thincoder 0.12.62 → 0.12.63

package/src/tui/cmd-new.mjs

@@ -1,4 +1,4 @@
-import { newSession, resetSessionState, bindRecordStore, slotPath } from "../session.mjs"
+import { newSession, resetSessionState, bindRecordStore, slotPath } from "@thincoder/core/session.mjs"
 import { C } from "./ansi.mjs"
 
 /** /new command: start a new session in a fresh slot.
@@ -6,8 +6,9 @@ import { C } from "./ansi.mjs"
 export async function handleNewCommand(ctx) {
   const { agent, state, pushLine, showPicker, render } = ctx
 
-  const doNewSession = () => {
-    const slot = newSession(agent.cwd)
+  // F-MI7：newSession = async（探测束）——doNewSession 随之为 async，调用点 await
+  const doNewSession = async () => {
+    const slot = await newSession(agent.cwd)
     // 2026-08-31 会诊 F3：resetSessionState 清全量会话态（_fullHistory/title/_sessionStart/
     // 多槽设计凭证（_engDesignTokens——单值镜像 _engDesignToken 已退役 D3）/压缩与验证计数
     // 等）——原实现只清 agent.history，新会话首次落盘把旧会话完整人类线 + 旧标题写进新
@@ -30,8 +31,8 @@ export async function handleNewCommand(ctx) {
       { type: "item", text: "Yes, start new session in a new slot", action: "yes" },
       { type: "item", text: "Cancel", action: "no" },
     ], { defaultIndex: 1 })
-    if (e?.action === "yes") doNewSession()
+    if (e?.action === "yes") await doNewSession()
     return
   }
-  doNewSession()
+  await doNewSession()
 }

package/src/tui/cmd-reindex.mjs

@@ -4,7 +4,7 @@ import { C } from "./ansi.mjs"
  *  ctx: { agent, distillOpts, pushLine } */
 export async function handleReindexCommand(ctx) {
   const { agent, distillOpts, pushLine } = ctx
-  const { syncDir, codeSync, docSync } = await import("../memory.mjs")
+  const { syncDir, codeSync, docSync } = await import("@thincoder/core/memory.mjs")
   pushLine("[reindex] Rebuilding index...", C.tool)
   agent.memory.db.prepare("DELETE FROM files").run()
   agent.memory.db.prepare("DELETE FROM code_chunks").run()

package/src/tui/cmd-restore.mjs

@@ -5,14 +5,14 @@ import { ansi, C } from "./ansi.mjs"
  *  (CHECKPOINT.md D8). ctx: { agent, showPicker, pushLine, pushLabel } */
 export async function handleRestoreCommand(ctx) {
   const { agent, showPicker, pushLine, pushLabel } = ctx
-  const { listCheckpoints, rewind, isGitRepo } = await import("../git/checkpoint.mjs")
+  const { listCheckpoints, rewind, isGitRepo } = await import("@thincoder/core/git/checkpoint.mjs")
   if (!isGitRepo(agent.cwd)) {
     pushLine("[rewind] not a git repository, checkpoints unavailable", C.error)
     return
   }
   // F6 lazy fallback——与 git 工具 checkpoint list/create 入口一致（git-checkpoint.mjs）：外部
   // git commit 后（HEAD 时间 > 最新快照）先清空过期快照，/restore 不列出 commit 前状态。
-  const { lazyClearIfCommitted } = await import("../tools/git-checkpoint.mjs")
+  const { lazyClearIfCommitted } = await import("@thincoder/core/tools/git-checkpoint.mjs")
   await lazyClearIfCommitted(agent.cwd)
   const cps = await listCheckpoints(agent.cwd)
   if (cps.length === 0) {

