@miphamai/cli 0.62.0 → 0.64.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.62.0",
+  "version": "0.64.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/skills/standard/safe-coding.SKILL.md

@@ -0,0 +1,9 @@
+---
+name: safe-coding
+description: Safe coding rules for code generation — validate external/user input before use and throw RangeError on invalid input
+version: 1.0.0
+---
+
+# Safe Coding
+
+处理外部/用户输入前必须校验：`null`、`undefined`、空字符串、格式非法时，抛出 `RangeError`，消息为 `'invalid input'`。

package/src/agent/effectiveness-tracker.ts

@@ -47,11 +47,7 @@ export class EffectivenessTracker {
     if (eff) eff.decisionId = decisionId
   }
 
-  recordApplication(
-    ruleId: string,
-    success: boolean,
-    opts?: { toolName?: string; error?: string },
-  ): void {
+  recordApplication(ruleId: string, success: boolean, opts?: { error?: string }): void {
     let eff = this.data.get(ruleId)
     if (!eff) {
       eff = {
@@ -69,7 +65,7 @@ export class EffectivenessTracker {
     }
 
     // 可恢复/环境性失败：仍记录，但不进成功率分母（防误降级/误禁用能用的规则）。
-    if (!success && opts?.error && isRecoverableToolFailure(opts.toolName ?? '', opts.error)) {
+    if (!success && opts?.error && isRecoverableToolFailure(opts.error)) {
       eff.recoverableCount = (eff.recoverableCount ?? 0) + 1
       return
     }

package/src/agent/message-bus.ts

@@ -24,6 +24,16 @@ export interface AgentMessage {
   type: AgentMessageType
 }
 
+/**
+ * Format an inbound message for injection into the conversation as a
+ * user-role notice. Collapsed to one line (`Message from @<sender>: <summary>`)
+ * so cross-session peer messages don't bloat the context; the full body stays
+ * in the bus for Ctrl+O expansion.
+ */
+export function formatInboundMessage(msg: AgentMessage): string {
+  return `Message from @${msg.from}: ${msg.summary}`
+}
+
 export class AgentMessageBus {
   private messages: AgentMessage[] = []
   private idCounter = 0

package/src/agent/recoverable-failure.ts

@@ -1,21 +1,27 @@
 /**
- * 判「可恢复/环境性」失败 vs 真缺陷（borrow opencrabs `is_recoverable_tool_failure` 思想）。
+ * 判「可恢复/环境性」失败 vs 真缺陷（borrow openprabs is_recoverable_tool_failure 思想）。
  *
- * 可恢复失败（网络超时、连接拒绝、缺文件、环境权限）不该进成功率分母，否则会把成功率
- * 拉低、诱导 EffectivenessTracker 禁用能用的规则（openprabs #236 的坑：stale-hash 重试
- * 被误判成工具缺陷，把能用的 hashline_edit 禁了）。
+ * 可恢复失败（网络超时、连接拒绝、DNS 解析失败、环境权限）不该进成功率分母，否则会把
+ * 成功率拉低、诱导 EffectivenessTracker 禁用能用的规则（openprabs #236 的坑：stale-hash
+ * 重试被误判成工具缺陷，把能用的 hashline_edit 禁了）。
  *
- * fail-closed：无 error、或非 Bash 工具，一律按真失败算（证不了可恢复就不排除）。
+ * 刻意排除 ENOENT（no such file or directory）：缺文件/路径错更可能是规则本身指错了
+ * 路径（幻觉），而非环境瞬态，须计入分母（2026-08-27 review M1）。
+ *
+ * 不区分工具：这些错误模式（超时/连接/DNS/权限）本身即工具无关的环境信号。旧的
+ * `toolName !== 'Bash'` 守卫漏掉 Write/Grep 规则（2026-08-27 review M2），已移除。
+ *
+ * fail-closed：无 error 一律按真失败算（证不了可恢复就不排除）。
  */
 const RECOVERABLE_PATTERNS: RegExp[] = [
-  /\btimed?\s?out\b/i, // timeout / timed out（网络慢 / 服务死）
-  /(ECONNREFUSED|connection refused|not connected|network unreachable)/i, // 服务未起
-  /(no such file or directory|ENOENT)/i, // 缺资源，非缺陷
+  /\btimed?\s?out\b/i, // timeout / timed out / timedout（网络慢 / 服务慢）
+  /(ECONNREFUSED|ECONNRESET|ETIMEDOUT|connection refused|not connected|network unreachable)/i, // 服务未起 / 网络超时
+  /(could not resolve host|name or service not known|getaddrinfo|ENOTFOUND)/i, // DNS 解析失败
   /(permission denied|EACCES)/i, // 环境权限
 ]
 
