thincoder 0.12.59 → 0.12.61

package/src/tui/cmd-eng.mjs

@@ -1,13 +1,14 @@
 /** /eng command: toggle engineering mode.
- *  Requires METHODOLOGY.md in project root. Offers to create one if missing.
- *  ctx: { agent, pushLine, pushLabel, persistRaw, showPicker } */
-import { existsSync, copyFileSync, readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync } from "node:fs"
-import { join, dirname } from "node:path"
-import { fileURLToPath } from "node:url"
+ *  No prerequisites (FR11): the mode works on any project — no methodology file,
+ *  no docs tree, no git. The retired gate demanded a methodology file and offered
+ *  to create it from a template that no longer ships — that option crashed
+ *  (PORTABILITY P14). ctx: { agent, pushLine, pushLabel } */
+import { readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync } from "node:fs"
+import { dirname } from "node:path"
 import { ansi, C } from "./ansi.mjs"
 import { activeSlot, slotPath } from "../session.mjs"
+import { purgeExpiredDesignTokens } from "../token-ttl.mjs"
 
-const templateDir = join(fileURLToPath(import.meta.url), "..", "..", "prompts")
 import { ENG_OFF_REMINDER } from "../agent.mjs"
 
 /** Atomic slot write (same shape as session.mjs writeSessionFile — kept local to avoid a
@@ -25,53 +26,46 @@ export function writeSessionFile(p, data) {
 }
 
 export async function handleEngCommand(ctx) {
-  const { agent, pushLine, pushLabel, persistRaw, showPicker } = ctx
+  const { agent, pushLine, pushLabel } = ctx
   agent.config.agent ??= {}
-  const methodologyPath = join(agent.cwd, "METHODOLOGY.md")
-
-  // Toggle on: check METHODOLOGY.md exists
-  if (!agent.config.agent.engineering) {
-    if (!existsSync(methodologyPath)) {
-      pushLabel("❯ Eng", ansi.bold + C.tool)
-      pushLine("METHODOLOGY.md not found in project root.", C.warn)
-      const choice = await showPicker("Create METHODOLOGY.md?", [
-        { type: "header", text: "Engineering mode requires a methodology file" },
-        { type: "item", text: "Yes, create from template", action: "create" },
-        { type: "item", text: "No, cancel", action: "cancel" },
-      ])
-      if (!choice || choice.action !== "create") return
-      const src = join(templateDir, "methodology-template.md")
-      copyFileSync(src, methodologyPath)
-      pushLine(`Created METHODOLOGY.md (from template) → edit it to fit your project`, C.tool)
-    }
-  }
 
+  // Toggle on/off — no prerequisite check (FR11: engineering mode depends on no
+  // project file at all; a missing docs tree or git repo must not block it).
   agent.config.agent.engineering = !agent.config.agent.engineering
+  // §11.2 D-24b: per-review instances die with the mode (fresh convergence cycles
+  // on the next toggle).
+  agent._advisorRuns = new Map()
   if (!agent.config.agent.engineering) {
-    agent._engDesignToken = null // invalidate stale token
-    agent._engDesignTokens = new Map() // multi-design slots die with the mode (2026-09-01 fix #2)
+    // R16 (2026-09-06 F-R16a): OFF 不清 token——有效 token 跨模式存活（仅 TTL 过期
+    // 在三清理时机删：恢复过滤 / 开模式清过期 / spawn 门禁拒时删槽）。
     // OFF must reach the model too (2026-08-25): /auto pushes a reminder on toggle — the
     // mode flip is invisible to the agent otherwise. (ON needs none here: the injector
     // in agent.mjs already announces ON transitions on the next turn.)
     agent._pendingReminders = agent._pendingReminders ?? []
     agent._pendingReminders.push(ENG_OFF_REMINDER)
   }
-  await persistEngineering(ctx, agent)
+  // 开工程模式（真实 OFF→ON 转换）→ 清过期 token（有效保留——用户裁定"打开工程
+  // 模式时应该清理"——F-R16b ②——与 eng tool enter 同语义）。
+  const clearedExpired = agent.config.agent.engineering ? purgeExpiredDesignTokens(agent) : 0
+  await persistEngineering(agent)
   pushLabel("❯ Eng", ansi.bold + C.tool)
   pushLine(`Engineering mode: ${agent.config.agent.engineering ? "ON" : "OFF"} (session)`, C.tool)
   if (agent.config.agent.engineering) {
-    pushLine(`  → strictly following ${methodologyPath}`, C.dim)
+    pushLine(`  → design-before-code enforced (design review + user approval before code)`, C.dim)
+    if (clearedExpired > 0) {
+      pushLine(`  → cleared ${clearedExpired} expired design token${clearedExpired === 1 ? "" : "s"}; valid tokens from prior reviews stay usable`, C.dim)
+    }
   }
 }
 
