@miphamai/cli 0.85.4 → 0.85.5

package/src/core/instructions.ts

@@ -156,12 +156,86 @@ export function buildPermissionBlock(mode: string): string {
   return `## Permission Context\n\n${description}\n\nWhen a tool is denied, do NOT retry it or any other approval-gated tool — Bash, WebSearch, network, and Workflow are all blocked in this mode.${escape} If the task genuinely needs a blocked tool, STOP retrying and ask the user to switch modes with Shift+Tab or add an allow rule (/permissions), then wait for the user's answer. Note that Shift+Tab's wheel does not reach bypassPermissions — that mode is set in config, so do not offer it as a keypress.`
 }
 
+/** Level label used in each prompt part's provenance comment. */
+const LEVEL_LABELS: Record<string, string> = {
+  group: 'Group Policy',
+  company: 'Company Policy',
+  project: 'Project Rules',
+  directory: 'Directory Rules',
+  user: 'User Preferences',
+}
+
+/**
+ * The text one loaded file contributes to the system prompt — `prompt-exclude`
+ * sections stripped, `privacy: private` files omitted (`null`).
+ *
+ * Single source for the prompt **and** the size report. A report that measured
+ * the file on disk instead would overcount exactly the files this repository
+ * writes (its own `prompt-exclude` hides tens of thousands of characters), and
+ * the two numbers would drift apart with nothing saying which one is sent.
+ */
+function instructionPartText(inst: InstructionFile): string | null {
+  if (inst.privacy === 'private') return null
+  const content = stripSections(
+    inst.content,
+    parsePromptExclude(inst.frontmatter['prompt-exclude']),
+  )
+  return `<!-- ${LEVEL_LABELS[inst.level] || inst.level} (${inst.path}) -->\n${content}`
+}
+
+/** One file's share of the instruction payload. */
+export interface InstructionSize {
+  path: string
+  chars: number
+}
+
+export interface InstructionSizeReport {
+  totalChars: number
+  /** Descending by size — the largest contributor first. */
+  files: InstructionSize[]
+}
+
+/**
+ * Characters of file-derived instruction text a session sends with **every**
+ * request, before the conversation starts. 40,000 is the budget this
+ * organisation already writes a single governance file against (the parent
+ * `CLAUDE.md`), so the notice fires when everything loaded together has grown
+ * past one such file.
+ */
+export const INSTRUCTION_BUDGET_CHARS = 40_000
+
+/**
+ * The startup notice, or `null` while the payload is within budget.
+ *
+ * The **total** is the point: no file has to be large for the instruction
+ * payload to crowd out the work, so a per-file check cannot see a dozen
+ * mid-sized rule files and a lessons block adding up. Naming the largest few
+ * is what makes the number actionable.
+ */
+export function formatInstructionSizeNotice(
+  report: InstructionSizeReport,
+  budget: number = INSTRUCTION_BUDGET_CHARS,
+): string | null {
+  if (report.totalChars <= budget) return null
+  const num = (n: number) => n.toLocaleString('en-US')
+  const shown = report.files.slice(0, 3).map((f) => `${f.path} — ${num(f.chars)}`)
+  if (report.files.length > shown.length) shown.push(`+${report.files.length - shown.length} more`)
+  return (
+    `⚠ Instruction files total ${num(report.totalChars)} characters (budget ${num(budget)}), ` +
+    `sent with every request.\n` +
+    `   Largest: ${shown.join(' · ')}\n` +
+    `   Trim them, or move doc-only sections under a \`prompt-exclude\` frontmatter key.`
+  )
+}
+
 export class InstructionsLoader {
   private instructions: InstructionFile[] = []
   private crsiLessonSummaries: CrsiLessonSummary[] = []
+  private lessonsPath: string | null = null
 
   loadAll(cwd: string): void {
     this.instructions = []
+    this.lessonsPath = null
     const root = gitRoot(cwd)
 
