@miphamai/cli 0.81.6 → 0.81.8

package/src/core/permission-rules.ts

@@ -1,3 +1,5 @@
+import { homedir } from 'node:os'
+import { join } from 'node:path'
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchPath } from './credential-masker/matcher'
 
@@ -106,6 +108,9 @@ const PREFIX_COMMANDS = new Set([
   'stdbuf',
 ])
 
+/** `timeout` 的 duration 形态：`5` / `0.5` / `30s` / `2m` / `1h` / `1d`。 */
+const TIMEOUT_DURATION_RE = /^\d+(\.\d+)?[smhd]?$/
+
 /** Value-taking options of wrapper commands (consume the following token). */
 const PREFIX_VALUE_OPTIONS = new Set([
   '-u',
@@ -137,6 +142,34 @@ const PREFIX_VALUE_OPTIONS = new Set([
   '--max-procs', // xargs
 ])
 
+/**
+ * Shell interpreters whose `-c` argument is itself a complete command line.
+ *
+ * Deliberately NOT added to PREFIX_COMMANDS: that table shares
+ * PREFIX_VALUE_OPTIONS, where `-s` means `timeout --signal` — a shell's option
+ * grammar (`-c`, merged clusters like `-lc`, `-o <name>`) has nothing in common
+ * with a wrapper's value-taking options, and its payload is a *new command line*
+ * to re-parse rather than "the real command".
+ *
+ * This table is a security surface, not a compatibility surface: every name
+ * added is another matching path. Deliberately excluded — interpreters that
+ * evaluate *another language* (`node -e`, `python -c`, `awk`), remote execution
+ * (`ssh host '…'`, `docker exec`), script files (`bash x.sh`, `source x.sh`,
+ * whose payload is a file rather than a command line), and `find -exec`.
+ */
+const SHELL_COMMANDS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'ash'])
+
+/** Shell short-option letters that consume the next token as a value (`-o pipefail`). */
+const SHELL_VALUE_LETTERS = 'o'
+
+/** Shell long options that consume the next token as a value. */
+const SHELL_VALUE_OPTIONS = new Set(['--init-file', '--rcfile'])
+
+/** How many `-c` / `$()` payload levels are re-parsed. Shared by both recursion
+ *  paths — a single counter is what makes the bound hold; separate counters
+ *  would let `bash -c 'bash -c "$(…)"'` alternate past it. */
+const MAX_COMMAND_DEPTH = 5
+
 /**
  * Split a (possibly compound) shell command into simple-command segments, so a
  * Bash(pattern) rule matches any segment rather than only the whole string
@@ -165,6 +198,76 @@ function stripQuotes(s: string): string {
   return s
 }
 
