thincoder 0.12.58 → 0.12.60

package/src/tui/tool-events.mjs

@@ -3,145 +3,37 @@
  * 满足 500 行硬限）。只做「事件 → TUI 状态/对话行」的映射：
  *
  *  - onToken/onReasoning  : 子agent 前缀分流（routeSub*）→ 主流 streaming/reasoning
- *  - onToolCall           : 状态栏 + `❯ name args` 标题行 + 计时
+ *  - onToolCall           : 状态栏 + `❯ name args` 标题行 + 计时 + §19 action 记录
  *  - onToolResult         : 子agent 完成冻结（finishSubTask + freezeDoneSubTasks）、
- *                           _live 行清理、done 行、advisor 评审冻结框
- *  - onToolOutput         : advisor 有序块缓冲 / `_live` 滚动预览（N 行 + `│ …` 折叠）
+ *                           工具块结果入块、advisor 评审冻结框
+ *  - onToolOutput         : advisor 有序块缓冲 / 工具块输出流
  *  - 其余                 : usage 累计、等待提示、task 面板、回合末增量落盘
  *
  * flushStream 同时返回给调用方（回合循环 / onTurnEnd 共用）。纯回调装配，无终端副作用
- * （除经 deps 注入的 pushLine/render）。
+ * （除经 deps 注入的 pushLine/render）。§19: subagent_check/escalate 工具退役后
+ * （§19.8——check 动作已删），subagent 家族全部调用以工具名 "subagent" +
+ * action 到达——完成路由按 onToolCall 时记录的 action 分流（spawn 区块 / escalate
+ * 区块 / status/observe/send 普通工具块——observe/send 不建子代理区块）。
  */
 import { C } from "./ansi.mjs"
 import { formatToolSummary } from "./tool-summaries.mjs"
 import { describeToolArgs, toolArgsLines } from "./tool-args.mjs"
 import { ADVISOR_THINKING_PLACEHOLDER, resolveAdvisorProvider } from "../advisor/run.mjs"
 import {
-  SUBAGENT_ROLES, routeSubToken, routeSubReasoning, routeSubToolCall,
-  routeSubToolOutput, finishSubTask, finishSubTasksByRole, finishSubTaskByModel, freezeDoneSubTasks,
+  SUB_PREFIX_RE, SUBAGENT_ROLES, routeSubToken, routeSubReasoning, routeSubToolCall,
+  routeSubToolOutput, finishSubTask, finishSubTaskKey, finishSubTasksByRole, freezeDoneSubTasks,
   ensureCompressPanel, markCompressFailed, markCompressDone, markCompressFallback,
 } from "./subagent-blocks.mjs"
 import { TURN_CAP_MARK } from "../agent/spawn-child.mjs"
-
-/** Tool execution start timestamps (performance.now ms). Keyed by tool_call id
- *  when available (parallel same-name tools each get their own tick — the
- *  P0-3 fix, 2026-08-30), falling back to a per-name FIFO queue for callers
- *  without ids (subagent relay). FIFO shift assumes near-call-order completion;
- *  a parallel same-name batch finishing out of order swaps durations between
- *  siblings — same magnitude, both keep an elapsed (display-level, acceptable). */
-
-// Named caps (consult P2, 2026-08-30): inline 200/8/120/3/5 were magic numbers.
-const TOOL_OUTPUT_LINE_CAP = 200          // per-call streaming output ring buffer
-const SUBAGENT_PREVIEW_LINES = 8          // report preview rows in the conversation
-const PREVIEW_LINE_CHARS = 120            // per-line preview slice
-const REMINDER_CAP = 3                    // max pending reminders shown on turn end
-const REMINDER_PERSIST_TURNS = 5          // persist reminders every N turns
-
-const _toolTicks = new Map()
-
-function tickStart(name, toolId) {
-  const key = toolId ?? name
-  if (toolId) { _toolTicks.set(key, performance.now()); return }
-  const q = _toolTicks.get(key) ?? []
-  q.push(performance.now())
-  _toolTicks.set(key, q)
-}
-
-/** Settle one pending tick: by tool_call id, or per-name FIFO. Returns start or null. */
-function tickTake(name, toolId) {
-  const key = toolId ?? name
-  const v = _toolTicks.get(key)
-  if (v === undefined) return null
-  if (toolId) { _toolTicks.delete(key); return v }
-  if (v.length === 0) { _toolTicks.delete(key); return null }
-  const started = v.shift()
-  if (v.length === 0) _toolTicks.delete(key)
-  return started
-}
-
-/** P0-2 sweep (2026-08-30 consult): an interrupted turn (Ctrl+C / error) leaves
- *  running tool-block carriers without an onToolResult — their header would say
- *  "running" forever. runAgentTurn's finally calls this: mark them done with an
- *  "(interrupted)" status and clear the tick table so no stale start time leaks
- *  into the next turn. Mirrors freezeAllSubTasks for the tool-block family. */
-export function sweepToolBlocks(state) {
-  for (const l of state.lines ?? []) {
-    const b = l._toolBlock
-    if (b && !b.done) {
-      b.done = true
-      b.summary = "(interrupted)"
-      b.interrupted = true
-    }
-  }
-  _toolTicks.clear()
-}
-
-/** Shared display guard for tool results — LIVE and RESTORE use the same
- *  function (P1, 2026-08-30 consult: restore lacked the live path's guards).
