@miphamai/cli 0.85.2 → 0.85.4

package/src/commands/project.ts

@@ -174,57 +174,108 @@ Run /setup for the full wizard, or /config to view current settings.`,
   }
 }
 
+/**
+ * Split the rule argument(s) out of the whitespace-split slash-command args.
+ *
+ * Every surface that advertises this command prints the rule **quoted** — the denial
+ * messages (`i18n-core/locales/{en-US,zh-CN}.json`), this command's usage line and its
+ * examples, and the `config.yml` sample — and the narrower form the message recommends
+ * (`Bash(npm test)`) carries a space. Args arrive split on whitespace with the quotes
+ * still in them, so the rule is re-joined and split on quotes here instead. Without
+ * this the command rejects the exact spelling it tells the user to type:
+ * `/permissions allow "Git"` → `Invalid rule ""Git"": not a single tool name.`
+ */
+function parseRuleArgs(args: string[]): { rules: string[]; unbalanced: boolean } {
+  const rules: string[] = []
+  let current = ''
+  let quote: string | null = null
+
+  for (const ch of args.join(' ')) {
+    if (quote) {
+      if (ch === quote) quote = null
+      else current += ch
+    } else if (ch === '"' || ch === "'") {
+      quote = ch
+    } else if (/\s/.test(ch)) {
+      if (current) rules.push(current)
+      current = ''
+    } else {
+      current += ch
+    }
+  }
+  if (current) rules.push(current)
+
+  return { rules, unbalanced: quote !== null }
+}
+
 const permissionsCmd: CommandHandler = async (ctx, args) => {
   const c = ctx.engine.getContext()
   const msgs = c.getMessages()
 
-  // ── Rule persistence: allow/deny/remove <rule> [--user] ──
-  const positional = args.filter((a) => !a.startsWith('--'))
+  // ── Rule persistence: allow/deny/remove <rule>... [--user] ──
+  // `--user` is matched exactly: a rule fragment may legitimately begin with `--`
+  // (`Bash(--version)`), and dropping it as "a flag" would corrupt the rule.
+  const rest = args.filter((a) => a !== '--user')
   const scope: 'project' | 'user' = args.includes('--user') ? 'user' : 'project'
-  const verb = positional[0]
-  const rule = positional[1]
+  const verb = rest[0]
 
   if (verb === 'allow' || verb === 'deny' || verb === 'remove') {
     const { validateRulePattern } = await import('../core/permission-rules')
     const { addSettingsRule, removeSettingsRule, settingsPathFor } =
       await import('../config/loader')
 
-    // A rule that can't match is worse than no rule: it reads as protection
-    // that isn't there. Validate before writing.
-    const invalid = validateRulePattern(rule ?? '')
+    const { rules, unbalanced } = parseRuleArgs(rest.slice(1))
     const usage =
-      `Usage: /permissions <allow|deny|remove> <rule> [--user]\n\n` +
-      `  rule   Tool pattern — "Bash" or "Bash(npm test)".\n` +
+      `Usage: /permissions <allow|deny|remove> <rule>... [--user]\n\n` +
+      `  rule   Tool pattern — "Bash" or "Bash(npm test)". Quote it if it has spaces.\n` +
       `  --user Write to ~/.mipham/settings.json instead of .mipham/settings.json.`
 
-    if (verb !== 'remove' && !rule) {
+    if (unbalanced) {
+      return { content: `Unbalanced quote in rule.\n\n${usage}` }
+    }
+    if (rules.length === 0) {
       return { content: `Missing rule.\n\n${usage}` }
     }
-    if (invalid && verb !== 'remove') {
-      return { content: `Invalid rule "${rule}": ${invalid}.\n\n${usage}` }
+    // A rule that can't match is worse than no rule: it reads as protection
+    // that isn't there. Validate every rule before writing any of them.
+    if (verb !== 'remove') {
+      for (const rule of rules) {
+        const invalid = validateRulePattern(rule)
+        if (invalid) {
+          return { content: `Invalid rule "${rule}": ${invalid}.\n\n${usage}` }
+        }
+      }
     }
 
     const perm = ctx.engine.getPermission()
 
     if (verb === 'remove') {
-      const removed = removeSettingsRule(rule!, scope)
-      if (!removed) {
-        return { content: `No rule "${rule}" in ${settingsPathFor(scope)}.` }
-      }
-      perm.removeRule(rule!)
-      return {
-        content: `Removed from ${removed.path}\n\npermissions.${removed.key}:\n  ${rule}`,
+      const parts: string[] = []
+      for (const rule of rules) {
+        const removed = removeSettingsRule(rule, scope)
+        if (!removed) {
+          parts.push(`No rule "${rule}" in ${settingsPathFor(scope)}.`)
+          continue
+        }
+        perm.removeRule(rule)
+        parts.push(`Removed from ${removed.path}\n\npermissions.${removed.key}:\n  ${rule}`)
       }
+      return { content: parts.join('\n\n') }
     }
 