+/** Shell 结构符号：分组与取反 —— 它们自身不是命令，紧跟其后的是。 */
+const LEADING_SHELL_PUNCT = new Set(['(', '{', '!'])
+
+/** Shell 关键字：其后才是真正的命令（`do rm -rf x` 执行的命令是 `rm`）。 */
+const LEADING_SHELL_KEYWORDS = new Set([
+  'do',
+  'then',
+  'else',
+  'elif',
+  'if',
+  'while',
+  'until',
+  'for',
+  'case',
+  'time',
+  'coproc',
+])
+
+/** 一条前导赋值：`NAME=value`（name 是合法标识符，`=` 前无引号）。 */
+const LEADING_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/
+
+/**
+ * 剥掉一段 shell 片段**前导**的噪声 token，露出真正的基命令。
+ *
+ * 为什么需要它：`Bash(rm *)` / `Read(secret)` 这类规则要匹配的是**命令本身**，
+ * 而 shell 允许在命令前放赋值（`IFS=x rm -rf x`）、分组符号（`( rm -rf x )`）、
+ * 关键字（`for …; do rm -rf x; done`）。这些都不改变「执行了什么命令」，却足以
+ * 让匹配器看不到 `rm`，于是 deny 规则被一个空格级的改写绕过。
+ *
+ * 只剥前导、可反复剥（`FOO=1 ! rm …`）。剥多了一律是过匹配，而 deny 规则的过
+ * 匹配是安全方向。关键字自己的裸 flag 也一并剥掉（`time -p rm …` 里的 `-p`），
+ * 否则关键字被剥走后会剩下 `-p rm …`，仍然看不见 `rm`。
+ *
+ * 不剥尾随符号（`rm -rf x )` 里的 `)`）：`wildcardMatch` 的 `*` 已经吃掉它。
+ */
+export function stripLeadingShellNoise(segment: string): string {
+  let tokens = segment.trim().split(/\s+/).filter(Boolean)
+  let stripped = false
+  let skipFlags = false
+  for (;;) {
+    const head = tokens[0]
+    if (!head) break
+    if (skipFlags && /^--?[A-Za-z]/.test(head)) {
+      tokens = tokens.slice(1)
+      stripped = true
+      continue
+    }
+    skipFlags = false
+    const bare = head.replace(/^[({!]+/, '') // `(!` 这类连写
+    if (bare !== head) {
+      tokens = bare ? [bare, ...tokens.slice(1)] : tokens.slice(1)
+      stripped = true
+      continue
+    }
+    if (LEADING_SHELL_PUNCT.has(head) || LEADING_ASSIGNMENT_RE.test(head)) {
+      tokens = tokens.slice(1)
+      stripped = true
+      continue
+    }
+    if (LEADING_SHELL_KEYWORDS.has(head)) {
+      tokens = tokens.slice(1)
+      stripped = true
+      skipFlags = true // `time -p rm …` —— 关键字自己的裸 flag 不是命令
+      continue
+    }
+    break
+  }
+  return stripped ? tokens.join(' ') : segment
+}
+
 function uniq(items: string[]): string[] {
   return [...new Set(items)]
 }
@@ -175,6 +278,29 @@ export interface BashFileAccess {
   write: string[]
 }
 
+/**
+ * 展开候选路径里**已知**的变量：前导 `~`、`$HOME`/`${HOME}`。
+ *
+ * 为什么需要：规则里写的是绝对路径（`Read(/Users/me/.ssh/id_rsa)`），而用户敲的
+ * 是同一个文件的另一种拼法（`cat ~/.ssh/id_rsa`）—— 不展开即等于放行。展开后
+ * 两种拼法落到同一个字符串上，绝对路径形与路径通配形（如「.ssh 下任意文件」）
+ * 规则都能命中。
+ *
+ * **只展开 HOME**。`$FOO` 这类未知变量原样保留：展开它需要求值环境，静默展开成
+ * 空串会让 `/x/$FOO/y` 变成 `/x//y` —— 那是**新增**一个漏判方向，比不展开更坏。
+ * `$PWD` 同理需要 cwd，而 `matchBashRule` 的调用点拿不到 cwd，故未覆盖。这两条
+ * 都是本函数已知的边界，不是遗漏。
+ *
+ * `~` 只在**开头**展开（`a/~/b` 里的 `~` 是普通字符，shell 也不展开它）。
+ */
+export function expandKnownPathVars(p: string): string {
+  const home = homedir() // 每次取，不在模块加载时绑定（HOME 可能被测试隔离改写）
+  let out = p
+  if (out === '~') out = home
+  else if (out.startsWith('~/')) out = join(home, out.slice(2))
+  return out.replace(/\$\{?HOME\}?/g, home)
+}
+
 /**
  * Extract the file paths a Bash command reads or writes, so Read()/Write()/
  * Edit() deny rules also apply to Bash (not just the Read/Write/Edit tools).
@@ -203,7 +329,9 @@ export function extractBashFileAccess(command: string): BashFileAccess {
   //    recursing into `$(...)` / backtick substitutions.
   scanReaderWriterCommands(command, read, write)
 
-  return { read: uniq(read), write: uniq(write) }
+  // 展开放在出口这一处，而不是每个 push 点 —— 重定向与读/写命令、以及它们的
+  // 递归内层都汇进这两个数组，一处展开即全覆盖。
+  return { read: uniq(read.map(expandKnownPathVars)), write: uniq(write.map(expandKnownPathVars)) }
 }
 
