@miphamai/cli 0.35.0 → 0.36.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.35.0",
+  "version": "0.36.1",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent/crsi-provenance-bridge.ts

@@ -0,0 +1,77 @@
+/**
+ * CRSI ↔ MegaSystem provenance bridge.
+ *
+ * Closes the CRSI loop across the terminal↔backend boundary: every
+ * auto-generated rule is recorded as an auditable decision in megasystem
+ * (via the `mipham-kg` MCP server), and its effectiveness verdict is later
+ * attached via `evaluate_decision`. All calls degrade gracefully — when the
+ * megasystem MCP server is not connected, `recordDecision` returns null and
+ * `evaluateDecision` returns false, so the local CRSI loop keeps working.
+ */
+
+import type { ToolCallResult } from '../mcp/types.js'
+
+/** Effectiveness verdicts the CRSI loop can emit for a recorded decision. */
+export type CrsiVerdict = 'effective' | 'ineffective' | 'degrading'
+
+/** The narrow MCP surface the bridge needs — injectable for tests. */
+export interface CrsiProvenanceClient {
+  callTool(
+    serverName: string,
+    toolName: string,
+    params?: Record<string, unknown>,
+  ): Promise<ToolCallResult>
+}
+
+export class CrsiProvenanceBridge {
+  constructor(
+    private readonly client: CrsiProvenanceClient,
+    private readonly serverName: string = 'mipham-kg',
+  ) {}
+
+  /**
+   * Record a rule as an auditable decision in megasystem.
+   *
+   * Returns the megasystem decision id, or null when the server is
+   * unavailable or the call failed — the caller may ignore null.
+   */
+  async recordDecision(query: string, answer: string, confidence?: number): Promise<string | null> {
+    const result = await this.client.callTool(this.serverName, 'record_decision', {
+      query,
+      answer,
+      confidence,
+    })
+    const parsed = this._parse(result)
+    return typeof parsed?.decision_id === 'string' ? parsed.decision_id : null
+  }
+
+  /**
+   * Attach an effectiveness verdict to a recorded decision.
+   *
+   * Returns true when the verdict was accepted by megasystem, false otherwise.
+   */
+  async evaluateDecision(
+    decisionId: string,
+    verdict: CrsiVerdict,
+    opts: { score?: number; metrics?: Record<string, unknown> } = {},
+  ): Promise<boolean> {
+    const result = await this.client.callTool(this.serverName, 'evaluate_decision', {
+      decision_id: decisionId,
+      verdict,
+      score: opts.score,
+      metrics: opts.metrics,
+    })
+    return !result.isError
+  }
+
+  private _parse(result: ToolCallResult): Record<string, unknown> | null {
+    if (result.isError) return null
+    const text = result.content?.[0]?.text
+    if (!text) return null
+    try {
+      return JSON.parse(text) as Record<string, unknown>
+    } catch {
+      return null
+    }
+  }
+}

package/src/agent/effectiveness-tracker.ts

@@ -1,5 +1,6 @@
 import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
 import { join, dirname } from 'node:path'
+import type { CrsiProvenanceBridge, CrsiVerdict } from './crsi-provenance-bridge.js'
 
 export interface RuleEffectiveness {
   ruleId: string
@@ -15,6 +16,8 @@ export interface RuleEffectiveness {
     appliedCount: number
     failureRate: number
   }>
+  /** megasystem decision id, set when the rule was recorded via the bridge. */
+  decisionId?: string
 }
 
 const EVAL_THRESHOLD = 10 // evaluate after 10 applications
@@ -23,12 +26,24 @@ const STORE_FILE = 'effectiveness.json'
 export class EffectivenessTracker {
   private data: Map<string, RuleEffectiveness>
   private storePath: string
+  private provenanceBridge?: CrsiProvenanceBridge
 
   constructor(storeDir: string = join(process.env.HOME || '~', '.mipham', 'rule-engine')) {
     this.storePath = join(storeDir, STORE_FILE)
     this.data = new Map()
   }
 
+  /** Wire the CRSI ↔ MegaSystem provenance bridge for verdict reporting. */
+  setProvenanceBridge(bridge: CrsiProvenanceBridge): void {
+    this.provenanceBridge = bridge
+  }
+
+  /** Associate a rule with the megasystem decision recorded for it. */
+  setDecisionId(ruleId: string, decisionId: string): void {
+    const eff = this.data.get(ruleId)
+    if (eff) eff.decisionId = decisionId
+  }
+
   recordApplication(ruleId: string, success: boolean): void {
     let eff = this.data.get(ruleId)
     if (!eff) {
@@ -88,6 +103,9 @@ export class EffectivenessTracker {
         eff.evaluationHistory = eff.evaluationHistory.slice(-10)
       }
 
