Session 日志可被空 toolCallId 永久锁死：崩溃恢复每次都在同一 seq 自锁

[guwenwu112233-dot]

发给DeepSeek_空toolCallId锁死会话.md

Session 日志可被空 toolCallId 永久锁死：崩溃恢复每次都在同一 seq 自锁

产品：DSH Desktop 0.11.0（Windows / win32-x64）
组件：dsh-session-persistence-jsonl + session-format-v4 校验 + agent-loop interruptedTurnClosers 恢复
会话格式：v4（session.v4.jsonl.zstd）
触发供应商：任意 OpenAI 兼容网关，本例为 agnes（api: openai-completions，模型 agnes-3.0-flash）
实际发生时间：2026-10-15 10:36（本地）
严重度建议：高（会话不可恢复损坏、无用户侧绕行手段、每次恢复重试都复现同一失败）

---

1. 摘要

当 OpenAI 兼容供应商返回的 tool call 带有空字符串 id（或空 name）时，DSH 的写路径只校验"该字段是字符串"，空串被放行并落盘。此后：

• 该轮次无法闭合；
• agent-loop 的崩溃恢复会给这条未闭合的 tool call 合成一条 tool/result 错误，但合成结果必然要过校验 toolCallId === source.callId，而来源 callId 是空串；
• 于是恢复逻辑自己把自己判死，每次恢复/重试都在同一 seq 抛出同一个错误，日志永远停在那一行。

即：一个上游畸形字段，把一份会话日志变成永久不可恢复。

类别说明：这不是安全漏洞（不涉及越权、注入或数据外泄），而是会话日志的健壮性/数据完整性缺陷——触发源是上游供应商返回的畸形字段，后果是用户数据不可恢复。归类到「service-stability」或「会话损坏」即可。

2. 实际错误

本轮运行失败
format v4 tool/result at seq 829 requires toolCallId matching its tool source
UNKNOWN
仅可从已完成轮次的最后一条消息分支
用量 793K tok

3. 触发链路（实测）

1. 同一时刻 DeepSeek 搜索端点返回 HTTP 503 Service is too busy，模型失去检索能力（该事件本身正常落盘于 seq 824，isError: true）。
2. 模型改用 write 工具直接落一个脚本，但经过 OpenAI 兼容网关返回的 tool call 里 id、name 均为空串，参数还多了一个空键（{"write":"","content":...}）。
3. DSH 原样落盘 → assistant/message（seq 827）内嵌的 tool-call block 与 tool/call（seq 828）身份同为空。
4. 紧接着要写 tool/result（seq 829）时校验失败，轮次整体作废，文件回滚并停在 seq 828（该会话物理日志里不存在 seq 829）。

日志尾部（session.v4.jsonl.zstd，已解压）:

{"type":"assistant/message","seq":827,...,"data":{"message":{"role":"assistant","content":[
  {"type":"text","text":"<text omitted>"},
  {"type":"tool-call","id":"","name":"","arguments":"{\"write\":\"\",\"content\":\"import urllib.request…\"}"}
],"source":{"kind":"model","provider":"agnes","model":"agnes-3.0-flash",
  "replayState":{"response":{"kind":"pi-ai","version":2,"api":"openai-completions","stopReason":"toolUse"}}}}}}

{"type":"tool/call","seq":828,"data":{"turn":7,"step":6,"callId":"","name":"","arguments":"{\"write\":\"\",\"content\":\"…\",\"file_path\":\"…\"}"}}

4. 关键代码

4.1 校验器（app.asar 行 889062 与 907730，两份 bundle 各一份）

const sourceCallId = isSessionFormatJsonObject(source) ? source["callId"] : void 0;
if (typeof toolCallId !== "string" || toolCallId.length === 0 || sourceCallId !== toolCallId)
  throw new SessionFormatError(`${subject} requires toolCallId matching its tool source`);

这条校验本身是正确的（它已经明确检查 toolCallId.length === 0 与 sourceCallId !== toolCallId）。真正的缺口在写入侧：它允许把 callId === "" 的 tool call 落盘，等价于给此后所有 tool/result 埋下一个永远无法满足的前置条件。

