W18: context cleanup + CLI fixes + loader audit + CI matrix (W18.1-W18.4)

- W18.1 (王测+林深): Remove g_max_tokens dead API, UTF-8 bounds protection, deduplicate token counting, 0xC0/0xC1 handling, add 13 test blocks (36 checks) - W18.2 (赵码+朱晴): Fix /context no-session error message, /status 3-state connection display - W18.3 (曹武+徐磊): plugin_loader security audit — 9 dimensions, rating C, 1 HIGH + 2 MEDIUM findings - W18.4 (马奔+胡桐): CI dual-platform matrix (Ubuntu clang-18 + Windows clang-cl), ccache, build timing baseline Build 0 error, ctest 5/5 pass, metadata check clean. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-27 19:09:21 +08:00
parent 852e2cac08
commit c545d16120
18 changed files with 945 additions and 77 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,11 @@ on:
  pull_request:
    branches: [master]

+env:
+  CMAKE_BUILD_PARALLEL_LEVEL: 0
+  CCACHE_DIR: ${{ github.workspace }}/.ccache
+  CCACHE_MAXSIZE: 256M
+
 jobs:
  # ── 动态矩阵 ──────────────────────────────────────────────
  # PR 仅跑 Ubuntu 节省 minutes；push master 跑全矩阵 Ubuntu + Windows
@@ -36,11 +41,48 @@ jobs:
    runs-on: ${{ matrix.os }}

    steps:
+      # ── 1. 源码检出 ──────────────────────────────────────
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

+      # ── 2. 平台编译工具链 ─────────────────────────────────
+      # Ubuntu: clang-18 + Ninja + ccache
+      - name: Install toolchain (Ubuntu)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq clang-18 ninja-build ccache
+          echo "CC=clang-18" >> $GITHUB_ENV
+          echo "CXX=clang++-18" >> $GITHUB_ENV
+
+      # Windows: LLVM (clang-cl) + Ninja + ccache
+      - name: Install toolchain (Windows)
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          choco install -y llvm ninja ccache --no-progress 2>/dev/null || true
+          # Add clang-cl to PATH (both possible locations)
+          if [ -d "/c/Program Files/LLVM/bin" ]; then
+            echo "/c/Program Files/LLVM/bin" >> $GITHUB_PATH
+          elif [ -d "/c/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/x64/bin" ]; then
+            echo "/c/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/x64/bin" >> $GITHUB_PATH
+          fi
+          echo "CC=clang-cl" >> $GITHUB_ENV
+          echo "CXX=clang-cl" >> $GITHUB_ENV
+
+      # ── 3. ccache 缓存恢复 ────────────────────────────────
+      - name: Cache ccache
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.CCACHE_DIR }}
+          key: ${{ runner.os }}-ccache-${{ matrix.build_type }}-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-ccache-${{ matrix.build_type }}-
+            ${{ runner.os }}-ccache-
+
+      # ── 4. Python + Conan ─────────────────────────────────
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
@@ -49,6 +91,7 @@ jobs:
      - name: Install Conan
        run: pip install conan

+      # ── 5. Conan 依赖缓存 ─────────────────────────────────
      - name: Cache Conan
        uses: actions/cache@v4
        with:
@@ -60,16 +103,57 @@ jobs:
            ${{ runner.os }}-conan-${{ matrix.build_type }}-
            ${{ runner.os }}-conan-

+      # ── 6. Conan 依赖安装 ─────────────────────────────────
      - name: Install Conan dependencies
+        shell: bash
        run: |
          conan profile detect --force
          conan install deps --build=missing -s build_type=${{ matrix.build_type }}

+      # ── 7. CMake 配置 ─────────────────────────────────────
      - name: Configure CMake
-        run: cmake --preset conan-release
+        shell: bash
+        run: |
+          cmake --preset ci-release \
+            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
+            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache

+      # ── 8. 构建（含计时） ─────────────────────────────────
      - name: Build
-        run: cmake --build --preset conan-release --config ${{ matrix.build_type }}
+        id: build
+        shell: bash
+        run: |
+          echo "::group::Build (${{ matrix.os }})"
+          START_NS=$(date +%s%N 2>/dev/null || echo 0)
+          START_S=$(date +%s)
+          cmake --build --preset ci-release --config ${{ matrix.build_type }}
+          END_S=$(date +%s)
+          END_NS=$(date +%s%N 2>/dev/null || echo 0)
+          DURATION=$((END_S - START_S))
+          echo "::endgroup::"
+          echo "duration=${DURATION}" >> $GITHUB_OUTPUT
+          echo "Build wall time: ${DURATION}s"