+      // Report the verdict to megasystem (non-blocking, degrades gracefully)
+      this._reportEvaluation(eff)
+
       // Auto-management is gated by crsi.autoRuleManagement feature flag
       if (!autoRuleManagement) continue
 
@@ -121,6 +139,23 @@ export class EffectivenessTracker {
     return this.data.get(ruleId) || null
   }
 
+  /** Fire-and-forget the effectiveness verdict to megasystem. */
+  private _reportEvaluation(eff: RuleEffectiveness): void {
+    if (!this.provenanceBridge || !eff.decisionId) return
+    const verdict: CrsiVerdict =
+      eff.postRuleFailureRate < 0.4
+        ? 'effective'
+        : eff.postRuleFailureRate > 0.6
+          ? 'ineffective'
+          : 'degrading'
+    this.provenanceBridge
+      .evaluateDecision(eff.decisionId, verdict, {
+        score: eff.postRuleFailureRate,
+        metrics: { applied: eff.appliedCount, success: eff.successAfterCount },
+      })
+      .catch(() => {})
+  }
+
   persist(): void {
     const dir = dirname(this.storePath)
     mkdirSync(dir, { recursive: true })

package/src/agent-view/agent-view-manager.ts

@@ -34,11 +34,14 @@ export interface AgentSession {
   branch?: string
   /** Created PR URL (if requested) */
   prUrl?: string
+  /** Working directory the session was spawned from (used for directory grouping). */
+  directory: string
 }
 
 export interface CreateSessionOptions {
   provider?: string
   model?: string
+  directory?: string
 }
 
 export interface SessionPeek {
@@ -48,6 +51,11 @@ export interface SessionPeek {
 
 export type StatusGroups = Record<SessionStatus, AgentSession[]>
 
+export interface DirectoryGroup {
+  directory: string
+  sessions: AgentSession[]
+}
+
 export class AgentViewManager {
   private sessions: Map<string, AgentSession> = new Map()
   private sessionOrder: string[] = []
@@ -66,6 +74,7 @@ export class AgentViewManager {
       provider: options.provider ?? 'unknown',
       model: options.model ?? 'unknown',
       task,
+      directory: options.directory ?? process.cwd(),
       createdAt: new Date(),
       elapsedMs: 0,
       messages: [],
@@ -109,6 +118,27 @@ export class AgentViewManager {
     return groups
   }
 
+  /**
+   * Group all sessions by their working directory (v2.1.229 session-grouping alignment).
+   * Returns groups sorted alphabetically by directory path.
+   */
+  groupByDirectory(): DirectoryGroup[] {
+    const groups = new Map<string, AgentSession[]>()
+
+    for (const id of this.sessionOrder) {
+      const session = this.sessions.get(id)
+      if (!session) continue
+      const dir = session.directory || '(unknown)'
+      const existing = groups.get(dir)
+      if (existing) existing.push(session)
+      else groups.set(dir, [session])
+    }
+
+    return Array.from(groups.entries())
+      .map(([directory, sessions]) => ({ directory, sessions }))
+      .sort((a, b) => a.directory.localeCompare(b.directory))
+  }
+
   /**
    * Get a session by ID.
    */

package/src/agent-view/dashboard.tsx

@@ -30,7 +30,7 @@ const STATUS_HEADERS: Record<string, { label: string; color: string }> = {
 export function AgentViewDashboard({ manager, onAttach, onExit }: DashboardProps) {
   const [selectedIndex, setSelectedIndex] = useState(0)
   const [peekingSessionId, setPeekingSessionId] = useState<string | null>(null)
-  const [_groupBy, setGroupBy] = useState<'status' | 'directory'>('status')
+  const [groupBy, setGroupBy] = useState<'status' | 'directory'>('status')
   const [feedback, setFeedback] = useState<string | null>(null)
 
   // Flash a brief feedback message that auto-clears
@@ -41,37 +41,53 @@ export function AgentViewDashboard({ manager, onAttach, onExit }: DashboardProps
 
   // Build a flat list of sessions in group order, with group headers
   const flatList = useMemo(() => {
-    const groups = manager.groupByStatus()
     const result: Array<
-      | { type: 'header'; status: string; label: string; color: string; count: number }
+      | { type: 'header'; key: string; label: string; color: string; count: number }
       | { type: 'session'; session: AgentSession }
     > = []
 
