thincoder 0.12.61 → 0.12.63

package/src/cli/memory-command.mjs

@@ -1,8 +1,8 @@
 import { isAbsolute, join } from "node:path"
-import { loadConfig } from "../config.mjs"
+import { loadConfig } from "@thincoder/core/config.mjs"
 import { teamConfig } from "./make-agent.mjs"
-import { put, search, list } from "../memory/core.mjs"
-import { deleteByUid } from "../memory/delete.mjs"
+import { put, search, list } from "@thincoder/core/memory/core.mjs"
+import { deleteByUid } from "@thincoder/core/memory/delete.mjs"
 
 /** thincoder memory <list|search|put|remove> subcommands.
  *  opts.dirs: { project, team } layer directories for project/team file deletion (tests inject their own);

package/src/cli/permission.mjs

@@ -1,48 +1,4 @@
-import { createInterface } from "node:readline"
-
-/** CLI tool arg summary (truncated long JSON) */
-export function summarize(toolArgs) {
-  const s = JSON.stringify(toolArgs)
-  return s.length > 120 ? s.slice(0, 120) + "..." : s
-}
-
-/** Permission request key info (per-tool customized), aligned with TUI formatPermission. name may include sub-agent prefix ("coder/bash") — extract basename for matching */
-export function formatPermission(name, args) {
-  const cap = (s, n = 1000) => (s.length > n ? `${s.slice(0, n)}…(共 ${s.length} 字符)` : s)
-  const base = name.includes("/") ? name.split("/").pop() : name
-  if (base === "bash") return cap(args.command ?? "")
-  if (base === "write") return `${args.path}（写入 ${(args.content ?? "").length} 字符）\n${cap(args.content ?? "", 1000)}`
-  if (base === "edit") {
-    const oldLines = cap(args.old_string ?? "", 500).split("\n").map((l) => `- ${l}`).join("\n")
-    const newLines = cap(args.new_string ?? "", 500).split("\n").map((l) => `+ ${l}`).join("\n")
-    return `${args.path}\n${oldLines}\n  ↓\n${newLines}`
-  }
-  if (base === "delete") return `${args.path}${args.force ? "（force：跟踪文件也删）" : ""}`
-  if (base === "subagent") return cap(args.task ?? "", 500)
-  if (base === "memory") {
-    // §6 action-routed preview: put shows content, batch delete/clear show the gate args
-    const action = String(args.action ?? "")
-    if (action === "put") return `[${args.type ?? ""}] ${args.title ?? ""}\n${cap(args.content ?? "", 500)}`
-    if (action === "delete") return args.id ? `id=${args.id}${args.layer ? ` layer=${args.layer}` : ""}` : `batch delete layer=${args.layer ?? ""} type=${args.type ?? ""} keyword=${args.keyword ?? ""} confirm=${args.confirm}`
-    if (action === "clear") return `clear layer=${args.layer ?? ""} confirm=${args.confirm}`
-    return cap(summarize(args), 300)
-  }
-  return cap(summarize(args), 300)
-}
-
-/** Permission confirmation: interactive y/n on TTY; non-interactive defaults to deny (safety-first) */
-export async function askPermission(name, toolArgs) {
-  if (!process.stdin.isTTY) {
-    console.error(`\n[deny] ${name} (non-interactive, side-effect tools require a TTY)`)
-    return false
-  }
-  const rl = createInterface({ input: process.stdin, output: process.stderr })
-  try {
-    const answer = await new Promise((resolve) => {
-      rl.question(`\n[allow?] ${name}\n${formatPermission(name, toolArgs)}\n(y/N) `, resolve)
-    })
-    return answer.trim().toLowerCase() === "y"
-  } finally {
-    rl.close()
-  }
-}
+/** permission.mjs — CLI 转口档（P2 机制层端差批 §2.20）：闸语义 + 每工具请示文案单源 = 核
+ *  `permission.mjs`（#165 落点——本端零第二实现）；展示面由核的 `io.ask` 缝承载。
+ *  导出面与核逐字对齐，保既有 import 面（`bin/thincoder.mjs` · `distill-command.mjs`）。 */
+export { summarize, formatPermission, askPermission } from "@thincoder/core/permission.mjs"

package/src/cli/setup-wizard.mjs

@@ -1,5 +1,5 @@
 import { createInterface } from "node:readline"
-import { configPath, writeConfigAtomic, PROVIDER_PRESETS } from "../config.mjs"
+import { configPath, writeConfigAtomic, PROVIDER_PRESETS } from "@thincoder/core/config.mjs"
 import { probeChannelModels } from "../tui/model-catalog.mjs"
 