 /**
- * Dual persistence (2026-08-29 — engineering is session-level): write the flipped flag into
- * the CURRENT session slot first (slot authority — shared with VS Code, per-session), then
- * the config.json mirror (CLI visibility/compat; no longer the cross-session source of truth).
+ * Slot-only persistence (2026-09-08 — ENG-SESSION-PROVIDER-CLEANUP D1.1): the flipped flag
+ * goes into the CURRENT session slot only — the slot is the sole authority (shared with
+ * VS Code, per-session; config.json is just the initial default, no mirror write).
  * The in-memory agent.config.agent.engineering (already flipped) stays the live authority for
  * this process; saveSession also round-trips it on every turn-end write.
  */
-async function persistEngineering(ctx, agent) {
+async function persistEngineering(agent) {
   const slot = activeSlot(agent.cwd)
   try {
     const p = slotPath(agent.cwd, slot)
@@ -80,11 +74,5 @@ async function persistEngineering(ctx, agent) {
       data.engineering = agent.config.agent.engineering
       writeSessionFile(p, data)
     }
-  } catch { /* slot missing/unreadable — config mirror still written */ }
-  if (ctx.persistRaw) {
-    await ctx.persistRaw((raw) => {
-      raw.agent ??= {}
-      raw.agent.engineering = agent.config.agent.engineering
-    })
-  }
+  } catch { /* slot missing/unreadable — in-memory flag already flipped; saveSession persists at turn end */ }
 }

package/src/tui/cmd-exit.mjs

@@ -1,9 +1,7 @@
-/** /exit command: exit TUI (same path as Ctrl+C).
- *  Direct synchronous process.exit — prevents the post-handler render()
- *  from redrawing the TUI over the cleaned terminal. The actual cleanup
- *  (saveSession + closeMcp + terminal reset) runs once
- *  via the process.on("exit") handler registered in index.mjs.
- */
-export async function handleExitCommand(_ctx) {
-  process.exit(0)
+/** /exit command: exit TUI via ctx.exit（F-2——RESIZE-MOUSE-LEAK-FIX——与 Ctrl+C 同退出
+ *  形态：cleanup 同步执行 + 延迟 exit——非同派发路径）。不再直调 process.exit(0)（零提前量——
+ *  清理押 'exit' 事件）；handleSlash 返回后的无条件 render() 由 render-loop tuiActive 守卫
+ *  抑制（cleanup 已清活动态——不把 TUI 帧重绘到已恢复的主屏）。 */
+export async function handleExitCommand(ctx) {
+  ctx.exit?.() // ctx.exit 由 index.mjs 装配（cleanup + 100ms 延迟 exit）
 }

package/src/tui/cmd-mcp.mjs

@@ -82,9 +82,15 @@ export async function handleMcpCommand(ctx, args = []) {
   }
 
   async function removeServer(name) {
+    // D-F5a（#7）先盘后存：磁盘 fresh raw.mcp.servers 上只删目标条目——不整节写回内存
+    // agent.config.mcp.servers（内存含 reloadMcpFromDisk 的 keptConnected 尾巴——
+    // 整节写回会把对端磁盘上其他 server 的新改动一起抹掉）；冲突放弃不留内存 ghost
+    await persistRaw((raw) => {
+      raw.mcp ??= { servers: [] }
+      if (!Array.isArray(raw.mcp.servers)) return
+      raw.mcp.servers = raw.mcp.servers.filter((s) => s?.name !== name)
+    })
     agent.config.mcp.servers = getServers().filter((s) => s.name !== name)
-    // 评审 #1：磁盘无 mcp 段时（T23 场景——mcp 段被整体删除而连接保留）raw.mcp 为 undefined → 先建段再写
-    await persistRaw((raw) => { raw.mcp ??= { servers: [] }; raw.mcp.servers = agent.config.mcp.servers })
     // Remove from tool list
     const { removeMcpTools } = await import("../mcp.mjs")
     removeMcpTools(agent, name)

package/src/tui/cmd-model.mjs

@@ -1,23 +1,25 @@
 import { C } from "./ansi.mjs"
+import { parseModelRef } from "../config.mjs"
 
