@miphamai/cli 0.85.1 → 0.85.2

package/src/core/session-store.ts

@@ -1,17 +1,16 @@
-import {
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  writeFileSync,
-  unlinkSync,
-  renameSync,
-  existsSync,
-  statSync,
-} from 'node:fs'
+import { mkdirSync, readdirSync, unlinkSync, existsSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import { createHash } from 'node:crypto'
 import type { Message } from '../shared/types'
-import { sanitizeSessionName, SessionLog, deriveMessages, messageToEvents } from './session-log'
+import {
+  sanitizeSessionName,
+  SessionLog,
+  deriveMessages,
+  messageToEvents,
+  isValidMessage,
+} from './session-log'
+import { atomicWriteFileSync } from '../shared/atomic-write'
+import { readRegularFileSync } from '../shared/regular-file'
 import { miphamHome } from './paths.ts'
 
 export interface SessionMetadata {
@@ -54,6 +53,25 @@ function filePath(name: string): string {
   return join(SESSIONS_DIR, `${sanitizeSessionName(name)}.jsonl`)
 }
 
+/**
+ * 旧格式快照（单 JSON 对象 `{metadata, messages}`）的形状闸。
+ *
+ * `'metadata' in parsed` 拦不住 `{"metadata": null, …}` —— `in` 看的是**键在不在**，
+ * 而 `/resume <name>` 紧接着就读 `session.metadata.name`，那条链上没有 try（实测
+ * `TypeError`）。`messages` 的元素同理：`[null]` 会一路送到 UI 的
+ * `forwardedMessages.map((msg) => msg.role)`（`app.tsx:1041`）与 provider 的内容分支。
+ *
+ * 形状不对**整份返回 null**，而不是把坏元素过滤掉：调用方随即回落到事件日志那条路，
+ * 读不出来会如实报 load failed；过滤则会凭空造出一段残缺历史 —— 静默改写用户数据。
+ */
+function asStoredSnapshot(parsed: unknown): StoredSession | null {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null
+  const { metadata, messages } = parsed as { metadata?: unknown; messages?: unknown }
+  if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata)) return null
+  if (!Array.isArray(messages) || !messages.every(isValidMessage)) return null
+  return { metadata: metadata as SessionMetadata, messages: messages as Message[] }
+}
+
 export class SessionStore {
   /**
    * Save a session as JSONL (one JSON object per line).
@@ -79,10 +97,11 @@ export class SessionStore {
       messages,
     }
 
-    // Atomic write: write to temp file, then rename (same-fs rename is atomic)
-    const tmp = path + '.tmp'
-    writeFileSync(tmp, JSON.stringify(session) + '\n', { encoding: 'utf-8', mode: 0o600 })
-    renameSync(tmp, path)
+    // Atomic write: write to temp file, then rename (same-fs rename is atomic).
+    // 临时名由 atomicWriteFileSync 生成（pid + 随机后缀）—— 从前这里是固定的
+    // `path + '.tmp'`，两个进程同时存同一个会话时，先 rename 的那个会把**后一个**写者的
+    // 内容搬进目标，而它自己的 rename 再抛 ENOENT：在一个「目标永不半截」的函数里丢一次写。
+    atomicWriteFileSync(path, JSON.stringify(session) + '\n', { mode: 0o600 })
 
     // Incremental index update — only touch this session's entry
     try {
@@ -123,18 +142,12 @@ export class SessionStore {
   /** 从磁盘重开一个 SessionLog（不存在返回空 log）。旧格式快照自动迁移为事件日志。 */
   static loadLog(name: string): SessionLog {
     const path = filePath(name)
-    if (!existsSync(path)) return SessionLog.open(name)
     try {
-      const raw = readFileSync(path, 'utf-8')
-      const parsed = JSON.parse(raw) as unknown
-      if (
-        parsed &&
-        typeof parsed === 'object' &&
-        'metadata' in parsed &&
-        Array.isArray((parsed as { messages?: unknown }).messages)
-      ) {
+      const raw = readRegularFileSync(path)
+      if (raw === null) return SessionLog.open(name)
+      const old = asStoredSnapshot(JSON.parse(raw))
+      if (old) {
         // 旧格式快照 → 迁移为事件日志（重写文件，避免后续 append 混格式）
-        const old = parsed as StoredSession
         const log = new SessionLog(name)
         log.append({
           type: 'session/start',
@@ -160,19 +173,12 @@ export class SessionStore {
    */
   static load(name: string): StoredSession | null {
     const path = filePath(name)
-    if (!existsSync(path)) return null
-
     try {
-      const raw = readFileSync(path, 'utf-8')
-      // 旧格式：单 JSON 对象 {metadata, messages}
-      const parsed = JSON.parse(raw) as unknown
-      if (
-        parsed &&
-        typeof parsed === 'object' &&
-        'metadata' in parsed &&
-        Array.isArray((parsed as { messages?: unknown }).messages)
-      ) {
-        return parsed as StoredSession
+      const raw = readRegularFileSync(path)
+      if (raw !== null) {
+        // 旧格式：单 JSON 对象 {metadata, messages}
+        const old = asStoredSnapshot(JSON.parse(raw))
+        if (old) return old
       }
     } catch {
       // 多行 JSONL → 新格式，走事件解析
@@ -295,7 +301,7 @@ export class SessionStore {
       }
     }
 