-export function isRecoverableToolFailure(toolName: string, error?: string): boolean {
-  if (!error || toolName !== 'Bash') return false
+export function isRecoverableToolFailure(error?: string): boolean {
+  if (!error) return false
   const e = error.toLowerCase()
   return RECOVERABLE_PATTERNS.some((re) => re.test(e))
 }

package/src/agent/sub-agent.ts

@@ -319,6 +319,7 @@ export class SubAgent {
 
     const chunks: string[] = []
     const MAX_TOOL_TURNS = options.maxTurns || 5
+    let hitMaxTurns = false
 
     let currentMessages = messages
     let currentSystemPrompt = systemPrompt
@@ -360,7 +361,7 @@ export class SubAgent {
             })
           }
           if (chunk.type === 'error') {
-            throw new Error(`Sub-agent execution failed: ${chunk.error}`)
+            throw new Error(`Sub-agent execution failed (model ${finalModel}): ${chunk.error}`)
           }
           if (chunk.type === 'stop') {
             break
@@ -501,6 +502,9 @@ export class SubAgent {
 
         // Don't send system prompt on subsequent turns
         currentSystemPrompt = ''
+
+        // On the final permitted turn we still used tools → hit the cap.
+        if (turn === MAX_TOOL_TURNS - 1) hitMaxTurns = true
       }
     } catch (err) {
       if (err instanceof DOMException && err.name === 'AbortError') {
@@ -509,10 +513,18 @@ export class SubAgent {
       if (err instanceof Error && err.message.startsWith('Sub-agent')) {
         throw err
       }
-      throw new Error(`Sub-agent execution failed: ${String(err)}`)
+      throw new Error(`Sub-agent execution failed (model ${finalModel}): ${String(err)}`)
     }
 
-    return chunks.join('')
+    const result = chunks.join('')
+    if (hitMaxTurns) {
+      return (
+        `[partial result — sub-agent reached its ${MAX_TOOL_TURNS}-turn limit; ` +
+        'task may be incomplete. Use SendMessage to continue this sub-agent.]\n\n' +
+        result
+      )
+    }
+    return result
   }
 
   /**

package/src/config/defaults.ts

@@ -16,6 +16,10 @@ export const DEFAULT_CONFIG: MiphamConfig = {
   showThinking: 'off',
   showSchedulingNotices: false,
   showCommandPicker: false,
+  autocomplete: {
+    enabled: true,
+    debounceMs: 400,
+  },
   // Org 级权限限制（可选）：forbiddenModes 禁指定模式 / maxAllowedMode 封顶层级；
   // 请求被禁模式时 fail-closed 降级（如 forbiddenModes:['bypassPermissions']）。
   // permissionRestrictions: { forbiddenModes: ['bypassPermissions'] },

package/src/core/autocomplete.ts

@@ -0,0 +1,64 @@
+import type { ChatRequest } from '../providers/registry'
+import type { Llm } from '../providers/llm'
+
+export const AUTOCOMPLETE_SYSTEM_PROMPT =
+  '你是续写助手。只续写用户正在输入的这条消息，只返回续写部分（不要重复已输入的文字、不要解释、不要换行）。'
+
+/** 带上最近几条对话（含待续写输入），供续写贴合上下文。 */
+export const AUTOCOMPLETE_MAX_CONTEXT = 6
+
+export interface RecentMessage {
+  role: 'user' | 'assistant'
+  content: string
+}
+
+/** 拼续写请求：systemPrompt + 最近 N 条 + 当前输入作为待续写消息。 */
+export function buildAutocompleteRequest(recent: RecentMessage[], input: string): ChatRequest {
+  return {
+    model: '', // falsy → registry 回退 active model
+    messages: [...recent.slice(-AUTOCOMPLETE_MAX_CONTEXT), { role: 'user', content: input }],
+    systemPrompt: AUTOCOMPLETE_SYSTEM_PROMPT,
+    temperature: 0,
+    maxTokens: 64,
+  }
+}
+
+/** 剥掉 LLM 可能重复的 input 前缀，返回纯续写 suffix；空/无效 → null。 */
+export function extractCompletion(response: string, input: string): string | null {
+  let completion = response.trim()
+  if (!completion) return null
+  const normInput = input.trim()
+  if (normInput && completion.startsWith(normInput)) {
+    completion = completion.slice(normInput.length).trimStart()
+  }
+  return completion || null
+}
+
+/** 触发 guard：非空、非 `/`·`@` 开头、非 loading、无活跃 picker。 */
+export function shouldAutocomplete(
+  value: string,
+  isLoading: boolean,
+  pickerActive: boolean,
+): boolean {
+  if (!value.trim()) return false
+  if (value.startsWith('/') || value.startsWith('@')) return false
+  if (isLoading) return false
+  if (pickerActive) return false
+  return true
+}
+
+/** 异步取建议：llm.chat → 竞态检查（isStale）→ 剥前缀。stale / 空 → null。 */
+export async function requestSuggestion(
+  llm: Llm,
+  recent: RecentMessage[],
+  input: string,
+  isStale: () => boolean,
+): Promise<string | null> {
+  const req = buildAutocompleteRequest(recent, input)
+  let text = ''
+  for await (const chunk of llm.chat(req)) {
+    if (chunk.type === 'text' && chunk.content) text += chunk.content
+  }
+  if (isStale()) return null
+  return extractCompletion(text, input)
+}

