iterate-plugin 2.10.0 → 2.11.0

package/src/review-scope.ts

@@ -114,20 +114,23 @@ function collectChanged(changedFiles: string[]): string[] {
 }
 
 function collectFull(root: string): string[] {
-  // Deterministic recursive walk built on Node's fs; a code reviewer never
-  // anchors findings to lock files, images, or vendored builds.
+  // Deterministic iterative walk (explicit stack — unbounded recursion could
+  // overflow on pathologically deep trees); a code reviewer never anchors
+  // findings to lock files, images, or vendored builds.
   const out: string[] = []
-  const walk = (dir: string): void => {
+  const stack: string[] = [root]
+  while (stack.length > 0) {
+    const dir = stack.pop()!
     let entries: import('node:fs').Dirent[]
     try {
       entries = readdirSync(dir, { withFileTypes: true })
     } catch {
-      return
+      continue
     }
     for (const entry of entries) {
       const abs = join(dir, entry.name)
       if (entry.isDirectory()) {
-        if (!isIgnoredDir(entry.name)) walk(abs)
+        if (!isIgnoredDir(entry.name)) stack.push(abs)
         continue
       }
       if (!entry.isFile()) continue
@@ -136,13 +139,14 @@ function collectFull(root: string): string[] {
       out.push(rel.split(SEP).join(SEP))
     }
   }
-  walk(root)
   return out.sort()
 }
 
 /** Split `files` into stable batches, keeping directory runs together. */
 export function chunkFiles(files: string[], perChunk?: number): string[][] {
-  const size = perChunk === undefined || perChunk < 1 ? DEFAULT_SCOPE_CHUNK_SIZE : perChunk
+  // Number.isFinite: NaN fails `perChunk < 1` and would yield one unbounded
+  // chunk (current.length >= NaN is never true).
+  const size = Number.isFinite(perChunk) && (perChunk as number) >= 1 ? (perChunk as number) : DEFAULT_SCOPE_CHUNK_SIZE
   const ordered = [...files].sort()
   const chunks: string[][] = []
   let current: string[] = []

package/src/review.ts

@@ -44,9 +44,11 @@ export function sortFindings(findings: ReviewFinding[]): ReviewFinding[] {
     const rankB = SEVERITY_RANK[b.severity] ?? SEVERITY_RANK.low
     const bySeverity = rankA - rankB
     if (bySeverity !== 0) return bySeverity
-    const byFile = a.file.localeCompare(b.file)
+    // Defensive coercion: `file`/`line` can be wrong-typed when schema
+    // validation is disabled — String()/Number() keep the comparator total.
+    const byFile = String(a.file ?? '').localeCompare(String(b.file ?? ''))
     if (byFile !== 0) return byFile
-    return (a.line ?? 0) - (b.line ?? 0)
+    return (Number(a.line) || 0) - (Number(b.line) || 0)
   })
 }
 
@@ -58,9 +60,15 @@ export function normalizeSummary(summary: string): string {
     .replace(/[\s\n\t]+/g, ' ')
 }
 
-/** Dedupe key: same file + same dimension + similar summary. */
+/**
+ * Dedupe key: same file + same dimension + similar summary + explicit line.
+ * Including the line keeps two genuine issues with identical wording at
+ * different locations from collapsing into one (the line is omitted only when
+ * neither side anchors one, i.e. whole-file findings).
+ */
 export function findingKey(f: ReviewFinding): string {
-  return `${f.file}|${f.dimension}|${normalizeSummary(f.summary)}`
+  const line = typeof f.line === 'number' && f.line > 0 ? f.line : 0
+  return `${f.file}|${f.dimension}|${line}|${normalizeSummary(f.summary)}`
 }
 
 /**
@@ -129,12 +137,19 @@ export function aggregateRounds(
   const merged: ReviewFinding[] = []
 
