@miphamai/cli 0.81.7 → 0.81.9

package/src/tools/scheduling/cron.ts

@@ -26,14 +26,31 @@ export interface CronJob {
   createdAt: string
   nextFire: string
   lastFired: string | null
+  /**
+   * The directory this job belongs to. The store is global (`~/.mipham/cron/`)
+   * and every session's poller reads all of it, so without this a job created in
+   * project A gets executed by whichever session in project B happens to be
+   * running — its prompt expands against the wrong codebase.
+   *
+   * Optional because files written before this field existed genuinely lack it;
+   * the poller treats a missing `cwd` as "any directory" so those keep firing.
+   */
+  cwd?: string
+  /** Session that created the job. Informational — the poller keys on `cwd`. */
+  sessionId?: string
 }
 
 function jobPath(id: string): string {
   return join(CRON_DIR, `${id}.json`)
 }
 
-function generateId(cron: string, prompt: string): string {
-  return createHash('sha256').update(`${cron}:${prompt}`).digest('hex').slice(0, 12)
+/**
+ * Job id includes `cwd`: keyed on `cron:prompt` alone, creating the same schedule
+ * in two directories wrote to the same file and the second silently replaced the
+ * first.
+ */
+function generateId(cron: string, prompt: string, cwd: string): string {
+  return createHash('sha256').update(`${cwd}:${cron}:${prompt}`).digest('hex').slice(0, 12)
 }
 
 /**
@@ -101,11 +118,11 @@ export const cronCreateTool: ToolDefinition = {
     },
     required: ['cron', 'prompt'],
   },
-  async execute(params, _ctx) {
+  async execute(params, ctx) {
     const cron = params.cron as string
     const prompt = params.prompt as string
     const recurring = params.recurring !== false
-    const id = generateId(cron, prompt)
+    const id = generateId(cron, prompt, ctx.cwd)
 
     const now = new Date()
     const job: CronJob = {
@@ -116,6 +133,8 @@ export const cronCreateTool: ToolDefinition = {
       createdAt: now.toISOString(),
       nextFire: computeNextFire(cron, now),
       lastFired: null,
+      cwd: ctx.cwd,
+      sessionId: ctx.sessionId,
     }
 
     writeJob(job)
@@ -127,6 +146,7 @@ export const cronCreateTool: ToolDefinition = {
         `Created ${type} cron job.\n` +
         `ID: ${id}\n` +
         `Schedule: ${cron}\n` +
+        `Scoped to: ${ctx.cwd}\n` +
         `Prompt: "${prompt.slice(0, 80)}${prompt.length > 80 ? '...' : ''}"`,
     }
   },
@@ -182,11 +202,20 @@ export const cronListTool: ToolDefinition = {
     const lines = [`── Scheduled Cron Jobs (${jobs.length}) ──`, '']
     for (const j of jobs) {
       const type = j.recurring ? 'recurring' : 'one-shot'
-      lines.push(`${j.id}  ${j.cron}  ${type}`)
+      // 目录要看得见：任务被限定在建立它的那个目录，从别的项目 `/schedule` 列出来时
+      // 用户得能看出它为什么不在自己这里跑。**没有 cwd 的旧文件恰恰相反** —— 它在任何
+      // 目录都会执行，而这里是唯一能看见那件事的地方，所以必须显式标出来（留空等于
+      // 把「无归属」显示成「和别的任务一样」）。
+      lines.push(`${j.id}  ${j.cron}  ${type}  ${j.cwd ? `[${j.cwd}]` : '[无归属]'}`)
       lines.push(`  ${j.prompt.slice(0, 100)}`)
       lines.push('')
     }
 
+    if (jobs.some((j) => !j.cwd)) {
+      lines.push('⚠️ [无归属] 是加 cwd 字段之前写的任务：没有目录可判，任何项目里都会执行。')
+      lines.push('   消除办法：在目标目录里用 CronCreate 重建，或让 Mipham 用 CronDelete 删掉。')
+    }
+
     return { success: true, content: lines.join('\n') }
   },
 }

package/src/tools/system/config.ts

@@ -1,7 +1,8 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
+import { readFileSync, existsSync, mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
 import { parse as parseYaml, stringify } from 'yaml'
+import { atomicWriteFileSync } from '../../shared/atomic-write'
 import type { ToolDefinition } from '../../shared/index.ts'
 
