@miphamai/cli 0.85.0 → 0.85.2

package/src/config/preferences.ts

@@ -5,16 +5,19 @@
  * NOT for config.yml settings — those belong in the YAML config system.
  * NOT for secrets — this file is plain JSON, not encrypted.
  */
-import { readFileSync, existsSync, mkdirSync } from 'node:fs'
+import { existsSync, mkdirSync } from 'node:fs'
 import { atomicWriteFileSync } from '../shared/atomic-write'
+import { readRegularFileSync } from '../shared/regular-file'
 import { miphamHome } from '../core/paths.ts'
 
 const PREFS_PATH = miphamHome('preferences.json')
 
 function readPrefs(): Record<string, string> {
   try {
-    if (!existsSync(PREFS_PATH)) return {}
-    const raw = readFileSync(PREFS_PATH, 'utf-8')
+    // 类型闸在读取之前 —— FIFO 上的 `readFileSync` 会一直等写者（见
+    // shared/regular-file.ts）。
+    const raw = readRegularFileSync(PREFS_PATH)
+    if (raw === null) return {}
     const parsed: unknown = JSON.parse(raw)
     if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return {}
     return parsed as Record<string, string>

package/src/core/constitution-loader.ts

@@ -13,7 +13,8 @@
  * Format: YAML with schema validation
  */
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs'
+import { readFileSync, mkdirSync, existsSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { miphamHome } from './paths.ts'
 import alignmentVocabulary from './alignment-vocabulary.json' with { type: 'json' }
 
@@ -103,7 +104,7 @@ export class ConstitutionLoader {
     try {
       const dir = miphamHome()
       if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
-      writeFileSync(this.path, this.serializeToYaml(DEFAULT_CONSTITUTION), 'utf-8')
+      atomicWriteFileSync(this.path, this.serializeToYaml(DEFAULT_CONSTITUTION), { mode: 0o644 })
     } catch {
       // Best-effort — default constitution works in-memory
     }

package/src/core/crsi-producer.ts

@@ -13,8 +13,9 @@
 import type { CrsiInsight } from './auto-memory'
 import type { MetaRule } from './meta-rule-engine'
 import type { Llm } from '../providers/llm'
-import { readdirSync, appendFileSync, readFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'
+import { readdirSync, readFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
+import { appendRegularFileSync } from '../shared/regular-file'
 import { miphamHome } from './paths.ts'
 
 /** 教训文件（相对仓库根）。预建，沙箱只能改已存在文件。 */
@@ -538,7 +539,8 @@ export function hasProposedProse(id: string): boolean {
 export function appendProseProposal(record: ProseProposalRecord): void {
   try {
     mkdirSync(miphamHome('crsi'), { recursive: true })
-    appendFileSync(proseLedgerFile(), JSON.stringify(record) + '\n', 'utf-8')
+    // FIFO 路径上「写不进去」与下面的 catch 同级：ledger 非关键，但**不挂**。
+    appendRegularFileSync(proseLedgerFile(), JSON.stringify(record) + '\n')
   } catch {
     // ledger 非关键，失败不影响提议本身
   }

package/src/core/crsi-sandbox.ts

@@ -16,6 +16,7 @@
 
 import { execSync } from 'node:child_process'
 import { mkdirSync, rmSync, existsSync, writeFileSync, readFileSync, readdirSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join, resolve, sep, posix } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
@@ -642,7 +643,7 @@ export class CrsiSandbox {
     // Persist to ~/.mipham/crsi-sandbox/
     const reportPath = join(REPORT_DIR, `${this.sessionReport.sessionId}.json`)
     try {
-      writeFileSync(reportPath, JSON.stringify(this.sessionReport, null, 2), 'utf-8')
+      atomicWriteFileSync(reportPath, JSON.stringify(this.sessionReport, null, 2), { mode: 0o644 })
     } catch {
       // Best-effort persistence
     }

package/src/core/dream-engine.ts

@@ -25,15 +25,8 @@
  *     → Write consolidated memory + generate DreamReport
  */
 
