mingdao-harness 0.1.59 → 0.1.60

package/README.md

@@ -101,6 +101,14 @@ git clone https://gitee.com/MingDaoTCM/MingDao-harness.git MingDao-Harness && cd
 node src/cli.js        # 直接运行，无需安装
 ```
 
+开发者护栏（提交前建议执行；CI 会强制跑全套）：
+
+```bash
+npm install            # 仅装 devDependencies（typescript + @types/node），运行时依旧零依赖
+npm run typecheck      # tsc --checkJs 类型护栏（覆盖 agent/cli/commands/provider/cachestats 等核心模块）
+node test/smoke.js && node test/e2e-local.js && node test/e2e-web.js && node test/e2e-schedule.js
+```
+
 ### 验证安装
 
 ```bash

package/docs/QA-REPORT.md

@@ -2,7 +2,7 @@
 
 > 质检日期：2026-08-18
 > 项目路径：`/home/YouLi/AI/DeepSeek-harness-Space/MingDao-Harness`
-> 版本：0.4.0（纯 ESM，零 npm 依赖，Node.js ≥ 18.17）
+> 版本：0.1.54（历史归档；现行 0.1.x 口径见根 README 与各版本 tag。纯 ESM，零 npm 依赖，Node.js ≥ 18.17）
 > 质检方式：全量源码走读 + 冒烟/端到端测试 + 针对性缺陷验证脚本
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mingdao-harness",
-  "version": "0.1.59",
+  "version": "0.1.60",
   "description": "MingDao Harness —— 开源智能体框架（Agent Harness）。零依赖、开箱即用，针对 DeepSeek-V4 系列优化，开放主流模型接入。",
   "type": "module",
   "bin": {
@@ -52,7 +52,8 @@
     "typecheck": "tsc -p tsconfig.json",
     "prepublishOnly": "node test/smoke.js && node test/e2e-local.js && node test/e2e-schedule.js",
     "desktop": "npm --prefix desktop start",
-    "desktop:dist": "npm --prefix desktop run dist:dir"
+    "desktop:dist": "node scripts/sync-versions.mjs && npm --prefix desktop run dist:dir",
+    "desktop:sync": "node scripts/sync-versions.mjs"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",

package/src/agent.js

@@ -16,6 +16,11 @@ import { checkCostGuard } from './cost-guard.js';
 const MAX_STEPS = 24;
 const SUBAGENT_MAX_STEPS = 12;
 
+/**
+ * 创建 Agent 循环（调用方只需传 provider/permission/io/modelName/workingDir，其余可选）
+ * @param {{ provider: any, permission: any, io: any, modelName: any, workingDir: any,
+ *   cfg?: any, undoStore?: any, maxSteps?: number, mcp?: any, onCompact?: any, sessionRef?: any }} params
+ */
 export function createAgent({ provider, permission, io, modelName, workingDir, cfg = {}, undoStore, maxSteps, mcp, onCompact, sessionRef }) {
   const preset = modelPreset(modelName) || {};
   const budget = cfg.contextBudget || preset.budgetTokens || 128000;
@@ -174,8 +179,10 @@ export function createAgent({ provider, permission, io, modelName, workingDir, c
       io.startSpinner('正在思考…');
 
       let res;
+      // 审计（tsc 扩面发现）：llmT0 此前在 try 内声明、catch 内引用——chat 抛错时
+      // catch 自身 ReferenceError，掩盖原始错误且计时丢失；提到 try 外声明。
+      const llmT0 = Date.now();
       try {
-        const llmT0 = Date.now();
         res = await provider.chat({
           model: modelName,
           messages: trimmed,

package/src/batch.js

@@ -11,7 +11,6 @@ import path from 'node:path';
 import { resolveProviderConfig } from './providers/index.js';
 import { estimateBatchCost, BATCH_DISCOUNT } from './pricing.js';
 import { recordCacheStats } from './cachestats.js';
-import { buildSystemPrompt } from './prompts.js';
 
 const DEFAULT_WINDOW = '24h';
 const DEFAULT_ENDPOINT = '/v1/chat/completions';
@@ -26,15 +25,16 @@ function batchBase(cfg, model) {
   return pc.name === 'deepseek' ? base.replace(/\/v1\/?$/, '') : base;
 }
 
