@miphamai/cli 0.81.7 → 0.81.8

package/src/core/session-log.ts

@@ -163,7 +163,9 @@ export class SessionLog {
       const trimmed = line.trim()
       if (!trimmed) continue
       try {
-        log.buf.push(JSON.parse(trimmed) as SessionEvent)
+        const parsed: unknown = JSON.parse(trimmed)
+        if (!isValidEvent(parsed)) continue
+        log.buf.push(parsed)
       } catch {
         // 跳过损坏行
       }
@@ -173,6 +175,47 @@ export class SessionLog {
   }
 }
 
+/**
+ * 事件结构校验 —— 磁盘→内存的**唯一**入口（`open()`）用它挡掉坏行。
+ *
+ * 只校验 `deriveMessages` 会解引用的字段：这不是 schema 校验，是「投影不许崩」的
+ * 最低门槛。**合法 JSON 不等于合法事件** —— `null`、`{"type":"user/message"}`（无
+ * message）、`{"type":"compaction/rewrite"}`（无 messages）都过得了 `JSON.parse`，
+ * 却让投影抛 TypeError（rewrite 那条更狠：`out` 直接变 `undefined`，下一条就炸），
+ * 而 `/resume` 那条链上没有 try 兜它。坏行来自手写/拼接/半截重排，不是本进程写的。
+ *
+ * 不校验 `session/start`、`assistant/chunk`、`checker/decision`：投影对它们无分支；
+ * 未知类型一律放行（前向兼容 —— 认不出来不等于要销毁它）。
+ */
+function isValidEvent(e: unknown): e is SessionEvent {
+  if (!e || typeof e !== 'object') return false
+  const ev = e as Record<string, unknown>
+  if (typeof ev.type !== 'string') return false
+  switch (ev.type) {
+    case 'user/message':
+    case 'assistant/message':
+      return !!ev.message && typeof ev.message === 'object'
+    case 'tool/call':
+      return (
+        typeof ev.id === 'string' &&
+        typeof ev.name === 'string' &&
+        !!ev.input &&
+        typeof ev.input === 'object'
+      )
+    case 'tool/result':
+      // 只要求 id：`result`（新格式）与 `content`（旧 JSONL）都可缺省，派生侧已兜底
+      return typeof ev.id === 'string'
+    case 'context/inject':
+      return typeof ev.text === 'string'
+    case 'compaction/summary':
+      return typeof ev.summary === 'string'
+    case 'compaction/rewrite':
+      return Array.isArray(ev.messages)
+    default:
+      return true
+  }
+}
+
 const SUMMARY_PREFIX = '[Earlier conversation summary]:'
 
 export function isCompactionSummary(m: Message): boolean {

package/src/core/session-store.ts

@@ -212,6 +212,11 @@ export class SessionStore {
 
   /**
    * List all saved sessions, most recent first.
+   *
+   * 单个文件读不出来只赔上它自己 —— 这里是为**逐文件**兜底，不是给整个列表兜底：
+   * 从前 try 包住整个 for 循环，第一个抛异常的文件就让 `/resume` 一条会话都不显示，
+   * 而其余文件全是好的。读不出来的（坏结构、半截写、I/O 错）直接跳过：连 metadata
+   * 都建不出来的会话没法在列表里表示。
    */
   static list(): SessionMetadata[] {
     ensureDir()
@@ -220,7 +225,12 @@ export class SessionStore {
       const sessions: SessionMetadata[] = []
       for (const file of files) {
         const name = file.replace('.jsonl', '')
-        const session = SessionStore.load(name)
+        let session: StoredSession | null = null
+        try {
+          session = SessionStore.load(name)
+        } catch {
+          continue
+        }
         if (session?.metadata) {
           sessions.push(session.metadata)
         }

package/src/daemon/session-worker.ts

@@ -126,6 +126,9 @@ export class SessionWorker {
     let totalInputTokens = 0
     let totalOutputTokens = 0
     let stopReason: string = 'end_turn'
+    // The provider hit its output ceiling at least once in this turn. Reported only
+    // when nothing worse happened — the three original values keep their precedence.
+    let truncated = false
 
     try {
       for await (const chunk of this.engine.process(prompt, signal)) {
@@ -152,6 +155,13 @@ export class SessionWorker {
           if (chunk.outputTokens) totalOutputTokens += chunk.outputTokens
         }
 
