dsh-vibe-math 2.4.0 → 2.4.1

package/vibe-math-v2/vibe-math-v2.js

@@ -1,5 +1,5 @@
-// Vibe Math V2 — host plugin implementing the NEW architecture spec
-// ("新架构-vibe-math-实现方案.md"): probability-driven scheduling over a
+// Vibe Math V2 — host plugin implementing the classic-architecture spec
+// ("vibe-math-v2/实现方案.md"): probability-driven scheduling over a
 // problem list (qs/qs.json) and a proposition knowledge base (Propos/),
 // multi-agent independent review → debate → consensus verification, with
 // checkpoint resume, manual intervention, and file/push progress reporting.
@@ -137,16 +137,10 @@ export function apply(ctx) {
 
   // ================= helpers =================
   function textBlock(t) { return { type: 'text', text: String(t) } }
-  function now() { return Date.now() }
-  function uuid() { const h = '0123456789abcdef'; let s = ''; for (let i = 0; i < 36; i++) { if (i === 8 || i === 13 || i === 18 || i === 23) s += '-'; else s += h[Math.floor(Math.random() * 16)] } return s }
-  function shortId() { const h = '0123456789abcdef'; let s = ''; for (let i = 0; i < 8; i++) s += h[Math.floor(Math.random() * 16)]; return s }
-  function clamp01(v) { const n = Number(v); if (!Number.isFinite(n)) return 0.5; return Math.max(0, Math.min(1, n)) }
   function workspaceRoot() { try { if (rootAgent && rootAgent.session && rootAgent.session.header && rootAgent.session.header.cwd) return rootAgent.session.header.cwd } catch (e) {} const sp = sandboxPolicyOf(); if (sp && sp.workspaceRoot) return sp.workspaceRoot; return '.' }
   function vibeRoot() { return (workspaceRoot() + '/VibeMath').replace(/\\/g, '/') }
   function projectRoot(slug) { return vibeRoot() + '/Projects/' + slug }
   function frameworkRoot() { return projectRoot(currentProject) }
-  function slugify(s) { const t = String(s == null ? '' : s).trim().toLowerCase().replace(/[^a-z0-9_\-\u4e00-\u9fa5]+/g, '-').replace(/^-+|-+$/g, ''); return t || 'project' }
-  function safeId(s) { return String(s == null ? 'anon' : s).replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 80) || 'anon' }
   let warnedNoPolicy = false
   function warnNoPolicyOnce() { if (!warnedNoPolicy) { warnedNoPolicy = true; console.error('vibe-math-v2: sandboxPolicy unavailable; writes go out with no explicit policy') } }
   // Sandbox fence for our own writes. The `resolve({})` fallback is a last resort and is
@@ -155,33 +149,6 @@ export function apply(ctx) {
   // which is not necessarily this session's workspace — a silently different fence.
   function getPolicy() { const sp = sandboxPolicyOf(); if (!sp) { warnNoPolicyOnce(); return undefined } try { if (rootAgent && rootAgent.session) return sp.resolve({ session: rootAgent.session }) } catch (e) { warnNoPolicyOnce() } try { const p = sp.resolve({}); if (!warnedNoPolicy) { warnedNoPolicy = true; console.error('vibe-math-v2: falling back to sandboxPolicy.resolve({}) — the fence root is the host-configured workspace, not necessarily this session cwd') } return p } catch (e) { warnNoPolicyOnce() } return undefined }
   function makeSignal(ms) { return AbortSignal.timeout(ms || 30000) }
-  function blocksToText(blocks) { if (!blocks) return ''; let out = ''; for (let i = 0; i < blocks.length; i++) { const b = blocks[i]; if (b && b.type === 'text' && typeof b.text === 'string') out += b.text + '\n' } return out.trim() }
-  function parseJson(text) {
-    if (typeof text !== 'string') return undefined
-    const tryObj = function (s) { try { const v = JSON.parse(s); return (v && typeof v === 'object' && !Array.isArray(v)) ? v : undefined } catch (e) { return undefined } }
-    const fenceRe = /```(?:json)?[ \t]*([\s\S]*?)```/gi
-    let m
-    while ((m = fenceRe.exec(text)) !== null) { const obj = tryObj(m[1].trim()); if (obj !== undefined) return obj }
-    const whole = tryObj(text.trim()); if (whole !== undefined) return whole
-    let best = undefined; let bestLen = -1
-    for (let start = 0; start < text.length; start++) {
-      if (text[start] !== '{') continue
-      let depth = 0, inStr = false, esc = false, end = -1
-      for (let i = start; i < text.length; i++) {
-        const c = text[i]
-        if (inStr) { if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') inStr = false; continue }
-        if (c === '"') { inStr = true; continue }
-        if (c === '{') depth++
-        else if (c === '}') { depth--; if (depth === 0) { end = i; break } }
-      }
-      if (end === -1) continue
-      const obj = tryObj(text.slice(start, end + 1))
-      if (obj !== undefined && (end - start + 1) > bestLen) { best = obj; bestLen = end - start + 1 }
-    }
-    return best
-  }
-  function safeJson(v, fb) { if (v == null || v === '') return fb; try { return JSON.parse(v) } catch (e) { return fb } }
-  function stripJsonComments(text) { let out = ''; let inStr = false; let inLine = false; let inBlock = false; let esc = false; for (let i = 0; i < text.length; i++) { const c = text[i]; const n = text[i + 1]; if (inLine) { if (c === '\n') { inLine = false; out += c } continue } if (inBlock) { if (c === '*' && n === '/') { inBlock = false; i++ } continue } if (inStr) { out += c; if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') inStr = false; continue } if (c === '"') { inStr = true; out += c; continue } if (c === '/' && n === '/') { inLine = true; i++; continue } if (c === '/' && n === '*') { inBlock = true; i++; continue } out += c } return out }
 
