@miphamai/cli 0.85.5 → 0.85.7

package/bin/mipham.ts

@@ -293,13 +293,26 @@ async function runUpdate(): Promise<boolean> {
   if (!result.ok) {
     console.log()
     console.log(`✗ Update failed: ${result.reason ?? 'unknown error'}`)
-    if (result.rolledBack) {
-      console.log(
-        `  Your previous install (v${currentVersion}) has been restored — mipham still works.`,
-      )
-    } else {
-      console.log('  ⚠ The previous install could not be restored.')
-      console.log(`    Reinstall with: npm install -g ${PACKAGE}@${currentVersion}`)
+    // 这句必须只说**我们知道的**：staging 之后最常见的失败（装在旁边那步挂了）压根没碰过
+    // 旧树，此时沿用「未能恢复」就是在讲一件没发生的事。
+    switch (result.installState) {
+      case 'untouched':
+        console.log(
+          `  Your previous install (v${currentVersion}) was not touched — mipham still works.`,
+        )
+        break
+      case 'restored':
+        console.log(
+          `  Your previous install (v${currentVersion}) has been restored — mipham still works.`,
+        )
+        break
+      case 'unknown':
+        console.log('  ⚠ Could not locate the global install path — unable to tell.')
+        console.log(`    Check with: mipham --version`)
+        break
+      default:
+        console.log('  ⚠ The previous install could not be restored.')
+        console.log(`    Reinstall with: npm install -g ${PACKAGE}@${currentVersion}`)
     }
     if (backupPath && existsSync(backupPath)) {
       console.log(`  Your config backup is at: ${backupPath}`)
@@ -1249,6 +1262,8 @@ Flags:
   --resume <name>            Open a saved session (see /resume for names)
   --permission <mode>        Start in this mode: ${ALL_MODES.join('|')}
                              (also accepted by 'mipham attach'; the daemon may clamp it)
+  --provider <id>            Start on this provider (overrides config.yml)
+  --model <id>               Start on this model (overrides config.yml)
   --version, -v, -V          Print version
 
 Docs: https://mipham.ai/code
@@ -1384,12 +1399,38 @@ npm:  https://www.npmjs.com/package/@miphamai/cli`)
     process.exit(1)
   }
 
+  // Parse --provider <id> / --model <id>: the provider and model the session starts
+  // on. Same shape as `--resume`/`--permission` — `RunOptions` declared both fields all
+  // along, `index.tsx` already reads them *ahead of* the merged config, and **nothing
+  // ever passed them**. That third instance cost more than the first two: both shipped
+  // IDE integrations build this exact command from their settings
+  // (`infrastructure/vscode/extension.js` `buildFlags()`, `MiphamAction.kt`
+  // `buildCommand()`), so a user who set a provider there got
+  // `Unknown command: mipham deepseek` and no CLI at all. Their values are open — a
+  // provider may be user-defined — so the value is forwarded as typed and an unknown id
+  // is refused by the registry (`ProviderRegistry.getActive()` throws with the id named),
+  // exactly as the same value already was when it came from `config.yml`.
+  const flagValue = (name: string): string | undefined => {
+    const at = process.argv.indexOf(name)
+    if (at === -1) return undefined
+    const value = process.argv[at + 1]
+    if (!value || value.startsWith('-')) {
+      console.error(`Usage: mipham ${name} <id>`)
+      process.exit(1)
+    }
+    return value
+  }
+  const providerFlag = flagValue('--provider')
+  const modelFlag = flagValue('--model')
+
   try {
     const { runApp } = await import('../src/index')
     await runApp({
       version: APP_VERSION,
       resume: resumeName,
       permission: permissionFlag.kind === 'ok' ? permissionFlag.mode : undefined,
+      provider: providerFlag,
+      model: modelFlag,
     })
   } catch (err: unknown) {
     const msg = err instanceof Error ? err.message : String(err)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.85.5",
+  "version": "0.85.7",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",
@@ -40,7 +40,7 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "knip": "knip --production --no-progress --no-exit-code",
-    "coverage": "vitest run --coverage",
+    "coverage": "vitest run --coverage --reporter=default --reporter=json --outputFile.json=coverage/vitest-report.json",
     "mutate": "stryker run"
   },
   "dependencies": {

package/src/agent/agent-context.ts

@@ -13,6 +13,13 @@ import { MIPHAM_DIR } from '../shared/constants.ts'
 export interface AgentContextResult {
   context: ContextManager
   allowedTools: ToolDefinition[]
+  /**
+   * 组装好的系统提示（**含** agent memory）。
+   *
+   * 必须由这里交出去、而不是让调用方自己再拼一份：memory 的拼接规则只此一处，调用方
+   * 拿不到它就等于重新推导一遍（漏掉的那一遍正是缺陷本身 —— 请求里从来没有记忆）。
+   */
+  systemPrompt: string
 }
 