+/** @returns {Promise<any>} */
 async function api(base, apiKey, methodPath, payload, httpMethod = 'POST') {
   const res = await fetch(base + methodPath, {
     method: httpMethod,
     headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
     body: payload === undefined ? undefined : JSON.stringify(payload),
   });
-  const j = await res.json().catch(() => ({}));
+  const j = /** @type {any} */ (await res.json().catch(() => ({})));
   if (!res.ok) {
-    const e = new Error(j?.error?.message || j?.message || `HTTP ${res.status}`);
+    const e = /** @type {Error & { status?: number }} */ (new Error(j?.error?.message || j?.message || `HTTP ${res.status}`));
     e.status = res.status;
     throw e;
   }
@@ -50,9 +50,9 @@ async function uploadFile(base, apiKey, jsonl) {
     headers: { Authorization: `Bearer ${apiKey}` },
     body: form,
   });
-  const j = await res.json().catch(() => ({}));
+  const j = /** @type {any} */ (await res.json().catch(() => ({})));
   if (!res.ok) {
-    const e = new Error(j?.error?.message || j?.message || `上传失败 HTTP ${res.status}`);
+    const e = /** @type {Error & { status?: number }} */ (new Error(j?.error?.message || j?.message || `上传失败 HTTP ${res.status}`));
     e.status = res.status;
     throw e;
   }
@@ -84,7 +84,8 @@ async function downloadResults(base, apiKey, batch) {
   throw new Error('批处理结果文件不可用（端点不支持或文件已过期）');
 }
 
