thincoder 0.12.54 → 0.12.59

package/src/advisor/run.mjs

@@ -3,7 +3,7 @@
  * Message building lives in advisor.mjs.
  */
 import { chat } from "../provider/core.mjs"
-import { findProvider, specForModel } from "../config.mjs"
+import { findProvider, providerSpec } from "../config.mjs"
 import { toOpenAISchema } from "../tools/index.mjs"
 import { prepareAdvisorMessages } from "../advisor.mjs"
 import { appendCitationReport } from "./citations.mjs"
@@ -120,6 +120,9 @@ function renderTimeline(timeline, tail = "") {
 }
 // Test seam (mirrors _advisorToolsFor).
 export { renderTimeline as _renderTimeline }
+// Test seam (T-TS8/9): the tool loop itself — toolsOverride injects a mock tool
+// set with controllable timing/errors (the real set comes from advisorToolsFor).
+export { runAdvisorToolLoop as _runAdvisorToolLoop }
 
 /**
  * Run the advisor's tool loop: chat → execute tools → repeat.
@@ -129,7 +132,7 @@ export { renderTimeline as _renderTimeline }
  * the panel keeps moving while the advisor explores — otherwise the panel sits
  * frozen through every tool-call phase and the review appears to have stalled.
  */
-async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, cwd) {
+async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, cwd, toolsOverride = null) {
   // Kind-tagged wrappers: the TUI panel colors reasoning / answer / tool progress differently.
   // Every chunk is ALSO recorded into an ordered timeline — the persisted record
   // must show the review process (thinking ↔ tool progress ↔ final text) at its
@@ -145,7 +148,9 @@ async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, c
   const onThink = emit("think")
   const onText = emit("text")
   const onTool = emit("tool")
-  const { schemas: toolSchemas, byName: toolByName } = advisorToolsFor(agent)
+  // toolsOverride = test seam (T-TS8/9): the real advisor tool set, or a mock
+  // set with controllable timing/errors.
+  const { schemas: toolSchemas, byName: toolByName } = toolsOverride ?? advisorToolsFor(agent)
   let turns = 0
   const startTime = Date.now()
   
@@ -198,6 +203,18 @@ async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, c
       signal: signal ?? null,
       onToken: onText,
       onReasoning: onThink,
+      // LOGGING（vscode advisor/run.mjs parity——按 stage 可 grep）
+      // §18.6 D-TR4：轨迹元数据增补——kind=advisor（评审独立于子代理——T-TR2）；role
+      // 透出调用方角色（eng-coder 内嵌评审时为 "eng-coder"）；session/cwd 供轨迹对回；
+      // traces 开关沿 agent.config（D-TR6）。
+      logCtx: {
+        stage: "advisor",
+        role: agent?._role ?? null,
+        kind: "advisor",
+        session: agent?._sessionStart ?? null,
+        cwd,
+        traces: agent?.config?.traces?.enabled !== false,
+      },
     })
 
     // No tool calls — this is the final review text. The final answer was
@@ -221,13 +238,24 @@ async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, c
         id: tc.id, type: "function",
         function: { name: tc.name, arguments: tc.arguments },
       })),
-      ...(response.reasoning && specForModel(provider.model).reasoningEcho === "required"
+      ...(response.reasoning && providerSpec(provider).reasoningEcho === "required"
         ? { reasoning_content: response.reasoning }
         : {}),
     })
 