 /** First-time setup (TTY chat / distill): ask a few questions to configure a provider, save to disk, return runtime provider. Cancel returns null. */

package/src/completions.mjs

@@ -21,7 +21,7 @@ export function printCompletion(shell) {
     distill) COMPREPLY=( \\$(compgen -W "--yes --layer=" -- "\\$cur") ) ;;
     completion) COMPREPLY=( \\$(compgen -W "bash zsh fish" -- "\\$cur") ) ;;
     *)
-      COMPREPLY=( \\$(compgen -W "chat acp memory sync reindex distill upgrade completion session -v --version -h --help" -- "\\$cur") ) ;;
+      COMPREPLY=( \\$(compgen -W "tui chat acp memory sync reindex distill upgrade completion session -v --version -h --help" -- "\\$cur") ) ;;
   esac
 }
 complete -F _thincoder thincoder
@@ -39,6 +39,7 @@ _thincoder() {
   case "\\$state" in
     cmd)
       _values 'command' \\
+        'tui[Launch the interactive TUI]' \\
         'chat[One-shot agent run with tools]' \\
         'acp[Agent Client Protocol server for IDEs]' \\
         'memory[Manage long-term memory]' \\
@@ -69,6 +70,7 @@ _thincoder
 complete -c thincoder -f
 
 # Subcommands
+complete -c thincoder -a tui      -d 'Launch the interactive TUI'
 complete -c thincoder -a chat     -d 'One-shot agent run with tools'
 complete -c thincoder -a memory   -d 'Manage long-term memory'
 complete -c thincoder -a sync     -d 'Sync team memory repo'

package/src/crash-reports.mjs

@@ -1,12 +1,14 @@
 /**
- * crash-reports.mjs — R25（docs/design/ARCHITECTURE.md §R25——F-R25a/b/c）CLI 异常终止
- * 捕获与留痕机制。
+ * crash-reports.mjs — 崩溃捕获与取证（docs/design/CRASH-REPORTS.md——F1/F2 为 R25 与
+ * TUI-STDERR-CAPTURE 存量迁移；F3 近堆上限堆快照 = TUI-OOM-FORENSICS 批新增）。
  *
- * 三类能力（与设计逐项对应）：
- * - prepareCrashReporting()（F-R25b）：入口最前调用——mkdir 预建 ~/.thincoder/crash-reports/
+ * 能力（与设计逐项对应）：
+ * - prepareCrashReporting()（F-R25b + F3①）：入口最前调用——mkdir 预建 ~/.thincoder/crash-reports/
  *   + process.report 代码内启用（reportOnFatalError + directory）——V8 OOM/原生 fatal
  *   自动写 report.*.json。实现批实测（2026-09-07）：目录缺失时 Node 对 fatal 静默不写
  *   报告——预建是必要动作而非"零成本保险"。
+ *   F3①：同点武装近堆上限堆快照（v8.setHeapSnapshotNearHeapLimit——对象级证据，回答
+ *   "谁在持内存"；全路径单源，默认开、THINCODER_HEAP_SNAPSHOT 可关——F3②）。
  * - writeCrashRecord()（F-R25a）：JS 异常钩子同步落盘 crash-{ts}-{pid}.json（ts = epoch ms
  *   UTC + pid——跨进程同 ms 防覆盖——复审 #3）——权限 0600（config.json 先例）。
  * - recentCrashHint()（F-R25c）：启动扫描 24h 窗内记录（两类文件模式定死——评审 #8：
@@ -23,7 +25,12 @@
  */
 import { chmodSync, existsSync, mkdirSync, readdirSync, statSync, unlinkSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
-import { configDir } from "./config.mjs"
+// F3① 命名空间 import：API 缺失（旧 Node）降级为调用期异常并被武装 try 吞掉——不做 import 期硬失败
+import * as v8 from "node:v8"
+import { configDir } from "@thincoder/core/config.mjs"
+
+/** F3② 关值集合（trim + 大小写不敏感）；其余取值（未设 / 空串 / 未知串）默认开——fail-open 向取证。 */
+const HEAP_SNAPSHOT_OFF_VALUES = new Set(["0", "false", "off", "no"])
 
 /** crash-reports 运行时目录（~/.thincoder/crash-reports——非仓内——写时自清理）。 */
 export function crashReportsDir() {
@@ -32,13 +39,15 @@ export function crashReportsDir() {
 
