@miphamai/cli 0.85.2 → 0.85.4

package/src/core/permission-config.ts

@@ -83,10 +83,31 @@ export const PERMISSION_MODE_HIERARCHY: PermissionMode[] = [
  * `forbiddenModes` / `maxAllowedMode` are applied to.
  *
  * Deliberately a separate array from `MODE_CYCLE`, and deliberately able to be a
- * **superset** of it: `bypassPermissions` is reachable through config /
- * `MIPHAM_DAEMON_PERMISSION` / settings without being something a user can
- * Shift+Tab into. Claude Code arranges it the same way — its descriptor table
- * lists `bypassPermissions` while its cycle array does not.
+ * **superset** of it: `bypassPermissions` is reachable by naming it at one of the
+ * doors listed below, without being something a user can Shift+Tab into. Claude
+ * Code arranges it the same way — its descriptor table lists
+ * `bypassPermissions` while its cycle array does not.
+ *
+ * **The doors, exhaustively** (this list is the point of the entry — a mode that
+ * is legal here and refused at some other door is a mode the user cannot reach
+ * and cannot get a reason for):
+ *
+ *   1. `~/.mipham/config.yml` → `permission: <mode>` (native key; may be the
+ *      first-run wizard's `default`, so it is ranked *below* 2)
+ *   2. `~/.mipham/settings.json` → `permissions.defaultMode` (the adopted
+ *      upstream key — user level **only**, see 5)
+ *   3. `mipham --permission <mode>` — this invocation's word, beats both files
+ *   4. `MIPHAM_DAEMON_PERMISSION` — the daemon's gate; the only door the daemon
+ *      reads at all (`resolveDaemonPermission`)
+ *   5. …and nothing else. Project-level `.mipham/config.yml` /
+ *      `.mipham/settings.json` are **not** doors: those files arrive with the
+ *      code, so whoever wrote the repository would be choosing the approval gate.
+ *      A mode declared there is withheld and reported, not applied.
+ *
+ * Every door lands on the same applier (`PermissionSystem.setDefaultLevel`), which
+ * is why this array is also the accepted *value* domain — a second validator would
+ * be a second domain, and the day a mode is added the two would disagree at one of
+ * the five doors.
  *
  * **The two arrays must not be collapsed back into one.** `getAllowedModes`
  * filters *this* array, never `MODE_CYCLE`. If it filtered the cycle, then the
@@ -115,9 +136,9 @@ export const ALL_MODES: PermissionMode[] = [
  * disturbing the ranking that `clampMode` walks.
  *
  * The two arrays **differ**, and that is the whole reason both exist:
- * `bypassPermissions` is a legal mode that no Shift+Tab reaches (asked for
- * through config / `MIPHAM_DAEMON_PERMISSION` / settings, where the user named
- * it explicitly), while `auto` is on the wheel. Collapsing them back into one
+ * `bypassPermissions` is a legal mode that no Shift+Tab reaches (asked for by
+ * name at one of the doors listed under `ALL_MODES`, where the user named it
+ * explicitly), while `auto` is on the wheel. Collapsing them back into one
  * would either drop a legal mode or advertise one the wheel cannot reach —
  * **do not "simplify" one back into the other.**
  *

package/src/daemon/attach-protocol.ts

@@ -1,6 +1,9 @@
 // apps/cli/src/daemon/attach-protocol.ts
-// Client → Daemon: prompt, interrupt
-// Daemon → Client: text, tool_use, tool_result, usage, task_notification, done, error, session_state
+// Client → Daemon: prompt, interrupt, set_mode
+// Daemon → Client: text, tool_use, tool_result, usage, task_notification, done, error,
+//                  session_state, mode
+
+import type { PermissionMode } from '../shared/types'
 
 export interface ClientPromptMessage {
   type: 'prompt'
@@ -11,7 +14,18 @@ export interface ClientInterruptMessage {
   type: 'interrupt'
   sessionId: string
 }
-export type ClientMessage = ClientPromptMessage | ClientInterruptMessage
+export interface ClientSetModeMessage {
+  type: 'set_mode'
+  sessionId: string
+  /**
+   * 请求的档位。daemon 会先过白名单、再走组织级限制的钳制，然后回播**生效**的那一档。
+   *
+   * `sessionId` 与 `prompt` / `interrupt` 一样是协议对称用的：daemon 一概以
+   * `ws.data.sessionId` 为准（否则一个 attach 就能改**别的**会话的闸门）。
+   */
+  mode: PermissionMode
+}
+export type ClientMessage = ClientPromptMessage | ClientInterruptMessage | ClientSetModeMessage
 