   // ================= parameter schema =================
   const PARAM_SCHEMA = [
@@ -996,7 +963,6 @@ export function apply(ctx) {
     L.push('')
     await writeText('Formal/TODO.md', L.join('\n'))
   }
-  function fmtTime(ms) { try { return new Date(Number(ms) || now()).toISOString().replace('T', ' ').slice(0, 19) } catch (e) { return '' } }
   async function rebuildLeanLibIndexes() {
     // 扫描**不执行**工具链：每次问"有什么可复用"就跑一遍 lean 既慢又出人意料。
     // 每个对象的运行结果存在对象记录里，显示在 Formal/Index.md。
@@ -1187,15 +1153,6 @@ export function apply(ctx) {
 
   // progress：结构化 JSON 对象（旧数据可能是 JSON 字符串，两者兼容解析）。
   // 注意：必须保证返回对象含 directions 数组（晋升/判断/子问题等 progress 可能只有来源/说明等字段）。
-  function parseProgress(q) {
-    const raw = (q && q.progress) || null
-    let p = null
-    if (raw && typeof raw === 'object' && !Array.isArray(raw)) p = raw
-    else p = safeJson(raw, null)
-    if (!p || typeof p !== 'object' || Array.isArray(p)) return { directions: [], experience: '' }
-    if (!Array.isArray(p.directions)) p.directions = []
-    return p
-  }
   async function saveProgress(qid, progObj) { const qs = await getQs(); const q = qs.find(function (x) { return x.id === qid }); if (!q) return; q.progress = progObj; await writeQs(qs) }
 