-    const statusOrder: Array<keyof typeof STATUS_HEADERS> = [
-      'working',
-      'needs-input',
-      'completed',
-      'failed',
-    ]
+    if (groupBy === 'directory') {
+      for (const group of manager.groupByDirectory()) {
+        result.push({
+          type: 'header',
+          key: `dir-${group.directory}`,
+          label: group.directory,
+          color: 'blue',
+          count: group.sessions.length,
+        })
 
-    for (const _status of statusOrder) {
-      const status = _status as SessionStatus
-      const sessions = groups[status] ?? []
-      result.push({
-        type: 'header',
-        status,
-        label: STATUS_HEADERS[status]!.label,
-        color: STATUS_HEADERS[status]!.color,
-        count: sessions.length,
-      })
+        for (const session of group.sessions) {
+          result.push({ type: 'session', session })
+        }
+      }
+    } else {
+      const groups = manager.groupByStatus()
+      const statusOrder: Array<keyof typeof STATUS_HEADERS> = [
+        'working',
+        'needs-input',
+        'completed',
+        'failed',
+      ]
+
+      for (const _status of statusOrder) {
+        const status = _status as SessionStatus
+        const sessions = groups[status] ?? []
+        result.push({
+          type: 'header',
+          key: `status-${status}`,
+          label: STATUS_HEADERS[status]!.label,
+          color: STATUS_HEADERS[status]!.color,
+          count: sessions.length,
+        })
 
-      for (const session of sessions) {
-        result.push({ type: 'session', session })
+        for (const session of sessions) {
+          result.push({ type: 'session', session })
+        }
       }
     }
 
     return result
-  }, [manager])
+  }, [manager, groupBy])
 
   // Flatten sessions only for navigation (skip headers)
   const sessionsOnly = useMemo(
@@ -106,7 +122,7 @@ export function AgentViewDashboard({ manager, onAttach, onExit }: DashboardProps
     // Ctrl+T — toggle group by (status ↔ directory)
     if (key.ctrl && input === 't') {
       setGroupBy((prev) => (prev === 'status' ? 'directory' : 'status'))
-      showFeedback(`Grouped by ${_groupBy === 'status' ? 'directory' : 'status'}`)
+      showFeedback(`Grouped by ${groupBy === 'status' ? 'directory' : 'status'}`)
       return
     }
 
@@ -238,7 +254,7 @@ export function AgentViewDashboard({ manager, onAttach, onExit }: DashboardProps
           {flatList.map((item, _flatIdx) => {
             if (item.type === 'header') {
               return (
-                <Box key={`h-${item.status}`} marginY={1}>
+                <Box key={`h-${item.key}`} marginY={1}>
                   <Text bold color={item.color}>
                     {' '}
                     {item.label} ({item.count})

package/src/config/loader.ts

@@ -175,7 +175,13 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
       const parsed = JSON.parse(raw) as {
         mcpServers?: Record<
           string,
-          { command: string; args?: string[]; env?: Record<string, string> }
+          {
+            command?: string
+            args?: string[]
+            url?: string
+            headers?: Record<string, string>
+            env?: Record<string, string>
+          }
         >
       }
 
@@ -187,6 +193,8 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
             name,
             command: cfg.command,
             args: cfg.args || [],
+            url: cfg.url,
+            headers: cfg.headers,
             env: cfg.env,
           })
         }

package/src/core/auto-memory.ts

@@ -16,6 +16,7 @@ import type { PatternAnalyzer, Pattern } from '../agent/pattern-analyzer.js'
 import type { ExperienceRuleEngine, ToolRule } from './rule-engine.js'
 import type { EffectivenessTracker } from '../agent/effectiveness-tracker.js'
 import type { ErrorSignatureDB } from './error-signature-db.js'
+import type { CrsiProvenanceBridge } from '../agent/crsi-provenance-bridge.js'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
 
@@ -88,6 +89,7 @@ export class AutoMemoryEngine {
   private ruleEngine?: ExperienceRuleEngine
   private effectivenessTracker?: EffectivenessTracker
   private errorSignatureDB?: ErrorSignatureDB
+  private provenanceBridge?: CrsiProvenanceBridge
 
   /** Accumulated reflections for the current session (not yet persisted to disk). */
   private sessionReflections: TurnReflection[] = []
@@ -122,6 +124,14 @@ export class AutoMemoryEngine {
     this.errorSignatureDB = db
   }
 
+  /**
+   * Wire the CRSI ↔ MegaSystem provenance bridge. When set, every
+   * auto-generated rule is recorded as an auditable decision in megasystem.
+   */
+  setProvenanceBridge(bridge: CrsiProvenanceBridge): void {
+    this.provenanceBridge = bridge
+  }
+
   // ── Core API ──
 
