@jpssff/vanor 0.1.0

package/base/memory/index.js

@@ -0,0 +1,139 @@
+// 记忆：长期（有界 Markdown）+ 工作记忆 + 关键词检索。
+
+import fs from "node:fs";
+import path from "node:path";
+import { EVENTS } from "../events.js";
+import { ensureDir } from "../utils.js";
+
+const SEP = "\n§\n";
+const LINE = "═".repeat(46);
+
+export function createMemory(paths, config, logger) {
+  const memFile = path.join(paths.memory, "MEMORY.md");
+  const userFile = path.join(paths.memory, "USER.md");
+  const limits = {
+    memory: config.memory?.memoryMaxChars ?? 2200,
+    user: config.memory?.userMaxChars ?? 1375,
+  };
+
+  function fileOf(target) {
+    return target === "user" ? userFile : memFile;
+  }
+
+  function loadEntries(target) {
+    const file = fileOf(target);
+    if (!fs.existsSync(file)) return [];
+    const text = fs.readFileSync(file, "utf8").trim();
+    if (!text) return [];
+    return text
+      .split(SEP)
+      .map((s) => s.trim())
+      .filter(Boolean);
+  }
+
+  function saveEntries(target, entries) {
+    ensureDir(paths.memory);
+    fs.writeFileSync(fileOf(target), entries.join(SEP) + (entries.length ? "\n" : ""));
+  }
+
+  function renderBlock(label, target) {
+    const entries = loadEntries(target);
+    if (!entries.length) return "";
+    const text = entries.join(SEP);
+    const used = text.length;
+    const pct = Math.round((used / limits[target]) * 100);
+    return `${LINE}\n${label} [${pct}% — ${used}/${limits[target]} chars]\n${LINE}\n${text}`;
+  }
+
+  /** 渲染注入系统 prompt 的记忆快照（空记忆返回空串）。 */
+  function snapshot() {
+    const blocks = [
+      renderBlock("MEMORY（环境与经验）", "memory"),
+      renderBlock("USER PROFILE（用户偏好）", "user"),
+    ].filter(Boolean);
+    return blocks.join("\n\n");
+  }
+
+  /** 应用 memory 工具操作。 */
+  function apply({ action, target = "memory", content, old_text }) {
+    if (!["memory", "user"].includes(target)) return { content: "target 必须为 memory 或 user", isError: true };
+    const entries = loadEntries(target);
+
+    if (action === "add") {
+      if (!content) return { content: "add 需要 content", isError: true };
+      entries.push(content.trim());
+    } else if (action === "replace") {
+      if (!old_text || !content) return { content: "replace 需要 old_text 与 content", isError: true };
+      const matched = entries.filter((e) => e.includes(old_text));
+      if (matched.length === 0) return { content: "未匹配到 old_text", isError: true };
+      if (matched.length > 1) return { content: "old_text 匹配多条，请更具体", isError: true };
+      const i = entries.findIndex((e) => e.includes(old_text));
+      entries[i] = content.trim();
+    } else if (action === "remove") {
+      if (!old_text) return { content: "remove 需要 old_text", isError: true };
+      const matched = entries.filter((e) => e.includes(old_text));
+      if (matched.length === 0) return { content: "未匹配到 old_text", isError: true };
+      if (matched.length > 1) return { content: "old_text 匹配多条，请更具体", isError: true };
+      const i = entries.findIndex((e) => e.includes(old_text));
+      entries.splice(i, 1);
+    } else {
+      return { content: `未知 action：${action}`, isError: true };
+    }
+
+    saveEntries(target, entries);
+    logger.info(EVENTS.memory.store, { action, target });
+    const used = entries.join(SEP).length;
+    const over = used > limits[target] ? `（已超出上限 ${limits[target]}，建议整合）` : "";
+    return { content: `记忆已更新：${action} → ${target}${over}` };
+  }
+
+  /** 关键词检索长期记忆，返回评分最高的若干条。 */
+  function search(query, topN = 5) {
+    const words = String(query || "").toLowerCase().split(/\s+/).filter(Boolean);
+    if (!words.length) return [];
+    const all = [...loadEntries("memory"), ...loadEntries("user")];
+    const scored = all
+      .map((e) => {
+        const lc = e.toLowerCase();
+        const score = words.reduce((s, w) => s + (lc.includes(w) ? 1 : 0), 0);
