@miphamai/cli 0.85.4 → 0.85.6

package/src/core/engine.ts

@@ -43,6 +43,7 @@ import { buildRequest, sendInferenceCheck, isInferenceHookEnabled } from './infe
 import { getFileInboxTransport } from '../agent/cross-session/file-inbox'
 import { registerWakeupHandler } from '../tools/scheduling/schedule-wakeup'
 import { accumulateGraftSavings } from '../shared/graft-savings'
+import { deletedCwdSessionMessage, resolveExistingCwd } from '../shared/deleted-cwd'
 import {
   getMessageBus,
   formatInboundMessage,
@@ -60,6 +61,18 @@ const bundles: Record<string, TranslationMap> = {
 }
 const t = createT(bundles['en-US'] || (enUS as TranslationMap), enUS as TranslationMap)
 
+/**
+ * Tool-calling rounds one **turn** may spend, however it spends them. 20 was too
+ * low for real multi-step tasks — the model hit "max turns" and dropped pending
+ * tools mid-task. 100 stays bounded.
+ *
+ * A budget for the turn, not for one loop: a blocking Stop hook buys another round
+ * out of the same pool. The earlier shape re-granted a fresh 100 per loop
+ * invocation, so the cap bounded no turn at all — a hook that always asked for more
+ * kept the turn running until the process died.
+ */
+const MAX_TOOL_TURNS = 100
+
 /**
  * Drop inbound messages whose timestamp is older than the dialog-expiry TTL.
  * A stale message's approval dialog is no longer relevant, so it's discarded
@@ -296,7 +309,7 @@ export class QueryEngine {
     let injected = 0
     for (const recipient of recipients) {
       for (const msg of bus.poll(recipient)) {
-        this.context.addMessage({ role: 'user', content: formatInboundMessage(msg) })
+        this.context.injectContext(`agent:${msg.from}`, formatInboundMessage(msg))
         injected++
       }
       bus.markAllRead(recipient)
@@ -389,7 +402,7 @@ export class QueryEngine {
     const files = Array.from(this.touchedFiles)
     const block = this.rulesLoader.buildContextBlock(files)
     if (!block) return
-    this.context.addMessage({ role: 'user', content: block })
+    this.context.injectContext('rules', block)
     this.touchedFiles.clear()
   }
 
@@ -789,14 +802,15 @@ export class QueryEngine {
       yield chunk
     }
 
-    // If tools were executed, recursively continue the conversation
+    // If tools were executed, recursively continue the conversation — with what
+    // is left of the turn's budget after the round just spent here.
     if (toolUses.length > 0) {
-      yield* this.continueWithTools(signal)
+      yield* this.continueWithTools(signal, MAX_TOOL_TURNS - 1)
       return
     }
 
     // Fire Stop hooks when AI finishes with no tool calls
-    yield* this.checkStopHook(signal)
+    yield* this.checkStopHook(signal, MAX_TOOL_TURNS - 1)
 
     // Final drain of task notifications
     for (const chunk of this.drainTaskNotifications()) {
@@ -883,17 +897,17 @@ export class QueryEngine {
     }
   }
 
-  private async *continueWithTools(signal?: AbortSignal): AsyncGenerator<StreamChunk> {
-    // Tool-calling round cap. 20 was too low for real multi-step tasks — the model
-    // hit "max turns" and dropped pending tools mid-task. 100 stays bounded.
-    const MAX_TURNS = 100
+  private async *continueWithTools(
+    signal?: AbortSignal,
+    roundsLeft: number = MAX_TOOL_TURNS,
+  ): AsyncGenerator<StreamChunk> {
     // Task-level stall guard: a turn that produces no text or tool result for
     // this long is considered stalled and stopped (prevents ~40-min idle spins).
     const TURN_TIMEOUT_MS = 15 * 60 * 1000
     let lastActivity = Date.now()
     const toolDefs = this.getToolDefinitions()
 
-    for (let turn = 0; turn < MAX_TURNS; turn++) {
+    for (let turn = 0; turn < roundsLeft; turn++) {
       if (Date.now() - lastActivity > TURN_TIMEOUT_MS) {
         yield {
           type: 'warning',
@@ -1008,11 +1022,11 @@ export class QueryEngine {
       }
 
