@miphamai/cli 0.73.0 → 0.74.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.73.0",
+  "version": "0.74.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/core/eval-harness.ts

@@ -70,6 +70,7 @@ export const ANCHOR_CONTRACT_IDS: ReadonlySet<string> = new Set([
   'red-team-zero-gaps',
   'producer-rule-shape',
   'producer-rule-idempotent',
+  'self-report-diagnostic',
 ])
 
 /** 细粒度防回退：返回 role==='anchor' 且已 FAIL 的契约 id。空 = 无 anchor 回退。 */
@@ -333,6 +334,21 @@ export function runEval(): EvalReport {
     results.push({ ...judgeBehaviorTask(task, ruleEngine), role: 'target' })
   }
 
+  // ── 自报分数只作诊断：评分路径无 LLM，分数来自 ground-truth 契约而非模型自报 ──
+  // anchor 锁死「评分组件不暴露 LLM 的 chat 能力」。4 个组件（ruleEngine/constitution/
+  // errorDB/preflight）都是确定性组件（runEval 同步评分）。若未来有人把 LLM 注入评分
+  // 路径（给组件挂 chat / Llm 接口），此契约立即 FAIL，anchor gate 拒绝固化——即「自报
+  // 分数不可信」的机器可判定信号。
+  const scoringComponents = [ruleEngine, constitution, errorDB, preflight]
+  const llmInjected = scoringComponents.some(
+    (c) => typeof (c as { chat?: unknown }).chat === 'function',
+  )
+  results.push({
+    id: 'self-report-diagnostic',
+    description: '评分无 LLM：机制哨兵组件不暴露 chat 能力（分数只来自 ground-truth，非模型自报）',
+    passed: !llmInjected,
+  })
+
   // 角色标注：anchor 走集中清单（门保护面单一真源），target 已在上方循环内联。
   for (const r of results) {
     if (ANCHOR_CONTRACT_IDS.has(r.id)) r.role = 'anchor'

package/src/i18n-core/locales/en-US.json

@@ -780,7 +780,7 @@
   "ui": {
     "banner": {
       "title": "Mipham Code",
-      "subtitle": "AI-Powered Programming Assistant",
+      "subtitle": "AI-Powered Super Agent",
       "tagline": "Multi-model / Multi-provider / Skills & Tools / Open-core",
       "start_message": "Type a message to start. /help for commands",
       "controls_hint": "Ctrl+P pick model · Esc to exit",

package/src/i18n-core/locales/zh-CN.json

@@ -780,7 +780,7 @@
   "ui": {
     "banner": {
       "title": "Mipham Code",
-      "subtitle": "AI 驱动的编程助手",
+      "subtitle": "AI 驱动的超级智能体",
       "tagline": "多模型 / 多提供商 / 技能与工具 / 开源核心",
       "start_message": "输入消息开始。 /help 查看命令",
       "controls_hint": "Ctrl+P 选择模型 · Esc 退出",

package/src/index.tsx

@@ -630,6 +630,28 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   // Auto-save session on exit
   let saved = false
+
+  // Persist the current session under its real name. Shared by saveAndExit and
+  // the process 'exit' safety net — the two paths must stay identical, or the
+  // session gets saved under a different (timestamped) name and /resume breaks.
+  const persistSession = () => {
+    if (context.getMessageCount() === 0) return
+    const log = context.getLog()
+    if (log) {
+      SessionStore.saveLog(sessionName, log, {
+        provider: defaultProvider,
+        model: defaultModel,
+        cwd: process.cwd(),
+      })
+    } else {
+      SessionStore.save(sessionName, context.getMessages(), {
+        provider: defaultProvider,
+        model: defaultModel,
+        cwd: process.cwd(),
+      })
+    }
+  }
+
   const saveAndExit = () => {
     saved = true
     clearInterval(heartbeatInterval)
@@ -637,22 +659,7 @@ export async function runApp(options: RunOptions): Promise<void> {
     // P2-1: Trigger SessionEnd hooks before cleanup (best-effort)
     hookEngine.executeSessionEnd(sessionName).catch(() => {})
     artifactServer.stop()
-    if (context.getMessageCount() > 0) {
-      const log = context.getLog()
-      if (log) {
-        SessionStore.saveLog(sessionName, log, {
-          provider: defaultProvider,
-          model: defaultModel,
-          cwd: process.cwd(),
-        })
-      } else {
-        SessionStore.save(sessionName, context.getMessages(), {
-          provider: defaultProvider,
-          model: defaultModel,
-          cwd: process.cwd(),
-        })
-      }
-    }
+    persistSession()
     // Finalize the session — write session summary + flush CRSI effectiveness
     // (evaluate rules and apply auto-degrade/disable). Best-effort: the
     // self-improvement closeout must never block session exit.
@@ -667,27 +674,25 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   process.on('SIGINT', saveAndExit)
   process.on('SIGTERM', saveAndExit)
+  // Terminal close / SSH disconnect sends SIGHUP (not SIGINT/SIGTERM); without
+  // a handler the session log is silently dropped on those paths.
+  process.on('SIGHUP', saveAndExit)
 