+        return { entry: e, score };
+      })
+      .filter((x) => x.score > 0)
+      .sort((a, b) => b.score - a.score)
+      .slice(0, topN);
+    logger.info(EVENTS.memory.retrieve, { query, hits: scored.length });
+    return scored.map((x) => x.entry);
+  }
+
+  function writeWorking(name, content) {
+    ensureDir(paths.working);
+    fs.writeFileSync(path.join(paths.working, name), content);
+  }
+  function readWorking(name) {
+    const f = path.join(paths.working, name);
+    return fs.existsSync(f) ? fs.readFileSync(f, "utf8") : "";
+  }
+
+  /** 绑定到本实例的 memory 工具。 */
+  const tool = {
+    name: "memory",
+    description:
+      "管理长期记忆。target=memory（环境/经验）或 user（用户偏好）；action=add|replace|remove。",
+    danger: "safe",
+    parameters: {
+      type: "object",
+      properties: {
+        action: { type: "string", enum: ["add", "replace", "remove"] },
+        target: { type: "string", enum: ["memory", "user"] },
+        content: { type: "string" },
+        old_text: { type: "string", description: "replace/remove 时用于子串匹配" },
+      },
+      required: ["action"],
+    },
+    handler(args) {
+      return apply(args);
+    },
+  };
+
+  return { snapshot, apply, search, writeWorking, readWorking, tool };
+}

package/base/security/index.js

@@ -0,0 +1,77 @@
+// 安全：命令审批、allow/deny、工作区边界。
+
+import path from "node:path";
+import fs from "node:fs";
+import { createI18n } from "../i18n/index.js";
+import { expandHome, globToRegExp } from "../utils.js";
+
+export function createSecurity(config) {
+  const sec = config.security || {};
+  const i18n = config.i18n || createI18n(config);
+  const { t } = i18n;
+  const workspaceRoot = sec.workspaceRoot || process.cwd();
+  const allow = (sec.allowlist || []).map(globToRegExp);
+  const deny = (sec.denylist || []).map(globToRegExp);
+  const initialApproval = sec.approval || "ask";
+  let approval = initialApproval;
+  const allowOutside = !!sec.allowOutsideWorkspace;
+
+  function within(abs) {
+    return abs === workspaceRoot || abs.startsWith(workspaceRoot + path.sep);
+  }
+
+  /** 命令审批决策：allow | deny | ask。 */
+  function checkCommand(cmd) {
+    const command = String(cmd || "").trim();
+    if (deny.some((re) => re.test(command))) return "deny";
+    if (allow.some((re) => re.test(command))) return "allow";
+    if (approval === "auto") return "allow";
+    if (approval === "deny") return "deny";
+    return "ask";
+  }
+
+  /** 非命令类的需确认操作（写文件等）：allow | deny | ask。 */
+  function approvalMode() {
+    if (approval === "auto") return "allow";
+    if (approval === "deny") return "deny";
+    return "ask";
+  }
+
+  /**
+   * 解析并校验路径是否在工作区内。
+   * @returns {{ ok:boolean, abs:string, reason?:string }}
+   */
+  function checkPath(p, { mustExist = false, dir = false } = {}) {
+    if (!p || typeof p !== "string") return { ok: false, abs: "", reason: t("security.invalidPath") };
+    const abs = path.resolve(workspaceRoot, expandHome(p));
+    if (!allowOutside && !within(abs)) {
+      return { ok: false, abs, reason: t("security.outsideWorkspace", { workspace: workspaceRoot }) };
+    }
+    if (mustExist && !fs.existsSync(abs)) {
+      return { ok: false, abs, reason: t("security.pathNotFound") };
+    }
+    if (mustExist && dir && !fs.statSync(abs).isDirectory()) {
+      return { ok: false, abs, reason: t("security.notDirectory") };
+    }
+    return { ok: true, abs };
+  }
+
+  // 运行时切换审批模式（如 /auto-run）。denylist 始终生效，不受影响。
+  function setApproval(mode) {
+    if (["ask", "auto", "deny"].includes(mode)) approval = mode;
+    return approval;
+  }
+
+  return {
+    workspaceRoot,
+    initialApproval,
+    get approval() {
+      return approval;
+    },
+    setApproval,
+    checkCommand,
+    approvalMode,
+    checkPath,
+    within,
+  };
+}

package/base/skills/loader.js

@@ -0,0 +1,297 @@
