@miphamai/cli 0.70.0 → 0.72.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.70.0",
+  "version": "0.72.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/core/crsi-producer.ts

@@ -235,6 +235,19 @@ export function renderManagedRuleSource(signal: CrsiSignal): string | null {
   return null
 }
 
+/**
+ * 只路由不禁用护栏（CRSI 教训 #learning）：拒绝「禁用某内置能力」的 blanket 规则。
+ * 命中返回 true——producer 拒绝产出 managed rule，强制改写成「prefer X over Y」路由。
+ */
+const DISABLE_INTENT_RE =
+  /(禁用|禁止|停用|封禁)[^，。\n]{0,20}(工具|能力|功能|tool|capabilit)|\bnever\s+use\b|\bdon'?t\s+use\b|\bdo\s+not\s+use\b/i
+
+/** 检测信号是否表达「禁用某能力」的 blanket 意图（而非「prefer X over Y」路由）。 */
+export function hasDisableIntent(signal: CrsiSignal): boolean {
+  if (/^(disable|ban|never-use|never_use)$/.test(signal.category)) return true
+  return DISABLE_INTENT_RE.test(`${signal.category} ${signal.title} ${signal.suggestion}`)
+}
+
 /** 产出受管理规则变更候选（毕业路径）。无合格信号 / 同名规则已存在时返回 null。 */
 export function produceRuleProposal(
   signal: CrsiSignal,
@@ -246,6 +259,8 @@ export function produceRuleProposal(
   originalContent: string
   blastRadius: string[]
 } | null {
+  // 只路由不禁用护栏：拒绝「禁用某内置能力」的 blanket 规则。
+  if (hasDisableIntent(signal)) return null
   const ruleSource = renderManagedRuleSource(signal)
   if (!ruleSource) return null
 

package/src/core/improvement-track.ts

@@ -1,8 +1,9 @@
 // CRSI 改进轨：噪声自适应改进判定 + 台账 + pending verdict 闸。
 // A1 不破：verdict / minEffect / 改进率全是确定性算术（均值/标准差/阈值/Wilson），无 LLM 裁判。
-import { appendFileSync, readFileSync, existsSync, mkdirSync } from 'node:fs'
+import { readFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import type { SkillDeltaSample } from './task-performance'
 
 export type ImprovementVerdict = 'improved' | 'regressed' | 'inconclusive'
@@ -115,7 +116,11 @@ export function improvementPath(): string {
 export function appendImprovement(record: ImprovementRecord): void {
   const file = improvementPath()
   mkdirSync(join(homedir(), '.mipham', 'crsi'), { recursive: true })
-  appendFileSync(file, JSON.stringify(record) + '\n', 'utf-8')
+  // 原子激活（④）：整账本读-改-写 + temp 文件 rename（见 shared/atomic-write），读者要么见旧要么见新。
+  // 非原子的 appendFileSync 写中途崩溃会留撕裂行，readImprovements 会 JSON.parse 抛错。
+  const existing = readImprovements()
+  existing.push(record)
+  atomicWriteFileSync(file, existing.map((r) => JSON.stringify(r)).join('\n') + '\n')
 }
 
 export function readImprovements(): ImprovementRecord[] {
@@ -124,19 +129,42 @@ export function readImprovements(): ImprovementRecord[] {
   return readFileSync(file, 'utf-8')
     .split('\n')
     .filter((line) => line.trim() !== '')
-    .map((line) => JSON.parse(line) as ImprovementRecord)
+    .flatMap((line) => {
+      try {
+        return [JSON.parse(line) as ImprovementRecord]
+      } catch {
+        return [] // 残留撕裂/坏行跳过，不抛（原子激活的容错侧）
+      }
+    })
 }
 
 // ── pending verdict 闸（倒退才拦） ──
+// 原子激活（④）：pending verdict 是「激活指针」，持久化为不可变 manifest + 原子替换
+// （temp+rename，见 shared/atomic-write），替代易失内存变量（进程重启即丢、无 manifest）。
 
