firmwareloop 0.7.4__tar.gz → 0.9.0__tar.gz

{firmwareloop-0.7.4 → firmwareloop-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firmwareloop
-Version: 0.7.4
+Version: 0.9.0
 Summary: AI Agent Firmware Development and Lab Automation Platform (Dual-Tier MCP Server)
 Author-email: WeilinZhang <19523330249@163.com>
 License: MIT
@@ -177,6 +177,8 @@ fwloop setup
    | Claude Code CLI | `~/.claude.json` |
    | Qoder / Qoder CN | `~/.qoder/mcp.json`、`~/.qoder-cn/mcp.json` |
    | CodeBuddy IDE | `~/.codebuddy/mcp.json` |
+   | DeepSeek Harness (DSH) | `~/.dsh/profiles/<已派生 profile>/cordis.patch.yml` |
+   | ZCode IDE | `~/.zcode/cli/config.json` |
 
 2. **同步技能包**（`firmwareloop`、`fwloop-adapter`）到 Antigravity 与 Claude Code 的全局 Skill 目录。
 3. **生成机器级全局配置** `%APPDATA%\FirmwareLoop\lab.yaml`（NdtBox 配置模板，已存在则不覆盖）。
@@ -383,7 +385,7 @@ claude mcp remove --scope user agentic-hil
 ├── demo-firmware/    示例固件（CMake；宿主编译模拟 MCU，闭环验证载体）
 ├── demo-make/        示例固件（Make；构建测试载体）
 ├── docs/             DEPENDENCY_MATRIX / REUSE_PLAN / V0.0.2_GAP_VERIFICATION
-├── pyproject.toml    标准 Python 包配置与 CLI 入口声明 (v0.7.4)
+├── pyproject.toml    标准 Python 包配置与 CLI 入口声明 (v0.9.0)
 ├── .mcp.example.json 双层 MCP 配置模板（firmwareloop + agentic-hil）
 ├── AGENTS.md         通用智能体规范（Antigravity / Qoder / Cursor 等）
 ├── CLAUDE.md         Claude Code CLI 指南
@@ -393,7 +395,7 @@ claude mcp remove --scope user agentic-hil
 
 ---
 
-## 能力验证状态（v0.7.4）
+## 能力验证状态（v0.9.0）
 
 > 状态定义：`Implemented`（已实现）/ `Simulator Validated`（模拟验证）/
 > `Real Hardware Validated`（真机验证）/ `Experimental` / `Not Implemented`
@@ -401,6 +403,7 @@ claude mcp remove --scope user agentic-hil
 | 能力 | 状态 |
 |---|---|
 | 双层 MCP 服务（13 个工作流与硬件工具） | Implemented + Protocol Validated（31/31 测试通过） |
+| fwloop setup 一键注册（7 Agent：Antigravity / Claude Code / Qoder(+CN) / CodeBuddy / DeepSeek Harness / ZCode） | Implemented + Multi-Agent Validated（DSH / ZCode 真机写入验证） |
 | 串口助手工具族（fw_serial_* 七工具, 长驻会话/发送序列/帧解析/窗口采集） | Implemented + Simulator Validated（55 例单测: 含残留 serve 自动清理 / close 进程回收 / UTF-8 线路 / 失败落 JSONL）-> Real Hardware Validated 待 DUT |
 | 一键多 Agent 脚手架（fwloop init / fw_init_project） | Implemented + Multi-Agent Validated |
 | 自定义/私有调试工具接入 Skill（fwloop-adapter） | Implemented + Multi-Skill Validated |
@@ -416,7 +419,7 @@ claude mcp remove --scope user agentic-hil
 | 自动修复闭环（M6 载体） | Simulator Validated -> Real Hardware Validated 待 DUT |
 | NdtBox 数据采集/调试（fw_ndtdbg_status / fw_ndtdbg_measure, ChipSea Fxx IIC） | Implemented（无硬件 Fail-Closed 已验证）-> Real Hardware Validated 待 NdtBox |
 | NdtBox 目标断电复位（fw_ndtdbg_power_cycle, 仅 io10 断电复位, 无写闸门） | Implemented（单测覆盖时序/探针缺失指引）-> Real Hardware Validated 待 NdtBox |
-| NdtBox IIC 固件烧录（fw_ndtdbg_flash, .bin/.nfw 整片擦写, 芯海 Fxx） | Real Hardware Validated（84.87.1.1 / 84.87.1.2 真机整片擦写 verify pass; 2026-09-11 同批文件桥内单体 flash 6/6 pass；双闸门 Fail-Closed）。**v0.7.2 起默认引擎 = 桥内单体 flash**（逐笔 serve 路径现场实测"擦除生效但页写不落地"，保留 `flash_engine: serve` 供 A/B）；差分 boot 判据 + `boot_judge: off` 逃生开关见 0.7.1；**待验收声明：默认引擎路径（Python 组 plan → Popen 桥 → 解析信封）尚待真机验收** |
+| NdtBox IIC 固件烧录（fw_ndtdbg_flash, .bin/.nfw 整片擦写, 芯海 Fxx） | Real Hardware Validated（两批真实固件镜像真机整片擦写 verify pass; 2026-09-11 同批文件桥内单体 flash 6/6 pass；双闸门 Fail-Closed）。**v0.7.2 起默认引擎 = 桥内单体 flash**（逐笔 serve 路径现场实测"擦除生效但页写不落地"，保留 `flash_engine: serve` 供 A/B）；差分 boot 判据 + `boot_judge: off` 逃生开关见 0.7.1；**待验收声明：默认引擎路径（Python 组 plan → Popen 桥 → 解析信封）尚待真机验收** |
 | 烧后冷启动冒烟（fw_ndtdbg_flash 默认开, `cold_boot_check`） | Implemented（单测覆盖通过/全 FF/期望不符/关闭；`COLD_BOOT_VERIFY_FAILED` 错误类）-> Real Hardware Validated 待真机 |
 | 串口占用取证（`port_probe` 试开硬结论 + `holder_candidates` 候选名单） | Implemented（试开结论可复现；候选按 cmdline/name 标注置信度） |
 | 抓开机日志（fw_serial_capture + power_cycle_off_ms, 窗口内断电复位） | Implemented（simulator 验证窗口与复位串联）-> Real Hardware Validated 待 NdtBox + DUT |

{firmwareloop-0.7.4 → firmwareloop-0.9.0}/README.md

@@ -149,6 +149,8 @@ fwloop setup
    | Claude Code CLI | `~/.claude.json` |
    | Qoder / Qoder CN | `~/.qoder/mcp.json`、`~/.qoder-cn/mcp.json` |
    | CodeBuddy IDE | `~/.codebuddy/mcp.json` |
+   | DeepSeek Harness (DSH) | `~/.dsh/profiles/<已派生 profile>/cordis.patch.yml` |
+   | ZCode IDE | `~/.zcode/cli/config.json` |
 
 2. **同步技能包**（`firmwareloop`、`fwloop-adapter`）到 Antigravity 与 Claude Code 的全局 Skill 目录。
 3. **生成机器级全局配置** `%APPDATA%\FirmwareLoop\lab.yaml`（NdtBox 配置模板，已存在则不覆盖）。
@@ -355,7 +357,7 @@ claude mcp remove --scope user agentic-hil
 ├── demo-firmware/    示例固件（CMake；宿主编译模拟 MCU，闭环验证载体）
 ├── demo-make/        示例固件（Make；构建测试载体）
 ├── docs/             DEPENDENCY_MATRIX / REUSE_PLAN / V0.0.2_GAP_VERIFICATION
-├── pyproject.toml    标准 Python 包配置与 CLI 入口声明 (v0.7.4)
+├── pyproject.toml    标准 Python 包配置与 CLI 入口声明 (v0.9.0)
 ├── .mcp.example.json 双层 MCP 配置模板（firmwareloop + agentic-hil）
 ├── AGENTS.md         通用智能体规范（Antigravity / Qoder / Cursor 等）
 ├── CLAUDE.md         Claude Code CLI 指南
@@ -365,7 +367,7 @@ claude mcp remove --scope user agentic-hil
 