+        // A turn cut off at the provider's output ceiling must not be reported as a
+        // clean finish — downstream (the benchmark driver reads stopReason) would
+        // read a truncated trial as a legitimate ending.
+        if (chunk.type === 'stop' && chunk.truncated) {
+          truncated = true
+        }
+
         // Deliberately NO break on 'stop' — the chunk type is overloaded here.
         // Providers emit a provider-level 'stop' unconditionally at the end of
         // EVERY LLM stream, including tool-call turns; the engine still has to
@@ -169,6 +179,11 @@ export class SessionWorker {
       stopReason = 'interrupted'
     }
 
+    // ── Truncation is the weakest signal: interrupted / error still win ──
+    if (truncated && stopReason === 'end_turn') {
+      stopReason = 'output_limit'
+    }
+
     // Step 4: Persist assistant response and finalize
     if (assistantContent) {
       // Save the final (or partial) assistant message

package/src/index.tsx

@@ -53,7 +53,8 @@ import { initTelemetry, enableTelemetryNow } from './telemetry/index'
 import { wasPrompted, markPrompted, isInteractive, setTelemetryEnabled } from './telemetry/consent'
 import { officialEndpointHost } from './telemetry/endpoint'
 import { getWorkspaceTrust } from './core/workspace-trust'
-import { ARTIFACTS_DIR, ARTIFACT_PORT, MIPHAM_DIR } from './shared/constants'
+import { ARTIFACT_PORT } from './shared/constants'
+import { artifactsRoot } from './artifacts/paths'
 import { AgentViewManager } from './agent-view/agent-view-manager'
 import { AgentViewDashboard } from './agent-view/dashboard'
 import { createT } from './i18n-core/t'
@@ -598,7 +599,7 @@ export async function runApp(options: RunOptions): Promise<void> {
   }
 
   // Start artifact server (lazy — first artifact creation triggers listening)
-  const artifactsDir = join(process.cwd(), MIPHAM_DIR, ARTIFACTS_DIR)
+  const artifactsDir = artifactsRoot(process.cwd())
   const artifactServer = new ArtifactServer(artifactsDir, ARTIFACT_PORT)
 
   // Create query engine

package/src/plugin/plugin-manager.ts

@@ -9,7 +9,7 @@ import {
 } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
-import { execSync } from 'node:child_process'
+import { execFileSync } from 'node:child_process'
 import { validatePlugin } from './plugin-validator'
 
 const PLUGIN_DIR = join(homedir(), '.mipham', 'plugins')
@@ -110,11 +110,22 @@ export class PluginManager {
         'utf-8',
       )
 
-      execSync(`npm install ${packageName} --prefix "${stagingDir}" --no-save`, {
-        encoding: 'utf-8',
-        stdio: 'pipe',
-        timeout: 60_000,
-      })
+      // `--ignore-scripts`: without it, installing a plugin runs that package's
+      // preinstall/install/postinstall hooks as the current user — arbitrary
+      // code execution from any npm package, reachable via `/install-plugin`.
+      // A plugin only needs to *be* files on disk; it never needs a build step
+      // of its own to be loaded from here. `execFileSync` (argv array, no
+      // shell) keeps the command line independent of packageName, so package
+      // name validation is not the only thing standing between us and a shell.
+      execFileSync(
+        'npm',
+        ['install', packageName, '--prefix', stagingDir, '--no-save', '--ignore-scripts'],
+        {
+          encoding: 'utf-8',
+          stdio: 'pipe',
+          timeout: 60_000,
+        },
+      )
 