 /**
@@ -145,5 +152,5 @@ export function createAgentContext(
     allowedTools = allowedTools.filter((t) => !denySet.has(t.name))
   }
 
-  return { context, allowedTools }
+  return { context, allowedTools, systemPrompt }
 }

package/src/agent/effectiveness-tracker.ts

@@ -181,8 +181,22 @@ export class EffectivenessTracker {
   load(): void {
     if (!existsSync(this.storePath)) return
     try {
-      const raw = JSON.parse(readFileSync(this.storePath, 'utf-8'))
-      this.data = new Map(Object.entries(raw))
+      const parsed: unknown = JSON.parse(readFileSync(this.storePath, 'utf-8'))
+      // 形状门：要的是「**以规则 id 为键的对象**」。`Object.entries` 对数组会拿**下标**
+      // 当键（`{"0":"x"}` ⇒ 一条 ruleId 为 undefined 的记录），而 `new Map(...)` 照收，
+      // 于是 `allRules` 把非规则对象当规则报出去。
+      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        this.data = new Map()
+        return
+      }
+      const data = new Map<string, RuleEffectiveness>()
+      for (const [k, v] of Object.entries(parsed)) {
+        if (!v || typeof v !== 'object' || Array.isArray(v)) continue
+        const rec = v as { ruleId?: unknown }
+        if (typeof rec.ruleId !== 'string') continue
+        data.set(k, v as RuleEffectiveness)
+      }
+      this.data = data
     } catch {
       // Corrupt file — start fresh
       this.data = new Map()

package/src/agent/sub-agent.ts

@@ -339,23 +339,31 @@ export class SubAgent {
     }
 
     // Create isolated context with tool scoping, sized to the resolved model.
-    const resolvedDef: AgentDefinition = agentDef || {
-      name: agentType,
-      description: '',
-      systemPrompt,
-      model: options.modelOverride || 'inherit',
-      permissionMode: 'inherit',
-      background: false,
-      source: 'builtin',
-    }
+    // `systemPrompt` 是运行时**解析出来的那一份**（定义 > 调用方传入 > 内建类型），
+    // 定义自己没写时就落到解析结果上 —— 否则 `createAgentContext()` 拿到的是空串，
+    // 记忆会拼在一个空的基座上。
+    const resolvedDef: AgentDefinition = agentDef
+      ? { ...agentDef, systemPrompt: agentDef.systemPrompt || systemPrompt }
+      : {
+          name: agentType,
+          description: '',
+          systemPrompt,
+          model: options.modelOverride || 'inherit',
+          permissionMode: 'inherit',
+          background: false,
+          source: 'builtin',
+        }
     const contextWindow = this.registry.findModel(finalModel)?.contextWindow
-    const { context, allowedTools } = createAgentContext(
-      resolvedDef,
-      this.toolRegistry,
-      contextWindow,
-    )
+    // 这一份**已含 agent memory**，是发出去的那个提示的唯一来源。
+    const {
+      context,
+      allowedTools,
+      systemPrompt: composedSystemPrompt,
+    } = createAgentContext(resolvedDef, this.toolRegistry, contextWindow)
 
-    context.setSystemPrompt(systemPrompt)
+    // 别再 `context.setSystemPrompt(systemPrompt)`：`createAgentContext` 已经拿**含记忆**的
+    // 那一份设过上下文，这里用裸提示再设一遍只会把记忆从上下文里抹掉，而请求读的又不是
+    // 上下文 —— 两处各设一次的结果是「上下文里没有、请求里也没有」。
 
