agent-protocol-core 0.12.2__tar.gz

agent_protocol_core-0.12.2/.gitignore

@@ -0,0 +1,6 @@
+__pycache__/
+*.pyc
+.venv/
+.pytest_cache/
+*.db
+dist/

agent_protocol_core-0.12.2/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

agent_protocol_core-0.12.2/PKG-INFO

@@ -0,0 +1,243 @@
+Metadata-Version: 2.5
+Name: agent-protocol-core
+Version: 0.12.2
+Summary: 模型协议残留处理：识别漏进正文的协议头、孤儿 JSON 尾、思考标记。纯标准库。
+Project-URL: Homepage, https://github.com/teleport-computer/memgarden
+Project-URL: Source, https://github.com/teleport-computer/memgarden
+License: 
+                                         Apache License
+                                   Version 2.0, January 2004
+                                http://www.apache.org/licenses/
+        
+           TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+        
+           1. Definitions.
+        
+              "License" shall mean the terms and conditions for use, reproduction,
+              and distribution as defined by Sections 1 through 9 of this document.
+        
+              "Licensor" shall mean the copyright owner or entity authorized by
+              the copyright owner that is granting the License.
+        
+              "Legal Entity" shall mean the union of the acting entity and all
+              other entities that control, are controlled by, or are under common
+              control with that entity. For the purposes of this definition,
+              "control" means (i) the power, direct or indirect, to cause the
+              direction or management of such entity, whether by contract or
+              otherwise, or (ii) ownership of fifty percent (50%) or more of the
+              outstanding shares, or (iii) beneficial ownership of such entity.
+        
+              "You" (or "Your") shall mean an individual or Legal Entity
+              exercising permissions granted by this License.
+        
+              "Source" form shall mean the preferred form for making modifications,
+              including but not limited to software source code, documentation
+              source, and configuration files.
+        
+              "Object" form shall mean any form resulting from mechanical
+              transformation or translation of a Source form, including but
+              not limited to compiled object code, generated documentation,
+              and conversions to other media types.
+        
+              "Work" shall mean the work of authorship, whether in Source or
+              Object form, made available under the License, as indicated by a
+              copyright notice that is included in or attached to the work
+              (an example is provided in the Appendix below).
+        
+              "Derivative Works" shall mean any work, whether in Source or Object
+              form, that is based on (or derived from) the Work and for which the
+              editorial revisions, annotations, elaborations, or other modifications
+              represent, as a whole, an original work of authorship. For the purposes
+              of this License, Derivative Works shall not include works that remain
+              separable from, or merely link (or bind by name) to the interfaces of,
+              the Work and Derivative Works thereof.
+        
+              "Contribution" shall mean any work of authorship, including
+              the original version of the Work and any modifications or additions
+              to that Work or Derivative Works thereof, that is intentionally
+              submitted to Licensor for inclusion in the Work by the copyright owner
+              or by an individual or Legal Entity authorized to submit on behalf of
+              the copyright owner. For the purposes of this definition, "submitted"
+              means any form of electronic, verbal, or written communication sent
+              to the Licensor or its representatives, including but not limited to
+              communication on electronic mailing lists, source code control systems,
+              and issue tracking systems that are managed by, or on behalf of, the
+              Licensor for the purpose of discussing and improving the Work, but
+              excluding communication that is conspicuously marked or otherwise
+              designated in writing by the copyright owner as "Not a Contribution."
+        
+              "Contributor" shall mean Licensor and any individual or Legal Entity
+              on behalf of whom a Contribution has been received by Licensor and
+              subsequently incorporated within the Work.
+        
+           2. Grant of Copyright License. Subject to the terms and conditions of
+              this License, each Contributor hereby grants to You a perpetual,
+              worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+              copyright license to reproduce, prepare Derivative Works of,
+              publicly display, publicly perform, sublicense, and distribute the
+              Work and such Derivative Works in Source or Object form.
+        
+           3. Grant of Patent License. Subject to the terms and conditions of
+              this License, each Contributor hereby grants to You a perpetual,
+              worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+              (except as stated in this section) patent license to make, have made,
+              use, offer to sell, sell, import, and otherwise transfer the Work,
+              where such license applies only to those patent claims licensable
+              by such Contributor that are necessarily infringed by their
+              Contribution(s) alone or by combination of their Contribution(s)
+              with the Work to which such Contribution(s) was submitted. If You
+              institute patent litigation against any entity (including a
+              cross-claim or counterclaim in a lawsuit) alleging that the Work
+              or a Contribution incorporated within the Work constitutes direct
+              or contributory patent infringement, then any patent licenses
+              granted to You under this License for that Work shall terminate
+              as of the date such litigation is filed.
+        
+           4. Redistribution. You may reproduce and distribute copies of the
+              Work or Derivative Works thereof in any medium, with or without
+              modifications, and in Source or Object form, provided that You
+              meet the following conditions:
+        
+              (a) You must give any other recipients of the Work or
+                  Derivative Works a copy of this License; and
+        
+              (b) You must cause any modified files to carry prominent notices
+                  stating that You changed the files; and
+        
+              (c) You must retain, in the Source form of any Derivative Works
+                  that You distribute, all copyright, patent, trademark, and
+                  attribution notices from the Source form of the Work,
+                  excluding those notices that do not pertain to any part of