       // npm installs the package into <stagingDir>/node_modules/<packageName>/ —
       // validate there, then flatten it to the plugin dir root so its layout

package/src/providers/anthropic.ts

@@ -33,6 +33,7 @@ interface AnthropicSSEEvent {
     text?: string
     thinking?: string
     partial_json?: string
+    stop_reason?: string | null
   }
   error?: { type: string; message: string }
   usage?: { input_tokens: number; output_tokens: number }
@@ -52,12 +53,21 @@ export class AnthropicProvider implements ProviderInstance {
     let currentToolId = ''
     let accumulatedToolInput = ''
 
+    // Set when the provider reports `stop_reason: 'max_tokens'` — the turn was cut
+    // off at the output ceiling rather than ended by the model.
+    let truncated = false
+
     const messages = this.convertMessages(req.messages)
     this.markPrefixCacheBreakpoint(messages)
 
+    // Priority: explicit request override (summarizer / sub-agent call sites) >
+    // the model's declared ceiling > 4096. The fallback stays: a model id that
+    // isn't in `config.models` has no known ceiling.
+    const declaredMaxOutput = this.config.models.find((m) => m.id === req.model)?.maxOutput
+
     const body: Record<string, unknown> = {
       model: req.model,
-      max_tokens: req.maxTokens || 4096,
+      max_tokens: req.maxTokens || declaredMaxOutput || 4096,
       stream: true,
       messages,
     }
@@ -184,6 +194,13 @@ export class AnthropicProvider implements ProviderInstance {
             }
 
             case 'content_block_stop': {
+              // 此刻还无从得知本轮是否被截断 —— `stop_reason` 要到后面的
+              // `message_delta` 才到（见下方同名分支）。所以被截断的 `tool_use`
+              // 在这里已经发出去了；openai-compat 那条路上「截断即丢弃未完成的
+              // tool_call」的处置，这里结构上做不到（它的 finish_reason 与
+              // tool_calls 落在同一个响应体里）。**这是有意的不对称，不是漏做**：
+              // 要在这里丢弃，就得把 `tool_use` 缓冲到 `message_stop` 再发 ——
+              // 那是一次行为变更，不属本次范围。
               if (currentToolId && currentToolName && accumulatedToolInput) {
                 let parsedInput: Record<string, unknown> = {}
                 try {
@@ -223,11 +240,18 @@ export class AnthropicProvider implements ProviderInstance {
               if (event.delta?.type === 'input_json_delta' && event.delta.partial_json) {
                 accumulatedToolInput += event.delta.partial_json
               }
+              // `max_tokens` means the turn hit the output ceiling. Without this the
+              // truncation is indistinguishable from `end_turn`: both arrive here and
+              // the terminal stop below looks the same either way.
+              const stopReason = event.delta?.stop_reason
+              if (stopReason === 'max_tokens') {
+                truncated = true
+              }
               break
             }
 
             case 'message_stop': {
-              yield { type: 'stop' }
+              yield truncated ? { type: 'stop', truncated: true } : { type: 'stop' }
               return
             }
 

package/src/providers/openai-compat.ts

@@ -17,11 +17,16 @@ export class OpenAICompatProvider implements ProviderInstance {
       ) || 'https://api.openai.com/v1'
     const apiKey = this.resolveApiKey(this.config.apiKey)
 
+    // Priority: explicit request override (summarizer / sub-agent call sites) >
+    // the model's declared ceiling > 8192. The fallback stays: local `ollama`
+    // model ids are not in `config.models`, so their real ceiling is unknown.
+    const declaredMaxOutput = this.config.models.find((m) => m.id === req.model)?.maxOutput
+
     const body = {
       model: req.model,
       messages: this.convertMessages(req.messages, req.systemPrompt),
       stream: true,
-      max_tokens: req.maxTokens || 8192,
+      max_tokens: req.maxTokens || declaredMaxOutput || 8192,
       temperature: req.temperature,
       tools: req.tools?.map((t) => ({ type: 'function', function: t })),
     }
@@ -173,6 +178,14 @@ export class OpenAICompatProvider implements ProviderInstance {
           if (choice.finish_reason === 'stop') {
             yield { type: 'stop', reasoning_content: reasoningContent }
           }
+
+          if (choice.finish_reason === 'length') {
+            // Truncated: the accumulated tool calls were cut off mid-arguments, so
+            // their JSON is incomplete. Drop them rather than dispatching a broken
+            // call, and clear the map so the `[DONE]` handler can't emit them either.
+            pendingToolCalls.clear()
+            yield { type: 'stop', reasoning_content: reasoningContent, truncated: true }
+          }
         } catch {
           // skip unparseable chunks
         }

package/src/security/path.ts

@@ -113,8 +113,13 @@ function findExistingParent(p: string): string | undefined {
 