 ---
 
-## 能力验证状态（v0.7.4）
+## 能力验证状态（v0.9.0）
 
 > 状态定义：`Implemented`（已实现）/ `Simulator Validated`（模拟验证）/
 > `Real Hardware Validated`（真机验证）/ `Experimental` / `Not Implemented`
@@ -373,6 +375,7 @@ claude mcp remove --scope user agentic-hil
 | 能力 | 状态 |
 |---|---|
 | 双层 MCP 服务（13 个工作流与硬件工具） | Implemented + Protocol Validated（31/31 测试通过） |
+| fwloop setup 一键注册（7 Agent：Antigravity / Claude Code / Qoder(+CN) / CodeBuddy / DeepSeek Harness / ZCode） | Implemented + Multi-Agent Validated（DSH / ZCode 真机写入验证） |
 | 串口助手工具族（fw_serial_* 七工具, 长驻会话/发送序列/帧解析/窗口采集） | Implemented + Simulator Validated（55 例单测: 含残留 serve 自动清理 / close 进程回收 / UTF-8 线路 / 失败落 JSONL）-> Real Hardware Validated 待 DUT |
 | 一键多 Agent 脚手架（fwloop init / fw_init_project） | Implemented + Multi-Agent Validated |
 | 自定义/私有调试工具接入 Skill（fwloop-adapter） | Implemented + Multi-Skill Validated |
@@ -388,7 +391,7 @@ claude mcp remove --scope user agentic-hil
 | 自动修复闭环（M6 载体） | Simulator Validated -> Real Hardware Validated 待 DUT |
 | NdtBox 数据采集/调试（fw_ndtdbg_status / fw_ndtdbg_measure, ChipSea Fxx IIC） | Implemented（无硬件 Fail-Closed 已验证）-> Real Hardware Validated 待 NdtBox |
 | NdtBox 目标断电复位（fw_ndtdbg_power_cycle, 仅 io10 断电复位, 无写闸门） | Implemented（单测覆盖时序/探针缺失指引）-> Real Hardware Validated 待 NdtBox |
-| NdtBox IIC 固件烧录（fw_ndtdbg_flash, .bin/.nfw 整片擦写, 芯海 Fxx） | Real Hardware Validated（84.87.1.1 / 84.87.1.2 真机整片擦写 verify pass; 2026-09-11 同批文件桥内单体 flash 6/6 pass；双闸门 Fail-Closed）。**v0.7.2 起默认引擎 = 桥内单体 flash**（逐笔 serve 路径现场实测"擦除生效但页写不落地"，保留 `flash_engine: serve` 供 A/B）；差分 boot 判据 + `boot_judge: off` 逃生开关见 0.7.1；**待验收声明：默认引擎路径（Python 组 plan → Popen 桥 → 解析信封）尚待真机验收** |
+| NdtBox IIC 固件烧录（fw_ndtdbg_flash, .bin/.nfw 整片擦写, 芯海 Fxx） | Real Hardware Validated（两批真实固件镜像真机整片擦写 verify pass; 2026-09-11 同批文件桥内单体 flash 6/6 pass；双闸门 Fail-Closed）。**v0.7.2 起默认引擎 = 桥内单体 flash**（逐笔 serve 路径现场实测"擦除生效但页写不落地"，保留 `flash_engine: serve` 供 A/B）；差分 boot 判据 + `boot_judge: off` 逃生开关见 0.7.1；**待验收声明：默认引擎路径（Python 组 plan → Popen 桥 → 解析信封）尚待真机验收** |
 | 烧后冷启动冒烟（fw_ndtdbg_flash 默认开, `cold_boot_check`） | Implemented（单测覆盖通过/全 FF/期望不符/关闭；`COLD_BOOT_VERIFY_FAILED` 错误类）-> Real Hardware Validated 待真机 |
 | 串口占用取证（`port_probe` 试开硬结论 + `holder_candidates` 候选名单） | Implemented（试开结论可复现；候选按 cmdline/name 标注置信度） |
 | 抓开机日志（fw_serial_capture + power_cycle_off_ms, 窗口内断电复位） | Implemented（simulator 验证窗口与复位串联）-> Real Hardware Validated 待 NdtBox + DUT |

{firmwareloop-0.7.4 → firmwareloop-0.9.0}/firmwareloop.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firmwareloop
-Version: 0.7.4
+Version: 0.9.0
 Summary: AI Agent Firmware Development and Lab Automation Platform (Dual-Tier MCP Server)
 Author-email: WeilinZhang <19523330249@163.com>
 License: MIT
@@ -177,6 +177,8 @@ fwloop setup
    | Claude Code CLI | `~/.claude.json` |
    | Qoder / Qoder CN | `~/.qoder/mcp.json`、`~/.qoder-cn/mcp.json` |
    | CodeBuddy IDE | `~/.codebuddy/mcp.json` |
+   | DeepSeek Harness (DSH) | `~/.dsh/profiles/<已派生 profile>/cordis.patch.yml` |
+   | ZCode IDE | `~/.zcode/cli/config.json` |
 
 2. **同步技能包**（`firmwareloop`、`fwloop-adapter`）到 Antigravity 与 Claude Code 的全局 Skill 目录。
 3. **生成机器级全局配置** `%APPDATA%\FirmwareLoop\lab.yaml`（NdtBox 配置模板，已存在则不覆盖）。
@@ -383,7 +385,7 @@ claude mcp remove --scope user agentic-hil
 ├── demo-firmware/    示例固件（CMake；宿主编译模拟 MCU，闭环验证载体）
 ├── demo-make/        示例固件（Make；构建测试载体）
 ├── docs/             DEPENDENCY_MATRIX / REUSE_PLAN / V0.0.2_GAP_VERIFICATION
-├── pyproject.toml    标准 Python 包配置与 CLI 入口声明 (v0.7.4)
+├── pyproject.toml    标准 Python 包配置与 CLI 入口声明 (v0.9.0)
 ├── .mcp.example.json 双层 MCP 配置模板（firmwareloop + agentic-hil）
 ├── AGENTS.md         通用智能体规范（Antigravity / Qoder / Cursor 等）
 ├── CLAUDE.md         Claude Code CLI 指南
@@ -393,7 +395,7 @@ claude mcp remove --scope user agentic-hil
 
 ---
 
-## 能力验证状态（v0.7.4）
+## 能力验证状态（v0.9.0）
 
 > 状态定义：`Implemented`（已实现）/ `Simulator Validated`（模拟验证）/
 > `Real Hardware Validated`（真机验证）/ `Experimental` / `Not Implemented`
@@ -401,6 +403,7 @@ claude mcp remove --scope user agentic-hil
 | 能力 | 状态 |
 |---|---|
 | 双层 MCP 服务（13 个工作流与硬件工具） | Implemented + Protocol Validated（31/31 测试通过） |
+| fwloop setup 一键注册（7 Agent：Antigravity / Claude Code / Qoder(+CN) / CodeBuddy / DeepSeek Harness / ZCode） | Implemented + Multi-Agent Validated（DSH / ZCode 真机写入验证） |
 | 串口助手工具族（fw_serial_* 七工具, 长驻会话/发送序列/帧解析/窗口采集） | Implemented + Simulator Validated（55 例单测: 含残留 serve 自动清理 / close 进程回收 / UTF-8 线路 / 失败落 JSONL）-> Real Hardware Validated 待 DUT |
 | 一键多 Agent 脚手架（fwloop init / fw_init_project） | Implemented + Multi-Agent Validated |
 | 自定义/私有调试工具接入 Skill（fwloop-adapter） | Implemented + Multi-Skill Validated |
@@ -416,7 +419,7 @@ claude mcp remove --scope user agentic-hil
 | 自动修复闭环（M6 载体） | Simulator Validated -> Real Hardware Validated 待 DUT |
 | NdtBox 数据采集/调试（fw_ndtdbg_status / fw_ndtdbg_measure, ChipSea Fxx IIC） | Implemented（无硬件 Fail-Closed 已验证）-> Real Hardware Validated 待 NdtBox |
 | NdtBox 目标断电复位（fw_ndtdbg_power_cycle, 仅 io10 断电复位, 无写闸门） | Implemented（单测覆盖时序/探针缺失指引）-> Real Hardware Validated 待 NdtBox |
-| NdtBox IIC 固件烧录（fw_ndtdbg_flash, .bin/.nfw 整片擦写, 芯海 Fxx） | Real Hardware Validated（84.87.1.1 / 84.87.1.2 真机整片擦写 verify pass; 2026-09-11 同批文件桥内单体 flash 6/6 pass；双闸门 Fail-Closed）。**v0.7.2 起默认引擎 = 桥内单体 flash**（逐笔 serve 路径现场实测"擦除生效但页写不落地"，保留 `flash_engine: serve` 供 A/B）；差分 boot 判据 + `boot_judge: off` 逃生开关见 0.7.1；**待验收声明：默认引擎路径（Python 组 plan → Popen 桥 → 解析信封）尚待真机验收** |
+| NdtBox IIC 固件烧录（fw_ndtdbg_flash, .bin/.nfw 整片擦写, 芯海 Fxx） | Real Hardware Validated（两批真实固件镜像真机整片擦写 verify pass; 2026-09-11 同批文件桥内单体 flash 6/6 pass；双闸门 Fail-Closed）。**v0.7.2 起默认引擎 = 桥内单体 flash**（逐笔 serve 路径现场实测"擦除生效但页写不落地"，保留 `flash_engine: serve` 供 A/B）；差分 boot 判据 + `boot_judge: off` 逃生开关见 0.7.1；**待验收声明：默认引擎路径（Python 组 plan → Popen 桥 → 解析信封）尚待真机验收** |
 | 烧后冷启动冒烟（fw_ndtdbg_flash 默认开, `cold_boot_check`） | Implemented（单测覆盖通过/全 FF/期望不符/关闭；`COLD_BOOT_VERIFY_FAILED` 错误类）-> Real Hardware Validated 待真机 |
 | 串口占用取证（`port_probe` 试开硬结论 + `holder_candidates` 候选名单） | Implemented（试开结论可复现；候选按 cmdline/name 标注置信度） |
 | 抓开机日志（fw_serial_capture + power_cycle_off_ms, 窗口内断电复位） | Implemented（simulator 验证窗口与复位串联）-> Real Hardware Validated 待 NdtBox + DUT |

