@miphamai/cli 0.81.7 → 0.81.9

package/src/i18n-core/locales/en-US.json

@@ -311,27 +311,27 @@
     },
     "resume": {
       "no_sessions": "No saved sessions.",
-      "restored": "─ Session Restored ─",
+      "restored": "─ Session History Loaded ─",
       "not_found": "Session \"{name}\" not found.",
       "saved_title": "─ Saved Sessions ─",
       "found_title": "─ Session Found ─",
       "not_found_title": "─ Session Not Found ─",
       "load_failed": "─ Load Failed ─",
       "restored_content": "Name:      {name}\nMessages:  {total} total{truncated}\nProvider:  {provider} / {model}\nUpdated:   {date}",
-      "restored_footer": "{loaded} of {total} messages loaded. Older context summarized above.",
-      "restored_full_footer": "{loaded} messages loaded. Context has been restored.",
+      "restored_footer": "{loaded} of {total} messages loaded into the view (older ones not shown).",
+      "restored_full_footer": "{loaded} messages loaded into the view. The model's context is unchanged — to continue this session, run: mipham --resume \"{name}\"",
       "delete_usage": "Usage: /resume delete <session-name>\n\nDelete a saved session. Use /resume to list all sessions.",
       "delete_confirmed": "✓ Session \"{name}\" deleted.",
       "delete_not_found": "✗ Session \"{name}\" not found. Use /resume to list all sessions.",
       "empty_footer": "Sessions are auto-saved to ~/.mipham/sessions/ when Mipham Code exits.\nStart a conversation — it will be saved automatically.",
       "total_footer": "Total: {count} session(s) • Location: ~/.mipham/sessions/",
-      "resume_hint": "To resume a session:   /resume <name>",
-      "resume_last_hint": "To resume most recent:  /resume last",
+      "resume_hint": "Session details:        /resume <name>",
+      "resume_last_hint": "Load recent history:    /resume last",
       "delete_hint": "To delete a session:    /resume delete <name>",
       "cli_hint": "To resume from CLI:     mipham --resume \"<name>\"",
-      "auto_save_hint": "Sessions are auto-saved on exit. The most recent session loads automatically on restart.",
+      "auto_save_hint": "Sessions are auto-saved on exit. On restart only the most recent session's summary is injected as context — to reopen a session: mipham --resume \"<name>\"",
       "not_found_content": "No session named \"{name}\".\n\nUse /resume without arguments to list all saved sessions.",
-      "found_content": "Name:      {name}\nMessages:  {messages}\nProvider:  {provider} / {model}\nUpdated:   {updated}\n\nTo resume this session:\n  /resume last    — restore the most recent session\n  mipham --resume \"{target}\"\n\nOr restart Mipham Code — the most recent session loads automatically."
+      "found_content": "Name:      {name}\nMessages:  {messages}\nProvider:  {provider} / {model}\nUpdated:   {updated}\n\nTo continue this session, start a new process with:\n  mipham --resume \"{target}\""
     },
     "help": { "title": "── Mipham Code Help ──" },
     "lang": {
@@ -423,6 +423,7 @@
     },
     "upgrade": {
       "uptodate": "── Upgrade Mipham Code ──\n\nCurrent version: v{current}\nLatest:          v{latest}\n\n✓ Already up to date.\n\nTo check manually: https://www.npmjs.com/package/@miphamai/cli",
+      "check_failed": "── Upgrade Mipham Code ──\n\n✗ Could not reach the npm registry — unable to tell whether v{current} is the latest.\n  Nothing was changed. Check your network, then retry: /upgrade",
       "title": "── Upgrade Mipham Code ──",
       "available": "Current version: v{current}\nLatest:          v{latest}\n\n→ New version available! Updating...",
       "updated": "✓ Updated to @miphamai/cli v{version}",
@@ -558,7 +559,7 @@
     "stats": {
       "title": "── Session Stats ──",
       "messages": "Messages:        {total} ({user} user, {assistant} AI, {system} system)",
-      "tokens": "Tokens:          ~{tokens} / 200,000",
+      "tokens": "Tokens:          ~{tokens} / {max}",
       "tools": "Tools available:  {count}",
       "provider": "Provider:         {provider}",
       "model": "Model:            {model}",
@@ -585,6 +586,9 @@
       "title": "── Hooks ──",
       "no_hooks": "── Hooks ──\n\nNo hooks configured.\n\nConfigure hooks in .mipham/settings.json under the hooks section:\n  PreToolUse   — before each tool\n  PostToolUse  — after each tool\n  Stop         — on session end\n\nCommand hooks read JSON from stdin; exit 2 blocks (stderr as reason).\nUse /loop init to scaffold settings.json.",
       "location": "Location: {path}",
+      "source_user": "user",
+      "source_project": "project",
+      "gated": "⚠️  workspace not trusted — will not run",
       "found": "{count} hook(s) found.",
       "error": "── Hooks ──\n\nCould not read hooks directory."
     },

