@miphamai/cli 0.60.0 → 0.61.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.60.0",
+  "version": "0.61.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/config/defaults.ts

@@ -13,7 +13,9 @@ export const DEFAULT_CONFIG: MiphamConfig = {
   defaultProvider: 'deepseek',
   defaultModel: 'deepseek-v4-pro',
   permission: 'default',
-  showThinking: 'minimal',
+  showThinking: 'off',
+  showSchedulingNotices: false,
+  showCommandPicker: false,
   // Org 级权限限制（可选）：forbiddenModes 禁指定模式 / maxAllowedMode 封顶层级；
   // 请求被禁模式时 fail-closed 降级（如 forbiddenModes:['bypassPermissions']）。
   // permissionRestrictions: { forbiddenModes: ['bypassPermissions'] },

package/src/core/crsi-modify.ts

@@ -13,7 +13,7 @@
  */
 
 import { randomUUID } from 'node:crypto'
-import { CrsiSandbox } from './crsi-sandbox'
+import { CrsiSandbox, validateBlastRadius } from './crsi-sandbox'
 import type { CrsiModificationResult } from './crsi-sandbox'
 import { runEval, appendEvalScore, getLastEvalScore } from './eval-harness'
 
@@ -28,6 +28,13 @@ export interface CrsiProposal {
   originalContent?: string
   /** 触发此改动的 CRSI insight id */
   crsiInsightId?: string
+  /**
+   * 完整覆盖（blast radius）：此改动触及的**所有**代码路径（文件列表）。
+   *
+   * 源于 2026-08-26 教训：修「思考转储」只接实时指示器、漏历史行冲刷路径——
+   * 局部正确、全局遗漏。自修改前必须摸清并声明全部受影响路径，否则 fail-closed 拒绝。
+   */
+  blastRadius?: string[]
 }
 
 // ── Pending proposal registry (两阶段闸门) ──
@@ -42,6 +49,25 @@ export function runCrsiModification(
   proposal: CrsiProposal,
   sandbox: CrsiSandbox = new CrsiSandbox(),
 ): CrsiModificationResult {
+  // 完整覆盖闸：自修改必须声明 blastRadius，否则 fail-closed（在 worktree 之前，零副作用）。
+  const blastRadiusError = validateBlastRadius(proposal)
+  if (blastRadiusError) {
+    return {
+      modification: {
+        id: 'crsi-mod-rejected-blast-radius',
+        description: proposal.description,
+        filePath: proposal.filePath,
+        newContent: proposal.newContent,
+        originalContent: proposal.originalContent ?? '',
+        crsiInsightId: proposal.crsiInsightId,
+        timestamp: new Date().toISOString(),
+      },
+      applied: false,
+      phase: 'failed',
+      error: blastRadiusError,
+    }
+  }
+
   sandbox.createWorktree()
 
   const applied = sandbox.applyModification({

package/src/core/crsi-producer.ts

@@ -127,7 +127,13 @@ export function produceCrsiProposal(
   metaRules: MetaRule[],
   currentLessons: string,
   timestamp: string,
-): { description: string; filePath: string; newContent: string; originalContent: string } | null {
+): {
+  description: string
+  filePath: string
+  newContent: string
+  originalContent: string
+  blastRadius: string[]
+} | null {
   const signal = selectCrsiSignal(insights, metaRules)
   if (!signal) return null
 
@@ -142,6 +148,7 @@ export function produceCrsiProposal(
     filePath: LESSONS_FILE,
     newContent,
     originalContent: currentLessons,
+    blastRadius: [LESSONS_FILE],
   }
 }
 
@@ -215,7 +222,13 @@ export function renderManagedRuleSource(signal: CrsiSignal): string | null {
 export function produceRuleProposal(
   signal: CrsiSignal,
   currentManagedRules: string,
-): { description: string; filePath: string; newContent: string; originalContent: string } | null {
+): {
+  description: string
+  filePath: string
+  newContent: string
+  originalContent: string
+  blastRadius: string[]
+} | null {
   const ruleSource = renderManagedRuleSource(signal)
   if (!ruleSource) return null
 