 /** 记录文件模式（评审 #8 定死）：crash-*.json = 自写（F-R25a）；report.*.json = Node
  *  fatal（默认命名 report.YYYYMMDD.HHMMSS.<pid>.<seq>.json——2026-09-07 实现批实测）。
- *  purge 另含 tui-stderr-*.log（TUI-STDERR-CAPTURE F-2——30 天同族淘汰）——但 recentCrashHint
- *  不计该类：tui-stderr 每次 TUI 启动都生成（正常退出也留档）——计入即正常会话误报"异常终止"。 */
+ *  purge 另含 tui-stderr-*.log（TUI-STDERR-CAPTURE F-2——30 天同族淘汰）与
+ *  Heap.*.heapsnapshot（CRASH-REPORTS F3③——快照 GB 级、TUI 落点须自动兜底）——但
+ *  recentCrashHint 两类均不计（N3）：tui-stderr 每次 TUI 启动都生成（正常退出也留档）、
+ *  快照非「异常终止」证据类——计入即正常会话误报。 */
 function isCrashRecordName(name) {
   return /^crash-.+\.json$/.test(name) || /^report\..+\.json$/.test(name)
 }
 function isPurgeRecordName(name) {
-  return isCrashRecordName(name) || /^tui-stderr-.+\.log$/.test(name)
+  return isCrashRecordName(name) || /^tui-stderr-.+\.log$/.test(name) || /^Heap\..+\.heapsnapshot$/.test(name)
 }
 
 /** >30 天淘汰（评审 #6）——写时自清理；搭车点 = 写 / 入口 mkdir / 启动扫描（复审 #4）。 */
@@ -54,18 +63,31 @@ function purgeOldCrashReports(dir) {
   }
 }
 
+/** F3② 武装判定（单点——包装器不判 env，防两处判定漂移）：关值集合命中 → 不武装；其余 → 武装。 */
+function heapSnapshotEnabled(env) {
+  return !HEAP_SNAPSHOT_OFF_VALUES.has(String(env?.THINCODER_HEAP_SNAPSHOT ?? "").trim().toLowerCase())
+}
+
 /**
  * F-R25b：入口最前调用（一切重活前——缩编程期窗口）——预建目录 + process.report 启用。
  * 任何失败不阻断启动（尽力面——record 路径自带降级）。返回目录路径。
+ * F3①：同点武装近堆上限堆快照（默认开——全路径单源；环境开关见 heapSnapshotEnabled）。
+ * @param {object} [opts] 注入缝（默认参数保 bin 入口调用点零改）
+ * @param {string} [opts.dir] 目录注入（测试用——同时服务 mkdir / report / purge / 返回）
+ * @param {object} [opts.env] env 注入（测试用）——仅服务 F3② 判定
+ * @param {(n: number) => void} [opts.armHeapSnapshot] 武装实现注入（测试用）——默认真实 node:v8 API
  */
-export function prepareCrashReporting() {
-  const dir = crashReportsDir()
+export function prepareCrashReporting({ dir = crashReportsDir(), env = process.env, armHeapSnapshot = v8.setHeapSnapshotNearHeapLimit } = {}) {
   try {
     mkdirSync(dir, { recursive: true })
     // 代码内启用：shebang 入口无法携带启动参数（env 单参数限制 + execArgv 仅子进程——评审 #1）
     process.report.directory = dir
     process.report.reportOnFatalError = true
   } catch { /* mkdir/启用失败不阻断启动——尽力面 */ }
+  // F3① 武装（独立 try——失败不阻断启动、不影响上方 F1 既有步骤；尽力面静默）
+  if (heapSnapshotEnabled(env)) {
+    try { armHeapSnapshot(1) } catch { /* 武装失败不阻断——N1 */ }
+  }
   purgeOldCrashReports(dir) // F-R25b 入口 mkdir 搭车清理（复审 #4——纯 fatal 序列也触发）
   return dir
 }

package/src/distill.mjs

@@ -4,10 +4,10 @@
  * Absolutely no automatic storage at session end.
  */
 
-import { chat } from "./provider/index.mjs"
-import { loadConfig } from "./config.mjs"
-import { put, putMarkdown } from "./memory.mjs"
-import { commitAndPush } from "./git/gitmem.mjs"
+import { chat } from "@thincoder/core/provider/index.mjs"
+import { loadConfig } from "@thincoder/core/config.mjs"
+import { put, putMarkdown } from "@thincoder/core/memory.mjs"
+import { commitAndPush } from "@thincoder/core/git/gitmem.mjs"
 
 const DISTILL_PROMPT = `You are a knowledge extractor. Read the following agent work session log and extract knowledge worth remembering across sessions.
 

