thincoder 0.12.62 → 0.12.63

package/src/advisor/project-context.mjs

@@ -1,194 +0,0 @@
-/**
- * advisor/project-context.mjs — project-context discovery and injection for review
- * messages (Project Guide, document map, project standards, change-set context).
- *
- * Split out of messages.mjs (the split registered as D-1 in ENGINEERING-MODE.md
- * §2.26.3, trigger "thicken again" — met by this batch). messages.mjs keeps its
- * pre-split surface via re-export; this module is consumed by it only.
- *
- * Portability contract (PORTABILITY FR10/FR11 · PO-1/PO-2 · P8): every discovery
- * step here is either satisfied or DEGRADED VISIBLY. The old code probed a fixed
- * `docs/README.md` and a fixed `METHODOLOGY.md` and skipped injection silently when
- * absent — in a project with a different layout the reviewer still scored the
- * dimension it could no longer check (silent failure, the worst class: invisible
- * and unfixable by the user). Missing pieces now say so, and the reviewer is told
- * to state the limitation in its findings. Projects can point at their own files
- * through `.thincoder/conventions.json` (advisor.docMap / advisor.standardsDoc).
- */
-import { readFileSync, existsSync } from "node:fs"
-import { resolve, join, relative, dirname, sep } from "node:path"
-import { providerSpec } from "../config.mjs"
-import { loadConventions } from "../conventions.mjs"
-
-/** Project guide (AGENTS.md) injection budget — decision 2026-08-08:
- *  NO fixed truncation; long-context models (1M+) get up to 5% of their context
- *  window for the doc map, small windows still get a floor so the map is always
- *  visible. The map is what tells the reviewer WHERE the requirements docs live
- *  (requirement-fit is judged against those docs, not the conversation only). */
-const PROJECT_GUIDE_MIN = 8192 // chars — floor for small-window models
-const PROJECT_GUIDE_FRACTION = 0.05 // 5% of the reviewer model's context window
-
-/** Absent-AGENTS.md notice (guide is optional: the conversation carries intent). */
-export const NO_GUIDE_NOTICE = "(No AGENTS.md found — neither at the working directory root nor in any review-scope subdirectory. Judge the user's requirements from the conversation background, and say so explicitly if the requirements are unclear.)"
-
-/** Explicit degradation sentences (PORTABILITY design §4.4 — verbatim). */
-export const NO_DOC_MAP_NOTICE = "(No document map found under the project root, and none is declared — the Document ownership criterion is degraded: check placement against the Project Guide where present, and state the limitation in your findings.)"
-export const NO_STANDARDS_NOTICE = "(No project standards document was declared — judge methodology compliance from the Project Guide (when present) and the review criteria above; state the limitation in your findings.)"
-export const NO_GIT_NOTICE = "(No git repository detected — change-set context is unavailable; read the review-scope files directly.)"
-
-/**
- * Discover the project root for the review — user decision 2026-08-08:
- * the project root is a SUBDIRECTORY of the working directory, never an
- * ancestor above it. Priority:
- *   1. Walk UP from each review-scope file's directory, bounded by cwd —
- *      the NEAREST AGENTS.md inside the workspace wins. In a monorepo this is
- *      the subproject's own doc map even when cwd itself has an AGENTS.md
- *      (a workspace-level meta map must not shadow the subproject guide).
- *   2. No scope files / nothing found → cwd (single project; the walk's
- *      last step naturally lands on cwd's own AGENTS.md when it exists).
- * @param {string} cwd — the agent's working directory (workspace root)
- * @param {string[]} scopeFiles — cwd-relative review-scope paths (may be empty)
- * @returns {string|null} absolute project root with an AGENTS.md, or null
- */
-export function findProjectRoot(cwd, scopeFiles) {
-  // Normalize separators before comparing: input paths may use either
-  // convention (join() → "\\" on Windows; tool args / tests → "/"). Mixed
-  // styles made isInside(cwd + sep) miss legitimately nested paths.
-  const norm = (p) => p.replaceAll("\\", "/")
-  const isInside = (dir) => {
-    const d = norm(dir)
-    const c = norm(cwd)
-    return d === c || d.startsWith(c + "/")
-  }
-  for (const f of scopeFiles) {
-    let dir = dirname(resolve(cwd, f))
-    while (isInside(dir) && dir !== dirname(dir)) {
-      if (existsSync(join(dir, "AGENTS.md"))) return dir
-      dir = dirname(dir)
-    }
-  }
-  // No scope files, or none found in the walk — cwd itself (its AGENTS.md is
-  // checked as the walk's final step for scope files; for empty scopes, check
-  // it explicitly so a bare cwd project still gets its guide).