- *  1) Multimodal results (read_image) embed FULL base64 images in the JSON —
- *     the human needs only the text part (model gets images via the multimodal
- *     channel); 2) results beyond maxRows are truncated in the block (full
- *     text always lives in history for the model). Returns row array. */
-export function slimToolResultForDisplay(result, maxRows = 400) {
-  let displayResult = result
-  try {
-    const parsed = JSON.parse(result)
-    if (parsed?.images?.length) displayResult = parsed.text ?? result
-  } catch { /* not JSON — show as-is */ }
-  const rows = String(displayResult).split("\n").filter((l) => l.trim())
-  return rows.length > maxRows
-    ? [...rows.slice(0, maxRows), `… (result truncated at ${maxRows} rows — full text in history)`]
-    : rows
-}
-/** Mark the dispatch-level tool carrier done when its result is consumed by a
- *  dedicated branch (subagent/escalate/advisor blocks) instead of the carrier
- *  body — without this the turn sweep mislabels successful calls as
- *  "(interrupted)" (consult P1, 2026-08-30). */
-function settleToolBlock(state, name, toolId, summary) {
-  const block = findToolBlock(state, name, toolId)
-  if (block) {
-    block.done = true
-    block.summary = summary
-    const started = tickTake(name, toolId)
-    block.elapsed = started !== null ? Math.round(performance.now() - started) : null
-  }
-}
-
-/** Async spawn detection (§15 D-A1): the subagent tool's async:true result is a
- *  status JSON ({id, role, status: running|queued}), NOT a report — the child
- *  keeps running, so its activity block must not be frozen at spawn time (it
- *  freezes via the ⟦ev⟧done event emitted at settle time — §15 D-A3). A real blocking
- *  report that happens to parse as this shape is a freak accident; the only
- *  consequence would be a late block freeze at turn end (cosmetic). */
-function isAsyncSpawnResult(result) {
-  try {
-    const o = JSON.parse(result)
-    return Boolean(o && typeof o === "object" && typeof o.id !== "undefined" && (o.status === "running" || o.status === "queued"))
-  } catch {
-    return false
-  }
-}
-
-
-
-/** Find the live tool-block carrier for a tool event: exact id match when the
- *  callback carries one (P0-3 — parallel same-name tools route to their own
- *  block); falls back to the last unfinished block of that name. */
-function findToolBlock(state, name, toolId) {
-  const lines = state.lines ?? []
-  if (toolId !== undefined && toolId !== null) {
-    for (let i = lines.length - 1; i >= 0; i--) {
-      if (lines[i]._toolBlock?.id === toolId) return lines[i]._toolBlock
-    }
-    return null
-  }
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const b = lines[i]._toolBlock
-    if (b && b.name === name && !b.done) return b
-  }
-  return null
-}
-
+// 2026-09-05 module-split：ticks/maps/sweep/slim/settle/探测/find 族迁 tool-display.mjs——
+// buildToolCallbacks 内部引用用本地 import；sweepToolBlocks re-export（agent-turn 消费面）
+import {
+  TOOL_OUTPUT_LINE_CAP, SUBAGENT_PREVIEW_LINES, PREVIEW_LINE_CHARS, REMINDER_CAP, REMINDER_PERSIST_TURNS,
+  _toolTicks, _subActions, _subActionQ,
+  tickStart, tickTake, settleToolBlock, isAsyncSpawnResult, isSpawnErrorResult,
+  findToolBlock, slimToolResultForDisplay, sweepToolBlocks,
+} from "./tool-display.mjs"
+export { sweepToolBlocks, slimToolResultForDisplay } from "./tool-display.mjs"
 
 /** Build the agent callbacks + the shared flushStream for one turn.
