@miphamai/cli 0.85.1 → 0.85.3

package/bin/mipham.ts

@@ -437,6 +437,19 @@ async function runAttachCLI(): Promise<boolean> {
   const args = process.argv.slice(2)
   if (args[0] !== 'attach') return false
 
+  // `--permission <mode>` is the same flag here as on the interactive path, because it
+  // is the same gate — it just lives on the other side of the socket. The request goes
+  // out as `set_mode` when the TUI starts, and the daemon's answer is what the footer
+  // shows: it clamps, so `--permission bypassPermissions` under an org cap comes back
+  // narrower. Checked before the daemon is contacted: a misspelled mode is wrong whether
+  // or not a daemon happens to be running.
+  const { parsePermissionFlag, firstPositional } = await import('../src/shared/arg-validation')
+  const permissionFlag = parsePermissionFlag(args)
+  if (permissionFlag.kind === 'error') {
+    console.error(permissionFlag.message)
+    process.exit(1)
+  }
+
   const { getPort, getDaemonStatus } = await import('../src/daemon/index')
   const { join } = await import('node:path')
   const { readFileSync, existsSync } = await import('node:fs')
@@ -479,7 +492,10 @@ async function runAttachCLI(): Promise<boolean> {
   }
 
   const latestFlag = args.includes('--latest')
-  const sessionIdArg = args[1] && !args[1].startsWith('-') ? args[1] : undefined
+  // Skip flags **and the values of value-taking flags**: with `--permission plan <id>`
+  // the old `args[1]` read `--permission` (starts with `-`, so no id) and silently fell
+  // through to the session list — the flag would have looked accepted and done nothing.
+  const sessionIdArg = firstPositional(args.slice(1)) ?? undefined
 
   let targetSession: SessionInfo | null = null
 
@@ -534,6 +550,7 @@ async function runAttachCLI(): Promise<boolean> {
   const { runApp } = await import('../src/index')
   await runApp({
     version,
+    permission: permissionFlag.kind === 'ok' ? permissionFlag.mode : undefined,
     remoteSession: {
       sessionId: targetSession.id,
       port,
@@ -1198,6 +1215,10 @@ async function main() {
     process.argv.includes('-h') ||
     process.argv.slice(2).some((a) => a === 'help')
   ) {
+    // The mode list is **derived**, never typed out here — a help screen with its own copy
+    // is how it comes to advertise a mode the flag then refuses (see `arg-validation`:
+    // the list in the error message and the list in the help are the same array).
+    const { ALL_MODES } = await import('../src/core/permission-config')
     console.log(`Mipham Code — AI-powered coding terminal
 
 Usage:
@@ -1226,6 +1247,8 @@ Flags:
   --dump-config              Print the assembled profile tree
   --safe-mode                Skip custom agents, skills, hooks, plugins
   --resume <name>            Open a saved session (see /resume for names)
+  --permission <mode>        Start in this mode: ${ALL_MODES.join('|')}
+                             (also accepted by 'mipham attach'; the daemon may clamp it)
   --version, -v, -V          Print version
 
 Docs: https://mipham.ai/code
@@ -1348,9 +1371,26 @@ npm:  https://www.npmjs.com/package/@miphamai/cli`)
     }
   }
 
+  // Parse --permission <mode>: the session's starting mode. `runApp` has accepted
+  // `options.permission` all along — the system prompt and the engine both read the live
+  // permission system it is applied to — but **nothing ever passed it**, so the only ways
+  // to pick a mode were `config.yml`, Shift+Tab after startup, or the daemon's env var.
+  // Same shape as `--resume` above; same remedy, and the value is refused rather than
+  // silently replaced (see `parsePermissionFlag`).
+  const { parsePermissionFlag } = await import('../src/shared/arg-validation')
+  const permissionFlag = parsePermissionFlag(process.argv.slice(2))
+  if (permissionFlag.kind === 'error') {
+    console.error(permissionFlag.message)
+    process.exit(1)
+  }
+
   try {
     const { runApp } = await import('../src/index')
-    await runApp({ version: APP_VERSION, resume: resumeName })
+    await runApp({
+      version: APP_VERSION,
+      resume: resumeName,
+      permission: permissionFlag.kind === 'ok' ? permissionFlag.mode : undefined,
+    })
   } catch (err: unknown) {
     const msg = err instanceof Error ? err.message : String(err)
     if (msg.includes('react-devtools-core')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.85.1",
+  "version": "0.85.3",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/skills/standard/mipham-code-setup.SKILL.md

@@ -360,13 +360,20 @@ Press **Shift+Tab** to change the mode live; it cycles
 `bypassPermissions` is a legal mode but is deliberately **not** on the wheel —
 it is reached by naming it in config, where the user has said what they mean.
 
