@miphamai/cli 0.81.8 → 0.82.0

package/src/core/crsi-sandbox.ts

@@ -19,6 +19,7 @@ import { mkdirSync, rmSync, existsSync, writeFileSync, readFileSync, readdirSync
 import { join, resolve, sep, posix } from 'node:path'
 import { tmpdir, homedir } from 'node:os'
 import { randomUUID } from 'node:crypto'
+import { LESSONS_FILE, MANAGED_RULES_FILE } from './crsi-producer'
 
 // ── Types ──
 
@@ -195,6 +196,70 @@ export function validateBlastRadius(proposal: {
   return null
 }
 
+/**
+ * 脚手架三项计数（B_H 的度量）。按 filePath 分派语义单位：
+ * 教训段数 / 受管理规则条数 / 其余按 UTF-8 字节数。
+ *
+ * **为什么教训/规则文件不计字节**：合并会重写散文，字节数随措辞涨落。把字节计入，
+ * 会让「删二增一」因新写的合并段比原来两段更长而被误拦 —— 即闸会挡掉它本该允许的那件事。
+ * skill 文件没有可用的语义单位（它的「条数」就是文件本身），才退到字节数。
+ *
+ * `## ` 的口径与 `removeLessonSections` 逐字一致 —— 闸数的必须是 crossover 真正删得掉的那些
+ * 单位，否则两把尺子会各说各话。**刻意不声称与 `extractCrsiLessonSummaries` 一致**：后者用
+ * `/^##\s+(.+?)\s*$/`，还认 `##\t`，而 `startsWith('## ')` 不认（`'##\ta: 1'` 在此计 0、
+ * 在那里计 1）。闸依赖的是「删得掉」，故按前者对齐；这个差是选择，不是遗漏。
+ *
+ * 分派按**解析后**的路径（`resolve` 两侧同调，`cwd` 相消）—— 字面量比较时，`./` 前缀或
+ * 绝对形式的教训路径会静默落到**字节**分支，而那正是上面说绝不该用在教训文件上的那把尺子。
+ * 兄弟守卫 `isProtectedPath` 本身不做规范化（纯前缀比较）；是调用点 `CrsiSandbox.applyModification`
+ * 先 `posix.normalize` 再调它（`proposal-guard.ts` 那条调用点未规范化）。
+ */
+export function measureScaffold(
+  filePath: string,
+  content: string,
+): { lessons: number; rules: number; bytes: number } {
+  if (resolve(filePath) === resolve(LESSONS_FILE)) {
+    const lessons = content.split('\n').filter((l) => l.startsWith('## ')).length
+    return { lessons, rules: 0, bytes: 0 }
+  }
+  if (resolve(filePath) === resolve(MANAGED_RULES_FILE)) {
+    const rules = (content.match(/id: '/g) ?? []).length
+    return { lessons: 0, rules, bytes: 0 }
+  }
+  return { lessons: 0, rules: 0, bytes: Buffer.byteLength(content, 'utf-8') }
+}
+
+/**
+ * 合并型提案的收敛闸（B_H）。**零写死常数** —— 它不设上界，只要求「合并这件事本身别把
+ * 脚手架抬高」。RSIH 的 ‖H‖≤B_H 需要一个数，是因为它必须允许学到上界、到顶再强制合并；
+ * 本仓已有 dedup 那一半（教训按 `## category: title` 幂等、规则按 id 幂等），
+ * 缺的只是另一半，而那一半不需要数：**闸只在「试图整合」那一刻开火**。
+ *
+ * 返回拒绝理由，合法时返回 null（同 validateBlastRadius 的签名）。
+ */
+export function validateMergeConvergence(proposal: {
+  filePath?: string
+  originalContent?: string
+  newContent?: string
+  merge?: boolean
+}): string | null {
+  if (proposal.merge !== true) return null
+  // 无基线不是有增长：手工路径在文件不存在时正是这个形态（commands.ts 的宽松模式）。
+  if (!proposal.originalContent || !proposal.newContent) return null
+
+  const filePath = proposal.filePath ?? ''
+  const before = measureScaffold(filePath, proposal.originalContent)
+  const after = measureScaffold(filePath, proposal.newContent)
+
+  const rose: string[] = []
+  if (after.lessons > before.lessons) rose.push(`教训段数 ${before.lessons} → ${after.lessons}`)
+  if (after.rules > before.rules) rose.push(`规则条数 ${before.rules} → ${after.rules}`)
+  if (after.bytes > before.bytes) rose.push(`字节数 ${before.bytes} → ${after.bytes}`)
+  if (rose.length === 0) return null
+
+  return `合并型提案必须收敛，但脚手架增长了：${rose.join('；')}。`
+}
+
 // ── Sandbox ──
 
