@miphamai/cli 0.61.0 → 0.63.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent/effectiveness-tracker.ts

@@ -1,11 +1,14 @@
 import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
 import { join, dirname } from 'node:path'
 import type { CrsiProvenanceBridge, CrsiVerdict } from './crsi-provenance-bridge.js'
+import { isRecoverableToolFailure } from './recoverable-failure.js'
 
 export interface RuleEffectiveness {
   ruleId: string
   appliedCount: number
   successAfterCount: number
+  /** 可恢复/环境性失败数——记录但排除在成功率分母外。 */
+  recoverableCount?: number
   preRuleFailureRate: number
   postRuleFailureRate: number
   status: 'active' | 'degrading' | 'disabled'
@@ -44,7 +47,7 @@ export class EffectivenessTracker {
     if (eff) eff.decisionId = decisionId
   }
 
-  recordApplication(ruleId: string, success: boolean): void {
+  recordApplication(ruleId: string, success: boolean, opts?: { error?: string }): void {
     let eff = this.data.get(ruleId)
     if (!eff) {
       eff = {
@@ -61,6 +64,12 @@ export class EffectivenessTracker {
       this.data.set(ruleId, eff)
     }
 
+    // 可恢复/环境性失败：仍记录，但不进成功率分母（防误降级/误禁用能用的规则）。
+    if (!success && opts?.error && isRecoverableToolFailure(opts.error)) {
+      eff.recoverableCount = (eff.recoverableCount ?? 0) + 1
+      return
+    }
+
     eff.appliedCount++
     if (success) eff.successAfterCount++
 

package/src/agent/message-bus.ts

@@ -24,6 +24,16 @@ export interface AgentMessage {
   type: AgentMessageType
 }
 
+/**
+ * Format an inbound message for injection into the conversation as a
+ * user-role notice. Collapsed to one line (`Message from @<sender>: <summary>`)
+ * so cross-session peer messages don't bloat the context; the full body stays
+ * in the bus for Ctrl+O expansion.
+ */
+export function formatInboundMessage(msg: AgentMessage): string {
+  return `Message from @${msg.from}: ${msg.summary}`
+}
+
 export class AgentMessageBus {
   private messages: AgentMessage[] = []
   private idCounter = 0

package/src/agent/recoverable-failure.ts

@@ -0,0 +1,27 @@
+/**
+ * 判「可恢复/环境性」失败 vs 真缺陷（borrow openprabs is_recoverable_tool_failure 思想）。
+ *
+ * 可恢复失败（网络超时、连接拒绝、DNS 解析失败、环境权限）不该进成功率分母，否则会把
+ * 成功率拉低、诱导 EffectivenessTracker 禁用能用的规则（openprabs #236 的坑：stale-hash
+ * 重试被误判成工具缺陷，把能用的 hashline_edit 禁了）。
+ *
+ * 刻意排除 ENOENT（no such file or directory）：缺文件/路径错更可能是规则本身指错了
+ * 路径（幻觉），而非环境瞬态，须计入分母（2026-08-27 review M1）。
+ *
+ * 不区分工具：这些错误模式（超时/连接/DNS/权限）本身即工具无关的环境信号。旧的
+ * `toolName !== 'Bash'` 守卫漏掉 Write/Grep 规则（2026-08-27 review M2），已移除。
+ *
+ * fail-closed：无 error 一律按真失败算（证不了可恢复就不排除）。
+ */
+const RECOVERABLE_PATTERNS: RegExp[] = [
+  /\btimed?\s?out\b/i, // timeout / timed out / timedout（网络慢 / 服务慢）
+  /(ECONNREFUSED|ECONNRESET|ETIMEDOUT|connection refused|not connected|network unreachable)/i, // 服务未起 / 网络超时
+  /(could not resolve host|name or service not known|getaddrinfo|ENOTFOUND)/i, // DNS 解析失败
+  /(permission denied|EACCES)/i, // 环境权限
+]
+
+export function isRecoverableToolFailure(error?: string): boolean {
+  if (!error) return false
+  const e = error.toLowerCase()
+  return RECOVERABLE_PATTERNS.some((re) => re.test(e))
+}

package/src/agent/sub-agent.ts

@@ -319,6 +319,7 @@ export class SubAgent {
 
     const chunks: string[] = []
     const MAX_TOOL_TURNS = options.maxTurns || 5
+    let hitMaxTurns = false
 
     let currentMessages = messages
     let currentSystemPrompt = systemPrompt
@@ -360,7 +361,7 @@ export class SubAgent {
             })
           }
           if (chunk.type === 'error') {
-            throw new Error(`Sub-agent execution failed: ${chunk.error}`)
+            throw new Error(`Sub-agent execution failed (model ${finalModel}): ${chunk.error}`)
           }
           if (chunk.type === 'stop') {
             break
@@ -501,6 +502,9 @@ export class SubAgent {
 
