@miphamai/cli 0.85.1 → 0.85.3

package/src/config/loader.ts

@@ -1,15 +1,8 @@
-import {
-  readFileSync,
-  existsSync,
-  copyFileSync,
-  mkdirSync,
-  readdirSync,
-  unlinkSync,
-  chmodSync,
-} from 'node:fs'
+import { existsSync, copyFileSync, mkdirSync, readdirSync, unlinkSync, chmodSync } from 'node:fs'
 import { join, dirname } from 'node:path'
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml'
 import { atomicWriteFileSync } from '../shared/atomic-write'
+import { isRegularFile, readRegularFileSync } from '../shared/regular-file'
 import type {
   MiphamConfig,
   ProviderConfig,
@@ -41,7 +34,16 @@ const BACKUP_PREFIX = 'config.backup-'
 function safeParseYaml(path: string, label: string): Partial<MiphamConfig> | null {
   try {
     if (!existsSync(path)) return null
-    const raw = readFileSync(path, 'utf-8')
+    // `existsSync` 先过一遍只为「缺席不吭声」；真正决定读不读的是**文件类型**
+    // —— FIFO 上 `readFileSync` 会阻塞到有写者出现，那次挂死没有报错也没有
+    // 计时器救得回来（见 shared/regular-file.ts）。
+    const raw = readRegularFileSync(path)
+    if (raw === null) {
+      process.stderr.write(
+        `⚠ Mipham Code: ${label} (${path}) is not a readable regular file — ignoring it.\n`,
+      )
+      return null
+    }
     return parseYaml(raw) as Partial<MiphamConfig>
   } catch (err: unknown) {
     const msg = err instanceof Error ? err.message : String(err)
@@ -145,13 +147,43 @@ function mergeConfig(
   return merged
 }
 
+/**
+ * Drop `permission` from a **project-level** `config.yml` before it is merged,
+ * reporting it instead of applying it.
+ *
+ * `permission` is a ceiling, not a rule: it decides what the approval gate lets
+ * through without asking. Every other project-level key is a preference that a
+ * repository may reasonably commit; this one means "and do not ask me about the
+ * commands in here" — which is a decision about the operator, made by whoever
+ * wrote the repository. The same reasoning admits project-level `permissions.deny`
+ * (it narrows) and withholds `permissions.defaultMode` in `settings.json` (it
+ * widens) — the two files are the same door, so both are closed here.
+ *
+ * `mergeConfig` has no per-key allowlist, so this has to happen at the two points
+ * the project file enters. Reported rather than dropped silently: a repo whose
+ * setting stopped working should say so out loud, and silence is exactly what
+ * "your config was ignored" looks like from the outside.
+ */
+function stripProjectPermission(cfg: Partial<MiphamConfig>, path: string): Partial<MiphamConfig> {
+  if (cfg.permission === undefined) return cfg
+  const { permission, ...rest } = cfg
+  const shown = typeof permission === 'string' ? permission : JSON.stringify(permission)
+  process.stderr.write(
+    `⚠ Mipham Code: ignored permission: ${shown} from project config ${path}\n` +
+      `    (a repository must not choose the approval gate — set it in ~/.mipham/config.yml,\n` +
+      `    or pass --permission <mode> for this invocation)\n`,
+  )
+  return rest as Partial<MiphamConfig>
+}
+
 /**
  * Save a timestamped backup of config.yml to ~/.mipham/.
  * Keeps at most 5 backups; older ones are pruned.
  */
 function backupConfig(configPath: string): void {
   try {
-    if (!existsSync(configPath)) return
+    // 备份源同样要过类型闸：`copyFileSync` 打开 FIFO 读端一样会等到有写者为止。
+    if (!isRegularFile(configPath)) return
     mkdirSync(MIPHAM_HOME, { recursive: true, mode: 0o700 })
 
     const ts = new Date().toISOString().replace(/[:.]/g, '-')
@@ -190,6 +222,10 @@ export function tryRestoreFromBackup(configPath: string): boolean {
 