package/src/heap-watch.mjs

@@ -0,0 +1,88 @@
+/**
+ * heap-watch.mjs — 堆遥测/看门狗（TUI-OOM-ROOTCAUSE 批——CRASH-REPORTS.md §8）。
+ *
+ * 事故会话堆爬升 ~19 分钟无任何事前信号（「炸了才知道」）；本模块补「事前预警」：
+ * 60s 采样 + 堆上限比例双档（70% / 85%）边缘触发 → stderr 行 + TUI 行（订阅制）+
+ * 事件日志。**只看不治**（不强制 GC、不阻断、不触发快照——D-HW2）。
+ *
+ * 关口（§8.3）：阈值 = `heapUsed / v8.getHeapStatistics().heap_size_limit`（比例——可移植，
+ * 无绝对 MB 常量）；双档边缘触发（每档一次/进程——不重复刷屏）；零常态开销
+ * （60s 一次 memoryUsage()，无输出——D-HW5）。
+ *
+ * 开关单点：`THINCODER_HEAP_WATCH`——关值集合 {`0`,`false`,`off`,`no`}（trim + 大小写
+ * 不敏感）→ 不启动；未设/空串/其他值 → 启动（默认开——与 F3② 同约定）。
+ *
+ * 注入缝（N5 可测）：`sample` / `heapLimit` / `timer`——测试以假实现 + `checkNow()`
+ * 直驱（零等待）；失败面全吞（采样抛错不阻断——样本失败静默跳过本次）。
+ */
+import { getHeapStatistics } from "node:v8"
+import { logEvent } from "@thincoder/core/log.mjs"
+
+/** 关值集合（单点判定——§3.2 同约定复用）。 */
+export const HEAP_WATCH_OFF = new Set(["0", "false", "off", "no"])
+
+/** 开关判定（单点——grep 面：仅本模块读 env.THINCODER_HEAP_WATCH）。 */
+export function heapWatchEnabled(env = process.env) {
+  const v = String(env.THINCODER_HEAP_WATCH ?? "").trim().toLowerCase()
+  return !HEAP_WATCH_OFF.has(v)
+}
+
+// 订阅表（TUI 行接线——§8.3 订阅制；模块级：武装在 bin、订阅在 startTUI）
+const _subscribers = new Set()
+
+/** 订阅预警行（返回退订函数）。 */
+export function onHeapWarn(cb) {
+  if (typeof cb !== "function") return () => {}
+  _subscribers.add(cb)
+  return () => _subscribers.delete(cb)
+}
+
+/** 预警行格式化（逐字——§8.3；U/L 一位小数、P 取整）。 */
+export function heapWarnLine(used, limit, ratio) {
+  const gb = (n) => (n / 1024 / 1024 / 1024).toFixed(1)
+  return `[heap] warning: heapUsed ${gb(used)} GB / ${gb(limit)} GB heap limit (${Math.round(ratio * 100)}%) — long session; consider /new to reset context`
+}
+
+/**
+ * 启动看门狗（返回 `{ stop(), checkNow() }`——checkNow 直驱一次采样并返回本轮新发预警行）。
+ * 关值（§8.3）→ 不注册定时器（返回惰性句柄）。
+ */
+export function startHeapWatch({
+  intervalMs = 60_000,
+  ratios = [0.7, 0.85],
+  sample = process.memoryUsage,
+  heapLimit = () => getHeapStatistics().heap_size_limit,
+  env = process.env,
+  timer = setInterval,
+} = {}) {
+  const warned = new Set()
+  const checkNow = () => {
+    const out = []
+    try {
+      const used = sample()?.heapUsed ?? 0
+      const limit = heapLimit()
+      if (!(limit > 0)) return out
+      const ratio = used / limit
+      for (const r of ratios) {
+        if (ratio >= r && !warned.has(r)) {
+          warned.add(r) // 每档一次/进程
+          const line = heapWarnLine(used, limit, ratio)
+          out.push(line)
+          try { console.error(line) } catch { /* 输出失败不阻断 */ } // stderr（headless 主面——§8.3）
+          for (const cb of _subscribers) { try { cb(line) } catch { /* 订阅者失败不阻断 */ } }
+          try { logEvent("heap-warn", { kind: "heap-warn", used, limit, ratio: Number(ratio.toFixed(3)) }) } catch { /* 日志失败不阻断（D-HW4） */ }
+        }
+      }
+    } catch { /* 失败面全吞（N5——采样/上限抛错不阻断、状态保持） */ }
+    return out
+  }
+  if (!heapWatchEnabled(env)) return { stop() {}, checkNow }
+  const handle = timer(checkNow, intervalMs)
+  try { handle?.unref?.() } catch { /* unref 失败不阻断（一次性命令自然退出） */ }
+  return {
+    stop() {
+      try { clearInterval(handle) } catch { /* 已停/不可清——静默（尽力面） */ }
+    },
+    checkNow,
+  }
+}

