@miphamai/cli 0.85.4 → 0.85.6

package/src/providers/openai-compat.ts

@@ -38,6 +38,10 @@ export class OpenAICompatProvider implements ProviderInstance {
         Authorization: `Bearer ${apiKey}`,
       },
       body: JSON.stringify(body),
+      // The caller's cancellation (e.g. `self-critique`'s 2s budget) has to reach
+      // the transport, or it is a no-op: `fetch-utils` only combines a caller
+      // signal when this field exists.
+      signal: req.signal,
     })
 
     if (!response.ok) {
@@ -63,136 +67,147 @@ export class OpenAICompatProvider implements ProviderInstance {
     // (DeepSeek V4 / reasoning models) aren't mistaken for a stalled connection.
     const STREAM_READ_TIMEOUT_MS = streamIdleTimeoutMs(req.effort)
 
-    while (true) {
-      let readResult: Awaited<ReturnType<typeof reader.read>>
-      let idleTimer: ReturnType<typeof setTimeout> | undefined
-      try {
-        readResult = await Promise.race([
-          reader.read(),
-          new Promise<never>((_, reject) => {
-            idleTimer = setTimeout(
-              () =>
-                reject(
-                  new Error(
-                    `Stream read timeout — no data for ${Math.round(STREAM_READ_TIMEOUT_MS / 1000)}s`,
+    // The read loop and the fallback stop share one reader, and that reader owns
+    // the connection. `engine.ts` breaks out of this generator on the ordinary
+    // `stop` chunk, and a sub-agent throws mid-stream on abort — both call
+    // `.return()`, which unwinds through here. Without this, a turn that ends
+    // normally (or is abandoned) leaves the body unread and uncancelled, so the
+    // socket can't be reused. `cancel()` on an already-errored stream rejects, and
+    // on a closed one is a no-op — the catch covers the first.
+    try {
+      while (true) {
+        let readResult: Awaited<ReturnType<typeof reader.read>>
+        let idleTimer: ReturnType<typeof setTimeout> | undefined
+        try {
+          readResult = await Promise.race([
+            reader.read(),
+            new Promise<never>((_, reject) => {
+              idleTimer = setTimeout(
+                () =>
+                  reject(
+                    new Error(
+                      `Stream read timeout — no data for ${Math.round(STREAM_READ_TIMEOUT_MS / 1000)}s`,
+                    ),
                   ),
-                ),
-              STREAM_READ_TIMEOUT_MS,
-            )
-          }),
-        ])
-      } catch (err) {
-        yield { type: 'error', error: `Stream stalled: ${String(err)}` }
-        return
-      } finally {
-        if (idleTimer) clearTimeout(idleTimer)
-      }
-      const { done, value } = readResult
-      if (done) break
-
-      buffer += decoder.decode(value, { stream: true })
-      const lines = buffer.split('\n')
-      buffer = lines.pop() || ''
-
-      for (const line of lines) {
-        const trimmed = line.trim()
-        if (!trimmed || !trimmed.startsWith('data: ')) continue
-        const data = trimmed.slice(6)
-        if (data === '[DONE]') {
-          // Emit any pending tool calls before stopping
-          for (const [, tc] of pendingToolCalls) {
-            if (!tc.name) continue // drop malformed tool call (missing name)
-            yield {
-              type: 'tool_use',
-              toolUse: {
+                STREAM_READ_TIMEOUT_MS,
+              )
+            }),
+          ])
+        } catch (err) {
+          yield { type: 'error', error: `Stream stalled: ${String(err)}` }
+          return
+        } finally {
+          if (idleTimer) clearTimeout(idleTimer)
+        }
+        const { done, value } = readResult
+        if (done) break
+
+        buffer += decoder.decode(value, { stream: true })
+        const lines = buffer.split('\n')
+        buffer = lines.pop() || ''
+
+        for (const line of lines) {
+          const trimmed = line.trim()
+          if (!trimmed || !trimmed.startsWith('data: ')) continue
+          const data = trimmed.slice(6)
+          if (data === '[DONE]') {
+            // Emit any pending tool calls before stopping
+            for (const [, tc] of pendingToolCalls) {
+              if (!tc.name) continue // drop malformed tool call (missing name)
+              yield {
                 type: 'tool_use',
-                id: tc.id || `call_${Date.now()}`,
-                name: tc.name,
-                input: this.safeParseJson(tc.arguments),
-              },
+                toolUse: {
+                  type: 'tool_use',
+                  id: tc.id || `call_${Date.now()}`,
+                  name: tc.name,
+                  input: this.safeParseJson(tc.arguments),
+                },
+              }
             }
+            yield { type: 'stop', reasoning_content: reasoningContent }
+            return
           }
-          yield { type: 'stop', reasoning_content: reasoningContent }
-          return
-        }
 