 export class CrsiSandbox {

package/src/core/engine.ts

@@ -256,11 +256,16 @@ export class QueryEngine {
           }
 
           if (policy === 'ask') {
-            // Mark as awaiting approval — the model should verify with the user before acting
+            // Mark as awaiting approval — the model should verify with the user before acting.
+            //
+            // The instruction goes in the *summary*, because that is the only field
+            // `formatInboundMessage` delivers. Putting it in the body (as it was) is
+            // how a consent gate ends up authored and never applied: the recipient saw
+            // "[Awaiting Approval]" but not what to do about it.
             bus.post(
               msg.from,
               msg.to,
-              `[Awaiting Approval] ${msg.summary}`,
+              `[Awaiting Approval — verify with the user before acting] ${msg.summary}`,
               `[Cross-session message from ${msg.from} — verify with user before acting]\n\n${msg.message}`,
               'warning',
             )

package/src/core/eval-harness.ts

@@ -21,14 +21,21 @@ import { PreFlightChecker } from './preflight-checker'
 import { createDefaultPostFlightChecker } from './post-flight-checker'
 import { WorkingMemory } from './working-memory'
 import { RedTeam } from './red-team'
-import { isProtectedPath, validateBlastRadius, PROTECTED_CRITICAL_FILES } from './crsi-sandbox'
+import {
+  isProtectedPath,
+  validateBlastRadius,
+  validateMergeConvergence,
+  PROTECTED_CRITICAL_FILES,
+} from './crsi-sandbox'
 import {
   produceRuleProposal,
   MANAGED_RULES_FILE,
+  LESSONS_FILE,
   buildLessonContent,
   renderManagedRuleSource,
 } from './crsi-producer'
 import type { CrsiSignal } from './crsi-producer'
+import { predictionHit } from './improvement-track'
 import { loadBehaviorTasks, judgeBehaviorTask } from './behavior-tasks'
 
 // ── Types ──
@@ -43,6 +50,12 @@ export interface EvalResult {
   detail?: string
   /** 契约角色。缺省 neutral。 */
   role?: ContractRole
+  /**
+   * anchor 契约的**定义处真源**。`role` 由此派生（见 runEval 末尾的回填）。
+   * `ANCHOR_CONTRACT_IDS` 退为**独立声明**，两者由 test/integrity/anchor-contract-wiring
+   * 守卫两向比对 —— 两处独立陈述同一件事，它们才可能不一致，守卫才有内容。
+   */
+  anchor?: true
 }
 
 export interface EvalReport {
@@ -70,6 +83,8 @@ export const ANCHOR_CONTRACT_IDS: ReadonlySet<string> = new Set([
   'red-team-zero-gaps',
   'producer-rule-shape',
   'producer-rule-idempotent',
+  'prediction-hit-truth-table',
+  'merge-convergence-gate',
   'self-report-diagnostic',
 ])
 
@@ -147,6 +162,7 @@ export function runEval(): EvalReport {
     id: 'rule-timeout',
     description: '内置 timeout 规则命中低超时的 npm install',
     passed: timeout.modified.timeout === 300000,
+    anchor: true,
   })
 
   const gitForce = ruleEngine.intercept('Bash', {
@@ -157,6 +173,7 @@ export function runEval(): EvalReport {
     id: 'rule-git-force',
     description: 'git --force 触发告警',
     passed: gitForce.warnings.length > 0,
+    anchor: true,
   })
 
   const disabledRule: import('./rule-engine').ToolRule = {
@@ -174,6 +191,7 @@ export function runEval(): EvalReport {
     id: 'rule-disabled-skip',
     description: '禁用规则被跳过',
     passed: disabled.warnings.length === 0,
+    anchor: true,
   })
 
