@miphamai/cli 0.85.1 → 0.85.3

package/src/daemon/remote-engine.ts

@@ -17,7 +17,13 @@
 //   }
 //   engine.close()
 
-import type { ClientPromptMessage, ClientInterruptMessage, ServerMessage } from './attach-protocol'
+import type {
+  ClientPromptMessage,
+  ClientInterruptMessage,
+  ClientSetModeMessage,
+  ServerMessage,
+} from './attach-protocol'
+import { ALL_MODES } from '../core/permission-config'
 import type { PermissionMode, StreamChunk } from '../shared/types'
 
 // ── Public API ───────────────────────────────────────────────────────────────
@@ -54,6 +60,46 @@ export class RemoteEngine {
   /** Whether this engine has been explicitly closed. */
   private closed = false
 
+  /** In-flight connection attempt. See `ensureConnected()`. */
+  private connecting: Promise<void> | null = null
+
+  // ── Permission mode (the gate lives on the daemon) ───────────────────────
+  //
+  // Two values, and the difference between them is the whole contract:
+  //
+  // - `modeChosen` — the mode **this client's user** picked on this attach. Set by a
+  //   keypress (so the footer advances immediately — `cyclePermissionMode` computes the
+  //   next slot from `getMode()`'s read-back, and a `getMode` that only reported confirmed
+  //   values would freeze the wheel), then overwritten by the daemon's **answer**, because
+  //   org level `permissionRestrictions` silently rewrite a request and the daemon is the
+  //   only side that can see the clamp. A non-null value is a standing instruction and gets
+  //   re-asserted before every prompt. A connect snapshot is not an answer (see
+  //   `absorbMode`): it predates anything this client sent and must not retract it.
+  // - `modeConfirmed` — what the daemon said is in effect, from a `mode` frame or an
+  //   attach snapshot. **Display only, never asserted**: it is how a client that has not
+  //   picked anything learns the session's mode, and re-sending it would let a bystander
+  //   push its own guess over an operator's `MIPHAM_DAEMON_PERMISSION` — a silent override
+  //   by a client that never expressed an intent.
+  private modeChosen: PermissionMode | null = null
+  private modeConfirmed: PermissionMode | null = null
+
+  /** Viewers of the confirmed mode (the TUI footer). See `onPermissionModeChange`. */
+  private readonly modeListeners = new Set<(mode: PermissionMode) => void>()
+
+  /**
+   * One stable object — **not** a fresh closure per `getPermission()` call.
+   *
+   * `app.tsx` calls `getPermission()` per keypress (`cyclePermissionMode(engine.getPermission(), …)`
+   * and the initial `useState`), so a per-call object-throws away everything it was told:
+   * the mode read back is a brand-new `'default'` and nothing is ever sent to the daemon.
+   */
+  private readonly permissionFacade = {
+    setMode: (mode: PermissionMode): void => {
+      this.requestMode(mode)
+    },
+    getMode: (): PermissionMode => this.modeChosen ?? this.modeConfirmed ?? 'default',
+  }
+
   constructor(options: RemoteEngineOptions) {
     this.sessionId = options.sessionId
     this.port = options.port
@@ -64,12 +110,20 @@ export class RemoteEngine {
 
   /**
    * Ensure a WebSocket connection to the daemon exists.
-   * Creates one lazily on the first process() call.
+   * Creates one lazily on the first process() or setMode() call.
+   *
+   * Concurrent callers **share** the in-flight attempt. Without that, the second caller
+   * sees `this.ws` set but not yet `OPEN`, treats it as a stale socket, nulls its handlers
+   * and closes it — so the first caller's promise can never settle (its `onopen` was
+   * detached) and the message it was about to send goes to a socket nobody is listening on.
    */
   private ensureConnected(): Promise<void> {
     if (this.ws && this.ws.readyState === WebSocket.OPEN) {
       return Promise.resolve()
     }
+    if (this.connecting) {
+      return this.connecting
+    }
 
     if (this.ws) {
       // Stale socket — clean up before reconnecting
@@ -87,7 +141,7 @@ export class RemoteEngine {
 
     const url = `ws://127.0.0.1:${this.port}/api/v1/sessions/${this.sessionId}/stream`
 
-    return new Promise<void>((resolve, reject) => {
+    const attempt = new Promise<void>((resolve, reject) => {
       const ws = new WebSocket(url)
       this.ws = ws
 