-        try {
-          const parsed = JSON.parse(data)
-          const choice = parsed.choices?.[0]
-
-          // Capture token usage when available (final chunk with stream_options.include_usage)
-          if (parsed.usage) {
-            yield {
-              type: 'usage',
-              inputTokens: parsed.usage.prompt_tokens,
-              outputTokens: parsed.usage.completion_tokens,
+          try {
+            const parsed = JSON.parse(data)
+            const choice = parsed.choices?.[0]
+
+            // Capture token usage when available (final chunk with stream_options.include_usage)
+            if (parsed.usage) {
+              yield {
+                type: 'usage',
+                inputTokens: parsed.usage.prompt_tokens,
+                outputTokens: parsed.usage.completion_tokens,
+              }
             }
-          }
 
-          if (!choice) continue
+            if (!choice) continue
 
-          const delta = choice.delta
+            const delta = choice.delta
 
-          if (delta?.tool_calls) {
-            for (const tc of delta.tool_calls) {
-              const idx = tc.index ?? 0
-              const pending = pendingToolCalls.get(idx) || {
-                id: '',
-                name: '',
-                arguments: '',
-              }
+            if (delta?.tool_calls) {
+              for (const tc of delta.tool_calls) {
+                const idx = tc.index ?? 0
+                const pending = pendingToolCalls.get(idx) || {
+                  id: '',
+                  name: '',
+                  arguments: '',
+                }
 
-              if (tc.id) pending.id = tc.id
-              if (tc.function?.name) pending.name = tc.function.name
-              if (tc.function?.arguments) pending.arguments += tc.function.arguments
+                if (tc.id) pending.id = tc.id
+                if (tc.function?.name) pending.name = tc.function.name
+                if (tc.function?.arguments) pending.arguments += tc.function.arguments
 
-              pendingToolCalls.set(idx, pending)
+                pendingToolCalls.set(idx, pending)
+              }
             }
-          }
 
-          if (delta?.content) {
-            yield { type: 'text', content: delta.content }
-          }
+            if (delta?.content) {
+              yield { type: 'text', content: delta.content }
+            }
 
-          if (delta?.reasoning_content) {
-            reasoningContent += delta.reasoning_content
-          }
+            if (delta?.reasoning_content) {
+              reasoningContent += delta.reasoning_content
+            }
 
-          if (choice.finish_reason === 'tool_calls') {
-            // Emit fully accumulated tool calls
-            for (const [, tc] of pendingToolCalls) {
-              if (!tc.name) continue // drop malformed tool call (missing name)
-              yield {
-                type: 'tool_use',
-                toolUse: {
+            if (choice.finish_reason === 'tool_calls') {
+              // Emit fully accumulated tool calls
+              for (const [, tc] of pendingToolCalls) {
+                if (!tc.name) continue // drop malformed tool call (missing name)
+                yield {
                   type: 'tool_use',
-                  id: tc.id || `call_${Date.now()}`,
-                  name: tc.name,
-                  input: this.safeParseJson(tc.arguments),
-                },
+                  toolUse: {
+                    type: 'tool_use',
+                    id: tc.id || `call_${Date.now()}`,
+                    name: tc.name,
+                    input: this.safeParseJson(tc.arguments),
+                  },
+                }
               }
+              pendingToolCalls.clear()
             }
-            pendingToolCalls.clear()
-          }
 