       // Safety: when max turns reached with pending tools, ask model to summarize
-      if (turn === MAX_TURNS - 1 && toolUses.length > 0) {
+      if (turn === roundsLeft - 1 && toolUses.length > 0) {
         this.context.addMessage({
           role: 'user',
           content: t('errors.max_tool_turns_warning', {
-            max: String(MAX_TURNS),
+            max: String(MAX_TOOL_TURNS),
             pending: String(toolUses.length),
           }),
         })
@@ -1033,7 +1047,7 @@ export class QueryEngine {
         } catch {
           yield {
             type: 'error',
-            error: t('errors.max_tool_turns', { max: String(MAX_TURNS) }),
+            error: t('errors.max_tool_turns', { max: String(MAX_TOOL_TURNS) }),
           }
         }
         return
@@ -1041,7 +1055,7 @@ export class QueryEngine {
 
       // No more tool calls — fire Stop hook and potentially continue
       if (toolUses.length === 0) {
-        yield* this.checkStopHook(signal)
+        yield* this.checkStopHook(signal, roundsLeft - turn - 1)
         return
       }
 
@@ -1228,8 +1242,24 @@ export class QueryEngine {
     }
 
     try {
+      // Every tool is handed the session's working directory, and that directory
+      // can be deleted while the session runs. Nothing upstream notices: Node
+      // throws from whichever call site touches it first, Bun keeps handing back
+      // the path it cached at startup, and the tool then fails at its first
+      // syscall naming whatever it touched (`spawn /bin/sh ENOENT` blames the
+      // shell). Refuse here, where the reason is still known.
+      const cwd = resolveExistingCwd()
+      if (!cwd) {
+        // Both fields carry the message on purpose: a failed result is projected
+        // as `error || content` (the two tool-result loops and the context log all
+        // read it that way), so guidance parked in `content` alone would be
+        // dropped exactly when it is needed.
+        const reason = deletedCwdSessionMessage()
+        return { success: false, content: reason, error: reason }
+      }
+
       const result = await tool.execute(effectiveParams, {
-        cwd: process.cwd(),
+        cwd,
         sessionId: this.sessionId,
         provider: this.registry.getActive().config.id,
         model: this.registry.getActiveModel(),
@@ -1373,9 +1403,21 @@ export class QueryEngine {
     this.llm = llm
   }
 
-  /** 统一 chat 出口：优先走注入的 Llm 缝，否则回退 registry。 */
+  /**
+   * 统一 chat 出口：优先走注入的 Llm 缝，否则回退 registry。
+   *
+   * 被截断的一轮在这里点名。`truncated` 只有 provider 能判（被上限截断、连接
+   * 被干净地关掉、正常写完，在字节流上是同一个形状），而这里是**每一处消费
+   * chat 流的地方都必经的唯一出口** —— 转发的循环有两个（`process` 与
+   * `continueWithTools`），各自补一次正是「两条渲染路径只接一条」的老毛病。
+   */
   private async *llmChat(req: ChatRequest): AsyncGenerator<StreamChunk> {
-    yield* (this.llm ?? this.registry).chat(req)
+    for await (const chunk of (this.llm ?? this.registry).chat(req)) {
+      if (chunk.type === 'stop' && chunk.truncated) {
+        yield { type: 'warning', content: t('errors.turn_truncated') }
+      }
+      yield chunk
+    }
   }
 
   /**
@@ -1494,13 +1536,15 @@ export class QueryEngine {
         : t('errors.tool_denied_classifier', { name, reason })
     }
 
