@miphamai/cli 0.85.4 → 0.85.5

package/src/providers/fetch-utils.ts

@@ -16,6 +16,58 @@ export interface FetchWithRetryOptions {
 
 const RETRYABLE_STATUSES = new Set([429, 500, 502, 503, 504])
 
+/**
+ * Upper bound on a server-supplied `Retry-After`, in ms.
+ *
+ * The header is a *request*, not a contract: a 5xx answering `Retry-After: 3600`
+ * used to park the CLI in `sleep` for a full hour with nothing on screen. The
+ * user cannot cancel what they cannot see, so the wait is capped and the reason
+ * is left in the comment rather than the terminal.
+ */
+export const RETRY_AFTER_MAX_MS = 60_000
+
+/**
+ * Lower bound on a server-supplied `Retry-After`, in ms.
+ *
+ * `Retry-After: 0` is a real thing servers send, and honouring it literally
+ * means retrying the instant the previous attempt failed — a hammering loop
+ * dressed up as politeness. Any present-but-tiny value lands here instead.
+ */
+const RETRY_AFTER_MIN_MS = 1_000
+
+/**
+ * Delay before the next retry attempt.
+ *
+ * `Retry-After` is honoured when it is parseable, clamped to
+ * `[RETRY_AFTER_MIN_MS, RETRY_AFTER_MAX_MS]`, and **ignored in favour of
+ * exponential backoff when it is not** — an unparseable header must not become
+ * `sleep(NaN)`, which `setTimeout` reads as 0 (the same back-to-back retry as
+ * `Retry-After: 0`, but silent).
+ *
+ * Accepts both RFC 9110 forms: delta-seconds and an HTTP-date.
+ */
+export function retryDelayMs(
+  retryAfter: string | null,
+  attempt: number,
+  baseDelay: number,
+): number {
+  const backoff = baseDelay * Math.pow(2, attempt)
+  if (retryAfter === null) return backoff
+
+  const header = retryAfter.trim()
+  const seconds = parseInt(header, 10)
+  let requested: number
+  if (!Number.isNaN(seconds)) {
+    requested = seconds * 1000
+  } else {
+    const at = Date.parse(header)
+    if (Number.isNaN(at)) return backoff // unparseable → backoff, never a zero sleep
+    requested = at - Date.now()
+  }
+
+  return Math.min(Math.max(requested, RETRY_AFTER_MIN_MS), RETRY_AFTER_MAX_MS)
+}
+
 function isRetryableError(err: unknown): boolean {
   if (err instanceof DOMException && err.name === 'AbortError') return false
   return true
@@ -51,11 +103,7 @@ export async function fetchWithRetry(
 
       // 429 / 5xx → retry
       if (RETRYABLE_STATUSES.has(response.status) && attempt < maxRetries) {
-        const retryAfter = response.headers.get('Retry-After')
-        const delay = retryAfter
-          ? parseInt(retryAfter, 10) * 1000
-          : baseDelay * Math.pow(2, attempt)
-        await sleep(delay)
+        await sleep(retryDelayMs(response.headers.get('Retry-After'), attempt, baseDelay))
         continue
       }
 

