@modusensus/dsh-mneme 0.7.14 → 0.7.16

package/test/client.test.js

@@ -41,71 +41,71 @@ test("memory entry registers into the sidebar foot slot", () => {
   );
 });
 
-// The drawer era is over as the PRIMARY surface: the sidebar entry must
-// activate the main-area memory library tab first. The one sanctioned
-// exception is the hero screen — the host hides the whole tab ring while a
-// session is blank, so activation legitimately fails there and the same
-// click falls back to a full-viewport overlay (same MemoryExplorer, not the
-// old 420px side drawer). A dialog role stays banned either way.
-test("tab-first activation with hero-screen overlay fallback", () => {
+// The tab era is over: the in-conversation memory tab fought the floating
+// composer and squeezed the session layout, so the library no longer
+// registers as a conversation view. The sidebar entry opens the centered
+// sheet directly — from any state, including the new-chat hero screen. A
+// dialog role stays banned either way.
+test("sidebar entry opens the sheet; conversation-view tab stays retired", () => {
   assert.equal(
     clientSource.includes("role: \"dialog\""),
     false,
     "no dialog surface should remain"
   );
   assert.ok(
-    clientSource.includes("activateExplorerTab(t(\"memory.view.label\"))"),
-    "the sidebar trigger must activate the memory library tab by its label"
+    /function openLibrary\(\) \{\s*setOverlayOpen\(true\);\s*\}/.test(clientSource),
+    "the entry must open the overlay directly (no tab activation)"
   );
-  assert.ok(
-    clientSource.includes("activateExplorerTab(t(\"memory.view.label\")).then((ok) => { if (!ok) setOpen(true); })"),
-    "a failed tab activation must open the fallback overlay"
-  );
-  assert.ok(
-    /if \(candidates\.length === 0\) \{ resolve\(false\); return; \}/.test(clientSource),
-    "activation must resolve false when the tab ring is absent (hero screen)"
+  assert.equal(
+    clientSource.includes('ctx.slots.inject("conversation.view"'),
+    false,
+    "the conversation.view tab must stay retired"
   );
-  assert.ok(
-    /aria-selected.*true/.test(clientSource),
-    "activation is only confirmed once the host marks the tab selected"
+  assert.equal(
+    clientSource.includes("activateExplorerTab"),
+    false,
+    "the tab-click activation machinery must be gone"
   );
-  // Same-labelled tabs from other plugins must never be activated by mistake:
-  // the click is only trusted once OUR explorer view actually rendered, and
-  // hidden tab panes are excluded before any click happens.
+});
+
+// The sheet is deliberately NOT fullscreen: a dimmed backdrop plus a rounded
+// panel capped at 1180×880 keeps the conversation visible behind it. It
+// reuses the full MemoryExplorer and closes on Esc, the close button, or a
+// backdrop click.
+test("memory library opens as a centered sheet with backdrop", () => {
   assert.ok(
-    /querySelector\("\.mneme-x"\) !== null/.test(clientSource),
-    "activation must verify the memory explorer rendered, not just the tab state"
+    clientSource.includes(".mneme-backdrop{position:fixed;inset:0"),
+    "a dimmed backdrop must sit behind the sheet"
   );
   assert.ok(
-    /offsetParent === null/.test(clientSource),
-    "hidden tab panes (settings dialogs etc.) must be excluded from activation"
+    /\.mneme-overlay\{position:fixed;z-index:1000;left:50%;top:50%;transform:translate\(-50%,-50%\)/.test(clientSource),
+    "the sheet must be centered, not viewport-filling"
   );
-});
-
-// The fallback overlay reuses the full MemoryExplorer (three columns, graph,
-// settings) at viewport size — not the old side drawer — and closes on Esc
-// or the close button.
-test("hero fallback overlay is a full-viewport MemoryExplorer with a close affordance", () => {
   assert.ok(
-    clientSource.includes('.mneme-overlay{position:fixed;inset:0'),
-    "the overlay must cover the full viewport"
+    clientSource.includes("width:min(1240px,calc(100vw - 88px))"),
+    "the sheet must not occupy the full width and keeps friendly margins"
   );
   assert.ok(
     clientSource.includes('h(MemoryExplorer, { t })'),
-    "the overlay renders the same MemoryExplorer component as the tab"
+    "the sheet renders the same MemoryExplorer component"
   );
   assert.ok(
     clientSource.includes('e.key === "Escape"'),
-    "Esc must close the overlay"
+    "Esc must close the sheet"
+  );
+  assert.ok(
+    clientSource.includes('className: "mneme-backdrop"'),
+    "the backdrop is a clickable close surface"
   );
   assert.ok(
     clientSource.includes('"memory.overlay.close"'),
-    "the overlay ships a localized close label in both dictionaries"
+    "the close affordance keeps its localized label"
   );
 });
 
