thincoder 0.12.54 → 0.12.59

package/src/config.mjs

@@ -73,13 +73,17 @@ export const DEFAULTS = {
     provider: "tavily",  // structured search API; empty apiKey → fall back to Bing HTML scraping
     apiKey: "",          // Tavily key (tvly-...) — optional
   },
+  traces: {
+    enabled: false,  // §18.6 D-TR6 修订（2026-09-05 用户裁定——发布隐私："不希望用户那边也采集"）：轨迹存档默认 OFF——新用户零采集；本地调试分析可显式开（~/.thincoder/config.json traces.enabled:true）
+    retentionHours: 24, // D-TR10：轨迹文件保留小时数——CLI 启动时删除超过该时长的文件（默认 24h）
+  },
 }
 
 // Model capability table + spec lookup live in model-specs.mjs (2026-08-31
 // extract — config.mjs had grown past the 300-line advisory). Re-exported here
 // so the 23 existing importers keep their import paths.
-import { specForModel } from "./model-specs.mjs"
-export { specForModel }
+import { specForModel, providerSpec } from "./model-specs.mjs"
+export { specForModel, providerSpec }
 
 
 // Window utilization threshold: compacts at 60% context, reserving 40% headroom
@@ -87,10 +91,14 @@ export { specForModel }
 // memory/doc search results) which can consume 30-50K tokens each turn.
 const COMPACT_RATIO = 0.6
 
-/** Derive compaction threshold; explicit is the value explicitly set in config file (takes priority), otherwise auto-computed from model */
-export function resolveCompactThreshold(explicit, model) {
+/** Derive compaction threshold; explicit is the value explicitly set in config file (takes priority), otherwise auto-computed from model.
+ *  Second param accepts EITHER a model name string (pure spec lookup — legacy caller:
+ *  first-run wizard) OR a provider object (providerSpec — the providers[].context
+ *  override in K units is honored, PROVIDER.md §15 T-C2). */
+export function resolveCompactThreshold(explicit, modelOrProvider) {
   if (explicit != null) return { value: explicit, auto: false }
-  const spec = specForModel(model)
+  const provider = typeof modelOrProvider === "string" ? { model: modelOrProvider } : (modelOrProvider ?? {})
+  const spec = providerSpec(provider)
   const value = Math.floor(spec.context * COMPACT_RATIO)
   return { value, auto: true }
 }
@@ -125,6 +133,9 @@ export function resolveEnableThinking(provider, spec) {
   return undefined
 }
 
+/** Module-level one-time warn dedupe for invalid providers[].context (PROVIDER.md §15 D-C1). */
+const warnedContextProviders = new Set()
+
 /**
  * Find provider by name in providers[].
  * Throws if name is non-empty but not found — a typo in activeProvider silently falling to the first provider would use the wrong key on the wrong endpoint.
@@ -188,6 +199,20 @@ export function loadConfig() {
     agent: { ...DEFAULTS.agent, ...config.agent },
     memory: { ...DEFAULTS.memory, ...config.memory },
     embedding: { ...DEFAULTS.embedding, ...config.embedding },
+    traces: { ...DEFAULTS.traces, ...config.traces },
+  }
+
+  // providers[].context (K units, PROVIDER.md §15 D-C1): positive integer only — invalid
+  // values (0/negative/non-numeric) are IGNORED (spec value applies) with a ONE-TIME warn
+  // per provider name (module-level dedupe, same precedent as warnedModels in model-specs.mjs).
+  for (const p of merged.providers) {
+    if (p.context === undefined) continue
+    if (Number.isInteger(Number(p.context)) && Number(p.context) > 0) { p.context = Number(p.context); continue } // 数字字符串（"128"）归一为数字——两端语义统一（code review #1）
+    if (!warnedContextProviders.has(p.name ?? "(unnamed)")) {
+      warnedContextProviders.add(p.name ?? "(unnamed)")
+      console.warn(`[config] provider "${p.name}" context must be a positive integer in K units (e.g. 128 = 128K) — got ${JSON.stringify(p.context)} — ignored, using the model spec value`)
+    }
+    delete p.context
   }
 