@@ -112,6 +166,15 @@ export class RemoteEngine {
         reject(new Error(`Failed to connect to daemon at 127.0.0.1:${this.port}`))
       }
     })
+
+    this.connecting = attempt
+    const clear = () => {
+      if (this.connecting === attempt) this.connecting = null
+    }
+    // Both slots handled on purpose: this promise is only ever awaited by callers that
+    // catch, but a rejection here would otherwise surface as unhandled.
+    attempt.then(clear, clear)
+    return attempt
   }
 
   // ── Prompt Processing (async generator) ──────────────────────────────────
@@ -145,6 +208,17 @@ export class RemoteEngine {
     this.resolveNext = null
     this.rejectNext = null
 
+    // Re-assert the mode this client's user picked, **before** the prompt — frames on one
+    // socket arrive in the order they were sent, so the daemon applies the gate first and
+    // this turn runs under the mode the user is looking at. Idempotent by design, and it
+    // heals the two ways the gate can drift behind the client's back (a daemon restart, or
+    // a worker evicted while idle and rebuilt from env).
+    //
+    // Skipped when nothing was ever picked here: the daemon owns the default (env config,
+    // an earlier client, an operator), and a bystander must not overwrite it by asserting
+    // the value it merely *displays*.
+    if (this.modeChosen) await this.sendMode(this.modeChosen)
+
     // Send the prompt
     const promptMsg: ClientPromptMessage = {
       type: 'prompt',
@@ -215,9 +289,10 @@ export class RemoteEngine {
 
   // ── Stub methods for TUI compatibility ───────────────────────────────────
   //
-  // In remote attach mode, the daemon manages providers, agents, permissions,
-  // and context. These stubs satisfy the TUI's engine interface without
-  // introducing daemon dependencies into the UI layer.
+  // In remote attach mode, the daemon manages providers, agents and context. These stubs
+  // satisfy the TUI's engine interface without introducing daemon dependencies into the
+  // UI layer. (Permissions are **not** in this list: they are forwarded over the attach
+  // protocol — see `getPermission` — because the footer is a display of the daemon's gate.)
   //
   // Slash commands may call any of these; we return safe defaults.
 
@@ -257,17 +332,31 @@ export class RemoteEngine {
     }
   }
 
-  /** Returns a stub permission object so slash commands don't crash. */
-  getPermission(): { setMode(_mode: PermissionMode): void; getMode(): PermissionMode } {
-    // Remote mode: permissions are managed by the daemon, and the attach protocol has
-    // no read-back — so `getMode` reports the last mode the user asked for (which is
-    // what the footer has always shown here), not a value the daemon never confirmed.
-    let requested: PermissionMode = 'default'
-    return {
-      setMode: (mode: PermissionMode) => {
-        requested = mode
-      },
-      getMode: () => requested,
+  /**
+   * The permission surface the footer reads and writes — wired to the daemon's gate,
+   * not a local mirror of it (`app.tsx` treats this line as **the mirror of execution**).
+   *
+   * Writing (`setMode`) sends `set_mode`; the daemon applies it to the session's live
+   * `PermissionSystem` and answers with the mode that actually took effect. Reading
+   * (`getMode`) answers optimistically until that answer arrives — see the field comments.
+   */
+  getPermission(): { setMode(mode: PermissionMode): void; getMode(): PermissionMode } {
+    return this.permissionFacade
+  }
+
+  /**
+   * Subscribe to mode corrections from the daemon (`mode` frames, and the `mode` field of
+   * a `session_state` snapshot). Returns an unsubscribe function.
+   *
+   * Needed because the confirmed value can arrive **asynchronously** — a keypress is not a
+   * render, so a footer that only ever read `getMode()` on keypress would keep displaying
+   * the pre-clamp value forever. Nothing local has this problem: a local engine's
+   * `getMode()` already reflects the clamp the moment `setMode` returns.
+   */
+  onPermissionModeChange(listener: (mode: PermissionMode) => void): () => void {
+    this.modeListeners.add(listener)
+    return () => {
+      this.modeListeners.delete(listener)
     }
   }
 