package/src/security/dangerous-rm.ts

@@ -0,0 +1,192 @@
+/**
+ * Recursive `rm` whose target cannot be read off the command text.
+ *
+ * `rm -rf node_modules` names what it deletes. `rm -rf "$(pwd)"` does not — the
+ * target is produced at run time, so no allow rule, no mode and no reviewer can
+ * see how far the deletion reaches.
+ *
+ * This is deliberately **not** a blocklist of dangerous paths. Those already
+ * exist (`tools/exec/bash.ts` BLOCKED_PATTERNS refuses `/`, `~`, `*`, `.` and
+ * absolute paths). What is left uncovered is the case where the *path is not in
+ * the text at all* — and that case is invisible to every string-matching guard,
+ * which is why it has to be recognised structurally instead.
+ *
+ * Judged on every command line inside the input, via the same `flattenCommand`
+ * the deny-rule path uses: reading one normalization while the deny rules read
+ * another is how a guard fires on one spelling and not on its twin.
+ */
+
+import { flattenCommand } from '../core/permission-rules'
+
+export type DangerousRmKind =
+  /** The target is led by command-substitution output: `rm -rf "$(pwd)"`. */
+  | 'substitution'
+  /** A variable plus one top-level directory name: `rm -rf $ROOT/usr`. */
+  | 'variable-top-level'
+  /** The target is anchored to a working-directory variable: `rm -rf $PWD`. */
+  | 'cwd-derived'
+  /** Nothing but backslashes: `rm -rf \`. */
+  | 'backslash-only'
+
+export interface DangerousRm {
+  kind: DangerousRmKind
+  /** The offending target, with its surrounding quotes stripped. */
+  target: string
+}
+
+/**
+ * Variables whose value is the directory the shell is in.
+ *
+ * The danger is not an unknown value — it is that the value is *movable*: an
+ * earlier segment of the same command line (`cd /tmp && …`) decides it, so the
+ * target is anchored to whatever directory the command happens to reach.
+ */
+const CWD_VARS = new Set(['PWD', 'OLDPWD'])
+
+/**
+ * Directory names that sit at the filesystem root.
+ *
+ * These are what make an empty variable dangerous. If `$VAR` is unset, the shell
+ * drops it and `rm -rf $VAR/usr` runs as `rm -rf /usr` — the variable does not
+ * fail loudly, it *disappears*, and what is left behind is an absolute path to a
+ * system directory. `$VAR/node_modules` collapsing to `/node_modules` is not in
+ * that class, so the directory name is what decides, not the variable.
+ */
+const TOP_LEVEL_DIRS = new Set([
+  'bin',
+  'boot',
+  'dev',
+  'etc',
+  'home',
+  'lib',
+  'lib64',
+  'opt',
+  'proc',
+  'root',
+  'run',
+  'sbin',
+  'srv',
+  'sys',
+  'tmp',
+  'usr',
+  'var',
+])
+
+/** Strip one layer of matching quotes — `"$(pwd)"` and `$(pwd)` are one target. */
+function stripQuotes(s: string): string {
+  if (s.length < 2) return s
+  const first = s[0]
+  const last = s[s.length - 1]
+  if ((first === '"' && last === '"') || (first === "'" && last === "'")) return s.slice(1, -1)
+  return s
+}
+
+/**
+ * Split an argument region into operands, keeping a quoted run or a `$(…)`
+ * substitution whole.
+ *
+ * Plain whitespace splitting is not enough here, and it fails in the direction
+ * that matters: `rm -rf "$(git rev-parse --show-toplevel)"` tokenizes to