     if (files.length === 0) return false
 
+    // 目标已经在那儿而且不是普通文件（FIFO/socket/目录）时不还原：往 FIFO 写
+    // 会挡在「等读者」上，把「恢复」变成又一次挂死；目录则会 EISDIR。缺席才写。
+    if (existsSync(configPath) && !isRegularFile(configPath)) return false
+
     const latestBackup = join(MIPHAM_HOME, files[0]!)
     copyFileSync(latestBackup, configPath)
     process.stderr.write(`⚠ Mipham Code: restored config from backup (${files[0]})\n`)
@@ -220,8 +256,8 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
 
   for (const path of searchPaths) {
     try {
-      if (!existsSync(path)) continue
-      const raw = readFileSync(path, 'utf-8')
+      const raw = readRegularFileSync(path)
+      if (raw === null) continue
       // Every McpServerConfig field is optional here (the name comes from the
       // key), so a field added to the type is accepted without touching this.
       const parsed = JSON.parse(raw) as {
@@ -247,11 +283,21 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
 
 /**
  * Parsed `settings.json` (Claude Code convention): hooks + permissions.
- * Hooks are additive across levels; permissions allow/deny are deduped unions.
+ * Hooks are additive across levels; permissions allow/deny are deduped unions —
+ * and `defaultMode` is the one member that is **not** merged, because it is a
+ * ceiling rather than a rule (see `loadSettingsJson`).
  */
 export interface SettingsJson {
   hooks: SettingsHooks
-  permissions: { allow: string[]; deny: string[] }
+  /**
+   * `defaultMode` is present only when the **user-level** file named one, and it
+   * is passed through **raw** (not validated here): the accepted spelling is
+   * `ALL_MODES`, and the single place that enforces it — plus the warning for a
+   * value that is not a mode — is `PermissionSystem.setDefaultLevel`. A second
+   * validator here would be a second value domain, and the two would drift the
+   * day a mode is added.
+   */
+  permissions: { allow: string[]; deny: string[]; defaultMode?: string }
   /**
    * Present (and `true`) only when the project-level file really did declare
    * hooks and they were withheld because the caller did not vouch for the
@@ -259,6 +305,13 @@ export interface SettingsJson {
    * so a caller announcing the skip cannot announce one that never happened.
    */
   projectHooksSkipped?: true
+  /**
+   * Same shape, for `permissions.defaultMode`: present only when the
+   * project-level file really declared a mode and it was **withheld**. Unlike
+   * `projectHooksSkipped` this is not conditioned on trust — the ceiling does not
+   * move for a file that arrives with the code, trusted workspace or not.
+   */
+  projectModeSkipped?: true
   /**
    * The subset of `hooks` that came from the project-level file — the entries
    * the workspace-trust gate governs. Absent unless the caller vouched for the
@@ -282,14 +335,35 @@ export interface SettingsJson {
  * established trust (or that only *display* the configured list) opt in
  * explicitly. The flag gates hooks only: `permissions` still merge from both
  * levels, since that question is answered by the mode ceiling, not by trust.
+ *
+ * **That last sentence is the reason `defaultMode` is the exception.** The
+ * ceiling only answers the trust question while repository-controlled files
+ * cannot move it; a repo that ships `.mipham/settings.json` with
+ * `permissions.defaultMode: "auto"` would otherwise hand itself the approval
+ * gate. So `defaultMode` is read from the **user-level file only**, and a
+ * project-level one is withheld and *reported* (`projectModeSkipped`) rather
+ * than dropped in silence — same treatment as a `plan`/`acceptEdits` value that
+ * used to be dropped entirely, except that the drop there fell back to the
+ * *wider* `default`. The upstream convention says the same thing in its own
+ * words: repo-level settings cannot grant `defaultMode`; adopt it in user
+ * settings instead.
+ *
+ * One consequence to keep in mind when reading a merged result: `permissions`
+ * is still provenance-free for allow/deny, so a caller cannot tell which of
+ * those two rules came from the repository. That is deliberate (above), and it
+ * is why the ceiling has to be the thing that repels the repo-controlled half.
  */
 export function loadSettingsJson(
   cwd: string = process.cwd(),
   options: { includeProjectHooks?: boolean } = {},
 ): SettingsJson {
   const hooks: SettingsHooks = {}
-  const permissions = { allow: [] as string[], deny: [] as string[] }
+  const permissions: { allow: string[]; deny: string[]; defaultMode?: string } = {
+    allow: [],
+    deny: [],
+  }
   let projectHooksSkipped = false
+  let projectModeSkipped = false
   // The project file's entries, kept out of the merge so provenance survives it.
   const projectHooks: SettingsHooks = {}
 