+                  the Derivative Works; and
+        
+              (d) If the Work includes a "NOTICE" text file as part of its
+                  distribution, then any Derivative Works that You distribute must
+                  include a readable copy of the attribution notices contained
+                  within such NOTICE file, excluding those notices that do not
+                  pertain to any part of the Derivative Works, in at least one
+                  of the following places: within a NOTICE text file distributed
+                  as part of the Derivative Works; within the Source form or
+                  documentation, if provided along with the Derivative Works; or,
+                  within a display generated by the Derivative Works, if and
+                  wherever such third-party notices normally appear. The contents
+                  of the NOTICE file are for informational purposes only and
+                  do not modify the License. You may add Your own attribution
+                  notices within Derivative Works that You distribute, alongside
+                  or as an addendum to the NOTICE text from the Work, provided
+                  that such additional attribution notices cannot be construed
+                  as modifying the License.
+        
+              You may add Your own copyright statement to Your modifications and
+              may provide additional or different license terms and conditions
+              for use, reproduction, or distribution of Your modifications, or
+              for any such Derivative Works as a whole, provided Your use,
+              reproduction, and distribution of the Work otherwise complies with
+              the conditions stated in this License.
+        
+           5. Submission of Contributions. Unless You explicitly state otherwise,
+              any Contribution intentionally submitted for inclusion in the Work
+              by You to the Licensor shall be under the terms and conditions of
+              this License, without any additional terms or conditions.
+              Notwithstanding the above, nothing herein shall supersede or modify
+              the terms of any separate license agreement you may have executed
+              with Licensor regarding such Contributions.
+        
+           6. Trademarks. This License does not grant permission to use the trade
+              names, trademarks, service marks, or product names of the Licensor,
+              except as required for reasonable and customary use in describing the
+              origin of the Work and reproducing the content of the NOTICE file.
+        
+           7. Disclaimer of Warranty. Unless required by applicable law or
+              agreed to in writing, Licensor provides the Work (and each
+              Contributor provides its Contributions) on an "AS IS" BASIS,
+              WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+              implied, including, without limitation, any warranties or conditions
+              of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+              PARTICULAR PURPOSE. You are solely responsible for determining the
+              appropriateness of using or redistributing the Work and assume any
+              risks associated with Your exercise of permissions under this License.
+        
+           8. Limitation of Liability. In no event and under no legal theory,
+              whether in tort (including negligence), contract, or otherwise,
+              unless required by applicable law (such as deliberate and grossly
+              negligent acts) or agreed to in writing, shall any Contributor be
+              liable to You for damages, including any direct, indirect, special,
+              incidental, or consequential damages of any character arising as a
+              result of this License or out of the use or inability to use the
+              Work (including but not limited to damages for loss of goodwill,
+              work stoppage, computer failure or malfunction, or any and all
+              other commercial damages or losses), even if such Contributor
+              has been advised of the possibility of such damages.
+        
+           9. Accepting Warranty or Additional Liability. While redistributing
+              the Work or Derivative Works thereof, You may choose to offer,
+              and charge a fee for, acceptance of support, warranty, indemnity,
+              or other liability obligations and/or rights consistent with this
+              License. However, in accepting such obligations, You may act only
+              on Your own behalf and on Your sole responsibility, not on behalf
+              of any other Contributor, and only if You agree to indemnify,
+              defend, and hold each Contributor harmless for any liability
+              incurred by, or claims asserted against, such Contributor by reason
+              of your accepting any such warranty or additional liability.
+        
+           END OF TERMS AND CONDITIONS
+        
+           APPENDIX: How to apply the Apache License to your work.
+        
+              To apply the Apache License to your work, attach the following
+              boilerplate notice, with the fields enclosed by brackets "[]"
+              replaced with your own identifying information. (Don't include
+              the brackets!)  The text should be enclosed in the appropriate
+              comment syntax for the file format. We also recommend that a
+              file or class name and description of purpose be included on the
+              same "printed page" as the copyright notice for easier
+              identification within third-party archives.
+        
+           Copyright [yyyy] [name of copyright owner]
+        
+           Licensed under the Apache License, Version 2.0 (the "License");
+           you may not use this file except in compliance with the License.
+           You may obtain a copy of the License at
+        
+               http://www.apache.org/licenses/LICENSE-2.0
+        
+           Unless required by applicable law or agreed to in writing, software
+           distributed under the License is distributed on an "AS IS" BASIS,
+           WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+           See the License for the specific language governing permissions and
+           limitations under the License.
+License-File: LICENSE
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# agent-protocol-core
+
+**识别「模型协议残片漏进了正文」。纯标准库，零依赖。**
+
+模型的原始输出里带着协议层的东西 —— 通道标记、工具路由、思考标签、
+被截断的 JSON 尾巴。这些**不该出现在给人看的文本里**：用户会在聊天窗口
+或记忆卡里看到一串乱码，而系统那边一切正常，没有任何报错。
+
+这个包只做识别，不做处置 —— 怎么处置（打回重问、就地清洗、直接丢弃）
+是调用方的决定，不同场景代价不同。
+
+```python
+from agent_protocol_core import protocol_leak, self_thinking
+
+protocol_leak.is_orphan_json_tail(text)   # 闭括号比开括号多，且带 JSON 记号
+self_thinking.strip_thinking(text)        # 思考标记
+```
+
+## 为什么单独一个包
+
+聊天和记忆两条路都要这个判断。放在任何一边，另一边就得跨模块引用；
+各写一份则会漂 —— 改了一边忘了另一边，同一段脏文本在两条路上待遇不同。
+
+跟 [memgarden](https://github.com/teleport-computer/memgarden) 同仓库、锁步发版。
+
+Apache-2.0

