@miphamai/cli 0.85.3 → 0.85.5

package/src/core/hooks-executor.ts

@@ -1,4 +1,6 @@
 import { spawnSync } from 'node:child_process'
+import { McpClient } from '../mcp/client'
+import type { ToolCallResult } from '../mcp/types'
 import type { HookConfig, HookContext, HookResult } from '../shared/index.ts'
 
 /**
@@ -7,13 +9,17 @@ import type { HookConfig, HookContext, HookResult } from '../shared/index.ts'
  * Supported types:
  * - command: Execute a shell command. Exit code 0 = allow, 2 = block with stderr as reason.
  * - http: POST to a URL, response body becomes additionalContext.
- * - mcp_tool: Call an MCP tool (delegates to MCP client -- stub for now).
+ * - mcp_tool: Call the MCP tool the hook names; its answer is read as the hook's.
  * - code: No-op (handled inline by the handler function directly).
  */
-export async function executeHook(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
+export async function executeHook(
+  cfg: HookConfig,
+  ctx: HookContext,
+  source?: string,
+): Promise<HookResult> {
   switch (cfg.type) {
     case 'command':
-      return executeCommand(cfg, ctx)
+      return executeCommand(cfg, ctx, source)
     case 'http':
       return executeHttp(cfg, ctx)
     case 'mcp_tool':
@@ -155,7 +161,26 @@ function spawnFailureCause(
   return null
 }
 
-async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
+/**
+ * The handle a failure message points the operator at: the command, and — when the
+ * hook came from a plugin rather than from the operator's own settings — who
+ * declared it.
+ *
+ * The command alone does not answer "which plugin do I look at". A plugin hook is
+ * typically `sh`, `node`, or a path under the plugin's root; none of those is a
+ * name the operator can search for. Two arguments rather than a pre-joined string
+ * because the parentheses and the `from` clause have to stay one decision: a
+ * caller that built half the label would be free to print `from "undefined"`.
+ */
+function failingLabel(command: string | undefined, source?: string): string {
+  return `(${command})${source ? ` from "${source}"` : ''}`
+}
+
+async function executeCommand(
+  cfg: HookConfig,
+  ctx: HookContext,
+  source?: string,
+): Promise<HookResult> {
   if (!cfg.command) return { allowed: true }
 
   try {
@@ -220,14 +245,14 @@ async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookRe
     if (failure) {
       return {
         allowed: true,
-        additionalContext: `Hook error (${cfg.command}): ${failure}`,
+        additionalContext: `Hook error ${failingLabel(cfg.command, source)}: ${failure}`,
       }
     }
 
     // Other non-zero exit: don't block, log the error as context
     return {
       allowed: true,
-      additionalContext: `Hook warning (${cfg.command}): ${stderr.trim()}`,
+      additionalContext: `Hook warning ${failingLabel(cfg.command, source)}: ${stderr.trim()}`,
     }
   } catch (err) {
     // Only reached when `spawnSync` itself throws — masking-policy load, env
@@ -237,7 +262,7 @@ async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookRe
 
     return {
       allowed: true,
-      additionalContext: `Hook error (${cfg.command}): ${message}`,
+      additionalContext: `Hook error ${failingLabel(cfg.command, source)}: ${message}`,
     }
   }
 }
@@ -282,8 +307,60 @@ async function executeHttp(cfg: HookConfig, ctx: HookContext): Promise<HookResul
   }
 }
 
