@miphamai/cli 0.82.0 → 0.84.0

package/src/core/rule-engine.ts

@@ -1,8 +1,8 @@
 import type { ExperienceRule } from '../agent/experience-rules.js'
 import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs'
 import { join, dirname } from 'node:path'
-import { homedir } from 'node:os'
 import { MANAGED_RULES } from './crsi-managed-rules'
+import { miphamHome } from './paths.ts'
 
 export interface ToolRule {
   id: string
@@ -62,7 +62,7 @@ export class ExperienceRuleEngine {
   private rules: ToolRule[]
   private storePath: string
 
-  constructor(storeDir: string = join(homedir(), '.mipham', 'rule-engine')) {
+  constructor(storeDir: string = miphamHome('rule-engine')) {
     this.rules = [...BUILTIN_RULES, ...MANAGED_RULES].map((r) => ({ ...r }))
     this.storePath = join(storeDir, 'rules.json')
     this.load()

package/src/core/rules-loader.ts

@@ -21,6 +21,7 @@ import { readdirSync, readFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { globToRegexSource } from './credential-masker/matcher'
 import { findWorktreeMarker } from './paths.ts'
+import { MIPHAM_DIR } from '../shared/constants.ts'
 
 interface RuleFile {
   name: string
@@ -49,9 +50,9 @@ export class RulesLoader {
   private projectRulesDir: string | null
 
   constructor(cwd: string) {
-    this.rulesDir = join(cwd, '.mipham', 'rules')
+    this.rulesDir = join(cwd, MIPHAM_DIR, 'rules')
     const marker = findWorktreeMarker(cwd)
-    const projectRulesDir = marker ? join(marker.root, '.mipham', 'rules') : null
+    const projectRulesDir = marker ? join(marker.root, MIPHAM_DIR, 'rules') : null
     this.projectRulesDir = projectRulesDir === this.rulesDir ? null : projectRulesDir
   }
 

package/src/core/session-log.ts

@@ -1,9 +1,9 @@
 import { appendFileSync, readFileSync, mkdirSync, existsSync } from 'node:fs'
-import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { createHash } from 'node:crypto'
 import type { Message, ToolUseContent, ToolResultContent, ToolResult } from '../shared/types'
 import type { CheckerDecision } from './post-flight-checker'
+import { miphamHome } from './paths.ts'
 
 export type SessionEvent =
   | {
@@ -115,8 +115,7 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
   return out
 }
 
-const HOME = homedir()
-const LOG_DIR = join(HOME, '.mipham', 'sessions')
+const LOG_DIR = miphamHome('sessions')
 
 /** 将会话名消毒为安全文件名（与 SessionStore 共用；防路径穿越）。 */
 export function sanitizeSessionName(name: string): string {

package/src/core/session-store.ts

@@ -8,11 +8,11 @@ import {
   existsSync,
   statSync,
 } from 'node:fs'
-import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { createHash } from 'node:crypto'
 import type { Message } from '../shared/types'
 import { sanitizeSessionName, SessionLog, deriveMessages, messageToEvents } from './session-log'
+import { miphamHome } from './paths.ts'
 
 export interface SessionMetadata {
   name: string
@@ -29,8 +29,7 @@ export interface StoredSession {
   messages: Message[]
 }
 
-const HOME = homedir()
-const SESSIONS_DIR = join(HOME, '.mipham', 'sessions')
+const SESSIONS_DIR = miphamHome('sessions')
 const INDEX_FILE = join(SESSIONS_DIR, '.index.json')
 const SUMMARIES_DIR = join(SESSIONS_DIR, '.summaries')
 

package/src/core/task-performance.ts

@@ -68,6 +68,8 @@ export interface TaskPerformanceReport {
   score: number
   results: TaskPerformanceResult[]
   failures: string[]
+  /** B2 代价维：整轮（LLM 生成 + 冻结测试判定）的墙钟耗时。只记录，不参与任何判定。 */
+  durationMs: number
 }
 
