@miphamai/cli 0.69.0 → 0.71.0

package/src/core/hooks-executor.ts

@@ -30,22 +30,101 @@ function substituteVars(template: string, ctx: HookContext): string {
     .replace(/\$SESSION_ID/g, ctx.sessionId)
 }
 
+/**
+ * Build the Claude Code protocol stdin JSON for a hook script. Mirrors the
+ * fields Claude Code passes (session_id / hook_event_name / cwd / tool_name /
+ * tool_input / tool_response) so hand-written Claude hooks can migrate
+ * unchanged.
+ */
+export function buildHookStdin(ctx: HookContext, cwd: string): Record<string, unknown> {
+  const payload: Record<string, unknown> = {
+    session_id: ctx.sessionId,
+    hook_event_name: ctx.event,
+    cwd,
+  }
+  if (ctx.toolName) payload.tool_name = ctx.toolName
+  if (ctx.toolInput) payload.tool_input = ctx.toolInput
+  if (ctx.toolResult) payload.tool_response = ctx.toolResult
+  return payload
+}
+
+/**
+ * Parse a hook script's stdout JSON into a HookResult, following the Claude
+ * Code output contract. Supports the modern `hookSpecificOutput` carrier
+ * (permissionDecision / updatedInput / additionalContext) plus the legacy
+ * root-level `decision` and `continue` fields. Non-JSON or empty stdout = allow.
+ */
+export function parseHookStdout(stdout: string | null | undefined, _ctx: HookContext): HookResult {
+  if (!stdout) return { allowed: true }
+
+  let parsed: Record<string, unknown>
+  try {
+    parsed = JSON.parse(stdout) as Record<string, unknown>
+  } catch {
+    return { allowed: true }
+  }
+
+  const hso = parsed.hookSpecificOutput as Record<string, unknown> | undefined
+  if (hso) {
+    const decision = hso.permissionDecision as string | undefined
+    const reason = hso.permissionDecisionReason as string | undefined
+    const additionalContext = hso.additionalContext as string | undefined
+    const updatedInput = hso.updatedInput as Record<string, unknown> | undefined
+
+    if (decision === 'deny') {
+      return { allowed: false, reason: reason ?? 'Denied by hook', additionalContext }
+    }
+    if (decision === 'allow') {
+      return {
+        allowed: true,
+        permissionDecision: 'allow',
+        modifiedInput: updatedInput,
+        additionalContext,
+      }
+    }
+    if (decision === 'ask') {
+      return { allowed: true, permissionDecision: 'ask', additionalContext }
+    }
+    if (decision === 'defer') {
+      return { allowed: true, permissionDecision: 'defer', additionalContext }
+    }
+    if (additionalContext) {
+      return { allowed: true, additionalContext }
+    }
+  }
+
+  // Legacy root-level decision: block / approve
+  if (parsed.decision === 'block') {
+    return { allowed: false, reason: (parsed.reason as string) ?? 'Blocked by hook' }
+  }
+
+  // Stop-style events: continue:false
+  if (parsed.continue === false) {
+    return { allowed: false, reason: (parsed.stopReason as string) ?? 'Stopped by hook' }
+  }
+
+  return { allowed: true }
+}
+
 function executeCommand(cfg: HookConfig, ctx: HookContext): HookResult {
   if (!cfg.command) return { allowed: true }
 
   try {
     const args = cfg.args ? cfg.args.map((a) => substituteVars(a, ctx)) : []
 
-    // Use spawnSync with array args — no shell, no command injection
+    // Use spawnSync with array args — no shell, no command injection.
+    // Pass the Claude-protocol stdin JSON so scripts can read structured context.
+    const input = JSON.stringify(buildHookStdin(ctx, process.cwd()))
     const result = spawnSync(cfg.command, args, {
-      timeout: 30_000,
+      timeout: (cfg.timeout ?? 60) * 1000,
       encoding: 'utf-8',
-      stdio: ['ignore', 'pipe', 'pipe'],
+      stdio: ['pipe', 'pipe', 'pipe'],
+      input,
     })
 
