thincoder 0.12.59 → 0.12.61

package/src/tui/tool-events.mjs

@@ -4,163 +4,39 @@
  *
  *  - onToken/onReasoning  : 子agent 前缀分流（routeSub*）→ 主流 streaming/reasoning
  *  - onToolCall           : 状态栏 + `❯ name args` 标题行 + 计时 + §19 action 记录
- *  - onToolResult         : 子agent 完成冻结（finishSubTask + freezeDoneSubTasks）、
+ *  - onToolResult         : 子agent 完成冻结（finishSubTaskKey 精确冻 + freezeDoneSubTasks——
+ *                           F-2 后 finishSubTask 为 no-op 兼容保留）、
  *                           工具块结果入块、advisor 评审冻结框
  *  - onToolOutput         : advisor 有序块缓冲 / 工具块输出流
  *  - 其余                 : usage 累计、等待提示、task 面板、回合末增量落盘
  *
  * flushStream 同时返回给调用方（回合循环 / onTurnEnd 共用）。纯回调装配，无终端副作用
- * （除经 deps 注入的 pushLine/render）。§19: subagent_check/escalate 工具退役后，
- * subagent 家族全部调用以工具名 "subagent" + action 到达——完成路由按 onToolCall 时
- * 记录的 action 分流（spawn 区块 / escalate 区块 / check·status 普通工具块）。
+ * （除经 deps 注入的 pushLine/render）。§19: subagent_check/escalate 工具退役后
+ * （§19.8——check 动作已删），subagent 家族全部调用以工具名 "subagent" +
+ * action 到达——完成路由按 onToolCall 时记录的 action 分流（spawn 区块 / escalate
+ * 区块 / status/observe/send 普通工具块——observe/send 不建子代理区块）。
  */
 import { C } from "./ansi.mjs"
 import { formatToolSummary } from "./tool-summaries.mjs"
 import { describeToolArgs, toolArgsLines } from "./tool-args.mjs"
 import { ADVISOR_THINKING_PLACEHOLDER, resolveAdvisorProvider } from "../advisor/run.mjs"
 import {
-  SUB_PREFIX_RE, SUBAGENT_ROLES, routeSubToken, routeSubReasoning, routeSubToolCall,
-  routeSubToolOutput, finishSubTask, finishSubTaskKey, finishSubTasksByRole, finishSubTaskByModel, freezeDoneSubTasks,
+  SUBAGENT_ROLES, routeSubToken, routeSubReasoning, routeSubToolCall,
+  routeSubToolOutput, finishSubTask, finishSubTaskKey, finishSubTasksByRole, freezeDoneSubTasks,
   ensureCompressPanel, markCompressFailed, markCompressDone, markCompressFallback,
 } from "./subagent-blocks.mjs"
-import { TURN_CAP_MARK } from "../agent/spawn-child.mjs"
-
-/** Tool execution start timestamps (performance.now ms). Keyed by tool_call id
- *  when available (parallel same-name tools each get their own tick — the
- *  P0-3 fix, 2026-08-30), falling back to a per-name FIFO queue for callers
- *  without ids (subagent relay). FIFO shift assumes near-call-order completion;
- *  a parallel same-name batch finishing out of order swaps durations between
- *  siblings — same magnitude, both keep an elapsed (display-level, acceptable). */
-
-// Named caps (consult P2, 2026-08-30): inline 200/8/120/3/5 were magic numbers.
-const TOOL_OUTPUT_LINE_CAP = 200          // per-call streaming output ring buffer
-const SUBAGENT_PREVIEW_LINES = 8          // report preview rows in the conversation
-const PREVIEW_LINE_CHARS = 120            // per-line preview slice
-const REMINDER_CAP = 3                    // max pending reminders shown on turn end
-const REMINDER_PERSIST_TURNS = 5          // persist reminders every N turns
-
-const _toolTicks = new Map()
-// §19 action registry: tool_call id → subagent action (non-spawn only — spawn is
-// the default when no record exists). onToolCall sees the args, onToolResult only
-// the name; without the record every subagent result would route as a spawn.
-const _subActions = new Map()
-const _subActionQ = [] // FIFO for subagent calls without a tool id (same fallback as tick queue)
-
-function tickStart(name, toolId) {
-  const key = toolId ?? name
-  if (toolId) { _toolTicks.set(key, performance.now()); return }
-  const q = _toolTicks.get(key) ?? []
-  q.push(performance.now())
-  _toolTicks.set(key, q)
-}
-
-/** Settle one pending tick: by tool_call id, or per-name FIFO. Returns start or null. */
-function tickTake(name, toolId) {
-  const key = toolId ?? name
-  const v = _toolTicks.get(key)
-  if (v === undefined) return null
-  if (toolId) { _toolTicks.delete(key); return v }
-  if (v.length === 0) { _toolTicks.delete(key); return null }
-  const started = v.shift()
-  if (v.length === 0) _toolTicks.delete(key)
-  return started
-}
-
-/** P0-2 sweep (2026-08-30 consult): an interrupted turn (Ctrl+C / error) leaves
- *  running tool-block carriers without an onToolResult — their header would say
- *  "running" forever. runAgentTurn's finally calls this: mark them done with an
- *  "(interrupted)" status and clear the tick table so no stale start time leaks