 /**
  * Check if `child` is within `parent` (or equal to it).
+ *
+ * Compares path segments, not string prefixes: `/a/b-evil` is NOT within
+ * `/a/b`. Both sides are expected to be resolved (no `..`, no trailing slash
+ * beyond the root). The trailing-slash normalization below is for callers that
+ * hand in an unresolved string such as `/proj/src/`.
  */
-function isWithin(child: string, parent: string): boolean {
+export function isWithin(child: string, parent: string): boolean {
   // Normalize trailing slashes for comparison
   const c = child.endsWith('/') ? child.slice(0, -1) : child
   const p = parent.endsWith('/') ? parent.slice(0, -1) : parent

package/src/shared/atomic-write.ts

@@ -1,17 +1,40 @@
-import { writeFileSync, renameSync } from 'node:fs'
+import { writeFileSync, renameSync, unlinkSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
 
 /**
- * Write a file atomically: write to a same-directory `.tmp` file, then rename
+ * Write a file atomically: write to a same-directory temp file, then rename
  * over the target. Same-filesystem rename is atomic, so a crash or kill
  * mid-write can never leave a truncated/corrupt file — readers see either the
  * old or the new content, never a partial write.
+ *
+ * The temp name carries the pid and a random suffix rather than being a fixed
+ * `path + '.tmp'`. Several callers write to *shared* locations (the telemetry
+ * queue on every process exit, skill usage, the CRSI ledger), so two sessions or
+ * daemon workers on one machine can be inside this function for the same path at
+ * the same time. With one shared temp name that interleaving loses a write (the
+ * first rename moves the *second* writer's content into place) and then throws
+ * ENOENT on the other writer's rename — in a function whose whole point is that
+ * the target is never observed half-written. Same directory is still required:
+ * rename is only atomic within a filesystem.
  */
 export function atomicWriteFileSync(
   path: string,
   content: string,
   options: { mode?: number } = {},
 ): void {
-  const tmp = path + '.tmp'
-  writeFileSync(tmp, content, { encoding: 'utf-8', mode: options.mode ?? 0o600 })
-  renameSync(tmp, path)
+  const tmp = `${path}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`
+  try {
+    writeFileSync(tmp, content, { encoding: 'utf-8', mode: options.mode ?? 0o600 })
+    renameSync(tmp, path)
+  } catch (err) {
+    // Clean up on the failure path: a fixed temp name used to be overwritten by
+    // the next writer, but unique names mean every abandoned write would leave
+    // its own orphan forever — nothing else ever sweeps this directory.
+    try {
+      unlinkSync(tmp)
+    } catch {
+      // Already renamed away (or never created) — nothing to clean.
+    }
+    throw err
+  }
 }

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.81.7' as const
+export const PACKAGE_VERSION = '0.81.8' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/types.ts

@@ -138,6 +138,15 @@ export interface StreamChunk {
   inputTokens?: number
   /** API-reported output token count (type: 'usage'). */
   outputTokens?: number
+  /**
+   * The provider stopped because it hit the output token ceiling
+   * (OpenAI `finish_reason: 'length'` / Anthropic `stop_reason: 'max_tokens'`).
+   * Set **only when true** — absent on every normal stop, so the success path
+   * stays byte-identical. Without it a truncated turn is indistinguishable
+   * from a turn the model chose to end: the provider emits its terminal stop
+   * either way, and tool calls cut off mid-arguments are dropped silently.
+   */
+  truncated?: boolean
 }
 
