (const toolCall of toolCalls) {
     const tool = toolByName.get(toolCall.name)
     let args
@@ -106,39 +111,74 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       }
     }
 
-    if (!tool.readonly) {
-      // autoApprove short-circuit: skip prompt when agent is already marked for auto-approval
-      const allowed = agent.autoApprove
-        ? true
-        : callbacks.onPermissionRequest
-          ? await (async () => {
-              // D2 (AGENT-LOOP.md §7.2): announce the wait BEFORE prompting — the TUI
-              // subagent block header flips to "等待审批" so a waiting child is visibly
-              // different from a stalled one. Depth>0 only (the parent TUI shows its own
-              // permission panel). turn n/max = the child's live turn counters.
-              if (depth > 0) {
-                callbacks.onToken?.(`⟦ev⟧approval\x1e${agent._currentTurn ?? 0}\x1e${agent._maxTurns ?? 0}\x1eapproval\x1e${String(toolCall.name).slice(0, 40)}`)
-              }
-              return await callbacks.onPermissionRequest(toolCall.name, args)
-            })()
-          : false
-      if (!allowed) {
-        prepared.push({ toolCall, tool, denied: true, reason: callbacks.onPermissionRequest ? "denied by user" : "no permission handler" })
+    // Readonly tools (and autoApprove — the short-circuit, unchanged for the
+    // whole batch too) skip the permission stage entirely.
+    if (tool.readonly || agent.autoApprove) {
+      if (!(await runHooks("PreToolUse", { agent, toolName: toolCall.name, toolArgs: args }))) {
+        prepared.push({ toolCall, tool, denied: true, reason: "blocked by PreToolUse hook" })
         continue
       }
-    }
-
-    // PreToolUse hooks: allow user scripts to gate tool execution
-    if (!(await runHooks("PreToolUse", { agent, toolName: toolCall.name, toolArgs: args }))) {
-      prepared.push({ toolCall, tool, denied: true, reason: "blocked by PreToolUse hook" })
+      // Panel area abolished — all tools now stream inline via onToolOutput.
+      callbacks.onToolCall?.(toolCall.name, args, toolCall.id)
+      prepared.push({ toolCall, tool, args })
       continue
     }
+    permPending.push({ toolCall, tool, args })
+  }
 
-    // Panel area abolished — all tools now stream inline via onToolOutput.
+  // ---- Permission stage: one merged ask for the whole batch (§16 D-B1) ----
+  // >1 non-readonly tools in the same toolCalls array → a single
+  // onBatchPermissionRequest({ tools, count }) ask; verdicts:
+  //   "approveAll" → batch-scope allowance (autoApprove style, NOT persistent)
+  //   "deny"       → the whole batch is rejected, no second ask
+  //   "oneByOne" (or anything else / no handler) → the existing per-item
+  //     onPermissionRequest channel, signature unchanged (NF-B1: ACP bridge /
+  //     headless / old versions without the new callback are never harmed).
+  if (permPending.length > 0) {
+    let batchAllowed = null // true = approveAll, false = deny, null = per-item fallback
+    if (permPending.length > 1 && callbacks.onBatchPermissionRequest) {
+      const verdict = await callbacks.onBatchPermissionRequest({
+        tools: permPending.map((p) => ({ name: p.toolCall.name, args: p.args })),
+        count: permPending.length,
+      })
+      if (verdict === "approveAll") batchAllowed = true
+      else if (verdict === "deny") batchAllowed = false
+      // anything else (oneByOne/unknown) → fall through to the per-item channel
+    }
+    for (const p of permPending) {
+      let allowed
+      if (batchAllowed === true) allowed = true
+      else if (batchAllowed === false) allowed = false
+      else if (callbacks.onPermissionRequest) {
+        allowed = await (async () => {
+          // D2 (AGENT-LOOP.md §7.2): announce the wait BEFORE prompting — the TUI
+          // subagent block header flips to "等待审批" so a waiting child is visibly
+          // different from a stalled one. Depth>0 only (the parent TUI shows its own
+          // permission panel). turn n/max = the child's live turn counters.
+          if (depth > 0) {
+            callbacks.onToken?.(`⟦ev⟧approval\x1e${agent._currentTurn ?? 0}\x1e${agent._maxTurns ?? 0}\x1eapproval\x1e${String(p.toolCall.name).slice(0, 40)}`)
+          }
+          return await callbacks.onPermissionRequest(p.toolCall.name, p.args)
+        })()
+      } else allowed = false
+      if (!allowed) {
+        prepared.push({
+          toolCall: p.toolCall, tool: p.tool, denied: true,
+          reason: (callbacks.onPermissionRequest || batchAllowed === false) ? "denied by user" : "no permission handler",
+        })
+        continue
+      }
 
