thincoder 0.12.59 → 0.12.60

package/src/tools/system.mjs

@@ -7,6 +7,8 @@ import {
   IGNORED_DIRS,
   resolveInCwd,
   globToRegex,
+  splitGlobPatterns,
+  compileGlobMatchers,
   normalizeEOL,
 } from "./shared.mjs";
 import { spawn, execFileSync } from "node:child_process";
@@ -145,6 +147,11 @@ function runBash(command, cwd, { timeout, signal, onOutput, shell }) {
       detached: process.platform !== "win32",
       stdio: ["ignore", "pipe", "pipe"],
       env: buildBashEnv(),
+      // 双保险（2026-09-05——裸 spawn 无 signal 教训：abort 只靠 killTree 手动杀——taskkill
+      // best-effort 可能失败/竞态）——Node signal option = 第一道（abort 时自动杀**直接**子
+      // 进程——cmd——语义保证）；killTree 仍是必需兜底（孙进程握管道使 close 不触发——见
+      // L191 注释——spawn 级 kill 不达孙进程）
+      ...(signal ? { signal } : {}),
     })
 
     const killTree = () => killProcessTree(child)
@@ -181,10 +188,18 @@ function runBash(command, cwd, { timeout, signal, onOutput, shell }) {
       settled = true
       clearTimeout(timer)
       clearTimeout(graceTimer)
+      // 2026-09-05（advisor 🟡#2）：收尾移除 abort 监听器——ctx.signal 为长生命周期对象，
+      // 残留 once 监听器每次 bash 调用累积（闭包持有 child/输出缓冲直到 abort 才释放）
+      if (signal) signal.removeEventListener("abort", killTree)
       resolve(result)
     }
 
     child.on("error", (error) => {
+      // signal 双保险（2026-09-05）：abort 时 Node signal option 杀直接子进程 → 本事件
+      // 以 AbortError 先触发——**跳过 finish**（不 settled）——exit 事件随后必到（实证
+      // 2ms 内）走 L195 分支带已收集输出收尾（user interrupted——不丢 partial）；
+      // 非 abort 的真 spawn 错误（command not found 等）保持原分支
+      if (error.name === "AbortError") return
       finish(truncate(`Command failed: ${error.message}\n[stdout]:\n${outBuf || "(empty)"}`))
     })
 
@@ -274,7 +289,7 @@ export const globTool = {
   parameters: {
     type: "object",
     properties: {
-      pattern: { type: "string", description: "Glob pattern" },
+      pattern: { type: "string", description: "Glob pattern — supports **, *, ?, [..], {a,b} braces, and space-separated exclusion (\"**/*.js !test/**\")" },
       path: { type: "string", description: "Directory to search in (default cwd)" },
     },
     required: ["pattern"],
@@ -282,10 +297,19 @@ export const globTool = {
   readonly: true,
   async execute(args, ctx) {
     const base = resolveInCwd(ctx, args.path ?? ".")
-    const regex = globToRegex(args.pattern)
+    // §17 调用侧拆分（评审 #5 职责分层）：空格分隔 include !exclude 多模式在这里拆；
+    // globToRegex 只收单个模式（数组由 compileGlobMatchers 收）。
+    let match
+    try {
+      const parts = splitGlobPatterns(args.pattern)
+      if (parts.length === 0) return "Error: pattern is required"
+      match = compileGlobMatchers(parts).test
+    } catch (e) {
+      return `glob error: invalid pattern "${args.pattern}": ${e.message}`
+    }
     const results = []
     for await (const relPath of walkFiles(base)) {
-      if (regex.test(relPath)) {
+      if (match(relPath)) {
         results.push(relPath)
         if (results.length >= 1000) break
       }
@@ -328,7 +352,7 @@ export const grepTool = {
     properties: {
       pattern: { type: "string", description: "Regular expression, or a literal string when literal=true" },
       path: { type: "string", description: "Directory or file to search (default cwd)" },
-      glob: { type: "string", description: "Only search files matching this glob (e.g. '*.mjs')" },
+      glob: { type: "string", description: "Only search files matching this glob — supports **, *, ?, [..], {a,b} braces and space-separated exclusion (\"**/*.js !test/**\")" },
       ignoreCase: { type: "boolean", description: "Case-insensitive match (default false)" },
       literal: { type: "boolean", description: "Literal string match — no regex interpretation (default false)" },
       before: { type: "integer", description: "Lines of context to show before each match (grep -B). Default 0" },
@@ -346,7 +370,16 @@ export const grepTool = {
     } catch (e) {
       throw new Error(`grep pattern /${args.pattern}/ is not a valid regex: ${e.message}`, { cause: e })
     }
-    const fileFilter = args.glob ? globToRegex(args.glob) : null
+    // §17 调用侧拆分：glob 参数支持空格分隔 include !exclude 多模式（include/exclude 求交）。
+    let fileTest = null
+    if (args.glob) {
+      try {
+        const parts = splitGlobPatterns(args.glob)
+        if (parts.length > 0) fileTest = compileGlobMatchers(parts).test
+      } catch (e) {
+        throw new Error(`grep glob /${args.glob}/ is invalid: ${e.message}`, { cause: e })
+      }
+    }
     const before = Math.max(0, Math.floor(args.before ?? 0))
     const after = Math.max(0, Math.floor(args.after ?? 0))
     const wantCtx = before > 0 || after > 0
@@ -373,13 +406,15 @@ export const grepTool = {
       }
     }
 