-    // Exit code 0 = success, allow
+    // Exit code 0 = success — parse the stdout JSON for structured decisions.
     if (result.status === 0) {
-      return { allowed: true }
+      return parseHookStdout(result.stdout, ctx)
     }
 
     // Non-zero exit: check for block signal (exit code 2)

package/src/core/improvement-track.ts

@@ -1,8 +1,9 @@
 // CRSI 改进轨：噪声自适应改进判定 + 台账 + pending verdict 闸。
 // A1 不破：verdict / minEffect / 改进率全是确定性算术（均值/标准差/阈值/Wilson），无 LLM 裁判。
-import { appendFileSync, readFileSync, existsSync, mkdirSync } from 'node:fs'
+import { readFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import type { SkillDeltaSample } from './task-performance'
 
 export type ImprovementVerdict = 'improved' | 'regressed' | 'inconclusive'
@@ -115,7 +116,11 @@ export function improvementPath(): string {
 export function appendImprovement(record: ImprovementRecord): void {
   const file = improvementPath()
   mkdirSync(join(homedir(), '.mipham', 'crsi'), { recursive: true })
-  appendFileSync(file, JSON.stringify(record) + '\n', 'utf-8')
+  // 原子激活（④）：整账本读-改-写 + temp 文件 rename（见 shared/atomic-write），读者要么见旧要么见新。
+  // 非原子的 appendFileSync 写中途崩溃会留撕裂行，readImprovements 会 JSON.parse 抛错。
+  const existing = readImprovements()
+  existing.push(record)
+  atomicWriteFileSync(file, existing.map((r) => JSON.stringify(r)).join('\n') + '\n')
 }
 
 export function readImprovements(): ImprovementRecord[] {
@@ -124,19 +129,42 @@ export function readImprovements(): ImprovementRecord[] {
   return readFileSync(file, 'utf-8')
     .split('\n')
     .filter((line) => line.trim() !== '')
-    .map((line) => JSON.parse(line) as ImprovementRecord)
+    .flatMap((line) => {
+      try {
+        return [JSON.parse(line) as ImprovementRecord]
+      } catch {
+        return [] // 残留撕裂/坏行跳过，不抛（原子激活的容错侧）
+      }
+    })
 }
 
 // ── pending verdict 闸（倒退才拦） ──
+// 原子激活（④）：pending verdict 是「激活指针」，持久化为不可变 manifest + 原子替换
+// （temp+rename，见 shared/atomic-write），替代易失内存变量（进程重启即丢、无 manifest）。
 
-let pendingVerdict: ImprovementVerdict | null = null
+export function pendingVerdictPath(): string {
+  return join(homedir(), '.mipham', 'crsi', 'pending-verdict.json')
+}
 
 export function setPendingVerdict(v: ImprovementVerdict | null): void {
-  pendingVerdict = v
+  const file = pendingVerdictPath()
+  if (v === null) {
+    rmSync(file, { force: true }) // 原子清除（unlink 原子）
+    return
+  }
+  mkdirSync(join(homedir(), '.mipham', 'crsi'), { recursive: true })
+  atomicWriteFileSync(file, JSON.stringify({ verdict: v, timestamp: new Date().toISOString() }))
 }
 
 export function getPendingVerdict(): ImprovementVerdict | null {
-  return pendingVerdict
+  const file = pendingVerdictPath()
+  if (!existsSync(file)) return null
+  try {
+    const parsed = JSON.parse(readFileSync(file, 'utf-8')) as { verdict: ImprovementVerdict }
+    return parsed.verdict
+  } catch {
+    return null // manifest 损坏 → 视为无 pending（与旧 `?? 'inconclusive'` 的 fail-open 一致）
+  }
 }
 
 export function shouldBlockApproval(v: ImprovementVerdict): boolean {

package/src/core/instructions.ts

@@ -11,12 +11,12 @@ import {
   type CrsiLessonSummary,
 } from './crsi-producer'
 
-interface FrontmatterResult {
+export interface FrontmatterResult {
   data: Record<string, unknown>
   content: string
 }
 
