@miphamai/cli 0.81.7 → 0.81.9

package/src/core/permission.ts

@@ -7,7 +7,13 @@ import type {
 } from '../shared/index.ts'
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchBashRule, compileRule } from './permission-rules'
-import { loadPermissionConfig, nextMode, clampMode, MODE_CYCLE } from './permission-config'
+import {
+  loadPermissionConfig,
+  nextMode,
+  clampMode,
+  normalizeRestrictions,
+  MODE_CYCLE,
+} from './permission-config'
 
 /**
  * Check if a Bash command is a "verification-only" command that should be
@@ -78,6 +84,8 @@ export class PermissionSystem {
   private allowRules: PermissionRuleEntry[] = []
   private denyRules: PermissionRuleEntry[] = []
   private askRules: PermissionRuleEntry[] = []
+  /** Malformed `permissionRestrictions` entries from the last set/load — see below. */
+  private restrictionWarnings: string[] = []
   /** Legacy exact-name rules for backward compat (set via setRule with 'auto' level). */
   private legacyRules = new Map<string, PermissionLevel>()
   /** Legacy default level from constructor when passed non-mode values like 'ask' or 'bypass'. */
@@ -130,9 +138,17 @@ export class PermissionSystem {
 
   // ── Restrictions (P0: org-level policy gap) ──
 
-  /** Apply org-level permission restrictions. Overwrites any previous restrictions. */
-  setRestrictions(restrictions: PermissionRestrictions | undefined): void {
+  /**
+   * Apply org-level permission restrictions. Overwrites any previous restrictions.
+   *
+   * The value is **validated and normalized** first: a config typo used to leave the
+   * whole policy silently inert (fail-open). Anything unrecognizable is now reported
+   * via `getInvalidRestrictions()` and pins the mode to the strictest (`P1`).
+   */
+  setRestrictions(raw: PermissionRestrictions | undefined): void {
+    const { restrictions, invalid } = normalizeRestrictions(raw)
     this.restrictions = restrictions
+    this.restrictionWarnings = invalid
     // Re-clamp current mode against new restrictions
     if (restrictions) {
       this.mode = clampMode(this.mode, restrictions)
@@ -140,6 +156,15 @@ export class PermissionSystem {
     this.invalidateCache()
   }
 
+  /**
+   * Malformed `permissionRestrictions` entries, one message each — the sibling of
+   * `getInvalidRules()`. Callers are expected to surface these to stderr; a silent
+   * return here means a policy the operator believes is enforced isn't.
+   */
+  getInvalidRestrictions(): string[] {
+    return this.restrictionWarnings
+  }
+
   getRestrictions(): PermissionRestrictions | undefined {
     return this.restrictions
   }
@@ -242,7 +267,13 @@ export class PermissionSystem {
         restrictions: PermissionRestrictions
       }>,
     )
-    this.mode = clampMode(config.mode, config.restrictions ?? this.restrictions)
+    // Same validation as setRestrictions — a config typo must not silently drop the cap
+    if (config.restrictions) {
+      const { restrictions, invalid } = normalizeRestrictions(config.restrictions)
+      this.restrictions = restrictions
+      this.restrictionWarnings = invalid
+    }
+    this.mode = clampMode(config.mode, this.restrictions)
 
     this.allowRules = []
     this.denyRules = []
@@ -255,10 +286,6 @@ export class PermissionSystem {
       this.denyRules.push(compileRule(rule, 'deny'))
     }
 
-    if (config.restrictions) {
-      this.restrictions = config.restrictions
-    }
-
     this.invalidateCache()
   }
 