-// The sidebar hands each footer action only its column state: a wide row
-// (icon + label) when expanded, a bare rail icon when collapsed.
+// The sidebar hands each entry only its column state: a wide row (icon +
+// label) when expanded, a bare rail icon when collapsed — for both the
+// portalled top button and the footer fallback.
 test("trigger renders a wide row or a rail icon from the wide flag", () => {
   assert.ok(
     /wide \? "mneme-trigger" : "mneme-trigger mneme-rail"/.test(clientSource),
@@ -115,23 +115,48 @@ test("trigger renders a wide row or a rail icon from the wide flag", () => {
     /wide && h\("span", \{ className: "mneme-trigger-label" \}/.test(clientSource),
     "the label span must render only when wide"
   );
+  assert.ok(
+    /size: wide \? 15 : 18/.test(clientSource),
+    "the portalled icon must follow the native rail sizing convention"
+  );
 });
 
-// The full-width memory browser lives in the conversation view ring beside
-// Chat / Trajectory, so the client must inject into `conversation.view` with
-// a stable entry id (the active view is persisted by that id).
-test("explorer registers into the conversation view ring", () => {
+// The entry lives ABOVE the workspaces region: the real button is portalled
+// just before the host's regionArea container (below New Session, above the
+// workspace list), while the sidebar.footer.action registration remains as
+// the React anchor and the in-place fallback when the host markup changes.
+test("sidebar entry portals above the workspaces region with footer fallback", () => {
   assert.ok(
-    clientSource.includes('ctx.slots.inject("conversation.view"'),
-    "client must inject into conversation.view"
+    clientSource.includes('ctx.slots.inject("sidebar.footer.action"'),
+    "the footer slot registration must stay as anchor + fallback"
+  );
+  assert.ok(
+    clientSource.includes("SidebarTopEntry"),
+    "the portalled top entry must exist"
+  );
+  assert.ok(
+    clientSource.includes(`'[class*="regionArea"]'`),
+    "the portal must anchor at the host's regionArea container"
   );
   assert.ok(
-    clientSource.includes('id: "dsh-mneme-memory"'),
-    "the view entry needs a stable, unique id"
+    clientSource.includes("insertBefore(created, region)"),
+    "the entry must sit immediately above the workspaces region"
+  );
+  assert.ok(
+    clientSource.includes("if (!host) return fallback;"),
+    "the portal entry persists across collapse (no footer jump); footer fallback only covers portal failure"
+  );
+  assert.ok(
+    clientSource.includes('className: `${nativeCls} mneme-topentry-native`'.replace("${nativeCls} mneme-topentry-native", "${nativeCls} mneme-topentry-native")),
+    "the entry must reuse the host New-Session button class for native geometry alignment"
+  );
+  assert.ok(
+    /querySelector\('\[class\*="newSession"\]'\)/.test(clientSource),
+    "the native class must be read from the live New-Session button, not hardcoded"
   );
   assert.ok(
     clientSource.includes('"memory.view.label"'),
-    "the tab label must come from the memory.view.label dictionary key"
+    "the sheet aria-label must come from the memory.view.label dictionary key"
   );
 });
 
