iterate-plugin 3.3.1 → 3.4.1

package/lib/client.js

@@ -115,10 +115,11 @@ function scanSessionForResume(obj, seen, maxDepth = 20) {
 function countSessionImages(session) {
   if (!session || typeof session !== "object") return 0;
   const ids = /* @__PURE__ */ new Set();
+  const consumed = /* @__PURE__ */ new Set();
   let count = 0;
   const walk = (obj, depth) => {
     if (depth <= 0 || !obj || typeof obj !== "object") return;
-    if (seen.has(obj)) return;
+    if (seen.has(obj) || consumed.has(obj)) return;
     seen.add(obj);
     const o = (
       /** @type {Record<string, unknown>} */
@@ -142,6 +143,7 @@ function countSessionImages(session) {
       } else {
         count += 1;
       }
+      consumed.add(ref);
     }
     if (Array.isArray(obj)) {
       for (const item of obj) walk(item, depth - 1);
@@ -289,16 +291,21 @@ function attachLive(manifest, source) {
   copy.live = live;
   return copy;
 }
-function extractTranscript(obj) {
+function extractTranscript(obj, seen, depth) {
+  if (depth === void 0) depth = 0;
+  if (depth > 20) return null;
   if (typeof obj === "string") {
     try {
       const parsed = JSON.parse(obj);
-      return extractTranscript(parsed);
+      return extractTranscript(parsed, seen, depth + 1);
     } catch {
       return null;
     }
   }
   if (!obj || typeof obj !== "object") return null;
+  if (!seen) seen = /* @__PURE__ */ new Set();
+  if (seen.has(obj)) return null;
+  seen.add(obj);
   if (isTranscriptManifest(obj)) return (
     /** @type {Record<string, unknown>} */
     obj
@@ -322,11 +329,11 @@ function extractTranscript(obj) {
     if (val !== void 0) {
       if (Array.isArray(val)) {
         for (const item of val) {
-          const found = extractTranscript(item);
+          const found = extractTranscript(item, seen, depth + 1);
           if (found) return attachLive(found, o);
         }
       } else {
-        const found = extractTranscript(val);
+        const found = extractTranscript(val, seen, depth + 1);
         if (found) return attachLive(found, o);
       }
     }
@@ -569,6 +576,24 @@ function latestToolResultNode(session, toolName) {
       /** @type {Array<Record<string, unknown>>} */
       messages
     );
+    for (let i = msgs.length - 1; i >= 0; i--) {
+      const msg = msgs[i];
+      if (!msg) continue;
+      const calls = safeGet(msg, "tool_calls");
+      if (!Array.isArray(calls)) continue;
+      const callList = (
+        /** @type {Array<Record<string, unknown>>} */
+        calls
+      );
+      for (let j = callList.length - 1; j >= 0; j--) {
+        const call = callList[j];
+        if (!call) continue;
+        const name2 = String(safeGet(call, "name") ?? safeGet(call, "tool") ?? "");
+        if (name2 !== toolName && !name2.endsWith(toolName)) continue;
+        const result = safeGet(call, "result") ?? safeGet(call, "response") ?? safeGet(call, "message");
+        if (result !== void 0 && result !== null) return result;
+      }
+    }
     for (let i = msgs.length - 1; i >= 0; i--) {
       const msg = msgs[i];
       if (!msg) continue;
@@ -895,6 +920,7 @@ function computeSummaryFromFindings(findings) {
   const counts = { critical: 0, high: 0, medium: 0, low: 0 };
   const byDimension = {};
   for (const f of findings) {
+    if (!f || typeof f !== "object") continue;
     const sev = String(f.severity ?? "low");
     if (sev in counts) counts[sev]++;
     const dim = String(f.dimension ?? "unknown");
@@ -942,6 +968,7 @@ function severityStats(report) {
   );
   const counts = { critical: 0, high: 0, medium: 0, low: 0 };
   for (const f of findings) {
+    if (!f || typeof f !== "object") continue;
     const sev = String(f.severity ?? "low");
     if (sev in counts) counts[sev]++;
   }
@@ -954,6 +981,7 @@ function groupByDimension(report) {
   );
   const groups = {};
   for (const f of findings) {
+    if (!f || typeof f !== "object") continue;
     const dim = String(f.dimension ?? "unknown");
     if (!groups[dim]) groups[dim] = [];
     groups[dim].push(f);
@@ -1048,6 +1076,7 @@ function normalizeFindingFilter(filter) {
   return { severities, dimensions, search };
 }
 function findingMatches(finding, filter) {
+  if (!finding || typeof finding !== "object") return false;
   const f = normalizeFindingFilter(filter);
   const sev = String(finding.severity ?? "low");
   if (f.severities.length > 0 && !f.severities.includes(sev)) return false;
@@ -1118,6 +1147,7 @@ function setAllVerdicts(triageState, verdict, indices) {
 function buildRoundHistory(report) {
   const rounds = Array.isArray(report.rounds) ? report.rounds : [];
   return rounds.map((r) => {
+    if (!r || typeof r !== "object") return { round: 0, count: 0, critical: 0, high: 0, medium: 0, low: 0 };
     const rr = (
       /** @type {Record<string, unknown>} */
       r
@@ -1274,7 +1304,13 @@ function filterTimelineEntries(entries, opts) {
     if (type && String(t.type ?? "") !== type) return false;
     if (round && String(t.round ?? "") !== round) return false;
     if (q) {
-      const hay = [String(t.type ?? ""), String(t.round ?? ""), JSON.stringify(t.data ?? {})].join(" ").toLowerCase();
+      let dataText = "";
+      try {
+        dataText = JSON.stringify(t.data ?? {});
+      } catch {
+        dataText = t.data === void 0 ? "{}" : String(t.data);
+      }
+      const hay = [String(t.type ?? ""), String(t.round ?? ""), dataText].join(" ").toLowerCase();
       if (hay.indexOf(q) < 0) return false;
     }
     return true;
@@ -1525,6 +1561,7 @@ var ITERATE_CSS = `
 /* Dashboard empty/onboarding state */
 .iterate-dashboard-empty { opacity: 0.75; }
 .iterate-empty-hint { font-size: 12px; color: var(--dsw-alias-label-secondary); }
+.iterate-dashboard-launch { display: inline-flex; align-items: center; gap: 6px; }
 
