@miphamai/cli 0.81.8 → 0.81.9

package/src/daemon/server.ts

@@ -101,6 +101,10 @@ export function buildDaemonPermission(
   for (const msg of permission.getInvalidRules()) {
     process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
   }
+  // Sibling channel for malformed restrictions (P1) — same as the CLI entry.
+  for (const msg of permission.getInvalidRestrictions()) {
+    process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
+  }
   return permission
 }
 
@@ -140,6 +144,12 @@ export function createServer(config: ServerConfig): Server<WsData> {
     dingtalk,
   } = config
 
+  // Mutable: `POST /api/v1/auth/rotate` replaces the live token. Destructuring
+  // `token` above yields a const, so the rotate route could only ever write the
+  // new token to disk — the running server kept accepting the old one and
+  // rejected the one it had just handed out.
+  let activeToken = token
+
   const wsClients = new Map<string, Set<ServerWebSocket<WsData>>>()
 
   // Captured once: a later chdir must not move the boundary that callers'
@@ -362,6 +372,23 @@ export function createServer(config: ServerConfig): Server<WsData> {
   const server = Bun.serve<WsData>({
     port,
     hostname,
+    // The fetch handler below has no top-level try/catch, so anything it throws
+    // reaches Bun — and `development` is true unless NODE_ENV=production, which
+    // for a daemon bound to MIPHAM_BIND=0.0.0.0 means an unauthenticated peer
+    // gets Bun's development error overlay. Measured on bun 1.3.14: with the
+    // flag off the body is a 67,154-byte HTML application; with it on, 21 bytes
+    // of plain text.
+    //
+    // Not established, and so not claimed: that the overlay hands back the
+    // source. Re-requesting the failing URL with the overlay's own Accept
+    // header, guessing the on-disk path, and /bun:info all failed to return the
+    // thrown text in a local probe (every unmatched path returned the same
+    // shell). What is certain is the shape: a developer debugging UI, shipped
+    // with its own JS, served to whoever sent the request.
+    //
+    // Set explicitly rather than relying on NODE_ENV — how an exposed daemon
+    // answers an error must not depend on the user's environment.
+    development: false,
     async fetch(req, server) {
       // ── CORS preflight ──────────────────────────────
       const corsResponse = corsMiddleware(req)
@@ -397,7 +424,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
       }
 
       // ── Auth check ──────────────────────────────────
-      const authError = authMiddleware(req, token, server.requestIP(req)?.address)
+      const authError = authMiddleware(req, activeToken, server.requestIP(req)?.address)
       if (authError) return addCorsHeaders(authError, req)
 
       // Helper: create JSON response with CORS headers for external origins
@@ -691,6 +718,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
       // ── Auth: rotate token ───────────────────────────
       if (method === 'POST' && path === '/api/v1/auth/rotate') {
         const newToken = rotateToken(tokenPath)
+        activeToken = newToken
         return json({ ok: true, data: { token: newToken } })
       }
 

