dowafu 0.4.0 → 0.5.0

package/dist/cost.js

@@ -18,6 +18,16 @@
 //    inputTokens 的子集（官方對「快取命中」的計費方式是「原生 input 價的一部分改用
 //    快取價」），要從 inputTokens 扣掉才是「非快取價」該計費的量，否則會把快取部分
 //    重複計成原價。
+// _docs/dispatch/v0_5_0/facts_output_cap.md §六：65,536（2^16）＝實測單輪 max 53,391
+// （deepseek-v4-flash，96.6% 是 reasoning）加約 22% 餘裕，且遠高於 OpenAI 官方建議的
+// 25,000 下限。四家 adapter 共用同一個常數（見 responses.ts／gemini-native.ts／
+// anthropic-messages.ts），改一處三家跟著動——不得在各 adapter 各自寫死字面量。
+export const OUTPUT_TOKEN_CAP = 65_536;
+// 票 cost-cap §D：實測 75 次 spoke 級派工最多只跑到 15 輪（facts_output_cap.md §四），
+// 降到 20 不影響任何一次既有派工；輪數對成本上界是線性的（estimateHardCapUsd）。
+// 放在這裡（不放 cli-args.ts）是為了讓 ticket-store.ts 也能匯入而不與 cli-args.ts 互相
+// 匯入成環——cli-args.ts 經 mcp/http.ts → mcp/protocol.ts 會匯回 ticket-store.ts。
+export const DEFAULT_MAX_TOOL_CALLS = 20;
 // exhaustive 對照表，缺一支會被 TypeScript 擋下——與 usage.ts 的 usageProviderKeyFor
 // 同樣理由：不留「其餘」預設分支，逼新增第四家 provider 時必須手動同步。
 const REASONING_INCLUDED_IN_OUTPUT = {
@@ -52,3 +62,17 @@ export function estimateCostUsd(usage, api, pricing) {
         (cacheWriteTokens / 1_000_000) * cacheWritePricePerM +
         (billableOutputTokens / 1_000_000) * pricing.outputPerM);
 }
+// 票 cost-cap §B：呼叫前的絕對上界，不是預測——與 estimateCostUsd（事後實算）互不相干，
+// 不吃 usage。R = maxToolCalls + 1（最後一輪不呼叫 tool，見 §D／cli-args.ts）；
+// 每輪都可能撞到 output 天花板，且最壞情況下每輪重送全部初始 prompt（無 cached 折扣）。
+// 實測顯示這是實際花費的 20–30 倍（facts_output_cap.md §六）——那是上界的本質，不是算錯；
+// 不得為了讓數字好看而調整這支算式，要調的是輪數上限（maxToolCalls）。
+// 缺價目資料時回傳 null，不是 0——與 estimateCostUsd 同一條規矩（§4）。
+export function estimateHardCapUsd(estimatedPromptTokens, maxToolCalls, pricing) {
+    if (!pricing)
+        return null;
+    const rounds = maxToolCalls + 1;
+    const outputCapTokens = OUTPUT_TOKEN_CAP * rounds;
+    const inputCapTokens = estimatedPromptTokens * rounds;
+    return (inputCapTokens / 1_000_000) * pricing.inputPerM + (outputCapTokens / 1_000_000) * pricing.outputPerM;
+}

package/dist/daemon.js

@@ -0,0 +1,209 @@
+import { execFileSync, spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { hasAnyActiveToken } from "./api-token.js";
+import { defaultDbPath, openDb } from "./db.js";
+import { claimNextJob, finishJob, heartbeatJob, reapInterruptedJobs } from "./job.js";
+import { DAEMON_STALE_MS, daemonAlive, daemonStatePath, writeHeartbeat } from "./liveness.js";
+import { createHttpServer, DEFAULT_HTTP_PORT } from "./mcp/http.js";
+import { maskString } from "./mask.js";
+import { m } from "./messages.js";
+export const DEFAULT_DAEMON_CONCURRENCY = 2;
+export const DAEMON_TICK_MS = 500;
+export const DAEMON_HEARTBEAT_MS = 5_000;
+// B（gaps #6）：reap 先前只在 daemon 啟動那一刻跑一次，所以 daemon 死了又沒人重開，
+// job 會**永遠**停在 running——只讀 status 的輪詢器等不到終態。
+// （既有那條測試的名字寫「不讓**重啟後**狀態永遠卡住」，它保證的正是「有重啟才不卡住」。）
+// 週期跑不會誤傷自己的 job：worker 的心跳每 2 秒寫一次，門檻是 15 秒，中間有 7 倍餘裕。
+export const DAEMON_REAP_MS = 5_000;
+export function resultCost(db, jobId) {
+    const row = db.prepare("SELECT SUM(cost_usd) AS cost FROM results WHERE job_id = ?").get(jobId);
+    return row.cost;
+}
+export function createDaemon(db, options) {
+    const maxConcurrent = options.maxConcurrent ?? DEFAULT_DAEMON_CONCURRENCY;
+    if (!Number.isInteger(maxConcurrent) || maxConcurrent < 1)
+        throw new Error("daemon concurrency must be a positive integer");