-import {
-  readdirSync,
-  readFileSync,
-  writeFileSync,
-  unlinkSync,
-  existsSync,
-  mkdirSync,
-  statSync,
-} from 'node:fs'
+import { readdirSync, readFileSync, unlinkSync, existsSync, mkdirSync, statSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join } from 'node:path'
 import { miphamHome } from './paths.ts'
 
@@ -320,7 +313,8 @@ export class DreamEngine {
         try {
           const links = secondary.map((s) => `- See also: [[${s.name}]]`).join('\n')
           const updated = primary.content + `\n\n## Related\n${links}`
-          writeFileSync(primary.path, updated, 'utf-8')
+          // 记忆正文：与 memory-manager 同权限语义（用户可读可编辑的内容）。
+          atomicWriteFileSync(primary.path, updated, { mode: 0o644 })
 
           for (const s of secondary) {
             try {
@@ -532,7 +526,7 @@ export class DreamEngine {
       log.unshift({ timestamp, actions })
       // Keep last 10 dream cycles
       if (log.length > 10) log = log.slice(0, 10)
-      writeFileSync(this.dreamLog, JSON.stringify(log, null, 2), 'utf-8')
+      atomicWriteFileSync(this.dreamLog, JSON.stringify(log, null, 2), { mode: 0o644 })
     } catch {
       // Best-effort persistence
     }

package/src/core/engine.ts

@@ -488,10 +488,15 @@ export class QueryEngine {
       try {
         for await (const chunk of this.llmChat({
           model: this.registry.getActiveModel(),
-          messages: [
-            { role: 'system', content: summaryPrompt },
-            { role: 'user', content: text },
-          ],
+          // The instruction goes in `systemPrompt`, **not** as a `system` message
+          // in the array. A system *entry* is a header, and the providers do not
+          // agree on one that arrives inside `messages`: anthropic drops every
+          // system entry (its protocol wants the top-level param, anthropic.ts),
+          // so the array form reached the OpenAI-compatible providers and no one
+          // else — the summarizer's instruction was missing for anthropic users
+          // while it worked here. `systemPrompt` is the one spelling both read.
+          systemPrompt: summaryPrompt,
+          messages: [{ role: 'user', content: text }],
           maxTokens: 2000,
         })) {
           if (chunk.type === 'text' && chunk.content) {

package/src/core/error-signature-db.ts

@@ -14,7 +14,8 @@
  *   PreFlightChecker.check() → ErrorSignatureDB.match()
  */
 
-import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { mkdirSync, readFileSync, existsSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import { miphamHome } from './paths.ts'
@@ -101,7 +102,7 @@ export class ErrorSignatureDB {
     try {
       mkdirSync(join(this.storePath, '..'), { recursive: true })
       const arr = Array.from(this.signatures.values())
-      writeFileSync(this.storePath, JSON.stringify(arr, null, 2), 'utf-8')
+      atomicWriteFileSync(this.storePath, JSON.stringify(arr, null, 2), { mode: 0o644 })
       this.dirty = false
     } catch {
       // Best-effort persistence — never crash on write failure

package/src/core/eval-harness.ts

@@ -13,7 +13,8 @@
 
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { mkdirSync, appendFileSync, readFileSync, existsSync } from 'node:fs'
+import { mkdirSync, readFileSync, existsSync } from 'node:fs'
+import { appendRegularFileSync } from '../shared/regular-file'
 import { ExperienceRuleEngine } from './rule-engine'
 import { ConstitutionLoader, DEFAULT_CONSTITUTION } from './constitution-loader'
 import { ErrorSignatureDB } from './error-signature-db'
@@ -119,7 +120,7 @@ export function appendEvalScore(
 ): void {
   try {
     mkdirSync(miphamHome('crsi'), { recursive: true })
-    appendFileSync(
+    appendRegularFileSync(
       SCORES_FILE,
       JSON.stringify({
         name,
@@ -131,7 +132,6 @@ export function appendEvalScore(
         // 读取侧跳过 —— 这是向后兼容的承重判据，别改成 `results: []`。
         ...(report.results ? { results: report.results.map(toContractResultRecord) } : {}),
       }) + '\n',
-      'utf-8',
     )
   } catch {
     // rewards 日志是非关键的——失败不影响评估本身