{firmwareloop-0.7.4 → firmwareloop-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "firmwareloop"
-version = "0.7.4"
+version = "0.9.0"
 description = "AI Agent Firmware Development and Lab Automation Platform (Dual-Tier MCP Server)"
 readme = "README.md"
 authors = [

{firmwareloop-0.7.4 → firmwareloop-0.9.0}/tools/__init__.py

@@ -2,4 +2,4 @@
 FirmwareLoop - AI Agent Firmware Development and Lab Automation Platform.
 """
 
-__version__ = "0.7.4"
+__version__ = "0.9.0"

{firmwareloop-0.7.4 → firmwareloop-0.9.0}/tools/fw_mcp_server.py

@@ -1,9 +1,10 @@
 #!/usr/bin/env python3
 """
-fw_mcp_server.py - FirmwareLoop High-Level Workflow & Device MCP Server (v0.7.4).
+fw_mcp_server.py - FirmwareLoop High-Level Workflow & Device MCP Server (v0.9.0).
 
 Exposes high-level firmware engineering and hardware management tools to AI Coding
-Agents (Antigravity CLI, Claude Code CLI, Qoder IDE, CodeBuddy IDE, Cursor) via the Model Context
+Agents (Antigravity CLI, Claude Code CLI, Qoder IDE, CodeBuddy IDE, DeepSeek Harness,
+ZCode IDE, Cursor) via the Model Context
 Protocol (JSON-RPC 2.0 stdio).
 
 Tools provided:
@@ -383,13 +384,16 @@ def handle_fw_ndtdbg_power_cycle(args: Dict[str, Any]) -> Dict[str, Any]:
 def _stream_cli_cmd(args: Dict[str, Any], out_path: str, duration_cap: float) -> Optional[list]:
     """构造 stream CLI 命令 (同步/job 共用); 返回 None 表示参数非法。"""
     cli_script = os.path.join(REPO_ROOT, "tools", "ndtdbg_cli.py")
-    regs = args.get("regs") or ["0xEE:8"]
     duration_s = min(max(float(args.get("duration_s", 10)), 0.0), duration_cap)
     max_frames = int(args.get("max_frames", 0))
     if duration_s <= 0 and max_frames <= 0:
         return None
-    cmd = [sys.executable, cli_script, "stream", "--regs", *[str(r) for r in regs],
-           "--out", out_path]
+    cmd = [sys.executable, cli_script, "stream", "--out", out_path]
+    regs = args.get("regs")
+    if regs:
+        if isinstance(regs, str):
+            regs = [regs]
+        cmd.extend(["--regs", *[str(r) for r in regs]])
     if args.get("interval_ms") is not None:
         cmd.extend(["--interval-ms", str(int(args["interval_ms"]))])
     if duration_s > 0:
@@ -566,10 +570,13 @@ def handle_fw_ndtdbg_capture_seq(args: Dict[str, Any]) -> Dict[str, Any]:
     cli_script = os.path.join(REPO_ROOT, "tools", "ndtdbg_cli.py")
     cap_script = os.path.join(REPO_ROOT, "tools", "logic_capture.ps1")
     duration_ms = int(args.get("duration_ms", 8000))
-    writes = args.get("writes", [{"reg": "0xBE", "data": "01"}, {"reg": "0x01", "data": "BE 42"}])
-    poll_reg = args.get("poll_reg", "0x01")
+    writes = args.get("writes")
+    if not writes:
+        return {"ok": False, "error_class": "CONFIG_ERROR",
+                "error": "fw_ndtdbg_capture_seq 必须传入非空 writes 序列 (如 [{'reg': '0xBE', 'data': '01'}]), 无默认序列; 参见目标固件协议文档"}
+    poll_reg = args.get("poll_reg")
     poll_attempts = int(args.get("poll_attempts", 5))
-    readback_reg = args.get("readback_reg", "0xBE")
+    readback_reg = args.get("readback_reg")
     poll_expect = " ".join(str(args.get("poll_expect", "00 00")).split()).upper()
     confirm = bool(args.get("confirm", True))
 
@@ -901,7 +908,7 @@ def handle_fw_init_project(args: Dict[str, Any]) -> Dict[str, Any]:
         return {
             "ok": False,
             "error_class": "CONFIG_ERROR",
-            "error": "target_chip 必填 (如 STM32F103C8 / CSA37F71)",
+            "error": "target_chip 必填 (如 STM32F103C8 / STM32F407ZG)",
             "detail": "fwloop init <target_chip> 或 MCP fw_init_project(target_chip=...)",
         }
 