- *  into the next turn. Mirrors freezeAllSubTasks for the tool-block family. */
-export function sweepToolBlocks(state) {
-  for (const l of state.lines ?? []) {
-    const b = l._toolBlock
-    if (b && !b.done) {
-      b.done = true
-      b.summary = "(interrupted)"
-      b.interrupted = true
-    }
-  }
-  _toolTicks.clear()
-  _subActions.clear()
-  _subActionQ.length = 0
-}
-
-/** Shared display guard for tool results — LIVE and RESTORE use the same
- *  function (P1, 2026-08-30 consult: restore lacked the live path's guards).
- *  1) Multimodal results (read_image) embed FULL base64 images in the JSON —
- *     the human needs only the text part (model gets images via the multimodal
- *     channel); 2) results beyond maxRows are truncated in the block (full
- *     text always lives in history for the model). Returns row array. */
-export function slimToolResultForDisplay(result, maxRows = 400) {
-  let displayResult = result
-  try {
-    const parsed = JSON.parse(result)
-    if (parsed?.images?.length) displayResult = parsed.text ?? result
-  } catch { /* not JSON — show as-is */ }
-  const rows = String(displayResult).split("\n").filter((l) => l.trim())
-  return rows.length > maxRows
-    ? [...rows.slice(0, maxRows), `… (result truncated at ${maxRows} rows — full text in history)`]
-    : rows
-}
-/** Mark the dispatch-level tool carrier done when its result is consumed by a
- *  dedicated branch (subagent/escalate/advisor blocks) — without this the turn
- *  sweep mislabels successful calls as "(interrupted)" (consult P1, 2026-08-30). */
-function settleToolBlock(state, name, toolId, summary) {
-  const block = findToolBlock(state, name, toolId)
-  if (block) {
-    block.done = true
-    block.summary = summary
-    const started = tickTake(name, toolId)
-    block.elapsed = started !== null ? Math.round(performance.now() - started) : null
-  }
-}
-
-/** Async spawn detection (§15 D-A1): the subagent tool's async:true result is a
- *  status JSON ({id, role, status: running|queued}), NOT a report — the child
- *  keeps running, so its activity block must not be frozen at spawn time (it
- *  freezes via the ⟦ev⟧done event at settle — §15 D-A3). */
-function isAsyncSpawnResult(result) {
-  try {
-    const o = JSON.parse(result)
-    return Boolean(o && typeof o === "object" && typeof o.id !== "undefined" && (o.status === "running" || o.status === "queued"))
-  } catch {
-    return false
-  }
-}
-
-/** §7.2.3 spawn 门拒错误探测（T-F5）：subagent spawn 的机械拒绝以 {status:"error"}
- *  JSON 返回（例：manual auto-turn digest spawn 门——digest 语义 organize-only）——
- *  错误路径不得触发完成冻结（round1 #1——错误路径不冻结任何 running 块）。该形态只
- *  出现在无 subKey 的拒绝路径（成功路径恒带 dispatch 传的 ctx._subagentKey）。 */
-function isSpawnErrorResult(result) {
-  try {
-    const o = JSON.parse(result)
-    return Boolean(o && typeof o === "object" && o.status === "error")
-  } catch {
-    return false
-  }
-}
-
-
-
-/** Find the live tool-block carrier for a tool event: exact id match when the
- *  callback carries one (P0-3 — parallel same-name tools route to their own
- *  block); falls back to the last unfinished block of that name. */
-function findToolBlock(state, name, toolId) {
-  const lines = state.lines ?? []
-  if (toolId !== undefined && toolId !== null) {
-    for (let i = lines.length - 1; i >= 0; i--) {
-      if (lines[i]._toolBlock?.id === toolId) return lines[i]._toolBlock
-    }
-    return null
-  }
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const b = lines[i]._toolBlock
-    if (b && b.name === name && !b.done) return b
-  }
-  return null
-}
-
+// 第 27 批 §12.3②：前缀正则换名 + import 源改文法模块（纯换名——语义零改）。
+import { RELAY_PREFIX_RE } from "../agent/relay-prefix.mjs"
+import { TURN_CAP_MARK, STOPPED_MARK } from "../agent/spawn-child.mjs"
+// 2026-09-05 module-split：ticks/maps/sweep/slim/settle/探测/find 族迁 tool-display.mjs——
+// buildToolCallbacks 内部引用用本地 import；sweepToolBlocks re-export（agent-turn 消费面）
+import {
+  TOOL_OUTPUT_LINE_CAP, REMINDER_CAP, REMINDER_PERSIST_TURNS,
+  _toolTicks, _subActions, _subActionQ,
+  tickStart, tickTake, settleToolBlock, isAsyncSpawnResult, isSpawnErrorResult,
+  findToolBlock, slimToolResultForDisplay, sweepToolBlocks,
+} from "./tool-display.mjs"
+export { sweepToolBlocks, slimToolResultForDisplay } from "./tool-display.mjs"
 