 const MIPHAM_HOME = join(homedir(), '.mipham')
@@ -60,7 +61,10 @@ export const configTool: ToolDefinition = {
         obj = obj[k] as Record<string, unknown>
       }
       obj[keys[keys.length - 1]!] = params.value
-      writeFileSync(USER_CONFIG, stringify(config), 'utf-8')
+      // 原子写 + 0o600：这是整份 read-modify-write，裸 writeFileSync 原地截断 ——
+      // 崩在写中途就留下半截 YAML，而权限由 umask 决定（典型 0644），比同一份配置的
+      // 另一个写者 saveProviderApiKey（loader.ts，0600 原子写）更松。
+      atomicWriteFileSync(USER_CONFIG, stringify(config), { mode: 0o600 })
       return { success: true, content: `Set ${key} = ${params.value}` }
     }
 

package/src/ui/app.tsx

@@ -114,9 +114,46 @@ const PERMISSION_COLORS: Record<PermissionMode, string> = {
   bypassPermissions: 'red',
 }
 
+/** 页脚读模式所需的最小面 —— `QueryEngine` 与 `RemoteEngine` 都满足。 */
+export type PermissionSource = {
+  setMode(mode: PermissionMode): void
+  getMode(): PermissionMode
+}
+
+/**
+ * 页脚那一行是**执行的镜像，不是本地猜的值**。
+ *
+ * 组织级限制（`maxAllowedMode` / `forbiddenModes`）会在 `setMode` 里**静默改写**你请求的
+ * 那一档，所以页脚存「请求值」就会报出一个引擎不会给你的权限 —— 说放行、实际审批。
+ * 初始值与每次 Shift+Tab 都从这里回读。
+ */
+export function livePermissionMode(permission: PermissionSource): PermissionMode {
+  return permission.getMode()
+}
+
+/** 走一档 Shift+Tab 循环，然后**回读**真正生效的模式（上限可能把这一档压回去）。 */
+export function cyclePermissionMode(
+  permission: PermissionSource,
+  current: PermissionMode,
+): PermissionMode {
+  const idx = PERMISSION_MODES.indexOf(current)
+  const next = PERMISSION_MODES[(idx + 1) % PERMISSION_MODES.length]!
+  permission.setMode(next)
+  return permission.getMode()
+}
+
+/** 预览截断按 UTF-16 码元计数，落点若正好夹在一个代理对中间，切完就留下
+ *  **半个** emoji（终端渲染成 U+FFFD）。落点是高代理时后退一个码元即可。 */
+export function truncateForDisplay(text: string, max: number): string {
+  if (text.length <= max) return text
+  const last = text.charCodeAt(max - 1)
+  const end = last >= 0xd800 && last <= 0xdbff ? max - 1 : max
+  return text.slice(0, end)
+}
+
 /** Format a tool's input parameters into a compact one-line detail string.
  *  Tool display names follow Claude Code convention: Write/Edit → Update. */
-function formatToolDetail(name: string, input: Record<string, unknown>): string {
+export function formatToolDetail(name: string, input: Record<string, unknown>): string {
   switch (name) {
     case 'Bash':
       return sanitizeForDisplay((input.command as string) || '')
@@ -125,13 +162,13 @@ function formatToolDetail(name: string, input: Record<string, unknown>): string
     case 'Write':
       return (input.file_path as string) || '' // displayed as "Update" in chat
     case 'Edit':
-      return `${(input.file_path as string) || ''}: ${((input.old_string as string) || '').slice(0, 60)}` // displayed as "Update" in chat
+      return `${(input.file_path as string) || ''}: ${truncateForDisplay((input.old_string as string) || '', 60)}` // displayed as "Update" in chat
     case 'Grep':
       return (input.pattern as string) || ''
     case 'Glob':
       return (input.pattern as string) || ''
     case 'Agent':
-      return `${(input.subagent_type as string) || 'general'}, "${((input.description as string) || (input.prompt as string) || '').slice(0, 80)}"`
+      return `${(input.subagent_type as string) || 'general'}, "${truncateForDisplay((input.description as string) || (input.prompt as string) || '', 80)}"`
     case 'WebSearch':
       return (input.query as string) || ''
     case 'WebFetch':
@@ -139,7 +176,7 @@ function formatToolDetail(name: string, input: Record<string, unknown>): string
     case 'Task':
       return `"${(input.subject as string) || ''}"`
     default:
-      return JSON.stringify(input).slice(0, 80)
+      return truncateForDisplay(JSON.stringify(input), 80)
   }
 }
 