package/src/tui/cmd-session.mjs

@@ -1,4 +1,5 @@
-import { listSlots, switchToSlot, applySession, renameSlot, activeSlot, slotOccupancy, readEndMarker, sessionDescriptor } from "../session.mjs"
+import { listSlots, switchToSlot, applySession, renameSlot, activeSlot, slotOccupancy, readEndMarker, sessionDescriptor, loadSlotFile } from "@thincoder/core/session.mjs"
+import { resolveEngineeringManifest } from "@thincoder/core/manifest.mjs"
 import { ansi, C } from "./ansi.mjs"
 import { restoreLines } from "./startup.mjs"
 import { stringWidth, sliceByWidth } from "./render.mjs"
@@ -81,6 +82,26 @@ export async function handleSessionCommand(ctx) {
   // 2026-08-31 会诊 deepseek 🔴：目标槽被另一活进程占用时 switchToSlot 不认领（避免
   // 劫持对方 active），本次会话仍读到数据，但下次保存会 fork 到新槽——提前提示。
   const occ = slotOccupancy(agent.cwd, e.slot)
+  // #41 先判后切（MANIFEST.md §2.8 F3 · 父侧裁定 3）：目标槽**合值**（§2.2 会话权威值
+  // 「槽带 `engineering` 字段 ? 槽值 : `config.agent.engineering`」）=== true 时，判据前置于
+  // `switchToSlot`——判据落其后会留下「指针已切、会话未换」的半态（下次 `saveSession` 把旧
+  // 会话写回目标槽 = 跨槽覆盖）。预读 = `loadSlotFile`（**纯读**——无认领副作用）。
+  // 触发条件 = 合值（遗留槽（无 `engineering` 字段）自工程会话切入时合值 = true ⇒ 预判据
+  // 照触发——F3 触发条件口径）；槽不可读（preview null）不判：该次切换本就以「Slot not
+  // found」收场（switchToSlot 返回 null），无半态面。拒 ⇒ 切槽整体不发生（switchToSlot /
+  // applySession 均不调——零副作用）+ 原因行；准 ⇒ 既有切换 + applySession 之后一行附着。
+  const preview = loadSlotFile(agent.cwd, e.slot)
+  const slotEng = preview?.engineering
+  const targetEng = preview != null && (slotEng !== undefined ? slotEng === true : agent.config?.agent?.engineering === true)
+  let manifestAfterSwitch = null
+  if (targetEng) {
+    const r = resolveEngineeringManifest(agent.cwd, { writer: "main" })
+    if (!r.ok) {
+      pushLine(`Cannot switch to slot ${e.slot} — ${r.message} (slot unchanged)`, C.warn)
+      return
+    }
+    manifestAfterSwitch = r.manifest
+  }
   const data = switchToSlot(agent.cwd, e.slot)
   if (!data) {
     pushLine(`Slot ${e.slot} not found`, C.dim)
@@ -90,6 +111,8 @@ export async function handleSessionCommand(ctx) {
     pushLine(`⚠ Slot ${e.slot} is being used by another live process (${occ.owner}) — continuing here will create a new copy on the next save`, C.warn)
   }
   applySession(agent, data, occ.occupied ? {} : { slot: e.slot })
+  // #41 准翻列：附着动作 = 翻转面自己赋值（`agent.manifest` ← 判据结果——相位行当回合起活）。
+  if (manifestAfterSwitch) agent.manifest = manifestAfterSwitch
   // Rebuild from history (lazy) — the display snapshot is deprecated.
   // §14.3.6：描述符 { history（尾窗+±1）, total, base }——标签口径 = total（非窗口长度）；
   // 未绑定（占用分支——模式 F）回退全量数组。

package/src/tui/cmd-skills.mjs

@@ -4,7 +4,7 @@ import { ansi, C } from "./ansi.mjs"
  *  ctx: { agent, pushLine, pushLabel } */
 export async function handleSkillsCommand(ctx) {
   const { agent, pushLine, pushLabel } = ctx
-  const { loadSkills } = await import("../skills.mjs")
+  const { loadSkills } = await import("@thincoder/core/skills.mjs")
   const skills = await loadSkills(agent.cwd)
   pushLabel(`❯ Skills`, ansi.bold + C.tool)
   if (skills.length === 0) {

package/src/tui/cmd-think.mjs

@@ -5,7 +5,7 @@ import { ansi, C } from "./ansi.mjs"
 
 export async function handleThinkCommand(ctx, args = []) {
   const { agent, showPicker, syncProviderField, pushLine, pushLabel } = ctx
-  const { specForModel } = await import("../config.mjs")
+  const { specForModel } = await import("@thincoder/core/config.mjs")
 
   // Fast path: direct args — exit immediately
   const cur = agent.provider
@@ -33,7 +33,8 @@ export async function handleThinkCommand(ctx, args = []) {
     if (autoThinkEnabled) { pushLine("Auto-think is ON — manual settings are overridden each turn; turn Auto off first via /think", C.error); return }
     await applyThink({ action: "effort", level }, agent, syncProviderField, spec, isEffortOnly, isCustomThink, thinkOnValue)
     pushLabel("❯ Think", ansi.bold + C.tool)
-    pushLine(`Thinking effort: ${level}`, C.tool)
+    // none = 关思考档（applyThink 内归一到 off 路径）⇒ 回执同 off 文案，不比照档位报“…none”
+    pushLine(level === "none" ? "Thinking: OFF" : `Thinking effort: ${level}`, C.tool)
     return
   }
   if (sub) { pushLine("Usage: /think [on|off|effort <level>]", C.error); return }
@@ -78,18 +79,29 @@ export async function handleThinkCommand(ctx, args = []) {
       pushLine(`Auto-think: ${newAuto ? "ON" : "OFF"}`, C.tool)
       return // exit loop — no useful actions remain when auto mode just changed (T8b 锁定——toggle 即退是已批准语义——2026-09-05 曾误改 OFF 回菜单——测试抓回归——已撤销)
     } else if (e.action === "effort") {
-      pushLine(`Reasoning effort: ${e.level}`, C.tool)
+      pushLine(e.level === "none" ? "Thinking: OFF" : `Reasoning effort: ${e.level}`, C.tool)
     } else {
+      // 与菜单头（:47-48）同式：`thinking:null`（NF1 显式 off）必须落 OFF——本式缺 `!== null` 守卫时
+      // effort 型 off 后回执误报 ON（同一状态、两处公式——单一口径 = 面板式）。
       const nowEnabled = cur.thinking?.type === thinkOnValue
-        || (cur.thinking?.type === undefined && !isCustomThink)
+        || (cur.thinking !== null && cur.thinking?.type === undefined && !isCustomThink)
       pushLine(`Thinking: ${nowEnabled ? "ON" : "OFF"}`, C.tool)
     }
   }
 }
 