 // ── Config Types ──

package/src/tools/artifact/artifact.ts

@@ -1,7 +1,8 @@
 import { writeFileSync, mkdirSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import type { ToolDefinition } from '../../shared/index.ts'
-import { ARTIFACTS_DIR, ARTIFACT_MAX_SIZE } from '../../shared/constants'
+import { ARTIFACT_MAX_SIZE } from '../../shared/constants'
+import { artifactsRoot } from '../../artifacts/paths'
 import { addToManifest, readManifest, archiveVersion } from '../../artifacts/manifest'
 
 const NAME_PATTERN = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/
@@ -57,8 +58,10 @@ export const artifactTool: ToolDefinition = {
       }
     }
 
-    // Determine output paths
-    const baseDir = join(ctx.cwd, ARTIFACTS_DIR)
+    // Determine output paths — the server's root, the manifest's home and this
+    // directory are one and the same; computing it here is what made the URL a
+    // guaranteed 404 before.
+    const baseDir = artifactsRoot(ctx.cwd)
     const sessionDir = join(baseDir, ctx.sessionId)
     mkdirSync(sessionDir, { recursive: true })
 
@@ -100,7 +103,7 @@ export const artifactTool: ToolDefinition = {
     const prev = manifestPre.artifacts.find((a) => a.name === name && a.sessionId === ctx.sessionId)
     const versionCount = prev?.versionCount || (isUpdate ? 1 : undefined)
 
-    addToManifest(
+    const { quarantined } = addToManifest(
       baseDir,
       {
         name,
@@ -124,6 +127,12 @@ export const artifactTool: ToolDefinition = {
     const galleryUrl = port ? `http://localhost:${port}` : undefined
     const versionLine = archivedVersion ? `   Prev archived as: ${archivedVersion}` : ''
     const galleryLine = galleryUrl ? `Gallery: ${galleryUrl}` : ''
+    // The index was unreadable and got moved aside, so this publish started from
+    // nothing: say it here, or the user reads "saved" and never learns that the
+    // rest of the index is now a file next to it.
+    const warnLine = quarantined
+      ? `   ⚠️  Index was unreadable; previous index kept at ${quarantined}`
+      : ''
 
     return {
       success: true,
@@ -132,6 +141,7 @@ export const artifactTool: ToolDefinition = {
         `   URL:  ${url}`,
         `   Size: ${size.toLocaleString()} bytes`,
         versionLine,
+        warnLine,
         galleryLine,
         '',
         `Open in browser: /artifact open ${name}`,

package/src/tools/exec/bash.ts

@@ -1,7 +1,8 @@
+import { resolve } from 'node:path'
 import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
 import { sanitizeCommand } from '../../shared/sanitize.ts'
 import { DANGEROUS_GIT_PATTERNS } from './git.ts'
-import { isUncOrDevicePath } from '../../security/path.ts'
+import { isUncOrDevicePath, isWithin } from '../../security/path.ts'
 import { findWorktreeMarker } from '../../core/paths.ts'
 import type { Service } from '../../vajra'
 import { toolKey } from '../seam'
@@ -308,6 +309,36 @@ function parseErrorLocations(stderr: string): ErrorLocation[] {
   return unique.slice(0, 10)
 }
 