-let pendingVerdict: ImprovementVerdict | null = null
+export function pendingVerdictPath(): string {
+  return join(homedir(), '.mipham', 'crsi', 'pending-verdict.json')
+}
 
 export function setPendingVerdict(v: ImprovementVerdict | null): void {
-  pendingVerdict = v
+  const file = pendingVerdictPath()
+  if (v === null) {
+    rmSync(file, { force: true }) // 原子清除（unlink 原子）
+    return
+  }
+  mkdirSync(join(homedir(), '.mipham', 'crsi'), { recursive: true })
+  atomicWriteFileSync(file, JSON.stringify({ verdict: v, timestamp: new Date().toISOString() }))
 }
 
 export function getPendingVerdict(): ImprovementVerdict | null {
-  return pendingVerdict
+  const file = pendingVerdictPath()
+  if (!existsSync(file)) return null
+  try {
+    const parsed = JSON.parse(readFileSync(file, 'utf-8')) as { verdict: ImprovementVerdict }
+    return parsed.verdict
+  } catch {
+    return null // manifest 损坏 → 视为无 pending（与旧 `?? 'inconclusive'` 的 fail-open 一致）
+  }
 }
 
 export function shouldBlockApproval(v: ImprovementVerdict): boolean {

package/src/core/memory/memory-manager.ts

@@ -9,7 +9,7 @@ import {
   statSync,
 } from 'node:fs'
 import { join, extname, basename } from 'node:path'
-import { similarities } from './tfidf'
+import { similarities, findNearDuplicates } from './tfidf'
 
 export interface MemoryMetadata {
   type: 'user' | 'feedback' | 'project' | 'reference'
@@ -333,6 +333,26 @@ export class MemoryManager {
     return { merged, removed }
   }
 
+  /**
+   * 只读「近重复报告」：跨所有记忆（含手写）列出 TF-IDF 余弦 > 阈值的近重复对，
+   * 供 /memory dedup 展示。只检测不合并——合并是用户的决定（写时去重已拦新增，
+   * 这里报告存量近重复供人工审视）。
+   */
+  listNearDuplicates(
+    threshold: number = DEDUP_THRESHOLD,
+  ): Array<{ a: string; b: string; similarity: number }> {
+    const entries = [...this.memories.values()]
+    const pairs = findNearDuplicates(
+      entries.map((e) => e.content),
+      threshold,
+    )
+    return pairs.map(({ i, j, similarity }) => ({
+      a: entries[i]!.name,
+      b: entries[j]!.name,
+      similarity,
+    }))
+  }
+
   buildSystemReminder(context: string, maxTokens?: number, grounding?: string): string {
     // Adaptive budget: 5% of context window, min 5000, max 75000
     const effectiveMaxTokens =

package/src/core/memory/tfidf.ts

@@ -106,3 +106,33 @@ export function similarities(query: string, docs: string[]): number[] {
   const queryVec = tfidfVector(queryTokens, df, numDocs)
   return docTokens.map((tokens) => cosine(queryVec, tfidfVector(tokens, df, numDocs)))
 }
+
+/**
+ * All pairs (i < j) of docs whose TF-IDF cosine similarity is `> threshold`,
+ * sorted by similarity descending. Deterministic near-duplicate detection —
+ * flags candidates for manual merge, never merges automatically.
+ */
+export function findNearDuplicates(
+  docs: string[],
+  threshold: number,
+): Array<{ i: number; j: number; similarity: number }> {
+  const docTokens = docs.map(tokenize)
+  const numDocs = docs.length
+
+  const df = new Map<string, number>()
+  for (const tokens of docTokens) {
+    for (const term of new Set(tokens)) {
+      df.set(term, (df.get(term) ?? 0) + 1)
+    }
+  }
+
+  const vectors = docTokens.map((tokens) => tfidfVector(tokens, df, numDocs))
+  const pairs: Array<{ i: number; j: number; similarity: number }> = []
+  for (let i = 0; i < numDocs; i++) {
+    for (let j = i + 1; j < numDocs; j++) {
+      const similarity = cosine(vectors[i]!, vectors[j]!)
+      if (similarity > threshold) pairs.push({ i, j, similarity })
+    }
+  }
+  return pairs.sort((a, b) => b.similarity - a.similarity)
+}

package/src/core/permission-rules.ts

@@ -1,6 +1,182 @@
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchPath } from './credential-masker/matcher'
 