@@ -1156,6 +1163,57 @@ custom_tools:
 向用户展示配置位置，并说明后续在对话中可以直接使用自然语言调度：
 - “*使用我们公司的烧录工具把固件刷入芯片*”
 - “*启动自研抓包工具采集 5 秒串口日志*”
+
+---
+
+## 可选手法：目标侧"只读诊断插桩"（通用模式）
+
+**适用**：目标固件"挂死 / 反复重启"，没有可用串口输出（或写通道不可用），但工具族能读寄存器。
+思路：让固件把**运行痕迹暴露成只读寄存器**，Agent 一次读回即可定位阶段与崩溃现场，
+不必"改一处 → 烧一次 → 猜一次"。
+
+> **⚠️ 归属规则（先看这条）**：本 skill 会**随包分发**（`fwloop init` / `fwloop setup` 会把它
+> 复制到用户工程与各 Agent 的 skills 目录），因此**这里只放与具体项目、具体芯片无关的通用内容**。
+> 每个项目的**地址约定、寄存器含义、现场案例属于项目资产**，请记录到：
+> - 该项目仓库内的 `docs/<project>-probe-convention.md`，或该项目自建的 project skill；
+>
+> 本 skill 负责教你**怎么设计**这套插桩、以及**记录到哪里**，不承载任何单一项目的约定。
+
+### 通用模式（由粗到细四件套）
+
+1. **阶段编号**：最后到达的启动边界；
+2. **阶段追踪环**：最近 N 步的环形缓冲（看清"路径"，而不只是终点）；
+3. **计数器组**：主循环迭代数、可疑等待循环的自旋计数、崩溃现场（fault 状态字 / PC / LR / xPSR）；
+4. **运行时可调"停靠级别"**：写后断电即可逐级二分崩溃点。
+
+### 通用约束（与芯片无关，都是踩出来的）
+
+1. 插桩数组放 **NOINIT** 段：复位/软复位不清零，才看得到"重启前最后执行到哪"；
+2. 尽量**只读注册**，不要占用可写寄存器语义；
+3. 注册表必须按**地址升序**：乱序会导致从机自检失败 / 初始化提前 `return`
+   ⇒ 通信通道根本没起来，现象与"目标掉电"完全一样（极易误判）；
+4. **避开厂商协议占用的地址**：例——烧录工具会往某个固定地址写擦除/完成魔数，
+   插桩变量放在那里会污染工具的判据；
+5. 采集遵守工具族的协议约束（升序读、单次长度上限、关键字节双读校验——见各工具描述）；
+6. 插桩代码用 `#if` 开关包裹：关闭时零成本、零 RAM。
+
+### 固件侧两条"已知良方"（与芯片无关）
+
+1. **"通道先行"**：把"能被工具读到的通道"（I2C 从机 / 串口）初始化提到所有可疑初始化**之前**
+   ⇒ 之后无论哪里崩，设备仍然可读（把它写在最后，往往会被插桩本身锁死）；
+2. **fault handler 禁止裸自旋**（`B .`）：其优先级高于一切可配置中断，死等会饿死通信中断，
+   目标"从总线上消失"（工具侧表现为 `BUS_TIMEOUT`）⇒ 应"记录现场 + 复位"。
+   （进阶手法"改写异常返回地址 → 恢复函数 → 重建通道 → 停靠"与芯片强相关，换目标需复测。）
+
+### 最小闭环（通用）
+
+```text
+fw_ndtdbg_power_cycle(off_ms=500)     # 复位（不需 write_allowed）
+fw_ndtdbg_status                      # 分级结论 + 判据表
+fw_ndtdbg_read_reg(reg=..., len=...)  # 读"项目约定文档"里定义的诊断寄存器
+fw_ndtdbg_flash(...)                  # 改完固件自助烧录（含烧后冷启动冒烟）
+fw_serial_capture(power_cycle_off_ms=500)   # 抓开机日志（窗口内自动复位）
+```
 """
     if not os.path.exists(adapter_skill_path) or overwrite:
         with open(adapter_skill_path, "w", encoding="utf-8") as fh:
@@ -1884,8 +1942,7 @@ TOOLS_REGISTRY = {
                 "regs": {
                     "type": "array",
                     "items": {"type": "string"},
-                    "description": "Register specs 'addr:len[:name]', e.g. ['0xEE:8:ch', '0x20:138:event']. Default ['0xEE:8'].",
-                    "default": ["0xEE:8"],
+                    "description": "Register specs 'addr:len[:name]', e.g. ['0xEE:8:ch'] (EXAMPLE). Required unless configured in lab.yaml ndtdbg.stream.regs or ndtdbg.target_profile.stream_regs.",
                 },
                 "interval_ms": {
                     "type": "integer",
@@ -1909,7 +1966,7 @@ TOOLS_REGISTRY = {
                 "decode": {
                     "type": "string",
                     "enum": ["hex", "int16le", "uint16le", "int8", "uint8"],
-                    "description": "Optional decoded columns besides raw hex (int16le for PT488 0xEE channels).",
+                    "description": "Optional decoded columns besides raw hex (e.g. int16le for 4-channel little-endian sensor frames).",
                     "default": "hex",
                 },
                 "retry": {
@@ -1935,7 +1992,7 @@ TOOLS_REGISTRY = {
                 "interleave_writes": {
                     "type": "array",
                     "items": {"type": "string"},
-                    "description": "Interleave-write stress profile (P1-1): 'addr:cycle:v1,v2,...:every=N' (rotate values every N frames) or 'addr:once:v:frame=M' (single write at frame M). Written in-frame gaps over the SAME USB session (no dual-open). Requires write_allowed: true AND confirm: true. e.g. ['0x56:cycle:00,01,02,03:every=8'] reproduces the PT488 schedule-race stress profile.",
+                    "description": "Interleave-write stress profile (P1-1): 'addr:cycle:v1,v2,...:every=N' (rotate values every N frames) or 'addr:once:v:frame=M' (single write at frame M). Written in-frame gaps over the SAME USB session (no dual-open). Requires write_allowed: true AND confirm: true. e.g. ['0x56:cycle:00,01,02,03:every=8'] reproduces schedule-race style concurrent-write stress profiles (example from a real product debugging session).",
                 },
                 "confirm": {
                     "type": "boolean",
@@ -1945,7 +2002,6 @@ TOOLS_REGISTRY = {
                 "dll_dir": {"type": "string", "description": "NdtDebugTool lib dir; default from lab.yaml ndtdbg.dll_dir"},
                 "slave_addr": {"type": "string", "description": "IIC slave address, e.g. 0xA0; default from lab.yaml"},
             },
-            "required": ["regs"],
             "additionalProperties": False,
         },
         "handler": handle_fw_ndtdbg_stream,
@@ -1958,8 +2014,7 @@ TOOLS_REGISTRY = {
                 "regs": {
                     "type": "array",
                     "items": {"type": "string"},
-                    "description": "Register specs 'addr:len[:name]'. Default ['0xEE:8'].",
-                    "default": ["0xEE:8"],
+                    "description": "Register specs 'addr:len[:name]', e.g. ['0xEE:8:ch'] (EXAMPLE). Required unless configured in lab.yaml ndtdbg.stream.regs or ndtdbg.target_profile.stream_regs.",
                 },
                 "interval_ms": {"type": "integer", "description": "Target sampling interval in ms.", "default": 100},
                 "duration_s": {"type": "number", "description": "Total capture duration in seconds (cap 3600).", "default": 10},
@@ -2004,7 +2059,7 @@ TOOLS_REGISTRY = {
         "handler": handle_fw_ndtdbg_stream_stop,
     },
     "fw_ndtdbg_capture_seq": {
-        "description": "One-call protocol evidence: concurrently runs a NdtBox register write sequence and a sigrok I2C capture, returning the capture path for fw_logic_decode. NOTE: the default sequence (0xBE=01, 0x01=BE 42, poll 0x01, readback 0xBE) is an EXAMPLE only - always pass your target firmware's real register protocol via writes/poll_reg/poll_expect. Writes are double-gated (confirm: true + lab.yaml ndtdbg.write_allowed); degrades to sequence-only execution (capture_skipped) when sigrok-cli is missing.",
+        "description": "One-call protocol evidence: concurrently runs a target-specific register write sequence and a sigrok I2C capture, returning the capture path for fw_logic_decode. REQUIRED: pass your target firmware's real register protocol via writes (e.g. [{'reg': '0xBE', 'data': '01'}]). Optional poll_reg/poll_expect/readback_reg for handshake & verification. Writes are double-gated (confirm: true + lab.yaml ndtdbg.write_allowed); degrades to sequence-only execution (capture_skipped) when sigrok-cli is missing.",
         "inputSchema": {
             "type": "object",
             "properties": {
@@ -2022,20 +2077,21 @@ TOOLS_REGISTRY = {
                             "data": {"type": "string"},
                         },
                     },
-                    "description": "Register write sequence per your firmware protocol (default 0xBE=01, 0x01=BE 42 is an EXAMPLE, may not match real firmware)",
+                    "description": "Target-specific register write sequence (e.g. [{'reg': '0xBE', 'data': '01'}]). Required, no hardcoded default.",
                 },
                 "confirm": {
                     "type": "boolean",
                     "description": "Acknowledge the register write intent; handler auto-passes --confirm to the CLI (double-gated with lab.yaml ndtdbg.write_allowed)",
                     "default": True,
                 },
-                "poll_reg": {"type": "string", "description": "Poll register until it matches poll_expect (default 0x01)"},
+                "poll_reg": {"type": "string", "description": "Optional poll register until it matches poll_expect (no default; skipped if omitted)"},
                 "poll_expect": {"type": "string", "description": "Expected poll register value (hex) that ends the poll loop; default '00 00' - set to match your firmware protocol", "default": "00 00"},
                 "poll_attempts": {"type": "integer", "description": "Max poll attempts", "default": 5},
-                "readback_reg": {"type": "string", "description": "Read-back verification register (default 0xBE)"},
+                "readback_reg": {"type": "string", "description": "Optional read-back verification register (no default; skipped if omitted)"},
                 "dll_dir": {"type": "string", "description": "NdtDebugTool lib directory; default from lab.yaml"},
                 "slave_addr": {"type": "string", "description": "IIC slave address (e.g. 0xA0)"},
             },
+            "required": ["writes"],
             "additionalProperties": False,
         },
         "handler": handle_fw_ndtdbg_capture_seq,
@@ -2122,7 +2178,7 @@ TOOLS_REGISTRY = {
                 },
                 "target_chip": {
                     "type": "string",
-                    "description": "Target MCU chip model (e.g. STM32F103C8, CSA37F71) - REQUIRED, no hardcoded default",
+                    "description": "Target MCU chip model (e.g. STM32F103C8, STM32F407ZG) - REQUIRED, no hardcoded default",
                 },
                 "build_backend": {
                     "type": "string",
@@ -2335,7 +2391,7 @@ def process_request(req: Dict[str, Any]) -> Optional[Dict[str, Any]]:
                 },
                 "serverInfo": {
                     "name": "firmwareloop",
-                    "version": "0.7.4"
+                    "version": "0.9.0"
                 }
             }
         }
@@ -2470,7 +2526,7 @@ def _settle_stashed_entrypoints(stashed) -> None:
 def handle_cli_update() -> int:
     """Handle `firmwareloop update` command."""
     print("============================================================")
-    print("  FirmwareLoop Auto-Updater (v0.7.4)")
+    print("  FirmwareLoop Auto-Updater (v0.9.0)")
     print("============================================================")
 
     is_git_repo = os.path.exists(os.path.join(REPO_ROOT, ".git"))
@@ -2607,6 +2663,18 @@ def handle_cli_selftest(target: str = "ndtdbg") -> int:
     def report(name, status, detail=""):
         results.append((name, status, detail))
 
+    # P2-2: 从生效配置加载产品协议 profile (避免硬编码 0xEE 与 0xBE)
+    try:
+        from tools import ndtdbg_cli
+        _cfg = ndtdbg_cli.load_config(None)
+    except Exception:
+        _cfg = {}
+    ndt_cfg = (_cfg.get("ndtdbg") or {}) if isinstance(_cfg, dict) else {}
+    target_profile = ndt_cfg.get("target_profile") or {}
+    stream_cfg = ndt_cfg.get("stream") or {}
+    stream_regs = target_profile.get("stream_regs") or stream_cfg.get("regs")
+    loop_cfg = target_profile.get("write_loop") or target_profile.get("selftest_sequence")
+
     # 1. status 分层探测
     print("\n[1/4] status 探测 (Box / IIC bus / target chip) ...")
     rc, body = run_cli("status", timeout=30)
@@ -2623,40 +2691,58 @@ def handle_cli_selftest(target: str = "ndtdbg") -> int:
     report("protocol.desync", _st, _detail)
 