   // ── 宪法（ground truth：8 原则 + facet 映射 + 愿力序言） ──
@@ -182,6 +200,7 @@ export function runEval(): EvalReport {
     id: 'constitution-8-principles',
     description: '宪法含 8 条原则',
     passed: principles.length === 8,
+    anchor: true,
   })
 
   const prajna = principles.filter((p) => p.facet === 'prajna').length
@@ -191,12 +210,14 @@ export function runEval(): EvalReport {
     id: 'constitution-facets',
     description: 'facet 映射 智3 / 金刚5 / 悲0',
     passed: prajna === 3 && vajra === 5 && karuna === 0,
+    anchor: true,
   })
 
   results.push({
     id: 'constitution-preamble',
     description: '愿力序言已注入',
     passed: !!DEFAULT_CONSTITUTION.preamble && DEFAULT_CONSTITUTION.preamble.includes('悲'),
+    anchor: true,
   })
 
   // ── 沙箱只读边界（ground truth：受保护路径被拒） ──
@@ -206,7 +227,12 @@ export function runEval(): EvalReport {
     ['sandbox-protected-machinery', 'apps/cli/src/core/crsi-sandbox.ts'],
   ]
   for (const [id, path] of protectedChecks) {
-    results.push({ id, description: `受保护路径被拒: ${path}`, passed: isProtectedPath(path) })
+    results.push({
+      id,
+      description: `受保护路径被拒: ${path}`,
+      passed: isProtectedPath(path),
+      anchor: true,
+    })
   }
 
   // ── 语义边界完整性（ground truth：金丝雀关键机制文件全覆盖） ──
@@ -216,6 +242,7 @@ export function runEval(): EvalReport {
     description: '语义保护边界覆盖全部关键机制文件（评估器 + 核心机制）',
     passed: unprotected.length === 0,
     ...(unprotected.length > 0 ? { detail: `未保护: ${unprotected.join(', ')}` } : {}),
+    anchor: true,
   })
 
   // ── 完整覆盖闸（ground truth：未声明 blast radius 的 proposal 被 fail-closed 拒绝） ──
@@ -226,6 +253,7 @@ export function runEval(): EvalReport {
       validateBlastRadius({ blastRadius: undefined }) !== null &&
       validateBlastRadius({ blastRadius: [] }) !== null &&
       validateBlastRadius({ blastRadius: ['apps/cli/src/foo.ts'] }) === null,
+    anchor: true,
   })
 
   // ── 安全（ground truth：16 攻击零漏过） ──
@@ -235,6 +263,7 @@ export function runEval(): EvalReport {
     description: '16 个对抗场景零漏过',
     passed: redTeam.passedThrough === 0,
     detail: `score=${redTeam.score}, passedThrough=${redTeam.passedThrough}, falsePositives=${redTeam.falsePositives}`,
+    anchor: true,
   })
 
   // ── producer 行为（ground truth：固化规则产出正确 shape + 幂等） ──
@@ -255,6 +284,7 @@ export function runEval(): EvalReport {
       ruleProposal.newContent.includes("source: 'managed'") &&
       ruleProposal.newContent.includes('timeout: 300000') &&
       ruleProposal.newContent.includes('enabled: true'),
+    anchor: true,
   })
 
   results.push({
@@ -262,6 +292,7 @@ export function runEval(): EvalReport {
     description: '同名规则重复产出被拒（幂等）',
     passed:
       ruleProposal !== null && produceRuleProposal(frozenSignal, ruleProposal.newContent) === null,
+    anchor: true,
   })
 