-    const { reason, rulePattern } = this.permission.explainDenial(tool, params)
+    const { reason, rulePattern, target } = this.permission.explainDenial(tool, params)
     const mode = this.permission.getMode()
     switch (reason) {
       case 'deny-rule':
         return t('errors.tool_denied_deny_rule', { name, pattern: rulePattern ?? '?' })
       case 'ask-rule':
         return t('errors.tool_denied_ask_rule', { name, pattern: rulePattern ?? '?' })
+      case 'dangerous-rm':
+        return t('errors.tool_denied_dangerous_rm', { name, target: target ?? '?' })
       default:
         // mode-baseline / tool-default / legacy-rule / system-default — a mode
         // switch (or /permissions) resolves it.
@@ -1685,10 +1729,10 @@ export class QueryEngine {
     if (this.hookEngine) {
       const preResult = await this.hookEngine.executePreCompact(this.sessionId)
       if (preResult.additionalContext) {
-        this.context.addMessage({
-          role: 'user',
-          content: `[Pre-compact context]: ${preResult.additionalContext}`,
-        })
+        this.context.injectContext(
+          'pre-compact',
+          `[Pre-compact context]: ${preResult.additionalContext}`,
+        )
       }
     }
 
@@ -1697,29 +1741,46 @@ export class QueryEngine {
     if (this.hookEngine) {
       const postResult = await this.hookEngine.executePostCompact(this.sessionId)
       if (postResult.additionalContext) {
-        this.context.addMessage({
-          role: 'user',
-          content: `[Post-compact context]: ${postResult.additionalContext}`,
-        })
+        this.context.injectContext(
+          'post-compact',
+          `[Post-compact context]: ${postResult.additionalContext}`,
+        )
       }
     }
   }
 
   /** Fire Stop hook. If blocked, feed the reason back to the AI and continue. */
-  private async *checkStopHook(signal?: AbortSignal): AsyncGenerator<StreamChunk> {
+  private async *checkStopHook(
+    signal?: AbortSignal,
+    roundsLeft: number = MAX_TOOL_TURNS,
+  ): AsyncGenerator<StreamChunk> {
     if (!this.hookEngine) return
 
     const stopResult = await this.hookEngine.executeStop(this.sessionId)
-    if (stopResult.decision === 'block') {
-      // Feed the block reason back to the AI and continue
-      this.context.addMessage({
-        role: 'user',
-        content: t('system.context.stop_blocked', {
+    if (stopResult.decision !== 'block') return
+
+    // A block asks for more work, and more work means another round — which the
+    // turn may have none of left. Saying so is the point: a hook quietly ignored
+    // is worse than one told it has been overruled.
+    if (roundsLeft <= 0) {
+      yield {
+        type: 'warning',
+        content: t('errors.stop_hook_budget_spent', {
+          max: String(MAX_TOOL_TURNS),
           reason: stopResult.reason || 'Continue working.',
         }),
-      })
-      yield* this.continueWithTools(signal)
+      }
+      return
     }
+
+    // Feed the block reason back to the AI and continue
+    this.context.injectContext(
+      'stop-hook',
+      t('system.context.stop_blocked', {
+        reason: stopResult.reason || 'Continue working.',
+      }),
+    )
+    yield* this.continueWithTools(signal, roundsLeft)
   }
 }
 

package/src/core/error-signature-db.ts

@@ -87,8 +87,13 @@ export class ErrorSignatureDB {
     try {
       if (!existsSync(this.storePath)) return
       const raw = readFileSync(this.storePath, 'utf-8')
-      const arr: ErrorSignature[] = JSON.parse(raw)
-      for (const sig of arr) {
+      const parsed: unknown = JSON.parse(raw)
+      // 形状门：`["x"]` 是合法 JSON、`for…of` 也照收 —— `sig.id` 是 `undefined`，
+      // 于是库里躺着一个**没有 id 的成员**（后面 `get(id)` 永远找不到它，
+      // 而 `getStats()` 的分母把它算进去）。形状不验 = 垃圾静默入库。
+      if (!Array.isArray(parsed)) return
+      for (const sig of parsed) {
+        if (!sig || typeof sig !== 'object' || typeof sig.id !== 'string') continue
         this.signatures.set(sig.id, sig)
       }
     } catch {

package/src/core/hooks-executor.ts

@@ -1,4 +1,6 @@
 import { spawnSync } from 'node:child_process'
+import { McpClient } from '../mcp/client'
+import type { ToolCallResult } from '../mcp/types'
 import type { HookConfig, HookContext, HookResult } from '../shared/index.ts'
 