     // Seed inherited parent conversation (fork inheritance) as a byte-identical
     // prefix so the provider prompt cache is reused.
@@ -405,8 +413,8 @@ export class SubAgent {
     // 权限段随**唯一**带提示的那一轮走，而不是每轮派生。
     const permissionBlock = buildPermissionBlock(gate.getMode())
     let currentSystemPrompt = permissionBlock
-      ? `${systemPrompt}\n\n---\n\n${permissionBlock}`
-      : systemPrompt
+      ? `${composedSystemPrompt}\n\n---\n\n${permissionBlock}`
+      : composedSystemPrompt
     let totalTokens = 0
 
     // Context for the sub-agent's own tool calls. Built once per run: the caller's

package/src/agent-view/dashboard.tsx

@@ -31,6 +31,13 @@ const STATUS_HEADERS: Record<string, { label: string; color: string }> = {
 }
 
 export function AgentViewDashboard({ manager, onAttach, onExit }: DashboardProps) {
+  // 这里**刻意**不迁 `useKeyState`（picker / config-wizard / command-picker 都迁了）。
+  // 那些地方的病是「一次刷进来的按键作用在上一拍的行上」，而 Ink 只在 chunk **以转义
+  // 序列打头**时才把它拆成多个事件 —— 所以能撞上的是方向键（`\x1b[B` + `\r` 拆成两拍）。
+  // 本面板的键全是普通字符（j / k / space / Enter / Ctrl+X / Ctrl+R / Ctrl+T），一起到达
+  // 时会**合并成一个**事件（实测 `'j\r'` → 单个 `input="j\r"`、`key.return` 为 false），
+  // 两个分支都不匹配 ⇒ 症状是「这一拍什么也没发生」，不是「作用在上一行」。
+  // 换句话说这一格没有可复现的故障，迁过去只会让测试**改前改后都绿**。
   const [selectedIndex, setSelectedIndex] = useState(0)
   const [peekingSessionId, setPeekingSessionId] = useState<string | null>(null)
   const [groupBy, setGroupBy] = useState<'status' | 'directory'>('status')

package/src/core/autocomplete.ts

@@ -7,16 +7,39 @@ export const AUTOCOMPLETE_SYSTEM_PROMPT =
 /** 带上最近几条对话（含待续写输入），供续写贴合上下文。 */
 export const AUTOCOMPLETE_MAX_CONTEXT = 6
 
+/**
+ * 每条上下文消息最多带这么多**字符**（保留尾部）。
+ *
+ * 上面那个常数限的是**条数**，而一条 `content` 可以任意长 —— 贴进来一个文件、
+ * 或一条长回复，6 条就是上万 token，而用户每次 >400ms 的停顿都要买一次。
+ * 续写要看的是「刚说到哪儿」，所以砍头留尾；加 `…` 是免得把片段读成消息开头。
+ * 每条封顶 + 条数封顶，总量就是封死的，不需要再维护第二个预算常数。
+ */
+export const AUTOCOMPLETE_MAX_CHARS_PER_MESSAGE = 2000
+
 export interface RecentMessage {
   role: 'user' | 'assistant'
   content: string
 }
 
-/** 拼续写请求：systemPrompt + 最近 N 条 + 当前输入作为待续写消息。 */
+function tailOf(content: string): string {
+  return content.length <= AUTOCOMPLETE_MAX_CHARS_PER_MESSAGE
+    ? content
+    : '…' + content.slice(-AUTOCOMPLETE_MAX_CHARS_PER_MESSAGE)
+}
+
+/** 拼续写请求：systemPrompt + 最近 N 条（每条限长）+ 当前输入作为待续写消息。 */
 export function buildAutocompleteRequest(recent: RecentMessage[], input: string): ChatRequest {
   return {
     model: '', // falsy → registry 回退 active model
-    messages: [...recent.slice(-AUTOCOMPLETE_MAX_CONTEXT), { role: 'user', content: input }],
+    // 待续写的当前输入**不截断**：它是被续写的那条本身，且 extractCompletion 的
+    // 判据依赖它的完整值。上限落在历史消息上。
+    messages: [
+      ...recent
+        .slice(-AUTOCOMPLETE_MAX_CONTEXT)
+        .map((m) => ({ role: m.role, content: tailOf(m.content) })),
+      { role: 'user', content: input },
+    ],
     systemPrompt: AUTOCOMPLETE_SYSTEM_PROMPT,
     temperature: 0,
     maxTokens: 64,
@@ -57,6 +80,11 @@ export async function requestSuggestion(
   const req = buildAutocompleteRequest(recent, input)
   let text = ''
   for await (const chunk of llm.chat(req)) {
+    // 用户又敲了一下 ⇒ 这条请求已经过期，当场走人。`break` 不只是「不再读」：
+    // 它触发生成器的 `.return()` ⇒ provider 的 `finally` ⇒ `reader.cancel()`，
+    // 连接当场释放。若把这一判挪到循环外，就等于**先把整条流读完**再丢掉结果 ——
+    // 那正是「取消不掉」：每次 >400ms 的停顿都买一个完整 completion。
+    if (isStale()) break
     if (chunk.type === 'text' && chunk.content) text += chunk.content
   }
   if (isStale()) return null

