@miphamai/cli 0.81.8 → 0.82.0

package/src/config/loader.ts

@@ -65,10 +65,21 @@ function mergeProviders(
   const merged = [...baseProviders]
 
   for (const op of overrideProviders) {
+    // This array comes straight out of hand-written YAML: an entry can be
+    // `null`, or a bare scalar (iterating `providers: nope` yields its
+    // characters). Neither is a provider config, and neither should reach the
+    // field reads below.
+    if (!op || typeof op !== 'object') continue
+
+    // A non-string `apiKey` (a number, a list, a nested map) is not a secret.
+    // It reads as "no key" — the same invariant getProviderApiKey enforces —
+    // rather than reaching a `.startsWith` and taking the whole CLI down.
+    const apiKey = typeof op.apiKey === 'string' ? op.apiKey : undefined
+
     const idx = merged.findIndex((bp) => bp.id === op.id)
     if (idx === -1) {
       // Provider not in defaults — add it wholesale (custom provider)
-      merged.push(op)
+      merged.push(apiKey === undefined ? op : { ...op, apiKey })
       continue
     }
 
@@ -82,7 +93,7 @@ function mergeProviders(
       // sent, so only trusted (user-level) config may override it. Untrusted
       // (project-level) config cannot redirect a built-in provider's traffic.
       baseUrl: allowBaseUrlOverride ? (op.baseUrl ?? base.baseUrl) : base.baseUrl,
-      apiKey: op.apiKey ?? base.apiKey,
+      apiKey: apiKey ?? base.apiKey,
       models: op.models?.length ? op.models : base.models,
       status: op.status ?? base.status,
     }
@@ -91,16 +102,44 @@ function mergeProviders(
   return merged
 }
 
+/**
+ * Merge `override` into `base`, recursing into plain objects so that a source
+ * setting one branch of an object does not drop the other source's siblings
+ * (`features.mcp` must not wipe `features.context`).
+ *
+ * Arrays and scalars replace: a project's `skills.paths` must not append to the
+ * user's list. Objects are rebuilt with spread rather than assignment — a parsed
+ * `__proto__` key is then copied as an ordinary own property instead of
+ * mutating the result's prototype.
+ */
+function mergeObjects<T extends Record<string, unknown>>(base: T, override: T): T {
+  let merged: Record<string, unknown> = { ...base }
+  for (const [key, value] of Object.entries(override)) {
+    const existing = (base as Record<string, unknown>)[key]
+    merged = {
+      ...merged,
+      [key]:
+        isPlainObject(value) && isPlainObject(existing) ? mergeObjects(existing, value) : value,
+    }
+  }
+  return merged as T
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
 function mergeConfig(
   base: MiphamConfig,
   override: Partial<MiphamConfig>,
   allowBaseUrlOverride: boolean,
 ): MiphamConfig {
-  const merged: MiphamConfig = { ...base, ...override }
+  const merged = mergeObjects(
+    base as unknown as Record<string, unknown>,
+    override as Record<string, unknown>,
+  ) as unknown as MiphamConfig
   if (override.providers) {
     merged.providers = mergeProviders(base.providers, override.providers, allowBaseUrlOverride)
-  } else {
-    merged.providers = base.providers
   }
   return merged
 }
@@ -182,31 +221,19 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
     try {
       if (!existsSync(path)) continue
       const raw = readFileSync(path, 'utf-8')
+      // Every McpServerConfig field is optional here (the name comes from the
+      // key), so a field added to the type is accepted without touching this.
       const parsed = JSON.parse(raw) as {
-        mcpServers?: Record<
-          string,
-          {
-            command?: string
-            args?: string[]
-            url?: string
-            headers?: Record<string, string>
-            env?: Record<string, string>
-          }
-        >
+        mcpServers?: Record<string, Partial<McpServerConfig>>
       }
 