  *          askPermission, askQuestion, saveSessionImpl } */
@@ -156,11 +48,8 @@ export function buildToolCallbacks(deps) {
   const flushStream = () => {
     if (state.reasoning) {
       pushLine(state.reasoning, C.reason, "thinking")
-      // Reasoning folds IMMEDIATELY on flush (user ruling 2026-08-30: the old
-      // "stay expanded until next turn" auto-expand was a leftover of the
-      // rejected pre-fold plan — thinking must be DEFAULT FOLDED in the exact
-      // unified form: named header + tail 3, expand ≤60%, click back). Same
-      // shape as the restore path — zero exceptions on either path.
+      // Reasoning folds IMMEDIATELY on flush (user ruling 2026-08-30): default-folded,
+      // named header + tail 3 — same shape as the restore path, zero exceptions.
       state.reasoning = ""
     }
     if (state.streaming) {
@@ -181,9 +70,8 @@ export function buildToolCallbacks(deps) {
       scheduleRender()
     },
     onReasoning: (t) => {
-      // Subagent reasoning tokens also carry role#id/ prefix — appended into the
-      // block buffer as kind=think (F2: same treatment as the main reasoning stream;
-      // previously the token only created the entry and the content was discarded).
+      // Subagent reasoning tokens also carry role#id/ prefix — appended into the block
+      // buffer as kind=think (F2: same treatment as the main reasoning stream).
       if (routeSubReasoning(state, t, scheduleRender)) return
       ensureAssistantLabel()
       state.reasoning += t
@@ -193,9 +81,14 @@ export function buildToolCallbacks(deps) {
       // Subagent tool call: prefix role#id/toolName → open a fresh tool block and
       // set currentTool for the header summary line.
       if (routeSubToolCall(state, name, args, scheduleRender)) return
-      // Redundant with flushStream() below (it clears both buffers) — kept as
-      // defense-in-depth so a future flushStream change cannot leak advisor
-      // buffers into the next tool's view.
+      // §19: record the action of a merged subagent-family call (spawn is the
+      // default — only non-spawn actions need a record for result-time routing).
+      if (name === "subagent" && args?.action && args.action !== "spawn") {
+        if (toolId !== undefined && toolId !== null) _subActions.set(toolId, args.action)
+        else _subActionQ.push(args.action)
+      }
+      // Redundant with flushStream() below (it clears both buffers) — defense-in-depth
+      // so a future flushStream change cannot leak advisor buffers into the next view.
       if (name === "advisor") { state._advisorBlocks = [] }
       flushStream()
       ensureAssistantLabel()
@@ -223,17 +116,12 @@ export function buildToolCallbacks(deps) {
       // is unreliable (it glues onto the previous line), so the round belongs here.
       // Also show the advisor's effective model (it may differ from the main agent's).
       const roundTag = name === "advisor" ? ` (round ${(agent._advisorRound || 0) + 1}${advModel ? " · " + advModel : ""})` : ""
-      // Readable key-args summary (vscode card-header parity, 2026-08-30) —
-      // replaces the raw JSON.stringify-80 slice: long paths landed mid-string,
-      // and the crucial argument was often past the cut. Unknown/MCP tools
-      // fall back to compact JSON inside describeToolArgs.
+      // Readable key-args summary (vscode card-header parity, 2026-08-30) — replaces
+      // the raw JSON.stringify-80 slice. Unknown/MCP tools fall back to compact JSON.
       const argSummary = describeToolArgs(name, args)
-      // ONE BLOCK PER TOOL CALL (user ruling 2026-08-30: "为什么不把名称和参数行
-      // 直接作为流式输出 block 的 title" — the four-piece ❯ title / _live scroll /
-      // done-line arrangement was pre-fold-era residue). The carrier line holds
-      // the whole call: header = name+args+live status, body = args JSON +
-      // streaming output + result. buildConvLines renders it via the shared
-      // fold-block component; restore (historyToLines) emits the SAME carrier.