-async function executeMcpTool(_cfg: HookConfig, _ctx: HookContext): Promise<HookResult> {
-  // Stub: MCP tool hook execution requires MCP client integration.
-  // For now, return allow to not block execution.
-  return { allowed: true }
+/**
+ * An `mcp_tool` hook: call the tool the hook names, and read its answer as the
+ * hook's own.
+ *
+ * The answer is read by the same contract a command hook's stdout follows — a
+ * structured decision decides, plain prose is context — so a tool that guards a
+ * tool call can block it the way a script would. An `isError` result is *not* a
+ * decision: it means the call did not speak, and an unreachable server reports
+ * the same way, so its message is reported rather than read as a verdict.
+ */
+async function executeMcpTool(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
+  if (!cfg.mcpServer || !cfg.mcpTool) return { allowed: true }
+
+  const client = McpClient.getInstance()
+
+  // Startup connects servers without blocking; this hook can arrive first.
+  if (!(await client.waitUntilReady(cfg.mcpServer))) {
+    return {
+      allowed: true,
+      additionalContext: `MCP hook (${cfg.mcpServer}/${cfg.mcpTool}): server "${cfg.mcpServer}" was still connecting — the tool was not called.`,
+    }
+  }
+
+  const result = await client.callTool(cfg.mcpServer, cfg.mcpTool, {
+    event: ctx.event,
+    toolName: ctx.toolName,
+    toolInput: ctx.toolInput,
+    sessionId: ctx.sessionId,
+  })
+  const body = mcpResultText(result)
+
+  if (result.isError) {
+    return {
+      allowed: true,
+      additionalContext: `MCP hook error (${cfg.mcpServer}/${cfg.mcpTool}): ${body.slice(0, 2000)}`,
+    }
+  }
+
+  const parsed = parseHookStdout(body, ctx)
+  const decided =
+    !parsed.allowed ||
+    parsed.additionalContext !== undefined ||
+    parsed.permissionDecision !== undefined ||
+    parsed.modifiedInput !== undefined
+
+  // Nothing in the hook contract matched, so the tool answered in prose: that
+  // answer is the context this hook contributes, not a silent no-op.
+  return decided ? parsed : { allowed: true, additionalContext: body.slice(0, 2000) || undefined }
+}
+
+/** The text an MCP tool call returned; non-text parts carry no message for a hook. */
+function mcpResultText(result: ToolCallResult): string {
+  return result.content
+    .map((part) => part.text ?? '')
+    .filter(Boolean)
+    .join('\n')
 }

package/src/core/hooks.ts

@@ -70,6 +70,18 @@ export class HookEngine {
     )
   }
 
+  /**
+   * Remove every hook a given source declared, and nothing else.
+   *
+   * `unregister(event)` matches on the event alone, so a caller that wanted to undo
+   * its own registrations took down every hook on those events — the operator's own
+   * from settings, and other plugins'. Scoping by source is the only removal that
+   * answers the question the caller is actually asking.
+   */
+  unregisterSource(source: string): void {
+    this.hooks = this.hooks.filter((h) => h.source !== source)
+  }
+
   // ── Existing event executors ──
 
   async executePreToolUse(
@@ -217,9 +229,21 @@ export class HookEngine {
 
   // ── Health & Resilience ──
 
-  /** Get a hook health key for tracking. */
+  /**
+   * Get a hook health key for tracking.
+   *
+   * Health is per hook, and the key is what says which hook. It was the event (plus
+   * the tool name), which is a *class* of hooks rather than one of them: two hooks
+   * on the same event shared one failure counter and one disabled flag, so five
+   * failures from a plugin's broken hook could auto-disable an unrelated hook that
+   * had never failed. The source is what makes the key name one hook.
+   *
+   * A hook with no source keeps the string it has always had — `/hooks enable`
+   * takes these keys, and a key for a hook that has no plugin must not renumber.
+   */
   private healthKey(hook: HookDefinition): string {
-    return hook.toolName ? `${hook.event}:${hook.toolName}` : hook.event
+    const base = hook.toolName ? `${hook.event}:${hook.toolName}` : hook.event
+    return hook.source ? `${hook.source}:${base}` : base
   }
 
   /** Check if a hook should be skipped due to repeated failures. */

package/src/core/instructions.ts

@@ -156,12 +156,86 @@ export function buildPermissionBlock(mode: string): string {
   return `## Permission Context\n\n${description}\n\nWhen a tool is denied, do NOT retry it or any other approval-gated tool — Bash, WebSearch, network, and Workflow are all blocked in this mode.${escape} If the task genuinely needs a blocked tool, STOP retrying and ask the user to switch modes with Shift+Tab or add an allow rule (/permissions), then wait for the user's answer. Note that Shift+Tab's wheel does not reach bypassPermissions — that mode is set in config, so do not offer it as a keypress.`
 }
 