 /** Extract the inner commands of `$(...)` and backtick substitutions. */
@@ -216,25 +344,45 @@ function extractSubstitutions(command: string): string[] {
   while ((m = dollarParen.exec(command)) !== null) inners.push(m[1]!)
   const backtick = /`([^`]*)`/g
   while ((m = backtick.exec(command)) !== null) inners.push(m[1]!)
+  // 进程替换 `<(cmd)` / `>(cmd)`：`cat <(cat secret)` 里读 secret 的是里层的
+  // `cat`，外层只是把它的 stdout 当成一个文件名。参数排除 `<>` 是因为
+  // `<(cat secret)` 的捕获若允许 `>`，遇到 `>(...)` 形态会被提前截断；非嵌套组
+  // 由调用方的递归处理。
+  const procSub = /[<>]\(([^()<>]*)\)/g
+  while ((m = procSub.exec(command)) !== null) inners.push(m[1]!)
   return inners
 }
 
 /**
  * Flatten a command into every matchable sub-command: its shell segments plus
- * the commands nested inside `$(...)`/backtick substitutions (recursively). So
- * a `Bash(rm *)` deny rule also matches `REPORTTIME=$(rm -rf ~)` — zsh evaluates
- * substitutions in REPORTTIME/REPORTMEMORY/DIRSTACKSIZE assignments immediately.
- * Over-matching is the safe direction for a deny rule.
+ * the commands nested inside `$(...)`/backtick substitutions and shell `-c`
+ * payloads (recursively, bounded by MAX_COMMAND_DEPTH). So a `Bash(rm *)` deny
+ * rule also matches `REPORTTIME=$(rm -rf ~)` — zsh evaluates substitutions in
+ * REPORTTIME/REPORTMEMORY/DIRSTACKSIZE assignments immediately — and
+ * `bash -c 'rm -rf /'`. Over-matching is the safe direction for a deny rule.
  */
-function flattenCommand(command: string): string[] {
+function flattenCommand(command: string, depth = 0): string[] {
   const out: string[] = []
   for (const seg of splitShellSegments(command)) {
     out.push(seg)
     const stripped = stripPrefixCommand(seg)
     if (stripped !== seg) out.push(stripped)
+    // 剥掉前导噪声后的形态也要参与匹配：`IFS=x rm -rf x` / `( rm -rf x )` /
+    // `for …; do rm -rf x; done` 执行的仍是 `rm`，规则必须看得见它。同一个函数
+    // 也被 scanReaderWriterCommands 用（Read/Write/Edit 桥接那条路径）—— 两条
+    // 路径共用一份归一化，只接一条就是只修一半。
+    const denoised = stripLeadingShellNoise(seg)
+    if (denoised !== seg) out.push(denoised)
     for (const inner of extractSubstitutions(seg)) {
-      out.push(...flattenCommand(inner))
+      out.push(...flattenCommand(inner, depth + 1))
     }
+    // A shell `-c` payload is a command line in its own right, so `Bash(rm *)`
+    // must also match `bash -c 'rm -rf /'`. Past the depth bound recursion stops
+    // outright rather than pushing the raw payload: the raw text
+    // (`bash -c 'rm -rf /'`) matches no `rm …` pattern anyway, and stopping
+    // keeps the boundary predictable.
+    const { payload } = effectiveCommand(seg.split(/\s+/).filter(Boolean))
+    if (payload && depth < MAX_COMMAND_DEPTH) out.push(...flattenCommand(payload, depth + 1))
   }
   return out
 }
@@ -248,8 +396,13 @@ function flattenCommand(command: string): string[] {
  * always treated as the command (never skipped) — which over-matches, the safe
  * direction for a deny rule.
  */
-function effectiveCommand(tokens: string[]): { base: string; args: string[] } {
+function effectiveCommand(tokens: string[]): {
+  base: string
+  args: string[]
+  payload: string | null
+} {
   let i = 0
+  let payload: string | null = null
   while (i < tokens.length) {
     const name = (tokens[i] || '').split('/').pop() || ''