   // Guard: round numbers are expected to be positive integers. Skip malformed
-  // entries defensively rather than letting `firstRoundByKey` key on NaN/0.
+  // entries defensively rather than letting `firstRoundByKey` key on NaN/0 or
+  // crashing on null / non-array findings.
+  // Hard ceiling: round numbers are model-authored JSON; an absurd round (e.g.
+  // 1e9) would otherwise allocate an array of that size below (OOM). Round
+  // numbers above the configured cap are clamped to the cap.
   let maxRound = 0
+  const roundCap = Math.max(1, maxReviewRounds)
   for (const round of rounds) {
+    if (!round || typeof round !== 'object') continue
     if (typeof round.round !== 'number' || !Number.isInteger(round.round) || round.round < 1) continue
+    const findings = Array.isArray(round.findings) ? round.findings : []
     if (round.round > maxRound) maxRound = round.round
-    for (const f of round.findings) {
+    for (const f of findings) {
       const key = findingKey(f)
       if (seen.has(key)) continue
       seen.add(key)
@@ -142,9 +157,11 @@ export function aggregateRounds(
       merged.push(f)
     }
   }
+  // Clamp the allocation bound so a hostile round number cannot OOM the tool.
+  const effectiveMax = Math.min(maxRound, Math.max(1, roundCap * 2))
 
   const findingsByRound: number[] = []
-  for (let r = 1; r <= maxRound; r++) {
+  for (let r = 1; r <= effectiveMax; r++) {
     let count = 0
     for (const key of firstRoundByKey.keys()) {
       if (firstRoundByKey.get(key) === r) count++
@@ -165,12 +182,18 @@ export function computeConvergence(
   const { findingsByRound } = aggregateRounds(rounds, maxReviewRounds)
   const totalRounds = rounds.length
   // `findingsByRound` is indexed by the actual round number (round r → index
-  // r-1), so convergence must read the LAST PRESENT round's count using its
-  // reported round number — not `totalRounds - 1`, which is only valid for
-  // contiguous 1..N round numbers.
-  const lastRound = totalRounds > 0 ? rounds[totalRounds - 1]!.round : 0
-  const lastRoundCount =
-    lastRound > 0 ? (findingsByRound[lastRound - 1] ?? 0) : 0
+  // r-1), sized to the highest present round (clamped). Convergence must read
+  // the HIGHEST PRESENT round's count — not the last array element (rounds
+  // may arrive unsorted) and not `totalRounds - 1` (only valid for contiguous
+  // 1..N). The count index is bounded by the array length aggregateRounds
+  // actually allocated.
+  let lastRound = 0
+  for (const round of rounds) {
+    if (!round || typeof round.round !== 'number' || !Number.isInteger(round.round) || round.round < 1) continue
+    if (round.round > lastRound) lastRound = round.round
+  }
+  const idx = Math.min(lastRound, findingsByRound.length) - 1
+  const lastRoundCount = idx >= 0 ? (findingsByRound[idx] ?? 0) : 0
   const converged = totalRounds > 0 && lastRoundCount === 0
   return {
     totalRounds,
@@ -224,8 +247,12 @@ export function buildReviewReport(input: {
 }): ReviewReport {
   // 1. Filter known-intentional per round (before cross-round dedupe).
   const filteredRounds = input.rounds.map((r) => ({
-    round: r.round,
-    findings: filterKnownIntentional(r.findings, input.knownIntentional),
+    round: typeof r?.round === 'number' ? r.round : 0,
+    findings: filterKnownIntentional(
+      Array.isArray(r?.findings) ? r.findings : [],
+      input.knownIntentional,
+    ),
+    readFiles: Array.isArray(r?.readFiles) ? r.readFiles : [],
   }))
 
   // 2. Cross-round dedupe + per-round "first seen" tracking.
@@ -262,6 +289,9 @@ export function buildReviewReport(input: {
     maxReviewRounds: input.maxReviewRounds,
     rounds: filteredRounds,
     findings: sorted,
+    // Aggregate of every round's self-reported reads, so the meta-review
+    // coverage gate can compare against the assigned inventory.
+    readFiles: ([] as string[]).concat(...filteredRounds.map((r) => r.readFiles ?? [])),
     convergence: {
       totalRounds: filteredRounds.length,
       findingsByRound,
@@ -470,8 +500,8 @@ export interface RoundSchemaValidation {
  */
 export function validateRoundsSchema(rounds: ReviewRound[]): RoundSchemaValidation[] {
   return rounds.map((r) => {
-    const issues = validateFindingsSchema(r.findings)
-    return { round: r.round, valid: issues.length === 0, issues }
+    const issues = validateFindingsSchema(Array.isArray(r?.findings) ? r.findings : [])
+    return { round: typeof r?.round === 'number' ? r.round : 0, valid: issues.length === 0, issues }
   })
 }
 