-    writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), { encoding: 'utf-8', mode: 0o600 })
+    atomicWriteFileSync(INDEX_FILE, JSON.stringify(index, null, 2), { mode: 0o600 })
   }
 
   /**
@@ -323,7 +329,7 @@ export class SessionStore {
     } else {
       index.push(entry)
     }
-    writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), { encoding: 'utf-8', mode: 0o600 })
+    atomicWriteFileSync(INDEX_FILE, JSON.stringify(index, null, 2), { mode: 0o600 })
   }
 
   /**
@@ -340,8 +346,7 @@ export class SessionStore {
         ? `${safeRaw.slice(0, 80)}-${createHash('sha256').update(safeRaw).digest('hex').slice(0, 16)}`
         : safeRaw
     const summaryPath = join(SUMMARIES_DIR, `${safe}.md`)
-    writeFileSync(summaryPath, `# ${name}\n\n${summary}\n\nTags: ${tags.join(', ')}\n`, {
-      encoding: 'utf-8',
+    atomicWriteFileSync(summaryPath, `# ${name}\n\n${summary}\n\nTags: ${tags.join(', ')}\n`, {
       mode: 0o600,
     })
 
@@ -365,7 +370,7 @@ export class SessionStore {
           tags,
         })
       }
-      writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), { encoding: 'utf-8', mode: 0o600 })
+      atomicWriteFileSync(INDEX_FILE, JSON.stringify(index, null, 2), { mode: 0o600 })
     } catch {
       // Index write is best-effort
     }
@@ -414,11 +419,26 @@ export class SessionStore {
 
   /**
    * Read the raw index file, returning empty array if missing or corrupt.
+   *
+   * 「corrupt」不只是语法错：`null`、`{"a":1}`、`[1,2]` 都过得了 `JSON.parse`。放它们
+   * 过去，`getLatest()` 会按数组用它 —— `null` 在启动路径（`index.tsx` 建系统提示时）
+   * 抛 `TypeError: index.length`；`[1,2]` 更安静：`getLatest()` 返回数字 `1`，调用方接着
+   * 读 `latest.name` 拿到 `undefined`，再喂给 `load()` ⇒ `name.replace` 抛。条目还必须
+   * 有**字符串 name**：索引条目的第一用途就是当文件名用。
    */
   private static loadIndexRaw(): SessionIndexEntry[] {
-    if (!existsSync(INDEX_FILE)) return []
+    const raw = readRegularFileSync(INDEX_FILE)
+    if (raw === null) return []
     try {
-      return JSON.parse(readFileSync(INDEX_FILE, 'utf-8'))
+      const parsed: unknown = JSON.parse(raw)
+      if (!Array.isArray(parsed)) return []
+      return parsed.filter(
+        (e): e is SessionIndexEntry =>
+          !!e &&
+          typeof e === 'object' &&
+          typeof (e as { name?: unknown }).name === 'string' &&
+          (e as { name: string }).name.length > 0,
+      )
     } catch {
       return []
     }

package/src/daemon/auth.ts

@@ -1,6 +1,7 @@
 // apps/cli/src/daemon/auth.ts
 import { randomBytes, timingSafeEqual } from 'node:crypto'
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
+import { readFileSync, existsSync, mkdirSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { dirname } from 'node:path'
 
 /**
@@ -21,7 +22,7 @@ export function loadOrCreateToken(tokenPath: string): string {
 
   const token = generateToken()
   mkdirSync(dirname(tokenPath), { recursive: true, mode: 0o700 })
-  writeFileSync(tokenPath, token, { mode: 0o600 })
+  atomicWriteFileSync(tokenPath, token, { mode: 0o600 })
   return token
 }
 