 /* Convergence-completed progress fill */
 .iterate-progress-fill-done { background: var(--dsw-alias-state-success-primary); }
@@ -1748,6 +1785,31 @@ function TrendChart({ points }) {
     "aria-label": `\u5404\u8F6E\u53D1\u73B0\u6570\u91CF\u8D8B\u52BF\uFF1A${summary}`
   }, ...bars);
 }
+function StartIterationButton() {
+  const [copied, setCopied] = React.useState(null);
+  const copy = (key, text) => {
+    copyText(text).then((ok) => {
+      if (ok) {
+        setCopied(key);
+        setTimeout(() => setCopied((cur) => cur === key ? null : cur), 1600);
+      }
+    });
+  };
+  const btn = (key, label, command, primary, title) => React.createElement("button", {
+    key,
+    className: "iterate-cmd",
+    "data-primary": primary ? "" : void 0,
+    "data-copied": copied === key ? "" : void 0,
+    onClick: () => copy(key, command),
+    title
+  }, copied === key ? "\u5DF2\u590D\u5236" : label);
+  return React.createElement(
+    "span",
+    { className: "iterate-dashboard-launch" },
+    btn("start-full", "\u5B8C\u6574\u8FED\u4EE3", "/iterate", true, "\u590D\u5236\u542F\u52A8\u547D\u4EE4\uFF1A\u5B8C\u6574\u300C\u5BA1\u67E5 \u2192 \u4FEE\u590D \u2192 \u9A8C\u8BC1\u300D\u95ED\u73AF"),
+    btn("start-review", "\u4EC5\u8BC4\u5BA1", "/iterate review-only", false, "\u590D\u5236\u542F\u52A8\u547D\u4EE4\uFF1A\u53EA\u5BA1\u67E5\u4E0D\u4FEE\u6539\uFF08dry-run\uFF09")
+  );
+}
 function ConvergenceDashboard(props) {
   const [pulseKey, setPulseKey] = React.useState(0);
   const session = props && props.session ? props.session : null;
@@ -1764,7 +1826,8 @@ function ConvergenceDashboard(props) {
       "div",
       { "data-iterate-root": "", "data-iterate": "dashboard", className: "iterate-dashboard iterate-dashboard-empty" },
       React.createElement("span", { className: "iterate-round-badge" }, "iterate"),
-      React.createElement("span", { className: "iterate-empty-hint" }, "\u8FD0\u884C\u4E00\u6B21\u8BC4\u5BA1\u540E\uFF0C\u8FD9\u91CC\u4F1A\u663E\u793A\u6536\u655B\u8FDB\u5EA6\u4E0E\u53D1\u73B0\u7EDF\u8BA1\u3002\u8BD5\u8BD5\u300Creview this project\u300D\u6216\u300C/iterate review-only\u300D")
+      React.createElement("span", { className: "iterate-empty-hint" }, "\u8FD0\u884C\u4E00\u6B21\u8BC4\u5BA1\u540E\uFF0C\u8FD9\u91CC\u4F1A\u663E\u793A\u6536\u655B\u8FDB\u5EA6\u4E0E\u53D1\u73B0\u7EDF\u8BA1\u3002"),
+      React.createElement(StartIterationButton, null)
     );
   }
   const round = getCurrentRound(report);