@@ -491,21 +521,27 @@ export function sanitizeRounds(
   schemaValidation: RoundSchemaValidation[] | null,
 ): ReviewRound[] {
   return rounds.map((r, i) => {
+    // Defensive: malformed rounds must never crash the deterministic core.
+    const findings = Array.isArray(r?.findings) ? r.findings : []
+    const roundNo = typeof r?.round === 'number' ? r.round : 0
+    const readFiles = Array.isArray(r?.readFiles) ? r.readFiles : []
     if (schemaValidation) {
       const issues = schemaValidation[i]?.issues ?? []
-      if (issues.some((iss) => iss.index === -1)) return { round: r.round, findings: [] }
+      if (issues.some((iss) => iss.index === -1)) return { round: roundNo, findings: [], readFiles }
       const bad = new Set(issues.map((iss) => iss.index))
       return {
-        round: r.round,
-        findings: r.findings.filter((_, fi) => !bad.has(fi)),
+        round: roundNo,
+        findings: findings.filter((_, fi) => !bad.has(fi)),
+        readFiles,
       }
     }
     return {
-      round: r.round,
-      findings: r.findings.filter(
+      round: roundNo,
+      findings: findings.filter(
         (f): f is ReviewFinding =>
           Boolean(f) && typeof f === 'object' && !Array.isArray(f),
       ),
+      readFiles,
     }
   })
 }
@@ -539,6 +575,12 @@ export function reviewerTaskPrompt(input: {
    * `changedFiles`.
    */
   scopeFiles?: string[]
+  /**
+   * Per-dimension focus guidance (from personalization.dimension_focus, or the
+   * skill's dimension definitions). Appended to the reviewer prompt so the
+   * review concentrates on the areas the user cares about.
+   */
+  focus?: string
 }): string {
   const parts: string[] = []
   parts.push(
@@ -546,6 +588,9 @@ export function reviewerTaskPrompt(input: {
     `Goal: ${input.goal}`,
     `Scope: ${input.scope === 'full' ? 'entire codebase' : 'changed files only'}.`,
   )
+  if (input.focus) {
+    parts.push(`FOCUS: ${input.focus}`)
+  }
   if (input.scopeFiles && input.scopeFiles.length > 0) {
     parts.push(
       'COVERAGE RULE (mandatory): below is the exact file inventory you are ' +
@@ -592,9 +637,9 @@ export function reviewerTaskPrompt(input: {
   parts.push(
     `Return a JSON object: {"findings": [...], "readFiles": [...]}.`,
     `Each finding: dimension (must be "${input.dimension}"), file (relative path), ` +
-      'line (REQUIRED positive integer — the exact line you READ for an ' +
-      'anchored, line-targeted issue; use 0 for whole-file/module-level ' +
-      'issues), severity (critical/high/medium/low), summary (one line), ' +
+      'line (optional; the exact line you READ for a line-targeted issue; ' +
+      '0 or omitted for whole-file/module-level issues), ' +
+      'severity (critical/high/medium/low), summary (one line), ' +
       'failure_scenario (how/when it fails, backed by the code you actually ' +
       'read), suggested_fix (the concrete fix), ' +
       `is_atomic (true if the fix is <= ${input.maxLines} lines within a SINGLE file/function, else false).`,
@@ -672,6 +717,17 @@ export function buildReviewPlan(input: {
     reviewerPrompt: string
     findingsSchema: Record<string, unknown>
   }[] = []
+  // personalization.dimension_focus: [{dimension, focus}] — appended to the
+  // matching dimension's reviewer prompt.
+  const focusMap = new Map<string, string>()
+  const pf = input.config.personalization as { dimension_focus?: { dimension?: string; focus?: string }[] } | undefined
+  if (pf && Array.isArray(pf.dimension_focus)) {
+    for (const entry of pf.dimension_focus) {
+      if (entry && typeof entry.dimension === 'string' && typeof entry.focus === 'string' && entry.focus) {
+        focusMap.set(entry.dimension, entry.focus)
+      }
+    }
+  }
   for (const d of dimensions) {
     batches.forEach((batch, index) => {
       const dimensionId = batches.length === 1 ? d : `${d}#${index + 1}`
@@ -687,6 +743,7 @@ export function buildReviewPlan(input: {
           maxLines,
           changedFiles: effectiveChangedOnly ? changedFiles : undefined,
           scopeFiles: batch,
+          focus: focusMap.get(d),
         }),
         findingsSchema: findingsSchema(),
       })

