@cjhyy/code-shell-core 0.6.0-rc.9 → 0.7.0

package/dist/run/RunApprovalBackend.d.ts

@@ -16,6 +16,7 @@ import type { AskUserFn } from "../tool-system/builtin/ask-user.js";
 export interface PendingApproval {
     resolve: (result: ApprovalResult) => void;
     request: ApprovalRequest;
+    timer: ReturnType<typeof setTimeout>;
 }
 export interface PendingInput {
     resolve: (answer: string) => void;
@@ -32,6 +33,7 @@ export interface RunLifecycleHooks {
 export declare class RunApprovalBackend implements ApprovalBackend {
     private pendingApproval;
     private hooks;
+    private approvalRequestSeq;
     setHooks(hooks: RunLifecycleHooks): void;
     /** Max time (ms) to wait for approval before auto-rejecting. Default: 24h */
     private timeoutMs;
@@ -42,6 +44,7 @@ export declare class RunApprovalBackend implements ApprovalBackend {
      */
     resolveApproval(result: ApprovalResult): boolean;
     hasPendingApproval(): boolean;
+    private supersedePendingApproval;
 }
 /**
  * Creates an AskUserFn that suspends the run when user input is needed.

package/dist/run/RunApprovalBackend.js

@@ -14,6 +14,7 @@
 export class RunApprovalBackend {
     pendingApproval = null;
     hooks = null;
+    approvalRequestSeq = 0;
     setHooks(hooks) {
         this.hooks = hooks;
     }
@@ -23,7 +24,8 @@ export class RunApprovalBackend {
         this.timeoutMs = ms;
     }
     async requestApproval(request) {
-        if (!this.hooks) {
+        const hooks = this.hooks;
+        if (!hooks) {
             // No hooks wired — fail CLOSED. This backend is the engine's approval
             // path for an interactive run; if a host forgot to setHooks() there is
             // no UI to ask, so auto-approving every tool (the old behavior) silently
@@ -34,11 +36,8 @@ export class RunApprovalBackend {
                 reason: "run approval backend has no lifecycle hooks wired (denied fail-closed)",
             };
         }
-        // Notify RunManager that approval is needed
-        const { approvalId } = await this.hooks.onApprovalNeeded(request);
-        // Suspend execution until resolved (with timeout safety net)
+        const requestSeq = ++this.approvalRequestSeq;
         return new Promise((resolve) => {
-            this.pendingApproval = { resolve, request };
             const timer = setTimeout(() => {
                 if (this.pendingApproval?.resolve === resolve) {
                     this.pendingApproval = null;
@@ -48,6 +47,30 @@ export class RunApprovalBackend {
             if (typeof timer === "object" && "unref" in timer) {
                 timer.unref();
             }
+            this.supersedePendingApproval();
+            this.pendingApproval = { resolve, request, timer };
+            void Promise.resolve()
+                .then(() => hooks.onApprovalNeeded(request))
+                .then(() => {
+                if (requestSeq !== this.approvalRequestSeq &&
+                    this.pendingApproval?.resolve === resolve) {
+                    this.pendingApproval = null;
+                    clearTimeout(timer);
+                    resolve({
+                        approved: false,
+                        reason: "superseded: a newer approval request replaced this one before it was answered",
+                    });
+                }
+            }, (err) => {
+                if (this.pendingApproval?.resolve !== resolve)
+                    return;
+                this.pendingApproval = null;
+                clearTimeout(timer);
+                resolve({
+                    approved: false,
+                    reason: `approval request failed: ${err instanceof Error ? err.message : String(err)}`,
+                });
+            });
         });
     }
     /**
@@ -56,14 +79,26 @@ export class RunApprovalBackend {
     resolveApproval(result) {
         if (!this.pendingApproval)
             return false;
-        const { resolve } = this.pendingApproval;
+        const { resolve, timer } = this.pendingApproval;
         this.pendingApproval = null;
+        clearTimeout(timer);
         resolve(result);
         return true;
     }
     hasPendingApproval() {
         return this.pendingApproval !== null;
     }
+    supersedePendingApproval() {
+        if (!this.pendingApproval)
+            return;
+        const { resolve, timer } = this.pendingApproval;
+        this.pendingApproval = null;
+        clearTimeout(timer);
+        resolve({
+            approved: false,
+            reason: "superseded: a newer approval request replaced this one before it was answered",
+        });
+    }
 }
 // ─── RunAskUserAdapter ───────────────────────────────────────────
 /**