-    async function walk(target) {
+    async function walk(target, rel) {
       if (hits.length >= 200) return
       // Use lstat to avoid following symlinks — prevents ./evil → /etc from making grep scan the entire system
       let s
       try { s = await lstat(target) } catch { return }
       if (!s.isDirectory()) {
-        if (!fileFilter || fileFilter.test(target.split(/[\\/]/).pop())) await search(target)
+        // rel 为相对搜索基的路径（排除前缀如 !test/** 必须按目录路径作用——不能用裸文件名）；
+        // 单文件目标（path 指向文件）时 rel 为空 → 退化为按文件名过滤（既有语义）。
+        if (!fileTest || fileTest(rel || target.split(/[\\/]/).pop())) await search(target)
         return
       }
       let entries
@@ -390,11 +425,11 @@ export const grepTool = {
       }
       for (const e of entries) {
         if (e.isDirectory() && IGNORED_DIRS.has(e.name)) continue
-        await walk(join(target, e.name))
+        await walk(join(target, e.name), rel ? `${rel}/${e.name}` : e.name)
       }
     }
 
-    await walk(base)
+    await walk(base, "")
     if (hits.length === 0) return "(no matches)"
 
     // No context: keep original path:line: content format

package/src/tools/wait_for.md

@@ -0,0 +1,22 @@
+Wait until a condition becomes true — polls the condition every interval_ms and returns as soon as it holds or the timeout_ms ceiling passes. Use it ONLY for genuinely asynchronous waits: an async subagent/consult still settling, a file appearing, a port opening. Synchronous tools (advisor, blocking subagent spawn) return when done — waiting after them is NOT needed and wastes time.
+
+Parameters:
+- condition (required): a semantic condition expression:
+  - `advisor settled` — an in-flight advisor review session has finished (async advisor-role children settled)
+  - `subagent id:N done` — async subagent N (the id your async spawn ack returned) has settled
+  - `consult done` — every consult_start session has drained
+  - `file exists:path` — the file at path exists (path relative to cwd)
+  - `port open:N` — something is listening on 127.0.0.1 port N
+  - The agent-internal conditions (advisor / subagent / consult) apply to ASYNC sessions only — a synchronous call already completed before it returned and has nothing to wait for. An unknown condition is an explicit error (`wait_for: unsupported condition "..."` — the supported forms are listed above), never a silent wait.
+- interval_ms: poll interval (default 1000, floor 100 — polling never busy-spins)
+- timeout_ms: overall ceiling (default 30000; config.json `agent.waitForTimeoutMs` overrides the default; hard cap 600000 like the execute tool)
+
+Returns:
+- `wait_for: condition satisfied after Nms (N checks): "<condition>"` — condition held
+- `wait_for: timed out after Nms waiting for "<condition>" ...` — ceiling passed with the condition still false (never burns beyond the ceiling)
+- interrupts (Ctrl+C / cancel) exit immediately; malformed conditions and unsupported syntax error out explicitly
+
+Notes:
+- Read-only and non-destructive — it only observes (agent pools, the filesystem, a local port probe).
+- Blocking by design — call it ALONE in a turn, not batched with calls that depend on its result.
+- Do not use it to wait after synchronous tools (advisor / blocking subagent spawn / verify return only when done).

package/src/tui/agent-turn.mjs

@@ -1,6 +1,5 @@
 /**
- * agent-turn.mjs — runAgentTurn：一个用户回合的驱动器（submit / 队列递归入口）
- * + §17 挂起会话（suspensionSession：async 子代理后台运行期间主会话可继续对话）。
+ * agent-turn.mjs — runAgentTurn：一个用户回合的驱动器（submit / 队列递归入口）。
  *
  * 2026-08-30 拆分（回回 500 行硬限）：回合生命周期（状态复位 → runAgent 循环 →
  * 错误/Continue/中断处理 → finally 收尾 → 队列）留在这里；工具事件 → TUI 状态的
@@ -9,37 +8,26 @@
  * （routeSub* / finishSubTask / freeze*SubTasks）在 subagent-blocks.mjs；标题生成
  * 在 generate-title.mjs ensureSessionTitle。
  *
- * §17（2026-09-02，AGENT-LOOP.md §17 D-S1..S9）：回合尾后台池非空 → 不阻塞等待，
- * 进入挂起态——输入放开（Enter = 新回合 / digest 中 Enter 排队 pendingInput）、
- * settle 事件驱动 auto-turn 消化（手动档 organize-only / AUTO 档全语义）、池空 + 无
- * 待处理输入 → 补发 done 冻结自然退出。状态机行表见 AGENT-LOOP.md §17 D-S9。
+ * 2026-09-05 module-split：§17 挂起会话段（suspensionSession/digestTurn/poolLive/
+ * poolCounts 等——agent-turn.mjs 535 > 500 硬限）verbatim 迁至 suspension-drive.mjs——
+ * 本文件回合尾经 suspensionSession 进入驱动器；驱动器内 digest/用户回合经 runAgentTurn
+ * 递归回本文件（函数级静态环——模块求值期无顶层调用，环安全——session-slots ↔
+ * session.mjs 同款先例）。
  */
 import { runAgent, ContinueError } from "../agent.mjs"
 import { saveSession } from "../session.mjs"
 import { ansi, C } from "./ansi.mjs"
 import { buildToolCallbacks, sweepToolBlocks } from "./tool-events.mjs"
-import { freezeAllSubTasks, freezeReclaimDigestedBlocks } from "./subagent-blocks.mjs"
+import { freezeAllSubTasks } from "./subagent-blocks.mjs" // freezeReclaimDigestedBlocks 随 §17 段迁 suspension-drive.mjs
 import { ensureSessionTitle } from "../generate-title.mjs"
 import { logEvent, errText } from "../log.mjs"
+import { suspensionSession, poolLive, planQueuedInput } from "./suspension-drive.mjs"
 