   // ================= data layer: Propos =================
@@ -1322,24 +1279,7 @@ export function apply(ctx) {
    * own rejection message, which lists every registered global tool, so this
    * never guesses. Returns undefined when nothing usable remains.
    */
-  function sanitizeToolFilter(filter, known) {
-    if (!filter || !(known instanceof Set) || known.size === 0) return filter
-    const out = {}
-    for (const key of ['allow', 'deny']) {
-      const list = filter[key]
-      if (!Array.isArray(list)) continue
-      const kept = list.filter(function (n) { return known.has(String(n).trim()) })
-      if (kept.length > 0) out[key] = kept
-    }
-    return (out.allow || out.deny) ? out : undefined
-  }
   /** The host names the offending tools and then lists the registered ones. */
-  function registeredToolsFromError(message) {
-    const m = /known global tools:\s*([^]*)$/.exec(String(message || ''))
-    if (!m) return undefined
-    const names = m[1].split(',').map(function (s) { return s.trim() }).filter(Boolean)
-    return names.length > 0 ? new Set(names) : undefined
-  }
   function buildToolFilter(role) { const allow = role === 'solver' ? params.solverToolAllow : role === 'verifier' ? params.verifierToolAllow : undefined; const deny = role === 'solver' ? params.solverToolDeny : role === 'verifier' ? params.verifierToolDeny : undefined; const net = role === 'solver' ? params.solverAllowNetwork : role === 'verifier' ? params.verifierAllowNetwork : undefined; const scr = role === 'solver' ? params.solverAllowScripts : role === 'verifier' ? params.verifierAllowScripts : undefined; let a = Array.isArray(allow) ? allow.slice() : []; let d = Array.isArray(deny) ? deny.slice() : []; if (net === false) d = d.concat(NETWORK_TOOLS); else if (net === true && a.length > 0) a = a.concat(NETWORK_TOOLS); if (scr === false) d = d.concat(SCRIPT_TOOLS); else if (scr === true && a.length > 0) a = a.concat(SCRIPT_TOOLS); const f = {}; if (a.length > 0) f.allow = a; if (d.length > 0) f.deny = d; return (f.allow || f.deny) ? f : undefined }
   async function spawnChild(label, promptText, meta) {
     const request = { prompt: [textBlock(promptText)], parent: rootAgent, agentOptions: childAgentOptions() }
@@ -2622,3 +2562,106 @@ export function apply(ctx) {
   // tick timer (registered once; ticks every running session at its own pace)
   ctx.effect(() => { const t = setInterval(function () { for (const s of sessions.values()) { if (s.getRunning() && !s.tickInFlight && s.tickDue() && s.scheduler.gate === null) s.scheduleTick() } }, 1000); return () => clearInterval(t) })
 }
+
+// ---- test seam: pure, stateless helpers --------------------------------
+// These helpers were declared inside `apply()` and are now declared at module scope, so
+// `apply()` closes over exactly the same function objects this export hands out. The audit
+// suites therefore exercise the REAL implementations by importing this module, instead of
+// extracting source text and compiling function bodies through the Function constructor
+// (dynamic code execution, rejected by the plugin-catalog security scan as
+// DANGEROUS_DYNAMIC_EXECUTION).
+//
+// Contract: no member may touch `ctx`, session state or mutable module state. Most are pure;
+// three are deliberately non-deterministic (`uuid`/`shortId` use Math.random, `fmtTime` falls back
+// to the clock) and `parseProgress` normalises the object it is handed in place (pre-existing).
+// Nothing here is used by the plugin at runtime except through `apply()`, and behaviour is
+// byte-identical to the previous in-`apply` declarations.
+export const __testHelpers = {
+  uuid,
+  shortId,
+  clamp01,
+  slugify,
+  safeId,
+  blocksToText,
+  parseJson,
+  safeJson,
+  stripJsonComments,
+  fmtTime,
+  parseProgress,
+  sanitizeToolFilter,
+  registeredToolsFromError,
+}
+
+function now() { return Date.now() }
+
+function uuid() { const h = '0123456789abcdef'; let s = ''; for (let i = 0; i < 36; i++) { if (i === 8 || i === 13 || i === 18 || i === 23) s += '-'; else s += h[Math.floor(Math.random() * 16)] } return s }
+
+function shortId() { const h = '0123456789abcdef'; let s = ''; for (let i = 0; i < 8; i++) s += h[Math.floor(Math.random() * 16)]; return s }
+
+function clamp01(v) { const n = Number(v); if (!Number.isFinite(n)) return 0.5; return Math.max(0, Math.min(1, n)) }
+
+function slugify(s) { const t = String(s == null ? '' : s).trim().toLowerCase().replace(/[^a-z0-9_\-\u4e00-\u9fa5]+/g, '-').replace(/^-+|-+$/g, ''); return t || 'project' }
+
+function safeId(s) { return String(s == null ? 'anon' : s).replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 80) || 'anon' }
+
+function blocksToText(blocks) { if (!blocks) return ''; let out = ''; for (let i = 0; i < blocks.length; i++) { const b = blocks[i]; if (b && b.type === 'text' && typeof b.text === 'string') out += b.text + '\n' } return out.trim() }
+
+function parseJson(text) {
+  if (typeof text !== 'string') return undefined
+  const tryObj = function (s) { try { const v = JSON.parse(s); return (v && typeof v === 'object' && !Array.isArray(v)) ? v : undefined } catch (e) { return undefined } }
+  const fenceRe = /```(?:json)?[ \t]*([\s\S]*?)```/gi
+  let m
+  while ((m = fenceRe.exec(text)) !== null) { const obj = tryObj(m[1].trim()); if (obj !== undefined) return obj }
+  const whole = tryObj(text.trim()); if (whole !== undefined) return whole
+  let best = undefined; let bestLen = -1
+  for (let start = 0; start < text.length; start++) {
+    if (text[start] !== '{') continue
+    let depth = 0, inStr = false, esc = false, end = -1
+    for (let i = start; i < text.length; i++) {
+      const c = text[i]
+      if (inStr) { if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') inStr = false; continue }
+      if (c === '"') { inStr = true; continue }
+      if (c === '{') depth++
+      else if (c === '}') { depth--; if (depth === 0) { end = i; break } }
+    }
+    if (end === -1) continue
+    const obj = tryObj(text.slice(start, end + 1))
+    if (obj !== undefined && (end - start + 1) > bestLen) { best = obj; bestLen = end - start + 1 }
+  }
+  return best
+}
+
+function safeJson(v, fb) { if (v == null || v === '') return fb; try { return JSON.parse(v) } catch (e) { return fb } }
+
+function stripJsonComments(text) { let out = ''; let inStr = false; let inLine = false; let inBlock = false; let esc = false; for (let i = 0; i < text.length; i++) { const c = text[i]; const n = text[i + 1]; if (inLine) { if (c === '\n') { inLine = false; out += c } continue } if (inBlock) { if (c === '*' && n === '/') { inBlock = false; i++ } continue } if (inStr) { out += c; if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') inStr = false; continue } if (c === '"') { inStr = true; out += c; continue } if (c === '/' && n === '/') { inLine = true; i++; continue } if (c === '/' && n === '*') { inBlock = true; i++; continue } out += c } return out }
+
+function fmtTime(ms) { try { return new Date(Number(ms) || now()).toISOString().replace('T', ' ').slice(0, 19) } catch (e) { return '' } }
+
+function parseProgress(q) {
+  const raw = (q && q.progress) || null
+  let p = null
+  if (raw && typeof raw === 'object' && !Array.isArray(raw)) p = raw
+  else p = safeJson(raw, null)
+  if (!p || typeof p !== 'object' || Array.isArray(p)) return { directions: [], experience: '' }
+  if (!Array.isArray(p.directions)) p.directions = []
+  return p
+}
+
+function sanitizeToolFilter(filter, known) {
+  if (!filter || !(known instanceof Set) || known.size === 0) return filter
+  const out = {}
+  for (const key of ['allow', 'deny']) {
+    const list = filter[key]
+    if (!Array.isArray(list)) continue
+    const kept = list.filter(function (n) { return known.has(String(n).trim()) })
+    if (kept.length > 0) out[key] = kept
+  }
+  return (out.allow || out.deny) ? out : undefined
+}
+
+function registeredToolsFromError(message) {
+  const m = /known global tools:\s*([^]*)$/.exec(String(message || ''))
+  if (!m) return undefined
+  const names = m[1].split(',').map(function (s) { return s.trim() }).filter(Boolean)
+  return names.length > 0 ? new Set(names) : undefined
+}