-To persist a mode for a project, in `.mipham/config.yml`:
+To persist a mode, name it in `~/.mipham/config.yml`:
 
 ```yaml
 permission: default
 ```
 
-Any mode name from the table above is accepted, including `bypassPermissions`.
+Or in `~/.mipham/settings.json` as `permissions.defaultMode` (the key Claude Code
+users already have). Any mode name from the table above is accepted in either,
+including `bypassPermissions`.
+
+A **project-level** `.mipham/config.yml` cannot set a mode — that file arrives with
+the code, so whoever wrote the repository would be choosing the approval gate. A
+mode found there is ignored and reported; the fix is to move the line to the user
+level, or to pass `--permission <mode>` for one invocation.
 
 Or via slash command:
 

package/src/agent/agent-experience.ts

@@ -1,4 +1,5 @@
-import { mkdirSync, readFileSync, writeFileSync, existsSync, unlinkSync } from 'node:fs'
+import { mkdirSync, readFileSync, existsSync, unlinkSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join } from 'node:path'
 import { ExperienceRuleExtractor, type ExperienceRule } from './experience-rules.js'
 import { miphamHome } from '../core/paths.ts'
@@ -109,6 +110,6 @@ export class AgentExperience {
       },
     )
 
-    writeFileSync(this.expFile, content, 'utf-8')
+    atomicWriteFileSync(this.expFile, content, { mode: 0o644 })
   }
 }

package/src/agent/background-registry.ts

@@ -83,12 +83,16 @@ export class BackgroundAgentRegistry {
    *
    * @param description - Human-readable description
    * @param agentType - Sub-agent type (general, explore, plan, code-review)
-   * @param executor - Async function that performs the work
+   * @param executor - Async function that performs the work. Given the task's
+   *   abort signal **and its id**: the id is minted here, and it is the address
+   *   peers send to (`SendMessage` → `MessageRouter` → this `bg-…`), so an
+   *   executor that never learns it has no way to be reachable. Callers that do
+   *   not need it can keep declaring just the signal.
    */
   spawn(
     description: string,
     agentType: string,
-    executor: (signal: AbortSignal) => Promise<string>,
+    executor: (signal: AbortSignal, id: string) => Promise<string>,
     kind: BackgroundTaskKind = 'interactive',
   ): string {
     const id = `bg-${++this.idCounter}-${Date.now().toString(36)}`
@@ -132,7 +136,7 @@ export class BackgroundAgentRegistry {
     }
 
     // Execute in background — do NOT await
-    executor(task.abortController.signal)
+    executor(task.abortController.signal, id)
       .then((result) => {
         task.status = 'completed'
         task.completedAt = new Date()

package/src/agent/cross-session/discovery.ts

@@ -1,12 +1,5 @@
-import {
-  readdirSync,
-  readFileSync,
-  writeFileSync,
-  existsSync,
-  mkdirSync,
-  unlinkSync,
-  statSync,
-} from 'node:fs'
+import { readdirSync, readFileSync, existsSync, mkdirSync, unlinkSync, statSync } from 'node:fs'
+import { atomicWriteFileSync } from '../../shared/atomic-write'
 import { join, basename } from 'node:path'
 import { hostname } from 'node:os'
 import type { SessionInfo, CrossSessionInbound } from '../../shared/types'
@@ -25,7 +18,7 @@ const STALE_SESSION_TTL_MS = 10 * 60 * 1000 // 10 min — heartbeat is 30s
 export function registerActiveSession(info: SessionInfo): void {
   mkdirSync(ACTIVE_SESSIONS_DIR, { recursive: true })
   const filePath = join(ACTIVE_SESSIONS_DIR, `${info.id}.json`)
-  writeFileSync(filePath, JSON.stringify(info, null, 2), 'utf-8')
+  atomicWriteFileSync(filePath, JSON.stringify(info, null, 2), { mode: 0o644 })
 }
 
 /**
@@ -36,7 +29,7 @@ export function heartbeatSession(sessionId: string): void {
   if (existsSync(filePath)) {
     // Touch the file by rewriting it
     const raw = readFileSync(filePath, 'utf-8')
-    writeFileSync(filePath, raw, 'utf-8') // updates mtime
+    atomicWriteFileSync(filePath, raw, { mode: 0o644 }) // updates mtime
   }
 }
 