package/dist/run/RunLock.js

@@ -10,6 +10,7 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { lock, check, unlock } from "../utils/lockfile.js";
 import { logger } from "../logging/logger.js";
+import { assertSafeRunId } from "./ids.js";
 export class RunLock {
     runsDir;
     staleMs;
@@ -135,6 +136,7 @@ export class RunLock {
         }
     }
     lockTarget(runId) {
+        assertSafeRunId(runId);
         return join(this.runsDir, runId, "run.json");
     }
 }

package/dist/run/RunManager.d.ts

@@ -66,6 +66,7 @@ export declare class RunManager {
     resume(runId: string, input?: ResumeRunInput): Promise<void>;
     private resumeInner;
     cancel(runId: string, reason?: string): Promise<void>;
+    private cancelInner;
     get(runId: string): Promise<RunSnapshot | null>;
     list(query?: ListRunsQuery): Promise<RunSnapshot[]>;
     getEvents(runId: string): Promise<RunEvent[]>;
@@ -90,5 +91,6 @@ export declare class RunManager {
     private transition;
     private emitRunEvent;
     private notifySubscribers;
+    private getPendingApprovalForResume;
     private getOrThrow;
 }

package/dist/run/RunManager.js

@@ -19,7 +19,13 @@ import { ArtifactTracker } from "./ArtifactTracker.js";
 import { RunLock } from "./RunLock.js";
 import { Heartbeat } from "./Heartbeat.js";
 import { NoopEvaluator } from "./Evaluator.js";
+import { assertSafeRunFileId, assertSafeRunId } from "./ids.js";
 import { VALID_TRANSITIONS } from "./types.js";
+function hasOwnString(value, key) {
+    return (value !== undefined &&
+        Object.prototype.hasOwnProperty.call(value, key) &&
+        typeof value[key] === "string");
+}
 export class RunManager {
     store;
     queue;
@@ -69,6 +75,9 @@ export class RunManager {
     async submit(input) {
         const now = Date.now();
         const runId = nanoid(16);
+        if (input.parentRunId !== undefined && input.parentRunId !== null) {
+            assertSafeRunId(input.parentRunId);
+        }
         const snapshot = {
             runId,
             objective: input.objective,
@@ -110,6 +119,7 @@ export class RunManager {
     }
     // ─── Resume ────────────────────────────────────────────────────
     async resume(runId, input) {
+        assertSafeRunId(runId);
         // Serialize resume/cancel decisions per run. Without this, two concurrent
         // resumes (or resume racing cancel) both pass the status check below —
         // status stays `waiting_*` until a later `await transition()` — and both
@@ -139,18 +149,15 @@ export class RunManager {
         if (handle) {
             if (run.status === "waiting_approval" && input?.approvalDecision) {
                 const { approvalId, approved, reason } = input.approvalDecision;
-                // Persist the approval decision
-                const approval = await this.store.getApproval(runId, approvalId);
-                if (approval && approval.status === "pending") {
-                    approval.status = approved ? "approved" : "rejected";
-                    approval.resolvedAt = Date.now();
-                    await this.store.saveApproval(approval);
-                    await this.emitRunEvent(runId, "approval_resolved", {
-                        approvalId,
-                        approved,
-                        reason,
-                    });
-                }
+                const approval = await this.getPendingApprovalForResume(run, approvalId);
+                approval.status = approved ? "approved" : "rejected";
+                approval.resolvedAt = Date.now();
+                await this.store.saveApproval(approval);
+                await this.emitRunEvent(runId, "approval_resolved", {
+                    approvalId,
+                    approved,
+                    reason,
+                });
                 // Transition back to running and resolve the suspended Engine
                 await this.transition(run, "queued");
                 await this.transition(run, "running");
@@ -158,7 +165,7 @@ export class RunManager {
                 handle.resolveApproval(approved, reason);
                 return;
             }
-            if (run.status === "waiting_input" && input?.userInput) {
+            if (run.status === "waiting_input" && hasOwnString(input, "userInput")) {
                 await this.transition(run, "queued");
                 await this.transition(run, "running");
                 await this.emitRunEvent(runId, "run_resumed", { userInput: input.userInput });
@@ -177,17 +184,15 @@ export class RunManager {