4.2 v4 bundle 中合成 closer 的实际构造（app.asar 行 880522–880561，ToolCallRecovery.results()）

for (const [callId, { turn, step, callSeq }] of this.pendingCalls) {
    const started = callSeq !== undefined;
    const message = deepFreeze({
        id: brandString(`${this.cause.kind}-tool-result-${callId}-${seq}`),
        role: 'tool',
        toolCallId: callId,                 // ← pendingCalls 里存的空串，原样传出
        isError: true,
        source: { kind: 'tool', callId },   // ← 同上
        content: [{ type: 'text', text: started ? text.started : text.notStarted }],
    });
    results.push({
        type: 'tool/result', seq: SessionSeq(seq++), time,
        data: { turn, step, message,
                error: started ? { name: 'ToolOutcomeUnknownError', code: TOOL_OUTCOME_UNKNOWN }
                               : { name: 'ToolNotStartedError', code: TOOL_NOT_STARTED } },
        surfaceOp: 'append',
        ...started ? { sourceEventSeqs: [callSeq] } : {},
    });
}

pendingCalls 的来源是同一个 v4 bundle 里 ToolCallRecovery.observe() 对 assistant/message 的收集：this.pendingCalls.set(block.id, { turn, step })（行 880492）。block.id 为空串时，这一对 toolCallId / source.callId 就是两个空串——在任何写入之前就已经注定不合规。

4.3 官方文档中承诺的恢复路径（app.asar 行 892285，dsh-session-persistence-jsonl README 中文章节「恢复与崩溃恢复」）

持久化返回物理上有效的日志；语义修复属于读方。中途崩溃的会话保留其未闭合的最终轮次……恢复（agent-loop）通过其写句柄读取已存储日志，计算 interruptedTurnClosers——合成 tool/result 错误、任何未闭合的 step/end，以及 turn/end {interrupted}——并把它们作为普通批次通过同一句柄追加。

结论：恢复机制本身是健康的（合成 closer 并把它们作为普通批次 append），但 4.2 生成的 closer 引用的是空 callId 的来源，于是在这批 append 上直接撞上 4.1 的校验。openTurnClosers 的契约（v4 bundle 行 880420）也决定了没有"先不闭合"这条退路：未闭合的 turn 只有"合成 closer 关闭"一种结局。

5. 最小复现

1. 配置一个上游会返回 "id": "" 的 OpenAI 兼容工具调用供应商（或直接构造该响应）。
2. 让它发一次任意工具调用（例如 write），使会话日志出现：

{"type":"assistant/message","seq":N,"data":{"message":{"content":[{"type":"tool-call","id":"","name":"","arguments":"{}"}]}}}
{"type":"tool/call","seq":N+1,"data":{"callId":"","name":"","arguments":"{}"}}

3. 让下一步的 tool/result 落盘，或直接触发崩溃恢复（关闭应用再以写模式重新打开该会话）。

预期：会话被拒绝读取/写入，抛 format v4 tool/result at seq N+2 requires toolCallId matching its tool source；此后每次恢复都在同一 seq 失败。崩溃恢复在 results() 里生成的合成结果会同时带上两个空身份（toolCallId: ""、source.callId: ""），其消息 id 也会退化成 …-tool-result--<seq> 这种双横线形式。

6. 影响

• 会话日志永久不可恢复（用户侧无绕行手段，只能丢弃该会话或从更早的已完成轮次分支，后者会丢掉整轮上下文）。
• 失败发生在轮次收尾阶段，该轮的落盘副作用（文件写入等）已经发生但账目丢失，用户看到"处理失败"却无法判断磁盘状态。
• 触发条件完全由上游供应商控制，DSH 侧无预警、无提示。

7. 修复建议（按优先级）

1. 写入侧守卫（最小改动、收益最大）：tool call 在持久化之前强制 callId 非空。上游缺失时不要写入空身份，而是当场合成一个稳定 id（例如 call_recovered_<seq>），并让它同时进入 assistant/message 的 tool-call block 与 tool/call 行——这样后续任何 tool/result（包括崩溃恢复合成的）都能满足 4.1 的等式。name 同理；空 name 目前也会落盘并让工具注册表查找失败。
2. 恢复侧兜底：ToolCallRecovery.results() 生成 toolCallId / source.callId 前，对空 callId 做一次归一（合成 id），使 interruptedTurnClosers 在任何历史数据上都能收尾；assertV4ToolResultMessage 对"来源为空"的历史记录应按可恢复尾部处理，而不是让整个 artifact 读取失败。
3. 回归测试：以"空 id/空 name 的 tool call 落盘后触发恢复"为 fixture，断言会话仍可打开、能正常收尾，且不产生空身份。
4. 入口文档：在供应商接入说明中写明 openai-completions 网关返回的 tool call id 必须非空（本例 agnes 走该网关且返回了空 id），说明 DSH 侧会归一或拒绝。

