@miphamai/cli 0.85.5 → 0.85.7

package/src/core/rule-engine.ts

@@ -18,6 +18,23 @@ export interface ToolRule {
   enabled: boolean
 }
 
+/**
+ * 一条**能真正生效**的规则必须自带 `match`/`fix` —— 而这两个是函数，落不了盘。
+ * 判据放在这里而不是内联，是为了让「载回来的规则必须是能用的规则」只有一处定义。
+ */
+function isUsableRule(candidate: unknown): candidate is ToolRule {
+  const r = candidate as Partial<ToolRule> | null
+  return (
+    !!r &&
+    typeof r === 'object' &&
+    typeof r.id === 'string' &&
+    r.id.length > 0 &&
+    typeof r.toolName === 'string' &&
+    typeof r.match === 'function' &&
+    typeof r.fix === 'function'
+  )
+}
+
 const BUILTIN_RULES: ToolRule[] = [
   {
     id: 'rule-timeout-bash-heavy',
@@ -168,9 +185,17 @@ export class ExperienceRuleEngine {
   load(): void {
     if (!existsSync(this.storePath)) return
     try {
-      const raw = JSON.parse(readFileSync(this.storePath, 'utf-8')) as ToolRule[]
+      const parsed: unknown = JSON.parse(readFileSync(this.storePath, 'utf-8'))
+      // 形状门 —— 这一格的门比别处严，因为**这个 store 载不动一条可用的规则**：
+      // `ToolRule.match`/`fix` 是函数，`JSON.stringify` 必然丢，所以 `persist()` 写出去的
+      // 形状里不可能带回来它们。旧读法把这种条目照收，`getActiveRules()` 再把它报成
+      // active（`/rules` 面板跟着说它是活的），而 `intercept()` 里 `rule.match` 不存在
+      // → 抛 → 被那个 `try/catch` 吞成**静默惰性**。列出来是活的、实际永不触发 ——
+      // 正是本仓库反复收的那种账。收不进就是收不进：不校验形状 = 报一份假的活跃清单。
+      if (!Array.isArray(parsed)) return
       const reservedIds = new Set([...BUILTIN_RULES, ...MANAGED_RULES].map((r) => r.id))
-      for (const rule of raw) {
+      for (const rule of parsed) {
+        if (!isUsableRule(rule)) continue
         // Reject if a builtin/managed rule with the same ID exists (source rules always win)
         if (reservedIds.has(rule.id)) continue
         this.rules.push(rule)

package/src/core/self-critique.ts

@@ -3,8 +3,11 @@
  *
  * Inspired by Anthropic's RLAIF (Reinforcement Learning from AI Feedback):
  * instead of relying on human feedback loops, the AI critiques its own
- * tool calls before execution. A fast model (Flash / Qwen2.5-1.5B) performs
- * a lightweight safety & correctness check with <200ms latency.
+ * tool calls before execution. A fast model performs a lightweight safety &
+ * correctness check — but "lightweight" is about the *prompt*, not the clock:
+ * it is a full model round-trip, measured at a median ≈4s on the configured
+ * provider (see `DEFAULT_SELF_CRITIQUE_CONFIG.timeoutMs`), not the sub-200ms
+ * this comment used to claim.
  *
  * Architecture:
  *   Model generates tool call
@@ -58,7 +61,16 @@ export const DEFAULT_SELF_CRITIQUE_CONFIG: SelfCritiqueConfig = {
   enabled: false, // Opt-in by default — user enables via /crsi critique on
   threshold: 0.6,
   targetTools: ['Bash', 'Write', 'Edit', 'Agent'],
-  timeoutMs: 2000,
+  // Measured, not chosen: 30 real critiques against the configured provider
+  // (`findFastestModel` → `deepseek-v4-flash`; default model is the slower
+  // `-pro`) took min 1.85s / median 3.95s / max 17.9s, and **28 of 30 exceeded
+  // 2s** — the value this replaced. At 2s the budget would have skipped 93% of
+  // critiques, and since `critique()` fails *open* (null ⇒ the tool runs
+  // unreviewed) that failure is silent: `/crsi critique` would look enabled and
+  // do nothing. 15s keeps 90% (27/30) while still bounding a gated tool call to
+  // well under the provider's 90s stream-idle backstop. One model, one day —
+  // re-measure if the critique model changes.
+  timeoutMs: 15_000,
 }
 