@@ -232,6 +245,7 @@ export function produceRuleProposal(
     filePath: MANAGED_RULES_FILE,
     newContent,
     originalContent: currentManagedRules,
+    blastRadius: [MANAGED_RULES_FILE],
   }
 }
 

package/src/core/crsi-sandbox.ts

@@ -122,6 +122,24 @@ export function isProtectedPath(filePath: string): boolean {
   return PROTECTED_PATHS.some((p) => filePath === p || filePath.startsWith(p))
 }
 
+/**
+ * 完整覆盖闸（blast radius）：自修改 proposal 必须声明非空 blastRadius，否则拒绝。
+ *
+ * 源于 2026-08-26 教训：修「思考转储」只接实时指示器、漏历史行冲刷路径——
+ * 局部正确、全局遗漏。自修改前必须摸清并声明全部受影响路径，fail-closed。
+ *
+ * 返回错误字符串（拒绝理由），合法时返回 null。
+ */
+export function validateBlastRadius(proposal: { blastRadius?: string[] }): string | null {
+  if (!proposal.blastRadius || proposal.blastRadius.length === 0) {
+    return (
+      'blast radius 未声明：自修改必须枚举触及的全部代码路径。' +
+      '教训：两条渲染路径只接一条 = 局部正确全局遗漏。'
+    )
+  }
+  return null
+}
+
 // ── Sandbox ──
 
 export class CrsiSandbox {

package/src/core/eval-harness.ts

@@ -19,7 +19,7 @@ import { ConstitutionLoader, DEFAULT_CONSTITUTION } from './constitution-loader'
 import { ErrorSignatureDB } from './error-signature-db'
 import { PreFlightChecker } from './preflight-checker'
 import { RedTeam } from './red-team'
-import { isProtectedPath } from './crsi-sandbox'
+import { isProtectedPath, validateBlastRadius } from './crsi-sandbox'
 import { produceRuleProposal, MANAGED_RULES_FILE } from './crsi-producer'
 import type { CrsiSignal } from './crsi-producer'
 import { loadBehaviorTasks, judgeBehaviorTask } from './behavior-tasks'
@@ -167,6 +167,16 @@ export function runEval(): EvalReport {
     results.push({ id, description: `受保护路径被拒: ${path}`, passed: isProtectedPath(path) })
   }
 
+  // ── 完整覆盖闸（ground truth：未声明 blast radius 的 proposal 被 fail-closed 拒绝） ──
+  results.push({
+    id: 'blast-radius-gate',
+    description: '自修改 proposal 未声明 blast radius 被拒，声明后放行',
+    passed:
+      validateBlastRadius({ blastRadius: undefined }) !== null &&
+      validateBlastRadius({ blastRadius: [] }) !== null &&
+      validateBlastRadius({ blastRadius: ['apps/cli/src/foo.ts'] }) === null,
+  })
+
   // ── 安全（ground truth：16 攻击零漏过） ──
   const redTeam = new RedTeam().run(constitution, preflight, errorDB)
   results.push({

package/src/core/instructions.ts

@@ -1,5 +1,5 @@
 import { readFileSync, existsSync } from 'node:fs'
-import { join } from 'node:path'
+import { join, resolve, relative, sep, isAbsolute } from 'node:path'
 import { execSync } from 'node:child_process'
 import { parse as parseYaml } from 'yaml'
 import type { InstructionFile } from '../shared/index.ts'
@@ -59,32 +59,78 @@ export function parsePromptExclude(value: unknown): string[] {
   return []
 }
 