         // Don't send system prompt on subsequent turns
         currentSystemPrompt = ''
+
+        // On the final permitted turn we still used tools → hit the cap.
+        if (turn === MAX_TOOL_TURNS - 1) hitMaxTurns = true
       }
     } catch (err) {
       if (err instanceof DOMException && err.name === 'AbortError') {
@@ -509,10 +513,18 @@ export class SubAgent {
       if (err instanceof Error && err.message.startsWith('Sub-agent')) {
         throw err
       }
-      throw new Error(`Sub-agent execution failed: ${String(err)}`)
+      throw new Error(`Sub-agent execution failed (model ${finalModel}): ${String(err)}`)
     }
 
-    return chunks.join('')
+    const result = chunks.join('')
+    if (hitMaxTurns) {
+      return (
+        `[partial result — sub-agent reached its ${MAX_TOOL_TURNS}-turn limit; ` +
+        'task may be incomplete. Use SendMessage to continue this sub-agent.]\n\n' +
+        result
+      )
+    }
+    return result
   }
 
   /**

package/src/core/cron-poller.ts

@@ -0,0 +1,52 @@
+// Cron poller — makes the CLI's durable CronCreate jobs actually fire.
+//
+// Every minute it reads ~/.mipham/cron/*.json and, for each job whose
+// nextFire has passed, enqueues the prompt into the engine's cron queue
+// (which re-invokes it into the current session) and then advances the job
+// (recurring → next fire; one-shot → deleted).
+
+import { computeNextFire } from './cron'
+import type { CronJob } from '../tools/scheduling/cron'
+import { readAllJobs, writeJob, deleteJobFile } from '../tools/scheduling/cron'
+
+/** Jobs whose nextFire is at or before `now`. Pure — separated for tests. */
+export function findDueJobs(jobs: CronJob[], now: Date): CronJob[] {
+  return jobs.filter((j) => new Date(j.nextFire).getTime() <= now.getTime())
+}
+
+/** Next state after firing a due job: recurring advances; one-shot → null (delete). */
+export function advanceJob(job: CronJob, now: Date): CronJob | null {
+  if (!job.recurring) return null
+  return {
+    ...job,
+    lastFired: now.toISOString(),
+    nextFire: computeNextFire(job.cron, now),
+  }
+}
+
+/** Read due jobs, enqueue their prompts, and advance/delete. Returns fired count. */
+export function checkCronJobs(enqueue: (prompt: string) => void, now = new Date()): number {
+  const due = findDueJobs(readAllJobs(), now)
+  for (const job of due) {
+    enqueue(job.prompt)
+    const next = advanceJob(job, now)
+    if (next) writeJob(next)
+    else deleteJobFile(job.id)
+  }
+  return due.length
+}
+
+/**
+ * Start the cron poller. Returns a stop function. The interval is unref'd so
+ * it never keeps the process alive on its own.
+ */
+export function startCronPoller(
+  enqueue: (prompt: string) => void,
+  intervalMs = 60_000,
+): () => void {
+  const timer = setInterval(() => {
+    checkCronJobs(enqueue)
+  }, intervalMs)
+  timer.unref()
+  return () => clearInterval(timer)
+}

package/src/core/cron.ts

@@ -0,0 +1,73 @@
+// Simple minute-granularity cron expression parser.
+//
+// Supports the standard 5-field cron format:
+//   minute hour day-of-month month day-of-week
+//
+// Handles: * (wildcard), star/N (step), N (exact), N-M (range), N,M,O (list).
+// Falls back to +1 minute if the expression is invalid or no match is found
+// within 366 days.
+
+export function computeNextFire(cronExpr: string, from: Date): string {
+  const fields = cronExpr.trim().split(/\s+/)
+  if (fields.length !== 5) {
+    return new Date(from.getTime() + 60_000).toISOString()
+  }
+
+  const minField = fields[0]!
+  const hourField = fields[1]!
+  const domField = fields[2]!
+  const monthField = fields[3]!
+  const dowField = fields[4]!
+
+  function matches(value: number, field: string): boolean {
+    if (field === '*') return true
+    // */N step
+    const stepMatch = field.match(/^\*\/(\d+)$/)
+    if (stepMatch) {
+      return value % parseInt(stepMatch[1]!, 10) === 0
+    }
+    // Comma-separated list
+    if (field.includes(',')) {
+      return field.split(',').some((f) => matches(value, f))
+    }
+    // Range
+    const rangeMatch = field.match(/^(\d+)-(\d+)$/)
+    if (rangeMatch) {
+      const low = parseInt(rangeMatch[1]!, 10)
+      const high = parseInt(rangeMatch[2]!, 10)
+      return value >= low && value <= high
+    }
+    // Exact value
+    return value === parseInt(field, 10)
+  }
+
+  const date = new Date(from)
+  date.setSeconds(0, 0)
+  // Start from the next minute to avoid matching the current minute
+  date.setMinutes(date.getMinutes() + 1)
+
+  // Try up to 366 days forward (safety limit — ~527k iterations)
+  const maxIterations = 366 * 24 * 60
+  for (let i = 0; i < maxIterations; i++) {
+    const minute = date.getMinutes()
+    const hour = date.getHours()
+    const dom = date.getDate()
+    const month = date.getMonth() + 1 // JS months are 0-indexed
+    const dow = date.getDay() // 0 = Sunday
+
+    if (
+      matches(minute, minField) &&
+      matches(hour, hourField) &&
+      matches(dom, domField) &&
+      matches(month, monthField) &&
+      matches(dow, dowField)
+    ) {
+      return date.toISOString()
+    }
+
+    date.setMinutes(date.getMinutes() + 1)
+  }
+
+  // Fallback: 1 minute from now
+  return new Date(from.getTime() + 60_000).toISOString()
+}