 // ── Prompt Templates ──

package/src/core/session-log.ts

@@ -23,6 +23,9 @@ export type SessionEvent =
   | { type: 'context/inject'; at: number; source: string; text: string }
   | { type: 'compaction/summary'; at: number; summary: string; replacedCount: number }
   | { type: 'compaction/rewrite'; at: number; messages: Message[] }
+  // 回退（`/rewind`）。投影语义与 `compaction/rewrite` 相同（整份快照替换），但**不是压缩**：
+  // 合用一个类型会让「这份日志里哪些轮被摘要过」的答案变成错的。
+  | { type: 'rewind'; at: number; messages: Message[] }
   | { type: 'checker/decision'; at: number; toolName: string; decision: CheckerDecision }
 
 export function messageToEvents(msg: Message, at = 0): SessionEvent[] {
@@ -110,6 +113,9 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
     } else if (e.type === 'compaction/rewrite') {
       // 快照替换：整个投影重建（微压缩/截断等结构性编辑的字节级复现）
       out = structuredClone(e.messages)
+    } else if (e.type === 'rewind') {
+      // 回退同样是快照替换：整份投影重建为回退到的那一点
+      out = structuredClone(e.messages)
     }
     // 'session/start' / 'checker/decision' → 无消息（决策仅记录证据，不进投影，保字节级可逆）
   }
@@ -311,6 +317,9 @@ function isValidEvent(e: unknown): e is SessionEvent {
     case 'compaction/rewrite':
       // 快照替换：整份投影由它重建 ⇒ 元素形状与 message 事件同罪
       return Array.isArray(ev.messages) && ev.messages.every(isValidMessage)
+    case 'rewind':
+      // 同上：回退也是整份投影替换，坏元素同样会让投影崩
+      return Array.isArray(ev.messages) && ev.messages.every(isValidMessage)
     default:
       return true
   }

package/src/daemon/launch.ts

@@ -12,7 +12,7 @@
  */
 
 import { spawn, type SpawnOptions } from 'node:child_process'
-import { closeSync, mkdirSync, openSync, readFileSync, statSync } from 'node:fs'
+import { closeSync, mkdirSync, openSync, readFileSync, renameSync, statSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { miphamHome } from '../core/paths.ts'
 
@@ -141,6 +141,13 @@ const READY_TIMEOUT_MS = 10_000
 const POLL_INTERVAL_MS = 100
 /** How long `restart` waits for the *old* daemon to go before refusing. */
 const OLD_DAEMON_EXIT_TIMEOUT_MS = 10_000
+/**
+ * Bound on the daemon log, enforced by `rotateLogIfLarge`. Two files at this size
+ * are invisible on any disk it will sit on, while the reader only ever wants a tail
+ * (`tailLog` takes the last 800 bytes) — so what the bound has to preserve is not
+ * volume but *the previous generation* of a start that keeps failing.
+ */
+export const MAX_LOG_BYTES = 5 * 1024 * 1024
 
 async function defaultGetStatus(): Promise<DaemonStatusLike | null> {
   const { getDaemonStatus } = await import('./index')
@@ -157,6 +164,45 @@ function tailLog(logPath: string, maxBytes = 800): string {
   }
 }
 