+// 技能加载器：扫描技能目录，解析 SKILL.md，按优先级去重。
+
+import fs from "node:fs";
+import path from "node:path";
+import { homedir } from "node:os";
+import { EVENTS } from "../events.js";
+import { createI18n } from "../i18n/index.js";
+import { ensureDir } from "../utils.js";
+
+const defaultI18n = createI18n("en");
+
+function ok(content) {
+  return { content: String(content) };
+}
+function fail(content) {
+  return { content: String(content), isError: true };
+}
+
+/** 默认技能目录，优先级从高到低。 */
+export function defaultSkillDirs(paths, workspaceRoot) {
+  const workspaceSkillDirs = workspaceRoot
+    ? [path.join(workspaceRoot, ".skills"), path.join(workspaceRoot, "skills")]
+    : [];
+  return [
+    paths.skills,
+    ...workspaceSkillDirs,
+    path.join(homedir(), ".cursor", "skills-cursor"),
+    path.join(homedir(), ".claude", "skills"),
+    path.join(homedir(), ".agents", "skills"),
+    path.join(homedir(), ".codex", "skills"),
+    path.join(homedir(), ".codex", "skills", ".archive"),
+    path.join(homedir(), ".agent", "skills"),
+    path.join(homedir(), ".skills"),
+  ];
+}
+
+/** 极简 frontmatter 解析：支持 `key: value` 与 YAML folded/literal block（如 description: >-）。 */
+function parseFrontmatter(md) {
+  const meta = {};
+  if (!md.startsWith("---")) return { meta, body: md };
+  const end = md.indexOf("\n---", 3);
+  if (end < 0) return { meta, body: md };
+  const header = md.slice(3, end).trim();
+  const lines = header.split("\n");
+  for (let idx = 0; idx < lines.length; idx++) {
+    const line = lines[idx];
+    const i = line.indexOf(":");
+    if (i < 0) continue;
+    const key = line.slice(0, i).trim();
+    let val = line.slice(i + 1).trim();
+    if (/^[>|][+-]?$/.test(val)) {
+      const block = [];
+      while (idx + 1 < lines.length && /^\s+/.test(lines[idx + 1])) {
+        block.push(lines[++idx].trim());
+      }
+      val = val.startsWith(">")
+        ? block.join(" ").replace(/\s+/g, " ").trim()
+        : block.join("\n").trim();
+    }
+    val = val.replace(/^["']|["']$/g, "");
+    if (key) meta[key] = val;
+  }
+  return { meta, body: md.slice(end + 4).trim() };
+}
+
+function readSkill(dir, name) {
+  const file = path.join(dir, name, "SKILL.md");
+  if (!fs.existsSync(file)) return null;
+  let md = "";
+  try {
+    md = fs.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+  const { meta } = parseFrontmatter(md);
+  const firstLine = md.split("\n").find((l) => l.trim() && !l.startsWith("---")) || "";
+  return {
+    name: meta.name || name,
+    description: meta.description || firstLine.replace(/^#+\s*/, "").slice(0, 200),
+    path: file,
+    dir: path.join(dir, name),
+    sourceDir: dir,
+  };
+}
+
+/**
+ * 加载所有技能，同名按目录优先级去重（高优先级先扫描）。
+ * @returns {Array<{name,description,path,dir}>}
+ */
+export function loadSkills(dirs, logger) {
+  const seen = new Set();
+  const skills = [];
+  for (const dir of dirs) {
+    if (!fs.existsSync(dir)) continue;
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      if (!e.isDirectory()) continue;
+      const skill = readSkill(dir, e.name);
+      if (!skill || seen.has(skill.name)) continue;
+      seen.add(skill.name);
+      skills.push(skill);
+    }
+  }
+  logger?.info(EVENTS.skill.load, { count: skills.length });
+  return skills;
+}
+
+/** 渲染为系统 prompt 中的技能清单。 */
+export function renderSkills(skills, i18n = defaultI18n) {
+  if (!skills.length) return "";
+  const { t } = i18n;
+  const lines = skills.map((s) => t("skills.promptItem", { name: s.name, description: s.description, path: s.path }));
+  return `${t("skills.promptIntro")}\n${lines.join("\n")}`;
+}
+
+export function summarizeSkills(skills) {
+  const byDir = new Map();
+  for (const skill of skills || []) {
+    const dir = skill.sourceDir || "(unknown)";
+    byDir.set(dir, (byDir.get(dir) || 0) + 1);
+  }
+  return {
+    total: (skills || []).length,