     # 2. stream 冒烟 (100ms x 10s)
-    print("[2/4] stream 冒烟 (100ms x 10s, int16 解码) ...")
-    rc, body = run_cli("stream", "--regs", "0xEE:8:ch", "--interval-ms", "100",
-                       "--duration-s", "10", "--decode", "int16le", timeout=60)
-    stream_data = (body or {}).get("data") if isinstance(body, dict) else None
-    if rc == 0 and stream_data:
-        total = stream_data.get("frames_total", 0)
-        conserved = (stream_data.get("frames_ok", 0) + stream_data.get("frames_ff_gap", 0)
-                     + stream_data.get("frames_io_fail", 0)) == total
-        avg = stream_data.get("interval_actual_avg_ms")
-        report("stream.frames_conserved", "PASS" if conserved else "FAIL",
-               f"total={total} (ok={stream_data.get('frames_ok')}, "
-               f"ff_gap={stream_data.get('frames_ff_gap')}, io_fail={stream_data.get('frames_io_fail')})")
-        report("stream.interval_perf", "PASS" if (avg is not None and avg <= 110) else "FAIL",
-               f"avg={avg}ms (target 100ms, 验收线 <=110ms)")
-        report("stream.io_overhead", "PASS" if stream_data.get("io_overhead_avg_ms") is not None else "FAIL",
-               f"io_overhead_avg_ms={stream_data.get('io_overhead_avg_ms')}")
-        report("stream.gaps", "PASS", f"gaps_n={stream_data.get('gaps_n', 0)} (仅 >2x target 计数)")
-    else:
-        report("stream", "FAIL", (body or {}).get("error_class", f"exit {rc}"))
-
-    # 3. 写读回环 (write_allowed 双门内; 未授权 SKIP, 不算 FAIL)
-    print("[3/4] 写读回环 (0xBE debug_mode, 需 lab.yaml write_allowed) ...")
-    rc, body = run_cli("write-reg", "--addr", "0xBE", "--data", "01", "--confirm")
-    if rc == 0 and body and body.get("ok"):
-        auth = (body.get("data") or {}).get("authorization") or {}
-        report("write.readback", "PASS", f"0xBE=01 写入成功 (授权来源: {auth.get('granted_by', '?')})")
-        run_cli("write-reg", "--addr", "0xBE", "--data", "00", "--confirm")
-        report("write.restore", "PASS", "0xBE=00 已恢复")
+    if stream_regs:
+        if isinstance(stream_regs, str):
+            stream_regs = [stream_regs]
+        stream_cmd = ["stream", "--interval-ms", "100", "--duration-s", "10",
+                      "--regs", *[str(r) for r in stream_regs]]
+        frame_cfg = target_profile.get("measure_frame") or {}
+        dec = frame_cfg.get("decode")
+        if dec and dec != "raw":
+            stream_cmd.extend(["--decode", dec])
+        print(f"[2/4] stream 冒烟 (100ms x 10s, regs={stream_regs}) ...")
+        rc, body = run_cli(*stream_cmd, timeout=60)
+        stream_data = (body or {}).get("data") if isinstance(body, dict) else None
+        if rc == 0 and stream_data:
+            total = stream_data.get("frames_total", 0)
+            conserved = (stream_data.get("frames_ok", 0) + stream_data.get("frames_ff_gap", 0)
+                         + stream_data.get("frames_io_fail", 0)) == total
+            avg = stream_data.get("interval_actual_avg_ms")
+            report("stream.frames_conserved", "PASS" if conserved else "FAIL",
+                   f"total={total} (ok={stream_data.get('frames_ok')}, "
+                   f"ff_gap={stream_data.get('frames_ff_gap')}, io_fail={stream_data.get('frames_io_fail')})")
+            report("stream.interval_perf", "PASS" if (avg is not None and avg <= 110) else "FAIL",
+                   f"avg={avg}ms (target 100ms, 验收线 <=110ms)")
+            report("stream.io_overhead", "PASS" if stream_data.get("io_overhead_avg_ms") is not None else "FAIL",
+                   f"io_overhead_avg_ms={stream_data.get('io_overhead_avg_ms')}")
+            report("stream.gaps", "PASS", f"gaps_n={stream_data.get('gaps_n', 0)} (仅 >2x target 计数)")
+        else:
+            report("stream", "FAIL", (body or {}).get("error_class", f"exit {rc}"))
     else:
-        err_class = (body or {}).get("error_class", f"exit {rc}")
-        if err_class == "PERMISSION_DENIED":
-            report("write.readback", "SKIP", "write_allowed 未开启 (双门保护), 跳过写回环")
+        print("[2/4] stream 冒烟 (未配置 target_profile.stream_regs, 跳过) ...")
+        report("stream", "SKIP", "未配置产品协议 profile (target_profile.stream_regs)，寄存器级自验跳过")
+
+    # 3. 写读回环 (write_allowed 双门内; 未授权或未配 profile 时 SKIP, 不算 FAIL)
+    if loop_cfg:
+        loop_addr = str(loop_cfg.get("addr", "0xBE"))
+        w_data = str(loop_cfg.get("write_data", "01"))
+        r_data = str(loop_cfg.get("restore_data", "00"))
+        print(f"[3/4] 写读回环 ({loop_addr}={w_data}->{r_data}, 需 lab.yaml write_allowed) ...")
+        rc, body = run_cli("write-reg", "--addr", loop_addr, "--data", w_data, "--confirm")
+        if rc == 0 and body and body.get("ok"):
+            auth = (body.get("data") or {}).get("authorization") or {}
+            report("write.readback", "PASS", f"{loop_addr}={w_data} 写入成功 (授权来源: {auth.get('granted_by', '?')})")
+            run_cli("write-reg", "--addr", loop_addr, "--data", r_data, "--confirm")
+            report("write.restore", "PASS", f"{loop_addr}={r_data} 已恢复")
         else:
-            report("write.readback", "FAIL", err_class)
+            err_class = (body or {}).get("error_class", f"exit {rc}")
+            if err_class == "PERMISSION_DENIED":
+                report("write.readback", "SKIP", "write_allowed 未开启 (双门保护), 跳过写回环")
+            else:
+                report("write.readback", "FAIL", err_class)
+    else:
+        print("[3/4] 写读回环 (未配置 target_profile.write_loop, 跳过) ...")
+        report("write.readback", "SKIP", "未配置产品协议 profile (target_profile.write_loop)，写回环自验跳过")
 
     # 3.5 write_allowed 卫生检查 (P1-2): 任何层级为 true 即 WARNING (会话级临时态)
     print("[3.5/4] write_allowed 卫生检查 ...")
@@ -2813,6 +2899,192 @@ def configure_codebuddy_user_mcp(user_home: str) -> Dict[str, Any]:
         return {"ok": False, "path": mcp_file, "reason": str(exc)}
 