@@ -2051,7 +2114,7 @@ function TriagePanel(props) {
   const ignoredCount = ignored.length;
   const counts = countVerdicts(verdicts);
   const doApproveArchitecturalFix = () => {
-    const cmd = "\u8BF7\u8C03\u7528 `iterate_fix` \u6279\u51C6\u67B6\u6784\u4FEE\u590D\uFF08\u8BBE\u7F6E is_architectural: true\uFF09";
+    const cmd = "\u8BF7\u8C03\u7528 `iterate_fix`\uFF0C\u5BF9\u672C\u9879\u76EE\u5269\u4F59\u67B6\u6784\u578B finding \u751F\u6210\u4FEE\u590D\u5185\u5BB9\u5E76\u8BBE\u7F6E force: true \u5E94\u7528\uFF08\u67B6\u6784\u4FEE\u590D\u5141\u8BB8\u8D85\u8FC7 atomic \u9608\u503C\uFF09";
     copyText(cmd).then((ok) => {
       if (ok) {
         setCmdCopied("approve-arch");
@@ -2069,7 +2132,7 @@ function TriagePanel(props) {
     });
   };
   const doRollbackToCheckpoint = () => {
-    const cmd = "\u8BF7\u8C03\u7528 `iterate_checkpoint` \u56DE\u6EDA\u5230\u4E0A\u4E00\u4E2A\u68C0\u67E5\u70B9";
+    const cmd = "\u8BF7\u56DE\u6EDA\u4E0A\u4E00\u8F6E\u8FED\u4EE3\u7684\u4FEE\u590D\uFF1A\u8C03\u7528 `iterate_history` \u67E5\u770B\u672C\u8F6E fix id\uFF0C\u518D\u7528 `iterate_rollback` \u9010\u4E2A\u64A4\u9500\u8FD9\u4E9B\u4FEE\u590D";
     copyText(cmd).then((ok) => {
       if (ok) {
         setCmdCopied("rollback");
@@ -3060,7 +3123,7 @@ ${JSON.stringify({
           "data-primary": "",
           "data-copied": copiedKey === "cp-resume" ? "" : void 0,
           onClick: () => copyInstruction("cp-resume", resumeText),
-          title: "\u590D\u5236 iterate_checkpoint \u7EFC/\u6062\u590D\u6307\u4EE4\u6587\u672C"
+          title: "\u590D\u5236 iterate_checkpoint resume \u6307\u4EE4\u6587\u672C\uFF08\u52A0\u8F7D\u65AD\u70B9\u5E76\u8BA1\u6570\u4E00\u6B21\u6062\u590D\uFF09"
         }, copiedKey === "cp-resume" ? "\u5DF2\u590D\u5236" : "\u590D\u5236\u6062\u590D\u6307\u4EE4")
       )
     );
@@ -3153,7 +3216,14 @@ ${JSON.stringify({ operation: "nudge", text: null }, null, 2)}
     const sorted = filtered.slice();
     const rows = sorted.map((t, i) => {
       const k = `f7-${i}`;
-      const dataText = t.data && typeof t.data === "object" ? JSON.stringify(t.data) : "";
+      let dataText = "";
+      if (t.data && typeof t.data === "object") {
+        try {
+          dataText = JSON.stringify(t.data);
+        } catch {
+          dataText = String(t.data);
+        }
+      }
       return React.createElement(
         "div",
         { key: k, className: "iterate-obs-row", style: { flexDirection: "column", alignItems: "flex-start" } },