package/src/i18n-core/locales/zh-CN.json

@@ -311,27 +311,27 @@
     },
     "resume": {
       "no_sessions": "没有已保存的会话。",
-      "restored": "─ 会话已恢复 ─",
+      "restored": "─ 会话历史已载入 ─",
       "not_found": "未找到会话 \"{name}\"。",
       "saved_title": "─ 已保存的会话 ─",
       "found_title": "─ 找到会话 ─",
       "not_found_title": "─ 未找到会话 ─",
       "load_failed": "─ 加载失败 ─",
       "restored_content": "名称:      {name}\n消息数:  {total} 条{truncated}\n提供商:  {provider} / {model}\n更新时间:   {date}",
-      "restored_footer": "已加载 {loaded}/{total} 条消息。较早的上下文已概括。",
-      "restored_full_footer": "已加载 {loaded} 条消息。上下文已恢复。",
+      "restored_footer": "已载入视图 {loaded}/{total} 条消息（较早的未显示）。",
+      "restored_full_footer": "已载入视图 {loaded} 条消息；模型上下文未变 —— 要接着此会话继续，请运行: mipham --resume \"{name}\"",
       "delete_usage": "用法: /resume delete <session-name>\n\n删除已保存的会话。使用 /resume 列出所有会话。",
       "delete_confirmed": "✓ 会话 \"{name}\" 已删除。",
       "delete_not_found": "✗ 未找到会话 \"{name}\"。使用 /resume 列出所有会话。",
       "empty_footer": "会话在 Mipham Code 退出时自动保存到 ~/.mipham/sessions/。\n开始对话 — 它将自动保存。",
       "total_footer": "总计: {count} 个会话 • 位置: ~/.mipham/sessions/",
-      "resume_hint": "恢复会话:   /resume <name>",
-      "resume_last_hint": "恢复最近:  /resume last",
+      "resume_hint": "查看会话详情:   /resume <name>",
+      "resume_last_hint": "载入最近历史:  /resume last",
       "delete_hint": "删除会话:    /resume delete <name>",
       "cli_hint": "命令行恢复:     mipham --resume \"<name>\"",
-      "auto_save_hint": "会话在退出时自动保存。最近会话在重启时自动加载。",
+      "auto_save_hint": "会话在退出时自动保存。重启时仅注入最近会话的摘要作为上下文 —— 要重新打开某个会话: mipham --resume \"<name>\"",
       "not_found_content": "未找到名为 \"{name}\" 的会话。\n\n不带参数运行 /resume 列出所有已保存的会话。",
-      "found_content": "名称:      {name}\n消息数:  {messages}\n提供商:  {provider} / {model}\n更新时间:   {updated}\n\n恢复此会话:\n  /resume last    — 恢复最近的会话\n  mipham --resume \"{target}\"\n\n或重启 Mipham Code — 最近会话将自动加载。"
+      "found_content": "名称:      {name}\n消息数:  {messages}\n提供商:  {provider} / {model}\n更新时间:   {updated}\n\n要接着此会话继续，请另起进程运行:\n  mipham --resume \"{target}\""
     },
     "help": { "title": "── Mipham Code 帮助 ──" },
     "lang": {
@@ -423,6 +423,7 @@
     },
     "upgrade": {
       "uptodate": "── 升级 Mipham Code ──\n\n当前版本: v{current}\n最新版本:          v{latest}\n\n✓ 已是最新版本。\n\n手动检查: https://www.npmjs.com/package/@miphamai/cli",
+      "check_failed": "── 升级 Mipham Code ──\n\n✗ 无法连接 npm registry —— 无法判断 v{current} 是否已是最新版本。\n  未做任何改动。请检查网络后重试: /upgrade",
       "title": "── 升级 Mipham Code ──",
       "available": "当前版本: v{current}\n最新版本:          v{latest}\n\n→ 发现新版本！正在更新...",
       "updated": "✓ 已更新至 @miphamai/cli v{version}",
@@ -558,7 +559,7 @@
     "stats": {
       "title": "── 会话统计 ──",
       "messages": "消息:        {total}（{user} 用户, {assistant} AI, {system} 系统）",
-      "tokens": "Token:          ~{tokens} / 200,000",
+      "tokens": "Token:          ~{tokens} / {max}",
       "tools": "可用工具:  {count}",
       "provider": "提供商:         {provider}",
       "model": "模型:            {model}",
@@ -585,6 +586,9 @@
       "title": "── 钩子 ──",
       "no_hooks": "── 钩子 ──\n\n未配置钩子。\n\n在 .mipham/settings.json 的 hooks 段配置钩子:\n  PreToolUse   — 工具执行前\n  PostToolUse  — 工具执行后\n  Stop         — 会话结束\n\n命令钩子从 stdin 读 JSON，exit 2 拦截（stderr 作理由）。\n使用 /loop init 初始化 settings.json。",
       "location": "位置: {path}",
+      "source_user": "用户级",
+      "source_project": "项目级",
+      "gated": "⚠️  工作区未受信任，不会运行",
       "found": "找到 {count} 个钩子。",
       "error": "── 钩子 ──\n\n无法读取钩子目录。"
     },