-          if (choice.finish_reason === 'stop') {
-            yield { type: 'stop', reasoning_content: reasoningContent }
-          }
+            if (choice.finish_reason === 'stop') {
+              yield { type: 'stop', reasoning_content: reasoningContent }
+            }
 
-          if (choice.finish_reason === 'length') {
-            // Truncated: the accumulated tool calls were cut off mid-arguments, so
-            // their JSON is incomplete. Drop them rather than dispatching a broken
-            // call, and clear the map so the `[DONE]` handler can't emit them either.
-            pendingToolCalls.clear()
-            yield { type: 'stop', reasoning_content: reasoningContent, truncated: true }
+            if (choice.finish_reason === 'length') {
+              // Truncated: the accumulated tool calls were cut off mid-arguments, so
+              // their JSON is incomplete. Drop them rather than dispatching a broken
+              // call, and clear the map so the `[DONE]` handler can't emit them either.
+              pendingToolCalls.clear()
+              yield { type: 'stop', reasoning_content: reasoningContent, truncated: true }
+            }
+          } catch {
+            // skip unparseable chunks
           }
-        } catch {
-          // skip unparseable chunks
         }
       }
-    }
 
-    yield { type: 'stop', reasoning_content: reasoningContent }
+      yield { type: 'stop', reasoning_content: reasoningContent }
+    } finally {
+      await reader.cancel().catch(() => {})
+    }
   }
 