 export interface ServerTextMessage {
   type: 'text'
@@ -61,6 +75,18 @@ export interface ServerSessionStateMessage {
   provider: string
   model: string
   turnCount: number
+  /** 本会话当前**生效**的档位 —— 新 attach 的客户端据此初始化页脚，而不是猜 `default`。 */
+  mode: PermissionMode
+}
+/**
+ * 回播生效档位。两个触发点：客户端发来 `set_mode`（含被拒的请求 —— 那时回播的是
+ * **当前**档），以及 `set_mode` 施加后。带的是 `PermissionSystem.getMode()` 的读数，
+ * 即**钳制之后**的值：报请求值就是那条老缺陷的形状 —— 说放行、实际审批。
+ */
+export interface ServerModeMessage {
+  type: 'mode'
+  sessionId: string
+  mode: PermissionMode
 }
 
 export type ServerMessage =
@@ -72,3 +98,4 @@ export type ServerMessage =
   | ServerDoneMessage
   | ServerErrorMessage
   | ServerSessionStateMessage
+  | ServerModeMessage

package/src/daemon/remote-engine.ts

@@ -17,7 +17,13 @@
 //   }
 //   engine.close()
 
-import type { ClientPromptMessage, ClientInterruptMessage, ServerMessage } from './attach-protocol'
+import type {
+  ClientPromptMessage,
+  ClientInterruptMessage,
+  ClientSetModeMessage,
+  ServerMessage,
+} from './attach-protocol'
+import { ALL_MODES } from '../core/permission-config'
 import type { PermissionMode, StreamChunk } from '../shared/types'
 
 // ── Public API ───────────────────────────────────────────────────────────────
@@ -54,6 +60,46 @@ export class RemoteEngine {
   /** Whether this engine has been explicitly closed. */
   private closed = false
 
+  /** In-flight connection attempt. See `ensureConnected()`. */
+  private connecting: Promise<void> | null = null
+
+  // ── Permission mode (the gate lives on the daemon) ───────────────────────
+  //
+  // Two values, and the difference between them is the whole contract:
+  //
+  // - `modeChosen` — the mode **this client's user** picked on this attach. Set by a
+  //   keypress (so the footer advances immediately — `cyclePermissionMode` computes the
+  //   next slot from `getMode()`'s read-back, and a `getMode` that only reported confirmed
+  //   values would freeze the wheel), then overwritten by the daemon's **answer**, because
+  //   org level `permissionRestrictions` silently rewrite a request and the daemon is the
+  //   only side that can see the clamp. A non-null value is a standing instruction and gets
+  //   re-asserted before every prompt. A connect snapshot is not an answer (see
+  //   `absorbMode`): it predates anything this client sent and must not retract it.
+  // - `modeConfirmed` — what the daemon said is in effect, from a `mode` frame or an
+  //   attach snapshot. **Display only, never asserted**: it is how a client that has not
+  //   picked anything learns the session's mode, and re-sending it would let a bystander
+  //   push its own guess over an operator's `MIPHAM_DAEMON_PERMISSION` — a silent override
+  //   by a client that never expressed an intent.
+  private modeChosen: PermissionMode | null = null
+  private modeConfirmed: PermissionMode | null = null
+
+  /** Viewers of the confirmed mode (the TUI footer). See `onPermissionModeChange`. */
+  private readonly modeListeners = new Set<(mode: PermissionMode) => void>()
+
+  /**
+   * One stable object — **not** a fresh closure per `getPermission()` call.
+   *
+   * `app.tsx` calls `getPermission()` per keypress (`cyclePermissionMode(engine.getPermission(), …)`
+   * and the initial `useState`), so a per-call object-throws away everything it was told:
+   * the mode read back is a brand-new `'default'` and nothing is ever sent to the daemon.
+   */
+  private readonly permissionFacade = {
+    setMode: (mode: PermissionMode): void => {
+      this.requestMode(mode)
+    },
+    getMode: (): PermissionMode => this.modeChosen ?? this.modeConfirmed ?? 'default',
+  }
+
   constructor(options: RemoteEngineOptions) {
     this.sessionId = options.sessionId
     this.port = options.port
@@ -64,12 +110,20 @@ export class RemoteEngine {
 