-    // Execute each tool call
-    for (const tc of response.toolCalls) {
+    // B1 (AGENT-LOOP.md §18.7 D-TS7): the SAME LLM reply's multiple read-only
+    // tool calls run in PARALLEL (Promise.all) — results are backfilled in
+    // toolCalls order (Promise.all preserves the input order → tool_call_id
+    // never mismatches); each tool's timeout/error is captured independently
+    // (the existing TOOL_TIMEOUT stays — one failing tool does not block the
+    // others); progress lines are emitted in toolCalls order. The read-only
+    // tool set has no side effects — no sequencing/serialization needed.
+    // Scope note (round1 review #10): B1 is ONLY in-loop tool parallelism — it
+    // does NOT solve the TODO "platform execution: advisor parallel calls are
+    // actually serial" mystery (docs/TODO.md — LOGGING evidence item), which
+    // concerns multiple advisor CALLS observed as serial, not one reply's
+    // tool calls.
+    const parsed = response.toolCalls.map((tc) => {
       const tool = toolByName.get(tc.name)
       let args = {}
       let parseError = null
@@ -236,63 +264,69 @@ async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, c
       } catch (e) {
         parseError = `Error: invalid JSON in tool arguments: ${e.message}\nRaw arguments: ${(tc.arguments || "").slice(0, 200)}`
       }
-      
-      // If parse failed, return error to model immediately
-      if (parseError) {
-        messages.push({ role: "tool", tool_call_id: tc.id, content: parseError })
-        continue
-      }
-      
-      const argsLine = describeToolArgs(tc.name, args)
-      onTool(`\n→ ${tc.name}${argsLine ? " " + argsLine : ""}\n`)
-      let result
-      if (!tool) {
-        result = `Error: unknown tool "${tc.name}". Available: ${[...toolByName.keys()].join(", ")}`
-      } else {
-        // Execute with timeout (clear the timer when the tool wins the race —
-        // otherwise up to MAX_ADVISOR_TURNS dangling timers accumulate)
+      return { tc, tool, args, parseError }
+    })
+    // Progress lines first, in toolCalls order (emitted before the parallel
+    // run — display order is independent of completion order).
+    for (const p of parsed) {
+      if (p.parseError) continue // parse-error tools get no progress line (legacy behavior)
+      const argsLine = describeToolArgs(p.tc.name, p.args)
+      onTool(`\n→ ${p.tc.name}${argsLine ? " " + argsLine : ""}\n`)
+    }
+    // Every tool runs CONCURRENTLY; each result/error lands in its own slot —
+    // Promise.all preserves input order, so index i always matches parsed[i].
+    const executed = await Promise.all(parsed.map(async (p) => {
+      // Parse failure → error to model immediately (no execution)
+      if (p.parseError) return p.parseError
+      if (!p.tool) return `Error: unknown tool "${p.tc.name}". Available: ${[...toolByName.keys()].join(", ")}`
+      // Execute with timeout (clear the timer when the tool wins the race —
+      // otherwise up to MAX_ADVISOR_TURNS dangling timers accumulate)
+      try {
+        let timeoutId
+        const timeoutPromise = new Promise((_, reject) => {
+          timeoutId = setTimeout(() => reject(new Error(`tool timeout after ${TOOL_TIMEOUT_MS}ms`)), TOOL_TIMEOUT_MS)
+        })
+        let toolPromise
         try {
-          let timeoutId
-          const timeoutPromise = new Promise((_, reject) => {
-            timeoutId = setTimeout(() => reject(new Error(`tool timeout after ${TOOL_TIMEOUT_MS}ms`)), TOOL_TIMEOUT_MS)
-          })
-          let toolPromise
-          try {
-            toolPromise = tool.execute(args, { cwd, agent, onOutput, signal })
-            result = await Promise.race([toolPromise, timeoutPromise])
-          } finally {
-            clearTimeout(timeoutId)
-            // Timeout won → toolPromise is still pending; a later rejection
-            // would surface as an unhandled rejection. The race already
-            // consumed the result/error in the normal path, so this no-op