-/** Shared apply logic — extracted from handleThinkCommand for reuse in both fast path and loop */
-async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCustomThink, thinkOnValue) {
+/** Shared apply logic — extracted from handleThinkCommand for reuse in both fast path and loop.
+ *  Named export (2026-09-20): the on-default-effort rule (§2.8) is unit-tested by driving this
+ *  directly with a synthetic spec — behavior otherwise unchanged.
+ *  Effort 档位 `"none"` = 关思考 ⇒ 入口归一到 off 路径（与菜单 off 项同形——见内注释）。 */
+export async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCustomThink, thinkOnValue) {
   const cur = agent.provider
+  // `effort` 档位取 `"none"` = **关思考**（非“强度零”）：与本面 off 动作同语义 ⇒ 归一到 off 路径
+  // （各族取其原生 off 形：effort 型 = `thinking:null`＋删 effort；type 型 = `{type:"disabled"}`）。
+  // 不归一的两处违约：① 菜单头同拍显示「Thinking: ON | Effort: none」自相矛盾（off 标记缺失）；
+  // ② 残留 `reasoningEffort:"none"` 会被载荷层当强度档送（`provider/core.mjs:197-204`），与百炼
+  // qwen 侧 off 判据（`config.mjs:133-139` 的 `thinking === null ⇒ false`）错位 ⇒ 服务端仍思考。
+  if (e.action === "effort" && e.level === "none") e = { action: "off" }
   if (e.action === "auto") {
     const cfg = agent.config.agent ??= {}
     cfg.autoThink = !cfg.autoThink
@@ -113,9 +125,10 @@ async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCus
       // Explicit off persists thinking:null (NF1 convention — distinguishable from autoThink's
       // delete/undefined); "on" deletes the marker so enable_thinking maps from effort again.
       if (!enable) { cur.thinking = null; delete cur.reasoningEffort }
-      // "on" 默认 effort 取 spec 枚举首值（交付评审 #2）：硬编码 "high" 对 qwen3.8-max
-      // （enum xhigh/medium/low）无效，会被 core.mjs 枚举校验 throw（400 前置）
-      else { delete cur.thinking; if (!cur.reasoningEffort) cur.reasoningEffort = spec.reasoningEffortEnum?.[0] ?? "high" }
+      // "on" 默认 effort 取 spec 枚举的**首个非 "none"** 档（批次档 §1.8-② / 设计 §2.8 D-9）：硬编码 "high"
+      // 对 qwen3.8-max（enum xhigh/medium/low）无效，会被 core.mjs 枚举校验 throw（400 前置）；而直接取枚举
+      // 首项在新档（首项 "none"）等于把思考关掉 ⇒ 跳过 "none"；枚举全 "none" 时与无枚举同型 ⇒ 回退 "high"
+      else { delete cur.thinking; if (!cur.reasoningEffort) cur.reasoningEffort = spec.reasoningEffortEnum?.find((v) => v !== "none") ?? "high" }
       await syncProviderField(agent.activeProvider, "thinking", cur.thinking)
       if (!enable) await syncProviderField(agent.activeProvider, "reasoningEffort", undefined)
       else await syncProviderField(agent.activeProvider, "reasoningEffort", cur.reasoningEffort)

package/src/tui/config-helpers.mjs

@@ -11,7 +11,7 @@ export function createConfigHelpers(agent, opts = {}) {
   /** 磁盘新鲜读 → mutate（单操作）→ mtime 门控写；冲突时 throw（提示语见下——TUI
    *  slash 分发层统一 [error] 行展示；调用方若自带 try/catch 展示 Save failed 同文案）。 */
   async function persistRaw(mutate) {
-    const { writeConfigAtomic, configPath } = await import("../config.mjs")
+    const { writeConfigAtomic, configPath } = await import("@thincoder/core/config.mjs")
     const r = writeConfigAtomic(cfgPath ?? configPath, mutate)
     if (!r.ok) throw new Error("config changed on disk concurrently — retry")
   }

package/src/tui/display-budget.mjs

@@ -3,17 +3,17 @@
  *
  * 职责（§15.3.2）：常量单源（D-TB4）+ 行/载体计长（`lineChars`）+ `state.lines` 总量
  * 对账（`syncLineBudget`）。纯函数本体（`capText` / `appendCappedText`）住
- * `src/text-budget.mjs`（零依赖）——与 agent 侧捕获共用（AGENT-LOOP.md §23.3.1，D2 单源）；
+ * `thincoder-core/text-budget.mjs`（零依赖）——与 agent 侧捕获共用（AGENT-LOOP.md §23.3.1，D2 单源）；
  * 本模块只承载 TUI 面常量与对账。
  *
- * 依赖方向：本模块只引 `./ansi.mjs` + `../text-budget.mjs`（叶子——不引 subagent 族，
+ * 依赖方向：本模块只引 `./ansi.mjs` + `@thincoder/core/text-budget.mjs`（叶子——不引 subagent 族，
  * 冻结锚点平移由调用方经 `onTrim` 注入，避环）。
  *
  * 计量口径 = UTF-16 码元（`String.length`——TUI.md §15.2 表 1）；行数维（5000 行环 /
  * 500 行块环 / 200 条目环）**原样保留**，字符维为第二维（D-TB5——既有 N5/N6 语义不动）。
  */
 import { C } from "./ansi.mjs"
-import { capText, appendCappedText, fillMarker } from "../text-budget.mjs"
+import { capText, appendCappedText, fillMarker } from "@thincoder/core/text-budget.mjs"
 