package/lib/parse.js

@@ -133,12 +133,13 @@ export function countSessionImages(session) {
   if (!session || typeof session !== 'object') return 0
 
   const ids = new Set()
+  const consumed = new Set()
   let count = 0
 
   /** @param {unknown} obj */
   const walk = (obj, depth) => {
     if (depth <= 0 || !obj || typeof obj !== 'object') return
-    if (seen.has(obj)) return
+    if (seen.has(obj) || consumed.has(obj)) return
     seen.add(obj)
     const o = /** @type {Record<string, unknown>} */ (obj)
 
@@ -158,6 +159,9 @@ export function countSessionImages(session) {
       } else {
         count += 1
       }
+      // The ref node is already counted; mark it consumed so descending into it
+      // (its own mediaType/attachmentId keys) does not double-count the image.
+      consumed.add(ref)
     }
 
     if (Array.isArray(obj)) {
@@ -364,18 +368,25 @@ function attachLive(manifest, source) {
  * manifest buried inside an arbitrary result still surfaces. Never throws.
  *
  * @param {unknown} obj
+ * @param {Set<unknown>} [seen]
+ * @param {number} [depth]
  * @returns {Record<string, unknown> | null}
  */
-function extractTranscript(obj) {
+function extractTranscript(obj, seen, depth) {
+  if (depth === undefined) depth = 0
+  if (depth > 20) return null
   if (typeof obj === 'string') {
     try {
       const parsed = JSON.parse(obj)
-      return extractTranscript(parsed)
+      return extractTranscript(parsed, seen, depth + 1)
     } catch {
       return null
     }
   }
   if (!obj || typeof obj !== 'object') return null
+  if (!seen) seen = new Set()
+  if (seen.has(obj)) return null
+  seen.add(obj)
 
   // Direct manifest.
   if (isTranscriptManifest(obj)) return /** @type {Record<string, unknown>} */ (obj)
@@ -397,11 +408,11 @@ function extractTranscript(obj) {
     if (val !== undefined) {
       if (Array.isArray(val)) {
         for (const item of val) {
-          const found = extractTranscript(item)
+          const found = extractTranscript(item, seen, depth + 1)
           if (found) return attachLive(found, o)
         }
       } else {
-        const found = extractTranscript(val)
+        const found = extractTranscript(val, seen, depth + 1)
         if (found) return attachLive(found, o)
       }
     }
@@ -745,6 +756,29 @@ function latestToolResultNode(session, toolName) {
   const messages = safeGet(s, 'messages')
   if (Array.isArray(messages)) {
     const msgs = /** @type {Array<Record<string, unknown>>} */ (messages)
+    // Assistant tool-call variant: the tool result may live on the call object
+    // inside message.tool_calls rather than on session.toolCalls. Scan every
+    // message for a matching call (newest-first) before falling back to the
+    // last message's raw content — a conversational closing message must not
+    // shadow an earlier message's real tool result.
+    for (let i = msgs.length - 1; i >= 0; i--) {
+      const msg = msgs[i]
+      if (!msg) continue
+      const calls = safeGet(msg, 'tool_calls')
+      if (!Array.isArray(calls)) continue
+      const callList = /** @type {Array<Record<string, unknown>>} */ (calls)
+      for (let j = callList.length - 1; j >= 0; j--) {
+        const call = callList[j]
+        if (!call) continue
+        const name = String(safeGet(call, 'name') ?? safeGet(call, 'tool') ?? '')
+        if (name !== toolName && !name.endsWith(toolName)) continue
+        const result = safeGet(call, 'result') ?? safeGet(call, 'response') ?? safeGet(call, 'message')
+        if (result !== undefined && result !== null) return result
+      }
+    }
+    // Fallback: the last message's raw content (pre-existing behavior — a
+    // plain conversational string yields null upstream, but an embedded JSON
+    // body is still worth surfacing for the deep-scan finders).
     for (let i = msgs.length - 1; i >= 0; i--) {
       const msg = msgs[i]
       if (!msg) continue
@@ -1151,6 +1185,7 @@ function computeSummaryFromFindings(findings) {
   const byDimension = {}
 