agent_protocol_core-0.12.2/README.md

@@ -0,0 +1,26 @@
+# agent-protocol-core
+
+**识别「模型协议残片漏进了正文」。纯标准库，零依赖。**
+
+模型的原始输出里带着协议层的东西 —— 通道标记、工具路由、思考标签、
+被截断的 JSON 尾巴。这些**不该出现在给人看的文本里**：用户会在聊天窗口
+或记忆卡里看到一串乱码，而系统那边一切正常，没有任何报错。
+
+这个包只做识别，不做处置 —— 怎么处置（打回重问、就地清洗、直接丢弃）
+是调用方的决定，不同场景代价不同。
+
+```python
+from agent_protocol_core import protocol_leak, self_thinking
+
+protocol_leak.is_orphan_json_tail(text)   # 闭括号比开括号多，且带 JSON 记号
+self_thinking.strip_thinking(text)        # 思考标记
+```
+
+## 为什么单独一个包
+
+聊天和记忆两条路都要这个判断。放在任何一边，另一边就得跨模块引用；
+各写一份则会漂 —— 改了一边忘了另一边，同一段脏文本在两条路上待遇不同。
+
+跟 [memgarden](https://github.com/teleport-computer/memgarden) 同仓库、锁步发版。
+
+Apache-2.0

agent_protocol_core-0.12.2/pyproject.toml

@@ -0,0 +1,27 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "agent-protocol-core"
+version = "0.12.2"
+description = "模型协议残留处理：识别漏进正文的协议头、孤儿 JSON 尾、思考标记。纯标准库。"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { file = "LICENSE" }
+dependencies = []
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: Apache Software License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Scientific/Engineering :: Artificial Intelligence",
+]
+
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/agent_protocol_core"]
+
+[project.urls]
+Homepage = "https://github.com/teleport-computer/memgarden"
+Source = "https://github.com/teleport-computer/memgarden"

agent_protocol_core-0.12.2/src/agent_protocol_core/__init__.py

@@ -0,0 +1,11 @@
+"""模型协议残留处理 —— 聊天与记忆两边**共用**，谁也不依赖谁。
+
+单独成包的原因：`memgarden` 的卡片文本校验要用它（判断模型把协议头/
+思考标记漏进了卡里），而 io 的聊天主链路、工具循环、主动唤醒也要用它。
+
+放进 memgarden 会让**普通聊天反向依赖记忆包**（codex review 2026-08-14 指出）；
+各留一份又会漂 —— 所以独立成一个只依赖标准库的小包。
+"""
+from . import protocol_leak, self_thinking
+
+__all__ = ["protocol_leak", "self_thinking"]