     // Tier 1: 集团/公司策略（锚定仓库根，从任意子目录启动都正确；不读 AGENTS.md）
@@ -198,23 +272,12 @@ export class InstructionsLoader {
     const parts: string[] = []
 
     for (const inst of this.instructions) {
-      // Honor `privacy: private` — such instructions are never sent to the model.
-      if (inst.privacy === 'private') continue
-
-      const levelLabel: Record<string, string> = {
-        group: 'Group Policy',
-        company: 'Company Policy',
-        project: 'Project Rules',
-        directory: 'Directory Rules',
-        user: 'User Preferences',
-      }
-      // Strip doc-only sections declared via `prompt-exclude` frontmatter
+      // `instructionPartText` honors `privacy: private` (never sent) and strips
+      // doc-only sections declared via `prompt-exclude` frontmatter
       // (changelog/roadmap/catalog are human-facing, not machine rules).
-      const content = stripSections(
-        inst.content,
-        parsePromptExclude(inst.frontmatter['prompt-exclude']),
-      )
-      parts.push(`<!-- ${levelLabel[inst.level] || inst.level} (${inst.path}) -->\n${content}`)
+      const text = instructionPartText(inst)
+      if (text === null) continue
+      parts.push(text)
     }
 
     // P2-2 的权限段**不在**这里 —— 见 `buildPermissionBlock` 与
@@ -371,8 +434,11 @@ Never omit it or present the work as purely human-authored.`)
 
   /** 读 crsi-lessons.md（按仓库根定位）提取教训精华。读不到则返回空。 */
   private loadCrsiLessons(root: string): CrsiLessonSummary[] {
+    const path = join(root, LESSONS_FILE)
     try {
-      const content = readFileSync(join(root, LESSONS_FILE), 'utf-8')
+      const content = readFileSync(path, 'utf-8')
+      // Remember where the recalled text came from — `sizeReport` names it.
+      this.lessonsPath = path
       return extractCrsiLessonSummaries(content)
     } catch {
       return []
@@ -392,6 +458,28 @@ Never omit it or present the work as purely human-authored.`)
     return [...this.instructions]
   }
 
+  /**
+   * How much instruction text this loader puts in the system prompt, per file.
+   *
+   * Read through `instructionPartText` — the same projection `buildSystemPrompt`
+   * uses — so the report cannot describe something other than what is sent. The
+   * CRSI lessons block counts too: it is rendered from `crsi-lessons.md` and
+   * carried on every request like any other rule file.
+   */
+  sizeReport(): InstructionSizeReport {
+    const files: InstructionSize[] = []
+    for (const inst of this.instructions) {
+      const text = instructionPartText(inst)
+      if (text !== null) files.push({ path: inst.path, chars: text.length })
+    }
+    if (this.lessonsPath) {
+      const lessons = buildCrsiLessonsBlock(this.crsiLessonSummaries)
+      if (lessons) files.push({ path: this.lessonsPath, chars: lessons.length })
+    }
+    files.sort((a, b) => b.chars - a.chars)
+    return { totalChars: files.reduce((n, f) => n + f.chars, 0), files }
+  }
+
   private tryLoad(path: string, level: InstructionFile['level']): void {
     if (!existsSync(path)) return
 

package/src/core/permission-rules.ts

@@ -362,7 +362,7 @@ function extractSubstitutions(command: string): string[] {
  * REPORTTIME/REPORTMEMORY/DIRSTACKSIZE assignments immediately — and
  * `bash -c 'rm -rf /'`. Over-matching is the safe direction for a deny rule.
  */
-function flattenCommand(command: string, depth = 0): string[] {
+export function flattenCommand(command: string, depth = 0): string[] {
   const out: string[] = []
   for (const seg of splitShellSegments(command)) {
     out.push(seg)

package/src/core/permission.ts

@@ -7,6 +7,8 @@ import type {
 } from '../shared/index.ts'
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchBashRule, compileRule } from './permission-rules'
+import { detectDangerousRm } from '../security/dangerous-rm'
+import type { DangerousRm } from '../security/dangerous-rm'
 import {
   loadPermissionConfig,
   nextMode,
@@ -123,6 +125,7 @@ export type PermissionDenialReason =
   | 'tool-default' // tool.permission === 'ask'
   | 'system-default' // no rule, no tool permission → fallback ask
   | 'classifier-deny' // `auto` mode's classifier ruled against the call
+  | 'dangerous-rm' // recursive rm whose target is not a path in the command text
 