-    const path = addSettingsRule(verb, rule!, scope)
-    if (verb === 'allow') perm.allow(rule!)
-    else perm.deny(rule!)
+    let path = ''
+    for (const rule of rules) {
+      path = addSettingsRule(verb, rule, scope)
+      if (verb === 'allow') perm.allow(rule)
+      else perm.deny(rule)
+    }
     return {
       content:
         `Added to ${path}\n\n` +
-        `permissions.${verb}:\n  ${rule}\n\n` +
-        `This rule persists across sessions and applies from now on.`,
+        `permissions.${verb}:\n${rules.map((r) => `  ${r}`).join('\n')}\n\n` +
+        (rules.length === 1
+          ? `This rule persists across sessions and applies from now on.`
+          : `These rules persist across sessions and apply from now on.`),
     }
   }
 
@@ -240,8 +291,10 @@ Messages:   ${msgs.length} in context
 Tools:      ${ctx.engine.getTools().size} available
 
 Shift+Tab cycles: ${renderCycleLine()} (this session only).
-To persist a mode, set \`permission:\` in .mipham/config.yml — every mode below is
-accepted there.
+To persist a mode, name it in ~/.mipham/config.yml (\`permission:\`) or in
+~/.mipham/settings.json (\`permissions.defaultMode\`) — every mode below is accepted
+in either. A **project-level** file cannot set a mode: it arrives with the code, so
+whoever wrote the repository would be choosing the approval gate.
 
 Modes (least → most permissive):
 ${renderModeTable()}
@@ -476,7 +529,7 @@ const setupCmd: CommandHandler = async (ctx, args) => {
   ${skills.length} loaded (${standardSkills} standard + ${miphamSkills} mipham)
 
   Permissions
-  Mode: ${ctx.config.permission}  ·  Tools: ${ctx.engine.getTools().size}
+  Mode: ${ctx.engine.getPermission().getMode()}  ·  Tools: ${ctx.engine.getTools().size}
 
 
   ── Setup Steps ──

package/src/config/loader.ts

@@ -147,6 +147,35 @@ function mergeConfig(
   return merged
 }
 
+/**
+ * Drop `permission` from a **project-level** `config.yml` before it is merged,
+ * reporting it instead of applying it.
+ *
+ * `permission` is a ceiling, not a rule: it decides what the approval gate lets
+ * through without asking. Every other project-level key is a preference that a
+ * repository may reasonably commit; this one means "and do not ask me about the
+ * commands in here" — which is a decision about the operator, made by whoever
+ * wrote the repository. The same reasoning admits project-level `permissions.deny`
+ * (it narrows) and withholds `permissions.defaultMode` in `settings.json` (it
+ * widens) — the two files are the same door, so both are closed here.
+ *
+ * `mergeConfig` has no per-key allowlist, so this has to happen at the two points
+ * the project file enters. Reported rather than dropped silently: a repo whose
+ * setting stopped working should say so out loud, and silence is exactly what
+ * "your config was ignored" looks like from the outside.
+ */
+function stripProjectPermission(cfg: Partial<MiphamConfig>, path: string): Partial<MiphamConfig> {
+  if (cfg.permission === undefined) return cfg
+  const { permission, ...rest } = cfg
+  const shown = typeof permission === 'string' ? permission : JSON.stringify(permission)
+  process.stderr.write(
+    `⚠ Mipham Code: ignored permission: ${shown} from project config ${path}\n` +
+      `    (a repository must not choose the approval gate — set it in ~/.mipham/config.yml,\n` +
+      `    or pass --permission <mode> for this invocation)\n`,
+  )
+  return rest as Partial<MiphamConfig>
+}
+
 /**
  * Save a timestamped backup of config.yml to ~/.mipham/.
  * Keeps at most 5 backups; older ones are pruned.
@@ -254,11 +283,21 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
 