@@ -310,10 +337,10 @@ export class PermissionSystem {
       }
     }
 
-    // 3. Check allow rules
+    // 3. Check allow rules — but an org ceiling still applies (see allowRuleDecision)
     for (const rule of this.allowRules) {
       if (this.ruleMatches(rule, tool, input)) {
-        const result: PermissionLevel = 'bypass'
+        const result = this.allowRuleDecision(tool, input)
         this.checkCache.set(cacheKey, result)
         return result
       }
@@ -399,19 +426,60 @@ export class PermissionSystem {
     tool: ToolDefinition,
     input: Record<string, unknown>,
   ): boolean {
-    // Try Bash-style matching first
+    // Try Bash-style matching first.
+    //
+    // The compound-command rule differs by direction, and the rule's own
+    // `level` is what decides it: a **deny/ask** rule matches if *any* part of
+    // a compound command matches (wide on purpose), while an **allow** rule
+    // matches only if *every* part does. Without that, `Bash(git:*)` grants
+    // `git status && rm -rf ./src` outright — see matchBashRule's `segmentMode`.
     if (rule.pattern.includes('(')) {
-      return matchBashRule(rule.pattern, tool.name, input)
+      return matchBashRule(rule.pattern, tool.name, input, rule.level === 'allow' ? 'all' : 'any')
     }
     // Simple tool name match
     return rule.pattern === tool.name || rule.compiled.test(tool.name)
   }
 
+  /**
+   * An allow rule matched — what does it actually grant?
+   *
+   * Without an org ceiling it grants `'bypass'` (unchanged behavior). With
+   * `maxAllowedMode` set, the rule may only grant what **the ceiling's own
+   * baseline** would grant: the ceiling is an upper bound on permissiveness, and
+   * a rule is a *source of permission* — letting it jump over the ceiling is the
+   * same defect one layer in. So `allow: ['Bash']` under a ceiling of
+   * `acceptEdits` still permits verification-only Bash, while `git push` falls
+   * back to approval.
+   *
+   * Decided here, at check time, rather than inside `allow()`: `setRestrictions`
+   * may land **after** the rules are registered (`loadConfig`, sub-agents handed
+   * the same restrictions), and a rule registered before the ceiling would
+   * otherwise keep its old meaning.
+   *
+   * Only `maxAllowedMode` gates this. `forbiddenModes` is about *which mode you
+   * may sit in*, not about what a rule may grant, so a `forbiddenModes`-only
+   * config behaves exactly as before.
+   *
+   * The `'mode-baseline'` sentinel (mode `default`) resolves to `tool.permission`
+   * and stops there — deliberately not continuing to the legacy fallback of
+   * `check()` step 7. That fallback can only ever be *wider* than `'ask'`, and a
+   * ceiling must not hand out more than the un-restricted chain would.
+   */
+  private allowRuleDecision(tool: ToolDefinition, input: Record<string, unknown>): PermissionLevel {
+    const cap = this.restrictions?.maxAllowedMode
+    if (!cap) return 'bypass'
+
+    const baseline = this.modeBaseline(tool, input, cap)
+    const level = baseline === 'mode-baseline' ? (tool.permission ?? 'ask') : baseline
+    return level === 'ask' ? 'ask' : 'bypass'
+  }
+
   private modeBaseline(
     tool: ToolDefinition,
     input?: Record<string, unknown>,
+    mode: PermissionMode = this.mode,
   ): PermissionLevel | 'mode-baseline' {
-    switch (this.mode) {
+    switch (mode) {
       case 'default':
         // Delegate to tool.permission (backward compat)
         return 'mode-baseline'

package/src/core/rules-loader.ts

@@ -20,6 +20,7 @@
 import { readdirSync, readFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { globToRegexSource } from './credential-masker/matcher'
+import { findWorktreeMarker } from './paths.ts'
 
 interface RuleFile {
   name: string
@@ -31,9 +32,27 @@ interface RuleFile {
 export class RulesLoader {
   private rules: RuleFile[] = []
   private rulesDir: string
+  /**
+   * Rules directory of the **project the cwd belongs to**, when cwd sits inside
+   * one of our worktrees; `null` otherwise.
+   *
+   * `.mipham/` is gitignored, so a worktree checkout never contains
+   * `.mipham/rules` — `git worktree add .mipham/worktrees/w1` produces a tree
+   * with no `.mipham/` at all (measured). Reading only `cwd` therefore made
+   * every project rule invisible inside a worktree session, **silently**: zero
+   * rules, no warning, empty context block.
+   *
+   * Detection is marker-based (`findWorktreeMarker`, the same one the git/bash
+   * tools use) — a worktree created outside `.mipham/worktrees/` and
+   * `.claude/worktrees/` is not covered.
+   */
+  private projectRulesDir: string | null
 