   async listModels(): Promise<ModelInfo[]> {

package/src/security/dangerous-rm.ts

@@ -0,0 +1,192 @@
+/**
+ * Recursive `rm` whose target cannot be read off the command text.
+ *
+ * `rm -rf node_modules` names what it deletes. `rm -rf "$(pwd)"` does not — the
+ * target is produced at run time, so no allow rule, no mode and no reviewer can
+ * see how far the deletion reaches.
+ *
+ * This is deliberately **not** a blocklist of dangerous paths. Those already
+ * exist (`tools/exec/bash.ts` BLOCKED_PATTERNS refuses `/`, `~`, `*`, `.` and
+ * absolute paths). What is left uncovered is the case where the *path is not in
+ * the text at all* — and that case is invisible to every string-matching guard,
+ * which is why it has to be recognised structurally instead.
+ *
+ * Judged on every command line inside the input, via the same `flattenCommand`
+ * the deny-rule path uses: reading one normalization while the deny rules read
+ * another is how a guard fires on one spelling and not on its twin.
+ */
+
+import { flattenCommand } from '../core/permission-rules'
+
+export type DangerousRmKind =
+  /** The target is led by command-substitution output: `rm -rf "$(pwd)"`. */
+  | 'substitution'
+  /** A variable plus one top-level directory name: `rm -rf $ROOT/usr`. */
+  | 'variable-top-level'
+  /** The target is anchored to a working-directory variable: `rm -rf $PWD`. */
+  | 'cwd-derived'
+  /** Nothing but backslashes: `rm -rf \`. */
+  | 'backslash-only'
+
+export interface DangerousRm {
+  kind: DangerousRmKind
+  /** The offending target, with its surrounding quotes stripped. */
+  target: string
+}
+
+/**
+ * Variables whose value is the directory the shell is in.
+ *
+ * The danger is not an unknown value — it is that the value is *movable*: an
+ * earlier segment of the same command line (`cd /tmp && …`) decides it, so the
+ * target is anchored to whatever directory the command happens to reach.
+ */
+const CWD_VARS = new Set(['PWD', 'OLDPWD'])
+
+/**
+ * Directory names that sit at the filesystem root.
+ *
+ * These are what make an empty variable dangerous. If `$VAR` is unset, the shell
+ * drops it and `rm -rf $VAR/usr` runs as `rm -rf /usr` — the variable does not
+ * fail loudly, it *disappears*, and what is left behind is an absolute path to a
+ * system directory. `$VAR/node_modules` collapsing to `/node_modules` is not in
+ * that class, so the directory name is what decides, not the variable.
+ */
+const TOP_LEVEL_DIRS = new Set([
+  'bin',
+  'boot',
+  'dev',
+  'etc',
+  'home',
+  'lib',
+  'lib64',
+  'opt',
+  'proc',
+  'root',
+  'run',
+  'sbin',
+  'srv',
+  'sys',
+  'tmp',
+  'usr',
+  'var',
+])
+
+/** Strip one layer of matching quotes — `"$(pwd)"` and `$(pwd)` are one target. */
+function stripQuotes(s: string): string {
+  if (s.length < 2) return s
+  const first = s[0]
+  const last = s[s.length - 1]
+  if ((first === '"' && last === '"') || (first === "'" && last === "'")) return s.slice(1, -1)
+  return s
+}
+
+/**
+ * Split an argument region into operands, keeping a quoted run or a `$(…)`
+ * substitution whole.
+ *
+ * Plain whitespace splitting is not enough here, and it fails in the direction
+ * that matters: `rm -rf "$(git rev-parse --show-toplevel)"` tokenizes to
+ * `['"$(git', 'rev-parse', '--show-toplevel)"']`, so the target never reads as a
+ * substitution at all. The cases this guard exists to catch are exactly the ones
+ * that contain spaces.
+ */
+function splitOperands(args: string): string[] {
+  const out: string[] = []
+  let cur = ''
+  let quote: string | null = null
+  let depth = 0
+
+  for (let i = 0; i < args.length; i++) {
+    const ch = args[i]!
+
+    if (quote) {
+      cur += ch
+      if (ch === quote) quote = null
+      continue
+    }
+    if (ch === '"' || ch === "'" || ch === '`') {
+      quote = ch
+      cur += ch
+      continue
+    }
+    if (ch === '$' && args[i + 1] === '(') {
+      depth++
+      cur += '$('
+      i++
+      continue
+    }
+    if (depth > 0) {
+      if (ch === ')') depth--
+      cur += ch
+      continue
+    }
+    if (/\s/.test(ch)) {
+      if (cur) out.push(cur)
+      cur = ''
+      continue
+    }
+    cur += ch
+  }
+
+  if (cur) out.push(cur)
+  return out
+}
+
+/**
+ * True for an `rm` invocation carrying a recursive flag.
+ *
+ * Force (`-f`) is deliberately not required: `rm -r "$(pwd)"` deletes just as
+ * much as `rm -rf "$(pwd)"` and asks fewer questions on the way in.
+ */
+function isRecursiveRm(tokens: string[]): boolean {
+  if (tokens[0] !== 'rm') return false
+  return tokens.slice(1).some((t) => {
+    if (t === '--recursive') return true
+    // A combined cluster (`-rf`, `-fr`, `-r`). A `--flag` long form is not one.
+    return /^-[A-Za-z]+$/.test(t) && t.includes('r')
+  })
+}
+
+/** Which enumerated shape (if any) this target has. */
+function classifyTarget(raw: string): DangerousRmKind | null {
+  const target = stripQuotes(raw)
+
+  if (/^\\+$/.test(target)) return 'backslash-only'
+
+  // Led by command-substitution output. A substitution *anywhere* in the target
+  // is not enough to judge, but a target that starts with one is anchored to a
+  // value decided at run time — including the prefix form, where the suffix only
+  // narrows an unknown directory to a named entry inside it.
+  const sub = target.match(/^(\$\([^)]*\)|`[^`]*`)(\/.*)?$/)
+  if (sub) return 'substitution'
+
+  const m = target.match(/^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?(\/\S*)?$/)
+  if (!m) return null
+  const name = m[1]!
+  const rest = m[2]
+  if (CWD_VARS.has(name)) return 'cwd-derived'
+
+  // A variable followed by exactly one more segment, and that segment is a
+  // filesystem-root directory name. Deeper paths are a named subdirectory, which
+  // is the ordinary case this must not refuse.
+  if (rest) {
+    const segments = rest.split('/').filter(Boolean)
+    if (segments.length === 1 && TOP_LEVEL_DIRS.has(segments[0]!)) return 'variable-top-level'
+  }
+  return null
+}
+
+/** Return the first unbounded recursive-`rm` target in `command`, or `null`. */
+export function detectDangerousRm(command: string): DangerousRm | null {
+  for (const segment of flattenCommand(command)) {
+    const tokens = splitOperands(segment)
+    if (!isRecursiveRm(tokens)) continue
+    for (const token of tokens.slice(1)) {
+      if (token.startsWith('-')) continue
+      const kind = classifyTarget(token)
+      if (kind) return { kind, target: stripQuotes(token) }
+    }
+  }
+  return null
+}