 /** Exit-flush bound for the async end-of-run distillation (SEND-STALL-DISTILL §2.5):
  *  wait at most this long for the in-flight distill before the final session save —
  *  never let shutdown hang on the background summary call. */
 const DISTILL_FLUSH_TIMEOUT_MS = 5000
 
-/** 后台池计数（LOGGING susp/digest 事件字段——pendingN/poolN）。
- *  poolN = _asyncSubagents map 大小（queued 条目同样在 map 内——2026-09-03 code
- *  review #2：不再 +queue.length 双计；与 vscode suspension poolCounts 口径一致）。 */
-function poolCounts(agent) {
-  const map = agent?._asyncSubagents
-  const running = map ? [...map.values()].filter((e) => e.status === "running").length : 0
-  return {
-    poolN: map?.size ?? 0,
-    pendingN: agent?._pendingAsyncResults?.length ?? 0,
-    runningN: running,
-  }
-}
-
 /**
  * LOGGING（docs/design/LOGGING.md）包装：回合骨架事件（turn:start/turn:end——kind
  * user/auto；result ok/stopped/error）。内层经 _logOutcome 载具回传终止原因（中止/
@@ -302,17 +290,20 @@ async function runAgentTurnInner(ctx, text, opts) {
     state.queue.push(...state.pendingInput.splice(0).map((t) => ({ text: String(t) })))
   }
 
-  // Queued messages: auto-process next one
+  // Queued messages: auto-process next one（§24 D-24c/R15：攒批合并——合并仅限
+  // 连续文本——/cmd 逐条保序即时——单条超长直发；每条 runAgentTurn 回合后余项
+  // 由递归层的本循环续取——边界幂等不丢）
   while (state.queue.length > 0 && !state.processing) {
-    const next = state.queue.shift()
-    // Queued slash commands execute directly — check every item, not just the first
-    if (next.text.startsWith("/")) {
-      await handleSlash(next.text)
+    const head = planQueuedInput(state.queue.map((q) => q.text))[0]
+    state.queue.splice(0, head.count)
+    // Queued slash commands execute directly — order-preserved, never merged
+    if (head.kind === "slash") {
+      await handleSlash(head.text)
       render()
       continue
     }
     pushLabel(`❯ You: (from queue)`, ansi.bold + C.user)
-    await runAgentTurn(ctx, next.text)
+    await runAgentTurn(ctx, head.text)
     return
   }
 