package/src/core/context.ts

@@ -30,7 +30,6 @@ export interface CompactionStats {
 interface Checkpoint {
   id: number
   messages: Message[]
-  estimatedTokens: number
   timestamp: Date
   label: string
 }
@@ -52,7 +51,22 @@ export class ContextManager {
    * 组装时烘进去的话，本次会话里后连上的 server 永远进不了提示 —— 用户只能重启。
    */
   private mcpInstructionsSource: (() => string) | null = null
-  private estimatedTokens = 0
+  /**
+   * **消息那部分**的估值，增量累加（提示那部分见 `promptTokens()`，读时派生）。
+   *
+   * 两份分开是因为它们的变化条件不同：消息只在本类里变（每次 push 顺手加一笔就够了），
+   * 而提示里的两段是**读时闭包**、变点不在这条类里（见上面两个 source 的注释）。
+   * 把两者混在一个累加器里，闭包那半就必然滞后 —— 这正是本类此前的缺陷。
+   */
+  private messageTokens = 0
+  /**
+   * `promptTokens()` 的记忆化。键**就是**那份拼好的提示本身，所以不存在失效问题：
+   * 「键没变而值该变」需要的恰恰是「输入没变而输出该变」，不可能发生。
+   *
+   * 记忆化只是别在每次 `addMessage` 里把同一份四万字符的系统提示重扫一遍
+   * （`checkCompression()` 会读估值，它在每条消息上都被调一次）。
+   */
+  private promptTokensCache: { text: string; tokens: number } | null = null
   private checkpoints: Checkpoint[] = []
   private checkpointCounter = 0
   private summarizer?: Summarizer
@@ -93,7 +107,7 @@ export class ContextManager {
     // 否则「模型看得见的必须已记录」这条不变量当场破），见 `closeInterruptedToolCalls`。
     closeInterruptedToolCalls(log)
     this.messages = deriveMessages(log.events())
-    this.reEstimateTokens()
+    this.recountMessageTokens()
   }
 
   /**
@@ -137,7 +151,13 @@ export class ContextManager {
 
   setSystemPrompt(prompt: string): void {
     this.systemPrompt = prompt
-    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
+    // 这里**故意什么都不算**。提示那部分由 `promptTokens()` 读时派生，消息那部分由
+    // `messageTokens` 自己带着 —— 所以「设提示」这件事对估值**没有可出错的空间**。
+    //
+    // 从前这里要重算一次，且必须记得「重算要含消息」：`--resume` 路径
+    // （`index.tsx:584-585`）先 `restoreLog()` 得出含消息的估值、紧接着设提示，只按
+    // 提示重算就会把它覆盖成偏低值。那是个**要靠注释守住的契约**；现在它不可能被违反
+    // —— 没有任何一条路径能在这里把消息那半丢掉。
   }
 
   /**
@@ -181,7 +201,7 @@ export class ContextManager {
 
   addMessage(msg: Message): void {
     this.messages.push(msg)
-    this.estimatedTokens += this.estimateTokens(
+    this.messageTokens += this.estimateTokens(
       typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
     )
 
@@ -208,7 +228,7 @@ export class ContextManager {
    */
   injectContext(source: string, text: string): void {
     this.messages.push({ role: 'user', content: text })
-    this.estimatedTokens += this.estimateTokens(text)
+    this.messageTokens += this.estimateTokens(text)
 
     if (this.log) {
       this.log.append({ type: 'context/inject', at: Date.now(), source, text })
@@ -237,7 +257,7 @@ export class ContextManager {
       ],
     }
     this.messages.push(msg)
-    this.estimatedTokens += this.estimateTokens(JSON.stringify(msg.content))
+    this.messageTokens += this.estimateTokens(JSON.stringify(msg.content))
     if (this.log) this.log.append({ type: 'tool/result', at: Date.now(), id: toolUseId, result })
     this.checkCompression()
   }
@@ -258,7 +278,7 @@ export class ContextManager {
     if (this.log) {
       for (const m of messages) for (const e of messageToEvents(m, Date.now())) this.log.append(e)
     }
-    this.reEstimateTokens()
+    this.recountMessageTokens()
 