   // Consult/escalate pool validation (CLI parity with the plugin): up to 5 candidates.
@@ -227,7 +252,16 @@ export function loadConfig() {
   merged.proxy = normalizeProxy(merged.proxy)
 
   // Get the currently active provider
-  const active = findProvider(merged.providers, merged.activeProvider)
+  // 2026-09-02 Q1（SESSION.md §8）：activeProvider 指向不存在的 provider 不再抛错——runtimeProvider
+  // 置空对象，由 make-agent.mjs assembleAgent 后的校验打 `_providerInvalid` 标记 → TUI 引导重选 /
+  // headless 报可读错误（原 findProvider throw 直接击穿 loadConfig → uncaughtException 退出）。
+  // findProvider 的 throw 契约保留（advisor/run.mjs 等直接调用方仍依赖）。
+  let active
+  try {
+    active = findProvider(merged.providers, merged.activeProvider)
+  } catch {
+    active = {}
+  }
 
   // Build runtime provider object (for agent.provider usage)
   const runtimeProvider = { ...active }
@@ -236,20 +270,103 @@ export function loadConfig() {
   if (merged.activeModel) runtimeProvider.model = merged.activeModel
   merged.activeModel = merged.activeModel || null  // normalize for agent.activeModel
 
-  // Compaction threshold follows the model
+  // Compaction threshold follows the model (provider-level context override honored — providerSpec)
   const explicitThreshold = config.agent?.compactThreshold
-  const { value, auto } = resolveCompactThreshold(explicitThreshold, runtimeProvider.model)
+  const { value, auto } = resolveCompactThreshold(explicitThreshold, runtimeProvider)
   merged.agent.compactThreshold = value
   merged.agent.compactThresholdAuto = auto
 
   // Write back to merged for convenient access by upper layers
   merged.provider = runtimeProvider
+  // fetch 超时可配置（2026-09-01：agent.fetchTimeoutMs——provider/core.mjs effectiveFetchTimeoutMs 消费）
+  runtimeProvider.fetchTimeoutMs = Number.isFinite(merged.agent?.fetchTimeoutMs) && merged.agent.fetchTimeoutMs > 0
+    ? merged.agent.fetchTimeoutMs : undefined
   merged.providersList = merged.providers
   merged.advisor = { ...merged.agent.advisor }  // promote for consistent access (decoupled copy)
 