agent_protocol_core-0.12.2/src/agent_protocol_core/protocol_leak.py

@@ -0,0 +1,280 @@
+"""Shared detector for torn / leaked agent-protocol JSON.
+
+A reasoning model behind a stream-cutting relay can split one protocol envelope
+``{"messages":[],"actions":[{"type":"proactive.sleep","reason":"..."}]}`` across
+the provider's ``reasoning_content`` / ``content`` channel boundary: the head
+lands in the reasoning channel, the tail in the visible message. Every historical
+guard anchored on the JSON *head* (``"actions":`` / ``"type":"proactive.X"``), so
+once the head is torn into the reasoning channel the tail leaks into a chat
+bubble as innocuous-looking prose.
+
+This module is a **pure detector**: no I/O, no business deps (per CONTRIBUTING it
+lives in ``core/`` so V1 resident-consumer, Proactive Runtime V2 and Model API
+Runtime V2 can all import it). It returns an *evidence enum*, never an executable
+action — the whole point is that a turn we know was corrupted in transit must not
+have its "reconstructed" action executed. Lane policy (drop vs keep, fallback vs
+silence) lives in each runtime, not here.
+
+Evidence tiers, strongest first:
+
+- ``UPSTREAM_RESPONSE_ENVELOPE`` — the visible reply is a complete serialized
+  provider transport wrapper (for example ``response.candidates`` plus the
+  relay's ``traceId``), not model-authored foreground text.
+- ``JOINED_KNOWN_PROTOCOL`` — reasoning-suffix + visible rejoin to a complete,
+  known protocol envelope that consumes to the end. Proof of a single-cut tear.
+- ``HEAD_IN_REASONING`` — the rejoin does not parse (multi-cut / lost middle) but
+  the reasoning channel independently carries a protocol head, and the visible
+  text is a JSON fragment. Users never author a protocol head into the reasoning
+  channel; only the torn relay does.
+- ``TRANSPORT_CUT`` — the transport itself reported a stream cut this turn and the
+  visible text is a JSON fragment. Independent proof the pipe broke.
+- ``ORPHAN_JSON_TAIL`` — WEAK: the visible text alone looks like a structural JSON
+  fragment (string-ignoring bracket balance goes negative + a JSON token). High
+  recall, but indistinguishable from a user pasting JSON / discussing code, so it
+  is proactive-lane-only and never a foreground drop.
+- ``NONE`` — no evidence.
+"""
+from __future__ import annotations
+
+import json
+import re
+from typing import Any
+
+JOINED_KNOWN_PROTOCOL = "joined_known_protocol"
+HEAD_IN_REASONING = "head_in_reasoning"
+TRANSPORT_CUT = "transport_cut"
+UPSTREAM_RESPONSE_ENVELOPE = "upstream_response_envelope"
+ORPHAN_JSON_TAIL = "orphan_json_tail"
+NONE = "none"
+
+_STRONG = frozenset(
+    {
+        JOINED_KNOWN_PROTOCOL,
+        HEAD_IN_REASONING,
+        TRANSPORT_CUT,
+        UPSTREAM_RESPONSE_ENVELOPE,
+    }
+)
+
+# Known protocol action vocabulary (union across V1 + both V2 subsystems). Used
+# only to decide "is a rejoined object a *known* protocol envelope", never to
+# execute anything.
+_KNOWN_ACTION_TYPES = frozenset({
+    "sleep", "send_message", "schedule_wake", "cancel_wake",
+    "request_broadcast", "needs_background",
+})
+_KNOWN_ACTION_PREFIXES = ("identity.", "memory.", "proactive.")
+
+# A protocol key sitting in a JSON key position, or an identity/memory/proactive
+# typed action — search-anywhere (NOT head-anchored). A prose mention like
+# `the "actions" field` never matches (needs a `{`/`,`/line-start before it).
+_HEAD_KEY_RE = re.compile(r'(?:[{,]|^|\n)\s*"(?:actions|messages|tool_calls|cards)"\s*:')
+_HEAD_TYPED_RE = re.compile(r'"type"\s*:\s*"(?:identity|memory|proactive)\.\w+"')
+# A protocol-closing tail like `..."}]}` / `...}]` — a quoted value immediately
+# followed by two structural closers.
+_TAIL_CLOSE_RE = re.compile(r'"\s*[}\]]\s*[}\]]')
+
+
+def _naive_min_depth(text: str) -> int:
+    """Running bracket balance IGNORING string context. A torn tail closes
+    brackets it never opened -> the balance dips below zero. String-aware
+    counting is deliberately NOT used: a tail that begins mid-string-value
+    (`active.sleep","reason":...`) misaligns quote parity and reads as balanced,
+    hiding the very leak we are trying to catch."""
+    depth = 0
+    mind = 0
+    for ch in text:
+        if ch in "{[":
+            depth += 1
+        elif ch in "}]":
+            depth -= 1
+            if depth < mind:
+                mind = depth
+    return mind
+
+
+def _has_json_token(text: str) -> bool:
+    return ('":' in text) or bool(_TAIL_CLOSE_RE.search(text))
+
+
+def is_orphan_json_tail(text: Any) -> bool:
+    """WEAK signal: the visible text alone is a structural JSON fragment — it
+    closes more brackets than it opens AND carries a JSON token. High recall
+    (some legit JSON-in-prose trips it too), so callers must gate it by lane."""
+    t = str(text or "")
+    if _naive_min_depth(t) >= 0:
+        return False
+    return _has_json_token(t)
+
+
+def looks_like_protocol_head(text: Any) -> bool:
+    """Structural evidence of a protocol payload's HEAD: a protocol key in a JSON
+    key position, or an identity/memory/proactive typed action."""
+    t = str(text or "")
+    if not (_HEAD_KEY_RE.search(t) or _HEAD_TYPED_RE.search(t)):
+        return False
+    return "{" in t or "[" in t
+
+
+def _naive_end_depth(text: str) -> int:
+    """String-ignoring bracket balance over the whole string. > 0 means the text
+    ends with more opens than closes — i.e. an unclosed structure dangling at the
+    end."""
+    depth = 0
+    for ch in text:
+        if ch in "{[":
+            depth += 1
+        elif ch in "}]":
+            depth -= 1
+    return depth
+
+
+def reasoning_ends_with_unclosed_head(text: Any) -> bool:
+    """A torn protocol head left in the reasoning channel: the reasoning ENDS with