   /**
    * Ensure a WebSocket connection to the daemon exists.
-   * Creates one lazily on the first process() call.
+   * Creates one lazily on the first process() or setMode() call.
+   *
+   * Concurrent callers **share** the in-flight attempt. Without that, the second caller
+   * sees `this.ws` set but not yet `OPEN`, treats it as a stale socket, nulls its handlers
+   * and closes it — so the first caller's promise can never settle (its `onopen` was
+   * detached) and the message it was about to send goes to a socket nobody is listening on.
    */
   private ensureConnected(): Promise<void> {
     if (this.ws && this.ws.readyState === WebSocket.OPEN) {
       return Promise.resolve()
     }
+    if (this.connecting) {
+      return this.connecting
+    }
 
     if (this.ws) {
       // Stale socket — clean up before reconnecting
@@ -87,7 +141,7 @@ export class RemoteEngine {
 
     const url = `ws://127.0.0.1:${this.port}/api/v1/sessions/${this.sessionId}/stream`
 
-    return new Promise<void>((resolve, reject) => {
+    const attempt = new Promise<void>((resolve, reject) => {
       const ws = new WebSocket(url)
       this.ws = ws
 
@@ -112,6 +166,15 @@ export class RemoteEngine {
         reject(new Error(`Failed to connect to daemon at 127.0.0.1:${this.port}`))
       }
     })
+
+    this.connecting = attempt
+    const clear = () => {
+      if (this.connecting === attempt) this.connecting = null
+    }
+    // Both slots handled on purpose: this promise is only ever awaited by callers that
+    // catch, but a rejection here would otherwise surface as unhandled.
+    attempt.then(clear, clear)
+    return attempt
   }
 
   // ── Prompt Processing (async generator) ──────────────────────────────────
@@ -145,6 +208,17 @@ export class RemoteEngine {
     this.resolveNext = null
     this.rejectNext = null
 
+    // Re-assert the mode this client's user picked, **before** the prompt — frames on one
+    // socket arrive in the order they were sent, so the daemon applies the gate first and
+    // this turn runs under the mode the user is looking at. Idempotent by design, and it
+    // heals the two ways the gate can drift behind the client's back (a daemon restart, or
+    // a worker evicted while idle and rebuilt from env).
+    //
+    // Skipped when nothing was ever picked here: the daemon owns the default (env config,
+    // an earlier client, an operator), and a bystander must not overwrite it by asserting
+    // the value it merely *displays*.
+    if (this.modeChosen) await this.sendMode(this.modeChosen)
+
     // Send the prompt
     const promptMsg: ClientPromptMessage = {
       type: 'prompt',
@@ -215,9 +289,10 @@ export class RemoteEngine {
 
   // ── Stub methods for TUI compatibility ───────────────────────────────────
   //
-  // In remote attach mode, the daemon manages providers, agents, permissions,
-  // and context. These stubs satisfy the TUI's engine interface without
-  // introducing daemon dependencies into the UI layer.
+  // In remote attach mode, the daemon manages providers, agents and context. These stubs
+  // satisfy the TUI's engine interface without introducing daemon dependencies into the
+  // UI layer. (Permissions are **not** in this list: they are forwarded over the attach
+  // protocol — see `getPermission` — because the footer is a display of the daemon's gate.)
   //
   // Slash commands may call any of these; we return safe defaults.
 
