@miphamai/cli 0.81.5 → 0.81.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.81.5",
+  "version": "0.81.6",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/core/engine.ts

@@ -193,6 +193,19 @@ export class QueryEngine {
     this.effort = level
   }
 
+  /**
+   * Forget which files the Read tool has loaded.
+   *
+   * The read-before-write guard (`tools/file/write.ts`) refuses to overwrite a
+   * file this session has not read. That record is per-conversation, so it has
+   * to be dropped whenever the conversation is not the same one anymore —
+   * `/clear` and `/resume` both replace the message history. Carrying it over
+   * let a fresh conversation silently overwrite a file it had never read.
+   */
+  resetFileTracking(): void {
+    this.readFiles.clear()
+  }
+
   /** Set the session identifier (called from index.tsx at startup with the actual session name). */
   setSessionId(id: string): void {
     this.sessionId = id

package/src/core/permission-rules.ts

@@ -43,6 +43,30 @@ const READER_COMMANDS = new Set([
   'view',
   'zcat',
   'bzcat',
+  // Text formatters/transforms that take an input file and write to stdout.
+  // These were missing, so `Read(secret)` was bypassed by `fmt secret` /
+  // `column -t secret` — the file sits after the command's own options.
+  'fmt',
+  'column',
+  'pr',
+  'fold',
+  'expand',
+  'unexpand',
+  'rev',
+  'look',
+  'bat',
+  // Structured readers and byte-level utilities that read their file argument.
+  'jq',
+  'yq',
+  'base64',
+  'md5sum',
+  'sha1sum',
+  'sha256sum',
+  'shasum',
+  'cksum',
+  'sum',
+  'cmp',
+  'iconv',
 ])
 
 /** Commands that write/modify a file (bypass Write()/Edit() rules today). */

package/src/daemon/remote-engine.ts

@@ -227,6 +227,9 @@ export class RemoteEngine {
   /** No-op: reasoning effort is managed by the daemon session. */
   setEffort(_level: string): void {}
 
+  /** No-op: file-read tracking lives with the daemon's own engine. */
+  resetFileTracking(): void {}
+
   /** Remote mode has no local agent registry. */
   getAgentRegistry(): undefined {
     return undefined

package/src/mcp/client.ts

@@ -31,6 +31,16 @@ function connectTimeoutMs(): number {
   return Number.isFinite(env) && env > 0 ? env : DEFAULT_CONNECT_TIMEOUT_MS
 }
 
+// A server may emit `notifications/tools/list_changed` once per tool it adds, or
+// in a tight loop. Each notification used to trigger its own `tools/list` round
+// trip plus a full downstream re-registration, so a burst produced sustained CPU
+// and a re-registration storm. Notifications are coalesced into one refresh per
+// window instead.
+const TOOLS_CHANGED_DEBOUNCE_MS = 250
+// Ceiling on the coalescing window — a server that notifies without pause would
+// otherwise keep pushing the refresh out forever.
+const TOOLS_CHANGED_MAX_DELAY_MS = 2_000
+
 interface ActiveConnection {
   config: McpServerConfig
   transport: Transport
@@ -39,6 +49,14 @@ interface ActiveConnection {
   tools: ToolDefinition[]
   serverInfo?: { name: string; version: string }
   error?: string
+  /** Coalescing timer for `tools/list_changed` (see scheduleToolsRefresh). */
+  toolsRefreshTimer?: ReturnType<typeof setTimeout>
+  /** When the last refresh started — caps the coalescing window. */
+  toolsRefreshedAt?: number
+  /** A `tools/list` round trip is in flight. */
+  toolsRefreshInFlight?: boolean
+  /** A notification arrived mid-flight: run exactly one more refresh after. */
+  toolsRefreshQueued?: boolean
 }
 
 /**
@@ -96,8 +114,19 @@ export class McpClient {
     })
   }
 
-  /** Handle tools/list_changed notification — diff and re-register. */
-  async onToolsChanged(name: string): Promise<void> {
+  /**
+   * Handle a `tools/list_changed` notification — diff and re-register.
+   *
+   * Returns immediately: the actual `tools/list` round trip is coalesced
+   * (see `scheduleToolsRefresh`), so a burst of notifications does not fan out
+   * into a burst of round trips.
+   */
+  onToolsChanged(name: string): void {
+    this.scheduleToolsRefresh(name)
+  }
+
+  /** Fetch the tool list and emit `tools-changed` when it actually differs. */
+  private async applyToolsChanged(name: string): Promise<void> {
     const connection = this.connections.get(name)
     if (!connection || connection.status !== 'connected') return
 