+/** Level label used in each prompt part's provenance comment. */
+const LEVEL_LABELS: Record<string, string> = {
+  group: 'Group Policy',
+  company: 'Company Policy',
+  project: 'Project Rules',
+  directory: 'Directory Rules',
+  user: 'User Preferences',
+}
+
+/**
+ * The text one loaded file contributes to the system prompt — `prompt-exclude`
+ * sections stripped, `privacy: private` files omitted (`null`).
+ *
+ * Single source for the prompt **and** the size report. A report that measured
+ * the file on disk instead would overcount exactly the files this repository
+ * writes (its own `prompt-exclude` hides tens of thousands of characters), and
+ * the two numbers would drift apart with nothing saying which one is sent.
+ */
+function instructionPartText(inst: InstructionFile): string | null {
+  if (inst.privacy === 'private') return null
+  const content = stripSections(
+    inst.content,
+    parsePromptExclude(inst.frontmatter['prompt-exclude']),
+  )
+  return `<!-- ${LEVEL_LABELS[inst.level] || inst.level} (${inst.path}) -->\n${content}`
+}
+
+/** One file's share of the instruction payload. */
+export interface InstructionSize {
+  path: string
+  chars: number
+}
+
+export interface InstructionSizeReport {
+  totalChars: number
+  /** Descending by size — the largest contributor first. */
+  files: InstructionSize[]
+}
+
+/**
+ * Characters of file-derived instruction text a session sends with **every**
+ * request, before the conversation starts. 40,000 is the budget this
+ * organisation already writes a single governance file against (the parent
+ * `CLAUDE.md`), so the notice fires when everything loaded together has grown
+ * past one such file.
+ */
+export const INSTRUCTION_BUDGET_CHARS = 40_000
+
+/**
+ * The startup notice, or `null` while the payload is within budget.
+ *
+ * The **total** is the point: no file has to be large for the instruction
+ * payload to crowd out the work, so a per-file check cannot see a dozen
+ * mid-sized rule files and a lessons block adding up. Naming the largest few
+ * is what makes the number actionable.
+ */
+export function formatInstructionSizeNotice(
+  report: InstructionSizeReport,
+  budget: number = INSTRUCTION_BUDGET_CHARS,
+): string | null {
+  if (report.totalChars <= budget) return null
+  const num = (n: number) => n.toLocaleString('en-US')
+  const shown = report.files.slice(0, 3).map((f) => `${f.path} — ${num(f.chars)}`)
+  if (report.files.length > shown.length) shown.push(`+${report.files.length - shown.length} more`)
+  return (
+    `⚠ Instruction files total ${num(report.totalChars)} characters (budget ${num(budget)}), ` +
+    `sent with every request.\n` +
+    `   Largest: ${shown.join(' · ')}\n` +
+    `   Trim them, or move doc-only sections under a \`prompt-exclude\` frontmatter key.`
+  )
+}
+
 export class InstructionsLoader {
   private instructions: InstructionFile[] = []
   private crsiLessonSummaries: CrsiLessonSummary[] = []
+  private lessonsPath: string | null = null
 
   loadAll(cwd: string): void {
     this.instructions = []
+    this.lessonsPath = null
     const root = gitRoot(cwd)
 