@@ -257,17 +332,31 @@ export class RemoteEngine {
     }
   }
 
-  /** Returns a stub permission object so slash commands don't crash. */
-  getPermission(): { setMode(_mode: PermissionMode): void; getMode(): PermissionMode } {
-    // Remote mode: permissions are managed by the daemon, and the attach protocol has
-    // no read-back — so `getMode` reports the last mode the user asked for (which is
-    // what the footer has always shown here), not a value the daemon never confirmed.
-    let requested: PermissionMode = 'default'
-    return {
-      setMode: (mode: PermissionMode) => {
-        requested = mode
-      },
-      getMode: () => requested,
+  /**
+   * The permission surface the footer reads and writes — wired to the daemon's gate,
+   * not a local mirror of it (`app.tsx` treats this line as **the mirror of execution**).
+   *
+   * Writing (`setMode`) sends `set_mode`; the daemon applies it to the session's live
+   * `PermissionSystem` and answers with the mode that actually took effect. Reading
+   * (`getMode`) answers optimistically until that answer arrives — see the field comments.
+   */
+  getPermission(): { setMode(mode: PermissionMode): void; getMode(): PermissionMode } {
+    return this.permissionFacade
+  }
+
+  /**
+   * Subscribe to mode corrections from the daemon (`mode` frames, and the `mode` field of
+   * a `session_state` snapshot). Returns an unsubscribe function.
+   *
+   * Needed because the confirmed value can arrive **asynchronously** — a keypress is not a
+   * render, so a footer that only ever read `getMode()` on keypress would keep displaying
+   * the pre-clamp value forever. Nothing local has this problem: a local engine's
+   * `getMode()` already reflects the clamp the moment `setMode` returns.
+   */
+  onPermissionModeChange(listener: (mode: PermissionMode) => void): () => void {
+    this.modeListeners.add(listener)
+    return () => {
+      this.modeListeners.delete(listener)
     }
   }
 
@@ -353,6 +442,14 @@ export class RemoteEngine {
       return
     }
 
+    // Session facts, not prompt stream: they carry the gate's current mode and must be
+    // absorbed even when nothing is consuming chunks (a keypress, not a turn).
+    if (msg.type === 'mode' || msg.type === 'session_state') {
+      // A snapshot describes the gate as of connect — see `absorbMode`.
+      this.absorbMode(msg.mode, msg.type === 'session_state')
+      return
+    }
+
     const chunk = this.mapMessageToChunk(msg)
     if (!chunk) return
 
@@ -364,10 +461,67 @@ export class RemoteEngine {
     }
   }
 
+  // ── Permission plumbing ─────────────────────────────────────────────────
+
+  /** Optimistically take the mode, then tell the daemon (best effort). */
+  private requestMode(mode: PermissionMode): void {
+    this.modeChosen = mode
+    // Fire and forget: the correctness-critical send is the one `process()` makes before
+    // every prompt. This one only shortens how long a footer can sit on a clamped value
+    // (the daemon answers with `mode`, which usually lands before the next render).
+    void this.sendMode(mode)
+  }
+
+  /** Send `set_mode`. Silent when the daemon is unreachable or the socket is closing. */
+  private async sendMode(mode: PermissionMode): Promise<void> {
+    try {
+      await this.ensureConnected()
+      const msg: ClientSetModeMessage = { type: 'set_mode', sessionId: this.sessionId, mode }
+      this.ws?.send(JSON.stringify(msg))
+    } catch {
+      // No daemon: the mode stays local, exactly as it did before this existed. The next
+      // `process()` re-asserts it, so nothing is lost if the connect was merely slow.
+    }
+  }
+
+  /**
+   * Take the daemon's word for the effective mode and hand it to the footer.
+   *
+   * Validated against `ALL_MODES` rather than trusted: this frame crosses a process
+   * boundary and the two sides version independently (an older daemon need not send the
+   * field at all), and a bad value would otherwise sit in the footer as a mode no wheel
+   * slot can step away from.
+   *
+   * `fromSnapshot` separates the two kinds of frame, and they are **not** interchangeable:
+   *
+   * - a `mode` frame is the daemon **answering** — either a `set_mode` this client (or
+   *   another) sent, or a live change. It is newer than anything we sent, so it replaces the
+   *   request; that is the channel a clamp travels back on;
+   * - `session_state` is sent the moment the socket attaches (`addClient` → `sendState`),
+   *   so it describes the gate as of connect — i.e. **before** a `set_mode` this client had
+   *   already sent could have been handled. Letting it retract the request would drop the
+   *   standing instruction, and the very next prompt is what would do the dropping: the
+   *   re-assert reads `modeChosen`, now holding the pre-request value, and helpfully pushes
+   *   it — so `--permission plan` (or a `Shift+Tab` made just before a reconnect) would be
+   *   silently **cancelled** rather than narrowed. It is not worth displaying either, since
+   *   it is already superseded by a request that is in flight; the answer is what the footer
+   *   needs, and the daemon always sends one for a `set_mode` it understood.
+   */
+  private absorbMode(mode: unknown, fromSnapshot = false): void {
+    if (typeof mode !== 'string' || !ALL_MODES.includes(mode as PermissionMode)) return
+    const effective = mode as PermissionMode
+    this.modeConfirmed = effective
+    if (this.modeChosen) {
+      if (fromSnapshot) return
+      this.modeChosen = effective
+    }
+    for (const listener of this.modeListeners) listener(effective)
+  }
+
   /**
    * Map a ServerMessage from the daemon to a StreamChunk.
-   * Returns null for message types that should be silently consumed
-   * (e.g., session_state which is only informative for attach).
+   * Returns null for message types that carry no prompt output. (`session_state` and
+   * `mode` never reach here — `onMessage` absorbs them as session facts.)
    */
   private mapMessageToChunk(msg: ServerMessage): StreamChunk | null {
     switch (msg.type) {
@@ -424,11 +578,6 @@ export class RemoteEngine {
         return { type: 'error', error: msg.message }
       }
 