+      // ONE BLOCK PER TOOL CALL (user ruling 2026-08-30): header = name+args+live
+      // status, body = args JSON + streaming output + result. buildConvLines renders
+      // it via the shared fold-block component; restore emits the SAME carrier.
       state.lines.push({
         text: "", color: C.tool,
         _lineId: (state._lineIdCounter = (state._lineIdCounter ?? 0) + 1),
@@ -250,71 +138,87 @@ export function buildToolCallbacks(deps) {
       })
       tickStart(name, toolId)
     },
-    onToolResult: (name, result, toolId) => {
+    // §7.2.3（方案 e）：dispatch runOne 把工具 ctx 上的 _subagentKey（sync spawn/
+    // escalate 成功路径设置——relayPrefix 去尾）作为第 4 参传来——undefined 兼容既有
+    // 签名（普通工具/老回调/错误路径不带 key）。
+    onToolResult: (name, result, toolId, subKey) => {
       state.currentTool = null
+      // §19 merged family: route per the action recorded at onToolCall (no record = default spawn).
+      let subAction = null
+      if (name === "subagent") {
+        subAction = (toolId !== undefined && toolId !== null)
+          ? _subActions.get(toolId) ?? null
+          : _subActionQ.shift() ?? null
+        if (toolId !== undefined && toolId !== null) _subActions.delete(toolId)
+      }
+      const isSubagent = name === "subagent" && subAction !== "status" && subAction !== "escalate" && subAction !== "cancel" && subAction !== "panel" && subAction !== "observe" && subAction !== "send"
+      const isEscalate = name === "subagent" && subAction === "escalate"
       // Subagent complete: mark the earliest running child as done — the block
       // persists (✓ frozen elapsed header, expandable) as the ONLY carrier of the
-      // child's activity (D4: no 3-second cleanup anymore). The report preview
-      // (max 8 lines) still enters the conversation via the existing path below.
-      // Block buffers survive the turn (no wipe in runAgentTurn start/finally):
-      // child tool calls never enter the parent's history, so the block is the
-      // only trace of what the child did — memory bounded by the N2 line cap.
-      const isSubagent = name === "subagent"
+      // child's activity; memory bounded by the N2 line cap.
+      // §19.5: cancel 动作排除在 isSubagent 外——ack/错误 JSON 走普通工具块；区块冻结由
+      // ⟦ev⟧stopped settle 事件承担（此处 finishSubTask 会误冻最早 running 区块）。
       if (isSubagent) {
         // The dispatch-level tool-block carrier for this call would otherwise
         // never be marked done (its result lands in the subagent block, not the
-        // carrier) and the turn sweep would mislabel it "(interrupted)" — every
-        // successful subagent call showed that banner (consult P1, 2026-08-30).
+        // carrier) and the turn sweep would mislabel it "(interrupted)".
         settleToolBlock(state, name, toolId, "completed")
         // Async spawn (§15 D-A1): the result is a status JSON, not a report — the
-        // child KEEPS running; skip the freeze (it would tombstone a live block
-        // and drop its relay stream). The block freezes on the ⟦ev⟧done event
-        // emitted at turn-end collection.
+        // child KEEPS running; skip the freeze (it would tombstone a live block and
+        // drop its relay stream). The block freezes on the ⟦ev⟧done settle event.
         if (!isAsyncSpawnResult(result)) {
-          finishSubTask(state, SUBAGENT_ROLES, result.includes(TURN_CAP_MARK) ? "turn cap reached — work may be partial" : null)
-          // Freeze the finished blocks into the conversation stream (user report
-          // 2026-08-30): a pinned tail section left every ✓ block stuck above the
-          // input box forever. As lines they scroll away, stay expandable via the
-          // dim auto-fold, and subTasks releases the entry.
-          freezeDoneSubTasks(state)
+          // §7.2.3 sync spawn 完成精确冻结：结果按 key 归属三支——
+          // ① dispatch 同步成功路径带 subKey（ctx._subagentKey = relayPrefix 去尾）：
+          //    finishSubTaskKey 按 key 精确冻——不再落 finishSubTask 的"最早 started"
+          //    启发式（async eng-coder 先启动时 explore 完成会误冻其块——7.2.3.1/T-F2）；
+          // ② spawn 门拒错误（{status:"error"} JSON——auto-turn digest spawn 拒绝）：
+          //    不冻结任何块（round1 #1——错误路径不冻结 running 块——T-F5）；
+          // ③ subKey undefined 非错误（老回调/测试直调——成功路径未知工具）→ 启发式
+          //    兜底（既有行为不变——面板单块时与精确冻同效——T-F1）。
+          const lastError = result.includes(TURN_CAP_MARK) ? "turn cap reached — work may be partial" : null
+          const hasSubKey = subKey !== undefined && subKey !== null && subKey !== ""
+          if (hasSubKey) {
+            finishSubTaskKey(state, String(subKey), lastError)
+            freezeDoneSubTasks(state)
+          } else if (!isSpawnErrorResult(result)) {
+            finishSubTask(state, SUBAGENT_ROLES, lastError)
+            freezeDoneSubTasks(state)
+          }
           // Subagent report preview (max 8 lines) displayed directly in conversation
           const lines = result.split("\n")
           const preview = lines.slice(0, SUBAGENT_PREVIEW_LINES).map((l) => l.slice(0, PREVIEW_LINE_CHARS)).join("\n")
           if (preview) pushLine(preview, C.dim)
           if (lines.length > SUBAGENT_PREVIEW_LINES) pushLine(`  ... (${lines.length - SUBAGENT_PREVIEW_LINES} more lines)`, C.dim)
         }
-      } else if (name === "escalate") {
-        // 飞刀 post-op report landed → freeze its block into the conversation too.