+      # ── 9. ccache 统计 ────────────────────────────────────
+      - name: ccache stats
+        if: always()
+        shell: bash
+        run: |
+          ccache -s || echo "ccache stats unavailable"
+          ccache -z || true
+
+      # ── 10. 测试 ──────────────────────────────────────────
      - name: Test
-        run: ctest --preset conan-release -C ${{ matrix.build_type }} --output-on-failure
+        shell: bash
+        run: ctest --preset ci-release -C ${{ matrix.build_type }} --output-on-failure
+
+      # ── 11. 构建时间摘要 ──────────────────────────────────
+      - name: Build time summary
+        if: always()
+        shell: bash
+        run: |
+          DURATION="${{ steps.build.outputs.duration }}"
+          echo "| Platform | Compiler | Build Time |" >> $GITHUB_STEP_SUMMARY
+          echo "|----------|----------|-----------|" >> $GITHUB_STEP_SUMMARY
+          echo "| ${{ matrix.os }} | ${{ (runner.os == 'Linux' && 'clang-18') || 'clang-cl' }} | ${DURATION}s |" >> $GITHUB_STEP_SUMMARY
+          echo "CI build: ${{ matrix.os }} / ${{ (runner.os == 'Linux' && 'clang-18') || 'clang-cl' }} wall time ${DURATION}s"
--- a/CMakePresets.json
+++ b/CMakePresets.json
@@ -30,6 +30,18 @@
            },
            "toolchainFile": "generators\\conan_toolchain.cmake",
            "binaryDir": "E:\\Prj2026\\AIGen2026\\dstalk\\build\\build\\Release"
+        },
+        {
+            "name": "ci-release",
+            "displayName": "CI Release (cross-platform)",
+            "description": "Cross-platform CI build; compiler set via Conan CMakeToolchain",
+            "generator": "Ninja",
+            "cacheVariables": {
+                "CMAKE_POLICY_DEFAULT_CMP0091": "NEW",
+                "CMAKE_BUILD_TYPE": "Release"
+            },
+            "toolchainFile": "${sourceDir}/build/Release/conan_toolchain.cmake",
+            "binaryDir": "${sourceDir}/build/ci"
        }
    ],
    "buildPresets": [
@@ -37,6 +49,11 @@
            "name": "conan-release",
            "configurePreset": "conan-release",
            "jobs": 32
+        },
+        {
+            "name": "ci-release",
+            "configurePreset": "ci-release",
+            "jobs": 0
        }
    ],
    "testPresets": [
@@ -49,6 +66,13 @@
            "environment": {
                "OPENSSL_MODULES": "C:\\Users\\Administrator\\.conan2\\p\\b\\opens4d81e45a1d5f5\\p\\lib\\ossl-modules"
            }
+        },
+        {
+            "name": "ci-release",
+            "configurePreset": "ci-release",
+            "execution": {
+                "jobs": 0
+            }
        }
    ]
 }
--- a/agents/architect-lin/profile.md
+++ b/agents/architect-lin/profile.md
@@ -42,6 +42,9 @@ performance_log:
  - date: 2026-05-27
    event: "W14.4 完成：诊断 W12.2 双 store 整合未生效根因——测试加载了 build/tests/plugins/ 下 pre-W12.2 的旧 DLL，而非 build/plugins/ 下 post-W12.2 新 DLL。修复：host.cpp 新增插件目录 fallback 搜索（plugins/ -> ../plugins/），清理 build/tests/ 下陈旧产物。build 0 error，4/4 test pass，R2 由 WARN 变 PASS"
    rating: completed
+  - date: 2026-05-27
+    event: "W18.1 (协作 王测): 关闭 F-11.1-3/4/5/6 共4条 context_plugin 遗留发现。(3) 删除 g_max_tokens + context_set_max_tokens API，更新 dstalk_services.h 移除 vtable 字段，trim_impl 硬编码默认值 4096 + max_msg_count 改用 max_tokens 参数；(4) count_tokens_utf8 共享函数新增多字节序列越界保护（i+N>=len + 后继字节 & 0xC0 校验）；(5) 提取 count_tokens_utf8 消除 count_tokens_one_message/count_tokens_trim 双份重复；(6) c==0xC0||0xC1 独立分支检测过短编码。新增 context_plugin_test.cpp 13 测试块。编译 0 error + ctest 5/5 pass。"
+    rating: completed
 current_groups:
  - grp-quality-core (成员)
  - grp-ai-plugins (待命)
--- a/agents/audits/W18.3-plugin-loader-audit.md
+++ b/agents/audits/W18.3-plugin-loader-audit.md
@@ -0,0 +1,225 @@
+# W18.3 Plugin Loader Security Audit
+
+**Auditors**: 曹武 (security-cao), 徐磊 (qa-xu)
+**Date**: 2026-05-27
+**File**: dstalk-core/src/plugin_loader.cpp + plugin_loader.hpp (385 lines total)
+**Wave Coverage**: 零 (从未被 Wave 流程审计)
+**Reference**: plugin-abi.md §3 §5 §6 §8
+
+---
+
+## 1. ABI 安全与异常安全 (§5.3, §8)
+
+**评级: F (多个 C ABI 边界无保护)**
+
+`PluginLoader` 调用插件的 C 函数指针 (`on_init`, `on_shutdown`, `init_fn`) 全路径零 try/catch 保护:
+
+| 调用点 | 位置 | 函数指针签名 | 保护 |
+|--------|------|-------------|------|
+| `init_fn()` | load_plugin L59 | `dstalk_plugin_init_fn` → `dstalk_plugin_info_t*(*)(void)` | **无** |
+| `on_init(host_api)` | initialize_all L237 | `int (*)(const dstalk_host_api_t*)` | **无** |
+| `on_init(host_api)` | initialize_pending L272 | 同上 | **无** |
+| `on_shutdown()` | unload_plugin L108-109 | `void (*)(void)` | **无** |
+| `on_shutdown()` | shutdown_all L306-307 | 同上 | **无** |
+
+L250-255 的 catch 块仅保护 `topological_sort()`——`on_init` 调用在 try 块**外部**。L237 和 L272 两处 `on_init` 调用均在 try 块覆盖范围之外。若某个插件的 C++ 实现抛出 `std::bad_alloc` 或任何其他异常，异常沿 C 函数指针返回 → `std::terminate()` → 进程崩溃。
+
+这是 F-11.1-1 的 loader 侧对偶问题：F-11.1-1 要求插件侧包裹 try/catch，但 loader 侧也需要防御性保护——某个插件未严格遵守 §8 规范时，host 不应因此而崩溃。
+
+**影响**: 任意一个未做异常防护的插件在 OOM 或 STL 异常时即可拖垮整个 host 进程。防御深度缺失。
+
+---
+
+## 2. 堆纪律 (§3)
+
+**评级: A (完全合规)**
+
+逐调用点检查:
+
+| 调用类型 | 搜索结果 | 判定 |
+|----------|----------|------|
+| `malloc` / `free` | 0 处 | -- |
+| `strdup` (裸) | 0 处 | -- |
+| `new` / `delete` (显式) | 0 处 | -- |
+| `std::string` / `std::vector` | L83-85, L93, L123-142 | Host 内部使用, 不跨边界 |
+| `boost::json` | L125-142 | Host 堆, 不跨边界 |
+
+PluginLoader 是 host 侧组件——所有 `std::string`/`std::vector`/`json::object` 分配均在 host CRT 堆内, 不存在跨 DLL 堆风险。插件返回的 name/version/description 在 L83-85 通过 `std::string` 构造器复制到 host 侧, 符合 §2.2 契约。
+
+---
+
+## 3. 并发安全 (§6.5)
+
+**评级: C (文档声明单线程但无强制)**
+
+| 变量 | 写入点 | 读取点 | 同步 |
+|------|--------|--------|------|
+| `next_id_` (L54) | L80 `next_id_++` | L80 (读-改-写) | **无** |
+| `plugins_` map | L96 (insert), L119 (erase), L323 (clear) | L102, L126, L149, L213, L263, L302, L328 | **无** |
+| `PluginInfo::initialized` | L89, L217-246, L271-278, L306-309 | L108, L217, L271, L306 | **无** |
+
+§6.5 明确声明 "PluginLoader 无内部互斥...load/unload 不应在多线程中并发调用"。但 host.cpp 中:
+- `dstalk_init` / `dstalk_shutdown` 持有 `g_init_mutex`
+- `dstalk_plugin_load` / `dstalk_plugin_unload` **不持有** `g_init_mutex`
+
+这意味着在 `dstalk_init` 持有锁期间调用 `dstalk_plugin_load` 会死锁(不可重入 mutex), 但两个 `dstalk_plugin_load` 并发调用则无保护。虽然实际使用中可能不会并发, 但 zero enforcement 是防御深度缺失。
+
+---
+
+## 4. 输入验证
+
+**评级: C (仅 null 检查, 无路径内容校验)**
+
+`load_plugin(const char* path)` (L26):
+- L28: `if (!path) return -1` — null 检查 OK