     // Tier 1: 集团/公司策略（锚定仓库根，从任意子目录启动都正确；不读 AGENTS.md）
@@ -198,23 +272,12 @@ export class InstructionsLoader {
     const parts: string[] = []
 
     for (const inst of this.instructions) {
-      // Honor `privacy: private` — such instructions are never sent to the model.
-      if (inst.privacy === 'private') continue
-
-      const levelLabel: Record<string, string> = {
-        group: 'Group Policy',
-        company: 'Company Policy',
-        project: 'Project Rules',
-        directory: 'Directory Rules',
-        user: 'User Preferences',
-      }
-      // Strip doc-only sections declared via `prompt-exclude` frontmatter
+      // `instructionPartText` honors `privacy: private` (never sent) and strips
+      // doc-only sections declared via `prompt-exclude` frontmatter
       // (changelog/roadmap/catalog are human-facing, not machine rules).
-      const content = stripSections(
-        inst.content,
-        parsePromptExclude(inst.frontmatter['prompt-exclude']),
-      )
-      parts.push(`<!-- ${levelLabel[inst.level] || inst.level} (${inst.path}) -->\n${content}`)
+      const text = instructionPartText(inst)
+      if (text === null) continue
+      parts.push(text)
     }
 
     // P2-2 的权限段**不在**这里 —— 见 `buildPermissionBlock` 与
@@ -371,8 +434,11 @@ Never omit it or present the work as purely human-authored.`)
 
   /** 读 crsi-lessons.md（按仓库根定位）提取教训精华。读不到则返回空。 */
   private loadCrsiLessons(root: string): CrsiLessonSummary[] {
+    const path = join(root, LESSONS_FILE)
     try {
-      const content = readFileSync(join(root, LESSONS_FILE), 'utf-8')
+      const content = readFileSync(path, 'utf-8')
+      // Remember where the recalled text came from — `sizeReport` names it.
+      this.lessonsPath = path
       return extractCrsiLessonSummaries(content)
     } catch {
       return []
@@ -392,6 +458,28 @@ Never omit it or present the work as purely human-authored.`)
     return [...this.instructions]
   }
 
+  /**
+   * How much instruction text this loader puts in the system prompt, per file.
+   *
+   * Read through `instructionPartText` — the same projection `buildSystemPrompt`
+   * uses — so the report cannot describe something other than what is sent. The
+   * CRSI lessons block counts too: it is rendered from `crsi-lessons.md` and
+   * carried on every request like any other rule file.
+   */
+  sizeReport(): InstructionSizeReport {
+    const files: InstructionSize[] = []
+    for (const inst of this.instructions) {
+      const text = instructionPartText(inst)
+      if (text !== null) files.push({ path: inst.path, chars: text.length })
+    }
+    if (this.lessonsPath) {
+      const lessons = buildCrsiLessonsBlock(this.crsiLessonSummaries)
+      if (lessons) files.push({ path: this.lessonsPath, chars: lessons.length })
+    }
+    files.sort((a, b) => b.chars - a.chars)
+    return { totalChars: files.reduce((n, f) => n + f.chars, 0), files }
+  }
+
   private tryLoad(path: string, level: InstructionFile['level']): void {
     if (!existsSync(path)) return
 

package/src/core/permission-classifier.ts

@@ -399,11 +399,21 @@ export class LlmPermissionClassifier implements PermissionClassifier {
 