+ * `['"$(git', 'rev-parse', '--show-toplevel)"']`, so the target never reads as a
+ * substitution at all. The cases this guard exists to catch are exactly the ones
+ * that contain spaces.
+ */
+function splitOperands(args: string): string[] {
+  const out: string[] = []
+  let cur = ''
+  let quote: string | null = null
+  let depth = 0
+
+  for (let i = 0; i < args.length; i++) {
+    const ch = args[i]!
+
+    if (quote) {
+      cur += ch
+      if (ch === quote) quote = null
+      continue
+    }
+    if (ch === '"' || ch === "'" || ch === '`') {
+      quote = ch
+      cur += ch
+      continue
+    }
+    if (ch === '$' && args[i + 1] === '(') {
+      depth++
+      cur += '$('
+      i++
+      continue
+    }
+    if (depth > 0) {
+      if (ch === ')') depth--
+      cur += ch
+      continue
+    }
+    if (/\s/.test(ch)) {
+      if (cur) out.push(cur)
+      cur = ''
+      continue
+    }
+    cur += ch
+  }
+
+  if (cur) out.push(cur)
+  return out
+}
+
+/**
+ * True for an `rm` invocation carrying a recursive flag.
+ *
+ * Force (`-f`) is deliberately not required: `rm -r "$(pwd)"` deletes just as
+ * much as `rm -rf "$(pwd)"` and asks fewer questions on the way in.
+ */
+function isRecursiveRm(tokens: string[]): boolean {
+  if (tokens[0] !== 'rm') return false
+  return tokens.slice(1).some((t) => {
+    if (t === '--recursive') return true
+    // A combined cluster (`-rf`, `-fr`, `-r`). A `--flag` long form is not one.
+    return /^-[A-Za-z]+$/.test(t) && t.includes('r')
+  })
+}
+
+/** Which enumerated shape (if any) this target has. */
+function classifyTarget(raw: string): DangerousRmKind | null {
+  const target = stripQuotes(raw)
+
+  if (/^\\+$/.test(target)) return 'backslash-only'
+
+  // Led by command-substitution output. A substitution *anywhere* in the target
+  // is not enough to judge, but a target that starts with one is anchored to a
+  // value decided at run time — including the prefix form, where the suffix only
+  // narrows an unknown directory to a named entry inside it.
+  const sub = target.match(/^(\$\([^)]*\)|`[^`]*`)(\/.*)?$/)
+  if (sub) return 'substitution'
+
+  const m = target.match(/^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?(\/\S*)?$/)
+  if (!m) return null
+  const name = m[1]!
+  const rest = m[2]
+  if (CWD_VARS.has(name)) return 'cwd-derived'
+
+  // A variable followed by exactly one more segment, and that segment is a
+  // filesystem-root directory name. Deeper paths are a named subdirectory, which
+  // is the ordinary case this must not refuse.
+  if (rest) {
+    const segments = rest.split('/').filter(Boolean)
+    if (segments.length === 1 && TOP_LEVEL_DIRS.has(segments[0]!)) return 'variable-top-level'
+  }
+  return null
+}
+
+/** Return the first unbounded recursive-`rm` target in `command`, or `null`. */
+export function detectDangerousRm(command: string): DangerousRm | null {
+  for (const segment of flattenCommand(command)) {
+    const tokens = splitOperands(segment)
+    if (!isRecursiveRm(tokens)) continue
+    for (const token of tokens.slice(1)) {
+      if (token.startsWith('-')) continue
+      const kind = classifyTarget(token)
+      if (kind) return { kind, target: stripQuotes(token) }
+    }
+  }
+  return null
+}