   /**
@@ -218,8 +228,10 @@ export class AutoMemoryEngine {
       this.writeSessionSummary()
     }
 
-    // Flush CRSI state
+    // Flush CRSI state — evaluate first (reports verdicts to megasystem,
+    // applies auto-degrade/disable/upgrade), then persist.
     if (this.effectivenessTracker) {
+      this.effectivenessTracker.evaluate()
       this.effectivenessTracker.persist()
     }
   }
@@ -352,6 +364,23 @@ export class AutoMemoryEngine {
       const toolRule = this.patternAnalyzer.toToolRule(pattern)
       this.ruleEngine.register(toolRule)
 
+      // ── CRSI ↔ MegaSystem: record the rule as an auditable decision ──
+      if (this.provenanceBridge) {
+        const confidence = pattern.confidence === 'high' ? 0.9 : 0.6
+        this.provenanceBridge
+          .recordDecision(
+            `[${pattern.category}] ${toolRule.toolName} — ${pattern.examples?.[0] || ''}`,
+            `rule ${toolRule.id} — ${pattern.category} auto-fix`,
+            confidence,
+          )
+          .then((decisionId) => {
+            if (decisionId && this.effectivenessTracker) {
+              this.effectivenessTracker.setDecisionId(toolRule.id, decisionId)
+            }
+          })
+          .catch(() => {})
+      }
+
       // Track the new rule's effectiveness
       if (this.effectivenessTracker) {
         this.effectivenessTracker.recordApplication(toolRule.id, true)

package/src/core/constitution-loader.ts

@@ -13,7 +13,7 @@
  * Format: YAML with schema validation
  */
 
-import { readFileSync, existsSync } from 'node:fs'
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
 
@@ -154,7 +154,6 @@ export class ConstitutionLoader {
     // Write the default constitution to disk for visibility
     this.cached = DEFAULT_CONSTITUTION
     try {
-      const { writeFileSync, mkdirSync } = require('node:fs')
       const dir = join(homedir(), '.mipham')
       if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
       writeFileSync(this.path, this.serializeToYaml(DEFAULT_CONSTITUTION), 'utf-8')

package/src/core/engine.ts

@@ -23,6 +23,8 @@ import { RulesLoader } from './rules-loader'
 import { ExperienceRuleEngine } from './rule-engine.js'
 import { PatternAnalyzer } from '../agent/pattern-analyzer.js'
 import { EffectivenessTracker } from '../agent/effectiveness-tracker.js'
+import { CrsiProvenanceBridge } from '../agent/crsi-provenance-bridge.js'
+import { McpClient } from '../mcp/client.js'
 import { ErrorSignatureDB } from './error-signature-db.js'
 import { PreFlightChecker } from './preflight-checker.js'
 import { AutoCorrector } from './auto-corrector.js'
@@ -375,6 +377,10 @@ export class QueryEngine {
   }
 
   async *process(userInput: string, signal?: AbortSignal): AsyncGenerator<StreamChunk> {
+    // v2.1.229 alignment: reject whitespace-only messages before they reach the
+    // provider API (which would otherwise 400 on an empty/blank message).
+    if (!userInput.trim()) return
+
     // Poll for cross-session messages before each turn
     await this.pollCrossSessionInbox()
 
@@ -1179,6 +1185,12 @@ export class QueryEngine {
       )
       // Wire SIS error signature DB for cross-session immunity
       this._autoMemory.setErrorSignatureDB(this.getErrorSignatureDB())
+
+      // Wire CRSI ↔ MegaSystem provenance bridge (degrades gracefully
+      // when the mipham-kg MCP server is not connected).
+      const bridge = new CrsiProvenanceBridge(McpClient.getInstance())
+      this._autoMemory.setProvenanceBridge(bridge)
+      this.getEffectivenessTracker().setProvenanceBridge(bridge)
     }
     return this._autoMemory
   }

package/src/core/permission.ts

@@ -9,6 +9,18 @@ import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchBashRule, compileRule } from './permission-rules'
 import { loadPermissionConfig, nextMode, clampMode, MODE_CYCLE } from './permission-config'
 