package/vibe-math-v3/vibe-math-v3.js

@@ -197,17 +197,10 @@ export function apply(ctx) {
 
   // ================= helpers =================
   function textBlock(t) { return { type: 'text', text: String(t) } }
-  function now() { return Date.now() }
-  function uuid() { const h = '0123456789abcdef'; let s = ''; for (let i = 0; i < 36; i++) { if (i === 8 || i === 13 || i === 18 || i === 23) s += '-'; else s += h[Math.floor(Math.random() * 16)] } return s }
-  function shortId() { const h = '0123456789abcdef'; let s = ''; for (let i = 0; i < 8; i++) s += h[Math.floor(Math.random() * 16)]; return s }
-  function clamp01(v) { const n = Number(v); if (!Number.isFinite(n)) return 0.5; return Math.max(0, Math.min(1, n)) }
-  function fmtTime(ts) { try { return new Date(ts || now()).toISOString().replace('T', ' ').slice(0, 19) } catch (e) { return String(ts || '') } }
   function workspaceRoot() { try { if (rootAgent && rootAgent.session && rootAgent.session.header && rootAgent.session.header.cwd) return rootAgent.session.header.cwd } catch (e) {} const sp = sandboxPolicyOf(); if (sp && sp.workspaceRoot) return sp.workspaceRoot; return '.' }
   function vibeRoot() { return (workspaceRoot() + '/VibeMath').replace(/\\/g, '/') }
   function projectRoot(slug) { return vibeRoot() + '/Projects/' + slug }
   function frameworkRoot() { return projectRoot(currentProject) }
-  function slugify(s) { const t = String(s == null ? '' : s).trim().toLowerCase().replace(/[^a-z0-9_\-\u4e00-\u9fa5]+/g, '-').replace(/^-+|-+$/g, ''); return t || 'project' }
-  function safeId(s) { return String(s == null ? 'anon' : s).replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 80) || 'anon' }
   /**
    * 把模型/用户提供的对象 id 消毒成**单个安全文件名**。v4 已有等价的 idSafe（见
    * vibe-math-v4.js），v3 此前缺这一步：saveProblem/saveProposition/saveVerified 直接
@@ -215,14 +208,6 @@ export function apply(ctx) {
    * 这里替换路径分隔符与控制字符、折叠连续连字符，并剥掉首尾的点/连字符，
    * 保证结果永不为 `.` / `..`、也不含分隔符。
    */
-  function idSafe(s) {
-    const t = String(s == null ? '' : s).trim()
-      .replace(/[\\/:*?"<>|\u0000-\u001f]+/g, '-')
-      .replace(/-{2,}/g, '-')
-      .replace(/^[.\-]+|[.\-]+$/g, '')
-      .slice(0, 80)
-    return t || 'id'
-  }
   let warnedNoPolicy = false
   function warnNoPolicyOnce() { if (!warnedNoPolicy) { warnedNoPolicy = true; console.error('vibe-math-v3: sandboxPolicy unavailable; writes go out with no explicit policy') } }
   // Sandbox fence for our own writes. The `resolve({})` fallback is a last resort and is
@@ -231,33 +216,6 @@ export function apply(ctx) {
   // which is not necessarily this session's workspace — a silently different fence.
   function getPolicy() { const sp = sandboxPolicyOf(); if (!sp) { warnNoPolicyOnce(); return undefined } try { if (rootAgent && rootAgent.session) return sp.resolve({ session: rootAgent.session }) } catch (e) { warnNoPolicyOnce() } try { const p = sp.resolve({}); if (!warnedNoPolicy) { warnedNoPolicy = true; console.error('vibe-math-v3: falling back to sandboxPolicy.resolve({}) — the fence root is the host-configured workspace, not necessarily this session cwd') } return p } catch (e) { warnNoPolicyOnce() } return undefined }
   function makeSignal(ms) { return AbortSignal.timeout(ms || 30000) }
-  function blocksToText(blocks) { if (!blocks) return ''; let out = ''; for (let i = 0; i < blocks.length; i++) { const b = blocks[i]; if (b && b.type === 'text' && typeof b.text === 'string') out += b.text + '\n' } return out.trim() }
-  function parseJson(text) {
-    if (typeof text !== 'string') return undefined
-    const tryObj = function (s) { try { const v = JSON.parse(s); return (v && typeof v === 'object' && !Array.isArray(v)) ? v : undefined } catch (e) { return undefined } }
-    const fenceRe = /```(?:json)?[ \t]*([\s\S]*?)```/gi
-    let m
-    while ((m = fenceRe.exec(text)) !== null) { const obj = tryObj(m[1].trim()); if (obj !== undefined) return obj }
-    const whole = tryObj(text.trim()); if (whole !== undefined) return whole
-    let best = undefined; let bestLen = -1
-    for (let start = 0; start < text.length; start++) {
-      if (text[start] !== '{') continue
-      let depth = 0, inStr = false, esc = false, end = -1
-      for (let i = start; i < text.length; i++) {
-        const c = text[i]
-        if (inStr) { if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') inStr = false; continue }
-        if (c === '"') { inStr = true; continue }
-        if (c === '{') depth++
-        else if (c === '}') { depth--; if (depth === 0) { end = i; break } }
-      }
-      if (end === -1) continue
-      const obj = tryObj(text.slice(start, end + 1))
-      if (obj !== undefined && (end - start + 1) > bestLen) { best = obj; bestLen = end - start + 1 }
-    }
-    return best
-  }
-  function safeJson(v, fb) { if (v == null || v === '') return fb; try { return JSON.parse(v) } catch (e) { return fb } }
-  function stripJsonComments(text) { let out = ''; let inStr = false; let inLine = false; let inBlock = false; let esc = false; for (let i = 0; i < text.length; i++) { const c = text[i]; const n = text[i + 1]; if (inLine) { if (c === '\n') { inLine = false; out += c } continue } if (inBlock) { if (c === '*' && n === '/') { inBlock = false; i++ } continue } if (inStr) { out += c; if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') inStr = false; continue } if (c === '"') { inStr = true; out += c; continue } if (c === '/' && n === '/') { inLine = true; i++; continue } if (c === '/' && n === '*') { inBlock = true; i++; continue } out += c } return out }
 