 /** 剥掉 LLM 可能包裹的 markdown 代码块（```ts ... ```），拿到裸代码。 */
@@ -101,6 +103,7 @@ export async function runTaskPerformance(
   const wanted = opts?.skill?.name
   const tasks = loadPerformanceTasks().filter((t) => (t.skill ?? undefined) === wanted)
   const results: TaskPerformanceResult[] = []
+  const startedAt = Date.now()
   for (const task of tasks) {
     const code = await collectGeneratedCode(llm, task.prompt, opts?.skill?.text)
     if (!code) {
@@ -127,6 +130,7 @@ export async function runTaskPerformance(
     score: results.length > 0 ? Math.round((passed / results.length) * 100) : 100,
     results,
     failures: results.filter((r) => !r.passed).map((r) => r.id),
+    durationMs: Date.now() - startedAt,
   }
 }
 
@@ -210,6 +214,13 @@ export interface SkillDeltaSample {
   skillName: string
   baselineScores: number[]
   postScores: number[]
+  /**
+   * B2 代价维：与分数数组**逐项对齐**的耗时（第 i 项就是产出第 i 个分数的那次采样）。
+   * 缺席 = 该样本未记代价（旧记录 / 旧调用点），读侧须按「缺席」处理、不得当成 0。
+   * 只记录，不参与改进判定 —— 样本量 k=3 时再加一个维度只会让统计问题更糟。
+   */
+  baselineDurations?: number[]
+  postDurations?: number[]
 }
 
 /**
@@ -227,18 +238,28 @@ export async function measureSkillDeltaRepeated(
   const k = opts?.k ?? 3
   const baselineScores: number[] = []
   const postScores: number[] = []
+  const baselineDurations: number[] = []
+  const postDurations: number[] = []
   for (let i = 0; i < k; i++) {
     const r = await runTaskPerformance(llm, {
       skill: { name: resolved.skillName, text: resolved.baselineText },
     })
     baselineScores.push(r.score)
+    baselineDurations.push(r.durationMs)
   }
   for (let i = 0; i < k; i++) {
     const r = await runTaskPerformance(llm, {
       skill: { name: resolved.skillName, text: resolved.postText },
     })
     postScores.push(r.score)
+    postDurations.push(r.durationMs)
   }
 
-  return { skillName: resolved.skillName, baselineScores, postScores }
+  return {
+    skillName: resolved.skillName,
+    baselineScores,
+    postScores,
+    baselineDurations,
+    postDurations,
+  }
 }

package/src/core/workspace-trust.ts

@@ -1,9 +1,10 @@
 import { readFileSync, existsSync, mkdirSync } from 'node:fs'
 import { join, dirname, resolve } from 'node:path'
-import { homedir } from 'node:os'
 import { atomicWriteFileSync } from '../shared/atomic-write'
+import { miphamHome } from './paths.ts'
+import { MIPHAM_DIR } from '../shared/constants.ts'
 
-const MIPHAM_HOME = join(homedir(), '.mipham')
+const MIPHAM_HOME = miphamHome()
 const TRUST_STORE_PATH = join(MIPHAM_HOME, 'trusted-workspaces.json')
 
 export interface TrustedWorkspaces {
@@ -198,7 +199,7 @@ export function resetWorkspaceTrust(): void {
  */
 export function warnProjectHooksSkipped(cwd: string): void {
   process.stderr.write(
-    `⚠️  Workspace not trusted: skipped hooks from ${join(cwd, '.mipham', 'settings.json')}\n` +
+    `⚠️  Workspace not trusted: skipped hooks from ${join(cwd, MIPHAM_DIR, 'settings.json')}\n` +
       `    (hooks run commands — repository-controlled). Trust this directory in an interactive\n` +
       `    session to enable them.\n`,
   )