-/** /model command: open model picker, or switch provider directly via `/model <provider>[:model]`.
+/** /model command: open the session model picker, or switch the SESSION model directly via
+ *  `/model <provider>:<model>`（MODEL-MERGE-SESSION——裁定③：裸 provider 拒——显式 p:m；
+ *  MODEL-SELECTION v2：显式复合一律放行——仅[空值/裸值/未知 provider]无效（M4），候选清单
+ *  由运行期拉取决定——不再有成员校验）。
+ *  /model 是会话级操作（写槽——不写 config）——config 默认模型走 /config → 默认模型。
  *  ctx: { agent, openModelPicker, selectModel, pushLine } */
 export async function handleModelCommand(ctx, args = []) {
-  const raw = args[0]?.toLowerCase()
+  const raw = args[0]?.trim()
   if (!raw) {
     ctx.openModelPicker().catch((e) => ctx.pushLine(`[error] ${e.message}`, C.error))
     return
   }
-  // Parse "provider:model" syntax
-  const colonIdx = raw.indexOf(":")
-  const providerName = colonIdx >= 0 ? raw.slice(0, colonIdx) : raw
-  const modelName = colonIdx >= 0 ? raw.slice(colonIdx + 1) : null
-
-  const target = ctx.agent.providers.find((p) => p.name.toLowerCase() === providerName)
-  if (!target) {
-    const available = ctx.agent.providers.map((p) => p.name).join(", ")
-    ctx.pushLine(`Unknown provider: ${providerName} (available: ${available})`, C.error)
+  // 首冒号复合解析（parseModelRef——裸 provider / 未知 provider / 空模型段 → ok:false；
+  // 候选外/多冒号一律放行——M4）
+  const parsed = parseModelRef(raw, ctx.agent.providers)
+  if (!parsed.ok) {
+    ctx.pushLine(`[error] ${parsed.reason}`, C.error)
+    ctx.pushLine(`/model 用法: /model provider:model（会话级——config 默认走 /config → 默认模型）`, C.dim)
     return
   }
-  await ctx.selectModel({ provider: target.name, model: modelName || target.model }).catch((e) => ctx.pushLine(`[error] ${e.message}`, C.error))
+  await ctx.selectModel({ provider: parsed.provider.name, model: parsed.model }).catch((e) => ctx.pushLine(`[error] ${e.message}`, C.error))
 }

package/src/tui/cmd-new.mjs

@@ -9,8 +9,9 @@ export async function handleNewCommand(ctx) {
   const doNewSession = () => {
     const slot = newSession(agent.cwd)
     // 2026-08-31 会诊 F3：resetSessionState 清全量会话态（_fullHistory/title/_sessionStart/
-    // _engDesignToken/压缩与验证计数等）——原实现只清 agent.history，新会话首次落盘把旧
-    // 会话完整人类线 + 旧标题写进新 slot（实锤 .19/.3 双副本）。_slot 更新为粘性新槽位。
+    // 多槽设计凭证（_engDesignTokens——单值镜像 _engDesignToken 已退役 D3）/压缩与验证计数
+    // 等）——原实现只清 agent.history，新会话首次落盘把旧会话完整人类线 + 旧标题写进新
+    // slot（实锤 .19/.3 双副本）。_slot 更新为粘性新槽位。
     resetSessionState(agent)
     agent._slot = slot
     state.tasks = []

package/src/tui/cmd-reindex.mjs

@@ -40,5 +40,12 @@ export async function handleReindexCommand(ctx) {
   ])
   pushLine(`  code: ${cr.total} files, +${cr.updated} ~${cr.skipped} -${cr.removed}`, C.dim)
   pushLine(`  doc: ${dr.total} files, +${dr.updated} ~${dr.skipped} -${dr.removed}`, C.dim)
+  // Unlisted extensions (PORTABILITY PO-9): files the index skipped because no
+  // index claims their extension — visible here + declarable in the project.
+  const unlisted = cr?.unlistedExts?.count ? cr.unlistedExts : dr?.unlistedExts
+  if (unlisted?.count > 0) {
+    const sample = unlisted.exts.map((e) => e.ext).join(" ")
+    pushLine(`  ${unlisted.count} file(s) with unlisted extension(s) skipped (${sample}) — declare them in .thincoder/conventions.json (index.codeExtensions / index.docExtensions) to index them`, C.warn)
+  }
   pushLine(`[reindex] Done, ${total} entries total. Vectors will be lazily generated on next search.`, C.tool)
 }