 /**
@@ -7,13 +9,17 @@ import type { HookConfig, HookContext, HookResult } from '../shared/index.ts'
  * Supported types:
  * - command: Execute a shell command. Exit code 0 = allow, 2 = block with stderr as reason.
  * - http: POST to a URL, response body becomes additionalContext.
- * - mcp_tool: Call an MCP tool (delegates to MCP client -- stub for now).
+ * - mcp_tool: Call the MCP tool the hook names; its answer is read as the hook's.
  * - code: No-op (handled inline by the handler function directly).
  */
-export async function executeHook(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
+export async function executeHook(
+  cfg: HookConfig,
+  ctx: HookContext,
+  source?: string,
+): Promise<HookResult> {
   switch (cfg.type) {
     case 'command':
-      return executeCommand(cfg, ctx)
+      return executeCommand(cfg, ctx, source)
     case 'http':
       return executeHttp(cfg, ctx)
     case 'mcp_tool':
@@ -155,7 +161,26 @@ function spawnFailureCause(
   return null
 }
 
-async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
+/**
+ * The handle a failure message points the operator at: the command, and — when the
+ * hook came from a plugin rather than from the operator's own settings — who
+ * declared it.
+ *
+ * The command alone does not answer "which plugin do I look at". A plugin hook is
+ * typically `sh`, `node`, or a path under the plugin's root; none of those is a
+ * name the operator can search for. Two arguments rather than a pre-joined string
+ * because the parentheses and the `from` clause have to stay one decision: a
+ * caller that built half the label would be free to print `from "undefined"`.
+ */
+function failingLabel(command: string | undefined, source?: string): string {
+  return `(${command})${source ? ` from "${source}"` : ''}`
+}
+
+async function executeCommand(
+  cfg: HookConfig,
+  ctx: HookContext,
+  source?: string,
+): Promise<HookResult> {
   if (!cfg.command) return { allowed: true }
 
   try {
@@ -220,14 +245,14 @@ async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookRe
     if (failure) {
       return {
         allowed: true,
-        additionalContext: `Hook error (${cfg.command}): ${failure}`,
+        additionalContext: `Hook error ${failingLabel(cfg.command, source)}: ${failure}`,
       }
     }
 
     // Other non-zero exit: don't block, log the error as context
     return {
       allowed: true,
-      additionalContext: `Hook warning (${cfg.command}): ${stderr.trim()}`,
+      additionalContext: `Hook warning ${failingLabel(cfg.command, source)}: ${stderr.trim()}`,
     }
   } catch (err) {
     // Only reached when `spawnSync` itself throws — masking-policy load, env
@@ -237,7 +262,7 @@ async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookRe
 
     return {
       allowed: true,
-      additionalContext: `Hook error (${cfg.command}): ${message}`,
+      additionalContext: `Hook error ${failingLabel(cfg.command, source)}: ${message}`,
     }
   }
 }
@@ -282,8 +307,60 @@ async function executeHttp(cfg: HookConfig, ctx: HookContext): Promise<HookResul
   }
 }
 