@@ -304,11 +378,11 @@ export function loadSettingsJson(
 
   for (const { path, readHooks, isProject } of searchPaths) {
     try {
-      if (!existsSync(path)) continue
-      const raw = readFileSync(path, 'utf-8')
+      const raw = readRegularFileSync(path)
+      if (raw === null) continue
       const parsed = JSON.parse(raw) as {
         hooks?: Record<string, unknown>
-        permissions?: { allow?: unknown; deny?: unknown }
+        permissions?: { allow?: unknown; deny?: unknown; defaultMode?: unknown }
       }
 
       if (!readHooks) {
@@ -336,6 +410,20 @@ export function loadSettingsJson(
       }
 
       if (parsed.permissions) {
+        // A mode counts as *declared* only when it is a non-empty string — the
+        // same test the hooks branch above uses, so a marker cannot outrun the
+        // fact it reports. What the string says is not checked here (see the
+        // `permissions` field doc): a typo must reach the applier, which is the
+        // one place that knows the accepted spellings and issues the warning.
+        const declaredMode =
+          typeof parsed.permissions.defaultMode === 'string' &&
+          parsed.permissions.defaultMode.trim() !== ''
+            ? parsed.permissions.defaultMode
+            : undefined
+        if (declaredMode !== undefined) {
+          if (isProject) projectModeSkipped = true
+          else permissions.defaultMode = declaredMode
+        }
         for (const key of ['allow', 'deny'] as const) {
           const list = parsed.permissions[key]
           if (!Array.isArray(list)) continue
@@ -355,6 +443,7 @@ export function loadSettingsJson(
   // gated on the strength of a file with nothing in it.
   const result: SettingsJson = { hooks, permissions }
   if (projectHooksSkipped) result.projectHooksSkipped = true
+  if (projectModeSkipped) result.projectModeSkipped = true
   if (Object.values(projectHooks).some((entries) => Array.isArray(entries) && entries.length > 0)) {
     result.projectHooks = projectHooks
   }
@@ -376,10 +465,11 @@ export function settingsPathFor(scope: SettingsScope, cwd: string = process.cwd(
  * not something to clobber — the user's other settings live in the same file.
  */
 export function readSettingsDoc(path: string): Record<string, unknown> {
-  if (!existsSync(path)) return {}
+  const raw = readRegularFileSync(path)
+  if (raw === null) return {}
   let parsed: unknown
   try {
-    parsed = JSON.parse(readFileSync(path, 'utf-8'))
+    parsed = JSON.parse(raw)
   } catch {
     throw new Error(`${path} is not valid JSON. Fix or remove it, then retry.`)
   }
@@ -448,12 +538,24 @@ export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
 