package/src/i18n-core/locales/en-US.json

@@ -311,27 +311,27 @@
     },
     "resume": {
       "no_sessions": "No saved sessions.",
-      "restored": "─ Session Restored ─",
+      "restored": "─ Session History Loaded ─",
       "not_found": "Session \"{name}\" not found.",
       "saved_title": "─ Saved Sessions ─",
       "found_title": "─ Session Found ─",
       "not_found_title": "─ Session Not Found ─",
       "load_failed": "─ Load Failed ─",
       "restored_content": "Name:      {name}\nMessages:  {total} total{truncated}\nProvider:  {provider} / {model}\nUpdated:   {date}",
-      "restored_footer": "{loaded} of {total} messages loaded. Older context summarized above.",
-      "restored_full_footer": "{loaded} messages loaded. Context has been restored.",
+      "restored_footer": "{loaded} of {total} messages loaded into the view (older ones not shown).",
+      "restored_full_footer": "{loaded} messages loaded into the view. The model's context is unchanged — to continue this session, run: mipham --resume \"{name}\"",
       "delete_usage": "Usage: /resume delete <session-name>\n\nDelete a saved session. Use /resume to list all sessions.",
       "delete_confirmed": "✓ Session \"{name}\" deleted.",
       "delete_not_found": "✗ Session \"{name}\" not found. Use /resume to list all sessions.",
       "empty_footer": "Sessions are auto-saved to ~/.mipham/sessions/ when Mipham Code exits.\nStart a conversation — it will be saved automatically.",
       "total_footer": "Total: {count} session(s) • Location: ~/.mipham/sessions/",
-      "resume_hint": "To resume a session:   /resume <name>",
-      "resume_last_hint": "To resume most recent:  /resume last",
+      "resume_hint": "Session details:        /resume <name>",
+      "resume_last_hint": "Load recent history:    /resume last",
       "delete_hint": "To delete a session:    /resume delete <name>",
       "cli_hint": "To resume from CLI:     mipham --resume \"<name>\"",
-      "auto_save_hint": "Sessions are auto-saved on exit. The most recent session loads automatically on restart.",
+      "auto_save_hint": "Sessions are auto-saved on exit. On restart only the most recent session's summary is injected as context — to reopen a session: mipham --resume \"<name>\"",
       "not_found_content": "No session named \"{name}\".\n\nUse /resume without arguments to list all saved sessions.",
-      "found_content": "Name:      {name}\nMessages:  {messages}\nProvider:  {provider} / {model}\nUpdated:   {updated}\n\nTo resume this session:\n  /resume last    — restore the most recent session\n  mipham --resume \"{target}\"\n\nOr restart Mipham Code — the most recent session loads automatically."
+      "found_content": "Name:      {name}\nMessages:  {messages}\nProvider:  {provider} / {model}\nUpdated:   {updated}\n\nTo continue this session, start a new process with:\n  mipham --resume \"{target}\""
     },
     "help": { "title": "── Mipham Code Help ──" },
     "lang": {
@@ -423,6 +423,7 @@
     },
     "upgrade": {
       "uptodate": "── Upgrade Mipham Code ──\n\nCurrent version: v{current}\nLatest:          v{latest}\n\n✓ Already up to date.\n\nTo check manually: https://www.npmjs.com/package/@miphamai/cli",
+      "check_failed": "── Upgrade Mipham Code ──\n\n✗ Could not reach the npm registry — unable to tell whether v{current} is the latest.\n  Nothing was changed. Check your network, then retry: /upgrade",
       "title": "── Upgrade Mipham Code ──",
       "available": "Current version: v{current}\nLatest:          v{latest}\n\n→ New version available! Updating...",
       "updated": "✓ Updated to @miphamai/cli v{version}",
@@ -558,7 +559,7 @@
     "stats": {
       "title": "── Session Stats ──",
       "messages": "Messages:        {total} ({user} user, {assistant} AI, {system} system)",
-      "tokens": "Tokens:          ~{tokens} / 200,000",
+      "tokens": "Tokens:          ~{tokens} / {max}",
       "tools": "Tools available:  {count}",
       "provider": "Provider:         {provider}",
       "model": "Model:            {model}",
@@ -585,6 +586,9 @@
       "title": "── Hooks ──",
       "no_hooks": "── Hooks ──\n\nNo hooks configured.\n\nConfigure hooks in .mipham/settings.json under the hooks section:\n  PreToolUse   — before each tool\n  PostToolUse  — after each tool\n  Stop         — on session end\n\nCommand hooks read JSON from stdin; exit 2 blocks (stderr as reason).\nUse /loop init to scaffold settings.json.",
       "location": "Location: {path}",
+      "source_user": "user",
+      "source_project": "project",
+      "gated": "⚠️  workspace not trusted — will not run",
       "found": "{count} hook(s) found.",
       "error": "── Hooks ──\n\nCould not read hooks directory."
     },