-// 执行一次批处理。questions: string[]。返回 { ok, outputFile, results, usage, cost, batchId }
+/** 执行一次批处理。questions: string[]。返回 { ok, outputFile, results, usage, cost, batchId }
+ * @param {{ cfg: any, model: any, questions: any, workingDir?: string, maxTokens?: number, temperature?: any, signal?: any, onStatus?: any }} opts */
 export async function runBatch({ cfg, model, questions, workingDir = process.cwd(), maxTokens = 4096, temperature, signal, onStatus }) {
   const list = (questions || []).map((q) => String(q).trim()).filter(Boolean);
   if (!list.length) return { error: '没有可批处理的问题（每行一个问题）' };
@@ -92,7 +93,10 @@ export async function runBatch({ cfg, model, questions, workingDir = process.cwd
   if (!pc.apiKey) return { error: `模型 ${model} 没有可用 API Key（mingdao key set ${pc.name}）` };
   const base = batchBase(cfg, model);
   const apiKey = pc.apiKey;
-  const systemPrompt = buildSystemPrompt({ workingDir });
+  // 审计（workbuddy P2-1）：批量任务无缓存语义，每个问题的 system 都按 input 全价计费——
+  // 不再携带完整系统提示（技能清单/用户记忆/AGENTS.md 对无工具批任务毫无意义，1000 问
+  // 可白烧 50-80 万 token）；改用一行精简角色提示，剩余能力损失为零。
+  const systemPrompt = '你是 MingDao Harness 编程助手。直接针对每个问题给出准确、完整的答案，不要复述问题、不要解释过程。';
   const bodyTemplate = {
     model,
     messages: null, // 逐行填充
@@ -122,11 +126,14 @@ export async function runBatch({ cfg, model, questions, workingDir = process.cwd
       completion_window: cfg?.batchWindow || DEFAULT_WINDOW,
     });
     onStatus?.(`任务已创建：${batch.id}`);
-    // 轮询（间隔可用 MINGDAO_BATCH_POLL_MS 覆盖，测试用）；连续失败 10 次 → 报错，绝不无限重试
-    const interval = Math.max(500, Number(process.env.MINGDAO_BATCH_POLL_MS) || 5000);
+    // 轮询：指数退避（审计 workbuddy P3-3）——基础间隔 5s（MINGDAO_BATCH_POLL_MS 可覆盖，测试用），
+    // ×1.5 逐次翻倍、30s 封顶：24h 窗口内轮询请求量从 ~1.7 万次降到 ~3 千次；
+    // 连续失败 10 次 → 报错，绝不无限重试。每次轮询报告进度（含已处理 X/Y）。
+    const baseInterval = Math.max(500, Number(process.env.MINGDAO_BATCH_POLL_MS) || 5000);
     const t0 = Date.now();
     let st = batch.status;
     let failures = 0;
+    let polls = 0;
     for (;;) {
       if (signal?.aborted) return { error: '已取消轮询（任务仍在服务端运行）', batchId: batch.id };
       if (Date.now() - t0 > 24 * 3600 * 1000) return { error: '批处理超过 24h 窗口', batchId: batch.id };
@@ -137,7 +144,7 @@ export async function runBatch({ cfg, model, questions, workingDir = process.cwd
       } catch (err) {
         failures += 1;
         if (failures >= 10) return { error: `轮询失败：${err?.message || err}（任务仍在服务端，ID ${batch.id}）`, batchId: batch.id };
-        await new Promise((r) => setTimeout(r, interval));
+        await new Promise((r) => setTimeout(r, Math.min(baseInterval * 1.5 ** failures, 30000)));
         continue;
       }
       st = j.status;
@@ -149,11 +156,11 @@ export async function runBatch({ cfg, model, questions, workingDir = process.cwd
         const detail = j?.errors?.data?.[0]?.message || j?.errors?.message || '';
         return { error: `批处理失败：${st}${detail ? '（' + detail + '）' : ''}`, batchId: batch.id };
       }
-      if (st !== 'in_progress' && st !== 'validating' && st !== 'finalizing') {
-        // 未知状态：继续等待但报告
-        onStatus?.(`状态：${st}`);
-      }
-      await new Promise((r) => setTimeout(r, interval));
+      polls += 1;
+      const rc = j?.request_counts || {};
+      const done = rc.completed != null && rc.total != null ? `${rc.completed}/${rc.total}` : '';
+      onStatus?.(`状态：${st}${done ? `（已处理 ${done}）` : ''}`);
+      await new Promise((r) => setTimeout(r, Math.min(baseInterval * 1.5 ** polls, 30000)));
     }
     onStatus?.('下载结果…');
     const results = await downloadResults(base, apiKey, batch);

package/src/cachestats.js

@@ -49,17 +49,27 @@ export function recordCacheStats(entry) {
   }
 }
 
+// listCacheStats 读取缓存（审计：costGuard 每步 / WebUI 每 15s / /cost 命令都调用——
+// 四报告共识 P2-2/§3.3-A：全文件读+逐行 parse 会随 JSONL 增长线性放大 IO。
+// 按 mtimeMs+size 双键缓存；写入追加会改两者，轮转重写同样改，缓存自动失效）
+let _statsCache = null;
+
 export function listCacheStats(limit = 2000) {
   try {
-    const raw = fs.readFileSync(cacheStatsFile(), 'utf8');
-    const out = [];
-    for (const l of raw.split('\n')) {
-      if (!l.trim()) continue;
-      try {
-        out.push(JSON.parse(l));
-      } catch {}
+    const file = cacheStatsFile();
+    const st = fs.statSync(file);
+    if (!_statsCache || _statsCache.mtimeMs !== st.mtimeMs || _statsCache.size !== st.size || _statsCache.limit < limit) {
+      const raw = fs.readFileSync(file, 'utf8');
+      const out = [];
+      for (const l of raw.split('\n')) {
+        if (!l.trim()) continue;
+        try {
+          out.push(JSON.parse(l));
+        } catch {}
+      }
+      _statsCache = { mtimeMs: st.mtimeMs, size: st.size, limit, lines: out };
     }
-    return out.slice(-limit);
+    return _statsCache.lines.slice(-limit);
   } catch {
     return [];
   }