   for (const f of findings) {
+    if (!f || typeof f !== 'object') continue
     const sev = String(f.severity ?? 'low')
     if (sev in counts) counts[sev]++
     const dim = String(f.dimension ?? 'unknown')
@@ -1224,6 +1259,7 @@ export function severityStats(report) {
   const findings = /** @type {Array<Record<string, unknown>>} */ (report.findings ?? [])
   const counts = { critical: 0, high: 0, medium: 0, low: 0 }
   for (const f of findings) {
+    if (!f || typeof f !== 'object') continue
     const sev = String(f.severity ?? 'low')
     if (sev in counts) counts[sev]++
   }
@@ -1243,6 +1279,7 @@ export function groupByDimension(report) {
   /** @type {Record<string, Array<Record<string, unknown>>>} */
   const groups = {}
   for (const f of findings) {
+    if (!f || typeof f !== 'object') continue
     const dim = String(f.dimension ?? 'unknown')
     if (!groups[dim]) groups[dim] = []
     groups[dim].push(f)
@@ -1412,6 +1449,7 @@ export function normalizeFindingFilter(filter) {
  * @returns {boolean}
  */
 export function findingMatches(finding, filter) {
+  if (!finding || typeof finding !== 'object') return false
   const f = normalizeFindingFilter(filter)
   const sev = String(finding.severity ?? 'low')
   if (f.severities.length > 0 && !f.severities.includes(sev)) return false
@@ -1553,6 +1591,7 @@ export function setAllVerdicts(triageState, verdict, indices) {
 export function buildRoundHistory(report) {
   const rounds = Array.isArray(report.rounds) ? report.rounds : []
   return rounds.map((r) => {
+    if (!r || typeof r !== 'object') return { round: 0, count: 0, critical: 0, high: 0, medium: 0, low: 0 }
     const rr = /** @type {Record<string, unknown>} */ (r)
     const findings = Array.isArray(rr.findings) ? rr.findings : []
     const sev = severityStats({ findings })
@@ -1823,7 +1862,15 @@ export function filterTimelineEntries(entries, opts) {
     if (type && String(t.type ?? '') !== type) return false
     if (round && String(t.round ?? '') !== round) return false
     if (q) {
-      const hay = [String(t.type ?? ''), String(t.round ?? ''), JSON.stringify(t.data ?? {})].join(' ').toLowerCase()
+      let dataText = ''
+      try {
+        dataText = JSON.stringify(t.data ?? {})
+      } catch {
+        // A self-referential `data` reference would throw on stringify — degrade
+        // to a string representation rather than crashing the search.
+        dataText = t.data === undefined ? '{}' : String(t.data)
+      }
+      const hay = [String(t.type ?? ''), String(t.round ?? ''), dataText].join(' ').toLowerCase()
       if (hay.indexOf(q) < 0) return false
     }
     return true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iterate-plugin",
-  "version": "3.3.1",
+  "version": "3.4.1",
   "description": "dsh plugin that turns the iterate skill into an autonomous closed-loop harness with quality command center and experience bank (v3.3). Features: plan -> parallel review xN -> atomic fixes -> validate -> loop -> auto-stop, plus dry-run pure-review mode, quality gate compute/persist, writable experience bank, defense events stream (record + bilingual labels), and native command buttons — with a live quality command center (F8/F9/F10 render real session data), §8 assign-fix instruction, and task_mode indicator wired end to end.",
   "type": "module",
   "license": "MIT",
@@ -29,9 +29,11 @@
     },
     "compatibility": {
       "dshReleases": {
+        "0.1.1-rc.1": "compatible",
         "0.1.2-alpha.4": "compatible",
         "0.1.2-alpha.5": "compatible",
-        "0.1.2-rc.1": "compatible"
+        "0.1.2-rc.1": "compatible",
+        "0.1.3-alpha.1": "compatible"
       }
     },
     "client": {