   constructor(cwd: string) {
     this.rulesDir = join(cwd, '.mipham', 'rules')
+    const marker = findWorktreeMarker(cwd)
+    const projectRulesDir = marker ? join(marker.root, '.mipham', 'rules') : null
+    this.projectRulesDir = projectRulesDir === this.rulesDir ? null : projectRulesDir
   }
 
   /**
@@ -41,16 +60,27 @@ export class RulesLoader {
    */
   load(): void {
     this.rules = []
-    if (!existsSync(this.rulesDir)) return
+    this.readDir(this.rulesDir)
+    if (this.projectRulesDir) this.readDir(this.projectRulesDir)
+  }
 
+  /**
+   * Read every `.md` in `dir` into `this.rules`. A name already loaded wins —
+   * "nearest first": a rule the worktree defines overrides the project copy.
+   */
+  private readDir(dir: string): void {
+    if (!existsSync(dir)) return
     try {
-      const files = readdirSync(this.rulesDir).filter((f) => f.endsWith('.md'))
+      const seen = new Set(this.rules.map((r) => r.name))
+      const files = readdirSync(dir).filter((f) => f.endsWith('.md'))
       for (const file of files) {
-        const filepath = join(this.rulesDir, file)
+        const name = file.replace(/\.md$/, '')
+        if (seen.has(name)) continue
         try {
-          const raw = readFileSync(filepath, 'utf-8')
+          const raw = readFileSync(join(dir, file), 'utf-8')
           const { paths, description, content } = this.parseRule(raw, file)
-          this.rules.push({ name: file.replace(/\.md$/, ''), paths, description, content })
+          this.rules.push({ name, paths, description, content })
+          seen.add(name)
         } catch {
           // Skip unparseable files
         }

package/src/core/session-log.ts

@@ -78,7 +78,11 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
       // 兼容旧 JSONL（存 content:string）；新格式存 result:ToolResult（含 success/error）
       const eo = e as unknown as { id: string; result?: ToolResult; content?: string }
       const result: ToolResult = eo.result ?? { success: true, content: eo.content ?? '' }
-      const content = result.success ? result.content : result.error || result.content
+      // `?? ''`：成功但没记下 content 的事件（`JSON.stringify` 会把 `undefined` 的键整个
+      // 抹掉，所以它在盘上长这样：`{"success":true}`）投影出来必须是**字符串**。
+      // 投影负责形状、provider 负责出网合法（`tool_result.content` 是 `string`）；
+      // 这里留 `undefined` 会让 `JSON.stringify` 同样抹掉该键，把问题送到线上。
+      const content = (result.success ? result.content : result.error || result.content) ?? ''
       out.push({
         role: 'user',
         content: [
@@ -163,7 +167,9 @@ export class SessionLog {
       const trimmed = line.trim()
       if (!trimmed) continue
       try {
-        log.buf.push(JSON.parse(trimmed) as SessionEvent)
+        const parsed: unknown = JSON.parse(trimmed)
+        if (!isValidEvent(parsed)) continue
+        log.buf.push(parsed)
       } catch {
         // 跳过损坏行
       }
@@ -173,6 +179,47 @@ export class SessionLog {
   }
 }
 
