@miphamai/cli 0.81.6 → 0.81.7

package/src/core/engine.ts

@@ -701,6 +701,7 @@ export class QueryEngine {
         type: 'tool_result',
         tool_use_id: toolUse.id,
         content: result.success ? result.content : result.error || result.content,
+        isError: !result.success,
       }
 
       // Collect tool call record for CRSI auto-reflection
@@ -1040,7 +1041,10 @@ export class QueryEngine {
         yield {
           type: 'tool_result',
           tool_use_id: toolUse.id,
-          content: result.content,
+          // 失败结果的 `content` 是空串（错误在 `error` 里，见 executeTool 的拒绝分支）
+          // —— 直接发 `content` 会让模型收到一个**空** tool_result，错误文案整个丢失。
+          content: result.success ? result.content : result.error || result.content,
+          isError: !result.success,
         }
 
         // DeepSeek V4 thinking mode requires reasoning_content on every assistant message
@@ -1333,7 +1337,15 @@ export class QueryEngine {
     return this.llm
   }
 
-  /** 注入 LLM 适配缝（换 chat 实现）。 */
+  /**
+   * 注入 LLM 适配缝（换 chat 实现）。
+   *
+   * 不变量：**缝 = 与 `registry` 不同的对象**。`chatWithFallback` 靠
+   * `this.llm !== this.registry` 判定「这个缝是否拥有整个 chat 流程」——
+   * 而生产路径注入的恰恰就是 registry 本身（`providers/llm.ts` 的 `mountLlm`
+   * 是原样 `provide(LLM_KEY, llm)`，`index.tsx` 把 `registry` 传了进去）。
+   * 若改成「非空即缝」，provider 回退分支就永远走不到，回退只活在测试里。
+   */
   setLlm(llm: Llm): void {
     this.llm = llm
   }
@@ -1384,8 +1396,11 @@ export class QueryEngine {
     }
 
     // ── Fallback: configured default provider, once ──
-    // 若已注入 Llm 缝，缝拥有整个 chat 流程——不回退（避免切 registry 状态 + 二次调用）
-    if (this.llm) {
+    // 若注入了**异己**的 Llm 缝，缝拥有整个 chat 流程——不回退（避免切 registry 状态 + 二次调用）。
+    // `!== this.registry` 不可省：生产路径注入的正是 registry 自己（`index.tsx` →
+    // `mountLlm(vajraContext, registry)` → `setLlm`），按「非空即缝」判定会让本分支
+    // 在生产恒不可达，而测试里构造引擎时不注入缝 ⇒ 套件全绿也发现不了。
+    if (this.llm && this.llm !== this.registry) {
       yield { type: 'error', error: failure }
       return
     }

package/src/core/metrics.ts

@@ -278,6 +278,9 @@ export class MetricsRegistry {
   /** Tool call counter, labelled by tool_name.  Callers use .inc({tool_name}). */
   readonly toolCalls: Counter
 
+  /** Slash-command counter, labelled by command_name. Callers use .inc({command_name}). */
+  readonly commandCalls: Counter
+
   /** Model API request counter, labelled by provider and model. */
   readonly modelRequests: Counter
 
@@ -308,6 +311,11 @@ export class MetricsRegistry {
 
     this.toolCalls = this.counter('mipham_code_tool_calls_total', 'Number of tool invocations')
 
+    this.commandCalls = this.counter(
+      'mipham_code_command_calls_total',
+      'Number of slash-command invocations',
+    )
+
     this.modelRequests = this.counter(
       'mipham_code_model_requests_total',
       'Number of model API requests',