   // ================= parameter schema =================
   const PARAM_SCHEMA = [
@@ -466,75 +424,14 @@ export function apply(ctx) {
   // ================= md soft-spec helpers =================
   // 软规范：对象 md 头部锚点行（唯一强制部分）+ 正文自由叙述。调度器只解析
   // 头部锚点与条目标题行（### 解法/证明/证伪 N｜标题｜概率X｜状态Y），从不解析正文散文。
-  function splitHeader(text) {
-    const idx = String(text).search(/\n## /)
-    const head = idx === -1 ? String(text) : String(text).slice(0, idx)
-    const body = idx === -1 ? '' : String(text).slice(idx + 1)
-    return { head: head, body: body }
-  }
-  function parseAnchors(head) {
-    const anchors = {}
-    const re = /^-\s*([A-Za-z\u4e00-\u9fa5/]+)\s*:\s*(.*)$/gm
-    let m
-    while ((m = re.exec(head)) !== null) anchors[m[1].trim()] = m[2].trim()
-    return anchors
-  }
   function anchorLine(k, v) { return '- ' + k + ': ' + String(v == null ? '' : v) }
   // 解析条目标题行 + 其后正文，直到下一个 ### / ## 标题。返回 [{heading, text}]
-  function parseEntries(body, kindRe) {
-    const out = []
-    const lines = String(body).split('\n')
-    let cur = null
-    for (let i = 0; i < lines.length; i++) {
-      const line = lines[i]
-      const m = kindRe.exec(line)
-      if (m) {
-        if (cur) out.push(cur)
-        // 约定：m[1]=标题段，m[2]=概率段，m[3]=状态段（应用记录正则只有 m[1]）
-        cur = { heading: line.trim(), title: (m[1] || '').trim(), prob: m[2] !== undefined ? Number(m[2]) : undefined, status: (m[3] || '').trim(), text: [] }
-        continue
-      }
-      if (/^#{2,3}\s/.test(line)) {
-        if (cur) { out.push(cur); cur = null }
-        continue
-      }
-      if (cur) cur.text.push(line)
-    }
-    if (cur) out.push(cur)
-    for (const e of out) e.text = e.text.join('\n').trim()
-    return out
-  }
-  function section(body, name) {
-    const re = new RegExp('^##\\s+' + name + '\\s*$', 'm')
-    const m = re.exec(String(body))
-    if (!m) return ''
-    const rest = String(body).slice(m.index + m[0].length)
-    const end = rest.search(/\n##\s/)
-    return (end === -1 ? rest : rest.slice(0, end)).trim()
-  }
   /**
    * 按顺序切出正文里的所有 `## ` 顶层段。用于"无损往返"：compose 只重新生成自己管理的
    * 那几段，其余段（例如 经验与教训、或代理自加的任何段）必须原样保留，否则每次调度器
    * 回写都会把代理写进卡片的内容抹掉（违反 实现方案.md「正文只追加，不覆盖」）。
    */
-  function parseBodySections(body) {
-    const text = String(body || '')
-    const re = /^##\s+(.+?)\s*$/gm
-    const found = []
-    let m
-    while ((m = re.exec(text)) !== null) found.push({ name: m[1].trim(), from: m.index, bodyFrom: m.index + m[0].length })
-    for (let i = 0; i < found.length; i++) {
-      const to = i + 1 < found.length ? found[i + 1].from : text.length
-      found[i].text = text.slice(found[i].bodyFrom, to).trim()
-    }
-    return found
-  }
   /** 未被 compose 接管的段：原样保留，避免回写时丢失。 */
-  function extraBodySections(body, managedNames) {
-    return parseBodySections(body)
-      .filter(function (s) { return !managedNames.includes(s.name) })
-      .map(function (s) { return { name: s.name, text: s.text } })
-  }
   /** 把保留段追加到 compose 输出末尾（无则原样返回），保证正文只增不减。 */
   function withExtraSections(lines, extras) {
     if (!Array.isArray(extras) || extras.length === 0) return lines
@@ -691,34 +588,6 @@ export function apply(ctx) {
    * 必须把 问题/方向 取回来：compose 会按本对象的字段重写该标题行，若解析时丢成空串，
    * 每次回写都会把"用在哪"永久抹掉（实现方案.md 要求记录 问题/方向）。
    */
-  function parseAppTitle(title) {
-    const t = String(title || '')
-    const mQ = /问题\s*(\S+)/.exec(t)
-    const mD = /方向\s*(\S+)/.exec(t)
-    // `at` = 第一段（时间戳）。取第一个 '｜' 之前的部分。
-    const at = t.split('｜')[0].trim()
-    return { at: at, 问题: mQ ? mQ[1] : '', 方向: mD ? mD[1] : '' }
-  }
-  function parseMethodMd(id, text) {
-    const { head, body } = splitHeader(text)
-    const a = parseAnchors(head)
-    const apps = parseEntries(body, /^###\s*应用\s*\d+｜(.*?)$/).map(function (e) {
-      const t = parseAppTitle(e.title)
-      return { at: t.at, 问题: t.问题, 方向: t.方向, text: e.text }
-    })
-    // 改进历史必须真正解析回来：此前硬编码 [] 导致每次 compose 都写成占位符，
-    // 于是"下一次用到该方法"就把代理沉淀的改进历史静默销毁（违反「正文只追加，不覆盖」）。
-    const improvements = parseEntries(body, /^###\s*v(\d+)\s*（(.*?)）\s*$/).map(function (e) {
-      return { v: Number(e.title) || 0, 原因: e.status || '', text: e.text }
-    })
-    return {
-      id: id, 标题: a['标题'] || id, 类型: a['类型'] || '方法', 状态: a['状态'] || '经验',
-      可信断言: safeJson(a['可信断言'], []), 上级体系: safeJson(a['上级体系'], []), 子方法: safeJson(a['子方法'], []), 相关: safeJson(a['相关'], []),
-      适用场景: a['适用场景'] || '', 核心内容: section(body, '核心内容'), 定义与记号: section(body, '定义与记号'),
-      applications: apps, improvements: improvements, 来源: a['来源'] || '',
-      extraSections: extraBodySections(body, ['核心内容', '定义与记号', '应用记录', '改进历史']),
-    }
-  }
 