         // Re-queue the run for a fresh execution attempt
         if (input?.approvalDecision) {
             const { approvalId, approved, reason } = input.approvalDecision;
-            const approval = await this.store.getApproval(runId, approvalId);
-            if (approval && approval.status === "pending") {
-                approval.status = approved ? "approved" : "rejected";
-                approval.resolvedAt = Date.now();
-                await this.store.saveApproval(approval);
-                await this.emitRunEvent(runId, "approval_resolved", {
-                    approvalId,
-                    approved,
-                    reason,
-                });
-            }
+            const approval = await this.getPendingApprovalForResume(run, approvalId);
+            approval.status = approved ? "approved" : "rejected";
+            approval.resolvedAt = Date.now();
+            await this.store.saveApproval(approval);
+            await this.emitRunEvent(runId, "approval_resolved", {
+                approvalId,
+                approved,
+                reason,
+            });
         }
         await this.transition(run, "queued");
         await this.emitRunEvent(runId, "run_resumed", {
@@ -197,6 +202,19 @@ export class RunManager {
     }
     // ─── Cancel ────────────────────────────────────────────────────
     async cancel(runId, reason) {
+        assertSafeRunId(runId);
+        if (this.resolvingRuns.has(runId)) {
+            throw new Error(`Cannot cancel run ${runId}: another resume/cancel is already in progress`);
+        }
+        this.resolvingRuns.add(runId);
+        try {
+            await this.cancelInner(runId, reason);
+        }
+        finally {
+            this.resolvingRuns.delete(runId);
+        }
+    }
+    async cancelInner(runId, reason) {
         const run = await this.getOrThrow(runId);
         if (run.status === "completed" || run.status === "failed" || run.status === "cancelled") {
             throw new Error(`Cannot cancel run ${runId}: already in terminal state ${run.status}`);
@@ -225,16 +243,19 @@ export class RunManager {
     }
     // ─── Query ─────────────────────────────────────────────────────
     async get(runId) {
+        assertSafeRunId(runId);
         return this.store.get(runId);
     }
     async list(query) {
         return this.store.list(query);
     }
     async getEvents(runId) {
+        assertSafeRunId(runId);
         return this.store.listEvents(runId);
     }
     // ─── Attach (live stream) ──────────────────────────────────────
     attach(runId, cb) {
+        assertSafeRunId(runId);
         if (!this.subscribers.has(runId)) {
             this.subscribers.set(runId, new Set());
         }
@@ -326,6 +347,7 @@ export class RunManager {
     }
     // ─── Internal: Execute a run ───────────────────────────────────
     async executeRun(runId) {
+        assertSafeRunId(runId);
         const run = await this.getOrThrow(runId);
         // Acquire run lock — prevents concurrent execution by multiple workers
         const lockResult = await this.lock.acquire(runId);
@@ -657,7 +679,25 @@ export class RunManager {
         }
     }
     // ─── Helpers ───────────────────────────────────────────────────
+    async getPendingApprovalForResume(run, approvalId) {
+        assertSafeRunFileId(approvalId, "approval id");
+        if (run.latestApprovalId !== approvalId) {
+            throw new Error(`Cannot resume run ${run.runId}: approval ${approvalId} is not the latest pending approval`);
+        }
+        const approval = await this.store.getApproval(run.runId, approvalId);
+        if (!approval) {
+            throw new Error(`Cannot resume run ${run.runId}: approval ${approvalId} was not found`);
+        }
+        if (approval.runId !== run.runId || approval.approvalId !== approvalId) {
+            throw new Error(`Cannot resume run ${run.runId}: approval ${approvalId} does not match this run`);
+        }
+        if (approval.status !== "pending") {
+            throw new Error(`Cannot resume run ${run.runId}: approval ${approvalId} is ${approval.status}, not pending`);
+        }
+        return approval;
+    }
     async getOrThrow(runId) {
+        assertSafeRunId(runId);
         const run = await this.store.get(runId);
         if (!run)
             throw new Error(`Run not found: ${runId}`);

package/dist/run/ids.d.ts

@@ -0,0 +1,2 @@
+export declare function assertSafeRunId(runId: unknown): asserts runId is string;
+export declare function assertSafeRunFileId(value: unknown, label: string): asserts value is string;