-    callbacks.onToolCall?.(toolCall.name, args, toolCall.id)
+      // PreToolUse hooks: allow user scripts to gate tool execution
+      if (!(await runHooks("PreToolUse", { agent, toolName: p.toolCall.name, toolArgs: p.args }))) {
+        prepared.push({ toolCall: p.toolCall, tool: p.tool, denied: true, reason: "blocked by PreToolUse hook" })
+        continue
+      }
 
-    prepared.push({ toolCall, tool, args })
+      // Panel area abolished — all tools now stream inline via onToolOutput.
+      callbacks.onToolCall?.(p.toolCall.name, p.args, p.toolCall.id)
+      prepared.push({ toolCall: p.toolCall, tool: p.tool, args: p.args })
+    }
   }
 
   // ---- Phase 2: order-preserving execution ----

package/src/agent/helpers.mjs

@@ -35,6 +35,17 @@ export const REPORT_CONTINUATION =
 const TOOL_RESULT_OFFLOAD_LIMIT = 64 * 1024 // 65536 chars — offload only above 64K (2026-08-24)
 const TOOL_RESULT_PREVIEW = 64 * 1024 // chars shown inline when offloaded (aligns with CLI/VS Code webview)
 
+/** UTF-16 安全截断（2026-09-02 deepseek 400 根因）：slice(0, N) 按码元切会把 emoji 代理对切成孤立
+ *  高代理（如 🔴=U+D83D+DD34 只剩 D83D）——deepseek 解析器严格 UTF-16 报 400
+ *  "unexpected end of hex escape"。截断点落在高代理上时向前收一个码元。
+ *  与 setup.mjs 的 safeSliceUTF16 同语义（两处独立实现——escape.mjs 的 sanitizeLoneSurrogates 是发送兜底，此处是源头）。 */
+function safeSliceUTF16(text, max) {
+  if (text.length <= max) return text
+  const cp = text.charCodeAt(max - 1)
+  if (cp >= 0xd800 && cp <= 0xdbff) return text.slice(0, max - 1)
+  return text.slice(0, max)
+}
+
 /** Offload-dir write-time self-cleanup retention window (2026-08-21): files older than 3 days are deleted on the next offload. */
 export const TMP_RETENTION_MS = 3 * 24 * 3600 * 1000
 
@@ -87,12 +98,12 @@ export async function offloadToolResult(text, callId, dir = join(configDir, "too
     const file = join(dir, `${Date.now()}-${String(callId).replace(/[^a-zA-Z0-9_-]/g, "_")}.log`)
     await writeFile(file, text, "utf8")
     return (
-      text.slice(0, TOOL_RESULT_PREVIEW) +
+      safeSliceUTF16(text, TOOL_RESULT_PREVIEW) +
       `\n\n[... output too large (${text.length} chars total), full content saved to: ${file}\n` +
       `Page through it with the read tool (offset/limit) or sed -n 'START,ENDp' — do NOT re-run the tool blindly.]`
     )
   } catch {
-    return text.slice(0, TOOL_RESULT_OFFLOAD_LIMIT) + `\n\n[... truncated: ${text.length} chars total, offload to disk failed]`
+    return safeSliceUTF16(text, TOOL_RESULT_OFFLOAD_LIMIT) + `\n\n[... truncated: ${text.length} chars total, offload to disk failed]`
   }
 }
 