package/src/daemon/database.ts

@@ -1,7 +1,6 @@
 // apps/cli/src/daemon/database.ts
 import { Database } from 'bun:sqlite'
 import { readdirSync, readFileSync, existsSync } from 'node:fs'
-import { homedir } from 'node:os'
 import { join } from 'node:path'
 import type {
   DaemonSession,
@@ -12,6 +11,7 @@ import type {
   CreateSessionInput,
   SessionStatus,
 } from './types'
+import { miphamHome } from '../core/paths.ts'
 
 export class DaemonDatabase {
   private db: Database
@@ -340,7 +340,7 @@ export class DaemonDatabase {
   // ── Migration ──────────────────────────────────────────────
 
   migrateFromJsonl(): number {
-    const sessionsDir = join(homedir(), '.mipham', 'sessions')
+    const sessionsDir = miphamHome('sessions')
 
     if (!existsSync(sessionsDir)) return 0
 

package/src/daemon/index.ts

@@ -8,7 +8,6 @@
 import { join } from 'node:path'
 import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync } from 'node:fs'
 import { createServer as createNetServer } from 'node:net'
-import { homedir } from 'node:os'
 import type { Server } from 'bun'
 import { DaemonDatabase } from './database'
 import { SessionManager } from './session-manager'
@@ -32,9 +31,9 @@ import type { WecomConfig } from './wecom/types.js'
 import { parseDingtalkEnv } from './dingtalk/env.js'
 import type { DingtalkConfig } from './dingtalk/types.js'
 import { loadConfig } from '../config/loader'
+import { miphamHome } from '../core/paths.ts'
 
-const HOME = homedir()
-const MIPHAM_HOME = join(HOME, '.mipham')
+const MIPHAM_HOME = miphamHome()
 const DB_PATH = join(MIPHAM_HOME, 'daemon.db')
 const TOKEN_PATH = join(MIPHAM_HOME, 'daemon.token')
 const PID_FILE = join(MIPHAM_HOME, 'daemon.pid')

package/src/daemon/launch.ts

@@ -13,13 +13,13 @@
 
 import { spawn, type SpawnOptions } from 'node:child_process'
 import { closeSync, mkdirSync, openSync, readFileSync, statSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { dirname, join, resolve } from 'node:path'
+import { dirname, resolve } from 'node:path'
+import { miphamHome } from '../core/paths.ts'
 
 /** argv sentinel that re-enters this program as a daemon. Not user-facing. */
 export const DAEMON_ENTRY = '__daemon'
 
-const DEFAULT_LOG_FILE = join(homedir(), '.mipham', 'daemon.log')
+const DEFAULT_LOG_FILE = miphamHome('daemon.log')
 
 /**
  * argv prefix that re-runs *this* program.

package/src/daemon/server.ts

@@ -63,10 +63,25 @@ interface WsData {
   sessionId: string
 }
 
+/**
+ * Values `MIPHAM_DAEMON_PERMISSION` accepts. The **default stays `'default'`**;
+ * every widening is an explicit operator choice.
+ *
+ * `'auto'` is accepted, and today it means **every tool call is refused**: the
+ * mode's static baseline answers `'ask'` for all of them, and the daemon has no
+ * classifier to rule on the `'ask'` (the classifier is wired in the CLI's
+ * `index.tsx`, not here). Refusing with the mode named is the honest reading —
+ * `auto` means "there is no human to ask, let a classifier decide", and with no
+ * classifier there is nothing to decide with. The alternative (leaving it out of
+ * this set) would silently fall back to `'default'`, which is *more* permissive
+ * than what was asked for; a silent widening is the worse of the two ways to be
+ * wrong. This entry becomes useful the day the daemon builds a classifier.
+ */
 const DAEMON_PERMISSION_MODES: ReadonlySet<PermissionMode> = new Set<PermissionMode>([
   'default',
   'acceptEdits',
   'plan',
+  'auto',
   'bypassPermissions',
 ])
 