 export { capText }
 
@@ -35,8 +35,10 @@ export const SUB_BLOCK_CHAR_LIMIT = 128_000
 export const ADVISOR_TEXT_MAX_CHARS = 128_000
 /** 流式缓冲（`state.streaming` / `state.reasoning`）累积额度。 */
 export const STREAM_MAX_CHARS = 256_000
-/** `state.lines` 全部行与载体文本总量（超出：与 5000 行环同款裁头 1000 行 + 收据行）。 */
+/** `state.lines` 全部行与载体文本总量（超出：最小步进裁头 + 冻结锚点平移 + 收据行——保底见下行）。 */
 export const LINES_CHAR_BUDGET = 2_000_000
+/** 字符超额裁剪保底行数——裁剪不得使 `state.lines` 低于该值；触底仍未脱额即停（接受超额——上界 = 保底 × 单行上限）。 */
+export const LINES_TRIM_FLOOR = 200
 /** 搜索匹配计数上限（超出截断 + 提示行）。 */
 export const SEARCH_MATCH_CAP = 10_000
 
@@ -140,6 +142,14 @@ export function accountLine(state, l) {
   l._budgetChars = next
 }
 
+/** 行移除负向出账（§5.5 记账口径——增删均须过账；不变式 `_linesChars === Σ lineChars`）：
+ *  `state._linesChars -= lineChars(l)`，钳 0。与 `accountLine` 不可互替——后者以行对象
+ *  `_budgetChars` 幂等（行从 `state.lines` 脱落后重调增量恒 0 ⇒ 账不降），移除需本导出。 */
+export function releaseLine(state, l) {
+  if (!l) return
+  state._linesChars = Math.max(0, (state._linesChars ?? 0) - lineChars(l))
+}
+
 /** 直算对账（双算法对照 / 初始化 / 漂移自愈——测试直算同源）。 */
 export function accountAll(state) {
   let total = 0
@@ -152,10 +162,19 @@ export function accountAll(state) {
   return total
 }
 
+/** 收据行长度预留（`syncLineBudget` 单轮 need 计入的收据余量：前缀 32 + N 数字位 + 尾 17 < 96——覆 7 位数余量）。 */
+const RECEIPT_RESERVE_CHARS = 96
+
 /**
- * `state.lines` 总量对账（§15.3.3 落点表末行）：超 `LINES_CHAR_BUDGET` → 与 5000 行环
- * 同款裁头 1000 行 + 收据行；`onTrim(state, removedCount)` 由调用方注入冻结锚点平移
- * （display-budget 不引 subagent 族——避环）。幂等（未超限零动作）。
+ * `state.lines` 总量对账（§15.3.3 落点表末行）：超 `LINES_CHAR_BUDGET` → **最小步进**裁头 +
+ * 收据行，且不使 `lines.length` 低于 `LINES_TRIM_FLOOR`（触底 = 内层 break——接受超额，
+ * 不靠守卫退出：FLOOR+1 且残余超额时守卫仍为真）。每轮裁「至额度内所需最少行数」
+ * （need = 超额 + 收据上界预留；上限 = 可裁至保底的行数）；`onTrim(state, removedCount)` 由
+ * 调用方注入冻结锚点平移（display-budget 不引 subagent 族——避环）。`pushLineLike` 注入面（无生产调用）：
+ * 仅**头插**语义下自洽——尾插会使收据位置、收据 N 口径与「净位移 = 丢行数 − 1」约定失真。
+ * 幂等（未超限 / 行数 ≤ 保底）。
+ * 旧颗粒 `min(1000, lines.length-1)` 在行数 ≤1001 且超额时一轮裁到 1 行（用户实测收据
+ * 「1 lines remaining」——TUI-HISTORY-TRIM 批修复：保底 200 + 最小步进）。
  * @returns {number} 本轮裁掉的行数
  */
 export function syncLineBudget(state, { pushLineLike = null, onTrim = null } = {}) {
@@ -163,11 +182,13 @@ export function syncLineBudget(state, { pushLineLike = null, onTrim = null } = {
   if (!Array.isArray(lines)) return 0
   if (!Number.isFinite(state._linesChars)) accountAll(state)
   let removed = 0
-  while (state._linesChars > LINES_CHAR_BUDGET && lines.length > 1) {
-    const take = Math.min(1000, lines.length - 1)
-    const dropped = lines.splice(0, take)
+  while (state._linesChars > LINES_CHAR_BUDGET && lines.length > LINES_TRIM_FLOOR) {
+    const limit = lines.length - LINES_TRIM_FLOOR
+    const need = state._linesChars - LINES_CHAR_BUDGET + RECEIPT_RESERVE_CHARS
+    let take = 0
     let freed = 0
-    for (const l of dropped) freed += lineChars(l)
+    while (take < limit && freed < need) { freed += lineChars(lines[take]); take++ }
+    lines.splice(0, take)
     state._linesChars = Math.max(0, state._linesChars - freed)
     removed += take
     const receipt = `... [earlier messages trimmed — ${lines.length} lines remaining]`
@@ -179,6 +200,7 @@ export function syncLineBudget(state, { pushLineLike = null, onTrim = null } = {
       state._linesChars += receipt.length
     }
     if (typeof onTrim === "function") onTrim(state, take)
+    if (take >= limit) break // 触底（可裁上限用尽）——接受超额；收敛靠本 break，不靠守卫退出
   }
   return removed
 }