+// ── Bash command analysis (Read/Write/Edit deny-rule extension) ──
+//
+// A Read(/etc/passwd) deny rule must also refuse Bash commands that read that
+// file (`cat /etc/passwd`, `tac /etc/passwd`, `grep x /etc/passwd`,
+// `< /etc/passwd`) — not only the Read tool. Same for Write/Edit rules and
+// `> file` redirects / in-place editors. These helpers map a Bash command to
+// the file paths it touches, conservatively: over-matching is the safe
+// direction for a deny rule, under-matching is not.
+
+/** Commands that read a file and print its contents (bypass Read() rules today). */
+const READER_COMMANDS = new Set([
+  'cat',
+  'tac',
+  'head',
+  'tail',
+  'less',
+  'more',
+  'grep',
+  'egrep',
+  'fgrep',
+  'rg',
+  'sed',
+  'perl',
+  'awk',
+  'nl',
+  'sort',
+  'uniq',
+  'cut',
+  'diff',
+  'comm',
+  'join',
+  'paste',
+  'file',
+  'stat',
+  'xxd',
+  'od',
+  'hexdump',
+  'strings',
+  'wc',
+  'view',
+  'zcat',
+  'bzcat',
+])
+
+/** Commands that write/modify a file (bypass Write()/Edit() rules today). */
+const WRITER_COMMANDS = new Set([
+  'tee',
+  'touch',
+  'nano',
+  'vi',
+  'vim',
+  'emacs',
+  'ed',
+  'ex',
+  'cp',
+  'mv',
+  'rm',
+  'dd',
+  'install',
+  'truncate',
+])
+
+/**
+ * Split a (possibly compound) shell command into simple-command segments, so a
+ * Bash(pattern) rule matches any segment rather than only the whole string
+ * (`rm -rf /` buried in `foo && rm -rf /` must still match).
+ *
+ * Separators: `&&` `||` `;` `|` `&` and newline. Redirect operators (`>`,
+ * `>>`, `<`) are NOT separators — they belong to the same simple command.
+ * Quoting is not parsed (a `&` inside quotes still splits), which only
+ * over-matches — the safe direction for deny rules.
+ */
+export function splitShellSegments(command: string): string[] {
+  return command
+    .split(/&&|\|\||;|\||&|\n|\r/g)
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0)
+}
+
+function stripQuotes(s: string): string {
+  if (s.length >= 2) {
+    const first = s[0]
+    const last = s[s.length - 1]
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+      return s.slice(1, -1)
+    }
+  }
+  return s
+}
+
+function uniq(items: string[]): string[] {
+  return [...new Set(items)]
+}
+
+/** File paths a Bash command reads or writes. */
+export interface BashFileAccess {
+  read: string[]
+  write: string[]
+}
+
+/**
+ * Extract the file paths a Bash command reads or writes, so Read()/Write()/
+ * Edit() deny rules also apply to Bash (not just the Read/Write/Edit tools).
+ * Covers redirects (`<` reads, `>`/`>>` writes) and reader/writer command
+ * arguments — including inside `$(...)` and backtick substitutions. Deliberately
+ * conservative, not a full shell parser.
+ */
+export function extractBashFileAccess(command: string): BashFileAccess {
+  const read: string[] = []
+  const write: string[] = []
+
+  // 1. Redirect targets. Handles `> file` and `>file`, optional fd prefix
+  //    (`2>`, `&>`). Heredocs (`<<`) and fd-dup targets (`2>&1`) are skipped —
+  //    their "target" is a delimiter or file descriptor, not a path.
+  const redirectRe = /(?:^|[\s;|&])([0-9]*&?)?(>>|<<|<|>)\s*([^\s;|&<>]+)/g
+  let m: RegExpExecArray | null
+  while ((m = redirectRe.exec(command)) !== null) {
+    const op = m[2]!
+    if (op === '<<') continue // heredoc delimiter
+    const target = stripQuotes(m[3]!)
+    if (op === '<') read.push(target)
+    else write.push(target)
+  }
+
+  // 2. Reader/writer command arguments (non-flag args are candidate paths),
+  //    recursing into `$(...)` / backtick substitutions.
+  scanReaderWriterCommands(command, read, write)
+
+  return { read: uniq(read), write: uniq(write) }
+}
+
+/** Extract the inner commands of `$(...)` and backtick substitutions. */
+function extractSubstitutions(command: string): string[] {
+  const inners: string[] = []
+  let m: RegExpExecArray | null
+  // `$(...)` — non-nested groups; deeper nesting is handled by the recursion
+  // in scanReaderWriterCommands (each level is extracted on the next pass).
+  const dollarParen = /\$\(([^()]*)\)/g
+  while ((m = dollarParen.exec(command)) !== null) inners.push(m[1]!)
+  const backtick = /`([^`]*)`/g
+  while ((m = backtick.exec(command)) !== null) inners.push(m[1]!)
+  return inners
+}
+
+/**
+ * Detect reader/writer commands at the front of each shell segment and recurse
+ * into command substitutions, so `echo $(cat .git-credentials)` is caught.
+ */
+function scanReaderWriterCommands(command: string, read: string[], write: string[]): void {
+  for (const seg of splitShellSegments(command)) {
+    const tokens = seg.split(/\s+/).filter(Boolean)
+    if (tokens.length > 0) {
+      const base = (tokens[0] || '').split('/').pop() || ''
+      const args = tokens.slice(1)
+      if (READER_COMMANDS.has(base)) {
+        // `sed -i` / `perl -i` read AND write their file args.
+        const inPlace = args.some((a) => a === '-i' || a.startsWith('--in-place'))
+        for (const arg of args) {
+          if (arg.startsWith('-')) continue
+          const p = stripQuotes(arg)
+          read.push(p)
+          if (inPlace) write.push(p)
+        }
+      } else if (WRITER_COMMANDS.has(base)) {
+        for (const arg of args) {
+          if (arg.startsWith('-')) continue
+          write.push(stripQuotes(arg))
+        }
+      }
+    }
+    for (const inner of extractSubstitutions(seg)) {
+      scanReaderWriterCommands(inner, read, write)
+    }
+  }
+}
+
 // Match a tool(parameter) rule against an actual tool call.
 //
 // Pattern formats:
@@ -25,12 +201,24 @@ export function matchBashRule(
 