-      // session_state is an informational message sent when a client
-      // first attaches. It is not part of the prompt stream.
-      case 'session_state':
-        return null
-
       default:
         return null
     }

package/src/daemon/server.ts

@@ -67,6 +67,13 @@ interface WsData {
  * Values `MIPHAM_DAEMON_PERMISSION` accepts. The **default stays `'default'`**;
  * every widening is an explicit operator choice.
  *
+ * Also the whitelist an attached client's `set_mode` is measured against: a mode the
+ * daemon does not understand must not be applied (fail-closed) — the client's footer
+ * is a *display* of this gate, never its input. Keeping both uses on one set means a
+ * mode the daemon declines via env is declined via `set_mode` too; a second hand-kept
+ * list would let the two drift (`test/integrity/permission-status-parity.test.ts` P7
+ * pins this set against `ALL_MODES`).
+ *
  * `'auto'` is accepted, and today it means **every tool call is refused**: the
  * mode's static baseline answers `'ask'` for all of them, and the daemon has no
  * classifier to rule on the `'ask'` (the classifier is wired in the CLI's
@@ -77,7 +84,7 @@ interface WsData {
  * than what was asked for; a silent widening is the worse of the two ways to be
  * wrong. This entry becomes useful the day the daemon builds a classifier.
  */
-const DAEMON_PERMISSION_MODES: ReadonlySet<PermissionMode> = new Set<PermissionMode>([
+export const DAEMON_PERMISSION_MODES: ReadonlySet<PermissionMode> = new Set<PermissionMode>([
   'default',
   'acceptEdits',
   'plan',
@@ -207,6 +214,19 @@ export function createServer(config: ServerConfig): Server<WsData> {
   let sharedRegistry: ProviderRegistry | null = null
   let sharedTools: Map<string, ToolDefinition> | null = null
 
+  /**
+   * The mode each session's client last asked for (`set_mode`), so a **rebuilt** engine
+   * comes back on the user's mode instead of the env default.
+   *
+   * Why not just read it back off the live engine: engines are not permanent. `WorkerPool`
+   * evicts an idle worker, which drops `engineCache`'s entry too, and the next prompt
+   * rebuilds from `resolveDaemonPermission()` — the env value. Without this map the gate
+   * silently reverts (narrower *or* wider than the footer says) and nothing announces it.
+   * Stored as **requested**, not effective: `setMode` re-clamps on the way in, so the
+   * rebuilt engine lands on the same value the first one did.
+   */
+  const sessionModes = new Map<string, PermissionMode>()
+
   function getOrCreateEngine(
     sessionId: string,
     cwd: string,
@@ -260,6 +280,10 @@ export function createServer(config: ServerConfig): Server<WsData> {
       daemonConfig.permissionRestrictions,
       daemonConfig.permissionRules,
     )
+    // After `setRestrictions` (inside the builder) so this goes through the same clamp the
+    // first engine did — see `sessionModes`. Absent entry ⇒ env mode, unchanged.
+    const requestedMode = sessionModes.get(sessionId)
+    if (requestedMode) permission.setMode(requestedMode)
     const engine = new QueryEngine(sharedRegistry, context, sharedTools, permission)
     engine.setSessionId(sessionId)
     // Same engine capabilities as the interactive CLI — see engine-capabilities.ts.
@@ -876,6 +900,32 @@ export function createServer(config: ServerConfig): Server<WsData> {
             break
           }
 