   // ── 组件归因（ground truth：缺省 experiential、显式组件透传、非 experiential 不进 managed-rule） ──
@@ -334,6 +365,46 @@ export function runEval(): EvalReport {
     results.push({ ...judgeBehaviorTask(task, ruleEngine), role: 'target' })
   }
 
+  // ── ε 预测命中真值表（ground truth：命中判据不叠加统计阈值） ──
+  // `(20, 20)` 那条**承重**：判据是 `deltaMean >= predicted` 而 `>=` 与 `>` 只在
+  // `predicted === deltaMean` 处分歧 ⇒ 少了它，「把 >= 翻成 >」在契约上不可观测。
+  results.push({
+    id: 'prediction-hit-truth-table',
+    description: 'predictionHit 真值表（返回值）：未达不算、达到或恰好相等算命中、缺席恒 false',
+    passed:
+      predictionHit(50, 20) === false &&
+      predictionHit(10, 20) === true &&
+      predictionHit(20, 20) === true &&
+      predictionHit(undefined, 20) === false,
+    anchor: true,
+  })
+
+  // ── B_H 合并型收敛闸（ground truth：净增被拒、删二增一通过、非合并型不受此闸） ──
+  results.push({
+    id: 'merge-convergence-gate',
+    description: '合并型净增被拒、删二增一通过、merge=false 净增通过',
+    passed:
+      validateMergeConvergence({
+        filePath: LESSONS_FILE,
+        originalContent: '## a: 1\n\n## b: 2\n',
+        newContent: '## a: 1\n\n## b: 2\n\n## c: 3\n',
+        merge: true,
+      }) !== null &&
+      validateMergeConvergence({
+        filePath: LESSONS_FILE,
+        originalContent: '## a: 1\n\n## b: 2\n',
+        newContent: '## ab: merged\n',
+        merge: true,
+      }) === null &&
+      validateMergeConvergence({
+        filePath: LESSONS_FILE,
+        originalContent: '## a: 1\n',
+        newContent: '## a: 1\n\n## b: 2\n',
+        merge: false,
+      }) === null,
+    anchor: true,
+  })
+
   // ── 自报分数只作诊断：评分路径无 LLM，分数来自 ground-truth 契约而非模型自报 ──
   // anchor 锁死「评分组件不暴露 LLM 的 chat 能力」。4 个组件（ruleEngine/constitution/
   // errorDB/preflight）都是确定性组件（runEval 同步评分）。若未来有人把 LLM 注入评分
@@ -347,11 +418,13 @@ export function runEval(): EvalReport {
     id: 'self-report-diagnostic',
     description: '评分无 LLM：机制哨兵组件不暴露 chat 能力（分数只来自 ground-truth，非模型自报）',
     passed: !llmInjected,
+    anchor: true,
   })
 
-  // 角色标注：anchor 走集中清单（门保护面单一真源），target 已在上方循环内联。
+  // 角色标注：anchor 由契约**定义处内联的标记**派生（真源），
+  // ANCHOR_CONTRACT_IDS 退为独立声明 —— 两者由 anchor-contract-wiring 守卫两向比对。
   for (const r of results) {
-    if (ANCHOR_CONTRACT_IDS.has(r.id)) r.role = 'anchor'
+    if (r.anchor) r.role = 'anchor'
   }
 
   // anchor 自检（ground truth：所有 anchor 契约必须全绿，否则门拒）。

package/src/core/hooks-executor.ts

@@ -106,20 +106,48 @@ export function parseHookStdout(stdout: string | null | undefined, _ctx: HookCon
   return { allowed: true }
 }
 
-function executeCommand(cfg: HookConfig, ctx: HookContext): HookResult {
+async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
   if (!cfg.command) return { allowed: true }
 
   try {
     const args = cfg.args ? cfg.args.map((a) => substituteVars(a, ctx)) : []
 