package/src/agent/setup.mjs

@@ -22,6 +22,17 @@ import { fileURLToPath } from "node:url"
 const DEFAULT_COMPACT_THRESHOLD = 100_000
 const DOC_SEARCH_LIMIT = 5
 const DOC_CHUNK_PREVIEW_LEN = 300
+/** UTF-16 安全截断（2026-09-02 deepseek 400 根因）：slice(0, N) 按码元切会把 emoji 代理对切成孤立
+ *  高代理（如 🔴=U+D83D+DD34 只剩 D83D）——deepseek 解析器严格 UTF-16 报 400
+ *  "unexpected end of hex escape"。截断点落在高代理上时向前收一个码元。 */
+function safeSliceUTF16(text, max) {
+  if (text.length <= max) return text
+  const end = max
+  // 截断点恰在高代理（D800-DBFF）上 → 收到高代理之前（不带它）
+  const cp = text.charCodeAt(end - 1)
+  if (cp >= 0xd800 && cp <= 0xdbff) return text.slice(0, end - 1)
+  return text.slice(0, end)
+}
 const MEMORY_SEARCH_LIMIT = 3
 
 /** Build engineering-mode system prompt by reading METHODOLOGY.md and wrapping it in the engineering template */
@@ -114,7 +125,7 @@ export async function prepareRun(agent, input, callbacks, {
           role: "user",
           content:
             `[Relevant documentation${more}:\n` +
-            docs.map((d) => `- ${d.path}${d.heading ? " > " + d.heading : ""}: <untrusted_doc_chunk>${escapeXml(d.content.slice(0, DOC_CHUNK_PREVIEW_LEN))}</untrusted_doc_chunk>`).join("\n") +
+            docs.map((d) => `- ${d.path}${d.heading ? " > " + d.heading : ""}: <untrusted_doc_chunk>${escapeXml(safeSliceUTF16(d.content, DOC_CHUNK_PREVIEW_LEN))}</untrusted_doc_chunk>`).join("\n") +
             "]",
           transient: true,
         })
@@ -169,6 +180,7 @@ export async function prepareRun(agent, input, callbacks, {
   // eng-coder subagents get advisor for mandatory design review before coding
   const { planTool, subagentTool, taskTool, skillTool, goalTool, verifyTool, recentChangesTool, timerTool, advisorTool, engTool } = await import("../agent-tools.mjs")
   const { consultStartTool, consultCheckTool, consultStopTool } = await import("../agent-tools/consult.mjs")
+  const { subagentCheckTool } = await import("../agent-tools/subagent-check.mjs")
   const { escalateTool } = await import("../agent-tools/escalate.mjs")
   const { CONSULT_BASE } = await import("../agent.mjs")
   // withPool: decorate consult_start/escalate descriptions with the CURRENT candidate pool
@@ -212,7 +224,7 @@ export async function prepareRun(agent, input, callbacks, {
   const consultTools = consultModels.length
     ? [withPool(consultStartTool), consultCheckTool, consultStopTool, ...(engineering ? [] : [withPool(escalateTool)])]
     : []
-  const depthOnly = depth === 0 ? [filteredSubagent, skillTool, goalTool, engTool, verifyTool, recentChangesTool, advisorTool, ...consultTools]
+  const depthOnly = depth === 0 ? [filteredSubagent, subagentCheckTool, skillTool, goalTool, engTool, verifyTool, recentChangesTool, advisorTool, ...consultTools]
     // Write-permission coder sub-agents (subagent role="coder" + escalate): the
     // system prompt names verify (system.md) and advisor (discipline.md) — without them an
     // escalate hit "unknown tool" and fell back to bash node --check / npm test to