package/src/prompt-injections.mjs

@@ -0,0 +1,20 @@
+/**
+ * prompt-injections.mjs — the CLI end's prompt-anchor value table.
+ *
+ * The core's single resolution face (`@thincoder/core/prompt-files.mjs`) owns the anchors
+ * (`{{inject:<name>}}` in `thincoder-core/prompts/` + `thincoder-core/tool-docs/`); this end
+ * supplies the values. The table is registered ONCE at the process entry (`bin/thincoder.mjs`)
+ * — before any assembly — via `configurePromptInjections`.
+ *
+ * 2026-09-17 消端差：提示词面（persona / discipline / common）注入锚全消——导航注记删
+ * （正文自足）、端特有段通用化并入核内正文、文档地图路径统一写死 `docs/README.md`。
+ * 剩 = 工具面 2 锚（bash-terminal-face / question-ui-face——真实工具差异，待工具面 review 处置）。
+ */
+
+/** 工具面 2 锚（锚名 → 本端取值）。 */
+export const CLI_PROMPT_INJECTIONS = {
+  // bash 宿主终端面——CLI 无 terminal 参数（工具面 review 再统一）
+  "bash-terminal-face": "",
+  // question 工具可用性行（核内正文该行已移出正文、锚原位替换——本端填回 CLI 措辞）
+  "question-ui-face": "- Availability: this tool needs an interactive UI — in contexts without one (headless runs, subagent children) it returns an error instead of asking; put the question in your reply text instead.",
+}

package/src/tui/agent-turn.mjs

@@ -14,13 +14,13 @@
  * 递归回本文件（函数级静态环——模块求值期无顶层调用，环安全——session-slots ↔
  * session.mjs 同款先例）。
  */
-import { runAgent, ContinueError } from "../agent.mjs"
-import { saveSession } from "../session.mjs"
+import { runAgent, ContinueError } from "@thincoder/core/agent.mjs"
+import { saveSession } from "@thincoder/core/session.mjs"
 import { ansi, C } from "./ansi.mjs"
 import { buildToolCallbacks, sweepToolBlocks } from "./tool-events.mjs"
 import { freezeAllSubTasks } from "./subagent-blocks.mjs" // freezeReclaimDigestedBlocks 随 §17 段迁 suspension-drive.mjs
-import { ensureSessionTitle } from "../generate-title.mjs"
-import { logEvent, errText } from "../log.mjs"
+import { ensureSessionTitle } from "@thincoder/core/generate-title.mjs"
+import { logEvent, errText } from "@thincoder/core/log.mjs"
 import { suspensionSession, poolLive } from "./suspension-drive.mjs"
 
 /** Exit-flush bound for the async end-of-run distillation (SEND-STALL-DISTILL §2.5):
@@ -28,6 +28,10 @@ import { suspensionSession, poolLive } from "./suspension-drive.mjs"
  *  never let shutdown hang on the background summary call. */
 const DISTILL_FLUSH_TIMEOUT_MS = 5000
 
+/** Provider 失败面 URL 脱敏（X8——判据与 VSC `panel-turn-loop.mjs:153` 同式；两端各自持有
+ *  字面 = 双写登记——单源化须动 VSC/核写域，出本批射程，见批档 §2.3）。 */
+const PROVIDER_URL_RE = /https?:\/\/[^\s,)"]+/g
+
 /**
  * 第 33 批（TUI §14.3(d)——纯函数，供测试直驱）：回合链尾「需要用户」谓词——agent 已停
  * 且无自动续跑 ⇒ 置 attention 位。排除项语义（F13）：`skipSession`（digest / 会话内回合
@@ -45,6 +49,8 @@ export function userNeededAtTurnEnd(state, agent, skipSession) {
  * user/auto；result ok/stopped/error）。内层经 _logOutcome 载具回传终止原因（中止/
  * turn-cap 拒绝/错误 vs 正常完成）——嵌套回合（队列递归/挂起会话内 digest 轮）各自
  * 新开载具（每次包装调用独立），互不串扰。err:internal = 逃出内层的未分类异常。
+ * @returns {Promise<"ok"|"stopped"|"error">} 本回合终态（同一载具外化——X9 消化轮
+ *  收尾可见行的 ok/aborted 判据；VSC digest end ok 旗标同口径）。
  */
 export async function runAgentTurn(ctx, text, opts = {}) {
   const kind = opts?.autoTurn ? "auto" : "user"
@@ -55,8 +61,8 @@ export async function runAgentTurn(ctx, text, opts = {}) {
   const t0 = Date.now()
   logEvent("turn:start", { kind })
   try {
-    const result = await runAgentTurnInner(ctx, text, runOpts)
-    return result
+    await runAgentTurnInner(ctx, text, runOpts)
+    return carrier.result ?? "ok"
   } catch (e) {
     carrier.result = "error"
     logEvent("err:internal", { msg: errText(e, 200), where: "runAgentTurn" })
@@ -68,7 +74,7 @@ export async function runAgentTurn(ctx, text, opts = {}) {
 