package/src/shared/arg-validation.ts

@@ -47,6 +47,8 @@ const KNOWN_FLAGS = [
   '--safe-mode',
   '--resume',
   '--permission',
+  '--provider',
+  '--model',
 ]
 
 /**
@@ -60,8 +62,16 @@ const KNOWN_FLAGS = [
  * `--permission` is here for the same reason and for one more: `mipham attach <id>
  * --permission plan` reads the session id through `firstPositional`, and without this
  * entry it would have taken `plan` for a session id.
+ *
+ * `--provider`/`--model` are the same defect a third time, and here it was *measured*
+ * rather than reasoned about: both shipped IDE integrations build
+ * `mipham --provider <id> --model <id>` from their settings (`infrastructure/vscode/
+ * extension.js`, `MiphamAction.kt`), and that command was answered with
+ * `Unknown command: mipham deepseek` — the provider *value* blamed, the flag that was
+ * actually wrong never mentioned, exit 1, no CLI. Their values are open (a provider may
+ * be user-defined), so — unlike `--permission` — this module owns only their spelling.
  */
-const VALUE_FLAGS = ['--resume', '--permission']
+const VALUE_FLAGS = ['--resume', '--permission', '--provider', '--model']
 
 /**
  * The first token that would be read as a command, skipping flags and the values

package/src/shared/constants.ts

@@ -95,6 +95,24 @@ export const DEFAULT_PROVIDERS: ProviderConfig[] = [
         vision: true,
         status: 'active',
       },
+      {
+        id: 'claude-fable-5-1',
+        name: 'Claude Fable 5.1',
+        providerId: 'anthropic',
+        contextWindow: 1_000_000,
+        maxOutput: 128_000,
+        vision: true,
+        status: 'active',
+      },
+      {
+        id: 'claude-opus-5-5',
+        name: 'Claude Opus 5.5',
+        providerId: 'anthropic',
+        contextWindow: 1_000_000,
+        maxOutput: 128_000,
+        vision: true,
+        status: 'active',
+      },
     ],
   },
   {

package/src/shared/deleted-cwd.ts

@@ -1,6 +1,6 @@
 /**
  * Detection and messaging for the "current working directory was deleted"
- * startup failure.
+ * failure — at startup, and mid-session.
  *
  * `process.cwd()` throws `ENOENT` when the directory the process was launched
  * from no longer exists (e.g. a removed git worktree). The CLI entry checks
@@ -8,6 +8,8 @@
  * error surface as a raw crash dump (matches Claude Code 2.1.239).
  */
 
+import { existsSync } from 'node:fs'
+
 /** True when `err` is the ENOENT thrown by `process.cwd()` on a deleted cwd. */
 export function isDeletedCwdError(err: unknown): boolean {
   if (!(err instanceof Error)) return false
@@ -24,3 +26,46 @@ export function deletedCwdMessage(): string {
     `Change to a valid directory and run \`mipham\` again.`
   )
 }
+
+/**
+ * `dir` (default `process.cwd()`) if it still exists, otherwise `null`.
+ *
+ * The launch-time check above covers a directory that was already gone when the
+ * process started. A directory deleted *while* the session runs reaches the same
+ * state, and neither runtime reports it on its own:
+ *
+ * - Node throws `ENOENT` from `process.cwd()` — but from inside whatever call
+ *   site happens to touch it first, so the message names the wrong thing;
+ * - Bun does not throw at all. It keeps returning the path it cached at startup,
+ *   so the deleted directory arrives as an ordinary string and only fails later,
+ *   at the first syscall that uses it (`spawn /bin/sh ENOENT` blames the shell).
+ *
+ * Asking the filesystem makes both runtimes agree, and lets the caller decide
+ * what to say. An error that is not this one is not swallowed.
+ */
+export function resolveExistingCwd(dir?: string): string | null {
+  let target: string
+  try {
+    target = dir ?? process.cwd()
+  } catch (err) {
+    if (isDeletedCwdError(err)) return null
+    throw err
+  }
+  return existsSync(target) ? target : null
+}
+
+/**
+ * Guidance for a session whose working directory was deleted while it ran.
+ *
+ * `deletedCwdMessage` is read before there is a session — it tells the reader to
+ * launch the CLI. This one is read from inside a running session, by the model
+ * and the operator, so it says what is broken now and what to do instead.
+ */
+export function deletedCwdSessionMessage(): string {
+  return (
+    `The working directory for this session no longer exists — it was deleted ` +
+    `while the session was running.\n` +
+    `Tools that need a directory cannot run until the session is restarted from ` +
+    `a directory that exists.`
+  )
+}