package/src/cli.js

@@ -23,7 +23,7 @@ import { enableAutostart, disableAutostart, autostartStatus, autostartPath } fro
 import { notifyTaskDone } from './notify.js';
 import { addWorkspace, removeWorkspace, workspacePath, touchWorkspace, listWorkspaces, currentWorkspace } from './workspace.js';
 import { finalizeSession, extractMemory, loadMemory, appendMemory, recentJournal, dedupeMemory, removeMemoryLines } from './memory.js';
-import { recordUsage, listCacheStats, summarizeCacheStats, formatCacheSummary } from './cachestats.js';
+import { recordUsage, listCacheStats, summarizeCacheStats, formatCacheSummary, costBreakdown } from './cachestats.js';
 import { presetList, buildPreset } from './mcp-presets.js';
 import {
   addSchedule,
@@ -508,10 +508,12 @@ async function main() {
     const route = await routeTask({ cfg, provider, currentModel: modelName, text: question });
     if (route.model !== modelName) {
       if (!jsonMode) io.print(style(`⤷ 自动路由 → ${route.model}（${route.reason}）`, C.dim));
+      // 审计 P1-2（第五轮复审实证）：先按新模型重建 provider、再改模型名——
+      // 此前顺序颠倒（先赋值再判断），条件恒假，跨服务商路由池会把 executor 模型名
+      // 发到 planner 的 baseUrl/key 上（401/404）。默认同服务商配置不受影响。
+      provider = await createProvider(cfg, route.model);
       modelName = route.model;
     }
-    // 审计 P1-2：自动路由改换模型后必须重建对应 provider（此前用旧模型的 baseUrl/key 发请求）
-    if (route.model !== modelName) provider = await createProvider(cfg, modelName);
     // JSON 模式：关闭流式输出，结果以单行 JSON 输出（脚本/管道友好）
     const turnIo = jsonMode ? createIO({ quiet: true }) : io;
     const session = createSession(home);
@@ -712,6 +714,9 @@ async function main() {
     if (input.startsWith('/')) {
       const [cmd, ...rest] = input.split(/\s+/);
       const arg = rest.join(' ');
+      // 审计（第五轮 P1-1 教训）：斜杠命令统一 try/catch——单条命令异常只提示不退出，
+      // 绝不再因一条命令的错误杀死整个 REPL 会话（历史 P1-1 曾导致会话上下文全丢）
+      try {
       if (cmd === '/exit' || cmd === '/quit') break;
       else if (cmd === '/help') printHelpLines(io.print);
       else if (cmd === '/clear') {
@@ -993,6 +998,10 @@ async function main() {
         io.print(style('未知命令，输入 /help 查看可用命令。', C.yellow));
       }
       continue;
+      } catch (err) {
+        io.print(style('[错误] 命令执行失败：' + (err?.message || err), C.red));
+        continue;
+      }
     }
 
     // 自动路由：规划类任务切 planner，执行类走 executor（会话粘滞 + 分类缓存见 routing.js）

package/src/commands/sync.js

@@ -18,7 +18,8 @@ import {
 
 async function askHidden(question) {
   return new Promise((resolve) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    // _writeToOutput 为 readline 内部接口：静音回显（密码输入），类型护栏下显式 any
+    const rl = /** @type {any} */ (readline.createInterface({ input: process.stdin, output: process.stdout }));
     const orig = rl._writeToOutput;
     rl._writeToOutput = () => {};
     rl.question(question, (a) => {

package/src/compact.js

@@ -19,12 +19,12 @@ const INPUT_MAX_CHARS = 30000; // 摘要输入上限（防超长工具输出撑
 const TOOL_OUTPUT_CAP = 300; // 摘要输入中每条工具结果截断长度
 