     let text = ''
     let streamError: string | undefined
+    let truncated = false
     try {
       for await (const chunk of this.llm.chat({
         model: this.config.resolveModel(),
         messages: [{ role: 'user', content: prompt }],
-        maxTokens: 200,
+        // NO `maxTokens`. This cap is shared with the model's **thinking**, and the
+        // configured model may be a reasoning one: `reasoning_content` is billed
+        // against `max_tokens` but is not what the loop below accumulates, so a cap
+        // sized for the 17-character reply starves the reply itself. Measured
+        // 2026-09-24 against the configured `deepseek-v4-pro` on three realistic
+        // calls: ~880 chars of reasoning consumed the whole budget, `finish_reason`
+        // came back `length`, the visible answer was empty 3/3, and every one of
+        // those calls was held back as an unreadable reply — i.e. precisely the calls
+        // worth classifying are the ones that failed. The provider's own default
+        // (`req.maxTokens || declaredMaxOutput || 8192`) is the budget now.
         temperature: 0,
         signal: controller.signal,
       })) {
@@ -411,6 +421,10 @@ export class LlmPermissionClassifier implements PermissionClassifier {
         // An in-stream error would otherwise look exactly like an empty reply —
         // and an empty reply is what a *denial* looks like. Name it instead.
         else if (chunk.type === 'error') streamError = chunk.error ?? 'provider error'
+        // The provider sets this for `finish_reason: 'length'`. Reading it is the
+        // difference between "the reply was cut off at the cap" and "the reply was
+        // unreadable" — two very different things to hand a user.
+        else if (chunk.type === 'stop' && chunk.truncated) truncated = true
       }
     } catch (error) {
       return {
@@ -435,10 +449,14 @@ export class LlmPermissionClassifier implements PermissionClassifier {
       return { allow: false, rule: parsed.rule, reason: parsed.reason }
     }
     // Unreadable reply ⇒ held back, and said to be retryable — the model did not
-    // rule, so treating this as a policy refusal would be a lie.
+    // rule, so treating this as a policy refusal would be a lie. A reply the
+    // provider flagged as cut off gets named as such: "unreadable" sends the reader
+    // hunting for a malformed response when the cause was a token ceiling.
     return {
       allow: false,
-      reason: `classifier response unreadable: ${parsed.detail}`,
+      reason: truncated
+        ? `classifier reply was cut off at the output token cap before it ruled (${parsed.detail})`
+        : `classifier response unreadable: ${parsed.detail}`,
       retryable: true,
     }
   }

package/src/core/permission-rules.ts

@@ -362,7 +362,7 @@ function extractSubstitutions(command: string): string[] {
  * REPORTTIME/REPORTMEMORY/DIRSTACKSIZE assignments immediately — and
  * `bash -c 'rm -rf /'`. Over-matching is the safe direction for a deny rule.
  */
-function flattenCommand(command: string, depth = 0): string[] {
+export function flattenCommand(command: string, depth = 0): string[] {
   const out: string[] = []
   for (const seg of splitShellSegments(command)) {
     out.push(seg)

package/src/core/permission.ts

@@ -7,6 +7,8 @@ import type {
 } from '../shared/index.ts'
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchBashRule, compileRule } from './permission-rules'
+import { detectDangerousRm } from '../security/dangerous-rm'
+import type { DangerousRm } from '../security/dangerous-rm'
 import {
   loadPermissionConfig,
   nextMode,
@@ -123,6 +125,7 @@ export type PermissionDenialReason =
   | 'tool-default' // tool.permission === 'ask'
   | 'system-default' // no rule, no tool permission → fallback ask
   | 'classifier-deny' // `auto` mode's classifier ruled against the call
+  | 'dangerous-rm' // recursive rm whose target is not a path in the command text
 
 /**
  * Which denial reasons `auto` mode's classifier is allowed to rule on — an
@@ -138,6 +141,11 @@ export type PermissionDenialReason =
  * `legacy-rule` is absent for the same reason as the rules: it is an explicit
  * per-tool decision from `setRule()`. `classifier-deny` is absent because it is not
  * a *static* reason at all — `explainDenial()` never returns it.
+ *
+ * `dangerous-rm` is absent because a classifier cannot be *asked* the question this
+ * reason answers. Every other reason here is "the mode was not sure, let a second
+ * opinion decide"; this one is "the command does not say what it will delete", and
+ * a second opinion reading the same command is reading the same missing text.
  */
 const CLASSIFIABLE: ReadonlySet<PermissionDenialReason> = new Set<PermissionDenialReason>([
   'mode-baseline',
@@ -463,6 +471,21 @@ export class PermissionSystem {
       return 'ask' // absent tool → safest default
     }
 