       if (parsed.mcpServers) {
         for (const [name, cfg] of Object.entries(parsed.mcpServers)) {
           // Avoid duplicates by name
           if (servers.some((s) => s.name === name)) continue
-          servers.push({
-            name,
-            command: cfg.command,
-            args: cfg.args || [],
-            url: cfg.url,
-            headers: cfg.headers,
-            env: cfg.env,
-          })
+          // Spread the whole entry rather than re-listing fields: hand-rebuilding
+          // the object silently dropped request_timeout_ms and auth.
+          servers.push({ ...cfg, name, args: cfg.args || [] })
         }
       }
     } catch {
@@ -224,20 +251,57 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
 export interface SettingsJson {
   hooks: SettingsHooks
   permissions: { allow: string[]; deny: string[] }
+  /**
+   * Present (and `true`) only when the project-level file really did declare
+   * hooks and they were withheld because the caller did not vouch for the
+   * workspace. Absent in every other case — including "the file has no hooks",
+   * so a caller announcing the skip cannot announce one that never happened.
+   */
+  projectHooksSkipped?: true
+  /**
+   * The subset of `hooks` that came from the project-level file — the entries
+   * the workspace-trust gate governs. Absent unless the caller vouched for the
+   * workspace *and* that file really declared hooks.
+   *
+   * Needed because `hooks` is provenance-free once merged: project and user
+   * entries sit in one bucket, yet only one of the two is gated. A caller that
+   * lists the merged form therefore cannot say which entries will run.
+   */
+  projectHooks?: SettingsHooks
 }
 
 /**
  * Load `settings.json` — project-level `.mipham/settings.json` then user-level
  * `~/.mipham/settings.json`. Mirrors the Claude Code convention (hooks additive,
  * permissions merged), so users can migrate their Claude settings unchanged.
+ *
+ * `includeProjectHooks` defaults to **false**, because the project-level file is
+ * repository-controlled and its `hooks` are shell commands this process will
+ * spawn — reading them is an act of trust, not a default. Callers that have
+ * established trust (or that only *display* the configured list) opt in
+ * explicitly. The flag gates hooks only: `permissions` still merge from both
+ * levels, since that question is answered by the mode ceiling, not by trust.
  */
-export function loadSettingsJson(cwd: string = process.cwd()): SettingsJson {
+export function loadSettingsJson(
+  cwd: string = process.cwd(),
+  options: { includeProjectHooks?: boolean } = {},
+): SettingsJson {
   const hooks: SettingsHooks = {}
   const permissions = { allow: [] as string[], deny: [] as string[] }
+  let projectHooksSkipped = false
+  // The project file's entries, kept out of the merge so provenance survives it.
+  const projectHooks: SettingsHooks = {}
+
+  const searchPaths: Array<{ path: string; readHooks: boolean; isProject?: boolean }> = [
+    {
+      path: join(cwd, '.mipham', 'settings.json'),
+      readHooks: options.includeProjectHooks ?? false,
+      isProject: true,
+    },
+    { path: join(MIPHAM_HOME, 'settings.json'), readHooks: true },
+  ]
 
-  const searchPaths = [join(cwd, '.mipham', 'settings.json'), join(MIPHAM_HOME, 'settings.json')]
-
-  for (const path of searchPaths) {
+  for (const { path, readHooks, isProject } of searchPaths) {
     try {
       if (!existsSync(path)) continue
       const raw = readFileSync(path, 'utf-8')
@@ -246,11 +310,27 @@ export function loadSettingsJson(cwd: string = process.cwd()): SettingsJson {
         permissions?: { allow?: unknown; deny?: unknown }
       }
 
-      if (parsed.hooks && typeof parsed.hooks === 'object') {
+      if (!readHooks) {
+        // "Was anything actually withheld?" is answered from the same parse that
+        // would have read it, so the skip notice cannot outrun the fact.
+        const declared = Object.values(parsed.hooks ?? {}).some(
+          (entries) => Array.isArray(entries) && entries.length > 0,
+        )
+        if (declared) projectHooksSkipped = true
+      }
+
+      if (readHooks && parsed.hooks && typeof parsed.hooks === 'object') {
         for (const [eventName, entries] of Object.entries(parsed.hooks)) {
           if (!Array.isArray(entries)) continue
           const bucket = (hooks as Record<string, unknown[]>)[eventName]
           ;(hooks as Record<string, unknown[]>)[eventName] = [...(bucket ?? []), ...entries]
+          if (isProject) {
+            const pBucket = (projectHooks as Record<string, unknown[]>)[eventName]
+            ;(projectHooks as Record<string, unknown[]>)[eventName] = [
+              ...(pBucket ?? []),
+              ...entries,
+            ]
+          }
         }
       }
 
@@ -268,7 +348,16 @@ export function loadSettingsJson(cwd: string = process.cwd()): SettingsJson {
     }
   }
 