-  if (existsSync(join(cwd, "AGENTS.md"))) return cwd
-  return null
-}
-
-/**
- * Inject the project guide (AGENTS.md) into the review message. AGENTS.md is the
- * project's doc map — it defines the structure and where requirements/design
- * documents live. The reviewer must see it FIRST: requirement-fit is judged
- * against the documents it points to, with the conversation background as a
- * supplement. Absent AGENTS.md degrades honestly (no pretending there is a map).
- * @param {Object} agent — the parent agent
- * @param {string[]} parts — message parts (mutated)
- * @param {string[]} [scopeFiles] — cwd-relative review-scope paths for project-root discovery
- * @returns {string|null} the discovered project root (abs), or null when no guide
- */
-export function injectProjectGuide(agent, parts, scopeFiles = []) {
-  parts.push("## Project Guide (AGENTS.md)")
-  const root = findProjectRoot(agent.cwd, scopeFiles)
-  const path = root ? join(root, "AGENTS.md") : null
-  let text
-  if (!path) {
-    parts.push(NO_GUIDE_NOTICE)
-    parts.push("")
-    return null // no guide — requirement-fit falls back to the conversation
-  }
-  try {
-    text = readFileSync(path, "utf8")
-  } catch (e) {
-    if (e.code !== "ENOENT") {
-      // File exists but is unreadable (EACCES etc.) — log, don't masquerade as "not found".
-      console.warn(`[advisor] AGENTS.md unreadable at ${path}: ${e.message}`)
-    }
-    parts.push(NO_GUIDE_NOTICE)
-    parts.push("")
-    return null // no guide — requirement-fit falls back to the conversation
-  }
-  // readFileSync succeeded — compute the budget OUTSIDE the try so a spec
-  // lookup failure can never masquerade as "no AGENTS.md".
-  // providerSpec: the project-guide budget follows the provider-level context
-  // override (PROVIDER.md §15 — advisor messages budget is context-based).
-  const ctx = providerSpec(agent.provider).context
-  const cap = Math.max(PROJECT_GUIDE_MIN, Math.floor(ctx * PROJECT_GUIDE_FRACTION))
-  const shown = text.length <= cap
-    ? text
-    : [...text].slice(0, cap).join("") + `\n\n…(truncated at ${cap} chars — read the full file if you need more)` // codepoint-safe slice: no broken surrogate pairs at the boundary
-  parts.push(`<!-- Project root: ${relative(agent.cwd, path).split(sep).join("/")} (inferred from the review scope under ${agent.cwd}) -->`)
-  parts.push("This file defines the project's structure and where its requirements/design documents live. Read the documents it points to — the user's requirements live THERE, not only in the conversation background.")
-  parts.push("")
-  parts.push(shown)
-  parts.push("")
-  return root // guide injected — requirement-fit criteria apply (truthy root)
-}
-
-/**
- * Inject the project document map (PO-1). Resolution: the DECLARED path
- * (`advisor.docMap`, project-root-relative) wins; the built-in probe
- * (`docs/README.md` → `docs/design/README.md`) stays as a fallback for projects
- * laid out that way. Neither usable → an explicit degradation sentence — never a
- * silent skip: the reviewer must know the Document-ownership criterion is unchecked.
- * @returns {string|null} the injected map path, or null when degraded
- */
-export function injectDocumentMap(agent, parts, root) {
-  const base = root ?? agent.cwd
-  const conv = loadConventions(agent.cwd)
-  let mapPath = null
-  if (conv.advisor.docMap) {
-    const declared = resolve(base, conv.advisor.docMap)
-    if (existsSync(declared)) mapPath = declared
-  } else {
-    mapPath = [resolve(base, "docs", "README.md"), resolve(base, "docs", "design", "README.md")]
-      .find((p) => existsSync(p)) ?? null
-  }
-  parts.push("## Document Map")
-  let text = null
-  if (mapPath) {
-    try {
-      text = readFileSync(mapPath, "utf8")
-    } catch (e) {
-      console.warn(`[advisor] document map unreadable at ${mapPath}: ${e.message}`)
-    }
-  }
-  if (text === null) {
-    parts.push(NO_DOC_MAP_NOTICE) // degraded — visible by contract
-    parts.push("")
-    return null
-  }
-  parts.push("The document map below registers which document files exist per section. Use it for the Document ownership criterion: a change for an existing section must amend that section's document, not create a new file.")
