@miphamai/cli 0.81.8 → 0.81.9

package/src/core/permission-config.ts

@@ -20,21 +20,161 @@ export function loadPermissionConfig(raw: Partial<PermissionConfig> = {}): Permi
 }
 
 /**
- * Permission modes ordered from least to most permissive.
- * Used to enforce maxAllowedMode: any mode ranked higher than the cap is forbidden.
+ * Nominal permissiveness ranking, least → most permissive. Two consumers only:
+ * `maxAllowedMode` (drop every mode ranked above the cap) and `clampMode` (walk
+ * downward to the nearest allowed mode below the one requested).
+ *
+ * **The four modes are not totally ordered in reality**, so this array carries
+ * only the relations that are actually measurable:
+ *
+ * - `plan` is strictly the narrowest. It passes only Read/Grep/Glob and sends
+ *   *everything* else to approval, while `default` passes every tool that
+ *   declares `permission: 'auto'` — git, task, web-fetch, cron, memory, … So a
+ *   cap of `'plan'` must not admit `default`, and `plan` belongs at the bottom.
+ * - `acceptEdits` and `default` are **incomparable**: acceptEdits auto-approves
+ *   Write/Edit and verification-only Bash that `default` asks about, while
+ *   `default` auto-approves the non-file `'auto'` tools that acceptEdits asks
+ *   about. No total order is faithful there, so the ranking only needs to carry
+ *   the relations the two consumers rely on.
+ *
+ * The array used to read `default → acceptEdits → plan → …`, which **inverted**
+ * both `plan` relations rather than merely approximating them: `maxAllowedMode:
+ * 'plan'` admitted acceptEdits *and* default — the ceiling let through the wider
+ * mode each time. The pairs are pinned by a probe in `test/core/permission.test.ts`
+ * (P4) so the claim stays measured rather than asserted.
  */
 export const PERMISSION_MODE_HIERARCHY: PermissionMode[] = [
+  'plan',
   'default',
   'acceptEdits',
-  'plan',
   'bypassPermissions',
 ]
 