@@ -141,7 +134,7 @@ export function renameActiveSession(sessionId: string, newName: string): string
   const info = JSON.parse(raw) as SessionInfo
   const others = discoverSessions().filter((s) => s.id !== sessionId)
   info.name = ensureUniqueSessionName(newName, others)
-  writeFileSync(filePath, JSON.stringify(info, null, 2), 'utf-8')
+  atomicWriteFileSync(filePath, JSON.stringify(info, null, 2), { mode: 0o644 })
   return info.name
 }
 

package/src/agent/cross-session/file-inbox.ts

@@ -1,6 +1,5 @@
 import {
   mkdirSync,
-  writeFileSync,
   readdirSync,
   readFileSync,
   unlinkSync,
@@ -8,6 +7,7 @@ import {
   renameSync,
   lstatSync,
 } from 'node:fs'
+import { atomicWriteFileSync } from '../../shared/atomic-write'
 import { join } from 'node:path'
 import type { CrossSessionTransport } from './transport'
 import type { AgentMessage } from '../message-bus'
@@ -69,7 +69,7 @@ export class FileInboxTransport implements CrossSessionTransport {
 
       // Atomic write: temp file then rename
       const tmpPath = filePath + '.tmp'
-      writeFileSync(tmpPath, JSON.stringify(envelope, null, 2), 'utf-8')
+      atomicWriteFileSync(tmpPath, JSON.stringify(envelope, null, 2), { mode: 0o644 })
       renameSync(tmpPath, filePath)
 
       return true

package/src/agent/effectiveness-tracker.ts

@@ -1,4 +1,5 @@
-import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { mkdirSync, readFileSync, existsSync } from 'node:fs'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { join, dirname } from 'node:path'
 import type { CrsiProvenanceBridge, CrsiVerdict } from './crsi-provenance-bridge.js'
 import { isRecoverableToolFailure } from './recoverable-failure.js'
@@ -174,7 +175,7 @@ export class EffectivenessTracker {
     for (const [k, v] of this.data) {
       obj[k] = v
     }
-    writeFileSync(this.storePath, JSON.stringify(obj, null, 2), 'utf-8')
+    atomicWriteFileSync(this.storePath, JSON.stringify(obj, null, 2), { mode: 0o644 })
   }
 
   load(): void {

package/src/agent/sub-agent.ts

@@ -1,12 +1,13 @@
 import type { ProviderRegistry } from '../providers/registry'
 import type { Llm } from '../providers/llm'
-import type { ToolDefinition, ToolContext } from '../shared/index.ts'
+import type { Message, ToolDefinition, ToolContext } from '../shared/index.ts'
 import type { SubAgentType, SubAgentOptions, AgentDefinition } from './types'
 import { createAgentContext } from './agent-context'
 import { getBackgroundAgentRegistry } from './background-registry'
-import { getMessageBus } from './message-bus'
+import { formatInboundMessage, getMessageBus } from './message-bus'
 import type { HookEngine } from '../core/hooks'
 import { PermissionSystem } from '../core/permission'
+import { buildPermissionBlock } from '../core/instructions'
 import { AgentExperience } from './agent-experience'
 import { PatternAnalyzer } from './pattern-analyzer.js'
 import { getWorkspaceTrust } from '../core/workspace-trust'
@@ -91,14 +92,14 @@ export class SubAgent {
     if (options.runInBackground) {
       const bgRegistry = getBackgroundAgentRegistry()
 
-      const taskId = bgRegistry.spawn(description, agentType, async (signal) => {
+      const taskId = bgRegistry.spawn(description, agentType, async (signal, agentId) => {
         // Run the synchronous execution inside the background executor, reporting
         // cumulative token usage back to the registry for live footer display.
         const opts: SubAgentOptions = {
           ...options,
           onTokenUsage: (total) => bgRegistry.updateTokenUsage(taskId, total),
         }
-        return this.runExecution(prompt, opts, signal)
+        return this.runExecution(prompt, opts, signal, agentId)
       })
 
       // Register completion callback for hook firing
@@ -148,7 +149,10 @@ export class SubAgent {
 