package/src/i18n-core/locales/zh-CN.json

@@ -311,27 +311,27 @@
     },
     "resume": {
       "no_sessions": "没有已保存的会话。",
-      "restored": "─ 会话已恢复 ─",
+      "restored": "─ 会话历史已载入 ─",
       "not_found": "未找到会话 \"{name}\"。",
       "saved_title": "─ 已保存的会话 ─",
       "found_title": "─ 找到会话 ─",
       "not_found_title": "─ 未找到会话 ─",
       "load_failed": "─ 加载失败 ─",
       "restored_content": "名称:      {name}\n消息数:  {total} 条{truncated}\n提供商:  {provider} / {model}\n更新时间:   {date}",
-      "restored_footer": "已加载 {loaded}/{total} 条消息。较早的上下文已概括。",
-      "restored_full_footer": "已加载 {loaded} 条消息。上下文已恢复。",
+      "restored_footer": "已载入视图 {loaded}/{total} 条消息（较早的未显示）。",
+      "restored_full_footer": "已载入视图 {loaded} 条消息；模型上下文未变 —— 要接着此会话继续，请运行: mipham --resume \"{name}\"",
       "delete_usage": "用法: /resume delete <session-name>\n\n删除已保存的会话。使用 /resume 列出所有会话。",
       "delete_confirmed": "✓ 会话 \"{name}\" 已删除。",
       "delete_not_found": "✗ 未找到会话 \"{name}\"。使用 /resume 列出所有会话。",
       "empty_footer": "会话在 Mipham Code 退出时自动保存到 ~/.mipham/sessions/。\n开始对话 — 它将自动保存。",
       "total_footer": "总计: {count} 个会话 • 位置: ~/.mipham/sessions/",
-      "resume_hint": "恢复会话:   /resume <name>",
-      "resume_last_hint": "恢复最近:  /resume last",
+      "resume_hint": "查看会话详情:   /resume <name>",
+      "resume_last_hint": "载入最近历史:  /resume last",
       "delete_hint": "删除会话:    /resume delete <name>",
       "cli_hint": "命令行恢复:     mipham --resume \"<name>\"",
-      "auto_save_hint": "会话在退出时自动保存。最近会话在重启时自动加载。",
+      "auto_save_hint": "会话在退出时自动保存。重启时仅注入最近会话的摘要作为上下文 —— 要重新打开某个会话: mipham --resume \"<name>\"",
       "not_found_content": "未找到名为 \"{name}\" 的会话。\n\n不带参数运行 /resume 列出所有已保存的会话。",
-      "found_content": "名称:      {name}\n消息数:  {messages}\n提供商:  {provider} / {model}\n更新时间:   {updated}\n\n恢复此会话:\n  /resume last    — 恢复最近的会话\n  mipham --resume \"{target}\"\n\n或重启 Mipham Code — 最近会话将自动加载。"
+      "found_content": "名称:      {name}\n消息数:  {messages}\n提供商:  {provider} / {model}\n更新时间:   {updated}\n\n要接着此会话继续，请另起进程运行:\n  mipham --resume \"{target}\""
     },
     "help": { "title": "── Mipham Code 帮助 ──" },
     "lang": {
@@ -423,6 +423,7 @@
     },
     "upgrade": {
       "uptodate": "── 升级 Mipham Code ──\n\n当前版本: v{current}\n最新版本:          v{latest}\n\n✓ 已是最新版本。\n\n手动检查: https://www.npmjs.com/package/@miphamai/cli",
+      "check_failed": "── 升级 Mipham Code ──\n\n✗ 无法连接 npm registry —— 无法判断 v{current} 是否已是最新版本。\n  未做任何改动。请检查网络后重试: /upgrade",
       "title": "── 升级 Mipham Code ──",
       "available": "当前版本: v{current}\n最新版本:          v{latest}\n\n→ 发现新版本！正在更新...",
       "updated": "✓ 已更新至 @miphamai/cli v{version}",
@@ -558,7 +559,7 @@
     "stats": {
       "title": "── 会话统计 ──",
       "messages": "消息:        {total}（{user} 用户, {assistant} AI, {system} 系统）",
-      "tokens": "Token:          ~{tokens} / 200,000",
+      "tokens": "Token:          ~{tokens} / {max}",
       "tools": "可用工具:  {count}",
       "provider": "提供商:         {provider}",
       "model": "模型:            {model}",
@@ -585,6 +586,9 @@
       "title": "── 钩子 ──",
       "no_hooks": "── 钩子 ──\n\n未配置钩子。\n\n在 .mipham/settings.json 的 hooks 段配置钩子:\n  PreToolUse   — 工具执行前\n  PostToolUse  — 工具执行后\n  Stop         — 会话结束\n\n命令钩子从 stdin 读 JSON，exit 2 拦截（stderr 作理由）。\n使用 /loop init 初始化 settings.json。",
       "location": "位置: {path}",
+      "source_user": "用户级",
+      "source_project": "项目级",
+      "gated": "⚠️  工作区未受信任，不会运行",
       "found": "找到 {count} 个钩子。",
       "error": "── 钩子 ──\n\n无法读取钩子目录。"
     },