+    const statePath = daemonStatePath(options.dbPath);
+    const intervals = [];
+    const running = new Set();
+    const nowMs = options.now ?? Date.now;
+    const schedule = options.setInterval ?? setInterval;
+    const cancel = options.clearInterval ?? clearInterval;
+    const beat = () => writeHeartbeat(statePath, options.pid);
+    const run = (job) => {
+        running.add(job.id);
+        const jobHeartbeat = schedule(() => heartbeatJob(db, job.id), 2_000);
+        void options
+            .execute(job)
+            .then((outcome) => finishJob(db, job.id, { error: outcome.error, costUsd: resultCost(db, job.id) }))
+            .catch((err) => finishJob(db, job.id, { error: String(err), costUsd: resultCost(db, job.id) }))
+            .finally(() => {
+            cancel(jobHeartbeat);
+            running.delete(job.id);
+        });
+    };
+    const tick = () => {
+        while (running.size < maxConcurrent) {
+            const job = claimNextJob(db);
+            if (!job)
+                break;
+            run(job);
+        }
+    };
+    // staleBefore 每次重算——先前是在啟動時算一次的區域變數，週期化之後若沿用那個值，
+    // 跑久了門檻會離現在越來越遠，最後等於不再 reap。
+    const reap = () => {
+        const reapedAt = new Date(nowMs()).toISOString();
+        return reapInterruptedJobs(db, new Date(nowMs() - DAEMON_STALE_MS).toISOString(), (jobId) => resultCost(db, jobId), reapedAt);
+    };
+    reap();
+    beat();
+    intervals.push(schedule(beat, DAEMON_HEARTBEAT_MS), schedule(tick, DAEMON_TICK_MS), schedule(reap, DAEMON_REAP_MS));
+    return {
+        tick,
+        stop: () => intervals.forEach(cancel),
+        running: () => running.size,
+    };
+}
+// 8 KiB retains several complete diagnostic lines while bounding daemon memory and DB error
+// rows; CLI failures normally put their actionable summary at the end of stderr.
+export const WORKER_STDERR_TAIL_BYTES = 8 * 1024;
+const DEFAULT_RUN_CLI_JOB_DEPS = { spawn, stderr: process.stderr };
+export function workerFailureMessage(lang, code, signal, stderr) {
+    const detail = maskString(stderr.trim());
+    if (signal)
+        return detail ? m(lang, "daemonWorkerTerminatedDetail", signal, detail) : m(lang, "daemonWorkerTerminated", signal);
+    const exitCode = code ?? "unknown";
+    return detail ? m(lang, "daemonWorkerExitedDetail", exitCode, detail) : m(lang, "daemonWorkerExited", exitCode);
+}
+export function runCliJob(job, dbPath, lang = "en", deps = DEFAULT_RUN_CLI_JOB_DEPS) {
+    const sourceMode = fileURLToPath(import.meta.url).endsWith(".ts");
+    const cliPath = fileURLToPath(new URL(sourceMode ? "./cli.ts" : "./cli.js", import.meta.url));
+    const args = sourceMode
+        ? ["--import", "tsx", cliPath, job.ticket, "--yes", "--job-id", job.id, "--db", dbPath]
+        : [cliPath, job.ticket, "--yes", "--job-id", job.id, "--db", dbPath];
+    return new Promise((resolve) => {
+        const child = deps.spawn(process.execPath, args, { stdio: ["inherit", "inherit", "pipe"], env: process.env });
+        let stderrTail = Buffer.alloc(0);
+        child.stderr?.on("data", (chunk) => {
+            // Preserve the daemon's own stderr/log stream while retaining a bounded tail for jobs.error.