+/**
+ * 找出命令里第一个 `cd` 到工作区之外的**目标原样字符串**（供错误文案用）；
+ * 无逃逸返回 null。判定边界是 `worktreeRoot`（项目根），不是 `cwd` ——
+ * 既有行为即如此：`cd <项目内其它目录>` 放行（见 test/tools/exec.test.ts
+ * 「allows cd inside the project from a .mipham worktree」）。
+ *
+ * 此前三个缺陷，其中两个是活的绕过：
+ *  - 相对路径用字符串拼接而非 `resolve`：`cd ../../../..` 拼出来的串仍以
+ *    cwd 开头，于是被当成「在区内」放行 —— **活绕过**；
+ *  - `command.match(...)` 非全局，只看第一个 `cd`，`cd sub && cd /etc` 的
+ *    后半段完全不检查 —— **活绕过**；
+ *  - 归属判定用 `resolved.startsWith(cwd)` 字符串前缀比较，`/proj/w1-evil`
+ *    会被判成「在 /proj/w1 里」；它只被 root 那个析取项兜住才没显形，故一并
+ *    改成按路径分段比较的 `isWithin`。
+ */
+export function resolveWorktreeEscape(
+  cwd: string,
+  worktreeRoot: string,
+  command: string,
+): string | null {
+  const cdRe = /\bcd\s+(?:"([^"]+)"|'([^']+)'|([^\s;|&]+))/g
+  for (const m of command.matchAll(cdRe)) {
+    const target = m[1] ?? m[2] ?? m[3]
+    if (!target) continue
+    const resolved = resolve(cwd, target)
+    if (!isWithin(resolved, cwd) && !isWithin(resolved, worktreeRoot)) return target
+  }
+  return null
+}
+
 export function createBashTool(credentialConfig?: CredentialMaskingConfig): ToolDefinition {
   return {
     name: 'Bash',
@@ -339,23 +370,14 @@ export function createBashTool(credentialConfig?: CredentialMaskingConfig): Tool
       // 隔离度只增不减（只认新前缀会让旧工作树失去保护）。
       const worktreeMarker = findWorktreeMarker(ctx.cwd)
       if (worktreeMarker) {
-        // Detect cd to absolute paths outside the worktree
-        const cdEscapePattern = /\bcd\s+(?:"([^"]+)"|'([^']+)'|([^\s;|&]+))/
-        const cdMatch = command.match(cdEscapePattern)
-        if (cdMatch) {
-          const target = cdMatch[1] || cdMatch[2] || cdMatch[3] || ''
-          // Resolve relative to cwd
-          const resolved = target.startsWith('/')
-            ? target
-            : `${ctx.cwd}/${target}`.replace(/\/\.\//g, '/')
-          if (!resolved.startsWith(ctx.cwd) && !resolved.startsWith(worktreeMarker.root + '/')) {
-            return {
-              success: false,
-              content: '',
-              error:
-                `Worktree isolation: cannot cd outside worktree directory. ` +
-                `Attempted: ${target}. Use tools within the worktree only.`,
-            }
+        const escapeTarget = resolveWorktreeEscape(ctx.cwd, worktreeMarker.root, command)
+        if (escapeTarget !== null) {
+          return {
+            success: false,
+            content: '',
+            error:
+              `Worktree isolation: cannot cd outside worktree directory. ` +
+              `Attempted: ${escapeTarget}. Use tools within the worktree only.`,
           }
         }
       }

package/src/tools/exec/git.ts

@@ -1,5 +1,7 @@
+import { resolve } from 'node:path'
 import type { ToolDefinition } from '../../shared/index.ts'
 import { findWorktreeMarker } from '../../core/paths.ts'
+import { isWithin } from '../../security/path.ts'
 
 // P0-4 (v2.1.222 alignment): Regex-based word-boundary patterns replace
 // fragile substring matching. Each pattern describes what it blocks.
@@ -75,8 +77,11 @@ function isOutsideWorktree(command: string, cwd: string): string | null {
     let match: RegExpExecArray | null
     while ((match = pathPattern.exec(command)) !== null) {
       const refPath = match[1]!
-      // If the referenced path is outside the worktree, block it
-      if (!refPath.startsWith(cwd) && !refPath.startsWith(worktreeRoot + '/')) {
+      // 归一后按**路径分段**判归属，不用字符串前缀：此前 `refPath.startsWith(cwd)`
+      // 从不解析 `..`，`--work-tree=/proj/../etc` 因为「以 /proj/ 开头」被放行，
+      // 而 git 拿到的是 /etc。判据与 Bash 守卫（resolveWorktreeEscape）同一套。
+      const resolved = resolve(cwd, refPath)
+      if (!isWithin(resolved, cwd) && !isWithin(resolved, worktreeRoot)) {
         return `Git command references path outside worktree: ${refPath}`
       }
     }