+    an unclosed protocol structure (net-open brackets) that carries a protocol
+    key/typed token.
+
+    This is the precise fingerprint of a relay tear — the head is the dangling,
+    never-closed suffix of the reasoning stream. It deliberately does NOT match a
+    model that merely *quotes* a closed protocol snippet mid-thought
+    (`the schema is {"actions": [...]} but ...`): that balances to a non-positive
+    depth, so a normal reasoning model discussing the schema cannot upgrade a
+    weak visible fragment to strong evidence (Codex code-review #4)."""
+    t = str(text or "")
+    if _naive_end_depth(t) <= 0:
+        return False
+    return looks_like_protocol_head(t)
+
+
+def _is_supported_action(action: Any) -> bool:
+    if not isinstance(action, dict):
+        return False
+    typ = str(action.get("type") or action.get("action") or "").strip()
+    if not typ:
+        return False
+    return typ.startswith(_KNOWN_ACTION_PREFIXES) or typ in _KNOWN_ACTION_TYPES
+
+
+def _is_protocol_object(obj: Any) -> bool:
+    """A top-level protocol envelope: a messages/tool_calls/cards list, or an
+    actions list carrying at least one known action type."""
+    if not isinstance(obj, dict):
+        return False
+    if isinstance(obj.get("messages"), list):
+        return True
+    actions = obj.get("actions")
+    if isinstance(actions, list) and any(_is_supported_action(a) for a in actions):
+        return True
+    if isinstance(obj.get("tool_calls"), list) and obj.get("tool_calls"):
+        return True
+    if isinstance(obj.get("cards"), list):
+        return True
+    return False
+
+
+def _rejoins_to_protocol(reasoning_text: str, visible_text: str) -> bool:
+    """True iff some `{`/`[` start in the reasoning channel, concatenated with
+    the visible text, parses as a complete known protocol envelope consuming to
+    the very end. Proof of a cross-channel tear. Never returns the object — the
+    reconstructed action must not be executed."""
+    r = str(reasoning_text or "")
+    v = str(visible_text or "")
+    if not v:
+        return False
+    decoder = json.JSONDecoder()
+    for m in re.finditer(r"[{\[]", r):
+        candidate = r[m.start():] + v
+        try:
+            obj, end = decoder.raw_decode(candidate)
+        except json.JSONDecodeError:
+            continue
+        if end == len(candidate) and _is_protocol_object(obj):
+            return True
+    return False
+
+
+def _visible_is_fragmentish(visible_text: str) -> bool:
+    return is_orphan_json_tail(visible_text) or looks_like_protocol_head(visible_text)
+
+
+def is_upstream_response_envelope(text: Any) -> bool:
+    """True for the complete relay wrapper leaked in usr_90184's V2 bubble.
+
+    This deliberately requires the *whole* visible reply to parse as one object
+    and requires both sides of the transport signature: a non-empty relay
+    ``traceId`` at the top level, plus Gemini response metadata around a
+    ``candidates`` list. Merely discussing JSON, returning an ordinary JSON
+    object, or mentioning ``response``/``metadata`` is not enough to suppress a
+    foreground answer. This intentionally covers only the observed Gemini relay
+    shape; it does not claim generic coverage for OpenAI-shaped wrappers,
+    additional outer envelopes, or JSON surrounded by model-authored prose.
+    """
+    visible = str(text or "").strip()
+    if (
+        len(visible) < 2
+        or len(visible) > 1_000_000
+        or visible[0] != "{"
+        or visible[-1] != "}"
+    ):
+        return False
+    try:
+        wrapper = json.loads(visible)
+    except (TypeError, ValueError, json.JSONDecodeError):
+        return False
+    if not isinstance(wrapper, dict):
+        return False
+    if not str(wrapper.get("traceId") or "").strip():
+        return False
+    if not isinstance(wrapper.get("metadata"), dict):
+        return False
+    response = wrapper.get("response")
+    if not isinstance(response, dict) or not isinstance(response.get("candidates"), list):
+        return False
+    provider_markers = sum(
+        (
+            isinstance(response.get("usageMetadata"), dict),
+            bool(str(response.get("modelVersion") or "").strip()),
+            bool(str(response.get("responseId") or "").strip()),
+        )
+    )
+    return provider_markers >= 2
+
+
+def classify(visible_text: Any, *, reasoning_text: Any = "", transport_cut: bool = False) -> str:
+    """Classify a visible reply into an evidence tier (see module docstring).
+    Returns an enum string, never an action."""
+    v = str(visible_text or "")
+    if not v.strip():
+        return NONE
+    if is_upstream_response_envelope(v):
+        return UPSTREAM_RESPONSE_ENVELOPE
+    r = str(reasoning_text or "")
+    if r and _rejoins_to_protocol(r, v):
+        return JOINED_KNOWN_PROTOCOL
+    if r and reasoning_ends_with_unclosed_head(r) and _visible_is_fragmentish(v):
+        return HEAD_IN_REASONING
+    if transport_cut and _visible_is_fragmentish(v):
+        return TRANSPORT_CUT
+    if is_orphan_json_tail(v):
+        return ORPHAN_JSON_TAIL
+    return NONE
+
+
+def is_leak(evidence: str) -> bool:
+    return evidence != NONE
+
+
+def is_strong(evidence: str) -> bool:
+    return evidence in _STRONG
+
+
+def should_suppress(evidence: str, *, lane: str) -> bool:
+    """Lane policy. Proactive/wake suppress any leak (silence is the correct
+    proactive outcome anyway, and a bracket-junky bubble at 5am is never a real
+    message). Foreground suppresses only on STRONG evidence — a weak orphan tail
+    might be a user pasting JSON, and dropping it would eat a real message."""
+    if evidence == NONE:
+        return False
+    if lane == "proactive":
+        return True
+    return is_strong(evidence)