-/** Valid mode transition order for Shift+Tab cycling. */
-export const MODE_CYCLE: PermissionMode[] = [...PERMISSION_MODE_HIERARCHY]
+/**
+ * Shift+Tab cycling order — deliberately **not** the permissiveness order above.
+ * The cycle is UX (manual → accept edits → plan → bypass); only the hierarchy
+ * answers "is this mode wider than that one". Keeping them separate is what lets
+ * `forbiddenModes` drop an entry from the cycle without disturbing the ranking
+ * that `clampMode` walks.
+ */
+export const MODE_CYCLE: PermissionMode[] = ['default', 'acceptEdits', 'plan', 'bypassPermissions']
+
+/** 规范形 → 把别名与大小写归一到一个键上（键一律小写）。 */
+const MODE_ALIASES: Record<string, PermissionMode> = {
+  default: 'default',
+  plan: 'plan',
+  acceptedits: 'acceptEdits',
+  bypasspermissions: 'bypassPermissions',
+  bypass: 'bypassPermissions', // 遗留 3 档名（PermissionLevel 里的 'bypass'）
+}
+
+/** 认不出的配置一律按这一档收紧 —— 层级表首位即最严的一档（与 P4 同一真源）。 */
+const STRICTEST_MODE: PermissionMode = PERMISSION_MODE_HIERARCHY[0]!
+
+const VALID_MODE_LIST = 'default, plan, acceptEdits, bypassPermissions'
+
+/** 可读的类型名 —— 报错要说清「你给的是个字符串」，而不是只说 invalid。 */
+function describeValue(value: unknown): string {
+  if (value === null) return 'null'
+  if (Array.isArray(value)) return 'array'
+  return typeof value
+}
+
+/** 认得出就返回规范形，认不出返回 undefined（调用方负责告警）。 */
+function normalizeModeName(value: unknown): PermissionMode | undefined {
+  if (typeof value !== 'string') return undefined
+  return MODE_ALIASES[value.trim().toLowerCase()]
+}
+
+/**
+ * 校验并规范化 `permissionRestrictions`。
+ *
+ * 与 `getInvalidRules()` 同一形状：写错的**规则**一直会被告警，写错的**限制**却不会
+ * —— 而限制写错的失效方向是 **fail-open**：`forbiddenModes` 里的错拼一个模式都匹配
+ * 不上；`maxAllowedMode` 认不出时 `indexOf` 返回 -1，`if (capIdx >= 0)` 之后整个上限
+ * 被跳过。于是配置里一个 typo 就让整条组织级策略静默失效，且无任何提示。
+ *
+ * `restrictions` 是规范化后的值（别名与大小写归一、认不出的条目剔除）；
+ * `invalid` 是逐条可读告警。**只要有任意一条认不出来，就按最严一档封顶** ——
+ * 拒绝而不是忽略（忽略就是上面那种 fail-open）。
+ *
+ * 幂等：已规范化的值再喂一次，`invalid` 必为空（子代理会原样转交一次）。
+ */
+export function normalizeRestrictions(raw: unknown): {
+  restrictions?: PermissionRestrictions
+  invalid: string[]
+} {
+  if (raw === undefined || raw === null) return { restrictions: undefined, invalid: [] }
+
+  if (typeof raw !== 'object' || Array.isArray(raw)) {
+    return {
+      restrictions: { maxAllowedMode: STRICTEST_MODE },
+      invalid: [`permissionRestrictions is not an object (got ${describeValue(raw)})`],
+    }
+  }
+
+  const source = raw as Record<string, unknown>
+  const invalid: string[] = []
+  const forbiddenModes: PermissionMode[] = []
+  let maxAllowedMode: PermissionMode | undefined
+  let sawForbidden = false
+  let sawMaxAllowed = false
+
+  for (const key of Object.keys(source)) {
+    if (key !== 'forbiddenModes' && key !== 'maxAllowedMode') {
+      invalid.push(
+        `permissionRestrictions has an unknown key "${key}"; valid keys: forbiddenModes, maxAllowedMode`,
+      )
+    }
+  }
+
+  if (source.forbiddenModes !== undefined) {
+    sawForbidden = true
+    if (!Array.isArray(source.forbiddenModes)) {
+      invalid.push(
+        `permissionRestrictions.forbiddenModes must be an array (got ${describeValue(source.forbiddenModes)})`,
+      )
+    } else {
+      source.forbiddenModes.forEach((entry: unknown, i: number) => {
+        const mode = normalizeModeName(entry)
+        if (mode) forbiddenModes.push(mode)
+        else
+          invalid.push(
+            `permissionRestrictions.forbiddenModes[${i}] is not a permission mode (${JSON.stringify(entry)}); valid: ${VALID_MODE_LIST}`,
+          )
+      })
+    }
+  }
+
+  if (source.maxAllowedMode !== undefined) {
+    sawMaxAllowed = true
+    const mode = normalizeModeName(source.maxAllowedMode)
+    if (mode) maxAllowedMode = mode
+    else
+      invalid.push(
+        `permissionRestrictions.maxAllowedMode is not a permission mode (${JSON.stringify(source.maxAllowedMode)}); valid: ${VALID_MODE_LIST}`,
+      )
+  }
+
+  if (invalid.length > 0) {
+    // fail-closed：认不出来就按最严一档封顶。识别得出的部分照旧保留。
+    invalid.push(
+      `permissionRestrictions could not be fully parsed → mode pinned to the strictest ("${STRICTEST_MODE}")`,
+    )
+    const restrictions: PermissionRestrictions = { maxAllowedMode: STRICTEST_MODE }
+    if (forbiddenModes.length > 0) restrictions.forbiddenModes = forbiddenModes
+    return { restrictions, invalid }
+  }
+
+  const restrictions: PermissionRestrictions = {}
+  if (sawForbidden) restrictions.forbiddenModes = forbiddenModes
+  if (sawMaxAllowed) restrictions.maxAllowedMode = maxAllowedMode
+  if (Object.keys(restrictions).length === 0) return { restrictions: undefined, invalid: [] }
+  return { restrictions, invalid }
+}
 