-function parseFrontmatter(raw: string): FrontmatterResult {
+export function parseFrontmatter(raw: string): FrontmatterResult {
   // Strip a leading UTF-8 BOM — otherwise `^---` never matches and a
   // BOM-prefixed file is silently treated as body text (effectively ignored).
   const src = raw.replace(/^\uFEFF/, '')

package/src/core/memory/memory-manager.ts

@@ -9,7 +9,7 @@ import {
   statSync,
 } from 'node:fs'
 import { join, extname, basename } from 'node:path'
-import { similarities } from './tfidf'
+import { similarities, findNearDuplicates } from './tfidf'
 
 export interface MemoryMetadata {
   type: 'user' | 'feedback' | 'project' | 'reference'
@@ -333,6 +333,26 @@ export class MemoryManager {
     return { merged, removed }
   }
 
+  /**
+   * 只读「近重复报告」：跨所有记忆（含手写）列出 TF-IDF 余弦 > 阈值的近重复对，
+   * 供 /memory dedup 展示。只检测不合并——合并是用户的决定（写时去重已拦新增，
+   * 这里报告存量近重复供人工审视）。
+   */
+  listNearDuplicates(
+    threshold: number = DEDUP_THRESHOLD,
+  ): Array<{ a: string; b: string; similarity: number }> {
+    const entries = [...this.memories.values()]
+    const pairs = findNearDuplicates(
+      entries.map((e) => e.content),
+      threshold,
+    )
+    return pairs.map(({ i, j, similarity }) => ({
+      a: entries[i]!.name,
+      b: entries[j]!.name,
+      similarity,
+    }))
+  }
+
   buildSystemReminder(context: string, maxTokens?: number, grounding?: string): string {
     // Adaptive budget: 5% of context window, min 5000, max 75000
     const effectiveMaxTokens =

package/src/core/memory/tfidf.ts

@@ -106,3 +106,33 @@ export function similarities(query: string, docs: string[]): number[] {
   const queryVec = tfidfVector(queryTokens, df, numDocs)
   return docTokens.map((tokens) => cosine(queryVec, tfidfVector(tokens, df, numDocs)))
 }
+
+/**
+ * All pairs (i < j) of docs whose TF-IDF cosine similarity is `> threshold`,
+ * sorted by similarity descending. Deterministic near-duplicate detection —
+ * flags candidates for manual merge, never merges automatically.
+ */
+export function findNearDuplicates(
+  docs: string[],
+  threshold: number,
+): Array<{ i: number; j: number; similarity: number }> {
+  const docTokens = docs.map(tokenize)
+  const numDocs = docs.length
+
+  const df = new Map<string, number>()
+  for (const tokens of docTokens) {
+    for (const term of new Set(tokens)) {
+      df.set(term, (df.get(term) ?? 0) + 1)
+    }
+  }
+
+  const vectors = docTokens.map((tokens) => tfidfVector(tokens, df, numDocs))
+  const pairs: Array<{ i: number; j: number; similarity: number }> = []
+  for (let i = 0; i < numDocs; i++) {
+    for (let j = i + 1; j < numDocs; j++) {
+      const similarity = cosine(vectors[i]!, vectors[j]!)
+      if (similarity > threshold) pairs.push({ i, j, similarity })
+    }
+  }
+  return pairs.sort((a, b) => b.similarity - a.similarity)
+}