package/src/core/hooks-executor.ts

@@ -106,6 +106,55 @@ export function parseHookStdout(stdout: string | null | undefined, _ctx: HookCon
   return { allowed: true }
 }
 
+/**
+ * Why the hook subprocess failed to run to completion, or `null` if it did exit.
+ *
+ * `spawnSync` does **not** throw for a failed spawn or a timeout — it reports them
+ * on the result, and all three shapes arrive with **empty stderr**: `error.code`
+ * is `ETIMEDOUT` for the timeout, `ENOENT` when the command does not exist, and an
+ * externally killed child comes back as `status: null` + `signal` with no `error`
+ * at all. Empty stderr is what made them one string with a benign non-zero exit
+ * that printed nothing — `Hook warning (<cmd>): ` with the reason left blank.
+ *
+ * A fourth shape is **not** a failure of the run at all: `EPIPE` on the write that
+ * hands the child its stdin payload, which is what happens whenever the child
+ * exits without reading it (measured: `status` survives — `exit 0` → 0, `exit 3`
+ * → 3 — and `signal` stays null). Hook commands routinely ignore stdin, and whether
+ * that write loses its race is a property of the scheduler, not of the hook: it
+ * never occurred on the dev machine and reddened CI on a faster one. Read as the
+ * cause, it **replaced** the child's real result — `Hook warning (<cmd>): boom`
+ * and `killed by SIGTERM` both came back as `Hook error (<cmd>): EPIPE`. So EPIPE
+ * is exempt from the two decisions below, and speaks only when nothing else can.
+ *
+ * Named here rather than in the caller's `catch`, which cannot see any of them:
+ * it runs only when `spawnSync` itself throws.
+ */
+function spawnFailureCause(
+  result: { status?: number | null; signal?: string | null; error?: unknown },
+  timeoutSeconds: number,
+): string | null {
+  const err = result.error as { code?: string; message?: string } | undefined
+  const hasExit = typeof result.status === 'number'
+  const writeFailed = err?.code === 'EPIPE'
+
+  if (err && !writeFailed) {
+    if (err.code === 'ETIMEDOUT') return `timed out after ${timeoutSeconds}s`
+    return err.message
+      ? `${err.code ?? 'spawn failed'}: ${err.message}`
+      : (err.code ?? 'spawn failed')
+  }
+
+  if (result.signal && !hasExit) {
+    return `killed by ${result.signal}`
+  }
+
+  // No branch for "EPIPE and nothing else": a failed write presupposes a child that
+  // was spawned and reaped, so `status` or `signal` is always present alongside it
+  // (`exit 0`/`exit 3` → 0/3, `kill -TERM $$` → SIGTERM). Unreachable error
+  // handling is what the exemption above is meant to avoid, not to add.
+  return null
+}
+
 async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
   if (!cfg.command) return { allowed: true }
 
@@ -167,16 +216,25 @@ async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookRe
       }
     }
 
+    const failure = spawnFailureCause(result, cfg.timeout ?? 60)
+    if (failure) {
+      return {
+        allowed: true,
+        additionalContext: `Hook error (${cfg.command}): ${failure}`,
+      }
+    }
+
     // Other non-zero exit: don't block, log the error as context
     return {
       allowed: true,
       additionalContext: `Hook warning (${cfg.command}): ${stderr.trim()}`,
     }
   } catch (err) {
-    // spawnSync errors (e.g., command not found, timeout, signal)
+    // Only reached when `spawnSync` itself throws — masking-policy load, env
+    // filter, or an option it rejects outright. Its comment used to name timeouts
+    // and missing commands, neither of which can arrive here.
     const message = (err as { message?: string }).message || String(err)
 