-  parts.push(text)
-  parts.push("")
-  return mapPath
-}
-
-/**
- * Inject the project standards document (PO-2). DECLARATION ONLY
- * (`advisor.standardsDoc`, project-root-relative): the old hardcoded
- * `METHODOLOGY.md` probe injected a file most projects do not have — and its
- * absence was silent. Undeclared (or unreadable) → explicit degradation sentence.
- * @returns {string|null} the injected standards path, or null when degraded
- */
-export function injectProjectStandards(agent, parts, root) {
-  const base = root ?? agent.cwd
-  const conv = loadConventions(agent.cwd)
-  const declared = conv.advisor.standardsDoc ? resolve(base, conv.advisor.standardsDoc) : null
-  parts.push("## Project Standards")
-  let text = null
-  if (declared && existsSync(declared)) {
-    try {
-      text = readFileSync(declared, "utf8")
-    } catch (e) {
-      console.warn(`[advisor] project standards unreadable at ${declared}: ${e.message}`)
-    }
-  }
-  if (text === null) {
-    parts.push(NO_STANDARDS_NOTICE) // degraded — visible by contract
-    parts.push("")
-    return null
-  }
-  parts.push("The project declares these standards for this review. Judge the design/changes against them:")
-  parts.push(text)
-  parts.push("")
-  return declared
-}

package/src/advisor/repos.mjs

@@ -1,150 +0,0 @@
-/**
- * advisor/repos.mjs — git repository discovery and change collection for advisor reviews.
- * Shared by message building (advisor.mjs) and the review runner (advisor/run.mjs).
- */
-import { execFileSync } from "node:child_process"
-import { dirname, basename, resolve } from "node:path"
-import { loadConventions, isCodePath } from "../conventions.mjs"
-
-const GIT_TIMEOUT = 5_000
-const MAX_EMBEDDED_DIFF = 50_000
-
-/**
- * Find the git repository roots that contain the agent's touched files.
- * Falls back to cwd if no repos found.
- */
-export function findReviewRepos(agent, paths = null) {
-  const touched = agent._touchedFiles ?? []
-  const sources = paths ? [...touched, ...paths.map((p) => resolve(agent.cwd, p))] : touched
-  const repos = []
-
-  for (const abs of sources) {
-    try {
-      const root = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-        cwd: dirname(abs), encoding: "utf8", timeout: GIT_TIMEOUT,
-        stdio: ["ignore", "pipe", "pipe"],
-      }).trim()
-      if (root && !repos.includes(root)) repos.push(root)
-    } catch { /* not a git repo */ }
-  }
-
-  if (repos.length > 0) return repos
-
-  // Fallback: cwd itself
-  try {
-    const root = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd: agent.cwd, encoding: "utf8", timeout: GIT_TIMEOUT,
-      stdio: ["ignore", "pipe", "pipe"],
-    }).trim()
-    if (root) return [root]
-  } catch { /* not a git repo */ }
-
-  return []
-}
-
-/**
- * Collect git status + diff for each repo, embedded into the review context so
- * the advisor doesn't need to spend its first tool calls discovering changes.
- */
-export function collectRepoSnapshots(repos, cwd) {
-  const targets = repos.length > 0 ? repos : [cwd]
-  const parts = []
-  for (const repo of targets) {
-    let status, diff
-    try {
-      status = execFileSync("git", ["status", "--porcelain"], {
-        cwd: repo, encoding: "utf8", timeout: GIT_TIMEOUT, stdio: ["ignore", "pipe", "pipe"],
-      }).trim()
-      diff = execFileSync("git", ["diff", "HEAD"], {
-        cwd: repo, encoding: "utf8", timeout: GIT_TIMEOUT, stdio: ["ignore", "pipe", "pipe"],
-        maxBuffer: 8 * 1024 * 1024,
-      })
-    } catch { continue /* not a git repo or git failed */ }
-    if (!status && !diff.trim()) continue
-    parts.push(`### ${repo}`)
-    if (status) parts.push("```", status, "```")
-    if (diff.trim()) {
-      const truncated = diff.length > MAX_EMBEDDED_DIFF
-      // Prepend a blockquote explaining diff notation to the LLM so it doesn't
-      // treat deleted lines (-) as still-present content (phantom-issue fix).
-      parts.push("**⚠️ IMPORTANT:** In the diff below, `-` lines are **REMOVED** (no longer in the file); `+` lines are **ADDED**. Always `read` the actual file for its current state — never treat a `-` line as still-present content.")
-      parts.push("```diff", truncated ? diff.slice(0, MAX_EMBEDDED_DIFF) : diff.trimEnd(), "```")
-      if (truncated) parts.push(`(diff truncated at ${MAX_EMBEDDED_DIFF} chars — use the git tool to see the rest)`)
-    }
-  }
-  return parts
-}
-
-/** List changed file paths (including untracked) across repos — used by design review
- *  so the advisor knows which files to read even when git diff HEAD can't show them.