 /**
  * Which denial reasons `auto` mode's classifier is allowed to rule on — an
@@ -138,6 +141,11 @@ export type PermissionDenialReason =
  * `legacy-rule` is absent for the same reason as the rules: it is an explicit
  * per-tool decision from `setRule()`. `classifier-deny` is absent because it is not
  * a *static* reason at all — `explainDenial()` never returns it.
+ *
+ * `dangerous-rm` is absent because a classifier cannot be *asked* the question this
+ * reason answers. Every other reason here is "the mode was not sure, let a second
+ * opinion decide"; this one is "the command does not say what it will delete", and
+ * a second opinion reading the same command is reading the same missing text.
  */
 const CLASSIFIABLE: ReadonlySet<PermissionDenialReason> = new Set<PermissionDenialReason>([
   'mode-baseline',
@@ -463,6 +471,21 @@ export class PermissionSystem {
       return 'ask' // absent tool → safest default
     }
 
+    // ── A recursive `rm` whose target is not a path written in the command ──
+    // First, and deliberately **uncached**. Every other branch below reasons about
+    // the command's text; this is the one case where the text does not name what
+    // gets deleted, so it has to sit ahead of the allow rules and ahead of every
+    // mode baseline (`auto`, `bypassPermissions`) rather than inside them.
+    //
+    // Not cached because its answer depends on the environment opt-out, and the
+    // cache is keyed on tool+input alone. Caching here would mean an opt-out set
+    // before launch could never be observed being *un*set — the decision would
+    // outlive the input that produced it. Re-running the string check on each Bash
+    // call is cheaper than a cache that can contradict its own inputs.
+    if (this.dangerousRm(tool, input)) {
+      return 'ask'
+    }
+
     // ── Cache lookup (P2): reuse decision for same tool+mode+input ──
     const cacheKey = this.cacheKey(tool, input)
     if (this.cacheMode === this.mode) {
@@ -551,7 +574,7 @@ export class PermissionSystem {
   explainDenial(
     tool: ToolDefinition,
     input: Record<string, unknown>,
-  ): { reason: PermissionDenialReason; rulePattern?: string } {
+  ): { reason: PermissionDenialReason; rulePattern?: string; target?: string } {
     for (const rule of this.denyRules) {
       if (this.ruleMatches(rule, tool, input)) {
         return { reason: 'deny-rule', rulePattern: rule.pattern }
@@ -562,6 +585,10 @@ export class PermissionSystem {
         return { reason: 'ask-rule', rulePattern: rule.pattern }
       }
     }
+    const dangerous = this.dangerousRm(tool, input)
+    if (dangerous) {
+      return { reason: 'dangerous-rm', target: dangerous.target }
+    }
     if (this.legacyRules.has(tool.name)) {
       return { reason: 'legacy-rule' }
     }
@@ -583,6 +610,28 @@ export class PermissionSystem {
     return tool.name + '|' + JSON.stringify(input, Object.keys(input).sort())
   }
 
+  /**
+   * A recursive `rm` whose target is not a path written in the command.
+   *
+   * Only the Bash tool: the question is about a *shell command line*, and a tool
+   * that merely happens to take a `command` parameter is not making a claim about
+   * what it will delete.
+   *
+   * The escape hatch is read from the **environment**, not from tool parameters.
+   * That is the difference between an operator switch and a model switch: a
+   * parameter the call can set is a guard the call can turn off, and
+   * `dangerouslyDisableSandbox` already shows how that ends. Read at call time
+   * rather than captured at construction so that a process which sets it before
+   * its first matching call gets the documented behaviour.
+   */
+  private dangerousRm(tool: ToolDefinition, input: Record<string, unknown>): DangerousRm | null {
+    if (tool.name !== 'Bash') return null
+    if (process.env.MIPHAM_DISABLE_DANGEROUS_RM_PROMPT === '1') return null
+    const command = input.command
+    if (typeof command !== 'string') return null
+    return detectDangerousRm(command)
+  }
+
   /**
    * Resolve a call to a decision, consulting `auto` mode's classifier when — and
    * only when — the static chain answered `'ask'` for a reason a classifier is

package/src/core/session-log.ts

@@ -118,6 +118,66 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
 
 const LOG_DIR = miphamHome('sessions')
 