+    byDir: [...byDir.entries()]
+      .map(([dir, count]) => ({ dir, count }))
+      .sort((a, b) => b.count - a.count || a.dir.localeCompare(b.dir)),
+  };
+}
+
+function safeDirName(name) {
+  const raw = String(name || "").trim();
+  if (!raw) return "";
+  let dir = raw
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 80);
+  if (!dir || dir === "." || dir === "..") {
+    dir = `skill-${Buffer.from(raw).toString("hex").slice(0, 64)}`;
+  }
+  return dir;
+}
+
+function localSkillFile(paths, name) {
+  const dirName = safeDirName(name);
+  if (!dirName) return null;
+  return path.join(paths.skills, dirName, "SKILL.md");
+}
+
+function ensureSkillMarkdown({ name, description, content }) {
+  const text = String(content || "").trim();
+  if (!text) return "";
+  if (text.startsWith("---")) return text + "\n";
+  const title = String(name || "").trim();
+  const desc = String(description || "").trim();
+  if (!title && !desc) return text + "\n";
+  const fm = ["---"];
+  if (title) fm.push(`name: ${title}`);
+  if (desc) fm.push(`description: ${desc}`);
+  fm.push("---", "", text);
+  return fm.join("\n") + "\n";
+}
+
+export function createSkillsTool(paths, logger, { getSkills, reloadSkills, getI18n } = {}) {
+  function i18n() {
+    return getI18n?.() || defaultI18n;
+  }
+  function t(key, vars) {
+    return i18n().t(key, vars);
+  }
+
+  function currentSkills() {
+    return getSkills ? getSkills() : loadSkills(defaultSkillDirs(paths), logger);
+  }
+
+  function findSkill(name) {
+    return currentSkills().find((s) => s.name === name || path.basename(s.dir) === safeDirName(name));
+  }
+
+  function list() {
+    const skills = currentSkills();
+    if (!skills.length) return ok(t("skills.none"));
+    const summary = summarizeSkills(skills);
+    const lines = skills.map((s) => {
+      const scope = path.resolve(s.sourceDir) === path.resolve(paths.skills) ? t("skills.local") : t("skills.shared");
+      return t("skills.listItem", { name: s.name, scope, description: s.description, path: s.path });
+    });
+    lines.push("", t("skills.total", { count: summary.total }));
+    for (const item of summary.byDir) lines.push(t("skills.dirCount", { dir: item.dir, count: item.count }));
+    return ok(
+      lines.join("\n"),
+    );
+  }
+
+  function read(name) {
+    const skill = findSkill(name);
+    if (!skill) return fail(t("skills.notFound", { name }));
+    try {
+      return ok(fs.readFileSync(skill.path, "utf8"));
+    } catch (e) {
+      return fail(t("skills.readFailed", { message: e.message }));
+    }
+  }
+
+  function write({ name, description, content }) {
+    const file = localSkillFile(paths, name);
+    if (!file) return fail(t("skills.invalidName"));
+    const md = ensureSkillMarkdown({ name, description, content });
+    if (!md) return fail(t("skills.writeNeedsContent"));
+    try {
+      ensureDir(path.dirname(file));
+      fs.writeFileSync(file, md);
+      reloadSkills?.();
+      logger?.info(EVENTS.skill.save, { name, path: file });
+      return ok(t("skills.saved", { name, file }));
+    } catch (e) {
+      return fail(t("skills.saveFailed", { message: e.message }));
+    }
+  }
+
+  function edit({ name, old_text, new_text }) {
+    if (!old_text) return fail(t("skills.editNeedsOldText"));
+    const file = localSkillFile(paths, name);
+    if (!file || !fs.existsSync(file)) return fail(t("skills.localNotFound", { name }));
+    let text = "";
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch (e) {
+      return fail(t("skills.readFailed", { message: e.message }));
+    }
+    const parts = text.split(old_text);
+    if (parts.length === 1) return fail(t("skills.oldTextNotFound"));
+    if (parts.length > 2) return fail(t("skills.oldTextNotUnique", { count: parts.length - 1 }));
+    try {
+      fs.writeFileSync(file, parts.join(new_text ?? ""));