+/**
+ * 事件结构校验 —— 磁盘→内存的**唯一**入口（`open()`）用它挡掉坏行。
+ *
+ * 只校验 `deriveMessages` 会解引用的字段：这不是 schema 校验，是「投影不许崩」的
+ * 最低门槛。**合法 JSON 不等于合法事件** —— `null`、`{"type":"user/message"}`（无
+ * message）、`{"type":"compaction/rewrite"}`（无 messages）都过得了 `JSON.parse`，
+ * 却让投影抛 TypeError（rewrite 那条更狠：`out` 直接变 `undefined`，下一条就炸），
+ * 而 `/resume` 那条链上没有 try 兜它。坏行来自手写/拼接/半截重排，不是本进程写的。
+ *
+ * 不校验 `session/start`、`assistant/chunk`、`checker/decision`：投影对它们无分支；
+ * 未知类型一律放行（前向兼容 —— 认不出来不等于要销毁它）。
+ */
+function isValidEvent(e: unknown): e is SessionEvent {
+  if (!e || typeof e !== 'object') return false
+  const ev = e as Record<string, unknown>
+  if (typeof ev.type !== 'string') return false
+  switch (ev.type) {
+    case 'user/message':
+    case 'assistant/message':
+      return !!ev.message && typeof ev.message === 'object'
+    case 'tool/call':
+      return (
+        typeof ev.id === 'string' &&
+        typeof ev.name === 'string' &&
+        !!ev.input &&
+        typeof ev.input === 'object'
+      )
+    case 'tool/result':
+      // 只要求 id：`result`（新格式）与 `content`（旧 JSONL）都可缺省，派生侧已兜底
+      return typeof ev.id === 'string'
+    case 'context/inject':
+      return typeof ev.text === 'string'
+    case 'compaction/summary':
+      return typeof ev.summary === 'string'
+    case 'compaction/rewrite':
+      return Array.isArray(ev.messages)
+    default:
+      return true
+  }
+}
+
 const SUMMARY_PREFIX = '[Earlier conversation summary]:'
 
 export function isCompactionSummary(m: Message): boolean {

package/src/core/session-store.ts

@@ -212,6 +212,11 @@ export class SessionStore {
 
   /**
    * List all saved sessions, most recent first.
+   *
+   * 单个文件读不出来只赔上它自己 —— 这里是为**逐文件**兜底，不是给整个列表兜底：
+   * 从前 try 包住整个 for 循环，第一个抛异常的文件就让 `/resume` 一条会话都不显示，
+   * 而其余文件全是好的。读不出来的（坏结构、半截写、I/O 错）直接跳过：连 metadata
+   * 都建不出来的会话没法在列表里表示。
    */
   static list(): SessionMetadata[] {
     ensureDir()
@@ -220,7 +225,12 @@ export class SessionStore {
       const sessions: SessionMetadata[] = []
       for (const file of files) {
         const name = file.replace('.jsonl', '')
-        const session = SessionStore.load(name)
+        let session: StoredSession | null = null
+        try {
+          session = SessionStore.load(name)
+        } catch {
+          continue
+        }
         if (session?.metadata) {
           sessions.push(session.metadata)
         }