 /** Build the agent callbacks + the shared flushStream for one turn.
  *          askPermission, askQuestion, saveSessionImpl } */
@@ -278,7 +154,7 @@ export function buildToolCallbacks(deps) {
           : _subActionQ.shift() ?? null
         if (toolId !== undefined && toolId !== null) _subActions.delete(toolId)
       }
-      const isSubagent = name === "subagent" && subAction !== "check" && subAction !== "status" && subAction !== "escalate" && subAction !== "cancel" && subAction !== "panel"
+      const isSubagent = name === "subagent" && subAction !== "status" && subAction !== "escalate" && subAction !== "cancel" && subAction !== "panel" && subAction !== "observe" && subAction !== "send"
       const isEscalate = name === "subagent" && subAction === "escalate"
       // Subagent complete: mark the earliest running child as done — the block
       // persists (✓ frozen elapsed header, expandable) as the ONLY carrier of the
@@ -300,9 +176,12 @@ export function buildToolCallbacks(deps) {
           //    启发式（async eng-coder 先启动时 explore 完成会误冻其块——7.2.3.1/T-F2）；
           // ② spawn 门拒错误（{status:"error"} JSON——auto-turn digest spawn 拒绝）：
           //    不冻结任何块（round1 #1——错误路径不冻结 running 块——T-F5）；
-          // ③ subKey undefined 非错误（老回调/测试直调——成功路径未知工具）→ 启发式
-          //    兜底（既有行为不变——面板单块时与精确冻同效——T-F1）。
-          const lastError = result.includes(TURN_CAP_MARK) ? "turn cap reached — work may be partial" : null
+          // ③ subKey undefined 非错误（老回调/测试直调——成功路径未知工具）→ 不冻结
+          //    任何块（CLI-ACTIVITY-DEBLOAT F-2 收窄：finishSubTask 恒 no-op——无 key
+          //    无从精确归属，宁可 no-op 不误冻；块由回合尾 freezeAllSubTasks 兜底清场）。
+          // SYNC-CANCEL（R6）：⏹ 折叠报告带 STOPPED_MARK——块冻结标 stopped 而非 done
+          // （lastError 注记 + 事件定格——兜底竞态窗口的 dispatch 精确冻路径）
+          const lastError = result.includes(TURN_CAP_MARK) ? "turn cap reached — work may be partial" : result.includes(STOPPED_MARK) ? "stopped by user — work may be partial" : null
           const hasSubKey = subKey !== undefined && subKey !== null && subKey !== ""
           if (hasSubKey) {
             finishSubTaskKey(state, String(subKey), lastError)
@@ -311,48 +190,40 @@ export function buildToolCallbacks(deps) {
             finishSubTask(state, SUBAGENT_ROLES, lastError)
             freezeDoneSubTasks(state)
           }
-          // Subagent report preview (max 8 lines) displayed directly in conversation
-          const lines = result.split("\n")
-          const preview = lines.slice(0, SUBAGENT_PREVIEW_LINES).map((l) => l.slice(0, PREVIEW_LINE_CHARS)).join("\n")
-          if (preview) pushLine(preview, C.dim)
-          if (lines.length > SUBAGENT_PREVIEW_LINES) pushLine(`  ... (${lines.length - SUBAGENT_PREVIEW_LINES} more lines)`, C.dim)
+          // CLI-ACTIVITY-DEBLOAT F-1 (2026-09-10): the conversation-stream report
+          // preview (max 8 dim lines) is deleted — the frozen block is the ONLY
+          // carrier of the child's report (full text also lives in history for the
+          // model; escalate#N keeps its no-preview surface unchanged).
         }
       } else if (isEscalate) {
         // 飞刀 post-op report landed under the subagent tool name — freeze the
         // escalate#N activity block (no preview; legacy surface).
         settleToolBlock(state, name, toolId, "completed")
-        // §7.2.3（round1 #2）：escalate 成功返回带 subKey（escalate#N）→ 精确冻；
-        // 失败/老回调无 subKey → escalate 角色启发式兜底（escalate 串行 + 角色限定——
-        // 既有行为）。
-        const lastError = result.includes(TURN_CAP_MARK) ? "turn cap reached — work may be partial" : null
-        if (subKey !== undefined && subKey !== null && subKey !== "") {
-          finishSubTaskKey(state, String(subKey), lastError)
-        } else {
-          finishSubTask(state, ["escalate"], lastError)
-        }
-        freezeDoneSubTasks(state)
-      } else if (name === "consult_check" || name === "consult_stop") {
-        // Consult session-level settle (2026-08-30 consult review): a session spawns
-        // N parallel children, so completion must settle ALL of them (single-shot
-        // finishSubTask froze only the earliest — N-1 stayed "running" then got
-        // mislabeled "interrupted").
-        //   - individual reply (done:false): settle precisely by r.model.
-        //   - done:true / stopped: settle every remaining consult block.
-        try {
-          const r = JSON.parse(result)
-          if (r?.done || r?.stopped !== undefined) {
-            finishSubTasksByRole(state, ["consult"], null)
-            freezeDoneSubTasks(state)
-          } else if (r?.model) {
-            finishSubTaskByModel(state, "consult", r.model)
-            freezeDoneSubTasks(state)
-          }
-        } catch {
-          if (name === "consult_stop") {
-            finishSubTasksByRole(state, ["consult"], null)
-            freezeDoneSubTasks(state)
+        // §25 D-R17b (R17): async escalate ack ({id, role:"escalate", status:
+        // running|queued}) — the child KEEPS running — skip the freeze like the
+        // async spawn path (the block freezes on the ⟦ev⟧done/stopped settle
+        // event at flight end). Sync results (async:false) freeze below.
+        if (!isAsyncSpawnResult(result)) {
+          // §7.2.3（round1 #2）：escalate 成功返回带 subKey（escalate#N）→ 精确冻；
+          // 失败/老回调无 subKey → 不冻结任何块（F-2 收窄——finishSubTask 恒 no-op，
+          // 块由回合尾 freezeAllSubTasks 兜底清场）。
+          // SYNC-CANCEL（R6）：同上——escalate 路径同款扩展（sync escalate 无 registry——
+          // 恒不折叠——扩展仅口径一致——零行为变化）
+          const lastError = result.includes(TURN_CAP_MARK) ? "turn cap reached — work may be partial" : result.includes(STOPPED_MARK) ? "stopped by user — work may be partial" : null
+          if (subKey !== undefined && subKey !== null && subKey !== "") {
+            finishSubTaskKey(state, String(subKey), lastError)
+          } else {
+            finishSubTask(state, ["escalate"], lastError)
           }
-        } /* non-JSON result — leave blocks as-is */
+          freezeDoneSubTasks(state)
+        }
+      } else if (name === "consult_stop") {
+        // R17（§25 D-R17a——check 已删）：consult_stop = 取消指定会诊会话。被 abort 的
+        // children 各自 settle（settleChild）时发 ⟦ev⟧done 冻结自己的卡——此处**不做按
+        // 角色整组清扫**（会诊会话可并发——按角色会误冻其他仍在运行的会话的卡，冻结即
+        // 截断其活动流——tool-events advisor 复评 🟡1 修正）；取消的即时可见性由 abort
+        // settle 事件承担（abort 解绕通常在同回合内完成——卡片在其 child settle 即冻结）。
+        // 仅结果本身落本工具调用自己的载体块（下方通用分支）。
       }
       if (!isSubagent && !isEscalate && name !== "advisor") {
         // Result lands INSIDE the block (restore parity — the restored carrier
@@ -407,7 +278,7 @@ export function buildToolCallbacks(deps) {
       // child-stdout/SSE fragments at arbitrary byte boundaries; trimEnd eats
       // real trailing newlines and routeSubToolOutput's verbatim concat would
       // glue lines (2026-09-03 修复轮; main path keeps the trimmed form below).
-      const isSubRelay = SUB_PREFIX_RE.test(name)
+      const isSubRelay = RELAY_PREFIX_RE.test(name)
       const rawText = typeof chunk === "string" ? chunk : String(chunk?.text ?? "")
       const part = {
         kind: typeof chunk === "string" ? "text" : (chunk?.kind ?? "text"),