     if (this.log && isAssertModelVisibleDebug()) {
       assertModelVisible(this.log.events(), this.messages)
@@ -270,11 +290,11 @@ export class ContextManager {
   }
 
   needsCompaction(): boolean {
-    return this.estimatedTokens > this.config.maxTokens * this.config.compactionThreshold
+    return this.getEstimatedTokens() > this.config.maxTokens * this.config.compactionThreshold
   }
 
   async compact(heading: string): Promise<{ before: number; after: number }> {
-    const beforeTokens = this.estimatedTokens
+    const beforeTokens = this.getEstimatedTokens()
 
     if (this.messages.length <= 30) {
       return { before: beforeTokens, after: beforeTokens }
@@ -318,26 +338,27 @@ export class ContextManager {
       }
     }
 
-    // Re-estimate tokens
-    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
-    for (const msg of this.messages) {
-      this.estimatedTokens += this.estimateTokens(
-        typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
-      )
-    }
+    // Re-estimate the message half (the prompt half is derived on read).
+    this.recountMessageTokens()
 
-    return { before: beforeTokens, after: this.estimatedTokens }
+    return { before: beforeTokens, after: this.getEstimatedTokens() }
   }
 
+  /**
+   * 当前会话的估算 token 数 = **消息那半（累加）+ 提示那半（读时派生）**。
+   *
+   * 提示那半必须在读数这一刻才拼：`systemPrompt`、权限段、MCP instructions 段三者任一
+   * 变了都该反映出来，而其中两段的变点在调用方（见字段注释）—— 派生就没有变点要枚举。
+   */
   getEstimatedTokens(): number {
-    return this.estimatedTokens
+    return this.messageTokens + this.promptTokens()
   }
 
   clear(): void {
     this.messages = []
     this.checkpoints = []
     this.checkpointCounter = 0
-    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
+    this.messageTokens = 0
   }
 
   getMessageCount(): number {
@@ -352,13 +373,8 @@ export class ContextManager {
    */
   replaceMessages(messages: Message[]): void {
     this.messages = messages
-    // Re-estimate tokens
-    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
-    for (const msg of messages) {
-      this.estimatedTokens += this.estimateTokens(
-        typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
-      )
-    }
+    // Re-estimate the message half (the prompt half is derived on read).
+    this.recountMessageTokens()
   }
 
   // ── Checkpoint / Rewind ──
@@ -368,7 +384,6 @@ export class ContextManager {
     const checkpoint: Checkpoint = {
       id: this.checkpointCounter,
       messages: structuredClone(this.messages),
-      estimatedTokens: this.estimatedTokens,
       timestamp: new Date(),
       label,
     }
@@ -395,7 +410,21 @@ export class ContextManager {
     }
 
     this.messages = structuredClone(target.messages)
-    this.estimatedTokens = target.estimatedTokens
+    // 估值从**刚恢复出来的这份消息**重算，而不是从快照里存的一个数还原：存下来的数
+    // 是「同一件事的第二份拷贝」，它会与消息各自漂移，而消息本身就是唯一真源。
+    this.recountMessageTokens()
+    // 回退改写的是**投影的整份内容**，所以它必须落成事件：日志是 `--resume` / `/resume`
+    // 重建历史的唯一来源，不记这一次改写，被回退掉的那一轮会在下次恢复时原样回来。
+    // 走与 `addMessage` 同一条写通路径（先入日志、再断言）—— 断言因此也从「前缀匹配」
+    // 变成「逐条相等」，回退不再是断言的一个盲区。
+    // 传快照副本：`append` 只按引用入 buf，序列化推迟到 `save()`，共用同一个数组会让
+    // 之后对 `this.messages` 的原地修改回写进已入队的事件里。
+    if (this.log) {
+      this.log.append({ type: 'rewind', at: Date.now(), messages: structuredClone(this.messages) })
+      if (isAssertModelVisibleDebug()) {
+        assertModelVisible(this.log.events(), this.messages)
+      }
+    }
     return { restored: true, messageCount: this.messages.length, label: target.label }
   }
 