@@ -251,7 +288,11 @@ export function App({
   const [focusMode, setFocusMode] = useState(false)
   const [_ultracodeMode, setUltracodeMode] = useState(false)
   const [goalText, setGoalText] = useState('')
-  const [permissionMode, setPermissionMode] = useState<PermissionMode>('default')
+  // 初始值取自 live 权限系统 —— 启动时 config 的模式可能已被组织级限制钳到别处
+  // （页脚写死 'default' 时会与执行不一致，且偏差方向是「报得比实际宽」）。
+  const [permissionMode, setPermissionMode] = useState<PermissionMode>(() =>
+    livePermissionMode(engine.getPermission()),
+  )
   const abortRef = useRef<AbortController | null>(null)
   // Monotonic turn id — lets a stale turn's finally() skip resetting shared UI
   // state (isLoading/abortRef/progress) after a newer turn has already started.
@@ -1239,12 +1280,7 @@ export function App({
                     })
                   }}
                   onCyclePermission={() => {
-                    setPermissionMode((prev) => {
-                      const idx = PERMISSION_MODES.indexOf(prev)
-                      const next = PERMISSION_MODES[(idx + 1) % PERMISSION_MODES.length]!
-                      engine.getPermission().setMode(next)
-                      return next
-                    })
+                    setPermissionMode((prev) => cyclePermissionMode(engine.getPermission(), prev))
                   }}
                   onCancel={() => {
                     if (abortRef.current) {

package/src/ui/commands.ts

@@ -13,6 +13,7 @@ import type { PluginManager } from '../plugin/plugin-manager'
 import type { Message } from '../shared/types.js'
 import type { UpdateStatus } from '../shared/update'
 import { McpClient } from '../mcp/client'
+import { unregisterMcpServerTools } from '../mcp/registry'
 import { buildCapabilityReport } from '../core/capability-inventory'
 import { InstructionsLoader } from '../core/instructions'
 import { findDerivableSections, DERIVABLE_HINTS } from '../core/claude-md-audit'
@@ -56,6 +57,7 @@ import {
 import { NPM_UPDATE_COMMAND, PACKAGE_VERSION, COAUTHOR_TRAILER } from '../shared/index.ts'
 import { getPreference } from '../config/preferences'
 import { loadCrossSessionConfig, tryRestoreFromBackup } from '../config/loader'
+import { getWorkspaceTrust } from '../core/workspace-trust'
 import { getMemoryManager } from '../core/memory/memory-loader'
 import {
   resolveTelemetry,
@@ -363,14 +365,18 @@ const contextCmd: CommandHandler = (ctx) => {
   const tokens = c.getEstimatedTokens()
   const msgs = c.getMessages()
   const systemPromptLen = c.getSystemPrompt().length
+  // 窗口与阈值一律问引擎：模型注册表里 1M/256K/128K/32K 都有，写死 200K 会
+  // 让 1M 模型显示约 5 倍偏高的百分比，并把压缩点说成 90%（实际 95%）。
+  const maxTokens = c.getMaxTokens()
+  const threshold = c.getCompactionThreshold()
   return {
     content: stripIndent`
       ${t('commands.context.title')}
       ${t('commands.context.messages')}       ${msgs.length}
-      ${t('commands.context.estimated_tokens')} ${tokens.toLocaleString()} / 200,000
-      ${t('commands.context.usage_pct')}           ${((tokens / 200_000) * 100).toFixed(1)}%
+      ${t('commands.context.estimated_tokens')} ${tokens.toLocaleString()} / ${maxTokens.toLocaleString()}
+      ${t('commands.context.usage_pct')}           ${((tokens / maxTokens) * 100).toFixed(1)}%
       ${t('commands.context.system_prompt')}   ${systemPromptLen.toLocaleString()} chars (~${Math.ceil(systemPromptLen / 4).toLocaleString()} tokens)
-      ${t('commands.context.compaction')}      at 90% (${(200_000 * 0.9).toLocaleString()} tokens)
+      ${t('commands.context.compaction')}      at ${(threshold * 100).toFixed(0)}% (${Math.round(maxTokens * threshold).toLocaleString()} tokens)
     `,
   }
 }
@@ -395,7 +401,7 @@ const statusCmd: CommandHandler = async (ctx) => {
       ${t('commands.status.provider')}   ${ctx.providerId}
       ${t('commands.status.model')}      ${ctx.modelId}
       ${t('commands.status.messages')}   ${c.getMessages().length}
-      ${t('commands.status.tokens')}     ~${c.getEstimatedTokens().toLocaleString()} / 200,000
+      ${t('commands.status.tokens')}     ~${c.getEstimatedTokens().toLocaleString()} / ${c.getMaxTokens().toLocaleString()}
       ${t('commands.status.tools')}      ${tools.size} ${t('commands.status.loaded')}
       ${t('commands.status.permission')} ${ctx.config.permission}
 