   // ---- compose: Verified card ----
   function composeVerifiedMd(card) {
@@ -1096,24 +965,7 @@ export function apply(ctx) {
    * own rejection message, which lists every registered global tool, so this
    * never guesses. Returns undefined when nothing usable remains.
    */
-  function sanitizeToolFilter(filter, known) {
-    if (!filter || !(known instanceof Set) || known.size === 0) return filter
-    const out = {}
-    for (const key of ['allow', 'deny']) {
-      const list = filter[key]
-      if (!Array.isArray(list)) continue
-      const kept = list.filter(function (n) { return known.has(String(n).trim()) })
-      if (kept.length > 0) out[key] = kept
-    }
-    return (out.allow || out.deny) ? out : undefined
-  }
   /** The host names the offending tools and then lists the registered ones. */
-  function registeredToolsFromError(message) {
-    const m = /known global tools:\s*([^]*)$/.exec(String(message || ''))
-    if (!m) return undefined
-    const names = m[1].split(',').map(function (s) { return s.trim() }).filter(Boolean)
-    return names.length > 0 ? new Set(names) : undefined
-  }
   function buildToolFilter(role) {
     const allow = role === 'solver' ? params.solverToolAllow : role === 'verifier' ? params.verifierToolAllow : undefined
     const deny = role === 'solver' ? params.solverToolDeny : role === 'verifier' ? params.verifierToolDeny : undefined
@@ -3799,3 +3651,210 @@ export function apply(ctx) {
   // tick timer (registered once; ticks every running session at its own pace)
   ctx.effect(() => { const t = setInterval(function () { for (const s of sessions.values()) { if (s.getRunning() && !s.tickInFlight && s.tickDue() && s.scheduler.gate === null) s.scheduleTick() } }, 1000); return () => clearInterval(t) })
 }
+
+// ---- test seam: pure, stateless helpers --------------------------------
+// These helpers were declared inside `apply()` and are now declared at module scope, so
+// `apply()` closes over exactly the same function objects this export hands out. The audit
+// suites therefore exercise the REAL implementations by importing this module, instead of
+// extracting source text and compiling function bodies through the Function constructor
+// (dynamic code execution, rejected by the plugin-catalog security scan as
+// DANGEROUS_DYNAMIC_EXECUTION).
+//
+// Contract: no member may touch `ctx`, session state or mutable module state. Most are pure;
+// three are deliberately non-deterministic (`uuid`/`shortId` use Math.random, `fmtTime` falls back
+// to the clock) and `parseProgress` normalises the object it is handed in place (pre-existing).
+// Nothing here is used by the plugin at runtime except through `apply()`, and behaviour is
+// byte-identical to the previous in-`apply` declarations.
+export const __testHelpers = {
+  uuid,
+  shortId,
+  clamp01,
+  fmtTime,
+  slugify,
+  safeId,
+  idSafe,
+  blocksToText,
+  parseJson,
+  safeJson,
+  stripJsonComments,
+  splitHeader,
+  parseAnchors,
+  parseEntries,
+  section,
+  parseBodySections,
+  extraBodySections,
+  parseAppTitle,
+  parseMethodMd,
+  sanitizeToolFilter,
+  registeredToolsFromError,
+}
+
+function now() { return Date.now() }
+
+function uuid() { const h = '0123456789abcdef'; let s = ''; for (let i = 0; i < 36; i++) { if (i === 8 || i === 13 || i === 18 || i === 23) s += '-'; else s += h[Math.floor(Math.random() * 16)] } return s }
+
+function shortId() { const h = '0123456789abcdef'; let s = ''; for (let i = 0; i < 8; i++) s += h[Math.floor(Math.random() * 16)]; return s }
+
+function clamp01(v) { const n = Number(v); if (!Number.isFinite(n)) return 0.5; return Math.max(0, Math.min(1, n)) }
+
+function fmtTime(ts) { try { return new Date(ts || now()).toISOString().replace('T', ' ').slice(0, 19) } catch (e) { return String(ts || '') } }
+
+function slugify(s) { const t = String(s == null ? '' : s).trim().toLowerCase().replace(/[^a-z0-9_\-\u4e00-\u9fa5]+/g, '-').replace(/^-+|-+$/g, ''); return t || 'project' }
+
+function safeId(s) { return String(s == null ? 'anon' : s).replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 80) || 'anon' }
+
+function idSafe(s) {
+  const t = String(s == null ? '' : s).trim()
+    .replace(/[\\/:*?"<>|\u0000-\u001f]+/g, '-')
+    .replace(/-{2,}/g, '-')
+    .replace(/^[.\-]+|[.\-]+$/g, '')
+    .slice(0, 80)
+  return t || 'id'
+}
+
+function blocksToText(blocks) { if (!blocks) return ''; let out = ''; for (let i = 0; i < blocks.length; i++) { const b = blocks[i]; if (b && b.type === 'text' && typeof b.text === 'string') out += b.text + '\n' } return out.trim() }
+
+function parseJson(text) {
+  if (typeof text !== 'string') return undefined
+  const tryObj = function (s) { try { const v = JSON.parse(s); return (v && typeof v === 'object' && !Array.isArray(v)) ? v : undefined } catch (e) { return undefined } }
+  const fenceRe = /```(?:json)?[ \t]*([\s\S]*?)```/gi
+  let m
+  while ((m = fenceRe.exec(text)) !== null) { const obj = tryObj(m[1].trim()); if (obj !== undefined) return obj }
+  const whole = tryObj(text.trim()); if (whole !== undefined) return whole
+  let best = undefined; let bestLen = -1
+  for (let start = 0; start < text.length; start++) {
+    if (text[start] !== '{') continue
+    let depth = 0, inStr = false, esc = false, end = -1
+    for (let i = start; i < text.length; i++) {
+      const c = text[i]
+      if (inStr) { if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') inStr = false; continue }