package/src/skill-prompt.ts

@@ -89,14 +89,28 @@ for (let r = 1; r <= maxRounds; r++) {
     const nudge = retries > 0
       ? '\\nSTRICT JSON REQUIRED: your previous output failed schema validation. Return ONLY a JSON object {"findings":[...]} where EVERY finding has dimension, file, line (non-negative integer; 0 = whole-file), severity (critical|high|medium|low), summary, failure_scenario, suggested_fix, is_atomic (boolean).'
       : ''
-    const raw = await parallel(dims.map(dim => () => agent(
-      'Review dimension "' + dim + '".' +
-      (attachments.length > 0 ? ' User-attached images are part of the evidence; use their descriptions when judging (you see the metadata/descriptions below, not the pixels): ' + JSON.stringify(attachments) + '.' : '') +
-      ' Already-known findings (do NOT re-report): ' +
-      JSON.stringify(known) + nudge + '\\nReturn the findings JSON object.',
-      Object.assign({ label: 'review:' + dim + ':r' + r, schema: plan.dimensions.find(x => x.id === dim).findingsSchema }, backend)
-    )))
-    const thisRound = { round: r, findings: [].concat(...raw.map(x => x && x.findings ? x.findings : [])) }
+    const raw = await parallel(dims.map(dim => () => {
+      // Pass the plan's full per-dimension reviewerPrompt (goal, COVERAGE RULE
+      // with the assigned file inventory, EVIDENCE RULE, output language) and
+      // append the round-specific context — the reviewers must receive the
+      // file inventory or the coverage machinery has nothing to enforce.
+      const meta = plan.dimensions.find(x => x.id === dim)
+      const base = (meta && typeof meta.reviewerPrompt === 'string' && meta.reviewerPrompt)
+        ? meta.reviewerPrompt
+        : 'Review dimension "' + dim + '".'
+      const extra =
+        (attachments.length > 0 ? '\\n User-attached images are part of the evidence; use their descriptions when judging (you see the metadata/descriptions below, not the pixels): ' + JSON.stringify(attachments) + '.' : '') +
+        '\\n Already-known findings (do NOT re-report): ' +
+        JSON.stringify(known) + nudge + '\\nReturn the findings JSON object.'
+      return agent(base + extra, Object.assign({ label: 'review:' + dim + ':r' + r, schema: meta.findingsSchema }, backend))
+    }))
+    const thisRound = {
+      round: r,
+      findings: [].concat(...raw.map(x => x && x.findings ? x.findings : [])),
+      // readFiles are threaded through so the aggregate/meta-review coverage
+      // gate can compare self-reported reads against the assigned inventory.
+      readFiles: [].concat(...raw.map(x => x && Array.isArray(x.readFiles) ? x.readFiles : [])),
+    }
     if (rounds.length >= r) rounds[r - 1] = thisRound; else rounds.push(thisRound)
     // Deterministic aggregate: cross-round dedupe + known_intentional filter + severity sort.
     agg = await agent(
@@ -229,6 +243,11 @@ let failedCommands = []
 phase('loop')
 for (let r = startRound; r <= maxRounds; r++) {
   log('round ' + r + ' of ' + maxRounds + ' — review current state, fix atomics via iterate_fix, validate')
+  // Audit-trail: record the round start (SKILL.md Phase 4 requires per-round records).
+  await agent(
+    'Call iterate_decision_log({operation:"append", type:"round_start", round:' + r + ', data:{maxRounds:' + maxRounds + ', fixedSoFar:' + fixedCount + '}})',
+    Object.assign({ label: 'log:start:r' + r }, backend)
+  )
   let agg = null
   let schemaInvalid = false
   let retries = 0
@@ -237,13 +256,24 @@ for (let r = startRound; r <= maxRounds; r++) {
     const nudge = retries > 0
       ? '\\nSTRICT JSON REQUIRED: your previous output failed schema validation. Return ONLY a JSON object {"findings":[...]} where EVERY finding has dimension, file, line (non-negative integer; 0 = whole-file), severity (critical|high|medium|low), summary, failure_scenario, suggested_fix, is_atomic (boolean).'
       : ''
-    const raw = await parallel(dims.map(dim => () => agent(
-      'Review dimension "' + dim + '" on the CURRENT code state (previous atomic findings are fixed). ' +
-      (attachments.length > 0 ? ' User-attached images are part of the evidence; use their descriptions when judging (you see the metadata/descriptions below, not the pixels): ' + JSON.stringify(attachments) + '.' : '') +
-      'Do NOT re-report already-known architectural findings: ' + JSON.stringify(architectural) + nudge + '\\nReturn the findings JSON object.',
-      Object.assign({ label: 'review:' + dim + ':r' + r, schema: plan.dimensions.find(x => x.id === dim).findingsSchema }, backend)
-    )))
-    const thisRound = { round: r, findings: [].concat(...raw.map(x => x && x.findings ? x.findings : [])) }
+    const raw = await parallel(dims.map(dim => () => {
+      // Pass the plan's full per-dimension reviewerPrompt (COVERAGE RULE with
+      // the assigned file inventory, EVIDENCE RULE, output language) plus the
+      // round-specific context.
+      const meta = plan.dimensions.find(x => x.id === dim)
+      const base = (meta && typeof meta.reviewerPrompt === 'string' && meta.reviewerPrompt)
+        ? meta.reviewerPrompt
+        : 'Review dimension "' + dim + '" on the CURRENT code state (previous atomic findings are fixed).'
+      const extra =
+        (attachments.length > 0 ? '\\n User-attached images are part of the evidence; use their descriptions when judging (you see the metadata/descriptions below, not the pixels): ' + JSON.stringify(attachments) + '.' : '') +
+        '\\n Do NOT re-report already-known architectural findings: ' + JSON.stringify(architectural) + nudge + '\\nReturn the findings JSON object.'
+      return agent(base + extra, Object.assign({ label: 'review:' + dim + ':r' + r, schema: meta.findingsSchema }, backend))
+    }))
+    const thisRound = {
+      round: r,
+      findings: [].concat(...raw.map(x => x && x.findings ? x.findings : [])),
+      readFiles: [].concat(...raw.map(x => x && Array.isArray(x.readFiles) ? x.readFiles : [])),
+    }
     if (rounds.length >= r) rounds[r - 1] = thisRound; else rounds.push(thisRound)
 
