thincoder 0.12.61 → 0.12.63

package/src/tui/tool-display.mjs

@@ -7,6 +7,9 @@
  * 不禁内容变更（.set/.delete/.push），调用方行为与同模块时代一致。
  */
 
+// TUI-OOM-ROOTCAUSE（TUI.md §15.3.1）：显示层额度常量/工具行定位（display-budget 叶子）。
+import { capLines, TOOL_RESULT_MAX_CHARS } from "./display-budget.mjs"
+
 // Tool execution start timestamps (performance.now ms). Keyed by tool_call id
 // when available (parallel same-name tools each get their own tick — the
 // P0-3 fix, 2026-08-30), falling back to a per-name FIFO queue for callers
@@ -73,7 +76,9 @@ export function sweepToolBlocks(state) {
  *  1) Multimodal results (read_image) embed FULL base64 images in the JSON —
  *     the human needs only the text part (model gets images via the multimodal
  *     channel); 2) results beyond maxRows are truncated in the block (full
- *     text always lives in history for the model). Returns row array. */
+ *     text always lives in history for the model). Returns row array.
+ *  TUI-OOM-ROOTCAUSE（§15.3.1 TOOL_RESULT_MAX_CHARS）：总量额度与 400 行双维
+ *  （单行任意大——无 `\n` 巨 chunk/JSON 尾行），尾截断 + 标记。 */
 export function slimToolResultForDisplay(result, maxRows = 400) {
   let displayResult = result
   try {
@@ -81,9 +86,18 @@ export function slimToolResultForDisplay(result, maxRows = 400) {
     if (parsed?.images?.length) displayResult = parsed.text ?? result
   } catch { /* not JSON — show as-is */ }
   const rows = String(displayResult).split("\n").filter((l) => l.trim())
-  return rows.length > maxRows
+  const capped = rows.length > maxRows
     ? [...rows.slice(0, maxRows), `… (result truncated at ${maxRows} rows — full text in history)`]
     : rows
+  return capLines(capped, TOOL_RESULT_MAX_CHARS)
+}
+
+/** 按块定位其载体行（字符账 re-account 用——块对象唯一）。 */
+export function findToolLine(state, name, toolId) {
+  const block = findToolBlock(state, name, toolId)
+  if (!block) return null
+  for (const l of state.lines ?? []) if (l._toolBlock === block) return l
+  return null
 }
 /** Mark the dispatch-level tool carrier done when its result is consumed by a
  *  dedicated branch (subagent/escalate/advisor blocks) — without this the turn

package/src/tui/tool-events.mjs

@@ -19,29 +19,60 @@
 import { C } from "./ansi.mjs"
 import { formatToolSummary } from "./tool-summaries.mjs"
 import { describeToolArgs, toolArgsLines } from "./tool-args.mjs"
-import { ADVISOR_THINKING_PLACEHOLDER, resolveAdvisorProvider } from "../advisor/run.mjs"
+import { ADVISOR_THINKING_PLACEHOLDER, resolveAdvisorProvider } from "@thincoder/core/advisor/run.mjs"
 import {
   SUBAGENT_ROLES, routeSubToken, routeSubReasoning, routeSubToolCall,
   routeSubToolOutput, finishSubTask, finishSubTaskKey, finishSubTasksByRole, freezeDoneSubTasks,
   ensureCompressPanel, markCompressFailed, markCompressDone, markCompressFallback,
+  shiftFreezeAnchors,
 } from "./subagent-blocks.mjs"
 // 第 27 批 §12.3②：前缀正则换名 + import 源改文法模块（纯换名——语义零改）。
-import { RELAY_PREFIX_RE } from "../agent/relay-prefix.mjs"
-import { TURN_CAP_MARK, STOPPED_MARK } from "../agent/spawn-child.mjs"
+import { RELAY_PREFIX_RE } from "@thincoder/core/agent/relay-prefix.mjs"
+import { TURN_CAP_MARK, STOPPED_MARK } from "@thincoder/core/agent/spawn-child.mjs"
+// 批 1 CORE-DEFECT-FIXES B3：onWait 相位值域 + 文案单源（消费面禁各自枚举——PROVIDER.md §6.20）
+import { waitStatusText } from "@thincoder/core/provider/wait-status.mjs"
 // 2026-09-05 module-split：ticks/maps/sweep/slim/settle/探测/find 族迁 tool-display.mjs——
 // buildToolCallbacks 内部引用用本地 import；sweepToolBlocks re-export（agent-turn 消费面）
 import {
   TOOL_OUTPUT_LINE_CAP, REMINDER_CAP, REMINDER_PERSIST_TURNS,
   _toolTicks, _subActions, _subActionQ,
   tickStart, tickTake, settleToolBlock, isAsyncSpawnResult, isSpawnErrorResult,
-  findToolBlock, slimToolResultForDisplay, sweepToolBlocks,
+  findToolBlock, findToolLine, slimToolResultForDisplay, sweepToolBlocks,
 } from "./tool-display.mjs"
 export { sweepToolBlocks, slimToolResultForDisplay } from "./tool-display.mjs"
+// TUI-OOM-ROOTCAUSE（TUI.md §15.3.1/§15.3.3）：显示层额度（行/载体/输出环/评审/流式）。
+import {
+  capText, capLine, capLines, appendCapped, capAdvisorText, accountLine, syncLineBudget,
+  LINE_TRUNC_MARKER, MIDDLE_TRUNC_MARKER, ADVISOR_CAP_OPTS, STREAM_CAP_OPTS,
+  TOOL_OUTPUT_ENTRY_MAX_CHARS, TOOL_OUTPUT_TOTAL_MAX_CHARS, ADVISOR_TEXT_MAX_CHARS,
+} from "./display-budget.mjs"
+
+/** 输出环字符维总量（§15.3.1 TOOL_OUTPUT_TOTAL_MAX_CHARS——与 200 条目环同款丢最旧）。 */
+function trimOutputChars(block) {
+  let total = 0
+  for (const s of block.output) total += s.length
+  while (total > TOOL_OUTPUT_TOTAL_MAX_CHARS && block.output.length > 0) {
+    total -= block.output.shift().length
+  }
+}
 