package/src/index.tsx

@@ -32,6 +32,7 @@ import { ExperienceRuleEngine } from './core/rule-engine.js'
 import { SessionLog } from './core/session-log'
 import { SessionStore } from './core/session-store'
 import type { PermissionLevel, MiphamConfig, McpServerConfig } from './shared/types'
+import { PermissionSystem } from './core/permission'
 import { SkillsLoader } from './skills/loader'
 import { PluginManager } from './plugin/plugin-manager'
 import { loadPlugins } from './plugin/plugin-loader'
@@ -52,7 +53,7 @@ import { getMetrics } from './core/metrics'
 import { initTelemetry, enableTelemetryNow } from './telemetry/index'
 import { wasPrompted, markPrompted, isInteractive, setTelemetryEnabled } from './telemetry/consent'
 import { officialEndpointHost } from './telemetry/endpoint'
-import { getWorkspaceTrust } from './core/workspace-trust'
+import { getWorkspaceTrust, warnProjectHooksSkipped } from './core/workspace-trust'
 import { ARTIFACT_PORT } from './shared/constants'
 import { artifactsRoot } from './artifacts/paths'
 import { AgentViewManager } from './agent-view/agent-view-manager'
@@ -375,6 +376,22 @@ export async function runApp(options: RunOptions): Promise<void> {
   // Load configuration
   const config = loadConfig()
 
+  // Permission policy is built **here**, before the system prompt exists, so the prompt
+  // can describe the mode the engine will actually run in. Building the prompt from
+  // `config.permission` handed the model a value that org restrictions can silently
+  // rewrite (and that may not even be a mode name — `bypass`/`auto`/`ask` inject nothing
+  // at all). The engine is created much later, after tools/hooks/vajra are mounted, so
+  // this instance is what gets handed to it rather than a second one built inside.
+  const permission = new PermissionSystem('default')
+  // Sync with config (fix: UI shows "auto" but engine defaulted to bypass-legacy)
+  if (config.permission) {
+    permission.setDefaultLevel(config.permission as PermissionLevel)
+  }
+  // Apply org-level permission restrictions (P0: bypassPermissions policy gap)
+  if (config.permissionRestrictions) {
+    permission.setRestrictions(config.permissionRestrictions)
+  }
+
   // Detect locale and create translation function
   const locale = detectLocale({ lang: options.lang })
   const t = createT(localeBundles[locale] || enUS, enUS)
@@ -479,12 +496,12 @@ export async function runApp(options: RunOptions): Promise<void> {
         }
       }
       context.restoreLog(log)
-      context.setSystemPrompt(instructions.buildSystemPrompt(config.permission as string))
+      context.setSystemPrompt(instructions.buildSystemPrompt(permission.getMode()))
     }
   }
 
   if (context.getMessageCount() === 0) {
-    const basePrompt = instructions.buildSystemPrompt(config.permission as string)
+    const basePrompt = instructions.buildSystemPrompt(permission.getMode())
     const memoryReminder = loadSessionMemories(basePrompt)
     const skillsReminder = skillsLoader.buildSystemReminder(5000, config.skills?.reminder ?? 'full')
 
@@ -582,8 +599,10 @@ export async function runApp(options: RunOptions): Promise<void> {
   // A dead server (e.g. a 15s connect timeout) no longer blocks startup.
   const mcpConnectPromise = connectMcpServers(config.skills?.mcpServers ?? [], tools)
 
-  // Initialize hook engine — register skill-defined hooks
-  const hookEngine = new HookEngine()
+  // Initialize hook engine — register skill-defined hooks.
+  // CLI 是一次性进程，会话 cwd 就是 `process.cwd()`；写出来是为了与 daemon 那处
+  // （`daemon/engine-capabilities.ts` 传会话 cwd）成对照，别让哪边看起来像漏了。
+  const hookEngine = new HookEngine(process.cwd())
   for (const skill of skillsLoader.list()) {
     if (skill.hooks) {
       for (const hook of skill.hooks) {
@@ -592,8 +611,17 @@ export async function runApp(options: RunOptions): Promise<void> {
     }
   }
 