package/src/tui/tui-lifecycle.mjs

@@ -3,6 +3,7 @@
  * 超 500 行硬限拆分——启动序列、退出清理序列与退出闭包从 index.mjs 移入本模块）。
  */
 
+import { appendFileSync } from "node:fs"
 import { ansi } from "./ansi.mjs"
 
 /** TUI 启动序列：alt buffer + 隐藏光标 + 鼠标/粘贴/键盘增强 + 禁环绕。
@@ -19,8 +20,42 @@ export function writeCleanupSequence(write = (s) => process.stdout.write(s)) {
   write(ansi.clearScreen + ansi.mouseOff + ansi.bracketedPasteOff + ansi.keyboardPop + ansi.modifyOtherKeysOff + ansi.mainBuffer + ansi.showCursor + ansi.reset + ansi.wrapOn)
 }
 
-/** 退出清理闭包：保存会话（同步）+ 关闭 MCP 子进程 + 恢复终端。幂等（cleanedUp 守卫）。 */
-export function createExitCleanup({ agent, saveSession, closeAllMcp }) {
+// R25（ARCHITECTURE.md §R25 F-R25a——复审 #1）：TUI 活动态标志——index.mjs 在终端接管
+// 处（writeStartupSequence 之后）经 setTuiActive(true) 置位，createExitCleanup 清理后清
+// false；bin/thincoder.mjs 崩溃钩子经 restoreTerminalAfterCrash 读同一标志——chat 模式
+// stdout 管道不得收 ANSI（误判即污染输出）。默认 false = 未启动（生产零变化——测试缝同源：
+// T-R25a.2 注入 mock 走同一 setter）。
+let tuiActive = false
+
+/** 置/清 TUI 活动态（TUI 启动接管处与退出清理处调用；测试 env 门注入同走此 setter）。 */
+export function setTuiActive(active) {
+  tuiActive = active === true
+}
+
+/** 读 TUI 活动态（F-2 渲染抑制守卫——render-loop doRender 前查——cleanup 清 false 后不再重绘已恢复的主屏）。 */
+export function isTuiActive() {
+  return tuiActive
+}
+
+/** R25 崩溃恢复：仅 TUI 活动态执行 writeCleanupSequence（复用本模块清理序列——符号锚）。
+ *  测试缝（T-R25a.2——env 门注入）：THINCODER_TEST_CLEANUP_OUT 指向文件时序列写入该文件
+ *  （观察恢复被调 + stdout 管道零 ANSI）——生产不设该 env → 恒 stdout（零变化）。
+ *  @returns {boolean} 是否执行了恢复（false = TUI 未启动——调用方无需处理） */
+export function restoreTerminalAfterCrash() {
+  if (!tuiActive) return false
+  const seamOut = process.env.THINCODER_TEST_CLEANUP_OUT
+  if (seamOut) {
+    writeCleanupSequence((s) => appendFileSync(seamOut, s, "utf8"))
+  } else {
+    writeCleanupSequence()
+  }
+  return true
+}
+
+/** 退出清理闭包：保存会话 + 关闭 MCP + 恢复终端。幂等（cleanedUp 守卫）。stdin/write 注入缝（测试锁序——缺省生产零变化）。
+ *  F-1 唯一权威序（RESIZE-MOUSE-LEAK-FIX）：① mouseOff DECRST → ② settle ~20ms（DECRST 往返——raw 仍开回显仍关）→
+ *  ③ raw off → ④ stdin 排空 → ⑤ 恢复屏幕 → ⑥ 清 TUI 活动态。 */
+export function createExitCleanup({ agent, saveSession, closeAllMcp, stdin = process.stdin, write = (s) => process.stdout.write(s) }) {
   let cleanedUp = false
   return () => {
     if (cleanedUp) return
@@ -39,7 +74,14 @@ export function createExitCleanup({ agent, saveSession, closeAllMcp }) {
     } catch {
       // Can't close? fine, process is exiting anyway
     }
-    process.stdin.setRawMode(false)
-    writeCleanupSequence()
+    // ① mouseOff 单独写（DECRST——不整包 writeCleanupSequence）：先于 raw off 停鼠标——消除「回显开而鼠标未停」暴露窗口
+    write(ansi.mouseOff)
+    // ② settle 20ms：Atomics.wait 同步等（不拆注册点——cleanup 亦挂 process.on("exit") 兜底异常退出——exit 事件仅同步合法）
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20)
+    // ③ raw off（DECRST 已被终端处理——无新上报可回显）→ ④ 排空：摘 data 监听 + pause——不依赖限时读——在途已读字节丢弃不归 shell
+    stdin.setRawMode(false); stdin.removeAllListeners("data"); stdin.pause()
+    // ⑤ writeCleanupSequence 余部（mouseOff 已单写——clearScreen/bracketedPasteOff/…/wrapOn 恢复屏幕）
+    write(ansi.clearScreen + ansi.bracketedPasteOff + ansi.keyboardPop + ansi.modifyOtherKeysOff + ansi.mainBuffer + ansi.showCursor + ansi.reset + ansi.wrapOn)
+    setTuiActive(false) // ⑥ R25：清理完即清活动态（崩溃钩子不再误判——渲染抑制锚）
   }
 }