 /** Build the agent callbacks + the shared flushStream for one turn.
  *          askPermission, askQuestion, saveSessionImpl } */
 export function buildToolCallbacks(deps) {
   const { agent, state, pushLine, render, scheduleRender, ensureAssistantLabel, askPermission, askBatchPermission, askQuestion, saveSessionImpl } = deps
+  // 行集总量对账便捷式（§15.3.3——冻结锚点平移交 subagent 族函数）
+  const budgetSync = () => syncLineBudget(state, { onTrim: (st, n) => shiftFreezeAnchors(st, n) })
+  /** Advisor 有序块累积 + 额度（§15.3.1 ADVISOR_TEXT_MAX_CHARS——头 32K/尾 96K/中段标记）。 */
+  const pushAdvisorChunk = (raw, kind) => {
+    const blocks = state._advisorBlocks ??= []
+    const last = blocks.at(-1)
+    if (last && last.kind === kind) last.text = appendCapped(last.text, raw, ADVISOR_CAP_OPTS)
+    else blocks.push({ kind, text: appendCapped("", raw, ADVISOR_CAP_OPTS) })
+    // 多块总量：丢最旧块直至 ≤ 额度（裁决尾部优先）
+    let total = 0
+    for (const b of blocks) total += b.text.length
+    while (total > ADVISOR_TEXT_MAX_CHARS && blocks.length > 1) total -= blocks.shift().text.length
+  }
   // NOTE: advisor buffers (_advisorThink/advisorStreaming) are cleared here too.
   // Timing safety: onToolResult flushes _advisorThink into history and empties
   // the buffers BEFORE onTurnEnd can call flushStream (tool result is
@@ -69,7 +100,7 @@ export function buildToolCallbacks(deps) {
       // block content, never the main stream (D1). Routing details in subagent-blocks.
       if (routeSubToken(state, t, scheduleRender)) return
       ensureAssistantLabel()
-      state.streaming += t
+      state.streaming = appendCapped(state.streaming, t, STREAM_CAP_OPTS) // §15.3.1 STREAM_MAX_CHARS
       scheduleRender()
     },
     onReasoning: (t) => {
@@ -77,7 +108,7 @@ export function buildToolCallbacks(deps) {
       // buffer as kind=think (F2: same treatment as the main reasoning stream).
       if (routeSubReasoning(state, t, scheduleRender)) return
       ensureAssistantLabel()
-      state.reasoning += t
+      state.reasoning = appendCapped(state.reasoning, t, STREAM_CAP_OPTS) // §15.3.1 STREAM_MAX_CHARS
       scheduleRender()
     },
     onToolCall: (name, args, toolId) => {
@@ -139,6 +170,8 @@ export function buildToolCallbacks(deps) {
           done: false,
         },
       })
+      accountLine(state, state.lines[state.lines.length - 1]) // 载体入总量账（§15.3.4）
+      budgetSync()
       tickStart(name, toolId)
     },
     // §7.2.3（方案 e）：dispatch runOne 把工具 ctx 上的 _subagentKey（sync spawn/
@@ -236,11 +269,13 @@ export function buildToolCallbacks(deps) {
           // screen of garbage (user report 2026-08-30). The model gets the image
           // via the multimodal channel (agent.mjs), the human needs only the
           // text part: strip image parts from the displayed result.
-          block.result = slimToolResultForDisplay(result)
+          block.result = slimToolResultForDisplay(result) // §15.3.1 RESULT 额度（行 400 + 字符 64K 双维）
           block.summary = formatToolSummary(name, result)
           block.done = true
           const started = tickTake(name, toolId)
           block.elapsed = started !== null ? Math.round(performance.now() - started) : null
+          accountLine(state, findToolLine(state, name, toolId)) // 载体原地变更 → 重新入账
+          budgetSync()
         }
       }
       if (name === "advisor") {
@@ -255,17 +290,22 @@ export function buildToolCallbacks(deps) {