+      if (c === '"') { inStr = true; continue }
+      if (c === '{') depth++
+      else if (c === '}') { depth--; if (depth === 0) { end = i; break } }
+    }
+    if (end === -1) continue
+    const obj = tryObj(text.slice(start, end + 1))
+    if (obj !== undefined && (end - start + 1) > bestLen) { best = obj; bestLen = end - start + 1 }
+  }
+  return best
+}
+
+function safeJson(v, fb) { if (v == null || v === '') return fb; try { return JSON.parse(v) } catch (e) { return fb } }
+
+function stripJsonComments(text) { let out = ''; let inStr = false; let inLine = false; let inBlock = false; let esc = false; for (let i = 0; i < text.length; i++) { const c = text[i]; const n = text[i + 1]; if (inLine) { if (c === '\n') { inLine = false; out += c } continue } if (inBlock) { if (c === '*' && n === '/') { inBlock = false; i++ } continue } if (inStr) { out += c; if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') inStr = false; continue } if (c === '"') { inStr = true; out += c; continue } if (c === '/' && n === '/') { inLine = true; i++; continue } if (c === '/' && n === '*') { inBlock = true; i++; continue } out += c } return out }
+
+function splitHeader(text) {
+  const idx = String(text).search(/\n## /)
+  const head = idx === -1 ? String(text) : String(text).slice(0, idx)
+  const body = idx === -1 ? '' : String(text).slice(idx + 1)
+  return { head: head, body: body }
+}
+
+function parseAnchors(head) {
+  const anchors = {}
+  const re = /^-\s*([A-Za-z\u4e00-\u9fa5/]+)\s*:\s*(.*)$/gm
+  let m
+  while ((m = re.exec(head)) !== null) anchors[m[1].trim()] = m[2].trim()
+  return anchors
+}
+
+function parseEntries(body, kindRe) {
+  const out = []
+  const lines = String(body).split('\n')
+  let cur = null
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    const m = kindRe.exec(line)
+    if (m) {
+      if (cur) out.push(cur)
+      // 约定：m[1]=标题段，m[2]=概率段，m[3]=状态段（应用记录正则只有 m[1]）
+      cur = { heading: line.trim(), title: (m[1] || '').trim(), prob: m[2] !== undefined ? Number(m[2]) : undefined, status: (m[3] || '').trim(), text: [] }
+      continue
+    }
+    if (/^#{2,3}\s/.test(line)) {
+      if (cur) { out.push(cur); cur = null }
+      continue
+    }
+    if (cur) cur.text.push(line)
+  }
+  if (cur) out.push(cur)
+  for (const e of out) e.text = e.text.join('\n').trim()
+  return out
+}
+
+function section(body, name) {
+  const re = new RegExp('^##\\s+' + name + '\\s*$', 'm')
+  const m = re.exec(String(body))
+  if (!m) return ''
+  const rest = String(body).slice(m.index + m[0].length)
+  const end = rest.search(/\n##\s/)
+  return (end === -1 ? rest : rest.slice(0, end)).trim()
+}
+
+function parseBodySections(body) {
+  const text = String(body || '')
+  const re = /^##\s+(.+?)\s*$/gm
+  const found = []
+  let m
+  while ((m = re.exec(text)) !== null) found.push({ name: m[1].trim(), from: m.index, bodyFrom: m.index + m[0].length })
+  for (let i = 0; i < found.length; i++) {
+    const to = i + 1 < found.length ? found[i + 1].from : text.length
+    found[i].text = text.slice(found[i].bodyFrom, to).trim()
+  }
+  return found
+}
+
+function extraBodySections(body, managedNames) {
+  return parseBodySections(body)
+    .filter(function (s) { return !managedNames.includes(s.name) })
+    .map(function (s) { return { name: s.name, text: s.text } })
+}
+
+function parseAppTitle(title) {
+  const t = String(title || '')
+  const mQ = /问题\s*(\S+)/.exec(t)
+  const mD = /方向\s*(\S+)/.exec(t)
+  // `at` = 第一段（时间戳）。取第一个 '｜' 之前的部分。
+  const at = t.split('｜')[0].trim()
+  return { at: at, 问题: mQ ? mQ[1] : '', 方向: mD ? mD[1] : '' }
+}
+
+function parseMethodMd(id, text) {
+  const { head, body } = splitHeader(text)
+  const a = parseAnchors(head)
+  const apps = parseEntries(body, /^###\s*应用\s*\d+｜(.*?)$/).map(function (e) {
+    const t = parseAppTitle(e.title)
+    return { at: t.at, 问题: t.问题, 方向: t.方向, text: e.text }
+  })
+  // 改进历史必须真正解析回来：此前硬编码 [] 导致每次 compose 都写成占位符，
+  // 于是"下一次用到该方法"就把代理沉淀的改进历史静默销毁（违反「正文只追加，不覆盖」）。
+  const improvements = parseEntries(body, /^###\s*v(\d+)\s*（(.*?)）\s*$/).map(function (e) {
+    return { v: Number(e.title) || 0, 原因: e.status || '', text: e.text }
+  })
+  return {
+    id: id, 标题: a['标题'] || id, 类型: a['类型'] || '方法', 状态: a['状态'] || '经验',
+    可信断言: safeJson(a['可信断言'], []), 上级体系: safeJson(a['上级体系'], []), 子方法: safeJson(a['子方法'], []), 相关: safeJson(a['相关'], []),
+    适用场景: a['适用场景'] || '', 核心内容: section(body, '核心内容'), 定义与记号: section(body, '定义与记号'),
+    applications: apps, improvements: improvements, 来源: a['来源'] || '',
+    extraSections: extraBodySections(body, ['核心内容', '定义与记号', '应用记录', '改进历史']),
+  }
+}
+
+function sanitizeToolFilter(filter, known) {
+  if (!filter || !(known instanceof Set) || known.size === 0) return filter
+  const out = {}
+  for (const key of ['allow', 'deny']) {
+    const list = filter[key]
+    if (!Array.isArray(list)) continue
+    const kept = list.filter(function (n) { return known.has(String(n).trim()) })
+    if (kept.length > 0) out[key] = kept
+  }
+  return (out.allow || out.deny) ? out : undefined
+}
+
+function registeredToolsFromError(message) {
+  const m = /known global tools:\s*([^]*)$/.exec(String(message || ''))
+  if (!m) return undefined
+  const names = m[1].split(',').map(function (s) { return s.trim() }).filter(Boolean)
+  return names.length > 0 ? new Set(names) : undefined
+}