 const SUMMARY_SYSTEM =
-  '你是 MingDao 的会话压缩器。把对话记录压成紧凑中文摘要（≤500 字，要点列表）：' +
+  '你是 MingDao Harness 的会话压缩器。把对话记录压成紧凑中文摘要（≤500 字，要点列表）：' +
   '保留用户目标与关键要求、已完成的步骤与结论、修改/创建的文件、未完成事项、重要约定与决策；' +
-  '省略已完成的中间过程与细节。只输出摘要本身，不要任何解释。';
+  '省略已完成的中间过程与细节。只输出 JSON：{"summary": "摘要内容"}。';
 
 export async function summarizeConversation(provider, model, convoText) {
-  const res = await provider.chat({
+  const base = {
     model,
     messages: [
       { role: 'system', content: SUMMARY_SYSTEM },
@@ -32,11 +32,26 @@ export async function summarizeConversation(provider, model, convoText) {
     ],
     tools: [],
     temperature: 0.2,
-    maxTokens: 2048, // 审计 Q2：与 SUMMARY_MAX_CHARS(1600 字) 匹配，避免模型侧先截断
-  });
-  const text = String(res?.text || '').trim();
-  if (!text) return { text: null, usage: res?.usage || null };
-  return { text: text.slice(0, SUMMARY_MAX_CHARS), usage: res?.usage || null };
+  };
+  // 结构化输出（审计 MiniMax §3.3-D）：压缩是 30K 输入 × pro 价的大开销，与标题/记忆/路由
+  // 一致改 json_object + maxTokens 2048→1024（1600 字摘要足够）；网关不支持时回退纯文本。
+  let text = '';
+  let usage = null;
+  try {
+    const res = await provider.chat({ ...base, maxTokens: 1024, responseFormat: { type: 'json_object' } });
+    const j = JSON.parse(String(res?.text || '').trim());
+    text = String(j?.summary || '').trim();
+    usage = res?.usage || null;
+  } catch {}
+  if (!text) {
+    try {
+      const res = await provider.chat({ ...base, maxTokens: 1024 });
+      text = String(res?.text || '').trim();
+      usage = res?.usage || null;
+    } catch {}
+  }
+  if (!text) return { text: null, usage };
+  return { text: text.slice(0, SUMMARY_MAX_CHARS), usage };
 }
 
 export async function compactConversation({ messages, budget, count, provider, executorModel, triggerRatio }) {

package/src/config.js

@@ -23,6 +23,8 @@ export function configPath() {
   return path.join(mingdaoHome(), 'config.json');
 }
 
+/** 读取配置对象（不存在/损坏返回 null）；返回值为用户可编辑的任意 JSON 配置，类型不定
+ * @returns {any} */
 export function loadConfig() {
   try {
     return JSON.parse(fs.readFileSync(configPath(), 'utf8'));

package/src/mcp.js

@@ -151,7 +151,7 @@ export class McpClient {
           this.notify('notifications/initialized');
           this.ready = true;
           clearTimeout(timer);
-          resolve();
+          resolve(undefined);
         })
         .catch((err) => {
           clearTimeout(timer);

package/src/memory.js

@@ -171,7 +171,7 @@ export async function extractMemory(provider, model, messages, existingMemory) {
       {
         role: 'system',
         content:
-          '你是 MingDao 的记忆提取器。从对话中提取值得长期记住的用户偏好与事实（工具链、代码风格、项目背景、个人约定、常用指令等）。每条一行，以 - 开头，≤30 字，只输出新条目（与「已有记忆」重复或对话中未提及的不要输出）；没有新增时 items 为空数组。\n已有记忆：\n' +
+          '你是 MingDao Harness 的记忆提取器。从对话中提取值得长期记住的用户偏好与事实（工具链、代码风格、项目背景、个人约定、常用指令等）。每条 ≤30 字，只输出新条目（与「已有记忆」重复或对话中未提及的不要输出）。只输出 JSON：{"items": ["条目1", "条目2"]}；没有新增时输出 {"items": []}。\n已有记忆：\n' +
           (existingMemory || '（空）'),
       },
       { role: 'user', content: convo.slice(0, 8000) },