@@ -353,6 +442,14 @@ export class RemoteEngine {
       return
     }
 
+    // Session facts, not prompt stream: they carry the gate's current mode and must be
+    // absorbed even when nothing is consuming chunks (a keypress, not a turn).
+    if (msg.type === 'mode' || msg.type === 'session_state') {
+      // A snapshot describes the gate as of connect — see `absorbMode`.
+      this.absorbMode(msg.mode, msg.type === 'session_state')
+      return
+    }
+
     const chunk = this.mapMessageToChunk(msg)
     if (!chunk) return
 
@@ -364,10 +461,67 @@ export class RemoteEngine {
     }
   }
 
+  // ── Permission plumbing ─────────────────────────────────────────────────
+
+  /** Optimistically take the mode, then tell the daemon (best effort). */
+  private requestMode(mode: PermissionMode): void {
+    this.modeChosen = mode
+    // Fire and forget: the correctness-critical send is the one `process()` makes before
+    // every prompt. This one only shortens how long a footer can sit on a clamped value
+    // (the daemon answers with `mode`, which usually lands before the next render).
+    void this.sendMode(mode)
+  }
+
+  /** Send `set_mode`. Silent when the daemon is unreachable or the socket is closing. */
+  private async sendMode(mode: PermissionMode): Promise<void> {
+    try {
+      await this.ensureConnected()
+      const msg: ClientSetModeMessage = { type: 'set_mode', sessionId: this.sessionId, mode }
+      this.ws?.send(JSON.stringify(msg))
+    } catch {
+      // No daemon: the mode stays local, exactly as it did before this existed. The next
+      // `process()` re-asserts it, so nothing is lost if the connect was merely slow.
+    }
+  }
+
+  /**
+   * Take the daemon's word for the effective mode and hand it to the footer.
+   *
+   * Validated against `ALL_MODES` rather than trusted: this frame crosses a process
+   * boundary and the two sides version independently (an older daemon need not send the
+   * field at all), and a bad value would otherwise sit in the footer as a mode no wheel
+   * slot can step away from.
+   *
+   * `fromSnapshot` separates the two kinds of frame, and they are **not** interchangeable:
+   *
+   * - a `mode` frame is the daemon **answering** — either a `set_mode` this client (or
+   *   another) sent, or a live change. It is newer than anything we sent, so it replaces the
+   *   request; that is the channel a clamp travels back on;
+   * - `session_state` is sent the moment the socket attaches (`addClient` → `sendState`),
+   *   so it describes the gate as of connect — i.e. **before** a `set_mode` this client had
+   *   already sent could have been handled. Letting it retract the request would drop the
+   *   standing instruction, and the very next prompt is what would do the dropping: the
+   *   re-assert reads `modeChosen`, now holding the pre-request value, and helpfully pushes
+   *   it — so `--permission plan` (or a `Shift+Tab` made just before a reconnect) would be
+   *   silently **cancelled** rather than narrowed. It is not worth displaying either, since
+   *   it is already superseded by a request that is in flight; the answer is what the footer
+   *   needs, and the daemon always sends one for a `set_mode` it understood.
+   */
+  private absorbMode(mode: unknown, fromSnapshot = false): void {
+    if (typeof mode !== 'string' || !ALL_MODES.includes(mode as PermissionMode)) return
+    const effective = mode as PermissionMode
+    this.modeConfirmed = effective
+    if (this.modeChosen) {
+      if (fromSnapshot) return
+      this.modeChosen = effective
+    }
+    for (const listener of this.modeListeners) listener(effective)
+  }
+
   /**
    * Map a ServerMessage from the daemon to a StreamChunk.
-   * Returns null for message types that should be silently consumed
-   * (e.g., session_state which is only informative for attach).
+   * Returns null for message types that carry no prompt output. (`session_state` and
+   * `mode` never reach here — `onMessage` absorbs them as session facts.)
    */
   private mapMessageToChunk(msg: ServerMessage): StreamChunk | null {
     switch (msg.type) {
@@ -424,11 +578,6 @@ export class RemoteEngine {
         return { type: 'error', error: msg.message }
       }
 