8. 本地已验证的缓解（非官方修复）

把坏记录的身份补成真值即可解锁恢复（下面的 call_1f0a7c93b4e24d6a8f21c05d 是修复脚本新生成的合成 id，非任何既有标识）：

• seq 827 内嵌 tool-call block：id/name 补为 call_1f0a7c93b4e24d6a8f21c05d / write；
• seq 828 tool/call：callId/name 同上，参数归一为 {"content":…,"file_path":…}（与该会话其余 145 条同形）；
• 追加 seq 829 tool/result：toolCallId === source.callId === call_1f0a7c93b4e24d6a8f21c05d，isError: true，sourceEventSeqs: [828]，surfaceOp: "append"；
• 事件 0..826 逐字节未改；seq 0..829 稠密；146 个 tool call ↔ 146 个 result 全配对；zstd 单帧可读。

修复后自检全部通过，恢复路径的阻塞点解除。（备份与原文件逐字节同期保留。）

9. 完整证据链

以下输出均由只读脚本 evidence_dump.py --redact 生成。主机路径、会话 id、消息 id、供应商 responseId 与助手/标题文本已隐去；可复核字段（工具名、参数键、配对 id、seq、行结构、工具错误文案）原样保留。不带 --redact 运行时输出本机真实值，便于在自己环境核对。

A. 结构性事实

A.1 损坏的原始日志（崩溃后未恢复的物理状态）

header: {"type": "session", "version": 4, "id": "<session-id>", "createdAt": 1792019514302, "cwd": "<workspace>", "isSeeded": false, "delegationDepth": 0, "agentPreset": "standard"}
decompressed bytes: 1499235 events: 829 max seq: 828
seq dense: True
MALFORMED tool-call block seq=827 id='' name='' args=3182 chars
MALFORMED tool/call seq=828 name='' callId=''

要点：物理日志的最大 seq 是 828，seq 稠密（0..828），不存在 seq 829。也就是说报错里点名的 tool/result at seq 829 从未成功落盘——失败发生在写入校验阶段，而不是读取/解码阶段。

A.2 坏记录原文（seq 828，脱敏）

{"type":"tool/call","seq":828,"time":1792031787744,"data":{"turn":7,"step":6,"callId":"","name":"","arguments":{"write":"","content":"import urllib.request, ssl, json, os, time, urllib.parse\n\nct …<2909 chars total>","file_path":"<workspace>\\<redacted>.py"}}}

注意 callId 与 name 都是空串，且 arguments 里多出一个空键 "write": ""——这是上游 OpenAI 兼容网关返回的畸形 tool call 被原样落盘的结果。对应的 assistant/message（seq 827）内嵌 block 同样是空身份：

{"type":"assistant/message","seq":827,"time":1792031787742,"data":{"turn":7,"step":6,"message":{"role":"assistant","content":[{"type":"text","text":"<text omitted>"},{"type":"tool-call","id":"","name":"","arguments":"{\"write\":\"\",\"content\":\"import urllib.request, ssl, json, os, time, urllib.parse\\n\\nctx = s …<malformed payload>"}],"source":"<provider metadata omitted>","id":"<message-id>"}},"surfaceOp":"append"}…

B. 修复后的三行证据链

B.1 assistant/message seq 827 —— 内嵌 tool-call block 已带上真实身份

== assistant/message seq 827 ==
message id: <message-id>
source: {"kind": "model", "provider": "agnes", "model": "agnes-3.0-flash", "replayState": {"response": {"kind": "pi-ai", "version": 2, "api": "openai-completions", "provider": "agnes", "model": "agnes-3.0-flash", "responseId": "<provider-response-id>", "stopReason": "toolUse"}, "blocks": [{"type": "text"}, {"type": "tool-call"}]}}
  block: {"type": "text", "text": "<text omitted>"}
  block: {"type": "tool-call", "id": "call_1f0a7c93b4e24d6a8f21c05d", "name": "write", "arguments": "{\"content\":\"import urllib.request, ssl, json, os, time, urllib.parse\\n\\nctx = ss …<normalized payload>"}

{"type":"assistant/message","seq":827,"time":1792031787742,"data":{"turn":7,"step":6,"message":{"role":"assistant","content":[{"type":"text","text":"<text omitted>"},{"type":"tool-call","id":"call_1f0a7c93b4e24d6a8f21c05d","name":"write","arguments":"{\"content\":\"import urllib.request, ssl, json, os, time, urllib.parse\\n\\nctx = ssl._create_ …<normalized payload>"}],"source":{"kind":"model","provider":"agnes","model":"agnes-3.0-flash","replayState":{"response":{"kind":"pi-ai","version":2,"api":"openai-completions","provider":"agnes","model":"agnes-3.0-flash","responseId":"<provider-response-id>","stopReason":"toolUse"},"blocks":[{"type":"text"},{"type":"tool-call"}]}},"id":"<message-id>"},"usage":{"inputTokens":611,"outputTokens":1055,"totalTokens":133762,"cacheReadTokens":132096},"stream":[{"type":"chunk","time":1792031767786,"chunk":{"type":"block-start","index":0,"blockType":"text"…