package/src/i18n-core/locales/en-US.json

@@ -235,6 +235,7 @@
       "title": "── Token Usage (estimated) ──",
       "context_tokens": "Context tokens:",
       "usage": "Usage:",
+      "prompt_cache": "Prompt cache: ~{cached} cached ({ratio}% hit) · ~{uncached} uncached",
       "footer": "Token counting is approximate (chars/4).\nActual API usage depends on provider and model."
     },
     "model": {
@@ -415,7 +416,10 @@
       "gc_done": "Done. Archived files moved to ~/.mipham/memory/archive/",
       "consolidate_title": "─ Memory Consolidate ─",
       "consolidate_none": "No auto-* memories to consolidate.",
-      "consolidate_result": "Consolidated: {removed} auto-* removed, {merged} lessons written."
+      "consolidate_result": "Consolidated: {removed} auto-* removed, {merged} lessons written.",
+      "dedup_title": "─ Memory Near-Duplicates ─",
+      "dedup_none": "No near-duplicate memories found.",
+      "dedup_footer": "Pairs above the TF-IDF cosine threshold. Merge is manual — run /memory consolidate for auto-* clustering, or edit the files directly."
     },
     "upgrade": {
       "uptodate": "── Upgrade Mipham Code ──\n\nCurrent version: v{current}\nLatest:          v{latest}\n\n✓ Already up to date.\n\nTo check manually: https://www.npmjs.com/package/@miphamai/cli",
@@ -579,7 +583,7 @@
     },
     "hooks": {
       "title": "── Hooks ──",
-      "no_hooks": "── Hooks ──\n\nNo hooks configured.\n\nCreate hook scripts in .mipham/hooks/:\n  pre-tool-use.sh   — runs before each tool\n  post-tool-use.sh  — runs after each tool\n  stop.sh           — runs when session ends\n\nUse /loop init to scaffold hooks directory.",
+      "no_hooks": "── Hooks ──\n\nNo hooks configured.\n\nConfigure hooks in .mipham/settings.json under the hooks section:\n  PreToolUse   — before each tool\n  PostToolUse  — after each tool\n  Stop         — on session end\n\nCommand hooks read JSON from stdin; exit 2 blocks (stderr as reason).\nUse /loop init to scaffold settings.json.",
       "location": "Location: {path}",
       "found": "{count} hook(s) found.",
       "error": "── Hooks ──\n\nCould not read hooks directory."
@@ -609,6 +613,26 @@
       "audit_clean": "  ✓ no code-derivable sections found",
       "audit_found": "Add the sections above to the `prompt-exclude` frontmatter to stop sending them to the model."
     },
+    "fix": {
+      "title": "── Fix ──",
+      "dryrun_banner": "[dry-run] preview — no changes written",
+      "doctor_clean": "✓ no code-derivable CLAUDE.md sections to fix",
+      "doctor_fixed": "✓ {path}: added prompt-exclude [{added}]",
+      "config_clean": "✓ config healthy, no disabled hooks",
+      "config_corrupt": "⚠ {path}: config corrupt",
+      "config_restored": "✓ restored config from backup: {path}",
+      "hook_disabled": "⚠ hook disabled: {key}",
+      "hook_reenabled": "✓ re-enabled hook: {key}",
+      "cache_clean": "✓ no corrupt cache lines",
+      "cache_found": "⚠ {path}: {count} corrupt line(s)",
+      "cache_cleaned": "✓ cleaned {path}: removed {count} line(s)",
+      "cache_hint": "Run /fix cache --apply to remove corrupt lines",
+      "test_usage": "Usage: /fix test <test-file> [--apply]\n\nLLM-driven repair of a failing test (test frozen, source only). Dry-run by default; --apply writes the fix.",
+      "test_no_llm": "No LLM available in this session — cannot generate a fix.",
+      "test_fixed": "✓ fixed {test} (source {source}, {attempts} attempt(s))",
+      "test_failed": "✗ could not fix {test}: {detail}",
+      "test_hint": "Run /fix test <file> --apply to write the fix."
+    },
     "plugins": {
       "unavailable": "PluginManager not available in this session.",
       "title": "── Installed Plugins ──",