-  // Safety net: auto-save on exit for paths that bypass saveAndExit
+  // Safety net: persist on exit for paths that bypass saveAndExit (e.g. /exit
+  // and /quit call process.exit(0) directly). saveAndExit already persists;
+  // guard on !saved to avoid double-writing.
   process.on('exit', () => {
     clearInterval(heartbeatInterval)
     unregisterSession(sessionName)
     // Finalize the session on non-interactive exit paths
-    // (daemon worker / crash / kill) that bypass saveAndExit. saveAndExit
-    // already finalizes; guard on !saved to avoid double-evaluating.
+    // (daemon worker / crash / kill) that bypass saveAndExit.
     if (!saved) {
       try {
         engine.getAutoMemory().finalizeSession()
       } catch {
         // ignore — CRSI closeout is non-critical
       }
-    }
-    if (!saved && context.getMessageCount() > 0) {
-      SessionStore.autoSave(context.getMessages(), {
-        provider: defaultProvider,
-        model: defaultModel,
-        cwd: process.cwd(),
-      })
+      persistSession()
       // Distill learnings from the last 5 user messages into memory
       const allMessages = context.getMessages()
       const userMessages = allMessages

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.73.0' as const
+export const PACKAGE_VERSION = '0.74.0' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/tools/file/grep.ts

@@ -1,3 +1,5 @@
+import { homedir } from 'node:os'
+import { parse } from 'node:path'
 import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
 import { resolveSafe } from '../../security/path'
 import type { Service } from '../../vajra'
@@ -37,6 +39,15 @@ export function truncateGrepOutput(stdout: string): string {
   return `${out.slice(0, GREP_MAX_OUTPUT_CHARS)}\n\n... (truncated)`
 }
 
+/**
+ * 判断搜索根是否是「顶层目录」（家目录或文件系统根）。这类范围扫描的是海量
+ * 文件树（macOS ~/Library 有数百万受保护文件），会让 rg exit 2、find 回退卡
+ * 满 120s。顶层范围应 fail-fast，让模型指定项目目录，而不是静默全盘扫。
+ */
+export function isTopLevelScope(searchPath: string, home = homedir()): boolean {
+  return searchPath === home || searchPath === parse(searchPath).root
+}
+
 export function createGrepTool(credentialConfig?: CredentialMaskingConfig): ToolDefinition {
   return {
     name: 'Grep',
@@ -65,6 +76,20 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
       const searchPath = resolveSafe(ctx.cwd, (params.path as string) || '.')
       const include = params.include as string | undefined
 