package/src/core/crsi-sandbox.ts

@@ -16,7 +16,7 @@
 
 import { execSync } from 'node:child_process'
 import { mkdirSync, rmSync, existsSync, writeFileSync, readFileSync, readdirSync } from 'node:fs'
-import { join, resolve, sep } from 'node:path'
+import { join, resolve, sep, posix } from 'node:path'
 import { tmpdir, homedir } from 'node:os'
 import { randomUUID } from 'node:crypto'
 
@@ -115,6 +115,12 @@ const PROTECTED_PATHS = [
   'apps/cli/src/core/crsi-sandbox.ts',
   'apps/cli/src/core/crsi-producer.ts',
   'apps/cli/src/core/proposal-guard.ts',
+  // 2026-08-27 review 补齐：运行时执行/评估器，改掉会削弱 grader 或安全边界
+  'apps/cli/src/core/crsi-modify.ts',
+  'apps/cli/src/core/rule-engine.ts',
+  'apps/cli/src/core/red-team.ts',
+  'apps/cli/src/core/error-signature-db.ts',
+  'apps/cli/src/core/preflight-checker.ts',
 ]
 
 /** 是否命中只读边界。前缀匹配，目录条目以 `/` 结尾。 */
@@ -130,13 +136,24 @@ export function isProtectedPath(filePath: string): boolean {
  *
  * 返回错误字符串（拒绝理由），合法时返回 null。
  */
-export function validateBlastRadius(proposal: { blastRadius?: string[] }): string | null {
+export function validateBlastRadius(proposal: {
+  filePath?: string
+  blastRadius?: string[]
+}): string | null {
+  const filePath = proposal.filePath
   if (!proposal.blastRadius || proposal.blastRadius.length === 0) {
     return (
       'blast radius 未声明：自修改必须枚举触及的全部代码路径。' +
       '教训：两条渲染路径只接一条 = 局部正确全局遗漏。'
     )
   }
+  // 2026-08-27 review：blastRadius 不能只自证「非空」，必须覆盖被修改文件本身
+  // （前缀匹配，目录条目以 / 结尾），否则声明形同虚设。
+  if (filePath && !proposal.blastRadius.some((p) => filePath === p || filePath.startsWith(p))) {
+    return (
+      `blast radius 未覆盖目标文件 "${filePath}"：` + '声明必须包含被修改文件本身（前缀匹配）。'
+    )
+  }
   return null
 }
 
@@ -225,7 +242,10 @@ export class CrsiSandbox {
     }
 
     const worktreeRoot = resolve(this.worktreePath)
-    const targetPath = resolve(this.worktreePath, mod.filePath)
+    // Normalize "./" and "subdir/../" so the protected-path guard can't be evaded
+    // by a path that resolves back inside the worktree (raw prefix match would miss it).
+    const normalizedFilePath = posix.normalize(mod.filePath)
+    const targetPath = resolve(this.worktreePath, normalizedFilePath)
 
     // Path traversal guard: reject any target that resolves outside the sandbox worktree
     if (targetPath !== worktreeRoot && !targetPath.startsWith(worktreeRoot + sep)) {
@@ -237,7 +257,7 @@ export class CrsiSandbox {
 
     // Protected-path guard: the self-improvement loop must not modify the
     // constitution, eval harness, or improvement machinery itself.
-    if (isProtectedPath(mod.filePath)) {
+    if (isProtectedPath(normalizedFilePath)) {
       result.error = `Protected path: "${mod.filePath}" is read-only to the self-improvement loop.`
       result.phase = 'failed'
       this.sessionReport.modifications.push(result)
@@ -275,7 +295,7 @@ export class CrsiSandbox {
 
       // Generate diff
       try {
-        result.diff = execSync(`git diff -- "${mod.filePath}"`, {
+        result.diff = execSync(`git diff -- "${normalizedFilePath}"`, {
           cwd: this.worktreePath,
           timeout: 10_000,
           encoding: 'utf-8',

package/src/core/engine.ts

@@ -40,7 +40,12 @@ import { buildRequest, sendInferenceCheck, isInferenceHookEnabled } from './infe
 import { getFileInboxTransport } from '../agent/cross-session/file-inbox'
 import { registerWakeupHandler } from '../tools/scheduling/schedule-wakeup'
 import { accumulateGraftSavings } from '../shared/graft-savings'
-import { getMessageBus, type AgentMessage } from '../agent/message-bus'
+import {
+  getMessageBus,
+  formatInboundMessage,
+  type AgentMessage,
+  type AgentMessageBus,
+} from '../agent/message-bus'
 import { createT } from '../i18n-core/t'
 import enUS from '../i18n-core/locales/en-US.json'
 import zhCN from '../i18n-core/locales/zh-CN.json'
@@ -105,6 +110,9 @@ export class QueryEngine {
   /** Pending /loop re-invocation prompts, enqueued by the ScheduleWakeup timer. */
   private wakeupQueue: Array<{ prompt: string; noop: boolean }> = []
 