     // Deterministic dedupe / known_intentional filter / severity sort for this round.

package/src/tools/checkpoint.ts

@@ -9,7 +9,7 @@
  * Checkpoint layout: `.iterate/checkpoint.json`.
  */
 
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { JsonValue } from '@deepseek-ai/dsh-session'
 import { resolveProjectRootForExec } from '../config-loader.ts'
@@ -107,7 +107,9 @@ export function computeStatus(input: {
     totalRounds,
     fixedCount,
     architecturalCount,
-    findingsCount: checkpoint?.findings.length ?? 0,
+    // A checkpoint may predate the `findings` field (or be hand-edited) — a
+    // missing findings must degrade to 0, never throw.
+    findingsCount: Array.isArray(checkpoint?.findings) ? checkpoint.findings.length : 0,
     totalDecisionLogEntries: entries.length,
     hasCheckpoint: checkpoint !== null,
     // A checkpoint left on disk means the previous run was interrupted before
@@ -209,7 +211,12 @@ export function registerCheckpointTool(ctx: { tools: { register: (def: ReturnTyp
           }
           try {
             mkdirSync(iterateDir(projectRoot), { recursive: true })
-            writeFileSync(checkpointPath(projectRoot), JSON.stringify(checkpoint, null, 2), 'utf-8')
+            // Atomic write (temp + rename): a crash mid-write must not corrupt
+            // the checkpoint and silently lose the interruption state.
+            const cpPath = checkpointPath(projectRoot)
+            const tmpPath = `${cpPath}.tmp-${Date.now()}`
+            writeFileSync(tmpPath, JSON.stringify(checkpoint, null, 2), 'utf-8')
+            renameSync(tmpPath, cpPath)
           } catch (err) {
             return { operation: 'save', ok: false, error: `failed to write checkpoint: ${String(err)}` }
           }

