@miphamai/cli 0.85.3 → 0.85.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.85.3",
+  "version": "0.85.5",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent-view/agents-standalone.tsx

@@ -0,0 +1,42 @@
+/**
+ * `mipham agents` 独立面板 —— 从 `index.tsx` 里抽出来的那段 JSX，好让它可测。
+ *
+ * 抽取的理由是**可测性**：`index.tsx` 是进程入口（`render` + `waitUntilExit`），
+ * 它里面传下去的东西在测试里够不着；而这条路上的 Enter 落点曾经整个缺席
+ * —— 页脚广告 attach，落点是 `() => {}`。
+ */
+
+import React, { useState } from 'react'
+
+import { AgentSessionView } from './session-view'
+import { AgentViewDashboard } from './dashboard'
+import type { AgentViewManager } from './agent-view-manager'
+
+interface AgentsStandaloneProps {
+  manager: AgentViewManager
+  onExit: () => void
+}
+
+export function AgentsStandalone({ manager, onExit }: AgentsStandaloneProps) {
+  // 与 `app.tsx` 同形：attach 把会话交给只读视图，视图里的 Esc 再交还列表。
+  // 页脚无条件印着「Enter attach」—— 它必须有个落点，否则按键有反应而世界不变。
+  const [attachedSessionId, setAttachedSessionId] = useState<string | null>(null)
+
+  if (attachedSessionId) {
+    return (
+      <AgentSessionView
+        manager={manager}
+        sessionId={attachedSessionId}
+        onDetach={() => setAttachedSessionId(null)}
+      />
+    )
+  }
+
+  return (
+    <AgentViewDashboard
+      manager={manager}
+      onAttach={(session) => setAttachedSessionId(session.id)}
+      onExit={onExit}
+    />
+  )
+}

package/src/commands/project.ts

@@ -174,57 +174,108 @@ Run /setup for the full wizard, or /config to view current settings.`,
   }
 }
 
+/**
+ * Split the rule argument(s) out of the whitespace-split slash-command args.
+ *
+ * Every surface that advertises this command prints the rule **quoted** — the denial
+ * messages (`i18n-core/locales/{en-US,zh-CN}.json`), this command's usage line and its
+ * examples, and the `config.yml` sample — and the narrower form the message recommends
+ * (`Bash(npm test)`) carries a space. Args arrive split on whitespace with the quotes
+ * still in them, so the rule is re-joined and split on quotes here instead. Without
+ * this the command rejects the exact spelling it tells the user to type:
+ * `/permissions allow "Git"` → `Invalid rule ""Git"": not a single tool name.`
+ */
+function parseRuleArgs(args: string[]): { rules: string[]; unbalanced: boolean } {
+  const rules: string[] = []
+  let current = ''
+  let quote: string | null = null
+
+  for (const ch of args.join(' ')) {
+    if (quote) {
+      if (ch === quote) quote = null
+      else current += ch
+    } else if (ch === '"' || ch === "'") {
+      quote = ch
+    } else if (/\s/.test(ch)) {
+      if (current) rules.push(current)
+      current = ''
+    } else {
+      current += ch
+    }
+  }
+  if (current) rules.push(current)
+
+  return { rules, unbalanced: quote !== null }
+}
+
 const permissionsCmd: CommandHandler = async (ctx, args) => {
   const c = ctx.engine.getContext()
   const msgs = c.getMessages()
 
-  // ── Rule persistence: allow/deny/remove <rule> [--user] ──
-  const positional = args.filter((a) => !a.startsWith('--'))
+  // ── Rule persistence: allow/deny/remove <rule>... [--user] ──
+  // `--user` is matched exactly: a rule fragment may legitimately begin with `--`
+  // (`Bash(--version)`), and dropping it as "a flag" would corrupt the rule.
+  const rest = args.filter((a) => a !== '--user')
   const scope: 'project' | 'user' = args.includes('--user') ? 'user' : 'project'
-  const verb = positional[0]
-  const rule = positional[1]
+  const verb = rest[0]
 
   if (verb === 'allow' || verb === 'deny' || verb === 'remove') {
     const { validateRulePattern } = await import('../core/permission-rules')
     const { addSettingsRule, removeSettingsRule, settingsPathFor } =
       await import('../config/loader')
 