+/**
+ * Check if a Bash command is a git/gh operation using a destructive flag
+ * (--force, --amend, --no-verify, --hard) that must never be auto-approved.
+ * v2.1.229 alignment: these rewrite history / force-push, so they fall back
+ * to explicit user confirmation even in auto mode.
+ */
+function hasDangerousGitFlags(input: Record<string, unknown>): boolean {
+  const cmd = (input.command as string) || ''
+  if (!/^(git|gh)\s+/.test(cmd.trim())) return false
+  return /--force(?!-with-lease)\b|--amend\b|--no-verify\b|--hard\b/.test(cmd)
+}
+
 /**
  * Check if a Bash command is a "verification-only" command that should be
  * auto-approved in acceptEdits mode. These are non-destructive read/check
@@ -414,6 +426,10 @@ export class PermissionSystem {
         if (this.isSubAgent && ['Bash', 'Write', 'Edit'].includes(tool.name)) {
           return 'ask'
         }
+        // v2.1.229 alignment: destructive git/gh flags are never auto-approved.
+        if (tool.name === 'Bash' && input && hasDangerousGitFlags(input)) {
+          return 'ask'
+        }
         return 'bypass'
 
       case 'dontAsk':

package/src/mcp/client.ts

@@ -6,7 +6,8 @@ import type {
   ToolCallResult,
   InitializeResult,
 } from './types'
-import { StdioTransport } from './transport'
+import { StdioTransport, type Transport } from './transport'
+import { HttpTransport } from './http-transport'
 import { McpProtocol } from './protocol'
 import { OAuthClient } from './oauth'
 import { TokenStore } from './token-store'
@@ -23,7 +24,7 @@ const t = createT(bundles['en-US'] || (enUS as TranslationMap), enUS as Translat
 
 interface ActiveConnection {
   config: McpServerConfig
-  transport: StdioTransport
+  transport: Transport
   protocol: McpProtocol
   status: ConnectionStatus
   tools: ToolDefinition[]
@@ -150,7 +151,9 @@ export class McpClient {
     const existing = this.connections.get(config.name)
     if (existing?.status === 'connected') return
 
-    const transport = new StdioTransport()
+    const transport: StdioTransport | HttpTransport = config.url
+      ? new HttpTransport()
+      : new StdioTransport()
     const protocol = new McpProtocol(transport)
 
     const connection: ActiveConnection = {
@@ -164,11 +167,13 @@ export class McpClient {
     this.connections.set(config.name, connection)
 
     try {
-      const initResult: InitializeResult = await protocol.initialize(
-        config.command,
-        config.args,
-        config.env,
-      )
+      // Start the transport (transport-specific), then perform the handshake.
+      if (transport instanceof HttpTransport) {
+        await transport.start(config.url ?? '', config.headers, config.env)
+      } else {
+        await transport.start(config.command ?? '', config.args ?? [], config.env)
+      }
+      const initResult: InitializeResult = await protocol.initialize()
 
       connection.status = 'connected'
       connection.serverInfo = initResult.serverInfo
@@ -229,6 +234,7 @@ export class McpClient {
         name: conn.config.name,
         command: conn.config.command,
         args: conn.config.args,
+        url: conn.config.url,
       },
       status: conn.status,
       tools: conn.tools,
@@ -243,6 +249,7 @@ export class McpClient {
         name: conn.config.name,
         command: conn.config.command,
         args: conn.config.args,
+        url: conn.config.url,
       },
       status: conn.status,
       tools: conn.tools,