+      reloadSkills?.();
+      logger?.info(EVENTS.skill.save, { name, path: file, action: "edit" });
+      return ok(t("skills.modified", { name }));
+    } catch (e) {
+      return fail(t("skills.modifyFailed", { message: e.message }));
+    }
+  }
+
+  function remove(name) {
+    const file = localSkillFile(paths, name);
+    if (!file || !fs.existsSync(file)) return fail(t("skills.localNotFound", { name }));
+    try {
+      fs.rmSync(path.dirname(file), { recursive: true, force: true });
+      reloadSkills?.();
+      logger?.info(EVENTS.skill.save, { name, action: "remove" });
+      return ok(t("skills.deleted", { name }));
+    } catch (e) {
+      return fail(t("skills.deleteFailed", { message: e.message }));
+    }
+  }
+
+  return {
+    name: "skills",
+    description: t("skills.toolDescription"),
+    danger(args) {
+      return ["list", "read"].includes(args.action) ? "safe" : "confirm";
+    },
+    parameters: {
+      type: "object",
+      properties: {
+        action: { type: "string", enum: ["list", "read", "write", "edit", "remove"] },
+        name: { type: "string", description: t("skills.paramName") },
+        description: { type: "string", description: t("skills.paramDescription") },
+        content: { type: "string", description: t("skills.paramContent") },
+        old_text: { type: "string", description: t("skills.paramOldText") },
+        new_text: { type: "string", description: t("skills.paramNewText") },
+      },
+      required: ["action"],
+    },
+    handler(args) {
+      switch (args.action) {
+        case "list":
+          return list();
+        case "read":
+          return args.name ? read(args.name) : fail(t("skills.readNeedsName"));
+        case "write":
+          return write(args);
+        case "edit":
+          return args.name ? edit(args) : fail(t("skills.editNeedsName"));
+        case "remove":
+          return args.name ? remove(args.name) : fail(t("skills.removeNeedsName"));
+        default:
+          return fail(t("skills.unknownAction", { action: args.action }));
+      }
+    },
+  };
+}

package/base/test/cli.test.js

@@ -0,0 +1,91 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  availableModels,
+  downgradeClearScreenDown,
+  formatConfirmMessage,
+  formatUserMessageRow,
+  helpText,
+  searchModels,
+  wrapText,
+} from "../transport/cli.js";
+import { createI18n } from "../i18n/index.js";
+
+test("clearScreenDown(ESC[0J/ESC[J) 降级为清到行尾(ESC[K)", () => {
+  assert.equal(downgradeClearScreenDown("abc\x1b[0J"), "abc\x1b[K");
+  assert.equal(downgradeClearScreenDown("\x1b[J"), "\x1b[K");
+  // 退格重绘的典型片段：定位行首 + 写内容 + clearScreenDown
+  assert.equal(downgradeClearScreenDown("\x1b[5;1H› hi\x1b[0J"), "\x1b[5;1H› hi\x1b[K");
+});
+
+test("不误伤其它清屏序列与光标移动", () => {
+  assert.equal(downgradeClearScreenDown("\x1b[2K"), "\x1b[2K"); // 清整行
+  assert.equal(downgradeClearScreenDown("\x1b[1J"), "\x1b[1J"); // 清到屏首
+  assert.equal(downgradeClearScreenDown("\x1b[2J"), "\x1b[2J"); // 全屏清除
+  assert.equal(downgradeClearScreenDown("\x1b[3;1H"), "\x1b[3;1H"); // 光标定位
+});
+
+test("非字符串原样返回", () => {
+  const buf = Buffer.from("x");
+  assert.equal(downgradeClearScreenDown(buf), buf);
+});
+
+test("wrapText 按显示宽度折行长文本", () => {
+  const wrapped = wrapText("执行一个很长很长的命令 abcdefghijklmnopqrstuvwxyz", 18, "  ");
+  const lines = wrapped.split("\n");
+  assert.ok(lines.length > 1);
+  assert.ok(lines.every((line) => line.length <= 18)); // 此用例全 ASCII/中文混合，粗略防止超长单行
+});
+
+test("formatConfirmMessage 将长 message 放在多行说明中", () => {
+  const msg = "exec: node scripts/very-long-command.js --workspace /Users/zhihui/wanyou/wanyou-vanor --dangerously-write-output";
+  const formatted = formatConfirmMessage(msg, 40, createI18n("zh-CN").t);
+  const lines = formatted.trimEnd().split("\n");
+  assert.equal(lines[0], "确认操作：");