 
+DSH_MCP_CLIENT_PLUGIN = "@deepseek-ai/dsh-mcp-client"
+
+# DSH (DeepSeek Harness) profile patch entries. Tools surface as
+# mcp__<serverName>__<tool> (same shape as Claude Code / Codex), e.g.
+# mcp__fwloop__fw_build. Bare command names resolve via PATH: the DSH
+# stdio transport only scrubs credential-shaped / DSH_* env vars, so the
+# parent PATH survives (same convention as the Qoder / Claude entries).
+DSH_MCP_SERVER_ENTRIES = (
+    ("mcp-fwloop", "fwloop", {"command": "fwloop", "args": []}),
+    ("mcp-agentic-hil", "agentic-hil", {"command": "agentic-hil", "args": ["mcp-stdio"]}),
+)
+
+DSH_PATCH_HEADER = (
+    "# FirmwareLoop dual-tier MCP (added by fwloop setup).\n"
+    "# Bridged by @deepseek-ai/dsh-mcp-client; tools surface as mcp__<serverName>__<tool>.\n"
+)
+
+
+def resolve_dsh_home(user_home: str) -> str:
+    """Resolve the DeepSeek Harness home: non-blank $DSH_HOME wins, else ~/.dsh.
+
+    Mirrors @deepseek-ai/dsh-home-paths precedence (an in-harness configured
+    home override is invisible to external tools and therefore not honored).
+    """
+    env_home = (os.environ.get("DSH_HOME") or "").strip()
+    return env_home if env_home else os.path.join(user_home, ".dsh")
+
+
+def discover_dsh_profiles(dsh_home: str) -> List[str]:
+    """List derived DSH profile names under <home>/profiles.
+
+    A directory counts as a profile only when it has a profile-root cordis.yml,
+    which excludes the shared <home>/profiles/node_modules dependency tree.
+    Built-in profiles (web/tui/headless) appear here once the user has booted
+    or derived them; never-derived ones do not exist on disk and are skipped.
+    """
+    profiles_dir = os.path.join(dsh_home, "profiles")
+    found: List[str] = []
+    if os.path.isdir(profiles_dir):
+        for name in sorted(os.listdir(profiles_dir)):
+            cand = os.path.join(profiles_dir, name)
+            if os.path.isdir(cand) and os.path.isfile(os.path.join(cand, "cordis.yml")):
+                found.append(name)
+    return found
+
+
+def _dsh_entry_yaml(entry_id: str, server_name: str, spec: Dict[str, Any]) -> str:
+    args_repr = ", ".join(f"'{a}'" for a in spec.get("args", []))
+    return (
+        f"    - id: {entry_id}\n"
+        f"      name: '{DSH_MCP_CLIENT_PLUGIN}'\n"
+        f"      config:\n"
+        f"        serverName: {server_name}\n"
+        f"        transport: stdio\n"
+        f"        command: {spec['command']}\n"
+        f"        args: [{args_repr}]\n"
+    )
+
+
+def upsert_dsh_patch_file(patch_path: str) -> str:
+    """Idempotently add the FirmwareLoop MCP entries to a profile's cordis.patch.yml.
+
+    Returns "written" or "already_configured". Text-level upsert on purpose:
+    a yaml.safe_dump round-trip would strip the user's guide comments, so an
+    existing file is only ever appended to. Membership is decided by a plain
+    substring check on our fixed ids (fail-safe side: a false positive merely
+    skips the write), and entries that already exist are never rewritten so
+    user overrides (e.g. a custom command) survive setup re-runs.
+    """
+    present = ""
+    if os.path.exists(patch_path):
+        with open(patch_path, "r", encoding="utf-8-sig") as f:
+            present = f.read()
+    missing = [eid for eid, _, _ in DSH_MCP_SERVER_ENTRIES if f"id: {eid}" not in present]
+    if present and not missing:
+        return "already_configured"
+    # Single "- insert:" block holding the missing entries, matching the shape
+    # of the official dsh-mcp-client sample (one block, several entries).
+    new_text = "- insert:\n" + "".join(
+        _dsh_entry_yaml(eid, name, spec)
+        for eid, name, spec in DSH_MCP_SERVER_ENTRIES
+        if eid in missing
+    )
+    parent = os.path.dirname(patch_path)
+    if parent:
+        os.makedirs(parent, exist_ok=True)
+    if not present:
+        with open(patch_path, "w", encoding="utf-8", newline="\n") as f:
+            f.write(DSH_PATCH_HEADER)
+            f.write(new_text)
+        return "written"
+    stripped = present.strip()
+    with open(patch_path, "w", encoding="utf-8", newline="\n") as f:
+        if not stripped or stripped == "[]":
+            # Empty document (blank or literal []): keep leading comment lines,
+            # then start the entries array.
+            comments = "\n".join(
+                line for line in present.splitlines() if line.strip().startswith("#")
+            )
+            if comments:
+                f.write(comments + "\n")
+            f.write(new_text)
+        else:
+            f.write(present)
+            if not present.endswith("\n"):
+                f.write("\n")
+            f.write("\n" + new_text)
+    return "written"
+
+
+def configure_dsh_profiles(user_home: str) -> List[Dict[str, Any]]:
+    """Add FirmwareLoop MCP entries to every derived DSH profile's cordis.patch.yml."""
+    dsh_home = resolve_dsh_home(user_home)
+    results: List[Dict[str, Any]] = []
+    for profile in discover_dsh_profiles(dsh_home):
+        patch_path = os.path.join(dsh_home, "profiles", profile, "cordis.patch.yml")
+        try:
+            status = upsert_dsh_patch_file(patch_path)
+            results.append({"profile": profile, "ok": True, "path": patch_path, "status": status})
+        except Exception as exc:
+            results.append({"profile": profile, "ok": False, "path": patch_path, "reason": str(exc)})
+    return results
+
+
+ZCODE_MCP_SERVERS = {
+    "fwloop": {"command": "fwloop", "type": "stdio"},
+    "agentic-hil": {"command": "agentic-hil", "args": ["mcp-stdio"], "type": "stdio"},
+}
+
+
+def upsert_zcode_mcp_json(mcp_path: str, servers: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+    """Merge MCP servers into ZCode's ~/.zcode/cli/config.json without dropping
+    existing entries.
+
+    ZCode (GLM desktop IDE) nests its MCP registry under "mcp"."servers" —
+    the per-entry shape (type/command/args) matches Qoder's mcpServers, so the
+    same per-entry merge (keep user extras like env) applies.
+    """
+    payload = dict(servers or ZCODE_MCP_SERVERS)
+    data: Dict[str, Any] = {}
+    if os.path.exists(mcp_path):
+        try:
+            with open(mcp_path, "r", encoding="utf-8-sig") as f:
+                loaded = json.load(f)
+            if isinstance(loaded, dict):
+                data = loaded
+        except Exception:
+            data = {}
+    mcp_root = data.get("mcp")
+    if not isinstance(mcp_root, dict):
+        mcp_root = {}
+    mcp_servers = mcp_root.get("servers")
+    if not isinstance(mcp_servers, dict):
+        mcp_servers = {}
+    for name, entry in payload.items():
+        old = mcp_servers.get(name)
+        if isinstance(old, dict) and isinstance(entry, dict):
+            merged = dict(old)
+            merged.update(entry)
+            mcp_servers[name] = merged
+        else:
+            mcp_servers[name] = entry
+    mcp_root["servers"] = mcp_servers
+    data["mcp"] = mcp_root
+    parent = os.path.dirname(mcp_path)
+    if parent:
+        os.makedirs(parent, exist_ok=True)
+    with open(mcp_path, "w", encoding="utf-8") as f:
+        json.dump(data, f, indent=2)
+        f.write("\n")
+    return data
+
+
+def configure_zcode_user_mcp(user_home: str) -> Dict[str, Any]:
+    """Write FirmwareLoop MCP entries into ZCode's ~/.zcode/cli/config.json."""
+    zcode_dir = os.path.join(user_home, ".zcode")
+    mcp_file = os.path.join(zcode_dir, "cli", "config.json")
+    if not os.path.isdir(zcode_dir):
+        return {"ok": False, "path": mcp_file, "reason": "not_installed"}
+    try:
+        upsert_zcode_mcp_json(mcp_file)
+        return {"ok": True, "path": mcp_file}
+    except Exception as exc:
+        return {"ok": False, "path": mcp_file, "reason": str(exc)}
+
+
 def resolve_ndtdebugtool_lib(tool_root: str) -> str:
     """Resolve the NdtDebugTool lib directory (must contain USBIOX.DLL)."""
     if not tool_root or not os.path.isdir(tool_root):
@@ -2899,9 +3171,9 @@ def set_ndtdbg_dlldir(dll_path: str) -> str:
 
 
 def handle_cli_setup() -> int:
-    """Handle `firmwareloop setup` command: simultaneously configure Antigravity CLI, Claude Code CLI, Qoder IDE, and CodeBuddy IDE."""
+    """Handle `firmwareloop setup` command: simultaneously configure Antigravity CLI, Claude Code CLI, Qoder IDE, CodeBuddy IDE, DeepSeek Harness (DSH), and ZCode IDE."""
     print("============================================================")
-    print("  FirmwareLoop Multi-Agent Global Setup Helper (v0.7.4)")
+    print("  FirmwareLoop Multi-Agent Global Setup Helper (v0.9.0)")
     print("============================================================")
     print("")
 
@@ -2985,7 +3257,37 @@ def handle_cli_setup() -> int:
     else:
         print(f"    - User MCP: [Warning] Could not write {cb_result['path']}: {cb_result.get('reason')}")
 
-    # 5. Global Skills Sync for Antigravity and Claude Code
+    # 5. DeepSeek Harness (DSH) — per-profile cordis.patch.yml upsert
+    # Only profiles already derived under <home>/profiles (a booted or
+    # --from-default-profile'd profile has a profile-root cordis.yml) are
+    # configured; never-derived built-ins do not exist on disk and are skipped.
+    print("\n[5] DeepSeek Harness (DSH):")
+    dsh_results = configure_dsh_profiles(user_home)
+    dsh_ok = [item for item in dsh_results if item.get("ok")]
+    if dsh_ok:
+        for item in dsh_ok:
+            state = "already configured" if item["status"] == "already_configured" else "written"
+            print(f"    - profile {item['profile']}: [OK] {state}: {item['path']}")
+        configured_agents.append("DeepSeek Harness (DSH)")
+    else:
+        print("    - ~/.dsh/profiles has no derived profile (DSH not installed, or no profile booted yet)")
+        print("    - Boot/derive a profile in DSH first, then re-run: fwloop setup")
+    for item in dsh_results:
+        if not item.get("ok"):
+            print(f"    - profile {item['profile']}: [Warning] Could not write {item['path']}: {item.get('reason')}")
+
+    # 6. ZCode IDE user-level MCP (~/.zcode/cli/config.json, {"mcp": {"servers": ...}})
+    print("\n[6] ZCode IDE:")
+    zc_result = configure_zcode_user_mcp(user_home)
+    if zc_result.get("ok"):
+        print(f"    - User MCP: [OK] Written to {zc_result['path']}")
+        configured_agents.append("ZCode")
+    elif zc_result.get("reason") == "not_installed":
+        print("    - User MCP: ~/.zcode not found (Workspace .mcp.json still supported)")
+    else:
+        print(f"    - User MCP: [Warning] Could not write {zc_result['path']}: {zc_result.get('reason')}")
+
+    # 7. Global Skills Sync for Antigravity and Claude Code
     ag_skills_dir = os.path.join(user_home, ".gemini", "antigravity-cli", "skills")
     claude_skills_dir = os.path.join(user_home, ".claude", "skills")
     source_skills_dir = os.path.join(REPO_ROOT, "skills")
@@ -3006,14 +3308,14 @@ def handle_cli_setup() -> int:
                 except Exception:
                     pass
 