 /**
  * Parsed `settings.json` (Claude Code convention): hooks + permissions.
- * Hooks are additive across levels; permissions allow/deny are deduped unions.
+ * Hooks are additive across levels; permissions allow/deny are deduped unions —
+ * and `defaultMode` is the one member that is **not** merged, because it is a
+ * ceiling rather than a rule (see `loadSettingsJson`).
  */
 export interface SettingsJson {
   hooks: SettingsHooks
-  permissions: { allow: string[]; deny: string[] }
+  /**
+   * `defaultMode` is present only when the **user-level** file named one, and it
+   * is passed through **raw** (not validated here): the accepted spelling is
+   * `ALL_MODES`, and the single place that enforces it — plus the warning for a
+   * value that is not a mode — is `PermissionSystem.setDefaultLevel`. A second
+   * validator here would be a second value domain, and the two would drift the
+   * day a mode is added.
+   */
+  permissions: { allow: string[]; deny: string[]; defaultMode?: string }
   /**
    * Present (and `true`) only when the project-level file really did declare
    * hooks and they were withheld because the caller did not vouch for the
@@ -266,6 +305,13 @@ export interface SettingsJson {
    * so a caller announcing the skip cannot announce one that never happened.
    */
   projectHooksSkipped?: true
+  /**
+   * Same shape, for `permissions.defaultMode`: present only when the
+   * project-level file really declared a mode and it was **withheld**. Unlike
+   * `projectHooksSkipped` this is not conditioned on trust — the ceiling does not
+   * move for a file that arrives with the code, trusted workspace or not.
+   */
+  projectModeSkipped?: true
   /**
    * The subset of `hooks` that came from the project-level file — the entries
    * the workspace-trust gate governs. Absent unless the caller vouched for the
@@ -289,14 +335,35 @@ export interface SettingsJson {
  * established trust (or that only *display* the configured list) opt in
  * explicitly. The flag gates hooks only: `permissions` still merge from both
  * levels, since that question is answered by the mode ceiling, not by trust.
+ *
+ * **That last sentence is the reason `defaultMode` is the exception.** The
+ * ceiling only answers the trust question while repository-controlled files
+ * cannot move it; a repo that ships `.mipham/settings.json` with
+ * `permissions.defaultMode: "auto"` would otherwise hand itself the approval
+ * gate. So `defaultMode` is read from the **user-level file only**, and a
+ * project-level one is withheld and *reported* (`projectModeSkipped`) rather
+ * than dropped in silence — same treatment as a `plan`/`acceptEdits` value that
+ * used to be dropped entirely, except that the drop there fell back to the
+ * *wider* `default`. The upstream convention says the same thing in its own
+ * words: repo-level settings cannot grant `defaultMode`; adopt it in user
+ * settings instead.
+ *
+ * One consequence to keep in mind when reading a merged result: `permissions`
+ * is still provenance-free for allow/deny, so a caller cannot tell which of
+ * those two rules came from the repository. That is deliberate (above), and it
+ * is why the ceiling has to be the thing that repels the repo-controlled half.
  */
 export function loadSettingsJson(
   cwd: string = process.cwd(),
   options: { includeProjectHooks?: boolean } = {},
 ): SettingsJson {
   const hooks: SettingsHooks = {}
-  const permissions = { allow: [] as string[], deny: [] as string[] }
+  const permissions: { allow: string[]; deny: string[]; defaultMode?: string } = {
+    allow: [],
+    deny: [],
+  }
   let projectHooksSkipped = false
+  let projectModeSkipped = false
   // The project file's entries, kept out of the merge so provenance survives it.
   const projectHooks: SettingsHooks = {}
 
@@ -315,7 +382,7 @@ export function loadSettingsJson(
       if (raw === null) continue
       const parsed = JSON.parse(raw) as {
         hooks?: Record<string, unknown>
-        permissions?: { allow?: unknown; deny?: unknown }
+        permissions?: { allow?: unknown; deny?: unknown; defaultMode?: unknown }
       }
 
       if (!readHooks) {
@@ -343,6 +410,20 @@ export function loadSettingsJson(
       }
 