@@ -331,205 +322,3 @@ async function runAgentTurnInner(ctx, text, opts) {
     state._suspAborted = false
   }
 }
-
-// ─── §17 挂起会话（AGENT-LOOP.md §17 D-S2/D-S9 状态机行表）────────────────
-
-/** 后台池存活判据（D-S2/F5 口径）：running/queued 子代理，或已 settle 未注入结果
- *  （_pendingAsyncResults 非空 = D-S3 "未注入"）。回合尾与每次轮末都用它评估退出。 */
-function poolLive(agent) {
-  const map = agent._asyncSubagents
-  return (map && map.size > 0) || (agent._pendingAsyncResults?.length ?? 0) > 0
-}
-
-/** D-S3 ③ 记账清扫：回合边界竞态落下的已 settle 项（settle 回调未及移交——发生在
- *  回合刚结束、_suspended 尚未置位的窗口）补入 pending。幂等：回调已移交的条目已
- *  从 map 删除并带 _inPending 标记，不会重复入列。 */
-function sweepSettledToPending(agent) {
-  const map = agent._asyncSubagents
-  if (!map || map.size === 0) return
-  agent._pendingAsyncResults ??= []
-  for (const e of [...map.values()]) {
-    if (e.done && !e._inPending) {
-      e._inPending = true
-      agent._pendingAsyncResults.push(e)
-      map.delete(String(e.id))
-    }
-  }
-}
-
-/** 等待下一次 settle（running 子代理 promise 完成）或用户唤醒（Enter 入队 / Ctrl+C /
- *  会话 abort）。唤醒器经 state._suspWake 单槽注入；abort 监听兜底。 */
-function waitForSettleOrWake(agent, state) {
-  return new Promise((resolve) => {
-    let finished = false
-    const cleanup = () => {
-      state._suspWake = null
-      const i = (agent._asyncWaiters ?? []).indexOf(w)
-      if (i >= 0) agent._asyncWaiters.splice(i, 1)
-      agent._sessionAbort?.signal.removeEventListener("abort", onAbort)
-    }
-    const finish = (why) => {
-      if (finished) return
-      finished = true
-      cleanup()
-      resolve(why)
-    }
-    const w = () => finish("settle")
-    const wake = () => finish("wake")
-    const onAbort = () => finish("aborted")
-    ;(agent._asyncWaiters ??= []).push(w)
-    state._suspWake = wake
-    if (agent._sessionAbort?.signal.aborted) { onAbort(); return }
-    agent._sessionAbort?.signal.addEventListener("abort", onAbort, { once: true })
-  })
-}
-
-/** 后台模式状态行文本（D-S8；17.5.4 #6 顺手对齐）："后台 N 子代理运行中 · M 完成待消化"
- *  ——"运行中" = running + queued；"完成待消化" = pending 移交项 + §17.5 回合尾留池的
- *  settled 未消费项（挂起会话 sweep 前的可见窗口）。 */
-function backgroundStatusText(agent) {
-  const map = agent._asyncSubagents
-  const running = map ? [...map.values()].filter((e) => e.status === "running").length : 0
-  const queued = agent._asyncQueue?.length ?? 0
-  const pending = agent._pendingAsyncResults?.length ?? 0
-  const doneInPool = map ? [...map.values()].filter((e) => e.done).length : 0 // §17.5 留池未消费
-  const awaiting = pending + doneInPool
-  const active = running + queued
-  return active > 0 || awaiting > 0
-    ? `后台 ${active} 子代理运行中${awaiting ? ` · ${awaiting} 完成待消化` : ""}`
-    : "后台子代理收尾…"
-}
-
-/** 消化轮：系统驱动的 auto-turn（D-S6）。手动档不传权限/问答 handler（D-S7 装配
- *  契约——denied 不弹面板、不悬挂）；AUTO 档沿用普通回调（autoApprove 短路自动
- *  执行）。_suspended 保持 true：消化中 settle 延迟冻结 + 移交 pending。 */
-async function digestTurn(ctx) {
-  const { agent, pushLine } = ctx
-  const manual = !agent.autoApprove
-  pushLine(manual
-    ? "[auto-turn: digesting finished subagent reports…]"
-    : "[auto-turn: continuing background work…]", C.dim)
-  const digestCtx = manual
-    ? { ...ctx, askPermission: null, askBatchPermission: null, askQuestion: null }
-    : ctx
-  // LOGGING：digest:* 事件（D-S9 消化轮边界——LOGGING.md F-L4 挂起态覆盖）
-  const d0 = Date.now()
-  const pend0 = agent?._pendingAsyncResults?.length ?? 0
-  logEvent("digest:start", { pendingN: pend0 })
-  await runAgentTurn(digestCtx, "", { autoTurn: true, skipSession: true })
-  logEvent("digest:end", { pendingN: agent?._pendingAsyncResults?.length ?? 0, ms: Date.now() - d0 })
-}
-
-/**
- * §17 挂起会话驱动（D-S9 行表；由 runAgentTurn 回合尾进入，池空自然退出）：
- * - suspension：池项 settle → 入 pending → 开 auto-turn（合并消化近邻 settle）；
- *   用户 Enter → pendingInput（digest 运行中排队，D-S5）——用户输入优先于 digest；
- * - auto-turn：消化中 settle 不并发开新轮（单 runAgent 循环），轮末按 pending/池态
- *   续开合并消化轮或回挂起；pendingInput 非空 → 以该消息开新回合（不触发新 digest）；
- * - §17.5.5：每次消化/会话内用户回合消费 pending 后 → freezeReclaimDigestedBlocks
- *   逐条冻结回收（消化完成块不滞留面板——不等池空；settle 锚点 splice——digest 总览
- *   文本之前——round1 #1 裁定）；
- * - 退出：池空 + pending 空 + 无待处理输入 → freezeAllSubTasks 补发冻结（仅兜底
- *   未消化残项——17.5.5 块回收与池空解耦）→ idle。
- * _suspended 翻转：会话期 true（settle 回调据此延迟冻结 + 移交 pending）；会话内
- * 用户回合执行期翻 false（普通回合语义：settle 即冻结 + 回合尾直注入 ①）。
- */
-async function suspensionSession(ctx) {
-  const { agent, state, render, pushLine } = ctx
-  state.pendingInput ??= []