-  // Register settings.json hooks (Claude Code convention — additive across levels)
-  const settingsJson = loadSettingsJson(process.cwd())
+  // Register settings.json hooks (Claude Code convention — additive across levels).
+  // Project-level hooks are repository-controlled shell commands, so they are only
+  // read once this workspace is trusted. On a TTY `checkWorkspaceTrust()` above has
+  // already asked — and exited the process on "no". With no TTY it *cannot* ask, so
+  // the answer is "no" and the hooks stay out rather than running unasked; that
+  // skip is announced, since silence would look the same as having passed.
+  const projectHooksTrusted = getWorkspaceTrust().isTrusted(process.cwd())
+  const settingsJson = loadSettingsJson(process.cwd(), {
+    includeProjectHooks: projectHooksTrusted,
+  })
+  if (settingsJson.projectHooksSkipped) warnProjectHooksSkipped(process.cwd())
   for (const def of loadHookConfigs(settingsJson.hooks)) {
     hookEngine.register(def)
   }
@@ -604,7 +632,7 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   // Create query engine
   const ruleEngine = new ExperienceRuleEngine()
-  const engine = new QueryEngine(registry, context, tools, undefined, ruleEngine)
+  const engine = new QueryEngine(registry, context, tools, permission, ruleEngine)
   engine.setHookEngine(hookEngine)
   engine.setArtifactServer(artifactServer)
   engine.setAgentViewManager(agentViewManager)
@@ -619,15 +647,8 @@ export async function runApp(options: RunOptions): Promise<void> {
   const inferenceHookConfig = loadInferenceHookConfig()
   engine.setInferenceHookConfig(inferenceHookConfig)
 
-  // Sync engine permission with config (fix: UI shows "auto" but engine defaulted to bypass-legacy)
-  if (config.permission) {
-    engine.getPermission().setDefaultLevel(config.permission as PermissionLevel)
-  }
-
-  // Apply org-level permission restrictions (P0: bypassPermissions policy gap)
-  if (config.permissionRestrictions) {
-    engine.getPermission().setRestrictions(config.permissionRestrictions)
-  }
+  // `config.permission` / `permissionRestrictions` are applied up top, on the instance
+  // handed to `new QueryEngine(...)` — the same one whose mode the system prompt reads.
 
   // Apply user-defined permission rules (allow/deny) — wire the rule system into runtime
   if (config.permissionRules) {
@@ -645,6 +666,12 @@ export async function runApp(options: RunOptions): Promise<void> {
     process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
   }
 
+  // Same warning channel for malformed restrictions (P1) — a typo'd
+  // `forbiddenModes`/`maxAllowedMode` used to leave the policy silently inert.
+  for (const msg of engine.getPermission().getInvalidRestrictions()) {
+    process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
+  }
+
   // Initialize agent registry and load plugin agents/skills/MCP/hooks
   const agentRegistry = new AgentRegistry()
   agentRegistry.loadUserAgents()

package/src/mcp/client.ts

@@ -187,6 +187,12 @@ export class McpClient {
     connection.toolsRefreshInFlight = true
     try {
       await this.applyToolsChanged(name)
+    } catch {
+      // A refresh against a server that has gone away must not surface as an
+      // unhandled rejection out of a timer callback — record the lost
+      // connection instead.
+      const current = this.connections.get(name)
+      if (current) this.markIfTransportLost(name, current)
     } finally {
       // Re-read: the server may have been disconnected while we were awaiting.
       const current = this.connections.get(name)
@@ -427,10 +433,28 @@ export class McpClient {
     try {
       return await conn.protocol.callTool(toolName, params)
     } catch (err) {
+      this.markIfTransportLost(serverName, conn)
       return {
         content: [{ type: 'text', text: t('errors.mcp_tool_error', { error: String(err) }) }],
         isError: true,
       }
     }
   }
+
+  /**
+   * Downgrade a connection whose transport has gone away.
+   *
+   * A tool call can fail because the *tool* failed or because the server did, and
+   * only the transport can tell those apart: a closed transport answers nothing
+   * from now on. Without this the connection stays 'connected' and `/mcp` keeps
+   * showing green for a server that is gone.
+   */
+  private markIfTransportLost(name: string, connection: ActiveConnection): void {
+    if (connection.transport.isConnected()) return
+    if (connection.status === 'error') return
+
+    connection.status = 'error'
+    connection.error = 'Connection lost — the transport is no longer connected'
+    this.emit('disconnected', name, connection.error)
+  }
 }