package/src/model-discovery.js

@@ -84,7 +84,7 @@ export async function fetchProviderModels(cfg, providerName, { force = false } =
         redirect: 'follow',
       });
       if (!res.ok) return { error: `HTTP ${res.status}` };
-      const j = await res.json().catch(() => null);
+      const j = /** @type {any} */ (await res.json().catch(() => null));
       const list = (j?.data || [])
         .map((m) => String(m?.id || '').trim())
         .filter((id) => id && isChatModel(id))

package/src/prompts.js

@@ -4,7 +4,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { skillsRegistryBlock } from './skills.js';
-import { mingdaoHome } from './config.js';
+import { mingdaoHome, loadConfig } from './config.js';
 import { recentJournalBlock } from './memory.js';
 
 const BASE = `你是 MingDao Harness，一个由 MingDao Harness 驱动的 AI 编程助手。你在用户的电脑上工作：通过工具读写文件、搜索代码、执行命令，帮助用户完成编程、调试与自动化任务。
@@ -29,6 +29,7 @@ function loadFile(p, cap) {
   }
 }
 
+/** @param {{ workingDir: any, withJournal?: boolean, [key: string]: any }} opts */
 export function buildSystemPrompt({ workingDir, withJournal = false }) {
   // 前缀字节稳定性（评估 P1-1/P1-2，四份评估一致的最高价值项）：
   // 系统提示不含「当前模型」「当前日期」等易变字段——DeepSeek 上下文缓存按前缀字节匹配，
@@ -50,9 +51,15 @@ export function buildSystemPrompt({ workingDir, withJournal = false }) {
   // 技能清单（渐进披露：仅名称+描述，按需加载全文）
   prompt += skillsRegistryBlock(workingDir);
 
-  // 项目约定（./AGENTS.md）
-  const agentsMd = loadFile(path.join(workingDir, 'AGENTS.md'), 20000);
-  if (agentsMd) prompt += `\n\n<agents_md>\n${agentsMd}\n</agents_md>`;
+  // 项目约定（./AGENTS.md）——体积可配置（审计 MiniMax §3.3-B，v0.1.48 P0-D）：
+  // 典型项目 6-12K 的 AGENTS.md 全量进 system 每轮按缓存价计费；默认截 4K，超长部分
+  // 模型可 read 工具按需读全文。config.maxAgentsMdChars 可调（0 表示不注入）。
+  const cfg = loadConfig();
+  const agentsMdCap = cfg && Number.isFinite(Number(cfg.maxAgentsMdChars)) ? Math.max(0, Number(cfg.maxAgentsMdChars)) : 4000;
+  if (agentsMdCap > 0) {
+    const agentsMd = loadFile(path.join(workingDir, 'AGENTS.md'), agentsMdCap);
+    if (agentsMd) prompt += `\n\n<agents_md>\n${agentsMd}\n</agents_md>`;
+  }
 
   return prompt;
 }

package/src/schedule.js

@@ -93,8 +93,8 @@ export function writeSchedule(home, job) {
   return job;
 }
 
-// 新建调度任务；after: 依赖的任务 ID（全部成功后才启动，任一失败则跳过）
-export function addSchedule(home, question, { at, every, after, permission, model, cwd, anchor, offpeak }) {
+/** 新建调度任务；after: 依赖的任务 ID（全部成功后才启动，任一失败则跳过） */
+export function addSchedule(home, question, /** @type {any} */ { at, every, after, permission, model, cwd, anchor, offpeak }) {
   const id = 'sc' + Date.now().toString(36) + Math.random().toString(36).slice(2, 5);
   const interval = every != null ? parseInterval(every) : null;
   const afterList = Array.isArray(after) ? after.filter(Boolean).map(String) : after ? String(after).split(',').map((x) => x.trim()).filter(Boolean) : [];
@@ -276,7 +276,11 @@ export function spawnDaemon(home) {
     env: { ...process.env, MINGDAO_HOME: home },
   });
   try {
-    fs.writeFileSync(daemonPidFile(home), `${child.pid} ${nonce}`);
+    // 原子写（审计 workbuddy P3-4）：tmp+rename 与 writeSchedule 同款——崩溃不留半截 pid 文件
+    const target = daemonPidFile(home);
+    const tmp = target + '.tmp';
+    fs.writeFileSync(tmp, `${child.pid} ${nonce}`);
+    fs.renameSync(tmp, target);
   } catch {}
   child.unref();
   return true;