-            // catch only fires for the abandoned-tool case.
-            toolPromise?.catch(() => {})
-          }
-        } catch (e) {
-          const errorType = e.message.includes("timeout") ? "timeout"
-            : e.message.includes("ENOENT") ? "file_not_found"
-            : e.message.includes("permission") ? "permission_denied"
-            : "execution_error"
-          result = `Error (${errorType}): ${e.message}`
+          toolPromise = p.tool.execute(p.args, { cwd, agent, onOutput, signal })
+          return await Promise.race([toolPromise, timeoutPromise])
+        } finally {
+          clearTimeout(timeoutId)
+          // Timeout won → toolPromise is still pending; a later rejection
+          // would surface as an unhandled rejection. The race already
+          // consumed the result/error in the normal path, so this no-op
+          // catch only fires for the abandoned-tool case.
+          toolPromise?.catch(() => {})
         }
+      } catch (e) {
+        const errorType = e.message.includes("timeout") ? "timeout"
+          : e.message.includes("ENOENT") ? "file_not_found"
+          : e.message.includes("permission") ? "permission_denied"
+          : "execution_error"
+        return `Error (${errorType}): ${e.message}`
       }
+    }))
+
+    // Backfill in toolCalls order (executed[i] ↔ parsed[i]); per-result
+    // non-string serialization + line-aware truncation stay per-tool.
+    for (let i = 0; i < parsed.length; i++) {
+      let result = executed[i]
       if (typeof result !== "string") result = JSON.stringify(result)
-      
-      // Line-aware truncation: preserve line integrity
+
       if (result.length > MAX_RESULT_CHARS) {
         const lines = result.split("\n")
         let truncated = ""
         let charCount = 0
         let keptLines = 0
-        
-        for (let i = 0; i < lines.length; i++) {
-          const line = lines[i]
+
+        for (let j = 0; j < lines.length; j++) {
+          const line = lines[j]
           if (charCount + line.length + 1 > MAX_RESULT_CHARS) break
           truncated += line + "\n"
           charCount += line.length + 1
           keptLines++
         }
-        
+
         const remainingLines = lines.length - keptLines
         result = (
           truncated +
@@ -300,8 +334,8 @@ async function runAdvisorToolLoop(provider, messages, onOutput, signal, agent, c
           `To see more content, use: read(path, offset=${keptLines + 1}, limit=200)`
         )
       }
-      
-      messages.push({ role: "tool", tool_call_id: tc.id, content: result })
+
+      messages.push({ role: "tool", tool_call_id: parsed[i].tc.id, content: result })
     }
   }
 }
@@ -359,8 +393,12 @@ function extractUnfixedIssues(priorText) {
  * Run an advisor review. reviewType: "code" (default) or "design". Returns review text or null when skipped.
  * @param {string|null} [designToken] — injected into the design-review prompt; the advisor echoes it only on approval.
  * @param {string[]|null} [documents] — design review only: explicit list of doc paths to review; passed through to the message builder.
+ * @param {string[]|null} [paths] — code review only: explicit list of file/dir paths to review.
+ * @param {Object|null} [object] — review-object declaration (§18.8 D-OA1/D-OA3):
+ *   { type, target, status, reason, exclude }; mechanically injected at the
+ *   start of every review round's user message. Absent → legacy behavior (no injection).
  */
-export async function runAdvisorReview(agent, reviewType, callbacks, designToken = null, documents = null, paths = null) {
+export async function runAdvisorReview(agent, reviewType, callbacks, designToken = null, documents = null, paths = null, object = null) {
   const onOutput = callbacks?.onOutput
   const signal = callbacks?.signal
   const startTime = Date.now()
@@ -395,7 +433,7 @@ export async function runAdvisorReview(agent, reviewType, callbacks, designToken
   // Advisor always works in the agent's cwd — scope is defined by paths/documents.
   const advisorCwd = agent.cwd
 