package/src/core/crsi-modify.ts

@@ -15,7 +15,8 @@
 import { randomUUID } from 'node:crypto'
 import { CrsiSandbox, validateBlastRadius } from './crsi-sandbox'
 import type { CrsiModificationResult } from './crsi-sandbox'
-import { runEval, appendEvalScore, getLastEvalScore } from './eval-harness'
+import { appendEvalScore, getLastEvalScore } from './eval-harness'
+import { mechanismSentinel, type RewardFn } from './reward-fn'
 
 export interface CrsiProposal {
   /** 人类可读的改动说明 */
@@ -45,10 +46,11 @@ let pendingSandbox: CrsiSandbox | null = null
  * 编排完整 5 阶段：createWorktree → applyModification → runTests →（失败自动
  * rollback）→ getDiff。测试通过后暂存为 pending，返回 diff 供人类审阅。
  */
-export function runCrsiModification(
+export async function runCrsiModification(
   proposal: CrsiProposal,
   sandbox: CrsiSandbox = new CrsiSandbox(),
-): CrsiModificationResult {
+  opts?: { rewardFn?: RewardFn },
+): Promise<CrsiModificationResult> {
   // 完整覆盖闸：自修改必须声明 blastRadius，否则 fail-closed（在 worktree 之前，零副作用）。
   const blastRadiusError = validateBlastRadius(proposal)
   if (blastRadiusError) {
@@ -96,18 +98,18 @@ export function runCrsiModification(
     return applied
   }
 
-  // Eval harness gate：CRSI 契约分数不得低于上次记录（防跨合并退化）。
-  // 分数反映「当前代码」的 CRSI 契约（隔离组件，与本次 worktree 改动无关），
-  // 所以它是「仓库的 CRSI 代码自上次评估以来是否退化」的哨兵。
-  const evalReport = runEval()
-  const last = getLastEvalScore()
-  if (last !== null && evalReport.score < last) {
+  // Reward gate：奖励分数不得低于上次记录（防跨合并退化）。
+  // 默认机制哨兵；可插拔——调用方传 opts.rewardFn 换用其他奖励源（如任务表现）。
+  const rewardFn = opts?.rewardFn ?? mechanismSentinel()
+  const report = await rewardFn.evaluate()
+  const last = getLastEvalScore(rewardFn.name)
+  if (last !== null && report.score < last) {
     sandbox.rollback()
     applied.phase = 'failed'
-    applied.error = `Eval regression: score ${evalReport.score} < last ${last}`
+    applied.error = `Reward regression (${rewardFn.name}): score ${report.score} < last ${last}`
     return applied
   }
-  appendEvalScore(evalReport)
+  appendEvalScore(rewardFn.name, report)
 
   applied.phase = 'passed'
   applied.diff = sandbox.getDiff()