   const [, baseTool, subPattern] = parenMatch
 
+  // A Read/Write/Edit rule must also refuse a Bash command that touches the
+  // same file (via a reader/editor command or a redirect), not only the
+  // Read/Write/Edit tool itself. Otherwise `cat .git-credentials` bypasses a
+  // `Read(.git-credentials)` deny rule.
+  if (toolName === 'Bash' && (baseTool === 'Read' || baseTool === 'Write' || baseTool === 'Edit')) {
+    const cmd = String(toolInput.command || '')
+    const access = extractBashFileAccess(cmd)
+    const paths = baseTool === 'Read' ? access.read : access.write
+    return paths.some((p) => matchPath(p, subPattern!))
+  }
+
   if (toolName !== baseTool!) return false
 
-  // For Bash: match against the command string
+  // For Bash: match against the command string (any segment of a compound
+  // command — `rm -rf /` buried in `foo && rm -rf /` still matches).
   if (baseTool === 'Bash') {
     const cmd = String(toolInput.command || '')
-    return wildcardMatch(subPattern!, cmd.trim())
+    return splitShellSegments(cmd).some((seg) => wildcardMatch(subPattern!, seg))
   }
 
   // For Write/Edit/Read: match against the file_path with path-glob semantics.

package/src/i18n-core/locales/en-US.json

@@ -235,6 +235,7 @@
       "title": "── Token Usage (estimated) ──",
       "context_tokens": "Context tokens:",
       "usage": "Usage:",
+      "prompt_cache": "Prompt cache: ~{cached} cached ({ratio}% hit) · ~{uncached} uncached",
       "footer": "Token counting is approximate (chars/4).\nActual API usage depends on provider and model."
     },
     "model": {
@@ -415,7 +416,10 @@
       "gc_done": "Done. Archived files moved to ~/.mipham/memory/archive/",
       "consolidate_title": "─ Memory Consolidate ─",
       "consolidate_none": "No auto-* memories to consolidate.",
-      "consolidate_result": "Consolidated: {removed} auto-* removed, {merged} lessons written."
+      "consolidate_result": "Consolidated: {removed} auto-* removed, {merged} lessons written.",
+      "dedup_title": "─ Memory Near-Duplicates ─",
+      "dedup_none": "No near-duplicate memories found.",
+      "dedup_footer": "Pairs above the TF-IDF cosine threshold. Merge is manual — run /memory consolidate for auto-* clustering, or edit the files directly."
     },
     "upgrade": {
       "uptodate": "── Upgrade Mipham Code ──\n\nCurrent version: v{current}\nLatest:          v{latest}\n\n✓ Already up to date.\n\nTo check manually: https://www.npmjs.com/package/@miphamai/cli",