       if (parsed.permissions) {
+        // A mode counts as *declared* only when it is a non-empty string — the
+        // same test the hooks branch above uses, so a marker cannot outrun the
+        // fact it reports. What the string says is not checked here (see the
+        // `permissions` field doc): a typo must reach the applier, which is the
+        // one place that knows the accepted spellings and issues the warning.
+        const declaredMode =
+          typeof parsed.permissions.defaultMode === 'string' &&
+          parsed.permissions.defaultMode.trim() !== ''
+            ? parsed.permissions.defaultMode
+            : undefined
+        if (declaredMode !== undefined) {
+          if (isProject) projectModeSkipped = true
+          else permissions.defaultMode = declaredMode
+        }
         for (const key of ['allow', 'deny'] as const) {
           const list = parsed.permissions[key]
           if (!Array.isArray(list)) continue
@@ -362,6 +443,7 @@ export function loadSettingsJson(
   // gated on the strength of a file with nothing in it.
   const result: SettingsJson = { hooks, permissions }
   if (projectHooksSkipped) result.projectHooksSkipped = true
+  if (projectModeSkipped) result.projectModeSkipped = true
   if (Object.values(projectHooks).some((entries) => Array.isArray(entries) && entries.length > 0)) {
     result.projectHooks = projectHooks
   }
@@ -456,10 +538,20 @@ export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
 
   let config = { ...DEFAULT_CONFIG }
 
+  // The project file enters `loadConfig` at **two** points (fresh parse, and the
+  // parse that follows a restore from backup). Both go through here, so the guard
+  // on `permission` cannot be present on one path and missing on the other — a
+  // corrupted config that recovers from a backup is still the same repository's
+  // file, and "corrupt it once, get the setting honored" would be a bypass of the
+  // one key that is refused.
+  const applyProjectConfig = (parsed: Partial<MiphamConfig>): void => {
+    config = mergeConfig(config, stripProjectPermission(parsed, configPath), false)
+  }
+
   // ── Load project-level config ──
   const projectConfig = safeParseYaml(configPath, 'project config')
   if (projectConfig) {
-    config = mergeConfig(config, projectConfig, false)
+    applyProjectConfig(projectConfig)
   } else if (isRegularFile(configPath)) {
     // A real file is there but failed to parse — try to restore from backup.
     // 非普通文件走不到这里：那不是「损坏的配置」，而是根本不该当配置读的东西
@@ -471,7 +563,7 @@ export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
       // Retry parsing after restore
       const restored = safeParseYaml(configPath, 'restored project config')
       if (restored) {
-        config = mergeConfig(config, restored, false)
+        applyProjectConfig(restored)
       }
     }
   }

package/src/core/context.ts

@@ -37,6 +37,14 @@ interface Checkpoint {
 export class ContextManager {
   private messages: Message[] = []
   private systemPrompt = ''
+  /**
+   * 系统提示里的**权限段**是读时派生的，不是组装时烘进 `systemPrompt` 的一份拷贝。
+   *
+   * 烘进去的那份拷贝会与执行分叉：Shift+Tab 之后闸门与页脚都变了，模型手里还是旧指令
+   * —— 往窄切是自纠正的（模型比闸门更保守），**往宽切**则让模型拒绝做它已经被允许做的事。
+   * `index.tsx` 把它接到 live `PermissionSystem.getMode()` 上，于是切一次档，下一次请求就变。
+   */
+  private permissionContextSource: (() => string) | null = null
   private estimatedTokens = 0
   private checkpoints: Checkpoint[] = []
   private checkpointCounter = 0
@@ -116,11 +124,32 @@ export class ContextManager {
 
   setSystemPrompt(prompt: string): void {
     this.systemPrompt = prompt
-    this.estimatedTokens = this.estimateTokens(prompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
+  }
+
+  /**
+   * 接线点（`index.tsx`）：把权限段接到 live `PermissionSystem.getMode()` 上。
+   *
+   * 传 `null` 撤销。**不接**时系统提示里没有权限段（这里是唯一的施加点，故
+   * `test/integrity/permission-status-parity.test.ts` 从源码侧断这一行在场）。
+   */
+  setPermissionContextSource(fn: (() => string) | null): void {
+    this.permissionContextSource = fn
+  }
+
+  /**
+   * 存储的提示 + 读时派生的权限段。
+   *
+   * 段尾追加（而非插回原来的中段位置）是刻意的：只切档时**前缀保持不变**，
+   * 提供方的 prefix cache 仍能命中到权限段之前的部分。
+   */
+  private composedSystemPrompt(): string {
+    const block = this.permissionContextSource?.() ?? ''
+    return block ? `${this.systemPrompt}\n\n---\n\n${block}` : this.systemPrompt
   }
 
   getSystemPrompt(): string {
-    return this.systemPrompt
+    return this.composedSystemPrompt()
   }
 
   addMessage(msg: Message): void {
@@ -239,7 +268,7 @@ export class ContextManager {
     }
 