package/src/index.tsx

@@ -32,6 +32,7 @@ import { ExperienceRuleEngine } from './core/rule-engine.js'
 import { SessionLog } from './core/session-log'
 import { SessionStore } from './core/session-store'
 import type { PermissionLevel, MiphamConfig, McpServerConfig } from './shared/types'
+import { PermissionSystem } from './core/permission'
 import { SkillsLoader } from './skills/loader'
 import { PluginManager } from './plugin/plugin-manager'
 import { loadPlugins } from './plugin/plugin-loader'
@@ -52,8 +53,9 @@ import { getMetrics } from './core/metrics'
 import { initTelemetry, enableTelemetryNow } from './telemetry/index'
 import { wasPrompted, markPrompted, isInteractive, setTelemetryEnabled } from './telemetry/consent'
 import { officialEndpointHost } from './telemetry/endpoint'
-import { getWorkspaceTrust } from './core/workspace-trust'
-import { ARTIFACTS_DIR, ARTIFACT_PORT, MIPHAM_DIR } from './shared/constants'
+import { getWorkspaceTrust, warnProjectHooksSkipped } from './core/workspace-trust'
+import { ARTIFACT_PORT } from './shared/constants'
+import { artifactsRoot } from './artifacts/paths'
 import { AgentViewManager } from './agent-view/agent-view-manager'
 import { AgentViewDashboard } from './agent-view/dashboard'
 import { createT } from './i18n-core/t'
@@ -374,6 +376,22 @@ export async function runApp(options: RunOptions): Promise<void> {
   // Load configuration
   const config = loadConfig()
 
+  // Permission policy is built **here**, before the system prompt exists, so the prompt
+  // can describe the mode the engine will actually run in. Building the prompt from
+  // `config.permission` handed the model a value that org restrictions can silently
+  // rewrite (and that may not even be a mode name — `bypass`/`auto`/`ask` inject nothing
+  // at all). The engine is created much later, after tools/hooks/vajra are mounted, so
+  // this instance is what gets handed to it rather than a second one built inside.
+  const permission = new PermissionSystem('default')
+  // Sync with config (fix: UI shows "auto" but engine defaulted to bypass-legacy)
+  if (config.permission) {
+    permission.setDefaultLevel(config.permission as PermissionLevel)
+  }
+  // Apply org-level permission restrictions (P0: bypassPermissions policy gap)
+  if (config.permissionRestrictions) {
+    permission.setRestrictions(config.permissionRestrictions)
+  }
+
   // Detect locale and create translation function
   const locale = detectLocale({ lang: options.lang })
   const t = createT(localeBundles[locale] || enUS, enUS)
@@ -478,12 +496,12 @@ export async function runApp(options: RunOptions): Promise<void> {
         }
       }
       context.restoreLog(log)
-      context.setSystemPrompt(instructions.buildSystemPrompt(config.permission as string))
+      context.setSystemPrompt(instructions.buildSystemPrompt(permission.getMode()))
     }
   }
 