- *  Multi-repo: each path is annotated with its repo basename so the advisor can resolve it. */
-export function collectChangedFiles(repos, cwd) {
-  const targets = repos.length > 0 ? repos : [cwd]
-  const files = []
-  for (const repo of targets) {
-    try {
-      const status = execFileSync("git", ["status", "--porcelain"], {
-        cwd: repo, encoding: "utf8", timeout: GIT_TIMEOUT, stdio: ["ignore", "pipe", "pipe"],
-      }).trim()
-      const repoLabel = targets.length > 1 ? `[${basename(repo)}] ` : ""
-      for (const line of status.split("\n")) {
-        // "XY path" or "XY old -> new" (rename) — take the final path, strip quotes
-        const pathParts = line.slice(3).split(" -> ")
-        const p = pathParts[pathParts.length - 1].trim().replace(/^"|"$/g, "")
-        if (p) files.push(repoLabel + p)
-      }
-    } catch { /* not a git repo — skip */ }
-  }
-  return files
-}
-
-// Path classification (code / doc / temp) lives in ../conventions.mjs — the single
-// authority shared by every gate and guard (PORTABILITY FR12 / PO-10). This module
-// consumes it: `isDocFile` / `isTempFile` were retired here (no re-export — a second
-// import path would recreate the drift the authority exists to remove).
-
-/**
- * True when this run mutated at least one CODE file. Shared single source of
- * truth for the advisor/verify guards (agent.mjs + agent/completion.mjs).
- * Doc-only changes (docs/, *.md, LICENSE…) must NOT trigger the guards — the
- * design phase edits docs/ and must not be pushed to a code review. Temp/scratch
- * files (tmp-*, .tmp, .temp) are excluded too — a throwaway diagnostic script
- * is not a code change. Mutations without a known path (tools outside
- * FILE_MUTATORS) are treated as code — cannot tell, so guard conservatively.
- * Classification semantics (incl. "a declared code segment wins over temp/doc")
- * live in conventions.mjs; _touchedFiles stores ABSOLUTE paths, which the
- * segment matcher handles at any depth.
- */
-export function hasCodeMutations({ _touchedFiles, _mutatedThisRun, cwd }) {
-  const files = _touchedFiles ?? []
-  if (files.length === 0) return _mutatedThisRun
-  const conv = loadConventions(cwd)
-  return files.some((p) => isCodePath(p, conv))
-}
-
-/** True when all changed files across repos are documentation (md/txt/LICENSE etc.).
- *  Anything inside a code segment (incl. src/prompts/*.md) counts as product code —
- *  the same authority the design gate uses. Paths here are repo-relative. */
-export function isDocOnlyChange(repos, cwd) {
-  const conv = loadConventions(cwd)
-  const targets = repos.length > 0 ? repos : [cwd]
-  let sawChanges = false
-  for (const repo of targets) {
-    let status
-    try {
-      status = execFileSync("git", ["status", "--porcelain"], {
-        cwd: repo, encoding: "utf8", timeout: GIT_TIMEOUT, stdio: ["ignore", "pipe", "pipe"],
-      }).trim()
-    } catch { continue /* repo inaccessible — check the rest */ }
-    if (!status) continue
-    sawChanges = true
-    for (const line of status.split("\n")) {
-      // porcelain: "XY path" or "XY old -> new" (rename)
-      const filePath = line.slice(3).split(" -> ").pop().replace(/^"|"$/g, "")
-      // Code (a declared code segment is unconditional, even for tmp-*.mjs) →
-      // not a doc-only change; docs and temp scratch files fall through.