 /** Resolve which modes are actually permitted given the restrictions. */
-export function getAllowedModes(restrictions?: PermissionRestrictions): PermissionMode[] {
+function getAllowedModes(restrictions?: PermissionRestrictions): PermissionMode[] {
   let allowed = [...MODE_CYCLE]
 
   if (restrictions?.forbiddenModes && restrictions.forbiddenModes.length > 0) {
@@ -52,14 +192,6 @@ export function getAllowedModes(restrictions?: PermissionRestrictions): Permissi
   return allowed
 }
 
-/** Check whether a given mode is permitted under the restrictions. */
-export function isModeAllowed(
-  mode: PermissionMode,
-  restrictions?: PermissionRestrictions,
-): boolean {
-  return getAllowedModes(restrictions).includes(mode)
-}
-
 /**
  * Return the highest allowed mode at or below `desired` given the restrictions.
  * Used to silently downgrade when a forbidden mode is requested.

package/src/core/permission-rules.ts

@@ -557,6 +557,7 @@ export function matchBashRule(
   pattern: string,
   toolName: string,
   toolInput: Record<string, unknown>,
+  segmentMode: 'any' | 'all' = 'any',
 ): boolean {
   // Check if pattern has a parenthesized sub-pattern
   const parenMatch = pattern.match(/^(\w+)\((.+)\)$/)
@@ -567,6 +568,20 @@ export function matchBashRule(
 
   const [, baseTool, subPattern] = parenMatch
 
+  // How a *compound* command is judged when only some parts match:
+  //   'any' (deny / ask) — one matching part is enough. Deliberately wide: a
+  //     deny rule that misses a part is a hole, so `foo && rm -rf /` must be
+  //     caught by `Bash(rm *)`.
+  //   'all' (allow) — every part must match. An allow rule is a *grant*, and
+  //     granting on one matching part hands over the whole compound command:
+  //     `Bash(git:*)` plus `git status && rm -rf ./src` used to return
+  //     `bypass` with no prompt at all.
+  // The `length > 0` guard is load-bearing: `[].every()` is `true`, so a
+  // command with no matchable segment (or no extracted file access) would
+  // otherwise satisfy **any** allow rule — a fail-open of its own.
+  const qualifies = (items: string[], match: (s: string) => boolean): boolean =>
+    segmentMode === 'all' ? items.length > 0 && items.every(match) : items.some(match)
+
   // A Read/Write/Edit rule must also refuse a Bash command that touches the
   // same file (via a reader/editor command or a redirect), not only the
   // Read/Write/Edit tool itself. Otherwise `cat .git-credentials` bypasses a
@@ -575,7 +590,7 @@ export function matchBashRule(
     const cmd = String(toolInput.command || '')
     const access = extractBashFileAccess(cmd)
     const paths = baseTool === 'Read' ? access.read : access.write
-    return paths.some((p) => matchPath(p, subPattern!))
+    return qualifies(paths, (p) => matchPath(p, subPattern!))
   }
 
   if (toolName !== baseTool!) return false
@@ -585,7 +600,7 @@ export function matchBashRule(
   // `$(...)`/backtick substitution, so `Bash(rm *)` catches `x=$(rm -rf ~)`).
   if (baseTool === 'Bash') {
     const cmd = String(toolInput.command || '')
-    return flattenCommand(cmd).some((seg) => wildcardMatch(subPattern!, seg))
+    return qualifies(flattenCommand(cmd), (seg) => wildcardMatch(subPattern!, seg))
   }
 
   // For Write/Edit/Read: match against the file_path with path-glob semantics.