   if (context.getMessageCount() === 0) {
-    const basePrompt = instructions.buildSystemPrompt(config.permission as string)
+    const basePrompt = instructions.buildSystemPrompt(permission.getMode())
     const memoryReminder = loadSessionMemories(basePrompt)
     const skillsReminder = skillsLoader.buildSystemReminder(5000, config.skills?.reminder ?? 'full')
 
@@ -581,8 +599,10 @@ export async function runApp(options: RunOptions): Promise<void> {
   // A dead server (e.g. a 15s connect timeout) no longer blocks startup.
   const mcpConnectPromise = connectMcpServers(config.skills?.mcpServers ?? [], tools)
 
-  // Initialize hook engine — register skill-defined hooks
-  const hookEngine = new HookEngine()
+  // Initialize hook engine — register skill-defined hooks.
+  // CLI 是一次性进程，会话 cwd 就是 `process.cwd()`；写出来是为了与 daemon 那处
+  // （`daemon/engine-capabilities.ts` 传会话 cwd）成对照，别让哪边看起来像漏了。
+  const hookEngine = new HookEngine(process.cwd())
   for (const skill of skillsLoader.list()) {
     if (skill.hooks) {
       for (const hook of skill.hooks) {
@@ -591,19 +611,28 @@ export async function runApp(options: RunOptions): Promise<void> {
     }
   }
 
-  // Register settings.json hooks (Claude Code convention — additive across levels)
-  const settingsJson = loadSettingsJson(process.cwd())
+  // Register settings.json hooks (Claude Code convention — additive across levels).
+  // Project-level hooks are repository-controlled shell commands, so they are only
+  // read once this workspace is trusted. On a TTY `checkWorkspaceTrust()` above has
+  // already asked — and exited the process on "no". With no TTY it *cannot* ask, so
+  // the answer is "no" and the hooks stay out rather than running unasked; that
+  // skip is announced, since silence would look the same as having passed.
+  const projectHooksTrusted = getWorkspaceTrust().isTrusted(process.cwd())
+  const settingsJson = loadSettingsJson(process.cwd(), {
+    includeProjectHooks: projectHooksTrusted,
+  })
+  if (settingsJson.projectHooksSkipped) warnProjectHooksSkipped(process.cwd())
   for (const def of loadHookConfigs(settingsJson.hooks)) {
     hookEngine.register(def)
   }
 
   // Start artifact server (lazy — first artifact creation triggers listening)
-  const artifactsDir = join(process.cwd(), MIPHAM_DIR, ARTIFACTS_DIR)
+  const artifactsDir = artifactsRoot(process.cwd())
   const artifactServer = new ArtifactServer(artifactsDir, ARTIFACT_PORT)
 
   // Create query engine
   const ruleEngine = new ExperienceRuleEngine()
-  const engine = new QueryEngine(registry, context, tools, undefined, ruleEngine)
+  const engine = new QueryEngine(registry, context, tools, permission, ruleEngine)
   engine.setHookEngine(hookEngine)
   engine.setArtifactServer(artifactServer)
   engine.setAgentViewManager(agentViewManager)
@@ -618,15 +647,8 @@ export async function runApp(options: RunOptions): Promise<void> {
   const inferenceHookConfig = loadInferenceHookConfig()
   engine.setInferenceHookConfig(inferenceHookConfig)
 
-  // Sync engine permission with config (fix: UI shows "auto" but engine defaulted to bypass-legacy)
-  if (config.permission) {
-    engine.getPermission().setDefaultLevel(config.permission as PermissionLevel)
-  }
-
-  // Apply org-level permission restrictions (P0: bypassPermissions policy gap)
-  if (config.permissionRestrictions) {
-    engine.getPermission().setRestrictions(config.permissionRestrictions)
-  }
+  // `config.permission` / `permissionRestrictions` are applied up top, on the instance
+  // handed to `new QueryEngine(...)` — the same one whose mode the system prompt reads.
 