package/dist/run/ids.js

@@ -0,0 +1,23 @@
+function assertSafeRunSegment(value, label) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`invalid ${label}: must be a non-empty string`);
+    }
+    if (value.includes("/") || value.includes("\\")) {
+        throw new Error(`invalid ${label}: contains path separator: ${value}`);
+    }
+    if (value === "." || value === ".." || value.includes("..")) {
+        throw new Error(`invalid ${label}: contains parent-dir token: ${value}`);
+    }
+    if (!/^[A-Za-z0-9_.-]+$/.test(value)) {
+        throw new Error(`invalid ${label}: unexpected characters: ${value}`);
+    }
+    if (value.length > 128) {
+        throw new Error(`invalid ${label}: too long (max 128 chars)`);
+    }
+}
+export function assertSafeRunId(runId) {
+    assertSafeRunSegment(runId, "run id");
+}
+export function assertSafeRunFileId(value, label) {
+    assertSafeRunSegment(value, label);
+}

package/dist/runtime/background-shell.d.ts

@@ -103,6 +103,7 @@ export declare class BackgroundShellManager {
     /** Raw retained output (no cleaning) — test/UI helper. */
     readOutputRaw(shellId: string): string | undefined;
     listForSession(sessionId: string): BgShell[];
+    list(): BgShell[];
     /**
      * Read a shell's output. `mode=incremental` (default) returns text since the
      * agent's last read; `mode=all` returns the full retained buffer. Output is

package/dist/runtime/background-shell.js

@@ -23,16 +23,16 @@
  * worker discover and reap them (§难点1, `reapOrphansFromPidfiles`).
  */
 import { spawn } from "node:child_process";
-import { homedir } from "node:os";
 import { join } from "node:path";
-import { mkdirSync, writeFileSync, rmSync, existsSync, readdirSync, readFileSync, } from "node:fs";
+import { mkdirSync, writeFileSync, rmSync, existsSync, readdirSync, readFileSync } from "node:fs";
 import { StringDecoder } from "node:string_decoder";
 import { utf8SafeCutLength } from "./utf8-cut.js";
-import { resolveSpawnTarget, buildSandboxEnv, mergeShellEnv, killProcessGroup, groupAlive, defaultShellBinary } from "./spawn-common.js";
+import { resolveSpawnTarget, buildSandboxEnv, mergeShellEnv, killProcessGroup, groupAlive, defaultShellBinary, } from "./spawn-common.js";
 import { RingFile } from "./ring-file.js";
 import { cleanOutput } from "./output-clean.js";
 import { notificationQueue } from "../tool-system/builtin/agent-notifications.js";
 import { logger } from "../logging/logger.js";
+import { codeShellHome } from "../session/session-manager.js";
 /** Per-session soft cap on background shells (design §7 — fork-bomb guard). */
 export const MAX_SHELLS_PER_SESSION = 16;
 /** Disk ring-file cap: keep the most recent 8MB of raw output (design §6). */
@@ -46,11 +46,10 @@ function nextShellId() {
     // Short, collision-resistant enough within a process: counter + base36 of
     // a monotonic-ish value. Avoids Date.now()/Math.random() (banned in some
     // contexts and unnecessary here).
-    return `bg_${shellCounter.toString(36)}${(shellCounter * 2654435761 % 0xffffff).toString(36)}`;
+    return `bg_${shellCounter.toString(36)}${((shellCounter * 2654435761) % 0xffffff).toString(36)}`;
 }
 function bgShellsRoot() {
-    const base = process.env.CODE_SHELL_HOME ?? process.env.HOME ?? homedir();
-    return join(base, ".code-shell", "bg-shells");
+    return join(codeShellHome(), "bg-shells");
 }
 const PORT_REGEXES = [
     /localhost:(\d{2,5})/i,
@@ -78,7 +77,11 @@ export class BackgroundShellManager {
         // the bg-shells root — refuse rather than trust the caller. Mirrors
         // SessionManager.assertSafeSessionId without importing across the layer.
         const sid = opts.sessionId;
-        if (typeof sid !== "string" || sid.length === 0 || sid.includes("..") || sid.includes("/") || sid.includes("\\")) {
+        if (typeof sid !== "string" ||
+            sid.length === 0 ||
+            sid.includes("..") ||
+            sid.includes("/") ||
+            sid.includes("\\")) {
             return { ok: false, error: `invalid sessionId for background shell` };
         }
         // Per-session soft cap (fork-bomb guard, §7).
@@ -220,9 +223,7 @@ export class BackgroundShellManager {
     }
     enqueueExitNotification(sh) {
         const ok = sh.exitCode === 0;
-        const exitDesc = sh.signal
-            ? `signal ${sh.signal}`
-            : `exit ${sh.exitCode ?? "?"}`;
+        const exitDesc = sh.signal ? `signal ${sh.signal}` : `exit ${sh.exitCode ?? "?"}`;
         notificationQueue.enqueue({
             agentId: sh.shellId,
             // English description is the agent-facing wakeup text. The UI ignores
@@ -234,7 +235,9 @@ export class BackgroundShellManager {
             status: ok ? "completed" : "failed",
             workKind: "shell",
             command: sh.command,
-            error: ok ? undefined : `Background shell ${sh.shellId} exited with ${exitDesc}. Use BashOutput("${sh.shellId}") to inspect.`,
+            error: ok
+                ? undefined
+                : `Background shell ${sh.shellId} exited with ${exitDesc}. Use BashOutput("${sh.shellId}") to inspect.`,
             enqueuedAt: Date.now(),
         }, sh.sessionId);
     }
@@ -267,6 +270,9 @@ export class BackgroundShellManager {
             .filter((s) => s.sessionId === sessionId)
             .map((s) => this.toPublic(s));
     }
+    list() {
+        return [...this.shells.values()].map((s) => this.toPublic(s));
+    }
     /**
      * Read a shell's output. `mode=incremental` (default) returns text since the
      * agent's last read; `mode=all` returns the full retained buffer. Output is
@@ -420,7 +426,9 @@ export class BackgroundShellManager {
                     try {
                         rmSync(path, { force: true });
                     }
-                    catch { /* ignore */ }
+                    catch {
+                        /* ignore */
+                    }
                     continue;
                 }
                 // Skip ones we already track in-process (this worker's own).
@@ -434,7 +442,9 @@ export class BackgroundShellManager {
                     try {
                         rmSync(path, { force: true });
                     }
-                    catch { /* ignore */ }
+                    catch {
+                        /* ignore */
+                    }
                 }
             }
         }