-    // A rule that can't match is worse than no rule: it reads as protection
-    // that isn't there. Validate before writing.
-    const invalid = validateRulePattern(rule ?? '')
+    const { rules, unbalanced } = parseRuleArgs(rest.slice(1))
     const usage =
-      `Usage: /permissions <allow|deny|remove> <rule> [--user]\n\n` +
-      `  rule   Tool pattern — "Bash" or "Bash(npm test)".\n` +
+      `Usage: /permissions <allow|deny|remove> <rule>... [--user]\n\n` +
+      `  rule   Tool pattern — "Bash" or "Bash(npm test)". Quote it if it has spaces.\n` +
       `  --user Write to ~/.mipham/settings.json instead of .mipham/settings.json.`
 
-    if (verb !== 'remove' && !rule) {
+    if (unbalanced) {
+      return { content: `Unbalanced quote in rule.\n\n${usage}` }
+    }
+    if (rules.length === 0) {
       return { content: `Missing rule.\n\n${usage}` }
     }
-    if (invalid && verb !== 'remove') {
-      return { content: `Invalid rule "${rule}": ${invalid}.\n\n${usage}` }
+    // A rule that can't match is worse than no rule: it reads as protection
+    // that isn't there. Validate every rule before writing any of them.
+    if (verb !== 'remove') {
+      for (const rule of rules) {
+        const invalid = validateRulePattern(rule)
+        if (invalid) {
+          return { content: `Invalid rule "${rule}": ${invalid}.\n\n${usage}` }
+        }
+      }
     }
 
     const perm = ctx.engine.getPermission()
 
     if (verb === 'remove') {
-      const removed = removeSettingsRule(rule!, scope)
-      if (!removed) {
-        return { content: `No rule "${rule}" in ${settingsPathFor(scope)}.` }
-      }
-      perm.removeRule(rule!)
-      return {
-        content: `Removed from ${removed.path}\n\npermissions.${removed.key}:\n  ${rule}`,
+      const parts: string[] = []
+      for (const rule of rules) {
+        const removed = removeSettingsRule(rule, scope)
+        if (!removed) {
+          parts.push(`No rule "${rule}" in ${settingsPathFor(scope)}.`)
+          continue
+        }
+        perm.removeRule(rule)
+        parts.push(`Removed from ${removed.path}\n\npermissions.${removed.key}:\n  ${rule}`)
       }
+      return { content: parts.join('\n\n') }
     }
 
-    const path = addSettingsRule(verb, rule!, scope)
-    if (verb === 'allow') perm.allow(rule!)
-    else perm.deny(rule!)
+    let path = ''
+    for (const rule of rules) {
+      path = addSettingsRule(verb, rule, scope)
+      if (verb === 'allow') perm.allow(rule)
+      else perm.deny(rule)
+    }
     return {
       content:
         `Added to ${path}\n\n` +
-        `permissions.${verb}:\n  ${rule}\n\n` +
-        `This rule persists across sessions and applies from now on.`,
+        `permissions.${verb}:\n${rules.map((r) => `  ${r}`).join('\n')}\n\n` +
+        (rules.length === 1
+          ? `This rule persists across sessions and applies from now on.`
+          : `These rules persist across sessions and apply from now on.`),
     }
   }
 

package/src/core/context.ts

@@ -8,6 +8,7 @@ import {
   deriveMessages,
   assertModelVisible,
   isAssertModelVisibleDebug,
+  closeInterruptedToolCalls,
 } from './session-log'
 