   return merged
 }
 
+/**
+ * MCP.md §5 D-3 (2026-09-01): re-read config.json and replace ONLY the agent's mcp section
+ * — the agent 代配 closed loop (agent edits config.json with its edit tool, /mcp picks it
+ * up). Never touches other config sections (providers/activeProvider stay as loaded).
+ *
+ * Malformed disk config → memory state kept, { ok:false, error } returned (the /mcp menu
+ * shows "⚠ disk config unreadable"). Never throws.
+ *
+ * 对账 (reconciliation, MCP.md §5 D-3 / T23): returns which disk servers CHANGED
+ * (fingerprint differs) or are DELETED from disk while still connected — fingerprint =
+ * endpoint + token + headers/env key order. Existing connections are NOT torn down (an
+ * in-use server must not be dropped): a deleted-but-connected server KEEPS its memory
+ * entry (appended after the disk list) so the /mcp list can still show the row with the
+ * "⚠ disk changed" mark. A server that is merely NEW on disk is not drift. persistRaw
+ * write + reload is idempotent (fingerprints equal → no drift mark).
+ *
+ * @param path optional config path override (tests inject a tmp file; default configPath)
+ */
+export function reloadMcpFromDisk(agent, path) {
+  const memoryServers = Array.isArray(agent.config?.mcp?.servers) ? agent.config.mcp.servers : []
+  const fileExists = existsSync(path ?? configPath)
+  const diskMcp = readMcpSection(path)
+  if (!diskMcp.ok) return { ok: false, error: diskMcp.error, changedNames: [] }
+  // Missing/deleted config file → keep whichever mcp servers the session had (never
+  // silently drop user servers because the file vanished — same memory-keeps policy
+  // as the malformed-disk fallback).
+  let diskServers = diskMcp.servers
+  if (diskServers.length === 0 && !fileExists) diskServers = memoryServers
+  // Drift vs the RAW disk list: fingerprint-changed or deleted-from-disk (T23 ⚠ 标记依据)
+  const diskNames = new Set(diskServers.filter((s) => s?.name).map((s) => s.name))
+  const changedNames = diffMcpServers(memoryServers, diskServers)
+  // Connected servers deleted from disk stay in the list (memory copy) — T23: the row
+  // must remain visible (marked ⚠) and its live connection untouched. They are already
+  // in changedNames (absent from disk), and stay flagged on every reload until the user
+  // reconnects (re-persists them) or removes them — real drift, honestly reported.
+  const connectedNames = new Set((agent.tools ?? []).filter((t) => t?._mcpName).map((t) => t._mcpName))
+  const keptConnected = memoryServers.filter((s) => s?.name && connectedNames.has(s.name) && !diskNames.has(s.name))
+  const finalServers = [...diskServers, ...keptConnected]
+  agent.config ??= {}
+  agent.config.mcp = { ...agent.config.mcp, servers: finalServers }
+  return { ok: true, servers: finalServers, changedNames }
+}
+
+/** Disk read behind reloadMcpFromDisk — bounded, never throws. */
+function readMcpSection(path = configPath) {
+  try {
+    if (!existsSync(path)) return { ok: true, servers: [] }
+    const raw = JSON.parse(readFileSync(path, "utf8"))
+    const servers = raw?.mcp?.servers
+    if (servers !== undefined && !Array.isArray(servers)) return { ok: true, servers: [] }
+    return { ok: true, servers: Array.isArray(servers) ? servers : [] }
+  } catch (error) {
+    return { ok: false, error: error?.message ?? String(error) }
+  }
+}
+
+/** Fingerprint = endpoint + token + headers/env entries in key order (JSON.stringify
+ *  of a normalized subset — key order included, matching connectMcpServer's
+ *  configFingerprint semantics: any change the connect layer would see counts).
+ *  Drift = CHANGED (fingerprint differs) or DELETED (missing from disk) — a server
+ *  that is new on disk is not drift (no live connection to protect). */
+function diffMcpServers(memoryServers, diskServers) {
+  const memFp = new Map(memoryServers.filter((s) => s?.name).map((s) => [s.name, mcpFingerprint(s)]))
+  const diskFp = new Map(diskServers.filter((s) => s?.name).map((s) => [s.name, mcpFingerprint(s)]))
+  const changed = []
+  for (const [name, fp] of diskFp) if (memFp.has(name) && memFp.get(name) !== fp) changed.push(name)
+  for (const name of memFp.keys()) if (!diskFp.has(name)) changed.push(name)
+  return changed
+}
+
+function mcpFingerprint(s) {
+  return JSON.stringify([
+    s.wsUrl ?? s.url ?? s.command ?? null,
+    s.args ?? null,
+    s.token ?? null,
+    s.headers ?? null,
+    s.env ?? null,
+  ])
+}
+
 /**
  * Save configuration. Preserves providers list structure and activeProvider pointer.
  * providers[i].apiKey is only written when explicitly passed in (does not overwrite env-var-fallback keys).

package/src/context.mjs

@@ -11,7 +11,7 @@
 
 import { chat } from "./provider/index.mjs"
 import { estimateText } from "./provider/rate.mjs"
-import { specForModel } from "./config.mjs"
+import { providerSpec } from "./config.mjs"
 
 const IMAGE_TOKEN_ESTIMATE = 2000 // rough estimate for image content tokens (CLI legacy 256 underestimated real image costs, delaying compaction)
 