package/src/sync-server.js

@@ -193,7 +193,7 @@ async function doRegister(body) {
   // 审计 P2-10：注册用进程内互斥，避免并发同名注册双双成功（后写覆盖）
   if (!registerLock) {
     registerLock = new Promise((resolve) => {
-      queueMicrotask(resolve);
+      queueMicrotask(() => resolve(undefined));
     });
   }
   const prev = registerLock;
@@ -530,6 +530,7 @@ async function handle(req, res) {
 }
 
 // ---------- 启动 ----------
+/** @param {{ port?: any, host?: any, dataDir?: any, cert?: any, key?: any }} [opts] */
 export function runSyncServer({ port, host, dataDir, cert, key } = {}) {
   const dir = dataDir || DEFAULT_DATA_DIR;
   ACTIVE_DIR = dir;

package/src/sync.js

@@ -63,7 +63,7 @@ async function apiCall(baseUrl, method, payload, token, timeoutMs = TIMEOUT_MS,
     if (insecure) {
       const { status, json: j } = await rawRequest(target, { headers, body, timeoutMs, insecure: true });
       if (status !== 200) {
-        const err = new Error(j.error || `HTTP ${status}`);
+        const err = /** @type {Error & { status?: number, body?: any }} */ (new Error(j.error || `HTTP ${status}`));
         err.status = status;
         err.body = j;
         throw err;
@@ -79,9 +79,9 @@ async function apiCall(baseUrl, method, payload, token, timeoutMs = TIMEOUT_MS,
         body,
         signal: ctrl.signal,
       });
-      const j = await res.json().catch(() => ({}));
+      const j = /** @type {any} */ (await res.json().catch(() => ({})));
       if (!res.ok) {
-        const err = new Error(j.error || `HTTP ${res.status}`);
+        const err = /** @type {Error & { status?: number, body?: any }} */ (new Error(j.error || `HTTP ${res.status}`));
         err.status = res.status;
         err.body = j;
         throw err;

package/src/tasks.js

@@ -54,7 +54,7 @@ export function isValidTaskId(id) {
   return typeof id === 'string' && /^[a-z0-9]+$/.test(id) && id.length >= 4 && id.length <= 40;
 }
 
-export function startTask(home, question, { permission, model, cwd, offpeak } = {}) {
+export function startTask(home, question, { permission, model, cwd, offpeak } = /** @type {any} */ ({})) {
   const id = Date.now().toString(36) + Math.random().toString(36).slice(2, 6) + process.pid.toString(36);
   const task = {
     id,

package/src/tools/bash.js

@@ -43,8 +43,35 @@ export function detectSandbox() {
   return sandboxSupport;
 }
 
+// 输出折叠（审计 MiniMax §3.3-E / v0.1.48 P1-G）：模型回填的 bash 输出先折叠再截断——
+// 1) 剥离 ANSI 转义序列（CSI/OSC）；2) 连续重复行（>3 行相同）折叠为「首行 + 重复标记」。
+// npm install 类输出通常 30-50KB → 折叠后 5-10KB，单次工具回填省 60-70% prompt token。
+function stripAnsi(s) {
+  return s
+    .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, '')
+    .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '');
+}
+function foldRepeats(s) {
+  const lines = s.split('\n');
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    let j = i;
+    while (j + 1 < lines.length && lines[j + 1] === lines[i]) j += 1;
+    const run = j - i + 1;
+    if (run > 3) {
+      out.push(lines[i], `…（以上重复 ${run} 行，已折叠）`);
+      i = j + 1;
+    } else {
+      out.push(lines[i]);
+      i += 1;
+    }
+  }
+  return out.join('\n');
+}
 function tail(s, n) {
-  return s.length > n ? `…[输出过长，已截断头部]\n${s.slice(-n)}` : s;
+  const folded = foldRepeats(stripAnsi(s));
+  return folded.length > n ? `…[输出过长，已截断头部]\n${folded.slice(-n)}` : folded;
 }
 