-      // session_state is an informational message sent when a client
-      // first attaches. It is not part of the prompt stream.
-      case 'session_state':
-        return null
-
       default:
         return null
     }

package/src/daemon/server.ts

@@ -67,6 +67,13 @@ interface WsData {
  * Values `MIPHAM_DAEMON_PERMISSION` accepts. The **default stays `'default'`**;
  * every widening is an explicit operator choice.
  *
+ * Also the whitelist an attached client's `set_mode` is measured against: a mode the
+ * daemon does not understand must not be applied (fail-closed) — the client's footer
+ * is a *display* of this gate, never its input. Keeping both uses on one set means a
+ * mode the daemon declines via env is declined via `set_mode` too; a second hand-kept
+ * list would let the two drift (`test/integrity/permission-status-parity.test.ts` P7
+ * pins this set against `ALL_MODES`).
+ *
  * `'auto'` is accepted, and today it means **every tool call is refused**: the
  * mode's static baseline answers `'ask'` for all of them, and the daemon has no
  * classifier to rule on the `'ask'` (the classifier is wired in the CLI's
@@ -77,7 +84,7 @@ interface WsData {
  * than what was asked for; a silent widening is the worse of the two ways to be
  * wrong. This entry becomes useful the day the daemon builds a classifier.
  */
-const DAEMON_PERMISSION_MODES: ReadonlySet<PermissionMode> = new Set<PermissionMode>([
+export const DAEMON_PERMISSION_MODES: ReadonlySet<PermissionMode> = new Set<PermissionMode>([
   'default',
   'acceptEdits',
   'plan',
@@ -207,6 +214,19 @@ export function createServer(config: ServerConfig): Server<WsData> {
   let sharedRegistry: ProviderRegistry | null = null
   let sharedTools: Map<string, ToolDefinition> | null = null
 
+  /**
+   * The mode each session's client last asked for (`set_mode`), so a **rebuilt** engine
+   * comes back on the user's mode instead of the env default.
+   *
+   * Why not just read it back off the live engine: engines are not permanent. `WorkerPool`
+   * evicts an idle worker, which drops `engineCache`'s entry too, and the next prompt
+   * rebuilds from `resolveDaemonPermission()` — the env value. Without this map the gate
+   * silently reverts (narrower *or* wider than the footer says) and nothing announces it.
+   * Stored as **requested**, not effective: `setMode` re-clamps on the way in, so the
+   * rebuilt engine lands on the same value the first one did.
+   */
+  const sessionModes = new Map<string, PermissionMode>()
+
   function getOrCreateEngine(
     sessionId: string,
     cwd: string,
@@ -260,6 +280,10 @@ export function createServer(config: ServerConfig): Server<WsData> {
       daemonConfig.permissionRestrictions,
       daemonConfig.permissionRules,
     )
+    // After `setRestrictions` (inside the builder) so this goes through the same clamp the
+    // first engine did — see `sessionModes`. Absent entry ⇒ env mode, unchanged.
+    const requestedMode = sessionModes.get(sessionId)
+    if (requestedMode) permission.setMode(requestedMode)
     const engine = new QueryEngine(sharedRegistry, context, sharedTools, permission)
     engine.setSessionId(sessionId)
     // Same engine capabilities as the interactive CLI — see engine-capabilities.ts.
@@ -876,6 +900,32 @@ export function createServer(config: ServerConfig): Server<WsData> {
             break
           }
 
+          case 'set_mode': {
+            // The client pressed Shift+Tab; the gate moves **here**, not in the client's
+            // footer. `sessionId` comes from the socket, never from the payload: the same
+            // message must not be able to move another session's gate.
+            const requested: unknown = parsed.mode
+            const known =
+              typeof requested === 'string' &&
+              DAEMON_PERMISSION_MODES.has(requested as PermissionMode)
+
+            // Materialize the worker when needed — a mode with no engine behind it is not a
+            // mode, and without this the very first keypress (before any prompt) would fall
+            // through and leave the footer's value unconfirmed. Cheap after the first time.
+            const worker = getOrCreateWorker(sessionId, ws)
+            if (!worker) return
+
+            if (known) sessionModes.set(sessionId, requested as PermissionMode)
+            // An unrecognized value changes nothing (fail-closed) — but the client is still
+            // told the **effective** mode, so its footer lands back on a mode this daemon
+            // really will grant instead of parking on one it never accepted.
+            const effective = known
+              ? worker.setPermissionMode(requested as PermissionMode)
+              : worker.getPermissionMode()
+            broadcast(sessionId, { type: 'mode', sessionId, mode: effective })
+            break
+          }
+
           default:
             // Unknown message type — silently ignored
             break