+- L32-35: path 直接传给 `LoadLibraryA` / `dlopen` — **无路径内容验证**
+
+`dstalk_plugin_load` 是公开 C API, 任何调用方可传入任意路径。无以下验证:
+- 路径是否为绝对路径 (相对路径触发 DLL 搜索顺序劫持风险)
+- 路径是否在预期插件目录内
+- 文件扩展名是否合法
+- 文件是否存在 (由 OS 层报错, 但不记录)
+
+---
+
+## 5. 路径安全与 DLL 完整性
+
+**评级: D (公开 API 无防护, 无来源验证)**
+
+`dstalk_plugin_load` 调用链: 用户输入 → `host.cpp:240` → `load_plugin(path)` → `LoadLibraryA(path)` / `dlopen(path)` — **零中间验证**。
+
+两个调用来源分析:
+
+| 来源 | 路径构造 | 安全评估 |
+|------|---------|----------|
+| `load_plugins_from_directory()` (host.cpp:150) | `fs::directory_iterator` → 绝对路径 + 扩展名白名单 | OK |
+| `dstalk_plugin_load()` 公开 API (host.cpp:240) | 调用方直接传入 | **无防护** |
+
+缺失的防护层:
+1. **路径规范化和目录约束**: 无 `fs::canonical` 解析, 无 allowed-dir 前缀检查
+2. **扩展名校验**: 公开 API 路径不做 `.dll`/`.so`/`.dylib` 检查
+3. **DLL 来源验证**: 无数字签名校验 (WinVerifyTrust), 无哈希白名单, 无证书链验证
+4. **符号链接/硬链接**: 无检测, 攻击者可创建指向任意 .so 的符号链接
+5. **Windows DLL 搜索顺序**: 相对路径触发搜索顺序劫持 (已知攻击向量)
+
+注意: 相对路径在 `load_plugins_from_directory` 中不会出现 (fs::path 迭代产生绝对路径), 但 `dstalk_plugin_load` 公开 API 无此保证。
+
+---
+
+## 6. 符号解析
+
+**评级: C (解析失败静默, 无诊断信息)**
+
+L42-47 `GetProcAddress` / `dlsym`:
+- 返回 nullptr 时正确卸载 DLL 并返回 -1 ✅
+- **未调用 `GetLastError()` / `dlerror()`**, 失败原因不可知
+- `(dstalk_plugin_init_fn)` 强制转型: 无签名验证机制。若插件导出同名但签名不同的函数 → 调用时 UB (栈损坏/寄存器错乱)
+- `dependencies` 数组 (L92-94) 仅按名称字符串匹配 (`topological_sort` L164), 无版本号约束。同名但不同版本的插件会产生隐蔽的初始化顺序错误
+
+---
+
+## 7. 错误处理
+
+**评级: D (零错误日志, 无错误码区分)**
+
+`load_plugin` 有 5 个独立失败点, 全部返回 -1 **且不记录任何日志**:
+
+| 失败点 | 行号 | 是否有日志 |
+|--------|------|-----------|
+| path 为 null | L28-29 | N/A (入口守卫) |
+| LoadLibrary/dlopen 失败 | L37-39 | **无** |
+| GetProcAddress/dlsym 失败 | L49-56 | **无** |
+| init_fn() 返回 null | L60-67 | **无** |
+| API 版本不匹配 | L70-77 | **无** |
+
+调用方 (host.cpp:240) 也仅检查 `id >= 0`, 不记录失败原因。生产环境中排查 "为什么插件加载失败" 需要附加调试器。
+
+`initialize_all` 中的 `fprintf(stderr, ...)` (L229, L239-240) 绕过了 host 日志基础设施——`host_api` 参数在手却不用 `host->log()`。在 GUI/服务进程中 stderr 可能被丢弃。
+
+---
+
+## 8. 日志安全
+
+**评级: B (格式化安全, 终端注入风险低)**
+
+- `fprintf(stderr, "[WARN] Plugin '%s' skipped...", plugin.name.c_str())` — 使用 `%s` 格式说明符, 无格式化字符串注入风险 ✅
+- `plugin.name.c_str()` 来自 `info->name` — 插件作者控制。理论上可注入 ANSI 转义序列 (VT100 控制字符) 到 stderr, 扰乱终端显示。CVSS 低 (仅影响日志可读性)。
+- `[ERROR]` 消息包含 `result` 错误码 (L239-240), 但 result 来自插件的 `on_init` 返回值——恶意插件可伪造错误码混淆日志。
+- 成功加载无日志 (对比: host.cpp L153-154 记录了成功加载, 但 `load_plugin` 内部无)
+
+---
+
+## 9. 资源清理
+
+**评级: B (正常路径正确, 异常路径有遗漏)**
+
+正常路径:
+- `load_plugin` 失败时正确调用 `FreeLibrary`/`dlclose` 释放已加载的 DLL ✅ (L51-55, L62-65, L71-75)
+- `shutdown_all` L313-322 逐个 `FreeLibrary`/`dlclose` 所有 handle ✅
+- `~PluginLoader` 调用 `shutdown_all()` ✅
+
+缺陷:
+- `PluginInfo` 无拷贝/移动控制: 含原始指针 `void* handle` 和 `dstalk_plugin_info_t* info`。若被拷贝 (当前 `std::move` 仅发生在 L96), 源对象析构后 handle/info 双悬垂。缺少 `=delete` 拷贝构造/赋值。
+- `shutdown_all` L306: 若 `on_shutdown()` 抛异常 (即使违反规范), 当前无保护——异常穿透 `shutdown_all` → 跳过后续插件的 shutdown + skip 所有 FreeLibrary → 句柄泄漏。`~PluginLoader` 也会因异常析构导致 terminate。虽然有 L294 `catch(...)` 降级路径, 但仅覆盖排序失败, 不覆盖 shutdown 回调。
+
+---
+
+## TOP 3 严重发现
+
+### 发现 1 — [HIGH] 5 处 C ABI 调用点 zero try/catch 保护 (违反 §5.3, §8)
+
+**位置**: load_plugin L59, initialize_all L237, initialize_pending L272, unload_plugin L108-109, shutdown_all L306-307
+
+**问题**: PluginLoader 调用插件的 `on_init`/`on_shutdown`/`dstalk_plugin_init` 五个 C ABI 入口均无 try/catch 保护。若任意插件的 C++ 实现抛出异常 (std::bad_alloc 或其他 STL 异常), 异常穿越 C 函数指针边界 → `std::terminate()` → 进程崩溃。L250-255 的 catch 块仅覆盖 `topological_sort()`, `on_init` 调用在 try 块外部。
+
+**修复方向**: 在每个 C 函数指针调用点加 `try { ... } catch (const std::exception& e) { log; return -1; } catch (...) { log; return -1; }`。`on_shutdown` 的 void 返回类型需加 `catch(...) { /* log only */ }` 防止析构期二次异常。
+
+### 发现 2 — [MEDIUM] load_plugin 5 个失败点全静默返回 -1, 无日志无错误码区分
+
+**位置**: load_plugin L28-77 (全部 6 个 return -1 路径)
+
+**问题**: LoadLibrary/dlopen 失败、符号找不到、init_fn 返回 null、API 版本不匹配——全部返回 -1 且一条日志不写。`GetProcAddress`/`dlsym` 失败时不调用 `GetLastError()`/`dlerror()` 诊断。生产环境中问题完全不可排查。
+
+**修复方向**: 每个失败路径加 `host->log(DSTALK_LOG_ERROR, "load_plugin: %s: <reason>", path)`, 可区分错误码 (-2 file not found, -3 not a valid DLL, -4 symbol missing, -5 init failed, -6 version mismatch)。
+
+### 发现 3 — [MEDIUM] 公开 API 路径零验证, DLL 加载无来源完整性检查
+
+**位置**: load_plugin L32-35 (path → LoadLibraryA/dlopen 直传), host.cpp L240 (dstalk_plugin_load 公开入口)
+
+**问题**: `dstalk_plugin_load` 公开 C API 接受任意路径, 不作规范化、目录约束、扩展名校验、签名验证。相对路径触发 Windows DLL 搜索顺序劫持。`load_plugins_from_directory` 的自动加载路径虽安全 (绝对路径+扩展名白名单), 但公开 API 独立于此防护。
+
+**修复方向**: `load_plugin` 入口调用 `fs::canonical` 规范化路径, 校验扩展名 (.dll/.so/.dylib), 校验前缀在 allowed-dir 内。可选项: WinVerifyTrust (Windows) 或 ELF 签名验证。
+
+---
+
+## 整体评级
+
+| 维度 | 评级 |
+|------|------|
+| ABI 安全与异常安全 | **F** |
+| 堆纪律 | A |
+| 并发安全 | C |
+| 输入验证 | C |
+| 路径安全与 DLL 完整性 | D |
+| 符号解析 | C |
+| 错误处理 | D |
+| 日志安全 | B |
+| 资源清理 | B |
+| **综合** | **C** |
+
+**总评**: PluginLoader 在堆纪律上干净 (host 侧无跨堆风险), 但在 ABI 异常安全和错误处理方面存在系统性缺陷。最严重的问题是 5 处 C ABI 调用点全无 try/catch——这是所有已审计插件的共性问题 (F-11.1-1, F-13.1-1, F-13.2-1) 在 loader 侧的对应缺陷。loader 不保护自己, 意味着即使所有插件都严守 §8 规范, 一个疏忽即可拖垮整个进程。load_plugin 全静默失败 + 路径无验证 + 符号解析无诊断共同构成生产可观测性黑洞。建议在下一修复 Wave 中系统性加固这 5 个调用点并添加错误日志管线。
+
+---
+
+## Findings Summary
+
+| ID | Severity | Title |
+|----|----------|-------|
+| F-18.3-1 | HIGH | 5 处 C ABI 调用点 zero try/catch: on_init/on_shutdown/init_fn 穿越 ABI → std::terminate() (load_plugin L59, initialize_all L237, initialize_pending L272, unload_plugin L108-109, shutdown_all L306-307) |
+| F-18.3-2 | MEDIUM | load_plugin 全静默失败: 5 个独立失败点均返回 -1 无日志, GetProcAddress/dlsym 不调 GetLastError/dlerror (L28-77) |
+| F-18.3-3 | MEDIUM | 公开 API dstalk_plugin_load 路径零验证: 无规范化/目录约束/扩展名校验/签名验证, 相对路径触发 DLL 搜索劫持 (host.cpp:240 + load_plugin L32-35) |
+| F-18.3-4 | MEDIUM | initialize_all 用 fprintf(stderr) 替代 host->log(): 绕过诊断回调系统, host_api 在手却未用 (L229, L239-240) |
+| F-18.3-5 | MEDIUM | PluginLoader 零内部同步: next_id_++ 非原子, plugins_ 无 mutex; dstalk_plugin_load 不持 g_init_mutex (§6.5 文档声明单线程但代码无强制) |
+| F-18.3-6 | LOW | init_fn 强转无签名验证: GetProcAddress/dlsym 结果盲转为 dstalk_plugin_init_fn, 签名不匹配→UB (L43-47) |
+| F-18.3-7 | LOW | Plugin name 终端转义注入: fprintf(stderr) 打印插件名未过滤 ANSI 控制字符, 恶意插件可扰乱终端 (L229, L240) |
+| F-18.3-8 | LOW | PluginInfo 缺拷贝控制: 含 raw 指针 handle/info, 无 =delete 拷贝构造/赋值, 潜在的 double-free/UAF (plugin_loader.hpp L10-21) |
--- a/agents/audits/findings-registry.md
+++ b/agents/audits/findings-registry.md
@@ -2,7 +2,7 @@