-    // Timeout/signal: treat as non-blocking warning
     return {
       allowed: true,
       additionalContext: `Hook error (${cfg.command}): ${message}`,

package/src/core/memory/memory-manager.ts

@@ -2,13 +2,13 @@ import {
   mkdirSync,
   readdirSync,
   readFileSync,
-  writeFileSync,
   unlinkSync,
   renameSync,
   existsSync,
   statSync,
 } from 'node:fs'
 import { join, extname, basename } from 'node:path'
+import { atomicWriteFileSync } from '../../shared/atomic-write'
 import { similarities, findNearDuplicates } from './tfidf'
 
 export interface MemoryMetadata {
@@ -135,7 +135,9 @@ export class MemoryManager {
     const filePath = join(this.memoryDir, fileName)
     const formattedBody = this.formatMemoryBody(metadata, content)
     const body = this.formatMemoryFile(name, metadata, content)
-    writeFileSync(filePath, body, 'utf-8')
+    // 原子写：从前是裸 writeFileSync，写到一半被杀留下的半截 JSON 会被读侧的 catch 当成
+    // 「文件损坏」清空 —— 一次崩溃赔上全部记忆/规则/统计，不是丢一条。
+    atomicWriteFileSync(filePath, body, { mode: 0o644 })
 
     const entry: MemoryEntry = {
       name,
@@ -158,7 +160,9 @@ export class MemoryManager {
     entry.description = metadata.relevance.join(', ')
     entry.updatedAt = new Date()
     const body = this.formatMemoryFile(entry.name, metadata, content)
-    writeFileSync(entry.filePath, body, 'utf-8')
+    // 原子写：从前是裸 writeFileSync，写到一半被杀留下的半截 JSON 会被读侧的 catch 当成
+    // 「文件损坏」清空 —— 一次崩溃赔上全部记忆/规则/统计，不是丢一条。
+    atomicWriteFileSync(entry.filePath, body, { mode: 0o644 })
     this.updateWikilinks(entry.name, content)
     this.updateIndex()
   }
@@ -465,7 +469,7 @@ export class MemoryManager {
       lines.push(`- [${entry.name}](${entry.name}.md) — ${entry.description}`)
     }
 
-    writeFileSync(join(this.memoryDir, INDEX_FILE), lines.join('\n') + '\n', 'utf-8')
+    atomicWriteFileSync(join(this.memoryDir, INDEX_FILE), lines.join('\n') + '\n', { mode: 0o644 })
   }
 
   private extractWikilinks(content: string): string[] {
@@ -532,7 +536,7 @@ export class MemoryManager {
       obj[k] = Array.from(v)
     }
     try {
-      writeFileSync(join(this.memoryDir, LINKS_FILE), JSON.stringify(obj, null, 2), 'utf-8')
+      atomicWriteFileSync(join(this.memoryDir, LINKS_FILE), JSON.stringify(obj, null, 2))
     } catch {
       // best-effort — never block on cache write
     }
@@ -573,7 +577,7 @@ export class MemoryManager {
     const obj: Record<string, { recallCount: number; lastRecalledAt: string }> = {}
     for (const [k, v] of this.recallStats) obj[k] = v
     try {
-      writeFileSync(join(this.memoryDir, RECALL_STATS_FILE), JSON.stringify(obj, null, 2), 'utf-8')
+      atomicWriteFileSync(join(this.memoryDir, RECALL_STATS_FILE), JSON.stringify(obj, null, 2))
     } catch {
       // best-effort — never block on stats write
     }

package/src/core/permission-audit.ts

@@ -31,10 +31,11 @@
  * 「分类器裁过什么」，不是「某条命令跑了几次」；执行次数要问 gate 侧的指标或会话日志。
  */
 
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { dirname } from 'node:path'
 import type { PermissionLevel, PermissionMode } from '../shared/index.ts'
 import type { PermissionDenialReason } from './permission'
+import { appendRegularFileSync } from '../shared/regular-file'
 import { miphamHome } from './paths.ts'
 