@@ -37,16 +37,25 @@ export function estimateTokens(messages) {
 const KEEP_HEAD = 0 // No dedicated head: earliest messages may be a COMPLETED earlier task in multi-task
 // sessions — keeping them verbatim anchored attention on stale work. Everything before the tail is
 // summarized (the summary itself distinguishes completed vs in-progress work; see SUMMARIZE_PROMPT).
-// Tail size scales with the model context window (~30 messages per 100K tokens),
-// capped at 40% of history so small histories don't over-reserve. Window-adaptive
-// replaces the old fixed 10: on a 1M window, 10 messages is too thin for recent work.
+// Tail count formula (D4): window-adaptive (~30 msgs per 100K — old fixed 10 too thin on 1M), capped
+// at 40% of history; §9 D-T1/D-T2 make the count only a CANDIDATE — a token budget (TAIL_BUDGET_FRACTION
+// × window − SUMMARY_TOKEN_ESTIMATE ≈1K, §8) tightens it over pair-safe boundaries when compaction runs,
+// never below TAIL_FLOOR_MESSAGES; ordinary sessions never reach it (D-T4: trigger 0.6 untouched).
+const TAIL_BUDGET_FRACTION = 0.15
+const SUMMARY_TOKEN_ESTIMATE = 1000 // §8: summary output target ~1K tokens — reserved from the 15%
+const TAIL_FLOOR_MESSAGES = 10 // §9 D-T2: the tail keeps ≥10 verbatim messages — floor beats budget
 function keepTailSize(provider, historyLen) {
-  // provider is guaranteed at every call site (runAgent always builds one); specForModel
-  // degrades to DEFAULT_SPEC (128K) only if provider/model is somehow absent — acceptable
-  // because the 40% history cap still bounds the tail.
-  const ctxWindow = specForModel(provider?.model ?? "").context
+  // provider is guaranteed at every call site (runAgent always builds one); providerSpec
+  // degrades to DEFAULT_SPEC (128K) only if provider is somehow absent — acceptable
+  // because the 40% history cap still bounds the tail. providers[].context override
+  // (K units) is honored here (PROVIDER.md §15 T-C2: tail formula follows the window).
+  const ctxWindow = providerSpec(provider).context
   return Math.min(Math.max(10, Math.floor((ctxWindow / 100_000) * 30)), Math.floor(historyLen * 0.4))
 }
+// §9 D-T1 tail token budget: window×15% − summary ~1K — the compressed history segment (summary + placeholder + tail) lands ≈ 15% (B 口径 §9.5).
+function tailBudgetTokens(provider) {
+  return Math.max(0, Math.floor(providerSpec(provider).context * TAIL_BUDGET_FRACTION) - SUMMARY_TOKEN_ESTIMATE)
+}
 
 export const SUMMARIZE_PROMPT = `You are a conversation compressor. Summarize the following agent work log into a compact summary for use as context in the ongoing conversation.
 Requirements:
@@ -58,7 +67,7 @@ Requirements:
 - Explicitly list UNRESOLVED ISSUES / TODOs: anything still open plus the next steps — so post-compaction recovery knows where to resume
 - Drop: pleasantries, repetition, fine-grained tool output details
 - Honestly mark uncertain items: anything not actually verified must say "unverified"; do not present guesses as facts
-- Use bullet-point output; aim for information completeness, not a hard word limit (old 500-char cap is deprecated; in a 1M-context era, err on the long side)
+- Use bullet-point output. Stay under ~1K tokens (≈1000 Chinese chars / 4000 ASCII chars) — a hard target. An oversized summary wastes window and dilutes the tail; the old unbounded-length guidance is deprecated. When over budget, trim in this order: completed recaps to one line; FILES CHANGED why-notes to bare paths; in-progress prose tightened. NEVER cut design anchors or UNRESOLVED ISSUES/TODOs — recovery depends on them.
 