+/**
+ * Bound the log the daemon is about to append to.
+ *
+ * Called before the child is spawned, which is the only moment nothing holds it:
+ * `startDetachedDaemon` returns early when a daemon is already up, so by here its
+ * pid file was gone. (A daemon that died without unlinking the pid file could still
+ * hold the old inode — its lines then land in the renamed file, which loses nothing
+ * and corrupts nothing.)
+ *
+ * **Rename, not truncate.** Either bounds the file, and the reader only wants a tail
+ * — but the case this exists for is a start that keeps failing, and there the
+ * previous generation *is* the evidence. Keeping exactly one bounds the sink at two
+ * files; `renameSync` overwrites the target, so that is also the oldest generation's
+ * cleanup. There is never a `.2`.
+ *
+ * Failing to bound is never fatal: a daemon that refuses to start because its log
+ * could not be rotated trades a slow hazard for an immediate one. And an unreadable
+ * size means the append below is about to fail loudly anyway, so `return` is not a
+ * silent degradation of anything that was working.
+ */
+export function rotateLogIfLarge(logPath: string, maxBytes: number = MAX_LOG_BYTES): void {
+  let size: number
+  try {
+    size = statSync(logPath).size
+  } catch {
+    return // no log yet (every first start)
+  }
+  if (size < maxBytes) return
+  try {
+    renameSync(logPath, `${logPath}.1`)
+  } catch (err) {
+    // Printed rather than thrown, but never swallowed: a bound that switched itself
+    // off in silence is the defect class this whole file is about.
+    process.stderr.write(
+      `⚠️  daemon 日志轮转失败，本次仍按无上限追加: ${err instanceof Error ? err.message : String(err)}\n`,
+    )
+  }
+}
+
 /**
  * Start the daemon detached and *wait until it is actually up*.
  *
@@ -177,6 +223,7 @@ export async function startDetachedDaemon(
 
   const plan = planDaemonSpawn()
   mkdirSync(dirname(plan.logPath), { recursive: true, mode: 0o700 })
+  rotateLogIfLarge(plan.logPath)
 
   let spawnError: Error | null = null
   let exitCode: number | null = null
@@ -217,9 +264,29 @@ export async function startDetachedDaemon(
       }
     }
   }
+  // The deadline is a prediction, not a fact. Probe once more before acting on
+  // it: a child that became ready inside the last poll interval is up, and
+  // reporting failure for it — then killing it — would be this module's own
+  // "success with no daemon behind it" defect wearing the opposite sign.
+  const late = await getStatus()
+  if (late) return { ok: true, pid: late.pid, port: late.port }
+
+  // Reclaim the child. Leaving it running makes a failed start a half-truth the
+  // caller cannot act on: `getStatus()` is a pid file plus `kill(pid, 0)`, so the
+  // next `daemon start` finds the abandoned process and reports *success* with
+  // its pid. SIGKILL, not SIGTERM: this process is by definition not ready, so
+  // there is no session to drain — and a child that has already ignored the
+  // deadline is exactly the one that may ignore a polite signal too.
+  const reclaimed = child.kill('SIGKILL')
   return {
     ok: false,
-    reason: `daemon did not become ready within ${opts.timeoutMs ?? READY_TIMEOUT_MS}ms (log: ${plan.logPath})`,
+    reason:
+      `daemon did not become ready within ${opts.timeoutMs ?? READY_TIMEOUT_MS}ms` +
+      // Claim the kill only when it happened: `kill()` also returns false for a
+      // child that exited on its own between the probe and here, and that is not
+      // something to report as "reclaimed".
+      (reclaimed ? '; the child it spawned was killed so no daemon is left running' : '') +
+      ` (log: ${plan.logPath})`,
   }
 }
 