 /** runAgentTurn 本体（LOGGING 包装之外——见上方包装器）。 */
 async function runAgentTurnInner(ctx, text, opts) {
-  const { autoTurn = false, skipSession = false } = opts ?? {}
+  const { autoTurn = false, skipSession = false, upstreamTurn = false } = opts ?? {} // upstreamTurn：上行 ask 唤醒轮旗标（§6.27.12.5 D/I——透传核 runAgent，仅供域文本选择）
   const { agent, state, pushLine, pushLabel, render, scheduleRender, ensureAssistantLabel, askPermission, askBatchPermission, askQuestion, handleSlash } = ctx
   // 可注入覆盖（测试用）；默认走真实实现
   const runAgentImpl = ctx.runAgent ?? runAgent
@@ -144,7 +150,7 @@ async function runAgentTurnInner(ctx, text, opts) {
   try {
     for (let resume = false; ; resume = true) {
       try {
-        await runAgentImpl(agent, text, callbacks, { signal: state.controller.signal, resume, autoTurn, suspDriven: true })
+        await runAgentImpl(agent, text, callbacks, { signal: state.controller.signal, resume, autoTurn, upstreamTurn, suspDriven: true })
         flushStream()
         break // Normal completion, exit loop
       } catch (error) {
@@ -216,7 +222,32 @@ async function runAgentTurnInner(ctx, text, opts) {
           state.controller = makeController()
           continue
         }
-        pushLine(`[error] ${error.message}`, C.error)
+        // X8（2026-09-20 端差·显示面消差批）：provider 失败面 = 友好首行（判据同 VSC
+        // panel-turn-loop.mjs:152-153：原文首行 + URL 脱敏）+ 诊断两行（Provider/Model）+ Retry
+        // 询问（复用 permission 机制——同意 ⇒ 重建 controller + resume 重入，与 ContinueError
+        // 同法；拒绝 ⇒ 现状 break，[error] 行保留）。
+        const rawMsg = error?.message || String(error)
+        const errLine = rawMsg.split("\n")[0].replace(PROVIDER_URL_RE, "[endpoint]")
+        // X8 跟进②（用户 2026-09-20 裁定）：原文余行 = **log-only**（表面零膨胀——不增 UI 行）。
+        // `head` 与 `err` **同过脱敏管道**（PROVIDER_URL_RE ⇒ `[endpoint]`——LOGGING.md §6.3
+        // D-LG4「URL 不入事件」）**先脱敏后截断**（防截断留 URL 残段），自限 ≤200（`err` 200 +
+        // `head` 200 + 固定字段 < 512——log.mjs NF-L2）；无余行 ⇒ 传 `null`（勿传空串）。
+        const restRaw = rawMsg.split("\n").slice(1).map((l) => l.trim()).filter(Boolean).join(" / ")
+        const restSan = restRaw.replace(PROVIDER_URL_RE, "[endpoint]")
+        logEvent("err:provider", { err: errLine, head: restSan ? (restSan.length > 200 ? restSan.slice(0, 199) + "…" : restSan) : null })
+        pushLine(`[error] ${errLine}`, C.error)
+        pushLine(`→ Provider: ${agent.provider?.baseURL}`, C.dim)
+        pushLine(`→ Model: ${agent.provider?.model}`, C.dim)
+        const willRetry = await new Promise((resolve) => {
+          state.permission = { name: "retry", args: { message: errLine }, resolve }
+          state.status = "Retry after provider error?"
+          render()
+        })
+        state.permission = null
+        if (willRetry) {
+          state.controller = makeController()
+          continue
+        }
         if (opts?._logOutcome) opts._logOutcome.result = "error"
         break
       }

package/src/tui/cmd-advisor.mjs

@@ -3,7 +3,7 @@
  *  ctx: { agent, showPicker, pushLine, pushLabel, persistRaw } */
 import { readFileSync } from "node:fs"
 import { ansi, C } from "./ansi.mjs"
-import { activeSlot, slotPath } from "../session.mjs"
+import { activeSlot, slotPath } from "@thincoder/core/session.mjs"
 import { writeSessionFile } from "./cmd-eng.mjs"
 
 export async function handleAdvisorCommand(ctx) {
@@ -98,7 +98,7 @@ export async function handleAdvisorCommand(ctx) {
         pushLabel("❯ Advisor", ansi.bold + C.tool)
         pushLine("Thinking: using main model settings", C.tool)
       } else if (c.action === "think_on") {
-        const { specForModel } = await import("../config.mjs")
+        const { specForModel } = await import("@thincoder/core/config.mjs")
         const spec = specForModel(getEffectiveModel(agent, cfg))
         cfg.thinking = { type: spec.thinkEnabledValue ?? "enabled" }
         if (spec.thinkApi === "effort") delete cfg.thinking
@@ -106,7 +106,7 @@ export async function handleAdvisorCommand(ctx) {
         pushLabel("❯ Advisor", ansi.bold + C.tool)
         pushLine(`Thinking: ON`, C.tool)
       } else if (c.action === "think_off") {
-        const { specForModel } = await import("../config.mjs")
+        const { specForModel } = await import("@thincoder/core/config.mjs")
         const spec = specForModel(getEffectiveModel(agent, cfg))
         const isCustomThink = (spec.thinkEnabledValue ?? "enabled") !== "enabled"
         cfg.thinking = isCustomThink ? null : { type: "disabled" }
@@ -179,7 +179,7 @@ function getEffectiveModel(agent, cfg) {
 }
 