@@ -447,7 +476,7 @@ export class ContextManager {
   private checkCompression(): void {
     if (this.compressionPending) return
 
-    const usage = this.estimatedTokens / this.config.maxTokens
+    const usage = this.getEstimatedTokens() / this.config.maxTokens
 
     // Adaptive microcompact threshold: 200K→0.70, 500K→0.80, 1M→0.85
     const microThreshold = this.config.contextWindow
@@ -493,19 +522,30 @@ export class ContextManager {
     } else {
       this.messages = compacted
     }
-    this.reEstimateTokens()
+    this.recountMessageTokens()
   }
 
-  /** Re-estimate tokens from system prompt + current messages. */
-  private reEstimateTokens(): void {
-    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
+  /** 从当前消息**重算消息那半**的估值（提示那半不在这里 —— 它是读时派生的）。 */
+  private recountMessageTokens(): void {
+    this.messageTokens = 0
     for (const msg of this.messages) {
-      this.estimatedTokens += this.estimateTokens(
+      this.messageTokens += this.estimateTokens(
         typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
       )
     }
   }
 
+  /** 提示那半的估值 —— 每次读数现拼现算，见 `getEstimatedTokens()`。 */
+  private promptTokens(): number {
+    const text = this.composedSystemPrompt()
+    const cached = this.promptTokensCache
+    if (cached && cached.text === text) return cached.tokens
+
+    const tokens = this.estimateTokens(text)
+    this.promptTokensCache = { text, tokens }
+    return tokens
+  }
+
   /**
    * Estimate token count for a text string.
    *

package/src/core/dream-engine.ts

@@ -521,7 +521,11 @@ export class DreamEngine {
 
       let log: Array<{ timestamp: string; actions: DreamAction[] }> = []
       if (existsSync(this.dreamLog)) {
-        log = JSON.parse(readFileSync(this.dreamLog, 'utf-8'))
+        // 形状门：`{"a":1}` 是**合法 JSON**，不抛 —— 而 `log.unshift` 会抛，被下面的
+        // `catch` 吞掉 ⇒ 这一轮梦白做、且用户看不到任何提示。退成空表继续，
+        // 让这一轮活下来，别让它给一个坏文件陪葬。
+        const parsed: unknown = JSON.parse(readFileSync(this.dreamLog, 'utf-8'))
+        if (Array.isArray(parsed)) log = parsed
       }
       log.unshift({ timestamp, actions })
       // Keep last 10 dream cycles
@@ -536,7 +540,18 @@ export class DreamEngine {
   getDreamHistory(): Array<{ timestamp: string; actions: DreamAction[] }> {
     try {
       if (!existsSync(this.dreamLog)) return []
-      return JSON.parse(readFileSync(this.dreamLog, 'utf-8'))
+      const parsed: unknown = JSON.parse(readFileSync(this.dreamLog, 'utf-8'))
+      // 声明返回数组，就必须真的是数组：`{"a":1}` 合法且不抛，而调用方
+      // （`ui/commands.ts` 的 `/dream --status`）紧接着 `.length` / `.slice` /
+      // `entry.actions.length` ⇒ `try` 护不住调用点，TypeError 直接冒到 UI。
+      if (!Array.isArray(parsed)) return []
+      return parsed.filter(
+        (e): e is { timestamp: string; actions: DreamAction[] } =>
+          !!e &&
+          typeof e === 'object' &&
+          typeof e.timestamp === 'string' &&
+          Array.isArray(e.actions),
+      )
     } catch {
       return []
     }

package/src/core/error-signature-db.ts

@@ -87,8 +87,13 @@ export class ErrorSignatureDB {
     try {
       if (!existsSync(this.storePath)) return
       const raw = readFileSync(this.storePath, 'utf-8')
-      const arr: ErrorSignature[] = JSON.parse(raw)
-      for (const sig of arr) {
+      const parsed: unknown = JSON.parse(raw)
+      // 形状门：`["x"]` 是合法 JSON、`for…of` 也照收 —— `sig.id` 是 `undefined`，
+      // 于是库里躺着一个**没有 id 的成员**（后面 `get(id)` 永远找不到它，
+      // 而 `getStats()` 的分母把它算进去）。形状不验 = 垃圾静默入库。
+      if (!Array.isArray(parsed)) return
+      for (const sig of parsed) {
+        if (!sig || typeof sig !== 'object' || typeof sig.id !== 'string') continue
         this.signatures.set(sig.id, sig)
       }
     } catch {