package/src/core/workspace-trust.ts

@@ -1,6 +1,7 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
+import { readFileSync, existsSync, mkdirSync } from 'node:fs'
 import { join, dirname, resolve } from 'node:path'
 import { homedir } from 'node:os'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 
 const MIPHAM_HOME = join(homedir(), '.mipham')
 const TRUST_STORE_PATH = join(MIPHAM_HOME, 'trusted-workspaces.json')
@@ -67,8 +68,16 @@ export class WorkspaceTrust {
       }
       const raw = readFileSync(TRUST_STORE_PATH, 'utf-8')
       const parsed = JSON.parse(raw) as TrustedWorkspaces
-      if (parsed.version !== 1) {
-        // Unknown version — reset
+      // The version check alone guarded a *field* while leaving the shape open:
+      // `{ version: 1 }` passes it and then `for (const trusted of
+      // this.store.directories)` throws on `undefined`. Entries must be strings
+      // too — `isTrusted` calls `.toLowerCase()` on each one.
+      if (
+        parsed.version !== 1 ||
+        !Array.isArray(parsed.directories) ||
+        !parsed.directories.every((d) => typeof d === 'string')
+      ) {
+        // Unknown version or malformed shape — reset
         return { version: 1, directories: [], updatedAt: new Date().toISOString() }
       }
       return parsed
@@ -84,7 +93,14 @@ export class WorkspaceTrust {
         mkdirSync(MIPHAM_HOME, { recursive: true })
       }
       this.store.updatedAt = new Date().toISOString()
-      writeFileSync(TRUST_STORE_PATH, JSON.stringify(this.store, null, 2), 'utf-8')
+      // Atomic: this store's own reader swallows a parse failure into a *reset
+      // store* (see `load`'s catch), so a write interrupted midway does not just
+      // lose the record — it silently un-trusts every directory the user had
+      // approved. Fail-closed, but the user never learns why they are being
+      // asked again.
+      atomicWriteFileSync(TRUST_STORE_PATH, JSON.stringify(this.store, null, 2) + '\n', {
+        mode: 0o600,
+      })
     } catch {
       // Best-effort: don't crash if we can't save
     }
@@ -165,3 +181,25 @@ export function getWorkspaceTrust(): WorkspaceTrust {
 export function resetWorkspaceTrust(): void {
   _instance = null
 }
+
+/**
+ * Say out loud that repository-controlled config was skipped because this
+ * workspace is not trusted.
+ *
+ * Call this only when hooks were *actually* withheld — `SettingsJson` reports
+ * that (`projectHooksSkipped`), so this cannot announce a skip that never
+ * happened.
+ *
+ * Deliberately not silent. When there is no TTY the trust prompt cannot be
+ * asked, so the answer is "no" and the hooks stay out — but a gate that fails
+ * without saying so is indistinguishable from one that passed, and the user is
+ * left wondering why their hooks do nothing. Written to stderr so it cannot
+ * corrupt stdout rendering.
+ */
+export function warnProjectHooksSkipped(cwd: string): void {
+  process.stderr.write(
+    `⚠️  Workspace not trusted: skipped hooks from ${join(cwd, '.mipham', 'settings.json')}\n` +
+      `    (hooks run commands — repository-controlled). Trust this directory in an interactive\n` +
+      `    session to enable them.\n`,
+  )
+}

package/src/daemon/auth.ts

@@ -1,16 +1,8 @@
 // apps/cli/src/daemon/auth.ts
-import { randomBytes } from 'node:crypto'
+import { randomBytes, timingSafeEqual } from 'node:crypto'
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
 import { dirname } from 'node:path'
 
-/**
- * bun-types@1.3.14 lacks constantTimeCompare in type definitions,
- * though the method exists at Bun 1.2+ runtime.
- */
-interface PasswordWithCompare {
-  constantTimeCompare(a: Buffer, b: Buffer): boolean
-}
-
 /**
  * Generate a 64-character hex token using cryptographically secure random bytes.
  */
@@ -35,14 +27,23 @@ export function loadOrCreateToken(tokenPath: string): string {
 
 /**
  * Verify a provided token against the expected token.
- * Uses Bun's constant-time comparison to prevent timing attacks.
+ * Uses a constant-time comparison to prevent timing attacks.
+ *
+ * `Bun.password` has no `constantTimeCompare` — on bun 1.3.14 it is
+ * `['hash','hashSync','verify','verifySync']`. Calling it threw a TypeError, so
+ * every authenticated remote request got a 500 instead of the intended 200/403.
+ * Node's `timingSafeEqual` is the same primitive and works under Bun.
+ *
+ * Length is checked first because `timingSafeEqual` throws RangeError when the
+ * buffers differ in length; unequal length is itself a mismatch, so returning
+ * false early leaks nothing that comparing would not.
  */
 export function verifyToken(expected: string, provided: string): boolean {
   if (!provided || !expected) return false
-  return (Bun.password as unknown as PasswordWithCompare).constantTimeCompare(
-    Buffer.from(expected),
-    Buffer.from(provided),
-  )
+  const a = Buffer.from(expected)
+  const b = Buffer.from(provided)
+  if (a.length !== b.length) return false
+  return timingSafeEqual(a, b)
 }
 