package/src/shared/constants.ts

@@ -95,6 +95,24 @@ export const DEFAULT_PROVIDERS: ProviderConfig[] = [
         vision: true,
         status: 'active',
       },
+      {
+        id: 'claude-fable-5-1',
+        name: 'Claude Fable 5.1',
+        providerId: 'anthropic',
+        contextWindow: 1_000_000,
+        maxOutput: 128_000,
+        vision: true,
+        status: 'active',
+      },
+      {
+        id: 'claude-opus-5-5',
+        name: 'Claude Opus 5.5',
+        providerId: 'anthropic',
+        contextWindow: 1_000_000,
+        maxOutput: 128_000,
+        vision: true,
+        status: 'active',
+      },
     ],
   },
   {

package/src/shared/deleted-cwd.ts

@@ -1,6 +1,6 @@
 /**
  * Detection and messaging for the "current working directory was deleted"
- * startup failure.
+ * failure — at startup, and mid-session.
  *
  * `process.cwd()` throws `ENOENT` when the directory the process was launched
  * from no longer exists (e.g. a removed git worktree). The CLI entry checks
@@ -8,6 +8,8 @@
  * error surface as a raw crash dump (matches Claude Code 2.1.239).
  */
 
+import { existsSync } from 'node:fs'
+
 /** True when `err` is the ENOENT thrown by `process.cwd()` on a deleted cwd. */
 export function isDeletedCwdError(err: unknown): boolean {
   if (!(err instanceof Error)) return false
@@ -24,3 +26,46 @@ export function deletedCwdMessage(): string {
     `Change to a valid directory and run \`mipham\` again.`
   )
 }
+
+/**
+ * `dir` (default `process.cwd()`) if it still exists, otherwise `null`.
+ *
+ * The launch-time check above covers a directory that was already gone when the
+ * process started. A directory deleted *while* the session runs reaches the same
+ * state, and neither runtime reports it on its own:
+ *
+ * - Node throws `ENOENT` from `process.cwd()` — but from inside whatever call
+ *   site happens to touch it first, so the message names the wrong thing;
+ * - Bun does not throw at all. It keeps returning the path it cached at startup,
+ *   so the deleted directory arrives as an ordinary string and only fails later,
+ *   at the first syscall that uses it (`spawn /bin/sh ENOENT` blames the shell).
+ *
+ * Asking the filesystem makes both runtimes agree, and lets the caller decide
+ * what to say. An error that is not this one is not swallowed.
+ */
+export function resolveExistingCwd(dir?: string): string | null {
+  let target: string
+  try {
+    target = dir ?? process.cwd()
+  } catch (err) {
+    if (isDeletedCwdError(err)) return null
+    throw err
+  }
+  return existsSync(target) ? target : null
+}
+
+/**
+ * Guidance for a session whose working directory was deleted while it ran.
+ *
+ * `deletedCwdMessage` is read before there is a session — it tells the reader to
+ * launch the CLI. This one is read from inside a running session, by the model
+ * and the operator, so it says what is broken now and what to do instead.
+ */
+export function deletedCwdSessionMessage(): string {
+  return (
+    `The working directory for this session no longer exists — it was deleted ` +
+    `while the session was running.\n` +
+    `Tools that need a directory cannot run until the session is restarted from ` +
+    `a directory that exists.`
+  )
+}

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.85.4' as const
+export const PACKAGE_VERSION = '0.85.5' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/types.ts

@@ -278,6 +278,14 @@ export interface HookConfig {
 export interface HookDefinition {
   event: HookEvent
   toolName?: string
+  /**
+   * Who declared this hook, when it was not the operator — a plugin name, today.
+   *
+   * The operator is no longer the only author of the hooks that fire, and without
+   * this the engine cannot tell them apart: a failure message names only a command,
+   * health is tracked per key, and removal has nothing to scope to.
+   */
+  source?: string
   handler: (context: HookContext) => Promise<HookResult>
 }
 

package/src/ui/command-picker.tsx

@@ -4,6 +4,7 @@ import TextInput from 'ink-text-input'
 import { useI18n } from '../i18n-context'
 import { getCommandList } from './commands.js'
 import { commandToken, hasInlineArgs } from './command-token.js'
+import { useKeyState } from './use-key-state'
 
 interface CommandPickerProps {
   /** Text already typed (e.g. "/", "/age") — used as initial filter */
@@ -59,7 +60,9 @@ export function CommandPicker({
   const { t } = useI18n()
   const allCommands = useMemo(() => getCommandList(), [])
   const [filter, setFilter] = useState(initialFilter)
-  const [cursorIdx, setCursorIdx] = useState(0)
+  // 光标走 `useKeyState`：一组按键可能在同一拍里到达（↓ 之后紧跟 Enter），确认时
+  // 必须读得到本次按键刚写下的那个索引，而不是上一张闭包里的。
+  const cursorIdx = useKeyState(0)
 
   // Filter commands based on user input (match on the command-name token, not the
   // full line — so "/loop 60s echo hello" still matches "/loop").
@@ -73,16 +76,16 @@ export function CommandPicker({
 
   // Reset cursor when filter changes
   useEffect(() => {
-    setCursorIdx(0)
-  }, [filter])
+    cursorIdx.set(0)
+  }, [filter, cursorIdx])
 
   // Scroll window: keep cursor in the visible range
   const scrollStart = Math.max(
     0,
-    Math.min(cursorIdx - Math.floor(maxVisible / 2), filtered.length - maxVisible),
+    Math.min(cursorIdx.value - Math.floor(maxVisible / 2), filtered.length - maxVisible),
   )
   const visible = filtered.slice(scrollStart, scrollStart + maxVisible)
-  const _adjustedCursor = cursorIdx - scrollStart
+  const _adjustedCursor = cursorIdx.value - scrollStart
 
   // Wrap cursor safely
   const safeCursor = (i: number) =>
@@ -97,7 +100,7 @@ export function CommandPicker({
       onSelect(trimmed)
       return
     }
-    const selected = filtered[cursorIdx]
+    const selected = filtered[cursorIdx.read()]
     if (selected) onSelect(selected.name)
   }
 