   // Apply user-defined permission rules (allow/deny) — wire the rule system into runtime
   if (config.permissionRules) {
@@ -644,6 +666,12 @@ export async function runApp(options: RunOptions): Promise<void> {
     process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
   }
 
+  // Same warning channel for malformed restrictions (P1) — a typo'd
+  // `forbiddenModes`/`maxAllowedMode` used to leave the policy silently inert.
+  for (const msg of engine.getPermission().getInvalidRestrictions()) {
+    process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
+  }
+
   // Initialize agent registry and load plugin agents/skills/MCP/hooks
   const agentRegistry = new AgentRegistry()
   agentRegistry.loadUserAgents()

package/src/mcp/client.ts

@@ -187,6 +187,12 @@ export class McpClient {
     connection.toolsRefreshInFlight = true
     try {
       await this.applyToolsChanged(name)
+    } catch {
+      // A refresh against a server that has gone away must not surface as an
+      // unhandled rejection out of a timer callback — record the lost
+      // connection instead.
+      const current = this.connections.get(name)
+      if (current) this.markIfTransportLost(name, current)
     } finally {
       // Re-read: the server may have been disconnected while we were awaiting.
       const current = this.connections.get(name)
@@ -427,10 +433,28 @@ export class McpClient {
     try {
       return await conn.protocol.callTool(toolName, params)
     } catch (err) {
+      this.markIfTransportLost(serverName, conn)
       return {
         content: [{ type: 'text', text: t('errors.mcp_tool_error', { error: String(err) }) }],
         isError: true,
       }
     }
   }
+
+  /**
+   * Downgrade a connection whose transport has gone away.
+   *
+   * A tool call can fail because the *tool* failed or because the server did, and
+   * only the transport can tell those apart: a closed transport answers nothing
+   * from now on. Without this the connection stays 'connected' and `/mcp` keeps
+   * showing green for a server that is gone.
+   */
+  private markIfTransportLost(name: string, connection: ActiveConnection): void {
+    if (connection.transport.isConnected()) return
+    if (connection.status === 'error') return
+
+    connection.status = 'error'
+    connection.error = 'Connection lost — the transport is no longer connected'
+    this.emit('disconnected', name, connection.error)
+  }
 }

package/src/mcp/http-transport.ts

@@ -12,7 +12,10 @@ type FetchFn = (input: string, init?: RequestInit) => Promise<Response>
  * result text (this is how Forge's `/mcp` streams progressive chunks). We
  * reassemble those slices so callers see one complete result.
  */
-function parseSseResponse(body: string): unknown {
+function parseSseResponse(
+  body: string,
+  onNotification?: (notification: JsonRpcNotification) => void,
+): unknown {
   const messages: Array<{ id?: number; result?: unknown; error?: JsonRpcError }> = []
 
   for (const block of body.split(/\n\n/)) {
@@ -21,7 +24,16 @@ function parseSseResponse(body: string): unknown {
       const payload = line.slice('data:'.length).trim()
       if (!payload) continue
       try {
-        messages.push(JSON.parse(payload))
+        const message = JSON.parse(payload) as JsonRpcResponse & JsonRpcNotification
+        // Server-initiated notifications (e.g. tools/list_changed) arrive on the
+        // same stream as the response to the request in flight. They carry no id
+        // and are not part of that response, so hand them off rather than letting
+        // them count as a result — or as a chunk of one.
+        if (message.method !== undefined && message.id === undefined) {
+          onNotification?.(message as JsonRpcNotification)
+          continue
+        }
+        messages.push(message)
       } catch {
         // Skip unparseable event lines
       }
@@ -111,6 +123,10 @@ export class HttpTransport implements Transport {
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs)
 