   let config = { ...DEFAULT_CONFIG }
 
+  // The project file enters `loadConfig` at **two** points (fresh parse, and the
+  // parse that follows a restore from backup). Both go through here, so the guard
+  // on `permission` cannot be present on one path and missing on the other — a
+  // corrupted config that recovers from a backup is still the same repository's
+  // file, and "corrupt it once, get the setting honored" would be a bypass of the
+  // one key that is refused.
+  const applyProjectConfig = (parsed: Partial<MiphamConfig>): void => {
+    config = mergeConfig(config, stripProjectPermission(parsed, configPath), false)
+  }
+
   // ── Load project-level config ──
   const projectConfig = safeParseYaml(configPath, 'project config')
   if (projectConfig) {
-    config = mergeConfig(config, projectConfig, false)
-  } else if (existsSync(configPath)) {
-    // File exists but failed to parse — try to restore from backup
+    applyProjectConfig(projectConfig)
+  } else if (isRegularFile(configPath)) {
+    // A real file is there but failed to parse — try to restore from backup.
+    // 非普通文件走不到这里：那不是「损坏的配置」，而是根本不该当配置读的东西
+    // （FIFO/socket/目录），「恢复」对它会变成往 FIFO 里写、又一次挂死。
     process.stderr.write(`⚠ Mipham Code: project config is corrupted, attempting recovery...\n`)
     if (!tryRestoreFromBackup(configPath)) {
       process.stderr.write(`⚠ Mipham Code: no backup available for project config. Skipping.\n`)
@@ -461,7 +563,7 @@ export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
       // Retry parsing after restore
       const restored = safeParseYaml(configPath, 'restored project config')
       if (restored) {
-        config = mergeConfig(config, restored, false)
+        applyProjectConfig(restored)
       }
     }
   }
@@ -470,8 +572,9 @@ export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
   const userConfig = safeParseYaml(userConfigPath, 'user config')
   if (userConfig) {
     config = mergeConfig(config, userConfig, true)
-  } else if (existsSync(userConfigPath)) {
-    // File exists but failed to parse — try to restore from backup
+  } else if (isRegularFile(userConfigPath)) {
+    // 用户的 config.yml 是真文件但解析不了 —— 才谈得上「恢复」。判据同上：
+    // 非普通文件不是损坏的配置。
     process.stderr.write(`⚠ Mipham Code: user config is corrupted, attempting recovery...\n`)
     if (!tryRestoreFromBackup(userConfigPath)) {
       process.stderr.write(`⚠ Mipham Code: no backup available for user config. Skipping.\n`)
@@ -545,8 +648,8 @@ export function loadInferenceHookConfig(): InferenceHookConfig {
   const paths = [userConfigPath]
   for (const path of paths) {
     try {
-      if (!existsSync(path)) continue
-      const raw = readFileSync(path, 'utf-8')
+      const raw = readRegularFileSync(path)
+      if (raw === null) continue
       const parsed = parseYaml(raw) as Record<string, unknown>
       const section = parsed.inference_hooks as Partial<InferenceHookConfig> | undefined
       if (section) {
@@ -587,8 +690,8 @@ function mergeCredentialMaskingFile(
   allowLoosening: boolean,
 ): CredentialMaskingConfig {
   try {
-    if (!existsSync(path)) return merged
-    const raw = readFileSync(path, 'utf-8')
+    const raw = readRegularFileSync(path)
+    if (raw === null) return merged
     const parsed = parseYaml(raw) as Record<string, unknown>
     const section = parsed.credential_masking as Partial<CredentialMaskingConfig> | undefined
     if (!section) return merged
@@ -664,8 +767,8 @@ export function loadBackgroundAgentConfig(cwd: string = process.cwd()): Backgrou
   const paths = [userConfigPath, configPath]
   for (const path of paths) {
     try {
-      if (!existsSync(path)) continue
-      const raw = readFileSync(path, 'utf-8')
+      const raw = readRegularFileSync(path)
+      if (raw === null) continue
       const parsed = parseYaml(raw) as Record<string, unknown>
       const section = parsed.background_agent as Partial<BackgroundAgentConfig> | undefined
       if (section) {
@@ -697,8 +800,8 @@ export function loadCrossSessionConfig(cwd: string = process.cwd()): CrossSessio
   const paths = [userConfigPath, configPath] // project wins (loaded last)
   for (const path of paths) {
     try {
-      if (!existsSync(path)) continue
-      const raw = readFileSync(path, 'utf-8')
+      const raw = readRegularFileSync(path)
+      if (raw === null) continue
       const parsed = parseYaml(raw) as Record<string, unknown>
       const section = parsed.cross_session as Partial<CrossSessionConfig> | undefined
       if (section) {
@@ -753,11 +856,11 @@ function decryptProviderApiKeys(providers: ProviderConfig[] | undefined): void {
 export function getProviderApiKey(providerId: string, cwd: string = process.cwd()): string | null {
   const userConfigPath = join(MIPHAM_HOME, 'config.yml')
   const projectConfigPath = join(cwd, MIPHAM_DIR, 'config.yml')
-  const configPath = existsSync(userConfigPath) ? userConfigPath : projectConfigPath
+  const configPath = isRegularFile(userConfigPath) ? userConfigPath : projectConfigPath
 
   try {
-    if (!existsSync(configPath)) return null
-    const raw = readFileSync(configPath, 'utf-8')
+    const raw = readRegularFileSync(configPath)
+    if (raw === null) return null
     const doc = (parseYaml(raw) as Record<string, unknown>) || {}
     const providers = (doc.providers as Array<Record<string, unknown>>) || []
     const p = providers.find((x) => x.id === providerId)
@@ -788,9 +891,9 @@ export function saveProviderApiKey(providerId: string, apiKey: string): boolean
 