-async function executeMcpTool(_cfg: HookConfig, _ctx: HookContext): Promise<HookResult> {
-  // Stub: MCP tool hook execution requires MCP client integration.
-  // For now, return allow to not block execution.
-  return { allowed: true }
+/**
+ * An `mcp_tool` hook: call the tool the hook names, and read its answer as the
+ * hook's own.
+ *
+ * The answer is read by the same contract a command hook's stdout follows — a
+ * structured decision decides, plain prose is context — so a tool that guards a
+ * tool call can block it the way a script would. An `isError` result is *not* a
+ * decision: it means the call did not speak, and an unreachable server reports
+ * the same way, so its message is reported rather than read as a verdict.
+ */
+async function executeMcpTool(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
+  if (!cfg.mcpServer || !cfg.mcpTool) return { allowed: true }
+
+  const client = McpClient.getInstance()
+
+  // Startup connects servers without blocking; this hook can arrive first.
+  if (!(await client.waitUntilReady(cfg.mcpServer))) {
+    return {
+      allowed: true,
+      additionalContext: `MCP hook (${cfg.mcpServer}/${cfg.mcpTool}): server "${cfg.mcpServer}" was still connecting — the tool was not called.`,
+    }
+  }
+
+  const result = await client.callTool(cfg.mcpServer, cfg.mcpTool, {
+    event: ctx.event,
+    toolName: ctx.toolName,
+    toolInput: ctx.toolInput,
+    sessionId: ctx.sessionId,
+  })
+  const body = mcpResultText(result)
+
+  if (result.isError) {
+    return {
+      allowed: true,
+      additionalContext: `MCP hook error (${cfg.mcpServer}/${cfg.mcpTool}): ${body.slice(0, 2000)}`,
+    }
+  }
+
+  const parsed = parseHookStdout(body, ctx)
+  const decided =
+    !parsed.allowed ||
+    parsed.additionalContext !== undefined ||
+    parsed.permissionDecision !== undefined ||
+    parsed.modifiedInput !== undefined
+
+  // Nothing in the hook contract matched, so the tool answered in prose: that
+  // answer is the context this hook contributes, not a silent no-op.
+  return decided ? parsed : { allowed: true, additionalContext: body.slice(0, 2000) || undefined }
+}
+
+/** The text an MCP tool call returned; non-text parts carry no message for a hook. */
+function mcpResultText(result: ToolCallResult): string {
+  return result.content
+    .map((part) => part.text ?? '')
+    .filter(Boolean)
+    .join('\n')
 }

package/src/core/hooks.ts

@@ -70,6 +70,18 @@ export class HookEngine {
     )
   }
 
+  /**
+   * Remove every hook a given source declared, and nothing else.
+   *
+   * `unregister(event)` matches on the event alone, so a caller that wanted to undo
+   * its own registrations took down every hook on those events — the operator's own
+   * from settings, and other plugins'. Scoping by source is the only removal that
+   * answers the question the caller is actually asking.
+   */
+  unregisterSource(source: string): void {
+    this.hooks = this.hooks.filter((h) => h.source !== source)
+  }
+
   // ── Existing event executors ──
 
   async executePreToolUse(
@@ -217,9 +229,21 @@ export class HookEngine {
 
   // ── Health & Resilience ──
 
-  /** Get a hook health key for tracking. */
+  /**
+   * Get a hook health key for tracking.
+   *
+   * Health is per hook, and the key is what says which hook. It was the event (plus
+   * the tool name), which is a *class* of hooks rather than one of them: two hooks
+   * on the same event shared one failure counter and one disabled flag, so five
+   * failures from a plugin's broken hook could auto-disable an unrelated hook that
+   * had never failed. The source is what makes the key name one hook.
+   *
+   * A hook with no source keeps the string it has always had — `/hooks enable`
+   * takes these keys, and a key for a hook that has no plugin must not renumber.
+   */
   private healthKey(hook: HookDefinition): string {
-    return hook.toolName ? `${hook.event}:${hook.toolName}` : hook.event
+    const base = hook.toolName ? `${hook.event}:${hook.toolName}` : hook.event
+    return hook.source ? `${hook.source}:${base}` : base
   }
 
   /** Check if a hook should be skipped due to repeated failures. */

package/src/core/instructions.ts

@@ -156,12 +156,86 @@ export function buildPermissionBlock(mode: string): string {
   return `## Permission Context\n\n${description}\n\nWhen a tool is denied, do NOT retry it or any other approval-gated tool — Bash, WebSearch, network, and Workflow are all blocked in this mode.${escape} If the task genuinely needs a blocked tool, STOP retrying and ask the user to switch modes with Shift+Tab or add an allow rule (/permissions), then wait for the user's answer. Note that Shift+Tab's wheel does not reach bypassPermissions — that mode is set in config, so do not offer it as a keypress.`
 }
 