package/src/client/index.ts

@@ -61,7 +61,6 @@ import {
   batchSetVerdict,
   setAllVerdicts,
   buildRoundHistory,
-  buildFindingTrend,
   computeTrendMetrics,
   trendMax,
   buildCompletionSummary,
@@ -567,6 +566,7 @@ const ITERATE_CSS = `
 /* Dashboard empty/onboarding state */
 .iterate-dashboard-empty { opacity: 0.75; }
 .iterate-empty-hint { font-size: 12px; color: var(--dsw-alias-label-secondary); }
+.iterate-dashboard-launch { display: inline-flex; align-items: center; gap: 6px; }
 
 /* Convergence-completed progress fill */
 .iterate-progress-fill-done { background: var(--dsw-alias-state-success-primary); }
@@ -834,6 +834,36 @@ function TrendChart({ points }: { points: Array<{ round: number; count: number }
   }, ...bars)
 }
 
+/** Start-iteration launcher shown on the empty dashboard: copies a runnable
+ *  command (the browser cannot invoke harness tools directly, so every action
+ *  follows the panel's copy-to-command pattern). */
+function StartIterationButton() {
+  const [copied, setCopied] = React.useState<string | null>(null)
+  const copy = (key: string, text: string) => {
+    copyText(text).then((ok) => {
+      if (ok) {
+        setCopied(key)
+        setTimeout(() => setCopied((cur) => (cur === key ? null : cur)), 1600)
+      }
+    })
+  }
+  const btn = (key: string, label: string, command: string, primary: boolean, title: string) =>
+    React.createElement('button', {
+      key,
+      className: 'iterate-cmd',
+      'data-primary': primary ? '' : undefined,
+      'data-copied': copied === key ? '' : undefined,
+      onClick: () => copy(key, command),
+      title,
+    }, copied === key ? '已复制' : label)
+  return React.createElement(
+    'span',
+    { className: 'iterate-dashboard-launch' },
+    btn('start-full', '完整迭代', '/iterate', true, '复制启动命令：完整「审查 → 修复 → 验证」闭环'),
+    btn('start-review', '仅评审', '/iterate review-only', false, '复制启动命令：只审查不修改（dry-run）'),
+  )
+}
+
 /** Dashboard: live convergence strip above the composer.
  *
  * The `conversation.input.dock` slot's owner share is `InputZone`, which
@@ -859,12 +889,15 @@ function ConvergenceDashboard(props: SlotProps) {
 
   if (!report) {
     // Empty/onboarding state: first-time users otherwise see nothing and have
-    // no idea the plugin exists or how to start.
+    // no idea the plugin exists or how to start. Provide a one-click command
+    // that launches the loop (copied for paste — the browser cannot call
+    // harness tools directly).
     return React.createElement(
       'div',
       { 'data-iterate-root': '', 'data-iterate': 'dashboard', className: 'iterate-dashboard iterate-dashboard-empty' },
       React.createElement('span', { className: 'iterate-round-badge' }, 'iterate'),
-      React.createElement('span', { className: 'iterate-empty-hint' }, '运行一次评审后，这里会显示收敛进度与发现统计。试试「review this project」或「/iterate review-only」'),
+      React.createElement('span', { className: 'iterate-empty-hint' }, '运行一次评审后，这里会显示收敛进度与发现统计。'),
+      React.createElement(StartIterationButton, null),
     )
   }
 
@@ -1192,7 +1225,10 @@ function TriagePanel(props: SlotProps) {
 
   // v3.0: Command handlers for native action buttons
   const doApproveArchitecturalFix = () => {
-    const cmd = '请调用 `iterate_fix` 批准架构修复（设置 is_architectural: true）'
+    // Architectural findings exceed the atomic threshold, so "approving" one
+    // means telling the model to apply it as a deliberate forced change via
+    // iterate_fix with force:true (is_architectural is not a real parameter).
+    const cmd = '请调用 `iterate_fix`，对本项目剩余架构型 finding 生成修复内容并设置 force: true 应用（架构修复允许超过 atomic 阈值）'
     copyText(cmd).then((ok) => {
       if (ok) {
         setCmdCopied('approve-arch')
@@ -1212,7 +1248,10 @@ function TriagePanel(props: SlotProps) {
   }
 