package/src/i18n-core/locales/en-US.json

@@ -42,129 +42,11 @@
     "dismiss": "Dismiss",
     "terminalName": "Mipham Code"
   },
-  "web": {
-    "hero": {
-      "title": "Mipham Code",
-      "subtitle": "Multi-model open-core intelligent coding terminal. Built for developers who demand power, speed, and flexibility.",
-      "company": "Powered by One Mipham Corporation | 北京华安麦逸科技有限公司",
-      "domains": "International: mipham.ai  |  中国大陆: onemipham.com",
-      "cta_start": "Get Started",
-      "cta_docs": "Documentation"
-    },
-    "features": {
-      "title": "Why Mipham Code?",
-      "multi_model": {
-        "title": "Multi-Model",
-        "desc": "Connect to Claude, GPT, DeepSeek, Qwen, Kimi, and more through a unified interface. Switch models on the fly with Ctrl+P."
-      },
-      "slash_commands": {
-        "title": "85 Slash Commands",
-        "desc": "Full Claude Code parity: /commit, /pr, /simplify, /lint, /loop init, /browse-plugins — all 85 commands with zero learning curve."
-      },
-      "plugins": {
-        "title": "Plugin Marketplace",
-        "desc": "Install plugins from npm or local paths. Discover community plugins including NotebookLM MCP integration."
-      },
-      "loopkit": {
-        "title": "LoopKit Vault",
-        "desc": "/loop init scaffolds a complete project structure: .mipham/ config, hooks, agents, 9-domain skills, .mcp.json, and more."
-      },
-      "mcp": {
-        "title": "MCP Protocol",
-        "desc": "Full Model Context Protocol support with stdio transport. Connect to NotebookLM, filesystem, GitHub, and custom MCP servers."
-      },
-      "secure": {
-        "title": "Open-Core & Secure",
-        "desc": "Apache 2.0 license. TLS 1.3, AES-256-GCM encryption, comprehensive permission system. Enterprise security out of the box."
-      }
-    },
-    "models": {
-      "title": "Supported Models",
-      "status_active": "Active",
-      "status_upcoming": "Upcoming"
-    },
-    "install_section": {
-      "title": "Install in Seconds",
-      "subtitle": "Four ways to install — choose what works for your platform.",
-      "npm_recommended": "npm (recommended)",
-      "curl_label": "curl (macOS / Linux)",
-      "powershell_label": "PowerShell (Windows)",
-      "label_international": "International · 国际站",
-      "label_china": "中国大陆 · China mainland",
-      "requirements": "Requires Bun 1.2+ or Node.js 22+. Supports macOS, Linux, Windows.",
-      "full_guide": "Full installation guide"
-    },
-    "footer": {
-      "copyright": "© {year} One Mipham Corporation. All rights reserved.",
-      "docs": "Docs",
-      "dashboard": "Dashboard",
-      "github": "GitHub"
-    },
-    "install_page": {
-      "title": "Installation",
-      "current_version": "Current version:",
-      "choose_platform": "Choose your platform and preferred install method.",
-      "all_methods_same": "All methods install the same Mipham Code.",
-      "prerequisites": "Prerequisites",
-      "prereq_bun": "Bun 1.2+ (recommended) or Node.js 22+",
-      "prereq_os": "macOS, Linux, or Windows (PowerShell)",
-      "prereq_api_key": "At least one AI provider API key (e.g., Anthropic, OpenAI)",
-      "npm_title": "1. npm Install (Recommended)",
-      "npm_desc": "Works on all platforms — macOS, Linux, Windows.",
-      "curl_title": "2. curl Install (macOS / Linux)",
-      "powershell_title": "3. PowerShell Install (Windows)",
-      "direct_download": "4. Direct Download",
-      "table_platform": "Platform",
-      "table_download": "Download",
-      "platform_mac_arm": "macOS (Apple Silicon)",
-      "platform_mac_intel": "macOS (Intel)",
-      "platform_linux": "Linux (x64)",
-      "platform_windows": "Windows (x64)",
-      "verify_title": "Verify Installation",
-      "start_title": "Start Mipham Code",
-      "first_launch": "On first launch, the interactive setup wizard (/setup) will guide you through provider configuration, model selection, skills installation, and permissions.",
-      "api_keys_title": "Set API Keys",
-      "api_keys_desc": "Export your provider API keys as environment variables:",
-      "international": "International · 国际站",
-      "china_mainland": "中国大陆 · China mainland"
-    },
-    "docs": {
-      "title": "Documentation",
-      "quick_start": "Quick Start",