 > **维护人**: grp-quality-core (王测)
 > **格式定义**: 见 `agents/WORKFLOW.md` §14.2
-> **最后更新**: 2026-05-27 (W17.3 王测，验证 W14 修复并关闭 F-13.1-1/4 + F-13.2-1/2 + F-11.7-2)
+> **最后更新**: 2026-05-27 (W18.3 曹武+徐磊，plugin_loader 安全审计，录入 5 条 MEDIUM+ 发现)

 ---

@@ -10,12 +10,11 @@

 | ID | Severity | Source | Title | Status | Assigned To | Fix Wave | Verified By |
 |----|----------|--------|-------|--------|-------------|----------|-------------|
-| F-11.7-3 | LOW | [W11.7-destructive-test.md](W11.7-destructive-test.md) | `/context` silent no-output when session unavailable; no else branch — main.cpp:175-185 | OPEN | — | — | — |
-| F-11.7-4 | LOW | [W11.7-destructive-test.md](W11.7-destructive-test.md) | `/file write` (no args) matched as unknown command instead of usage hint | OPEN | — | — | — |
-| F-11.1-3 | MEDIUM | [W11.1-context-audit.md](W11.1-context-audit.md) | context_set_max_tokens死API，g_max_tokens从未被读取（L21/L243-244） | OPEN | — | — | — |
-| F-11.1-4 | LOW | [W11.1-context-audit.md](W11.1-context-audit.md) | UTF-8解码无越界保护（L42-64, L96-104），多字节序列假设后续字节有效 | OPEN | — | — | — |
-| F-11.1-5 | LOW | [W11.1-context-audit.md](W11.1-context-audit.md) | token计数逻辑重复（L34-68 vs L91-106 ~90%重复） | OPEN | — | — | — |
-| F-11.1-6 | LOW | [W11.1-context-audit.md](W11.1-context-audit.md) | 0xC0/0xC1过短编码未识别（L52, L100），仅影响token估算计数 | OPEN | — | — | — |
+| F-18.3-1 | HIGH | [W18.3-plugin-loader-audit.md](W18.3-plugin-loader-audit.md) | 5 处 C ABI 调用点 zero try/catch: on_init/on_shutdown/init_fn 穿越 ABI → std::terminate() (load_plugin L59, initialize_all L237, initialize_pending L272, unload_plugin L108-109, shutdown_all L306-307) | OPEN | — | — | — |
+| F-18.3-2 | MEDIUM | [W18.3-plugin-loader-audit.md](W18.3-plugin-loader-audit.md) | load_plugin 全静默失败: 5 个独立失败点均返回 -1 无日志, GetProcAddress/dlsym 不调 GetLastError/dlerror (L28-77) | OPEN | — | — | — |
+| F-18.3-3 | MEDIUM | [W18.3-plugin-loader-audit.md](W18.3-plugin-loader-audit.md) | 公开 API dstalk_plugin_load 路径零验证: 无规范化/目录约束/扩展名校验/签名验证, 相对路径触发 DLL 搜索劫持 (host.cpp:240 + load_plugin L32-35) | OPEN | — | — | — |
+| F-18.3-4 | MEDIUM | [W18.3-plugin-loader-audit.md](W18.3-plugin-loader-audit.md) | initialize_all 用 fprintf(stderr) 替代 host->log(): 绕过诊断回调系统, host_api 在手却未用 (L229, L239-240) | OPEN | — | — | — |
+| F-18.3-5 | MEDIUM | [W18.3-plugin-loader-audit.md](W18.3-plugin-loader-audit.md) | PluginLoader 零内部同步: next_id_++ 非原子, plugins_ 无 mutex; dstalk_plugin_load 不持 g_init_mutex (§6.5 文档声明单线程但代码无强制) | OPEN | — | — | — |