@@ -199,16 +224,21 @@ test("entity: search grammar offers a graph jump", () => {
   );
 });
 
-// The explorer is a three-pane layout: types with counts, a month→day time
-// tree, and a detail pane rendering the untruncated content.
+// The explorer is a card-grid / timeline browse with a right-hand detail
+// drawer: types with counts, a month→day time tree (timeline mode), and the
+// drawer rendering the untruncated content.
 test("explorer lays out types, timeline, and full-text detail", () => {
   assert.ok(
     clientSource.includes('className: "mneme-xmain"'),
     "the three-column grid must be present"
   );
   assert.ok(
-    clientSource.includes('className: "mneme-xdcontent"'),
-    "the detail pane must render the full content"
+    clientSource.includes('className: "mneme-dcontent"'),
+    "the detail drawer must render the full content"
+  );
+  assert.ok(
+    clientSource.includes('className: "mneme-cards"'),
+    "the card-grid view must exist alongside the timeline"
   );
   assert.ok(
     /toLocaleDateString\(undefined, \{ year: "numeric", month: "long" \}\)/.test(clientSource),

package/test/dream.test.js

@@ -870,7 +870,7 @@ test("Bug8: runDream records llm_audit_logs rows for consolidation and summary",
   assert.deepEqual(summarize.related_memory_ids, [], "summary audit has no related ids");
   for (const row of rows) {
     assert.equal(row.status, "success");
-    assert.equal(row.model_id, "mock:stress-model");
+    assert.equal(row.model_id, "deepseek:deepseek-chat", "config-first route (Issue #25): dreamProvider/dreamModel wins");
     assert.ok(Number.isInteger(row.duration_ms) && row.duration_ms >= 0, "duration recorded");
     assert.equal(row.input_tokens, 0);
     assert.equal(row.output_tokens, 0);

package/test/helpers/peer-worker.mjs

@@ -5,6 +5,21 @@
 import { createStore } from "../../src/store.js";
 
 const [, , dbPath, iterations] = process.argv;
-const store = createStore(dbPath);
-for (let i = 0; i < Number(iterations); i++) store.incrementGeneration();
+
+// Windows CI 上 8 进程并发写同一 generation 行时，busy_timeout(5s) 到期仍偶发
+// SQLITE_BUSY（"database is locked"）。锁是瞬时资源竞争，线性重试即可收敛；
+// incrementGeneration 是单条原子 UPDATE（失败即未执行），重试不会重复计数。
+async function withBusyRetry(fn) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return fn();
+    } catch (err) {
+      if (!/database is locked|SQLITE_BUSY/i.test(String(err?.message ?? err)) || attempt >= 40) throw err;
+      await new Promise((r) => setTimeout(r, 250));
+    }
+  }
+}
+
+const store = await withBusyRetry(() => createStore(dbPath));
+for (let i = 0; i < Number(iterations); i++) await withBusyRetry(() => store.incrementGeneration());
 store.close();

package/test/llm-audit.test.js

@@ -50,10 +50,11 @@ test("autoDream writes llm_audit_logs rows for consolidation and summary", async
   assert.equal(summarize.trigger_source, "autoDream");
   assert.equal(consolidate.status, "success");
   assert.equal(summarize.status, "success");
-  // mockCtx resolves the route from agentDefaultModel (mock:stress-model), not
-  // the config fallback — assert the actually-used route.
-  assert.equal(consolidate.model_id, "mock:stress-model");
-  assert.equal(summarize.model_id, "mock:stress-model");
+  // config-first (Issue #25): dreamSetup sets dreamProvider/dreamModel, so it
+  // wins over mockCtx's agentDefaultModel (mock:stress-model) — assert the
+  // actually-used config route.
+  assert.equal(consolidate.model_id, "deepseek:deepseek-chat");
+  assert.equal(summarize.model_id, "deepseek:deepseek-chat");
   assert.ok(Array.isArray(consolidate.related_memory_ids) && consolidate.related_memory_ids.length === 2,
     "consolidation audit records the snapshot ids");
   assert.ok(consolidate.total_tokens >= 0 && summarize.total_tokens >= 0);
@@ -110,6 +111,35 @@ test("autoDream throwing LLM is audited as status=error", async () => {
   store.close();
 });
 