+/** 补上的那条结果的正文：说明事情本身，并给出下一步，而不是只报一个状态。 */
+function interruptedCallNotice(): string {
+  return (
+    `This tool call was in flight when the session ended, so its outcome is unknown — ` +
+    `the result was never recorded.\n` +
+    `Do not assume it succeeded or failed: check the actual state (read the files, ` +
+    `re-run the command) and re-issue the call if it did not take effect.`
+  )
+}
+
+/**
+ * 恢复会话时收尾：给日志里**没有结果**的调用补一条「结果未知」的 `tool/result`
+ * 事件，返回补了几条。
+ *
+ * 为什么非补不可：助手消息里挂着 `tool_calls` 而没有任何结果回应，OpenAI / DeepSeek
+ * 会整条请求拒收，Anthropic 还要求 `tool_result` 紧跟在那条 `tool_use` 之后。于是
+ * 「这次的调用没收尾」在用户那里表现成「恢复之后说的第一句话就报协议错」。
+ *
+ * 这个形状**是从盘上读来的，不是引擎写出来的**：`engine.ts` 先落调用消息、紧接着
+ * 落结果（同一同步块），而这批事件只在退出时整份刷盘 —— 跑到一半被杀根本留不下那条
+ * 调用。够得着的是**读侧**：`save()` 逐行追加，`open()` 把读不动的行静默丢掉（半截
+ * JSON 过不了 `JSON.parse`），于是写盘写到一半被打断时，末尾那条结果被丢、调用留在
+ * 盘上。修在恢复这一步，是因为读侧的入口只有这一个（`ContextManager.restoreLog`）。
+ *
+ * 为什么补成**事件**而不是往投影里塞一条消息：本仓库的不变量是「模型看得见的必须已
+ * 记录」（`assertModelVisible`），凭空出现的消息正好违反它；`messageToEvents` /
+ * `deriveMessages` 的字节级互逆也不能被动过。补事件两边都成立 —— 模型**看得见那次
+ * 调用**（它本来就在历史里），也知道**结果未知**，于是它先去查证，而不是当成没发生过、
+ * 也不是猜成功或失败。
+ *
+ * 幂等：已经有结果的 id 不会再补第二条。
+ */
+export function closeInterruptedToolCalls(log: SessionLog): number {
+  const events = log.events()
+  const answered = new Set<string>()
+  for (const e of events) {
+    if (e.type === 'tool/result') answered.add(e.id)
+    else if (e.type === 'user/message' && Array.isArray(e.message.content)) {
+      // 结果也可能整条嵌在 user/message 里（多块消息不拆事件），一样算「已回答」。
+      for (const b of e.message.content) {
+        if (b.type === 'tool_result') answered.add(b.tool_use_id)
+      }
+    }
+  }
+
+  const pending: string[] = []
+  for (const e of events) {
+    if (e.type === 'tool/call' && !answered.has(e.id)) pending.push(e.id)
+  }
+
+  const at = Date.now()
+  for (const id of pending) {
+    // 失败结果在投影里被读成 `error || content`（见 `deriveMessages`），两个字段同写；
+    // 这一段与 `deleted-cwd` 那次是同一个教训。
+    const content = interruptedCallNotice()
+    log.append({ type: 'tool/result', at, id, result: { success: false, content, error: content } })
+  }
+  return pending.length
+}
+
 /** 一次性告警：日志路径不是普通文件（写不进去），每个进程只说一句。 */
 let warnedNotAppendable = false
 