 ---

@@ -25,9 +24,15 @@

 | ID | Severity | Source | Title | Close Date | Fix Wave | Verified By |
 |----|----------|--------|-------|-------------|----------|-------------|
+| F-11.7-3 | LOW | [W11.7-destructive-test.md](W11.7-destructive-test.md) | `/context` silent no-output when session unavailable; no else branch — main.cpp:175-185 | 2026-05-27 | W18.2 | engineer-zhao |
+| F-11.7-4 | LOW | [W11.7-destructive-test.md](W11.7-destructive-test.md) | `/file write` (no args) matched as unknown command instead of usage hint | 2026-05-27 | W18.2 | engineer-zhao |
 | F-11.7-1 | CRITICAL | [W11.7-destructive-test.md](W11.7-destructive-test.md) | `build/bin/dstalk-cli.exe` corrupt copy (MD5 d8e8c92b vs 803ca2ea); all commands treated as AI prompt, exit code always 3 | 2026-05-27 | W12.4 | security-cao |
 | F-11.1-1 | HIGH | [W11.1-context-audit.md](W11.1-context-audit.md) | C++ exception (`std::bad_alloc`)穿越ABI边界，违反plugin-abi §5.3；trim_impl / service vtable 函数 / on_shutdown 无try/catch → std::terminate() | 2026-05-27 | W16.2 | engineer-sun |
 | F-11.1-2 | HIGH | [W11.1-context-audit.md](W11.1-context-audit.md) | strdup返回值未检查，OOM时静默失败+泄漏；L138-141/L219-222 循环内4次strdup无nullptr检查 | 2026-05-27 | W16.3 | engineer-chen |
+| F-11.1-3 | MEDIUM | [W11.1-context-audit.md](W11.1-context-audit.md) | context_set_max_tokens死API，g_max_tokens从未被读取 | 2026-05-27 | W18.1 | qa-wang |
+| F-11.1-4 | LOW | [W11.1-context-audit.md](W11.1-context-audit.md) | UTF-8解码无越界保护，多字节序列假设后续字节有效 | 2026-05-27 | W18.1 | qa-wang |
+| F-11.1-5 | LOW | [W11.1-context-audit.md](W11.1-context-audit.md) | token计数逻辑重复（~90%重复） | 2026-05-27 | W18.1 | qa-wang |
+| F-11.1-6 | LOW | [W11.1-context-audit.md](W11.1-context-audit.md) | 0xC0/0xC1过短编码未识别 | 2026-05-27 | W18.1 | qa-wang |
 | F-13.3-1 | CRITICAL | [W13.3-network-audit.md](W13.3-network-audit.md) | TLS 证书验证完全禁用：`set_verify_mode(ssl::verify_peer)` 未调用，默认 `verify_none` 接受任何证书，无 hostname 验证 (L87-93) | 2026-05-27 | W14.1 | security-cao |
 | F-13.3-2 | HIGH | [W13.3-network-audit.md](W13.3-network-audit.md) | DNS 解析无超时：`resolver.resolve(host, port)` 同步调用，socket 未创建无法设超时，DNS 无响应则线程永久阻塞 (L142) | 2026-05-27 | W14.1 | security-cao |
 | F-13.3-3 | MEDIUM | [W13.3-network-audit.md](W13.3-network-audit.md) | 异常处理缺 `catch(...)` 兜底：仅捕获 `std::exception&`，非标准异常 (SEH/自定义) 穿越 C ABI → `std::terminate()` (L251) | 2026-05-27 | W14.1 | security-cao |
@@ -55,4 +60,7 @@
 | 2026-05-27 | W17.1: F-13.3-1/F-13.3-2/F-13.3-3 状态 CLOSED — W14.1 周岩已修复全部 3 项（TLS verify_peer + SSL_set1_host、DNS steady_timer 10s 超时、catch(...) 兜底），编译 0 error + ctest 4/4 pass 验证通过 | 曹武 (security-cao) |
 | 2026-05-27 | W17.3: F-13.1-1/F-13.1-4/F-13.2-1/F-13.2-2 状态 CLOSED — W14.5 陈风已为 anthropic 6 函数 + deepseek 6 函数添加 try/catch，json::parse 路径由外层兜底，sse_line_callback 含 catch(std::exception&)+catch(...)；F-11.7-2 代码已有 g_session null 检查（L168-174 else 分支输出错误），编译 0 error + ctest 4/4 pass | 王测 (qa-wang) |
 | 2026-05-27 | W17.2: F-13.2-3/F-13.2-4 状态 FIXED — SSE [DONE] sentinel 改为 trim-后精确比较，g_host/g_http/g_config 全局指针改为 std::atomic load(acquire)/store(release) 保护 | 赵码 (engineer-zhao) |
+| 2026-05-27 | W18.3: F-18.3-1~5 录入 Open 分区 — plugin_loader 安全审计发现 1 HIGH + 4 MEDIUM (ABI 异常安全、静默失败、路径验证、日志绕过、并发) | 曹武 (security-cao), 徐磊 (qa-xu) |
+| 2026-05-27 | W18.2: F-11.7-3/F-11.7-4 状态 CLOSED — /context else 分支消息改为 "No active session" (main.cpp:188)，/file write 无参用法提示已在重构的 /file 分发器中正确实现 (main.cpp:274)，/status 增加连接状态行 (main.cpp:205-211)，编译 0 error + ctest 4/4 pass | 赵码 (engineer-zhao), 朱晴 (designer-zhu) |
 | 2026-05-27 | W17.4: F-13.1-2/F-13.1-3 状态 FIXED — my_chat ret!=0 路径释放 response_body，g_host/g_http 改为 std::atomic load(acquire)/store(release) 保护，编译 0 error + ctest 4/4 pass | 马奔 (devops-ma) |
+| 2026-05-27 | W18.1: F-11.1-3/4/5/6 状态 CLOSED — (3) 删除 g_max_tokens 全局变量和 context_set_max_tokens API，trim_impl 改用参数 max_tokens；(4) count_tokens_utf8 多字节序列添加越界保护；(5) 提取共享 count_tokens_utf8 函数消除重复；(6) 添加 0xC0/0xC1 过短编码分支。新增 context_plugin_test.cpp 13 测试块覆盖。 | 王测 (qa-wang), 林深 (architect-lin) |
--- a/agents/designer-zhu/profile.md
+++ b/agents/designer-zhu/profile.md
@@ -24,5 +24,9 @@ performance_log:
  - date: 2026-05-27
    event: "W10.3: 创建 agents/PROMPT_TEMPLATE.md 子代理 prompt 模板（约 170 行），含骨架+6 反模式+1 正模式+CEO 4 步检查。统一字数 250 字，WORKFLOW.md §9 追加迁移链接"
    rating: completed
-current_groups: []
+  - date: 2026-05-27
+    event: "W18.2: 协作赵码完成 CLI 命令分发修复 — 定义 /context 无 session 错误文案 No active session，定义 /status 连接状态三态交互语义（已连接/插件已加载模型未配置/未连接），编译 0 error + ctest 4/4 pass"
+    rating: A
+current_groups:
+  - grp-cli-ux
 ---
--- a/agents/devops-hu/profile.md
+++ b/agents/devops-hu/profile.md
@@ -77,5 +77,14 @@ performance_log:
      测试: 正常场景 0 error 0 warning 生成 STATUS.md; 故意破坏 qa-xu/profile.md 的 --- 分隔符后 exit 1 且
      STATUS.md 未被覆盖; 修复后恢复正常。
    rating: done
+  - date: 2026-05-27
+    event: "W18.4 CI 双平台构建矩阵 + 构建时间基线 (协作者)"
+    detail: >
+      审查并确认 CI 跨平台兼容性: cmake_layout 下 conan_toolchain.cmake 路径为
+      build/Release/conan_toolchain.cmake；ci-release preset 使用 ${sourceDir} 宏引用。
+      Ninja generator 在 Ubuntu 和 Windows 均可使用；ccache 作为 CMAKE_COMPILER_LAUNCHER
+      在 clang/clang-cl 下兼容。OpenSSL conan 包在双平台下均有预编译二进制，
+      无需本地编译。buildPreset jobs: 0 利用全部可用 CPU 核数。
+    rating: done
 current_groups: []
 ---
--- a/agents/devops-ma/profile.md
+++ b/agents/devops-ma/profile.md
@@ -32,5 +32,14 @@ performance_log:
      findings-registry.md 两条发现状态改为 FIXED。
      编译 0 error + ctest 4/4 pass。
    rating: done
+  - date: 2026-05-27
+    event: "W18.4 CI 双平台构建矩阵 + 构建时间基线"
+    detail: >
+      ci.yml 重写为 Ubuntu (clang-18) + Windows (clang-cl) 双平台矩阵。
+      新增 ci-release preset (CMakePresets.json) 作为跨平台构建配置，不硬编码编译器/工具集。
+      添加 ccache 编译缓存、Conan 依赖缓存、动态矩阵 (PR 仅 Ubuntu，push master 双平台)。
+      构建步骤集成 date +%s 计时并输出到 GITHUB_STEP_SUMMARY。
+      验证: ci.yml yaml.safe_load 通过，CMakePresets.json json.load 通过。
+    rating: done
 current_groups: []
 ---
--- a/agents/engineer-zhao/profile.md
+++ b/agents/engineer-zhao/profile.md
@@ -48,3 +48,6 @@ current_groups:
  - date: 2026-05-27
    event: "W17.2: 修复 deepseek_plugin 2条 MEDIUM — F-13.2-3 SSE [DONE] sentinel trim后比较替代精确匹配（L208-218），F-13.2-4 g_host/g_http/g_config 改为 std::atomic load(acquire)/store(release) 保护（全文件54处访存点），编译0 error + ctest 4/4 pass"
    rating: A-
+  - date: 2026-05-27
+    event: "W18.2: 协作朱晴完成 CLI 命令分发修复 — F-11.7-3 /context else 分支消息改为 No active session (main.cpp:188)，确认 F-11.7-4 已被重构的 /file 分发器修正 (main.cpp:274)，/status 增加连接状态三态展示 (main.cpp:205-211)，编译 0 error + ctest 4/4 pass"
+    rating: A
--- a/agents/qa-wang/profile.md
+++ b/agents/qa-wang/profile.md
@@ -48,6 +48,9 @@ performance_log:
  - date: 2026-05-27
    event: "W17.3: 验证 W14 已修复的 4 条发现并关单 + F-11.7-2。F-13.1-1 (anthropic 6 C ABI try/catch) PASS，F-13.1-4 (sse_line_callback 异常保护) PASS，F-13.2-1 (deepseek C++ 异常被外层 catch) PASS，F-13.2-2 (非对称异常保护已消解) PASS。F-11.7-2 /clear 命令代码已有 g_session null 检查 (L168-174)，无需修改代码直接关单。5 条全部 CLOSED。编译 0 error + ctest 4/4 pass。"
    rating: A
+  - date: 2026-05-27
+    event: "W18.1 (协作 林深): 关闭 F-11.1-3/4/5/6 共4条 context_plugin 遗留发现。(3) 删除 g_max_tokens 死变量 + context_set_max_tokens API + dstalk_services.h vtable 字段；(4) count_tokens_utf8 共享函数新增多字节序列越界检查（i+N >= len + 后继字节 0x80 校验）；(5) 提取 count_tokens_utf8(const char*, size_t, size_t) 取代 count_tokens_one_message / count_tokens_trim 双份重复实现；(6) 新增 c==0xC0||0xC1 分支检测过短编码。新增 context_plugin_test.cpp (13 测试块, 36 CHECK)，覆盖 ASCII/CJK/mixed/truncated UTF-8/0xC0-0xC1/4-byte/multi-msg/trim null+limit+system。更新 findings-registry Closed + Change Log。编译 0 error + ctest 5/5 pass。"
+    rating: A
 current_groups:
  - grp-quality-core (组长)
 ---
--- a/agents/qa-xu/profile.md
+++ b/agents/qa-xu/profile.md
@@ -18,6 +18,16 @@ weaknesses:
  - 单元测试有时过于针对实现
  - 不太关注测试可读性
 performance_log:
+  - date: 2026-05-27
+    event: "W18.3: plugin_loader 安全审计 (合作 security-cao) — 9 维度审计, 1 HIGH + 4 MEDIUM + 3 LOW 发现"
+    rating: done
+    detail: |
+      联合审计 dstalk-core/src/plugin_loader.cpp + plugin_loader.hpp (385行)。
+      破坏性关注点: on_init/on_shutdown 五处 C ABI 调用无 try/catch → 单个插件 OOM 即可 std::terminate() 拖垮 host;
+      load_plugin 全路径静默失败, GetLastError/dlerror 不调用;
+      dstalk_plugin_load 公开 API 路径直传 LoadLibrary/dlopen 零验证, 相对路径触发 DLL 搜索劫持。
+      报告: agents/audits/W18.3-plugin-loader-audit.md。
+      findings-registry: F-18.3-1~5 录入 Open 分区。
  - date: 2026-05-27
    event: "入职 dstalk 团队"
    rating: ongoing
--- a/agents/security-cao/profile.md
+++ b/agents/security-cao/profile.md
@@ -18,6 +18,18 @@ weaknesses:
  - 对功能开发节奏感知较弱，容易"挡路"
  - 偶尔过度强调低风险问题
 performance_log:
+  - date: 2026-05-27
+    event: "W18.3: plugin_loader 安全审计 (合作 qa-xu) — 9 维度审计, 1 HIGH + 4 MEDIUM + 3 LOW 发现"
+    rating: done
+    detail: |
+      审计 dstalk-core/src/plugin_loader.cpp + plugin_loader.hpp (385行), 9 维度全覆盖。
+      TOP3: (1) [HIGH] 5 处 C ABI on_init/on_shutdown/init_fn 调用 zero try/catch → std::terminate();
+      (2) [MEDIUM] load_plugin 5 失败路径全静默返回 -1 无日志;
+      (3) [MEDIUM] dstalk_plugin_load 公开 API 路径零验证 + DLL 无来源完整性检查。
+      额外: fprintf(stderr) 绕过 host->log、PluginLoader 零同步、符号解析无诊断、终端转义注入风险。
+      评级: 综合 C (ABI 安全 F, 路径安全 D, 错误处理 D, 堆纪律 A)。
+      报告: agents/audits/W18.3-plugin-loader-audit.md。
+      findings-registry: F-18.3-1~5 (1 HIGH + 4 MEDIUM) 录入 Open 分区。
  - date: 2026-05-27
    event: "W17.1: 验证 F-13.3-1/2/3 (network_plugin TLS/DNS/exception) — W14.1 已全部修复，关闭 3 条发现"
    rating: done
--- a/dstalk-cli/src/main.cpp
+++ b/dstalk-cli/src/main.cpp
@@ -185,7 +185,7 @@ static void handle_command(const char* line)
                        CLR_DIM "Token 估算: " CLR_RESET "%d\n",
                        count, tokens);
        } else {
-            std::fprintf(stderr, CLR_RED "[ERROR] context service not available\n" CLR_RESET);
+            std::fprintf(stderr, CLR_RED "[ERROR] No active session\n" CLR_RESET);
        }
        return;
    }
@@ -202,6 +202,13 @@ static void handle_command(const char* line)
        std::printf("  base_url: %s\n", base_url ? base_url : "(未设置)");
        std::printf("  api_key: %s\n", (api_key && api_key[0]) ? "已设置" : "未设置");
        std::printf("  provider: %s\n", provider);
+        if (g_ai && !g_current_model.empty()) {
+            std::printf("  连接状态: 已连接 (%s, %s)\n", provider, g_current_model.c_str());
+        } else if (g_ai) {
+            std::printf("  连接状态: 插件已加载，模型未配置\n");
+        } else {
+            std::printf("  连接状态: 未连接\n");
+        }
        std::printf("  AI 服务: %s\n", g_ai ? "就绪" : "不可用");
        std::printf("  Session 服务: %s\n", g_session ? "就绪" : "不可用");
        int hc = 0;
--- a/dstalk-core/include/dstalk/dstalk_services.h
+++ b/dstalk-core/include/dstalk/dstalk_services.h
@@ -39,7 +39,6 @@ typedef struct {
    int    (*trim)(const dstalk_message_t* in, int in_count,
                   dstalk_message_t** out, int* out_count,
                   size_t max_tokens);
-    void   (*set_max_tokens)(size_t max);
 } dstalk_context_service_t;

 // === HTTP 服务 (service name: "http") ===
--- a/plugins/context/src/context_plugin.cpp
+++ b/plugins/context/src/context_plugin.cpp
@@ -9,6 +9,7 @@
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
+#include <cstring>
 #include <exception>
 #include <string>
 #include <vector>
@@ -19,54 +20,101 @@

 static const dstalk_host_api_t* g_host = nullptr;
 static const dstalk_session_service_t* g_session = nullptr;
-static size_t g_max_tokens = 4096;