     // Read existing config (or start fresh)
     let doc: Record<string, unknown> = {}
-    if (existsSync(configPath)) {
-      const raw = readFileSync(configPath, 'utf-8')
-      doc = (parseYaml(raw) as Record<string, unknown>) || {}
+    const existing = readRegularFileSync(configPath)
+    if (existing !== null) {
+      doc = (parseYaml(existing) as Record<string, unknown>) || {}
     }
 
     // Find and update the provider in the providers array

package/src/config/preferences.ts

@@ -5,16 +5,19 @@
  * NOT for config.yml settings — those belong in the YAML config system.
  * NOT for secrets — this file is plain JSON, not encrypted.
  */
-import { readFileSync, existsSync, mkdirSync } from 'node:fs'
+import { existsSync, mkdirSync } from 'node:fs'
 import { atomicWriteFileSync } from '../shared/atomic-write'
+import { readRegularFileSync } from '../shared/regular-file'
 import { miphamHome } from '../core/paths.ts'
 
 const PREFS_PATH = miphamHome('preferences.json')
 
 function readPrefs(): Record<string, string> {
   try {
-    if (!existsSync(PREFS_PATH)) return {}
-    const raw = readFileSync(PREFS_PATH, 'utf-8')
+    // 类型闸在读取之前 —— FIFO 上的 `readFileSync` 会一直等写者（见
+    // shared/regular-file.ts）。
+    const raw = readRegularFileSync(PREFS_PATH)
+    if (raw === null) return {}
     const parsed: unknown = JSON.parse(raw)
     if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return {}
     return parsed as Record<string, string>

package/src/core/constitution-loader.ts

@@ -13,7 +13,8 @@
  * Format: YAML with schema validation
  */
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs'
+import { readFileSync, mkdirSync, existsSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { miphamHome } from './paths.ts'
 import alignmentVocabulary from './alignment-vocabulary.json' with { type: 'json' }
 
@@ -103,7 +104,7 @@ export class ConstitutionLoader {
     try {
       const dir = miphamHome()
       if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
-      writeFileSync(this.path, this.serializeToYaml(DEFAULT_CONSTITUTION), 'utf-8')
+      atomicWriteFileSync(this.path, this.serializeToYaml(DEFAULT_CONSTITUTION), { mode: 0o644 })
     } catch {
       // Best-effort — default constitution works in-memory
     }

package/src/core/context.ts

@@ -37,6 +37,14 @@ interface Checkpoint {
 export class ContextManager {
   private messages: Message[] = []
   private systemPrompt = ''
+  /**
+   * 系统提示里的**权限段**是读时派生的，不是组装时烘进 `systemPrompt` 的一份拷贝。
+   *
+   * 烘进去的那份拷贝会与执行分叉：Shift+Tab 之后闸门与页脚都变了，模型手里还是旧指令
+   * —— 往窄切是自纠正的（模型比闸门更保守），**往宽切**则让模型拒绝做它已经被允许做的事。
+   * `index.tsx` 把它接到 live `PermissionSystem.getMode()` 上，于是切一次档，下一次请求就变。
+   */
+  private permissionContextSource: (() => string) | null = null
   private estimatedTokens = 0
   private checkpoints: Checkpoint[] = []
   private checkpointCounter = 0
@@ -116,11 +124,32 @@ export class ContextManager {
 