 async function fetchAdvisorModels(agent) {
-  const { listModels } = await import("../provider/index.mjs")
+  const { listModels } = await import("@thincoder/core/provider/index.mjs")
   const result = new Map()
   await Promise.all((agent.providers || []).map(async (p) => {
     try {
@@ -223,7 +223,7 @@ function buildModelEntries(agent, cfg, cache) {
 }
 
 async function buildThinkingEntries(agent, cfg) {
-  const { specForModel } = await import("../config.mjs")
+  const { specForModel } = await import("@thincoder/core/config.mjs")
   const providerForDefaults = cfg.provider
     ? agent.providers?.find(p => p.name === cfg.provider) || agent.provider
     : agent.provider

package/src/tui/cmd-clear.mjs

@@ -9,12 +9,14 @@ export async function handleClearCommand(ctx) {
     ], { defaultIndex: 1 })
     if (e?.action === "yes") {
       state.lines = []
+      state._linesChars = 0 // TUI-OOM-ROOTCAUSE（§15.3.2）：行集清空 → 字符账同步归零
       state.streaming = ""
       render()
     }
     return
   }
   state.lines = []
+  state._linesChars = 0 // TUI-OOM-ROOTCAUSE（§15.3.2）：行集清空 → 字符账同步归零
   state.streaming = ""
   render()
 }

package/src/tui/cmd-config.mjs

@@ -23,7 +23,7 @@ export function poolCur(pl, defaults) {
 /** /config command: view and set agent/embedding/proxy config. */
 export async function handleConfigCommand(ctx, args = []) {
   const { agent, pushLine, pushLabel, showPicker, askQuestion, persistRaw, maskKey, pickModelForSlot } = ctx
-  const { configPath, DEFAULTS } = await import("../config.mjs")
+  const { configPath, DEFAULTS } = await import("@thincoder/core/config.mjs")
   let ac = agent.config?.agent ?? {}
   let ec = agent.config?.embedding ?? {}
   let tc = agent.config?.traces ?? {}
@@ -43,7 +43,7 @@ export async function handleConfigCommand(ctx, args = []) {
     agent.config.embedding ??= {}
     agent.config.embedding.apiKey = embKey
     if (agent.memory) {
-      const { createEmbedder } = await import("../embedding.mjs")
+      const { createEmbedder } = await import("@thincoder/core/embedding.mjs")
       agent.memory.embedder = createEmbedder(agent.config.embedding)
     }
     pushLabel("❯ Config", ansi.bold + C.tool)
@@ -55,8 +55,8 @@ export async function handleConfigCommand(ctx, args = []) {
    *  MODEL-MERGE-SESSION 三支改写（cfg 无 active*）：运行时由「会话槽复合仍在 providers 中 →
    *  保持槽值」或「config defaultModel（新会话起点）」决定——不再有渠道默认字段可回退。 */
   async function reloadConfig() {
-    const { loadConfig } = await import("../config.mjs")
-    const { injectProxy } = await import("../proxy.mjs")
+    const { loadConfig } = await import("@thincoder/core/config.mjs")
+    const { injectProxy } = await import("@thincoder/core/proxy.mjs")
     const cfg = loadConfig()
     injectProxy(cfg.providersList, cfg)
     const sessionName = agent.activeProvider
@@ -82,7 +82,7 @@ export async function handleConfigCommand(ctx, args = []) {
     // 运行时重建后同步注入结果（cfg.provider 系 loadConfig 内建——injectProxy 后建）
     agent.provider.proxyUri = cfg.providersList.find((p) => p.name === agent.activeProvider)?.proxyUri
     if (agent.config?.agent?.compactThresholdAuto) {
-      const { resolveCompactThreshold } = await import("../config.mjs")
+      const { resolveCompactThreshold } = await import("@thincoder/core/config.mjs")
       agent.config.agent.compactThreshold = resolveCompactThreshold(null, agent.provider).value
     }
   }
@@ -136,8 +136,8 @@ export async function handleConfigCommand(ctx, args = []) {
           pushLabel("❯ Config", ansi.bold + C.tool)
           pushLine(`proxy.${key} = ${!pc[key] ? "on" : "off"}`, C.tool)
         } else if (c.action === "test") {
-          const { proxyFetch, resolveWebProxy } = await import("../proxy.mjs")
-          const { UA } = await import("../tools/web.mjs")
+          const { proxyFetch, resolveWebProxy } = await import("@thincoder/core/proxy.mjs")
+          const { UA } = await import("@thincoder/core/tools/web.mjs")
           const uri = resolveWebProxy({ agent })
           pushLabel("❯ Config", ansi.bold + C.tool)
           pushLine(`Testing ${uri ? `via proxy ${uri}` : "direct (no proxy)"}...`, C.dim)
@@ -170,7 +170,7 @@ export async function handleConfigCommand(ctx, args = []) {
 