package/src/mcp/http-transport.ts

@@ -12,7 +12,10 @@ type FetchFn = (input: string, init?: RequestInit) => Promise<Response>
  * result text (this is how Forge's `/mcp` streams progressive chunks). We
  * reassemble those slices so callers see one complete result.
  */
-function parseSseResponse(body: string): unknown {
+function parseSseResponse(
+  body: string,
+  onNotification?: (notification: JsonRpcNotification) => void,
+): unknown {
   const messages: Array<{ id?: number; result?: unknown; error?: JsonRpcError }> = []
 
   for (const block of body.split(/\n\n/)) {
@@ -21,7 +24,16 @@ function parseSseResponse(body: string): unknown {
       const payload = line.slice('data:'.length).trim()
       if (!payload) continue
       try {
-        messages.push(JSON.parse(payload))
+        const message = JSON.parse(payload) as JsonRpcResponse & JsonRpcNotification
+        // Server-initiated notifications (e.g. tools/list_changed) arrive on the
+        // same stream as the response to the request in flight. They carry no id
+        // and are not part of that response, so hand them off rather than letting
+        // them count as a result — or as a chunk of one.
+        if (message.method !== undefined && message.id === undefined) {
+          onNotification?.(message as JsonRpcNotification)
+          continue
+        }
+        messages.push(message)
       } catch {
         // Skip unparseable event lines
       }
@@ -111,6 +123,10 @@ export class HttpTransport implements Transport {
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs)
 
+    // Did an HTTP response come back at all? A rejected fetch or a timeout means
+    // the endpoint is unreachable; an error *status* only means it said no.
+    let reachable = false
+
     try {
       const response = await this.fetchImpl(this.url, {
         method: 'POST',
@@ -123,6 +139,7 @@ export class HttpTransport implements Transport {
         signal: controller.signal,
         redirect: 'manual',
       })
+      reachable = true
 
       if (!response.ok) {
         let detail = `HTTP ${response.status}`
@@ -136,7 +153,7 @@ export class HttpTransport implements Transport {
 
       const contentType = response.headers.get('content-type') || ''
       if (contentType.includes('text/event-stream')) {
-        return parseSseResponse(await response.text())
+        return parseSseResponse(await response.text(), (n) => this.dispatchNotification(n))
       }
 
       const json = (await response.json()) as JsonRpcResponse
@@ -146,8 +163,16 @@ export class HttpTransport implements Transport {
       return json.result
     } catch (err) {
       if (controller.signal.aborted) {
+        // The endpoint never answered. Every later request would hang the same
+        // way, so the transport reports itself disconnected — the same state a
+        // stdio transport reaches when its process exits — until reconnect()
+        // replaces it.
+        this.closed = true
         throw requestTimeoutError(method, this.requestTimeoutMs)
       }
+      if (!reachable) {
+        this.closed = true
+      }
       throw err
     } finally {
       clearTimeout(timer)
@@ -182,6 +207,13 @@ export class HttpTransport implements Transport {
     this.notificationHandlers.push(handler)
   }
 
+  /** Hand a server-initiated notification to every registered handler. */
+  private dispatchNotification(notification: JsonRpcNotification): void {
+    for (const handler of this.notificationHandlers) {
+      handler(notification)
+    }
+  }
+
   async close(): Promise<void> {
     this.closed = true
     this.url = null

package/src/plugin/plugin-manager.ts

@@ -11,6 +11,7 @@ import { join } from 'node:path'
 import { homedir } from 'node:os'
 import { execFileSync } from 'node:child_process'
 import { validatePlugin } from './plugin-validator'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 
 const PLUGIN_DIR = join(homedir(), '.mipham', 'plugins')
 