         // _advisorBlocks keep rendering the running view until cleared at turn end.
         const blocks = state._advisorBlocks ?? []
         if (blocks.length > 0) {
-          const text = blocks
+          // 冻结文本额度（§15.3.1：头 32K + 尾 96K 保裁决尾部 + 中段标记——非静默截断，
+          // 代码评审 #3：capLines(...)[0] 会丢标记且截尾）
+          const text = capAdvisorText(blocks
             .map((b) => b.text.replaceAll(ADVISOR_THINKING_PLACEHOLDER, ""))
             .join("")
             .replace(/\n{3,}/g, "\n\n")
-            .trim()
+            .trim())
           if (text) {
-            state.lines.push({
+            const line = {
               text: "advisor review",
               color: C.dim,
               _frozenAdvisor: text,
-            })
+            }
+            state.lines.push(line)
+            accountLine(state, line)
+            budgetSync()
           }
         }
       }
@@ -298,25 +338,26 @@ export function buildToolCallbacks(deps) {
         const isString = typeof chunk === "string"
         const raw = isString ? chunk : String(chunk?.text ?? "")
         const kind = isString ? "text" : (chunk?.kind ?? "text")
-        const blocks = state._advisorBlocks ??= []
-        const last = blocks.at(-1)
-        if (last && last.kind === kind) last.text += raw
-        else blocks.push({ kind, text: raw })
+        pushAdvisorChunk(raw, kind) // §15.3.1 累积额度（多块丢最旧）
         scheduleRender()
         return
       }
       // Append into the CURRENT tool block's output buffer (the block is the
       // display; no _live scroll lines anymore). N2-style cap keeps memory
-      // bounded: keep the LAST 200 output lines per call.
+      // bounded: keep the LAST 200 output lines per call; 字符维双维
+      // （§15.3.1：单条目 ≤ TOOL_OUTPUT_ENTRY_MAX_CHARS、总量 ≤ TOOL_OUTPUT_TOTAL_MAX_CHARS 丢最旧）。
       const block = findToolBlock(state, name, toolId)
       if (block) {
         for (const line of part.text.split("\n")) {
           const trimmed = line.trimEnd()
-          if (trimmed) block.output.push(trimmed)
+          if (trimmed) block.output.push(capText(trimmed, { max: TOOL_OUTPUT_ENTRY_MAX_CHARS, keepHead: 6_000, keepTail: 2_000, marker: MIDDLE_TRUNC_MARKER }))
         }
         if (block.output.length > TOOL_OUTPUT_LINE_CAP) {
           block.output.splice(0, block.output.length - TOOL_OUTPUT_LINE_CAP)
         }
+        trimOutputChars(block)
+        accountLine(state, findToolLine(state, name, toolId))
+        budgetSync()
       }
       scheduleRender()
     },
@@ -363,11 +404,12 @@ export function buildToolCallbacks(deps) {
       state.tokens.cacheMiss += usage.prompt_cache_miss_tokens ?? 0
       state.tokens.reasoningTokens += usage.completion_tokens_details?.reasoning_tokens ?? 0
     },
-    // Throttle wait (active gate / 429 backoff): show in status bar so user knows it's not frozen
-    onWait: ({ phase, seconds }) => {
-      if (phase === "gate") state.status = `TPM throttle wait ~${seconds}s`
-      else if (phase === "overloaded") state.status = `Server overloaded, retrying in ${seconds}s`
-      else state.status = `Rate-limited 429, retry in ${seconds}s`
+    // Throttle wait (active gate / 429 backoff): show in status bar so user knows it's not frozen.
+    // 相位值域/文案取自核单源（wait-status.mjs）——未知相位与 warn 前置告警不显示（不落兜底误标）。
+    onWait: (ev) => {
+      const s = waitStatusText(ev)
+      if (!s) return
+      state.status = s
       render()
     },
     onTaskUpdate: (items) => {