-  state._suspAborted = false
-  agent._suspended = true
-  agent._sessionSignal = agent._sessionAbort.signal // 会话内 spawn 的 children 共享（subagent.mjs）
-  state.suspended = true
-  state._suspPending = false // 偏差 #1：进入真正挂起态——标志只在释放窗口期有效（此后由 state.suspended 分流）
-  const suspTick = setInterval(() => {
-    if (state.suspended && !state.processing) {
-      state.status = backgroundStatusText(agent)
-      render()
-    }
-  }, 1000)
-  state.status = backgroundStatusText(agent)
-  render()
-  // LOGGING：susp:* 事件（挂起态进入/退出——F-L4；挂起期输入事件 v1 不记——refinement #1）
-  const s0 = Date.now()
-  logEvent("susp:enter", poolCounts(agent))
-  try {
-    while (!state._suspAborted && !agent._sessionAbort.signal.aborted) {
-      sweepSettledToPending(agent)
-      // 1. 用户输入优先（D-S5）：pendingInput 队列 + 消化期排队的 slash 命令
-      const queuedText = state.pendingInput.length > 0 ? state.pendingInput.shift()
-        : state.queue.length > 0 ? state.queue.shift().text : null
-      if (queuedText) {
-        if (String(queuedText).startsWith("/")) {
-          await ctx.handleSlash?.(queuedText)
-          render()
-          continue
-        }
-        agent._suspended = false // 用户回合 = 普通回合语义（① 直注入 + settle 即冻结）
-        await runAgentTurn(ctx, String(queuedText), { skipSession: true })
-        agent._suspended = true
-        // §17.5.5：该回合消化完 pending（run 首行注入）→ 逐条冻结回收驻留块
-        // （不等池空——settle 锚点 splice——digest 总览文本之前；与 digest 回收同规则）
-        freezeReclaimDigestedBlocks(state, agent._pendingAsyncResults ?? [])
-        state.status = backgroundStatusText(agent)
-        continue
-      }
-      // 2. pending 非空 → 合并消化轮（注入由 runAgent 首行统一完成——D-S3 单注入点）
-      if ((agent._pendingAsyncResults?.length ?? 0) > 0) {
-        await digestTurn(ctx)
-        // §17.5.5 实测修订（2026-09-03）：digest 消化完成（pending 条目已注入）→ 逐条补发
-        // done 冻结回收——不等池空——块从面板移除进流（settle 锚点 splice 落位——digest
-        // 总览文本之前——round1 #1 裁定）；池空 freeze-out 仅兜底未消化残项（挂起会话
-        // 结束统一清场）——块回收与池空解耦（T-H7/AC-H5）。
-        // 归属不变式：会话内任何 run 开始前 pinned 块（awaitingDigest）的条目必在 pending
-        // ——run 消费后不在 pending 的 pinned 块即本 run 消化者（无需快照即精确归属）。
-        freezeReclaimDigestedBlocks(state, agent._pendingAsyncResults ?? [])
-        state.status = backgroundStatusText(agent)
-        continue
-      }
-      // 3. 池空（无 running/queued/未注入）→ 自然退出回 idle（补发冻结在 finally）
-      if (!poolLive(agent)) break
-      // 4. 等下一 settle / 用户唤醒（Enter 入队、Ctrl+C）
-      await waitForSettleOrWake(agent, state)
-    }
-  } finally {
-    clearInterval(suspTick)
-    const aborted = state._suspAborted || agent._sessionAbort.signal.aborted
-    if (aborted && (agent._asyncSubagents?.size ?? 0) > 0) logEvent("ev:stopped", { poolN: agent._asyncSubagents?.size ?? 0, where: "suspension-abort" })
-    logEvent("susp:exit", { ...poolCounts(agent), ms: Date.now() - s0, reason: aborted ? "aborted" : "idle" })
-    agent._suspended = false
-    agent._sessionSignal = null
-    agent._sessionAbort = null
-    agent._sessionAbortAll = null // 偏差 #3：会话期 controller 集合随句柄一并释放
-    state.suspended = false
-    state._suspWake = null
-    state.suspAbortArmed = false // round2 偏差 #4：会话退出即解除挂起中止武装（防跨会话粘滞）
-    if (aborted) {
-      // §15 abort 语义：清池不注入（用户显式停——不注入陈旧错误）
-      agent._asyncSubagents?.clear()
-      agent._asyncQueue = []
-      agent._pendingAsyncResults = []
-      // §17 round2 偏差 #2-CLI（code review round2 #2-CLI）：中止时不静默丢弃挂起期
-      // 排队的用户消息——Enter 已清空输入框并入 pendingInput（用户视为已发送），
-      // 残余转回 state.queue（{text} 条目，下个普通回合的队列循环续发——零丢失）
-      // + 提示行明示去向（不静默丢）。
-      const queuedN = state.pendingInput?.length ?? 0
-      if (queuedN > 0) {
-        state.queue.push(...state.pendingInput.splice(0).map((t) => ({ text: String(t) })))
-        pushLine(`[background work stopped — ${queuedN} queued message${queuedN > 1 ? "s" : ""} will run as a normal turn]`, C.warn)
-      }
-    } else {
-      // D-S3 ③ 兜底：退出前残余（极端竞态）直注入再退——结果零丢失（AC-S2）
-      const residual = agent._pendingAsyncResults
-      if (residual?.length) {
-        const { injectAsyncResult } = await import("../agent-tools/subagent.mjs")
-        for (const e of residual.splice(0)) await injectAsyncResult(agent, e)
-      }
-    }
-    // 补发 done 冻结：驻留面板的 awaiting-digest 块随池空冻结进流（T-S14）
-    freezeAllSubTasks(state)
-    sweepToolBlocks(state)
-    state.status = "Ready"
-    render()
-  }
-}