-    print(f"\n[5] Global Skills:")
+    print(f"\n[7] Global Skills:")
     print(f"    - Synchronized: [OK] {skills_synced} skills (firmwareloop, fwloop-adapter) to Antigravity & Claude Code")
 
-    # 5. Machine-level global lab.yaml (ndtdbg config for the globally installed tool)
+    # 8. Machine-level global lab.yaml (ndtdbg config for the globally installed tool)
     global_cfg = ensure_global_lab_yaml()
     if global_cfg:
         exists = "  [已存在, 未覆盖]" if os.path.isfile(global_cfg) else "  [已创建]"
-        print("\n[6] NdtBox 全局配置:")
+        print("\n[8] NdtBox 全局配置:")
         print(f"    - {global_cfg}{exists}")
         print("    - 若未配置, 请运行: fwloop ndtdebugtool \"<NdtDebugTool 根目录>\"")
 
@@ -3026,7 +3328,7 @@ def handle_cli_setup() -> int:
 def handle_cli_init(chip: Optional[str] = None, upgrade: bool = False) -> int:
     """Handle `firmwareloop init [target_chip]` command."""
     print("============================================================")
-    print("  FirmwareLoop Multi-Agent Project Initializer (v0.7.4)")
+    print("  FirmwareLoop Multi-Agent Project Initializer (v0.9.0)")
     print("============================================================")
     cwd = os.getcwd()
     print(f"[*] Initializing multi-agent guidelines & bench config in:\n    {cwd}\n")
@@ -3059,7 +3361,7 @@ def handle_cli_init(chip: Optional[str] = None, upgrade: bool = False) -> int:
 
 
 def print_cli_help() -> None:
-    print("""FirmwareLoop (fwloop) — AI Agent Firmware Engineering & Lab Automation Platform (v0.7.4)
+    print("""FirmwareLoop (fwloop) — AI Agent Firmware Engineering & Lab Automation Platform (v0.9.0)
 
 Usage:
   fwloop [command]   (or: firmwareloop [command])
@@ -3105,7 +3407,7 @@ def main() -> None:
                 sys.exit(2)
             sys.exit(handle_cli_ndtdebugtool(args[1]))
         elif cmd in ["version", "-v", "--version"]:
-            print("FirmwareLoop v0.7.4")
+            print("FirmwareLoop v0.9.0")
             sys.exit(0)
         elif cmd in ["help", "-h", "--help"]:
             print_cli_help()

{firmwareloop-0.7.4 → firmwareloop-0.9.0}/tools/lib/ndtdbg.py

@@ -64,18 +64,53 @@ def build_frame(slave_addr: int, payload: bytes) -> bytes:
     return bytes([slave_addr & 0xFF]) + payload
 
 
-def parse_getdata(data: bytes) -> list[int] | None:
-    """解析 0xEE 数据帧: 末 2 字节负和校验, 返回 LE int16 通道数组 (C# (short) 有符号); 校验失败返回 None。"""
-    if len(data) < 4 or len(data) % 2 != 0:
-        return None
-    expected = int.from_bytes(data[-2:], "little")
-    if expected != checksum_two_bytes(data[:-2]):
+def parse_getdata(data: bytes, profile: dict | None = None) -> list[int] | None:
+    """按 profile 参数化解析数据帧 (P1-1):
+
+    profile:
+      checksum: "negated-sum-le16" (默认) | "none"
+      decode: "int16le" (默认) | "uint16le" | "int8" | "uint8" | "raw"
+      min_len: 最短字节数 (默认: negated-sum-le16 为 4, 其余为 1)
+    校验失败、长度不足或格式不合法返回 None。
+    """
+    cfg = profile or {}
+    checksum_algo = cfg.get("checksum", "negated-sum-le16")
+    decode_mode = cfg.get("decode", "int16le")
+    min_len = int(cfg.get("min_len", 4 if checksum_algo == "negated-sum-le16" else 1))
+
+    if checksum_algo not in ("negated-sum-le16", "none", None):
+        raise NdtBoxError("CONFIG_ERROR", f"不支持的 measure_frame 校验算法: {checksum_algo}")
+    if decode_mode not in ("int16le", "uint16le", "int8", "uint8", "raw"):
+        raise NdtBoxError("CONFIG_ERROR", f"不支持的 measure_frame 解码模式: {decode_mode}")
+
+    if len(data) < min_len:
         return None
-    channels = []
-    for i in range(len(data[:-2]) // 2):
-        raw = int.from_bytes(data[i * 2:i * 2 + 2], "little")
-        channels.append(raw - 0x10000 if raw >= 0x8000 else raw)
-    return channels
+
+    if checksum_algo == "negated-sum-le16":
+        if len(data) < 2 or len(data) % 2 != 0:
+            return None
+        payload = data[:-2]
+        expected = int.from_bytes(data[-2:], "little")
+        if expected != checksum_two_bytes(payload):
+            return None
+    else:
+        payload = data
+
+    if decode_mode == "int16le":
+        channels = []
+        for i in range(0, len(payload) - len(payload) % 2, 2):
+            raw = int.from_bytes(payload[i:i + 2], "little")
+            channels.append(raw - 0x10000 if raw >= 0x8000 else raw)
+        return channels
+    elif decode_mode == "uint16le":
+        return [int.from_bytes(payload[i:i + 2], "little")
+                for i in range(0, len(payload) - len(payload) % 2, 2)]
+    elif decode_mode == "int8":
+        return [b - 256 if b >= 0x80 else b for b in payload]
+    elif decode_mode in ("uint8", "raw"):
+        return list(payload)
+    else:
+        raise NdtBoxError("CONFIG_ERROR", f"不支持的 measure_frame 解码模式: {decode_mode}")
 
 
 def parse_version(data: bytes) -> str:
@@ -1364,15 +1399,23 @@ class ChipSeaFxx:
 
     # -- 调试数据流 (对齐 ReadModuleConnectDynamic + GetData) --
 
-    def poll(self, duration_ms: int, interval_ms: int = 10, ready_timeout_ms: int = 2000) -> dict:
+    def poll(self, duration_ms: int, interval_ms: int = 10, ready_timeout_ms: int = 2000,
+             frame_profile: dict | None = None) -> dict:
         """连续轮询一帧或多帧, 返回 {frame_count, checksum_errors, ready_timeouts, frames}。
 
-        frames: [{"t": epoch_ms, "ch": [int16...]}, ...]——0.4.0 Python 驱动: serve
+        frames: [{"t": epoch_ms, "ch": [...]}, ...]——0.4.0 Python 驱动: serve
         会话长驻, 序列对齐 ChipSea.cs ReadModuleConnectDynamic + GetData
         (SetDebugMode(0) -> ClearDataReady -> SetDebugMode(0xA4) -> 读 ready -> 读数据)。
+        P1-1: 数据寄存器与帧解析由 frame_profile (lab.yaml target_profile.measure_frame) 参数化。
         """
         if duration_ms <= 0:
             raise NdtBoxError("CONFIG_ERROR", "poll 时长必须 > 0", str(duration_ms))
+        cfg = frame_profile or {}
+        data_reg = int(str(cfg.get("data_reg", 0xEE)), 0) if "data_reg" in cfg else 0xEE
+        checksum_algo = cfg.get("checksum", "negated-sum-le16")
+        decode_mode = cfg.get("decode", "int16le")
+        needs_even = (checksum_algo == "negated-sum-le16" or decode_mode in ("int16le", "uint16le"))
+
         import time
         frames: list[dict] = []
         checksum_errors = 0
@@ -1397,26 +1440,17 @@ class ChipSeaFxx:
                     time.sleep(interval_ms / 1000.0)
                     continue
                 length = ready
-                if length % 2 != 0:
+                if needs_even and length % 2 != 0:
                     checksum_errors += 1
                     time.sleep(interval_ms / 1000.0)
                     continue
-                rb = self._io.read_reg(0xEE, length)
-                if length >= 4:
-                    expected = int.from_bytes(rb[-2:], "little")
-                    if expected != checksum_two_bytes(rb[:-2]):
-                        checksum_errors += 1
-                    else:
-                        samples = []
-                        for i in range(length // 2 - 1):
-                            v = int.from_bytes(rb[i * 2:i * 2 + 2], "little")
-                            if v > 32767:
-                                v -= 65536   # C# (short) 有符号语义
-                            samples.append(v)
-                        if samples:
-                            frames.append({"t": time.time() * 1000, "ch": samples})
-                else:
+                rb = self._io.read_reg(data_reg, length)
+                samples = parse_getdata(rb, cfg)
+                if samples is None:
                     checksum_errors += 1
+                else:
+                    if samples:
+                        frames.append({"t": time.time() * 1000, "ch": samples})
                 time.sleep(interval_ms / 1000.0)
         return {"frame_count": len(frames), "checksum_errors": checksum_errors,
                 "ready_timeouts": dead_frames, "interval_ms": interval_ms,