+test("autoDream parse failure is audited as status=error, not fake success", async () => {
+  const { store, service, config } = dreamSetup();
+  service.saveWithDedupe({ type: "project", title: "主题", content: "内容" });
+  // Stream completes fine but returns no JSON array — the run fails, and the
+  // audit must NOT claim success (the old bug: llm_audit said dream_consolidate
+  // success while the run recorded failed).
+  const warnings = [];
+  const ctx = {
+    logger: { warn: (m) => warnings.push(m) },
+    llm: {
+      async *stream() {
+        yield { type: "text-delta", index: 0, text: "抱歉，我无法解析成 JSON。" };
+        yield { type: "finish", reason: { kind: "stop" } };
+      }
+    }
+  };
+  const dream = createDreamScheduler({ thresholdCount: 1, thresholdChars: 0, delayMs: 0 });
+  const result = await dream.runDream(ctx, service, config);
+  assert.equal(result.ok, false);
+  assert.equal(result.error, "no json array in llm output");
+  const rows = service.listLlmAudits();
+  assert.equal(rows.length, 1, "failed consolidation still audited");
+  assert.equal(rows[0].operation_type, "dream_consolidate");
+  assert.equal(rows[0].status, "error", "stream succeeded but output unusable → audit error");
+  assert.match(rows[0].error_message, /no json array in llm output/);
+  assert.ok(warnings.some((m) => m.includes("head: 抱歉，我无法解析成")), "raw output head logged for diagnosis");
+  store.close();
+});
+
 test("autoDream audit is skipped when llmAudit.enabled === false", async () => {
   const { store, service, config } = dreamSetup({ llmAudit: { enabled: false } });
   service.saveWithDedupe({ type: "project", title: "主题", content: "内容" });

package/test/peer-blockers.test.js

@@ -115,8 +115,14 @@ test("peer-C: 多进程并发原子递增——8 进程×10 次 incrementGenerat
     }
   } finally {
     // Windows：8 个 SQLite 子进程退出后 -shm/-wal 句柄延迟释放，删目录偶发 EPERM；
-    // maxRetries 让 rm 自动重试（Node 文档：EBUSY/EPERM 等会重试），不影响并发逻辑。
-    rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
+    // rm 带 maxRetries 自动重试（30×100ms 共 3s），仍失败则放行——清理只是收尾，
+    // 并发断言正确性由上方 generation 断言保证，残留临时目录交给 OS/CI 回收，
+    // 绝不让句柄释放慢把 flaky 标红。
+    try {
+      rmSync(dir, { recursive: true, force: true, maxRetries: 30, retryDelay: 100 });
+    } catch (err) {
+      if (!["EPERM", "EBUSY", "EACCES"].includes(err.code)) throw err;
+    }
   }
 });
 

package/test/reasoning-effort.test.js

@@ -107,6 +107,70 @@ test("issue#9: dream forwards dreamReasoningEffort on both LLM calls", async ()
   store.close();
 });
 