+          case 'set_mode': {
+            // The client pressed Shift+Tab; the gate moves **here**, not in the client's
+            // footer. `sessionId` comes from the socket, never from the payload: the same
+            // message must not be able to move another session's gate.
+            const requested: unknown = parsed.mode
+            const known =
+              typeof requested === 'string' &&
+              DAEMON_PERMISSION_MODES.has(requested as PermissionMode)
+
+            // Materialize the worker when needed — a mode with no engine behind it is not a
+            // mode, and without this the very first keypress (before any prompt) would fall
+            // through and leave the footer's value unconfirmed. Cheap after the first time.
+            const worker = getOrCreateWorker(sessionId, ws)
+            if (!worker) return
+
+            if (known) sessionModes.set(sessionId, requested as PermissionMode)
+            // An unrecognized value changes nothing (fail-closed) — but the client is still
+            // told the **effective** mode, so its footer lands back on a mode this daemon
+            // really will grant instead of parking on one it never accepted.
+            const effective = known
+              ? worker.setPermissionMode(requested as PermissionMode)
+              : worker.getPermissionMode()
+            broadcast(sessionId, { type: 'mode', sessionId, mode: effective })
+            break
+          }
+
           default:
             // Unknown message type — silently ignored
             break

package/src/daemon/session-worker.ts

@@ -22,7 +22,7 @@ import type { ServerWebSocket } from 'bun'
 import type { QueryEngine } from '../core/engine'
 import type { DaemonDatabase } from './database'
 import type { DaemonSession, MessageRecord } from './types'
-import type { StreamChunk } from '../shared/types'
+import type { PermissionMode, StreamChunk } from '../shared/types'
 import type {
   ClientInterruptMessage,
   ServerMessage,
@@ -47,6 +47,8 @@ export interface SessionStateSnapshot {
   status: string
   /** Last N messages for context restoration on attach. */
   messages: MessageRecord[]
+  /** 本会话闸门当前生效的档位 —— attach 的客户端据此初始化页脚。 */
+  permissionMode: PermissionMode
 }
 
 // ── SessionWorker ─────────────────────────────────────────────────────────
@@ -234,6 +236,33 @@ export class SessionWorker {
     this.interrupt()
   }
 
+  // ── Permission Mode ────────────────────────────────────────────────────
+
+  /**
+   * Apply a permission mode to this session's live gate and return the mode that
+   * actually took effect.
+   *
+   * Through `engine.getPermission()` — the very object the engine's tool gate reads
+   * (`engine.ts` `this.permission.resolveApproval(…)`), so this is not a copy that
+   * the gate never sees.
+   *
+   * **Returns the effective mode, never the requested one.** Org-level
+   * `permissionRestrictions` silently rewrite what you ask for inside `setMode`, so
+   * echoing the request back would tell the attaching client's footer it has a
+   * permission the daemon will not grant — "says allowed, actually asks". The
+   * daemon is the only authority on this value; the client displays what it is told.
+   */
+  setPermissionMode(mode: PermissionMode): PermissionMode {
+    const permission = this.engine.getPermission()
+    permission.setMode(mode)
+    return permission.getMode()
+  }
+
+  /** The mode currently in effect for this session's gate. */
+  getPermissionMode(): PermissionMode {
+    return this.engine.getPermission().getMode()
+  }
+
   // ── Session State ──────────────────────────────────────────────────────
 
   /**
@@ -250,6 +279,7 @@ export class SessionWorker {
       turnCount: this.session.turnCount,
       status: this.session.status,
       messages,
+      permissionMode: this.getPermissionMode(),
     }
   }
 
@@ -413,6 +443,9 @@ export class SessionWorker {
       provider: state.provider,
       model: state.model,
       turnCount: state.turnCount,
+      // 带上生效档，否则新 attach 的客户端只能猜 `default` —— 在 `MIPHAM_DAEMON_PERMISSION`
+      // 或上一次 `set_mode` 把 daemon 定在别处时，页脚从第一帧起就与闸门不符。
+      mode: state.permissionMode,
     }
     try {
       ws.send(JSON.stringify(msg))