-      if (isCodePath(filePath, conv)) return false
-    }
-  }
-  return sawChanges
-}

package/src/advisor/run.mjs

@@ -1,293 +0,0 @@
-/**
- * advisor/run.mjs — advisor execution: provider resolution and the review entry
- * point. Message building lives in advisor.mjs; the tool loop lives in loop.mjs
- * and the context/limit/tail guards in compaction.mjs（第 11 批硬帽拆分——
- * run.mjs 原 498/500；既有 import 面经 re-export 保持不变）。
- */
-import { findProvider } from "../config.mjs"
-import { prepareAdvisorMessages } from "../advisor.mjs"
-import { buildObjectDeclarationBlock, buildDesignApprovalBlock } from "./messages.mjs"
-import { appendCitationReport } from "./citations.mjs"
-import { runAdvisorToolLoop } from "./loop.mjs"
-import { advisorIncompleteMarker, estimateTokens } from "./compaction.mjs"
-import { batchDocForReview } from "../agent-tools/batch-segment.mjs"
-// 第 33 批（§17.5 模块图）：护栏常量 / doc-set 键 / 记录读取——单向导入（review-streak 无回指）。
-import {
-  MAX_DESIGN_REVIEW_STREAK, docSetKey, designReviewStreakRecord, designReviewStreakStopped,
-} from "../agent-tools/review-streak.mjs"
-
-// 拆分后 import 面（既有导出名逐一保面——re-export；谓词为本批新增）。
-export { ADVISOR_THINKING_PLACEHOLDER, MAX_RESULT_CHARS, renderTimeline as _renderTimeline } from "./compaction.mjs"
-export { advisorToolsFor, advisorToolsFor as _advisorToolsFor } from "./loop.mjs"
-export { runAdvisorToolLoop as _runAdvisorToolLoop } from "./loop.mjs"
-export { advisorIncompleteMarker } from "./compaction.mjs"
-
-// Mechanical convergence cap: up to 5 rounds suffice; a 6th call means the model
-// is looping — refuse it instead of burning tokens. §11.2 D-24b (2026-09-06): PER
-// REVIEW INSTANCE (agent._advisorRuns); CODE REVIEWS ONLY (2026-09-07 §8 ruling)
-// — design reviews are EXEMPT: their rounds keep advancing, the cap never refuses.
-export const MAX_ADVISOR_ROUNDS = 5
-
-/** B 启动拒绝前缀（§14.4 #2）——稳定契约单源（三消费点同串）：run.mjs 生成；同步工具面
- *  据此登记 `_advisorRefusals`；异步结算面据此不置 `_calledAdvisorThisRun`。 */
-export const ADVISOR_LAUNCH_REFUSAL_PREFIX = "Advisor: design review launch refused"
-
-/** 评审失败护栏稳定前缀（第 33 批 §17.4——与 `ADVISOR_LAUNCH_REFUSAL_PREFIX` 同族；
- *  实现 grep / 用例断言锚）。凭证卫生：串内零 token / designId 值。 */
-export const ADVISOR_DESIGN_STREAK_STOP_PREFIX = "Advisor: design review stopped"
-
-/** kind → 人读说明（第 33 批 §17.4 逐字——结论表第三列；八类 = 五 kind + stale +
- *  no_credential + no_report，与 review-streak.mjs 分类输出同集）。 */
-const DESIGN_REVIEW_OUTCOME_MEANINGS = {
-  timeout: "review exceeded the wall-clock budget (agent.advisor.timeoutMs)",
-  context_limit: "review exceeded the model context budget",
-  turn_cap: "review exceeded the tool-round limit",
-  empty: "the provider returned an empty response",
-  review_failed: "provider / transport error",
-  stale: "the reviewed documents changed while the review was in flight",
-  no_credential: "the token could not be written to the session ledger",
-  no_report: "the review settled without a report",
-}
-
-/**
- * 停止结论串（第 33 批 §17.4 逐字；F29）：稳定前缀 + 停止的 doc-set 清单 + 失败尝试表
- * （记录逐条——kind + 人读说明）+ 三选项（接受现状 / 改变或缩小范围后重跑 / /new 重置）。
- * 全文零凭证值；不自动执行任何恢复动作（发起权在父代理 / 用户）。
- * @param {{count: number, log: string[]}|null} record — 护栏记录（`designReviewStreakRecord`）
- * @param {string[]|null} documents — 被停的文档集（结论清单数据源）
- */
-export function buildDesignReviewGuardMessage(record, documents) {
-  const log = Array.isArray(record?.log) ? record.log : []
-  const docList = Array.isArray(documents) ? documents.filter((d) => typeof d === "string" && d.trim()) : []
-  return [
-    `${ADVISOR_DESIGN_STREAK_STOP_PREFIX} — ${MAX_DESIGN_REVIEW_STREAK} consecutive attempts on this document set produced no design token (repeated failed settlements; no further reviews will start for this set in this session).`,
-    "Document set (1 design instance — no token issued):",
-    ...docList.map((d) => `- ${d}`),
-    "Attempts (most recent last):",
-    "| # | outcome | meaning |",
-    "|---|---|---|",
-    ...log.map((kind, i) => `| ${i + 1} | ${kind} | ${DESIGN_REVIEW_OUTCOME_MEANINGS[kind] ?? kind} |`),
-    "Options:",
-    "1. Accept the current state and proceed — implementation for this document set stays gated (no design token).",
-    "2. Narrow or change the scope: a different document set starts a fresh budget — fix the cause first (agent.advisor.timeoutMs / advisor model / provider).",
-    "3. Start a new session (/new) to reset the guard.",
-  ].join("\n")
-}
-
-const MAX_UNFIXED_DISPLAY = 10 // unfixed issues shown in the cap message
-
-/** Resolve the advisor's provider: cfg.provider/model when set, otherwise the main agent's provider */
-export function resolveAdvisorProvider(agent) {
-  const cfg = agent.config?.advisor
-  if (cfg?.provider) {
-    try {
-      // F-1 (ISSUE-FIX-BATCH): children carry no agent.providers (spawn childConfig copies the
-      // parent config) — fall back to config.providersList (.length: [] must not skip the list).