package/src/tui/index.mjs

@@ -20,8 +20,8 @@
 
 import { emitKeypressEvents } from "node:readline"
 import { PassThrough } from "node:stream"
-import { saveSession } from "../session.mjs"
-import { closeAllMcp } from "../mcp.mjs"
+import { saveSession } from "@thincoder/core/session.mjs"
+import { closeAllMcp } from "@thincoder/core/mcp.mjs"
 import { ansi, C } from "./ansi.mjs"
 import { createRenderLoop } from "./render-loop.mjs"
 import { makeDimsState } from "./dims.mjs"
@@ -45,11 +45,11 @@ import { startLedgerSurface } from "./ledger-surface.mjs"
 export { upgradeFailureText, pendingNoticeReady } from "./update-notice.mjs"
 
 /**
- * SESSION.md §8 D-S2 — TUI 启动首帧前的 provider 重选流程：
+ * SESSION.md §6.8 D-S2 — TUI 启动首帧前的 provider 重选流程：
  * provider 无效（`_providerInvalid` 标记或 provider 为 null）→ 先弹模型选择 picker
  * （复用 openModelPicker，展示当前可用 providers）；用户选定后继续正常启动。
- * 选择取消（Esc）→ 仍进入 TUI，推送提示行（"未配置有效 provider，可用 /model 选择或
- * /provider 配置"）——绝不因无 provider 拒绝进入。返回 true 表示弹过选择流程。
+ * 选择取消（Esc）→ 仍进入 TUI，推送提示行（"未配置有效 provider，可用 /model 配置
+ * 渠道与模型"）——绝不因无 provider 拒绝进入。返回 true 表示弹过选择流程。
  */
 export async function promptProviderIfInvalid(agent, openModelPicker, pushLine) {
   if (!(agent._providerInvalid || !agent.provider)) return false
@@ -60,7 +60,7 @@ export async function promptProviderIfInvalid(agent, openModelPicker, pushLine)
     const hasProviders = (agent.providers?.length ?? 0) > 0
     pushLine(hasProviders && !agent.config?.defaultModel
       ? "尚未设置默认模型（config.defaultModel——新会话起点）：/config → 默认模型 设置一次；/model 仅改本会话"
-      : "未配置有效 provider，可用 /model 选择或 /provider 配置", C.warn)
+      : "未配置有效 provider，可用 /model 配置渠道与模型", C.warn)
   }
   return true
 }
@@ -406,7 +406,7 @@ export async function startTUI(agent, opts = {}) {
   const { persistRaw, syncProviderField, maskKey } = createConfigHelpers(agent)
 
   // Model picker + generic picker: implemented in pickers.mjs
-  const { closePicker, showPicker, popPicker, renderPickerLines, openModelPicker, selectModel, setProviderKey, pickModelForSlot } = createPickers({
+  const { closePicker, showPicker, popPicker, renderPickerLines, openModelPicker, selectModel, setProviderKey, pickModelForSlot, confirmDelete } = createPickers({
     agent, state, render, ansi, C, pushLine, pushLabel, persistRaw, askQuestion, maskKey,
   })
 
@@ -423,7 +423,7 @@ export async function startTUI(agent, opts = {}) {
   const { handleSlash, completions, handleTab } = createSlashCommands({
     agent, state, distillOpts,
     pushLine, pushLabel, render,
-    showPicker, closePicker, askQuestion, askPermission,
+    showPicker, closePicker, askQuestion, askPermission, confirmDelete,
     persistRaw, syncProviderField, maskKey,
     openModelPicker: () => openModelPicker(),
     selectModel,
@@ -458,7 +458,7 @@ export async function startTUI(agent, opts = {}) {
 
   // ---------------------------------------------------------- Startup screen + background indexing
 
-  // SESSION.md §8 D-S2：startTUI 首帧前 —— provider 无效（_providerInvalid / provider 为 null）
+  // SESSION.md §6.8 D-S2：startTUI 首帧前 —— provider 无效（_providerInvalid / provider 为 null）
   // → 先弹模型选择 picker（keyStream 已挂 keypress，Esc/Enter 可用）；Esc → 提示行，仍进 TUI
   await promptProviderIfInvalid(agent, () => openModelPicker(), pushLine)
 

package/src/tui/interaction.mjs

@@ -1,5 +1,6 @@
 import { ansi, C } from "./ansi.mjs"
-import { detectDanger } from "../tools/shared.mjs"
+import { detectDanger } from "@thincoder/core/tools/shared.mjs"
+import { askPermission as coreAskPermission } from "@thincoder/core/permission.mjs"
 
 /** Interaction primitives: permission approval + question input.
  *  Extracted from index.mjs, receives closure dependencies via createInteraction(ctx).
@@ -9,6 +10,11 @@ import { detectDanger } from "../tools/shared.mjs"
  *  answer mode (the user supplements/corrects the AI's preset choices). */
 export const QUESTION_CUSTOM = "\u0001custom-answer"
 