 Work log:
 `
@@ -67,7 +76,7 @@ Work log:
 const COMPACTION_PREFIX =
   "[Context was automatically compacted. Below is a summary of earlier work. " +
   "Treat it as notes, not proof — trust its conclusions (don't redo what it reports as done) " +
-  "but re-verify transient state with tools. Check memory_search for any missing decisions.]\n\n"
+  "but re-verify transient state with tools. Check memory search for any missing decisions.]\n\n"
 
 /** After this many consecutive compaction summary failures, degrade to deterministic truncation (losing info is better than task-killing 400 errors) */
 export const COMPRESS_FAILURE_LIMIT = 3
@@ -83,12 +92,13 @@ const FALLBACK_NOTE =
 
 /**
  * Split history into head / middle (to be summarized) / tail; return null if no middle to compress.
- * head is normally empty (KEEP_HEAD = 0 — earliest messages go into the summary); the
- * tool_calls-extension logic below is defensive for future KEEP_HEAD > 0.
- * The tail boundary must include any assistant whose tool results are in the tail — if the assistant is in the middle,
- * the summary swallows it, leaving orphan tool results → protocol 400.
+ * head is normally empty (KEEP_HEAD = 0 — earliest messages go into the summary); the tool_calls-extension logic below is defensive for future KEEP_HEAD > 0.
+ * The tail boundary must include any assistant whose tool results are in the tail — if the assistant is in the middle, the summary swallows it, leaving orphan tool results → protocol 400.
+ * `budgetTokens` (optional, §9 D-T1): when the candidate's estimate exceeds it, the boundary moves
+ * forward until the tail fits — never below the D-T2 floor (10 msgs, or the candidate itself when
+ * the 40% cap made it < 10 — short history).
  */
-function splitHistory(history, keepTail) {
+function splitHistory(history, keepTail, budgetTokens = null) {
   if (history.length <= KEEP_HEAD + keepTail + 1) return null
   let headEnd = KEEP_HEAD
   // head must not end with dangling tool_calls: when assistant declares tool_calls, all its tool results must stay in head.
@@ -96,10 +106,24 @@ function splitHistory(history, keepTail) {
   if (history[headEnd - 1]?.role === "assistant" && history[headEnd - 1].tool_calls?.length) {
     while (headEnd < history.length && history[headEnd].role === "tool") headEnd++
   }
-  let tailStart = history.length - keepTail
+  const candidate = repairedTailStart(history, headEnd, history.length - keepTail)
+  if (candidate <= headEnd) return null
+  let tailStart = candidate
+  // §9 D-T1: tighten only above the floor — a candidate ≤ 10 IS the floor (short history under the 40% cap must not tighten further, review #5); the floor is D5-repaired too.
+  if (budgetTokens > 0 && keepTail > TAIL_FLOOR_MESSAGES) {
+    const floor = repairedTailStart(history, headEnd, history.length - TAIL_FLOOR_MESSAGES)
+    if (floor > candidate) tailStart = tightenTailByBudget(history, candidate, floor, budgetTokens)
+  }
+  return { headEnd, tailStart }
+}
 
-  // Tool messages in the tail region whose assistant tool_calls are in the middle: the summary would swallow the assistant,
-  // leaving orphan tool results → protocol 400. Collect tool_call_ids from the tail, find their owner assistants and pull them into tail
+/**
+ * D5 tail-side pairing repair for a raw cut at history.length − tailCount: pull into the tail any
+ * assistant whose tool results are in the tail (the summary swallowing the owner leaves orphan tool
+ * results → protocol 400), then skip orphan tool messages at the new boundary. Single-assistant
+ * assumption (nearest owner only — a tail spans at most one assistant→tools cycle); bounds-guarded.
+ */
+function repairedTailStart(history, headEnd, tailStart) {
   const tailToolIds = new Set()
   for (let i = tailStart; i < history.length; i++) {
     if (history[i].role === "tool") tailToolIds.add(history[i].tool_call_id)
@@ -111,16 +135,28 @@ function splitHistory(history, keepTail) {
       break
     }
   }
-
-  // skip orphan tool messages at the new tail boundary (tool whose assistant was pulled in above)
-  // NOTE: single-assistant assumption — the backwards scan pulls the nearest owner only; in
-  // practice a tail spans at most one assistant→tools cycle (parallel calls share one assistant).
-  // Bounds-guarded so an all-tool tail cannot push tailStart past history.length.
   while (tailStart < history.length && tailStart > headEnd && history[tailStart].role === "tool") {
     tailStart++
   }
-  if (tailStart <= headEnd) return null
-  return { headEnd, tailStart }
+  return tailStart
+}
+
+/**
+ * §9 D-T1 budget tightening (pair-safe, review #2): walk the boundary FORWARD (fewer tail messages —
+ * the rest joins the summary) while the tail's estimated tokens exceed the budget. Only pair-safe
+ * positions may stop the walk: a boundary ON a tool message would orphan its owner assistant into the
+ * middle (D5); pairing is contiguous in the machine line (§6 note) — every non-tool boundary is safe.
+ * No fit before the floor → keep the floor, accept the overrun.
+ */
+function tightenTailByBudget(history, start, floorStart, budgetTokens) {
+  const suffixTokens = new Array(history.length + 1)
+  suffixTokens[history.length] = 0
+  for (let i = history.length - 1; i >= 0; i--) suffixTokens[i] = suffixTokens[i + 1] + estimateTokens([history[i]])
+  if (suffixTokens[start] <= budgetTokens) return start // already fits — ordinary sessions stay untouched (D-T2)
+  for (let p = start + 1; p <= floorStart; p++) { // first fit keeps the most recent verbatim context
+    if (history[p].role !== "tool" && suffixTokens[p] <= budgetTokens) return p
+  }
+  return floorStart
 }
 