package/src/agent/spawn-child.mjs

@@ -51,7 +51,9 @@ export function makeRelay(parent, label, emit, model) {
 // Single source for the event grammar branch lists (consult P3, 2026-08-30):
 // stripEventToken (display) and stripEventTokensForCapture (capture) shared them
 // literally — extending the event set meant touching both regexes.
-const EVENT_PHASE = "turn|approval"
+// "done" = §15 D-A3 async-child completion event (emitted by the parent's
+// turn-end collection, not by children — listed so the grammar stays honest).
+const EVENT_PHASE = "turn|approval|done"
 const EVENT_TYPE = "llm|tool|approval|done"
 const WELL_FORMED_EVENT = new RegExp(`^${EVENT_SENTINEL}(${EVENT_PHASE})${RS}[^${RS}]*${RS}[^${RS}]*${RS}(${EVENT_TYPE})${RS}`)
 export function stripEventToken(text) {

package/src/agent-tools/advisor.mjs

@@ -130,7 +130,12 @@ export const advisorTool = {
     // Generate the design token BEFORE the review and inject it into the advisor's prompt.
     // The advisor (LLM) decides pass/fail itself and echoes the token only on approval —
     // the gate is a mechanical string match, not fragile semantics parsing.
+    // A random designId is minted for EVERY design-review call (2026-09-01 multi-design
+    // slots): on pass the token is stored in parent._engDesignTokens keyed by this id and
+    // the id is echoed to the parent; on failure the id is dropped — never stored, so it
+    // cannot clobber any other design's slot. Not a document anchor (rejected 2026-08-31).
     const designToken = reviewType === "design" ? generateDesignToken(agent) : null
+    const designId = reviewType === "design" ? randomUUID() : null
     const result = await runAdvisorReview(agent, reviewType, {
       onOutput: ctx.onOutput,
       signal: ctx.signal,
@@ -144,6 +149,11 @@ export const advisorTool = {
       if (designToken && result && tokenPattern.test(result)) {
         // Advisor echoed the token → review passed. Issue it to the parent for eng-coder.
         // (session cleanup for design reviews is owned by runAdvisorReview)
+        // Multi-design slots (2026-09-01): store under this review's designId; the single
+        // `_engDesignToken` mirror stays for the legacy boolean gates (dispatch "has token",
+        // session persistence) — key decision ② of ENGINEERING-MODE.md §7 2026-09-01.
+        agent._engDesignTokens ??= new Map()
+        agent._engDesignTokens.set(designId, designToken)
         agent._engDesignToken = designToken
         // Unlock the dispatch design gate (dispatch.mjs) for eng-coder SELF-review:
         // an eng-coder whose own design review passed may write files without the
@@ -156,16 +166,16 @@ export const advisorTool = {
         if (agent._role === "eng-coder") agent._engDesignReviewed = true
         // Strip the bracketed token so only ONE unambiguous format (plain UUID) reaches the main agent
         const cleanResult = result.replace(makeDesignTokenRegex(designToken, "g"), "").trim()
-        return `${cleanResult}\n\nApproved. Pass this exact token to eng-coder (designToken parameter): ${designToken}`
+        // designId rides the Approved block (review #1): the parent needs it to aim the FIRST
+        // eng-coder spawn when several designs live in the same session.
+        return `${cleanResult}\n\nApproved. Pass this exact token to eng-coder (designToken parameter): ${designToken}\ndesignId: ${designId} (pass as the designId parameter when spawning eng-coder; optional while this session holds a single design)`
       }
-      // Review failed (or advisor chose not to pass) → invalidate any previously-issued token.
-      // Guards (v2 2026-08-25): result === null means the review was SKIPPED (advisor disabled /
-      // not engineering mode) — must not revoke. An error reply (own "Advisor:" prefix — the
-      // error-return convention of runAdvisorReview) is a provider crash/timeout artifact, not
-      // a completed verdict — a network glitch must not revoke unrelated standing tokens.
-      // Only a COMPLETED review that did not pass revokes.
-      const isCompletedReview = result !== null && !result.startsWith("Advisor:")
-      if (isCompletedReview) agent._engDesignToken = null
+      // Review failed (or advisor chose not to pass) → do NOT touch ANY slot (方案 ②, review #2:
+      // a failed RE-review leaves the previously approved token alive until TTL; the failed call's
+      // own designId was never stored, so there is nothing to clear). Isolation (2026-08-30,
+      // extended to the multi-slot Map 2026-09-01): a network glitch must not clear / other
+      // designs' slots must not be affected — only a COMPLETED non-passing review lands here,
+      // and it revokes nothing.
       // Strip every dead token occurrence from the raw output so the main agent can't grab an invalid one
       if (result) {
         const stripped = result.replace(makeDesignTokenRegex(designToken, "g"), "").trim()