+/** y/n-only modal family（判据单源——key-modes / render-frame 同引）：`continue`（回合帽）
+ *  与 `retry`（provider 失败面）同形 ⇒ 仅 `y` / `n`。`a` 不属该族键面（会翻会话级 AUTO）。 */
+const YES_NO_MODALS = new Set(["continue", "retry"])
+export function isYesNoModal(name) { return YES_NO_MODALS.has(name) }
+
 export function createInteraction(ctx) {
   const { agent, state, pushLine, pushLabel, render, summarize } = ctx
 
@@ -62,12 +68,15 @@ export function createInteraction(ctx) {
       pushLine(`  [auto] ${name}${argSummary ? ` ${argSummary}` : ""}`, C.warn)
       return Promise.resolve(true)
     }
-    // store preview content in permissionPreview, rendered above input box next to "Allow?" prompt
-    state.permissionPreview = formatPermission(name, args)
-    return new Promise((resolve) => {
-      state.permission = { name, args, resolve }
-      state.status = `Waiting: ${name}`
-      render()
+    // 闸语义 / 请示流程 = 核单源（P2 批 §2.20）；本端只供展示面——卡片预览经 `io.ask` 缝
+    // 注入（permissionPreview 渲染在输入框上方，与 "Allow?" 提示同帧）。
+    return coreAskPermission(name, args, {
+      ask: ({ name: n, toolArgs }) => new Promise((resolve) => {
+        state.permissionPreview = formatPermission(n, toolArgs)
+        state.permission = { name: n, args: toolArgs, resolve }
+        state.status = `Waiting: ${n}`
+        render()
+      }),
     })
   }
 

package/src/tui/key-modes.mjs

@@ -7,7 +7,7 @@
  */
 import { C } from "./ansi.mjs"
 import { readClipboardText, insertPastedText } from "./clipboard.mjs"
-import { QUESTION_CUSTOM } from "./interaction.mjs"
+import { QUESTION_CUSTOM, isYesNoModal } from "./interaction.mjs"
 import { inputContentWidth } from "./layout.mjs"
 import { moveCursorVertical } from "./render.mjs"
 
@@ -35,14 +35,19 @@ export function denyModalForOwner(state, key, { pushLine, render } = {}) {
 }
 
 /** permission 确认模态：y/n/a（a = approve + AUTO ON）；batch（§16 D-B1）：a/o/n（Esc = deny）。
+ *  `continue` / `retry` = y/n-only 族（判据单源 `isYesNoModal`——X8 跟进①：`retry` 框不
+ *  广告 `a`，零会话级 AUTO 副作用）。
  *  consume：valid 键或 Esc 走 resolve 分支；其余键静默吞掉（模态独占）。 */
 export function handlePermissionMode(str, key, ctx) {
   const { state, agent, pushLine, render } = ctx
   if (!state.permission) return false
   const answer = (str || "").toLowerCase()
+  // `yOnly` = 本框键面仅 y/n（continue / retry）；`isContinue` 仅保轨迹行豁免（continue 有
+  // 自有输出行——retry **保留** `[approved]` / `[denied]` 轨迹行）。
   const isContinue = state.permission.name === "continue"
+  const yOnly = isYesNoModal(state.permission.name)
   const isBatch = Boolean(state.permission.batch)
-  const validKeys = isContinue ? ["y", "n"] : isBatch ? ["a", "o", "n"] : ["y", "n", "a"]
+  const validKeys = yOnly ? ["y", "n"] : isBatch ? ["a", "o", "n"] : ["y", "n", "a"]
   if (validKeys.includes(answer) || key.name === "escape") {
     const { resolve, name } = state.permission
     state.permission = null
@@ -58,13 +63,13 @@ export function handlePermissionMode(str, key, ctx) {
       render()
       return true
     }
-    if (answer === "a" && !isContinue) {
+    if (answer === "a" && !yOnly) {
       agent.autoApprove = true
       agent._pendingReminders = agent._pendingReminders ?? []
       agent._pendingReminders.push("[System reminder: AUTO mode is now ON. All tool calls are automatically approved. Use /auto to disable.]")
       pushLine(`  [auto] AUTO ON: tool calls no longer prompt for approval (/auto to disable)`, C.warn)
     }
-    const approved = answer === "y" || (answer === "a" && !isContinue)
+    const approved = answer === "y" || (answer === "a" && !yOnly)
     // leave trail: record approval/denial in conversation (continue prompt has its own output, don't duplicate)
     if (!isContinue) {
       pushLine(`  [${approved ? "approved" : "denied"}] ${name}`, approved ? C.dim : C.error)

package/src/tui/ledger-surface.mjs

@@ -5,21 +5,35 @@
  * 越线 / 池达阈值——一次性去重 + **送达门**：未送达不记账）③ 状态位（`state.ledger`——L1
  * 常驻标记，`render-frame.mjs` 消费；**不受启动行门约束**——F2 按标记态照显）。
  * 只读台账；唯一写面 = 去重档（`~/.thincoder/ledger-notify.json`）。
+ *
+ * M2/KD-M2-3：核台账面**动态 import**（`@thincoder/core/ledger.mjs` 静态链 `node:sqlite`——
+ * 静态 import 会把 `node:sqlite` 拽进端壳静态面）；载入失败 = 降级不崩（N1），扫描拍重试。
  */
-import { blameAges, detailScans, discoverFamily, formatDetailLine, formatMarker, loadNotifyState, NOTIFY_FILE, notifyKey, planChangeLines, REFRESH_MS, saveNotifyState, summarizeLedger } from "../ledger.mjs"
 import { C } from "./ansi.mjs"
 