-  return { hooks, permissions }
+  // Keys added only when they have something to say: `toEqual` distinguishes
+  // `false` from absent, and "no project hooks" must stay indistinguishable from
+  // "nothing to report" — an empty marker would let a caller tag user hooks as
+  // gated on the strength of a file with nothing in it.
+  const result: SettingsJson = { hooks, permissions }
+  if (projectHooksSkipped) result.projectHooksSkipped = true
+  if (Object.values(projectHooks).some((entries) => Array.isArray(entries) && entries.length > 0)) {
+    result.projectHooks = projectHooks
+  }
+  return result
 }
 
 /** Which settings.json a permission rule is persisted to. */
@@ -478,44 +567,90 @@ export function loadInferenceHookConfig(): InferenceHookConfig {
 }
 
 /**
- * Load credential masking configuration from the same config sources.
- * Merges project-level over user-level. Returns defaults if no section present.
+ * Overlay one config file's `credential_masking` section onto `merged`.
+ *
+ * A malformed file leaves `merged` untouched — so a config that cannot be read
+ * costs you the *overrides*, never the masking itself (the defaults are on).
+ *
+ * `allowLoosening` is the same split as `baseUrl` in `mergeProviders`: the
+ * user's own `~/.mipham/config.yml` is trusted and may set anything, while a
+ * **project** file is whatever the repo you cloned shipped. Project level may
+ * only tighten — switch masking on and add rules, never switch it off or drop a
+ * rule. Otherwise one line in a cloned repo silently takes away a control the
+ * user already had (`enabled: false`), or `files: [...]` replaces the defaults
+ * wholesale and the SSH private-key rule stops being masked.
  */
-export function loadCredentialMaskingConfig(cwd: string = process.cwd()): CredentialMaskingConfig {
-  const configPath = join(cwd, '.mipham', 'config.yml')
-  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
-
-  let merged = { ...DEFAULT_CREDENTIAL_MASKING_CONFIG }
-
-  const paths = [userConfigPath, configPath] // project wins (loaded last)
-  for (const path of paths) {
-    try {
-      if (!existsSync(path)) continue
-      const raw = readFileSync(path, 'utf-8')
-      const parsed = parseYaml(raw) as Record<string, unknown>
-      const section = parsed.credential_masking as Partial<CredentialMaskingConfig> | undefined
-      if (section) {
-        merged = {
-          enabled: section.enabled ?? merged.enabled,
-          files: section.files ?? merged.files,
-          output_scrubbing: {
-            enabled: section.output_scrubbing?.enabled ?? merged.output_scrubbing.enabled,
-            patterns: section.output_scrubbing?.patterns ?? merged.output_scrubbing.patterns,
-          },
-          env_filter: {
-            enabled: section.env_filter?.enabled ?? merged.env_filter.enabled,
-            patterns: section.env_filter?.patterns ?? merged.env_filter.patterns,
-          },
-        }
-      }
-    } catch {
-      // Silently skip malformed configs
+function mergeCredentialMaskingFile(
+  merged: CredentialMaskingConfig,
+  path: string,
+  allowLoosening: boolean,
+): CredentialMaskingConfig {
+  try {
+    if (!existsSync(path)) return merged
+    const raw = readFileSync(path, 'utf-8')
+    const parsed = parseYaml(raw) as Record<string, unknown>
+    const section = parsed.credential_masking as Partial<CredentialMaskingConfig> | undefined
+    if (!section) return merged
+
+    // Tightening can only ever turn a switch on, never off.
+    const flag = (next: boolean | undefined, cur: boolean): boolean =>
+      allowLoosening ? (next ?? cur) : cur || (next ?? false)
+
+    // Tightening adds rules instead of replacing them. Earlier rules stay in
+    // front because `matchCredentialFile` returns the **first** match — so a
+    // project cannot weaken a path's mode by adding a second rule for it.
+    const rules = <T>(next: T[] | undefined, cur: T[]): T[] =>
+      allowLoosening ? (next ?? cur) : [...cur, ...(next ?? [])]
+
+    return {
+      enabled: flag(section.enabled, merged.enabled),
+      files: rules(section.files, merged.files),
+      output_scrubbing: {
+        enabled: flag(section.output_scrubbing?.enabled, merged.output_scrubbing.enabled),
+        patterns: rules(section.output_scrubbing?.patterns, merged.output_scrubbing.patterns),
+      },
+      env_filter: {
+        enabled: flag(section.env_filter?.enabled, merged.env_filter.enabled),
+        patterns: rules(section.env_filter?.patterns, merged.env_filter.patterns),
+      },
     }
+  } catch {
+    // Silently skip malformed configs
+    return merged
   }
+}
 