+      } else if (isEscalate) {
+        // 飞刀 post-op report landed under the subagent tool name — freeze the
+        // escalate#N activity block (no preview; legacy surface).
         settleToolBlock(state, name, toolId, "completed")
-        finishSubTask(state, ["escalate"], result.includes(TURN_CAP_MARK) ? "turn cap reached — work may be partial" : null)
-        freezeDoneSubTasks(state)
-      } else if (name === "consult_check" || name === "consult_stop") {
-        // Consult session-level settle (2026-08-30 consult review): a session
-        // spawns N parallel children, so completion must settle ALL of them.
-        // The single-shot finishSubTask here only froze the EARLIEST running
-        // block — the other N-1 stayed "running" pinned above the input box
-        // all through the final answer, then got mislabeled "interrupted".
-        //   - individual reply (done:false): settle precisely by r.model —
-        //     models settle out of order; the earliest-running heuristic froze
-        //     the wrong block.
-        //   - done:true / stopped: settle every remaining consult block.
-        try {
-          const r = JSON.parse(result)
-          if (r?.done || r?.stopped !== undefined) {
-            finishSubTasksByRole(state, ["consult"], null)
-            freezeDoneSubTasks(state)
-          } else if (r?.model) {
-            finishSubTaskByModel(state, "consult", r.model)
-            freezeDoneSubTasks(state)
-          }
-        } catch {
-          if (name === "consult_stop") {
-            finishSubTasksByRole(state, ["consult"], null)
-            freezeDoneSubTasks(state)
+        // §25 D-R17b (R17): async escalate ack ({id, role:"escalate", status:
+        // running|queued}) — the child KEEPS running — skip the freeze like the
+        // async spawn path (the block freezes on the ⟦ev⟧done/stopped settle
+        // event at flight end). Sync results (async:false) freeze below.
+        if (!isAsyncSpawnResult(result)) {
+          // §7.2.3（round1 #2）：escalate 成功返回带 subKey（escalate#N）→ 精确冻；
+          // 失败/老回调无 subKey → escalate 角色启发式兜底（escalate 串行 + 角色限定——
+          // 既有行为）。
+          const lastError = result.includes(TURN_CAP_MARK) ? "turn cap reached — work may be partial" : null
+          if (subKey !== undefined && subKey !== null && subKey !== "") {
+            finishSubTaskKey(state, String(subKey), lastError)
+          } else {
+            finishSubTask(state, ["escalate"], lastError)
           }
-        } /* non-JSON result — leave blocks as-is */
+          freezeDoneSubTasks(state)
+        }
+      } else if (name === "consult_stop") {
+        // R17（§25 D-R17a——check 已删）：consult_stop = 取消指定会诊会话。被 abort 的
+        // children 各自 settle（settleChild）时发 ⟦ev⟧done 冻结自己的卡——此处**不做按
+        // 角色整组清扫**（会诊会话可并发——按角色会误冻其他仍在运行的会话的卡，冻结即
+        // 截断其活动流——tool-events advisor 复评 🟡1 修正）；取消的即时可见性由 abort
+        // settle 事件承担（abort 解绕通常在同回合内完成——卡片在其 child settle 即冻结）。
+        // 仅结果本身落本工具调用自己的载体块（下方通用分支）。
       }
-      if (!isSubagent && name !== "advisor") {
+      if (!isSubagent && !isEscalate && name !== "advisor") {
         // Result lands INSIDE the block (restore parity — the restored carrier
         // carries the same fields). The done line is gone: status/elapsed live
         // in the header now.