package/src/core/permission.ts

@@ -7,7 +7,13 @@ import type {
 } from '../shared/index.ts'
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchBashRule, compileRule } from './permission-rules'
-import { loadPermissionConfig, nextMode, clampMode, MODE_CYCLE } from './permission-config'
+import {
+  loadPermissionConfig,
+  nextMode,
+  clampMode,
+  normalizeRestrictions,
+  MODE_CYCLE,
+} from './permission-config'
 
 /**
  * Check if a Bash command is a "verification-only" command that should be
@@ -78,6 +84,8 @@ export class PermissionSystem {
   private allowRules: PermissionRuleEntry[] = []
   private denyRules: PermissionRuleEntry[] = []
   private askRules: PermissionRuleEntry[] = []
+  /** Malformed `permissionRestrictions` entries from the last set/load — see below. */
+  private restrictionWarnings: string[] = []
   /** Legacy exact-name rules for backward compat (set via setRule with 'auto' level). */
   private legacyRules = new Map<string, PermissionLevel>()
   /** Legacy default level from constructor when passed non-mode values like 'ask' or 'bypass'. */
@@ -130,9 +138,17 @@ export class PermissionSystem {
 
   // ── Restrictions (P0: org-level policy gap) ──
 
-  /** Apply org-level permission restrictions. Overwrites any previous restrictions. */
-  setRestrictions(restrictions: PermissionRestrictions | undefined): void {
+  /**
+   * Apply org-level permission restrictions. Overwrites any previous restrictions.
+   *
+   * The value is **validated and normalized** first: a config typo used to leave the
+   * whole policy silently inert (fail-open). Anything unrecognizable is now reported
+   * via `getInvalidRestrictions()` and pins the mode to the strictest (`P1`).
+   */
+  setRestrictions(raw: PermissionRestrictions | undefined): void {
+    const { restrictions, invalid } = normalizeRestrictions(raw)
     this.restrictions = restrictions
+    this.restrictionWarnings = invalid
     // Re-clamp current mode against new restrictions
     if (restrictions) {
       this.mode = clampMode(this.mode, restrictions)
@@ -140,6 +156,15 @@ export class PermissionSystem {
     this.invalidateCache()
   }
 
+  /**
+   * Malformed `permissionRestrictions` entries, one message each — the sibling of
+   * `getInvalidRules()`. Callers are expected to surface these to stderr; a silent
+   * return here means a policy the operator believes is enforced isn't.
+   */
+  getInvalidRestrictions(): string[] {
+    return this.restrictionWarnings
+  }
+
   getRestrictions(): PermissionRestrictions | undefined {
     return this.restrictions
   }
@@ -242,7 +267,13 @@ export class PermissionSystem {
         restrictions: PermissionRestrictions
       }>,
     )
-    this.mode = clampMode(config.mode, config.restrictions ?? this.restrictions)
+    // Same validation as setRestrictions — a config typo must not silently drop the cap
+    if (config.restrictions) {
+      const { restrictions, invalid } = normalizeRestrictions(config.restrictions)
+      this.restrictions = restrictions
+      this.restrictionWarnings = invalid
+    }
+    this.mode = clampMode(config.mode, this.restrictions)
 
     this.allowRules = []
     this.denyRules = []
@@ -255,10 +286,6 @@ export class PermissionSystem {
       this.denyRules.push(compileRule(rule, 'deny'))
     }
 
-    if (config.restrictions) {
-      this.restrictions = config.restrictions
-    }
-
     this.invalidateCache()
   }
 