B.2 tool/call seq 828 —— 参数归一为 {content, file_path}

{"type":"tool/call","seq":828,"time":1792031787744,"data":{"turn":7,"step":6,"callId":"call_1f0a7c93b4e24d6a8f21c05d","name":"write","arguments":{"content":"import urllib.request, ssl, json, os, time, urllib.parse\n\nct …<2909 chars total>","file_path":"<workspace>\\<redacted>.py"}}}

B.3 tool/result seq 829 —— 补上的结果，身份与被修好的来源一致

{"type":"tool/result","seq":829,"time":1792031787745,"data":{"turn":7,"step":6,"message":{"role":"tool","source":{"kind":"tool","callId":"call_1f0a7c93b4e24d6a8f21c05d"},"toolCallId":"call_1f0a7c93b4e24d6a8f21c05d","content":[{"type":"text","text":"Error: run failed before this tool result was recorded (session log repair)"}],"isError":true,"id":"<message-id>"},"error":{"name":"SessionRepair","code":"TOOL_RESULT_RECOVERED"}},"sourceEventSeqs":[828],"surfaceOp":"append"}

C. 全量校验结果（修复后）

== tool/result seq 829 ==
toolCallId='call_1f0a7c93b4e24d6a8f21c05d' source.callId='call_1f0a7c93b4e24d6a8f21c05d'
message id: <message-id>
isError: True | text: Error: run failed before this tool result was recorded (session log repair)
row keys: ['data', 'seq', 'sourceEventSeqs', 'surfaceOp', 'time', 'type'] | sourceEventSeqs: [828] | surfaceOp: append

validation: PASS - every checked V4 rule holds

校验覆盖：seq 稠密（0..829）、146 个 tool/call ↔ 146 个 tool/result 一一配对、每条结果的 toolCallId === source.callId、sourceEventSeqs === [对应 call 的 seq]、assistant/message 内嵌 block 的 id 都能找到对应 call 行、事件时间单调。

D. 复核脚本（只读，可直接保存运行）

"""Investigation helper (sanitized): walk a DSH V4 transcript, verify tool-call/result
pairing, and dump before/after evidence for the empty-toolCallId defect.

Usage:
    python evidence_dump.py <path-to-session.v4.jsonl.zstd> [--redact]
    python evidence_dump.py <path-to-session.v4.jsonl.zstd> <seq-a> <seq-b> <seq-c> [--redact]

Phase 1  (no seq args): print structural facts + every malformed identity.
Phase 2  (three seq args): dump the assistant/message -> tool/call -> tool/result chain
                            and run the full V4 pair validation.

Read-only; writes nothing.
"""
import json
import sys

sys.stdout.reconfigure(encoding="utf-8", errors="replace")
from compression import zstd


def load(path):
    data = zstd.ZstdFile(path, "rb").read()
    rows = [json.loads(l) for l in data.split(b"\n") if l.strip()]
    return data, rows[0], rows[1:]


REDACT = "--redact" in sys.argv


def head(obj, limit):
    """Serialize one value for display, hiding host-identifying values when --redact is set.

    A session/message `id` is hidden; a nested tool-call block `id` is the call
    identity and survives, because it is the evidence under inspection.
    """
    if not REDACT:
        return json.dumps(obj, ensure_ascii=False)[:limit]
    import copy
    o = copy.deepcopy(obj)

    def walk(node):
        if isinstance(node, list):
            for item in node:
                walk(item)
            return
        if not isinstance(node, dict):
            return
        # a message carries `role`; a replayState.response does not.
        if isinstance(node.get("id"), str) and "role" in node:
            node["id"] = "<message-id>"
        if isinstance(node.get("responseId"), str):
            node["responseId"] = "<provider-response-id>"
        if isinstance(node.get("text"), str):
            node["text"] = "<text omitted>"
        for value in node.values():
            walk(value)

    walk(o)
    return json.dumps(o, ensure_ascii=False)[:limit]


def main():
    path = sys.argv[1]
    data, header, events = load(path)
    seq_args = [a for a in sys.argv[2:] if a.lstrip("-").isdigit()]