package/src/tui/update-notice.mjs

@@ -37,9 +37,13 @@ export function createUpdateNotice(ctx) {
     const { exec } = await import("node:child_process")
     const cp = exec("npm install -g thincoder@latest", { windowsHide: true })
     let stdout = ""
+    let done = false
     cp.stdout?.on("data", (d) => { stdout += d })
     cp.stderr?.on("data", (d) => { stdout += d })
+    cp.on("error", (e) => { if (done) return; done = true; pushLine(`✗ Upgrade failed (${e.message}). Run \`thincoder upgrade\` manually.`, C.error); render() })
     cp.on("close", (code) => {
+      if (done) return
+      done = true
       if (code === 0) {
         pushLine(`✓ Upgraded to ${result.latest}. Restart to apply.`, C.tool)
       } else {

package/src/tui/wizard.mjs

@@ -8,6 +8,8 @@
 
 import { PROVIDER_PRESETS as PRESETS } from "../config.mjs"
 import { ansi, C } from "./ansi.mjs"
+import { computeLayout } from "./layout.mjs"
+import { probeChannelModels } from "./model-catalog.mjs"
 
 /**
  * Creates the wizard controller.
@@ -16,16 +18,17 @@ import { ansi, C } from "./ansi.mjs"
 export function createWizard(ctx) {
   const { agent, state, pushLine, pushLabel, render, persistRaw } = ctx
 
-  /** Candidates for the menu step: existing providers (marked "no key" if missing), unadded presets, custom */
+  /** Candidates for the menu step: existing providers (marked "no key" if missing), unadded presets, custom
+   *  MODEL-SELECTION v2：渠道默认模型 = 单值 `model`（preset 自带；候选清单运行期拉取） */
   function wizardProviderItems() {
     const items = []
     for (const p of agent.providers) {
-      items.push({ kind: "existing", name: p.name, baseURL: p.baseURL, model: p.model, label: `${p.name} (added${p.apiKey ? "" : ", no key"})` })
+      items.push({ kind: "existing", name: p.name, baseURL: p.baseURL, model: p.model ?? "", label: `${p.name} (added${p.apiKey ? "" : ", no key"})` })
     }
     for (const [name, p] of Object.entries(PRESETS)) {
       if (!agent.providers.some((x) => x.name === name)) {
         items.push({
-          kind: "preset", name, baseURL: p.baseURL, model: p.model, label: `${name} (${p.desc})`,
+          kind: "preset", name, baseURL: p.baseURL, model: p.model ?? "", label: `${name} (${p.desc})`,
           // 预设自身声明的扩展字段随 preset 直达落盘（code review 🟡——与 pickers preset 路径同构；
           // claude/gemini 缺 format、deepseek/glm 缺 thinking/maxTokens 会静默错配）；不新增提问步。
           format: p.format, thinking: p.thinking, reasoningEffort: p.reasoningEffort,
@@ -100,6 +103,19 @@ export function createWizard(ctx) {
     }
     if (w.error) lines.push({ text: ` ${w.error}`, color: C.error })
     w.lines = lines
+    // A4（第 20 批 §12.5——D-SS6）：provider 步选中行自动滚入可视窗——renderWizard 是索引变化的单一路径（产出即一致）；
+    // winH 走 computeLayout（同 pickers.mjs 口径）+ try/catch 兜底 8（无 dims/测试环境不崩）。
+    if (w.step === "provider") {
+      let winH
+      try {
+        winH = Math.max(1, (computeLayout(state, { cols: (state.dims?.get() ?? {}).cols ?? (process.stdout.columns || 80), rows: (state.dims?.get() ?? {}).rows ?? (process.stdout.rows || 24) }).panels.picker?.h ?? lines.length + 1) - 1)
+      } catch {
+        winH = 8 // safe fallback for mocks without dims（同 pickers.mjs 兜底口径）
+      }
+      if (w.selectedLine < w.scroll) w.scroll = w.selectedLine
+      if (w.selectedLine >= w.scroll + winH) w.scroll = w.selectedLine - winH + 1
+      w.scroll = Math.max(0, Math.min(w.scroll, Math.max(0, lines.length - winH)))
+    }
     render()
   }
 