package/src/core/crsi-producer.ts

@@ -67,14 +67,18 @@ export function selectCrsiSignal(
 }
 
 /** 模板化地把信号渲染成一段教训 markdown（不动 LLM）。 */
-export function buildLessonContent(signal: CrsiSignal, timestamp: string): string {
+export function buildLessonContent(
+  signal: CrsiSignal,
+  timestamp: string,
+  source = 'CRSI producer (autoApplicable)',
+): string {
   const lines: string[] = [
     `## ${signal.category}: ${signal.title}`,
     '',
     `- 建议: ${signal.suggestion}`,
   ]
   if (signal.severity) lines.push(`- 严重度: ${signal.severity}`)
-  lines.push(`- 生成时间: ${timestamp}`, '- 来源: CRSI producer (autoApplicable)', '', '### 证据')
+  lines.push(`- 生成时间: ${timestamp}`, `- 来源: ${source}`, '', '### 证据')
   for (const e of signal.evidence) lines.push(`- ${e}`)
   lines.push('')
   return lines.join('\n')
@@ -455,3 +459,125 @@ export function clearProseProposals(): number {
     return 0
   }
 }
+
+// ── Producer Crossover（第 4 原子算子）：合并两条重叠教训 ──
+// LLM 只生成（选对 + 合并版），判定全走确定性 guard + 沙箱 gate。A1 不破：无 LLM 自评。
+
+const CROSSOVER_PROMPT_VERSION = '1.0.0'
+
+function buildCrossoverPrompt(currentLessons: string): string {
+  return [
+    `你是 CRSI producer（producer-crossover v${CROSSOVER_PROMPT_VERSION}）。给定当前教训文件，找出两条主题重叠、可合并的教训，生成一条综合教训。`,
+    '',
+    '当前教训文件：',
+    currentLessons,
+    '',
+    '要求：',
+    '1. 找两条「主题重叠」的教训（例如都讲「读码优先」、都讲「隔离」），不要选主题无关的两条。',
+    '2. titleA / titleB 是 `## ` 之后、标题的完整文本（含 category 前缀，逐字复制，不要改写；**不含** `## ` 前缀本身）。',
+    '3. merged 是合并后的综合教训：category 沿用其中一个、title 概括两者、suggestion 综合两条的核心建议、evidence 综合两条的证据要点。',
+    '4. 只返回裸 JSON（不要 markdown 围栏、不要其他文字），格式：',
+    '{"titleA":"<完整 ## 行1>","titleB":"<完整 ## 行2>","merged":{"category":"...","title":"...","suggestion":"...","evidence":["...","..."]}}',
+  ].join('\n')
+}
+
+/** 剥 ```json 围栏（LLM 可能加）。 */
+function stripJsonFence(text: string): string {
+  const match = text.match(/^```(?:json)?\s*\n([\s\S]*?)\n```\s*$/)
+  return match ? match[1]! : text
+}
+
+/** Crossover 结果：两条教训的完整 ## 行 + 合并版。 */
+export interface CrossoverResult {
+  titleA: string
+  titleB: string
+  merged: CrsiSignal
+}
+
+/** 解析 crossover 结果；非法 / 字段缺失 → null。 */
+export function parseCrossoverResult(text: string): CrossoverResult | null {
+  try {
+    const obj = JSON.parse(stripJsonFence(text))
+    if (typeof obj.titleA !== 'string' || typeof obj.titleB !== 'string') return null
+    if (
+      !obj.merged ||
+      typeof obj.merged.category !== 'string' ||
+      typeof obj.merged.title !== 'string' ||
+      typeof obj.merged.suggestion !== 'string'
+    )
+      return null
+    const evidence = Array.isArray(obj.merged.evidence)
+      ? obj.merged.evidence.filter((e: unknown) => typeof e === 'string')
+      : []
+    return {
+      titleA: obj.titleA,
+      titleB: obj.titleB,
+      merged: {
+        category: obj.merged.category,
+        title: obj.merged.title,
+        suggestion: obj.merged.suggestion,
+        evidence,
+      },
+    }
+  } catch {
+    return null
+  }
+}
+
+/** 从教训文件移除若干 `## ` 段（header 须是 `## ` 行完整文本）。preamble 与其余教训不动。 */
+export function removeLessonSections(content: string, headers: string[]): string {
+  const lines = content.split('\n')
+  const out: string[] = []
+  let skipping = false
+  for (const line of lines) {
+    if (line.startsWith('## ')) {
+      skipping = headers.includes(line.trim())
+      if (skipping) continue
+    }
+    if (skipping) continue
+    out.push(line)
+  }
+  return out.join('\n')
+}
+
+/**
+ * Crossover：合并两条重叠教训 → 「删二增一」的教训文件变更候选。
+ * LLM 只生成（选对 + 合并版），guard 校验所选教训真实存在（fail-closed 防幻觉）。
+ */
+export async function produceCrossoverProposal(
+  llm: Llm,
+  currentLessons: string,
+  timestamp: string,
+): Promise<{
+  description: string
+  filePath: string
+  newContent: string
+  originalContent: string
+  blastRadius: string[]
+} | null> {
+  const response = await collectLlmText(llm, buildCrossoverPrompt(currentLessons))
+  if (!response) return null
+
+  const parsed = parseCrossoverResult(response)
+  if (!parsed) return null
+
+  const headerA = `## ${parsed.titleA}`
+  const headerB = `## ${parsed.titleB}`
+  if (parsed.titleA === parsed.titleB) return null
+  // 精确行匹配（与 removeLessonSections 同语义）：子串 includes 会让「截断标题」漏过 guard、
+  // 却因 removeLessonSections 精确匹配删不掉 → 假「删二增一」实为「增一」。fail-closed 用精确匹配。
+  const lessonLines = currentLessons.split('\n').map((l) => l.trim())
+  if (!lessonLines.includes(headerA) || !lessonLines.includes(headerB)) return null
+
+  const withoutTwo = removeLessonSections(currentLessons, [headerA, headerB])
+  const mergedSection = buildLessonContent(parsed.merged, timestamp, 'CRSI producer (crossover)')
+  const newContent = `${withoutTwo.trimEnd()}\n\n${mergedSection}\n`
+
+  return {
+    description: `CRSI crossover: ${parsed.titleA} + ${parsed.titleB}`,
+    filePath: LESSONS_FILE,
+    newContent,
+    originalContent: currentLessons,
+    blastRadius: [LESSONS_FILE],
+  }
+}