package/src/agent-tools/eng.mjs

@@ -22,6 +22,7 @@ export const engTool = {
     if (args.action === "exit") {
       ctx.agent.config.agent.engineering = false
       ctx.agent._engDesignToken = null   // stale token from prior design review invalidated
+      ctx.agent._engDesignTokens = new Map() // multi-design slots die with the mode (2026-09-01 fix #2)
       ctx.agent._engDesignReviewed = false // reset gate state
       ctx.agent._advisorRound = 0          // reset convergence budget
       ctx.agent._touchedFiles = []         // clear mutation tracking
@@ -49,6 +50,7 @@ export const engTool = {
       }
       ctx.agent.config.agent.engineering = true
       ctx.agent._engDesignToken = null   // off→on transition requires a fresh design review
+      ctx.agent._engDesignTokens = new Map() // multi-design slots die with the mode (2026-09-01 fix #2)
       ctx.agent._lastEngState = true
       ctx.agent._pendingReminders = ctx.agent._pendingReminders ?? []
       ctx.agent._pendingReminders.push(ENG_ON_REMINDER)

package/src/agent-tools/subagent-check.mjs

@@ -0,0 +1,107 @@
+/**
+ * subagent-check.mjs — async subagent 结果消费侧（AGENT-LOOP.md §15 D-A2）。
+ *
+ * 与 subagent.mjs 的生成侧（async 分支 + 槽位队列）分离，保持 subagent.mjs
+ * 在 500 行硬限内；本模块只承载 subagent_check 工具 + 其等待机制。
+ *
+ * 语义（D-A2）：
+ * - id 缺省 → 按 ARRIVAL ORDER 返回下一个已完成的子代理（先完成先返回）
+ * - id 给定 → 阻塞到该 id 完成（queued 项先等启动再等完成）
+ * - n（必填）→ 1-based 递增读数，per-run 计数器（runAgent 非 resume 重置、
+ *   turn-end 清空）；乱序/重复 n 拒绝且不消费结果；超 MAX_ASYNC_CHECKS 上限
+ *   报错引导走回合收尾自动等待
+ * - 消费后从 map 删除——已消费 id 再查 = 与未知 id 同款错误（T12）
+ */
+import { MAX_ASYNC_CHECKS } from "./subagent.mjs"
+
+/** Wait for an async entry to settle (or the parent signal to abort), parked on
+ *  the agent's waiter list — the entry settle finally wakes every waiter (same
+ *  pattern as consult_check's session waiters). Returns "aborted" on signal. */
+function wakeOnAsyncSettle(agent, ctx) {
+  return new Promise((resolve) => {
+    const cleanup = () => {
+      const i = (agent._asyncWaiters ?? []).indexOf(w)
+      if (i >= 0) agent._asyncWaiters.splice(i, 1)
+      ctx.signal?.removeEventListener("abort", onAbort)
+    }
+    const w = () => { cleanup(); resolve("settled") }
+    const onAbort = () => { cleanup(); resolve("aborted") }
+    ;(agent._asyncWaiters ??= []).push(w)
+    if (ctx.signal) {
+      if (ctx.signal.aborted) { onAbort(); return }
+      ctx.signal.addEventListener("abort", onAbort, { once: true })
+    }
+  })
+}
+
+/**
+ * subagent_check (AGENT-LOOP.md §15 D-A2) — fetch async subagent results.
+ * - id omitted → the next completed child in ARRIVAL order (first finished first)
+ * - id given → block until THAT child finishes (queued items wait for their start)
+ * - n (required) → 1-based read counter, strictly incrementing per run (loop
+ *   guard); capped at MAX_ASYNC_CHECKS per turn — beyond that, use the turn-end
+ *   auto-wait. Errors never consume results.
+ * Consumed entries are deleted from the map — a re-check of the same id is the
+ * same "unknown async subagent id" error (T12).
+ */
+export const subagentCheckTool = {
+  name: "subagent_check",
+  readonly: true,
+  description:
+    "Fetch the result of an async subagent (subagent with async:true). Spawn async children to keep working in your own turn while they run in the background, then collect their reports here. Multiple async children return in completion (arrival) order — the first finished is returned first, so fast results are handled immediately instead of waiting for the slowest. Blocks until the target finishes.\n" +
+    "When done is true, no more results are coming (all finished and consumed) — anything left arrives automatically at turn end.\n" +
+    "Parameters:\n" +
+    "- id (optional): the subagent id from the async spawn return. Omit to fetch the next completed child (arrival order).\n" +
+    "- n (required): 1-based read counter — pass 1 on the first check, 2 on the next, and so on. Consecutive checks must be distinct tool calls (loop detector); at most 3 checks per turn — use the turn-end auto-wait for the rest.",
+  parameters: {
+    type: "object",
+    properties: {
+      id: { type: "string", description: "Optional subagent id (from the async spawn return). Omit = next completed child (arrival order)." },
+      n: { type: "number", description: "1-based read counter: 1 for the first check of the turn, incrementing with each subsequent check (loop detector — consecutive checks must be distinct tool calls)." },
+    },
+    required: ["n"],
+  },
+  async execute({ id, n }, ctx) {
+    const agent = ctx.agent
+    const map = agent._asyncSubagents ?? new Map()
+    // Strict 1-based incrementing read counter (D-A2, review #1): out-of-order /
+    // repeated n is rejected WITHOUT consuming a result (T14).
+    const lastN = agent._asyncCheckLastN ?? 0
+    if (!Number.isInteger(n) || n !== lastN + 1) {
+      return JSON.stringify({ status: "error", error: "invalid read counter — pass n = lastN+1" })
+    }
+    if (n > MAX_ASYNC_CHECKS) {
+      return JSON.stringify({ status: "error", error: "check limit exceeded — use turn-end auto-wait for the rest" })
+    }
+    agent._asyncCheckLastN = n
+
+    let target = null
+    if (id !== undefined && id !== null && String(id) !== "") {
+      target = map.get(String(id))
+      // Unknown OR already-consumed ids (consumed entries are deleted) — same error (T12).
+      if (!target) return JSON.stringify({ id: String(id), status: "error", error: `unknown async subagent id: ${id}` })
+    }
+
+    // Block until the target settles (specific id / next completed in arrival order).
+    for (;;) {
+      if (target) {
+        if (target.done) break
+        const woke = await wakeOnAsyncSettle(agent, ctx)
+        if (woke === "aborted") return JSON.stringify({ done: true, stopped: true })
+        continue
+      }
+      const completed = [...map.values()].filter((e) => e.done)
+      if (completed.length > 0) {
+        target = completed.sort((a, b) => (a._settleSeq ?? 0) - (b._settleSeq ?? 0))[0]
+        break
+      }
+      if (map.size === 0) return JSON.stringify({ done: true })
+      const woke = await wakeOnAsyncSettle(agent, ctx)
+      if (woke === "aborted") return JSON.stringify({ done: true, stopped: true })
+    }
+
+    map.delete(String(target.id))
+    if (target.error) return JSON.stringify({ id: String(target.id), status: "error", error: target.error })
+    return JSON.stringify({ id: String(target.id), role: target.role, status: "done", report: target.report ?? "" })
+  },
+}