package/src/daemon/index.ts

@@ -13,7 +13,6 @@ import type { Server } from 'bun'
 import { DaemonDatabase } from './database'
 import { SessionManager } from './session-manager'
 import { AgentManager } from './agent-manager'
-import { MessageBus } from './message-bus'
 import { GoalManager } from './goal-manager'
 import { ScheduleManager } from './schedule-manager'
 import { createServer } from './server'
@@ -118,7 +117,7 @@ export function getPort(): number {
  * 1. Ensures ~/.mipham exists (mode 0o700)
  * 2. Loads or creates the auth token
  * 3. Initializes the SQLite database and runs JSONL migration on first start
- * 4. Creates a SessionManager, AgentManager, and MessageBus
+ * 4. Creates a SessionManager and AgentManager
  * 5. Starts the HTTP server on an available port
  * 6. Writes PID and port files to disk
  *
@@ -152,9 +151,8 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
   const pool = new WorkerPool(db)
   activePool = pool
 
-  // Create agent manager and message bus (Phase 3)
+  // Create agent manager (Phase 3)
   const agentManager = new AgentManager(db)
-  const messageBus = new MessageBus()
 
   // Create goal manager and schedule manager (Phase 4)
   const goalManager = new GoalManager(db)
@@ -236,7 +234,6 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
     port,
     hostname,
     agentManager,
-    messageBus,
     goalManager,
     scheduleManager,
     rateLimiter,

package/src/daemon/server.ts

@@ -3,7 +3,6 @@ import type { Server, ServerWebSocket } from 'bun'
 import type { DaemonDatabase } from './database'
 import type { SessionManager } from './session-manager'
 import type { AgentManager } from './agent-manager'
-import type { MessageBus } from './message-bus'
 import type { DaemonGoal, AgentKind } from './types'
 import type { GoalManager } from './goal-manager'
 import type { ScheduleManager } from './schedule-manager'
@@ -49,7 +48,6 @@ interface ServerConfig {
   port: number
   hostname: string
   agentManager: AgentManager
-  messageBus: MessageBus
   goalManager: GoalManager
   scheduleManager: ScheduleManager
   rateLimiter: RateLimiter
@@ -156,7 +154,6 @@ export function createServer(config: ServerConfig): Server<WsData> {
     port,
     hostname,
     agentManager,
-    messageBus,
     goalManager,
     scheduleManager,
     rateLimiter,
@@ -192,15 +189,8 @@ export function createServer(config: ServerConfig): Server<WsData> {
     }
   }
 
-  // ── Agent lifecycle → WebSocket broadcast + MessageBus registration ──
+  // ── Agent lifecycle → WebSocket broadcast ──
   agentManager.onLifecycleEvent((event) => {
-    // Register / unregister in the message bus for broadcastToSession routing
-    if (event.type === 'created') {
-      messageBus.registerAgent(event.agent.sessionId, event.agent.id)
-    } else if (event.type === 'completed' || event.type === 'failed') {
-      messageBus.unregisterAgent(event.agent.id)
-    }
-
     // Broadcast lifecycle events to all WebSocket clients in the agent's session
     broadcast(event.agent.sessionId, {
       type: 'agent_lifecycle',
@@ -670,8 +660,23 @@ export function createServer(config: ServerConfig): Server<WsData> {
           return json({ ok: false, error: 'Agent not found' }, { status: 404 })
         }
 
-        messageBus.send('user', agentId, content)
-        return json({ ok: true }, { status: 202 })
+        // 从前这里 `messageBus.send(...)` 后回 **202 + `{ok:true}`** —— 一张兑现不了的收条。
+        // daemon 侧**不存在 agent 执行循环**（`AgentManager` 纯持久化，`src/daemon/*.ts` 里
+        // `SubAgent`/`spawn` 零命中），所以进程内没有任何东西会去读这条消息；而真正在用的
+        // 那条总线（`src/agent/message-bus.ts`）由子代理 / workflow 用 `bg-…` 那套 id 投递，
+        // 与这里的 `agent-<uuid8>` **不同一个 id 空间**，改投它也找不到人。
+        // 202 在这里是有害的：调用方据此认为话已送达，于是不再重试、也不再报错。
+        // 报 501 并给出替代路径 —— 只说「不支持」会让调用方反复重试同一件事。
+        return json(
+          {
+            ok: false,
+            error:
+              'Agent messaging is not implemented on the daemon: this build has no agent ' +
+              'execution loop, so nothing would receive the message. Use ' +
+              'POST /api/v1/sessions/:id/prompt to send work to a session instead.',
+          },
+          { status: 501 },
+        )
       }
 