+/** 核台账面惰性载入（KD-M2-3 动态 import——失败不缓存，下次扫描拍重试；N1 降级不崩）。 */
+let _core = null
+function loadCore() {
+  if (!_core) {
+    _core = import("@thincoder/core/ledger.mjs")
+    _core.catch(() => { _core = null })
+  }
+  return _core
+}
+
 /** 单次扫描（直驱面——timer 包装见 `startLedgerSurface`）。
  *  `startup=true` = 会话首扫（补启动行；变化行在前、明细行在后）。 */
-export function runLedgerScan({ state, agent = null, anchor = null, notifyFile = NOTIFY_FILE, pushLine = () => {}, render = () => {}, startup = false, ageOf = blameAges } = {}) {
+export async function runLedgerScan({ state, agent = null, anchor = null, notifyFile = undefined, pushLine = () => {}, render = () => {}, startup = false } = {}) {
+  const core = await loadCore()
+  const { buildScan, detailScans, discoverFamily, formatDetailLine, formatMarker, loadNotifyState, NOTIFY_FILE, notifyKey, planChangeLines, saveNotifyState } = core
   const base = anchor ?? agent?.cwd ?? process.cwd()
   const family = discoverFamily(base)
   const scans = []
   for (const p of family.projects) {
-    try { scans.push(summarizeLedger(p, { ageOf })) } catch { /* 台账不可读 → 该项目跳过（余者照常——N1/T110①） */ }
+    try { scans.push(buildScan({ cwd: p.root })) } catch { /* 台账不可读 → 该项目跳过（余者照常——N1/T110①） */ }
   }
   const current = family.current ? scans.find((s) => s.root === family.current.root) ?? null : null
-  const notify = loadNotifyState(notifyFile)
+  const notify = loadNotifyState(notifyFile ?? NOTIFY_FILE)
   const plans = scans.map((s) => ({ s, plan: planChangeLines(notify.ledgers[notifyKey(s.ledger)], s) }))
   const changeLines = plans.flatMap(({ plan }) => plan.lines)
   const showStartup = startup && scans.some((s) => s.actionable)
@@ -38,7 +52,7 @@ export function runLedgerScan({ state, agent = null, anchor = null, notifyFile =
   if (changeLines.length ? delivered : changed) {
     const ledgers = { ...notify.ledgers }
     for (const { s, plan } of plans) ledgers[notifyKey(s.ledger)] = { ...plan.next, updatedAt: Date.now() }
-    saveNotifyState(notifyFile, { version: 1, ledgers })
+    saveNotifyState(notifyFile ?? NOTIFY_FILE, { version: 1, ledgers })
   }
   state.ledger = { marker: current ? formatMarker(current) : null, warn: Boolean(current && current.aged > 0), scannedAt: Date.now() }
   render()
@@ -48,15 +62,17 @@ export function runLedgerScan({ state, agent = null, anchor = null, notifyFile =
 export function startLedgerSurface(ctx = {}) {
   let disposed = false
   let timer = null
-  const tick = (startup) => {
+  const tick = async (startup) => {
     if (disposed) return
-    if (!startup && ctx.state?.processing) return // git 子进程不打断回合帧
-    try { runLedgerScan({ ...ctx, startup }) } catch { /* 可见面尽力——不崩 TUI（N1） */ }
+    if (!startup && ctx.state?.processing) return // 扫描不打断回合帧
+    try { await runLedgerScan({ ...ctx, startup }) } catch { /* 可见面尽力——不崩 TUI（N1） */ }
   }
-  setImmediate(() => {
+  setImmediate(async () => {
     if (disposed) return
     tick(true)
-    timer = setInterval(() => tick(false), REFRESH_MS)
+    const core = await loadCore().catch(() => null)
+    if (disposed || !core) return // 载入失败 → 无周期（N1——降级不崩）
+    timer = setInterval(() => tick(false), core.REFRESH_MS)
     timer.unref?.()
   })
   return {

package/src/tui/model-catalog.mjs

@@ -1,7 +1,7 @@
 /**
  * model-catalog.mjs — 会话级模型清单 helper（PROVIDER.md §16.2 M2/M9——2026-09-10 MODEL-SELECTION）。
  *
- * 清单唯一权威 = provider 运行期拉取（`GET /models`——provider/list-models.mjs 按 format 分派）。
+ * 清单唯一权威 = provider 运行期拉取（`GET /models`——thincoder-core/provider/list-models.mjs 按 format 分派）。
  * 本模块提供：
  * - `getProviderModels(providerConfig)`：拉取 + **会话级缓存**（TTL 60s；失败不缓存——下次重试）；
  * - `probeChannelModels(providerConfig)`：配置阶段准入探（M9——探通入缓存候选直接可用 / 探不通返回
@@ -9,14 +9,14 @@
  * - `modelListFailureText(error)`：M8 失败消息本体（逐字长句——界面明示的唯一断言对象）；
  * - `dedupeModels` / `modelSeries`：显示归并（自 model-picker.mjs 迁入——会话面与槽位面共用）。
  *
- * 缓存时钟可注入（`_catalogHooks.now`——先例 rate.mjs `_rateHooks`）：测试假时钟确定性断言 T6 不依赖壁钟。
+ * 缓存时钟可注入（`_catalogHooks.now`——先例 thincoder-core/provider/rate.mjs `_rateHooks`）：测试假时钟确定性断言 T6 不依赖壁钟。
  */
-import { listModels } from "../provider/list-models.mjs"
+import { listModels } from "@thincoder/core/provider/list-models.mjs"
 