-  const messages = prepareAdvisorMessages(agent, reviewType, designToken, documents, paths)
+  const messages = prepareAdvisorMessages(agent, reviewType, designToken, documents, paths, null, object)
 
   try {
     const result = await runAdvisorToolLoop(provider, messages, onOutput, signal, agent, advisorCwd)

package/src/advisor.mjs

@@ -45,12 +45,13 @@ import { readFileSync } from "node:fs"
 import { join, dirname } from "node:path"
 import { fileURLToPath } from "node:url"
 import { extractAgentResponseTable } from "./advisor/history.mjs"
-import { buildAdvisorUserMessage, resolveScopeFiles } from "./advisor/messages.mjs"
+import { buildAdvisorUserMessage, resolveScopeFiles, buildObjectDeclarationBlock } from "./advisor/messages.mjs"
 import { buildConvergenceBody } from "./advisor/convergence.mjs"
 import { escapeLiteralEscapes } from "./escape.mjs"
 // Re-export for run.mjs and tests (keeps their imports from "../advisor.mjs" stable)
 export { ADVISOR_MD_PATH, extractAgentResponseTable, extractConversationBackground } from "./advisor/history.mjs"
 export { buildAdvisorUserMessage } from "./advisor/messages.mjs"
+export { buildObjectDeclarationBlock } from "./advisor/messages.mjs"
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 
@@ -135,13 +136,15 @@ export function buildAdvisorSystemPrompt(agent, prior, reviewType) {
  * @param {Object} agent — the parent agent (history used for the response table)
  * @param {Object|null} prior — prior issue table (extracted from history when null)
  * @param {string[]|null} [scopeFiles] — review surface for the no-response fallback (cwd-relative)
+ * @param {Object|null} [object] — review-object declaration (§18.8): mechanically
+ *   prepended to the round-2+ follow-up so every round stays anchored (T-OA2).
  * @returns {string} the follow-up user message — or a plain "System reminder: …"
  *   fresh-review fallback (NO brackets — some OpenAI-compatible servers parse
  *   '['-prefixed content as structured data / expand escapes) when no prior
  *   review exists at all (caller misuse; the response-table extraction would
  *   otherwise scan history from index 0 and could match an unrelated stale table)
  */
-export function buildAdvisorFollowUp(agent, prior, scopeFiles = null) {
+export function buildAdvisorFollowUp(agent, prior, scopeFiles = null, object = null) {
   // Convergence follow-up REQUIRES a prior review record — the full output of
   // the last review, injected VERBATIM (decision 2026-08-08: the model
   // understands the review output; no table/header/phrase parsing). The caller
@@ -164,7 +167,9 @@ export function buildAdvisorFollowUp(agent, prior, scopeFiles = null) {
     : "(Agent did not provide a response table — perform a fresh full review; the review surface is unknown, ask the user for the file list)"
   const response = extractAgentResponseTable(agent.history) || noResponseFallback
   const round = (agent._advisorRound || 0) + 1
-  return buildConvergenceBody(p, response, round, scopeFiles)
+  // Review-object declaration FIRST (T-OA2 — round 2+ stays anchored, no re-archaeology).
+  const declaration = buildObjectDeclarationBlock(object)
+  return (declaration ? declaration + "\n" : "") + buildConvergenceBody(p, response, round, scopeFiles)
 }
 
 /**
@@ -187,8 +192,11 @@ export { escapeLiteralEscapes }
  * @param {string|null} [designToken] — design-review approval token (design only)
  * @param {string[]|null} [documents] — design review only: explicit list of doc paths to review (passed through to buildAdvisorUserMessage)
  * @param {string[]|null} [paths] — code review only: explicit list of file/dir paths to review
+ * @param {Object|null} [object] — review-object declaration (§18.8 D-OA1): passed through
+ *   to the user-message builders; mechanically injected at the start of every review
+ *   round (round 1 design/code + round 2+ follow-up). Absent → legacy behavior.
  */
-export function prepareAdvisorMessages(agent, reviewType, designToken = null, documents = null, paths = null, priorParam = null) {
+export function prepareAdvisorMessages(agent, reviewType, designToken = null, documents = null, paths = null, priorParam = null, object = null) {
   // Deterministic convergence state (decision 2026-08-08): round 2+ requires
   // _advisorRound > 0 AND a stored prior review output. No history parsing.
   // priorParam (direct callers) wins over the stored output — same derivation
@@ -201,7 +209,7 @@ export function prepareAdvisorMessages(agent, reviewType, designToken = null, do
   if (reviewType === "design" && (agent._advisorRound || 0) === 0) {
     return [
       { role: "system", content: withTime(buildAdvisorSystemPrompt(agent, prior, reviewType)) },
-      { role: "user", content: escapeLiteralEscapes(buildAdvisorUserMessage(agent, prior, reviewType, designToken, documents, paths)) },
+      { role: "user", content: escapeLiteralEscapes(buildAdvisorUserMessage(agent, prior, reviewType, designToken, documents, paths, object)) },
     ]
   }
 