+    // ── A recursive `rm` whose target is not a path written in the command ──
+    // First, and deliberately **uncached**. Every other branch below reasons about
+    // the command's text; this is the one case where the text does not name what
+    // gets deleted, so it has to sit ahead of the allow rules and ahead of every
+    // mode baseline (`auto`, `bypassPermissions`) rather than inside them.
+    //
+    // Not cached because its answer depends on the environment opt-out, and the
+    // cache is keyed on tool+input alone. Caching here would mean an opt-out set
+    // before launch could never be observed being *un*set — the decision would
+    // outlive the input that produced it. Re-running the string check on each Bash
+    // call is cheaper than a cache that can contradict its own inputs.
+    if (this.dangerousRm(tool, input)) {
+      return 'ask'
+    }
+
     // ── Cache lookup (P2): reuse decision for same tool+mode+input ──
     const cacheKey = this.cacheKey(tool, input)
     if (this.cacheMode === this.mode) {
@@ -551,7 +574,7 @@ export class PermissionSystem {
   explainDenial(
     tool: ToolDefinition,
     input: Record<string, unknown>,
-  ): { reason: PermissionDenialReason; rulePattern?: string } {
+  ): { reason: PermissionDenialReason; rulePattern?: string; target?: string } {
     for (const rule of this.denyRules) {
       if (this.ruleMatches(rule, tool, input)) {
         return { reason: 'deny-rule', rulePattern: rule.pattern }
@@ -562,6 +585,10 @@ export class PermissionSystem {
         return { reason: 'ask-rule', rulePattern: rule.pattern }
       }
     }
+    const dangerous = this.dangerousRm(tool, input)
+    if (dangerous) {
+      return { reason: 'dangerous-rm', target: dangerous.target }
+    }
     if (this.legacyRules.has(tool.name)) {
       return { reason: 'legacy-rule' }
     }
@@ -583,6 +610,28 @@ export class PermissionSystem {
     return tool.name + '|' + JSON.stringify(input, Object.keys(input).sort())
   }
 
+  /**
+   * A recursive `rm` whose target is not a path written in the command.
+   *
+   * Only the Bash tool: the question is about a *shell command line*, and a tool
+   * that merely happens to take a `command` parameter is not making a claim about
+   * what it will delete.
+   *
+   * The escape hatch is read from the **environment**, not from tool parameters.
+   * That is the difference between an operator switch and a model switch: a
+   * parameter the call can set is a guard the call can turn off, and
+   * `dangerouslyDisableSandbox` already shows how that ends. Read at call time
+   * rather than captured at construction so that a process which sets it before
+   * its first matching call gets the documented behaviour.
+   */
+  private dangerousRm(tool: ToolDefinition, input: Record<string, unknown>): DangerousRm | null {
+    if (tool.name !== 'Bash') return null
+    if (process.env.MIPHAM_DISABLE_DANGEROUS_RM_PROMPT === '1') return null
+    const command = input.command
+    if (typeof command !== 'string') return null
+    return detectDangerousRm(command)
+  }
+
   /**
    * Resolve a call to a decision, consulting `auto` mode's classifier when — and
    * only when — the static chain answered `'ask'` for a reason a classifier is

package/src/core/session-log.ts

@@ -118,6 +118,66 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
 
 const LOG_DIR = miphamHome('sessions')
 