 export function runBash(args, ctx) {

package/src/update.js

@@ -111,7 +111,7 @@ const NPM_HINT =
   '源码包安装请重新运行安装脚本（install.sh）；或从任意平台仓库克隆后 `npm link`：' +
   'https://gitee.com/MingDaoTCM/MingDao-harness · https://gitcode.com/MingDaoTCM/MingDao-Harness · https://github.com/MingDaoTCM/MingDao-Harness';
 
-export async function updateCheck({ repo } = {}) {
+export async function updateCheck({ repo } = /** @type {any} */ ({})) {
   const lines = [];
   const root = resolveRepo(repo);
   if (!root) return { ok: false, lines: [NPM_HINT] };
@@ -130,7 +130,7 @@ export async function updateCheck({ repo } = {}) {
   };
 }
 
-export async function mingdaoUpdate({ repo } = {}) {
+export async function mingdaoUpdate({ repo } = /** @type {any} */ ({})) {
   const lines = [];
   const root = resolveRepo(repo);
   if (!root) return { ok: false, lines: [NPM_HINT] };
@@ -195,7 +195,7 @@ export async function mingdaoUpdate({ repo } = {}) {
   };
 }
 
-export function mingdaoRollback({ repo } = {}) {
+export function mingdaoRollback({ repo } = /** @type {any} */ ({})) {
   const root = resolveRepo(repo);
   if (!root) return { ok: false, lines: [NPM_HINT] };
   const st = readState();

package/src/web/index.html

@@ -3,6 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'">
 <title>MingDao Harness</title>
 <link rel="manifest" href="/manifest.webmanifest">
 <link rel="icon" href="/icon-192.png" type="image/png">

package/src/web/server.js

@@ -74,7 +74,7 @@ function readBody(req) {
     let size = 0;
     // 审计 P2-6：慢速连接防护——60s 未传完请求体即断开，防占满 socket
     const slowTimer = setTimeout(() => {
-      const err = new Error('请求体上传超时（60s）');
+      const err = /** @type {Error & { status?: number }} */ (new Error('请求体上传超时（60s）'));
       err.status = 408;
       req.destroy();
       reject(err);
@@ -84,7 +84,7 @@ function readBody(req) {
     req.on('data', (d) => {
       size += d.length;
       if (size > MAX_BODY) {
-        const err = new Error('请求体过大（>40MB）');
+        const err = /** @type {Error & { status?: number }} */ (new Error('请求体过大（>40MB）'));
         err.status = 413;
         req.destroy();
         reject(err);
@@ -104,6 +104,7 @@ function readBody(req) {
   });
 }
 
+/** @param {{ host?: string, port?: number, authToken?: string|null, [key: string]: any }} [opts] */
 export async function runWebServer({ host = '127.0.0.1', port = 3820, authToken } = {}) {
   const home = ensureHome();
   const cfg = loadConfig();
@@ -1138,7 +1139,7 @@ export async function runWebServer({ host = '127.0.0.1', port = 3820, authToken
     });
   });
 
-  server.on('error', (err) => {
+  server.on('error', (/** @type {Error & { code?: string }} */ err) => {
     if (err.code === 'EADDRINUSE') {
       console.error(`[MingDao] 端口 ${port} 已被占用，请换一个端口：mingdao web <端口号>`);
     } else {
@@ -1148,7 +1149,7 @@ export async function runWebServer({ host = '127.0.0.1', port = 3820, authToken
   });
 
   server.listen(port, host, () => {
-    const actual = server.address().port;
+    const actual = /** @type {import('node:net').AddressInfo} */ (server.address()).port;
     boundPort = actual;
     const displayHost = host === '0.0.0.0' ? '127.0.0.1' : host;
     console.log('');