package/src/tui/tui-lifecycle.mjs

@@ -15,9 +15,16 @@ export function writeStartupSequence(write = (s) => process.stdout.write(s)) {
   write(ansi.altBuffer + ansi.hideCursor + ansi.mouseOn + ansi.bracketedPasteOn + ansi.keyboardPush + ansi.modifyOtherKeysOn + ansi.wrapOff)
 }
 
-/** TUI 清理序列：清屏 + 关闭鼠标/粘贴/键盘增强 + 退出 alt buffer + 显示光标 + 恢复环绕。 */
+/** TUI 清理序列 = 异常退出恢复序列（单一来源——§9.2 表 2 候选 1）：清屏 + 关闭鼠标/
+ *  粘贴/键盘增强 + 退出 alt buffer + 显示光标 + 恢复环绕。
+ *  TUI-OOM-ROOTCAUSE（CRASH-REPORTS.md §9.3）：提取为导出常量 `RECOVERY_SEQUENCE`——
+ *  包装父在子异常退出（V8 fatal——不走 JS 钩子）时补发同一序列（单一来源，禁第三份
+ *  副本）；writeCleanupSequence 引用同常量（行为逐字不变——既有字节锁测试保持，AC-RT3）。 */
+export const RECOVERY_SEQUENCE =
+  ansi.clearScreen + ansi.mouseOff + ansi.bracketedPasteOff + ansi.keyboardPop + ansi.modifyOtherKeysOff + ansi.mainBuffer + ansi.showCursor + ansi.reset + ansi.wrapOn
+
 export function writeCleanupSequence(write = (s) => process.stdout.write(s)) {
-  write(ansi.clearScreen + ansi.mouseOff + ansi.bracketedPasteOff + ansi.keyboardPop + ansi.modifyOtherKeysOff + ansi.mainBuffer + ansi.showCursor + ansi.reset + ansi.wrapOn)
+  write(RECOVERY_SEQUENCE)
 }
 
 // R25（ARCHITECTURE.md §R25 F-R25a——复审 #1）：TUI 活动态标志——index.mjs 在终端接管

package/src/tui/wizard.mjs

@@ -6,7 +6,7 @@
  * ctx: { agent, state, pushLine, pushLabel, render, persistRaw, openModelPicker }
  */
 
-import { PROVIDER_PRESETS as PRESETS } from "../config.mjs"
+import { PROVIDER_PRESETS as PRESETS } from "@thincoder/core/config.mjs"
 import { ansi, C } from "./ansi.mjs"
 import { computeLayout } from "./layout.mjs"
 import { probeChannelModels } from "./model-catalog.mjs"
@@ -202,7 +202,7 @@ export function createWizard(ctx) {
     agent.provider = { ...agent.providers.find((p) => p.name === f.name) }
     agent.provider.model = agent.activeModel
     if (agent.config?.agent?.compactThresholdAuto) {
-      const { resolveCompactThreshold } = await import("../config.mjs")
+      const { resolveCompactThreshold } = await import("@thincoder/core/config.mjs")
       agent.config.agent.compactThreshold = resolveCompactThreshold(null, agent.provider).value
     }
     // agent.config 是 loadConfig merged——无 active* 键可写——defaultModel 随内存 merged 更新
@@ -226,7 +226,7 @@ export function createWizard(ctx) {
       agent.config.embedding ??= {}
       agent.config.embedding.apiKey = f.embedkey
       if (agent.memory && !agent.memory.embedder) {
-        const { createEmbedder } = await import("../embedding.mjs")
+        const { createEmbedder } = await import("@thincoder/core/embedding.mjs")
         agent.memory.embedder = createEmbedder(agent.config.embedding)
       }
       pushLine(`Vector search enabled (${agent.config.embedding.model ?? "BAAI/bge-m3"})`, C.tool)

package/src/tui/wrapped-spawn.mjs

@@ -6,12 +6,13 @@ import { appendFileSync, mkdirSync, writeFileSync } from "node:fs"
 import { spawn } from "node:child_process"
 import { fileURLToPath } from "node:url"
 import { crashReportsDir } from "../crash-reports.mjs"
+import { RECOVERY_SEQUENCE } from "./tui-lifecycle.mjs"
 