-      const provider = findProvider(agent.providers?.length ? agent.providers : agent.config?.providersList ?? [agent.provider], cfg.provider)
-      // F-2a (MODEL-400-FIX)：无 cfg.model 时渠道克隆须重派生 model——渠道裸克隆会丢 model 键
-      // → 无 model 请求 → serde 400。
-      // MODEL-SELECTION v2（M3④）：无 cfg.model → 命中渠道自己的默认模型（`provider.model`
-      // 单值）；渠道无默认模型 → 父 provider 兜底（与 subagent F-2c 同构）——绝不产出静默
-      // undefined-model 请求（最极端两者皆无 → chat 前 assertProviderModel fail-fast）。
-      const result = cfg.model ? { ...provider, model: cfg.model } : { ...provider, model: provider.model ?? agent.provider?.model }
-      if (cfg.thinking === null || cfg.thinking === false) result.thinking = undefined  // explicitly off
-      else if (cfg.thinking !== undefined) result.thinking = cfg.thinking
-      if (cfg.reasoningEffort !== undefined) result.reasoningEffort = cfg.reasoningEffort
-      return result
-    } catch (e) {
-      // Provider not found or lookup failed — fall back to main provider, but surface the reason
-      console.warn(`[advisor] resolveAdvisorProvider: ${e.message}`)
-    }
-  }
-  const provider = { ...agent.provider }
-  if (cfg?.model) provider.model = cfg.model
-  // thinking off: null AND false both mean "explicitly off" — a raw `false`
-  // value is invalid for providers that expect undefined or an object.
-  if (cfg?.thinking === null || cfg?.thinking === false) provider.thinking = undefined
-  else if (cfg?.thinking !== undefined) provider.thinking = cfg.thinking
-  if (cfg?.reasoningEffort !== undefined) provider.reasoningEffort = cfg.reasoningEffort
-  return provider
-}
-
-/**
- * Extract unfixed issues from prior review text (for the cap message).
- * Input: an advisor review markdown table (`| # | … |` rows). A row counts as
- * unfixed unless its line carries a resolved-status word (fixed/resolved/done/
- * addressed/corrected, ✓/✔). Returns at most MAX_UNFIXED_DISPLAY plain
- * (pipe-stripped) row strings.
- */
-function extractUnfixedIssues(priorText) {
-  if (!priorText) return []
-  const lines = priorText.split("\n")
-  // Resolved-status words: fixed/resolved/done/addressed/corrected (+ ✓/✔).
-  // \b prevents "unfixed"/"prefixed" from matching "fixed".
-  const resolvedRe = /\b(?:fixed|resolved|done|addressed|corrected)\b|✓|✔/i
-  return lines
-    .filter((line) => /\|\s*\d+\s*\|/.test(line)) // 匹配表格行
-    .filter((line) => !resolvedRe.test(line))
-    // Strip only the leading/trailing table pipes — inner pipes (escaped or
-    // in-cell content) stay intact instead of garbling the cap message.