 export type Summarizer = (messages: Message[], heading: string) => Promise<string>
@@ -45,6 +46,12 @@ export class ContextManager {
    * `index.tsx` 把它接到 live `PermissionSystem.getMode()` 上，于是切一次档，下一次请求就变。
    */
   private permissionContextSource: (() => string) | null = null
+  /**
+   * 系统提示里的 **MCP instructions 段**同样是读时派生的，理由比权限段更硬：
+   * MCP server 是**启动后异步连上**的，而提示在 `setSystemPrompt()` 那一刻就建好了。
+   * 组装时烘进去的话，本次会话里后连上的 server 永远进不了提示 —— 用户只能重启。
+   */
+  private mcpInstructionsSource: (() => string) | null = null
   private estimatedTokens = 0
   private checkpoints: Checkpoint[] = []
   private checkpointCounter = 0
@@ -79,6 +86,12 @@ export class ContextManager {
   /** 从已持久化的日志恢复：设 log 为源，messages 为投影（不重复写通）。 */
   restoreLog(log: SessionLog): void {
     this.log = log
+    // 盘上那份历史可能以一条**没有结果**的调用收尾（写盘写到一半被打断，末尾那行半截
+    // 结果被 `open()` 静默丢掉 —— 引擎自己的日志顺序到不了这个形状，见下面那个函数的
+    // 注释）。挂着 `tool_calls` 却没有结果回应的请求会被 provider 整条拒收，用户看到的
+    // 是「恢复之后第一句话就报协议错」。恢复的这一刻把它补**进日志**（不是补进投影，
+    // 否则「模型看得见的必须已记录」这条不变量当场破），见 `closeInterruptedToolCalls`。
+    closeInterruptedToolCalls(log)
     this.messages = deriveMessages(log.events())
     this.reEstimateTokens()
   }
@@ -138,14 +151,28 @@ export class ContextManager {
   }
 
   /**
-   * 存储的提示 + 读时派生的权限段。
+   * 接线点（`index.tsx`）：把已连 MCP server 自带的 `instructions` 接到提示上。
    *
-   * 段尾追加（而非插回原来的中段位置）是刻意的：只切档时**前缀保持不变**，
-   * 提供方的 prefix cache 仍能命中到权限段之前的部分。
+   * 传 `null` 撤销。空串（无 server / 都没写 instructions）不产生空段。
+   */
+  setMcpInstructionsSource(fn: (() => string) | null): void {
+    this.mcpInstructionsSource = fn
+  }
+
+  /**
+   * 存储的提示 + 读时派生的段（权限 / MCP instructions）。
+   *
+   * 段尾追加（而非插回原来的中段位置）是刻意的：只切档、只连一个新 server 时
+   * **前缀保持不变**，提供方的 prefix cache 仍能命中到这些段之前的部分。
    */
   private composedSystemPrompt(): string {
-    const block = this.permissionContextSource?.() ?? ''
-    return block ? `${this.systemPrompt}\n\n---\n\n${block}` : this.systemPrompt
+    const blocks = [
+      this.permissionContextSource?.() ?? '',
+      this.mcpInstructionsSource?.() ?? '',
+    ].filter((b) => b !== '')
+    return blocks.length > 0
+      ? [this.systemPrompt, ...blocks].join('\n\n---\n\n')
+      : this.systemPrompt
   }
 
   getSystemPrompt(): string {
@@ -170,6 +197,30 @@ export class ContextManager {
     this.checkCompression()
   }
 