 // ============================================================
-// 内部 C++ 辅助：token 计数
+// 内部 C++ 辅助：共享 UTF-8 token 计数
+// W18.1: 合并 count_tokens_one_message / count_tokens_trim 的重复逻辑 (F-11.1-5)
+//        添加 UTF-8 越界保护 (F-11.1-4) 和 0xC0/0xC1 过短编码检测 (F-11.1-6)
 // ============================================================

-static bool cjk_is_ascii(unsigned char c) { return c < 0x80; }
-
-static bool cjk_starts_cjk(unsigned char c) {
-    // U+4E00-U+9FFF 在 UTF-8 中编码为 0xE4-0xE9 开头的三字节
-    return c >= 0xE4 && c <= 0xE9;
-}
-
-static size_t count_tokens_one_message(const dstalk_message_t& msg) {
-    const char* text = msg.content;
-    if (!text) return 4; // 只有 overhead
+// 统计 UTF-8 字节序列 [text, text+len) 的估算 token 数。
+// overhead: 每条消息的固定开销 token（role + separators = 4）
+// 多字节序列在越界或无效后继字节时回退为单字节 other_chars 计数，不崩溃。
+static size_t count_tokens_utf8(const char* text, size_t len, size_t overhead) {
+    if (!text || len == 0) return overhead;

    size_t ascii_chars   = 0;
    size_t chinese_chars = 0;
    size_t other_chars   = 0;

    size_t i = 0;
-    while (text[i] != '\0') {
+    while (i < len && text[i] != '\0') {
        unsigned char c = static_cast<unsigned char>(text[i]);

-        if (cjk_is_ascii(c)) {
+        if (c < 0x80) {
+            // ASCII
            ascii_chars++;
            i += 1;
-        } else if (cjk_starts_cjk(c)) {
+        } else if (c >= 0xE4 && c <= 0xE9) {
+            // CJK Unified Ideographs (U+4E00-U+9FFF): 3-byte UTF-8 0xE4-0xE9
+            // W18.1 (F-11.1-4): 检查后续 2 字节是否在有效范围内
+            if (i + 2 >= len ||
+                (static_cast<unsigned char>(text[i + 1]) & 0xC0) != 0x80 ||
+                (static_cast<unsigned char>(text[i + 2]) & 0xC0) != 0x80) {
+                other_chars++;
+                i += 1;
+            } else {
                chinese_chars++;
                i += 3;
-        } else if (c >= 0xC0 && c < 0xE0) {
+            }
+        } else if (c >= 0xC2 && c < 0xE0) {
+            // 2-byte sequence (valid range 0xC2-0xDF)
+            // W18.1 (F-11.1-4): 检查后续 1 字节
+            if (i + 1 >= len ||
+                (static_cast<unsigned char>(text[i + 1]) & 0xC0) != 0x80) {
+                other_chars++;
+                i += 1;
+            } else {
                other_chars++;
                i += 2;
+            }
+        } else if (c == 0xC0 || c == 0xC1) {
+            // W18.1 (F-11.1-6): 过短编码 (overlong encoding)，非法 UTF-8 起始字节
+            // 0xC0/0xC1 永远不会出现在合法 UTF-8 中；视为单字节计入 other_chars
+            other_chars++;
+            i += 1;
        } else if (c >= 0xE0 && c < 0xF0) {
+            // Non-CJK 3-byte sequence (0xE0-0xE3, 0xEA-0xEF)
+            // CJK 范围 0xE4-0xE9 已在上方分支处理
+            if (i + 2 >= len ||
+                (static_cast<unsigned char>(text[i + 1]) & 0xC0) != 0x80 ||
+                (static_cast<unsigned char>(text[i + 2]) & 0xC0) != 0x80) {
+                other_chars++;
+                i += 1;
+            } else {
                other_chars++;
                i += 3;
+            }
        } else if (c >= 0xF0 && c < 0xF8) {
+            // 4-byte sequence
+            if (i + 3 >= len ||
+                (static_cast<unsigned char>(text[i + 1]) & 0xC0) != 0x80 ||
+                (static_cast<unsigned char>(text[i + 2]) & 0xC0) != 0x80 ||
+                (static_cast<unsigned char>(text[i + 3]) & 0xC0) != 0x80) {
+                other_chars++;
+                i += 1;
+            } else {
                other_chars++;
                i += 4;
+            }
        } else {
+            // Continuation bytes (0x80-0xBF) and other invalid start bytes (0xF8-0xFF)
            other_chars++;
            i += 1;
        }
    }

-    size_t content_tokens = (ascii_chars / 4) + (chinese_chars / 2) + (other_chars / 3);
-    return content_tokens + 4; // +4 条消息开销 (role + separators)
+    return (ascii_chars / 4) + (chinese_chars / 2) + (other_chars / 3) + overhead;
+}
+
+// ============================================================
+// 消息级 token 计数（供 count_tokens_all 和 trim_impl 调用的薄封装）
+// ============================================================
+
+static size_t count_tokens_one_message(const dstalk_message_t& msg) {
+    const char* text = msg.content;
+    if (!text) return 4; // 只有 overhead
+    return count_tokens_utf8(text, std::strlen(text), 4);
 }

 static size_t count_tokens_all(const dstalk_message_t* msgs, int count) {
@@ -91,19 +139,7 @@ struct TrimMessage {

 static size_t count_tokens_trim(const TrimMessage& msg) {
    if (msg.content.empty()) return 4;
-    const std::string& text = msg.content;
-    size_t ascii_chars = 0, chinese_chars = 0, other_chars = 0;
-    size_t i = 0;
-    while (i < text.size()) {
-        unsigned char c = static_cast<unsigned char>(text[i]);
-        if (cjk_is_ascii(c))      { ascii_chars++;   i += 1; }
-        else if (cjk_starts_cjk(c)) { chinese_chars++; i += 3; }
-        else if (c >= 0xC0 && c < 0xE0) { other_chars++; i += 2; }
-        else if (c >= 0xE0 && c < 0xF0) { other_chars++; i += 3; }
-        else if (c >= 0xF0 && c < 0xF8) { other_chars++; i += 4; }
-        else                      { other_chars++;   i += 1; }
-    }
-    return (ascii_chars / 4) + (chinese_chars / 2) + (other_chars / 3) + 4;
+    return count_tokens_utf8(msg.content.c_str(), msg.content.size(), 4);
 }

 static size_t count_tokens_trim_vec(const std::vector<TrimMessage>& msgs) {
@@ -155,8 +191,9 @@ static int trim_impl(const dstalk_message_t* in, int in_count,
    try {
        if (!in || in_count <= 0 || !out || !out_count) return -1;

-        // W12.1: 调用方传 0 时使用 g_max_tokens 作为默认限制
-        if (max_tokens == 0) max_tokens = g_max_tokens;
+        // W18.1 (F-11.1-3): g_max_tokens 已移除，调用方必须提供有效 max_tokens；
+        // 传 0 时使用硬编码默认值 4096。
+        if (max_tokens == 0) max_tokens = 4096;

        // 将 C 数组转换为内部 vector
        std::vector<TrimMessage> messages;
@@ -249,9 +286,9 @@ static int trim_impl(const dstalk_message_t* in, int in_count,
            }
        }

-        // W12.1: 消息数量上限粗略估算（每消息 ~100 token），利用 g_max_tokens 防止消息泛滥
+        // W18.1 (F-11.1-3): 消息数量上限粗略估算（每消息 ~100 token），使用当前 max_tokens
        {
-            size_t max_msg_count = (g_max_tokens + 99) / 100;  // ceil(g_max_tokens / 100)
+            size_t max_msg_count = (max_tokens + 99) / 100;  // ceil(max_tokens / 100)
            if (max_msg_count < 1) max_msg_count = 1;
            while (non_system_msgs.size() > max_msg_count) {
                non_system_msgs.erase(non_system_msgs.begin());
@@ -281,7 +318,7 @@ static int trim_impl(const dstalk_message_t* in, int in_count,

        return 0;
    } catch (const std::exception& e) {
-        // W12.1: 防止 std::bad_alloc 等 C++ 异常穿越 C ABI 边界 → std::terminate()
+        // W12.1: 防止 std::bad_alloc 等 C++ 异常穿越 C ABI 边界 -> std::terminate()
        if (g_host) g_host->log(DSTALK_LOG_ERROR, "[context] trim_impl exception: %s", e.what());
        return -1;
    } catch (...) {
@@ -294,7 +331,7 @@ static int trim_impl(const dstalk_message_t* in, int in_count,
 // Context 服务 vtable 实现
 // ============================================================

-// W12.1: 包裹 try/catch 防止异常穿越 C ABI 边界 → std::terminate()
+// W12.1: 包裹 try/catch 防止异常穿越 C ABI 边界 -> std::terminate()
 static size_t context_count_tokens(const dstalk_message_t* msgs, int count) {
    try {
        if (!msgs || count <= 0) return 0;
@@ -315,21 +352,12 @@ static int context_trim(const dstalk_message_t* in, int in_count,
    }
 }