   setSystemPrompt(prompt: string): void {
     this.systemPrompt = prompt
-    this.estimatedTokens = this.estimateTokens(prompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
+  }
+
+  /**
+   * 接线点（`index.tsx`）：把权限段接到 live `PermissionSystem.getMode()` 上。
+   *
+   * 传 `null` 撤销。**不接**时系统提示里没有权限段（这里是唯一的施加点，故
+   * `test/integrity/permission-status-parity.test.ts` 从源码侧断这一行在场）。
+   */
+  setPermissionContextSource(fn: (() => string) | null): void {
+    this.permissionContextSource = fn
+  }
+
+  /**
+   * 存储的提示 + 读时派生的权限段。
+   *
+   * 段尾追加（而非插回原来的中段位置）是刻意的：只切档时**前缀保持不变**，
+   * 提供方的 prefix cache 仍能命中到权限段之前的部分。
+   */
+  private composedSystemPrompt(): string {
+    const block = this.permissionContextSource?.() ?? ''
+    return block ? `${this.systemPrompt}\n\n---\n\n${block}` : this.systemPrompt
   }
 
   getSystemPrompt(): string {
-    return this.systemPrompt
+    return this.composedSystemPrompt()
   }
 
   addMessage(msg: Message): void {
@@ -239,7 +268,7 @@ export class ContextManager {
     }
 
     // Re-estimate tokens
-    this.estimatedTokens = this.estimateTokens(this.systemPrompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
     for (const msg of this.messages) {
       this.estimatedTokens += this.estimateTokens(
         typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
@@ -257,7 +286,7 @@ export class ContextManager {
     this.messages = []
     this.checkpoints = []
     this.checkpointCounter = 0
-    this.estimatedTokens = this.estimateTokens(this.systemPrompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
   }
 
   getMessageCount(): number {
@@ -273,7 +302,7 @@ export class ContextManager {
   replaceMessages(messages: Message[]): void {
     this.messages = messages
     // Re-estimate tokens
-    this.estimatedTokens = this.estimateTokens(this.systemPrompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
     for (const msg of messages) {
       this.estimatedTokens += this.estimateTokens(
         typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
@@ -418,7 +447,7 @@ export class ContextManager {
 
   /** Re-estimate tokens from system prompt + current messages. */
   private reEstimateTokens(): void {
-    this.estimatedTokens = this.estimateTokens(this.systemPrompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
     for (const msg of this.messages) {
       this.estimatedTokens += this.estimateTokens(
         typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),

package/src/core/crsi-producer.ts

@@ -13,8 +13,9 @@
 import type { CrsiInsight } from './auto-memory'
 import type { MetaRule } from './meta-rule-engine'
 import type { Llm } from '../providers/llm'
-import { readdirSync, appendFileSync, readFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'
+import { readdirSync, readFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
+import { appendRegularFileSync } from '../shared/regular-file'
 import { miphamHome } from './paths.ts'
 
 /** 教训文件（相对仓库根）。预建，沙箱只能改已存在文件。 */
@@ -538,7 +539,8 @@ export function hasProposedProse(id: string): boolean {
 export function appendProseProposal(record: ProseProposalRecord): void {
   try {
     mkdirSync(miphamHome('crsi'), { recursive: true })
-    appendFileSync(proseLedgerFile(), JSON.stringify(record) + '\n', 'utf-8')
+    // FIFO 路径上「写不进去」与下面的 catch 同级：ledger 非关键，但**不挂**。
+    appendRegularFileSync(proseLedgerFile(), JSON.stringify(record) + '\n')
   } catch {
     // ledger 非关键，失败不影响提议本身
   }

package/src/core/crsi-sandbox.ts

@@ -16,6 +16,7 @@
 
 import { execSync } from 'node:child_process'
 import { mkdirSync, rmSync, existsSync, writeFileSync, readFileSync, readdirSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join, resolve, sep, posix } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
@@ -642,7 +643,7 @@ export class CrsiSandbox {
     // Persist to ~/.mipham/crsi-sandbox/
     const reportPath = join(REPORT_DIR, `${this.sessionReport.sessionId}.json`)
     try {
-      writeFileSync(reportPath, JSON.stringify(this.sessionReport, null, 2), 'utf-8')
+      atomicWriteFileSync(reportPath, JSON.stringify(this.sessionReport, null, 2), { mode: 0o644 })
     } catch {
       // Best-effort persistence
     }

package/src/core/dream-engine.ts

@@ -25,15 +25,8 @@
  *     → Write consolidated memory + generate DreamReport
  */
 