@@ -51,7 +52,7 @@ export function verifyToken(expected: string, provided: string): boolean {
  */
 export function rotateToken(tokenPath: string): string {
   const token = generateToken()
-  writeFileSync(tokenPath, token, { mode: 0o600 })
+  atomicWriteFileSync(tokenPath, token, { mode: 0o600 })
   return token
 }
 

package/src/daemon/index.ts

@@ -6,7 +6,8 @@
 // getPort()      reads the last known port from disk
 
 import { join } from 'node:path'
-import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync } from 'node:fs'
+import { existsSync, readFileSync, unlinkSync, mkdirSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { createServer as createNetServer } from 'node:net'
 import type { Server } from 'bun'
 import { DaemonDatabase } from './database'
@@ -247,8 +248,8 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
   activeServer = server
 
   // Write PID and port files
-  writeFileSync(PID_FILE, String(process.pid))
-  writeFileSync(PORT_FILE, String(port))
+  atomicWriteFileSync(PID_FILE, String(process.pid), { mode: 0o644 })
+  atomicWriteFileSync(PORT_FILE, String(port), { mode: 0o644 })
 
   return { port, token }
 }

package/src/i18n-core/locales/en-US.json

@@ -893,6 +893,7 @@
     },
     "status": {
       "esc_to_interrupt": "esc to interrupt",
+      "ctrl_c_again": "ctrl+c again to exit",
       "shift_tab_cycle": "shift+tab",
       "left_for_agents": "ctrl+g agents to manage",
       "mipham_modes": "Mipham",

package/src/i18n-core/locales/zh-CN.json

@@ -893,6 +893,7 @@
     },
     "status": {
       "esc_to_interrupt": "Esc 中断",
+      "ctrl_c_again": "再按一次 Ctrl+C 退出",
       "shift_tab_cycle": "Shift+Tab",
       "left_for_agents": "ctrl+g 管理代理",
       "mipham_modes": "Mipham独有",

package/src/index.tsx

@@ -346,6 +346,10 @@ export async function runApp(options: RunOptions): Promise<void> {
           sessionId: options.remoteSession.sessionId,
         }),
       }),
+      // Ink 默认 exitOnCtrlC: true，它在**任何 handler 拿到按键之前**就退进程
+      // （App.js `input === '\x03'`，且 useInput 那条路还会跳过全部监听器）。
+      // 于是 Ctrl+C 的语义只能由我们自己定 —— 见 App 里的「再按一次才退」。
+      { exitOnCtrlC: false },
     )
     await waitUntilExit()
 
@@ -364,6 +368,7 @@ export async function runApp(options: RunOptions): Promise<void> {
         onAttach={() => {}}
         onExit={() => process.exit(0)}
       />,
+      { exitOnCtrlC: false },
     )
     await waitUntilExit()
     process.exit(0)
@@ -868,6 +873,7 @@ export async function runApp(options: RunOptions): Promise<void> {
         t,
       }),
     }),
+    { exitOnCtrlC: false },
   )
   await waitUntilExit()
   saveAndExit()

package/src/mcp/oauth.ts

@@ -3,7 +3,7 @@ import { exec } from 'node:child_process'
 import { createServer, Server } from 'node:http'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { McpServerConfig } from '../shared/types'
-import { TokenStore } from './token-store'
+import { TokenStore, type TokenData } from './token-store'
 import { fetchWithRetry } from '../providers/fetch-utils'
 import { createT } from '../i18n-core/t'
 import enUS from '../i18n-core/locales/en-US.json'
@@ -23,6 +23,29 @@ interface TokenResponse {
   scopes?: string[]
 }
 
+/**
+ * 这份凭证**绑给谁** —— 即它会流经哪几个端点、以哪个 client 身份取得。
+ *
+ * 为什么需要：`TokenStore` 只按**服务名**存（`<name>.enc`），而这个名来自
+ * `.mcp.json` —— 那是**从 cwd 读**的项目级配置。clone 一个仓库就等于让它给你的
+ * MCP 服务起名，于是「名字相同」推不出「签发方相同」：把某个常见名（如 `github`）
+ * 的 url / tokenUrl 指到别处，缓存里那份真凭证就会被送给新的主机 —— access token
+ * 被直接塞进 env 交给对面，refresh token 被 POST 给对面的令牌端点（后者更危险：
+ * 它能换出新的 access token）。
+ *
+ * 绑定的是**凭证会去的地方**，四者任一变化即视为另一份凭证：授权端点、令牌端点、
+ * client 身份、资源端点（access token 最终发给它）。
+ */
+export function credentialBinding(config: McpServerConfig): string {
+  const auth = config.auth
+  return JSON.stringify([
+    auth?.authorizationUrl ?? '',
+    auth?.tokenUrl ?? '',
+    auth?.clientId ?? '',
+    config.url ?? '',
+  ])
+}
+
 function base64url(buf: Buffer): string {
   return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
 }
@@ -127,12 +150,28 @@ export class OAuthClient {
       scopes: data.scope?.split(' '),
     }
 