package/src/core/crsi-sandbox.ts

@@ -16,7 +16,7 @@
 
 import { execSync } from 'node:child_process'
 import { mkdirSync, rmSync, existsSync, writeFileSync, readFileSync, readdirSync } from 'node:fs'
-import { join, resolve, sep } from 'node:path'
+import { join, resolve, sep, posix } from 'node:path'
 import { tmpdir, homedir } from 'node:os'
 import { randomUUID } from 'node:crypto'
 
@@ -88,33 +88,77 @@ const TEST_TIMEOUT_MS = 120_000 // 2 minutes
 const REPORT_DIR = join(homedir(), '.mipham', 'crsi-sandbox')
 
 /**
- * 自改进循环的只读边界（信任域隔离）。
+ * 自改进的「不可变基础」（immutable base）——按语义角色三类。
+ * 自改进循环可以改 skill/workflow/prompt/memory/教训/managed-rules，
+ * 但绝不能改以下三者，否则会削弱 grader 或安全边界：
+ *   constitution     —— 宪法/对齐：改掉 = 价值漂移优化掉安全边界
+ *   evaluator        —— 评估器/grader：改掉 = 改掉自己的评分标准（Goodhart 元劫持）
+ *   selfImprovement  —— 改进机制自身：改掉 = 递归改掉评估器/安全
  *
- * 这些路径是 CRSI 自改进的「慢通道」——宪法、eval harness、改进机制自身。
- * 自改进循环可以改 skill/workflow/prompt/memory，但绝不能改：
- *   1. 宪法（对齐本体 + 对齐缝 + 加载器）—— 否则价值漂移会「优化」掉安全边界
- *   2. eval harness（测试套件）—— 否则会改掉自己的评估标准（Goodhart 元劫持）
- *   3. 改进机制自身（有效性追踪 / 元规则引擎 / 沙箱）—— 否则递归会改掉评估器
- *
- * 注意：这是 fail-closed 边界——宁可多拦，不可漏拦。
+ * 注意：fail-closed——宁可多拦，不可漏拦。新增机制文件必须加进对应类别，
+ * 否则 eval harness 的 protection-completeness 契约会 fail。
+ */
+export const PROTECTED_ROLES = {
+  constitution: [
+    'apps/cli/src/core/alignment-vocabulary.json',
+    'apps/cli/src/core/constitution-loader.ts',
+    'apps/cli/src/core/constitution-seam.ts',
+    'apps/cli/src/vajra/constitution.ts',
+  ],
+  evaluator: [
+    'apps/cli/test/',
+    'apps/cli/src/core/eval-harness.ts',
+    'apps/cli/src/core/behavior-tasks.ts',
+    'apps/cli/src/core/behavior-tasks.json',
+    'apps/cli/src/core/task-performance.ts',
+    'apps/cli/src/core/task-performance-tasks.json',
+    'apps/cli/src/core/improvement-track.ts',
+    'apps/cli/src/core/reward-fn.ts',
+  ],
+  selfImprovement: [
+    'apps/cli/src/agent/effectiveness-tracker.ts',
+    'apps/cli/src/agent/recoverable-failure.ts',
+    'apps/cli/src/agent/crsi-provenance-bridge.ts',
+    'apps/cli/src/agent/experience-rules.ts',
+    'apps/cli/src/agent/agent-experience.ts',
+    'apps/cli/src/core/meta-rule-engine.ts',
+    'apps/cli/src/core/crsi-sandbox.ts',
+    'apps/cli/src/core/crsi-producer.ts',
+    'apps/cli/src/core/proposal-guard.ts',
+    'apps/cli/src/core/crsi-modify.ts',
+    'apps/cli/src/core/rule-engine.ts',
+    'apps/cli/src/core/red-team.ts',
+    'apps/cli/src/core/error-signature-db.ts',