 /** 一条分类器裁决。 */
@@ -85,11 +86,17 @@ export function recordClassifierRuling(record: Omit<ClassifierRulingRecord, 'at'
   try {
     const file = permissionAuditPath()
     mkdirSync(dirname(file), { recursive: true, mode: 0o700 })
-    appendFileSync(file, JSON.stringify({ at: new Date().toISOString(), ...record }) + '\n', {
-      encoding: 'utf-8',
-      // 只在创建时生效；已存在的文件不会被改权限。
-      mode: 0o600,
-    })
+    // 台账路径上是个 FIFO 时**不写**也**不挂**（`appendFileSync` 会打开它写 ⇒ 等到有
+    // 读者为止）：当成一次写失败，走下面那条「第一次说一句」的路。
+    if (
+      !appendRegularFileSync(
+        file,
+        JSON.stringify({ at: new Date().toISOString(), ...record }) + '\n',
+        { mode: 0o600 },
+      )
+    ) {
+      throw new Error(`${file} is not a regular file`)
+    }
   } catch (err) {
     if (!warnedOnce) {
       warnedOnce = true

package/src/core/permission-rules.ts

@@ -1,7 +1,8 @@
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { isAbsolute, join, normalize } from 'node:path'
+import { realpathSync } from 'node:fs'
 import type { PermissionRuleEntry } from '../shared/index.ts'
-import { matchPath } from './credential-masker/matcher'
+import { expandHome, matchPath } from './credential-masker/matcher'
 
 // ── Bash command analysis (Read/Write/Edit deny-rule extension) ──
 //
@@ -543,6 +544,99 @@ function scanReaderWriterCommands(
  */
 const PARAMETERISED_TOOLS = new Set(['Bash', 'Read', 'Write', 'Edit', 'Grep', 'Glob'])
 