-    this.store.save(config.name, result)
+    this.store.save(config.name, { ...result, boundTo: credentialBinding(config) })
     return result
   }
 
-  async getValidAccessToken(serverName: string, config: McpServerConfig): Promise<string> {
+  /**
+   * 取回该服务名下的凭证 —— **仅当它确实是当前这份配置签发的**。
+   *
+   * 绑定值不符时**不删**：把配置改回去，这份凭证仍然有效，而删除是不可逆的副作用。
+   * 但也**不用**它 —— 换过端点之后，「同名」不再说明任何事。
+   *
+   * 旧版本存下的凭证没有 `boundTo`（`undefined`）⇒ 一律不匹配 ⇒ 走一次 PKCE 重新
+   * 授权。这是认下的代价：无法核实签发方的凭证，就是不能拿出去用，而多授权一次
+   * 的代价远小于把一份 refresh token 交给别人的端点。
+   */
+  private loadBoundToken(serverName: string, config: McpServerConfig): TokenData | null {
     const saved = this.store.load(serverName)
+    if (!saved) return null
+    return saved.boundTo === credentialBinding(config) ? saved : null
+  }
+
+  async getValidAccessToken(serverName: string, config: McpServerConfig): Promise<string> {
+    const saved = this.loadBoundToken(serverName, config)
     if (saved && new Date(saved.expiresAt).getTime() > Date.now() + 60000) {
       return saved.accessToken
     }
@@ -144,9 +183,11 @@ export class OAuthClient {
   }
 
   async refreshAccessToken(serverName: string, config: McpServerConfig): Promise<string> {
-    const saved = this.store.load(serverName)
+    const saved = this.loadBoundToken(serverName, config)
     if (!saved?.refreshToken) {
-      throw new Error(`No refresh token available for "${serverName}"`)
+      throw new Error(
+        `No refresh token available for "${serverName}" — none stored, or the stored one was issued for a different endpoint`,
+      )
     }
     const auth = config.auth!
     // A single failed refresh is often a transient network/server error, not a
@@ -179,6 +220,7 @@ export class OAuthClient {
       accessToken: data.access_token,
       refreshToken: data.refresh_token || saved.refreshToken,
       expiresAt: new Date(Date.now() + (data.expires_in || 3600) * 1000).toISOString(),
+      boundTo: credentialBinding(config),
     })
     return data.access_token
   }

package/src/mcp/token-store.ts

@@ -1,22 +1,21 @@
-import {
-  existsSync,
-  readFileSync,
-  writeFileSync,
-  mkdirSync,
-  unlinkSync,
-  readdirSync,
-  chmodSync,
-} from 'node:fs'
+import { existsSync, readFileSync, mkdirSync, unlinkSync, readdirSync, chmodSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join, dirname } from 'node:path'
 import { encrypt, decrypt, getCredentialKey } from '../config/credential-crypto'
 import { miphamHome } from '../core/paths.ts'
 
-interface TokenData {
+export interface TokenData {
   accessToken: string
   refreshToken?: string
   expiresAt: string
   createdAt?: string
   scopes?: string[]
+  /**
+   * 这份凭证绑给哪个签发方（见 `credentialBinding`）。缺失 = 绑定未知，
+   * 调用方必须当作**不可用** —— 凭证只按服务名存，而服务名来自可从 cwd 读的
+   * 项目级配置，故「同名」推不出「同一签发方」。
+   */
+  boundTo?: string
 }
 
 export class TokenStore {
@@ -36,7 +35,7 @@ export class TokenStore {
       createdAt: data.createdAt || new Date().toISOString(),
     })
     const encrypted = encrypt(json, this.key)
-    writeFileSync(filePath, encrypted, { mode: 0o600 })
+    atomicWriteFileSync(filePath, encrypted, { mode: 0o600 })
     try {
       chmodSync(filePath, 0o600)
     } catch {

package/src/providers/openai-compat.ts

@@ -280,6 +280,17 @@ export class OpenAICompatProvider implements ProviderInstance {
       const msg = messages[i]!
       if (!msg) continue
 