+    // Did an HTTP response come back at all? A rejected fetch or a timeout means
+    // the endpoint is unreachable; an error *status* only means it said no.
+    let reachable = false
+
     try {
       const response = await this.fetchImpl(this.url, {
         method: 'POST',
@@ -123,6 +139,7 @@ export class HttpTransport implements Transport {
         signal: controller.signal,
         redirect: 'manual',
       })
+      reachable = true
 
       if (!response.ok) {
         let detail = `HTTP ${response.status}`
@@ -136,7 +153,7 @@ export class HttpTransport implements Transport {
 
       const contentType = response.headers.get('content-type') || ''
       if (contentType.includes('text/event-stream')) {
-        return parseSseResponse(await response.text())
+        return parseSseResponse(await response.text(), (n) => this.dispatchNotification(n))
       }
 
       const json = (await response.json()) as JsonRpcResponse
@@ -146,8 +163,16 @@ export class HttpTransport implements Transport {
       return json.result
     } catch (err) {
       if (controller.signal.aborted) {
+        // The endpoint never answered. Every later request would hang the same
+        // way, so the transport reports itself disconnected — the same state a
+        // stdio transport reaches when its process exits — until reconnect()
+        // replaces it.
+        this.closed = true
         throw requestTimeoutError(method, this.requestTimeoutMs)
       }
+      if (!reachable) {
+        this.closed = true
+      }
       throw err
     } finally {
       clearTimeout(timer)
@@ -182,6 +207,13 @@ export class HttpTransport implements Transport {
     this.notificationHandlers.push(handler)
   }
 
+  /** Hand a server-initiated notification to every registered handler. */
+  private dispatchNotification(notification: JsonRpcNotification): void {
+    for (const handler of this.notificationHandlers) {
+      handler(notification)
+    }
+  }
+
   async close(): Promise<void> {
     this.closed = true
     this.url = null

package/src/plugin/plugin-manager.ts

@@ -9,8 +9,9 @@ import {
 } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
-import { execSync } from 'node:child_process'
+import { execFileSync } from 'node:child_process'
 import { validatePlugin } from './plugin-validator'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 
 const PLUGIN_DIR = join(homedir(), '.mipham', 'plugins')
 
@@ -110,11 +111,22 @@ export class PluginManager {
         'utf-8',
       )
 
-      execSync(`npm install ${packageName} --prefix "${stagingDir}" --no-save`, {
-        encoding: 'utf-8',
-        stdio: 'pipe',
-        timeout: 60_000,
-      })
+      // `--ignore-scripts`: without it, installing a plugin runs that package's
+      // preinstall/install/postinstall hooks as the current user — arbitrary
+      // code execution from any npm package, reachable via `/install-plugin`.
+      // A plugin only needs to *be* files on disk; it never needs a build step
+      // of its own to be loaded from here. `execFileSync` (argv array, no
+      // shell) keeps the command line independent of packageName, so package
+      // name validation is not the only thing standing between us and a shell.
+      execFileSync(
+        'npm',
+        ['install', packageName, '--prefix', stagingDir, '--no-save', '--ignore-scripts'],
+        {
+          encoding: 'utf-8',
+          stdio: 'pipe',
+          timeout: 60_000,
+        },
+      )
 
       // npm installs the package into <stagingDir>/node_modules/<packageName>/ —
       // validate there, then flatten it to the plugin dir root so its layout
@@ -276,7 +288,12 @@ export class PluginManager {
   private loadState(): void {
     try {
       if (existsSync(this.statePath)) {
-        this.plugins = JSON.parse(readFileSync(this.statePath, 'utf-8'))
+        const parsed: unknown = JSON.parse(readFileSync(this.statePath, 'utf-8'))
+        // Parsing is not validating: `{}` / `null` / `"x"` are all valid JSON and
+        // all make the readers below throw (`.find`/`.filter`/`.map` on a
+        // non-array), so a file that is merely *shaped* wrong took down every
+        // plugin command instead of starting empty.
+        this.plugins = Array.isArray(parsed) ? (parsed as InstalledPlugin[]) : []
       }
     } catch {
       this.plugins = []
@@ -284,6 +301,11 @@ export class PluginManager {
   }
 
   private saveState(): void {
-    writeFileSync(this.statePath, JSON.stringify(this.plugins, null, 2), 'utf-8')
+    // Was a bare writeFileSync: an interrupted write left unparseable JSON, and
+    // `loadState` swallows that into `[]` ⇒ the installed-plugin list silently
+    // vanished. Atomic write means a reader sees the old list or the new one.
+    atomicWriteFileSync(this.statePath, JSON.stringify(this.plugins, null, 2) + '\n', {
+      mode: 0o600,
+    })
   }
 }

package/src/providers/anthropic.ts

@@ -33,11 +33,33 @@ interface AnthropicSSEEvent {
     text?: string
     thinking?: string
     partial_json?: string
+    stop_reason?: string | null
   }
   error?: { type: string; message: string }
   usage?: { input_tokens: number; output_tokens: number }
 }
 