package/src/i18n-core/locales/zh-CN.json

@@ -235,6 +235,7 @@
       "title": "── Token 用量（估算）──",
       "context_tokens": "上下文 Token:",
       "usage": "使用率:",
+      "prompt_cache": "Prompt 缓存: ~{cached} 命中 ({ratio}% hit) · ~{uncached} 未命中",
       "footer": "Token 计数为近似值（字符数/4）。\n实际 API 用量取决于提供商和模型。"
     },
     "model": {
@@ -415,7 +416,10 @@
       "gc_done": "完成。归档文件已移到 ~/.mipham/memory/archive/",
       "consolidate_title": "─ 记忆合并 ─",
       "consolidate_none": "没有需要合并的 auto-* 记忆。",
-      "consolidate_result": "合并完成：删除 {removed} 条 auto-*，写入 {merged} 条 lesson-*。"
+      "consolidate_result": "合并完成：删除 {removed} 条 auto-*，写入 {merged} 条 lesson-*。",
+      "dedup_title": "─ 记忆近重复 ─",
+      "dedup_none": "未发现近重复记忆。",
+      "dedup_footer": "以上为 TF-IDF 余弦超过阈值的近重复对。合并需手动——auto-* 走 /memory consolidate 聚簇，或直接编辑文件。"
     },
     "upgrade": {
       "uptodate": "── 升级 Mipham Code ──\n\n当前版本: v{current}\n最新版本:          v{latest}\n\n✓ 已是最新版本。\n\n手动检查: https://www.npmjs.com/package/@miphamai/cli",

package/src/providers/openai-compat.ts

@@ -96,11 +96,12 @@ export class OpenAICompatProvider implements ProviderInstance {
         if (data === '[DONE]') {
           // Emit any pending tool calls before stopping
           for (const [, tc] of pendingToolCalls) {
+            if (!tc.name) continue // drop malformed tool call (missing name)
             yield {
               type: 'tool_use',
               toolUse: {
                 type: 'tool_use',
-                id: tc.id,
+                id: tc.id || `call_${Date.now()}`,
                 name: tc.name,
                 input: this.safeParseJson(tc.arguments),
               },
@@ -155,6 +156,7 @@ export class OpenAICompatProvider implements ProviderInstance {
           if (choice.finish_reason === 'tool_calls') {
             // Emit fully accumulated tool calls
             for (const [, tc] of pendingToolCalls) {
+              if (!tc.name) continue // drop malformed tool call (missing name)
               yield {
                 type: 'tool_use',
                 toolUse: {

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.70.0' as const
+export const PACKAGE_VERSION = '0.72.0' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/tools/exec/bash.ts

@@ -130,7 +130,10 @@ export function isBlocked(command: string): string | null {
 
   // Detect dangerous git operations invoked via Bash — anywhere in the command,
   // so `echo ok && git push --force` is still caught (not just `^git`).
-  if (/(?:^|[\s;&|])(?:sudo\s+)?(?:git|gh)\s+/.test(normalized)) {
+  // `gh` is deliberately NOT scanned: DANGEROUS_GIT_PATTERNS are all git
+  // subcommands (push/reset/clean/…), and scanning `gh` only produced false
+  // positives (e.g. `gh issue create --body "...git config user.name..."`).
+  if (/(?:^|[\s;&|])(?:sudo\s+)?git\s+/.test(normalized)) {
     for (const { pattern, description } of DANGEROUS_GIT_PATTERNS) {
       if (pattern.test(normalized)) {
         return `Dangerous git command blocked: "${description}". Run manually if intended.`

package/src/tools/network/web-fetch.ts

@@ -276,7 +276,7 @@ export const webFetchTool: ToolDefinition = {
       const message =
         err instanceof Error && err.name === 'AbortError'
           ? 'Request timed out (30s)'
-          : `Fetch failed: ${String(err)}`
+          : `Fetch failed: ${String(err)}. If direct network is blocked, retry via the web-access skill (CDP through the user's logged-in Chrome).`
       return { success: false, content: '', error: message }
     }
   },