     // Re-estimate tokens
-    this.estimatedTokens = this.estimateTokens(this.systemPrompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
     for (const msg of this.messages) {
       this.estimatedTokens += this.estimateTokens(
         typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
@@ -257,7 +286,7 @@ export class ContextManager {
     this.messages = []
     this.checkpoints = []
     this.checkpointCounter = 0
-    this.estimatedTokens = this.estimateTokens(this.systemPrompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
   }
 
   getMessageCount(): number {
@@ -273,7 +302,7 @@ export class ContextManager {
   replaceMessages(messages: Message[]): void {
     this.messages = messages
     // Re-estimate tokens
-    this.estimatedTokens = this.estimateTokens(this.systemPrompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
     for (const msg of messages) {
       this.estimatedTokens += this.estimateTokens(
         typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
@@ -418,7 +447,7 @@ export class ContextManager {
 
   /** Re-estimate tokens from system prompt + current messages. */
   private reEstimateTokens(): void {
-    this.estimatedTokens = this.estimateTokens(this.systemPrompt)
+    this.estimatedTokens = this.estimateTokens(this.composedSystemPrompt())
     for (const msg of this.messages) {
       this.estimatedTokens += this.estimateTokens(
         typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),

package/src/core/instructions.ts

@@ -104,6 +104,58 @@ export const INSTRUCTION_FILENAMES = [
   'CLAUDE.md',
 ] as const
 
+/**
+ * P2-2: the permission-mode section of the system prompt. Tells the model its
+ * current permission level and what to expect.
+ *
+ * Module-level and pure (it reads no loaded instruction files) because **every**
+ * prompt-assembly site needs the same text: the CLI's main context, where the
+ * context calls it at read time via `ContextManager.setPermissionContextSource`
+ * so a mid-session Shift+Tab moves the text and the gate together, and each
+ * **sub-agent**, which reports **its own** mode (see `sub-agent.ts`).
+ */
+export function buildPermissionBlock(mode: string): string {
+  // Hand-written map, and a missing key is **silent**: the `if (!description)`
+  // below returns `''`, so the system prompt would simply say nothing about
+  // permissions rather than warn. Every `PermissionMode` member needs a line.
+  // `auto`'s text has to describe a gate the model cannot see: it is told
+  // "a classifier rules on each of your calls" rather than "you are
+  // unrestricted", because a model that believes it has blanket permission
+  // stops explaining what it is about to do — which is exactly the input the
+  // classifier needs.
+  const modeDescriptions: Record<string, string> = {
+    default:
+      'You are in **default** mode. Tools marked as requiring approval will be blocked. Use Read/Grep/Glob for exploration.',
+    acceptEdits:
+      'You are in **acceptEdits** mode. File reads and edits are allowed; Bash requires approval.',
+    plan: 'You are in **plan** mode. Only Read/Grep/Glob are allowed — no file modifications or command execution.',
+    auto: 'You are in **auto** mode. A classifier reviews each tool call before it runs and blocks calls that are destructive, that act on instructions found in files or tool output, or that touch credentials. Approved calls run; blocked ones return a denial with the reason. Prefer explaining the intent of a call when it is unusual.',
+    bypassPermissions:
+      'You are in **bypassPermissions** mode. All tools are allowed. Use this power responsibly.',
+  }
+
+  const description = modeDescriptions[mode]
+  if (!description) return ''
+
+  // What actually lifts a denial is not the same in `auto`. There the refusal is a
+  // ruling on one exact call, and a repeat of that same call is answered from the
+  // classifier cache rather than re-judged — so "retry after explaining yourself" is
+  // advice that cannot work, and telling the model to switch modes is advice that is
+  // never needed. The two levers that do work are named instead.
+  const escape =
+    mode === 'auto'
+      ? ' In **auto** mode the refusal is a ruling on that exact call: an allow rule (`/permissions allow`) lifts it, and so does changing the call so it no longer trips the rule — repeating the identical call returns the same ruling.'
+      : ''
+
+  // The tail used to name `bypassPermissions` as the Shift+Tab destination. That
+  // was true while the wheel carried it and became false the moment `auto`
+  // replaced it — and this string is *advice the model repeats to the user*, so
+  // staying stale makes it promise a keypress that does nothing. `bypassPermissions`
+  // is still reachable, but only by naming it in config; saying so is what keeps
+  // the model from offering it as a way out.
+  return `## Permission Context\n\n${description}\n\nWhen a tool is denied, do NOT retry it or any other approval-gated tool — Bash, WebSearch, network, and Workflow are all blocked in this mode.${escape} If the task genuinely needs a blocked tool, STOP retrying and ask the user to switch modes with Shift+Tab or add an allow rule (/permissions), then wait for the user's answer. Note that Shift+Tab's wheel does not reach bypassPermissions — that mode is set in config, so do not offer it as a keypress.`
+}
+
 export class InstructionsLoader {
   private instructions: InstructionFile[] = []
   private crsiLessonSummaries: CrsiLessonSummary[] = []
@@ -133,7 +185,16 @@ export class InstructionsLoader {
     this.crsiLessonSummaries = this.loadCrsiLessons(root)
   }
 