+/**
+ * Stand-in for a tool result that has no content of its own.
+ *
+ * `tool_result.content` is normalized to a text block server-side, and an empty
+ * one is rejected with a 400 — which fails the *whole* request, history
+ * included. Multiple paths produce one: a tool that reports success with no
+ * output (`content: ''`), a failed tool with no message, and a log projection
+ * whose `content` never got written (`undefined`). All of them mean the same
+ * thing to the model, so they get the same words.
+ */
+const NO_TOOL_OUTPUT = '(no output)'
+
+/**
+ * An empty text block is not a stylistic wart — Anthropic rejects it with a 400,
+ * and since every message in the request is history, one such block makes the
+ * conversation permanently unsendable (every later turn re-sends it).
+ */
+function isEmptyTextBlock(block: Record<string, unknown>): boolean {
+  return block.type === 'text' && block.text === ''
+}
+
 export class AnthropicProvider implements ProviderInstance {
   private baseUrl = 'https://api.anthropic.com/v1'
   private anthropicVersion = '2023-06-01'
@@ -52,12 +74,21 @@ export class AnthropicProvider implements ProviderInstance {
     let currentToolId = ''
     let accumulatedToolInput = ''
 
+    // Set when the provider reports `stop_reason: 'max_tokens'` — the turn was cut
+    // off at the output ceiling rather than ended by the model.
+    let truncated = false
+
     const messages = this.convertMessages(req.messages)
     this.markPrefixCacheBreakpoint(messages)
 
+    // Priority: explicit request override (summarizer / sub-agent call sites) >
+    // the model's declared ceiling > 4096. The fallback stays: a model id that
+    // isn't in `config.models` has no known ceiling.
+    const declaredMaxOutput = this.config.models.find((m) => m.id === req.model)?.maxOutput
+
     const body: Record<string, unknown> = {
       model: req.model,
-      max_tokens: req.maxTokens || 4096,
+      max_tokens: req.maxTokens || declaredMaxOutput || 4096,
       stream: true,
       messages,
     }
@@ -184,6 +215,13 @@ export class AnthropicProvider implements ProviderInstance {
             }
 
             case 'content_block_stop': {
+              // 此刻还无从得知本轮是否被截断 —— `stop_reason` 要到后面的
+              // `message_delta` 才到（见下方同名分支）。所以被截断的 `tool_use`
+              // 在这里已经发出去了；openai-compat 那条路上「截断即丢弃未完成的
+              // tool_call」的处置，这里结构上做不到（它的 finish_reason 与
+              // tool_calls 落在同一个响应体里）。**这是有意的不对称，不是漏做**：
+              // 要在这里丢弃，就得把 `tool_use` 缓冲到 `message_stop` 再发 ——
+              // 那是一次行为变更，不属本次范围。
               if (currentToolId && currentToolName && accumulatedToolInput) {
                 let parsedInput: Record<string, unknown> = {}
                 try {
@@ -223,11 +261,18 @@ export class AnthropicProvider implements ProviderInstance {
               if (event.delta?.type === 'input_json_delta' && event.delta.partial_json) {
                 accumulatedToolInput += event.delta.partial_json
               }
+              // `max_tokens` means the turn hit the output ceiling. Without this the
+              // truncation is indistinguishable from `end_turn`: both arrive here and
+              // the terminal stop below looks the same either way.
+              const stopReason = event.delta?.stop_reason
+              if (stopReason === 'max_tokens') {
+                truncated = true
+              }
               break
             }
 
             case 'message_stop': {
-              yield { type: 'stop' }
+              yield truncated ? { type: 'stop', truncated: true } : { type: 'stop' }
               return
             }
 