package/src/tui/cmd-session.mjs

@@ -1,4 +1,4 @@
-import { listSlots, switchToSlot, applySession, renameSlot, activeSlot, slotOccupancy } from "../session.mjs"
+import { listSlots, switchToSlot, applySession, renameSlot, activeSlot, slotOccupancy, readEndMarker } from "../session.mjs"
 import { ansi, C } from "./ansi.mjs"
 import { restoreLines } from "./startup.mjs"
 import { stringWidth, sliceByWidth } from "./render.mjs"
@@ -19,8 +19,16 @@ export async function handleRenameCommand(ctx, args) {
     pushLine(`Title too long (max 80 chars)`, C.error)
     return
   }
-  if (!renameSlot(agent.cwd, slot, title)) {
-    pushLine(`Rename failed — active session (slot ${slot}) not found`, C.error)
+  // §12.2.5：renameSlot 契约 { ok, reason }——失败原因对用户可见（F3）
+  const r = renameSlot(agent.cwd, slot, title)
+  if (!r.ok) {
+    const why = {
+      "file-missing": `active session (slot ${slot}) not found`,
+      "parse-failure": `session file (slot ${slot}) is corrupted`,
+      "mtime-conflict": "session changed on disk concurrently — retry",
+      "invalid-slot": `invalid slot ${slot}`,
+    }[r.reason] ?? r.reason
+    pushLine(`Rename failed — ${why}`, C.error)
     return
   }
   agent.title = title
@@ -37,6 +45,13 @@ export async function handleSessionCommand(ctx) {
     pushLine("No sessions (use /new to start a new session)", C.dim)
     return
   }
+  // 2026-09-05 §10 D-5：本端高亮按端记录（● = 记录槽 ∈ 列表 ? 记录槽 : manifest active
+  // 回退——含"记录槽已被对端删除"的守卫）；listSlots 的 manifest active 语义不变
+  // （ACP session/list 零变化——manifest active 保留为列表回退高亮）
+  const rec = readEndMarker(agent.cwd)
+  const highlightSlot = (rec?.slot != null && slots.some((s) => s.slot === rec.slot))
+    ? rec.slot
+    : (slots.find((s) => s.isActive)?.slot ?? null)
   const shortDate = (d) => {
     const dt = new Date(d)
     return `${dt.getMonth() + 1}/${dt.getDate()} ${String(dt.getHours()).padStart(2, "0")}:${String(dt.getMinutes()).padStart(2, "0")}`
@@ -53,7 +68,7 @@ export async function handleSessionCommand(ctx) {
       const turns = s.turnCount > 0 ? `${s.turnCount} turns` : "0 turns"
       const when = shortDate(s.updatedAt)
       const model = s.activeProvider ? ` — ${s.activeProvider}` : ""
-      const marker = s.isActive ? " ●" : ""
+      const marker = s.slot === highlightSlot ? " ●" : ""
       return {
         type: "item",
         text: `Slot ${s.slot} │ ${turns} │ ${when} │ ${label}${model}${marker}`,

package/src/tui/cmd-submodel.mjs

@@ -1,7 +1,7 @@
 import { ansi, C } from "./ansi.mjs"
 
 /** Subagent role slots — each has an independent model override slot */
-export const SUBMODEL_SLOTS = ["explore", "plan", "coder", "eng-coder"]
+export const SUBMODEL_SLOTS = ["explore", "plan", "coder", "eng-coder", "eng-designer"]
 
 /** Human-readable effective display with inheritance source. role=null → global slot.
  *  source semantics: "type" = role-specific override (subagentModels[role]),
@@ -21,12 +21,14 @@ function slotDisplay(agent, role) {
 