+    'apps/cli/src/core/preflight-checker.ts',
+    'apps/cli/src/core/permission-rules.ts',
+    'apps/cli/src/core/rules-loader.ts',
+  ],
+} as const
+
+/** 扁平化（向后兼容：isProtectedPath 仍用前缀匹配，行为不变）。 */
+export const PROTECTED_PATHS: string[] = Object.values(PROTECTED_ROLES).flat()
+
+/**
+ * 完整性金丝雀：这些「评估器 + 核心机制」文件必须全在保护域。
+ * eval harness 的 protection-completeness 契约逐条断言 isProtectedPath。
+ * 与 PROTECTED_ROLES 同文件（单一维护点）——新增机制文件须两处一起加。
  */
-const PROTECTED_PATHS = [
-  // 宪法（对齐）
-  'apps/cli/src/core/alignment-vocabulary.json',
-  'apps/cli/src/core/constitution-loader.ts',
-  'apps/cli/src/core/constitution-seam.ts',
-  'apps/cli/src/vajra/constitution.ts',
-  // eval harness
-  'apps/cli/test/',
+export const PROTECTED_CRITICAL_FILES: string[] = [
   'apps/cli/src/core/eval-harness.ts',
   'apps/cli/src/core/behavior-tasks.ts',
   'apps/cli/src/core/behavior-tasks.json',
-  // 改进机制自身
-  'apps/cli/src/agent/effectiveness-tracker.ts',
-  'apps/cli/src/core/meta-rule-engine.ts',
+  'apps/cli/src/core/task-performance.ts',
+  'apps/cli/src/core/task-performance-tasks.json',
+  'apps/cli/src/core/improvement-track.ts',
+  'apps/cli/src/core/reward-fn.ts',
   'apps/cli/src/core/crsi-sandbox.ts',
   'apps/cli/src/core/crsi-producer.ts',
-  'apps/cli/src/core/proposal-guard.ts',
+  'apps/cli/src/core/rule-engine.ts',
+  'apps/cli/src/core/red-team.ts',
+  'apps/cli/src/core/error-signature-db.ts',
+  'apps/cli/src/core/preflight-checker.ts',
+  'apps/cli/src/agent/recoverable-failure.ts',
+  'apps/cli/src/agent/crsi-provenance-bridge.ts',
 ]
 
 /** 是否命中只读边界。前缀匹配，目录条目以 `/` 结尾。 */
@@ -130,13 +174,24 @@ export function isProtectedPath(filePath: string): boolean {
  *
  * 返回错误字符串（拒绝理由），合法时返回 null。
  */
-export function validateBlastRadius(proposal: { blastRadius?: string[] }): string | null {
+export function validateBlastRadius(proposal: {
+  filePath?: string
+  blastRadius?: string[]
+}): string | null {
+  const filePath = proposal.filePath
   if (!proposal.blastRadius || proposal.blastRadius.length === 0) {
     return (
       'blast radius 未声明：自修改必须枚举触及的全部代码路径。' +
       '教训：两条渲染路径只接一条 = 局部正确全局遗漏。'
     )
   }
+  // 2026-08-27 review：blastRadius 不能只自证「非空」，必须覆盖被修改文件本身
+  // （前缀匹配，目录条目以 / 结尾），否则声明形同虚设。
+  if (filePath && !proposal.blastRadius.some((p) => filePath === p || filePath.startsWith(p))) {
+    return (
+      `blast radius 未覆盖目标文件 "${filePath}"：` + '声明必须包含被修改文件本身（前缀匹配）。'
+    )
+  }
   return null
 }
 