package/src/i18n-core/locales/en-US.json

@@ -804,6 +804,7 @@
       "manual": "manual mode",
       "accept_edits": "accept edits on",
       "plan_mode": "plan mode / read-only",
+      "auto_mode": "auto mode on",
       "bypass": "bypass"
     },
     "loading": {
@@ -992,6 +993,8 @@
     "tool_denied_deny_rule": "Tool \"{name}\" blocked by a deny rule (\"{pattern}\"). Deny rules override permission mode — try a different approach, or drop the rule with: /permissions remove \"{pattern}\"",
     "tool_denied_ask_rule": "Tool \"{name}\" requires approval (ask rule: \"{pattern}\"). Approve when prompted, or stop being asked with: /permissions allow \"{pattern}\"",
     "tool_denied_mode": "Tool \"{name}\" requires approval under \"{mode}\" mode. Press Shift+Tab to switch permission mode, or stop being asked with: /permissions allow \"{name}\" (or a narrower \"{name}(arg)\")",
+    "tool_denied_classifier": "Tool \"{name}\" was blocked in auto mode by the permission classifier ({reason}). This is a policy decision, not a failure — switching modes will not change it, and repeating the identical call returns the same ruling. Change the call so it no longer trips the rule, or allow it outright with: /permissions allow \"{name}\"",
+    "tool_denied_classifier_unavailable": "Tool \"{name}\" was held back because the auto-mode classifier could not be reached or its answer could not be read ({reason}). This is NOT a policy decision — the call was never judged, and retrying is appropriate. If this keeps happening, switch modes with Shift+Tab.",
     "tool_blocked": "Tool \"{name}\" blocked by hook",
     "user_input_blocked": "User input blocked by hook.",
     "dlp_blocked": "Request blocked by DLP policy.",

package/src/i18n-core/locales/zh-CN.json

@@ -804,6 +804,7 @@
       "manual": "手动模式",
       "accept_edits": "接受编辑",
       "plan_mode": "计划模式 / 只读",
+      "auto_mode": "自动模式",
       "bypass": "绕过权限"
     },
     "loading": {
@@ -992,6 +993,8 @@
     "tool_denied_deny_rule": "工具 \"{name}\" 被拒绝规则（\"{pattern}\"）阻止。拒绝规则优先于权限模式 — 请改用其他方式，或移除该规则：/permissions remove \"{pattern}\"",
     "tool_denied_ask_rule": "工具 \"{name}\" 需要批准（ask 规则：\"{pattern}\"）。请在提示时批准，或不再询问：/permissions allow \"{pattern}\"",
     "tool_denied_mode": "工具 \"{name}\" 在 \"{mode}\" 模式下需要批准。按 Shift+Tab 切换权限模式，或不再询问：/permissions allow \"{name}\"（更窄的 \"{name}(arg)\" 亦可）",
+    "tool_denied_classifier": "工具 \"{name}\" 在 auto 模式下被权限分类器拦下（{reason}）。这是策略裁决、不是故障 —— 切换模式不会改变它，把同一次调用原样重发也只会得到同一个裁决。请改变这次调用使其不再触犯该规则，或直接放行：/permissions allow \"{name}\"",
+    "tool_denied_classifier_unavailable": "工具 \"{name}\" 被暂缓：auto 模式的分类器不可达，或其回复无法解析（{reason}）。这**不是**策略裁决 —— 该调用从未被裁决，重试是恰当的。若持续发生，按 Shift+Tab 切换模式。",
     "tool_blocked": "工具 \"{name}\" 被钩子拦截",
     "user_input_blocked": "用户输入被钩子拦截。",
     "dlp_blocked": "请求被 DLP 策略阻止。",