package/src/tools/context.ts

@@ -1,4 +1,4 @@
-import { readFileSync, existsSync } from 'node:fs'
+import { readFileSync, existsSync, statSync } from 'node:fs'
 import { join, dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { defineTool } from '@deepseek-ai/dsh-tools'
@@ -263,7 +263,8 @@ export function registerContextTool(ctx: { tools: { register: (def: ReturnType<t
           return { found: false, error: resolved.reason, searched: [] }
         }
         const projectRoot = resolved.root
-        const requested = (args.files ?? '')
+        // Guard: `files` must be a comma-separated string (model-controlled).
+        const requested = (typeof args.files === 'string' ? args.files : '')
           .split(',')
           .map((s) => s.trim().toLowerCase())
           .filter(Boolean)
@@ -295,7 +296,17 @@ export function registerContextTool(ctx: { tools: { register: (def: ReturnType<t
           // are all supported.
           const skillRoot = findSkillRoot(PLUGIN_SRC_DIR)
           const candidates: string[] = []
-          if (args.skillDir) candidates.push(args.skillDir)
+          // skillDir is a model-controlled path; only honor it when it is an
+          // existing directory (resolve it first) — otherwise fall through to
+          // the auto-detected root / project root.
+          if (typeof args.skillDir === 'string' && args.skillDir.trim()) {
+            try {
+              const dir = resolve(args.skillDir)
+              if (existsSync(dir) && statSync(dir).isDirectory()) candidates.push(dir)
+            } catch {
+              // unreadable/invalid skillDir — skip it
+            }
+          }
           if (skillRoot) candidates.push(skillRoot)
           candidates.push(projectRoot)
           result.searched = candidates

package/src/tools/decision-log.ts

@@ -52,12 +52,19 @@ function logPath(projectRoot: string): string {
 
 /**
  * Append one entry to the decision log (JSONL format).
- * Returns the entry count after appending.
+ * Returns the entry count after appending. Never throws — a disk failure is
+ * surfaced through `error` so callers (fix/prune) can report the audit-trail
+ * miss without failing the mutation they already performed.
  */
-export function appendDecisionEntry(projectRoot: string, entry: DecisionLogEntry): { count: number; path: string } {
-  const filePath = logPath(projectRoot)
-  const line = JSON.stringify(entry) + '\n'
-  appendFileSync(filePath, line, 'utf-8')
+export function appendDecisionEntry(projectRoot: string, entry: DecisionLogEntry): { count: number; path: string; error?: string } {
+  let filePath: string
+  try {
+    filePath = logPath(projectRoot)
+    const line = JSON.stringify(entry) + '\n'
+    appendFileSync(filePath, line, 'utf-8')
+  } catch (err) {
+    return { count: -1, path: join(projectRoot, LOG_DIR, LOG_FILE), error: `failed to append decision log: ${String(err)}` }
+  }
   // Count entries
   let count = 0
   try {
@@ -71,19 +78,29 @@ export function appendDecisionEntry(projectRoot: string, entry: DecisionLogEntry
 
 /**
  * Read all entries from the decision log.
+ * A single corrupt line (partial write, hand-edit) is SKIPPED, not fatal —
+ * one bad line must never empty the whole history for every reader.
  */
 export function readDecisionEntries(projectRoot: string): DecisionLogEntry[] {
   const filePath = join(projectRoot, LOG_DIR, LOG_FILE)
   if (!existsSync(filePath)) return []
+  let content: string
   try {
-    const content = readFileSync(filePath, 'utf-8')
-    return content
-      .split('\n')
-      .filter((l) => l.trim().length > 0)
-      .map((l) => JSON.parse(l) as DecisionLogEntry)
+    content = readFileSync(filePath, 'utf-8')
   } catch {
     return []
   }
+  const out: DecisionLogEntry[] = []
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim()
+    if (trimmed.length === 0) continue
+    try {
+      out.push(JSON.parse(trimmed) as DecisionLogEntry)
+    } catch {
+      // skip the corrupt line, keep the rest
+    }
+  }
+  return out
 }
 