@@ -115,6 +144,70 @@ export class McpClient {
     }
   }
 
+  /**
+   * Coalesce a `tools/list_changed` notification into a single refresh.
+   *
+   * Rapid notifications (one per added tool, or a server stuck in a loop) become
+   * one `tools/list` round trip per window rather than one each. The window is
+   * capped by `TOOLS_CHANGED_MAX_DELAY_MS` so a server that never stops notifying
+   * still gets refreshed at a bounded rate instead of being starved forever.
+   */
+  private scheduleToolsRefresh(name: string): void {
+    const connection = this.connections.get(name)
+    if (!connection || connection.status !== 'connected') return
+
+    if (connection.toolsRefreshInFlight) {
+      // Don't drop a change that landed during the round trip — queue one more.
+      connection.toolsRefreshQueued = true
+      return
+    }
+    if (connection.toolsRefreshTimer) return // already scheduled in this window
+
+    const elapsed = Date.now() - (connection.toolsRefreshedAt ?? 0)
+    const delay = Math.min(
+      TOOLS_CHANGED_DEBOUNCE_MS,
+      Math.max(0, TOOLS_CHANGED_MAX_DELAY_MS - elapsed),
+    )
+
+    const timer = setTimeout(() => {
+      connection.toolsRefreshTimer = undefined
+      void this.runToolsRefresh(name)
+    }, delay)
+    // Housekeeping only — it must not hold the CLI process open.
+    timer.unref()
+    connection.toolsRefreshTimer = timer
+  }
+
+  /** Run a coalesced refresh, then drain a notification that arrived mid-flight. */
+  private async runToolsRefresh(name: string): Promise<void> {
+    const connection = this.connections.get(name)
+    if (!connection || connection.status !== 'connected') return
+
+    connection.toolsRefreshedAt = Date.now()
+    connection.toolsRefreshInFlight = true
+    try {
+      await this.applyToolsChanged(name)
+    } finally {
+      // Re-read: the server may have been disconnected while we were awaiting.
+      const current = this.connections.get(name)
+      if (current) {
+        current.toolsRefreshInFlight = false
+        if (current.toolsRefreshQueued) {
+          current.toolsRefreshQueued = false
+          this.scheduleToolsRefresh(name)
+        }
+      }
+    }
+  }
+
+  /** Drop any pending refresh state for a connection being torn down. */
+  private cancelToolsRefresh(connection: ActiveConnection): void {
+    if (connection.toolsRefreshTimer) clearTimeout(connection.toolsRefreshTimer)
+    connection.toolsRefreshTimer = undefined
+    connection.toolsRefreshQueued = false
+    connection.toolsRefreshInFlight = false
+  }
+
   /** Reconnect with exponential backoff (1s→2s→4s→…max 60s, 10 attempts). */
   async reconnect(name: string): Promise<void> {
     const connection = this.connections.get(name)
@@ -132,6 +225,9 @@ export class McpClient {
         } catch {
           /* ok */
         }
+        // A pending refresh timer would outlive this connection and re-fire
+        // against the replacement registered under the same name.
+        this.cancelToolsRefresh(connection)
         this.connections.delete(name)
 
         await this.connect(config)
@@ -188,9 +284,9 @@ export class McpClient {
         connection.status = 'connected'
         connection.serverInfo = initResult.serverInfo
 
-        // Wire tools-changed notification
-        protocol.on('tools-changed', async () => {
-          await this.onToolsChanged(config.name)
+        // Wire tools-changed notification (coalesced — see scheduleToolsRefresh)
+        protocol.on('tools-changed', () => {
+          this.scheduleToolsRefresh(config.name)
         })
 
         // Discover tools
@@ -241,6 +337,7 @@ export class McpClient {
     const conn = this.connections.get(name)
     if (!conn) return []
 
+    this.cancelToolsRefresh(conn)
     try {
       conn.transport.close()
     } catch {
@@ -254,8 +351,10 @@ export class McpClient {
   async closeAll(): Promise<void> {
     const names = Array.from(this.connections.keys())
     for (const name of names) {
+      const conn = this.connections.get(name)
+      if (conn) this.cancelToolsRefresh(conn)
       try {
-        await this.connections.get(name)?.transport.close()
+        await conn?.transport.close()
       } catch {
         /* best effort */
       }

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.81.5' as const
+export const PACKAGE_VERSION = '0.81.6' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/ui/app.tsx

@@ -927,6 +927,13 @@ export function App({
           if (result.nextProvider) setProviderId(result.nextProvider)
           if (result.nextModel) setModelId(result.nextModel)
           if (result.exit) process.exit(0)
+          if (result.clearMessages || (result.forwardedMessages?.length ?? 0) > 0) {
+            // The conversation this session is looking at just changed (/clear,
+            // /resume) — the read-before-write record belongs to the old one.
+            // Clearing is the fail-closed direction: an unread file must be
+            // re-read rather than silently overwritten.
+            engine.resetFileTracking()
+          }
           if (result.forwardedMessages && result.forwardedMessages.length > 0) {
             const restored: ChatMessage[] = result.forwardedMessages.map((msg) => ({
               role: msg.role,