 // F-3 信号语义（raw mode 既有 key-handler 双按语义——Ctrl+C = stdin 字节不产生信号 → 子正常退 → 父收
 // exit 同码退）：父忽略 SIGINT/SIGTERM——tee 不被打断。2026-09-09 实测：Windows process.kill(SIGINT)
 // = 硬杀 ≠ 控制台 Ctrl+C 事件（handler 不触发）——信号面测试走 mock（真控制台端到端留发布前手动 QA）。
 export const ignoreSignal = () => {} // no-op 单一引用——父信号 + stderr-error 监听共用——测试可精确复原
-export function spawnTuiWrapped({ dir = crashReportsDir(), script = fileURLToPath(new URL("../../bin/thincoder.mjs", import.meta.url)), spawnImpl = spawn, exitImpl = (code) => process.exit(code) } = {}) {
+export function spawnTuiWrapped({ dir = crashReportsDir(), script = fileURLToPath(new URL("../../bin/thincoder.mjs", import.meta.url)), spawnImpl = spawn, exitImpl = (code) => process.exit(code), writeImpl = (s) => process.stdout.write(s) } = {}) {
   // ① mkdir 前置（评审 #2——prepareCrashReporting 只在子内跑——首启目录缺失会静默不包装）+ 开日志
   //（文件头元信息行：时间/pid/argv——F-2——0600 append）——失败 → false：不包装直接跑现逻辑（尽力面）
   let logPath = null
@@ -25,14 +26,29 @@ export function spawnTuiWrapped({ dir = crashReportsDir(), script = fileURLToPat
   const note = (s) => { try { appendFileSync(logPath, s) } catch { /* 落盘尽力面——不阻断 tee */ } }
   let exitCode = null, exitSignal = null, settled = false
   const finish = (code) => { if (!settled) { settled = true; exitImpl(code) } }
-  const child = spawnImpl(process.execPath, [script, ...process.argv.slice(2)], {
+  // TUI-OOM-ROOTCAUSE（CRASH-REPORTS.md §9.3）：子异常退出（V8 fatal——不走 JS 钩子）→
+  // 包装父补发恢复序列（唯一存活方；序列单一来源 = tui-lifecycle.RECOVERY_SEQUENCE）。
+  // 守卫落点 = exit/close 处置内（**不在共享 finish**——spawn error 路径经 error→finish(1)，
+  // 字面挂 finish 会在子未启动时补发 clearScreen 序列，违 F5③）；按 exitCode/exitSignal
+  // 判定（code !== 0 || signal != null）；异常退出零动作；正常退出（code 0）零干预；
+  // 每进程恰一次（recovered 守卫，exit/close 双路 + 30s 兜底路径同守）；写失败不阻断收尾。
+  let recovered = false
+  const recoverTerminal = (code, signal) => {
+    if (recovered) return
+    if (!(code !== 0 || signal != null)) return
+    recovered = true
+    try { writeImpl(RECOVERY_SEQUENCE) } catch { /* 尽力面：终端已关/管道已断——不阻断收尾 */ }
+  }
+  // F3③（CRASH-REPORTS）：近堆上限快照落点定向——--diagnostic-dir 为 Node 选项，须在脚本路径前；
+  // 无条件注入（gate 单点在 crash-reports.mjs——包装器不判 env）；未触发快照时零副作用。
+  const child = spawnImpl(process.execPath, [`--diagnostic-dir=${dir}`, script, ...process.argv.slice(2)], {
     stdio: ["inherit", "inherit", "pipe"], // 子 stderr pipe → tee；stdin/stdout 继承（TTY 原样）
     env: { ...process.env, THINCODER_TUI_WRAPPED: "1" }, // env 门——子内判定不包装——纯现逻辑（红线）
     windowsHide: false,
   })
   child.stderr.on("data", (chunk) => { try { process.stderr.write(chunk) } catch { /* 终端已关——日志仍落 */ } note(chunk) }) // ② tee 双写：终端实时 + 日志
-  child.on("exit", (code, signal) => { exitCode = code; exitSignal = signal; setTimeout(() => finish(exitCode ?? (exitSignal ? 1 : 0)), 30_000).unref() }) // ③ exit 记码；兜底 30s 强退
-  child.on("close", () => finish(exitCode ?? (exitSignal ? 1 : 0))) // ④ close = stderr 尾数据全收（AC-2）→ 同码退
-  child.on("error", (err) => { note(`# spawn error: ${err.message}\n`); finish(1) }) // ⑤ spawn 失败不发 exit 只发 error
+  child.on("exit", (code, signal) => { exitCode = code; exitSignal = signal; recoverTerminal(code, signal); setTimeout(() => { recoverTerminal(exitCode, exitSignal); finish(exitCode ?? (exitSignal ? 1 : 0)) }, 30_000).unref() }) // ③ exit 记码；异常退出→补发恢复；兜底 30s 强退
+  child.on("close", () => { recoverTerminal(exitCode, exitSignal); finish(exitCode ?? (exitSignal ? 1 : 0)) }) // ④ close = stderr 尾数据全收（AC-2）→ 同码退
+  child.on("error", (err) => { note(`# spawn error: ${err.message}\n`); finish(1) }) // ⑤ spawn 失败不发 exit 只发 error（零序列动作——F5③）
   return true
 }

