SivanCola a947374b3b Fix tool-result cache prefix stability / 修复工具结果缓存前缀稳定性 (#9033) ...

* Fix tool-result cache prefix stability

Problem: complete tool RawContent was promoted into ordinary provider requests, making large results consume context and destabilize cacheable prefixes.

Root cause: sampling, summaries, projection replay, and covered-prefix hashing shared the promoted RawContent representation instead of the bounded persisted Content.

Fix: keep provider-visible tool results at 32KB, add session-scoped paged recovery through use_capability, and exactly migrate promoted-RawContent sidecars back to bounded hashes without changing session JSON or top-level tool schemas.

Verification: focused agent tests, race tests, cache guard scenarios, boot/repolint tests, and DeepSeek live A/B cache trend checks.

* Extract tool-result capability helpers

Move the new marker and restricted-list helpers out of already-large agent files so the implementation stays within repository size budgets without changing behavior or repolint baselines.

* Handle missing raw results by marker reference

When a new-format truncated record no longer has RawContent, retain the original result_ref from its marker so explicit recovery returns the stable unrecoverable-result error instead of a misleading not-found response.

* Modernize tool-result iteration

Use slices.Backward and strings.FieldsSeq so the new capability code satisfies the repository's golangci modernize checks without changing selection or marker parsing behavior.

* Fix provider projection isolation

Problem:
- Request normalization could mutate its provider-visible input copy and break active-turn and overflow progress decisions.
- Pressure pruning could derive provider-visible content from local RawContent.

Root cause:
- ModelMessages has a zero-copy fast path, but request-only metadata cleanup assumed an isolated slice.
- The pressure prune source preferred RawContent over bounded Content.

Fix:
- Detach the request message slice before request-only rewrites.
- Prune only provider-visible Content or the legacy ProviderContent representation.
- Add regressions for input immutability and RawContent pressure isolation.

Verification:
- go test ./...
- go test -race ./internal/agent
- ./scripts/cache-guard.sh
- go vet ./...
- go run ./tools/repolint

* Harden tool-result migration isolation

Problem:
- promoted sidecars could retain full tool-result bodies after their hashes were migrated
- restricted capability frontends could share a session reader across agents

Root cause:
- sidecar migration normalized only covered hashes
- clone paths handled only bare UseCapabilityTool instances

Fix:
- normalize exact promoted projection bodies to canonical bounded Content and fail closed on ambiguous bodies
- clone restricted frontends, resolvers, and allowlists for subagents and planners
- add load, recovery-copy, duplicate-ID, schema-stability, and session-isolation regressions

Verification:
- go test ./internal/agent ./internal/boot -count=1
- go test -race ./internal/agent -count=1
- ./scripts/cache-guard.sh
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint

* Satisfy capability clone lint

Problem:
- CI lint rejected the bool-map clone loop under the modernize ruleset

Root cause:
- the helper used a manual map assignment loop

Fix:
- copy immutable allowlist snapshots with maps.Copy

Verification:
- golangci-lint run --timeout=5m
- go test ./internal/agent -run 'Test(RestrictedCapabilityFrontendCloneKeepsAgentSessionsIsolated|PlannerRestrictedCapabilityFrontendCloneKeepsExecutorSession|PlannerToolRegistryClonesUseCapability)' -count=1
- go vet ./internal/agent
- go run ./tools/repolint

* Fix path-bound tool-result session binding

Problem:
- explicit write_paths subagents exposed use_capability but could not read their own retained tool results

Root cause:
- pathBoundCapabilityProxy did not forward the session binder and cloneCapabilityFrontend did not rebuild that wrapper around an agent-owned frontend

Fix:
- forward session binding through the path-bound wrapper
- deep-clone its inner unrestricted or restricted frontend before rebuilding the wrapper
- cover parent/child session isolation and provider-visible schema stability

Verification:
- go test ./...
- go test -race ./internal/agent
- go vet ./...
- golangci-lint run --timeout=5m
- go run ./tools/repolint
- ./scripts/cache-guard.sh

2026-08-17 22:20:00 +08:00

..

cache-aware-compaction-design.md

Fix tool-result cache prefix stability / 修复工具结果缓存前缀稳定性 (#9033)

2026-08-17 22:20:00 +08:00