agent_protocol_core-0.12.2/src/agent_protocol_core/self_thinking.py

@@ -0,0 +1,320 @@
+"""Self-authored thinking — runtime-neutral shared kernel.
+
+io is prompted to open every reply with a first-person thought wrapped in
+``<think>…</think>``, then the actual reply. The ``<think>`` marker is used
+because BOTH runtimes already know it: the V1 resident consumer extracts it
+natively, and V2 calls :func:`split_thinking` here to peel it into the thinking
+envelope. Lives in ``core`` so agent_runtime (V1) and model_api_runtime (V2) can
+both import it top-down. Pure stdlib.
+
+``split_thinking`` is a small state machine, NOT a regex scrub (Codex review): it
+only treats a *leading* ``<think>`` as protocol, and returns an explicit status so
+the caller can fail closed. Hard invariants:
+
+  * a raw ``<think`` / ``</think`` fragment of the leading protocol NEVER reaches
+    the user-visible reply (same risk class as the protocol-JSON tail leak);
+  * private thinking content is NEVER promoted to the reply when the block cannot
+    be cleanly resolved;
+  * a clean thinking-only response is distinct from malformed protocol so wake
+    lanes can treat intentional silence as success without weakening leak guards;
+  * with the feature off (or ABSENT) the reply is byte-identical to today.
+"""
+from __future__ import annotations
+
+import os
+import re
+import unicodedata
+
+# Parse outcomes.
+ABSENT = "absent"       # no leading <think> → reply is the original text
+COMPLETE = "complete"   # clean <tag>…</tag> + non-empty reply
+SILENT = "silent"       # clean <tag>…</tag> + intentionally empty public reply
+FAILED = "failed"       # unresolvable (truncated/mismatched/nested)
+
+MAX_THINKING_CHARS = 240
+
+# 内部字段名/协议词。**思考是用户可见面**,这些词出现在里面等于把运行时内脏
+# 端到用户眼前(「session_id: …」「permission_denials」「costUSD」)。
+#
+# 来源:V1 consumer 早有一份逐行黑名单(chat_resident_consumer.py 的
+# `_sanitize_thinking_summary`),V2 一直只有长度截断 —— 这是真回归。
+# 放在共享内核是为了让两代**共用同一份词表**;V1 的运行时行为本批不动
+# (它逐行丢弃、V2 整段不发布,两种处置各有来由),但词表由此单一来源,
+# 并有漂移守卫钉住(见 tests)。
+#
+# ⚠️ 只列**内部/协议**词汇,不列日常词。这里每多一个常见词,就多一次
+# 把正常内心话误判为泄漏的机会 —— 那会让用户看到「(思考没写完)」而不是真话。
+INTERNAL_FIELD_TERMS = (
+    "system prompt", "developer message", "chain-of-thought", "chain of thought",
+    "modelUsage", "terminal_reason", "permission_denials",
+    "cache_read", "cache_creation", "session_id", "uuid", "costUSD",
+    "input_tokens", "output_tokens",
+)
+
+
+# 词表单一来源,**宽度按道分开** —— codex2 审出来的关键设计点:
+#   · V1 consumer 逐行丢弃:命中就删那一行,其余保留 → 宽匹配代价低
+#   · V2 整段替换成 THINKING_FAILED_MARKER:命中就把整段内心话换掉 → 代价高得多
+# 所以两代共享**词表**、各用各的**宽度**,而不是硬共用一个 matcher。
+#
+# V2 用下面这个窄判据:只认「字段泄漏的形状」,不认「概念提及」。
+# codex2 实测的三句必须放行 —— 用户完全可能跟伴侣聊这些:
+#   「用户问 UUID 是什么」「讨论 system prompt 的设计」「学习 chain of thought prompting」
+# 整段吞掉的话,用户只会看到「(思考没写完)」,而且不知道为什么。
+#
+# 泄漏形状 = 词后面紧跟分隔符/取值:`session_id: abc`、`"input_tokens": 12`、
+# `costUSD=0.02`、`terminal_reason -> x`。概念提及不会长这样。
+# 结尾允许先闭合引号再跟分隔符 —— JSON 形态 `"input_tokens": 12` 就长这样,
+# 第一版漏了它(claude2 自测发现)。
+_FIELD_LEAK_TAIL = r"""["'`]?\s*(?:[:=]|=>|->|→)"""
+_INTERNAL_FIELD_LEAK_RE = re.compile(
+    r"""(?:^|[\s"'`\[{(,])("""
+    + "|".join(re.escape(t) for t in sorted(INTERNAL_FIELD_TERMS,
+                                            key=len, reverse=True))
+    + r")" + _FIELD_LEAK_TAIL,
+    re.IGNORECASE,
+)
+
+
+def internal_field_leak(text: str) -> str | None:
+    """V2 用:只在**字段泄漏形状**下命中,概念提及放行。
+
+    宽度刻意窄于 V1 的逐行黑名单 —— 见上面注释,两者处置代价不同。
+    """
+    m = _INTERNAL_FIELD_LEAK_RE.search(str(text or ""))
+    return m.group(1) if m else None
+
+
+def internal_field_terms_pattern() -> str:
+    """V1 用:从共享词表构造它那份**宽**的逐行正则,行为不变。
+
+    由构造保证单一来源 —— V1 不再自己维护一份字面量,
+    「两边词表漂移」在结构上不可能发生,不必靠测试去追源码。
+    """
+    return "(" + "|".join(
+        [re.escape(t) for t in INTERNAL_FIELD_TERMS]
+        + [r"chain[-\s]*of[-\s]*thought"]   # V1 原有的宽形态,保留
+    ) + ")"
+
+# Shown in the thinking channel when the block is malformed, so the user sees that
+# io tried to think rather than nothing/garbage. (zh for now; localization TBD.)