+  /**
+   * 注入一段**模型可见的上下文**（规则块 / compact 前后的 hook 提示 / stop hook 交回的话 /
+   * 后台 agent 的来件）。
+   *
+   * 为什么不复用 addMessage：那会把注入记成 `user/message`，在日志里与**用户真说过的话**
+   * 完全同形 —— 事后翻 session log 分不出哪一句是用户敲的、哪一句是我们塞进去的。记成
+   * `context/inject`（带 `source`）就带得出来源；而 `deriveMessages` 仍把它还原成同一个
+   * user 消息，所以**投影逐字节不变**，「model-visible means logged」照样成立。
+   */
+  injectContext(source: string, text: string): void {
+    this.messages.push({ role: 'user', content: text })
+    this.estimatedTokens += this.estimateTokens(text)
+
+    if (this.log) {
+      this.log.append({ type: 'context/inject', at: Date.now(), source, text })
+    }
+
+    if (this.log && isAssertModelVisibleDebug()) {
+      assertModelVisible(this.log.events(), this.messages)
+    }
+
+    this.checkCompression()
+  }
+
   /** 记录工具执行结果（全量 ToolResult 含 success/error）到日志，并写投影消息（不重复走 messageToEvents 拆分）。 */
   addToolResult(toolUseId: string, result: ToolResult): void {
     const content = result.success ? result.content : result.error || result.content

package/src/core/engine.ts

@@ -43,6 +43,7 @@ import { buildRequest, sendInferenceCheck, isInferenceHookEnabled } from './infe
 import { getFileInboxTransport } from '../agent/cross-session/file-inbox'
 import { registerWakeupHandler } from '../tools/scheduling/schedule-wakeup'
 import { accumulateGraftSavings } from '../shared/graft-savings'
+import { deletedCwdSessionMessage, resolveExistingCwd } from '../shared/deleted-cwd'
 import {
   getMessageBus,
   formatInboundMessage,
@@ -60,6 +61,18 @@ const bundles: Record<string, TranslationMap> = {
 }
 const t = createT(bundles['en-US'] || (enUS as TranslationMap), enUS as TranslationMap)
 
+/**
+ * Tool-calling rounds one **turn** may spend, however it spends them. 20 was too
+ * low for real multi-step tasks — the model hit "max turns" and dropped pending
+ * tools mid-task. 100 stays bounded.
+ *
+ * A budget for the turn, not for one loop: a blocking Stop hook buys another round
+ * out of the same pool. The earlier shape re-granted a fresh 100 per loop
+ * invocation, so the cap bounded no turn at all — a hook that always asked for more
+ * kept the turn running until the process died.
+ */
+const MAX_TOOL_TURNS = 100
+
 /**
  * Drop inbound messages whose timestamp is older than the dialog-expiry TTL.
  * A stale message's approval dialog is no longer relevant, so it's discarded
@@ -296,7 +309,7 @@ export class QueryEngine {
     let injected = 0
     for (const recipient of recipients) {
       for (const msg of bus.poll(recipient)) {
-        this.context.addMessage({ role: 'user', content: formatInboundMessage(msg) })
+        this.context.injectContext(`agent:${msg.from}`, formatInboundMessage(msg))
         injected++
       }
       bus.markAllRead(recipient)
@@ -389,7 +402,7 @@ export class QueryEngine {
     const files = Array.from(this.touchedFiles)
     const block = this.rulesLoader.buildContextBlock(files)
     if (!block) return
-    this.context.addMessage({ role: 'user', content: block })
+    this.context.injectContext('rules', block)
     this.touchedFiles.clear()
   }
 
@@ -789,14 +802,15 @@ export class QueryEngine {
       yield chunk
     }
 
-    // If tools were executed, recursively continue the conversation
+    // If tools were executed, recursively continue the conversation — with what
+    // is left of the turn's budget after the round just spent here.
     if (toolUses.length > 0) {
-      yield* this.continueWithTools(signal)
+      yield* this.continueWithTools(signal, MAX_TOOL_TURNS - 1)
       return
     }
 
     // Fire Stop hooks when AI finishes with no tool calls
-    yield* this.checkStopHook(signal)
+    yield* this.checkStopHook(signal, MAX_TOOL_TURNS - 1)
 
     // Final drain of task notifications
     for (const chunk of this.drainTaskNotifications()) {
@@ -883,17 +897,17 @@ export class QueryEngine {
     }
   }
 