+      // A `system` entry is a header, not a turn: it belongs in the first slot,
+      // and never alongside an already-emitted system prompt. A mid-array entry
+      // is a client-generated UI line — the engine stores a provider failure as
+      // `system` so a resumed session can render it as an ⚠ line — and passing it
+      // through as system role hands text that came *from a provider* the highest
+      // authority on the very next turn. anthropic.ts drops system entries
+      // outright (its protocol forbids them in the array at all); keeping the
+      // head is the part OpenAI-compatible endpoints genuinely accept.
+      const isHeader = msg.role === 'system' && i === 0 && result.length === 0
+      if (msg.role === 'system' && !isHeader) continue
+
       // ── String content ──
       if (typeof msg.content === 'string') {
         // Combine: assistant text + next assistant message with tool_use blocks

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.85.1' as const
+export const PACKAGE_VERSION = '0.85.2' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/regular-file.ts

@@ -0,0 +1,63 @@
+import { appendFileSync, existsSync, readFileSync, statSync } from 'node:fs'
+
+/**
+ * 路径是不是**普通文件** —— 判据是文件**类型**，不是存在性。
+ *
+ * `existsSync` 对 FIFO、socket、设备节点、目录一律为真，而 `readFileSync` 读一个
+ * 没有写者的 FIFO 会**阻塞到有写者打开它为止**。于是 `mkfifo ~/.mipham/config.yml`
+ * 这一条命令（或某个崩掉的工具留在 `~/.mipham/` 下的 socket）就能让 CLI 启动**永久
+ * 挂住**：没有输出、没有报错，也没有任何东西能给它计时 —— 阻塞发生在同步调用里，
+ * 定时器与 signal handler 都排不上队。闸门只能架在文件类型上。
+ *
+ * 符号链接指向普通文件**算数**（`statSync` 跟随链接，`~/.mipham` 常被软链进
+ * dotfiles 仓库）；指向 FIFO 的不算。
+ *
+ * 已知边界：stat 与随后的 read 之间不是原子的 —— 恰好在那道缝里把路径换成 FIFO
+ * 仍会阻塞。不设防：能改你配置路径的人本来就能做更坏的事。
+ */
+export function isRegularFile(path: string): boolean {
+  try {
+    return statSync(path).isFile()
+  } catch {
+    // 不存在（ENOENT）、路径中有一段不是目录（ENOTDIR）、权限不足（EACCES）、
+    // 链接成环（ELOOP）—— 对调用方都是同一件事：这里没有能读的内容。
+    return false
+  }
+}
+
+/**
+ * 读一个**普通文件**的文本内容；没有可读的普通文件时返回 null。
+ *
+ * null 的含义是「这里没有可读的普通文件」，三种来源一视同仁：缺失、不是普通文件
+ * （FIFO / socket / 目录 / 设备节点）、是普通文件但读不动（权限等）。
+ *
+ * 本函数**不往 stderr 写任何东西** —— 多数调用点读的是可选覆盖层，「文件不在」是
+ * 常态。需要提示的调用点自己判断（见 `config/loader.ts` 的 `safeParseYaml`）。
+ */
+export function readRegularFileSync(path: string): string | null {
+  if (!isRegularFile(path)) return null
+  try {
+    return readFileSync(path, 'utf-8')
+  } catch {
+    return null
+  }
+}
+
+/**
+ * 追加写入，只在目标**是普通文件或还不存在**时才写；返回是否真的写了。
+ *
+ * `appendFileSync` 会**打开目标写** —— 目标若是 FIFO 就等到有读者为止，与读侧同一个
+ * 坑，只是撞在写这一侧（配置备份的 `copyFileSync` 当初也是这么挂住的）。「还不存在」
+ * 必须放行：追加写天然承担创建。
+ *
+ * 返回 `false` 的意思是**没写**，调用方得知道自己丢了什么 —— 别把「跳过」当成功。
+ */
+export function appendRegularFileSync(
+  path: string,
+  content: string,
+  options: { mode?: number } = {},
+): boolean {
+  if (existsSync(path) && !isRegularFile(path)) return false
+  appendFileSync(path, content, { encoding: 'utf-8', mode: options.mode ?? 0o600 })
+  return true
+}