package/src/abort-provenance.mjs

@@ -1,116 +0,0 @@
-/**
- * abort-provenance.mjs — abort 来源标注词汇表（单一权威源——AGENT-LOOP.md §20.3 第 1/2 条）
- *
- * 子代理 / 评审 / 会诊死亡的可诊断性：产生点标注结构化来源（`err.abortInfo`）→
- * controller 链 hop 逐跳保 reason（§20.3 第 4 条 #10）→ 结算 / 报告面用 `deathLine`
- * 合成死亡行（原 message 前缀逐字保留 + 来源后缀）。
- *
- * 纯函数、零 import——任意层可引、无环（provider / proxy / agent / settle 族共用）。
- * 词汇表：
- * - trigger（5 值）：`user`（reason.interrupt）· `timeout`（TimeoutError / 定时器面）·
- *   `cancel`（定向中止）· `stop`（整批 / 会话 / 回合级停）· `unknown`（残留 / 未标注——告警态）。
- * - layer（3 值）：`provider` / `agent` / `settle`；未标注错误回落 `unrecorded`（合成器 token）。
- */
-
-/** trigger 枚举权威（测试锁计数 5——AGENT-LOOP.md §20.3 第 1 条表）。 */
-export const TRIGGERS = ["user", "timeout", "cancel", "stop", "unknown"]
-
-/**
- * trigger 判定（判据序 = §20.3 第 1 条表；signal.reason 四形态：
- * ① `{interrupt:true(,message)}`（既有 user 面）② `TimeoutError`（原生——timeout 面）
- * ③ `{abortTrigger:"cancel"|"stop"|"timeout"(,abortDetail)}`（新增——程序性中止）
- * ④ 缺失 / 无已知键（→ unknown——诊断告警态，不得静默）。
- */
-export function triggerOf(signal) {
-  const reason = signal?.reason
-  if (reason == null) return "unknown"
-  if (reason.interrupt === true) return "user"
-  if (reason.name === "TimeoutError" || reason.abortTrigger === "timeout") return "timeout"
-  if (reason.abortTrigger === "cancel") return "cancel"
-  if (reason.abortTrigger === "stop") return "stop"
-  return "unknown"
-}
-
-/**
- * 产生点错误（abort 面）：AbortError + `reason` 透传 + `abortInfo` 标注。
- * message 取既有通用文案（既有前缀断言零回归——死亡行前缀逐字保留）。
- */
-export function abortError(signal, layer, detail) {
-  const e = new DOMException("The operation was aborted", "AbortError")
-  e.reason = signal?.reason
-  e.abortInfo = { trigger: triggerOf(signal), layer, detail }
-  return e
-}
-
-/**
- * 产生点错误（定时器面）：自有 message + `abortInfo{trigger:"timeout"}`。
- * name 保持 "Error"（既有分类谓词——`AbortError` 分支——零变化）。
- */
-export function timeoutError(message, layer, detail) {
-  const e = new Error(message)
-  e.abortInfo = { trigger: "timeout", layer, detail }
-  return e
-}
-
-/**
- * 外部错误补标（undici / fetch 拒否等）：缺 `abortInfo` 才补（不覆盖产生点标注）；
- * 不改 `name` / `message`（消费面零回归）。
- * 第 4 参 detail 为站点名（站点表逐站点传——自由短串）。
- */
-export function annotateAbort(err, signal, layer, detail) {
-  if (err?.abortInfo) return err
-  try {
-    err.abortInfo = { trigger: triggerOf(signal), layer, detail: detail ?? "unrecorded" }
-  } catch { /* frozen error——保持未标注（合成器 unknown 告警兜底） */ }
-  return err
-}
-
-/** 死亡行长度上限（AGENT-LOOP.md §20.3 第 3 条——超长优先截 detail）。 */
-const MAX_LEN = 300
-/** unknown 形态 detail token（§20.3 第 3 条逐字）。 */
-const NO_REASON = "no reason on signal"
-/** 未标注回落 token（layer / detail 两面兜底）。 */
-const UNRECORDED = "unrecorded"
-
-/** 信号域 detail 回落（§20.3 第 1 条形态③——`abortDetail` 载站点名；错误未标注时仍可辨发起动作）。 */
-const detailOf = (signal) => (typeof signal?.reason?.abortDetail === "string" ? signal.reason.abortDetail : null)
-
-/** 求值链（§20.3 第 1 条：err.abortInfo → triggerOf(signal) → err.name 兜底）。 */
-function resolveAbort(err, signal) {
-  const info = err?.abortInfo
-  if (info?.trigger) return { trigger: info.trigger, layer: info.layer ?? UNRECORDED, detail: info.detail || null }
-  const fromSignal = triggerOf(signal)
-  if (fromSignal !== "unknown") return { trigger: fromSignal, layer: UNRECORDED, detail: detailOf(signal) }
-  if (err?.name === "TimeoutError") return { trigger: "timeout", layer: UNRECORDED, detail: detailOf(signal) }
-  // AbortError / 无名——告警态（unknown 显式，空后缀即违规）
-  return { trigger: "unknown", layer: UNRECORDED, detail: NO_REASON }
-}
-
-/** detail 裁剪：优先截 detail（budget = 上限内剩余字符）。 */
-function clipDetail(detail, budget) {
-  if (budget <= 0) return ""
-  return detail.length <= budget ? detail : detail.slice(0, Math.max(1, budget - 1)) + "…"
-}
-
-/**
- * 死亡行合成器（§20.3 第 3 条——报告面单点）：
- * `<原 message>[ ← cause: <cause.message>][ · abort(<trigger>@<layer>:<detail>)]`
- * - 原 message 前缀逐字保留（既有前缀 / 包含断言零回归）；
- * - 后缀出现条件 = `err.abortInfo` 存在 ∨ `signal?.aborted` ∨ `err.name ∈ {AbortError, TimeoutError}`；
- * - cause 段（P1）独立于后缀（"fetch failed" 类网络死亡真因同判）；
- * - 总长 ≤300 字符（超长先截 detail，仍超再截尾）。
- */
-export function deathLine(err, signal) {
-  let line = err?.message ?? String(err ?? "")
-  if (err?.cause?.message) line += ` ← cause: ${err.cause.message}`
-  const abortish = Boolean(err?.abortInfo) || Boolean(signal?.aborted) ||
-    err?.name === "AbortError" || err?.name === "TimeoutError"
-  if (abortish) {
-    const { trigger, layer, detail } = resolveAbort(err, signal)
-    const head = `${line} · abort(${trigger}@${layer}:`
-    // unknown 形态逐字用告警 token（§20.3 第 3 条——站点 detail 不进告警行）；非串 detail 归一化
-    const text = trigger === "unknown" ? NO_REASON : (detail == null ? UNRECORDED : String(detail))
-    line = `${head}${clipDetail(text, MAX_LEN - head.length - 1)})`
-  }
-  return line.length > MAX_LEN ? line.slice(0, MAX_LEN - 1) + "…" : line
-}