-  private async *continueWithTools(signal?: AbortSignal): AsyncGenerator<StreamChunk> {
-    // Tool-calling round cap. 20 was too low for real multi-step tasks — the model
-    // hit "max turns" and dropped pending tools mid-task. 100 stays bounded.
-    const MAX_TURNS = 100
+  private async *continueWithTools(
+    signal?: AbortSignal,
+    roundsLeft: number = MAX_TOOL_TURNS,
+  ): AsyncGenerator<StreamChunk> {
     // Task-level stall guard: a turn that produces no text or tool result for
     // this long is considered stalled and stopped (prevents ~40-min idle spins).
     const TURN_TIMEOUT_MS = 15 * 60 * 1000
     let lastActivity = Date.now()
     const toolDefs = this.getToolDefinitions()
 
-    for (let turn = 0; turn < MAX_TURNS; turn++) {
+    for (let turn = 0; turn < roundsLeft; turn++) {
       if (Date.now() - lastActivity > TURN_TIMEOUT_MS) {
         yield {
           type: 'warning',
@@ -1008,11 +1022,11 @@ export class QueryEngine {
       }
 
       // Safety: when max turns reached with pending tools, ask model to summarize
-      if (turn === MAX_TURNS - 1 && toolUses.length > 0) {
+      if (turn === roundsLeft - 1 && toolUses.length > 0) {
         this.context.addMessage({
           role: 'user',
           content: t('errors.max_tool_turns_warning', {
-            max: String(MAX_TURNS),
+            max: String(MAX_TOOL_TURNS),
             pending: String(toolUses.length),
           }),
         })
@@ -1033,7 +1047,7 @@ export class QueryEngine {
         } catch {
           yield {
             type: 'error',
-            error: t('errors.max_tool_turns', { max: String(MAX_TURNS) }),
+            error: t('errors.max_tool_turns', { max: String(MAX_TOOL_TURNS) }),
           }
         }
         return
@@ -1041,7 +1055,7 @@ export class QueryEngine {
 
       // No more tool calls — fire Stop hook and potentially continue
       if (toolUses.length === 0) {
-        yield* this.checkStopHook(signal)
+        yield* this.checkStopHook(signal, roundsLeft - turn - 1)
         return
       }
 
@@ -1228,8 +1242,24 @@ export class QueryEngine {
     }
 
     try {
+      // Every tool is handed the session's working directory, and that directory
+      // can be deleted while the session runs. Nothing upstream notices: Node
+      // throws from whichever call site touches it first, Bun keeps handing back
+      // the path it cached at startup, and the tool then fails at its first
+      // syscall naming whatever it touched (`spawn /bin/sh ENOENT` blames the
+      // shell). Refuse here, where the reason is still known.
+      const cwd = resolveExistingCwd()
+      if (!cwd) {
+        // Both fields carry the message on purpose: a failed result is projected
+        // as `error || content` (the two tool-result loops and the context log all
+        // read it that way), so guidance parked in `content` alone would be
+        // dropped exactly when it is needed.
+        const reason = deletedCwdSessionMessage()
+        return { success: false, content: reason, error: reason }
+      }
+
       const result = await tool.execute(effectiveParams, {
-        cwd: process.cwd(),
+        cwd,
         sessionId: this.sessionId,
         provider: this.registry.getActive().config.id,
         model: this.registry.getActiveModel(),
@@ -1373,9 +1403,21 @@ export class QueryEngine {
     this.llm = llm
   }
 
-  /** 统一 chat 出口：优先走注入的 Llm 缝，否则回退 registry。 */
+  /**
+   * 统一 chat 出口：优先走注入的 Llm 缝，否则回退 registry。
+   *
+   * 被截断的一轮在这里点名。`truncated` 只有 provider 能判（被上限截断、连接
+   * 被干净地关掉、正常写完，在字节流上是同一个形状），而这里是**每一处消费
+   * chat 流的地方都必经的唯一出口** —— 转发的循环有两个（`process` 与
+   * `continueWithTools`），各自补一次正是「两条渲染路径只接一条」的老毛病。
+   */
   private async *llmChat(req: ChatRequest): AsyncGenerator<StreamChunk> {
-    yield* (this.llm ?? this.registry).chat(req)
+    for await (const chunk of (this.llm ?? this.registry).chat(req)) {
+      if (chunk.type === 'stop' && chunk.truncated) {
+        yield { type: 'warning', content: t('errors.turn_truncated') }
+      }
+      yield chunk
+    }
   }
 