@@ -226,7 +234,7 @@ export function prepareAdvisorMessages(agent, reviewType, designToken = null, do
       agent._advisorRound = 0
     }
     // Mutations exist → KEEP the round (cap keeps advancing through retries).
-    const user = buildAdvisorUserMessage(agent, prior, reviewType, designToken, documents, paths)
+    const user = buildAdvisorUserMessage(agent, prior, reviewType, designToken, documents, paths, object)
     return [
       { role: "system", content: withTime(buildAdvisorSystemPrompt(agent, prior, reviewType)) },
       {
@@ -257,6 +265,6 @@ export function prepareAdvisorMessages(agent, reviewType, designToken = null, do
   const scopeFiles = resolveScopeFiles(agent, paths)
   return [
     { role: "system", content: withTime(buildAdvisorSystemPrompt(agent, prior, reviewType)) },
-    { role: "user", content: escapeLiteralEscapes(buildAdvisorFollowUp(agent, prior, scopeFiles)) },
+    { role: "user", content: escapeLiteralEscapes(buildAdvisorFollowUp(agent, prior, scopeFiles, object)) },
   ]
 }

package/src/agent/dispatch.mjs

@@ -1,6 +1,7 @@
 /**
  * agent/dispatch.mjs — two-phase tool call execution
  */
+import { logEvent, errText, headText } from "../log.mjs"
 import { offloadToolResult, FILE_MUTATORS } from "./helpers.mjs"
 import { runHooks } from "../hooks.mjs"
 import { snapshotForUndo } from "../tui/cmd-undo.mjs"
@@ -37,6 +38,55 @@ function logToolError(toolName, args, error) {
   }
 }
 
+/**
+ * §19 action-level classification (AGENT-LOOP.md §19 D-M1): the merged subagent
+ * tool expresses spawn (side effect) and check/status (read-only queries) through
+ * its `action` parameter — the tool-level readonly flag can no longer express both.
+ * dispatch Phase-1/Phase-2 classifies per action: check/status behave as readonly
+ * (planMode pass / no permission ask / batchable), spawn keeps its non-readonly
+ * gates, escalate runs non-readonly AND serially (the retired escalate tool had no
+ * parallel flag — zero behavior change under the merged surface).
+ * §19.5 cancel (19.5.2b round2 #4): CONTROL-class exemption — cancel only
+ * stops, never starts. isSubagentControlAction feeds the SAME two gate sites as
+ * readonly (planMode pass / no permission ask — never joins a batch approval
+ * group / no handler → not denied — digest 内 cancel 放行).
+ * §19.6 panel (round1 #5): view 面归只读类（同 check/status——planMode 放行、免
+ * 审批、可批并行）；freeze 面归控制类（同 cancel——planMode 放行、免权限审批、
+ * 批审批不入组、digest 内放行）。freeze 存在（非空 key）即控制类——否则只读类。
+ */
+function isSubagentReadonlyAction(toolName, args) {
+  // §6 memory 工具面重构（MEMORY.md §6 D-M5）：memory search/list 是只读动作——与
+  // subagent check/status 同分类（planMode 放行/免审批——Phase-2 批并行只认工具级
+  // readonly/parallel，memory 无 parallel → 按非只读串行，见 MEMORY.md §6.4 实现注）。
+  // 动作级判定——不能按工具名（同一 memory 工具的 put/delete/clear 保持侧效门）。
+  if (toolName === "memory") {
+    const action = args?.action
+    return action === "search" || action === "list"
+  }
+  // SETTINGS-TOOL.md（2026-09-05）：settings list/get 是只读动作（memory search/list 同分类——
+  // planMode 放行/免审批）；set 保持侧效门。
+  if (toolName === "settings") {
+    const action = args?.action
+    return action === "list" || action === "get"
+  }
+  if (toolName !== "subagent" || !args || typeof args !== "object") return false
+  const action = args.action
+  if (action === "check" || action === "status") return true
+  // §19.6 panel view 面（freeze 缺省/空 = 视图请求——readonly；非空 freeze 归控制类）
+  if (action === "panel" && (args.freeze === undefined || args.freeze === null || String(args.freeze) === "")) return true
+  return false
+}
+function isSubagentControlAction(toolName, args) {
+  if (toolName !== "subagent") return false
+  if (args?.action === "cancel") return true
+  // §19.6 panel freeze 面（D-P3 门控在 executor——只读/控制分类在此）
+  if (args?.action === "panel" && args.freeze !== undefined && args.freeze !== null && String(args.freeze) !== "") return true
+  return false
+}
+function isSubagentEscalateAction(toolName, args) {
+  return toolName === "subagent" && args?.action === "escalate"
+}
+
 /**
  * Two-phase execution:
  * Phase 1 (serial): parse args one by one + planMode check + permission confirmation (side-effecting tools)
@@ -46,7 +96,12 @@ function logToolError(toolName, args, error) {
  */
 export async function executeToolCalls(agent, toolByName, toolCalls, callbacks, depth = 0, signal) {
   // ---- Phase 1: serial preparation ----
+  // Pre-gates run per tool (parse/planMode/engineering gates); non-readonly tools
+  // that REACH the permission stage are collected into one batch — a single merged
+  // ask covers the whole toolCalls array (§16 D-B1, "approve all / one by one /
+  // deny"). Tools stopped by a pre-gate never join the batch (review #7).
   const prepared = []
+  const permPending = [] // { toolCall, tool, args } — reached the permission stage
   for (const toolCall of toolCalls) {
     const tool = toolByName.get(toolCall.name)
     let args
@@ -64,7 +119,7 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       continue
     }
 