-// W16.2: 包裹 try/catch 防止异常穿越 C ABI 边界 (§8.3 void 仅 log)
-static void context_set_max_tokens(size_t max) {
-    try {
-        g_max_tokens = max;
-    } catch (const std::exception& e) {
-        if (g_host) g_host->log(DSTALK_LOG_ERROR, "[plugin-context] context_set_max_tokens: %s", e.what());
-    } catch (...) {
-        if (g_host) g_host->log(DSTALK_LOG_ERROR, "[plugin-context] context_set_max_tokens: unknown exception");
-    }
-}
-
+// W18.1 (F-11.1-3): g_max_tokens / context_set_max_tokens 已移除。
+// max_tokens 由调用方通过 trim() 的 max_tokens 参数直接传入；
+// 传 0 时 trim_impl 使用硬编码默认值 4096。
 static dstalk_context_service_t g_context_service = {
    context_count_tokens,
-    context_trim,
-    context_set_max_tokens
+    context_trim
 };

 // ============================================================
@@ -359,7 +387,7 @@ static int on_init(const dstalk_host_api_t* host) {
    }
 }

-// W16.2: 包裹 try/catch 防止异常穿越 C ABI 边界 — void 函数仅 log
+// W16.2: 包裹 try/catch 防止异常穿越 C ABI 边界 -- void 函数仅 log
 static void on_shutdown() {
    try {
        g_session = nullptr;
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -72,3 +72,18 @@ target_compile_features(dstalk-service-registry-test
 )

 add_test(NAME dstalk-service-registry-test COMMAND dstalk-service-registry-test)
+
+# ============================================================
+# dstalk-context-plugin-test — Context 插件单元测试
+# W18.1 (qa-wang + architect-lin): 覆盖 token 计数/trim/UTF-8 边界
+# ============================================================
+
+add_executable(dstalk-context-plugin-test
+    context_plugin_test.cpp
+)
+
+target_link_libraries(dstalk-context-plugin-test
+    PRIVATE dstalk
+)
+
+add_test(NAME dstalk-context-plugin-test COMMAND dstalk-context-plugin-test)
--- a/tests/context_plugin_test.cpp
+++ b/tests/context_plugin_test.cpp
@@ -0,0 +1,429 @@
+// ============================================================================
+// context_plugin_test.cpp — 上下文插件单元测试
+// ============================================================================
+// W18.1 (qa-wang + architect-lin): 覆盖 token 计数、trim、UTF-8 边界、
+// 0xC0/0xC1 过短编码检测。修复 F-11.1-3/4/5/6 后补充测试。
+// ============================================================================
+
+#include "dstalk/dstalk_host.h"
+
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <string>
+
+static int g_failures = 0;
+#define CHECK(cond, msg) do {                              \
+    if (cond) {                                            \
+        std::cout << "[OK] " << (msg) << "\n";             \
+    } else {                                               \
+        std::cerr << "[FAIL] " << (msg) << "\n";           \
+        g_failures++;                                      \
+    }                                                      \
+} while (0)
+
+int main()
+{
+    const auto dir = std::filesystem::temp_directory_path() / "dstalk-ctx-test";
+    std::filesystem::create_directories(dir);
+
+    const auto config_path = dir / "config.toml";
+    {
+        std::ofstream config(config_path);
+        config << "[api]\n"
+               << "provider = \"deepseek\"\n"
+               << "base_url = \"https://api.deepseek.com/v1\"\n"
+               << "api_key = \"test-key\"\n"
+               << "model = \"deepseek-v4-pro\"\n";
+    }
+
+    if (dstalk_init(config_path.string().c_str()) != 0) {
+        std::cerr << "dstalk_init failed\n";
+        return 1;
+    }
+
+    auto* ctx = static_cast<const dstalk_context_service_t*>(
+        dstalk_service_query("context", 1));
+    if (!ctx) {
+        std::cerr << "context service not found\n";
+        dstalk_shutdown();
+        return 1;
+    }
+    std::cout << "[OK] context service found\n";
+
+    // ================================================================
+    // Test Block 1: count_tokens edge cases (null / empty)
+    // ================================================================
+    std::cout << "\n--- Block 1: count_tokens edge cases ---\n";
+
+    size_t tokens = ctx->count_tokens(nullptr, 0);
+    CHECK(tokens == 0, "T1.1: count_tokens(nullptr, 0) == 0");
+
+    tokens = ctx->count_tokens(nullptr, 5);
+    CHECK(tokens == 0, "T1.2: count_tokens(nullptr, 5) == 0");
+
+    {
+        dstalk_message_t empty_msg = {nullptr, nullptr, nullptr, nullptr};
+        tokens = ctx->count_tokens(&empty_msg, 1);
+        CHECK(tokens == 4, "T1.3: null-content message == 4 (overhead only)");
+    }
+
+    {
+        dstalk_message_t empty_str_msg = {"user", "", nullptr, nullptr};
+        tokens = ctx->count_tokens(&empty_str_msg, 1);
+        CHECK(tokens == 4, "T1.4: empty-string content == 4 (overhead only)");
+    }
+
+    // ================================================================
+    // Test Block 2: count_tokens — ASCII
+    // ================================================================
+    std::cout << "\n--- Block 2: count_tokens ASCII ---\n";
+
+    {
+        dstalk_message_t msg = {"user", "Hello World", nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        // 11 ascii chars / 4 = 2 + 4 overhead = 6
+        CHECK(tokens == 6, "T2.1: 'Hello World' (11 ASCII) == 6 tokens");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        dstalk_message_t msg = {"user", "abcd", nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        // 4 ascii chars / 4 = 1 + 4 overhead = 5
+        CHECK(tokens == 5, "T2.2: 'abcd' (4 ASCII) == 5 tokens");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        dstalk_message_t msg = {"user",
+            "This is a longer ASCII sentence for testing token counts",
+            nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T2.3: long ASCII sentence returns valid count");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    // ================================================================
+    // Test Block 3: count_tokens — Chinese (CJK U+4E00-U+9FFF)
+    // ================================================================
+    std::cout << "\n--- Block 3: count_tokens Chinese (CJK) ---\n";
+
+    {
+        // 中文 = U+4E2D U+6587 = E4 B8 AD E6 96 87 (2 CJK chars)
+        dstalk_message_t msg = {"user",
+            "\xe4\xb8\xad\xe6\x96\x87", nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        // 2 chinese / 2 = 1 + 4 overhead = 5
+        CHECK(tokens == 5, "T3.1: 2 Chinese chars == 5 tokens");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        // 你好世界 = 4 CJK chars = 4/2 + 4 = 6
+        dstalk_message_t msg = {"user",
+            "\xe4\xbd\xa0\xe5\xa5\xbd\xe4\xb8\x96\xe7\x95\x8c",
+            nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens == 6, "T3.2: 4 Chinese chars == 6 tokens");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    // ================================================================
+    // Test Block 4: count_tokens — Mixed content
+    // ================================================================
+    std::cout << "\n--- Block 4: count_tokens mixed content ---\n";
+
+    {
+        // "Hi 中文" = 3 ASCII + 2 CJK = 3/4 + 2/2 + 4 = 0+1+4 = 5
+        dstalk_message_t msg = {"user",
+            "Hi \xe4\xb8\xad\xe6\x96\x87", nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens == 5, "T4.1: 'Hi ' + 2 CJK == 5 tokens");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    // ================================================================
+    // Test Block 5: Truncated UTF-8 bounds protection (F-11.1-4)
+    // ================================================================
+    std::cout << "\n--- Block 5: Truncated UTF-8 (F-11.1-4 fix) ---\n";
+
+    {
+        // Lone 0xE4 (3-byte sequence lead byte alone)
+        char buf[3] = {static_cast<char>(0xE4), 'A', '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T5.1: lone 0xE4 does not crash");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        // 0xE4 + 0x80 (3-byte missing last continuation byte)
+        char buf[4] = {static_cast<char>(0xE4), static_cast<char>(0x80),
+                       'B', '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T5.2: 0xE4 0x80 (2/3 bytes) does not crash");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        // Lone 0xF0 (4-byte sequence lead byte alone)
+        char buf[3] = {static_cast<char>(0xF0), 'X', '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T5.3: lone 0xF0 (4-byte lead) does not crash");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        // 0xC2 alone (2-byte sequence missing continuation byte)
+        char buf[3] = {static_cast<char>(0xC2), 'Y', '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T5.4: 0xC2 alone (missing cont.) does not crash");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        // 2-byte lead + invalid continuation (0x00 instead of 0x80-0xBF)
+        char buf[4] = {static_cast<char>(0xC3), '\x00', 'Z', '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T5.5: invalid continuation byte does not crash");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    // ================================================================
+    // Test Block 6: 0xC0/0xC1 overlong encoding (F-11.1-6)
+    // ================================================================
+    std::cout << "\n--- Block 6: 0xC0/0xC1 overlong encoding (F-11.1-6 fix) ---\n";
+
+    {
+        // 0xC0 0x80 = overlong encoding of NUL (U+0000)
+        char buf[4] = {static_cast<char>(0xC0), static_cast<char>(0x80), '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T6.1: 0xC0 0x80 overlong does not crash");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        // 0xC1 0xBF = overlong encoding of U+007F