package/src/daemon/session-worker.ts

@@ -22,7 +22,7 @@ import type { ServerWebSocket } from 'bun'
 import type { QueryEngine } from '../core/engine'
 import type { DaemonDatabase } from './database'
 import type { DaemonSession, MessageRecord } from './types'
-import type { StreamChunk } from '../shared/types'
+import type { PermissionMode, StreamChunk } from '../shared/types'
 import type {
   ClientInterruptMessage,
   ServerMessage,
@@ -47,6 +47,8 @@ export interface SessionStateSnapshot {
   status: string
   /** Last N messages for context restoration on attach. */
   messages: MessageRecord[]
+  /** 本会话闸门当前生效的档位 —— attach 的客户端据此初始化页脚。 */
+  permissionMode: PermissionMode
 }
 
 // ── SessionWorker ─────────────────────────────────────────────────────────
@@ -234,6 +236,33 @@ export class SessionWorker {
     this.interrupt()
   }
 
+  // ── Permission Mode ────────────────────────────────────────────────────
+
+  /**
+   * Apply a permission mode to this session's live gate and return the mode that
+   * actually took effect.
+   *
+   * Through `engine.getPermission()` — the very object the engine's tool gate reads
+   * (`engine.ts` `this.permission.resolveApproval(…)`), so this is not a copy that
+   * the gate never sees.
+   *
+   * **Returns the effective mode, never the requested one.** Org-level
+   * `permissionRestrictions` silently rewrite what you ask for inside `setMode`, so
+   * echoing the request back would tell the attaching client's footer it has a
+   * permission the daemon will not grant — "says allowed, actually asks". The
+   * daemon is the only authority on this value; the client displays what it is told.
+   */
+  setPermissionMode(mode: PermissionMode): PermissionMode {
+    const permission = this.engine.getPermission()
+    permission.setMode(mode)
+    return permission.getMode()
+  }
+
+  /** The mode currently in effect for this session's gate. */
+  getPermissionMode(): PermissionMode {
+    return this.engine.getPermission().getMode()
+  }
+
   // ── Session State ──────────────────────────────────────────────────────
 
   /**
@@ -250,6 +279,7 @@ export class SessionWorker {
       turnCount: this.session.turnCount,
       status: this.session.status,
       messages,
+      permissionMode: this.getPermissionMode(),
     }
   }
 
@@ -413,6 +443,9 @@ export class SessionWorker {
       provider: state.provider,
       model: state.model,
       turnCount: state.turnCount,
+      // 带上生效档，否则新 attach 的客户端只能猜 `default` —— 在 `MIPHAM_DAEMON_PERMISSION`
+      // 或上一次 `set_mode` 把 daemon 定在别处时，页脚从第一帧起就与闸门不符。
+      mode: state.permissionMode,
     }
     try {
       ws.send(JSON.stringify(msg))

package/src/i18n-core/locales/en-US.json

@@ -893,6 +893,7 @@
     },
     "status": {
       "esc_to_interrupt": "esc to interrupt",
+      "ctrl_c_again": "ctrl+c again to exit",
       "shift_tab_cycle": "shift+tab",
       "left_for_agents": "ctrl+g agents to manage",
       "mipham_modes": "Mipham",

package/src/i18n-core/locales/zh-CN.json

@@ -893,6 +893,7 @@
     },
     "status": {
       "esc_to_interrupt": "Esc 中断",
+      "ctrl_c_again": "再按一次 Ctrl+C 退出",
       "shift_tab_cycle": "Shift+Tab",
       "left_for_agents": "ctrl+g 管理代理",
       "mipham_modes": "Mipham独有",