package/src/shared/sanitize.ts

@@ -25,16 +25,28 @@
  *   applied to what tools *write to disk*, not only to what gets pattern-matched.
  *   Adding them here would silently rewrite file contents.
  *
+ * Deliberately **not** included — the two joiners, ZWNJ (U+200C) and ZWJ (U+200D),
+ * for exactly the reason above. This is why the zero-width part of the set is spelled
+ * `\u{200B}\u{200E}-\u{200F}` and *not* the closed range `\u{200B}-\u{200F}` it used to be:
+ * - both are load-bearing in *visible* text. ZWNJ attaches a Persian/Arabic suffix to a
+ *   Latin word or number (the plural of "PDF"), and ZWJ is what holds a family emoji
+ *   together (U+1F468 U+200D U+1F469 U+200D U+1F467) rather than three separate people;
+ * - they buy nothing on the permission path either, since no shell ignores them —
+ *   `bash -c 'ec<ZWJ>ho hi'` is `command not found` (same for ZWNJ and ZWSP). So removing
+ *   them from the set costs no matching protection; it only stops the write path from
+ *   rewriting what the user asked us to write.
+ *
  * The tag block (U+E0000–E007F) *is* included: it is invisible in itself, and the
  * only sequences that use it (subdivision flags, e.g. U+1F3F4 + a tag run) degrade
  * to the bare black flag — which renders the same.
  */
 const DANGEROUS_UNICODE =
-  /[\u{061C}\u{115F}-\u{1160}\u{180E}\u{200B}-\u{200F}\u{202A}-\u{202E}\u{2060}\u{2066}-\u{2069}\u{3164}\u{FEFF}\u{FFA0}\u{E0000}-\u{E007F}]/gu
+  /[\u{061C}\u{115F}-\u{1160}\u{180E}\u{200B}\u{200E}-\u{200F}\u{202A}-\u{202E}\u{2060}\u{2066}-\u{2069}\u{3164}\u{FEFF}\u{FFA0}\u{E0000}-\u{E007F}]/gu
 
 /**
  * Strip dangerous invisible Unicode characters from a string.
- * - Zero-width: U+200B (ZWSP), U+200C (ZWNJ), U+200D (ZWJ), U+200E/F (LTR/RTL marks)
+ * - Zero-width: U+200B (ZWSP), U+200E/F (LTR/RTL marks) — the joiners U+200C/U+200D are
+ *   deliberately kept, see `DANGEROUS_UNICODE`
  * - Bidi controls: U+202A-E, U+2066-9, U+061C (Arabic letter mark)
  * - Word joiner: U+2060
  * - BOM: U+FEFF

package/src/tools/agent/memory.ts

@@ -1,4 +1,5 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from 'node:fs'
+import { readFileSync, mkdirSync, existsSync, readdirSync } from 'node:fs'
+import { atomicWriteFileSync } from '../../shared/atomic-write'
 import { join } from 'node:path'
 import type { ToolDefinition } from '../../shared/index.ts'
 import { MemoryManager } from '../../core/memory/memory-manager'
@@ -83,7 +84,8 @@ export const memoryTool: ToolDefinition = {
 
     if (action === 'write') {
       const body = formatMemory(name, params.content as string)
-      writeFileSync(filePath, body, 'utf-8')
+      // 与 MemoryManager 写的是同一批 .md：两侧都走原子写，权限语义保持一致。
+      atomicWriteFileSync(filePath, body, { mode: 0o644 })
       return { success: true, content: `Memory "${name}" written` }
     }
 

package/src/tools/agent/workflow.ts

@@ -111,16 +111,19 @@ export const workflowTool: ToolDefinition = {
       // Persist last-run state for /workflow save
       let persistWarning = ''
       try {
-        const { existsSync, mkdirSync, writeFileSync } = await import('node:fs')
+        const { existsSync, mkdirSync } = await import('node:fs')
+        const { atomicWriteFileSync } = await import('../../shared/atomic-write')
         const { join } = await import('node:path')
         const workflowsDir = workflowScriptDir(process.cwd())
         if (!existsSync(workflowsDir)) {
           mkdirSync(workflowsDir, { recursive: true })
         }
-        writeFileSync(
+        // 机器状态（每次 run 重写，`/workflow save` 会读回）：非原子写留下的半截 JSON
+        // 会让那条读取抛解析错。
+        atomicWriteFileSync(
           join(workflowsDir, '.last-run.json'),
           JSON.stringify({ runId, script, timestamp: new Date().toISOString() }),
-          'utf-8',
+          { mode: 0o644 },
         )
       } catch (err) {
         // Persistence stays best-effort — the workflow itself succeeded, so a