     if (!PREFIX_COMMANDS.has(name)) break
@@ -262,10 +415,69 @@ function effectiveCommand(tokens: string[]): { base: string; args: string[] } {
     if (name === 'env') {
       while (i < tokens.length && tokens[i]!.includes('=')) i++ // `VAR=value` assignments
     }
-    if (name === 'timeout') i++ // positional duration
+    // `timeout` 的位置参数是 duration，**不是**必然存在：`timeout 5 cmd` 有，
+    // `timeout --preserve-status cmd` 没有。无条件 `i++` 会把后者真正的命令
+    // （`cat`）当成 duration 吃掉，基命令退化成它的第一个参数。
+    if (name === 'timeout' && i < tokens.length && TIMEOUT_DURATION_RE.test(tokens[i]!)) i++
+    // `eval`'s remaining arguments are themselves a command line, and must be
+    // captured here rather than via the SHELL_COMMANDS branch below: `eval "cat
+    // secret"` tokenizes to ['eval', '"cat', 'secret"'], so the base degrades to
+    // `"cat` — a name no command set contains. The quotes land on *different*
+    // tokens, so de-quoting a single token cannot recover it either.
+    if (name === 'eval' && payload === null && i < tokens.length) {
+      payload = stripQuotes(tokens.slice(i).join(' '))
+    }
+  }
+  if (i >= tokens.length) return { base: '', args: [], payload }
+  const base = (tokens[i] || '').split('/').pop() || ''
+  if (payload === null && SHELL_COMMANDS.has(base)) payload = shellPayload(tokens, i)
+  return { base, args: tokens.slice(i + 1), payload }
+}
+
+/**
+ * The command string a shell runs via `-c` (`bash -c 'cat X'`). Only `-c` yields
+ * a nested command line — a script-file operand (`bash x.sh`) does not — so the
+ * scan stops at the first non-flag token, per getopt: `bash script.sh -c foo` is
+ * NOT a payload. Short options are walked as a cluster because shells accept
+ * `-lc` / `-xc` / `-euo pipefail`, which a flat option table (PREFIX_VALUE_OPTIONS)
+ * can never match.
+ *
+ * The payload is reassembled from every remaining token rather than taken from
+ * the one right after `-c`: it is a single shell word that routinely contains
+ * spaces (`'while read f; do cat "$f"; done'`), so whitespace tokenization has
+ * split it apart.
+ */
+function shellPayload(tokens: string[], start: number): string | null {
+  let i = start + 1
+  while (i < tokens.length) {
+    const t = tokens[i]!
+    if (!/^[-+]/.test(t) || t === '-' || t === '+') return null // first operand ends option parsing
+    if (t === '--') return null
+    if (t.startsWith('--')) {
+      i += SHELL_VALUE_OPTIONS.has(t) ? 2 : 1
+      continue
+    }
+    const body = t.slice(1)
+    let consumed = 0
+    let inline: string | null = null
+    for (let k = 0; k < body.length; k++) {
+      const letter = body[k]!
+      if (letter === 'c') {
+        inline = body.slice(k + 1) // `-c'cat X'` attaches the payload to the flag
+        break
+      }
+      if (SHELL_VALUE_LETTERS.includes(letter)) {
+        if (k + 1 >= body.length) consumed = 1 // value is the next token
+        break
+      }
+    }
+    if (inline !== null) {
+      const tail = tokens.slice(i + 1).join(' ')
+      return stripQuotes([inline, tail].filter(Boolean).join(' ')) || null
+    }
+    i += 1 + consumed
   }
-  if (i >= tokens.length) return { base: '', args: [] }
-  return { base: (tokens[i] || '').split('/').pop() || '', args: tokens.slice(i + 1) }
+  return null
 }
 