-    .map((line) => line.trim().replace(/^\|/, "").replace(/\|$/, "").trim())
-    .filter(Boolean)
-    .slice(0, MAX_UNFIXED_DISPLAY)
-}
-/** Review-looking guard (async settle parity): a markdown table row or ≥200 chars of prose counts as a prior. */
-export function looksLikeReviewOutput(text) {
-  const trimmed = String(text ?? "").trim()
-  return /\|.*\|.*\|/.test(trimmed) || trimmed.length >= 200
-}
-/** Cap message (shared by runAdvisorReview and the async pre-check — per-review refusal). */
-export function buildCapMessage(agent) {
-  const prior = agent._lastAdvisorOutput
-  const unfixed = prior ? extractUnfixedIssues(prior) : []
-  let message = `Advisor: convergence cap reached after ${MAX_ADVISOR_ROUNDS} rounds.\n`
-  if (unfixed.length > 0) {
-    message += `\nUnresolved issues from prior rounds:\n${unfixed.map((i) => `- ${i}`).join("\n")}\n`
-  } else {
-    message += "\nAll prior issues appear resolved.\n"
-  }
-  message += "\nOptions:\n1. Accept current state and proceed\n2. Manually review specific concerns with read/grep\n3. Start a new session (/new) to reset the advisor"
-  return message
-}
-
-/**
- * 压缩定锚简报（F13/§14.4 #3）——**由评审参数构建**（非模型输出）：对象声明 / 文档清单 /
- * Approval Signal 三锚；重内容（项目指南 / 方法论 / 文档地图）不入 pin（压缩的意义所在）。
- * 形态逐字见设计 §14.4 #3（首行为机械化重挂说明）。
- */
-function buildPinnedBrief(reviewType, documents, object, designToken, designId) {
-  const docList = Array.isArray(documents) ? documents.filter((d) => typeof d === "string" && d.trim()) : []
-  const parts = ["[review brief — re-attached after context compaction; the original review request is no longer in the context]"]
-  const declaration = buildObjectDeclarationBlock(object)
-  if (declaration) parts.push(declaration.trimEnd())
-  if (docList.length > 0) {
-    parts.push("## Documents to Review")
-    parts.push(docList.map((d) => `- ${d} — Read this file in full`).join("\n"))
-  }
-  if (reviewType === "design" && designToken) parts.push(buildDesignApprovalBlock(designToken, designId))
-  return parts.join("\n\n")
-}
-
-/**
- * Run an advisor review. reviewType: "code" (default) or "design". Returns review text or null when skipped.
- * @param {string|null} [designToken] — injected into the design-review prompt; the advisor echoes it only on approval.
- * @param {string[]|null} [documents] — design review only: explicit list of doc paths to review; passed through to the message builder.
- * @param {string[]|null} [paths] — code review only: explicit list of file/dir paths to review.
- * @param {Object|null} [object] — review-object declaration (§18.8 D-OA1/D-OA3): { type, target, status, reason, exclude }; absent → legacy behavior (no injection).
- * @param {string|null} [designId] — §29.1 F2a: injected next to the design token in
- *   the Approval Signal (passed through to the message builders).
- */
-export async function runAdvisorReview(agent, reviewType, callbacks, designToken = null, documents = null, paths = null, object = null, designId = null) {
-  const onOutput = callbacks?.onOutput
-  const signal = callbacks?.signal
-  const startTime = Date.now()
-
-  // Advisor reviews are ALWAYS available (2026-08-21 semantic refactor): the
-  // former advisor.enabled gate is removed — review capability has no off
-  // switch; only the guard (completion pushback) is opt-in via advisor.guard.
-
-  // Mechanical convergence cap — CODE REVIEWS ONLY (2026-09-07 §8 ruling: design
-  // reviews are exempt). _advisorRound is scoped to the current review instance
-  // (§11.2 D-24b ③), so >= MAX_ADVISOR_ROUNDS blocks the next call of THIS instance.
-  // 5 rounds max; after that the review is never pushed back.
-  if (reviewType !== "design" && (agent._advisorRound || 0) >= MAX_ADVISOR_ROUNDS) {
-    return buildCapMessage(agent)
-  }
-
-  // 第 33 批（§17.5 检查点 2——内防线）：同一 doc-set 连续未产出可用结算达阈值 ⇒ 直接拒绝
-  // （不建消息、不发起、零 LLM）——防直接调用方绕过工具层预检（正常工具链在预检已拒）。
-  if (reviewType === "design" && Array.isArray(documents) && documents.length > 0) {
-    const streakKey = docSetKey(documents, agent.cwd)
-    if (designReviewStreakStopped(agent, streakKey)) {
-      return buildDesignReviewGuardMessage(designReviewStreakRecord(agent, streakKey), documents)
-    }
-  }
-
-  const provider = resolveAdvisorProvider(agent)
-  // Advisor always works in the agent's cwd — scope is defined by paths/documents.