@@ -109,8 +125,7 @@ export function createWizard(ctx) {
       w.step = "name"
     } else {
       w.fields = { name: item.name, baseURL: item.baseURL, model: item.model }
-      // preset 直达：预设声明的扩展字段（format/thinking/maxTokens/chatPath…）直接带进 fields——
-      // 无 format 提问步（T-C4）但落盘不丢字段（code review 🟡——picker preset 路径同款复制）。
+      // preset 直达：其余扩展字段照旧（渠道默认模型 = 单值 model——随 fields 落盘）
       for (const k of ["format", "thinking", "reasoningEffort", "maxTokens", "chatPath"]) {
         if (item[k]) w.fields[k] = item[k]
       }
@@ -145,46 +160,71 @@ export function createWizard(ctx) {
 
   function cancelWizard() {
     state.wizard = null
-    pushLine("Skipped initial setup. Use /model to add providers and configure API keys anytime.", C.dim)
+    // MODEL-MERGE-SESSION 引导 A（F-6）：有 provider 但 defaultModel 未设时指引 /config 入口
+    const hint = (agent.providers?.length ?? 0) > 0 && !agent.config?.defaultModel
+      ? "Skipped initial setup. 已配置渠道但 config.defaultModel 未设——新会话无起点：/config → 默认模型 设置一次（或 /model 仅改本会话）。"
+      : "Skipped initial setup. Use /model to add providers and configure API keys anytime."
+    pushLine(hint, C.dim)
     render()
   }
 
-  /** Wizard complete: write provider (update if exists), set active, persist, then open model picker */
+  /** Wizard complete: write provider (update if exists) with its single default model (`model`),
+   *  set config.defaultModel（裁定⑦——首配模型即写 defaultModel——新会话起点）, then open the
+   *  session model picker. 加渠道 = 配置写入面——落盘后探一次 `/models`（M9：探不通标「不可用」
+   *  + 明示原因，不阻断保存）。 */
   async function finishWizard() {
     const f = state.wizard.fields
     state.wizard = null
     // D-C2：format 非默认（anthropic/google）时落盘；openai = 默认省略（与 D-C1 picker 路径同构）
+    // MODEL-SELECTION v2：渠道默认模型 = 单值 model
     const providerRec = { name: f.name, baseURL: f.baseURL, model: f.model, apiKey: f.key }
     if (f.format && f.format !== "openai") providerRec.format = f.format
-    // code review 🟡：preset 直达带来的扩展字段一并落盘（truthy 语义与 pickers preset 分支一致——
-    // thinking: null 不落；Custom 路径无这些字段不受影响）
     for (const k of ["thinking", "reasoningEffort", "maxTokens", "chatPath"]) {
       if (f[k]) providerRec[k] = f[k]
     }
+    // D-F5a（wizard finishWizard——清单外同型写回补正）先盘后存：磁盘 fresh raw 单操作
+    // （upsert 目标项 + defaultModel + 清 legacy 字段）——冲突放弃不留下内存 ghost（F5 约定）
+    await persistRaw((raw) => {
+      raw.providers ??= []
+      const existing = raw.providers.find((p) => p?.name === f.name)
+      if (existing) Object.assign(existing, providerRec)
+      else raw.providers.push(providerRec)
+      raw.defaultModel = `${f.name}:${providerRec.model}`
+      delete raw.activeProvider
+      delete raw.activeModel
+      // 渠道老字段（models 候选清单）由 config-migrate 在下次 load 统一清理（迁移唯一权威）
+    })
     const existing = agent.providers.find((p) => p.name === f.name)
     if (existing) Object.assign(existing, providerRec)
     else agent.providers.push(providerRec)
     agent.activeProvider = f.name
-    agent.activeModel = null
+    agent.activeModel = providerRec.model
     agent.provider = { ...agent.providers.find((p) => p.name === f.name) }
+    agent.provider.model = agent.activeModel
     if (agent.config?.agent?.compactThresholdAuto) {
       const { resolveCompactThreshold } = await import("../config.mjs")
-      agent.config.agent.compactThreshold = resolveCompactThreshold(null, f.model).value
+      agent.config.agent.compactThreshold = resolveCompactThreshold(null, agent.provider).value
     }
-    await persistRaw((raw) => {
-      raw.providers = agent.providers
-      raw.activeProvider = f.name
-      raw.activeModel = undefined  // reset to default model
-    })
-    agent.config.activeProvider = f.name
-    agent.config.activeModel = null
+    // agent.config 是 loadConfig merged——无 active* 键可写——defaultModel 随内存 merged 更新
+    agent.config.defaultModel = `${f.name}:${agent.activeModel}`
     pushLabel(`❯ Setup`, ansi.bold + C.tool)
-    pushLine(`Setup complete: ${f.name} / ${f.model} (saved to config)`, C.tool)
+    pushLine(`Setup complete: ${f.name} / ${agent.activeModel} (defaultModel 已设——新会话起点)`, C.tool)
+    // M9 配置阶段准入：加渠道属配置写入面——保存已落，探一次 `/models`（探不通标「不可用」+ 明示原因；不阻断）
+    const channel = agent.providers.find((p) => p.name === f.name) ?? providerRec
+    const probe = await probeChannelModels(channel)
+    if (probe.ok) {
+      delete channel._unavailable
+      pushLine(`${f.name}: /models 可用（${probe.list.length} 个模型可候选）`, C.tool)
+    } else {
+      channel._unavailable = true
+      pushLine(`${f.name} 不可用 — ${probe.message}`, C.error)
+    }
     // embedding key: if provided, enable vector search; if not, show how to enable later
     if (f.embedkey) {
+      // D-F5b 语义先盘后存（embedding 单键补丁——冲突放弃不留 ghost）
+      await persistRaw((raw) => { raw.embedding = { ...(raw.embedding ?? {}), apiKey: f.embedkey } })
       agent.config.embedding ??= {}
       agent.config.embedding.apiKey = f.embedkey
-      await persistRaw((raw) => { raw.embedding = { ...(raw.embedding ?? {}), apiKey: f.embedkey } })
       if (agent.memory && !agent.memory.embedder) {
         const { createEmbedder } = await import("../embedding.mjs")
         agent.memory.embedder = createEmbedder(agent.config.embedding)
@@ -193,7 +233,7 @@ export function createWizard(ctx) {
     } else {
       pushLine(`Vector search disabled (memory falls back to text-only search). Run /config embedkey <key> to enable.`, C.dim)
     }
-    pushLine(`Select model (Esc to keep ${f.model})`, C.dim)
+    pushLine(`Select model (Esc to keep ${agent.activeModel})`, C.dim)
     ctx.openModelPicker().catch((e) => pushLine(`[error] ${e.message}`, C.error))
   }
 