+  /** Pending durable cron prompts, enqueued by the cron poller (FIFO — every due job fires). */
+  private cronQueue: string[] = []
+
   /** Callback fired whenever a wakeup is enqueued (the ScheduleWakeup timer fired). */
   private onWakeupEnqueued: (() => void) | null = null
 
@@ -148,6 +156,26 @@ export class QueryEngine {
     return this.wakeupQueue.length > 0
   }
 
+  /** Enqueue a durable cron prompt for re-invocation (FIFO — every due job fires). */
+  enqueueCronPrompt(prompt: string): void {
+    // Dedup by prompt: a recurring job whose previous fire is still queued
+    // (slow turn) re-fires the same prompt — skip it rather than pile up.
+    if (!this.cronQueue.includes(prompt)) {
+      this.cronQueue.push(prompt)
+    }
+    this.onWakeupEnqueued?.()
+  }
+
+  /** Pop the next pending cron prompt, or null when the queue is empty. */
+  dequeueCronPrompt(): string | null {
+    return this.cronQueue.shift() ?? null
+  }
+
+  /** Whether a cron prompt is pending re-invocation. */
+  hasPendingCron(): boolean {
+    return this.cronQueue.length > 0
+  }
+
   /** Session identifier for cross-session messaging. Set by the app startup via setSessionId(). */
   private sessionId: string = 'session-1'
 
@@ -232,6 +260,28 @@ export class QueryEngine {
     }
   }
 
+  /**
+   * Drain unread inbound messages from the in-memory bus (addressed to this
+   * session or to "main") and inject them into the conversation as user-role
+   * notices. Returns the number of messages injected.
+   *
+   * The bus is the delivery channel for same-process SendMessage ("main",
+   * "bg-*", "sub-agent-*") and the re-post target of pollCrossSessionInbox;
+   * this is the missing "drain" step that surfaces those messages to the model.
+   */
+  drainInboundMessages(bus: AgentMessageBus = getMessageBus()): number {
+    const recipients = [...new Set([this.sessionId, 'main'])]
+    let injected = 0
+    for (const recipient of recipients) {
+      for (const msg of bus.poll(recipient)) {
+        this.context.addMessage({ role: 'user', content: formatInboundMessage(msg) })
+        injected++
+      }
+      bus.markAllRead(recipient)
+    }
+    return injected
+  }
+
   /** Register a hook engine for pre/post tool-use lifecycle events. */
   setHookEngine(hooks: HookEngine): void {
     this.hookEngine = hooks
@@ -451,6 +501,8 @@ export class QueryEngine {
 
     // Poll for cross-session messages before each turn
     await this.pollCrossSessionInbox()
+    // Drain in-memory bus messages (same-process SendMessage + cross-session re-posts)
+    this.drainInboundMessages()
 
     // Fire UserPromptSubmit hooks before processing
     if (this.hookEngine) {
@@ -1180,7 +1232,9 @@ export class QueryEngine {
           const match = warning.match(/^\[rule:([^\]]+)\]/)
           const ruleId = match?.[1]
           if (ruleId) {
-            tracker.recordApplication(ruleId, result.success)
+            tracker.recordApplication(ruleId, result.success, {
+              error: result.error,
+            })
           }
         }
         tracker.persist()

package/src/core/hooks-executor.ts

@@ -49,7 +49,8 @@ function executeCommand(cfg: HookConfig, ctx: HookContext): HookResult {
     }
 
     // Non-zero exit: check for block signal (exit code 2)
-    const stderr = result.stderr?.toString() || ''
+    // 截断 stderr 防 MB 级 hook 输出溢出会话（对齐 HTTP hook 的 slice(0,2000)）。
+    const stderr = (result.stderr?.toString() || '').slice(0, 2000)
 
     if (result.status === 2) {
       return {

package/src/core/instructions.ts

@@ -308,7 +308,7 @@ Never omit it or present the work as purely human-authored.`)
     const description = modeDescriptions[mode]
     if (!description) return ''
 
-    return `## Permission Context\n\n${description}\n\nWhen a tool is denied, do NOT retry with the same tool and similar parameters. Move on to a different approach or ask the user for guidance.`
+    return `## Permission Context\n\n${description}\n\nWhen a tool is denied, do NOT retry it or any other approval-gated tool — Bash, WebSearch, network, and Workflow are all blocked in this mode. If the task genuinely needs a blocked tool, STOP retrying and ask the user to switch to bypassPermissions (Shift+Tab) or add an allow rule (/permissions), then wait for the user's answer.`
   }
 
   list(): InstructionFile[] {

package/src/core/memory/memory-manager.ts

@@ -8,6 +8,7 @@ import {
   statSync,
 } from 'node:fs'
 import { join, extname } from 'node:path'
+import { similarities } from './tfidf'
 
 export interface MemoryMetadata {
   type: 'user' | 'feedback' | 'project' | 'reference'
@@ -113,21 +114,22 @@ export class MemoryManager {
 
   recall(context: string, limit: number = 10): MemoryEntry[] {
     const contextLower = context.toLowerCase()
+    const entries = [...this.memories.values()]
+    // TF-IDF cosine similarity (CJK-bigram aware) replaces the old word-overlap.
+    const sims = similarities(
+      context,
+      entries.map((e) => e.content),
+    )
     const scored: Array<{ entry: MemoryEntry; score: number }> = []
     const seen = new Set<string>()
 