package/src/core/paths.ts

@@ -0,0 +1,79 @@
+/**
+ * 项目内数据目录的路径单一真源。
+ *
+ * 写入一律落在 `.mipham/`（我们自己的目录）；`.claude/` 只保留**只读兼容** ——
+ * 早期版本把 worktree 建在 `.claude/worktrees/` 下，那些工作树今天仍要可列举、
+ * 可退出、可隔离。因此隔离判据必须同时认两个前缀：只认新前缀会让旧工作树
+ * 突然失去隔离保护（隔离度只许增不许减）。
+ */
+
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { MIPHAM_DIR } from '../shared/constants.ts'
+
+/** 只读兼容目录名。 */
+export const LEGACY_CLAUDE_DIR = '.claude'
+
+/**
+ * worktree 的识别标记（含结尾斜杠），新前缀在前。
+ * 用于从 `cwd` 反推 worktree 所属的项目根。
+ */
+export const WORKTREE_MARKERS = [
+  `${MIPHAM_DIR}/worktrees/`,
+  `${LEGACY_CLAUDE_DIR}/worktrees/`,
+] as const
+
+/** 新建 worktree 的根目录（绝对路径）。 */
+export function worktreeRoot(cwd: string): string {
+  return join(cwd, MIPHAM_DIR, 'worktrees')
+}
+
+/** 历史与当前的全部 worktree 根目录，写入根在前。 */
+export function worktreeRoots(cwd: string): string[] {
+  return [worktreeRoot(cwd), join(cwd, LEGACY_CLAUDE_DIR, 'worktrees')]
+}
+
+/**
+ * 在 `cwd` 中定位 worktree 标记，返回项目根与命中的标记。
+ * 不在任何 worktree 内时返回 null。
+ */
+/**
+ * Locate the project root by looking for a worktree marker in `cwd`.
+ *
+ * The returned `root` has no trailing separator: callers compose it as
+ * `root + '/'` for a prefix compare, and a trailing slash there would make
+ * the pattern `${root}//` match nothing.
+ */
+export function findWorktreeMarker(cwd: string): { root: string; marker: string } | null {
+  for (const marker of WORKTREE_MARKERS) {
+    const index = cwd.indexOf(marker)
+    if (index !== -1) return { root: cwd.substring(0, index).replace(/\/+$/, ''), marker }
+  }
+  return null
+}
+
+/**
+ * 新建 workflow 脚本的目录（绝对路径）。与 worktree 同理：写入落在 `.mipham/`。
+ *
+ * 注意别与**运行产物**目录混淆：`~/.mipham/workflows/<runId>/`（见
+ * `workflow/journal.ts`）同名但不同义，装的是 journal 与转录。两者靠「非递归
+ * readdir + 只收 .js」区分，属巧合而非设计，故本函数绝不返回那个根。
+ */
+export function workflowScriptDir(cwd: string): string {
+  return join(cwd, MIPHAM_DIR, 'workflows')
+}
+
+/**
+ * 全部可读的 workflow 脚本目录，写入根在前。
+ *
+ * 读侧必须同时认新旧前缀，否则升级后第一次 `/workflow save` 会失败 ——
+ * 上一次运行的 `.last-run.json` 还在旧目录里。用户级旧前缀也保留在列，
+ * 但**没有**对应的 `~/.mipham/workflows` 用户级脚本根：那里是运行产物的地盘。
+ */
+export function workflowScriptDirs(cwd: string): string[] {
+  return [
+    workflowScriptDir(cwd),
+    join(cwd, LEGACY_CLAUDE_DIR, 'workflows'),
+    join(homedir(), LEGACY_CLAUDE_DIR, 'workflows'),
+  ]
+}

package/src/core/permission-rules.ts

@@ -137,6 +137,34 @@ const PREFIX_VALUE_OPTIONS = new Set([
   '--max-procs', // xargs
 ])
 
+/**
+ * Shell interpreters whose `-c` argument is itself a complete command line.
+ *
+ * Deliberately NOT added to PREFIX_COMMANDS: that table shares
+ * PREFIX_VALUE_OPTIONS, where `-s` means `timeout --signal` — a shell's option
+ * grammar (`-c`, merged clusters like `-lc`, `-o <name>`) has nothing in common
+ * with a wrapper's value-taking options, and its payload is a *new command line*
+ * to re-parse rather than "the real command".
+ *
+ * This table is a security surface, not a compatibility surface: every name
+ * added is another matching path. Deliberately excluded — interpreters that
+ * evaluate *another language* (`node -e`, `python -c`, `awk`), remote execution
+ * (`ssh host '…'`, `docker exec`), script files (`bash x.sh`, `source x.sh`,
+ * whose payload is a file rather than a command line), and `find -exec`.
+ */
+const SHELL_COMMANDS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'ash'])
+
+/** Shell short-option letters that consume the next token as a value (`-o pipefail`). */
+const SHELL_VALUE_LETTERS = 'o'
+
+/** Shell long options that consume the next token as a value. */
+const SHELL_VALUE_OPTIONS = new Set(['--init-file', '--rcfile'])
+
+/** How many `-c` / `$()` payload levels are re-parsed. Shared by both recursion
+ *  paths — a single counter is what makes the bound hold; separate counters
+ *  would let `bash -c 'bash -c "$(…)"'` alternate past it. */
+const MAX_COMMAND_DEPTH = 5
+
 /**
  * Split a (possibly compound) shell command into simple-command segments, so a
  * Bash(pattern) rule matches any segment rather than only the whole string
@@ -221,20 +249,28 @@ function extractSubstitutions(command: string): string[] {
 