       // ── Goals (Phase 4 — service-backed) ────────────
@@ -806,7 +811,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
               {
                 method: 'POST',
                 path: '/api/v1/agents/:id/message',
-                description: 'Send message to an agent',
+                description: 'Not implemented — always 501; use POST /api/v1/sessions/:id/prompt',
               },
               { method: 'GET', path: '/api/v1/goals', description: 'List goals for a session' },
               { method: 'POST', path: '/api/v1/goals', description: 'Create a goal' },

package/src/i18n-core/locales/en-US.json

@@ -996,8 +996,9 @@
   "errors": {
     "tool_denied_deny_rule": "Tool \"{name}\" blocked by a deny rule (\"{pattern}\"). Deny rules override permission mode — try a different approach, or drop the rule with: /permissions remove \"{pattern}\"",
     "tool_denied_ask_rule": "Tool \"{name}\" requires approval (ask rule: \"{pattern}\"). Approve when prompted, or stop being asked with: /permissions allow \"{pattern}\"",
-    "tool_denied_mode": "Tool \"{name}\" requires approval under \"{mode}\" mode. Press Shift+Tab to switch permission mode, or stop being asked with: /permissions allow \"{name}\" (or a narrower \"{name}(arg)\")",
-    "tool_denied_classifier": "Tool \"{name}\" was blocked in auto mode by the permission classifier ({reason}). This is a policy decision, not a failure — switching modes will not change it, and repeating the identical call returns the same ruling. Change the call so it no longer trips the rule, or allow it outright with: /permissions allow \"{name}\"",
+    "tool_denied_mode": "Tool \"{name}\" requires approval under \"{mode}\" mode. Press Shift+Tab to switch permission mode, or stop being asked with: /permissions allow \"{name}\" (or a narrower \"{name}(arg)\") Treat this denial as covering the outcome, not only this exact command.",
+    "tool_denied_classifier": "Tool \"{name}\" was blocked in auto mode by the permission classifier ({reason}). This is a policy decision, not a failure — switching modes will not change it, and repeating the identical call returns the same ruling. Change the call so it no longer trips the rule, or allow it outright with: /permissions allow \"{name}\" Treat this denial as covering the outcome, not only this exact command.",
+    "tool_denied_dangerous_rm": "Tool \"{name}\" was refused: this is a recursive rm whose target is not a path written in the command (\"{target}\"). The target is produced when the command runs, so neither an allow rule nor the permission mode can bound what it deletes. Name the directory literally instead — `rm -rf node_modules` rather than `rm -rf \"$(pwd)\"` — and treat this refusal as covering the outcome, not only this exact spelling. To turn this check off: MIPHAM_DISABLE_DANGEROUS_RM_PROMPT=1",
     "tool_denied_classifier_unavailable": "Tool \"{name}\" was held back because the auto-mode classifier could not be reached or its answer could not be read ({reason}). This is NOT a policy decision — the call was never judged, and retrying is appropriate. If this keeps happening, switch modes with Shift+Tab.",
     "tool_blocked": "Tool \"{name}\" blocked by hook",
     "user_input_blocked": "User input blocked by hook.",
@@ -1020,6 +1021,8 @@
     "max_tool_turns": "Max tool-calling turns ({max}) reached. Some tool calls were not executed.",
     "max_tool_turns_warning": "You've reached the maximum of {max} tool-calling rounds. {pending} tool call(s) were not executed. Please summarize what you found so far and any next steps the user should take.",
     "turn_timeout": "Task produced no substantial output for {minutes} minutes and was stopped. Break the task into smaller steps or clarify the next step, then retry.",
+    "turn_truncated": "The response was cut off mid-turn, not finished — the provider stopped at its output limit or the connection closed.",
+    "stop_hook_budget_spent": "The Stop hook asked for more work (\"{reason}\"), but this turn has used all {max} of its tool-calling rounds — stopping here. Send another message to continue.",
     "mcp_not_connected": "Error: MCP server \"{server}\" not connected",
     "mcp_tool_error": "MCP tool error: {error}",
     "mcp_no_connection": "No connection for \"{name}\""