 /**

package/src/tools/fix.ts

@@ -17,8 +17,8 @@
  *   - Atomicity is enforced against `config.atomic.max_lines` unless `force`.
  */
 
-import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { join, sep } from 'node:path'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { JsonValue } from '@deepseek-ai/dsh-session'
 import { loadEffectiveConfig, resolveProjectRootForExec } from '../config-loader.ts'
@@ -123,6 +123,11 @@ export function readRegistry(projectRoot: string): FixRegistry {
   try {
     const parsed = JSON.parse(readFileSync(file, 'utf-8')) as FixRegistry
     if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.rounds)) return emptyRegistry()
+    // Defensive: a hand-edited or partially-written registry may contain a
+    // round without a `records` array — normalize instead of crashing readers.
+    parsed.rounds = parsed.rounds.filter(
+      (r) => r && typeof r === 'object' && Array.isArray(r.records),
+    )
     return parsed
   } catch {
     return emptyRegistry()
@@ -198,11 +203,56 @@ export function resolveProjectFile(projectRoot: string, file: string): { ok: tru
   if (resolved === projectRoot || !resolved.startsWith(projectRoot + '/') && !resolved.startsWith(projectRoot + '\\')) {
     return { ok: false, reason: 'file resolves outside the project root' }
   }
+  // Symlink containment: the lexical prefix check above does not resolve
+  // symlinks. If the target exists, verify its REAL path stays inside the REAL
+  // project root so a symlinked directory/file inside the repo can never route
+  // a fix (write/rollback/diff) outside the project.
+  if (existsSync(resolved)) {
+    let rootReal: string
+    let real: string
+    try {
+      rootReal = realpathSync(projectRoot)
+      real = realpathSync(resolved)
+    } catch {
+      return { ok: false, reason: 'failed to resolve real path for containment check' }
+    }
+    const rootPrefix = rootReal.endsWith(sep) ? rootReal : rootReal + sep
+    if (real !== rootReal && !real.startsWith(rootPrefix)) {
+      return { ok: false, reason: 'file resolves outside the project root (symlink escape)' }
+    }
+  }
   return { ok: true, resolved }
 }
 
 // ─── Shared execute helpers ──────────────────────────────────────────────────
 
+/**
+ * Minimal glob matcher for personalization.protected_paths.
+ * Supports `*` (any run of chars within one segment) and `**` (any chars,
+ * including separators). All other characters are literal. Pure, unit-testable.
+ */
+export function globMatch(path: string, pattern: string): boolean {
+  if (typeof path !== 'string' || typeof pattern !== 'string') return false
+  // Escape regex specials except our two wildcards.
+  let re = ''
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i] as string
+    if (ch === '*') {
+      const isDouble = pattern[i + 1] === '*'
+      if (isDouble) { re += '[\\s\\S]*'; i++ } else { re += '[^/\\\\]*' }
+    } else if ('.[]{}()+-^$|?'.includes(ch)) {
+      re += '\\' + ch
+    } else {
+      re += ch
+    }
+  }
+  try {
+    return new RegExp('^' + re + '$').test(path)
+  } catch {
+    return false
+  }
+}
+
 /** Read the current content of a file under the project root. */
 function readProjectFile(projectRoot: string, file: string): { ok: true; content: string } | { ok: false; reason: string } {
   const resolved = resolveProjectFile(projectRoot, file)
@@ -314,6 +364,28 @@ export function registerFixTool(ctx: { tools: { register: (def: ReturnType<typeo
         if (typeof finding.dimension !== 'string' || finding.dimension.trim().length === 0) {
           return { ok: false, error: 'finding.dimension must be a non-empty string' }
         }
+        // The finding must reference the file being fixed — the fix id and the
+        // rollback/diff target are derived from finding.file, so a mismatch
+        // would back up/restore the WRONG file.
+        if (finding.file !== file) {
+          return { ok: false, error: `finding.file ("${finding.file}") must match the file being fixed ("${file}")` }
+        }
+        // Full finding validation, mirroring the review schema: malformed
+        // findings would produce lossy registry/log entries and a degraded id.
+        const SEVERITY_SET = new Set(['critical', 'high', 'medium', 'low'])
+        if (!SEVERITY_SET.has(finding.severity)) {
+          return { ok: false, error: 'finding.severity must be one of critical/high/medium/low' }
+        }
+        if (typeof finding.summary !== 'string' || finding.summary.trim().length === 0) {
+          return { ok: false, error: 'finding.summary must be a non-empty string' }
+        }
+        if (typeof finding.is_atomic !== 'boolean') {
+          return { ok: false, error: 'finding.is_atomic must be a boolean' }
+        }
+        if (finding.line !== undefined && finding.line !== null &&
+            (typeof finding.line !== 'number' || !Number.isInteger(finding.line) || finding.line < 0)) {
+          return { ok: false, error: 'finding.line must be a non-negative integer (0 = whole-file)' }
+        }
 