@@ -113,12 +116,12 @@ export function CommandPicker({
     }
 
     if (key.upArrow) {
-      setCursorIdx((prev) => safeCursor(prev - 1))
+      cursorIdx.set((prev) => safeCursor(prev - 1))
       return
     }
 
     if (key.downArrow) {
-      setCursorIdx((prev) => safeCursor(prev + 1))
+      cursorIdx.set((prev) => safeCursor(prev + 1))
       return
     }
   })
@@ -143,7 +146,7 @@ export function CommandPicker({
         )}
         {visible.map((cmd, i) => {
           const globalIdx = i + scrollStart
-          const isCursor = globalIdx === cursorIdx
+          const isCursor = globalIdx === cursorIdx.value
           const query = commandToken(filter)
           const segments = highlightMatches(cmd.name, query)
           const padLen = Math.max(0, 20 - cmd.name.length)
@@ -180,10 +183,15 @@ export function CommandPicker({
       {/* Filter input */}
       <Box>
         <Text color="cyan">/ </Text>
+        {/*
+            Enter 由本组件自己的 `useInput` 处理（那里才知道光标停在哪一行、要不要走
+            内联参数那条路）。**不要再给 TextInput 挂 `onSubmit`** —— 它会成为第二个
+            监听者，一次 Enter 变成两次提交，而 `onSelect` 的调用点接的是「提交这条
+            命令」：多出来的一遍就是命令跑两次。
+        */}
         <TextInput
           value={filter.startsWith('/') ? filter.slice(1) : filter}
           onChange={(val) => setFilter(`/${val}`)}
-          onSubmit={() => submitSelection()}
           placeholder={t('ui.command_picker.placeholder')}
         />
       </Box>

package/src/ui/commands.ts

@@ -4593,7 +4593,7 @@ const workflowsCmd: CommandHandler = async () => {
   } else {
     lines.push('')
     lines.push(`${found} workflow(s) found.`)
-    lines.push('Use /workflows <name> to run a specific workflow.')
+    lines.push('Use /workflow run <name> to run one.')
   }
 
   return { content: lines.join('\n') }

package/src/ui/config-wizard.tsx

@@ -11,6 +11,7 @@
 import React, { useState, useEffect } from 'react'
 import { Box, Text, useInput } from 'ink'
 import { useI18n } from '../i18n-context'
+import { useKeyState } from './use-key-state'
 import TextInput from 'ink-text-input'
 import { DEFAULT_PROVIDERS, OLLAMA_PRESET_MODELS } from '../shared/constants'
 import type { ModelInfo } from '../shared/types'
@@ -159,7 +160,9 @@ export function ConfigWizard({ onComplete, onSkip }: Props) {
   const [error, setError] = useState<string | null>(null)
 
   // List navigation cursor
-  const [cursor, setCursor] = useState(0)
+  // 光标走 `useKeyState`：一组按键可能在同一拍里到达（↓ 之后紧跟 Enter），确认时
+  // 必须读得到本次按键刚写下的那个索引，而不是上一张闭包里的。
+  const cursor = useKeyState(0)
 
   // Ollama
   const [ollamaModel, _setOllamaModel] = useState('')
@@ -174,7 +177,7 @@ export function ConfigWizard({ onComplete, onSkip }: Props) {
 
   // Reset cursor when step changes
   const goStep = (s: Step) => {
-    setCursor(0)
+    cursor.set(0)
     setOllamaCursor(0)
     setError(null)
     setStep(s)
@@ -265,10 +268,10 @@ export function ConfigWizard({ onComplete, onSkip }: Props) {
 
     // ── Mode selection ──
     if (step === 'mode') {
-      if (key.upArrow) setCursor((c) => (c === 0 ? 1 : 0))
-      if (key.downArrow) setCursor((c) => (c === 0 ? 1 : 0))
+      if (key.upArrow) cursor.set((c) => (c === 0 ? 1 : 0))
+      if (key.downArrow) cursor.set((c) => (c === 0 ? 1 : 0))
       if (key.return) {
-        if (cursor === 0) {
+        if (cursor.read() === 0) {
           // Cloud
           setMode('cloud')
           goStep('provider')
@@ -284,10 +287,10 @@ export function ConfigWizard({ onComplete, onSkip }: Props) {
 