@@ -310,10 +337,10 @@ export class PermissionSystem {
       }
     }
 
-    // 3. Check allow rules
+    // 3. Check allow rules — but an org ceiling still applies (see allowRuleDecision)
     for (const rule of this.allowRules) {
       if (this.ruleMatches(rule, tool, input)) {
-        const result: PermissionLevel = 'bypass'
+        const result = this.allowRuleDecision(tool, input)
         this.checkCache.set(cacheKey, result)
         return result
       }
@@ -399,19 +426,60 @@ export class PermissionSystem {
     tool: ToolDefinition,
     input: Record<string, unknown>,
   ): boolean {
-    // Try Bash-style matching first
+    // Try Bash-style matching first.
+    //
+    // The compound-command rule differs by direction, and the rule's own
+    // `level` is what decides it: a **deny/ask** rule matches if *any* part of
+    // a compound command matches (wide on purpose), while an **allow** rule
+    // matches only if *every* part does. Without that, `Bash(git:*)` grants
+    // `git status && rm -rf ./src` outright — see matchBashRule's `segmentMode`.
     if (rule.pattern.includes('(')) {
-      return matchBashRule(rule.pattern, tool.name, input)
+      return matchBashRule(rule.pattern, tool.name, input, rule.level === 'allow' ? 'all' : 'any')
     }
     // Simple tool name match
     return rule.pattern === tool.name || rule.compiled.test(tool.name)
   }
 
+  /**
+   * An allow rule matched — what does it actually grant?
+   *
+   * Without an org ceiling it grants `'bypass'` (unchanged behavior). With
+   * `maxAllowedMode` set, the rule may only grant what **the ceiling's own
+   * baseline** would grant: the ceiling is an upper bound on permissiveness, and
+   * a rule is a *source of permission* — letting it jump over the ceiling is the
+   * same defect one layer in. So `allow: ['Bash']` under a ceiling of
+   * `acceptEdits` still permits verification-only Bash, while `git push` falls
+   * back to approval.
+   *
+   * Decided here, at check time, rather than inside `allow()`: `setRestrictions`
+   * may land **after** the rules are registered (`loadConfig`, sub-agents handed
+   * the same restrictions), and a rule registered before the ceiling would
+   * otherwise keep its old meaning.
+   *
+   * Only `maxAllowedMode` gates this. `forbiddenModes` is about *which mode you
+   * may sit in*, not about what a rule may grant, so a `forbiddenModes`-only
+   * config behaves exactly as before.
+   *
+   * The `'mode-baseline'` sentinel (mode `default`) resolves to `tool.permission`
+   * and stops there — deliberately not continuing to the legacy fallback of
+   * `check()` step 7. That fallback can only ever be *wider* than `'ask'`, and a
+   * ceiling must not hand out more than the un-restricted chain would.
+   */
+  private allowRuleDecision(tool: ToolDefinition, input: Record<string, unknown>): PermissionLevel {
+    const cap = this.restrictions?.maxAllowedMode
+    if (!cap) return 'bypass'
+
+    const baseline = this.modeBaseline(tool, input, cap)
+    const level = baseline === 'mode-baseline' ? (tool.permission ?? 'ask') : baseline
+    return level === 'ask' ? 'ask' : 'bypass'
+  }
+
   private modeBaseline(
     tool: ToolDefinition,
     input?: Record<string, unknown>,
+    mode: PermissionMode = this.mode,
   ): PermissionLevel | 'mode-baseline' {
-    switch (this.mode) {
+    switch (mode) {
       case 'default':
         // Delegate to tool.permission (backward compat)
         return 'mode-baseline'

package/src/core/rules-loader.ts

@@ -20,6 +20,7 @@
 import { readdirSync, readFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { globToRegexSource } from './credential-masker/matcher'
+import { findWorktreeMarker } from './paths.ts'
 
 interface RuleFile {
   name: string
@@ -31,9 +32,27 @@ interface RuleFile {
 export class RulesLoader {
   private rules: RuleFile[] = []
   private rulesDir: string
+  /**
+   * Rules directory of the **project the cwd belongs to**, when cwd sits inside
+   * one of our worktrees; `null` otherwise.
+   *
+   * `.mipham/` is gitignored, so a worktree checkout never contains
+   * `.mipham/rules` — `git worktree add .mipham/worktrees/w1` produces a tree
+   * with no `.mipham/` at all (measured). Reading only `cwd` therefore made
+   * every project rule invisible inside a worktree session, **silently**: zero
+   * rules, no warning, empty context block.
+   *
+   * Detection is marker-based (`findWorktreeMarker`, the same one the git/bash
+   * tools use) — a worktree created outside `.mipham/worktrees/` and
+   * `.claude/worktrees/` is not covered.
+   */
+  private projectRulesDir: string | null
 