   const doRollbackToCheckpoint = () => {
-    const cmd = '请调用 `iterate_checkpoint` 回滚到上一个检查点'
+    // iterate_checkpoint has NO rollback operation (save/load/resume/clear
+    // only); reverting applied fixes is done via iterate_rollback by fix id,
+    // so the paste-able instruction must point there instead.
+    const cmd = '请回滚上一轮迭代的修复：调用 `iterate_history` 查看本轮 fix id，再用 `iterate_rollback` 逐个撤销这些修复'
     copyText(cmd).then((ok) => {
       if (ok) {
         setCmdCopied('rollback')
@@ -2151,7 +2190,7 @@ function ObservatoryPanel(props: SlotProps) {
         React.createElement('button', {
           className: 'iterate-btn', 'data-primary': '', 'data-copied': copiedKey === 'cp-resume' ? '' : undefined,
           onClick: () => copyInstruction('cp-resume', resumeText),
-          title: '复制 iterate_checkpoint 综/恢复指令文本',
+          title: '复制 iterate_checkpoint resume 指令文本（加载断点并计数一次恢复）',
         }, copiedKey === 'cp-resume' ? '已复制' : '复制恢复指令'),
       ),
     )
@@ -2233,7 +2272,10 @@ function ObservatoryPanel(props: SlotProps) {
     const sorted = filtered.slice()
     const rows = sorted.map((t, i) => {
       const k = `f7-${i}`
-      const dataText = t.data && typeof t.data === 'object' ? JSON.stringify(t.data) : ''
+      let dataText = ''
+      if (t.data && typeof t.data === 'object') {
+        try { dataText = JSON.stringify(t.data) } catch { dataText = String(t.data) }
+      }
       return React.createElement('div', { key: k, className: 'iterate-obs-row', style: { flexDirection: 'column', alignItems: 'flex-start' } },
         React.createElement('div', { className: 'iterate-obs-bar', style: { width: '100%' } },
           React.createElement('span', { className: 'iterate-obs-chip' }, String(t.type || '?')),

package/src/config-write.ts

@@ -92,6 +92,28 @@ export function validateConfigUpdates(updates: Record<string, unknown>): string[
       errors.push('updates.validation.commands must be an object of command arrays')
     }
   }
+  if ('observatory' in updates) {
+    const o = updates.observatory as Record<string, unknown> | undefined
+    if (!o || typeof o !== 'object') {
+      errors.push('updates.observatory must be an object')
+    } else {
+      if (o.capture !== undefined && typeof o.capture !== 'boolean') {
+        errors.push('updates.observatory.capture must be a boolean')
+      }
+      // The approval policy is the AUTHORITATIVE human-consent seam for
+      // destructive iterate tools (session-hooks.ts reads it at call time).
+      // Letting the model flip it to `allow` via a config write would bypass
+      // the gate entirely, so model-driven approval changes are refused
+      // fail-closed — the value can only be set by editing the config file
+      // directly (a human action the approval seam can trust).
+      if ('approval' in o) {
+        errors.push(
+          'updates.observatory.approval cannot be changed through iterate_config — ' +
+          'edit iterate.config.yaml directly (the approval gate is human-controlled)',
+        )
+      }
+    }
+  }
   if ('personalization' in updates && (!updates.personalization || typeof updates.personalization !== 'object')) {
     errors.push('updates.personalization must be an object')
   }
@@ -109,6 +131,11 @@ export function applyConfigUpdates(
   const out: Record<string, unknown> = { ...base }
   for (const [key, value] of Object.entries(updates)) {
     if (value === undefined) continue
+    // Prototype-pollution guard (mirrors config-loader.mergeConfig): a
+    // caller-supplied `__proto__`/`constructor`/`prototype` key must never be
+    // plain-assigned — on a plain object `out['__proto__'] = value` would set
+    // the object's prototype instead of an own property.
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue
     const baseValue = out[key]
     if (
       baseValue &&

package/src/git-scope.ts

@@ -23,7 +23,7 @@
 
 import { execFile } from 'node:child_process'
 import { existsSync, statSync } from 'node:fs'
-import { join } from 'node:path'
+import { join, sep } from 'node:path'
 