@@ -412,16 +418,18 @@ const statusCmd: CommandHandler = async (ctx) => {
 
 const costCmd: CommandHandler = (ctx) => {
   const t = resolveT(ctx)
-  const tokens = ctx.engine.getContext().getEstimatedTokens()
-  const cacheStatus = ctx.engine.getContext().getCacheStatus()
+  const c = ctx.engine.getContext()
+  const tokens = c.getEstimatedTokens()
+  const cacheStatus = c.getCacheStatus()
   const cachedTokens = cacheStatus.cachedTokens
   const hitRatio = tokens > 0 ? Math.min(1, cachedTokens / tokens) : 0
   const uncachedTokens = Math.max(0, tokens - cachedTokens)
+  const maxTokens = c.getMaxTokens()
   return {
     content: stripIndent`
       ${t('commands.context_tokens.title')}
-      ${t('commands.context_tokens.context_tokens')} ~${tokens.toLocaleString()} / 200,000
-      ${t('commands.context_tokens.usage')} ${((tokens / 200_000) * 100).toFixed(1)}%
+      ${t('commands.context_tokens.context_tokens')} ~${tokens.toLocaleString()} / ${maxTokens.toLocaleString()}
+      ${t('commands.context_tokens.usage')} ${((tokens / maxTokens) * 100).toFixed(1)}%
       ${t('commands.context_tokens.prompt_cache', {
         cached: cachedTokens.toLocaleString(),
         ratio: (hitRatio * 100).toFixed(1),
@@ -2257,7 +2265,7 @@ const usageCmd: CommandHandler = (ctx) => {
   const c = ctx.engine.getContext()
   const estTokens = c.getEstimatedTokens()
   const msgs = c.getMessages()
-  const maxTokens = 200_000
+  const maxTokens = c.getMaxTokens()
   const pct = ((estTokens / maxTokens) * 100).toFixed(1)
 
   const tracker = ctx.engine.getUsageTracker()
@@ -3133,9 +3141,10 @@ const doctorCmd: CommandHandler = async (ctx) => {
   const c = ctx.engine.getContext()
   const msgs = c.getMessages()
   const tokens = c.getEstimatedTokens()
+  const maxTokens = c.getMaxTokens()
   lines.push(`Messages     ${msgs.length}`)
   lines.push(
-    `Tokens       ~${tokens.toLocaleString()} / 200,000 (${((tokens / 200_000) * 100).toFixed(1)}%)`,
+    `Tokens       ~${tokens.toLocaleString()} / ${maxTokens.toLocaleString()} (${((tokens / maxTokens) * 100).toFixed(1)}%)`,
   )
   lines.push(`Checkpoints  ${c.getCheckpoints().length}`)
 
@@ -3637,13 +3646,16 @@ const statsCmd: CommandHandler = (ctx) => {
       assistant: String(assistantMsgs),
       system: String(systemMsgs),
     }),
-    t('commands.stats.tokens', { tokens: tokens.toLocaleString() }),
+    t('commands.stats.tokens', {
+      tokens: tokens.toLocaleString(),
+      max: c.getMaxTokens().toLocaleString(),
+    }),
     t('commands.stats.tools', { count: String(tools.size) }),
     t('commands.stats.provider', { provider: ctx.providerId }),
     t('commands.stats.model', { model: ctx.modelId }),
     t('commands.stats.permission', { permission: ctx.config.permission }),
     '',
-    t('commands.stats.usage', { pct: ((tokens / 200_000) * 100).toFixed(1) }),
+    t('commands.stats.usage', { pct: ((tokens / c.getMaxTokens()) * 100).toFixed(1) }),
   ]
 