+/**
+ * The **landing** spelling of a path *or a pattern*: the realpath of its
+ * longest **existing** prefix, with everything after that prefix kept verbatim.
+ * Returns the input unchanged when nothing along it exists.
+ *
+ * A prefix walk rather than a bare `realpathSync`, for two reasons:
+ *
+ * - A rule may legitimately name a leaf that does not exist yet
+ *   (`Write(/tmp/new.txt)`) — `realpathSync` on it throws, so a leaf-only
+ *   resolve would decide that a path the tool is about to create has no
+ *   landing at all.
+ * - macOS resolves `/tmp` → `/private/tmp` (likewise `/etc`, `/var`), so a
+ *   pattern has to be resolved **the same way as the path** or `/tmp/**` stops
+ *   matching its own files. Resolving only one side is what turns a tightening
+ *   into a silent refusal.
+ *
+ * A prefix whose segments carry a glob metacharacter is not a path on disk
+ * (`/tmp/*` denotes "whatever is under /tmp"), so the walk steps over it: the
+ * glob-free prefix gets resolved and `*` / `**` / `?` survive verbatim.
+ */
+function resolveLanding(p: string): string {
+  const parts = expandHome(p).replace(/\\/g, '/').split('/')
+  for (let i = parts.length; i > 0; i--) {
+    const prefix = parts.slice(0, i).join('/')
+    if (!prefix || /[*?]/.test(prefix)) continue
+    try {
+      const real = realpathSync(prefix)
+      const rest = parts.slice(i).join('/')
+      return rest ? `${real}/${rest}` : real
+    } catch {
+      // Not on disk — try its parent.
+    }
+  }
+  return p
+}
+
+/**
+ * Where `p` would read if nothing along it were a symlink — the same string
+ * spelled without touching the disk. Used only to ask "did resolving this path
+ * change anything", never as a match candidate.
+ */
+function lexicallySpelled(p: string): string {
+  const expanded = expandHome(p).replace(/\\/g, '/')
+  if (isAbsolute(expanded) || /^[A-Za-z]:\//.test(expanded)) return normalize(expanded)
+  return normalize(join(process.cwd(), expanded))
+}
+
+/**
+ * Match a path rule against the path an operation *lands* on, not just the one
+ * it was spelled with. `notes.txt` symlinked to `.env` **is** a read of `.env`,
+ * and the rule only ever sees the spelling the model sent.
+ *
+ * Deny/ask (`segmentMode === 'any'`): a miss is a hole, and the resolved form
+ * can only *add* matches — this direction is strictly fail-closed, and cannot
+ * un-protect anything protected today.
+ *
+ * Allow (`'all'`) is the direction where a grant can leak, so the landing has to
+ * be inside the same grant: an allow rule granting every `.txt` file no longer
+ * auto-approves a `.txt` symlink that lands on `.env`. The extra judgement is
+ * gated on the path actually having been redirected — if resolving it changes
+ * nothing, there is no second spelling to disagree about and the decision is
+ * identical to the literal one. Patterns are resolved on the same axes as paths
+ * precisely so that gate does not misfire on `/tmp/**`, on a pattern naming a
+ * symlink on purpose, or on a leaf that does not exist yet.
+ */
+function matchPathRule(path: string, pattern: string, segmentMode: 'any' | 'all'): boolean {
+  const literal = matchPath(path, pattern)
+  const landing = resolveLanding(path)
+  // The pattern canonicalised on the same axes as the path (`/tmp/**` →
+  // `/private/tmp/**`). `expandHome` first: `matchPath` expands the pattern but
+  // never the path, so a `~` pattern has to be absolute before it is resolved.
+  const canon = resolveLanding(expandHome(pattern))
+
+  if (segmentMode === 'all') {
+    if (!literal) return false
+    if (landing === lexicallySpelled(path)) return true
+    return matchPath(landing, canon)
+  }
+
+  if (literal) return true
+  if (matchPath(landing, canon)) return true
+  try {
+    // The pre-existing check, kept verbatim so this direction stays a
+    // mechanical superset of what it used to match (it differs only for a path
+    // whose own name contains a glob character).
+    return matchPath(realpathSync(path), expandHome(pattern))
+  } catch {
+    // Nothing on disk to resolve (ENOENT, EACCES, a path the model invented) —
+    // there is no second spelling to try, and the literal already missed.
+    return false
+  }
+}
+
 // Match a tool(parameter) rule against an actual tool call.
 //
 // Pattern formats:
@@ -590,7 +684,7 @@ export function matchBashRule(
     const cmd = String(toolInput.command || '')
     const access = extractBashFileAccess(cmd)
     const paths = baseTool === 'Read' ? access.read : access.write
-    return qualifies(paths, (p) => matchPath(p, subPattern!))
+    return qualifies(paths, (p) => matchPathRule(p, subPattern!, segmentMode))
   }
 
   if (toolName !== baseTool!) return false
@@ -609,13 +703,13 @@ export function matchBashRule(
   // paths — `*` would cross `/` and Windows drive letters like `C:\` get mangled.
   if (baseTool === 'Write' || baseTool === 'Edit' || baseTool === 'Read') {
     const path = String(toolInput.file_path || '')
-    return matchPath(path, subPattern!)
+    return matchPathRule(path, subPattern!, segmentMode)
   }
 