+      // Scope guard: a top-level search root (home or filesystem root) scans an
+      // enormous tree and stalls the find fallback for minutes. Fail fast and
+      // ask for a project-scoped path instead of silently scanning everything.
+      if (!params.path && isTopLevelScope(searchPath)) {
+        return {
+          success: false,
+          content: '',
+          error:
+            `Search scope is the home directory / filesystem root (${searchPath}) — too large ` +
+            'and contains protected directories. Specify a project directory with "path", ' +
+            'or cd into the project first.',
+        }
+      }
+
       // 1. ripgrep (fast path)
       const rgArgs = ['rg', '-n', '--heading', '--color=never', '-M', '500', pattern]
       if (include) rgArgs.push('--glob', include)
@@ -85,9 +110,30 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
             content: maskSearchOutput(stdout || '(no matches)', credentialConfig, 'heading'),
           }
         }
-        // rg exit 2 (error) or null (killed) → fall through to grep
+        // rg exit 2 (error, e.g. permission denied on protected dirs) — do NOT
+        // fall back to the slow `find -type f` scan (it hits the same unreadable
+        // paths and stalls on huge trees). Return partial matches if any, else
+        // a clear narrow-scope error.
+        if (stdout && stdout.trim()) {
+          return {
+            success: true,
+            content: maskSearchOutput(
+              stdout +
+                '\n\n(rg exited 2 — some paths unreadable; narrow scope for complete results)',
+              credentialConfig,
+              'heading',
+            ),
+          }
+        }
+        return {
+          success: false,
+          content: '',
+          error:
+            'rg error (exit 2) — likely permission denied on a large/protected tree. ' +
+            'Narrow scope with "path" (project directory) and "include".',
+        }
       } catch {
-        // rg not installed → fall through to grep
+        // rg not installed → fall through to grep (find + grep fallback)
       }
 
       // 2. fallback: `find -type f -exec grep -Hn {} +`

package/src/ui/input.tsx

@@ -1,6 +1,5 @@
 import React, { useState, useEffect, useRef, useMemo } from 'react'
 import { Box, Text, useInput } from 'ink'
-import TextInput from 'ink-text-input'
 import { getCommandList } from './commands.js'
 import { CommandPicker } from './command-picker.js'
 import { useI18n } from '../i18n-context'
@@ -80,11 +79,11 @@ function pick<T>(arr: T[]): T {
 }
 
 /**
- * 判断一次输入是否为「批量」（长度跳变 >1：粘贴 / IME 替换）。
- * 批量输入需节流防渲染风暴；普通单字符输入应立即显示，无节流延迟。
+ * 归一化输入：多行粘贴折叠成单行（CR/LF/Tab → 空格）。
+ * ink-text-input 是单行组件，嵌入的 \r 会拉回行首覆盖显示、\n 会 trap 光标。
  */
-export function isBulkInput(prev: string, next: string): boolean {
-  return Math.abs(next.length - prev.length) > 1
+export function normalizeInput(input: string): string {
+  return input.replace(/[\r\n\t]+/g, ' ')
 }
 
 /** True when typing a leading `/` should auto-open the slash-command picker. */
@@ -92,6 +91,81 @@ export function shouldAutoOpenPicker(value: string, prevValue: string, enabled:
   return enabled && value.startsWith('/') && !prevValue.startsWith('/')
 }
 