 /**
  * Flatten a command into every matchable sub-command: its shell segments plus
- * the commands nested inside `$(...)`/backtick substitutions (recursively). So
- * a `Bash(rm *)` deny rule also matches `REPORTTIME=$(rm -rf ~)` — zsh evaluates
- * substitutions in REPORTTIME/REPORTMEMORY/DIRSTACKSIZE assignments immediately.
- * Over-matching is the safe direction for a deny rule.
+ * the commands nested inside `$(...)`/backtick substitutions and shell `-c`
+ * payloads (recursively, bounded by MAX_COMMAND_DEPTH). So a `Bash(rm *)` deny
+ * rule also matches `REPORTTIME=$(rm -rf ~)` — zsh evaluates substitutions in
+ * REPORTTIME/REPORTMEMORY/DIRSTACKSIZE assignments immediately — and
+ * `bash -c 'rm -rf /'`. Over-matching is the safe direction for a deny rule.
  */
-function flattenCommand(command: string): string[] {
+function flattenCommand(command: string, depth = 0): string[] {
   const out: string[] = []
   for (const seg of splitShellSegments(command)) {
     out.push(seg)
     const stripped = stripPrefixCommand(seg)
     if (stripped !== seg) out.push(stripped)
     for (const inner of extractSubstitutions(seg)) {
-      out.push(...flattenCommand(inner))
+      out.push(...flattenCommand(inner, depth + 1))
     }
+    // A shell `-c` payload is a command line in its own right, so `Bash(rm *)`
+    // must also match `bash -c 'rm -rf /'`. Past the depth bound recursion stops
+    // outright rather than pushing the raw payload: the raw text
+    // (`bash -c 'rm -rf /'`) matches no `rm …` pattern anyway, and stopping
+    // keeps the boundary predictable.
+    const { payload } = effectiveCommand(seg.split(/\s+/).filter(Boolean))
+    if (payload && depth < MAX_COMMAND_DEPTH) out.push(...flattenCommand(payload, depth + 1))
   }
   return out
 }
@@ -248,8 +284,13 @@ function flattenCommand(command: string): string[] {
  * always treated as the command (never skipped) — which over-matches, the safe
  * direction for a deny rule.
  */
-function effectiveCommand(tokens: string[]): { base: string; args: string[] } {
+function effectiveCommand(tokens: string[]): {
+  base: string
+  args: string[]
+  payload: string | null
+} {
   let i = 0
+  let payload: string | null = null
   while (i < tokens.length) {
     const name = (tokens[i] || '').split('/').pop() || ''
     if (!PREFIX_COMMANDS.has(name)) break
@@ -263,9 +304,65 @@ function effectiveCommand(tokens: string[]): { base: string; args: string[] } {
       while (i < tokens.length && tokens[i]!.includes('=')) i++ // `VAR=value` assignments
     }
     if (name === 'timeout') i++ // positional duration
+    // `eval`'s remaining arguments are themselves a command line, and must be
+    // captured here rather than via the SHELL_COMMANDS branch below: `eval "cat
+    // secret"` tokenizes to ['eval', '"cat', 'secret"'], so the base degrades to
+    // `"cat` — a name no command set contains. The quotes land on *different*
+    // tokens, so de-quoting a single token cannot recover it either.
+    if (name === 'eval' && payload === null && i < tokens.length) {
+      payload = stripQuotes(tokens.slice(i).join(' '))
+    }
   }
-  if (i >= tokens.length) return { base: '', args: [] }
-  return { base: (tokens[i] || '').split('/').pop() || '', args: tokens.slice(i + 1) }
+  if (i >= tokens.length) return { base: '', args: [], payload }
+  const base = (tokens[i] || '').split('/').pop() || ''
+  if (payload === null && SHELL_COMMANDS.has(base)) payload = shellPayload(tokens, i)
+  return { base, args: tokens.slice(i + 1), payload }
+}
+
+/**
+ * The command string a shell runs via `-c` (`bash -c 'cat X'`). Only `-c` yields
+ * a nested command line — a script-file operand (`bash x.sh`) does not — so the
+ * scan stops at the first non-flag token, per getopt: `bash script.sh -c foo` is
+ * NOT a payload. Short options are walked as a cluster because shells accept
+ * `-lc` / `-xc` / `-euo pipefail`, which a flat option table (PREFIX_VALUE_OPTIONS)
+ * can never match.
+ *
+ * The payload is reassembled from every remaining token rather than taken from
+ * the one right after `-c`: it is a single shell word that routinely contains
+ * spaces (`'while read f; do cat "$f"; done'`), so whitespace tokenization has
+ * split it apart.
+ */
+function shellPayload(tokens: string[], start: number): string | null {
+  let i = start + 1
+  while (i < tokens.length) {
+    const t = tokens[i]!
+    if (!/^[-+]/.test(t) || t === '-' || t === '+') return null // first operand ends option parsing
+    if (t === '--') return null
+    if (t.startsWith('--')) {
+      i += SHELL_VALUE_OPTIONS.has(t) ? 2 : 1
+      continue
+    }
+    const body = t.slice(1)
+    let consumed = 0
+    let inline: string | null = null
+    for (let k = 0; k < body.length; k++) {
+      const letter = body[k]!
+      if (letter === 'c') {
+        inline = body.slice(k + 1) // `-c'cat X'` attaches the payload to the flag
+        break
+      }
+      if (SHELL_VALUE_LETTERS.includes(letter)) {
+        if (k + 1 >= body.length) consumed = 1 // value is the next token
+        break
+      }
+    }
+    if (inline !== null) {
+      const tail = tokens.slice(i + 1).join(' ')
+      return stripQuotes([inline, tail].filter(Boolean).join(' ')) || null
+    }
+    i += 1 + consumed
+  }
+  return null
 }
 