+  assert.ok(lines.length > 3);
+  assert.match(formatted, /very-long-command/);
+  assert.doesNotMatch(lines.at(-1), /\[y\/N\]/); // 输入提示独立显示，避免长文本挤在输入行
+});
+
+test("helpText 支持英文语言并包含 /language", () => {
+  const text = helpText(createI18n("en").t);
+  assert.match(text, /Commands:/);
+  assert.match(text, /\/language/);
+  assert.doesNotMatch(text, /命令：/);
+});
+
+test("formatUserMessageRow 将多行用户消息格式化为单行", () => {
+  const row = formatUserMessageRow({
+    time: "2026-06-07T08:00:00.000Z",
+    content: "第一行\n第二行\t第三行",
+  });
+  assert.match(row, /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}  第一行 第二行 第三行$/);
+});
+
+test("availableModels 从当前模型、默认模型、fallback 和 provider.models 推导候选", () => {
+  const models = availableModels(
+    {
+      llm: {
+        defaultModel: "wanyou/deepseek/deepseek-v4-pro",
+        fallback: ["anthropic/claude-sonnet", "wanyou/deepseek/deepseek-v4-pro"],
+        providers: {
+          wanyou: { models: ["deepseek/deepseek-v4-pro", "deepseek/deepseek-v4-flash", { id: "qwen-max" }] },
+        },
+      },
+    },
+    "wanyou/deepseek/deepseek-v4-flash",
+  );
+  assert.deepEqual(models, [
+    "wanyou/deepseek/deepseek-v4-flash",
+    "wanyou/deepseek/deepseek-v4-pro",
+    "anthropic/claude-sonnet",
+    "wanyou/qwen-max",
+  ]);
+});
+
+test("searchModels 按关键词忽略大小写搜索", () => {
+  assert.deepEqual(
+    searchModels(["wanyou/deepseek/deepseek-v4-pro", "wanyou/deepseek/deepseek-v4-flash", "anthropic/claude"], "FLASH"),
+    ["wanyou/deepseek/deepseek-v4-flash"],
+  );
+});

package/base/test/config.test.js

@@ -0,0 +1,63 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { loadConfig, saveUiLanguage, validateConfig, DEFAULT_CONFIG } from "../config.js";
+
+test("缺失配置文件时使用默认值", () => {
+  const file = path.join(os.tmpdir(), "vanor-nope-" + Date.now(), "config.json");
+  const { config, exists } = loadConfig(file);
+  assert.equal(exists, false);
+  assert.equal(config.agent.maxIterations, DEFAULT_CONFIG.agent.maxIterations);
+  assert.equal(config.ui.language, "auto");
+});
+
+test("validateConfig 报告缺失项", () => {
+  const issues = validateConfig(DEFAULT_CONFIG);
+  assert.ok(issues.some((i) => i.includes("defaultModel")));
+});
+
+test("解析 env: 引用与 workspaceRoot 绝对化", () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "vanor-cfg-"));
+  const file = path.join(dir, "config.json");
+  process.env.VANOR_TEST_KEY = "secret123";
+  fs.writeFileSync(
+    file,
+    JSON.stringify({
+      llm: { defaultModel: "p/m", providers: { p: { type: "openai", baseURL: "u", apiKey: "env:VANOR_TEST_KEY" } } },
+      security: { workspaceRoot: dir },
+    }),
+  );
+  const { config } = loadConfig(file);
+  assert.equal(config.llm.providers.p.apiKey, "secret123");
+  assert.ok(path.isAbsolute(config.security.workspaceRoot));
+  assert.deepEqual(validateConfig(config), []);
+});
+
+test("validateConfig 校验 ui.language", () => {
+  const config = {
+    ...DEFAULT_CONFIG,
+    llm: { defaultModel: "p/m", providers: { p: { type: "openai", baseURL: "u", apiKey: "k" } } },
+    ui: { ...DEFAULT_CONFIG.ui, language: "fr" },
+  };
+  const issues = validateConfig(config);
+  assert.ok(issues.some((i) => i.includes("ui.language")));
+});
+
+test("saveUiLanguage 只写回语言并保留 env 引用", () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "vanor-cfg-lang-"));
+  const file = path.join(dir, "config.json");
+  fs.writeFileSync(
+    file,
+    JSON.stringify({
+      llm: { defaultModel: "p/m", providers: { p: { type: "openai", baseURL: "u", apiKey: "env:VANOR_TEST_KEY" } } },
+      ui: { color: true },
+    }),
+  );
+  saveUiLanguage(file, "zh-CN");
+  const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+  assert.equal(raw.ui.language, "zh-CN");
+  assert.equal(raw.llm.providers.p.apiKey, "env:VANOR_TEST_KEY");
+  assert.equal(raw.agent, undefined);
+});