package/dist/runtime/spawn-common.js

@@ -159,6 +159,13 @@ export function resolveGitBash() {
     const override = process.env.CODE_SHELL_GIT_BASH_PATH;
     if (override && existsSync(override))
         return (gitBashCache = override);
+    // Test-only hermetic switch: skip auto-discovery entirely. Clearing PATH is
+    // NOT enough on Windows — CreateProcess always searches System32, so `where`
+    // still spawns and a CI runner's preinstalled Git for Windows would resolve a
+    // real bash.exe and defeat the fallback tests. This env flag makes the
+    // "Git Bash absent" scenario reproducible on a real Windows host.
+    if (process.env.CODE_SHELL_NO_SHELL_DISCOVERY)
+        return (gitBashCache = null) ?? undefined;
     const candidates = [];
     // (2) derive from `where git`. Git installs git.exe under either \cmd\ or
     // \bin\; bash.exe lives under the sibling \bin\. Walk up to the Git root.
@@ -194,6 +201,9 @@ export function resolvePowerShell() {
     const override = process.env.CODE_SHELL_POWERSHELL_PATH;
     if (override && existsSync(override))
         return (powerShellCache = override);
+    // Test-only hermetic switch (see resolveGitBash for why PATH-clearing fails).
+    if (process.env.CODE_SHELL_NO_SHELL_DISCOVERY)
+        return (powerShellCache = null) ?? undefined;
     const candidates = [];
     for (const exe of ["pwsh", "powershell"]) {
         try {