+/**
+ * Load credential masking configuration from the same config sources.
+ * Returns defaults if no section present.
+ *
+ * User level first (trusted, may loosen), then project level (tighten only).
+ */
+export function loadCredentialMaskingConfig(cwd: string = process.cwd()): CredentialMaskingConfig {
+  let merged = { ...DEFAULT_CREDENTIAL_MASKING_CONFIG }
+  merged = mergeCredentialMaskingFile(merged, join(MIPHAM_HOME, 'config.yml'), true)
+  merged = mergeCredentialMaskingFile(merged, join(cwd, '.mipham', 'config.yml'), false)
   return merged
 }
 
+/**
+ * User-level masking policy only (`~/.mipham/config.yml`), without any project
+ * section.
+ *
+ * The tool registry is one instance per daemon process, while sessions carry
+ * different cwds (`createToolRegistry()` in `daemon/server.ts` is memoized) —
+ * so a project's section cannot be applied to it without leaking one project's
+ * policy into another session. User level is the only scope that is true for
+ * every session the registry serves.
+ */
+export function loadUserCredentialMaskingConfig(): CredentialMaskingConfig {
+  return mergeCredentialMaskingFile(
+    { ...DEFAULT_CREDENTIAL_MASKING_CONFIG },
+    join(MIPHAM_HOME, 'config.yml'),
+    true,
+  )
+}
+
 /**
  * Load background agent configuration from config sources.
  */
@@ -588,11 +723,15 @@ export function loadCrossSessionConfig(cwd: string = process.cwd()): CrossSessio
  */
 function decryptProviderApiKeys(providers: ProviderConfig[] | undefined): void {
   if (!providers) return
-  const needsKey = providers.some((p) => p.apiKey.startsWith(ENC_PREFIX))
-  if (!needsKey) return
+  // Same invariant as getProviderApiKey: only a string can carry the `enc:v1:`
+  // prefix, so a malformed entry counts as "no key" instead of throwing on
+  // `.startsWith` and taking the whole CLI down at startup.
+  const isEncrypted = (p: ProviderConfig | null): boolean =>
+    !!p && typeof p.apiKey === 'string' && p.apiKey.startsWith(ENC_PREFIX)
+  if (!providers.some(isEncrypted)) return
   const key = getCredentialKey(MIPHAM_HOME)
   for (const p of providers) {
-    if (!p.apiKey.startsWith(ENC_PREFIX)) continue
+    if (!isEncrypted(p)) continue
     try {
       p.apiKey = decryptApiKey(p.apiKey, key)
     } catch (err: unknown) {

package/src/core/credential-masker/output-scrub.ts

@@ -11,6 +11,16 @@ import { SecurityGate } from '../../security/gate'
 const TOKEN_REDACTION_PATTERN =
   /\b(?:ghp_|gho_|ghs_|ghu_|ghr_|github_pat_|glpat-|gldt-|glrt-|gloas-)[A-Za-z0-9_-]{8,}/g
 
+/**
+ * Credentials embedded in a URL's userinfo — `scheme://user:password@host`.
+ *
+ * Nothing in the *name* gives this away: `DATABASE_URL` holds no secret word,
+ * so a name-based pattern cannot see it (and masking every `*_URL` would take
+ * out every non-secret endpoint too). The shape is the only reliable tell.
+ * Redacts the password and keeps user + host, or the line stops being readable.
+ */
+const URL_USERINFO_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/gi
+
 /**
  * Scrub credential patterns from stdout/stderr output.
  * Uses the configured output_scrubbing patterns to detect and replace
@@ -24,6 +34,9 @@ export function maskOutput(output: string, config: CredentialMaskingConfig): str
   // Redact bare secret tokens by prefix (always on, independent of config patterns).
   masked = masked.replace(TOKEN_REDACTION_PATTERN, CREDENTIAL_SENTINEL)
 