   // ── CRSI & SIS extensions ──
@@ -3780,18 +3792,42 @@ const cdCmd: CommandHandler = async (ctx, args) => {
 const hooksCmd: CommandHandler = async (ctx) => {
   const t = resolveT(ctx)
   const { loadSettingsJson } = await import('../config/loader')
-  const settingsJson = loadSettingsJson(process.cwd())
-
-  const hooks = settingsJson.hooks as Record<
-    string,
-    Array<{ matcher?: string; hooks: Array<{ type: string; command?: string }> }>
-  >
+  const cwd = process.cwd()
+  // This command *displays* the configured list, so it asks for the project file
+  // explicitly — the loader's default drops project hooks (they are
+  // repository-controlled code execution) and would hide hooks that really do
+  // exist here.
+  //
+  // Two calls, one per source: the merged list cannot say which entry came from
+  // which file, and the two are not governed alike — only the project file's
+  // entries are gated on workspace trust.
+  const userHooks = loadSettingsJson(cwd).hooks
+  const projectHooks = loadSettingsJson(cwd, { includeProjectHooks: true }).projectHooks ?? {}
+
+  // Listing them is not the same claim as their running. Project hooks are
+  // gated, and this command renders them even when the gate is shut — so the
+  // display has to name the source and say which entries will not run.
+  const gated = !getWorkspaceTrust().isTrusted(cwd)
+
+  type Entry = { matcher?: string; hooks: Array<{ type: string; command?: string }> }
+  const sources: Array<{ project: boolean; hooks: Record<string, Entry[]> }> = [
+    { project: true, hooks: projectHooks as Record<string, Entry[]> },
+    { project: false, hooks: userHooks as Record<string, Entry[]> },
+  ]
 
-  const configured = Object.entries(hooks).filter(
-    ([, entries]) => Array.isArray(entries) && entries.length > 0,
-  )
+  // Event → its entries, project first — the order the merged list produced, so
+  // a trusted workspace's output is unchanged by the split.
+  const byEvent = new Map<string, Array<{ entry: Entry; project: boolean }>>()
+  for (const { project, hooks } of sources) {
+    for (const [eventName, entries] of Object.entries(hooks)) {
+      if (!Array.isArray(entries) || entries.length === 0) continue
+      const bucket = byEvent.get(eventName) ?? []
+      for (const entry of entries) bucket.push({ entry, project })
+      byEvent.set(eventName, bucket)
+    }
+  }
 
-  if (configured.length === 0) {
+  if (byEvent.size === 0) {
     return { content: t('commands.hooks.no_hooks') }
   }
 
@@ -3803,13 +3839,15 @@ const hooksCmd: CommandHandler = async (ctx) => {
   ]
 
   let count = 0
-  for (const [eventName, entries] of configured) {
-    for (const entry of entries) {
+  for (const [eventName, bucket] of byEvent) {
+    for (const { entry, project } of bucket) {
       for (const hook of entry.hooks) {
         count++
         const matcher = entry.matcher || '*'
         const cmd = hook.type === 'command' && hook.command ? hook.command : hook.type
-        lines.push(`  ${eventName} [${matcher}] → ${cmd}`)
+        const source = t(project ? 'commands.hooks.source_project' : 'commands.hooks.source_user')
+        const suffix = project && gated ? `  ${t('commands.hooks.gated')}` : ''
+        lines.push(`  [${source}] ${eventName} [${matcher}] → ${cmd}${suffix}`)
       }
     }
   }
@@ -4092,7 +4130,12 @@ const resumeLastCmd: CommandHandler = async (ctx) => {
             loaded: String(messages.length),
             total: String(session.messages.length),
           })
-        : t('commands.resume.restored_full_footer', { loaded: String(messages.length) }),
+        : t('commands.resume.restored_full_footer', {
+            loaded: String(messages.length),
+            // 文案里的 `{name}` 必须真给：`t()` 把没给的占位符替换成**空串**
+            // （`t.ts` 的 `params[k] ?? ''`），漏掉就静默印出 `--resume ""`。
+            name: latest.name,
+          }),
     ].join('\n'),
     forwardedMessages: messages,
     resumeWarning: true,
@@ -4319,6 +4362,16 @@ const upgradeCmd: CommandHandler = async (ctx) => {
 
   const update = checkForUpdates()
 