package/src/index.tsx

@@ -1,6 +1,5 @@
 import React from 'react'
 import { join, basename } from 'node:path'
-import { homedir } from 'node:os'
 import { existsSync } from 'node:fs'
 import { render } from 'ink'
 import * as readline from 'node:readline'
@@ -33,6 +32,7 @@ import { SessionLog } from './core/session-log'
 import { SessionStore } from './core/session-store'
 import type { PermissionLevel, MiphamConfig, McpServerConfig } from './shared/types'
 import { PermissionSystem } from './core/permission'
+import { LlmPermissionClassifier } from './core/permission-classifier'
 import { SkillsLoader } from './skills/loader'
 import { PluginManager } from './plugin/plugin-manager'
 import { loadPlugins } from './plugin/plugin-loader'
@@ -54,7 +54,7 @@ import { initTelemetry, enableTelemetryNow } from './telemetry/index'
 import { wasPrompted, markPrompted, isInteractive, setTelemetryEnabled } from './telemetry/consent'
 import { officialEndpointHost } from './telemetry/endpoint'
 import { getWorkspaceTrust, warnProjectHooksSkipped } from './core/workspace-trust'
-import { ARTIFACT_PORT } from './shared/constants'
+import { ARTIFACT_PORT, MIPHAM_DIR } from './shared/constants'
 import { artifactsRoot } from './artifacts/paths'
 import { AgentViewManager } from './agent-view/agent-view-manager'
 import { AgentViewDashboard } from './agent-view/dashboard'
@@ -65,6 +65,7 @@ import { ConfigWizard } from './ui/config-wizard'
 import enUS from './i18n-core/locales/en-US.json' with { type: 'json' }
 import zhCN from './i18n-core/locales/zh-CN.json' with { type: 'json' }
 import type { TranslationMap } from './i18n-core/types'
+import { miphamHome } from './core/paths.ts'
 
 // Locale bundles — defined at module level so the remote-attach branch can
 // reference them before the full bootstrap path runs.
@@ -401,6 +402,21 @@ export async function runApp(options: RunOptions): Promise<void> {
   const defaultModel = options.model || config.defaultModel
   const registry = bootstrapProviders(config.providers, defaultProvider, defaultModel)
 
+  // Attach `auto` mode's classifier here, where the provider registry exists —
+  // `PermissionSystem` itself imports no provider module, so the classifier is handed
+  // in rather than built inside. Doing it on the permission system instead of the
+  // engine is deliberate: an engine-side setter would be a new engine capability the
+  // daemon would then have to match or be exempted from
+  // (`test/integrity/daemon-capability-parity.test.ts`). Because that guard therefore
+  // cannot see this line, the wiring is asserted separately at the source level.
+  //
+  // The model is resolved per ruling through the thunk: capturing the active model
+  // here would freeze it at whatever was active at startup, so a user who switches to
+  // a cheaper model would keep paying for the old one with nothing on screen to say so.
+  permission.setClassifier(
+    new LlmPermissionClassifier(registry, { resolveModel: () => registry.getActiveModel() }),
+  )
+
   // Load instructions
   const instructions = new InstructionsLoader()
   instructions.loadAll(process.cwd())
@@ -529,8 +545,8 @@ export async function runApp(options: RunOptions): Promise<void> {
     // First-run setup detection: inject mipham-code-setup guidance when
     // no project or user config exists. This mirrors Claude Code's first-run
     // onboarding flow — the AI proactively offers to help configure the tool.
-    const hasProjectConfig = existsSync(join(process.cwd(), '.mipham', 'config.yml'))
-    const hasUserConfig = existsSync(join(homedir(), '.mipham', 'config.yml'))
+    const hasProjectConfig = existsSync(join(process.cwd(), MIPHAM_DIR, 'config.yml'))
+    const hasUserConfig = existsSync(miphamHome('config.yml'))
     const hasMiphamMd = existsSync(join(process.cwd(), 'MIPHAM.md'))
     if (!hasProjectConfig && !hasUserConfig) {
       const setupReminder = [
@@ -672,6 +688,14 @@ export async function runApp(options: RunOptions): Promise<void> {
     process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
   }
 