 /** A command with any wrapper prefix commands stripped, so `sudo rm -rf /`
@@ -281,13 +378,19 @@ function stripPrefixCommand(command: string): string {
 
 /**
  * Detect reader/writer commands at the front of each shell segment and recurse
- * into command substitutions, so `echo $(cat .git-credentials)` is caught.
+ * into command substitutions and shell `-c` payloads, so both
+ * `echo $(cat .git-credentials)` and `bash -c 'cat .git-credentials'` are caught.
  */
-function scanReaderWriterCommands(command: string, read: string[], write: string[]): void {
+function scanReaderWriterCommands(
+  command: string,
+  read: string[],
+  write: string[],
+  depth = 0,
+): void {
   for (const seg of splitShellSegments(command)) {
     const tokens = seg.split(/\s+/).filter(Boolean)
     if (tokens.length > 0) {
-      const { base, args } = effectiveCommand(tokens)
+      const { base, args, payload } = effectiveCommand(tokens)
       if (READER_COMMANDS.has(base)) {
         // `sed -i` / `perl -i` read AND write their file args.
         const inPlace = args.some((a) => a === '-i' || a.startsWith('--in-place'))
@@ -303,9 +406,14 @@ function scanReaderWriterCommands(command: string, read: string[], write: string
           write.push(stripQuotes(arg))
         }
       }
+      // Re-parse a shell `-c` payload: `bash -c 'cat secret'` reads `secret`
+      // just as directly as `cat secret` does.
+      if (payload && depth < MAX_COMMAND_DEPTH) {
+        scanReaderWriterCommands(payload, read, write, depth + 1)
+      }
     }
     for (const inner of extractSubstitutions(seg)) {
-      scanReaderWriterCommands(inner, read, write)
+      scanReaderWriterCommands(inner, read, write, depth + 1)
     }
   }
 }

package/src/core/permission.ts

@@ -215,14 +215,17 @@ export class PermissionSystem {
 
   allow(rule: string): void {
     this.allowRules.push(compileRule(rule, 'allow'))
+    this.invalidateCache()
   }
 
   deny(rule: string): void {
     this.denyRules.push(compileRule(rule, 'deny'))
+    this.invalidateCache()
   }
 
   ask(rule: string): void {
     this.askRules.push(compileRule(rule, 'ask'))
+    this.invalidateCache()
   }
 
   loadConfig(raw: {

package/src/core/session-log.ts

@@ -36,7 +36,8 @@ export function messageToEvents(msg: Message, at = 0): SessionEvent[] {
             type: 'tool/result',
             at,
             id: r.tool_use_id,
-            result: { success: true, content: r.content },
+            // 读真值：旧消息无 is_error ⇒ 视为成功（向后兼容，无需迁移）
+            result: { success: !(r.is_error === true), content: r.content },
           },
         ]
       }
@@ -80,7 +81,15 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
       const content = result.success ? result.content : result.error || result.content
       out.push({
         role: 'user',
-        content: [{ type: 'tool_result', tool_use_id: e.id, content }],
+        content: [
+          {
+            type: 'tool_result',
+            tool_use_id: e.id,
+            content,
+            // 展平式的对称边：成功不写该键（与 messageToEvents 侧对称，保字节级互逆）
+            ...(result.success ? {} : { is_error: true }),
+          },
+        ],
       })
     } else if (e.type === 'context/inject') {
       out.push({ role: 'user', content: e.text })