 /** A resolved changed-only scope result. */
 export interface GitScopeResult {
@@ -113,10 +113,11 @@ export function parseChangedFiles(stdout: string): string[] {
  */
 export function filterExistingFiles(root: string, files: string[]): string[] {
   const out: string[] = []
+  const rootPrefix = root.endsWith(sep) ? root : root + sep
   for (const rel of files) {
     if (rel.startsWith('/') || rel.includes('\0')) continue
     const candidate = join(root, rel)
-    if (!candidate.startsWith(root + '/') && candidate !== root) continue
+    if (!candidate.startsWith(rootPrefix) && candidate !== root) continue
     try {
       if (existsSync(candidate) && statSync(candidate).isFile()) out.push(rel)
     } catch {

package/src/review-scope.ts

@@ -22,7 +22,7 @@
  */
 
 import { readdirSync } from 'node:fs'
-import { join } from 'node:path'
+import { join, relative } from 'node:path'
 
 export interface CoverageResult {
   assigned: string[]
@@ -135,8 +135,15 @@ function collectFull(root: string): string[] {
       }
       if (!entry.isFile()) continue
       if (!sourceExt(entry.name)) continue
-      const rel = abs.startsWith(root + SEP) ? abs.slice(root.length + 1) : abs
-      out.push(rel.split(SEP).join(SEP))
+      // Derive the inventory path relative to the root via path.relative (then
+      // canonicalize separators). The old `abs.slice(root.length + 1)` string
+      // prefix was only correct on POSIX: on Windows path.join emits '\\' while
+      // this module's SEP is '/', so the prefix never matched and the ABSOLUTE
+      // path leaked into the inventory. path.relative is separator-agnostic and
+      // always yields a path strictly inside `root`.
+      const rel = normalizePath(relative(root, abs))
+      if (rel === '' || rel === '.' || rel.startsWith('../') || rel === '..') continue
+      out.push(rel)
     }
   }
   return out.sort()

package/src/review.ts

@@ -247,14 +247,20 @@ export function buildReviewReport(input: {
   fixedCount?: number
 }): ReviewReport {
   // 1. Filter known-intentional per round (before cross-round dedupe).
-  const filteredRounds = input.rounds.map((r) => ({
-    round: typeof r?.round === 'number' ? r.round : 0,
-    findings: filterKnownIntentional(
-      Array.isArray(r?.findings) ? r.findings : [],
-      input.knownIntentional,
-    ),
-    readFiles: Array.isArray(r?.readFiles) ? r.readFiles : [],
-  }))
+  const filteredRounds = input.rounds
+    .map((r) => ({
+      round: typeof r?.round === 'number' ? r.round : 0,
+      findings: filterKnownIntentional(
+        Array.isArray(r?.findings) ? r.findings : [],
+        input.knownIntentional,
+      ),
+      readFiles: Array.isArray(r?.readFiles) ? r.readFiles : [],
+    }))
+    // Sort by round number so convergence math below (and the meta-review
+    // audit, which reads the LAST element as the highest round) never depends
+    // on the caller's array order. A resumed run that only passes [round 5]
+    // must be audited as round 5, not as "one round with no number".
+    .sort((a, b) => a.round - b.round)
 
   // 2. Cross-round dedupe + per-round "first seen" tracking.
   const { findings, findingsByRound } = aggregateRounds(
@@ -271,8 +277,10 @@ export function buildReviewReport(input: {
   //    using its reported round number — NOT `filteredRounds.length - 1`, which
   //    is only valid for contiguous 1..N round numbers (resumed iterations and
   //    non-contiguous round sets would otherwise read the wrong count).
-  const lastRound =
-    filteredRounds.length > 0 ? filteredRounds[filteredRounds.length - 1]!.round : 0
+  let lastRound = 0
+  for (const r of filteredRounds) {
+    if (typeof r.round === 'number' && r.round > lastRound) lastRound = r.round
+  }
   const lastRoundCount =
     lastRound > 0 ? (findingsByRound[lastRound - 1] ?? 0) : 0
   const converged = filteredRounds.length > 0 && lastRoundCount === 0