@@ -287,7 +288,12 @@ export class PluginManager {
   private loadState(): void {
     try {
       if (existsSync(this.statePath)) {
-        this.plugins = JSON.parse(readFileSync(this.statePath, 'utf-8'))
+        const parsed: unknown = JSON.parse(readFileSync(this.statePath, 'utf-8'))
+        // Parsing is not validating: `{}` / `null` / `"x"` are all valid JSON and
+        // all make the readers below throw (`.find`/`.filter`/`.map` on a
+        // non-array), so a file that is merely *shaped* wrong took down every
+        // plugin command instead of starting empty.
+        this.plugins = Array.isArray(parsed) ? (parsed as InstalledPlugin[]) : []
       }
     } catch {
       this.plugins = []
@@ -295,6 +301,11 @@ export class PluginManager {
   }
 
   private saveState(): void {
-    writeFileSync(this.statePath, JSON.stringify(this.plugins, null, 2), 'utf-8')
+    // Was a bare writeFileSync: an interrupted write left unparseable JSON, and
+    // `loadState` swallows that into `[]` ⇒ the installed-plugin list silently
+    // vanished. Atomic write means a reader sees the old list or the new one.
+    atomicWriteFileSync(this.statePath, JSON.stringify(this.plugins, null, 2) + '\n', {
+      mode: 0o600,
+    })
   }
 }

package/src/providers/anthropic.ts

@@ -39,6 +39,27 @@ interface AnthropicSSEEvent {
   usage?: { input_tokens: number; output_tokens: number }
 }
 
+/**
+ * Stand-in for a tool result that has no content of its own.
+ *
+ * `tool_result.content` is normalized to a text block server-side, and an empty
+ * one is rejected with a 400 — which fails the *whole* request, history
+ * included. Multiple paths produce one: a tool that reports success with no
+ * output (`content: ''`), a failed tool with no message, and a log projection
+ * whose `content` never got written (`undefined`). All of them mean the same
+ * thing to the model, so they get the same words.
+ */
+const NO_TOOL_OUTPUT = '(no output)'
+
+/**
+ * An empty text block is not a stylistic wart — Anthropic rejects it with a 400,
+ * and since every message in the request is history, one such block makes the
+ * conversation permanently unsendable (every later turn re-sends it).
+ */
+function isEmptyTextBlock(block: Record<string, unknown>): boolean {
+  return block.type === 'text' && block.text === ''
+}
+
 export class AnthropicProvider implements ProviderInstance {
   private baseUrl = 'https://api.anthropic.com/v1'
   private anthropicVersion = '2023-06-01'
@@ -302,17 +323,23 @@ export class AnthropicProvider implements ProviderInstance {
       if (msg.role === 'system') continue
 
       if (typeof msg.content === 'string') {
-        const content: unknown[] = [{ type: 'text', text: msg.content }]
+        const content: unknown[] = []
+        // 空串不产出 text 块（见 isEmptyTextBlock）：用户发了个空消息、或工具返回
+        // 空内容时会走到这里，而它会让之后每一轮都 400。
+        if (msg.content !== '') content.push({ type: 'text', text: msg.content })
         // DeepSeek V4 thinking mode via Anthropic endpoint: every assistant
         // message must contain a thinking block if any message in history does.
         if (msg.role === 'assistant') {
           const thinkingText = (msg as any).reasoning_content || ''
           content.unshift({ type: 'thinking', thinking: thinkingText })
         }
-        result.push({
-          role: msg.role,
-          content,
-        })
+        // 全部内容都被滤掉的消息**整条**不下发 —— 空 content 数组同样被 API 拒。
+        if (content.length > 0) {
+          result.push({
+            role: msg.role,
+            content,
+          })
+        }
       } else {
         const blocks = (msg.content as ContentBlock[]).map((block) => {
           switch (block.type) {
@@ -362,22 +389,32 @@ export class AnthropicProvider implements ProviderInstance {
               return {
                 type: 'tool_result',
                 tool_use_id: block.tool_use_id,
-                content: block.content,
+                // 空 content 同样整条请求被拒（见 NO_TOOL_OUTPUT）。`||` 而非 `=== ''`：
+                // 投影层缺失该字段时这里是 `undefined`，空数组同理。
+                content: block.content || NO_TOOL_OUTPUT,
                 // 只在失败时下发 —— 成功请求体与改动前逐字节相同，不引入 prompt-cache 前缀抖动
                 ...(block.is_error === true ? { is_error: true } : {}),
               }
 