    if not seq_args:
        shown = dict(header)
        if REDACT:
            shown["id"] = "<session-id>"
            shown["cwd"] = "<workspace>"
        print("header:", head(shown, 400))
        print("decompressed bytes:", len(data), "events:", len(events),
              "max seq:", max(e["seq"] for e in events))
        print("seq dense:", [e["seq"] for e in events] == list(range(len(events))))
        for e in events:
            if e["type"] == "tool/call" and not e["data"].get("callId"):
                print("MALFORMED tool/call seq=%s name=%r callId=%r"
                      % (e["seq"], e["data"].get("name"), e["data"].get("callId")))
                if REDACT:
                    print("  raw row:", json.dumps({**e, "data": {**e["data"],
                          "arguments": '{"write":"","content":"…","file_path":"<workspace>\\\\<redacted>.py"}'}},
                          ensure_ascii=False))
                else:
                    print("  raw row:", json.dumps(e, ensure_ascii=False)[:220])
            if e["type"] == "assistant/message":
                for b in e["data"]["message"]["content"]:
                    if b.get("type") == "tool-call" and (not b.get("id") or not b.get("name")):
                        print("MALFORMED tool-call block seq=%s id=%r name=%r args=%d chars"
                              % (e["seq"], b.get("id"), b.get("name"), len(b.get("arguments") or "")))
        return

    a_seq, call_seq, res_seq = (int(x) for x in seq_args[:3])
    by_seq = {e["seq"]: e for e in events}

    a = by_seq[a_seq]["data"]["message"]
    print("== assistant/message seq %d ==" % a_seq)
    print("message id:", a.get("id") if not REDACT else "<message-id>")
    print("source:", head(a.get("source"), 400))
    for b in a["content"]:
        bb = dict(b)
        if bb.get("type") == "tool-call":
            bb["arguments"] = (bb.get("arguments") or "")[:80] + " ...[truncated]"
        print("  block:", head(bb, 600))

    c = by_seq[call_seq]
    print("\n== tool/call seq %d ==" % call_seq)
    print("callId=%r name=%r" % (c["data"].get("callId"), c["data"].get("name")))
    args = json.loads(c["data"]["arguments"])
    print("argument keys:", list(args.keys()))
    if "file_path" in args:
        name = args["file_path"].replace("/", "\\").rsplit("\\", 1)[-1]
        print("file_path basename:", name if "--redact" not in sys.argv else "<redacted>.py")
    print("content chars:", len(args.get("content") or ""))

    r = by_seq[res_seq]
    m = r["data"]["message"]
    print("\n== tool/result seq %d ==" % res_seq)
    print("toolCallId=%r source.callId=%r" % (m.get("toolCallId"), (m.get("source") or {}).get("callId")))
    print("message id:", m.get("id") if not REDACT else "<message-id>")
    print("isError:", m.get("isError"), "| text:", (m.get("content") or [{}])[0].get("text", "")[:90])
    print("row keys:", sorted(r.keys()), "| sourceEventSeqs:", r.get("sourceEventSeqs"),
          "| surfaceOp:", r.get("surfaceOp"))

    # full V4 pair validation
    problems = []
    calls = {}
    for e in events:
        if e["type"] == "tool/call":
            cid = e["data"].get("callId")
            if not isinstance(cid, str) or not cid:
                problems.append("empty callId at seq %s" % e["seq"])
            calls.setdefault(cid, []).append(e["seq"])
    for e in events:
        if e["type"] == "tool/result":
            mm = e["data"].get("message") or {}
            cid = mm.get("toolCallId")
            if not isinstance(cid, str) or not cid or (mm.get("source") or {}).get("callId") != cid:
                problems.append("seq %s toolCallId/source mismatch" % e["seq"])
            elif cid not in calls:
                problems.append("seq %s orphan result" % e["seq"])
            elif e.get("sourceEventSeqs") != calls[cid]:
                problems.append("seq %s sourceEventSeqs %r != %r"
                                % (e["seq"], e.get("sourceEventSeqs"), calls[cid]))
    for e in events:
        if e["type"] == "assistant/message":
            for b in e["data"]["message"]["content"]:
                if b.get("type") == "tool-call" and (not b.get("id") or not b.get("name")):
                    problems.append("seq %s tool-call block missing id/name" % e["seq"])
                elif b.get("type") == "tool-call" and b.get("id") not in calls:
                    problems.append("seq %s tool-call block id has no call row" % e["seq"])
    print("\nvalidation:", "PASS - every checked V4 rule holds" if not problems else problems)


main()

用法：

python evidence_dump.py <session.v4.jsonl.zstd> --redact
python evidence_dump.py <session.v4.jsonl.zstd> 827 828 829 --redact

不带 --redact 时输出本机真实值，便于维护者在自己环境里核对。脚本只读，不写任何文件。