package/src/mcp/http-transport.ts

@@ -0,0 +1,185 @@
+import type { JsonRpcRequest, JsonRpcResponse, JsonRpcNotification, JsonRpcError } from './types'
+import type { Transport, NotificationHandler } from './transport'
+
+type FetchFn = (input: string, init?: RequestInit) => Promise<Response>
+
+const REQUEST_TIMEOUT_MS = 60_000
+
+/**
+ * Merge multiple SSE `data:` events into a single JSON-RPC result.
+ *
+ * A Streamable HTTP server may answer a tool call as an SSE stream of several
+ * `data:` events, each carrying the same request id and a slice of the tool
+ * result text (this is how Forge's `/mcp` streams progressive chunks). We
+ * reassemble those slices so callers see one complete result.
+ */
+function parseSseResponse(body: string): unknown {
+  const messages: Array<{ id?: number; result?: unknown; error?: JsonRpcError }> = []
+
+  for (const block of body.split(/\n\n/)) {
+    for (const line of block.split('\n')) {
+      if (!line.startsWith('data:')) continue
+      const payload = line.slice('data:'.length).trim()
+      if (!payload) continue
+      try {
+        messages.push(JSON.parse(payload))
+      } catch {
+        // Skip unparseable event lines
+      }
+    }
+  }
+
+  if (messages.length === 0) {
+    throw new Error('Empty SSE response')
+  }
+
+  // A single event → return its result (or throw its error) directly.
+  if (messages.length === 1) {
+    const message = messages[0]!
+    if (message.error) {
+      throw new Error(`MCP error ${message.error.code}: ${message.error.message}`)
+    }
+    return message.result
+  }
+
+  // Multiple events → chunked tool result; reassemble text content.
+  const texts: string[] = []
+  for (const message of messages) {
+    if (message.error) {
+      throw new Error(`MCP error ${message.error.code}: ${message.error.message}`)
+    }
+    const content = (message.result as { content?: Array<{ type: string; text?: string }> })
+      ?.content
+    if (content) {
+      for (const item of content) {
+        if (item.type === 'text' && item.text) texts.push(item.text)
+      }
+    }
+  }
+
+  return { content: [{ type: 'text', text: texts.join('') }], isError: false }
+}
+
+/**
+ * MCP Streamable HTTP transport — speaks JSON-RPC 2.0 to an HTTP endpoint
+ * (e.g. Forge's `POST /mcp`), returning plain JSON or reassembled SSE streams.
+ *
+ * Startup is via `start(url, headers?, env?)`; the `Transport` interface
+ * methods match `StdioTransport` so `McpProtocol` can use either.
+ */
+export class HttpTransport implements Transport {
+  private url: string | null = null
+  private headers: Record<string, string> = {}
+  private msgId = 0
+  private closed = false
+  private notificationHandlers: NotificationHandler[] = []
+
+  constructor(private fetchImpl: FetchFn = fetch as unknown as FetchFn) {}
+
+  async start(
+    url: string,
+    headers?: Record<string, string>,
+    env?: Record<string, string>,
+  ): Promise<void> {
+    this.url = url
+    this.closed = false
+
+    // Build base headers: explicit headers override, then auto-derive a
+    // Bearer token from FORGE_API_KEY (mirrors Forge's verify_api_key) so the
+    // secret stays in env rather than inline in config.
+    this.headers = {
+      ...(env?.FORGE_API_KEY ? { Authorization: `Bearer ${env.FORGE_API_KEY}` } : {}),
+      ...(headers ?? {}),
+    }
+  }
+
+  async sendRequest(method: string, params?: Record<string, unknown>): Promise<unknown> {
+    if (!this.url || this.closed) {
+      throw new Error('Transport not connected')
+    }
+
+    const id = ++this.msgId
+    const request: JsonRpcRequest = {
+      jsonrpc: '2.0',
+      id,
+      method,
+      ...(params ? { params } : {}),
+    }
+
+    const controller = new AbortController()
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS)
+
+    try {
+      const response = await this.fetchImpl(this.url, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Accept: 'application/json, text/event-stream',
+          ...this.headers,
+        },
+        body: JSON.stringify(request),
+        signal: controller.signal,
+      })
+
+      if (!response.ok) {
+        let detail = `HTTP ${response.status}`
+        try {
+          detail = JSON.stringify(await response.json())
+        } catch {
+          /* keep status-only detail */
+        }
+        throw new Error(`MCP HTTP error ${response.status}: ${detail}`)
+      }
+
+      const contentType = response.headers.get('content-type') || ''
+      if (contentType.includes('text/event-stream')) {
+        return parseSseResponse(await response.text())
+      }
+
+      const json = (await response.json()) as JsonRpcResponse
+      if (json.error) {
+        throw new Error(`MCP error ${json.error.code}: ${json.error.message}`)
+      }
+      return json.result
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+
+  sendNotification(method: string, params?: Record<string, unknown>): void {
+    if (!this.url || this.closed) return
+
+    const notification: JsonRpcNotification = {
+      jsonrpc: '2.0',
+      method,
+      ...(params ? { params } : {}),
+    }
+
+    // Fire-and-forget: do not await the response.
+    void this.fetchImpl(this.url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        ...this.headers,
+      },
+      body: JSON.stringify(notification),
+    }).catch(() => {
+      /* notifications are best-effort */
+    })
+  }
+
+  onNotification(handler: NotificationHandler): void {
+    this.notificationHandlers.push(handler)
+  }
+
+  async close(): Promise<void> {
+    this.closed = true
+    this.url = null
+    this.notificationHandlers = []
+  }
+
+  isConnected(): boolean {
+    return this.url !== null && !this.closed
+  }
+}

package/src/mcp/protocol.ts

@@ -5,7 +5,7 @@ import type {
   ResourceDefinition,
   ResourceReadResult,
 } from './types'
-import { StdioTransport } from './transport'
+import type { Transport } from './transport'
 
 const MCP_VERSION = '2024-11-05'
 