+/**
+ * Mipham 自有的单行文本输入，替代 ink-text-input。
+ *
+ * 为什么不用 ink-text-input：它把粘贴按「光标偏移切片插入」逐块处理，而
+ * cursorOffset 与受控 value 都来自渲染闭包——Ink 会把长粘贴按 stdin read()
+ * 边界拆成多块，同一轮 synchronous flush 里后续块读到的仍是旧值，于是「覆盖
+ * 前块 / 插到中段」，表现为粘贴内容乱序、丢失、冻住。
+ *
+ * 这里用 ref 做同步真值：每块按当前 ref 原子追加（光标恒在末尾），不依赖
+ * React 渲染时序，分块粘贴自然累积成完整文本。
+ */
+function MiphamTextInput({
+  value,
+  onChange,
+  onSubmit,
+  placeholder = '',
+  focus = true,
+}: {
+  value: string
+  onChange: (next: string) => void
+  onSubmit: (value: string) => void
+  placeholder?: string
+  focus?: boolean
+}) {
+  // 同步真值：valueRef 永远是最新文本；受控 value 仅在渲染时落后于 ref。
+  const valueRef = useRef(value)
+
+  // 外部改动（箭头历史回填、提交清空）时，把真值对齐回受控 prop。
+  useEffect(() => {
+    valueRef.current = value
+  }, [value])
+
+  useInput(
+    (input, key) => {
+      if (!focus) return
+      // 上行/下行/制表/Ctrl 由 InputBar 自己的 useInput 处理（历史导航、热键）。
+      if (key.upArrow || key.downArrow || key.tab || (key.shift && key.tab) || key.ctrl) return
+
+      if (key.return) {
+        onSubmit(valueRef.current)
+        return
+      }
+      if (key.backspace || key.delete) {
+        if (valueRef.current.length > 0) {
+          const next = valueRef.current.slice(0, -1)
+          valueRef.current = next
+          onChange(next)
+        }
+        return
+      }
+
+      // 打字 / 粘贴：归一化控制符后原子追加（光标恒在末尾）。
+      const cleaned = normalizeInput(input)
+      if (!cleaned) return
+      const next = valueRef.current + cleaned
+      valueRef.current = next
+      onChange(next)
+    },
+    { isActive: focus },
+  )
+
+  return (
+    <Text>
+      {value.length === 0 && placeholder ? (
+        <Text dimColor>{placeholder}</Text>
+      ) : (
+        <>
+          {value}
+          <Text inverse> </Text>
+        </>
+      )}
+    </Text>
+  )
+}
+
 export function InputBar({
   onSubmit,
   isLoading,
@@ -110,10 +184,7 @@ export function InputBar({
   const { t } = useI18n()
   const [value, setValue] = useState('')
   // Ref mirror of value — used by useInput to read latest without stale closure.
-  // Also used by throttled onChange to hold the latest pending value.
   const valueRef = useRef(value)
-  // Throttle timer for onChange — prevents React render floods during paste.
-  const onChangeTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
   const [verb, setVerb] = useState(() => t(pick(LOADING_KEYS)))
   const [completionVerb, setCompletionVerb] = useState<string | null>(null)
   const prevLoading = useRef(isLoading)
@@ -190,15 +261,6 @@ export function InputBar({
     prevLoading.current = isLoading
   }, [isLoading])
 
-  // Track pre-shortcut value so we can revert ink-text-input's Ctrl-key insertions.
-  // ink-text-input inserts 'p'/'f'/'o' for Ctrl+P/F/O (Ink normalizes control chars
-  // to their letter names before passing to useInput).
-  const valueBeforeShortcut = useRef(value)
-  // Keep the ref in sync with state on every change that isn't a Ctrl shortcut revert.
-  useEffect(() => {
-    valueBeforeShortcut.current = value
-  }, [value])
-
   useInput((input, key) => {
     // ── Escape: cancel loading → clear draft ──
     if (key.escape) {
@@ -220,9 +282,9 @@ export function InputBar({
       onCyclePermission?.()
       return
     }
-    // Tab → 接受 ghost-text 建议（复用 Ctrl-key 的 revert 手法）
+    // Tab → 接受 ghost-text 建议
     if (key.tab && !key.shift && suggestion) {
-      const next = valueBeforeShortcut.current + suggestion
+      const next = valueRef.current + suggestion
       setValue(next)
       valueRef.current = next
       setSuggestion(null)
@@ -230,27 +292,22 @@ export function InputBar({
     }
     // Ctrl+P → toggle model picker
     // NOTE: Ink passes input=keypress.name (just 'p') when ctrl is true, not raw \x10.
-    // ink-text-input inserts 'p' as literal text — revert it.
     if (key.ctrl && input === 'p') {
-      setValue(valueBeforeShortcut.current)
       onTogglePicker?.()
       return
     }
     // Ctrl+F → toggle focus mode
     if (key.ctrl && input === 'f') {
-      setValue(valueBeforeShortcut.current)
       onToggleFocus?.()
       return
     }
     // Ctrl+O → expand/collapse last tool call
     if (key.ctrl && input === 'o') {
-      setValue(valueBeforeShortcut.current)
       onToggleExpand?.()
       return
     }
     // Ctrl+G → toggle agent view dashboard
     if (key.ctrl && input === 'g') {
-      setValue(valueBeforeShortcut.current)
       onToggleAgentView?.()
       return
     }
@@ -267,13 +324,7 @@ export function InputBar({
         if (submittedHistory.length === 0) return
         // Save current draft the first time we enter history browsing
         if (historyIndexRef.current === -1) {
-          // Flush any pending throttle so its deferred setValue doesn't overwrite
-          // history navigation (paste → immediate ↑ race). Save the latest value
-          // from the ref — state `value` is stale inside the throttle window.
-          if (onChangeTimerRef.current) {
-            clearTimeout(onChangeTimerRef.current)
-            onChangeTimerRef.current = null
-          }
+          // Save the latest value from the ref — state `value` may lag a render.
           savedDraftRef.current = valueRef.current
         }
         const newIndex = Math.min(historyIndexRef.current + 1, submittedHistory.length - 1)
@@ -319,13 +370,7 @@ export function InputBar({
   }, [value])
 