+  // Third channel: an unrecognized `permission:` value in config.yml. Until
+  // `setDefaultLevel` honoured real mode names, *no* value except `bypass` could
+  // report anything — they all just became `default`. Warnings are collected on the
+  // instance, so this has to run after the config was applied above.
+  for (const msg of engine.getPermission().getInvalidPermissionMode()) {
+    process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
+  }
+
   // Initialize agent registry and load plugin agents/skills/MCP/hooks
   const agentRegistry = new AgentRegistry()
   agentRegistry.loadUserAgents()
@@ -815,8 +839,8 @@ export async function runApp(options: RunOptions): Promise<void> {
   })
 
   // ── First-run detection: show interactive ConfigWizard if no config exists ──
-  const hasUserConfig = existsSync(join(homedir(), '.mipham', 'config.yml'))
-  const hasProjectConfig = existsSync(join(process.cwd(), '.mipham', 'config.yml'))
+  const hasUserConfig = existsSync(miphamHome('config.yml'))
+  const hasProjectConfig = existsSync(join(process.cwd(), MIPHAM_DIR, 'config.yml'))
   const needsSetup = !hasUserConfig && !hasProjectConfig
 
   // Only ask when the first-run wizard is *not* about to take over the

package/src/mcp/token-store.ts

@@ -8,8 +8,8 @@ import {
   chmodSync,
 } from 'node:fs'
 import { join, dirname } from 'node:path'
-import { homedir } from 'node:os'
 import { encrypt, decrypt, getCredentialKey } from '../config/credential-crypto'
+import { miphamHome } from '../core/paths.ts'
 
 interface TokenData {
   accessToken: string
@@ -24,7 +24,7 @@ export class TokenStore {
   private storeDir: string
 
   constructor(storeDir?: string) {
-    this.storeDir = storeDir || join(homedir(), '.mipham', 'mcp-tokens')
+    this.storeDir = storeDir || miphamHome('mcp-tokens')
     this.key = getCredentialKey(dirname(this.storeDir))
   }
 

package/src/plugin/plugin-manager.ts

@@ -8,12 +8,12 @@ import {
   renameSync,
 } from 'node:fs'
 import { join } from 'node:path'
-import { homedir } from 'node:os'
 import { execFileSync } from 'node:child_process'
 import { validatePlugin } from './plugin-validator'
 import { atomicWriteFileSync } from '../shared/atomic-write'
+import { miphamHome } from '../core/paths.ts'
 
-const PLUGIN_DIR = join(homedir(), '.mipham', 'plugins')
+const PLUGIN_DIR = miphamHome('plugins')
 
 export interface InstalledPlugin {
   name: string

package/src/shared/constants.ts

@@ -539,7 +539,6 @@ export const TOOL_CATEGORIES = [
 ] as const
 export const CONFIG_FILE_NAME = 'config.yml'
 export const MIPHAM_DIR = '.mipham'
-export const USER_CONFIG_DIR = '.mipham'
 export const MEMORY_DIR = 'memory'
 
 /** 预置 Ollama 模型 — 与 ollama list 结果合并去重后展示 */

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.82.0' as const
+export const PACKAGE_VERSION = '0.84.0' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/types.ts

@@ -67,7 +67,14 @@ export interface Message {
 }
 
 // ── Tool Types ──
-export type ToolPermission = 'auto' | 'ask' | 'bypass'
+/**
+ * Legacy 3-level tool permission (predates `PermissionMode`).
+ * `'self'` means "let the tool self-decide" — i.e. allowed, but not flagged as `'bypass'`.
+ * Renamed from `'auto'` (2026-09-22) so that `auto` can name the *classifier mode*
+ * without a second meaning living in `PermissionLevel` — see
+ * `docs/superpowers/specs/2026-09-22-permission-classifier-design.md` §3.1.
+ */
+export type ToolPermission = 'self' | 'ask' | 'bypass'
 export type ToolCategory =
   'file' | 'exec' | 'agent' | 'network' | 'system' | 'artifact' | 'scheduling'
 