 /**
@@ -131,9 +167,14 @@ function splitHistory(history, keepTail) {
  * Machine-only messages ([System reminder:...], compaction notes, task/plan/checkpoint re-injections)
  * are pushed directly to agent.history WITHOUT going through here, so they never enter _fullHistory.
  * The two lines are written independently at the source — no after-the-fact delta sync.
+ * Message timestamps (SESSION.md §9 D-S1): stamped HERE once at push time (epoch ms) — a single
+ * point covers every real message. Pre-existing ts (e.g. from another end writing the shared slot)
+ * is preserved; restored old messages keep no ts rather than getting a misleading backdate (D-S3).
+ * ts is a LOCAL-ONLY field — the send layer strips it before any provider request (T-S3).
  */
 export function pushReal(agent, msg) {
   if (!Array.isArray(agent._fullHistory)) agent._fullHistory = []
+  if (msg && msg.ts === undefined) msg.ts = Date.now()
   agent._fullHistory.push(msg)
   agent.history.push(msg)
 }
@@ -147,10 +188,14 @@ function applyCompression(agent, headEnd, tailStart, note) {
   // possibly-completed earlier requests.
   const head = agent.history.slice(0, headEnd)
   const tail = agent.history.slice(tailStart)
+  // SESSION.md §9 D-S1: compaction-injected messages (note + "Understood") carry a ts —
+  // Date.now() at the compaction moment. They are machine-only (never in _fullHistory),
+  // but the machine-line timeline stays consistent for any audit use.
+  const now = Date.now()
   agent.history = [
     ...head,
-    { role: "user", content: note },
-    { role: "assistant", content: "Understood. I'll continue from these notes, re-verifying anything transient." },
+    { role: "user", content: note, ts: now },
+    { role: "assistant", content: "Understood. I'll continue from these notes, re-verifying anything transient.", ts: now },
     ...tail,
   ]
   // Compaction REBUILDS the machine line (head + note + "Understood" + tail), so the pre-compaction
@@ -195,8 +240,10 @@ function applyCompression(agent, headEnd, tailStart, note) {
  * Automatically re-injects task list state after compaction.
  * @param {object} agent
  * @param {number} threshold - compaction threshold in tokens
- * @param {object} callbacks - { onToken, onReasoning, onCompress } — summary generation is SILENT
- *   (never forwards onToken/onReasoning: the compaction process is an internal mechanism, not a model reply)
+ * @param {object} callbacks - { onToken, onReasoning, onCompress, onCompressStart } — summary
+ *   generation is SILENT (never forwards onToken/onReasoning: the compaction process is an
+ *   internal mechanism, not a model reply); onCompressStart fires right before the summary call
+ *   (§7 D-C1, compression lifecycle visibility — panel start state)
  * @param {object} extras - { systemPrompt?, tools? } — estimated overhead for the pure-estimation
  *   path (no measured baseline); the measured path already includes system+tools in prompt_tokens.
  */
@@ -214,7 +261,7 @@ export async function compressIfNeeded(agent, threshold, callbacks, extras = {},
   if (tokens <= threshold) return false
 