-  buildSystemPrompt(permissionMode?: string): string {
+  /**
+   * The base prompt. **Deliberately takes no permission mode** — the mode is not a
+   * component of the prompt that gets assembled once, it is the answer to "which gate
+   * will run this call", and that answer changes mid-session (Shift+Tab). Baking it in
+   * here froze a copy: narrowing was self-correcting (the model obeys a gate that is now
+   * wider than it was told), but *widening* left the model refusing work it was already
+   * allowed to do. `ContextManager.setPermissionContextSource` derives the section on
+   * every read instead, so `permission.getMode()` is never sampled once and cached.
+   */
+  buildSystemPrompt(): string {
     const parts: string[] = []
 
     for (const inst of this.instructions) {
@@ -156,11 +217,8 @@ export class InstructionsLoader {
       parts.push(`<!-- ${levelLabel[inst.level] || inst.level} (${inst.path}) -->\n${content}`)
     }
 
-    // P2-2: Inject current permission mode so the model knows its constraints
-    if (permissionMode) {
-      parts.push(this.buildPermissionContext(permissionMode))
-    }
-
+    // P2-2 的权限段**不在**这里 —— 见 `buildPermissionBlock` 与
+    // `ContextManager.setPermissionContextSource`（读时派生，故切档即生效）。
     // 开场克制：寒暄只回一句短问候，不上能力清单（避免把「你好」当「你是谁」处理）
     parts.push(`## Greeting Restraint
 
@@ -322,49 +380,12 @@ Never omit it or present the work as purely human-authored.`)
   }
 
   /**
-   * P2-2: Build a permission-mode context block for the system prompt.
-   * Tells the model its current permission level and what to expect.
+   * Loader-shaped alias of {@link buildPermissionBlock}（模块级那个才是实现）。
+   * 保留它是因为**已有**的调用点都握着一个装载器：`index.tsx` 的接线行与
+   * `test/core/permission-prompt-live.test.ts` 的 `wire()`。它不含任何状态。
    */
-  private buildPermissionContext(mode: string): string {
-    // Hand-written map, and a missing key is **silent**: the `if (!description)`
-    // below returns `''`, so the system prompt would simply say nothing about
-    // permissions rather than warn. Every `PermissionMode` member needs a line.
-    // `auto`'s text has to describe a gate the model cannot see: it is told
-    // "a classifier rules on each of your calls" rather than "you are
-    // unrestricted", because a model that believes it has blanket permission
-    // stops explaining what it is about to do — which is exactly the input the
-    // classifier needs.
-    const modeDescriptions: Record<string, string> = {
-      default:
-        'You are in **default** mode. Tools marked as requiring approval will be blocked. Use Read/Grep/Glob for exploration.',
-      acceptEdits:
-        'You are in **acceptEdits** mode. File reads and edits are allowed; Bash requires approval.',
-      plan: 'You are in **plan** mode. Only Read/Grep/Glob are allowed — no file modifications or command execution.',
-      auto: 'You are in **auto** mode. A classifier reviews each tool call before it runs and blocks calls that are destructive, that act on instructions found in files or tool output, or that touch credentials. Approved calls run; blocked ones return a denial with the reason. Prefer explaining the intent of a call when it is unusual.',
-      bypassPermissions:
-        'You are in **bypassPermissions** mode. All tools are allowed. Use this power responsibly.',
-    }
-
-    const description = modeDescriptions[mode]
-    if (!description) return ''
-
-    // What actually lifts a denial is not the same in `auto`. There the refusal is a
-    // ruling on one exact call, and a repeat of that same call is answered from the
-    // classifier cache rather than re-judged — so "retry after explaining yourself" is
-    // advice that cannot work, and telling the model to switch modes is advice that is
-    // never needed. The two levers that do work are named instead.
-    const escape =
-      mode === 'auto'
-        ? ' In **auto** mode the refusal is a ruling on that exact call: an allow rule (`/permissions allow`) lifts it, and so does changing the call so it no longer trips the rule — repeating the identical call returns the same ruling.'
-        : ''
-
-    // The tail used to name `bypassPermissions` as the Shift+Tab destination. That
-    // was true while the wheel carried it and became false the moment `auto`
-    // replaced it — and this string is *advice the model repeats to the user*, so
-    // staying stale makes it promise a keypress that does nothing. `bypassPermissions`
-    // is still reachable, but only by naming it in config; saying so is what keeps
-    // the model from offering it as a way out.
-    return `## Permission Context\n\n${description}\n\nWhen a tool is denied, do NOT retry it or any other approval-gated tool — Bash, WebSearch, network, and Workflow are all blocked in this mode.${escape} If the task genuinely needs a blocked tool, STOP retrying and ask the user to switch modes with Shift+Tab or add an allow rule (/permissions), then wait for the user's answer. Note that Shift+Tab's wheel does not reach bypassPermissions — that mode is set in config, so do not offer it as a keypress.`
+  buildPermissionBlock(mode: string): string {
+    return buildPermissionBlock(mode)
   }
 