@@ -337,16 +241,11 @@ export function buildToolCallbacks(deps) {
         // the frozen box, but the dispatch-level tool carrier must still be
         // marked done (consult P1, 2026-08-30: sweep mislabeled it interrupted).
         settleToolBlock(state, name, toolId, "completed")
-        // The review's thinking must survive into the conversation history like
-        // the main agent's reasoning (flushStream does for state.reasoning) —
-        // discarding it left the thought process visible only mid-review, then
-        // gone. Flush BEFORE the done line so the block sits above it.
-        // 2026-08-30: flushed as a COLLAPSIBLE box (frozen-folded semantics,
-        // aligned with subagent blocks) instead of a flat auto-expanded line —
-        // the flat form flooded the conversation. Full text still lives in the
-        // tool result message; the box is the reviewable record. Live
-        // _advisorBlocks keep rendering the running view until cleared in the
-        // turn finally.
+        // The review's thinking must survive into the conversation history like the
+        // main agent's reasoning — flushed as a COLLAPSIBLE box before the done
+        // line (frozen-folded semantics, aligned with subagent blocks; the flat
+        // form flooded the conversation). Full text lives in the tool result;
+        // _advisorBlocks keep rendering the running view until cleared at turn end.
         const blocks = state._advisorBlocks ?? []
         if (blocks.length > 0) {
           const text = blocks
@@ -368,17 +267,17 @@ export function buildToolCallbacks(deps) {
       }
     },
     onToolOutput: (name, chunk, toolId) => {
-      // All tools use inline conversation blocks — panel area is abolished.
-      // Stream up to N preview lines (config ?? per-tool ?? 5); the full result
-      // is in the tool message.
-      const part = typeof chunk === "string"
-        ? { kind: "text", text: chunk.trimEnd() }
-        : { kind: chunk?.kind ?? "text", text: String(chunk?.text ?? "").trimEnd() }
+      // Subagent relays (name "role#id/tool", D1) route RAW — chunks are
+      // child-stdout/SSE fragments at arbitrary byte boundaries; trimEnd eats
+      // real trailing newlines and routeSubToolOutput's verbatim concat would
+      // glue lines (2026-09-03 修复轮; main path keeps the trimmed form below).
+      const isSubRelay = SUB_PREFIX_RE.test(name)
+      const rawText = typeof chunk === "string" ? chunk : String(chunk?.text ?? "")
+      const part = {
+        kind: typeof chunk === "string" ? "text" : (chunk?.kind ?? "text"),
+        text: isSubRelay ? rawText : rawText.trimEnd(),
+      }
       if (!part.text) return
-      // Subagent tool output (D1: childCallbacks.onToolOutput relays under the
-      // prefixed name "role#id/toolName") → append into the CURRENT tool block of
-      // that child's activity buffer. Render throttled at 250ms (N1); the data
-      // append itself is never delayed.
       if (routeSubToolOutput(state, name, part, scheduleRender)) return
       if (name === "advisor") {
         // Accumulate to buffer — formatTables + wrapText in render-conversation
@@ -386,13 +285,9 @@ export function buildToolCallbacks(deps) {
         // NOTE: the advisor tool ALWAYS emits {kind, text} objects (run.mjs's
         // emit() wrapper) — a raw string chunk is never think; if that ever
         // changes, plain-string think would land in advisorStreaming.
-        // ORDERED block buffer — preserves the interleaved emission order
-        // (think → tool → think → … → final). Two separate buffers (_advisorThink
-        // vs advisorStreaming) rendered think-block-then-main-block, which
-        // regrouped ALL thinking above ALL tool progress — the alternating
-        // timeline was destroyed. Consecutive chunks of the same kind merge
-        // into one block; kind flips start a new block; render walks the
-        // blocks in order with per-kind colors.
+        // ORDERED block buffer — preserves the interleaved emission order (think →
+        // tool → think → … → final); consecutive chunks of the same kind merge
+        // into one block, kind flips start a new block, render walks them in order.
         const isString = typeof chunk === "string"
         const raw = isString ? chunk : String(chunk?.text ?? "")
         const kind = isString ? "text" : (chunk?.kind ?? "text")
@@ -418,19 +313,20 @@ export function buildToolCallbacks(deps) {
       }
       scheduleRender()
     },
-    onPermissionRequest: (name, args) => askPermission(name, args),
+    // Manual-tier auto-turn digests (agent-turn.mjs suspension driver) pass null
+    // handlers — permission requests then deny WITHOUT a panel (§17 D-S7: no modal
+    // during unattended digestion) and question errors out instead of hanging.