-    for (const entry of this.memories.values()) {
-      let score = 0
-      // Match against relevance tags
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i]!
+      let score = sims[i]! * 10
+      // Match against relevance tags (strong curated signal)
       for (const tag of entry.metadata.relevance) {
         if (contextLower.includes(tag.toLowerCase())) score += 3
       }
-      // Match against content keywords
-      const contentWords = entry.content.toLowerCase().split(/\s+/)
-      const contextWords = new Set(contextLower.split(/\s+/))
-      for (const word of contentWords) {
-        if (contextWords.has(word) && word.length > 3) score += 1
-      }
       if (score > 0) {
         scored.push({ entry, score })
         seen.add(entry.name)

package/src/core/memory/tfidf.ts

@@ -0,0 +1,108 @@
+// Local TF-IDF similarity — zero-dependency "semantic-ish" recall.
+//
+// The built-in memory is local files and must stay offline. This module upgrades
+// the old exact-keyword overlap to TF-IDF-weighted cosine similarity, with a CJK
+// character-bigram tokenizer so Chinese content (which has no word separators)
+// is matched on adjacent-character overlap rather than whole-word equality.
+
+const CJK_RE = /[㐀-䶿一-鿿]/
+const WORD_RE = /[a-z0-9]/
+
+function isCjk(ch: string): boolean {
+  return CJK_RE.test(ch)
+}
+
+function isWordChar(ch: string): boolean {
+  return WORD_RE.test(ch)
+}
+
+/**
+ * Tokenize text into CJK character bigrams + lowercase ASCII words (length ≥ 2).
+ * Punctuation and single-char ASCII tokens are dropped as noise.
+ */
+export function tokenize(text: string): string[] {
+  const tokens: string[] = []
+  const lower = text.toLowerCase()
+  let i = 0
+
+  while (i < lower.length) {
+    const ch = lower[i]!
+    if (isCjk(ch)) {
+      let run = ''
+      while (i < lower.length && isCjk(lower[i]!)) {
+        run += lower[i]!
+        i++
+      }
+      if (run.length === 1) {
+        tokens.push(run)
+      } else {
+        for (let j = 0; j < run.length - 1; j++) {
+          tokens.push(run.slice(j, j + 2))
+        }
+      }
+    } else if (isWordChar(ch)) {
+      let word = ''
+      while (i < lower.length && isWordChar(lower[i]!)) {
+        word += lower[i]!
+        i++
+      }
+      if (word.length >= 2) tokens.push(word)
+    } else {
+      i++
+    }
+  }
+
+  return tokens
+}
+
+/** Cosine similarity between two sparse term-weight vectors. */
+export function cosine(a: Map<string, number>, b: Map<string, number>): number {
+  let dot = 0
+  let normA = 0
+  for (const [term, w] of a) {
+    normA += w * w
+    const wb = b.get(term)
+    if (wb !== undefined) dot += w * wb
+  }
+  let normB = 0
+  for (const w of b.values()) normB += w * w
+  if (normA === 0 || normB === 0) return 0
+  return dot / (Math.sqrt(normA) * Math.sqrt(normB))
+}
+
+/** TF-IDF weight vector for one token list, given corpus document frequency. */
+function tfidfVector(
+  tokens: string[],
+  df: Map<string, number>,
+  numDocs: number,
+): Map<string, number> {
+  const tf = new Map<string, number>()
+  for (const t of tokens) tf.set(t, (tf.get(t) ?? 0) + 1)
+
+  const vec = new Map<string, number>()
+  for (const [term, freq] of tf) {
+    const idf = Math.log((numDocs + 1) / ((df.get(term) ?? 0) + 1)) + 1
+    vec.set(term, freq * idf)
+  }
+  return vec
+}
+
+/**
+ * Cosine similarity of a query against each document, index-aligned.
+ * `docs` are raw texts; tokenization + TF-IDF weighting is applied internally.
+ */
+export function similarities(query: string, docs: string[]): number[] {
+  const docTokens = docs.map(tokenize)
+  const queryTokens = tokenize(query)
+  const numDocs = docs.length
+
+  const df = new Map<string, number>()
+  for (const tokens of docTokens) {
+    for (const term of new Set(tokens)) {
+      df.set(term, (df.get(term) ?? 0) + 1)
+    }
+  }
+
+  const queryVec = tfidfVector(queryTokens, df, numDocs)
+  return docTokens.map((tokens) => cosine(queryVec, tfidfVector(tokens, df, numDocs)))
+}