package/src/i18n-core/locales/zh-CN.json

@@ -996,8 +996,9 @@
   "errors": {
     "tool_denied_deny_rule": "工具 \"{name}\" 被拒绝规则（\"{pattern}\"）阻止。拒绝规则优先于权限模式 — 请改用其他方式，或移除该规则：/permissions remove \"{pattern}\"",
     "tool_denied_ask_rule": "工具 \"{name}\" 需要批准（ask 规则：\"{pattern}\"）。请在提示时批准，或不再询问：/permissions allow \"{pattern}\"",
-    "tool_denied_mode": "工具 \"{name}\" 在 \"{mode}\" 模式下需要批准。按 Shift+Tab 切换权限模式，或不再询问：/permissions allow \"{name}\"（更窄的 \"{name}(arg)\" 亦可）",
-    "tool_denied_classifier": "工具 \"{name}\" 在 auto 模式下被权限分类器拦下（{reason}）。这是策略裁决、不是故障 —— 切换模式不会改变它，把同一次调用原样重发也只会得到同一个裁决。请改变这次调用使其不再触犯该规则，或直接放行：/permissions allow \"{name}\"",
+    "tool_denied_mode": "工具 \"{name}\" 在 \"{mode}\" 模式下需要批准。按 Shift+Tab 切换权限模式，或不再询问：/permissions allow \"{name}\"（更窄的 \"{name}(arg)\" 亦可） 请把这次拒绝理解为对结果本身的禁止，而不只是这一条命令。",
+    "tool_denied_classifier": "工具 \"{name}\" 在 auto 模式下被权限分类器拦下（{reason}）。这是策略裁决、不是故障 —— 切换模式不会改变它，把同一次调用原样重发也只会得到同一个裁决。请改变这次调用使其不再触犯该规则，或直接放行：/permissions allow \"{name}\" 请把这次拒绝理解为对结果本身的禁止，而不只是这一条命令。",
+    "tool_denied_dangerous_rm": "工具 \"{name}\" 被拒绝：这是一条递归 rm，其目标并非命令里写出的路径（\"{target}\"）。该目标要到命令运行时才产生，所以任何放行规则与权限模式都无法界定它会删掉什么。请改为字面写出目录名 —— 用 `rm -rf node_modules` 而不是 `rm -rf \"$(pwd)\"` —— 并把这次拒绝理解为对结果本身的禁止，而不只是这一种写法。关闭此检查：MIPHAM_DISABLE_DANGEROUS_RM_PROMPT=1",
     "tool_denied_classifier_unavailable": "工具 \"{name}\" 被暂缓：auto 模式的分类器不可达，或其回复无法解析（{reason}）。这**不是**策略裁决 —— 该调用从未被裁决，重试是恰当的。若持续发生，按 Shift+Tab 切换模式。",
     "tool_blocked": "工具 \"{name}\" 被钩子拦截",
     "user_input_blocked": "用户输入被钩子拦截。",
@@ -1020,6 +1021,8 @@
     "max_tool_turns": "超出最大工具调用轮次（{max}）。部分工具调用未执行。",
     "max_tool_turns_warning": "已达到最大 {max} 轮工具调用。{pending} 个工具调用未执行。请总结当前发现及后续步骤。",
     "turn_timeout": "任务已超过 {minutes} 分钟无实质产出，已自动停止。建议拆分任务或明确下一步后重新发起。",
+    "turn_truncated": "回复写到一半就断了，不是正常写完 —— 提供商到了输出上限，或连接被关闭。",
+    "stop_hook_budget_spent": "Stop 钩子要求继续（{reason}），但本轮 {max} 轮工具调用已用尽 —— 就此停下。再发一条消息即可继续。",
     "mcp_not_connected": "错误：MCP 服务器 \"{server}\" 未连接",
     "mcp_tool_error": "MCP 工具错误：{error}",
     "mcp_no_connection": "未找到 \"{name}\" 的连接"