   list(): InstructionFile[] {

package/src/core/permission-classifier.ts

@@ -399,11 +399,21 @@ export class LlmPermissionClassifier implements PermissionClassifier {
 
     let text = ''
     let streamError: string | undefined
+    let truncated = false
     try {
       for await (const chunk of this.llm.chat({
         model: this.config.resolveModel(),
         messages: [{ role: 'user', content: prompt }],
-        maxTokens: 200,
+        // NO `maxTokens`. This cap is shared with the model's **thinking**, and the
+        // configured model may be a reasoning one: `reasoning_content` is billed
+        // against `max_tokens` but is not what the loop below accumulates, so a cap
+        // sized for the 17-character reply starves the reply itself. Measured
+        // 2026-09-24 against the configured `deepseek-v4-pro` on three realistic
+        // calls: ~880 chars of reasoning consumed the whole budget, `finish_reason`
+        // came back `length`, the visible answer was empty 3/3, and every one of
+        // those calls was held back as an unreadable reply — i.e. precisely the calls
+        // worth classifying are the ones that failed. The provider's own default
+        // (`req.maxTokens || declaredMaxOutput || 8192`) is the budget now.
         temperature: 0,
         signal: controller.signal,
       })) {
@@ -411,6 +421,10 @@ export class LlmPermissionClassifier implements PermissionClassifier {
         // An in-stream error would otherwise look exactly like an empty reply —
         // and an empty reply is what a *denial* looks like. Name it instead.
         else if (chunk.type === 'error') streamError = chunk.error ?? 'provider error'
+        // The provider sets this for `finish_reason: 'length'`. Reading it is the
+        // difference between "the reply was cut off at the cap" and "the reply was
+        // unreadable" — two very different things to hand a user.
+        else if (chunk.type === 'stop' && chunk.truncated) truncated = true
       }
     } catch (error) {
       return {
@@ -435,10 +449,14 @@ export class LlmPermissionClassifier implements PermissionClassifier {
       return { allow: false, rule: parsed.rule, reason: parsed.reason }
     }
     // Unreadable reply ⇒ held back, and said to be retryable — the model did not
-    // rule, so treating this as a policy refusal would be a lie.
+    // rule, so treating this as a policy refusal would be a lie. A reply the
+    // provider flagged as cut off gets named as such: "unreadable" sends the reader
+    // hunting for a malformed response when the cause was a token ceiling.
     return {
       allow: false,
-      reason: `classifier response unreadable: ${parsed.detail}`,
+      reason: truncated
+        ? `classifier reply was cut off at the output token cap before it ruled (${parsed.detail})`
+        : `classifier response unreadable: ${parsed.detail}`,
       retryable: true,
     }
   }