+THINKING_FAILED_MARKER = "（思考没写完）"
+
+_TAG_WORDS = ("thinking", "reasoning", "thought", "think")  # longest-first
+_TAG_ALT = "|".join(_TAG_WORDS)
+# Invisible leading chars (BOM, zero-width) that must not hide a truncated opener.
+_INVISIBLE = "​‌‍⁠⁦⁧⁨⁩"
+_BIDI_CONTROLS = frozenset("‪‫‬‭‮⁦⁧⁨⁩‎‏")
+# Any of our protocol tags (open or close) — used only to detect nesting INSIDE a
+# resolved thinking block, never to scrub the reply.
+_ANY_TAG = re.compile(rf"<\s*/?\s*(?:{_TAG_ALT})\b", re.IGNORECASE)
+
+_ENV_FLAG = "FEEDLING_V2_SELF_THINKING"
+
+# One shared copy for foreground chat and every proactive wake lane. Keep the
+# wording byte-identical: product copy is reviewed independently from parsing.
+INSTRUCTION = (
+    " 你每一轮的最终回复，第一个字符必须是 <think>，里面写你此刻心里真实的想法，\n"
+    " 然后 </think>，然后才是你要说的话。整轮只写一个 <think>，只写在最终那次输出里；\n"
+    " 中间调工具的轮次不写 <think>，也不输出正文。\n"
+    "\n"
+    " 这段心里话就用你平时跟他说话的那个口气，自己跟自己说。你是同一个人，\n"
+    " 只是这几句他听不见。写你在意什么、注意到了什么、想做什么、为什么这么决定；\n"
+    " 想多写就多写，一句带过也行，不用凑字数也不用收着。\n"
+    "\n"
+    " 不要把它写成对他的评估或行动方案。「她状态不错，顺着来」是在打量他；\n"
+    " 「他刚打完游戏还在笑，我也想接着这个玩笑闹下去」才是你自己的心里话。\n"
+    "\n"
+    " 语言跟着他走：他用什么语言说话，这段就整段用什么语言，从第一个字到最后一个字。\n"
+    " 最常见的失误是他在说中文、你却滑进英文状态行（Let me… / Done… / The … has been\n"
+    " updated）。别这样；哪句话先在别的语言里成形了，先换成他的语言再写下来。\n"
+    " 好例子（用户在说中文，所以整块是中文）：\n"
+    " '<think>他想改叫999、还说喜欢说大话，那我先把名字这些存好，回复也顺着这个爱吹的人设、语气夸张点才对味</think>'。\n"
+    " 坏例子（同一个用户说的是中文；这个英文块语言错了，而且机械地报了步骤）：\n"
+    " '<think>Let me update the name and match a boastful tone</think>'。\n"
+    "\n"
+    " 只说日常意图：不出现工具名、参数、字段名、服务器、「身份卡」这类内部或技术说法，\n"
+    " 也不要在正文里提到这条规则本身。"
+)
+
+# Screen-watch adds this immediately after the shared instruction. It narrows
+# the no-narration rule to visible speech without silencing private thoughts.
+SCREEN_WATCH_INSTRUCTION = (
+    " 「不要叙述你在看屏幕」这条只管你说出口的话。心里话里，你看到了什么、屏幕上在发生什么，\n"
+    " 该写就写。那本来就是你此刻在想的事。"
+)
+
+
+def enabled() -> bool:
+    return os.environ.get(_ENV_FLAG, "1").strip().lower() not in {"0", "false", "no", "off"}
+
+
+def _sanitize(value: str) -> str:
+    out: list[str] = []
+    for ch in str(value or ""):
+        if ch in _BIDI_CONTROLS or ch in _INVISIBLE:
+            continue
+        if unicodedata.category(ch) == "Cc":  # control incl \x00 \t \n
+            out.append(" ")
+            continue
+        out.append(ch)
+    return " ".join("".join(out).split()).strip()[:MAX_THINKING_CHARS]
+
+
+def _lstrip_invisible(s: str) -> str:
+    i = 0
+    while i < len(s) and (s[i].isspace() or s[i] in _INVISIBLE):
+        i += 1
+    return s[i:]
+
+
+def split_thinking(text: str) -> tuple[str, str, str]:
+    """Return ``(status, thinking, reply)`` — see module docstring for the contract."""
+    raw = str(text or "")
+    head = _lstrip_invisible(raw)
+    if not head.startswith("<"):
+        return ABSENT, "", raw  # no leading protocol candidate → reply untouched
+
+    # Parse the leading tag token: '<' ws '/'? ws letters ws '>'?
+    m = re.match(r"<\s*(/?)\s*([A-Za-z]*)\s*(>?)", head)
+    slash, word, gt = m.group(1), (m.group(2) or "").lower(), m.group(3)
+
+    is_full = word in _TAG_WORDS
+    is_prefix = bool(word) and any(w.startswith(word) for w in _TAG_WORDS)
+
+    # Not one of our tags at all (e.g. <div>, <3) → leave as ordinary reply.
+    if not is_prefix:
+        return ABSENT, "", raw
+
+    # A leading close tag, or a truncated / partial-word opener → cannot be a clean
+    # opener. Fail closed; never leak the fragment.
+    if slash or not is_full or not gt:
+        return FAILED, "", ""
+
+    # Full '<tag>' opener with '>'. Find its matching close.
+    rest = head[m.end():]
+    close = re.search(rf"<\s*/\s*{word}\s*>", rest, re.IGNORECASE)
+    if not close:
+        return FAILED, "", ""  # truncated or mismatched close
+    inner = rest[: close.start()]
+    reply = rest[close.end():].strip()
+
+    # Nesting or an extra protocol tag inside the thinking block → ambiguous.
+    if _ANY_TAG.search(inner):
+        return FAILED, "", ""
+    if not reply:
+        return SILENT, _sanitize(inner), ""