package/src/daemon/engine-capabilities.ts

@@ -0,0 +1,131 @@
+/**
+ * daemon 侧的引擎能力接线 —— 「两条渲染路径只接一条」的收口（ROADMAP T5）。
+ *
+ * 交互式 CLI 的装配内联在 `index.tsx`（约 300 行，含 TUI 专属件），而 daemon 这条
+ * 路径此前**一个 setter 都没接**。后果分三档，且都不报错：
+ *
+ * - `setSkills` 缺 ⇒ `createToolRegistry()` 无参调用照样把 `Skill` 工具挂进了注册表，
+ *   但工具上下文里没有 loader ⇒ 那个工具**每次调用都返回错误**（模型被广告了一个
+ *   永远失败的工具）。
+ * - `setRulesLoader` / `setHookEngine` / `setAgentRegistry` 缺 ⇒ 静默退化：
+ *   `injectRules()` 永远早退、hooks 全不跑、自定义 agent 解析不到（`agent.ts` 里是
+ *   `?.` 可选链，连警告都没有）。
+ * - `setLlm` 是**反例**：daemon 原本没有缝，`llmChat` 回退 registry、provider 回退
+ *   照常工作。所以顺序不可颠倒 —— 先修 `chatWithFallback` 的判据（见该处注释），
+ *   再接，否则「对等」会削掉 daemon 唯一还活着的回退。
+ *
+ * 这类缺口 lint / typecheck / 覆盖率 / 安全审计**全部看不见**（上一次同类事故是
+ * `rules-loader`，定义后潜伏数月，靠覆盖率实测才挖出来）。所以这里不只接线，还把
+ * daemon 该有的能力集中到**一个**装配点，让「再加一个能力忘了接 daemon」变成
+ * `test/integrity/daemon-capability-parity.test.ts` 能咬住的源码差异，而不是靠人记得。
+ *
+ * 不搬 `index.tsx` 的整套装配：ArtifactServer 是 TUI 画廊的 localhost 监听器、
+ * AgentViewManager 的唯一消费者是 TUI slash 命令。这里只接**有后果的四条**加
+ * `setLlm`；其余按后果分级进守卫的具名豁免表，逐条写理由。
+ */
+
+import type { QueryEngine } from '../core/engine'
+import type { ProviderRegistry } from '../providers/registry'
+import { SkillsLoader } from '../skills/loader'
+import { RulesLoader } from '../core/rules-loader'
+import { HookEngine } from '../core/hooks'
+import { loadHookConfigs } from '../core/hooks-config'
+import { loadSettingsJson } from '../config/loader'
+import { AgentRegistry } from '../agent/agent-registry'
+
+export interface DaemonEngineCapabilities {
+  /** 会话工作目录 —— 三者的派生源（外部 skill 路径 / hooks / agents 都从它算）。 */
+  cwd: string
+  /** daemon 共享的 provider registry，注入为 LLM 缝。 */
+  registry: ProviderRegistry
+  /** `config.skills.paths`（外部 skill 目录）。省略即只加载内置与用户 skill。 */
+  skillsPaths?: string[]
+}
+
+/**
+ * 按 cwd 记忆化。
+ *
+ * daemon 是一个长命进程服务多个会话、cwd 各不相同，而 skills / hooks / agents 三者
+ * 都从 cwd 派生（`config.skills.paths` / `<cwd>/.mipham/settings.json` /
+ * `<cwd>/.mipham/agents`）。每次 `getOrCreateEngine` 都重建会重复读盘与解析。
+ *
+ * 缓存是**有界**的：cwd 必须先过 `isCwdAllowed`（在 daemon 根之内，或在用户信任
+ * 列表里 —— 见 `workspace-guard.ts`），不是调用方随便给的路径。
+ *
+ * 代价已认下：表活到进程结束，所以改 `~/.mipham/settings.json` 或项目 agents 要
+ * **重启 daemon** 才生效。CLI 是一次性进程，没这个问题 —— 不做 per-session rebuild，
+ * 真要失效化另立条目。
+ */
+const skillsCache = new Map<string, SkillsLoader>()
+const hookCache = new Map<string, HookEngine>()
+const agentCache = new Map<string, AgentRegistry>()
+
+function skillsFor(cwd: string, paths?: string[]): SkillsLoader {
+  const cached = skillsCache.get(cwd)
+  if (cached) return cached
+  const loader = new SkillsLoader()
+  // 内置 skill 从包内解析（`import.meta.dirname`），与 cwd 无关；用户 skill 在