   const handleSubmit = (val: string) => {
-    // Flush any pending throttled onChange before submitting
-    if (onChangeTimerRef.current) {
-      clearTimeout(onChangeTimerRef.current)
-      onChangeTimerRef.current = null
-    }
-    // Use the latest value from the ref — state lags behind during throttle, and
-    // the onSubmit `val` is the stale controlled prop in that window.
+    // Use the latest value from the ref; `val` is the value passed by MiphamTextInput.
     const finalValue = valueRef.current || val
     if (!finalValue.trim()) return
     // Submitting while a response streams interrupts it (Claude Code parity)
@@ -371,7 +416,7 @@ export function InputBar({
         <Box marginRight={1}>
           <Text color={isLoading ? 'yellow' : 'cyan'}>{'>'}</Text>
         </Box>
-        <TextInput
+        <MiphamTextInput
           value={value}
           onChange={(val) => {
             // Reset history browsing when user starts typing
@@ -379,9 +424,6 @@ export function InputBar({
               historyIndexRef.current = -1
               savedDraftRef.current = ''
             }
-            // Normalize newlines → spaces. ink-text-input is single-line; multi-line
-            // paste would trap arrow-key navigation on the first line.
-            const normalized = val.replace(/\n/g, ' ')
             // ── Ghost-text 自动补全：每次输入清 suggestion + 重排防抖 ──
             setSuggestion(null)
             const suggestionReqId = ++suggestionReqIdRef.current
@@ -389,16 +431,12 @@ export function InputBar({
               clearTimeout(suggestionTimerRef.current)
               suggestionTimerRef.current = null
             }
-            if (
-              llm &&
-              autocompleteEnabled &&
-              shouldAutocomplete(normalized, isLoading, pickerActive)
-            ) {
+            if (llm && autocompleteEnabled && shouldAutocomplete(val, isLoading, pickerActive)) {
               suggestionTimerRef.current = setTimeout(() => {
                 requestSuggestion(
                   llm,
                   recentMessages ?? [],
-                  normalized,
+                  val,
                   () => suggestionReqId !== suggestionReqIdRef.current,
                 )
                   .then((completion) => {
@@ -409,24 +447,8 @@ export function InputBar({
                   })
               }, autocompleteDebounceMs)
             }
-            // 批量输入（paste/IME 替换）节流防渲染风暴；普通单字符输入立即显示，
-            // 避免 33ms trailing 的「慢半拍」尾巴。
-            const bulk = isBulkInput(valueRef.current, normalized)
-            valueRef.current = normalized
-            if (!bulk) {
-              if (onChangeTimerRef.current) {
-                clearTimeout(onChangeTimerRef.current)
-                onChangeTimerRef.current = null
-              }
-              setValue(normalized)
-              return
-            }
-            if (onChangeTimerRef.current) return // timer pending, latest value in ref
-            setValue(normalized)
-            onChangeTimerRef.current = setTimeout(() => {
-              onChangeTimerRef.current = null
-              setValue(valueRef.current)
-            }, 33) // ~30fps
+            valueRef.current = val
+            setValue(val)
           }}
           onSubmit={handleSubmit}
           placeholder={