 /** A command with any wrapper prefix commands stripped, so `sudo rm -rf /`
@@ -281,13 +493,22 @@ function stripPrefixCommand(command: string): string {
 
 /**
  * Detect reader/writer commands at the front of each shell segment and recurse
- * into command substitutions, so `echo $(cat .git-credentials)` is caught.
+ * into command substitutions and shell `-c` payloads, so both
+ * `echo $(cat .git-credentials)` and `bash -c 'cat .git-credentials'` are caught.
  */
-function scanReaderWriterCommands(command: string, read: string[], write: string[]): void {
+function scanReaderWriterCommands(
+  command: string,
+  read: string[],
+  write: string[],
+  depth = 0,
+): void {
   for (const seg of splitShellSegments(command)) {
-    const tokens = seg.split(/\s+/).filter(Boolean)
+    // 先剥前导噪声再 tokenize：`IFS=x cat secret` / `! cat secret` /
+    // `time -p cat secret` 读的是同一个文件，Read() 规则必须看得见 `cat`。
+    // 与 flattenCommand 共用 stripLeadingShellNoise —— 两条路径一份归一化。
+    const tokens = stripLeadingShellNoise(seg).split(/\s+/).filter(Boolean)
     if (tokens.length > 0) {
-      const { base, args } = effectiveCommand(tokens)
+      const { base, args, payload } = effectiveCommand(tokens)
       if (READER_COMMANDS.has(base)) {
         // `sed -i` / `perl -i` read AND write their file args.
         const inPlace = args.some((a) => a === '-i' || a.startsWith('--in-place'))
@@ -303,13 +524,25 @@ function scanReaderWriterCommands(command: string, read: string[], write: string
           write.push(stripQuotes(arg))
         }
       }
+      // Re-parse a shell `-c` payload: `bash -c 'cat secret'` reads `secret`
+      // just as directly as `cat secret` does.
+      if (payload && depth < MAX_COMMAND_DEPTH) {
+        scanReaderWriterCommands(payload, read, write, depth + 1)
+      }
     }
     for (const inner of extractSubstitutions(seg)) {
-      scanReaderWriterCommands(inner, read, write)
+      scanReaderWriterCommands(inner, read, write, depth + 1)
     }
   }
 }
 
+/**
+ * `matchBashRule` 真正会按参数匹配工具名的集合。**与 matchBashRule 的分支一一
+ * 对应** —— 那里 `return false` 的工具，参数化规则在 validateRulePattern 里必须
+ * 被拒（否则规则永远不命中，是静默空防护）。改一边必须改另一边。
+ */
+const PARAMETERISED_TOOLS = new Set(['Bash', 'Read', 'Write', 'Edit', 'Grep', 'Glob'])
+
 // Match a tool(parameter) rule against an actual tool call.
 //
 // Pattern formats:
@@ -392,6 +625,10 @@ export function wildcardMatch(pattern: string, input: string): boolean {
  * `Bash()`) is silently dead today — this returns a human-readable reason so
  * the caller can report it as an invalid setting instead of ignoring it.
  *
+ * 校验的是**结构 + 工具名**（后者见 PARAMETERISED_TOOLS）。**不**校验子模式本身
+ * 能否匹配任何东西 —— `Bash(zzz *)` 合法、装得上、只是不会命中，那是用户自己的
+ * 选择，不是配置错误。
+ *
  * Returns null when the pattern is valid, or a reason string when malformed.
  */
 export function validateRulePattern(pattern: string): string | null {
@@ -402,9 +639,16 @@ export function validateRulePattern(pattern: string): string | null {
     // Empty parameter: `Bash()` or `Bash( )`
     if (/\(\s*\)$/.test(pattern)) return 'empty parameter'
     // Must be exactly `ToolName(param)` with nothing before or after.
-    if (!/^(\w+)\((.+)\)$/.test(pattern)) {
+    const shape = pattern.match(/^(\w+)\((.+)\)$/)
+    if (!shape) {
       return 'unexpected text after the closing parenthesis'
     }
+    // 工具名必须落在 matchBashRule 真正会按参数匹配的那一集合里，否则这条规则是
+    // **静默空防护**：语法合法、装得上、永远不命中，而用户以为配了保护。
+    const tool = shape[1]!
+    if (!PARAMETERISED_TOOLS.has(tool)) {
+      return `parameterised rules are not supported for tool "${tool}" (it would never match)`
+    }
     return null
   }
 

package/src/core/permission.ts

@@ -215,14 +215,17 @@ export class PermissionSystem {
 
   allow(rule: string): void {
     this.allowRules.push(compileRule(rule, 'allow'))
+    this.invalidateCache()
   }
 
   deny(rule: string): void {
     this.denyRules.push(compileRule(rule, 'deny'))
+    this.invalidateCache()
   }
 
   ask(rule: string): void {
     this.askRules.push(compileRule(rule, 'ask'))
+    this.invalidateCache()
   }
 