+/** 定位仓库根（git rev-parse --show-toplevel），非 git 目录回退 cwd。 */
+export function gitRoot(cwd: string): string {
+  try {
+    return execSync('git rev-parse --show-toplevel', {
+      cwd,
+      timeout: 5000,
+      encoding: 'utf-8',
+    }).trim()
+  } catch {
+    return cwd
+  }
+}
+
+/** 从仓库根到 cwd 的目录链（含两端），就近（cwd）在最后。cwd 不在 root 下时退化为 [cwd]。 */
+export function discoverDirectories(root: string, cwd: string): string[] {
+  const absRoot = resolve(root)
+  const absCwd = resolve(cwd)
+  if (absCwd === absRoot) return [absRoot]
+
+  const rel = relative(absRoot, absCwd)
+  if (rel.startsWith('..') || isAbsolute(rel)) return [absCwd]
+
+  const dirs = [absRoot]
+  let cur = absRoot
+  for (const seg of rel.split(sep)) {
+    cur = join(cur, seg)
+    dirs.push(cur)
+  }
+  return dirs
+}
+
+/**
+ * 每目录内指令文件的读取顺序（后加载 = 更高优先级）。
+ * AGENTS.md（行业标准基线）→ AGENTS.override.md（Codex 覆盖层）→
+ * MIPHAM.md（Mipham 品牌）→ CLAUDE.md（Claude Code 兼容）。
+ * MIPHAM→CLAUDE 相对顺序保持现状不变，仅前置 AGENTS 两条，避免行为回归。
+ */
+export const INSTRUCTION_FILENAMES = [
+  'AGENTS.md',
+  'AGENTS.override.md',
+  'MIPHAM.md',
+  'CLAUDE.md',
+] as const
+
 export class InstructionsLoader {
   private instructions: InstructionFile[] = []
   private crsiLessonSummaries: CrsiLessonSummary[] = []
 
   loadAll(cwd: string): void {
     this.instructions = []
+    const root = gitRoot(cwd)
+
+    // Tier 1: 集团/公司策略（锚定仓库根，从任意子目录启动都正确；不读 AGENTS.md）
+    this.tryLoad(join(root, '..', '..', 'CLAUDE.md'), 'group') // Rismed_Ronxin_Capital
+    this.tryLoad(join(root, '..', 'CLAUDE.md'), 'company') // One_Mipham_Corporation
+    this.tryLoad(join(root, '..', 'MIPHAM.md'), 'group')
+
+    // Tier 2: 递归项目层 — git 根 → cwd，逐目录读，就近（cwd）最后 = 优先级最高
+    const dirs = discoverDirectories(root, cwd)
+    dirs.forEach((dir, i) => {
+      const level: InstructionFile['level'] = i === dirs.length - 1 ? 'project' : 'directory'
+      for (const name of INSTRUCTION_FILENAMES) {
+        this.tryLoad(join(dir, name), level)
+      }
+    })
 
-    // Tier 1: Ancestor-level CLAUDE.md (for Claude Code compatibility)
-    // ../../ = Rismed_Ronxin_Capital
-    this.tryLoad(join(cwd, '..', '..', 'CLAUDE.md'), 'group')
-    // ../ = One_Mipham_Corporation
-    this.tryLoad(join(cwd, '..', 'CLAUDE.md'), 'company')
-
-    // Tier 1b: Group-level MIPHAM.md — One_Mipham_Corporation is the root
-    this.tryLoad(join(cwd, '..', 'MIPHAM.md'), 'group')
-
-    // Tier 2: Project-level (CLAUDE.md + MIPHAM.md at cwd)
-    this.tryLoad(join(cwd, 'MIPHAM.md'), 'project')
-    this.tryLoad(join(cwd, 'CLAUDE.md'), 'project')
-
-    // Tier 3: User-level ~/.mipham/USER.md
+    // Tier 3: 用户层 ~/.mipham/USER.md
     const home = process.env.HOME || '~'
     this.tryLoad(join(home, '.mipham', 'USER.md'), 'user')
 