 /**

package/src/daemon/engine-capabilities.ts

@@ -31,6 +31,7 @@ import { RulesLoader } from '../core/rules-loader'
 import { HookEngine } from '../core/hooks'
 import { loadHookConfigs } from '../core/hooks-config'
 import { loadSettingsJson } from '../config/loader'
+import { getWorkspaceTrust, warnProjectHooksSkipped } from '../core/workspace-trust'
 import { AgentRegistry } from '../agent/agent-registry'
 
 export interface DaemonEngineCapabilities {
@@ -87,11 +88,20 @@ function skillsFor(cwd: string, paths?: string[]): SkillsLoader {
 function hooksFor(cwd: string, skills: SkillsLoader): HookEngine {
   const cached = hookCache.get(cwd)
   if (cached) return cached
-  const engine = new HookEngine()
+  // 会话 cwd 必须显式传：daemon 一个进程服务多个会话，`process.cwd()` 是它自己被
+  // 启动时所在的目录，不属于任何会话 —— hooks 会在那里跑，并且**被告知**它在那里。
+  const engine = new HookEngine(cwd)
   for (const skill of skills.list()) {
     for (const hook of skill.hooks ?? []) engine.register(hook)
   }
-  for (const def of loadHookConfigs(loadSettingsJson(cwd).hooks)) engine.register(def)
+  // 项目级 hooks 是仓库可控的代码执行面，且 daemon 这条路径**从不**经过交互式信任
+  // 询问 —— 而 `isCwdAllowed` 只要求会话 cwd 在 daemon 根目录之内（`workspace-guard.ts:27`
+  // `isWithin(cwd, daemonRoot) || isTrusted(cwd)`）⇒ 在未信任的克隆里启动的 daemon，
+  // 以前会照着那个仓库的 settings.json 起子进程。未信任即不加载，并说出口。
+  const projectHooksTrusted = getWorkspaceTrust().isTrusted(cwd)
+  const settings = loadSettingsJson(cwd, { includeProjectHooks: projectHooksTrusted })
+  if (settings.projectHooksSkipped) warnProjectHooksSkipped(cwd)
+  for (const def of loadHookConfigs(settings.hooks)) engine.register(def)
   hookCache.set(cwd, engine)
   return engine
 }

package/src/daemon/remote-engine.ts

@@ -18,7 +18,7 @@
 //   engine.close()
 
 import type { ClientPromptMessage, ClientInterruptMessage, ServerMessage } from './attach-protocol'
-import type { StreamChunk } from '../shared/types'
+import type { PermissionMode, StreamChunk } from '../shared/types'
 
 // ── Public API ───────────────────────────────────────────────────────────────
 
@@ -258,11 +258,16 @@ export class RemoteEngine {
   }
 
   /** Returns a stub permission object so slash commands don't crash. */
-  getPermission(): { setMode(_mode: string): void } {
+  getPermission(): { setMode(_mode: PermissionMode): void; getMode(): PermissionMode } {
+    // Remote mode: permissions are managed by the daemon, and the attach protocol has
+    // no read-back — so `getMode` reports the last mode the user asked for (which is
+    // what the footer has always shown here), not a value the daemon never confirmed.
+    let requested: PermissionMode = 'default'
     return {
-      setMode: (_mode: string) => {
-        // Remote mode: permissions are managed by the daemon
+      setMode: (mode: PermissionMode) => {
+        requested = mode
       },
+      getMode: () => requested,
     }
   }
 

package/src/daemon/server.ts

@@ -101,6 +101,10 @@ export function buildDaemonPermission(
   for (const msg of permission.getInvalidRules()) {
     process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
   }
+  // Sibling channel for malformed restrictions (P1) — same as the CLI entry.
+  for (const msg of permission.getInvalidRestrictions()) {
+    process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
+  }
   return permission
 }
 