+  // The registry was never reached. "Already up to date" would be a claim we
+  // cannot support: `checkForUpdates` leaves `latest === current` on failure, so
+  // the old code printed "✓ Already up to date (v0.81.8 → v0.81.8)" while
+  // offline and gave no hint that a check had even been attempted.
+  // (`mipham update` on the CLI path already says "Could not determine latest
+  // version" — this is the TUI's equivalent.)
+  if (!update.checked) {
+    return { content: t('commands.upgrade.check_failed', { current: update.current }) }
+  }
+
   if (!update.available) {
     return {
       content: t('commands.upgrade.uptodate', { current: update.current, latest: update.latest }),
@@ -4688,18 +4741,51 @@ const mcpCmd: CommandHandler = async (ctx, args) => {
   if (sub === 'disconnect') {
     const name = args[1]
     if (!name) return { content: 'Usage: /mcp disconnect <server-name>' }
-    const tools = client.disconnect(name)
+    client.disconnect(name)
+    // Dropping the connection is not dropping the tools. They live in the
+    // engine's registry — the map the model actually calls — and closing the
+    // transport leaves every one of them registered and selectable, failing
+    // only at call time. Count what the registry actually gave up, not what the
+    // connection used to hold: those are different objects and only one of them
+    // is what "removed" refers to.
+    const toolsMap = ctx.engine.getTools()
+    const before = toolsMap.size
+    unregisterMcpServerTools(name, toolsMap)
+    const removed = before - toolsMap.size
     return {
       content: [
         `── MCP Disconnect: ${name} ──`,
         '',
-        tools.length > 0
-          ? `Disconnected. ${tools.length} tool(s) removed.`
+        removed > 0
+          ? `Disconnected. ${removed} tool(s) removed.`
           : 'Disconnected (no tools were registered).',
       ].join('\n'),
     }
   }
 
+  // /mcp reconnect <name>
+  if (sub === 'reconnect') {
+    const name = args[1]
+    if (!name) return { content: 'Usage: /mcp reconnect <server-name>' }
+    try {
+      await client.reconnect(name)
+      const count = client.getTools(name).length
+      return {
+        content: `── MCP Reconnect: ${name} ──\n\nReconnected — ${count} tool(s) rediscovered.`,
+      }
+    } catch (err) {
+      return {
+        content: [
+          `── MCP Reconnect: ${name} ──`,
+          '',
+          `Failed: ${String(err)}`,
+          '',
+          `The server stayed disconnected. Check that it is reachable, then retry — or use /mcp connect ${name}.`,
+        ].join('\n'),
+      }
+    }
+  }
+
   // /mcp reload
   if (sub === 'reload') {
     return {
@@ -4749,6 +4835,7 @@ const mcpCmd: CommandHandler = async (ctx, args) => {
   lines.push('── Commands ──')
   lines.push('  /mcp connect <name>    Connect to a server (OAuth or stdio)')
   lines.push('  /mcp disconnect <name>  Disconnect from a server')
+  lines.push('  /mcp reconnect <name>  Reconnect a dropped server (with backoff)')
   lines.push('  /mcp reload            Disconnect all and reconnect')
   lines.push('')
   lines.push('── Protocol ──')
@@ -4994,7 +5081,7 @@ Or use the Agent tool in a conversation to launch a sub-agent.`,
   return { content: lines.join('\n') }
 }
 
-const bgCmd: CommandHandler = (ctx, args) => {
+const bgCmd: CommandHandler = async (ctx, args) => {
   const prompt = args.join(' ')
   if (!prompt.trim()) {
     return {
@@ -5023,6 +5110,49 @@ Background agents appear in the Agent View dashboard (/agents).`,
 
   agentViewManager.addMessage(session.id, { role: 'user', content: prompt })
   agentViewManager.updateStatus(session.id, 'working')
+  session.kind = 'unattended'
+
+  // A session row is not a task. Without the spawn below this command only ever
+  // wrote a dashboard entry and reported success — the prompt was never handed
+  // to a model, and the row sat at `working` forever.
+  const bgReg = (await import('../agent/background-registry')).getBackgroundAgentRegistry()
+  bgReg.spawn(
+    prompt,
+    'general',
+    async (_signal) => {
+      const { SubAgent } = await import('../agent/sub-agent')
+      const sa = new SubAgent(
+        ctx.engine.getRegistry(),
+        ctx.engine.getTools(),
+        ctx.engine.getPermission(),
+        undefined,
+        undefined,
+        ctx.engine.getLlm(),
+      )
+      try {
+        // The prompt came from the user typing `/bg …`, so it stays unframed —
+        // unlike a workflow script's computed prompt.
+        const result = await sa.execute(prompt, 'bg: ' + prompt.slice(0, 60), { type: 'general' })
+        agentViewManager.addMessage(session.id, {
+          role: 'assistant',
+          content: result || '(no output)',
+        })
+        agentViewManager.updateStatus(session.id, 'completed')
+        return result
+      } catch (err) {
+        // Leave the row honest on failure too — a session stuck at `working`
+        // after its executor died is the same lie as never spawning at all.
+        const message = err instanceof Error ? err.message : String(err)
+        agentViewManager.addMessage(session.id, {
+          role: 'assistant',
+          content: `Background agent failed: ${message}`,
+        })
+        agentViewManager.updateStatus(session.id, 'failed')
+        throw err
+      }
+    },
+    'unattended',
+  )
 