package/vibe-math-v3//345/256/236/347/216/260/346/226/271/346/241/210.md

@@ -610,7 +610,7 @@ VibeMath/                                   # 工作区级
 | 4. 方法库 | 方法卡+体系层级、应用记录自动追加、`new_inventions` 上报、Method Keeper 提炼、经验条目可信约束、项目→全局晋升 | 上报→沉淀→体系化链路通；经验条目不被当定理；晋升走门 |
 | 5. 控制面 | 参数/工具/命令、人工干预门（计划审批/裁决/方法晋升）、汇报、提示词全量 | manual 门挂起与 decide 放行；push 汇报触发 |
 | 6. 多会话 | per-session 隔离 + 项目锁 + 进程纪元 | 双会话并行各跑各的项目；resume 0 误中断 |
-| 7. 文档与迁移 | README（v3 为主推）、可选 v2→v3 迁移工具（JSON 项目 → md 骨架） | 迁移后项目可被 v3 调度器索引与续跑 |
+| 7. 文档与迁移 | README（v3 为经典）、可选 v2→v3 迁移工具（JSON 项目 → md 骨架） | 迁移后项目可被 v3 调度器索引与续跑 |
 
 ---
 
@@ -634,7 +634,7 @@ VibeMath/                                   # 工作区级
 3. **Verified 采用"调度器生成副本"**（Propos 保留历史，Verified 为定论只读版本），而非原位删除/移动。
 4. **规划代理输出 JSON**（机器接口），知识才用 md——调度器需要可校验的动作流，JSON 是最低成本的机器契约；md 的自由叙述留给知识对象。
 5. **软规范取折中**（锚点行强制 + 正文自由），而非完全零规范——否则调度器无法可靠索引；锚点仅 4~7 行，符合"不设较高严格规范"。
-6. **v3 作为新 preset id** `vibe-math-v3` 并入现有 npm 包 `dsh-vibe-math`（与 v2/v4 同包多预设），版本发布策略沿用（README 标注 v2 与 v3 同级主推、按需选择；老的 `vibe-math-v1` 已于 v2.0.0 移除，本包仅含 v2/v3/v4）。
+6. **v3 作为新 preset id** `vibe-math-v3` 并入现有 npm 包 `dsh-vibe-math`（与 v2/v4 同包多预设），版本发布策略沿用（README 标注四者同级、v2 与 v3 为经典；老的 `vibe-math-v1` 已于 v2.0.0 移除，本包仅含 v2/v3/v4/v5）。
 7. **v2 审计发现的两个缺陷**（flat 高置信分歧误判 0.5、引用被证伪卡片）在 v3 默认修复（§8.2）。
 8. **方法库收录范围**：不限解题技巧——任何过程中发明的/经验性总结出的有价值理论体系、框架、工具、方法、思想、范式、技巧均可沉淀（§7.1）；允许经验性条目（§7.4）；条目可组成体系层级并跨项目持续扩充（§7.3）。