+  // Redact URL-embedded passwords — also shape-based, also always on.
+  masked = masked.replace(URL_USERINFO_PATTERN, `$1$2:${CREDENTIAL_SENTINEL}@`)
+
   // Redact bare sk-/sk-ant-/JWT tokens — wire the SecurityGate credential-leak
   // detection into the output path (defense-in-depth beyond the config patterns).
   masked = SecurityGate.redactCredentialLeak(masked)
@@ -34,8 +47,9 @@ export function maskOutput(output: string, config: CredentialMaskingConfig): str
       const clean = pattern.replace(/^\(\?i\)/, '')
       const regex = new RegExp(clean, 'gim')
       masked = masked.replace(regex, (match) => {
-        // Replace everything after the separator (= or :)
-        return match.replace(/\s*[:=]\s*\S+/, `=${CREDENTIAL_SENTINEL}`)
+        // Replace everything after the separator (= or :), swallowing the quote
+        // a JSON-shaped hit puts in front of it (`"apiKey": "…"`).
+        return match.replace(/\s*["']?\s*[:=]\s*["']?\S+/, `=${CREDENTIAL_SENTINEL}`)
       })
     } catch {
       // Invalid regex — skip

package/src/core/crsi-modify.ts

@@ -13,7 +13,7 @@
  */
 
 import { randomUUID } from 'node:crypto'
-import { CrsiSandbox, validateBlastRadius } from './crsi-sandbox'
+import { CrsiSandbox, validateBlastRadius, validateMergeConvergence } from './crsi-sandbox'
 import type { CrsiModificationResult } from './crsi-sandbox'
 import { appendEvalScore, getLastEvalScore, regressedAnchors } from './eval-harness'
 import { mechanismSentinel, type RewardFn } from './reward-fn'
@@ -36,6 +36,19 @@ export interface CrsiProposal {
    * 局部正确、全局遗漏。自修改前必须摸清并声明全部受影响路径，否则 fail-closed 拒绝。
    */
   blastRadius?: string[]
+  /**
+   * ε：提交者**事前**写下的预期效果（任务表现提升点数）。
+   * 缺席 = 不预测。判定见 improvement-track 的 predictionHit。
+   */
+  expectedEffect?: number
+  /** R：风险声明（这次改动可能在哪方面变差）。缺席 = 未声明。 */
+  risk?: string
+  /**
+   * 声明这是一次**合并型**提案（整合已有内容，而非新增）。
+   * 只有它为 true 时 `validateMergeConvergence` 才开火 —— 学习本身就是增长，
+   * 对新增型设非增长约束等于永久禁掉 `/crsi propose`。
+   */
+  merge?: boolean
 }
 
 // ── Pending proposal registry (两阶段闸门) ──
@@ -70,6 +83,26 @@ export async function runCrsiModification(
     }
   }
 
+  // B_H 收敛闸：合并型提案不得抬高脚手架成本。
+  // 位置与 blast radius 闸同序 —— 都在 worktree 之前，纯字符串比较、零磁盘 I/O、零副作用。
+  const convergenceError = validateMergeConvergence(proposal)
+  if (convergenceError) {
+    return {
+      modification: {
+        id: 'crsi-mod-rejected-merge-convergence',
+        description: proposal.description,
+        filePath: proposal.filePath,
+        newContent: proposal.newContent,
+        originalContent: proposal.originalContent ?? '',
+        crsiInsightId: proposal.crsiInsightId,
+        timestamp: new Date().toISOString(),
+      },
+      applied: false,
+      phase: 'failed',
+      error: convergenceError,
+    }
+  }
+
   sandbox.createWorktree()
 
   const applied = sandbox.applyModification({

package/src/core/crsi-producer.ts

@@ -336,7 +336,7 @@ export async function selectTargetSkill(
   return extractFilePath(response, skillFiles)
 }
 
-const PROSE_GENERATE_PROMPT_VERSION = '1.0.0'
+const PROSE_GENERATE_PROMPT_VERSION = '1.1.0'
 
 function buildGenerateProsePrompt(
   signal: CrsiSignal,
@@ -357,7 +357,12 @@ function buildGenerateProsePrompt(
     '当前内容：',
     originalContent,
     '',
-    '请返回改进后的完整 markdown（保持 YAML frontmatter 的 name/description 字段，正文针对失败信号做针对性改进）。只返回 markdown，不要额外说明。',
+    '返回格式（严格遵守，两段）：',
+    '第 1 行：一行 JSON，写下你对这次改动的**预期效果**与**风险**：',
+    '{"expectedDelta": <number 或 null>, "risk": "<字符串>"}',
+    '- expectedDelta 是预期该 skill 的任务表现提升**点数**（可正可负；无法预测写 null）。',
+    '- risk 是这次改动可能在哪方面变差（一句话）。',
+    '第 2 行起：改进后的完整 markdown（保持 YAML frontmatter 的 name/description 字段，正文针对失败信号做针对性改进）。不要用代码围栏包住。',
   ].join('\n')
 }
 
@@ -366,16 +371,68 @@ function stripMarkdownFence(text: string): string {
   return match ? match[1]! : text
 }
 