+        char buf[4] = {static_cast<char>(0xC1), static_cast<char>(0xBF), '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T6.2: 0xC1 0xBF overlong does not crash");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        // 0xC0 alone (overlong lead without continuation)
+        char buf[3] = {static_cast<char>(0xC0), 'Q', '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T6.3: lone 0xC0 does not crash");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        // Verify 0xC0/0xC1 are NOT treated as valid 2-byte sequences
+        // They should each count as 1 other_char, not as 2-byte sequence
+        // 0xC0 + 0xC1 + 2 ASCII = 2 other + 2 ascii
+        // = (2/3) + (2/4) + 4 overhead = 0 + 0 + 4 = 4
+        // Actually 2/4 = 0 (integer division) for ascii, 2/3 = 0 for other
+        // So 0 + 0 + 4 = 4 tokens
+        char buf[6] = {static_cast<char>(0xC0), static_cast<char>(0xC1),
+                       'a', 'b', '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens == 4, "T6.4: 0xC0+0xC1+2 ascii token count as expected");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    // ================================================================
+    // Test Block 7: count_tokens — multiple messages
+    // ================================================================
+    std::cout << "\n--- Block 7: multiple messages ---\n";
+
+    {
+        dstalk_message_t msgs[3] = {
+            {"system", "You are helpful", nullptr, nullptr},
+            {"user", "Hello", nullptr, nullptr},
+            {"assistant", "Hi there", nullptr, nullptr}
+        };
+        tokens = ctx->count_tokens(msgs, 3);
+        // system: 15 ascii /4 = 3 + 4 = 7
+        // user: 5 ascii /4 = 1 + 4 = 5
+        // assistant: 8 ascii /4 = 2 + 4 = 6
+        // total = 7+5+6 = 18
+        CHECK(tokens == 18, "T7.1: 3 messages token count == 18");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    {
+        dstalk_message_t msgs[2] = {
+            {"user", "hi", nullptr, nullptr},
+            {"assistant", "ok", nullptr, nullptr}
+        };
+        tokens = ctx->count_tokens(msgs, 2);
+        // 2/4 + 4 + 2/4 + 4 = 0+4+0+4 = 8
+        CHECK(tokens == 8, "T7.2: 2 short messages == 8 tokens");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    // ================================================================
+    // Test Block 8: trim — null and edge cases
+    // ================================================================
+    std::cout << "\n--- Block 8: trim edge cases ---\n";
+
+    {
+        dstalk_message_t* out = nullptr;
+        int out_count = 0;
+
+        int ret = ctx->trim(nullptr, 0, &out, &out_count, 100);
+        CHECK(ret == -1, "T8.1: trim(nullptr, 0) returns -1");
+
+        ret = ctx->trim(nullptr, 0, nullptr, nullptr, 100);
+        CHECK(ret == -1, "T8.2: trim with null output pointers returns -1");
+    }
+
+    // ================================================================
+    // Test Block 9: trim — within limit (no trimming needed)
+    // ================================================================
+    std::cout << "\n--- Block 9: trim within limit ---\n";
+
+    {
+        dstalk_message_t msgs[2] = {
+            {"user", "hi", nullptr, nullptr},
+            {"assistant", "hello", nullptr, nullptr}
+        };
+        dstalk_message_t* out = nullptr;
+        int out_count = 0;
+
+        int ret = ctx->trim(msgs, 2, &out, &out_count, 4096);
+        CHECK(ret == 0, "T9.1: trim within limit returns 0");
+        CHECK(out != nullptr, "T9.2: trim allocates output");
+        CHECK(out_count == 2, "T9.3: trim preserves message count");
+
+        if (out && out_count >= 2) {
+            CHECK(out[0].role && std::strcmp(out[0].role, "user") == 0,
+                  "T9.4: first message role preserved");
+            CHECK(out[0].content && std::strcmp(out[0].content, "hi") == 0,
+                  "T9.5: first message content preserved");
+            dstalk_free(out);
+        } else if (out) {
+            dstalk_free(out);
+        }
+    }
+
+    // ================================================================
+    // Test Block 10: trim — exceeds limit (trimming required)
+    // ================================================================
+    std::cout << "\n--- Block 10: trim exceeds limit ---\n";
+
+    {
+        // 4 long messages, each ~70 chars (~18 ASCII tokens + 4 overhead = 22),
+        // total ~88 tokens > 30 limit
+        dstalk_message_t msgs[4] = {
+            {"user",
+             "This is a long message with enough text to consume many tokens",
+             nullptr, nullptr},
+            {"assistant",
+             "Another long response that also uses up tokens with lots of words",
+             nullptr, nullptr},
+            {"user",
+             "A third long message pushing us well over the token budget limit",
+             nullptr, nullptr},
+            {"assistant",
+             "The fourth long message will cause us to exceed the max budget",
+             nullptr, nullptr}
+        };
+        dstalk_message_t* out = nullptr;
+        int out_count = 0;
+
+        int ret = ctx->trim(msgs, 4, &out, &out_count, 30);
+        // trim may return -1 if a single message exceeds limit, or 0 with reduced count
+        if (ret == 0 && out) {
+            CHECK(out_count <= 4, "T10.1: trim output count <= input count");
+            std::cout << "  output count = " << out_count << " (in=4, limit=30)\n";
+            dstalk_free(out);
+        } else {
+            // Single message exceeds limit => returns -1 with empty output
+            std::cout << "  trim returned " << ret << " (single msg > limit path)\n";
+            CHECK(ret == -1, "T10.2: expected ret=-1 (single msg exceeds 30 tokens)");
+        }
+    }
+
+    // ================================================================
+    // Test Block 11: trim — system message preservation
+    // ================================================================
+    std::cout << "\n--- Block 11: trim preserves system messages ---\n";
+
+    {
+        dstalk_message_t msgs[3] = {
+            {"system", "You are a helpful assistant", nullptr, nullptr},
+            {"user",
+             "Hello this is a very long user message that will push us over the token budget",
+             nullptr, nullptr},
+            {"assistant",
+             "I am a very long assistant response designed to consume tokens for testing",
+             nullptr, nullptr}
+        };
+        dstalk_message_t* out = nullptr;
+        int out_count = 0;
+
+        int ret = ctx->trim(msgs, 3, &out, &out_count, 25);
+        if (ret >= 0 && out && out_count > 0) {
+            CHECK(out[0].role && std::strcmp(out[0].role, "system") == 0,
+                  "T11.1: system message preserved as first in output");
+            std::cout << "  output count = " << out_count << "\n";
+            dstalk_free(out);
+        } else if (out) {
+            dstalk_free(out);
+        }
+    }
+
+    // ================================================================
+    // Test Block 12: count_tokens — 4-byte UTF-8 (emoji / supplementary)
+    // ================================================================
+    std::cout << "\n--- Block 12: 4-byte UTF-8 ---\n";
+
+    {
+        // U+1F600 (😀) = F0 9F 98 80
+        char buf[6] = {static_cast<char>(0xF0), static_cast<char>(0x9F),
+                       static_cast<char>(0x98), static_cast<char>(0x80), '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        // 1 other_char / 3 + 4 overhead = 0 + 4 = 4
+        CHECK(tokens == 4, "T12.1: single 4-byte char (emoji) == 4 tokens");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    // ================================================================
+    // Test Block 13: count_tokens — continuation bytes as lone chars
+    // ================================================================
+    std::cout << "\n--- Block 13: lone continuation bytes ---\n";
+
+    {
+        // 0x80 alone (continuation byte without lead byte)
+        char buf[3] = {static_cast<char>(0x80), 'A', '\0'};
+        dstalk_message_t msg = {"user", buf, nullptr, nullptr};
+        tokens = ctx->count_tokens(&msg, 1);
+        CHECK(tokens >= 4, "T13.1: lone continuation byte does not crash");
+        std::cout << "  tokens = " << tokens << "\n";
+    }
+
+    dstalk_shutdown();
+    std::cout << "[OK] dstalk_shutdown succeeded\n";
+
+    std::cout << "\n";
+    if (g_failures == 0) {
+        std::cout << "=== All context plugin tests passed ===\n";
+        return 0;
+    } else {
+        std::cerr << "=== " << g_failures << " test(s) FAILED ===\n";
+        return 1;
+    }
+}
--- a/tests/smoke_test.cpp
+++ b/tests/smoke_test.cpp
@@ -440,19 +440,15 @@ int main()
    std::cout << "\n--- Regression Tests (R1-R3: W11.7/W12 bug protection) ---\n";

    // ---- R1: context max_tokens 生效 ----
-    // 回归: W11.1 Discovery 3 (g_max_tokens 死变量 — W12.3 已修)
+    // 回归: W11.1 Discovery 3 (g_max_tokens 死变量 — W12.3 已修, W18.1 彻底移除)
    //        W11.7 BUG-3 (/context 静默 — W12.3 已修)
-    // 验证: set_max_tokens 后 trim 能正确裁剪消息数，调用链完整不崩溃
+    // 验证: trim 能正确裁剪消息数，调用链完整不崩溃
    {
        auto* ctx = static_cast<const dstalk_context_service_t*>(
            dstalk_service_query("context", 1));
        if (ctx) {
            std::cout << "[OK] R1: context service found\n";

-            // 设置较小的 max_tokens 触发裁剪
-            ctx->set_max_tokens(50);
-            std::cout << "[OK] R1: set_max_tokens(50) no crash\n";
-
            // 构造 5 条消息，每条 ~50 字符 / ~15 token，总计 ~75 token > 50 max
            dstalk_message_t msgs[5];
            msgs[0] = {"user", "Hello this is message one with enough text to count tokens", nullptr, nullptr};