-    if (agent.planMode && !tool.readonly) {
+    if (agent.planMode && !tool.readonly && !isSubagentReadonlyAction(toolCall.name, args) && !isSubagentControlAction(toolCall.name, args)) {
       prepared.push({ toolCall, tool, denied: true, reason: "plan mode" })
       continue
     }
@@ -106,39 +161,82 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       }
     }
 
-    if (!tool.readonly) {
-      // autoApprove short-circuit: skip prompt when agent is already marked for auto-approval
-      const allowed = agent.autoApprove
-        ? true
-        : callbacks.onPermissionRequest
-          ? await (async () => {
-              // D2 (AGENT-LOOP.md §7.2): announce the wait BEFORE prompting — the TUI
-              // subagent block header flips to "等待审批" so a waiting child is visibly
-              // different from a stalled one. Depth>0 only (the parent TUI shows its own
-              // permission panel). turn n/max = the child's live turn counters.
-              if (depth > 0) {
-                callbacks.onToken?.(`⟦ev⟧approval\x1e${agent._currentTurn ?? 0}\x1e${agent._maxTurns ?? 0}\x1eapproval\x1e${String(toolCall.name).slice(0, 40)}`)
-              }
-              return await callbacks.onPermissionRequest(toolCall.name, args)
-            })()
-          : false
-      if (!allowed) {
-        prepared.push({ toolCall, tool, denied: true, reason: callbacks.onPermissionRequest ? "denied by user" : "no permission handler" })
+    // Readonly tools (and autoApprove — the short-circuit, unchanged for the
+    // whole batch too) skip the permission stage entirely.
+    // §18 D-E3 task-domain authorization (spawn-time): an eng-coder child's
+    // tools skip the permission ASK stage exactly like autoApprove — granted by
+    // the parent spawn (approved design + task = authorization; subagent.mjs
+    // sets _engTaskAuthorized on the child). Everything EARLIER in Phase 1
+    // (JSON parse / unknown tool / planMode / design-token gates) ran unchanged
+    // — the exemption never widens what reaches this stage (round4 #3, T-E14).
+    // PreToolUse hooks still run below. Non-eng-coder children keep the manual
+    // parent ask (human in the loop).
+    if (tool.readonly || isSubagentReadonlyAction(toolCall.name, args) || isSubagentControlAction(toolCall.name, args) || agent.autoApprove || agent._engTaskAuthorized) {
+      if (!(await runHooks("PreToolUse", { agent, toolName: toolCall.name, toolArgs: args }))) {
+        prepared.push({ toolCall, tool, denied: true, reason: "blocked by PreToolUse hook" })
         continue
       }
-    }
-
-    // PreToolUse hooks: allow user scripts to gate tool execution
-    if (!(await runHooks("PreToolUse", { agent, toolName: toolCall.name, toolArgs: args }))) {
-      prepared.push({ toolCall, tool, denied: true, reason: "blocked by PreToolUse hook" })
+      // Panel area abolished — all tools now stream inline via onToolOutput.
+      callbacks.onToolCall?.(toolCall.name, args, toolCall.id)
+      prepared.push({ toolCall, tool, args })
       continue
     }
+    permPending.push({ toolCall, tool, args })
+  }
 