@@ -140,6 +144,12 @@ export function createServer(config: ServerConfig): Server<WsData> {
     dingtalk,
   } = config
 
+  // Mutable: `POST /api/v1/auth/rotate` replaces the live token. Destructuring
+  // `token` above yields a const, so the rotate route could only ever write the
+  // new token to disk — the running server kept accepting the old one and
+  // rejected the one it had just handed out.
+  let activeToken = token
+
   const wsClients = new Map<string, Set<ServerWebSocket<WsData>>>()
 
   // Captured once: a later chdir must not move the boundary that callers'
@@ -362,6 +372,23 @@ export function createServer(config: ServerConfig): Server<WsData> {
   const server = Bun.serve<WsData>({
     port,
     hostname,
+    // The fetch handler below has no top-level try/catch, so anything it throws
+    // reaches Bun — and `development` is true unless NODE_ENV=production, which
+    // for a daemon bound to MIPHAM_BIND=0.0.0.0 means an unauthenticated peer
+    // gets Bun's development error overlay. Measured on bun 1.3.14: with the
+    // flag off the body is a 67,154-byte HTML application; with it on, 21 bytes
+    // of plain text.
+    //
+    // Not established, and so not claimed: that the overlay hands back the
+    // source. Re-requesting the failing URL with the overlay's own Accept
+    // header, guessing the on-disk path, and /bun:info all failed to return the
+    // thrown text in a local probe (every unmatched path returned the same
+    // shell). What is certain is the shape: a developer debugging UI, shipped
+    // with its own JS, served to whoever sent the request.
+    //
+    // Set explicitly rather than relying on NODE_ENV — how an exposed daemon
+    // answers an error must not depend on the user's environment.
+    development: false,
     async fetch(req, server) {
       // ── CORS preflight ──────────────────────────────
       const corsResponse = corsMiddleware(req)
@@ -397,7 +424,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
       }
 
       // ── Auth check ──────────────────────────────────
-      const authError = authMiddleware(req, token, server.requestIP(req)?.address)
+      const authError = authMiddleware(req, activeToken, server.requestIP(req)?.address)
       if (authError) return addCorsHeaders(authError, req)
 
       // Helper: create JSON response with CORS headers for external origins
@@ -691,6 +718,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
       // ── Auth: rotate token ───────────────────────────
       if (method === 'POST' && path === '/api/v1/auth/rotate') {
         const newToken = rotateToken(tokenPath)
+        activeToken = newToken
         return json({ ok: true, data: { token: newToken } })
       }
 

package/src/daemon/session-worker.ts

@@ -126,6 +126,9 @@ export class SessionWorker {
     let totalInputTokens = 0
     let totalOutputTokens = 0
     let stopReason: string = 'end_turn'
+    // The provider hit its output ceiling at least once in this turn. Reported only
+    // when nothing worse happened — the three original values keep their precedence.
+    let truncated = false
 
     try {
       for await (const chunk of this.engine.process(prompt, signal)) {
@@ -152,6 +155,13 @@ export class SessionWorker {
           if (chunk.outputTokens) totalOutputTokens += chunk.outputTokens
         }
 
+        // A turn cut off at the provider's output ceiling must not be reported as a
+        // clean finish — downstream (the benchmark driver reads stopReason) would
+        // read a truncated trial as a legitimate ending.
+        if (chunk.type === 'stop' && chunk.truncated) {
+          truncated = true
+        }
+
         // Deliberately NO break on 'stop' — the chunk type is overloaded here.
         // Providers emit a provider-level 'stop' unconditionally at the end of
         // EVERY LLM stream, including tool-call turns; the engine still has to
@@ -169,6 +179,11 @@ export class SessionWorker {
       stopReason = 'interrupted'
     }
 
+    // ── Truncation is the weakest signal: interrupted / error still win ──
+    if (truncated && stopReason === 'end_turn') {
+      stopReason = 'output_limit'
+    }
+
     // Step 4: Persist assistant response and finalize
     if (assistantContent) {
       // Save the final (or partial) assistant message