+    ...(askPermission ? { onPermissionRequest: (name, args) => askPermission(name, args) } : {}),
     // Merged batch ask (§16 D-B1): one confirmation for N non-readonly tools in
     // the same response — "approve all / one by one / deny" (key-handler resolves
     // the verdict string; approveAll is batch-scope only, never the AUTO flag).
-    onBatchPermissionRequest: (req) => askBatchPermission(req),
-    onQuestion: (text, options) => askQuestion(text, options),
-    // Compression lifecycle (CONTEXT-COMPACTION.md §7 D-C2): the compression session renders
-    // as a subagent-style panel block — start → running panel ("Compressing context…" +
-    // "summarizing N messages" + elapsed ticker), fail → error text ONLY (no degradation note —
-    // that belongs to the 3-consecutive-failures fallback), success → frozen "Compressed: N
-    // tokens freed → summary (Xs)" / fallback → "truncated to N messages". The summary BODY
-    // never enters the panel or the stream (the summary call is silent). Replaces the old
-    // one-line "[context] Context too long..." warn (user ruling: panel, not a status line).
+    ...(askBatchPermission ? { onBatchPermissionRequest: (req) => askBatchPermission(req) } : {}),
+    ...(askQuestion ? { onQuestion: (text, options) => askQuestion(text, options) } : {}),
+    // Compression lifecycle (CONTEXT-COMPACTION.md §7 D-C2): the compression session
+    // renders as a subagent-style panel block — start → running panel ("Compressing
+    // context…" + "summarizing N messages" + elapsed ticker), fail → error text only,
+    // success → frozen "Compressed: N tokens freed → summary (Xs)" / fallback →
+    // "truncated to N messages". The summary BODY never enters the panel or stream.
     onCompressStart: (info) => {
       ensureCompressPanel(state, info)
       scheduleRender()

package/src/tui/tui-lifecycle.mjs

@@ -3,6 +3,7 @@
  * 超 500 行硬限拆分——启动序列、退出清理序列与退出闭包从 index.mjs 移入本模块）。
  */
 
+import { appendFileSync } from "node:fs"
 import { ansi } from "./ansi.mjs"
 
 /** TUI 启动序列：alt buffer + 隐藏光标 + 鼠标/粘贴/键盘增强 + 禁环绕。
@@ -19,6 +20,33 @@ export function writeCleanupSequence(write = (s) => process.stdout.write(s)) {
   write(ansi.clearScreen + ansi.mouseOff + ansi.bracketedPasteOff + ansi.keyboardPop + ansi.modifyOtherKeysOff + ansi.mainBuffer + ansi.showCursor + ansi.reset + ansi.wrapOn)
 }
 
+// R25（ARCHITECTURE.md §R25 F-R25a——复审 #1）：TUI 活动态标志——index.mjs 在终端接管
+// 处（writeStartupSequence 之后）经 setTuiActive(true) 置位，createExitCleanup 清理后清
+// false；bin/thincoder.mjs 崩溃钩子经 restoreTerminalAfterCrash 读同一标志——chat 模式
+// stdout 管道不得收 ANSI（误判即污染输出）。默认 false = 未启动（生产零变化——测试缝同源：
+// T-R25a.2 注入 mock 走同一 setter）。
+let tuiActive = false
+
+/** 置/清 TUI 活动态（TUI 启动接管处与退出清理处调用；测试 env 门注入同走此 setter）。 */
+export function setTuiActive(active) {
+  tuiActive = active === true
+}
+
+/** R25 崩溃恢复：仅 TUI 活动态执行 writeCleanupSequence（复用本模块清理序列——符号锚）。
+ *  测试缝（T-R25a.2——env 门注入）：THINCODER_TEST_CLEANUP_OUT 指向文件时序列写入该文件
+ *  （观察恢复被调 + stdout 管道零 ANSI）——生产不设该 env → 恒 stdout（零变化）。
+ *  @returns {boolean} 是否执行了恢复（false = TUI 未启动——调用方无需处理） */
+export function restoreTerminalAfterCrash() {
+  if (!tuiActive) return false
+  const seamOut = process.env.THINCODER_TEST_CLEANUP_OUT
+  if (seamOut) {
+    writeCleanupSequence((s) => appendFileSync(seamOut, s, "utf8"))
+  } else {
+    writeCleanupSequence()
+  }
+  return true
+}
+
 /** 退出清理闭包：保存会话（同步）+ 关闭 MCP 子进程 + 恢复终端。幂等（cleanedUp 守卫）。 */