             default:
-              return { type: 'text', text: '' }
+              // 未知块类型**无法**原样表达，而 `{type:'text',text:''}` 是一个必然被拒
+              // 的载荷 —— 改成丢这一个块（下面的 filter），而不是拿它毒掉整条请求。
+              return null
           }
-        })
+        }) as (Record<string, unknown> | null)[]
+
+        // 丢掉表达不出来的块（未知类型）与空的 text 块。
+        const kept = blocks.filter(
+          (b): b is Record<string, unknown> => b !== null && !isEmptyTextBlock(b),
+        )
 
         // DeepSeek V4 thinking mode via Anthropic endpoint: every assistant
         // message must contain a thinking block if any message in history does.
-        if (msg.role === 'assistant' && !blocks.some((b: any) => b.type === 'thinking')) {
-          blocks.unshift({ type: 'thinking', thinking: '' })
+        if (msg.role === 'assistant' && !kept.some((b) => b.type === 'thinking')) {
+          kept.unshift({ type: 'thinking', thinking: '' })
         }
-        result.push({ role: msg.role, content: blocks })
+        if (kept.length === 0) continue
+        result.push({ role: msg.role, content: kept })
       }
     }
 

package/src/security/gate.ts

@@ -1,3 +1,21 @@
+/**
+ * SecurityGate — 判定函数集合。
+ *
+ * ⚠️ **本文件不是一个已生效的安全门。** 它是一个**判定函数的库**，其中只有一部分
+ * 被接进生产路径。别把「文件被 import」读成「这些检查在生产里跑」：
+ *
+ * - `redactCredentialLeak` — **已接线**（`core/behavior-tasks.ts`、
+ *   `core/credential-masker/output-scrub.ts`）。
+ * - 其余三个 `check*` 方法 — **生产零调用点**，唯一消费者是
+ *   `test/security/penetration/`。因此 CI 的 `penetration-test` job 全绿只说明
+ *   **这些判定函数被自己测过**，不说明生产有这三道防线。三条各自的去路（为什么不接、
+ *   生产另有哪条防线）登记在
+ *   `test/integrity/unwired-disposition.test.ts` 的 `KEPT_UNWIRED_METHODS` 里，
+ *   由机器两向强制（存在 + 生产零引用）。
+ *
+ * 想让某条真正生效时：先读那条登记的理由，再决定是接线还是改判据 —— 直接 `import`
+ * 进来调是最容易的一步，也是最容易多出一道更弱、更难维护、判据还与被取代者不一致的门。
+ */
 export interface GateResult {
   blocked: boolean
   reason?: string

package/src/security/path.ts

@@ -7,6 +7,24 @@ import { realpathSync, existsSync } from 'node:fs'
  */
 const BLOCKED_PATHS = ['/etc', '/proc', '/sys', '/dev', '/boot', '/root']
 
+/**
+ * The same list in canonical form.
+ *
+ * The check below compares against an already-resolved path, so the entries
+ * must be resolved too: on macOS `/etc` is a symlink to `/private/etc`, and
+ * comparing `/private/etc/x` against the literal `/etc` never matched — the
+ * check was dead there. Entries that don't exist yet keep their literal form
+ * (there is nothing to resolve, and a later `realpathSync` of the same path
+ * cannot produce a different spelling).
+ */
+const BLOCKED_CANONICAL: string[] = BLOCKED_PATHS.map((p) => {
+  try {
+    return existsSync(p) ? realpathSync(p) : p
+  } catch {
+    return p
+  }
+})
+
 /**
  * Windows UNC paths and NT/Win32/DOS device-namespace prefixes.
  *
@@ -86,7 +104,7 @@ export function resolveSafe(cwd: string, inputPath: string): string {
   }
 
   // Check 2: must not target sensitive system directories
-  for (const blocked of BLOCKED_PATHS) {
+  for (const blocked of BLOCKED_CANONICAL) {
     if (canonical === blocked || canonical.startsWith(blocked + '/')) {
       throw new Error(
         `Path rejected: "${inputPath}" resolves to a protected system directory (${blocked}).`,