package/src/tui/cmd-config.mjs

@@ -1,4 +1,3 @@
-import { existsSync, readFileSync } from "node:fs"
 import { ansi, C } from "./ansi.mjs"
 /** Merge an embedding-key save into the raw config, backfilling baseURL/model from defaults.
  *  Keeps existing custom values (Ollama/local embedding); defaults are the single source
@@ -31,9 +30,10 @@ export async function handleConfigCommand(ctx, args = []) {
   async function setEmbedKey() {
     const embKey = await askQuestion("Enter embedding API key (default: SiliconFlow bge-m3):")
     if (!embKey) return false
+    // D-F5b 语义先盘后存（embeddingPatch 在磁盘 fresh raw 上合并——冲突放弃不留 ghost）
+    await persistRaw((raw) => { raw.embedding = embeddingPatch(raw, embKey, DEFAULTS.embedding) })
     agent.config.embedding ??= {}
     agent.config.embedding.apiKey = embKey
-    await persistRaw((raw) => { raw.embedding = embeddingPatch(raw, embKey, DEFAULTS.embedding) })
     if (agent.memory) {
       const { createEmbedder } = await import("../embedding.mjs")
       agent.memory.embedder = createEmbedder(agent.config.embedding)
@@ -78,13 +78,15 @@ export async function handleConfigCommand(ctx, args = []) {
     }
   }
 
-  /** 保存 config（mutate 改 raw）→ reloadConfig（provider 代理无需重启即生效） */
+  /** 保存 config（mutate 改 raw）→ reloadConfig（provider 代理无需重启即生效）。
+   *  D-F5b：磁盘新鲜读 → mutate → 写前 mtime 门控（writeConfigAtomic——冲突放弃 +
+   *  .bak 留现场）；冲突时先 reloadConfig 采纳磁盘新值再 throw——调用方 try/catch
+   *  统一展示 "Save failed: config changed on disk concurrently — retry"。 */
   async function saveProxy(mutate) {
-    const raw = existsSync(configPath) ? JSON.parse(readFileSync(configPath, "utf8")) : {}
-    mutate(raw)
-    const { saveConfig } = await import("../config.mjs")
-    saveConfig(raw)
+    const { writeConfigAtomic, configPath } = await import("../config.mjs")
+    const r = writeConfigAtomic(configPath, mutate)
     await reloadConfig()
+    if (!r.ok) throw new Error("config changed on disk concurrently — retry")
   }
 
   // ── Proxy sub-menu loop：每轮重建 entries 显示最新状态，defaultIndex 记住上次位置 ──
@@ -229,6 +231,36 @@ export async function handleConfigCommand(ctx, args = []) {
     }
   }
 