 /** /submodel command: subagent model config — picker menu (default) or direct args.
  *  ctx: { agent, pushLine, showPicker, askQuestion, persistRaw, pickModelForSlot }
- *  /submodel                        → picker: global + 4 role slots
+ *  /submodel                        → picker: global + 5 role slots
  *  /submodel <value>                → set global default
  *  /submodel <type> <value>         → set a role slot
  *  /submodel <type>                 → show a slot
  *  /submodel reset [type]           → clear global (or a slot)
- *  value forms: provider:model | provider name | model name (same as subagent tool model arg) */
+ *  value forms: provider:model | provider name | model name (same as subagent tool model arg) —
+ *  MODEL-MERGE-SESSION：会话模型 = provider:model 复合（agent.activeProvider/activeModel 双字段
+ *  恒非空——无渠道默认字段——父会话模型引用一律复合值）。 */
 export async function handleSubmodelCommand(ctx, args = []) {
   const { agent, pushLine, showPicker, askQuestion, persistRaw, pickModelForSlot } = ctx
   const input = args.join(" ").trim()
@@ -85,7 +87,7 @@ export async function handleSubmodelCommand(ctx, args = []) {
     return
   }
 
-  // ── Picker menu: global + 4 role slots ──
+  // ── Picker menu: global + 5 role slots ──
   // for(;;) loop relies on showPicker's async/Promise suspension — every iteration
   // awaits a user choice; Esc (null) exits. Mirrors openModelPicker's menu-loop pattern.
   for (;;) {
@@ -132,7 +134,8 @@ export async function handleSubmodelCommand(ctx, args = []) {
         pushLine(`Subagent global model set to \`${value}\`.`, C.text)
       }
     } else if (sub.action === "parent") {
-      const value = `${agent.activeProvider}:${agent.activeModel ?? agent.provider?.model}`
+      // 会话复合值语义（MODEL-MERGE-SESSION——activeModel 恒非空——不再回退渠道字段）
+      const value = `${agent.activeProvider}:${agent.activeModel ?? ""}`
       if (role) {
         await persist((a) => { a.subagentModels ??= {}; a.subagentModels[role] = value })
       } else {

package/src/tui/cmd-think.mjs

@@ -97,16 +97,16 @@ async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCus
       // 开 auto = 要思考：清显式 off 标记（thinking:null，NF1 约定；交付评审 #1）——残留 null
       // 会让 auto 每轮写入的 reasoning_effort 与 enable_thinking:false 矛盾同发（F2 违约）。
       // 仅清 null：thinking-type 模型的 {type:"disabled"} 不在评审 #1 范围，保持既有语义。
-      if (cur.thinking === null) { delete cur.thinking; await syncProviderField("thinking", undefined) }
+      if (cur.thinking === null) { delete cur.thinking; await syncProviderField(agent.activeProvider, "thinking", undefined) }
       delete cur.reasoningEffort
-      await syncProviderField("reasoningEffort", undefined)
+      await syncProviderField(agent.activeProvider, "reasoningEffort", undefined)
     }
   } else if (e.action === "effort") {
     // 选档位 = 要思考：清显式 off 标记（thinking:null，NF1 约定；交付评审 #1）——残留 null 会让
     // enable_thinking:false 与 reasoning_effort 矛盾同发（F2 违约）。仅清 null（同上注释）。
-    if (cur.thinking === null) { delete cur.thinking; await syncProviderField("thinking", undefined) }
+    if (cur.thinking === null) { delete cur.thinking; await syncProviderField(agent.activeProvider, "thinking", undefined) }
     cur.reasoningEffort = e.level
-    await syncProviderField("reasoningEffort", e.level)
+    await syncProviderField(agent.activeProvider, "reasoningEffort", e.level)
   } else {
     const enable = e.action === "on"
     if (isEffortOnly) {
@@ -116,9 +116,9 @@ async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCus
       // "on" 默认 effort 取 spec 枚举首值（交付评审 #2）：硬编码 "high" 对 qwen3.8-max
       // （enum xhigh/medium/low）无效，会被 core.mjs 枚举校验 throw（400 前置）
       else { delete cur.thinking; if (!cur.reasoningEffort) cur.reasoningEffort = spec.reasoningEffortEnum?.[0] ?? "high" }
-      await syncProviderField("thinking", cur.thinking)
-      if (!enable) await syncProviderField("reasoningEffort", undefined)
-      else await syncProviderField("reasoningEffort", cur.reasoningEffort)
+      await syncProviderField(agent.activeProvider, "thinking", cur.thinking)
+      if (!enable) await syncProviderField(agent.activeProvider, "reasoningEffort", undefined)
+      else await syncProviderField(agent.activeProvider, "reasoningEffort", cur.reasoningEffort)
     } else {
       if (enable) {
         cur.thinking = { type: thinkOnValue }
@@ -127,11 +127,11 @@ async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCus
         cur.thinking = isCustomThink ? undefined : { type: "disabled" }
         delete cur.reasoningEffort
       }
-      await syncProviderField("thinking", cur.thinking)
+      await syncProviderField(agent.activeProvider, "thinking", cur.thinking)
       if (enable) {
-        await syncProviderField("reasoningEffort", cur.reasoningEffort)
+        await syncProviderField(agent.activeProvider, "reasoningEffort", cur.reasoningEffort)
       } else {
-        await syncProviderField("reasoningEffort", undefined)
+        await syncProviderField(agent.activeProvider, "reasoningEffort", undefined)
       }
     }
   }