package/src/i18n-core/locales/zh-CN.json

@@ -235,6 +235,7 @@
       "title": "── Token 用量（估算）──",
       "context_tokens": "上下文 Token:",
       "usage": "使用率:",
+      "prompt_cache": "Prompt 缓存: ~{cached} 命中 ({ratio}% hit) · ~{uncached} 未命中",
       "footer": "Token 计数为近似值（字符数/4）。\n实际 API 用量取决于提供商和模型。"
     },
     "model": {
@@ -415,7 +416,10 @@
       "gc_done": "完成。归档文件已移到 ~/.mipham/memory/archive/",
       "consolidate_title": "─ 记忆合并 ─",
       "consolidate_none": "没有需要合并的 auto-* 记忆。",
-      "consolidate_result": "合并完成：删除 {removed} 条 auto-*，写入 {merged} 条 lesson-*。"
+      "consolidate_result": "合并完成：删除 {removed} 条 auto-*，写入 {merged} 条 lesson-*。",
+      "dedup_title": "─ 记忆近重复 ─",
+      "dedup_none": "未发现近重复记忆。",
+      "dedup_footer": "以上为 TF-IDF 余弦超过阈值的近重复对。合并需手动——auto-* 走 /memory consolidate 聚簇，或直接编辑文件。"
     },
     "upgrade": {
       "uptodate": "── 升级 Mipham Code ──\n\n当前版本: v{current}\n最新版本:          v{latest}\n\n✓ 已是最新版本。\n\n手动检查: https://www.npmjs.com/package/@miphamai/cli",
@@ -579,7 +583,7 @@
     },
     "hooks": {
       "title": "── 钩子 ──",
-      "no_hooks": "── 钩子 ──\n\n未配置钩子。\n\n在 .mipham/hooks/ 中创建钩子脚本:\n  pre-tool-use.sh   — 在每次工具执行前运行\n  post-tool-use.sh  — 在每次工具执行后运行\n  stop.sh           — 会话结束时运行\n\n使用 /loop init 初始化钩子目录。",
+      "no_hooks": "── 钩子 ──\n\n未配置钩子。\n\n在 .mipham/settings.json 的 hooks 段配置钩子:\n  PreToolUse   — 工具执行前\n  PostToolUse  — 工具执行后\n  Stop         — 会话结束\n\n命令钩子从 stdin 读 JSON，exit 2 拦截（stderr 作理由）。\n使用 /loop init 初始化 settings.json。",
       "location": "位置: {path}",
       "found": "找到 {count} 个钩子。",
       "error": "── 钩子 ──\n\n无法读取钩子目录。"
@@ -609,6 +613,26 @@
       "audit_clean": "  ✓ 未发现可从代码推断的冗余章节",
       "audit_found": "将上述章节加入 `prompt-exclude` frontmatter，可停止发送给模型、节省 token。"
     },
+    "fix": {
+      "title": "── 修复 ──",
+      "dryrun_banner": "[dry-run] 预览模式 — 不落盘",
+      "doctor_clean": "✓ CLAUDE.md 无需要修复的冗余章节",
+      "doctor_fixed": "✓ {path}: 已加 prompt-exclude [{added}]",
+      "config_clean": "✓ 配置无损坏、hooks 无禁用",
+      "config_corrupt": "⚠ {path}: 配置损坏",
+      "config_restored": "✓ 已从备份恢复 config: {path}",
+      "hook_disabled": "⚠ hook 已禁用: {key}",
+      "hook_reenabled": "✓ 已重新启用 hook: {key}",
+      "cache_clean": "✓ 缓存无损坏行",
+      "cache_found": "⚠ {path}: {count} 行损坏",
+      "cache_cleaned": "✓ 已清理 {path}: 移除 {count} 行",
+      "cache_hint": "使用 /fix cache --apply 清理损坏行",
+      "test_usage": "用法: /fix test <测试文件> [--apply]\n\nLLM 自动修复失败测试（测试冻结，只改源码）。默认 dry-run，--apply 落盘。",
+      "test_no_llm": "当前会话无可用 LLM，无法生成修复。",
+      "test_fixed": "✓ 已修复 {test}（源码 {source}，{attempts} 次尝试）",
+      "test_failed": "✗ 未能修复 {test}: {detail}",
+      "test_hint": "使用 /fix test <文件> --apply 落盘修复。"
+    },
     "plugins": {
       "unavailable": "当前会话中 PluginManager 不可用。",
       "title": "── 已安装插件 ──",