+  // ── 并发池子菜单（§24 D-24a/R14——agent.poolLimits——读/改两域；保存经 saveProxy
+  // 落盘 + reloadConfig 热应用——下个 spawn 生效）──
+  async function poolMenu() {
+    let poolIdx = 0
+    for (;;) {
+      const pl = agent.config?.agent?.poolLimits ?? {}
+      // 显示回退与默认同源（DEFAULTS.agent.poolLimits——配置 DEFAULTS 与运行时回退常量
+      // ASYNC_POOL_LIMITS 的耦合由 T-24a4 锚定断言锁住——防默认值单侧漂移）
+      const cur = (k) => (Number.isInteger(pl[k]) && pl[k] >= 1 ? pl[k] : DEFAULTS.agent.poolLimits[k])
+      const entries = [
+        { type: "header", text: `Async pools: eng-coder ${cur("engCoder")} / other ${cur("other")}（默认 4/4——分域互不阻塞——超限排队）` },
+        { type: "item", text: `eng-coder 池上限 = ${cur("engCoder")}`, action: "engCoder" },
+        { type: "item", text: `其他角色池上限 = ${cur("other")}`, action: "other" },
+      ]
+      const c = await showPicker("并发池（agent.poolLimits）", entries, { defaultIndex: poolIdx })
+      if (!c) return // Esc 返回主菜单
+      poolIdx = Math.max(0, entries.filter((e) => e.type === "item").indexOf(c))
+      const val = await askQuestion(`${c.action} pool limit (current: ${cur(c.action)} — positive integer ≥1):`)
+      if (!val) continue // 空输入不改动
+      const num = Number(val)
+      if (!Number.isInteger(num) || num < 1) { pushLine("Pool limit must be a positive integer (≥1)", C.error); continue }
+      const next = { engCoder: cur("engCoder"), other: cur("other"), [c.action]: num }
+      try {
+        await saveProxy((raw) => { raw.agent ??= {}; raw.agent.poolLimits = { engCoder: next.engCoder, other: next.other } })
+        pushLabel("❯ Config", ansi.bold + C.tool)
+        pushLine(`agent.poolLimits = { engCoder: ${next.engCoder}, other: ${next.other} }（下个 spawn 生效——分域互不阻塞）`, C.tool)
+      } catch (error) { pushLine(`Save failed: ${error.message}`, C.error) }
+    }
+  }
+
   // ── Main config loop ──
   let running = true
   let mainIdx = 0 // 记住上次选中位置，改完一项回主菜单时恢复
@@ -238,10 +270,13 @@ export async function handleConfigCommand(ctx, args = []) {
     ec = agent.config?.embedding ?? {}
     tc = agent.config?.traces ?? {}
     const consultCount = (ac.consultModels ?? []).length
+    const pl = ac.poolLimits ?? {}
+    const cur = (k) => (Number.isInteger(pl[k]) && pl[k] >= 1 ? pl[k] : DEFAULTS.agent.poolLimits[k])
     const mainEntries = [
       { type: "header", text: `proxy=${proxySummary()} | maxTurns=${ac.maxTurns ?? 200} | compactThreshold=${ac.compactThreshold ?? 100000} | verifyGuard=${ac.verifyGuard === true ? "on" : "off"} | consult=${consultCount} model(s) | embedding=${agent.memory?.embedder ? "on" : "off"} | traces=${tc.enabled === false ? "off" : "on"}` },
       { type: "item", text: `agent.maxTurns = ${ac.maxTurns ?? 200}`, action: "agent.maxTurns" },
       { type: "item", text: `agent.subagentTurns = ${ac.subagentTurns ?? 100}`, action: "agent.subagentTurns" },
+      { type: "item", text: `并发池 agent.poolLimits = engCoder ${cur("engCoder")} / other ${cur("other")}（async 分域上限）`, action: "pool" },
       { type: "item", text: `agent.compactThreshold = ${ac.compactThreshold ?? 100000}${agent.config?.agent?.compactThresholdAuto ? " (auto)" : ""}`, action: "agent.compactThreshold" },
       { type: "item", text: `agent.verifyGuard = ${ac.verifyGuard === true ? "on" : "off"}`, action: "agent.verifyGuard" },
       { type: "item", text: `traces.enabled = ${tc.enabled === false ? "off" : "on"}（轨迹存档——发布默认关——隐私）`, action: "traces.enabled" },
@@ -269,6 +304,7 @@ export async function handleConfigCommand(ctx, args = []) {
       pushLine(`traces.enabled: ${tc.enabled === false ? "off" : "on"}（默认 off——发布隐私——本地分析可开）`, C.dim)
       pushLine(`traces.retentionHours: ${tc.retentionHours ?? 24}（超期文件启动清理——D-TR10）`, C.dim)
       pushLine(`agent.consultModels: ${(ac.consultModels ?? []).map((m) => `${m.provider}:${m.model}${m.effort ? ` (${m.effort})` : ""}`).join(", ") || "(none)"}`, C.dim)
+      pushLine(`agent.poolLimits: { engCoder: ${cur("engCoder")}, other: ${cur("other")} }（async 分域上限——默认 4/4——agent.poolLimits 可配）`, C.dim)
       pushLine(`agent.consultTurns: ${ac.consultTurns ?? 40}`, C.dim)
       pushLine(`agent.consultTimeoutMs: ${Math.round((ac.consultTimeoutMs ?? 600000) / 60000)} min`, C.dim)
       pushLine(`embedding: ${agent.memory?.embedder ? `enabled (${ec.model ?? ""})` : "disabled (FTS only)"}`, C.dim)
@@ -287,6 +323,11 @@ export async function handleConfigCommand(ctx, args = []) {
       continue
     }
 
+    if (choice.action === "pool") {
+      await poolMenu()
+      continue
+    }
+
     if (choice.action === "embedkey") {
       await setEmbedKey() // 保存成功/取消都回主菜单（Esc 退出）
       continue

package/src/tui/cmd-eng.mjs

@@ -1,11 +1,12 @@
 /** /eng command: toggle engineering mode.
  *  Requires METHODOLOGY.md in project root. Offers to create one if missing.
- *  ctx: { agent, pushLine, pushLabel, persistRaw, showPicker } */
+ *  ctx: { agent, pushLine, pushLabel, showPicker } */
 import { existsSync, copyFileSync, readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync } from "node:fs"
 import { join, dirname } from "node:path"
 import { fileURLToPath } from "node:url"
 import { ansi, C } from "./ansi.mjs"
 import { activeSlot, slotPath } from "../session.mjs"
+import { purgeExpiredDesignTokens } from "../token-ttl.mjs"
 
 const templateDir = join(fileURLToPath(import.meta.url), "..", "..", "prompts")
 import { ENG_OFF_REMINDER } from "../agent.mjs"
@@ -25,7 +26,7 @@ export function writeSessionFile(p, data) {
 }
 
 export async function handleEngCommand(ctx) {
-  const { agent, pushLine, pushLabel, persistRaw, showPicker } = ctx
+  const { agent, pushLine, pushLabel, showPicker } = ctx
   agent.config.agent ??= {}
   const methodologyPath = join(agent.cwd, "METHODOLOGY.md")
 