+            deps.stderr.write(chunk);
+            stderrTail = Buffer.concat([stderrTail, chunk]).subarray(-WORKER_STDERR_TAIL_BYTES);
+        });
+        child.once("error", (err) => resolve({ error: m(lang, "daemonWorkerSpawnFailed", maskString(String(err))) }));
+        child.once("exit", (code, signal) => {
+            if (code === 0)
+                resolve({});
+            else
+                resolve({ error: workerFailureMessage(lang, code, signal, stderrTail.toString("utf8")) });
+        });
+    });
+}
+const STOP_CHECK_INTERVAL_MS = 100;
+const STOP_CHECK_ATTEMPTS = 10;
+const STOP_RESTART_WAIT_MS = 500;
+const DEFAULT_STOP_DAEMON_DEPS = {
+    liveness: (statePath) => daemonAlive(statePath),
+    countRunningJobs: (dbPath) => {
+        const row = openDb(dbPath).prepare("SELECT COUNT(*) AS count FROM jobs WHERE status = 'running'").get();
+        return row.count;
+    },
+    processCommand: (pid) => {
+        try {
+            return execFileSync("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        }
+        catch {
+            return null;
+        }
+    },
+    kill: (pid, signal) => process.kill(pid, signal),
+    wait: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+};
+function isDowafuProcess(command) {
+    return command !== null && /(?:\bdowafu\b|\bcli\.(?:ts|js)\b)/.test(command);
+}
+export async function stopDaemon(dbPath = defaultDbPath(), options = {}) {
+    const deps = options.deps ?? DEFAULT_STOP_DAEMON_DEPS;
+    const statePath = daemonStatePath(dbPath);
+    const initial = deps.liveness(statePath);
+    if (!initial.alive)
+        return { status: "not_running", reason: initial.reason };
+    const runningJobs = deps.countRunningJobs(dbPath);
+    if (runningJobs > 0 && !options.force) {
+        const confirmed = await (options.confirmRunningJobs?.(runningJobs) ?? Promise.resolve(false));
+        if (!confirmed)
+            return { status: "cancelled", runningJobs };
+    }
+    if (!isDowafuProcess(deps.processCommand(initial.pid)))
+        return { status: "pid_not_dowafu", pid: initial.pid };
+    try {
+        deps.kill(initial.pid, "SIGTERM");
+    }
+    catch {
+        return { status: "signal_failed", pid: initial.pid };
+    }
+    for (let attempt = 0; attempt < STOP_CHECK_ATTEMPTS; attempt++) {
+        await deps.wait(STOP_CHECK_INTERVAL_MS);
+        if (!deps.liveness(statePath).alive) {
+            await deps.wait(STOP_RESTART_WAIT_MS);
+            return deps.liveness(statePath).alive ? { status: "restarted", pid: initial.pid } : { status: "stopped", pid: initial.pid };
+        }
+    }
+    return { status: "signal_failed", pid: initial.pid };
+}
+function bindHttp(db, dbPath, httpPort) {
+    return new Promise((resolve, reject) => {
+        // 工單 C §零裁示 1：只綁 127.0.0.1，沒有 --host——公開與否是 tunnel 的事。
+        const server = createHttpServer({ db, dbPath });
+        const onError = (err) => {
+            server.removeListener("listening", onListening);
+            reject(err);
+        };
+        const onListening = () => {
+            server.removeListener("error", onError);
+            resolve(server);
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(httpPort, "127.0.0.1");
+    });
+}
+// 工單 C §D：HTTP 起不來時，整個 serve 失敗（不降級成「只有 stdio 能用的 daemon」）。
+// worker／心跳只在 HTTP 成功綁定之後才建立，兩者要嘛一起活、要嘛都不起——一個活著但另一個
+// 靜默死掉，正是「失敗長得像成功」的形態，本票明文選擇不要那樣。
+//
+// `serve` 本身刻意不是 async function：daemon-already-running 那個守衛必須維持同步拋出
+// （既有測試 `assert.throws(() => serve(dbPath), ...)` 依賴這一點），只有 HTTP 綁定之後
+// 那段才回傳 Promise。
+export function serve(dbPath = defaultDbPath(), maxConcurrent = Number(process.env.DOWAFU_MAX_CONCURRENT ?? DEFAULT_DAEMON_CONCURRENCY), httpPort = Number(process.env.DOWAFU_HTTP_PORT ?? DEFAULT_HTTP_PORT), lang = "en") {
+    const state = daemonAlive(daemonStatePath(dbPath));
+    if (state.alive)
+        throw new Error(`daemon already running (pid ${state.pid})`);
+    const db = openDb(dbPath);
+    return bindHttp(db, dbPath, httpPort).then((httpServer) => {
+        let daemon;
+        try {
+            daemon = createDaemon(db, { dbPath, maxConcurrent, execute: (job) => runCliJob(job, dbPath, lang) });
+        }
+        catch (err) {
+            httpServer.close();
+            throw err;
+        }
+        process.on("SIGINT", () => {
+            daemon.stop();
+            httpServer.close();
+            process.exit(0);
+        });
+        const address = httpServer.address();
+        const boundPort = typeof address === "object" && address ? address.port : httpPort;
+        return {
+            ...daemon,
+            stop: () => {
+                daemon.stop();
+                httpServer.close();
+            },
+            httpPort: boundPort,
+            hasActiveToken: hasAnyActiveToken(db),
+        };
+    });
+}

package/dist/db.js

@@ -0,0 +1,219 @@
+// D1: the only module that knows about SQLite.  Keep all schema and driver details here.