         const current = readProjectFile(projectRoot, file)
         if (!current.ok) return { ok: false, error: current.reason }
@@ -346,6 +418,30 @@ export function registerFixTool(ctx: { tools: { register: (def: ReturnType<typeo
         const target = resolveProjectFile(projectRoot, file)
         if (!target.ok) return { ok: false, error: target.reason }
 
+        // Personalization guards (SKILL.md Phase 2): protected_paths veto the
+        // fix outright; forbidden_fixes veto fix approaches appearing in the
+        // new content. Both are security-relevant, so they are enforced here
+        // in the tool, not left to the model.
+        const pers = config.personalization as
+          | { protected_paths?: unknown; forbidden_fixes?: unknown }
+          | undefined
+        const protectedPaths = Array.isArray(pers?.protected_paths)
+          ? (pers.protected_paths as unknown[]).filter((p): p is string => typeof p === 'string' && p.length > 0)
+          : []
+        for (const pattern of protectedPaths) {
+          if (globMatch(file, pattern)) {
+            return { ok: false, error: `skipped: ${file} matches protected path "${pattern}" (personalization.protected_paths forbids modifying it)` }
+          }
+        }
+        const forbiddenFixes = Array.isArray(pers?.forbidden_fixes)
+          ? (pers.forbidden_fixes as unknown[]).filter((f): f is string => typeof f === 'string' && f.length > 0)
+          : []
+        for (const forbidden of forbiddenFixes) {
+          if (args.content.includes(forbidden)) {
+            return { ok: false, error: `fix uses a forbidden approach: "${forbidden}" appears in the new content (personalization.forbidden_fixes)` }
+          }
+        }
+
         const timestamp = new Date().toISOString()
         const backupPath = fixBackupPath(projectRoot, id, timestamp)
         try {
@@ -376,7 +472,19 @@ export function registerFixTool(ctx: { tools: { register: (def: ReturnType<typeo
         try {
           writeFileSync(fixRegistryPath(projectRoot), JSON.stringify(nextRegistry, null, 2), 'utf-8')
         } catch (err) {
-          return { ok: false, error: `failed to write fix registry: ${String(err)}` }
+          // Registry write failed → the file was already modified but no record
+          // exists, so a later rollback/diff could never see it and a retry would
+          // back up the already-fixed content as "original". Restore the file
+          // from the backup to leave the tree exactly as it was.
+          try {
+            copyFileSync(backupPath, target.resolved)
+          } catch (restoreErr) {
+            return {
+              ok: false,
+              error: `failed to write fix registry: ${String(err)}; additionally failed to restore ${file} from backup: ${String(restoreErr)}`,
+            }
+          }
+          return { ok: false, error: `failed to write fix registry: ${String(err)} (file restored from backup)` }
         }
 
         appendDecisionEntry(projectRoot, {
@@ -485,6 +593,9 @@ export function registerDiffTool(ctx: { tools: { register: (def: ReturnType<type
             if (existing) {
               existing.linesAdded += r.linesAdded
               existing.linesRemoved += r.linesRemoved
+              // Recompute the summary from the summed counts so a multi-fix
+              // file's text does not contradict its accumulated numbers.
+              existing.diffSummary = `+${existing.linesAdded}/-${existing.linesRemoved} lines`
             } else {
               files.push({
                 file: r.finding.file,