   loadConfig(raw: {

package/src/core/session-log.ts

@@ -36,7 +36,8 @@ export function messageToEvents(msg: Message, at = 0): SessionEvent[] {
             type: 'tool/result',
             at,
             id: r.tool_use_id,
-            result: { success: true, content: r.content },
+            // 读真值：旧消息无 is_error ⇒ 视为成功（向后兼容，无需迁移）
+            result: { success: !(r.is_error === true), content: r.content },
           },
         ]
       }
@@ -80,7 +81,15 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
       const content = result.success ? result.content : result.error || result.content
       out.push({
         role: 'user',
-        content: [{ type: 'tool_result', tool_use_id: e.id, content }],
+        content: [
+          {
+            type: 'tool_result',
+            tool_use_id: e.id,
+            content,
+            // 展平式的对称边：成功不写该键（与 messageToEvents 侧对称，保字节级互逆）
+            ...(result.success ? {} : { is_error: true }),
+          },
+        ],
       })
     } else if (e.type === 'context/inject') {
       out.push({ role: 'user', content: e.text })
@@ -154,7 +163,9 @@ export class SessionLog {
       const trimmed = line.trim()
       if (!trimmed) continue
       try {
-        log.buf.push(JSON.parse(trimmed) as SessionEvent)
+        const parsed: unknown = JSON.parse(trimmed)
+        if (!isValidEvent(parsed)) continue
+        log.buf.push(parsed)
       } catch {
         // 跳过损坏行
       }
@@ -164,6 +175,47 @@ export class SessionLog {
   }
 }
 
+/**
+ * 事件结构校验 —— 磁盘→内存的**唯一**入口（`open()`）用它挡掉坏行。
+ *
+ * 只校验 `deriveMessages` 会解引用的字段：这不是 schema 校验，是「投影不许崩」的
+ * 最低门槛。**合法 JSON 不等于合法事件** —— `null`、`{"type":"user/message"}`（无
+ * message）、`{"type":"compaction/rewrite"}`（无 messages）都过得了 `JSON.parse`，
+ * 却让投影抛 TypeError（rewrite 那条更狠：`out` 直接变 `undefined`，下一条就炸），
+ * 而 `/resume` 那条链上没有 try 兜它。坏行来自手写/拼接/半截重排，不是本进程写的。
+ *
+ * 不校验 `session/start`、`assistant/chunk`、`checker/decision`：投影对它们无分支；
+ * 未知类型一律放行（前向兼容 —— 认不出来不等于要销毁它）。
+ */
+function isValidEvent(e: unknown): e is SessionEvent {
+  if (!e || typeof e !== 'object') return false
+  const ev = e as Record<string, unknown>
+  if (typeof ev.type !== 'string') return false
+  switch (ev.type) {
+    case 'user/message':
+    case 'assistant/message':
+      return !!ev.message && typeof ev.message === 'object'
+    case 'tool/call':
+      return (
+        typeof ev.id === 'string' &&
+        typeof ev.name === 'string' &&
+        !!ev.input &&
+        typeof ev.input === 'object'
+      )
+    case 'tool/result':
+      // 只要求 id：`result`（新格式）与 `content`（旧 JSONL）都可缺省，派生侧已兜底
+      return typeof ev.id === 'string'
+    case 'context/inject':
+      return typeof ev.text === 'string'
+    case 'compaction/summary':
+      return typeof ev.summary === 'string'
+    case 'compaction/rewrite':
+      return Array.isArray(ev.messages)
+    default:
+      return true
+  }
+}
+
 const SUMMARY_PREFIX = '[Earlier conversation summary]:'
 
 export function isCompactionSummary(m: Message): boolean {

package/src/core/session-store.ts

@@ -212,6 +212,11 @@ export class SessionStore {
 
   /**
    * List all saved sessions, most recent first.
+   *
+   * 单个文件读不出来只赔上它自己 —— 这里是为**逐文件**兜底，不是给整个列表兜底：
+   * 从前 try 包住整个 for 循环，第一个抛异常的文件就让 `/resume` 一条会话都不显示，
+   * 而其余文件全是好的。读不出来的（坏结构、半截写、I/O 错）直接跳过：连 metadata
+   * 都建不出来的会话没法在列表里表示。
    */
   static list(): SessionMetadata[] {
     ensureDir()
@@ -220,7 +225,12 @@ export class SessionStore {
       const sessions: SessionMetadata[] = []
       for (const file of files) {
         const name = file.replace('.jsonl', '')
-        const session = SessionStore.load(name)
+        let session: StoredSession | null = null
+        try {
+          session = SessionStore.load(name)
+        } catch {
+          continue
+        }
         if (session?.metadata) {
           sessions.push(session.metadata)
         }