   constructor(cwd: string) {
     this.rulesDir = join(cwd, '.mipham', 'rules')
+    const marker = findWorktreeMarker(cwd)
+    const projectRulesDir = marker ? join(marker.root, '.mipham', 'rules') : null
+    this.projectRulesDir = projectRulesDir === this.rulesDir ? null : projectRulesDir
   }
 
   /**
@@ -41,16 +60,27 @@ export class RulesLoader {
    */
   load(): void {
     this.rules = []
-    if (!existsSync(this.rulesDir)) return
+    this.readDir(this.rulesDir)
+    if (this.projectRulesDir) this.readDir(this.projectRulesDir)
+  }
 
+  /**
+   * Read every `.md` in `dir` into `this.rules`. A name already loaded wins —
+   * "nearest first": a rule the worktree defines overrides the project copy.
+   */
+  private readDir(dir: string): void {
+    if (!existsSync(dir)) return
     try {
-      const files = readdirSync(this.rulesDir).filter((f) => f.endsWith('.md'))
+      const seen = new Set(this.rules.map((r) => r.name))
+      const files = readdirSync(dir).filter((f) => f.endsWith('.md'))
       for (const file of files) {
-        const filepath = join(this.rulesDir, file)
+        const name = file.replace(/\.md$/, '')
+        if (seen.has(name)) continue
         try {
-          const raw = readFileSync(filepath, 'utf-8')
+          const raw = readFileSync(join(dir, file), 'utf-8')
           const { paths, description, content } = this.parseRule(raw, file)
-          this.rules.push({ name: file.replace(/\.md$/, ''), paths, description, content })
+          this.rules.push({ name, paths, description, content })
+          seen.add(name)
         } catch {
           // Skip unparseable files
         }

package/src/core/session-log.ts

@@ -78,7 +78,11 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
       // 兼容旧 JSONL（存 content:string）；新格式存 result:ToolResult（含 success/error）
       const eo = e as unknown as { id: string; result?: ToolResult; content?: string }
       const result: ToolResult = eo.result ?? { success: true, content: eo.content ?? '' }
-      const content = result.success ? result.content : result.error || result.content
+      // `?? ''`：成功但没记下 content 的事件（`JSON.stringify` 会把 `undefined` 的键整个
+      // 抹掉，所以它在盘上长这样：`{"success":true}`）投影出来必须是**字符串**。
+      // 投影负责形状、provider 负责出网合法（`tool_result.content` 是 `string`）；
+      // 这里留 `undefined` 会让 `JSON.stringify` 同样抹掉该键，把问题送到线上。
+      const content = (result.success ? result.content : result.error || result.content) ?? ''
       out.push({
         role: 'user',
         content: [