package/src/tui/wrapped-spawn.mjs

@@ -0,0 +1,38 @@
+/** wrapped-spawn.mjs — TUI-STDERR-CAPTURE F-1/F-3：包装父
+ * spawn 子（自身 bin）tee stderr → 终端 + crash-reports/tui-stderr-<ts>-<pid>.log（外部终止/
+ * native abort——fd 2 进程内不可改——诊断唯一默认捕获路）。子死 → 日志收尾 → 同码退（null 映射
+ * code??(signal?1:0)——评审 #1）；spawn error → 注日志 + exit 1（评审 #5——不挂死）。 */
+import { appendFileSync, mkdirSync, writeFileSync } from "node:fs"
+import { spawn } from "node:child_process"
+import { fileURLToPath } from "node:url"
+import { crashReportsDir } from "../crash-reports.mjs"
+
+// F-3 信号语义（raw mode 既有 key-handler 双按语义——Ctrl+C = stdin 字节不产生信号 → 子正常退 → 父收
+// exit 同码退）：父忽略 SIGINT/SIGTERM——tee 不被打断。2026-09-09 实测：Windows process.kill(SIGINT)
+// = 硬杀 ≠ 控制台 Ctrl+C 事件（handler 不触发）——信号面测试走 mock（真控制台端到端留发布前手动 QA）。
+export const ignoreSignal = () => {} // no-op 单一引用——父信号 + stderr-error 监听共用——测试可精确复原
+export function spawnTuiWrapped({ dir = crashReportsDir(), script = fileURLToPath(new URL("../../bin/thincoder.mjs", import.meta.url)), spawnImpl = spawn, exitImpl = (code) => process.exit(code) } = {}) {
+  // ① mkdir 前置（评审 #2——prepareCrashReporting 只在子内跑——首启目录缺失会静默不包装）+ 开日志
+  //（文件头元信息行：时间/pid/argv——F-2——0600 append）——失败 → false：不包装直接跑现逻辑（尽力面）
+  let logPath = null
+  try {
+    mkdirSync(dir, { recursive: true })
+    logPath = `${dir}/tui-stderr-${Date.now()}-${process.pid}.log`
+    writeFileSync(logPath, `# tui-stderr ${new Date().toISOString()} pid=${process.pid} argv=${JSON.stringify(process.argv)}\n`, { flag: "a", mode: 0o600 })
+  } catch { return false }
+  process.on("SIGINT", ignoreSignal); process.on("SIGTERM", ignoreSignal) // 父忽略信号（F-3）——tee 不被打断
+  process.stderr.on("error", ignoreSignal) // 父 stderr 异步 EPIPE（终端/管道已关）→ 不炸父——tee 继续
+  const note = (s) => { try { appendFileSync(logPath, s) } catch { /* 落盘尽力面——不阻断 tee */ } }
+  let exitCode = null, exitSignal = null, settled = false
+  const finish = (code) => { if (!settled) { settled = true; exitImpl(code) } }
+  const child = spawnImpl(process.execPath, [script, ...process.argv.slice(2)], {
+    stdio: ["inherit", "inherit", "pipe"], // 子 stderr pipe → tee；stdin/stdout 继承（TTY 原样）
+    env: { ...process.env, THINCODER_TUI_WRAPPED: "1" }, // env 门——子内判定不包装——纯现逻辑（红线）
+    windowsHide: false,
+  })
+  child.stderr.on("data", (chunk) => { try { process.stderr.write(chunk) } catch { /* 终端已关——日志仍落 */ } note(chunk) }) // ② tee 双写：终端实时 + 日志
+  child.on("exit", (code, signal) => { exitCode = code; exitSignal = signal; setTimeout(() => finish(exitCode ?? (exitSignal ? 1 : 0)), 30_000).unref() }) // ③ exit 记码；兜底 30s 强退
+  child.on("close", () => finish(exitCode ?? (exitSignal ? 1 : 0))) // ④ close = stderr 尾数据全收（AC-2）→ 同码退
+  child.on("error", (err) => { note(`# spawn error: ${err.message}\n`); finish(1) }) // ⑤ spawn 失败不发 exit 只发 error
+  return true
+}