     // CRSI 教训召回：读 crsi-lessons.md 提取精华，注入系统提示（只写不读 → 写后召回）
-    this.crsiLessonSummaries = this.loadCrsiLessons(cwd)
+    this.crsiLessonSummaries = this.loadCrsiLessons(root)
   }
 
   buildSystemPrompt(permissionMode?: string): string {
@@ -235,17 +281,7 @@ Never omit it or present the work as purely human-authored.`)
   }
 
   /** 读 crsi-lessons.md（按仓库根定位）提取教训精华。读不到则返回空。 */
-  private loadCrsiLessons(cwd: string): CrsiLessonSummary[] {
-    let root = cwd
-    try {
-      root = execSync('git rev-parse --show-toplevel', {
-        cwd,
-        timeout: 5000,
-        encoding: 'utf-8',
-      }).trim()
-    } catch {
-      // 非 git 目录 → 回退 cwd
-    }
+  private loadCrsiLessons(root: string): CrsiLessonSummary[] {
     try {
       const content = readFileSync(join(root, LESSONS_FILE), 'utf-8')
       return extractCrsiLessonSummaries(content)

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.60.0' as const
+export const PACKAGE_VERSION = '0.61.0' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/types.ts

@@ -137,11 +137,15 @@ export interface MiphamConfig {
   permissionRules?: { allow?: string[]; deny?: string[] }
   /**
    * How to render the model's reasoning/thinking before the answer:
-   * - `off`     → hide entirely
-   * - `minimal` → content-free "thinking…" indicator (default)
+   * - `off`     → hide entirely (default — clean output)
+   * - `minimal` → content-free "thinking…" indicator
    * - `full`    → last 200 chars of the actual thinking text
    */
   showThinking?: 'off' | 'minimal' | 'full'
+  /** When false, hide the `⏰ Wakeup scheduled` scheduling confirmation notices. Default false. */
+  showSchedulingNotices?: boolean
+  /** When false, disable the slash-command picker auto-popup on `/`. Default false. */
+  showCommandPicker?: boolean
   providers: ProviderConfig[]
   skills?: { paths: string[]; mcpServers: McpServerConfig[] }
   marketplace?: {

package/src/ui/app.tsx

@@ -446,10 +446,17 @@ export function App({
                   clearTimeout(thinkingTimerRef.current)
                   thinkingTimerRef.current = null
                 }
-                setMessages((prev) => [
-                  ...prev,
-                  { role: 'system' as const, content: `💭 ${thought}` },
-                ])
+                const thinkingLine = formatThinking(
+                  config.showThinking ?? 'off',
+                  thought,
+                  t('ui.loading.thinking'),
+                )
+                if (thinkingLine) {
+                  setMessages((prev) => [
+                    ...prev,
+                    { role: 'system' as const, content: thinkingLine },
+                  ])
+                }
               }
               turnContent = chunk.content
               isNewTurn = false
@@ -668,7 +675,7 @@ export function App({
       // Turn finished — drain any /loop wakeup queued while we were running.
       drainLoopQueueRef.current?.(turnId)
     },
-    [engine, syncBgAgents],
+    [engine, syncBgAgents, config, t],
   )
 
   // Ref-held drain breaks the runTurn ↔ drain circular useCallback dependency: runTurn
@@ -811,11 +818,11 @@ export function App({
             setApiKeyPrompt(result.needsApiKey)
             setApiKeyInput('')
           }
-          setMessages((prev) => [
-            ...prev,
-            { role: 'user', content: input },
-            { role: 'system', content: result.content },
-          ])
+          setMessages((prev) => {
+            const next: ChatMessage[] = [...prev, { role: 'user', content: input }]
+            if (result.content) next.push({ role: 'system', content: result.content })
+            return next
+          })
           if (result.needsApiKey) {
             // Don't process nextProvider/model when waiting for API key
             if (result.exit) process.exit(0)
@@ -1019,7 +1026,7 @@ export function App({
             <ChatPanel messages={messages} focusMode={focusMode} />
             {(() => {
               const indicator = formatThinking(
-                config.showThinking ?? 'minimal',
+                config.showThinking ?? 'off',
                 thinkingText,
                 t('ui.loading.thinking'),
               )
@@ -1063,6 +1070,7 @@ export function App({
                 <InputBar
                   onSubmit={handleSubmit}
                   isLoading={isLoading}
+                  showCommandPicker={config.showCommandPicker ?? false}
                   onTogglePicker={() => setPickerOpen((prev) => !prev)}
                   onToggleFocus={() => setFocusMode((prev) => !prev)}
                   onToggleExpand={() => {