package/dist/services/auto-dream.d.ts

@@ -27,10 +27,9 @@ export declare function recordDreamComplete(): void;
 /**
  * System prompt for the auto-dream tool-call loop.
  *
- * Drives the LLM as a "memory consolidation assistant" that operates ONLY in
- * the dream scope via the MemorySave/MemoryDelete tools. The user scope is
- * read-only context — modifying it would need permission, which a background
- * dream pass cannot obtain (no UI on the call path).
+ * Drives the LLM as a "memory consolidation assistant" that operates in dream
+ * scope and may maintain dream-owned user memories. Manual user memories are
+ * read-only and protected by the dispatcher.
  */
 export declare function buildDreamSystemPrompt(): string;
 /**
@@ -39,15 +38,27 @@ export declare function buildDreamSystemPrompt(): string;
  * body. The LLM uses MemoryRead to fetch bodies for entries it wants to act on.
  */
 export declare function buildDreamUserPrompt(userMemories: Array<{
+    id?: string;
     name: string;
     type: string;
     description: string;
+    origin?: string;
+    useCount?: number;
+    updateCount?: number;
 }>, dreamMemories: Array<{
+    id?: string;
     name: string;
     type: string;
     description: string;
+    origin?: string;
+    useCount?: number;
+    updateCount?: number;
 }>, globalMemories?: Array<{
+    id?: string;
     name: string;
     type: string;
     description: string;
+    origin?: string;
+    useCount?: number;
+    updateCount?: number;
 }>): string;