@@ -278,17 +323,23 @@ export class AnthropicProvider implements ProviderInstance {
       if (msg.role === 'system') continue
 
       if (typeof msg.content === 'string') {
-        const content: unknown[] = [{ type: 'text', text: msg.content }]
+        const content: unknown[] = []
+        // 空串不产出 text 块（见 isEmptyTextBlock）：用户发了个空消息、或工具返回
+        // 空内容时会走到这里，而它会让之后每一轮都 400。
+        if (msg.content !== '') content.push({ type: 'text', text: msg.content })
         // DeepSeek V4 thinking mode via Anthropic endpoint: every assistant
         // message must contain a thinking block if any message in history does.
         if (msg.role === 'assistant') {
           const thinkingText = (msg as any).reasoning_content || ''
           content.unshift({ type: 'thinking', thinking: thinkingText })
         }
-        result.push({
-          role: msg.role,
-          content,
-        })
+        // 全部内容都被滤掉的消息**整条**不下发 —— 空 content 数组同样被 API 拒。
+        if (content.length > 0) {
+          result.push({
+            role: msg.role,
+            content,
+          })
+        }
       } else {
         const blocks = (msg.content as ContentBlock[]).map((block) => {
           switch (block.type) {
@@ -338,22 +389,32 @@ export class AnthropicProvider implements ProviderInstance {
               return {
                 type: 'tool_result',
                 tool_use_id: block.tool_use_id,
-                content: block.content,
+                // 空 content 同样整条请求被拒（见 NO_TOOL_OUTPUT）。`||` 而非 `=== ''`：
+                // 投影层缺失该字段时这里是 `undefined`，空数组同理。
+                content: block.content || NO_TOOL_OUTPUT,
                 // 只在失败时下发 —— 成功请求体与改动前逐字节相同，不引入 prompt-cache 前缀抖动
                 ...(block.is_error === true ? { is_error: true } : {}),
               }
 
             default:
-              return { type: 'text', text: '' }
+              // 未知块类型**无法**原样表达，而 `{type:'text',text:''}` 是一个必然被拒
+              // 的载荷 —— 改成丢这一个块（下面的 filter），而不是拿它毒掉整条请求。
+              return null
           }
-        })
+        }) as (Record<string, unknown> | null)[]
+
+        // 丢掉表达不出来的块（未知类型）与空的 text 块。
+        const kept = blocks.filter(
+          (b): b is Record<string, unknown> => b !== null && !isEmptyTextBlock(b),
+        )
 
         // DeepSeek V4 thinking mode via Anthropic endpoint: every assistant
         // message must contain a thinking block if any message in history does.
-        if (msg.role === 'assistant' && !blocks.some((b: any) => b.type === 'thinking')) {
-          blocks.unshift({ type: 'thinking', thinking: '' })
+        if (msg.role === 'assistant' && !kept.some((b) => b.type === 'thinking')) {
+          kept.unshift({ type: 'thinking', thinking: '' })
         }
-        result.push({ role: msg.role, content: blocks })
+        if (kept.length === 0) continue
+        result.push({ role: msg.role, content: kept })
       }
     }
 

package/src/providers/openai-compat.ts

@@ -17,11 +17,16 @@ export class OpenAICompatProvider implements ProviderInstance {
       ) || 'https://api.openai.com/v1'
     const apiKey = this.resolveApiKey(this.config.apiKey)
 
+    // Priority: explicit request override (summarizer / sub-agent call sites) >
+    // the model's declared ceiling > 8192. The fallback stays: local `ollama`
+    // model ids are not in `config.models`, so their real ceiling is unknown.
+    const declaredMaxOutput = this.config.models.find((m) => m.id === req.model)?.maxOutput
+
     const body = {
       model: req.model,
       messages: this.convertMessages(req.messages, req.systemPrompt),
       stream: true,
-      max_tokens: req.maxTokens || 8192,
+      max_tokens: req.maxTokens || declaredMaxOutput || 8192,
       temperature: req.temperature,
       tools: req.tools?.map((t) => ({ type: 'function', function: t })),
     }
@@ -173,6 +178,14 @@ export class OpenAICompatProvider implements ProviderInstance {
           if (choice.finish_reason === 'stop') {
             yield { type: 'stop', reasoning_content: reasoningContent }
           }
+
+          if (choice.finish_reason === 'length') {
+            // Truncated: the accumulated tool calls were cut off mid-arguments, so
+            // their JSON is incomplete. Drop them rather than dispatching a broken
+            // call, and clear the map so the `[DONE]` handler can't emit them either.
+            pendingToolCalls.clear()
+            yield { type: 'stop', reasoning_content: reasoningContent, truncated: true }
+          }
         } catch {
           // skip unparseable chunks
         }