-import {
-  readdirSync,
-  readFileSync,
-  writeFileSync,
-  unlinkSync,
-  existsSync,
-  mkdirSync,
-  statSync,
-} from 'node:fs'
+import { readdirSync, readFileSync, unlinkSync, existsSync, mkdirSync, statSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join } from 'node:path'
 import { miphamHome } from './paths.ts'
 
@@ -320,7 +313,8 @@ export class DreamEngine {
         try {
           const links = secondary.map((s) => `- See also: [[${s.name}]]`).join('\n')
           const updated = primary.content + `\n\n## Related\n${links}`
-          writeFileSync(primary.path, updated, 'utf-8')
+          // 记忆正文：与 memory-manager 同权限语义（用户可读可编辑的内容）。
+          atomicWriteFileSync(primary.path, updated, { mode: 0o644 })
 
           for (const s of secondary) {
             try {
@@ -532,7 +526,7 @@ export class DreamEngine {
       log.unshift({ timestamp, actions })
       // Keep last 10 dream cycles
       if (log.length > 10) log = log.slice(0, 10)
-      writeFileSync(this.dreamLog, JSON.stringify(log, null, 2), 'utf-8')
+      atomicWriteFileSync(this.dreamLog, JSON.stringify(log, null, 2), { mode: 0o644 })
     } catch {
       // Best-effort persistence
     }

package/src/core/engine.ts

@@ -488,10 +488,15 @@ export class QueryEngine {
       try {
         for await (const chunk of this.llmChat({
           model: this.registry.getActiveModel(),
-          messages: [
-            { role: 'system', content: summaryPrompt },
-            { role: 'user', content: text },
-          ],
+          // The instruction goes in `systemPrompt`, **not** as a `system` message
+          // in the array. A system *entry* is a header, and the providers do not
+          // agree on one that arrives inside `messages`: anthropic drops every
+          // system entry (its protocol wants the top-level param, anthropic.ts),
+          // so the array form reached the OpenAI-compatible providers and no one
+          // else — the summarizer's instruction was missing for anthropic users
+          // while it worked here. `systemPrompt` is the one spelling both read.
+          systemPrompt: summaryPrompt,
+          messages: [{ role: 'user', content: text }],
           maxTokens: 2000,
         })) {
           if (chunk.type === 'text' && chunk.content) {

package/src/core/error-signature-db.ts

@@ -14,7 +14,8 @@
  *   PreFlightChecker.check() → ErrorSignatureDB.match()
  */
 
-import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { mkdirSync, readFileSync, existsSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import { miphamHome } from './paths.ts'
@@ -101,7 +102,7 @@ export class ErrorSignatureDB {
     try {
       mkdirSync(join(this.storePath, '..'), { recursive: true })
       const arr = Array.from(this.signatures.values())
-      writeFileSync(this.storePath, JSON.stringify(arr, null, 2), 'utf-8')
+      atomicWriteFileSync(this.storePath, JSON.stringify(arr, null, 2), { mode: 0o644 })
       this.dirty = false
     } catch {
       // Best-effort persistence — never crash on write failure

package/src/core/eval-harness.ts

@@ -13,7 +13,8 @@
 
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { mkdirSync, appendFileSync, readFileSync, existsSync } from 'node:fs'
+import { mkdirSync, readFileSync, existsSync } from 'node:fs'
+import { appendRegularFileSync } from '../shared/regular-file'
 import { ExperienceRuleEngine } from './rule-engine'
 import { ConstitutionLoader, DEFAULT_CONSTITUTION } from './constitution-loader'
 import { ErrorSignatureDB } from './error-signature-db'
@@ -119,7 +120,7 @@ export function appendEvalScore(
 ): void {
   try {
     mkdirSync(miphamHome('crsi'), { recursive: true })
-    appendFileSync(
+    appendRegularFileSync(
       SCORES_FILE,
       JSON.stringify({
         name,
@@ -131,7 +132,6 @@ export function appendEvalScore(
         // 读取侧跳过 —— 这是向后兼容的承重判据，别改成 `results: []`。
         ...(report.results ? { results: report.results.map(toContractResultRecord) } : {}),
       }) + '\n',
-      'utf-8',
     )
   } catch {
     // rewards 日志是非关键的——失败不影响评估本身