+/** 补上的那条结果的正文：说明事情本身，并给出下一步，而不是只报一个状态。 */
+function interruptedCallNotice(): string {
+  return (
+    `This tool call was in flight when the session ended, so its outcome is unknown — ` +
+    `the result was never recorded.\n` +
+    `Do not assume it succeeded or failed: check the actual state (read the files, ` +
+    `re-run the command) and re-issue the call if it did not take effect.`
+  )
+}
+
+/**
+ * 恢复会话时收尾：给日志里**没有结果**的调用补一条「结果未知」的 `tool/result`
+ * 事件，返回补了几条。
+ *
+ * 为什么非补不可：助手消息里挂着 `tool_calls` 而没有任何结果回应，OpenAI / DeepSeek
+ * 会整条请求拒收，Anthropic 还要求 `tool_result` 紧跟在那条 `tool_use` 之后。于是
+ * 「这次的调用没收尾」在用户那里表现成「恢复之后说的第一句话就报协议错」。
+ *
+ * 这个形状**是从盘上读来的，不是引擎写出来的**：`engine.ts` 先落调用消息、紧接着
+ * 落结果（同一同步块），而这批事件只在退出时整份刷盘 —— 跑到一半被杀根本留不下那条
+ * 调用。够得着的是**读侧**：`save()` 逐行追加，`open()` 把读不动的行静默丢掉（半截
+ * JSON 过不了 `JSON.parse`），于是写盘写到一半被打断时，末尾那条结果被丢、调用留在
+ * 盘上。修在恢复这一步，是因为读侧的入口只有这一个（`ContextManager.restoreLog`）。
+ *
+ * 为什么补成**事件**而不是往投影里塞一条消息：本仓库的不变量是「模型看得见的必须已
+ * 记录」（`assertModelVisible`），凭空出现的消息正好违反它；`messageToEvents` /
+ * `deriveMessages` 的字节级互逆也不能被动过。补事件两边都成立 —— 模型**看得见那次
+ * 调用**（它本来就在历史里），也知道**结果未知**，于是它先去查证，而不是当成没发生过、
+ * 也不是猜成功或失败。
+ *
+ * 幂等：已经有结果的 id 不会再补第二条。
+ */
+export function closeInterruptedToolCalls(log: SessionLog): number {
+  const events = log.events()
+  const answered = new Set<string>()
+  for (const e of events) {
+    if (e.type === 'tool/result') answered.add(e.id)
+    else if (e.type === 'user/message' && Array.isArray(e.message.content)) {
+      // 结果也可能整条嵌在 user/message 里（多块消息不拆事件），一样算「已回答」。
+      for (const b of e.message.content) {
+        if (b.type === 'tool_result') answered.add(b.tool_use_id)
+      }
+    }
+  }
+
+  const pending: string[] = []
+  for (const e of events) {
+    if (e.type === 'tool/call' && !answered.has(e.id)) pending.push(e.id)
+  }
+
+  const at = Date.now()
+  for (const id of pending) {
+    // 失败结果在投影里被读成 `error || content`（见 `deriveMessages`），两个字段同写；
+    // 这一段与 `deleted-cwd` 那次是同一个教训。
+    const content = interruptedCallNotice()
+    log.append({ type: 'tool/result', at, id, result: { success: false, content, error: content } })
+  }
+  return pending.length
+}
+
 /** 一次性告警：日志路径不是普通文件（写不进去），每个进程只说一句。 */
 let warnedNotAppendable = false
 

package/src/daemon/index.ts

@@ -13,7 +13,6 @@ import type { Server } from 'bun'
 import { DaemonDatabase } from './database'
 import { SessionManager } from './session-manager'
 import { AgentManager } from './agent-manager'
-import { MessageBus } from './message-bus'
 import { GoalManager } from './goal-manager'
 import { ScheduleManager } from './schedule-manager'
 import { createServer } from './server'
@@ -118,7 +117,7 @@ export function getPort(): number {
  * 1. Ensures ~/.mipham exists (mode 0o700)
  * 2. Loads or creates the auth token
  * 3. Initializes the SQLite database and runs JSONL migration on first start
- * 4. Creates a SessionManager, AgentManager, and MessageBus
+ * 4. Creates a SessionManager and AgentManager
  * 5. Starts the HTTP server on an available port
  * 6. Writes PID and port files to disk
  *
@@ -152,9 +151,8 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
   const pool = new WorkerPool(db)
   activePool = pool
 
-  // Create agent manager and message bus (Phase 3)
+  // Create agent manager (Phase 3)
   const agentManager = new AgentManager(db)
-  const messageBus = new MessageBus()
 
   // Create goal manager and schedule manager (Phase 4)
   const goalManager = new GoalManager(db)
@@ -236,7 +234,6 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
     port,
     hostname,
     agentManager,
-    messageBus,
     goalManager,
     scheduleManager,
     rateLimiter,