1. Fix UTF-8 boundary panic in clean_pdf_text (tools/file.rs:295)
- rfind returns byte index of char start, i+1 may not be char boundary
- Use char-aware byte offset calculation instead
2. Fix integer overflow in context_lines (tools/search.rs:103)
- Clamp model-provided context_lines to 1000 to prevent massive allocations
- On 32-bit, usize::try_from(u64::MAX) falls back to usize::MAX causing overflow
3. Fix u64->usize truncating cast (tools/file.rs:117,127)
- Use usize::try_from() with proper error instead of silent truncation
- Prevents reading from wrong line on 32-bit platforms
4. Fix ContentBlockStop wrong index in SSE stream cleanup (client/chat.rs:435)
- saturating_sub(1) on 0u32 wraps to u32::MAX when stream breaks during thinking
- Merge thinking/text close into single guard to avoid duplicate stops
5. Fix missing providers in provider_accepts_reasoning_content (client/chat.rs:1966)
- Add SiliconflowCn and Volcengine which are in apply_reasoning_effort
- Without this, non-DeepSeek reasoning models on these providers lose thinking traces
6. Fix TOCTOU double-call in run_skill_by_name (commands/mod.rs:671)
- Replace is_some()+unwrap() with if-let-Some pattern
- Prevents potential panic if state changes between calls
7. Fix incomplete hex decoding in from_api_tool_name (client.rs:54-76)
- Require exactly 6 hex digits to match encoder output
- Short sequences from malformed model output now pass through as-is
8. Fix token count u64->u32 truncation (client.rs:1298-1299)
- Use .min(u32::MAX) saturating cast consistent with sanitizer at line 1807
- Prevents silent wraparound for extremely large token counts
9. Fix HTTP response body read errors silently swallowed (client/chat.rs:170, client.rs:750)
- Replace unwrap_or_default() with .context()? propagation
- Connection drops mid-body now surface as clear error instead of JSON parse failure
huqiantao
3468b25cf3