package/src/daemon/engine-capabilities.ts

@@ -0,0 +1,131 @@
+/**
+ * daemon 侧的引擎能力接线 —— 「两条渲染路径只接一条」的收口（ROADMAP T5）。
+ *
+ * 交互式 CLI 的装配内联在 `index.tsx`（约 300 行，含 TUI 专属件），而 daemon 这条
+ * 路径此前**一个 setter 都没接**。后果分三档，且都不报错：
+ *
+ * - `setSkills` 缺 ⇒ `createToolRegistry()` 无参调用照样把 `Skill` 工具挂进了注册表，
+ *   但工具上下文里没有 loader ⇒ 那个工具**每次调用都返回错误**（模型被广告了一个
+ *   永远失败的工具）。
+ * - `setRulesLoader` / `setHookEngine` / `setAgentRegistry` 缺 ⇒ 静默退化：
+ *   `injectRules()` 永远早退、hooks 全不跑、自定义 agent 解析不到（`agent.ts` 里是
+ *   `?.` 可选链，连警告都没有）。
+ * - `setLlm` 是**反例**：daemon 原本没有缝，`llmChat` 回退 registry、provider 回退
+ *   照常工作。所以顺序不可颠倒 —— 先修 `chatWithFallback` 的判据（见该处注释），
+ *   再接，否则「对等」会削掉 daemon 唯一还活着的回退。
+ *
+ * 这类缺口 lint / typecheck / 覆盖率 / 安全审计**全部看不见**（上一次同类事故是
+ * `rules-loader`，定义后潜伏数月，靠覆盖率实测才挖出来）。所以这里不只接线，还把
+ * daemon 该有的能力集中到**一个**装配点，让「再加一个能力忘了接 daemon」变成
+ * `test/integrity/daemon-capability-parity.test.ts` 能咬住的源码差异，而不是靠人记得。
+ *
+ * 不搬 `index.tsx` 的整套装配：ArtifactServer 是 TUI 画廊的 localhost 监听器、
+ * AgentViewManager 的唯一消费者是 TUI slash 命令。这里只接**有后果的四条**加
+ * `setLlm`；其余按后果分级进守卫的具名豁免表，逐条写理由。
+ */
+
+import type { QueryEngine } from '../core/engine'
+import type { ProviderRegistry } from '../providers/registry'
+import { SkillsLoader } from '../skills/loader'
+import { RulesLoader } from '../core/rules-loader'
+import { HookEngine } from '../core/hooks'
+import { loadHookConfigs } from '../core/hooks-config'
+import { loadSettingsJson } from '../config/loader'
+import { AgentRegistry } from '../agent/agent-registry'
+
+export interface DaemonEngineCapabilities {
+  /** 会话工作目录 —— 三者的派生源（外部 skill 路径 / hooks / agents 都从它算）。 */
+  cwd: string
+  /** daemon 共享的 provider registry，注入为 LLM 缝。 */
+  registry: ProviderRegistry
+  /** `config.skills.paths`（外部 skill 目录）。省略即只加载内置与用户 skill。 */
+  skillsPaths?: string[]
+}
+
+/**
+ * 按 cwd 记忆化。
+ *
+ * daemon 是一个长命进程服务多个会话、cwd 各不相同，而 skills / hooks / agents 三者
+ * 都从 cwd 派生（`config.skills.paths` / `<cwd>/.mipham/settings.json` /
+ * `<cwd>/.mipham/agents`）。每次 `getOrCreateEngine` 都重建会重复读盘与解析。
+ *
+ * 缓存是**有界**的：cwd 必须先过 `isCwdAllowed`（在 daemon 根之内，或在用户信任
+ * 列表里 —— 见 `workspace-guard.ts`），不是调用方随便给的路径。
+ *
+ * 代价已认下：表活到进程结束，所以改 `~/.mipham/settings.json` 或项目 agents 要
+ * **重启 daemon** 才生效。CLI 是一次性进程，没这个问题 —— 不做 per-session rebuild，
+ * 真要失效化另立条目。
+ */
+const skillsCache = new Map<string, SkillsLoader>()
+const hookCache = new Map<string, HookEngine>()
+const agentCache = new Map<string, AgentRegistry>()
+
+function skillsFor(cwd: string, paths?: string[]): SkillsLoader {
+  const cached = skillsCache.get(cwd)
+  if (cached) return cached
+  const loader = new SkillsLoader()
+  // 内置 skill 从包内解析（`import.meta.dirname`），与 cwd 无关；用户 skill 在