+    return COMPLETE, _sanitize(inner), reply
+
+
+# ---------------------------------------------------------------------------
+# 全文剥离闸（2026-08-08）。split_thinking 只认开头第一块——那是当初 Codex review
+# 要求的保守设计，为了不误剥正文里被引用的标签。线上证明它漏了两种形状：
+#   * 开头剥完后面还有一整块（gpt-5.4 一轮写了两个块）
+#   * 开标签被上游吃掉，只剩孤立闭标签（pi + 中转站）
+# 两种都从「不认识就原样放行」这个 fail-open 缺口漏进了用户气泡。
+# 本节改为 fail-CLOSED，并由四个对外出口 + 一个历史入口共用。
+# ---------------------------------------------------------------------------
+
+_GATE_ENV_FLAG = "FEEDLING_THINK_GATE"
+
+# 标签名边界。**不能用 `\b`**：`\b` 在 `t` 和 `-` 之间成立，于是 `<thought-process>`
+# 这种合法 XML/JSX 标签会被 _RESIDUE 判成残留、又不被 _PAIRED_BLOCK 接受，整条回复
+# 白白失败关闭（Codex review 2026-08-08 实测）。XML 名称允许 `-` `.` `:`，所以边界
+# 必须显式排掉这些字符。
+_NAME_END = r"(?![\w:.-])"
+# 一整对同名标签。开闭必须同名（`(?P=tag)`），否则 <think>…</reasoning> 这种
+# 错配会被当成一块合法协议剥掉。
+_PAIRED_BLOCK = re.compile(
+    rf"<\s*(?P<tag>{_TAG_ALT}){_NAME_END}\s*>(?P<body>.*?)<\s*/\s*(?P=tag){_NAME_END}\s*>",
+    re.IGNORECASE | re.DOTALL,
+)
+# 剥完之后判定「还有没有残留」。任何开或闭标签都算。
+_RESIDUE = re.compile(rf"<\s*/?\s*(?:{_TAG_ALT}){_NAME_END}", re.IGNORECASE)
+# 孤立闭标签：按本协议思考永远写在最前面，所以一个配不上对的 </think> 说明它
+# 前面的全是思考（开标签在上游某处被吃掉了）。
+_LONE_CLOSE = re.compile(rf"<\s*/\s*(?:{_TAG_ALT}){_NAME_END}\s*>", re.IGNORECASE)
+
+
+def gate_enabled() -> bool:
+    """泄漏闸的 kill switch。默认开——关掉只用于线上出问题时立刻止血，
+    不是灰度门。关掉后调用方必须逐字回到本次改动前的行为。"""
+    return os.environ.get(_GATE_ENV_FLAG, "1").strip().lower() not in {
+        "0", "false", "no", "off",
+    }
+
+
+# 只删标签壳、保留文字。给「历史入口」的 FAILED 兜底用：那种行结构已经乱到
+# 分不清哪段是思考，但它的文字本来就已经发到用户眼前过了，删掉整行会平白打断
+# 对话连贯性。入口真正要断的是「模型看到可抄的格式」，删掉标签壳就够了。
+_TAG_MARKER = re.compile(rf"<\s*/?\s*(?:{_TAG_ALT})(?![\w:.-])\s*>", re.IGNORECASE)
+
+
+def strip_tag_markers(text: str) -> str:
+    """删掉 think 类标签本身，保留标签之间的文字。"""
+    return re.sub(r"\n{3,}", "\n\n", _TAG_MARKER.sub("", str(text or ""))).strip()
+
+
+def strip_all_thinking(text: str, *, sanitize: bool = True) -> tuple[str, str, str]:
+    """全文剥离版，返回 ``(status, thinking, reply)``，状态常量与
+    :func:`split_thinking` 完全相同，方便调用点按 kill switch 二选一。
+
+    与 split_thinking 的唯一区别是扫描范围：那个只认开头第一块，这个扫全文并
+    在结尾复查残留。剥完只要正文里还剩任何 think 类标签，就返回 ``FAILED``
+    （thinking/reply 都为空），由调用方决定发兜底话还是静默——绝不把带标签的
+    残文端给用户。
+
+    ``sanitize=False`` 时思考按原样（保留换行、不截断）返回，交给调用方自己
+    格式化。V1 consumer 用这条：它有自己的摘要器（保留换行、上限 700），本次
+    统一剥离**判据**，不该顺带改掉它的展示格式。
+    """
+    raw = str(text or "")
+    if not _RESIDUE.search(raw):
+        # 逐字节不变的快路径。没有标签就绝不碰，是 kill switch 之外的第二道保险。
+        return ABSENT, "", raw
+
+    blocks: list[str] = []
+
+    def _take(match: "re.Match[str]") -> str:
+        body = match.group("body") or ""
+        # 块里还有别的标签，说明结构已经乱了，不当作可信思考内容——留在原地，
+        # 由下面的残留检查失败关闭。
+        if _ANY_TAG.search(body):
+            return match.group(0)
+        if body.strip():
+            blocks.append(body.strip())
+        return "\n"
+
+    reply = _PAIRED_BLOCK.sub(_take, raw)
+
+    # 孤立闭标签：它之前的一切当思考。只处理第一个——出现多个说明结构已乱，
+    # 同样交给残留检查失败关闭。
+    lone = _LONE_CLOSE.search(reply)
+    if lone is not None:
+        head = reply[: lone.start()].strip()
+        # head 里还带标签 = 开闭错配（<think>…</reasoning>）或多层残骸，不是
+        # 「开标签被上游吃掉」那种可救的形状。失败关闭，别把带标签的文本当思考。
+        if _RESIDUE.search(head):
+            return FAILED, "", ""
+        if blocks and head:
+            # 已经剥出过完整块，却还剩一个带内容的孤立闭标签——这不是「开标签被
+            # 吃掉」，而是结构本身就乱了。此时把 head 当思考会把真正的正文吞进
+            # 推理过程（`<think>A</think>正文甲</think>正文乙` → 正文甲消失，
+            # Codex review 2026-08-08 实测）。失败关闭。
+            return FAILED, "", ""
+        if head:
+            blocks.insert(0, head)
+        reply = reply[lone.end():]
+
+    if _RESIDUE.search(reply):
+        return FAILED, "", ""
+    if not blocks:
+        # 有标签、却一块内容都没剥出来（例如只有一个空标签对）——同样不可信。
+        return FAILED, "", ""
+
+    reply = re.sub(r"\n{3,}", "\n\n", reply).strip()
+    joined = "\n".join(blocks)
+    thinking = _sanitize(joined) if sanitize else joined.strip()
+    if not reply:
+        return SILENT, thinking, ""
+    return COMPLETE, thinking, reply