package/src/index.tsx

@@ -10,6 +10,7 @@ import {
   loadCredentialMaskingConfig,
   loadCrossSessionConfig,
   loadSettingsJson,
+  settingsPathFor,
 } from './config/loader'
 import {
   registerActiveSession,
@@ -30,7 +31,7 @@ import { generateSessionName } from './core/session-name'
 import { ExperienceRuleEngine } from './core/rule-engine.js'
 import { SessionLog } from './core/session-log'
 import { SessionStore } from './core/session-store'
-import type { PermissionLevel, MiphamConfig, McpServerConfig } from './shared/types'
+import type { PermissionLevel, PermissionMode, MiphamConfig, McpServerConfig } from './shared/types'
 import { PermissionSystem } from './core/permission'
 import { LlmPermissionClassifier } from './core/permission-classifier'
 import { SkillsLoader } from './skills/loader'
@@ -78,7 +79,16 @@ interface RunOptions {
   model?: string
   provider?: string
   lang?: string
-  permission?: string
+  /**
+   * Starting permission mode, from `--permission <mode>`.
+   *
+   * Typed as a real mode rather than a string on purpose: the flag is validated against
+   * `ALL_MODES` before it gets here (`shared/arg-validation.ts`), and this field used to
+   * be a `string` no caller ever filled in — the "written but unreachable" shape
+   * `--resume` had. Under `mipham attach` the daemon is still the authority: this becomes
+   * a `set_mode` request and its answer is what the footer shows.
+   */
+  permission?: PermissionMode
   resume?: string
   version?: string
   /** When set, launch TUI in remote mode connected to a daemon session. */
@@ -326,6 +336,13 @@ export async function runApp(options: RunOptions): Promise<void> {
     const { RemoteEngine } = await import('./daemon/remote-engine')
     const engine = new RemoteEngine(options.remoteSession)
 
+    // `--permission <mode>` under `attach`: this is a request, not an assignment — the
+    // gate is the daemon's, and `setMode` sends `set_mode` and takes the daemon's answer
+    // back (it clamps, and the answer is what the footer shows). Set before the TUI
+    // renders so the first render already reflects the user's intent rather than
+    // `default`; the frame itself is re-asserted ahead of every prompt.
+    if (options.permission) engine.getPermission().setMode(options.permission)
+
     // Detect locale and create translation function (same as local path)
     const locale = detectLocale({ lang: options.lang })
     const t = createT(localeBundles[locale] || enUS, enUS)
@@ -346,6 +363,10 @@ export async function runApp(options: RunOptions): Promise<void> {
           sessionId: options.remoteSession.sessionId,
         }),
       }),
+      // Ink 默认 exitOnCtrlC: true，它在**任何 handler 拿到按键之前**就退进程
+      // （App.js `input === '\x03'`，且 useInput 那条路还会跳过全部监听器）。
+      // 于是 Ctrl+C 的语义只能由我们自己定 —— 见 App 里的「再按一次才退」。
+      { exitOnCtrlC: false },
     )
     await waitUntilExit()
 
@@ -364,6 +385,7 @@ export async function runApp(options: RunOptions): Promise<void> {
         onAttach={() => {}}
         onExit={() => process.exit(0)}
       />,
+      { exitOnCtrlC: false },
     )
     await waitUntilExit()
     process.exit(0)
@@ -377,16 +399,49 @@ export async function runApp(options: RunOptions): Promise<void> {
   // Load configuration
   const config = loadConfig()
 