-    // Panel area abolished — all tools now stream inline via onToolOutput.
+  // ---- Permission stage: one merged ask for the whole batch (§16 D-B1) ----
+  // >1 non-readonly tools in the same toolCalls array → a single
+  // onBatchPermissionRequest({ tools, count }) ask; verdicts:
+  //   "approveAll" → batch-scope allowance (autoApprove style, NOT persistent)
+  //   "deny"       → the whole batch is rejected, no second ask
+  //   "oneByOne" (or anything else / no handler) → the existing per-item
+  //     onPermissionRequest channel, signature unchanged (NF-B1: ACP bridge /
+  //     headless / old versions without the new callback are never harmed).
+  if (permPending.length > 0) {
+    let batchAllowed = null // true = approveAll, false = deny, null = per-item fallback
+    if (permPending.length > 1 && callbacks.onBatchPermissionRequest) {
+      const verdict = await callbacks.onBatchPermissionRequest({
+        tools: permPending.map((p) => ({ name: p.toolCall.name, args: p.args })),
+        count: permPending.length,
+      })
+      if (verdict === "approveAll") batchAllowed = true
+      else if (verdict === "deny") batchAllowed = false
+      // anything else (oneByOne/unknown) → fall through to the per-item channel
+    }
+    for (const p of permPending) {
+      let allowed
+      if (batchAllowed === true) allowed = true
+      else if (batchAllowed === false) allowed = false
+      else if (callbacks.onPermissionRequest) {
+        allowed = await (async () => {
+          // D2 (AGENT-LOOP.md §7.2): announce the wait BEFORE prompting — the TUI
+          // subagent block header flips to "等待审批" so a waiting child is visibly
+          // different from a stalled one. Depth>0 only (the parent TUI shows its own
+          // permission panel). turn n/max = the child's live turn counters.
+          if (depth > 0) {
+            callbacks.onToken?.(`⟦ev⟧approval\x1e${agent._currentTurn ?? 0}\x1e${agent._maxTurns ?? 0}\x1eapproval\x1e${String(p.toolCall.name).slice(0, 40)}`)
+          }
+          return await callbacks.onPermissionRequest(p.toolCall.name, p.args)
+        })()
+      } else allowed = false
+      if (!allowed) {
+        prepared.push({
+          toolCall: p.toolCall, tool: p.tool, denied: true,
+          reason: (callbacks.onPermissionRequest || batchAllowed === false) ? "denied by user" : "no permission handler",
+        })
+        continue
+      }
 
-    callbacks.onToolCall?.(toolCall.name, args, toolCall.id)
+      // PreToolUse hooks: allow user scripts to gate tool execution
+      if (!(await runHooks("PreToolUse", { agent, toolName: p.toolCall.name, toolArgs: p.args }))) {
+        prepared.push({ toolCall: p.toolCall, tool: p.tool, denied: true, reason: "blocked by PreToolUse hook" })
+        continue
+      }
 
-    prepared.push({ toolCall, tool, args })
+      // Panel area abolished — all tools now stream inline via onToolOutput.
+      callbacks.onToolCall?.(p.toolCall.name, p.args, p.toolCall.id)
+      prepared.push({ toolCall: p.toolCall, tool: p.tool, args: p.args })
+    }
   }
 