   // For Grep/Glob: match against the base search path (a directory)
   if (baseTool === 'Grep' || baseTool === 'Glob') {
     const path = String(toolInput.path || '')
-    return matchPath(path, subPattern!)
+    return matchPathRule(path, subPattern!, segmentMode)
   }
 
   return false

package/src/core/permission.ts

@@ -205,7 +205,12 @@ export class PermissionSystem {
 
   // ── P1-4: Consecutive block counter (prevents infinite retry loops) ──
   private consecutiveBlockCount = 0
-  private static readonly MAX_CONSECUTIVE_BLOCKS = 3
+  /**
+   * Shared by both tool loops — `Engine.executeTool` and the sub-agent's own
+   * turn loop (which bypasses the engine and reimplements the permission step).
+   * Public so the second reader cannot drift to its own number.
+   */
+  static readonly MAX_CONSECUTIVE_BLOCKS = 3
 
   /** Invalidate the permission cache (called on any rule/mode change). */
   private invalidateCache(): void {

package/src/core/rule-engine.ts

@@ -1,5 +1,6 @@
 import type { ExperienceRule } from '../agent/experience-rules.js'
-import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs'
+import { mkdirSync, readFileSync, existsSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join, dirname } from 'node:path'
 import { MANAGED_RULES } from './crsi-managed-rules'
 import { miphamHome } from './paths.ts'
@@ -160,7 +161,7 @@ export class ExperienceRuleEngine {
     const nonBuiltin = this.rules.filter((r) => r.source !== 'builtin' && r.source !== 'managed')
     const dir = dirname(this.storePath)
     mkdirSync(dir, { recursive: true })
-    writeFileSync(this.storePath, JSON.stringify(nonBuiltin, null, 2), 'utf-8')
+    atomicWriteFileSync(this.storePath, JSON.stringify(nonBuiltin, null, 2), { mode: 0o644 })
   }
 
   /** Load persisted runtime rules from disk. Rejects rules whose IDs conflict with builtin/managed. */

package/src/core/session-log.ts

@@ -1,8 +1,9 @@
-import { appendFileSync, readFileSync, mkdirSync, existsSync } from 'node:fs'
+import { mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { createHash } from 'node:crypto'
 import type { Message, ToolUseContent, ToolResultContent, ToolResult } from '../shared/types'
 import type { CheckerDecision } from './post-flight-checker'
+import { appendRegularFileSync, readRegularFileSync } from '../shared/regular-file'
 import { miphamHome } from './paths.ts'
 
 export type SessionEvent =
@@ -117,6 +118,9 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
 
 const LOG_DIR = miphamHome('sessions')
 
+/** 一次性告警：日志路径不是普通文件（写不进去），每个进程只说一句。 */
+let warnedNotAppendable = false
+
 /** 将会话名消毒为安全文件名（与 SessionStore 共用；防路径穿越）。 */
 export function sanitizeSessionName(name: string): string {
   const safe = name.replace(/[^a-zA-Z0-9_-]/g, '_')
@@ -147,22 +151,34 @@ export class SessionLog {
     // Session logs contain full conversation + tool results (possibly credentials):
     // restrict to owner-only (dir 0700, file 0600).
     mkdirSync(LOG_DIR, { recursive: true, mode: 0o700 })
+    const path = join(LOG_DIR, `${sanitizeSessionName(this.name)}.jsonl`)
+    let wrote = 0
     for (const e of this.buf.slice(this.flushed)) {
-      appendFileSync(
-        join(LOG_DIR, `${sanitizeSessionName(this.name)}.jsonl`),
-        JSON.stringify(e) + '\n',
-        { encoding: 'utf-8', mode: 0o600 },
-      )
+      // FIFO/socket 路径上「写不进去」而不是**干等**（`appendFileSync` 会打开目标写）。
+      // 写失败时**不推进** flushed：这些事件还算未落盘，路径恢复后下一次 save 会补上。
+      if (!appendRegularFileSync(path, JSON.stringify(e) + '\n', { mode: 0o600 })) {
+        if (!warnedNotAppendable) {
+          warnedNotAppendable = true
+          process.stderr.write(
+            `⚠ Mipham Code: ${path} is not a regular file — session log events were not written.\n`,
+          )
+        }
+        break
+      }
+      wrote++
     }
-    this.flushed = this.buf.length
+    this.flushed += wrote
   }
 