package/src/ui/command-picker.tsx

@@ -3,6 +3,7 @@ import { Box, Text, useInput } from 'ink'
 import TextInput from 'ink-text-input'
 import { useI18n } from '../i18n-context'
 import { getCommandList } from './commands.js'
+import { commandToken, hasInlineArgs } from './command-token.js'
 
 interface CommandPickerProps {
   /** Text already typed (e.g. "/", "/age") — used as initial filter */
@@ -60,9 +61,10 @@ export function CommandPicker({
   const [filter, setFilter] = useState(initialFilter)
   const [cursorIdx, setCursorIdx] = useState(0)
 
-  // Filter commands based on user input
+  // Filter commands based on user input (match on the command-name token, not the
+  // full line — so "/loop 60s echo hello" still matches "/loop").
   const filtered = useMemo(() => {
-    const q = filter.startsWith('/') ? filter.slice(1).toLowerCase() : filter.toLowerCase()
+    const q = commandToken(filter)
     if (!q) return allCommands
     return allCommands.filter(
       (cmd) => cmd.name.toLowerCase().includes(q) || cmd.description.toLowerCase().includes(q),
@@ -86,6 +88,19 @@ export function CommandPicker({
   const safeCursor = (i: number) =>
     filtered.length === 0 ? 0 : ((i % filtered.length) + filtered.length) % filtered.length
 
+  // Submit the selection: if the filter has inline args (e.g. "/loop 60s echo hello"),
+  // submit the full line so the args reach the command handler; otherwise submit the
+  // highlighted command name.
+  const submitSelection = () => {
+    const trimmed = filter.trim()
+    if (hasInlineArgs(trimmed)) {
+      onSelect(trimmed)
+      return
+    }
+    const selected = filtered[cursorIdx]
+    if (selected) onSelect(selected.name)
+  }
+
   useInput((_input, key) => {
     if (key.escape) {
       onClose()
@@ -93,10 +108,7 @@ export function CommandPicker({
     }
 
     if (key.return) {
-      const selected = filtered[cursorIdx]
-      if (selected) {
-        onSelect(selected.name)
-      }
+      submitSelection()
       return
     }
 
@@ -132,7 +144,7 @@ export function CommandPicker({
         {visible.map((cmd, i) => {
           const globalIdx = i + scrollStart
           const isCursor = globalIdx === cursorIdx
-          const query = filter.startsWith('/') ? filter.slice(1) : filter
+          const query = commandToken(filter)
           const segments = highlightMatches(cmd.name, query)
           const padLen = Math.max(0, 20 - cmd.name.length)
           return (
@@ -171,12 +183,7 @@ export function CommandPicker({
         <TextInput
           value={filter.startsWith('/') ? filter.slice(1) : filter}
           onChange={(val) => setFilter(`/${val}`)}
-          onSubmit={() => {
-            const selected = filtered[cursorIdx]
-            if (selected) {
-              onSelect(selected.name)
-            }
-          }}
+          onSubmit={() => submitSelection()}
           placeholder={t('ui.command_picker.placeholder')}
         />
       </Box>