     // ── Synchronous execution path ──
     try {
-      const result = await this.runExecution(prompt, options)
+      // A caller that spawned the registry task itself owns the only abort
+      // controller for it; without passing it down the run ignores every check
+      // inside `runExecution` and cannot be stopped from the dashboard.
+      const result = await this.runExecution(prompt, options, options.signal)
       if (this.hookEngine) {
         await this.hookEngine.executeSubagentStop(agentType, description, 'sub-agent', true, result)
       }
@@ -210,10 +214,35 @@ export class SubAgent {
   /**
    * Internal execution method — shared by sync and background paths.
    */
+  /**
+   * Drain same-process messages addressed to *this* agent into its own turn,
+   * mirroring `Engine.drainInboundMessages` for the main session.
+   *
+   * Only the background path has an address to drain: `bg-…` is the recipient the
+   * message router publishes to, and it is minted by the registry — which is why
+   * `spawn` hands it to the executor. Until this ran, `SendMessage` to a running
+   * background agent returned `success: true, routedTo: 'bus'` and the message was
+   * read by nobody: the bus's only reader polled `[sessionId, 'main']`, so what
+   * the sender was told had been delivered sat there until the 1-hour prune.
+   * (The same hole the max-turns notice advertises away — "Use SendMessage to
+   * continue this sub-agent".)
+   */
+  private drainInboundMessages(agentId: string | undefined, messages: Message[]): number {
+    if (!agentId) return 0
+    const bus = getMessageBus()
+    const inbound = bus.poll(agentId)
+    for (const msg of inbound) {
+      messages.push({ role: 'user', content: formatInboundMessage(msg) })
+    }
+    if (inbound.length > 0) bus.markAllRead(agentId)
+    return inbound.length
+  }
+
   private async runExecution(
     prompt: string,
     options: SubAgentOptions,
     signal?: AbortSignal,
+    agentId?: string,
   ): Promise<string> {
     if (!this.registry.getActive()) {
       throw new Error('No active provider available for sub-agent execution')
@@ -360,7 +389,24 @@ export class SubAgent {
     let hitMaxTurns = false
 
     let currentMessages = messages
-    let currentSystemPrompt = systemPrompt
+    // ── 子代理报**它自己的档**，不是父档 ──
+    // `gate` 是每个工具调用真正过的那个闸门（上面构造的那个，缺省是 `default`）；
+    // 闸门的模式取自 `createSubAgentPermission` 的**解析结果** —— 定义写了
+    // `permissionMode` 的就是它自己那一档，写 `inherit` 的才是父档 —— 这里只读结果、
+    // 不重算，免得同一个事实有第二份推导。读 `getMode()` 而不是定义里那个字符串：
+    // 组织级上限（`maxAllowedMode`/`forbiddenModes`）会静默把模式钳走，报请求档就是
+    // 报得比实际宽 —— 与系统提示那边（`index.tsx` 的接线行）同一个理由。
+    //
+    // 它烘在**这一处**而不是走 `ContextManager.setPermissionContextSource`：子代理的请求
+    // 读的是下面这个局部变量（`systemPrompt: currentSystemPrompt`），**从不读上下文**的
+    // 系统提示 —— 挂在上下文上会是一处装饰（有接线、请求里一个字都到不了），正是本仓库
+    // 反复收的那种账。同样因为后续回合把提示清成 `''`（`currentSystemPrompt = ''`，
+    // 首轮才带系统提示），
+    // 权限段随**唯一**带提示的那一轮走，而不是每轮派生。
+    const permissionBlock = buildPermissionBlock(gate.getMode())
+    let currentSystemPrompt = permissionBlock
+      ? `${systemPrompt}\n\n---\n\n${permissionBlock}`
+      : systemPrompt
     let totalTokens = 0
 
     // Context for the sub-agent's own tool calls. Built once per run: the caller's
@@ -391,6 +437,10 @@ export class SubAgent {
           throw new DOMException('Aborted', 'AbortError')
         }
 
+        // Per turn, not once per run: a peer can write while this agent is mid
+        // task, and the point of the channel is to steer the work in progress.
+        this.drainInboundMessages(agentId, currentMessages)
+
         const toolUses: Array<{ id: string; name: string; input: Record<string, unknown> }> = []
         let turnText = ''
 
@@ -506,6 +556,12 @@ export class SubAgent {
           // `createSubAgentPermission`), so the default sub-agent is unchanged.
           const decision = await gate.resolveApproval(tool, effectiveInput, { signal })
           if (decision.level === 'ask') {
+            // Same circuit breaker as `Engine.executeTool`, sharing its threshold:
+            // after this many refusals in a row, say so, so the model stops
+            // re-issuing the call. It matters more here — a sub-agent gets five
+            // turns and cannot ask anyone, so a silent retry loop spends the whole
+            // run on a route that is closed to it.
+            const limitExceeded = gate.incrementBlockCounter()
             currentMessages.push({
               role: 'user' as const,
               content:
@@ -513,10 +569,15 @@ export class SubAgent {
                 `Cannot execute in non-interactive sub-agent context.` +
                 (decision.source === 'classifier' && decision.classifierReason
                   ? ` Classifier: ${decision.classifierReason}`
+                  : '') +
+                (limitExceeded
+                  ? '\n(Consecutive block limit reached. This route stays closed for the rest of this run — try a different approach instead of retrying this call.)'
                   : ''),
             })
             continue
           }
+          // Allowed — the streak is broken (mirrors the engine's reset).
+          gate.resetBlockCounter()
 