+import { mkdirSync } from "node:fs";
+import path from "node:path";
+import { resolveDispatchHome } from "./dispatch-home.js";
+import { DispatchError } from "./types.js";
+import { m } from "./messages.js";
+let warningFilterInstalled = false;
+export function installSqliteWarningFilter() {
+    if (warningFilterInstalled)
+        return;
+    warningFilterInstalled = true;
+    const listeners = process.listeners("warning");
+    process.removeAllListeners("warning");
+    process.on("warning", (warning) => {
+        if (warning.name === "ExperimentalWarning" && /SQLite/i.test(warning.message))
+            return;
+        for (const listener of listeners)
+            listener(warning);
+    });
+}
+// The warning is emitted as node:sqlite is loaded, so the filter must exist before
+// the runtime import (a static import is too early for that ordering).
+installSqliteWarningFilter();
+const { DatabaseSync: DatabaseSyncDriver } = await import("node:sqlite");
+export function defaultDbPath() {
+    const home = resolveDispatchHome();
+    return process.env.DOWAFU_DB ?? path.join(home ?? process.cwd(), "dowafu.db");
+}
+const MIGRATIONS = [
+    {
+        version: 1,
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS tickets (
+          name TEXT PRIMARY KEY,
+          doc TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE TABLE IF NOT EXISTS jobs (
+          id TEXT PRIMARY KEY,
+          ticket TEXT NOT NULL,
+          status TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          approved_at TEXT,
+          claimed_at TEXT,
+          heartbeat_at TEXT,
+          finished_at TEXT,
+          error TEXT,
+          cost_usd REAL
+        );
+        CREATE TABLE IF NOT EXISTS results (
+          job_id TEXT NOT NULL,
+          agent TEXT NOT NULL,
+          output TEXT,
+          request TEXT,
+          response TEXT,
+          tokens_in INTEGER,
+          tokens_out INTEGER,
+          cost_usd REAL,
+          PRIMARY KEY (job_id, agent)
+        );
+
+        -- providers/models mirror providers.json's two levels instead of flattening them.
+        -- Flattening would repeat every provider-level field on each model row, and the
+        -- import merge would then have to reconcile rows of the same provider disagreeing.
+        -- 'reasoning' and 'pricing_source' stay as JSON text: they are nested config that
+        -- is read whole, never filtered on.
+        CREATE TABLE IF NOT EXISTS providers (
+          name TEXT PRIMARY KEY,
+          base_url TEXT NOT NULL,
+          api TEXT NOT NULL,
+          store INTEGER,
+          tool_calling INTEGER NOT NULL,
+          reasoning TEXT NOT NULL,
+          chars_per_token REAL,
+          tpm_limit INTEGER,
+          max_spoke_tokens INTEGER,
+          pricing_source TEXT,
+          updated_at TEXT NOT NULL
+        );
+        -- One row per model serves both roles providers.json splits across 'models[]' and
+        -- 'pricing{}': the row's existence is the whitelist, its price columns are the
+        -- pricing, and 'enabled' is the new gate.  Price columns stay nullable because a
+        -- whitelisted model may have no pricing data — "cannot estimate" and "costs zero"
+        -- must remain distinguishable (see cost.ts).