+  // `~/.mipham/skills`。三者里只有外部路径随 cwd 变。
+  loader.loadBuiltinFromPackage()
+  loader.loadUserSkills()
+  if (paths && paths.length > 0) loader.loadExternal(paths)
+  skillsCache.set(cwd, loader)
+  return loader
+}
+
+/**
+ * skill 自带的 hooks 先注册，`settings.json` 的随后 —— 与 `index.tsx:585-598` 同序。
+ *
+ * 内置 skill 当前**一个都不声明 hooks**（实测 grep 为 0），所以这条只在用户自装
+ * skill 上生效。留着是为了两入口的行为集合真的相等：少了它，装了带 hooks 的 skill
+ * 的用户在 daemon 里会静默少跑一半 hooks —— 正是本项要消灭的那类缺口。
+ *
+ * 注意 `settings.json` 是**仓库可控**的文件（`<cwd>/.mipham/settings.json`），
+ * 其 hooks 会 spawn shell。这与 CLI 同构，但 daemon 的会话可被远程渠道调用者驱动，
+ * 属本次已认下的后果，见 ROADMAP T5 落地结果。
+ */
+function hooksFor(cwd: string, skills: SkillsLoader): HookEngine {
+  const cached = hookCache.get(cwd)
+  if (cached) return cached
+  const engine = new HookEngine()
+  for (const skill of skills.list()) {
+    for (const hook of skill.hooks ?? []) engine.register(hook)
+  }
+  for (const def of loadHookConfigs(loadSettingsJson(cwd).hooks)) engine.register(def)
+  hookCache.set(cwd, engine)
+  return engine
+}
+
+function agentsFor(cwd: string): AgentRegistry {
+  const cached = agentCache.get(cwd)
+  if (cached) return cached
+  const registry = new AgentRegistry()
+  registry.loadUserAgents()
+  registry.loadProjectAgents(cwd)
+  agentCache.set(cwd, registry)
+  return registry
+}
+
+/**
+ * 把一个 daemon 引擎接成「和交互式 CLI 同等能干活」的样子。
+ *
+ * 调用点在 `server.ts` 的 `getOrCreateEngine`，紧跟 `setSessionId` —— 引擎建成之后、
+ * 进 `engineCache` 之前，保证任何取到引擎的路径都已经接过线。
+ */
+export function wireDaemonEngine(engine: QueryEngine, opts: DaemonEngineCapabilities): void {
+  const skills = skillsFor(opts.cwd, opts.skillsPaths)
+  engine.setSkills(skills)
+
+  // **每会话新建、不记忆化**：`setRulesLoader` 会顺手 `loader.load()`
+  // （`engine.ts:352-355`），而 `load()` 是同步、幂等、先清空再读几个小文件
+  // （`rules-loader.ts:42-61`）。共享一只的话，一个长命 daemon 会永远看不见会话
+  // 期间新增的规则；不共享的代价只是每次建引擎多读一次目录。
+  engine.setRulesLoader(new RulesLoader(opts.cwd))
+
+  engine.setHookEngine(hooksFor(opts.cwd, skills))
+  engine.setAgentRegistry(agentsFor(opts.cwd))
+
+  // 语义等价于不接（`llmChat` 本就是 `this.llm ?? this.registry`），接上是为了让
+  // 两个入口的能力集合真的相等；D2 靠它证明「先修语义再对等」这条顺序约束。
+  engine.setLlm(opts.registry)
+}

package/src/daemon/index.ts

@@ -276,7 +276,10 @@ export async function stopDaemon(force: boolean = false): Promise<void> {
 
   // Stop HTTP server (disconnects WebSocket clients)
   if (activeServer) {
-    activeServer.stop()
+    // Awaited: the PID/port cleanup below is documented to run regardless of
+    // failure, so a rejection must not skip it — but the stop must finish before
+    // this function reports the daemon as stopped.
+    await activeServer.stop().catch(() => {})
     activeServer = null
   }