     // ── Cloud provider selection ──
     if (step === 'provider') {
-      if (key.upArrow) setCursor((c) => (c > 0 ? c - 1 : providerList.length - 1))
-      if (key.downArrow) setCursor((c) => (c < providerList.length - 1 ? c + 1 : 0))
+      if (key.upArrow) cursor.set((c) => (c > 0 ? c - 1 : providerList.length - 1))
+      if (key.downArrow) cursor.set((c) => (c < providerList.length - 1 ? c + 1 : 0))
       if (key.return) {
-        const p = providerList[cursor]
+        const p = providerList[cursor.read()]
         if (p) {
           setProviderId(p.id)
           goStep('model')
@@ -299,10 +302,10 @@ export function ConfigWizard({ onComplete, onSkip }: Props) {
     // ── Cloud model selection ──
     if (step === 'model') {
       if (modelList.length === 0) return
-      if (key.upArrow) setCursor((c) => (c > 0 ? c - 1 : modelList.length - 1))
-      if (key.downArrow) setCursor((c) => (c < modelList.length - 1 ? c + 1 : 0))
+      if (key.upArrow) cursor.set((c) => (c > 0 ? c - 1 : modelList.length - 1))
+      if (key.downArrow) cursor.set((c) => (c < modelList.length - 1 ? c + 1 : 0))
       if (key.return) {
-        const m = modelList[cursor]
+        const m = modelList[cursor.read()]
         if (m) {
           setModelId(m.id)
           goStep('apikey')
@@ -381,8 +384,8 @@ export function ConfigWizard({ onComplete, onSkip }: Props) {
           </Box>
 
           <Box marginBottom={1}>
-            <Text color={cursor === 0 ? SELECTED_COLOR : undefined}>
-              {cursor === 0 ? '▶' : ' '} {t('ui.wizard.mode_cloud')}
+            <Text color={cursor.value === 0 ? SELECTED_COLOR : undefined}>
+              {cursor.value === 0 ? '▶' : ' '} {t('ui.wizard.mode_cloud')}
             </Text>
           </Box>
           <Text dimColor>
@@ -390,8 +393,8 @@ export function ConfigWizard({ onComplete, onSkip }: Props) {
           </Text>
 
           <Box marginTop={2} marginBottom={1}>
-            <Text color={cursor === 1 ? SELECTED_COLOR : undefined}>
-              {cursor === 1 ? '▶' : ' '} {t('ui.wizard.mode_local')}
+            <Text color={cursor.value === 1 ? SELECTED_COLOR : undefined}>
+              {cursor.value === 1 ? '▶' : ' '} {t('ui.wizard.mode_local')}
             </Text>
           </Box>
           <Text dimColor>{t('ui.wizard.mode_local_hint')}</Text>
@@ -410,8 +413,8 @@ export function ConfigWizard({ onComplete, onSkip }: Props) {
           </Box>
           {providerList.map((p, i) => (
             <Box key={p.id} marginBottom={1}>
-              <Text color={i === cursor ? SELECTED_COLOR : undefined}>
-                {i === cursor ? '▶' : '  '} {p.name}
+              <Text color={i === cursor.value ? SELECTED_COLOR : undefined}>
+                {i === cursor.value ? '▶' : '  '} {p.name}
               </Text>
               <Text dimColor>
                 {t('ui.wizard.provider_count', {
@@ -439,8 +442,8 @@ export function ConfigWizard({ onComplete, onSkip }: Props) {
           </Box>
           {modelList.map((m, i) => (
             <Box key={m.id} marginBottom={1}>
-              <Text color={i === cursor ? SELECTED_COLOR : undefined}>
-                {i === cursor ? '▶' : '  '} {m.name}
+              <Text color={i === cursor.value ? SELECTED_COLOR : undefined}>
+                {i === cursor.value ? '▶' : '  '} {m.name}
               </Text>
               <Text dimColor> ({m.id})</Text>
             </Box>