+test("issue#25: dreamProvider/dreamModel config wins over the agentDefaultModel route", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const dream = createDreamScheduler({ onRun: () => Promise.resolve({ ok: true, skipped: true }) });
+  const { memory: a } = service.saveWithDedupe({ type: "project", title: "插件", content: "旧", importance: 3 });
+  const { memory: b } = service.saveWithDedupe({ type: "project", title: "插件2", content: "新细节", importance: 4 });
+  const captured = [];
+  const ctx = dreamCtx({
+    captured,
+    onConsolidation: () => JSON.stringify([
+      { action: "merge", ids: [a.id, b.id], keepSource: b.id, title: "插件总览", content: "合并内容", importance: 4 }
+    ])
+  });
+  // dreamCtx's agentDefaultModel resolves (mock:mock-model), but the explicit
+  // config route must win — otherwise dreamProvider/dreamModel is dead code in
+  // a standard DSH install and the dream can never be moved off a thinking model.
+  const result = await dream.runDream(ctx, service, { dreamProvider: "volcano", dreamModel: "deepseek-v3" });
+  assert.equal(result.ok, true);
+  assert.ok(captured.length >= 2, "consolidation + summary both hit the LLM");
+  for (const options of captured) {
+    assert.equal(options.provider, "volcano");
+    assert.equal(options.model, "deepseek-v3", "config route wins over agentDefaultModel (mock:mock-model)");
+  }
+  store.close();
+});
+
+test("issue#9: rejected reasoningEffort retries once without it and still consolidates", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const dream = createDreamScheduler({ onRun: () => Promise.resolve({ ok: true, skipped: true }) });
+  const { memory: a } = service.saveWithDedupe({ type: "project", title: "插件", content: "旧", importance: 3 });
+  const { memory: b } = service.saveWithDedupe({ type: "project", title: "插件2", content: "新细节", importance: 4 });
+  const calls = [];
+  const ctx = {
+    logger: { warn: () => {} },
+    agentDefaultModel: { currentSelection: () => ({ provider: "mock", model: "mock-model" }) },
+    llm: {
+      async *stream(options) {
+        calls.push(options);
+        const userText = options.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "";
+        if (userText.startsWith("id=")) {
+          // First attempt forwards reasoningEffort: the provider rejects it.
+          if (options.reasoningEffort) {
+            throw new Error("UNSUPPORTED_REASONING_EFFORT: DeepSeek does not support reasoning effort \"low\"");
+          }
+          yield { type: "text-delta", index: 0, text: JSON.stringify([
+            { action: "merge", ids: [a.id, b.id], keepSource: b.id, title: "合并标题", content: "合并内容", importance: 4 }
+          ]) };
+        } else {
+          yield { type: "text-delta", index: 0, text: "记忆库总览：用户偏好中文。" };
+        }
+        yield { type: "finish", reason: { kind: "stop" } };
+      }
+    }
+  };
+  const result = await dream.runDream(ctx, service, { dreamReasoningEffort: "low" });
+  assert.equal(result.ok, true, "run survives the effort rejection via the fallback retry");
+  assert.ok(result.applied > 0, "consolidation still lands changes");
+  assert.equal(calls.length, 3, "consolidation tried (rejected) + retried without effort + summary");
+  assert.equal(calls[0].reasoningEffort, "low", "first consolidation attempt forwards the effort");
+  assert.equal("reasoningEffort" in calls[1], false, "retry omits the rejected effort field");
+  store.close();
+});
+
 // ---------------------------------------------------------------- sleep passthrough
 