   // ---- Phase 2: order-preserving execution ----
@@ -163,6 +261,11 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
     // 捕获分离（父恢复原始后子的拦截期间父捕获停止、子恢复后父继续）——正确。
     // 声明在 try 之外：catch 块（异常路径）也要访问（报错前的探查输出回显）。
     const capturedConsole = []
+    // LOGGING（LOGGING.md）：tool:* 事件——仅真实执行（pre-gate 拦截项在下方早退分支不入事件）。
+    // 参数值永不落盘（NF-L3——工具事件不记 args）；child=子代理 id（agent._logId，spawn 时 stamp）。
+    const toolT0 = Date.now()
+    const toolName = item.toolCall.name
+    logEvent("tool:call", { tool: toolName, child: agent?._logId })
     try {
       // Snapshot for undo before side-effect tools (setupOutputPanel already fired in Phase 1)
       if (!item.tool?.readonly && item.args) {
@@ -174,6 +277,7 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
         const routed = await callbacks.toolRouter(item.toolCall.name, item.args)
         if (routed?.handled) {
           callbacks.onToolResult?.(item.toolCall.name, routed.result, item.toolCall.id)
+          logEvent("tool:done", { tool: toolName, ms: Date.now() - toolT0, head: headText(routed.result, 200), child: agent?._logId })
           return { ...item, result: routed.result, ok: true }
         }
       }
@@ -182,17 +286,22 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       console.log = (...a) => capturedConsole.push(a.map(String).join(" "))
       console.error = (...a) => capturedConsole.push("[err] " + a.map(String).join(" "))
       let rawResult
+      // ctx 对象提升为变量（§7.2.3）：subagent 阻塞 execute 返回前在 ctx 上留
+      // _subagentKey（relayPrefix 去尾）——runOne 在 execute 返回后读它作 onToolResult
+      // 第 4 参（普通工具/错误路径无此字段——undefined 兼容既有签名）。每次工具调用
+      // 独立 ctx——并行同名工具（批并行 runOne）各自带自己的 key，互不串扰。
+      const toolCtx = {
+        cwd: agent.cwd,
+        agent,
+        depth,
+        signal,
+        callbacks,
+        onOutput: (chunk) => callbacks.onToolOutput?.(item.toolCall.name, chunk, item.toolCall.id),
+        onQuestion: callbacks.onQuestion,
+        onPermissionRequest: callbacks.onPermissionRequest,
+      }
       try {
-        rawResult = await item.tool.execute(item.args, {
-          cwd: agent.cwd,
-          agent,
-          depth,
-          signal,
-          callbacks,
-          onOutput: (chunk) => callbacks.onToolOutput?.(item.toolCall.name, chunk, item.toolCall.id),
-          onQuestion: callbacks.onQuestion,
-          onPermissionRequest: callbacks.onPermissionRequest,
-        })
+        rawResult = await item.tool.execute(item.args, toolCtx)
       } finally {
         console.log = origConsoleLog
         console.error = origConsoleErr
@@ -207,9 +316,10 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       const resultWithConsole = capturedConsole.length > 0
         ? `${result}\n[console during ${item.toolCall.name}]\n${capturedConsole.join("\n")}`
         : result
-      callbacks.onToolResult?.(item.toolCall.name, resultWithConsole, item.toolCall.id)
+      callbacks.onToolResult?.(item.toolCall.name, resultWithConsole, item.toolCall.id, toolCtx._subagentKey)
       // PostToolUse hooks: fire-and-forget (result not awaited on hook failure)
       runHooks("PostToolUse", { agent, toolName: item.toolCall.name, toolArgs: item.args, result: raw }).catch(() => {})
+      logEvent("tool:done", { tool: toolName, ms: Date.now() - toolT0, head: headText(resultWithConsole, 200), child: agent?._logId })
       return { ...item, result: resultWithConsole, ok: true }
     } catch (error) {
       // Persist to ~/.thincoder/tool-errors/ for post-mortem; only pass message to the model (stack traces confuse LLMs and may leak paths)
@@ -219,6 +329,9 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       // asked to stop — worst case with subagents, where the child runs its
       // whole turn budget and the interrupt appears to do nothing.
       if (signal?.aborted) throw error
+      // LOGGING（2026-09-03 code review #4）：中止先于事件——用户停不落 tool:error
+      //（vscode execute-tools parity；阻塞子代理 child:error 同款抑制）
+      logEvent("tool:error", { tool: toolName, ms: Date.now() - toolT0, err: errText(error, 200), child: agent?._logId })
       runHooks("PostToolUseFailure", { agent, toolName: item.toolCall.name, toolArgs: item.args, error }).catch(() => {})
       // Build contextual error: tool name + key args so the model can reason about what went wrong
       const ctxParts = []
@@ -242,7 +355,11 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
     batch = []
   }
   for (const item of prepared) {
-    if (item.tool && !item.tool.readonly && !item.tool.parallel) {
+    // escalate action keeps the retired escalate tool's serial placement (no
+    // parallel flag): it flushes the batch and runs alone in call order (§19 —
+    // spawn stays parallel; check/status classify as readonly and batch freely).
+    if (item.tool && !item.tool.readonly
+        && (!item.tool.parallel || isSubagentEscalateAction(item.tool.name, item.args))) {
       await flush()
       results.push(await runOne(item))
     } else {