   /**
@@ -1494,13 +1536,15 @@ export class QueryEngine {
         : t('errors.tool_denied_classifier', { name, reason })
     }
 
-    const { reason, rulePattern } = this.permission.explainDenial(tool, params)
+    const { reason, rulePattern, target } = this.permission.explainDenial(tool, params)
     const mode = this.permission.getMode()
     switch (reason) {
       case 'deny-rule':
         return t('errors.tool_denied_deny_rule', { name, pattern: rulePattern ?? '?' })
       case 'ask-rule':
         return t('errors.tool_denied_ask_rule', { name, pattern: rulePattern ?? '?' })
+      case 'dangerous-rm':
+        return t('errors.tool_denied_dangerous_rm', { name, target: target ?? '?' })
       default:
         // mode-baseline / tool-default / legacy-rule / system-default — a mode
         // switch (or /permissions) resolves it.
@@ -1685,10 +1729,10 @@ export class QueryEngine {
     if (this.hookEngine) {
       const preResult = await this.hookEngine.executePreCompact(this.sessionId)
       if (preResult.additionalContext) {
-        this.context.addMessage({
-          role: 'user',
-          content: `[Pre-compact context]: ${preResult.additionalContext}`,
-        })
+        this.context.injectContext(
+          'pre-compact',
+          `[Pre-compact context]: ${preResult.additionalContext}`,
+        )
       }
     }
 
@@ -1697,29 +1741,46 @@ export class QueryEngine {
     if (this.hookEngine) {
       const postResult = await this.hookEngine.executePostCompact(this.sessionId)
       if (postResult.additionalContext) {
-        this.context.addMessage({
-          role: 'user',
-          content: `[Post-compact context]: ${postResult.additionalContext}`,
-        })
+        this.context.injectContext(
+          'post-compact',
+          `[Post-compact context]: ${postResult.additionalContext}`,
+        )
       }
     }
   }
 
   /** Fire Stop hook. If blocked, feed the reason back to the AI and continue. */
-  private async *checkStopHook(signal?: AbortSignal): AsyncGenerator<StreamChunk> {
+  private async *checkStopHook(
+    signal?: AbortSignal,
+    roundsLeft: number = MAX_TOOL_TURNS,
+  ): AsyncGenerator<StreamChunk> {
     if (!this.hookEngine) return
 
     const stopResult = await this.hookEngine.executeStop(this.sessionId)
-    if (stopResult.decision === 'block') {
-      // Feed the block reason back to the AI and continue
-      this.context.addMessage({
-        role: 'user',
-        content: t('system.context.stop_blocked', {
+    if (stopResult.decision !== 'block') return
+
+    // A block asks for more work, and more work means another round — which the
+    // turn may have none of left. Saying so is the point: a hook quietly ignored
+    // is worse than one told it has been overruled.
+    if (roundsLeft <= 0) {
+      yield {
+        type: 'warning',
+        content: t('errors.stop_hook_budget_spent', {
+          max: String(MAX_TOOL_TURNS),
           reason: stopResult.reason || 'Continue working.',
         }),
-      })
-      yield* this.continueWithTools(signal)
+      }
+      return
     }
+
+    // Feed the block reason back to the AI and continue
+    this.context.injectContext(
+      'stop-hook',
+      t('system.context.stop_blocked', {
+        reason: stopResult.reason || 'Continue working.',
+      }),
+    )
+    yield* this.continueWithTools(signal, roundsLeft)
   }
 }