 function sleepSetup() {

package/test/settings.test.js

@@ -123,3 +123,139 @@ test("external api settings persist token and merge partial writes", () => {
   assert.deepEqual(settings.getExternalApi(), { enabled: true, port: 9000, host: "0.0.0.0", token: "tok-2" });
   store.close();
 });
+
+// --- feature flags ---
+
+test("feature flags default to an empty object", () => {
+  const { store, settings } = setup();
+  assert.deepEqual(settings.getFeatureFlags(), {});
+  store.close();
+});
+
+test("setFeatureFlags rejects unknown keys and persists nothing", () => {
+  const { store, settings } = setup();
+  settings.setFeatureFlags({ autoDream: false });
+  assert.throws(() => settings.setFeatureFlags({ noSuchFlag: true }), TypeError);
+  assert.throws(() => settings.setFeatureFlags({ noSuchFlag: true }), /noSuchFlag/);
+  // 被拒的 patch 不落库，已存的合法值原样保留
+  assert.deepEqual(settings.getFeatureFlags(), { autoDream: false });
+  store.close();
+});
+
+test("setFeatureFlags enforces boolean types and integer ranges", () => {
+  const { store, settings } = setup();
+  assert.throws(() => settings.setFeatureFlags({ autoInject: "yes" }), /autoInject/);
+  assert.throws(() => settings.setFeatureFlags({ distillMaxChars: 500 }), /distillMaxChars/);
+  assert.throws(() => settings.setFeatureFlags({ distillRateLimitRetries: 1.5 }), /distillRateLimitRetries/);
+  assert.throws(() => settings.setFeatureFlags({ codingBoostFactor: 9 }), /codingBoostFactor/);
+  assert.deepEqual(settings.getFeatureFlags(), {}, "failed writes persist nothing");
+  store.close();
+});
+
+test("setFeatureFlags merges partial patches and persists across instances", () => {
+  const { store, settings } = setup();
+  settings.setFeatureFlags({ autoDream: false, distillMaxChars: 48000 });
+  settings.setFeatureFlags({ rerankEnabled: true });
+  // 同一 kv 上的新实例读回合并结果，证明已真正持久化
+  const settings2 = createSettings(store.db);
+  assert.deepEqual(settings2.getFeatureFlags(), { autoDream: false, distillMaxChars: 48000, rerankEnabled: true });
+  store.close();
+});
+
+test("getFeatureFlags drops unknown and corrupted keys from the kv", () => {
+  const { store, settings } = setup();
+  settings.setFeatureFlags({ autoInject: false });
+  // 模拟旧版本/手改残留：绕过校验直接写脏 kv
+  store.db.prepare("UPDATE user_settings SET value = ? WHERE key = ?").run(
+    JSON.stringify({ autoInject: false, legacyFlag: true, autoDream: "yes", distillMaxChars: 999999 }),
+    "feature_flags"
+  );
+  assert.deepEqual(settings.getFeatureFlags(), { autoInject: false });
+  // 整个 kv 损坏（非 JSON）→ 读回空对象而不是抛错
+  store.db.prepare("UPDATE user_settings SET value = ? WHERE key = ?").run("not-json", "feature_flags");
+  assert.deepEqual(settings.getFeatureFlags(), {});
+  store.close();
+});
+
+test("feature flags accept the new boolean, string, url and enum keys", () => {
+  const { store, settings } = setup();
+  settings.setFeatureFlags({
+    "memoryQualityFilter.enabled": false,
+    "llmAudit.enabled": false,
+    bm25SearchEnabled: false,
+    conflictFreezeEnabled: true,
+    trustEpistemicWeighting: true,
+    reflectionFailureTracking: false,
+    dreamProvider: "  siliconflow  ",
+    dreamModel: "deepseek-chat",
+    localEmbedModel: "Xenova/bge-small-zh-v1.5",
+    ollamaModel: "nomic-embed-text",
+    ollamaBaseUrl: "http://127.0.0.1:11434/",
+    embedProvider: "ollama"
+  });
+  const flags = settings.getFeatureFlags();
+  assert.equal(flags["memoryQualityFilter.enabled"], false, "nested keys stored flat");
+  assert.equal(flags["llmAudit.enabled"], false);
+  assert.equal(flags.bm25SearchEnabled, false);
+  assert.equal(flags.conflictFreezeEnabled, true);
+  assert.equal(flags.trustEpistemicWeighting, true);