   /** 会诊/飞刀候选池子菜单：列出 / 添加 / 编辑 effort / 删除 consultModels 条目。 */
   async function pickEffort(current, model) {
-    const { specForModel } = await import("../config.mjs")
+    const { specForModel } = await import("@thincoder/core/config.mjs")
     const enumList = model ? specForModel(model).reasoningEffortEnum : null
     // The model's reasoning-effort enum is HETEROGENEOUS across providers (deepseek:
     // low/high/max; qwen3.8-max: xhigh/medium/low; kimi: 7 levels). A fixed

package/src/tui/cmd-eng.mjs

@@ -1,15 +1,17 @@
 /** /eng command: toggle engineering mode.
- *  No prerequisites (FR11): the mode works on any project — no methodology file,
- *  no docs tree, no git. The retired gate demanded a methodology file and offered
- *  to create it from a template that no longer ships — that option crashed
- *  (PORTABILITY P14). ctx: { agent, pushLine, pushLabel } */
+ *  No retired-concept prerequisites (FR11 收正口径 — `docs/core/requirements/PORTABILITY.md:62`):
+ *  no methodology file, no docs tree. The **repo-root anchor（git）= E2 既有入口前提**：
+ *  非锚 cwd 上 ON = fail-closed 拒翻 + 明示原因、模式保持 OFF（#41 —
+ *  `docs/core/design/MANIFEST.md` §2.8 F2/F3；判定面 = 入口决策树单源）。
+ *  ctx: { agent, pushLine, pushLabel } */
 import { readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync } from "node:fs"
 import { dirname } from "node:path"
 import { ansi, C } from "./ansi.mjs"
-import { activeSlot, slotPath } from "../session.mjs"
-import { purgeExpiredDesignTokens } from "../token-ttl.mjs"
+import { activeSlot, slotPath } from "@thincoder/core/session.mjs"
+import { purgeExpiredDesignTokens } from "@thincoder/core/token-ttl.mjs"
+import { resolveEngineeringManifest } from "@thincoder/core/manifest.mjs"
 
-import { ENG_OFF_REMINDER } from "../agent.mjs"
+import { ENG_OFF_REMINDER } from "@thincoder/core/agent.mjs"
 
 /** Atomic slot write (same shape as session.mjs writeSessionFile — kept local to avoid a
  *  private-import; cmd-advisor's guard toggle shares this helper). */
@@ -29,8 +31,22 @@ export async function handleEngCommand(ctx) {
   const { agent, pushLine, pushLabel } = ctx
   agent.config.agent ??= {}
 
-  // Toggle on/off — no prerequisite check (FR11: engineering mode depends on no
-  // project file at all; a missing docs tree or git repo must not block it).
+  // No retired-concept prerequisite check (FR11 收正口径；退场原因见档头注)。ON 方向的门
+  // = 入口决策树（下方）；OFF 方向恒放行（F2 表 OFF 行——零 manifest I/O）。
+  //
+  // #41 先判后翻（MANIFEST.md §2.8 F2/F3 · KD-M1-21）：**ON 方向**先走入口决策树单源
+  // （resolveEngineeringManifest——KD-M1-20），判据通过才写态；OFF 方向零改（F2 表 OFF 行）。
+  // 拒 ⇒ warn 行 + **零标签**（标签 = 成功回显——拒时零标签防假成功）+ 零副作用
+  // （模式未翻 / token 未清 / `_advisorRuns` 未重置 / 提醒未入列 / 槽未写）。
+  // 准 ⇒ 缺档格就地建档（writer:'main'）+ `agent.manifest` ← 结果（相位行当回合起活）。
+  if (!agent.config.agent.engineering) {
+    const r = resolveEngineeringManifest(agent.cwd ?? process.cwd(), { writer: "main" })
+    if (!r.ok) {
+      pushLine(`Engineering mode not enabled — ${r.message} (mode unchanged)`, C.warn)
+      return
+    }
+    agent.manifest = r.manifest
+  }
   agent.config.agent.engineering = !agent.config.agent.engineering
   // §11.2 D-24b: per-review instances die with the mode (fresh convergence cycles
   // on the next toggle).