+        CREATE TABLE IF NOT EXISTS models (
+          provider TEXT NOT NULL,
+          model TEXT NOT NULL,
+          input_per_m REAL,
+          cached_input_per_m REAL,
+          cache_write_per_m REAL,
+          output_per_m REAL,
+          enabled INTEGER NOT NULL DEFAULT 0,
+          updated_at TEXT NOT NULL,
+          PRIMARY KEY (provider, model)
+        );
+        -- Inbound HTTP credentials.  Only ever compared, never replayed, so the hash is
+        -- all we keep.  Provider API keys are the opposite case and deliberately do not
+        -- share this table: they have to be handed to the vendor verbatim.
+        CREATE TABLE IF NOT EXISTS tokens (
+          id TEXT PRIMARY KEY,
+          hash TEXT NOT NULL,
+          label TEXT,
+          created_at TEXT NOT NULL,
+          revoked_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_jobs_ticket_status ON jobs (ticket, status);
+        CREATE INDEX IF NOT EXISTS idx_jobs_status ON jobs (status);
+        CREATE INDEX IF NOT EXISTS idx_models_enabled ON models (enabled);
+      `);
+        },
+    },
+    // T1 (E12): outbound provider API keys.  Deliberately NOT the `tokens` table — that one
+    // holds *inbound* HTTP credentials and stores only a hash, while these have to be handed
+    // back in cleartext to call the provider.  Opposite storage requirements, separate tables.
+    //
+    // Stored in cleartext, and that is the decision on record (decision_mcp.md E12): the win
+    // here is operational (set once via CLI, no file to chmod, works on Windows), not security
+    // — a SQLite file is as readable as the .env it replaces.  Do not add encryption that
+    // would only look like protection.
+    {
+        version: 2,
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS provider_keys (
+          provider   TEXT PRIMARY KEY,
+          api_key    TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+      `);
+        },
+    },
+    // B（gaps #6）：跑的過程中看得到進度。`results` 每支 spoke 只在**跑完的那一刻**寫一次，
+    // 所以單支 spoke 的工單在跑完之前完全沒有訊號——最壞安靜十分鐘，而 skill 只能寫
+    // 「安靜不代表當掉」。這張表補的就是那段空白。
+    //
+    // **每輪 append 一列，不是 update 一列。** 「哪一輪慢」是 `RunLogWriter` 退場時明文記為
+    // 降級的四項之一（_archived/log.md §七），逐列才留得住輪級時間戳；更新同一列只留得下
+    // 最後一輪。列數上限是 maxToolCalls（20）＋1，代價可以忽略。
+    //
+    // **這張表刻意與 `results` 分開。** `results` 是寫一次的已付費產出，`persistSpokeResultDb`
+    // 對「實質不同的重寫」會撞 primary-key constraint 炸出來——那是 D1-hot3 為了
+    // 「落檔失敗不得銷毀已付費結果」建的守衛。逐輪寫進度本質上就是「每次都不一樣的寫入」，
+    // 混進去會正面撞上它。進度是可丟棄的診斷資料，兩者的耐久性要求本來就不同。
+    //
+    // 欄位用 `result_id` 而不是比照 `results` 的 `job_id`：那一欄存的其實是
+    // `jobId ?? ticketId`（前景直接跑 CLI 時沒有 job），叫 job_id 是既有的名實不符，
+    // 新表不跟進。**用同一個值當 key，所以前景那條路也拿得到進度。**
+    {
+        version: 3,
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS progress (
+          result_id      TEXT NOT NULL,
+          agent          TEXT NOT NULL,
+          round          INTEGER NOT NULL,
+          at             TEXT NOT NULL,
+          tokens_in      INTEGER NOT NULL,
+          tokens_out     INTEGER NOT NULL,
+          has_tool_calls INTEGER NOT NULL,
+          PRIMARY KEY (result_id, agent, round)
+        );
+      `);
+        },
+    },
+    // key-visibility §B：key 本身更新的時間不能冒充「最後驗證」；三個 nullable 欄位把
+    // 從未測過、測過成功、測過失敗分開。正常升級只會對 v3 DB 跑一次，但檢查既有欄位，
+    // 仍讓中斷後重跑或測試回退的 migration 安全，不把 ALTER TABLE 當成有 IF NOT EXISTS。
+    {
+        version: 4,
+        up: (db) => {
+            const columns = new Set(db.prepare("PRAGMA table_info(provider_keys)").all().map((column) => column.name));
+            if (!columns.has("last_tested_at"))
+                db.exec("ALTER TABLE provider_keys ADD COLUMN last_tested_at TEXT");
+            if (!columns.has("last_test_model"))
+                db.exec("ALTER TABLE provider_keys ADD COLUMN last_test_model TEXT");
+            if (!columns.has("last_test_succeeded"))
+                db.exec("ALTER TABLE provider_keys ADD COLUMN last_test_succeeded INTEGER");
+        },
+    },
+];
+const LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;
+function migrate(db, lang) {
+    const current = Number(db.prepare("PRAGMA user_version").get().user_version);
+    // Fail closed on a DB written by a newer dowafu.  Carrying on would mean an older binary
+    // reading a schema it does not know, which reads as working right up until it does not.