package/src/index.tsx

@@ -10,6 +10,7 @@ import {
   loadInferenceHookConfig,
   loadCredentialMaskingConfig,
   loadCrossSessionConfig,
+  loadSettingsJson,
 } from './config/loader'
 import {
   registerActiveSession,
@@ -44,6 +45,7 @@ import { registerMcpServerTools, syncMcpToolsOnChange } from './mcp/registry'
 import { formatMcpConnectFailures, type McpConnectFailure } from './mcp/connect-failures'
 import { AgentRegistry } from './agent/agent-registry'
 import { HookEngine } from './core/hooks'
+import { loadHookConfigs } from './core/hooks-config'
 import { ArtifactServer } from './artifacts/server'
 import { getMetrics } from './core/metrics'
 import { getWorkspaceTrust } from './core/workspace-trust'
@@ -514,6 +516,12 @@ export async function runApp(options: RunOptions): Promise<void> {
     }
   }
 
+  // Register settings.json hooks (Claude Code convention — additive across levels)
+  const settingsJson = loadSettingsJson(process.cwd())
+  for (const def of loadHookConfigs(settingsJson.hooks)) {
+    hookEngine.register(def)
+  }
+
   // Start artifact server (lazy — first artifact creation triggers listening)
   const artifactsDir = join(process.cwd(), MIPHAM_DIR, ARTIFACTS_DIR)
   const artifactServer = new ArtifactServer(artifactsDir, ARTIFACT_PORT)
@@ -547,6 +555,10 @@ export async function runApp(options: RunOptions): Promise<void> {
     for (const rule of config.permissionRules.deny ?? []) engine.getPermission().deny(rule)
   }
 
+  // Apply settings.json permissions (allow/deny) — Claude Code convention
+  for (const rule of settingsJson.permissions.allow) engine.getPermission().allow(rule)
+  for (const rule of settingsJson.permissions.deny) engine.getPermission().deny(rule)
+
   // Initialize agent registry and load plugin agents/skills/MCP/hooks
   const agentRegistry = new AgentRegistry()
   agentRegistry.loadUserAgents()

package/src/providers/openai-compat.ts

@@ -96,11 +96,12 @@ export class OpenAICompatProvider implements ProviderInstance {
         if (data === '[DONE]') {
           // Emit any pending tool calls before stopping
           for (const [, tc] of pendingToolCalls) {
+            if (!tc.name) continue // drop malformed tool call (missing name)
             yield {
               type: 'tool_use',
               toolUse: {
                 type: 'tool_use',
-                id: tc.id,
+                id: tc.id || `call_${Date.now()}`,
                 name: tc.name,
                 input: this.safeParseJson(tc.arguments),
               },
@@ -155,6 +156,7 @@ export class OpenAICompatProvider implements ProviderInstance {
           if (choice.finish_reason === 'tool_calls') {
             // Emit fully accumulated tool calls
             for (const [, tc] of pendingToolCalls) {
+              if (!tc.name) continue // drop malformed tool call (missing name)
               yield {
                 type: 'tool_use',
                 toolUse: {

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.69.0' as const
+export const PACKAGE_VERSION = '0.71.0' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/types.ts

@@ -234,6 +234,8 @@ export interface HookConfig {
   headers?: Record<string, string>
   mcpServer?: string
   mcpTool?: string
+  /** Command timeout in seconds (Claude Code default is 60). */
+  timeout?: number
   continueOnBlock?: boolean
 }
 

package/src/skills/community-registry.json

@@ -77,5 +77,21 @@
     "file": "frontend-design.SKILL.md",
     "category": "Design",
     "author": "Anthropic"
+  },
+  {
+    "name": "grill-me",
+    "description": "A relentless one-question-at-a-time interview that stress-tests your plan or design",
+    "url": "https://github.com/mattpocock/skills",
+    "file": "skills/productivity/grill-me/SKILL.md",
+    "category": "Development",
+    "author": "Matt Pocock"
+  },
+  {
+    "name": "eli5",
+    "description": "Explain any topic like the user knows nothing about it, using an HTML artifact with big pictures and few words",
+    "url": "https://github.com/anthropics/claude-plugins-community",
+    "file": "eli5/skills/eli5/SKILL.md",
+    "category": "Communication",
+    "author": "Anthropic"
   }
 ]