package/src/core/session-name.ts

@@ -0,0 +1,12 @@
+/**
+ * Generate the session name (ID) used for cross-session tracking, inbox routing,
+ * and session persistence.
+ *
+ * Includes milliseconds so two sessions launched in the same second do not
+ * collide on the shared inbox directory / active-session registry. (2026-08-27
+ * review: the old `slice(0, 19)` dropped ms and let same-second launches share
+ * one inbox, leaking / misdelivering cross-session messages.)
+ */
+export function generateSessionName(resume: string | undefined, now: Date = new Date()): string {
+  return resume || `session-${now.toISOString().replace(/[:.]/g, '-')}`
+}

package/src/daemon/schedule-manager.ts

@@ -6,79 +6,7 @@ import type { DaemonDatabase } from './database'
 import type { WorkerPool } from './worker-pool'
 import type { DaemonSchedule } from './types'
 import { logger } from './logger'
-
-// Simple minute-granularity cron expression parser.
-//
-// Supports the standard 5-field cron format:
-//   minute hour day-of-month month day-of-week
-//
-// Handles: * (wildcard), star/N (step), N (exact), N-M (range), N,M,O (list).
-// Falls back to +1 minute if the expression is invalid or no match is found
-// within 366 days.
-function computeNextFire(cronExpr: string, from: Date): string {
-  const fields = cronExpr.trim().split(/\s+/)
-  if (fields.length !== 5) {
-    return new Date(from.getTime() + 60_000).toISOString()
-  }
-
-  const minField = fields[0]!
-  const hourField = fields[1]!
-  const domField = fields[2]!
-  const monthField = fields[3]!
-  const dowField = fields[4]!
-
-  function matches(value: number, field: string): boolean {
-    if (field === '*') return true
-    // */N step
-    const stepMatch = field.match(/^\*\/(\d+)$/)
-    if (stepMatch) {
-      return value % parseInt(stepMatch[1]!, 10) === 0
-    }
-    // Comma-separated list
-    if (field.includes(',')) {
-      return field.split(',').some((f) => matches(value, f))
-    }
-    // Range
-    const rangeMatch = field.match(/^(\d+)-(\d+)$/)
-    if (rangeMatch) {
-      const low = parseInt(rangeMatch[1]!, 10)
-      const high = parseInt(rangeMatch[2]!, 10)
-      return value >= low && value <= high
-    }
-    // Exact value
-    return value === parseInt(field, 10)
-  }
-
-  const date = new Date(from)
-  date.setSeconds(0, 0)
-  // Start from the next minute to avoid matching the current minute
-  date.setMinutes(date.getMinutes() + 1)
-
-  // Try up to 366 days forward (safety limit — ~527k iterations)
-  const maxIterations = 366 * 24 * 60
-  for (let i = 0; i < maxIterations; i++) {
-    const minute = date.getMinutes()
-    const hour = date.getHours()
-    const dom = date.getDate()
-    const month = date.getMonth() + 1 // JS months are 0-indexed
-    const dow = date.getDay() // 0 = Sunday
-
-    if (
-      matches(minute, minField) &&
-      matches(hour, hourField) &&
-      matches(dom, domField) &&
-      matches(month, monthField) &&
-      matches(dow, dowField)
-    ) {
-      return date.toISOString()
-    }
-
-    date.setMinutes(date.getMinutes() + 1)
-  }
-
-  // Fallback: 1 minute from now
-  return new Date(from.getTime() + 60_000).toISOString()
-}
+import { computeNextFire } from '../core/cron'
 
 export class ScheduleManager {
   private db: DaemonDatabase

package/src/index.tsx

@@ -25,6 +25,7 @@ import { loadSessionMemories, getMemoryManager } from './core/memory/memory-load
 import { ContextManager } from './core/context'
 import { PrefixCacheTracker } from './core/context-token'
 import { QueryEngine } from './core/engine'
+import { generateSessionName } from './core/session-name'
 import { ExperienceRuleEngine } from './core/rule-engine.js'
 import { SessionLog } from './core/session-log'
 import { SessionStore } from './core/session-store'
@@ -40,6 +41,7 @@ import { mountConstitution, createConstitution } from './core/constitution-seam'
 import { ConstitutionLoader } from './core/constitution-loader'
 import { McpClient } from './mcp/client'
 import { registerMcpServerTools, syncMcpToolsOnChange } from './mcp/registry'
+import { formatMcpConnectFailures, type McpConnectFailure } from './mcp/connect-failures'
 import { AgentRegistry } from './agent/agent-registry'
 import { HookEngine } from './core/hooks'
 import { ArtifactServer } from './artifacts/server'
@@ -202,8 +204,8 @@ function SetupGate(props: SetupGateProps) {
 async function connectMcpServers(
   mcpServers: McpServerConfig[],
   tools: ReturnType<typeof createToolRegistry>,
-): Promise<void> {
-  if (mcpServers.length === 0) return
+): Promise<McpConnectFailure[]> {
+  if (mcpServers.length === 0) return []
   const mcp = McpClient.getInstance()
   // Wire runtime tool-list changes before connect so mid-connect updates land.
   syncMcpToolsOnChange(mcp, tools)
@@ -216,14 +218,17 @@ async function connectMcpServers(
       }
     }),
   )
+  const failures: McpConnectFailure[] = []
   for (let i = 0; i < results.length; i++) {
     const result = results[i]!
     if (result.status === 'rejected') {
-      process.stderr.write(
-        `[mcp] Failed to connect "${mcpServers[i]!.name}": ${String(result.reason)}\n`,
-      )
+      const name = mcpServers[i]!.name
+      const reason = String(result.reason)
+      failures.push({ name, reason })
+      process.stderr.write(`[mcp] Failed to connect "${name}": ${reason}\n`)
     }
   }
+  return failures
 }
 
 export async function runApp(options: RunOptions): Promise<void> {
@@ -325,8 +330,7 @@ export async function runApp(options: RunOptions): Promise<void> {
   const pluginManager = new PluginManager()
 