+/** Level label used in each prompt part's provenance comment. */
+const LEVEL_LABELS: Record<string, string> = {
+  group: 'Group Policy',
+  company: 'Company Policy',
+  project: 'Project Rules',
+  directory: 'Directory Rules',
+  user: 'User Preferences',
+}
+
+/**
+ * The text one loaded file contributes to the system prompt — `prompt-exclude`
+ * sections stripped, `privacy: private` files omitted (`null`).
+ *
+ * Single source for the prompt **and** the size report. A report that measured
+ * the file on disk instead would overcount exactly the files this repository
+ * writes (its own `prompt-exclude` hides tens of thousands of characters), and
+ * the two numbers would drift apart with nothing saying which one is sent.
+ */
+function instructionPartText(inst: InstructionFile): string | null {
+  if (inst.privacy === 'private') return null
+  const content = stripSections(
+    inst.content,
+    parsePromptExclude(inst.frontmatter['prompt-exclude']),
+  )
+  return `<!-- ${LEVEL_LABELS[inst.level] || inst.level} (${inst.path}) -->\n${content}`
+}
+
+/** One file's share of the instruction payload. */
+export interface InstructionSize {
+  path: string
+  chars: number
+}
+
+export interface InstructionSizeReport {
+  totalChars: number
+  /** Descending by size — the largest contributor first. */
+  files: InstructionSize[]
+}
+
+/**
+ * Characters of file-derived instruction text a session sends with **every**
+ * request, before the conversation starts. 40,000 is the budget this
+ * organisation already writes a single governance file against (the parent
+ * `CLAUDE.md`), so the notice fires when everything loaded together has grown
+ * past one such file.
+ */
+export const INSTRUCTION_BUDGET_CHARS = 40_000
+
+/**
+ * The startup notice, or `null` while the payload is within budget.
+ *
+ * The **total** is the point: no file has to be large for the instruction
+ * payload to crowd out the work, so a per-file check cannot see a dozen
+ * mid-sized rule files and a lessons block adding up. Naming the largest few
+ * is what makes the number actionable.
+ */
+export function formatInstructionSizeNotice(
+  report: InstructionSizeReport,
+  budget: number = INSTRUCTION_BUDGET_CHARS,
+): string | null {
+  if (report.totalChars <= budget) return null
+  const num = (n: number) => n.toLocaleString('en-US')
+  const shown = report.files.slice(0, 3).map((f) => `${f.path} — ${num(f.chars)}`)
+  if (report.files.length > shown.length) shown.push(`+${report.files.length - shown.length} more`)
+  return (
+    `⚠ Instruction files total ${num(report.totalChars)} characters (budget ${num(budget)}), ` +
+    `sent with every request.\n` +
+    `   Largest: ${shown.join(' · ')}\n` +
+    `   Trim them, or move doc-only sections under a \`prompt-exclude\` frontmatter key.`
+  )
+}
+
 export class InstructionsLoader {
   private instructions: InstructionFile[] = []
   private crsiLessonSummaries: CrsiLessonSummary[] = []
+  private lessonsPath: string | null = null
 
   loadAll(cwd: string): void {
     this.instructions = []
+    this.lessonsPath = null
     const root = gitRoot(cwd)
 
     // Tier 1: 集团/公司策略（锚定仓库根，从任意子目录启动都正确；不读 AGENTS.md）
@@ -198,23 +272,12 @@ export class InstructionsLoader {
     const parts: string[] = []
 
     for (const inst of this.instructions) {
-      // Honor `privacy: private` — such instructions are never sent to the model.
-      if (inst.privacy === 'private') continue
-
-      const levelLabel: Record<string, string> = {
-        group: 'Group Policy',
-        company: 'Company Policy',
-        project: 'Project Rules',
-        directory: 'Directory Rules',
-        user: 'User Preferences',
-      }
-      // Strip doc-only sections declared via `prompt-exclude` frontmatter
+      // `instructionPartText` honors `privacy: private` (never sent) and strips
+      // doc-only sections declared via `prompt-exclude` frontmatter
       // (changelog/roadmap/catalog are human-facing, not machine rules).
-      const content = stripSections(
-        inst.content,
-        parsePromptExclude(inst.frontmatter['prompt-exclude']),
-      )
-      parts.push(`<!-- ${levelLabel[inst.level] || inst.level} (${inst.path}) -->\n${content}`)
+      const text = instructionPartText(inst)
+      if (text === null) continue
+      parts.push(text)
     }
 