+    if (current > LATEST_SCHEMA_VERSION) {
+        throw new DispatchError(m(lang, "dbSchemaTooNew", current, LATEST_SCHEMA_VERSION), 2);
+    }
+    for (const migration of MIGRATIONS) {
+        if (migration.version <= current)
+            continue;
+        db.exec("BEGIN");
+        try {
+            migration.up(db);
+            // PRAGMA takes no bound parameters; the value is an integer literal from MIGRATIONS.
+            db.exec(`PRAGMA user_version = ${migration.version}`);
+            db.exec("COMMIT");
+        }
+        catch (err) {
+            db.exec("ROLLBACK");
+            throw err;
+        }
+    }
+}
+export function openDb(dbPath = defaultDbPath(), lang = "en") {
+    installSqliteWarningFilter();
+    if (dbPath !== ":memory:")
+        mkdirSync(path.dirname(path.resolve(dbPath)), { recursive: true });
+    const db = new DatabaseSyncDriver(dbPath);
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec("PRAGMA busy_timeout = 5000");
+    migrate(db, lang);
+    return db;
+}
+export { LATEST_SCHEMA_VERSION };
+export const now = () => new Date().toISOString();

package/dist/dispatch-home.js

@@ -1,12 +1,12 @@
-// plan_dispatch_v1.10.md §24.4：API key 的載入順序與位置。ambient process.env 優先
-// （CI、一次性覆寫），其次 $DISPATCH_HOME/.env；dotenv 預設不覆寫既有變數，故 ambient
-// 優先自然成立，不需額外邏輯。
+// `$DISPATCH_HOME` 的解析。**0.5.0 起本檔不再載入任何 `.env`**（使用者裁示，2026-09-06）：
+// API key 的唯一來源是 DB 的 `provider_keys` 表，見 provider-key.ts 的檔頭。
 //
-// 明文禁令：dispatch 不得讀取 cwd 的 `.env`——cwd 是被審專案，`import "dotenv/config"`
-// 會把該專案的整份 `.env`（資料庫密碼、第三方 token、webhook secret）載入一個正對三家
-// 外部 API 發請求的行程，而 §12 的遮蔽名單認不出那些秘密。此檔取代原本
-// `src/cli.ts` 頂部的 `import "dotenv/config"`。
-import dotenv from "dotenv";
+// 原本這裡有一支 `loadDispatchEnv`，把 `$DISPATCH_HOME/.env` 灌進 process.env，並為了讓
+// `--doctor` 分辨「ambient 填的」與「.env 填的」而在載入前後各拍一次快照。單一來源之後
+// 那整段連同 dotenv 依賴一起退場——**沒有那段程式，就沒有優先序與來源分辨的問題**。
+//
+// v1.10 §24.4 的禁令（不得讀 cwd 的 `.env`）現在由「根本不依賴 dotenv」保證，比原本的
+// 「只准讀指定路徑」更硬；`dotenv-invariant.test.ts` 的靜態掃描續留，防止有人加回來。
 import os from "node:os";
 import path from "node:path";
 // plan_i18n_v1.3.md §三：這兩個函式現在跑在 parseArgs／--help 之前（見 cli.ts），任何
@@ -28,14 +28,3 @@ export function resolveDispatchHome(env = process.env, homedir = os.homedir) {
         return null;
     }
 }
-// 唯一允許呼叫 dotenv 的地方——`path` 一律明確指定為 dispatchHome 下的 `.env`，
-// 絕不留白（留白即回退成 dotenv 預設讀 cwd 的 `.env`，正是本函式存在的目的所要杜絕的）。
-// 維持 `void` 簽名：讀取失敗一律降級為「沒有設定檔」（見上方註解），呼叫端不需要狀態。
-export function loadDispatchEnv(dispatchHome) {
-    try {
-        dotenv.config({ path: path.join(dispatchHome, ".env") });
-    }
-    catch {
-        // .env 是目錄／無讀取權限／內容畸形等，全部降級，不中止、不拋。
-    }
-}