package/src/index.tsx

@@ -21,7 +21,7 @@ import {
   discoverSessions,
 } from './agent/cross-session/discovery'
 import { bootstrapProviders } from './providers/bootstrap'
-import { InstructionsLoader } from './core/instructions'
+import { InstructionsLoader, formatInstructionSizeNotice } from './core/instructions'
 import { loadSessionMemories, getMemoryManager } from './core/memory/memory-loader'
 import { ContextManager } from './core/context'
 import { PrefixCacheTracker } from './core/context-token'
@@ -44,6 +44,7 @@ import { mountLlm, LLM_KEY } from './providers/llm'
 import { mountConstitution, createConstitution } from './core/constitution-seam'
 import { ConstitutionLoader } from './core/constitution-loader'
 import { McpClient } from './mcp/client'
+import { buildMcpInstructionsBlock } from './mcp/instructions'
 import { registerMcpServerTools, syncMcpToolsOnChange } from './mcp/registry'
 import { formatMcpConnectFailures, type McpConnectFailure } from './mcp/connect-failures'
 import { AgentRegistry } from './agent/agent-registry'
@@ -58,7 +59,7 @@ import { getWorkspaceTrust, warnProjectHooksSkipped } from './core/workspace-tru
 import { ARTIFACT_PORT, MIPHAM_DIR } from './shared/constants'
 import { artifactsRoot } from './artifacts/paths'
 import { AgentViewManager } from './agent-view/agent-view-manager'
-import { AgentViewDashboard } from './agent-view/dashboard'
+import { AgentsStandalone } from './agent-view/agents-standalone'
 import { createT } from './i18n-core/t'
 import { detectLocale } from './i18n-core/detect'
 import { I18nProvider } from './i18n-context'
@@ -380,11 +381,7 @@ export async function runApp(options: RunOptions): Promise<void> {
   if (args[0] === 'agents') {
     const agentViewManager = new AgentViewManager()
     const { waitUntilExit } = render(
-      <AgentViewDashboard
-        manager={agentViewManager}
-        onAttach={() => {}}
-        onExit={() => process.exit(0)}
-      />,
+      <AgentsStandalone manager={agentViewManager} onExit={() => process.exit(0)} />,
       { exitOnCtrlC: false },
     )
     await waitUntilExit()
@@ -476,6 +473,11 @@ export async function runApp(options: RunOptions): Promise<void> {
   const instructions = new InstructionsLoader()
   instructions.loadAll(process.cwd())
 
+  // 指令体积提示：**按总量**说话（单文件都不大也可能一起挤占上下文）。
+  // 计数读的是真正会被发出去的那份投影（见 `instructionPartText`），不是磁盘上的字节。
+  const sizeNotice = formatInstructionSizeNotice(instructions.sizeReport())
+  if (sizeNotice) console.log(`\n${sizeNotice}\n`)
+
   // 空目录提示：愣建文件夹时温和提醒走 mipham init，而非默默开始（寒暄克制——一句即可）
   const { isEmptyProject } = await import('./core/project-scaffold')
   if (isEmptyProject(process.cwd())) {
@@ -555,6 +557,14 @@ export async function runApp(options: RunOptions): Promise<void> {
   // 这里接的是 live `permission` —— 同一实例也交给引擎去执行，故下一次请求就与新档一致。
   context.setPermissionContextSource(() => instructions.buildPermissionBlock(permission.getMode()))
 
+  // MCP server 自带的 `instructions` 走同一条读时派生的路，理由比权限段更硬：server 是**启动后
+  // 异步连上**的（见下方 `connectMcpServers`），而提示在这一刻就建好了。组装时烘进去的话，
+  // 本次会话里后连上的 server 永远进不了提示 —— 用户只能重启。读 `/listConnections()` 是
+  // live 的，连上一个下一次请求就带上。
+  context.setMcpInstructionsSource(() =>
+    buildMcpInstructionsBlock(McpClient.getInstance().listConnections()),
+  )
+
   // Adaptive memory budget: scale with model's context window
   getMemoryManager().setContextWindow(modelContextWindow)