+    // A hook command is a child of this process, so a bare `spawnSync` would hand
+    // it the whole environment — every provider key and bot secret included. Bash
+    // has been masking these since E1; hooks were the remaining door, so they use
+    // the same policy. Resolved at **user level** — the same choice E1 made for
+    // every spawn it could not scope to one session's project section
+    // (`tools/index.ts:45-48`). Scoping it to `ctx.cwd` now that this file has one
+    // would be a masking-policy change, not a plumbing fix, so it is not made here.
+    const { loadUserCredentialMaskingConfig } = await import('../config/loader')
+    const { filterEnv } = await import('./credential-masker')
+    const masking = loadUserCredentialMaskingConfig()
+    const env =
+      masking.enabled && masking.env_filter.enabled
+        ? filterEnv(process.env as Record<string, string | undefined>, masking)
+        : undefined
+
+    // Which workspace the hook is *for* is the session's business, not this
+    // process's — the daemon runs many sessions and its own cwd belongs to none of
+    // them. `HookEngine` stamps `ctx.cwd`; the fallback covers a context built by
+    // hand, and is exactly right for the one-shot CLI.
+    const cwd = ctx.cwd ?? process.cwd()
+
     // Use spawnSync with array args — no shell, no command injection.
     // Pass the Claude-protocol stdin JSON so scripts can read structured context.
-    const input = JSON.stringify(buildHookStdin(ctx, process.cwd()))
+    const input = JSON.stringify(buildHookStdin(ctx, cwd))
     const result = spawnSync(cfg.command, args, {
       timeout: (cfg.timeout ?? 60) * 1000,
       encoding: 'utf-8',
       stdio: ['pipe', 'pipe', 'pipe'],
       input,
+      // Both halves of "where is this hook": the directory it runs in, and the
+      // `cwd` it reads off stdin. Fixing only one leaves the hook told it is
+      // somewhere it is not.
+      cwd,
+      // `undefined` = inherit, which is what node does by default; passing it
+      // explicitly keeps the two branches visible at one site.
+      env,
     })
 
     // Exit code 0 = success — parse the stdout JSON for structured decisions.

package/src/core/hooks.ts

@@ -48,6 +48,18 @@ export class HookEngine {
   /** Health tracking per hook key (event[:toolName]) */
   private health = new Map<string, HookHealth>()
 
+  /**
+   * The workspace this engine's hooks run *for*.
+   *
+   * Settled at construction because one engine belongs to one session, not to one
+   * hook. The default is exactly right for the one-shot CLI, whose process cwd
+   * *is* the session cwd — but the daemon serves many sessions from one process,
+   * so it must pass the session's cwd. Left to the executor's own
+   * `process.cwd()`, every daemon hook would run in — and be told it is in — the
+   * directory the daemon happened to be started from.
+   */
+  constructor(private readonly cwd: string = process.cwd()) {}
+
   register(hook: HookDefinition): void {
     this.hooks.push(hook)
   }
@@ -98,7 +110,12 @@ export class HookEngine {
 
   async executeStop(sessionId: string): Promise<HookResult> {
     const ctx: HookContext = { event: 'Stop', sessionId }
-    return this.runHooks('Stop', undefined, ctx)
+    const result = await this.runHooks('Stop', undefined, ctx)
+
+    // A blocking Stop hook arrives as a deny (exit code 2, `decision: block`, or
+    // `continue: false`), but the engine's Stop path reads `decision`. Derive it
+    // here rather than at each producer so every form reaches "do not stop yet".
+    return result.allowed ? result : { ...result, decision: 'block' }
   }
 
   async executeUserPromptSubmit(prompt: string, sessionId: string): Promise<HookResult> {
@@ -134,9 +151,12 @@ export class HookEngine {
     const ctx: HookContext = {
       event: 'SubagentStart',
       sessionId,
+      // The agent type plays the role a tool name plays for PreToolUse: it is
+      // what a settings.json `matcher` selects on.
+      toolName: agentType,
       toolInput: { agentType, description },
     }
-    return this.runHooks('SubagentStart', undefined, ctx)
+    return this.runHooks('SubagentStart', agentType, ctx)
   }
 