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.85.4' as const
+export const PACKAGE_VERSION = '0.85.6' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const
@@ -56,3 +56,38 @@ export const COMPANY_NAME_ZH = '北京华安麦逄科技有限公司' as const
 
 /** 公司简称 */
 export const COMPANY_SHORT = '华安麦逄科技' as const
+
+/**
+ * 计数类常量 —— 公开面（两个官网的产品页）与文档消费的那几个数。
+ *
+ * **不要手改。** 这四个数由 `apps/cli/scripts/sync-counts.ts` 从真源产出后回写：
+ * 命令 / 提供商 / 工具在**进程内算出**（`getCommandNames()` / `DEFAULT_PROVIDERS` /
+ * `createToolRegistry()`），测试数由**一次真套件跑**的自报总数产出。
+ *
+ * 为什么要有这几个槽位（2026-09-25）：两个官网的产品页把「137 命令 · 3473 测试」
+ * 当**字面量**写死，没有真源 ⇒ 只能靠人记得去改，同一处**至少手改过 7 次**
+ * （2262 → … → 3473），而每次手改本身还会再漂。站点侧的传播链其实一直存在 ——
+ * 两站的 deploy 脚本都 `cp` 本文件覆盖自己那份 `src/config/package-info.json`
+ * —— 缺的只是**槽位**。名字/版本有槽位所以不漂，计数连槽位都没有。
+ *
+ * 守卫：`apps/cli/test/integrity/published-counts.test.ts`（三个进程内计数与落盘值
+ * 逐一对齐）；测试总数另由 CI 的 Test job 与套件自报的总数比对（硬门禁）。
+ */
+
+/** Slash 命令总数（真源：`getCommandNames().length`，`apps/cli/src/ui/commands.ts`） */
+export const SLASH_COMMAND_COUNT = 137 as const
+
+/** 内置提供商总数（真源：`DEFAULT_PROVIDERS.length`，`apps/cli/src/shared/constants.ts`） */
+export const PROVIDER_COUNT = 12 as const
+
+/** 已注册工具总数（真源：`createToolRegistry().size`，`apps/cli/src/tools/index.ts`） */
+export const TOOL_COUNT = 31 as const
+
+/**
+ * 测试总数（真源：**一次真套件跑**的自报总数）。
+ *
+ * 取**总数**而不是 `passed`：本机（macOS）与 CI（Linux）的 passed/skipped 切分**不同**
+ * —— `test/e2e/full-pipeline.test.ts` 在 Linux 上整文件 skip、在 macOS 上跑 ——
+ * 但**总数相同**（两边都把被 skip 的算进去）。
+ */
+export const TEST_COUNT = 3506 as const

package/src/shared/types.ts

@@ -278,6 +278,14 @@ export interface HookConfig {
 export interface HookDefinition {
   event: HookEvent
   toolName?: string
+  /**
+   * Who declared this hook, when it was not the operator — a plugin name, today.
+   *
+   * The operator is no longer the only author of the hooks that fire, and without
+   * this the engine cannot tell them apart: a failure message names only a command,
+   * health is tracked per key, and removal has nothing to scope to.
+   */
+  source?: string
   handler: (context: HookContext) => Promise<HookResult>
 }