   // Generate session name for tracking (used by /cd to persist cwd)
-  const sessionName =
-    options.resume || `session-${new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)}`
+  const sessionName = generateSessionName(options.resume)
 
   // Initialize context — restore saved session if available
   // Read the active model's context window for dynamic max-token sizing.
@@ -498,7 +502,7 @@ export async function runApp(options: RunOptions): Promise<void> {
   // Connect MCP servers lazily in the background: the UI renders immediately,
   // and each server's tools register into the shared registry as it connects.
   // A dead server (e.g. a 15s connect timeout) no longer blocks startup.
-  void connectMcpServers(config.skills?.mcpServers ?? [], tools)
+  const mcpConnectPromise = connectMcpServers(config.skills?.mcpServers ?? [], tools)
 
   // Initialize hook engine — register skill-defined hooks
   const hookEngine = new HookEngine()
@@ -562,6 +566,14 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   // ── Cross-session messaging: register session, heartbeat, shutdown ──
   engine.setSessionId(sessionName)
+
+  // Surface MCP connect failures to the model once they settle, so it knows
+  // those servers' tools are unavailable (rather than silently concluding the
+  // tools don't exist). Injected asynchronously — never blocks first paint.
+  void mcpConnectPromise.then((failures) => {
+    const notice = formatMcpConnectFailures(failures)
+    if (notice) engine.getContext().addMessage({ role: 'user', content: notice })
+  })
   // Human-readable, cross-session-addressable name. Defaults to the cwd basename
   // so `@mipham-code` can address this session; uniqueness is enforced against
   // other live sessions (suffix -2, -3, …). The id stays a stable `session-<ts>`.

package/src/mcp/connect-failures.ts

@@ -0,0 +1,15 @@
+export interface McpConnectFailure {
+  name: string
+  reason: string
+}
+
+/**
+ * Format a startup notice for MCP servers that failed to connect, so the model
+ * knows their tools are unavailable (instead of concluding the tools don't
+ * exist). Empty string when nothing failed.
+ */
+export function formatMcpConnectFailures(failures: McpConnectFailure[]): string {
+  if (failures.length === 0) return ''
+  const list = failures.map((f) => `- ${f.name}: ${f.reason}`).join('\n')
+  return `[MCP] These MCP servers failed to connect — their tools are unavailable:\n${list}`
+}

package/src/plugin/claude-plugin.ts

@@ -26,7 +26,7 @@ export function readClaudeManifest(dir: string): ClaudeManifest | null {
   const path = join(dir, '.claude-plugin', 'plugin.json')
   if (!existsSync(path)) return null
   try {
-    return JSON.parse(readFileSync(path, 'utf-8')) as ClaudeManifest
+    return JSON.parse(readFileSync(path, 'utf-8').replace(/^\uFEFF/, '')) as ClaudeManifest
   } catch {
     return null
   }

package/src/plugin/plugin-validator.ts

@@ -52,7 +52,7 @@ export function validatePlugin(dir: string): PluginValidation {
 
   const errors: string[] = []
   try {
-    const raw = readFileSync(resolved.path, 'utf-8')
+    const raw = readFileSync(resolved.path, 'utf-8').replace(/^\uFEFF/, '')
     const manifest = JSON.parse(raw) as PluginManifest
 
     if (!manifest.name || !/^[a-z0-9-]+$/.test(manifest.name)) {

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.61.0' as const
+export const PACKAGE_VERSION = '0.63.0' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/tools/scheduling/cron.ts

@@ -10,6 +10,7 @@ import { join } from 'node:path'
 import { createHash } from 'node:crypto'
 import { homedir } from 'node:os'
 import type { ToolDefinition } from '../../shared/index.ts'
+import { computeNextFire } from '../../core/cron'
 
 const CRON_DIR = join(homedir(), '.mipham', 'cron')
 
@@ -17,12 +18,14 @@ function ensureCronDir(): void {
   if (!existsSync(CRON_DIR)) mkdirSync(CRON_DIR, { recursive: true })
 }
 
-interface CronJob {
+export interface CronJob {
   id: string
   cron: string
   prompt: string
   recurring: boolean
   createdAt: string
+  nextFire: string
+  lastFired: string | null
 }
 
 function jobPath(id: string): string {
@@ -33,13 +36,21 @@ function generateId(cron: string, prompt: string): string {
   return createHash('sha256').update(`${cron}:${prompt}`).digest('hex').slice(0, 12)
 }
 