package/src/ui/command-token.ts

@@ -0,0 +1,10 @@
+/** Extract the command-name token from a slash filter: "/loop 60s echo hello" → "loop". */
+export function commandToken(filter: string): string {
+  const withoutSlash = filter.startsWith('/') ? filter.slice(1) : filter
+  return withoutSlash.trim().split(/\s+/)[0]?.toLowerCase() ?? ''
+}
+
+/** True when the filter carries inline args beyond the command name: "/loop auto" → true, "/loop" → false. */
+export function hasInlineArgs(filter: string): boolean {
+  return filter.trim().includes(' ')
+}

package/src/ui/commands.ts

@@ -546,7 +546,9 @@ const configCmd: CommandHandler = (ctx) => {
     `defaultProvider:  ${c.defaultProvider}`,
     `defaultModel:     ${c.defaultModel}`,
     `permission:       ${c.permission}`,
-    `showThinking:     ${c.showThinking ?? 'minimal'}`,
+    `showThinking:     ${c.showThinking ?? 'off'}`,
+    `showSchedulingNotices: ${c.showSchedulingNotices ?? false}`,
+    `showCommandPicker: ${c.showCommandPicker ?? false}`,
     `providers:        ${c.providers.length} configured`,
     '',
     `crossSessionInbound: ${xs.crossSessionInbound}`,
@@ -2821,9 +2823,14 @@ const loopCmd: CommandHandler = async (ctx, args) => {
       { delaySeconds: seconds, reason: `Loop: ${prompt.slice(0, 40)}`, prompt },
       { cwd: process.cwd(), sessionId: 'loop-session', provider: '', model: '' },
     )
-    return result.success
-      ? { content: result.content }
-      : { content: `Loop failed: ${result.error || 'unknown error'}` }
+    if (!result.success) {
+      return { content: `Loop failed: ${result.error || 'unknown error'}` }
+    }
+    // When scheduling notices are hidden, stay silent — the loop is already scheduled.
+    if (ctx.config.showSchedulingNotices === false) {
+      return { content: '' }
+    }
+    return { content: result.content }
   } catch (e) {
     return { content: `Loop failed: ${e instanceof Error ? e.message : String(e)}` }
   }

package/src/ui/input.tsx

@@ -21,6 +21,8 @@ interface InputBarProps {
   onCyclePermission?: () => void
   /** Escape → cancel loading / clear draft */
   onCancel?: () => void
+  /** When false, don't auto-open the slash-command picker when typing `/`. */
+  showCommandPicker?: boolean
 }
 
 // ── Loading verb keys (i18n) ──
@@ -75,6 +77,11 @@ export function isBulkInput(prev: string, next: string): boolean {
   return Math.abs(next.length - prev.length) > 1
 }
 
+/** True when typing a leading `/` should auto-open the slash-command picker. */
+export function shouldAutoOpenPicker(value: string, prevValue: string, enabled: boolean): boolean {
+  return enabled && value.startsWith('/') && !prevValue.startsWith('/')
+}
+
 export function InputBar({
   onSubmit,
   isLoading,
@@ -84,6 +91,7 @@ export function InputBar({
   onToggleAgentView,
   onCyclePermission,
   onCancel,
+  showCommandPicker = true,
 }: InputBarProps) {
   const { t } = useI18n()
   const [value, setValue] = useState('')
@@ -251,9 +259,9 @@ export function InputBar({
   const [pickerActive, setPickerActive] = useState(false)
   const prevValueRef = useRef(value)
 
-  // Auto-activate picker when user types "/"
+  // Auto-activate picker when user types "/" (unless disabled via showCommandPicker)
   useEffect(() => {
-    if (value.startsWith('/') && !prevValueRef.current.startsWith('/')) {
+    if (shouldAutoOpenPicker(value, prevValueRef.current, showCommandPicker)) {
       setPickerActive(true)
     }
     // Dismiss picker when user clears the / prefix
@@ -261,7 +269,7 @@ export function InputBar({
       setPickerActive(false)
     }
     prevValueRef.current = value
-  }, [value])
+  }, [value, showCommandPicker])
 
   // Keep valueRef in sync with state (so useInput handlers read latest value)
   useEffect(() => {