     // P2-2 的权限段**不在**这里 —— 见 `buildPermissionBlock` 与
@@ -371,8 +434,11 @@ Never omit it or present the work as purely human-authored.`)
 
   /** 读 crsi-lessons.md（按仓库根定位）提取教训精华。读不到则返回空。 */
   private loadCrsiLessons(root: string): CrsiLessonSummary[] {
+    const path = join(root, LESSONS_FILE)
     try {
-      const content = readFileSync(join(root, LESSONS_FILE), 'utf-8')
+      const content = readFileSync(path, 'utf-8')
+      // Remember where the recalled text came from — `sizeReport` names it.
+      this.lessonsPath = path
       return extractCrsiLessonSummaries(content)
     } catch {
       return []
@@ -392,6 +458,28 @@ Never omit it or present the work as purely human-authored.`)
     return [...this.instructions]
   }
 
+  /**
+   * How much instruction text this loader puts in the system prompt, per file.
+   *
+   * Read through `instructionPartText` — the same projection `buildSystemPrompt`
+   * uses — so the report cannot describe something other than what is sent. The
+   * CRSI lessons block counts too: it is rendered from `crsi-lessons.md` and
+   * carried on every request like any other rule file.
+   */
+  sizeReport(): InstructionSizeReport {
+    const files: InstructionSize[] = []
+    for (const inst of this.instructions) {
+      const text = instructionPartText(inst)
+      if (text !== null) files.push({ path: inst.path, chars: text.length })
+    }
+    if (this.lessonsPath) {
+      const lessons = buildCrsiLessonsBlock(this.crsiLessonSummaries)
+      if (lessons) files.push({ path: this.lessonsPath, chars: lessons.length })
+    }
+    files.sort((a, b) => b.chars - a.chars)
+    return { totalChars: files.reduce((n, f) => n + f.chars, 0), files }
+  }
+
   private tryLoad(path: string, level: InstructionFile['level']): void {
     if (!existsSync(path)) return
 

package/src/core/memory/memory-manager.ts

@@ -546,9 +546,13 @@ export class MemoryManager {
     const path = join(this.memoryDir, LINKS_FILE)
     if (!existsSync(path)) return false
     try {
-      const raw = JSON.parse(readFileSync(path, 'utf-8'))
+      const raw: unknown = JSON.parse(readFileSync(path, 'utf-8'))
+      // 形状门：值必须是**字符串数组**。`new Set("bc")` 会**按字符**迭代 ⇒ 一条链接被
+      // 拆成 'b'、'c' 两条（而 `as string[]` 让 TS 一声不吭）。对象/数组本身也过了门才用。
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return false
       for (const [k, v] of Object.entries(raw)) {
-        this.linkGraph.set(k, new Set(v as string[]))
+        if (!Array.isArray(v)) continue
+        this.linkGraph.set(k, new Set(v.filter((x): x is string => typeof x === 'string')))
       }
       return this.linkGraph.size > 0
     } catch {
@@ -587,12 +591,16 @@ export class MemoryManager {
     const path = join(this.memoryDir, RECALL_STATS_FILE)
     if (!existsSync(path)) return
     try {
-      const raw = JSON.parse(readFileSync(path, 'utf-8'))
+      const raw: unknown = JSON.parse(readFileSync(path, 'utf-8'))
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return
       for (const [k, v] of Object.entries(raw)) {
-        const rec = v as { recallCount?: number; lastRecalledAt?: string }
+        // 逐条门控（不是整表退回）：`catch` 在循环外，一个坏条目会把**后面所有**条目
+        // 一起带走 —— 一条脏记录赔上整份召回统计。
+        if (!v || typeof v !== 'object' || Array.isArray(v)) continue
+        const rec = v as { recallCount?: unknown; lastRecalledAt?: unknown }
         this.recallStats.set(k, {
-          recallCount: rec.recallCount ?? 0,
-          lastRecalledAt: rec.lastRecalledAt ?? '',
+          recallCount: typeof rec.recallCount === 'number' ? rec.recallCount : 0,
+          lastRecalledAt: typeof rec.lastRecalledAt === 'string' ? rec.lastRecalledAt : '',
         })
       }
     } catch {