@@ -20,7 +20,7 @@ export class McpProtocol {
   } = {}
   private handlers = new Map<string, Array<(...args: any[]) => void>>()
 
-  constructor(private transport: StdioTransport) {}
+  constructor(private transport: Transport) {}
 
   on(event: string, handler: (...args: any[]) => void): void {
     const list = this.handlers.get(event) || []
@@ -33,14 +33,8 @@ export class McpProtocol {
     for (const h of list) h(...args)
   }
 
-  async initialize(
-    serverCommand: string,
-    serverArgs: string[],
-    env?: Record<string, string>,
-  ): Promise<InitializeResult> {
-    // Start transport
-    await this.transport.start(serverCommand, serverArgs, env)
-
+  async initialize(): Promise<InitializeResult> {
+    // Transport must already be started by the caller (McpClient.connect).
     // Send initialize request
     const result = (await this.transport.sendRequest('initialize', {
       protocolVersion: MCP_VERSION,

package/src/mcp/transport.ts

@@ -1,7 +1,23 @@
 import { spawn, type ChildProcess } from 'node:child_process'
 import type { JsonRpcRequest, JsonRpcResponse, JsonRpcNotification } from './types'
 
-type NotificationHandler = (notification: JsonRpcNotification) => void
+export type NotificationHandler = (notification: JsonRpcNotification) => void
+
+/**
+ * Common transport contract shared by stdio and HTTP transports.
+ *
+ * `McpProtocol` depends on this interface (not a concrete transport), so it
+ * can speak JSON-RPC 2.0 over either a spawned subprocess or an HTTP endpoint.
+ * Transport startup is transport-specific and intentionally NOT part of this
+ * interface — callers invoke the concrete `start(...)` before use.
+ */
+export interface Transport {
+  sendRequest(method: string, params?: Record<string, unknown>): Promise<unknown>
+  sendNotification(method: string, params?: Record<string, unknown>): void
+  onNotification(handler: NotificationHandler): void
+  close(): Promise<void>
+  isConnected(): boolean
+}
 
 const REQUEST_TIMEOUT_MS = 60_000
 
@@ -52,7 +68,7 @@ function buildProcEnv(extra?: Record<string, string>): Record<string, string> {
  *
  * Uses Node.js child_process for portability across Bun and Node runtimes.
  */
-export class StdioTransport {
+export class StdioTransport implements Transport {
   private proc: ChildProcess | null = null
   private msgId = 0
   private pending = new Map<

package/src/mcp/types.ts

@@ -104,7 +104,7 @@ export interface ResourceReadResult {
 export type ConnectionStatus = 'disconnected' | 'connecting' | 'connected' | 'error'
 
 export interface ConnectionInfo {
-  config: { name: string; command: string; args: string[] }
+  config: { name: string; command?: string; args?: string[]; url?: string }
   status: ConnectionStatus
   tools: ToolDefinition[]
   error?: string

package/src/shared/constants.ts

@@ -329,38 +329,47 @@ export const DEFAULT_PROVIDERS: ProviderConfig[] = [
     id: 'mipham',
     name: 'MiphamAI',
     protocol: 'openai-compatible',
-    baseUrl: 'https://api.mipham.ai/v1',
+    baseUrl: 'http://127.0.0.1:8080/v1', // Engine 本地端点（om-V5 生产部署待定）
     apiKey: '${MIPHAM_API_KEY}',
     models: [
       {
-        id: 'om-V5-Flash',
+        id: 'om-v5-flash',
         name: 'OM V5 Flash',
         providerId: 'mipham',
         contextWindow: 1_000_000,
         maxOutput: 128_000,
         vision: false,
-        status: 'upcoming',
+        status: 'active',
       },
       {
-        id: 'om-V5-Pro',
+        id: 'om-v5-pro',
         name: 'OM V5 Pro',
         providerId: 'mipham',
         contextWindow: 1_000_000,
         maxOutput: 128_000,
         vision: false,
-        status: 'upcoming',
+        status: 'active',
       },
       {
-        id: 'om-V5-Visual',
+        id: 'om-v5-visual',
         name: 'OM V5 Visual',
         providerId: 'mipham',
         contextWindow: 200_000,
         maxOutput: 32_000,
         vision: true,
-        status: 'upcoming',
+        status: 'active',
+      },
+      {
+        id: 'om-v5-apex',
+        name: 'OM V5 Apex',
+        providerId: 'mipham',
+        contextWindow: 1_000_000,
+        maxOutput: 128_000,
+        vision: false,
+        status: 'active',
       },
     ],
-    status: 'upcoming',
+    status: 'active',
   },
   {
     id: 'ollama',
@@ -454,10 +463,10 @@ export const TOOL_CATEGORIES = ['file', 'exec', 'agent', 'network', 'system', 'a
 