package/src/advisor/citations.mjs

@@ -1,139 +0,0 @@
-/**
- * citations.mjs — host-verified citation checking (decision d698434).
- * Extracted from advisor/run.mjs (file-size split). The evidence rule becomes
- * a host fact: every `file:line: content` reference in a review is mechanically
- * checked against the CURRENT disk state; mismatches mark the finding
- * unverified and cannot support a push-back.
- *
- * 第 11 批（C / F14 / §14.5）：解析候选 = cwd + **评审对象声明范围派生根**（声明仓根 /
- * 声明文件目录 / 声明目录——纯路径派生，零扫描、零 git）；命中判据三条件全中（围栏内 ∧
- * 可读 ∧ 目标行含引文内容）⇒ 零新增假命中。失败原因三分（file unreadable /
- * content mismatch @ path / path traversal）——父侧不再人肉复核。
- */
-import { readFileSync, realpathSync } from "node:fs"
-import { resolve, relative, dirname, extname, sep, isAbsolute, join } from "node:path"
-
-// `file:line: content` citations — the file group is narrowed to source/config
-// extensions so URLs (`example.com:8080: …`) don't become false-positive
-// citations that fail as "file unreadable" in the verification report.
-// Single-letter extensions (c/h) are kept — false positives (e.g. "a.c:1: x")
-// are rare and only add a failed-citation line to the report; the report is
-// advisory for the parent agent, never a crash path.
-const CITATION_RE = /([\w./\\-]+\.(?:mjs|cjs|js|ts|jsx|tsx|mts|cts|py|rs|go|c|h|cpp|hpp|java|rb|php|sh|bash|json|md|markdown|mdx|yaml|yml|toml|css|html)):(\d+):\s*([^`\n]{4,})/g
-
-/** Extract `file:line: content` citations from a review text. */
-export function extractCitations(text) {
-  const out = []
-  for (const m of text.matchAll(CITATION_RE)) {
-    out.push({ file: m[1], line: Number(m[2]), content: m[3].trim() })
-  }
-  return out
-}
-
-/** 候选解析根（§14.5——纯路径派生，候选顺序 = cwd → 各声明路径的派生根）：
- *  声明仓根（`cwd/<segs[0]>`）与 声明文件目录 / 声明目录本身。声明在 cwd 之外 → 不派生
- *  （relative 越出 cwd 或跨盘符——候选与声明脱节即假命中面）。 */
-function citationRoots(cwd, scope) {
-  const base = resolve(cwd)
-  const roots = [base]
-  for (const s of Array.isArray(scope) ? scope : []) {
-    if (typeof s !== "string" || !s.trim()) continue
-    const abs = resolve(base, s)
-    const rel = relative(base, abs)
-    if (!rel || rel.startsWith("..") || isAbsolute(rel)) continue
-    const segs = rel.split(/[\\/]/).filter(Boolean)
-    if (segs.length === 0) continue
-    const repoRoot = join(base, segs[0])
-    const declaredDir = extname(abs) ? dirname(abs) : abs
-    for (const r of [repoRoot, declaredDir]) if (!roots.includes(r)) roots.push(r)
-  }
-  return roots
-}
-
-/** 单引文解析（§14.5）：按候选顺序试 `resolve(root, file)`；三条件全中才算命中。
- *  @returns {{matched: true, root: string, resolved: string}|{matched: false, reason: string}} */
-function resolveCitation(citation, roots, base) {
-  const fence = base + sep
-  let mismatch = null
-  let traversal = false
-  for (const root of roots) {
-    let real
-    try {
-      // Path confinement: citation paths are LLM-generated — never trust them.
-      // A hallucinated "../config.json" would otherwise read (and leak via the
-      // report) files outside the project, including API-key configs.
-      // realpathSync resolves symlinks too — a link inside the project that