package/dist/services/auto-dream.js

@@ -71,34 +71,34 @@ export function recordDreamComplete() {
 /**
  * System prompt for the auto-dream tool-call loop.
  *
- * Drives the LLM as a "memory consolidation assistant" that operates ONLY in
- * the dream scope via the MemorySave/MemoryDelete tools. The user scope is
- * read-only context — modifying it would need permission, which a background
- * dream pass cannot obtain (no UI on the call path).
+ * Drives the LLM as a "memory consolidation assistant" that operates in dream
+ * scope and may maintain dream-owned user memories. Manual user memories are
+ * read-only and protected by the dispatcher.
  */
 export function buildDreamSystemPrompt() {
     return [
         "You are a memory consolidation assistant for the CodeShell memory system.",
         "",
-        "Your job: clean up the `dream` scope by deduplicating, merging, removing stale, and improving descriptions.",
+        "Your job: clean up the `dream` scope by deduplicating, merging, removing stale, and improving descriptions, and promote only durable lessons into dream-owned `user` entries.",
         "",
         "Tools available (each takes `location`: 'global' = cross-project store, 'project' = this repo; default project):",
         "- MemoryList({ scope, location }): list memories in a scope/location",
         "- MemoryRead({ scope, location, name }): read full content of an entry",
-        "- MemorySave({ scope: 'dream', location, ... }): create or overwrite a dream entry (auto-approved)",
-        "- MemoryDelete({ scope: 'dream', location, name }): soft-delete a dream entry (auto-approved, recoverable from trash)",
+        "- MemorySave({ scope: 'dream'|'user', location, id?, ... }): create or update an entry by id",
+        "- MemoryDelete({ scope: 'dream'|'user', location, name }): soft-delete an owned entry (recoverable from trash)",
         "",
-        "Consolidate BOTH the project dream scope AND the global dream scope (pass location accordingly). Global holds cross-project lessons; keep it deduped too.",
+        "Consolidate BOTH the project dream workspace AND the global dream workspace (pass location accordingly). Global dream is a cross-project workspace, not a dumping ground for single-project progress.",
         "",
         "Rules — read carefully:",
-        "1. You may freely Save/Delete in the `dream` scope (any location). These operations DO NOT prompt the user.",
-        "2. You may NOT Save/Delete in the `user` scope from this loop — those operations require interactive permission which is not available here. Treat user-scope entries as read-only context.",
-        "3. If you find user-scope entries that look stale, surface them in your final summary text — don't try to delete them.",
-        "4. Prefer fewer, higher-quality merged entries over many similar fragments.",
-        "5. When an entry has versioned variants (e.g. `*-v1`, `*-v2`, `*-v3`), keep only the latest.",
-        "6. Be conservative: if uncertain whether two entries are truly duplicates, leave them alone.",
-        "7. Archive COMPLETED work: dream entries that only record a finished fix/task (\"已修\", \"已完成\", \"done\") and carry no reusable lesson should be deleted, or merged into one compact changelog-style entry — completed-state notes that only grow are the main source of clutter. Keep any durable lesson (root cause, pitfall, convention) by folding it into a topical entry first.",
-        "8. When you're done, stop calling tools and respond with a one-paragraph summary of what you changed.",
+        "1. You may Save/Delete dream-scope entries only when they are origin:auto or origin:dream. Never modify origin:manual; missing origin means manual.",
+        "2. You may Save user-scope entries only for durable conclusions you own. The dispatcher will force origin:dream. You may update existing user entries only when they are origin:dream or origin:auto. Never modify/delete origin:manual user entries.",
+        "3. Use MemoryList first. If the same topic already has an id, update that id instead of creating a date, version, batch, or progress variant.",
+        "4. Cluster duplicates without vectors: compare stable topic words after removing dates, versions, batch numbers, and progress/completed wording.",
+        "5. Time-sensitivity rule: entries with dates, today/yesterday, progress snapshots, completed fixes, review batches, or one-off task state should stay in dream, be merged, or be deleted. Do not promote them to user.",
+        "6. Durable lessons may be promoted to user only when they are reusable: user preferences, long-term project constraints, architecture decisions, root-cause lessons, non-obvious test/build traps, or stable references.",
+        '7. Archive COMPLETED work: dream entries that only record a finished fix/task ("已修", "已完成", "done") and carry no reusable lesson should be deleted, or merged into one compact topical entry. Keep any durable lesson by folding it into a date-free topic entry first.',
+        "8. Prefer fewer, higher-quality merged entries over many similar fragments. Be conservative: if uncertain whether two entries are truly duplicates, leave them alone.",
+        "9. When you're done, stop calling tools and respond with a one-paragraph summary of what you changed.",
     ].join("\n");
 }
 /**
@@ -107,18 +107,18 @@ export function buildDreamSystemPrompt() {
  * body. The LLM uses MemoryRead to fetch bodies for entries it wants to act on.
  */
 export function buildDreamUserPrompt(userMemories, dreamMemories, globalMemories = []) {
-    const fmt = (m) => `  - [${m.type}] ${m.name}: ${m.description}`;
+    const fmt = (m) => `  - [${m.type}] ${m.name} (id:${m.id ?? "(none)"}, origin:${m.origin ?? "manual"}, use:${m.useCount ?? 0}, updates:${m.updateCount ?? 0}): ${m.description}`;
     const listOrNone = (arr, noneMsg) => arr.length === 0 ? noneMsg : arr.map(fmt).join("\n");
     const sections = [];
-    sections.push(`Project user-scope memories (READ-ONLY context, ${userMemories.length} entries):`);
+    sections.push(`Project user-scope memories (manual is READ-ONLY; origin:dream/auto may be maintained by id, ${userMemories.length} entries):`);
     sections.push(listOrNone(userMemories, "  (none)"));
     sections.push("");
     sections.push(`Project dream-scope memories (YOUR WORKSPACE — location:'project', ${dreamMemories.length} entries):`);
     sections.push(listOrNone(dreamMemories, "  (none — you may consolidate from user-scope by re-saving curated entries into dream)"));
     sections.push("");
-    sections.push(`Global memories (cross-project — clean these too via location:'global', ${globalMemories.length} entries):`);
+    sections.push(`Global dream workspace memories (cross-project dream — clean these too via location:'global', ${globalMemories.length} entries):`);
     sections.push(listOrNone(globalMemories, "  (none)"));
     sections.push("");
-    sections.push("Begin consolidation. Use MemoryRead to inspect any entries whose names suggest duplication or staleness, then MemorySave/MemoryDelete (with the right location) to clean up.");
+    sections.push("Begin consolidation. Use MemoryRead to inspect any entries whose names suggest duplication or staleness, then MemorySave/MemoryDelete (with the right id/location/scope) to clean up.");
     return sections.join("\n");
 }

package/dist/services/dream-consolidation.d.ts

@@ -13,9 +13,8 @@
  * The loop is intentionally small and offline:
  *   - No streaming, no UI events — it runs in the background.
  *   - No permission prompts — there is no interactive backend on this path, so
- *     we hard-reject any attempt to Save/Delete in the "user" scope before
- *     dispatching. The "dream" scope is the LLM's workspace and goes through
- *     freely.
+ *     Save/Delete goes through an origin guard before dispatching. Dream may
+ *     maintain origin:dream/auto entries but never touches origin:manual.
  *   - Capped at MAX_TURNS LLM round-trips and MAX_WRITES total mutations to
  *     bound damage on misbehavior.
  */