   const keepTail = keepTailSize(agent.provider, history.length)
-  const split = splitHistory(history, keepTail)
+  const split = splitHistory(history, keepTail, tailBudgetTokens(agent.provider))
   if (!split) {
     // History is too short (≤KEEP_HEAD+keepTail+1 messages) to find a middle section, but tokens exceed threshold — typically a single giant message
     // (large paste / huge injection). When summarization has no room, degrade to deterministic shrinking to ensure context always reduces
@@ -239,13 +286,35 @@ export async function compressIfNeeded(agent, threshold, callbacks, extras = {},
   // The summary is a plain-text task, no reasoning needed — passing thinking to the compaction provider wastes tokens.
   // Silent by design (D11): no onToken/onReasoning — the compaction process must not stream to the frontend.
   // signal propagates user cancellation (Ctrl+C) to the in-flight summary call.
+  // Compression visibility (CONTEXT-COMPACTION.md §7 D-C1/D-C2): the frontend learns the compression
+  // STARTED right before the LLM call ("Compressing context… / summarizing N messages" panel) — only
+  // the lifecycle is surfaced, never the summary body. N = the number of history messages being summarized.
+  callbacks?.onCompressStart?.({ messages: middle.length })
+  const startedAt = performance.now()
   const summary = await chat({ ...agent.provider, thinking: null, reasoningEffort: null }, {
     messages: [{ role: "user", content: SUMMARIZE_PROMPT + serialized }],
     signal,
+    // §18.6 D-TR4：轨迹元数据增补——kind=compress（上下文构建面——agent 元数据透出；
+    // depth 经 extras.traceDepth——agent.mjs 主作用域传入——compress 调用点补齐）
+    logCtx: {
+      stage: "compress", child: agent._logId, kind: "compress",
+      role: agent._role ?? null, depth: extras?.traceDepth ?? null,
+      session: agent._sessionStart ?? null, cwd: agent.cwd,
+      traces: agent.config?.traces?.enabled !== false,
+    },
   })
 
   applyCompression(agent, split.headEnd, split.tailStart, COMPACTION_PREFIX + summary.content)
 
+  // Completion info for the compression panel (D-C2): tokens freed = the pre-compression prompt
+  // estimate (`tokens` — the value that tripped the threshold, incl. system/tools overhead on the
+  // pure-estimation path) minus the post-compression estimate on the same basis. Elapsed = the
+  // summary call + splice duration. agent.mjs forwards this to onCompress unchanged.
+  agent._lastCompressInfo = {
+    mode: "summary",
+    tokensFreed: Math.max(0, Math.round(tokens - (estimateTokens(agent.history) + overhead))),
+    elapsedMs: performance.now() - startedAt,
+  }
   return true
 }
 
@@ -255,9 +324,13 @@ export async function compressIfNeeded(agent, threshold, callbacks, extras = {},
  */
 export function compressFallback(agent) {
   const keepTail = keepTailSize(agent.provider, agent.history.length)
-  const split = splitHistory(agent.history, keepTail)
+  const split = splitHistory(agent.history, keepTail, tailBudgetTokens(agent.provider))
   if (!split) return false
+  const tailMessages = agent.history.length - split.tailStart
   applyCompression(agent, split.headEnd, split.tailStart, FALLBACK_NOTE)
+  // Fallback completion info (D-C2): mode marks the deterministic-truncation path — the panel
+  // shows the degradation note ("truncated to N messages") ONLY after 3 consecutive failures.
+  agent._lastCompressInfo = { mode: "fallback", tailMessages }
   return true
 }
 