           try {
             const result = await tool.execute(effectiveInput, toolContext)

package/src/agent/types.ts

@@ -55,6 +55,16 @@ export interface SubAgentOptions {
   worktreePath?: string
   /** Seed the sub-agent with a parent conversation prefix (e.g., fork inheritance). */
   inheritContext?: { messages: Message[] }
+  /**
+   * Abort signal for a caller-owned execution.
+   *
+   * The `runInBackground` path mints its own controller inside `SubAgent`, so it
+   * needs nothing here. A caller that spawned the task in the registry itself
+   * (`/bg`, `/fork`) holds the only handle that can stop it — and if it does not
+   * hand that signal down, the signal is decoration: the registry's `stop()`
+   * aborts a controller nobody reads, and the agent runs to completion.
+   */
+  signal?: AbortSignal
   /**
    * Who authored the prompt. `'script'` marks text computed by a workflow
    * script — which is not the user speaking, even though it arrives as the

package/src/agent-view/agent-view-manager.ts

@@ -34,6 +34,16 @@ export interface AgentSession {
   branch?: string
   /** Created PR URL (if requested) */
   prUrl?: string
+  /**
+   * Id of the `BackgroundAgentRegistry` task actually doing the work, when this
+   * session was spawned by `/bg` or `/fork`.
+   *
+   * The two id spaces are minted separately (`agent-…` here, `bg-…` there), so
+   * without this the dashboard holds a row it cannot act on: its own `kill()`
+   * only flips the row's status and leaves the real task running with no handle
+   * left in the UI. This field is that handle.
+   */
+  taskId?: string
   /** Working directory the session was spawned from (used for directory grouping). */
   directory: string
 }
@@ -60,6 +70,35 @@ export class AgentViewManager {
   private sessions: Map<string, AgentSession> = new Map()
   private sessionOrder: string[] = []
   private idCounter = 0
+  private listeners: Set<() => void> = new Set()
+
+  /**
+   * Subscribe to any mutation of the session set. Returns an unsubscribe fn.
+   *
+   * The dashboard renders from this object, but the changes originate elsewhere
+   * (`/bg` and `/fork` mutate it from their executors, which resolve long after
+   * the keystroke that spawned them). Without a subscription the view is a
+   * snapshot painted once at mount: `setVersion` had exactly one caller
+   * (Ctrl+X), so a row that finished while the panel was open stayed `working`
+   * on screen forever.
+   */
+  onChange(listener: () => void): () => void {
+    this.listeners.add(listener)
+    return () => {
+      this.listeners.delete(listener)
+    }
+  }
+
+  /** One listener throwing must not stop the others, nor the mutation itself. */
+  private notify(): void {
+    for (const listener of this.listeners) {
+      try {
+        listener()
+      } catch {
+        // A broken view must never break the state transition that triggered it.
+      }
+    }
+  }
 
   /**
    * Create a new background agent session.
@@ -82,6 +121,7 @@ export class AgentViewManager {
 
     this.sessions.set(id, session)
     this.sessionOrder.push(id)
+    this.notify()
 
     return session
   }
@@ -171,6 +211,7 @@ export class AgentViewManager {
       session.startedAt = new Date()
     }
 
+    this.notify()
     return session
   }
 
@@ -189,6 +230,7 @@ export class AgentViewManager {
 
     session.status = 'failed'
     session.completedAt = new Date()
+    this.notify()
     return true
   }
 
@@ -208,6 +250,7 @@ export class AgentViewManager {
       session.completedAt = new Date()
     }
 
+    this.notify()
     return true
   }
 
@@ -219,6 +262,7 @@ export class AgentViewManager {
     if (!session) return false
 
     session.messages.push(message)
+    this.notify()
     return true
   }
 
@@ -247,6 +291,7 @@ export class AgentViewManager {
     const session = this.sessions.get(id)
     if (!session) return false
     session.title = newTitle
+    this.notify()
     return true
   }
 
@@ -257,6 +302,7 @@ export class AgentViewManager {
     if (!this.sessions.has(id)) return false
     this.sessions.delete(id)
     this.sessionOrder = this.sessionOrder.filter((oid) => oid !== id)
+    this.notify()
     return true
   }