-  const advisorCwd = agent.cwd
-
-  const messages = prepareAdvisorMessages(agent, reviewType, designToken, documents, paths, null, object, designId)
-
-  // B 启动断言（fail-closed——§14.4 #2）：设计评审请求内**必须**携带与本次签发 token 精确
-  // 对应的 Approval Signal——构建面补不上就拒绝启动（不发"请回显一个不存在的 token"的请求）。
-  // 拒绝报告前缀 `Advisor: design review launch refused` = 稳定契约（同步工具面据此登记
-  // _advisorRefusals；异步结算面据此不置 _calledAdvisorThisRun）。工具路径恒签发 token ⇒
-  // 该拒绝为直接调用方兜底（防御纵深——正常链不可达，如实注）。
-  if (reviewType === "design") {
-    const missing = !designToken
-      ? "no design token was minted"
-      : (messages.some((m) => m.role === "user" && String(m.content ?? "").includes(`[DESIGN-TOKEN:${designToken}`))
-        ? null
-        : "the request does not carry the approval signal")
-    if (missing) {
-      return `${ADVISOR_LAUNCH_REFUSAL_PREFIX} — ${missing}. Nothing was sent: a request that asks the reviewer to echo a token it cannot see would break the credential chain. Re-run advisor(type='design') to mint a fresh token.`
-    }
-  }
-
-  // §2.20.3 批次档写通道的绑定（仅设计评审）：同步路径 = 调用方（advisor 工具）传入的
-  // callbacks.batchDoc（即 resolved.run 的实例绑定）；异步路径 = 本实例在跑池条目的
-  // run.batchDoc（同文档集实例键——各评审各取各档，不用单值会话态）。
-  const boundBatchDoc = reviewType === "design" ? batchDocForReview(agent, documents, callbacks) : null
-  // F13/§14.4 #3：压缩定锚简报（评审参数构建——压缩触发时由 compaction 重挂）。
-  const pinned = buildPinnedBrief(reviewType, documents, object, designToken, designId)
-
-  try {
-    const result = await runAdvisorToolLoop(provider, messages, onOutput, signal, agent, advisorCwd, null, reviewType, boundBatchDoc, pinned)
-
-    // Host-verified citations (decision d698434): mechanically check every
-    // `file:line: content` reference in the review against the CURRENT file
-    // state. LLMs cannot self-enforce the evidence rule — the model may quote
-    // the prior table instead of re-reading (three consecutive false reports
-    // cited pre-fix line content). Unverified citations must not support a
-    // push-back; the parent agent sees the verification report.
-    // F14/§14.5：解析候选 = cwd + 评审对象声明范围派生根（scope = documents + paths）。
-    let final = result
-    if (!result.trimStart().startsWith("Advisor:")) {
-      final = appendCitationReport(result, advisorCwd, { scope: [...(documents ?? []), ...(paths ?? [])] })
-      // Success path: keep the FULL review output for convergence rounds —
-      // round 2+ injects this verbatim and the model understands it (decision
-      // 2026-08-08: prior-table hard parsing removed; no phrase/header matching).
-      // Guard: only store outputs that actually carry a review — a markdown
-      // table row (`| a | b | c |`) or substantial prose (>200 chars). An
-      // empty or tool-progress-only reply must not become the "prior review"
-      // of round 2+.
-      const looksLikeReview = looksLikeReviewOutput(final)
-      if (looksLikeReview) {
-        agent._lastAdvisorOutput = final
-      }
-    }
-
-    // Log review statistics for observability
-    const elapsed = Math.round((Date.now() - startTime) / 1000)
-    const toolCallCount = messages.filter((m) => m.role === "tool").length
-    const tokensUsed = estimateTokens(messages)
-    onOutput?.({
-      kind: "text",
-      text: `\n[advisor] Review completed: ${elapsed}s, ${toolCallCount} tool calls, ~${Math.round(tokensUsed / 1000)}k tokens\n`,
-    })
-    return final
-  } catch (e) {
-    if (e.name === "AbortError" && signal?.reason?.interrupt) throw e
-    
-    // 细化错误类型
-    const errorType = e.message.includes("rate limit") || e.message.includes("429") ? "rate limit"
-      : e.message.includes("timeout") ? "timeout"
-      : e.message.includes("network") || e.message.includes("ECONNREFUSED") ? "network"
-      : e.message.includes("context length") ? "context_too_long"
-      : "unknown"
-    
-    const retryAdvice = errorType === "rate limit"
-      ? "Wait a moment and retry. Consider using a cheaper model for advisor."
-      : errorType === "timeout"
-        ? "The model took too long. Try with a narrower scope."
-        : errorType === "context_too_long"
-          ? "Reduce the scope (fewer files/paths) or use a model with larger context window."
-          : "You may retry or proceed to verify manually."
-    
-    return `Advisor: review failed (${errorType}) — ${e.message || "unknown error"}. ${retryAdvice}`
-  }
-}
-// Host-verified citations — moved to citations.mjs (kept re-exported here for
-// import compatibility: tests and callers import from run.mjs).
-export { extractCitations, verifyCitations, appendCitationReport } from "./citations.mjs"