   /** 从既有 JSONL 打开，逐行解析为事件（已落盘事件标记为已 flush）。 */
   static open(name: string): SessionLog {
     const log = new SessionLog(name)
     const path = join(LOG_DIR, `${sanitizeSessionName(name)}.jsonl`)
-    if (!existsSync(path)) return log
-    for (const line of readFileSync(path, 'utf-8').split('\n')) {
+    // 类型闸在读取之前：`SessionStore.load` 在快照读不出来时**回落到这里**，所以路径上
+    // 是个 FIFO 时不能在这里换个函数继续等 —— 读不动就当空日志（见 shared/regular-file.ts）。
+    const raw = readRegularFileSync(path)
+    if (raw === null) return log
+    for (const line of raw.split('\n')) {
       const trimmed = line.trim()
       if (!trimmed) continue
       try {
@@ -178,6 +194,23 @@ export class SessionLog {
   }
 }
 
+/**
+ * 消息形状闸 —— 投影与**出网**两侧都会解引用的字段的最低门槛，不是 schema 校验。
+ *
+ * 从前这里只查「`message` 是个对象」，于是 `{"type":"user/message","message":{}}`
+ * 一路活到线上：投影照原样收下它，provider 侧读到 `content` 为 `undefined` 走
+ * 「非字符串即 `ContentBlock[]`」那条分支，`.filter` 当场 TypeError（实测）。
+ * `content` 数组里的块同理 —— provider 会 `b.type` 逐个读。
+ */
+export function isValidMessage(m: unknown): boolean {
+  if (!m || typeof m !== 'object') return false
+  const msg = m as Record<string, unknown>
+  if (msg.role !== 'user' && msg.role !== 'assistant' && msg.role !== 'system') return false
+  const content = msg.content
+  if (typeof content === 'string') return true
+  return Array.isArray(content) && content.every((b) => !!b && typeof b === 'object')
+}
+
 /**
  * 事件结构校验 —— 磁盘→内存的**唯一**入口（`open()`）用它挡掉坏行。
  *
@@ -187,6 +220,9 @@ export class SessionLog {
  * 却让投影抛 TypeError（rewrite 那条更狠：`out` 直接变 `undefined`，下一条就炸），
  * 而 `/resume` 那条链上没有 try 兜它。坏行来自手写/拼接/半截重排，不是本进程写的。
  *
+ * 带 message 的事件还要过 `isValidMessage`：投影只把它 `push` 进数组、自己不碰字段，
+ * 所以「投影不许崩」在这里**不够** —— 崩点在下游（provider 分支、UI 的 `msg.role`）。
+ *
  * 不校验 `session/start`、`assistant/chunk`、`checker/decision`：投影对它们无分支；
  * 未知类型一律放行（前向兼容 —— 认不出来不等于要销毁它）。
  */
@@ -197,7 +233,7 @@ function isValidEvent(e: unknown): e is SessionEvent {
   switch (ev.type) {
     case 'user/message':
     case 'assistant/message':
-      return !!ev.message && typeof ev.message === 'object'
+      return isValidMessage(ev.message)
     case 'tool/call':
       return (
         typeof ev.id === 'string' &&
@@ -213,7 +249,8 @@ function isValidEvent(e: unknown): e is SessionEvent {
     case 'compaction/summary':
       return typeof ev.summary === 'string'
     case 'compaction/rewrite':
-      return Array.isArray(ev.messages)
+      // 快照替换：整份投影由它重建 ⇒ 元素形状与 message 事件同罪
+      return Array.isArray(ev.messages) && ev.messages.every(isValidMessage)
     default:
       return true
   }