@@ -47,31 +48,40 @@ export async function handleEngCommand(ctx) {
   }
 
   agent.config.agent.engineering = !agent.config.agent.engineering
+  // §24 D-24b: per-review instances die with the mode (fresh convergence cycles
+  // on the next toggle).
+  agent._advisorRuns = new Map()
   if (!agent.config.agent.engineering) {
-    agent._engDesignToken = null // invalidate stale token
-    agent._engDesignTokens = new Map() // multi-design slots die with the mode (2026-09-01 fix #2)
+    // R16 (2026-09-06 F-R16a): OFF 不清 token——有效 token 跨模式存活（仅 TTL 过期
+    // 在三清理时机删：恢复过滤 / 开模式清过期 / spawn 门禁拒时删槽）。
     // OFF must reach the model too (2026-08-25): /auto pushes a reminder on toggle — the
     // mode flip is invisible to the agent otherwise. (ON needs none here: the injector
     // in agent.mjs already announces ON transitions on the next turn.)
     agent._pendingReminders = agent._pendingReminders ?? []
     agent._pendingReminders.push(ENG_OFF_REMINDER)
   }
-  await persistEngineering(ctx, agent)
+  // 开工程模式（真实 OFF→ON 转换）→ 清过期 token（有效保留——用户裁定"打开工程
+  // 模式时应该清理"——F-R16b ②——与 eng tool enter 同语义）。
+  const clearedExpired = agent.config.agent.engineering ? purgeExpiredDesignTokens(agent) : 0
+  await persistEngineering(agent)
   pushLabel("❯ Eng", ansi.bold + C.tool)
   pushLine(`Engineering mode: ${agent.config.agent.engineering ? "ON" : "OFF"} (session)`, C.tool)
   if (agent.config.agent.engineering) {
     pushLine(`  → strictly following ${methodologyPath}`, C.dim)
+    if (clearedExpired > 0) {
+      pushLine(`  → cleared ${clearedExpired} expired design token${clearedExpired === 1 ? "" : "s"}; valid tokens from prior reviews stay usable`, C.dim)
+    }
   }
 }
 
 /**
- * Dual persistence (2026-08-29 — engineering is session-level): write the flipped flag into
- * the CURRENT session slot first (slot authority — shared with VS Code, per-session), then
- * the config.json mirror (CLI visibility/compat; no longer the cross-session source of truth).
+ * Slot-only persistence (2026-09-08 — ENG-SESSION-PROVIDER-CLEANUP D1.1): the flipped flag
+ * goes into the CURRENT session slot only — the slot is the sole authority (shared with
+ * VS Code, per-session; config.json is just the initial default, no mirror write).
  * The in-memory agent.config.agent.engineering (already flipped) stays the live authority for
  * this process; saveSession also round-trips it on every turn-end write.
  */
-async function persistEngineering(ctx, agent) {
+async function persistEngineering(agent) {
   const slot = activeSlot(agent.cwd)
   try {
     const p = slotPath(agent.cwd, slot)
@@ -80,11 +90,5 @@ async function persistEngineering(ctx, agent) {
       data.engineering = agent.config.agent.engineering
       writeSessionFile(p, data)
     }
-  } catch { /* slot missing/unreadable — config mirror still written */ }
-  if (ctx.persistRaw) {
-    await ctx.persistRaw((raw) => {
-      raw.agent ??= {}
-      raw.agent.engineering = agent.config.agent.engineering
-    })
-  }
+  } catch { /* slot missing/unreadable — in-memory flag already flipped; saveSession persists at turn end */ }
 }

package/src/tui/cmd-mcp.mjs

@@ -82,9 +82,15 @@ export async function handleMcpCommand(ctx, args = []) {
   }
 
   async function removeServer(name) {
+    // D-F5a（#7）先盘后存：磁盘 fresh raw.mcp.servers 上只删目标条目——不整节写回内存
+    // agent.config.mcp.servers（内存含 reloadMcpFromDisk 的 keptConnected 尾巴——
+    // 整节写回会把对端磁盘上其他 server 的新改动一起抹掉）；冲突放弃不留内存 ghost
+    await persistRaw((raw) => {
+      raw.mcp ??= { servers: [] }
+      if (!Array.isArray(raw.mcp.servers)) return
+      raw.mcp.servers = raw.mcp.servers.filter((s) => s?.name !== name)
+    })
     agent.config.mcp.servers = getServers().filter((s) => s.name !== name)
-    // 评审 #1：磁盘无 mcp 段时（T23 场景——mcp 段被整体删除而连接保留）raw.mcp 为 undefined → 先建段再写
-    await persistRaw((raw) => { raw.mcp ??= { servers: [] }; raw.mcp.servers = agent.config.mcp.servers })
     // Remove from tool list
     const { removeMcpTools } = await import("../mcp.mjs")
     removeMcpTools(agent, name)