@@ -383,7 +456,7 @@ function serializeExplorationMessages(messages) {
  * or null when there is nothing to shrink (<3 exploration results / LLM failure). Pairing-safe:
  * whole assistant→tool blocks are removed, so no orphan tool_calls/tool can survive.
  */
-async function distillExplorations(history, start, provider, signal) {
+async function distillExplorations(history, start, provider, signal, agent, depth) {
   if (!Array.isArray(history) || history.length - start < 2) return null
   const blocks = findExplorationBlocks(history, start)
   const resultCount = blocks.reduce((n, b) => n + b.toolCount, 0)
@@ -398,6 +471,14 @@ async function distillExplorations(history, start, provider, signal) {
     const resp = await chat({ ...provider, thinking: null, reasoningEffort: null }, {
       messages: [{ role: "user", content: EXPLORE_SUMMARY_PROMPT + serialized }],
       signal,
+      // §18.6 D-TR4：轨迹元数据增补——kind=distill（探索蒸馏面——agent 元数据透出；
+      // depth 经 summarizeRunExplorations 参数透传——agent.mjs 主作用域传入）
+      logCtx: {
+        stage: "distill", child: agent?._logId ?? null, kind: "distill",
+        role: agent?._role ?? null, depth: depth ?? null,
+        session: agent?._sessionStart ?? null, cwd: agent?.cwd ?? process.cwd(),
+        traces: agent?.config?.traces?.enabled !== false,
+      },
     })
     summary = resp?.content
   } catch {
@@ -428,8 +509,8 @@ async function distillExplorations(history, start, provider, signal) {
  * ONLY after the replacement actually lands (never on no-op/failure) — callers persist the
  * compressed session (SEND-STALL-DISTILL §2.3).
  */
-export async function summarizeRunExplorations(agent, callbacks, signal) {
-  const next = await distillExplorations(agent.history, agent._runStartHistoryLen ?? 0, agent.provider, signal)
+export async function summarizeRunExplorations(agent, callbacks, signal, depth = 0) {
+  const next = await distillExplorations(agent.history, agent._runStartHistoryLen ?? 0, agent.provider, signal, agent, depth)
   if (!next) return
   agent.history = next
   // The machine line changed shape — the measured token baseline was for the pre-shrink context.

package/src/distill.mjs

@@ -5,6 +5,7 @@
  */
 
 import { chat } from "./provider/index.mjs"
+import { loadConfig } from "./config.mjs"
 import { put, putMarkdown } from "./memory.mjs"
 import { commitAndPush } from "./git/gitmem.mjs"
 
@@ -39,13 +40,30 @@ If the session is long, prioritize conclusions that appeared last and are still
 Session log:
 `
 
+/** §18.6 D-TR6（2026-09-04 fix round1）：distill 调用点无 agent 作用域——traces 开关
+ *  缺省回退磁盘配置（loadConfig——与 agent.config 同源：traces.enabled 缺省 on）；
+ *  配置不可读时按缺省 on（注：CLI 启动早已 loadConfig——此处仅是兜底防御）。 */
+function tracesEnabledFromConfig() {
+  try {
+    return loadConfig().traces?.enabled !== false
+  } catch {
+    return true
+  }
+}
+
 /**
  * Extract candidates from a session transcript. transcript: plain-text session record.
  * Returns [{ type, title, content, tags, scope }], or [] on parse failure.
+ * opts.traces（可选）：§18.6 D-TR6 开关显式透传（测试隔离/未来调用方）——缺省回退
+ * 磁盘配置（tracesEnabledFromConfig）——关 = chat() 出口不落盘。
  */
-export async function extractCandidates(provider, transcript) {
+export async function extractCandidates(provider, transcript, opts = {}) {
+  const traces = opts.traces ?? tracesEnabledFromConfig()
   const res = await chat(provider, {
     messages: [{ role: "user", content: DISTILL_PROMPT + transcript }],
+    // §18.6 D-TR4/D-TR6（fix round1）：distill 调用经 chat() 唯一采集点——补轨迹
+    // 元数据 + traces 开关透传（关=不落盘必须全覆盖——不再静默越过开关）
+    logCtx: { stage: "distill", kind: "distill", traces },
   })
   // Balanced-bracket extraction: find the first '[' and track depth through nested
   // brackets (tags arrays, nested objects, etc.) until the matching ']'.