+  assert.equal(flags.reflectionFailureTracking, false);
+  assert.equal(flags.dreamProvider, "siliconflow", "string values are trimmed");
+  assert.equal(flags.dreamModel, "deepseek-chat");
+  assert.equal(flags.ollamaBaseUrl, "http://127.0.0.1:11434/");
+  assert.equal(flags.embedProvider, "ollama");
+  // 同一 kv 上的新实例读回合并结果：点号键按平铺键持久化
+  const settings2 = createSettings(store.db);
+  assert.equal(settings2.getFeatureFlags()["memoryQualityFilter.enabled"], false);
+  assert.equal(settings2.getFeatureFlags().embedProvider, "ollama");
+  store.close();
+});
+
+test("nested feature flag keys are validated as booleans and rejected otherwise", () => {
+  const { store, settings } = setup();
+  assert.throws(() => settings.setFeatureFlags({ "memoryQualityFilter.enabled": "yes" }), /memoryQualityFilter\.enabled/);
+  assert.throws(() => settings.setFeatureFlags({ "llmAudit.enabled": 1 }), /llmAudit\.enabled/);
+  assert.deepEqual(settings.getFeatureFlags(), {}, "failed writes persist nothing");
+  store.close();
+});
+
+test("string feature flags: empty is legal, over-length and enum violations rejected", () => {
+  const { store, settings } = setup();
+  // 空字符串合法 = 跟随主对话模型（面板显示 placeholder）
+  settings.setFeatureFlags({ dreamProvider: "", dreamModel: "   " });
+  assert.equal(settings.getFeatureFlags().dreamProvider, "");
+  assert.equal(settings.getFeatureFlags().dreamModel, "", "whitespace-only trims to empty");
+  assert.throws(() => settings.setFeatureFlags({ dreamModel: "x".repeat(201) }), /dreamModel/);
+  assert.throws(() => settings.setFeatureFlags({ localEmbedModel: 42 }), /localEmbedModel/);
+  assert.throws(() => settings.setFeatureFlags({ embedProvider: "bogus" }), /embedProvider/);
+  assert.throws(() => settings.setFeatureFlags({ embedProvider: "OpenAI" }), /embedProvider/, "enum is case-sensitive");
+  assert.deepEqual(settings.getFeatureFlags(), { dreamProvider: "", dreamModel: "" }, "failed writes persist nothing");
+  store.close();
+});
+
+test("ollamaBaseUrl accepts empty and http(s) URLs, rejects other protocols", () => {
+  const { store, settings } = setup();
+  settings.setFeatureFlags({ ollamaBaseUrl: "" });
+  assert.equal(settings.getFeatureFlags().ollamaBaseUrl, "", "empty = follow default");
+  settings.setFeatureFlags({ ollamaBaseUrl: "  https://embed.example.com/v1  " });
+  assert.equal(settings.getFeatureFlags().ollamaBaseUrl, "https://embed.example.com/v1");
+  assert.throws(() => settings.setFeatureFlags({ ollamaBaseUrl: "ftp://localhost:11434" }), /ollamaBaseUrl/);
+  assert.throws(() => settings.setFeatureFlags({ ollamaBaseUrl: "file:///etc/passwd" }), /ollamaBaseUrl/);
+  assert.throws(() => settings.setFeatureFlags({ ollamaBaseUrl: "javascript:alert(1)" }), /ollamaBaseUrl/);
+  assert.throws(() => settings.setFeatureFlags({ ollamaBaseUrl: "localhost:11434" }), /ollamaBaseUrl/, "protocol is required");
+  assert.throws(() => settings.setFeatureFlags({ ollamaBaseUrl: "not a url" }), /ollamaBaseUrl/);
+  assert.equal(settings.getFeatureFlags().ollamaBaseUrl, "https://embed.example.com/v1", "rejected writes persist nothing");
+  store.close();
+});
+
+test("getFeatureFlags drops corrupted string, url and enum keys from the kv", () => {
+  const { store, settings } = setup();
+  settings.setFeatureFlags({ dreamModel: "m", ollamaBaseUrl: "http://localhost:11434", embedProvider: "local" });
+  // 模拟旧版本/手改残留：字符串键混入非字符串、URL 键混入非法协议、枚举越界
+  store.db.prepare("UPDATE user_settings SET value = ? WHERE key = ?").run(
+    JSON.stringify({ dreamModel: 42, ollamaBaseUrl: "ftp://bad", embedProvider: "bogus", autoInject: false }),
+    "feature_flags"
+  );
+  assert.deepEqual(settings.getFeatureFlags(), { autoInject: false });
+  store.close();
+});