+  // `~/.mipham/skills`。三者里只有外部路径随 cwd 变。
+  loader.loadBuiltinFromPackage()
+  loader.loadUserSkills()
+  if (paths && paths.length > 0) loader.loadExternal(paths)
+  skillsCache.set(cwd, loader)
+  return loader
+}
+
+/**
+ * skill 自带的 hooks 先注册，`settings.json` 的随后 —— 与 `index.tsx:585-598` 同序。
+ *
+ * 内置 skill 当前**一个都不声明 hooks**（实测 grep 为 0），所以这条只在用户自装
+ * skill 上生效。留着是为了两入口的行为集合真的相等：少了它，装了带 hooks 的 skill
+ * 的用户在 daemon 里会静默少跑一半 hooks —— 正是本项要消灭的那类缺口。
+ *
+ * 注意 `settings.json` 是**仓库可控**的文件（`<cwd>/.mipham/settings.json`），
+ * 其 hooks 会 spawn shell。这与 CLI 同构，但 daemon 的会话可被远程渠道调用者驱动，
+ * 属本次已认下的后果，见 ROADMAP T5 落地结果。
+ */
+function hooksFor(cwd: string, skills: SkillsLoader): HookEngine {
+  const cached = hookCache.get(cwd)
+  if (cached) return cached
+  const engine = new HookEngine()
+  for (const skill of skills.list()) {
+    for (const hook of skill.hooks ?? []) engine.register(hook)
+  }
+  for (const def of loadHookConfigs(loadSettingsJson(cwd).hooks)) engine.register(def)
+  hookCache.set(cwd, engine)
+  return engine
+}
+
+function agentsFor(cwd: string): AgentRegistry {
+  const cached = agentCache.get(cwd)
+  if (cached) return cached
+  const registry = new AgentRegistry()
+  registry.loadUserAgents()
+  registry.loadProjectAgents(cwd)
+  agentCache.set(cwd, registry)
+  return registry
+}
+
+/**
+ * 把一个 daemon 引擎接成「和交互式 CLI 同等能干活」的样子。
+ *
+ * 调用点在 `server.ts` 的 `getOrCreateEngine`，紧跟 `setSessionId` —— 引擎建成之后、
+ * 进 `engineCache` 之前，保证任何取到引擎的路径都已经接过线。
+ */
+export function wireDaemonEngine(engine: QueryEngine, opts: DaemonEngineCapabilities): void {
+  const skills = skillsFor(opts.cwd, opts.skillsPaths)
+  engine.setSkills(skills)
+
+  // **每会话新建、不记忆化**：`setRulesLoader` 会顺手 `loader.load()`
+  // （`engine.ts:352-355`），而 `load()` 是同步、幂等、先清空再读几个小文件
+  // （`rules-loader.ts:42-61`）。共享一只的话，一个长命 daemon 会永远看不见会话
+  // 期间新增的规则；不共享的代价只是每次建引擎多读一次目录。
+  engine.setRulesLoader(new RulesLoader(opts.cwd))
+
+  engine.setHookEngine(hooksFor(opts.cwd, skills))
+  engine.setAgentRegistry(agentsFor(opts.cwd))
+
+  // 语义等价于不接（`llmChat` 本就是 `this.llm ?? this.registry`），接上是为了让
+  // 两个入口的能力集合真的相等；D2 靠它证明「先修语义再对等」这条顺序约束。
+  engine.setLlm(opts.registry)
+}

package/src/daemon/index.ts

@@ -276,7 +276,10 @@ export async function stopDaemon(force: boolean = false): Promise<void> {
 
   // Stop HTTP server (disconnects WebSocket clients)
   if (activeServer) {
-    activeServer.stop()
+    // Awaited: the PID/port cleanup below is documented to run regardless of
+    // failure, so a rejection must not skip it — but the stop must finish before
+    // this function reports the daemon as stopped.
+    await activeServer.stop().catch(() => {})
     activeServer = null
   }