+/** prose 提议的解析产物：正文 + 可选的事前预登记（ε 与风险声明）。 */
+export interface ProsePrediction {
+  body: string
+  /** ε：事前写下的预期提升点数。缺席 = 模型没预测（含显式写 null）。 */
+  expectedEffect?: number
+  /** R：风险声明。缺席 = 未声明。 */
+  risk?: string
+}
+
+/**
+ * 解析 prose 响应：可选的一行 JSON 前缀（ε）+ 正文。
+ *
+ * 顺序是**先归一化、后嗅探**（不可颠倒）：stripMarkdownFence 的正则锚在串首
+ * （/^```(?:markdown|md)?\s*\n…\n```\s*$/）。若先剥「首行围栏」再嗅探，正文尾部的
+ * 那个 ``` 就再没有东西去剥它 ⇒ 孤立的尾部围栏会进入写盘路径。
+ *
+ * 认领标记是**含 `expectedDelta` 键**（盖住 number 与显式 null 两种写法）；
+ * 其余任何情况都走兜底 —— 正文 = 归一化后的原文，一字不改。
+ */
+export function parseProsePrediction(raw: string): ProsePrediction {
+  const stripped = stripMarkdownFence(raw)
+  const lines = stripped.split('\n')
+  const firstIdx = lines.findIndex((l) => l.trim() !== '')
+  if (firstIdx === -1) return { body: stripped }
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(lines[firstIdx]!.trim())
+  } catch {
+    return { body: stripped } // 首行不是 JSON → 兜底
+  }
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    return { body: stripped }
+  }
+  const rec = parsed as { expectedDelta?: unknown; risk?: unknown }
+  if (!('expectedDelta' in rec)) return { body: stripped } // 不带 ε 的 JSON 不吃
+
+  const expectedEffect = typeof rec.expectedDelta === 'number' ? rec.expectedDelta : undefined
+  const risk = typeof rec.risk === 'string' ? rec.risk : undefined
+  // 剥掉 JSON 行本身 + 紧随其后的空行
+  const body = lines
+    .slice(firstIdx + 1)
+    .join('\n')
+    .replace(/^[ \t]*\n/, '')
+
+  return {
+    body,
+    ...(expectedEffect !== undefined ? { expectedEffect } : {}),
+    ...(risk !== undefined ? { risk } : {}),
+  }
+}
+
 export async function generateProseContent(
   signal: CrsiSignal,
   llm: Llm,
   filePath: string,
   originalContent: string,
-): Promise<string | null> {
+): Promise<ProsePrediction | null> {
   const prompt = buildGenerateProsePrompt(signal, filePath, originalContent)
   const response = await collectLlmText(llm, prompt)
   if (!response) return null
-  return stripMarkdownFence(response)
+  return parseProsePrediction(response)
 }
 
 export interface ProseProposalResult {
@@ -383,6 +440,10 @@ export interface ProseProposalResult {
   newContent: string
   originalContent: string
   description: string
+  /** ε：由模型在正文之前写下（见 parseProsePrediction）。 */
+  expectedEffect?: number
+  /** R：风险声明。 */
+  risk?: string
 }
 
 export async function produceProseProposal(
@@ -401,10 +462,17 @@ export async function produceProseProposal(
     return null
   }
 
-  const newContent = await generateProseContent(signal, llm, filePath, originalContent)
-  if (!newContent) return null
+  const generated = await generateProseContent(signal, llm, filePath, originalContent)
+  if (!generated || !generated.body) return null
 
-  return { filePath, newContent, originalContent, description: signal.title }
+  return {
+    filePath,
+    newContent: generated.body,
+    originalContent,
+    description: signal.title,
+    ...(generated.expectedEffect !== undefined ? { expectedEffect: generated.expectedEffect } : {}),
+    ...(generated.risk !== undefined ? { risk: generated.risk } : {}),
+  }
 }
 
 const SKILL_DIRS: Array<[string, string]> = [
@@ -582,6 +650,7 @@ export async function produceCrossoverProposal(
   newContent: string
   originalContent: string
   blastRadius: string[]
+  merge: boolean
 } | null> {
   const response = await collectLlmText(llm, buildCrossoverPrompt(currentLessons))
   if (!response) return null
@@ -607,5 +676,6 @@ export async function produceCrossoverProposal(
     newContent,
     originalContent: currentLessons,
     blastRadius: [LESSONS_FILE],
+    merge: true,
   }
 }