   async executeSubagentStop(
@@ -149,10 +169,12 @@ export class HookEngine {
     const ctx: HookContext = {
       event: 'SubagentStop',
       sessionId,
+      // Matcher target — see executeSubagentStart.
+      toolName: agentType,
       toolInput: { agentType, description, success },
       toolResult: result ? { success, content: result.slice(0, 2000) } : undefined,
     }
-    return this.runHooks('SubagentStop', undefined, ctx)
+    return this.runHooks('SubagentStop', agentType, ctx)
   }
 
   async executePostToolUseFailure(
@@ -268,15 +290,40 @@ export class HookEngine {
 
   // ── Core execution ──
 
+  /**
+   * Does a hook's `matcher` select this invocation?
+   *
+   * No matcher means every invocation of the event. Otherwise the stored matcher
+   * is a regex — `loadHookConfigs` compiles it as one — tested against the name
+   * this event filters on: the tool name for tool events, the agent type for the
+   * subagent events. Events that carry no such name (Stop, SessionStart, …) are
+   * not filtered here.
+   */
+  private matchesMatcher(matcher: string | undefined, name: string | undefined): boolean {
+    if (!matcher || !name) return true
+    try {
+      return new RegExp(matcher).test(name)
+    } catch {
+      // An uncompilable pattern cannot get this far through loadHookConfigs,
+      // which compiles every matcher when it loads. Keep such a hook running
+      // rather than dropping it silently.
+      return true
+    }
+  }
+
   private async runHooks(
     event: HookEvent,
     toolName: string | undefined,
     ctx: HookContext,
   ): Promise<HookResult> {
     const matching = this.hooks.filter(
-      (h) => h.event === event && (!toolName || !h.toolName || h.toolName === toolName),
+      (h) => h.event === event && this.matchesMatcher(h.toolName, toolName),
     )
 
+    // Stamped here rather than at each `executeX`: the cwd is a property of the
+    // engine, and every context this engine hands out needs it.
+    ctx.cwd = this.cwd
+
     const result: HookResult = { allowed: true }
 
     for (const hook of matching) {

package/src/core/improvement-track.ts

@@ -22,6 +22,10 @@ export interface ImprovementReport {
   noise: number
   minEffect: number
   verdict: ImprovementVerdict
+  /** ε：提交者事前写下的预期提升点数。缺席 = 该记录没有预登记。 */
+  predictedDelta?: number
+  /** 预测是否命中。与 predictedDelta 同时出现、同时缺席（JSON 序列化会丢掉 undefined 键）。 */
+  predictionHit?: boolean
 }
 
 export interface ImprovementRecord extends ImprovementReport {
@@ -55,6 +59,7 @@ function stdDev(xs: number[]): number {
 export function buildImprovementReport(
   sample: SkillDeltaSample,
   changeSet: string[],
+  predicted?: number,
 ): ImprovementReport {
   const deltaMean = mean(sample.postScores) - mean(sample.baselineScores)
   const noise = stdDev(sample.baselineScores)
@@ -70,6 +75,14 @@ export function buildImprovementReport(
     noise,
     minEffect,
     verdict,
+    // 两个字段同生同灭：缺席预测必须**键不存在**，而不是 predictionHit: false。
+    // 理由**不是**「predictionHit: false 会被算进分母」—— 分母只认 `predictedDelta !== undefined`
+    //（只写 `predictionHit: false` 而不写 `predictedDelta` 会被整条忽略）。真正的风险是**反过来的半条**：
+    // 有 `predictedDelta` 而无 `predictionHit` ⇒ 该条进了分母，却永远不可能被算成命中
+    //（分子只认 `predictionHit === true`），等于一条静默的「未命中」。
+    ...(predicted !== undefined
+      ? { predictedDelta: predicted, predictionHit: predictionHit(predicted, deltaMean) }
+      : {}),
   }
 }
 
@@ -107,6 +120,34 @@ export function improvementSignalStrong(records: ImprovementRecord[]): boolean {
   return records.length > 0 && lo > FALSE_POSITIVE_BASELINE
 }
 