package/src/core/memory/memory-manager.ts

@@ -546,9 +546,13 @@ export class MemoryManager {
     const path = join(this.memoryDir, LINKS_FILE)
     if (!existsSync(path)) return false
     try {
-      const raw = JSON.parse(readFileSync(path, 'utf-8'))
+      const raw: unknown = JSON.parse(readFileSync(path, 'utf-8'))
+      // 形状门：值必须是**字符串数组**。`new Set("bc")` 会**按字符**迭代 ⇒ 一条链接被
+      // 拆成 'b'、'c' 两条（而 `as string[]` 让 TS 一声不吭）。对象/数组本身也过了门才用。
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return false
       for (const [k, v] of Object.entries(raw)) {
-        this.linkGraph.set(k, new Set(v as string[]))
+        if (!Array.isArray(v)) continue
+        this.linkGraph.set(k, new Set(v.filter((x): x is string => typeof x === 'string')))
       }
       return this.linkGraph.size > 0
     } catch {
@@ -587,12 +591,16 @@ export class MemoryManager {
     const path = join(this.memoryDir, RECALL_STATS_FILE)
     if (!existsSync(path)) return
     try {
-      const raw = JSON.parse(readFileSync(path, 'utf-8'))
+      const raw: unknown = JSON.parse(readFileSync(path, 'utf-8'))
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return
       for (const [k, v] of Object.entries(raw)) {
-        const rec = v as { recallCount?: number; lastRecalledAt?: string }
+        // 逐条门控（不是整表退回）：`catch` 在循环外，一个坏条目会把**后面所有**条目
+        // 一起带走 —— 一条脏记录赔上整份召回统计。
+        if (!v || typeof v !== 'object' || Array.isArray(v)) continue
+        const rec = v as { recallCount?: unknown; lastRecalledAt?: unknown }
         this.recallStats.set(k, {
-          recallCount: rec.recallCount ?? 0,
-          lastRecalledAt: rec.lastRecalledAt ?? '',
+          recallCount: typeof rec.recallCount === 'number' ? rec.recallCount : 0,
+          lastRecalledAt: typeof rec.lastRecalledAt === 'string' ? rec.lastRecalledAt : '',
         })
       }
     } catch {

package/src/core/permission-classifier.ts

@@ -57,15 +57,27 @@ import type { PermissionMode } from '../shared/index.ts'
 export const PROMPT_VERSION = 'mipham-auto-classifier/1'
 
 /**
- * Milliseconds before a ruling is abandoned. Same bound as
- * `self-critique.ts:52`, which is the only measured precedent in this repo.
+ * Milliseconds before a ruling is abandoned.
+ *
+ * This used to be declared as "same bound as `self-critique.ts`" — that pairing
+ * is gone, and deliberately not restored in either direction. The two are both
+ * secondary model calls, but they fail in *opposite* directions: `self-critique`
+ * fails **open** (a timeout ⇒ `null` ⇒ the tool runs), so its budget is bounded
+ * by "how often do we want the critique to actually happen"; this one fails
+ * **closed**, so its budget is bounded by "how long may a legitimate call be
+ * refused for". A budget derived from the fail-open side would be a budget
+ * derived from the wrong question.
  *
  * A tighter bound was considered (it is on the gated path, so every ruled call
  * costs the user the full wait) and rejected: with a fail-closed default, a
  * timeout is indistinguishable from a denial to the user, so shrinking this
- * trades "slow" for "auto mode intermittently refuses legitimate work" — and
- * nobody has measured where the real latency distribution sits. Making it
- * configurable is the right fix when someone does.
+ * trades "slow" for "auto mode intermittently refuses legitimate work" — and the
+ * classifier's own latency distribution still has not been measured. (A sibling
+ * measurement does now exist — `self-critique`'s, median 3.95s over 30 real
+ * calls — and it is a reason to *distrust* this 2s, not a reading that may be
+ * substituted for one.) Making it configurable, or re-basing it, needs that
+ * measurement first; the prompts, the target model and the output shape all
+ * differ from the sibling.
  */
 export const DEFAULT_CLASSIFIER_TIMEOUT_MS = 2000