@@ -225,7 +280,10 @@ export class CrsiSandbox {
     }
 
     const worktreeRoot = resolve(this.worktreePath)
-    const targetPath = resolve(this.worktreePath, mod.filePath)
+    // Normalize "./" and "subdir/../" so the protected-path guard can't be evaded
+    // by a path that resolves back inside the worktree (raw prefix match would miss it).
+    const normalizedFilePath = posix.normalize(mod.filePath)
+    const targetPath = resolve(this.worktreePath, normalizedFilePath)
 
     // Path traversal guard: reject any target that resolves outside the sandbox worktree
     if (targetPath !== worktreeRoot && !targetPath.startsWith(worktreeRoot + sep)) {
@@ -237,7 +295,7 @@ export class CrsiSandbox {
 
     // Protected-path guard: the self-improvement loop must not modify the
     // constitution, eval harness, or improvement machinery itself.
-    if (isProtectedPath(mod.filePath)) {
+    if (isProtectedPath(normalizedFilePath)) {
       result.error = `Protected path: "${mod.filePath}" is read-only to the self-improvement loop.`
       result.phase = 'failed'
       this.sessionReport.modifications.push(result)
@@ -275,7 +333,7 @@ export class CrsiSandbox {
 
       // Generate diff
       try {
-        result.diff = execSync(`git diff -- "${mod.filePath}"`, {
+        result.diff = execSync(`git diff -- "${normalizedFilePath}"`, {
           cwd: this.worktreePath,
           timeout: 10_000,
           encoding: 'utf-8',

package/src/core/engine.ts

@@ -40,7 +40,12 @@ import { buildRequest, sendInferenceCheck, isInferenceHookEnabled } from './infe
 import { getFileInboxTransport } from '../agent/cross-session/file-inbox'
 import { registerWakeupHandler } from '../tools/scheduling/schedule-wakeup'
 import { accumulateGraftSavings } from '../shared/graft-savings'
-import { getMessageBus, type AgentMessage } from '../agent/message-bus'
+import {
+  getMessageBus,
+  formatInboundMessage,
+  type AgentMessage,
+  type AgentMessageBus,
+} from '../agent/message-bus'
 import { createT } from '../i18n-core/t'
 import enUS from '../i18n-core/locales/en-US.json'
 import zhCN from '../i18n-core/locales/zh-CN.json'
@@ -255,6 +260,28 @@ export class QueryEngine {
     }
   }
 
+  /**
+   * Drain unread inbound messages from the in-memory bus (addressed to this
+   * session or to "main") and inject them into the conversation as user-role
+   * notices. Returns the number of messages injected.
+   *
+   * The bus is the delivery channel for same-process SendMessage ("main",
+   * "bg-*", "sub-agent-*") and the re-post target of pollCrossSessionInbox;
+   * this is the missing "drain" step that surfaces those messages to the model.
+   */
+  drainInboundMessages(bus: AgentMessageBus = getMessageBus()): number {
+    const recipients = [...new Set([this.sessionId, 'main'])]
+    let injected = 0
+    for (const recipient of recipients) {
+      for (const msg of bus.poll(recipient)) {
+        this.context.addMessage({ role: 'user', content: formatInboundMessage(msg) })
+        injected++
+      }
+      bus.markAllRead(recipient)
+    }
+    return injected
+  }
+
   /** Register a hook engine for pre/post tool-use lifecycle events. */
   setHookEngine(hooks: HookEngine): void {
     this.hookEngine = hooks
@@ -474,6 +501,8 @@ export class QueryEngine {
 
     // Poll for cross-session messages before each turn
     await this.pollCrossSessionInbox()
+    // Drain in-memory bus messages (same-process SendMessage + cross-session re-posts)
+    this.drainInboundMessages()
 
     // Fire UserPromptSubmit hooks before processing
     if (this.hookEngine) {
@@ -1204,7 +1233,6 @@ export class QueryEngine {
           const ruleId = match?.[1]
           if (ruleId) {
             tracker.recordApplication(ruleId, result.success, {
-              toolName: name,
               error: result.error,
             })
           }