package/src/tui/cmd-undo.mjs

@@ -6,7 +6,7 @@
  */
 
 import { existsSync, writeFileSync, unlinkSync, readFileSync } from "node:fs"
-import { join } from "node:path"
+import { isAbsolute, join } from "node:path"
 import { ansi, C } from "./ansi.mjs"
 
 const MAX_UNDO = 50
@@ -20,7 +20,8 @@ export function snapshotForUndo(agent, toolName, args, cwd) {
   const path = args.path ?? args.file
   if (!path || typeof path !== "string") return
 
-  const abs = join(cwd, ...path.split("/"))
+  // 绝对路径直接用（path.join 对绝对段不重置——Windows 反斜杠路径也不按 "/" 切分）；相对路径整段 join(cwd)。
+  const abs = isAbsolute(path) ? path : join(cwd, path)
   let backup = null
   try {
     if (existsSync(abs)) {
@@ -68,7 +69,7 @@ export async function handleUndoCommand(ctx) {
   const e = await showPicker("Undo", entries)
   if (!e) return
   const item = stack[e.idx]
-  const abs = join(agent.cwd, ...item.path.split("/"))
+  const abs = isAbsolute(item.path) ? item.path : join(agent.cwd, item.path)
 
   try {
     if (item.backup === null) {

package/src/tui/cmd-upgrade.mjs

@@ -1,9 +1,10 @@
 import { ansi, C } from "./ansi.mjs"
+import { upgradeFailureText } from "./update-notice.mjs"
 
 /** /upgrade command: check for updates and optionally upgrade.
  *  ctx: { agent, pushLine, pushLabel, showPicker } */
 export async function handleUpgradeCommand(ctx) {
-  const { pushLine, pushLabel, showPicker } = ctx
+  const { pushLine, pushLabel, showPicker, render } = ctx
   const { checkForUpdate } = await import("../upgrade.mjs")
   const { readFileSync } = await import("node:fs")
 
@@ -31,13 +32,27 @@ export async function handleUpgradeCommand(ctx) {
   pushLine(`Upgrading to ${result.latest}...`, C.tool)
   const { exec } = await import("node:child_process")
   const cp = exec("npm install -g thincoder@latest", { windowsHide: true })
-  cp.stdout?.on("data", () => {})
-  cp.stderr?.on("data", () => {})
+  let stdout = ""
+  let done = false
+  cp.stdout?.on("data", (d) => { stdout += d })
+  cp.stderr?.on("data", (d) => { stdout += d })
+  // 2026-09-05（advisor 🟡#5/#7）：异步回调必须显式 render（pushLine 只写 lines 不绘制——
+  // handleSlash 返回后的统一 render 先于 exec 完成，结论行要等下次输入才可见）；失败文案
+  // 复用 upgradeFailureText（附 npm 输出尾 ≤3 行——与 update-notice 后台路径同诊断能力）
+  cp.on("error", (e) => {
+    if (done) return
+    done = true
+    pushLine(`✗ Upgrade failed (${e.message}). Run \`thincoder upgrade\` manually.`, C.error)
+    render?.()
+  })
   cp.on("close", (code) => {
+    if (done) return
+    done = true
     if (code === 0) {
       pushLine(`✓ Upgraded to ${result.latest}. Restart to apply.`, C.tool)
     } else {
-      pushLine(`✗ Upgrade failed (exit ${code}). Run \`thincoder upgrade\` manually.`, C.error)
+      pushLine(upgradeFailureText(code, stdout), C.error)
     }
+    render?.()
   })
 }