 export function createExitCleanup({ agent, saveSession, closeAllMcp }) {
   let cleanedUp = false
@@ -41,5 +69,6 @@ export function createExitCleanup({ agent, saveSession, closeAllMcp }) {
     }
     process.stdin.setRawMode(false)
     writeCleanupSequence()
+    setTuiActive(false) // R25：清理完成即清活动态（崩溃钩子不再收到误判）
   }
 }

package/src/tui/update-notice.mjs

@@ -0,0 +1,76 @@
+/**
+ * update-notice.mjs — 后台升级提示（2026-09-03 D-S1c 自 index.mjs 拆出）：
+ * upgradeFailureText / pendingNoticeReady（纯函数，index.mjs re-export——tui.test
+ * 动态 import 面零改动）+ createUpdateNotice 装配（升级提示 picker + 启动检查）。
+ * index.mjs 只保留装配调用（showPicker 闭包在此经 ctx 注入）。
+ */
+import { ansi, C } from "./ansi.mjs"
+
+/** 升级失败提示文案：附 npm 输出尾部（最多 3 行），方便定位失败原因。 */
+export function upgradeFailureText(code, output) {
+  const tail = (output ?? "").trimEnd().split("\n").slice(-3).join("\n")
+  return `✗ Upgrade failed (exit ${code}). Run \`thincoder upgrade\` manually.${tail ? `\n${tail}` : ""}`
+}
+
+/** 后台更新提示可弹出的条件：无任何交互弹层（picker/permission/question）激活。 */
+export function pendingNoticeReady(state) {
+  return Boolean(state.pendingNotice && !state.picker && !state.permission && !state.question)
+}
+
+/**
+ * 升级提示 + 启动检查装配。ctx: { state, showPicker, pushLine, pushLabel, render }
+ * 返回 { showUpdateNotice, checkUpdates }——checkUpdates 非阻塞（网络错误静默跳过）；
+ * 有 picker 打开时提示挂到 state.pendingNotice，picker 全部关闭后由 doRender 弹出。
+ */
+export function createUpdateNotice(ctx) {
+  const { state, showPicker, pushLine, pushLabel, render } = ctx
+
+  const showUpdateNotice = async (result) => {
+    const sel = await showPicker(`Update available: ${result.local} → ${result.latest}`, [
+      { type: "header", text: `thincoder ${result.latest} is available (current: ${result.local})` },
+      { type: "item", text: "Upgrade now", action: "upgrade" },
+      { type: "item", text: "Later", action: "later" },
+    ])
+    if (sel?.action !== "upgrade") return
+    pushLabel(`❯ Upgrade`, ansi.bold + C.tool)
+    pushLine(`Upgrading to ${result.latest}...`, C.tool)
+    const { exec } = await import("node:child_process")
+    const cp = exec("npm install -g thincoder@latest", { windowsHide: true })
+    let stdout = ""
+    let done = false
+    cp.stdout?.on("data", (d) => { stdout += d })
+    cp.stderr?.on("data", (d) => { stdout += d })
+    cp.on("error", (e) => { if (done) return; done = true; pushLine(`✗ Upgrade failed (${e.message}). Run \`thincoder upgrade\` manually.`, C.error); render() })
+    cp.on("close", (code) => {
+      if (done) return
+      done = true
+      if (code === 0) {
+        pushLine(`✓ Upgraded to ${result.latest}. Restart to apply.`, C.tool)
+      } else {
+        pushLine(upgradeFailureText(code, stdout), C.error)
+      }
+      render()
+    })
+  }
+
+  const checkUpdates = async () => {
+    try {
+      const { readFileSync } = await import("node:fs")
+      const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"))
+      const { checkForUpdate } = await import("../upgrade.mjs")
+      const result = await checkForUpdate(pkg.version)
+      if (result?.newer) {
+        // Defer: if wizard is still active, just show a dim line
+        if (state.wizard) {
+          pushLine(`Tip: thincoder ${result.latest} is available (run /upgrade later or restart)`, C.dim)
+          render()
+        } else {
+          state.pendingNotice = result
+          render()
+        }
+      }
+    } catch { /* network error or timeout — silently skip */ }
+  }
+
+  return { showUpdateNotice, checkUpdates }
+}