   return {
     content: `✓ Background agent spawned: ${session.id}
@@ -5191,10 +5321,23 @@ const artifactOpenCmd: CommandHandler = async (ctx, args) => {
     return { content: 'Usage: /artifact open <name>\nExample: /artifact open dashboard' }
   }
 
-  const sessionId = 'session-1' // default session
-  const port = 9876
-  const ext = name.endsWith('.svg') ? '' : '.html'
-  const url = `http://localhost:${port}/${sessionId}/${name}${ext}`
+  const { readManifest } = await import('../artifacts/manifest')
+  const { artifactsRoot } = await import('../artifacts/paths')
+  const manifest = readManifest(artifactsRoot(process.cwd()))
+
+  // 先找本会话，再退到任意会话：文件在磁盘上跨会话留存，而 `open` 是用户手敲的。
+  // 原先写死 `session-1` + 端口 9876，工具回报的却是真会话 id 和**实际**端口
+  // （服务端遇到端口占用会自增），所以这条命令从构造上就打不开任何东西。
+  const entry =
+    manifest.artifacts.find((a) => a.name === name && a.sessionId === ctx.sessionId) ??
+    manifest.artifacts.find((a) => a.name === name)
+
+  if (!entry) {
+    return { content: `✗ No artifact named "${name}". Run /artifact list to see them.` }
+  }
+
+  // 用工具落盘时记下的 URL —— 那就是它印给用户的同一个坐标，两边不该各算一次。
+  const url = entry.url
 
   try {
     await openBrowser(url)
@@ -5204,13 +5347,14 @@ const artifactOpenCmd: CommandHandler = async (ctx, args) => {
   }
 }
 
-const artifactListCmd: CommandHandler = async (_ctx, _args) => {
-  const { getSessionArtifacts } = await import('../artifacts/manifest')
-  const { join } = await import('node:path')
-  const { ARTIFACTS_DIR } = await import('../shared/constants')
+const artifactListCmd: CommandHandler = async (ctx, _args) => {
+  const { readManifest, getSessionArtifacts } = await import('../artifacts/manifest')
+  const { artifactsRoot } = await import('../artifacts/paths')
 
-  const dir = join(process.cwd(), ARTIFACTS_DIR)
-  const entries = getSessionArtifacts(dir, 'session-1')
+  const dir = artifactsRoot(process.cwd())
+  // 会话 id 取自真实上下文，不是写死的 'session-1' —— 工具落盘时写的是真 id，
+  // 写死的那一支必然过滤出空列表。
+  const entries = getSessionArtifacts(dir, ctx.sessionId)
 
   if (entries.length === 0) {
     return {
@@ -5226,7 +5370,9 @@ const artifactListCmd: CommandHandler = async (_ctx, _args) => {
     )
   }
   lines.push('', `  ${entries.length} artifact(s) — /artifact open <name> to view`)
-  lines.push(`  Gallery: http://localhost:9876`)
+  // 画廊端口同样不写死：用最近一次落盘记下的那个（服务端会因端口占用自增）。
+  const { port } = readManifest(dir)
+  if (port) lines.push(`  Gallery: http://localhost:${port}`)
 
   return { content: lines.join('\n') }
 }

package/src/workflow/primitives/agent.ts

@@ -108,6 +108,10 @@ export async function workflowAgent(
         modelOverride: opts.model,
         allowedTools: undefined, // use all tools by default
         worktreePath,
+        // The prompt is computed by the script, not typed by the user — say so,
+        // so text the script relayed from a file or another agent cannot pass
+        // as the user's own opening instruction.
+        promptOrigin: 'script',
       })
 
       lastResult = textResult