-function readAllJobs(): CronJob[] {
+/**
+ * Read all durable cron jobs. Backfills `nextFire`/`lastFired` for files
+ * written before the executor landed (they only had id/cron/prompt/recurring).
+ */
+export function readAllJobs(): CronJob[] {
   ensureCronDir()
   const jobs: CronJob[] = []
   for (const file of readdirSync(CRON_DIR)) {
     if (!file.endsWith('.json')) continue
     try {
-      jobs.push(JSON.parse(readFileSync(join(CRON_DIR, file), 'utf-8')))
+      const parsed = JSON.parse(readFileSync(join(CRON_DIR, file), 'utf-8')) as Partial<CronJob>
+      if (!parsed.nextFire)
+        parsed.nextFire = computeNextFire(parsed.cron ?? '* * * * *', new Date())
+      if (parsed.lastFired === undefined) parsed.lastFired = null
+      jobs.push(parsed as CronJob)
     } catch {
       /* skip corrupt files */
     }
@@ -47,6 +58,20 @@ function readAllJobs(): CronJob[] {
   return jobs.sort((a, b) => a.createdAt.localeCompare(b.createdAt))
 }
 
+/** Persist a job (create or update) to its JSON file. */
+export function writeJob(job: CronJob): void {
+  ensureCronDir()
+  writeFileSync(jobPath(job.id), JSON.stringify(job, null, 2), 'utf-8')
+}
+
+/** Delete a job's file. Returns false when the job did not exist. */
+export function deleteJobFile(id: string): boolean {
+  const path = jobPath(id)
+  if (!existsSync(path)) return false
+  unlinkSync(path)
+  return true
+}
+
 export const cronCreateTool: ToolDefinition = {
   name: 'CronCreate',
   description:
@@ -82,17 +107,18 @@ export const cronCreateTool: ToolDefinition = {
     const recurring = params.recurring !== false
     const id = generateId(cron, prompt)
 
-    ensureCronDir()
-
+    const now = new Date()
     const job: CronJob = {
       id,
       cron,
       prompt: prompt.slice(0, 1000),
       recurring,
-      createdAt: new Date().toISOString(),
+      createdAt: now.toISOString(),
+      nextFire: computeNextFire(cron, now),
+      lastFired: null,
     }
 
-    writeFileSync(jobPath(id), JSON.stringify(job, null, 2), 'utf-8')
+    writeJob(job)
 
     const type = recurring ? 'recurring' : 'one-shot'
     return {
@@ -124,11 +150,9 @@ export const cronDeleteTool: ToolDefinition = {
   },
   async execute(params, _ctx) {
     const id = params.id as string
-    const path = jobPath(id)
-    if (!existsSync(path)) {
+    if (!deleteJobFile(id)) {
       return { success: false, content: '', error: `Cron job "${id}" not found.` }
     }
-    unlinkSync(path)
     return { success: true, content: `Cron job "${id}" deleted.` }
   },
 }

package/src/ui/app.tsx

@@ -52,6 +52,7 @@ import type { PermissionMode } from '../shared/index.ts'
 import { sanitizeForDisplay } from '../shared/sanitize.ts'
 import { recordLoopTurn, readAutoloopJournal } from '../commands/autoloop-journal.js'
 import { cancelAllSessionTimers } from '../tools/scheduling/schedule-wakeup.js'
+import { startCronPoller } from '../core/cron-poller'
 
 interface AppProps {
   engine: QueryEngine | RemoteEngine
@@ -686,9 +687,16 @@ export function App({
     // User turn wins: if a user submitted meanwhile, turnId advanced and this loop wakeup
     // yields (the next timer fire re-enqueues). Spec §六 — do not force it to run anyway.
     if (turnIdRef.current !== turnId) return
-    // RemoteEngine (remote attach mode) has no wakeup queue — /loop is CLI-local.
+    // RemoteEngine (remote attach mode) has no wakeup queue — /loop + cron are CLI-local.
     if (!('hasPendingWakeup' in engine)) return
-    const next = engine.hasPendingWakeup() ? engine.dequeueWakeup() : null
+    // Cron first (absolute-time scheduled, FIFO — every due job fires), then /loop.
+    const cronPrompt = engine.hasPendingCron() ? engine.dequeueCronPrompt() : null
+    const next =
+      cronPrompt !== null
+        ? { prompt: cronPrompt, noop: false }
+        : engine.hasPendingWakeup()
+          ? engine.dequeueWakeup()
+          : null
     if (next) await runTurn(next.prompt, 'loop', undefined, next.noop)
   }
 
@@ -713,6 +721,17 @@ export function App({
     drainLoopQueueRef.current?.(turnIdRef.current)
   }, [wakeupTick, isLoading])
 
+  // ── cron poller ──
+  // Start the durable-cron poller so CronCreate jobs actually fire into this session.
+  // It enqueues due prompts into the engine's cron queue; the drain above re-invokes
+  // them. Cron is CLI-local (RemoteEngine has no cron queue), like /loop.
+  useEffect(() => {
+    if (!('hasPendingWakeup' in engine)) return
+    const qe = engine // narrow to QueryEngine for the cleanup closure
+    const stop = startCronPoller((prompt) => qe.enqueueCronPrompt(prompt))
+    return stop
+  }, [engine])
+
   const handleSubmit = useCallback(
     async (input: string) => {
       if (!input.trim()) return