package/src/tools/network/web-search.ts

@@ -126,6 +126,8 @@ export const webSearchTool: ToolDefinition = {
           'Alternatives (add API key for any):',
           '   TAVILY_API_KEY   — https://tavily.com',
           '   SERPAPI_API_KEY  — https://serpapi.com',
+          '',
+          'No API key? Use the web-access skill (CDP through your logged-in Chrome) for live web search.',
         ].join('\n'),
       }
     }
@@ -199,7 +201,7 @@ export const webSearchTool: ToolDefinition = {
       const message =
         err instanceof Error && err.name === 'AbortError'
           ? 'Search timed out (15s). Try a more specific query.'
-          : `Search failed: ${String(err)}`
+          : `Search failed: ${String(err)}. If direct network is blocked, retry via the web-access skill (CDP through the user's logged-in Chrome).`
       return { success: false, content: '', error: message }
     }
   },

package/src/ui/commands.ts

@@ -400,11 +400,20 @@ const statusCmd: CommandHandler = async (ctx) => {
 const costCmd: CommandHandler = (ctx) => {
   const t = resolveT(ctx)
   const tokens = ctx.engine.getContext().getEstimatedTokens()
+  const cacheStatus = ctx.engine.getContext().getCacheStatus()
+  const cachedTokens = cacheStatus.cachedTokens
+  const hitRatio = tokens > 0 ? Math.min(1, cachedTokens / tokens) : 0
+  const uncachedTokens = Math.max(0, tokens - cachedTokens)
   return {
     content: stripIndent`
       ${t('commands.context_tokens.title')}
       ${t('commands.context_tokens.context_tokens')} ~${tokens.toLocaleString()} / 200,000
       ${t('commands.context_tokens.usage')} ${((tokens / 200_000) * 100).toFixed(1)}%
+      ${t('commands.context_tokens.prompt_cache', {
+        cached: cachedTokens.toLocaleString(),
+        ratio: (hitRatio * 100).toFixed(1),
+        uncached: uncachedTokens.toLocaleString(),
+      })}
 
       ${t('commands.context_tokens.footer')}
     `,
@@ -4086,6 +4095,23 @@ const memoryCmd: CommandHandler = async (ctx, args) => {
     return { content: lines.join('\n') }
   }
 
+  // /memory dedup — 只读近重复报告：列出 TF-IDF 余弦 > 阈值的近重复对，用户决定是否合并
+  if (args[0]?.toLowerCase() === 'dedup') {
+    const mm = getMemoryManager()
+    const pairs = mm.listNearDuplicates()
+    const lines: string[] = [t('commands.memories.dedup_title'), '']
+    if (pairs.length === 0) {
+      lines.push(t('commands.memories.dedup_none'))
+    } else {
+      for (const { a, b, similarity } of pairs) {
+        lines.push(`  ${a} ↔ ${b}  (${(similarity * 100).toFixed(0)}%)`)
+      }
+      lines.push('')
+      lines.push(t('commands.memories.dedup_footer'))
+    }
+    return { content: lines.join('\n') }
+  }
+
   if (!existsSync(memoryDir)) {
     return { content: t('commands.memories.no_memories') }
   }
@@ -4495,6 +4521,14 @@ const mcpCmd: CommandHandler = async (ctx, args) => {
       }
     }
     const via = config.url ? 'HTTP' : 'stdio'
+    if (config.url) {
+      const headerKeys = config.headers ? Object.keys(config.headers) : []
+      const headerLine = headerKeys.length > 0 ? `\nHeaders to send: ${headerKeys.join(', ')}` : ''
+      return {
+        content: `── MCP Connect: ${name} ──\n\nConnecting via HTTP\nURL: ${config.url}${headerLine}\n\n⚠️ Verify the URL — any configured headers (e.g. Authorization) will be sent to this server.`,
+        forwardToAI: `Connect to MCP server "${name}" using McpClient.getInstance().connect(config), then register its tools. Report the result.`,
+      }
+    }
     return {
       content: `── MCP Connect: ${name} ──\n\nConnecting via ${via}...`,
       forwardToAI: `Connect to MCP server "${name}" using McpClient.getInstance().connect(config), then register its tools. Report the result.`,