package/src/core/workspace-trust.ts

@@ -1,6 +1,7 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
+import { readFileSync, existsSync, mkdirSync } from 'node:fs'
 import { join, dirname, resolve } from 'node:path'
 import { homedir } from 'node:os'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 
 const MIPHAM_HOME = join(homedir(), '.mipham')
 const TRUST_STORE_PATH = join(MIPHAM_HOME, 'trusted-workspaces.json')
@@ -67,8 +68,16 @@ export class WorkspaceTrust {
       }
       const raw = readFileSync(TRUST_STORE_PATH, 'utf-8')
       const parsed = JSON.parse(raw) as TrustedWorkspaces
-      if (parsed.version !== 1) {
-        // Unknown version — reset
+      // The version check alone guarded a *field* while leaving the shape open:
+      // `{ version: 1 }` passes it and then `for (const trusted of
+      // this.store.directories)` throws on `undefined`. Entries must be strings
+      // too — `isTrusted` calls `.toLowerCase()` on each one.
+      if (
+        parsed.version !== 1 ||
+        !Array.isArray(parsed.directories) ||
+        !parsed.directories.every((d) => typeof d === 'string')
+      ) {
+        // Unknown version or malformed shape — reset
         return { version: 1, directories: [], updatedAt: new Date().toISOString() }
       }
       return parsed
@@ -84,7 +93,14 @@ export class WorkspaceTrust {
         mkdirSync(MIPHAM_HOME, { recursive: true })
       }
       this.store.updatedAt = new Date().toISOString()
-      writeFileSync(TRUST_STORE_PATH, JSON.stringify(this.store, null, 2), 'utf-8')
+      // Atomic: this store's own reader swallows a parse failure into a *reset
+      // store* (see `load`'s catch), so a write interrupted midway does not just
+      // lose the record — it silently un-trusts every directory the user had
+      // approved. Fail-closed, but the user never learns why they are being
+      // asked again.
+      atomicWriteFileSync(TRUST_STORE_PATH, JSON.stringify(this.store, null, 2) + '\n', {
+        mode: 0o600,
+      })
     } catch {
       // Best-effort: don't crash if we can't save
     }
@@ -165,3 +181,25 @@ export function getWorkspaceTrust(): WorkspaceTrust {
 export function resetWorkspaceTrust(): void {
   _instance = null
 }
+
+/**
+ * Say out loud that repository-controlled config was skipped because this
+ * workspace is not trusted.
+ *
+ * Call this only when hooks were *actually* withheld — `SettingsJson` reports
+ * that (`projectHooksSkipped`), so this cannot announce a skip that never
+ * happened.
+ *
+ * Deliberately not silent. When there is no TTY the trust prompt cannot be
+ * asked, so the answer is "no" and the hooks stay out — but a gate that fails
+ * without saying so is indistinguishable from one that passed, and the user is
+ * left wondering why their hooks do nothing. Written to stderr so it cannot
+ * corrupt stdout rendering.
+ */
+export function warnProjectHooksSkipped(cwd: string): void {
+  process.stderr.write(
+    `⚠️  Workspace not trusted: skipped hooks from ${join(cwd, '.mipham', 'settings.json')}\n` +
+      `    (hooks run commands — repository-controlled). Trust this directory in an interactive\n` +
+      `    session to enable them.\n`,
+  )
+}

package/src/daemon/auth.ts

@@ -1,16 +1,8 @@
 // apps/cli/src/daemon/auth.ts
-import { randomBytes } from 'node:crypto'
+import { randomBytes, timingSafeEqual } from 'node:crypto'
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
 import { dirname } from 'node:path'
 
-/**
- * bun-types@1.3.14 lacks constantTimeCompare in type definitions,
- * though the method exists at Bun 1.2+ runtime.
- */
-interface PasswordWithCompare {
-  constantTimeCompare(a: Buffer, b: Buffer): boolean
-}
-
 /**
  * Generate a 64-character hex token using cryptographically secure random bytes.
  */
@@ -35,14 +27,23 @@ export function loadOrCreateToken(tokenPath: string): string {
 
 /**
  * Verify a provided token against the expected token.
- * Uses Bun's constant-time comparison to prevent timing attacks.
+ * Uses a constant-time comparison to prevent timing attacks.
+ *
+ * `Bun.password` has no `constantTimeCompare` — on bun 1.3.14 it is
+ * `['hash','hashSync','verify','verifySync']`. Calling it threw a TypeError, so
+ * every authenticated remote request got a 500 instead of the intended 200/403.
+ * Node's `timingSafeEqual` is the same primitive and works under Bun.
+ *
+ * Length is checked first because `timingSafeEqual` throws RangeError when the
+ * buffers differ in length; unequal length is itself a mismatch, so returning
+ * false early leaks nothing that comparing would not.
  */
 export function verifyToken(expected: string, provided: string): boolean {
   if (!provided || !expected) return false
-  return (Bun.password as unknown as PasswordWithCompare).constantTimeCompare(
-    Buffer.from(expected),
-    Buffer.from(provided),
-  )
+  const a = Buffer.from(expected)
+  const b = Buffer.from(provided)
+  if (a.length !== b.length) return false
+  return timingSafeEqual(a, b)
 }
 