 /** 会话级缓存 TTL（§16.4 a2：连续操作不重复付网络；60s 新鲜窗口）。 */
 const CACHE_TTL_MS = 60_000
 
-/** 测试钩子（先例 `rate.mjs` `_rateHooks`）：时钟可注入——T6 假时钟断言。 */
+/** 测试钩子（先例 thincoder-core/provider/rate.mjs `_rateHooks`）：时钟可注入——T6 假时钟断言。 */
 export const _catalogHooks = { now: () => Date.now() }
 
 /** 会话内缓存：key = name + baseURL（同渠道不同端点各自成条）；value = { models, at }。 */

package/src/tui/model-picker.mjs

@@ -10,16 +10,16 @@
  * 渠道管理流（add/remove/key/context）是 provider 级 config 写——语义不变。F-4 (ISSUE-FIX-BATCH)：
  * removeProviderFlow 级联清理悬挂引用（cascadeRemoveProvider——文件尾导出）。
  * ctx: { agent, state, render, ansi, C, pushLine, persistRaw, askQuestion, maskKey, showPicker,
- *      closePicker, renderPickerLines }（后三者为 pickers.mjs 通用 picker 绑定——闭包入参，环安全）。
+ *      closePicker, renderPickerLines, confirmDelete }（后四者为 pickers.mjs 通用 picker 绑定——闭包入参，环安全）。
  */
 import { sliceByWidth } from "./render.mjs"
-import { PROVIDER_PRESETS as PRESETS, providerSpec, specMatch } from "../config.mjs"
-import { saveSession } from "../session.mjs"
+import { PROVIDER_PRESETS as PRESETS, providerSpec, specMatch } from "@thincoder/core/config.mjs"
+import { saveSession } from "@thincoder/core/session.mjs"
 import { getProviderModels, probeChannelModels, modelListFailureText, dedupeModels } from "./model-catalog.mjs"
 
 /** createModelPicker(ctx) → { openModelPicker, selectModel, setProviderKey, setContextFlow, pickModelForSlot } */
 export function createModelPicker(ctx) {
-  const { agent, state, pushLine, persistRaw, askQuestion, maskKey, showPicker, closePicker, renderPickerLines } = ctx
+  const { agent, state, pushLine, persistRaw, askQuestion, maskKey, showPicker, closePicker, renderPickerLines, confirmDelete = () => { throw new Error("ctx.confirmDelete missing — deletion refused (fail-closed)") } } = ctx
   const { ansi, C } = ctx
 
   /** entry 唯一标识：异步更新 entries 后按它恢复选中项 */
@@ -231,7 +231,7 @@ export function createModelPicker(ctx) {
     agent.provider = { ...target }
     agent.provider.model = item.model
     if (agent.config?.agent?.compactThresholdAuto) {
-      const { resolveCompactThreshold } = await import("../config.mjs")
+      const { resolveCompactThreshold } = await import("@thincoder/core/config.mjs")
       agent.config.agent.compactThreshold = resolveCompactThreshold(null, agent.provider).value
     }
     // 写会话槽（saveSession——槽双字段恒非空）——config 文件零写
@@ -280,7 +280,7 @@ export function createModelPicker(ctx) {
   /** Slot 面 fetch：模型直接并入可选行（旧 pickModelForSlot 语义——自由面；槽位面零改——
    *  仅随 M1 获得三 format 支持 + 占位行（同会话面：0 item 的 picker 不会打开））。 */
   async function fetchSlotModels(providerName, providerConfig, entries) {
-    const { listModels } = await import("../provider/index.mjs")
+    const { listModels } = await import("@thincoder/core/provider/index.mjs")
     let selKey = null
     try {
       const models = await listModels(
@@ -379,6 +379,7 @@ export function createModelPicker(ctx) {
       ...candidates.map((p) => ({ type: "item", text: `${p.name} (${defaultModelLabel(p)})`, name: p.name })),
     ])
     if (!se) return
+    if (!(await confirmDelete(`Remove provider ${se.name}?`))) return
     await persistRaw((raw) => {
       raw.providers ??= []
       const idx = raw.providers.findIndex((p) => p?.name === se.name)
@@ -460,7 +461,7 @@ export function createModelPicker(ctx) {
       if (newCtx === undefined) delete agent.provider.context
       else agent.provider.context = newCtx
       if (agent.config?.agent?.compactThresholdAuto) {
-        const { resolveCompactThreshold } = await import("../config.mjs")
+        const { resolveCompactThreshold } = await import("@thincoder/core/config.mjs")
         agent.config.agent.compactThreshold = resolveCompactThreshold(null, agent.provider).value
       }
     }