-  // Permission policy is built **here**, before the system prompt exists, so the prompt
-  // can describe the mode the engine will actually run in. Building the prompt from
-  // `config.permission` handed the model a value that org restrictions can silently
-  // rewrite (and that may not even be a mode name — `bypass`/`auto`/`ask` inject nothing
-  // at all). The engine is created much later, after tools/hooks/vajra are mounted, so
-  // this instance is what gets handed to it rather than a second one built inside.
+  // Permission policy is built **here**, before anything can describe it. Neither the
+  // prompt nor the engine may read `config.permission`: org restrictions silently
+  // rewrite it, and it may not even be a mode name — `bypass`/`ask`/a typo inject
+  // nothing at all. The engine is created much later, after tools/hooks/vajra are
+  // mounted, so this instance is what gets handed to it rather than a second one built
+  // inside; the system prompt's permission section reads its `getMode()` per request
+  // (wired at `setPermissionContextSource` below), so it cannot drift from execution.
   const permission = new PermissionSystem('default')
-  // Sync with config (fix: UI shows "auto" but engine defaulted to bypass-legacy)
-  if (config.permission) {
-    permission.setDefaultLevel(config.permission as PermissionLevel)
+  // Read settings.json **here**, ahead of the mode, because it is one of the mode's
+  // sources (the hook registration further down consumes the same object — one read,
+  // two readers, so the two can never disagree about which file said what).
+  const projectHooksTrusted = getWorkspaceTrust().isTrusted(process.cwd())
+  const settingsJson = loadSettingsJson(process.cwd(), {
+    includeProjectHooks: projectHooksTrusted,
+  })
+  // Origin order, most specific first:
+  //   1. `--permission <mode>` — the operator's word **for this invocation**, typed
+  //      seconds ago. Nothing beats that.
+  //   2. user-level `settings.json` `permissions.defaultMode` — the adopted upstream
+  //      key. It outranks `config.yml` because a `config.yml` value **cannot be told
+  //      apart from the first-run wizard's**: the wizard writes `permission: default`
+  //      into that file, so ranking config first would let a line nobody chose
+  //      permanently shadow the key the user did write. (Both are the user's own
+  //      file; a project-level one never gets this far — see `loadSettingsJson`.)
+  //   3. `config.yml permission` — the native key, and the older of the two.
+  //   4. the built-in `default`.
+  // Every source lands on the **same** applier (`setDefaultLevel`), so there is one
+  // accepted value domain and one warning channel, whichever door the value came
+  // through. Org restrictions are applied just below, after all of them.
+  const configuredMode =
+    options.permission ?? settingsJson.permissions.defaultMode ?? config.permission
+  if (configuredMode) {
+    permission.setDefaultLevel(configuredMode as PermissionLevel)
+  }
+  // A withheld project-level mode is announced, for the same reason a withheld
+  // project-level hook is: from the outside, "ignored on purpose" and "never read
+  // your file" are the same silence — and this one is the user's own editing,
+  // made in a file they can still see the key in.
+  if (settingsJson.projectModeSkipped) {
+    process.stderr.write(
+      `⚠ Mipham Code: ignored permissions.defaultMode from ${settingsPathFor('project', process.cwd())}\n` +
+        `    (a repository must not choose the approval gate — set it in ${settingsPathFor('user', process.cwd())})\n`,
+    )
   }
   // Apply org-level permission restrictions (P0: bypassPermissions policy gap)
   if (config.permissionRestrictions) {
@@ -495,6 +550,11 @@ export async function runApp(options: RunOptions): Promise<void> {
   // Cache-aware microcompaction: track the provider's prompt-cache prefix.
   context.setCacheTracker(new PrefixCacheTracker())
 
+  // 权限段**读时派生**，不在组装时烘进提示。烘进去的是模式的一份拷贝，而模式会在会话中途
+  // 变（Shift+Tab）：往窄切是自纠正的，**往宽切**则让模型拿着旧指令拒绝做它已被允许做的事。
+  // 这里接的是 live `permission` —— 同一实例也交给引擎去执行，故下一次请求就与新档一致。
+  context.setPermissionContextSource(() => instructions.buildPermissionBlock(permission.getMode()))
+
   // Adaptive memory budget: scale with model's context window
   getMemoryManager().setContextWindow(modelContextWindow)
 
@@ -512,12 +572,12 @@ export async function runApp(options: RunOptions): Promise<void> {
         }
       }
       context.restoreLog(log)
-      context.setSystemPrompt(instructions.buildSystemPrompt(permission.getMode()))
+      context.setSystemPrompt(instructions.buildSystemPrompt())
     }
   }
 
   if (context.getMessageCount() === 0) {
-    const basePrompt = instructions.buildSystemPrompt(permission.getMode())
+    const basePrompt = instructions.buildSystemPrompt()
     const memoryReminder = loadSessionMemories(basePrompt)
     const skillsReminder = skillsLoader.buildSystemReminder(5000, config.skills?.reminder ?? 'full')
 
@@ -633,10 +693,7 @@ export async function runApp(options: RunOptions): Promise<void> {
   // already asked — and exited the process on "no". With no TTY it *cannot* ask, so
   // the answer is "no" and the hooks stay out rather than running unasked; that
   // skip is announced, since silence would look the same as having passed.
-  const projectHooksTrusted = getWorkspaceTrust().isTrusted(process.cwd())
-  const settingsJson = loadSettingsJson(process.cwd(), {
-    includeProjectHooks: projectHooksTrusted,
-  })
+  // `settingsJson` itself was read up top, next to the permission it also feeds.
   if (settingsJson.projectHooksSkipped) warnProjectHooksSkipped(process.cwd())
   for (const def of loadHookConfigs(settingsJson.hooks)) {
     hookEngine.register(def)
@@ -868,6 +925,7 @@ export async function runApp(options: RunOptions): Promise<void> {
         t,
       }),
     }),
+    { exitOnCtrlC: false },
   )
   await waitUntilExit()
   saveAndExit()