 /**

package/src/daemon/engine-capabilities.ts

@@ -31,6 +31,7 @@ import { RulesLoader } from '../core/rules-loader'
 import { HookEngine } from '../core/hooks'
 import { loadHookConfigs } from '../core/hooks-config'
 import { loadSettingsJson } from '../config/loader'
+import { getWorkspaceTrust, warnProjectHooksSkipped } from '../core/workspace-trust'
 import { AgentRegistry } from '../agent/agent-registry'
 
 export interface DaemonEngineCapabilities {
@@ -87,11 +88,20 @@ function skillsFor(cwd: string, paths?: string[]): SkillsLoader {
 function hooksFor(cwd: string, skills: SkillsLoader): HookEngine {
   const cached = hookCache.get(cwd)
   if (cached) return cached
-  const engine = new HookEngine()
+  // 会话 cwd 必须显式传：daemon 一个进程服务多个会话，`process.cwd()` 是它自己被
+  // 启动时所在的目录，不属于任何会话 —— hooks 会在那里跑，并且**被告知**它在那里。
+  const engine = new HookEngine(cwd)
   for (const skill of skills.list()) {
     for (const hook of skill.hooks ?? []) engine.register(hook)
   }
-  for (const def of loadHookConfigs(loadSettingsJson(cwd).hooks)) engine.register(def)
+  // 项目级 hooks 是仓库可控的代码执行面，且 daemon 这条路径**从不**经过交互式信任
+  // 询问 —— 而 `isCwdAllowed` 只要求会话 cwd 在 daemon 根目录之内（`workspace-guard.ts:27`
+  // `isWithin(cwd, daemonRoot) || isTrusted(cwd)`）⇒ 在未信任的克隆里启动的 daemon，
+  // 以前会照着那个仓库的 settings.json 起子进程。未信任即不加载，并说出口。
+  const projectHooksTrusted = getWorkspaceTrust().isTrusted(cwd)
+  const settings = loadSettingsJson(cwd, { includeProjectHooks: projectHooksTrusted })
+  if (settings.projectHooksSkipped) warnProjectHooksSkipped(cwd)
+  for (const def of loadHookConfigs(settings.hooks)) engine.register(def)
   hookCache.set(cwd, engine)
   return engine
 }

package/src/daemon/remote-engine.ts

@@ -18,7 +18,7 @@
 //   engine.close()
 
 import type { ClientPromptMessage, ClientInterruptMessage, ServerMessage } from './attach-protocol'
-import type { StreamChunk } from '../shared/types'
+import type { PermissionMode, StreamChunk } from '../shared/types'
 
 // ── Public API ───────────────────────────────────────────────────────────────
 
@@ -258,11 +258,16 @@ export class RemoteEngine {
   }
 
   /** Returns a stub permission object so slash commands don't crash. */
-  getPermission(): { setMode(_mode: string): void } {
+  getPermission(): { setMode(_mode: PermissionMode): void; getMode(): PermissionMode } {
+    // Remote mode: permissions are managed by the daemon, and the attach protocol has
+    // no read-back — so `getMode` reports the last mode the user asked for (which is
+    // what the footer has always shown here), not a value the daemon never confirmed.
+    let requested: PermissionMode = 'default'
     return {
-      setMode: (_mode: string) => {
-        // Remote mode: permissions are managed by the daemon
+      setMode: (mode: PermissionMode) => {
+        requested = mode
       },
+      getMode: () => requested,
     }
   }