package/src/prompts/coder.md

@@ -1,56 +0,0 @@
-You are a coding subagent. The parent agent dispatched you to handle a self-contained coding task. The parent CANNOT see your context — it only sees your final report.
-
-## Your role (identity — read before you code)
-
-You are an IMPLEMENTER with independent judgment — not a typewriter.
-
-1. **Evidence discipline**: every factual/behavioral assertion you make MUST be
-   verified from the code/docs in front of you (read them, cite file:line) —
-   or explicitly marked `unverified`. NEVER assert "Known behavior…",
-   "I'm confident…", or rely on remembered API semantics when the source is
-   readable — a behavioral question is an EVIDENCE question, not a reasoning
-   question.
-2. **Neutrality**: you implement the design; you are not the designer. If the
-   design conflicts with what you find in the code (an interface change broke a
-   caller, a referenced symbol does not exist), STOP and report the conflict
-   to the parent — do not silently adapt. The parent decides; you surface.
-3. **Boundary**: your task = the parent's task brief (files, acceptance
-   criteria). Do not expand it. Findings that touch things outside the brief
-   (other modules, parent-side docs) go in a trailing "out-of-scope note" in
-   your report — no action without the parent's word.
-
-- before you start coding, locate the owning design doc for this change (docs/design/ — via the doc map); if it exists, note the change in it (变更记录/设计注); if not, create it and register it in the map. Then code. No exemption — even one-line fixes.
-
-Guidelines:
-- Work independently: use doc_search to learn project conventions and design, repo_outline to understand structure, then code_search to find implementations.
-  Don't write code until you know what the project intends.
-- COMPLETE delivery: solve the ENTIRE task the parent gave you — every requirement, every file, every acceptance criterion. Nothing less. Do what was asked, fully. No opportunistic cleanup, no speculative generality, no half-finished refactors. When you finish, include a delivery table (see Discipline rules) — every requirement either Done, Simplified, or Not done. The parent doesn't read your diff; it reads your report.
-- Write code one file at a time, verify each before moving on — don't write multiple files at once without checking each along the way:
-  1. After every write/edit of a file: run a syntax/lint check to catch parse errors immediately
-  2. After a logical group of changes: run the relevant tests to confirm behavior
-  3. Before finishing: run tests relevant to your changes; run the full test suite only if you changed core infrastructure (agent loop, provider protocol, config schema, tool execution, memory schema)
-- Be thorough: include what you did, which files you changed, why, and any caveats
-- If the task is ambiguous, note the ambiguity in your report; do not ask the user
-- It is always OK to say "this is too hard for me." Bad work is worse than no work — you will not be penalized for escalating
-- BEFORE finishing, do a final review of your work:
-  1. Run relevant tests — confirm all pass
-  2. If no existing test covers your change, add at least one test
-  3. Read every file you changed — catch leftover debug code, stale comments, or incomplete edits
-  4. Check that comments and docstrings match what the code actually does
-  5. Verify imports/dependencies are correct — no stale or missing references
-- Your last message IS the report the parent sees — it is the ONLY thing the parent receives. Make it complete and self-contained. A report that fails this checklist is sent back for expansion, costing an extra turn:
-  1. What you changed and why
-  2. The path of every file you touched
-  3. How you verified the change (tests run, commands executed, with results)
-  4. **Delivery transparency table** — mandatory. Format:
-     | # | Status | Requirement |
-     |---|--------|-------------|
-     | 1 | ✅ Done | (fully covered) |
-     | 2 | ⚠️ Simplified | (delivered but simpler — explain the gap) |
-     | 3 | ❌ Not done | (NOT implemented — including anything you wanted to defer) |
-     Every requirement point from the parent's task must appear in exactly one row. There is no "deferred" or "later" column — pushing to later means "not done now," so it goes under ❌.
-  5. consistency self-check: does the delivery match the task instruction and the board design doc (if any)? Report deviations explicitly. Fix implementation deviations (partial implementation / silent simplification) so the delivery matches the doc before reporting; report genuine doc drift or out-of-scope changes.
-
-IMPORTANT — Tool permissions: when you see "permission denied by user" for a tool, it means the parent has not granted that tool.
-This is expected: your job is to write a detailed report of what SHOULD be done, not to force tool execution.
-Describe the needed changes clearly in your report so the parent agent can apply them.