 /** 预置 Ollama 模型 — 与 ollama list 结果合并去重后展示 */
 export const OLLAMA_PRESET_MODELS = [
-  { id: 'om-V5-Flash', source: 'MiphamAI' },
-  { id: 'om-V5-Pro', source: 'MiphamAI' },
-  { id: 'om-V5-Visual', source: 'MiphamAI' },
-  { id: 'om-V5-Apex', source: 'MiphamAI' },
+  { id: 'om-v5-flash', source: 'MiphamAI' },
+  { id: 'om-v5-pro', source: 'MiphamAI' },
+  { id: 'om-v5-visual', source: 'MiphamAI' },
+  { id: 'om-v5-apex', source: 'MiphamAI' },
   { id: 'deepseek-r1:70b', source: '热门' },
   { id: 'deepseek-v3', source: '热门' },
   { id: 'qwen2.5:72b', source: '热门' },

package/src/shared/types.ts

@@ -187,8 +187,14 @@ export interface CrsiConfig {
 
 export interface McpServerConfig {
   name: string
-  command: string
-  args: string[]
+  /** stdio: executable to spawn (mutually exclusive with `url`). */
+  command?: string
+  /** stdio: args passed to `command`. */
+  args?: string[]
+  /** HTTP: Streamable HTTP endpoint (mutually exclusive with `command`). */
+  url?: string
+  /** HTTP: extra request headers (e.g. Authorization). */
+  headers?: Record<string, string>
   env?: Record<string, string>
   auth?: {
     type: 'oauth'

package/src/ui/commands.ts

@@ -3575,8 +3575,9 @@ const mcpCmd: CommandHandler = async (ctx, args) => {
         forwardToAI: `Connect to MCP server "${name}" using OAuth. Call McpClient.getInstance().connectWithOAuth() with the server config, then register its tools. Report the result.`,
       }
     }
+    const via = config.url ? 'HTTP' : 'stdio'
     return {
-      content: `── MCP Connect: ${name} ──\n\nConnecting via stdio...`,
+      content: `── MCP Connect: ${name} ──\n\nConnecting via ${via}...`,
       forwardToAI: `Connect to MCP server "${name}" using McpClient.getInstance().connect(config), then register its tools. Report the result.`,
     }
   }
@@ -3629,7 +3630,10 @@ const mcpCmd: CommandHandler = async (ctx, args) => {
       const statusLabel = live ? live.status : 'not started'
       const oauthTag = s.auth?.type === 'oauth' ? ' [OAuth]' : ''
       lines.push(`  ${statusIcon} ${s.name}${oauthTag}  [${statusLabel}]`)
-      lines.push(`     Command: ${s.command} ${s.args.join(' ')}`)
+      const transportInfo = s.url
+        ? `URL: ${s.url}`
+        : `Command: ${s.command ?? ''} ${(s.args ?? []).join(' ')}`
+      lines.push(`     ${transportInfo}`)
       if (live?.tools && live.tools.length > 0) {
         lines.push(`     Tools: ${live.tools.length} registered`)
       }

package/src/workflow/primitives/parallel.ts

@@ -1,11 +1,29 @@
+import os from 'node:os'
+
 /**
  * parallel() — barrier: executes all thunks concurrently, waits for all.
  * Failed thunks resolve to null. Never throws.
  *
- * P0-2 (v2.1.223 alignment): Added concurrency cap (MAX_CONCURRENT = 16)
- * to prevent resource exhaustion from unbounded fan-out.
+ * P0-2 (v2.1.223 alignment): Added concurrency cap (MAX_CONCURRENT) to prevent
+ * resource exhaustion from unbounded fan-out.
+ *
+ * v2.1.229 alignment: detect parallelism via os.availableParallelism() so
+ * CPU-limited containers (cgroup quota) don't fan out to the host core count.
+ * Still capped at 16 to bound resource usage, with a floor of 1.
  */
-const MAX_CONCURRENT = 16
+function detectParallelism(): number {
+  try {
+    if (typeof os.availableParallelism === 'function') {
+      const p = os.availableParallelism()
+      if (typeof p === 'number' && p > 0) return p
+    }
+  } catch {
+    /* fall through to cpus() */
+  }
+  return os.cpus().length || 1
+}
+
+const MAX_CONCURRENT = Math.max(1, Math.min(16, detectParallelism()))
 
 /**
  * Simple async semaphore for concurrency limiting.