@@ -326,11 +333,44 @@ export interface InstructionFile {
 }
 
 // ── Permission Types ──
-/** Four explicit permission modes matching Claude Code's permission architecture */
-export type PermissionMode = 'default' | 'acceptEdits' | 'plan' | 'bypassPermissions'
-
-/** Backward-compatible alias: PermissionMode plus legacy 'auto'/'ask'/'bypass' */
-export type PermissionLevel = PermissionMode | 'auto' | 'ask' | 'bypass'
+/**
+ * Permission modes, matching Claude Code's permission architecture.
+ *
+ * `bypassPermissions` is legal but **off the Shift+Tab cycle** — the cycle is the
+ * four slots Claude Code's own cycle array lists (`default`, `acceptEdits`,
+ * `plan`, `auto`), while this union is the full set the config may request. See
+ * `ALL_MODES` / `MODE_CYCLE` in `core/permission-config.ts` for why those two
+ * arrays are separate, and why merging them silently demotes
+ * `bypassPermissions`.
+ *
+ * `auto` behaves unlike the other four: it does not decide anything statically.
+ * Its baseline answers `'ask'` for **every** call, and the ruling is delegated to
+ * the LLM permission classifier (`core/permission-classifier.ts`). Two
+ * consequences worth knowing before reading code that switches on this union:
+ *
+ * - `auto` has **no static width**, so a "which mode is narrower" measurement
+ *   taken from the static chain reads it as narrower than `plan` — a
+ *   measurement of the wrong object, not a fact about `auto`.
+ * - A mode whose static baseline is `'ask'` must not be *reached* by a caller
+ *   that never consults the classifier, or it degrades into "refuse everything".
+ *
+ * This copy is kept in step with `packages/shared/src/types.ts` mechanically:
+ * `test/integrity/shared-types-parity.test.ts` asserts that every declaration
+ * the two files share has the same member set (and, for union aliases, the same
+ * literal set). Member *lists* are all it covers — a stale prose default is
+ * still a human's to catch.
+ */
+export type PermissionMode = 'default' | 'acceptEdits' | 'plan' | 'auto' | 'bypassPermissions'
+
+/**
+ * Backward-compatible alias: `PermissionMode` plus the legacy 3-level
+ * `'self'`/`'ask'`/`'bypass'`. The legacy level was named `'auto'` until 2026-09-22;
+ * that name now belongs to the classifier mode, so the two can no longer be
+ * confused for one another (the `fc5afd3a` incident was exactly that confusion:
+ * a config `permission: auto` meaning "tool self-decides" silently becoming
+ * "run everything").
+ */
+export type PermissionLevel = PermissionMode | 'self' | 'ask' | 'bypass'
 
 /** Org-level restrictions that cap or forbid specific permission modes. */
 export interface PermissionRestrictions {

package/src/shared/update.ts

@@ -9,12 +9,11 @@
 import { readFileSync, existsSync, copyFileSync, mkdirSync, chmodSync } from 'node:fs'
 import { join } from 'node:path'
 import { execSync } from 'node:child_process'
-import { homedir } from 'node:os'
 import { PACKAGE_VERSION } from './package-info'
+import { miphamHome } from '../core/paths.ts'
 
 const PACKAGE = '@miphamai/cli'
-const HOME = homedir()
-const MIPHAM_HOME = join(HOME, '.mipham')
+const MIPHAM_HOME = miphamHome()
 const CONFIG_PATH = join(MIPHAM_HOME, 'config.yml')
 
 // Registry fallback chain: npm default → npmmirror (China mirror)