-      // points outside must not pass the prefix check.
-      real = realpathSync(resolve(root, citation.file))
-    } catch {
-      continue // 该候选无此文件（或不可解析）——试下一候选
-    }
-    if (!real.startsWith(fence)) { traversal = true; continue }
-    let line = ""
-    try {
-      line = readFileSync(real, "utf8").split("\n")[citation.line - 1] ?? ""
-    } catch {
-      continue // 存在但读不了（目录等）——按未命中处理，试下一候选
-    }
-    if (line.includes(citation.content)) {
-      return { matched: true, root, resolved: relative(base, real).split(sep).join("/") }
-    }
-    mismatch ??= real
-  }
-  if (mismatch) return { matched: false, reason: `content mismatch @ ${relative(base, mismatch).split(sep).join("/")}` }
-  if (traversal) return { matched: false, reason: "path traversal" }
-  return { matched: false, reason: "file unreadable" }
-}
-
-/**
- * Mechanically verify citations against the CURRENT file state: read the file,
- * take the exact line, check it CONTAINS the quoted content. Reports
- * N/M matched + the mismatches. Unverified citations cannot support a
- * push-back — the evidence rule becomes a host fact, not a prompt wish.
- * @param {string} text — the review text
- * @param {string} cwd — the agent's working directory (workspace root)
- * @param {{scope?: string[]}} [opts] — scope = 评审对象声明路径（documents + paths）；
- *   省略 ⇒ 旧行为（仅 cwd 候选——签名向后兼容）。
- */
-export function verifyCitations(text, cwd, opts = {}) {
-  const citations = extractCitations(text)
-  const matched = []
-  const failed = []
-  const base = resolve(cwd)
-  const roots = citationRoots(cwd, opts?.scope)
-  for (const c of citations) {
-    const r = resolveCitation(c, roots, base)
-    if (r.matched) {
-      // 命中根记录（§14.5）：经派生根解析（非 cwd 直解）的命中在报告中注明解析路径。
-      matched.push(r.root === base ? c : { ...c, root: r.root, resolved: r.resolved })
-    } else {
-      failed.push({ ...c, reason: r.reason })
-    }
-  }
-  return { total: citations.length, matched, failed }
-}
-
-/** Append the verification report to the review text (visible to the parent agent). */
-export function appendCitationReport(text, cwd, opts = {}) {
-  const { total, matched, failed } = verifyCitations(text, cwd, opts)
-  if (total === 0) return text // no citations — nothing to verify
-  const lines = [
-    "",
-    "---",
-    `[host-verified] ${matched.length}/${total} citations match current file state.`,
-  ]
-  // 命中根透明（F14/§14.5）：经声明范围派生根解析的命中逐条注明解析路径（cwd 直解的不列
-  // ——零噪音；列的正是修复前会被误报为 unreadable 的裸路径引用）。
-  const derived = matched.filter((c) => c.resolved)
-  if (derived.length > 0) {
-    lines.push("Citations resolved via the declared review scope (bare path — resolved root noted):")
-    for (const c of derived.slice(0, 10)) lines.push(`- ${c.file}:${c.line} → ${c.resolved}`)
-  }
-  if (failed.length > 0) {
-    lines.push("Citations that do NOT match the current file state (treat their claims as unverified):")
-    for (const f of failed.slice(0, 10)) {
-      lines.push(`- ${f.file}:${f.line}: ${f.content.slice(0, 80)}${f.reason ? ` (${f.reason})` : ""}`)
-    }
-  }
-  return text + lines.join("\n")
-}