{firmwareloop-0.7.4 → firmwareloop-0.9.0}/tools/ndtdbg_cli.py

@@ -350,10 +350,19 @@ def cmd_write_reg(io: NdtBoxIo, config: dict, reg: int, data_hex: str, confirm:
     }, log=f"WriteReg(0x{reg:02X})")
 
 
-def cmd_poll(io: NdtBoxIo, duration_ms: int, interval_ms: int, max_frames: int, full: bool) -> None:
+def cmd_poll(io: NdtBoxIo, config: dict, duration_ms: int, interval_ms: int, max_frames: int, full: bool) -> None:
     if duration_ms <= 0:
         fail("CONFIG_ERROR", "poll 时长必须 > 0", str(duration_ms))
-    result = ChipSeaFxx(io).poll(duration_ms, interval_ms=interval_ms)
+    ndtdbg_cfg = config.get("ndtdbg") or {}
+    target_profile = ndtdbg_cfg.get("target_profile") or {}
+    frame_profile = target_profile.get("measure_frame") or ndtdbg_cfg.get("measure_frame")
+    if not frame_profile:
+        fail("CONFIG_ERROR",
+             "measure/poll 缺失目标产品帧格式配置 (target_profile.measure_frame)",
+             detail=(f"生效配置: {effective_config_desc()}; "
+                     "请在 lab.yaml ndtdbg.target_profile.measure_frame 配置帧格式 "
+                     "(如 data_reg: '0xEE', checksum: 'negated-sum-le16', decode: 'int16le', min_len: 4)"))
+    result = ChipSeaFxx(io).poll(duration_ms, interval_ms=interval_ms, frame_profile=frame_profile)
     frames = result.get("frames", [])
     if not full and len(frames) > max_frames:
         kept = frames[:max_frames // 2 + 1] + frames[-(max_frames // 2 + 1):]
@@ -373,6 +382,8 @@ def cmd_stream(io: NdtBoxIo, config: dict, specs: list, interval_ms, duration_s:
     IO_FAIL (重试后仍无应答, 连续计数达 fail_threshold 熔断)。Ctrl+C 优雅收尾,
     CSV 已采数据保留, summary 标记 aborted。
     """
+    if not specs:
+        fail("CONFIG_ERROR", "stream 缺失目标寄存器表 (specs 不能为空)")
     # 默认值: lab.yaml ndtdbg.stream 段可覆盖内置默认 (均有默认值, 非必填)
     stream_cfg = (config.get("ndtdbg") or {}).get("stream") or {}
     if interval_ms is None:
@@ -463,7 +474,7 @@ def cmd_stream(io: NdtBoxIo, config: dict, specs: list, interval_ms, duration_s:
             fh.close()
             hints = {
                 "PROBE_NOT_FOUND": "检查 NdtBox USB 连接与 CH341 驱动; 退出 STDataCollection.exe (USB 独占)",
-                "TARGET_MISMATCH": "检查 IIC 接线/上拉/供电/从机地址; 请求-响应式通道需先 write_reg 开启 debug_mode (如 0xBE=01)",
+                "TARGET_MISMATCH": "检查 IIC 接线/上拉/供电/从机地址; 请求-响应式通道需先 write_reg 开启 debug_mode (参见目标固件协议文档)",
             }
             hint = hints.get(exc.error_class)
             detail = exc.detail or ""
@@ -601,7 +612,7 @@ def build_parser() -> argparse.ArgumentParser:
     w.add_argument("--addr", type=lambda x: int(x, 0), required=True)
     w.add_argument("--data", required=True, help="十六进制数据, 如 'A5 01 02'")
 
-    p_poll = sub.add_parser("poll", parents=[common], help="轮询采集 (0xEC/0xED/0xEE 调试流)")
+    p_poll = sub.add_parser("poll", parents=[common], help="轮询采集 (调试数据流, 依 lab.yaml target_profile.measure_frame 解析)")
     p_poll.add_argument("--duration-ms", type=int, default=2000)
     p_poll.add_argument("--interval-ms", type=int, default=10)
     p_poll.add_argument("--max-frames", type=int, default=4, help="非 --full 时保留的帧样本数")
@@ -636,8 +647,8 @@ def build_parser() -> argparse.ArgumentParser:
 
     st = sub.add_parser("stream", parents=[common],
                         help="高速连续采集寄存器组到 CSV (单会话长驻, 只读)")
-    st.add_argument("--regs", nargs="+", default=["0xEE:8"],
-                    help="寄存器 spec addr:len[:name], 如 0xEE:8:ch 0x20:138:event")
+    st.add_argument("--regs", nargs="+", default=None,
+                    help="寄存器 spec addr:len[:name], 如 0xEE:8:ch (默认读 lab.yaml ndtdbg.stream.regs 或 target_profile.stream_regs)")
     st.add_argument("--interval-ms", type=int, default=None,
                     help="目标采样间隔 ms (默认 lab.yaml ndtdbg.stream.default_interval_ms 或 100)")
     st.add_argument("--duration-s", type=float, default=0,
@@ -689,7 +700,7 @@ def main(argv=None) -> None:
                 fail("CONFIG_ERROR", "write-reg 参数非法")
             cmd_write_reg(io, config, args.addr, args.data, args.confirm)
         elif args.cmd == "poll":
-            cmd_poll(io, args.duration_ms, args.interval_ms, args.max_frames, args.full)
+            cmd_poll(io, config, args.duration_ms, args.interval_ms, args.max_frames, args.full)
         elif args.cmd == "flash-bin":
             cmd_flash_bin(io, config, args.file, args.erase_ms, args.confirm,
                           off_ms=args.off_ms, rewrite_times=args.rewrite_times,
@@ -698,7 +709,21 @@ def main(argv=None) -> None:
                           cold_boot_reg=args.cold_boot_reg,
                           cold_boot_expect=args.cold_boot_expect)
         elif args.cmd == "stream":
-            specs = [parse_reg_spec(s) for s in args.regs]
+            raw_regs = args.regs
+            if not raw_regs:
+                ndtdbg_cfg = config.get("ndtdbg") or {}
+                stream_cfg = ndtdbg_cfg.get("stream") or {}
+                target_profile = ndtdbg_cfg.get("target_profile") or {}
+                raw_regs = stream_cfg.get("regs") or target_profile.get("stream_regs")
+            if not raw_regs:
+                fail("CONFIG_ERROR",
+                     "stream 缺失目标寄存器表 (regs 必填且未配置兜底)",
+                     detail=(f"生效配置: {effective_config_desc()}; "
+                             "请传 --regs 参数 (如 --regs 0xEE:8:ch), "
+                             "或在 lab.yaml ndtdbg.stream.regs / ndtdbg.target_profile.stream_regs 配置"))
+            if isinstance(raw_regs, str):
+                raw_regs = [raw_regs]
+            specs = [parse_reg_spec(s) for s in raw_regs]
             cmd_stream(io, config, specs, args.interval_ms, args.duration_s,
                        args.max_frames, args.out, args.decode, args.retry,
                        args.fail_threshold, args.require_target, args.pre_write,

{firmwareloop-0.7.4 → firmwareloop-0.9.0}/tools/setup-agent-mcp.ps1

@@ -1,6 +1,6 @@
 <#
 .SYNOPSIS
-    Dual-Tier MCP setup and registration helper (v0.7.4).
+    Dual-Tier MCP setup and registration helper (v0.9.0).
     Inspects installed AI coding agents (Qoder, Claude Code, Antigravity, Cursor)
     and configures global MCP / skills or prints exact registration commands.
 
@@ -242,7 +242,7 @@ if ($Json) {
     Write-FwJson ([pscustomobject]$report)
 } else {
     Write-Host "============================================================" -ForegroundColor Cyan
-    Write-Host "  FirmwareLoop Dual-Tier MCP & Agent Setup Helper (v0.7.4)" -ForegroundColor Green
+    Write-Host "  FirmwareLoop Dual-Tier MCP & Agent Setup Helper (v0.9.0)" -ForegroundColor Green
     Write-Host "============================================================" -ForegroundColor Cyan
     Write-Host ""
     Write-Host "[1] Google Antigravity / Gemini CLI:" -ForegroundColor Yellow