+/**
+ * 预测命中：事前写下的点数被实际达到。缺席预测（undefined）不计入。
+ *
+ * 刻意**不叠加 `minEffect`** —— ε 是提交者自己写下的数，判据就是「达到没达到」；
+ * 再套一层统计阈值会让两个数打架，且使「命中」不可复算。
+ */
+export function predictionHit(predicted: number | undefined, deltaMean: number): boolean {
+  return predicted !== undefined && deltaMean >= predicted
+}
+
+/**
+ * ε 命中率。分母 = **有预测的记录数**（判据取 `predictedDelta !== undefined`），
+ * 复用既有 wilsonInterval。无预测的记录既不入分子也不入分母。
+ */
+export function predictionHitRate(records: ImprovementRecord[]): {
+  total: number
+  hits: number
+  rate: number
+  lo: number
+  hi: number
+} {
+  const judged = records.filter((r) => r.predictedDelta !== undefined)
+  const total = judged.length
+  const hits = judged.filter((r) => r.predictionHit === true).length
+  const { lo, hi } = wilsonInterval(hits, total)
+  return { total, hits, rate: total === 0 ? 0 : hits / total, lo, hi }
+}
+
 // ── 台账 ──
 
 export function improvementPath(): string {

package/src/core/paths.ts

@@ -7,8 +7,9 @@
  * 突然失去隔离保护（隔离度只许增不许减）。
  */
 
+import { realpathSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { basename, dirname, join } from 'node:path'
 import { MIPHAM_DIR } from '../shared/constants.ts'
 
 /** 只读兼容目录名。 */
@@ -33,6 +34,48 @@ export function worktreeRoots(cwd: string): string[] {
   return [worktreeRoot(cwd), join(cwd, LEGACY_CLAUDE_DIR, 'worktrees')]
 }
 
+/**
+ * 规范化 worktree 路径，两侧都过一遍才谈得上比较。
+ *
+ * 叶子不存在是常态（工作树已被删、或路径是模型编出来的），此时 `realpathSync`
+ * 会抛 —— 那就只规范父目录、最后一段按原样留着，否则「叶子没了」会被误读成
+ * 「拼法不同」（明明同一个路径，却因为 P 的拼法与 git 打印的不同而判成不在）。
+ */
+function canonicalWorktreePath(path: string): string {
+  const trimmed = path.endsWith('/') && path !== '/' ? path.slice(0, -1) : path
+  try {
+    return realpathSync(trimmed)
+  } catch {
+    try {
+      return join(realpathSync(dirname(trimmed)), basename(trimmed))
+    } catch {
+      return trimmed
+    }
+  }
+}
+
+/**
+ * `git worktree list --porcelain` 里是否**确实**列出了 `target` 这个工作树。
+ *
+ * 不能用 `output.includes(target)`：那是子串判定，本机实测（真 git，建出 `w1`
+ * 与 `w10`）它错在三个方向 ——
+ *   - `.../w1` 命中 **`.../w10` 那一行**（前缀当成同一个）⇒ 不存在被判成存在。
+ *     EnterWorktree 那侧因此连 `w1` 都建不出来：明明没有，它报 already exists；
+ *   - 带尾斜杠的 `.../w1/` 一行都不命中 ⇒ 存在被判成 not found；
+ *   - git 打印 **realpath 拼法**（`mktemp -d /tmp/x` 建的在 porcelain 里是
+ *     `/private/tmp/x/...`）⇒ 别名拼法一头都命中不了，而 EnterWorktree 的成功
+ *     文案里印的正是它自己算出来的那个拼法，模型照抄回来必然吃 not found。
+ *
+ * 判据是**相等**（名字比对），不是包含 —— 工作树列表里列的就是工作树根。
+ */
+export function listsWorktree(output: string, target: string): boolean {
+  const want = canonicalWorktreePath(target)
+  return output
+    .split('\n')
+    .filter((line) => line.startsWith('worktree '))
+    .some((line) => canonicalWorktreePath(line.slice('worktree '.length).trim()) === want)
+}
+
 /**
  * 在 `cwd` 中定位 worktree 标记，返回项目根与命中的标记。
  * 不在任何 worktree 内时返回 null。