package/src/tui/config-helpers.mjs

@@ -1,26 +1,38 @@
-import { existsSync, readFileSync } from "node:fs"
-
 /** persistRaw / syncProviderField / maskKey: config read/write helpers.
  *  Extracted from index.mjs for shared use by slash-commands, wizard, and pickers.
- *  createConfigHelpers(agent) returns { persistRaw, syncProviderField, maskKey } */
-export function createConfigHelpers(agent) {
-  /** Read config.json → mutate → persist to disk */
+ *  createConfigHelpers(agent) returns { persistRaw, syncProviderField, maskKey }
+ *  R10 F5（D-F5b）：persistRaw 全链（磁盘新鲜读→mutate→写）收口进 config.mjs
+ *  writeConfigAtomic——mtime 门控 + .bak + 冲突放弃（见 MULTI-INSTANCE-COLLAB.md §2a.2）。
+ *  createConfigHelpers(agent, opts)：opts.configPath 为测试注入缝（默认 configPath——
+ *  生产 index.mjs 单参调用零变化）。 */
+export function createConfigHelpers(agent, opts = {}) {
+  const cfgPath = opts.configPath ?? null // null → 默认 configPath（动态 import 解）
+
+  /** 磁盘新鲜读 → mutate（单操作）→ mtime 门控写；冲突时 throw（提示语见下——TUI
+   *  slash 分发层统一 [error] 行展示；调用方若自带 try/catch 展示 Save failed 同文案）。 */
   async function persistRaw(mutate) {
-    const { saveConfig, configPath } = await import("../config.mjs")
-    const raw = existsSync(configPath) ? JSON.parse(readFileSync(configPath, "utf8")) : {}
-    mutate(raw)
-    saveConfig(raw)
+    const { writeConfigAtomic, configPath } = await import("../config.mjs")
+    const r = writeConfigAtomic(cfgPath ?? configPath, mutate)
+    if (!r.ok) throw new Error("config changed on disk concurrently — retry")
   }
 
-  /** Sync a field of the current provider to the providers array and persist to disk */
-  async function syncProviderField(field, value) {
-    const target = agent.providers.find((p) => p.name === agent.activeProvider)
-    if (!target) return
-    if (value === undefined) delete target[field]
-    else target[field] = value
+  /** Sync a field of a provider (by name) to the providers array and persist to disk.
+   *  D-F5a（#1）：磁盘 fresh raw.providers 上单字段补丁——不取 agent.providers 整数组
+   *  （长跑进程的内存 providers 快照不得整体写回——会抹掉对端对磁盘其他改动的保留）。
+   *  内存 agent.providers 目标项同步镜像（旧行为：改内存 + 整节写盘——镜像保留内存
+   *  一致性，磁盘写只剩单字段）。value === undefined → 删除该字段。 */
+  async function syncProviderField(name, field, value) {
+    const mem = agent.providers?.find((p) => p?.name === name)
+    if (!mem) return // 内存无此 provider（旧语义 early return——不产生空写）
     await persistRaw((raw) => {
-      raw.providers = agent.providers
+      raw.providers ??= []
+      const target = raw.providers.find((p) => p?.name === name)
+      if (!target) return // 磁盘目标已被对端删除 → 只做内存镜像，不落盘
+      if (value === undefined) delete target[field]
+      else target[field] = value
     })
+    if (value === undefined) delete mem[field]
+    else mem[field] = value
   }
 
   /** Mask API key for display */

package/src/tui/distill-cmd.mjs

@@ -22,7 +22,7 @@ export async function runDistill(ctx) {
     }
     let saved = 0
     for (const c of candidates) {
-      pushLine(`── Candidate [${c.type}] ${c.title} (scope: ${c.scope ?? "personal"})`, C.warn)
+      pushLine(`── Candidate [${c.type}] ${c.title} (layer: ${c.layer ?? "personal"})`, C.warn)
       for (const line of c.content.split("\n").slice(0, 6)) pushLine(`   ${line}`, C.dim)
       if (c.type === "rule") pushLine("   (rule type — consider writing manually; press y to extract)", C.warn)
       const accept = await askPermission("distill-save", { title: c.title })