package/src/tools/file/grep.ts

@@ -16,17 +16,23 @@ export async function runSearch(
   cmd: string[],
   cwd: string,
   timeoutMs: number,
-): Promise<{ stdout: string; timedOut: boolean; exitCode: number | null }> {
+): Promise<{ stdout: string; stderr: string; timedOut: boolean; exitCode: number | null }> {
   const proc = Bun.spawn(cmd, { cwd, stdout: 'pipe', stderr: 'pipe' })
   let timedOut = false
   const timer = setTimeout(() => {
     timedOut = true
     proc.kill()
   }, timeoutMs)
-  const stdout = await new Response(proc.stdout).text()
+  // 两条管道必须**并发**读。先读满 stdout 再读 stderr 会在子进程写满
+  // stderr（~64 KB 管道缓冲）时死锁：它阻塞在 write 上不退出，stdout 也就
+  // 永远读不到 EOF —— 只能等超时兜底，而超时会把「慢」和「错」说成同一件事。
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ])
   await proc.exited
   clearTimeout(timer)
-  return { stdout, timedOut, exitCode: proc.exitCode }
+  return { stdout, stderr, timedOut, exitCode: proc.exitCode }
 }
 
 /** grep 输出上限：超过则显式截断并附标记（不能静默丢内容——模型会误以为看全了）。 */
@@ -107,7 +113,9 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
         if (exitCode === 0) {
           return {
             success: true,
-            content: maskSearchOutput(stdout || '(no matches)', credentialConfig, 'heading'),
+            content: truncateGrepOutput(
+              maskSearchOutput(stdout || '(no matches)', credentialConfig, 'heading'),
+            ),
           }
         }
         // rg exit 2 (error, e.g. permission denied on protected dirs) — do NOT
@@ -117,12 +125,11 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
         if (stdout && stdout.trim()) {
           return {
             success: true,
-            content: maskSearchOutput(
-              stdout +
-                '\n\n(rg exited 2 — some paths unreadable; narrow scope for complete results)',
-              credentialConfig,
-              'heading',
-            ),
+            // 先截断正文、再拼注解：注解拼在截断之内的话，它自己会被切掉，
+            // 模型拿到的就是一句没头没尾的提示。
+            content:
+              truncateGrepOutput(maskSearchOutput(stdout, credentialConfig, 'heading')) +
+              '\n\n(rg exited 2 — some paths unreadable; narrow scope for complete results)',
           }
         }
         return {
@@ -153,7 +160,11 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
         '+',
       ]
       try {
-        const { stdout, timedOut, exitCode } = await runSearch(grepArgs, ctx.cwd, GREP_TIMEOUT_MS)
+        const { stdout, stderr, timedOut, exitCode } = await runSearch(
+          grepArgs,
+          ctx.cwd,
+          GREP_TIMEOUT_MS,
+        )
         if (timedOut) {
           return {
             success: false,
@@ -161,7 +172,17 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
             error: `Grep timed out after ${GREP_TIMEOUT_MS / 1000}s — narrow scope with "path" and "include".`,
           }
         }
-        if (exitCode === 1) return { success: true, content: '(no matches)' }
+        // 退出码 1 在 find 这里是**两件事**：真的没搜到，和「根本没搜成」
+        // —— 目录不可读、grep 正则非法、grep 不在 PATH，BSD find 全都退 1。
+        // 后者一律伴随 stderr，所以用 stderr 而非退出码分辨；不加这一刀，
+        // 模型会被告知「没有匹配」，而真相是这次搜索压根没跑起来。
+        if (exitCode === 1) {
+          const err = stderr.trim()
+          if (err) {
+            return { success: false, content: '', error: `Search failed: ${err.slice(0, 500)}` }
+          }
+          return { success: true, content: '(no matches)' }
+        }
         if (exitCode === 0) {
           return {
             success: true,
@@ -171,7 +192,10 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
         return {
           success: false,
           content: '',
-          error: 'grep failed. Install ripgrep: brew install ripgrep',
+          error:
+            `grep failed (exit ${exitCode})` +
+            (stderr.trim() ? `: ${stderr.trim().slice(0, 500)}` : '') +
+            '. Install ripgrep: brew install ripgrep',
         }
       } catch {
         return {