-      "configuration": "Configuration",
-      "commands": "Commands",
-      "help": "Show help",
-      "model": "Show current model",
-      "switch": "Switch model",
-      "clear": "Clear conversation",
-      "exit": "Exit Mipham Code"
-    },
-    "dashboard": {
-      "title": "Dashboard",
-      "coming_soon": "Coming Soon",
-      "description": "The Mipham Code dashboard will show your usage analytics — session history, token consumption, most-used models and tools, and skill activity. We’re building this now.",
-      "sessions": "Sessions",
-      "sessions_desc": "Session history & stats",
-      "tokens": "Tokens",
-      "tokens_desc": "Usage across providers",
-      "skills": "Skills",
-      "skills_desc": "Active skill analytics"
-    },
-    "not_found": {
-      "code": "404",
-      "title": "Page not found",
-      "description": "The page you’re looking for doesn’t exist.",
-      "back": "Back to Mipham Code"
-    },
-    "error": {
-      "title": "Something went wrong",
-      "fallback_message": "An unexpected error occurred.",
-      "try_again": "Try again"
-    }
-  },
   "greeting": "Hello {name}",
   "commands": {
-    "clear": { "confirmed": "✓ Conversation cleared. Context reset." },
+    "clear": {
+      "confirmed": "✓ Conversation cleared. Context reset."
+    },
     "compact": {
       "confirmed": "✓ Context compacted.",
       "tokens": "Tokens: {before} → {after} (saved {saved}%)"
@@ -304,7 +186,6 @@
     },
     "task_list": {
       "title": "── Background Tasks ──",
-      "detected": "{count} task operations detected in this session.\n\nUse the Task tool (action \"create\" / \"update\" / \"list\") to manage structured task tracking.",
       "no_tasks": "No tasks tracked yet. Use the Task tool with action \"create\", \"update\", or \"list\" to manage structured tasks.",
       "reference": "Quick reference:",
       "legacy_hint": "Type /todos for the legacy task interface."
@@ -333,7 +214,9 @@
       "not_found_content": "No session named \"{name}\".\n\nUse /resume without arguments to list all saved sessions.",
       "found_content": "Name:      {name}\nMessages:  {messages}\nProvider:  {provider} / {model}\nUpdated:   {updated}\n\nTo continue this session, start a new process with:\n  mipham --resume \"{target}\""
     },
-    "help": { "title": "── Mipham Code Help ──" },
+    "help": {
+      "title": "── Mipham Code Help ──"
+    },
     "lang": {
       "current": "Language: {locale}",
       "set": "Language set to {locale}. Restart Mipham Code to apply."
@@ -433,6 +316,8 @@
       "update_failed": "✗ Update failed: {reason}{rolledBack}\n  Try manually: {command}\n  Your config backup is at: {path}",
       "rolled_back": "\n  Your previous install was restored — mipham still works.",
       "no_rollback": "\n  ⚠ Your previous install could not be restored — reinstall it manually (see below).",
+      "install_untouched": "\n  Your previous install was not touched — mipham still works.",
+      "install_unknown": "\n  ⚠ Could not locate the global install path — unable to tell whether your install survived.",
       "unverified": "⚠ Installed, but could not verify the new version: {reason}"
     },
     "no_plan": {
@@ -849,9 +734,15 @@
       "finished": "finished",
       "status_label": "Agents"
     },
-    "system": { "role_label": "System" },
-    "assistant": { "role_label": "Mipham Code" },
-    "user": { "role_label": "User" },
+    "system": {
+      "role_label": "System"
+    },
+    "assistant": {
+      "role_label": "Mipham Code"
+    },
+    "user": {
+      "role_label": "User"
+    },
     "input": {
       "placeholder": "Type a message (Esc to clear)..."
     },
@@ -976,22 +867,70 @@
     }
   },
   "tools": {
-    "bash": { "name": "Bash", "description": "Execute shell commands" },
-    "read": { "name": "Read", "description": "Read a file from the filesystem" },
-    "write": { "name": "Write", "description": "Write content to a file" },
-    "edit": { "name": "Edit", "description": "Edit a file with string replacement" },
-    "glob": { "name": "Glob", "description": "Find files matching a pattern" },
-    "grep": { "name": "Grep", "description": "Search file contents with regex" },
-    "web_fetch": { "name": "WebFetch", "description": "Fetch a URL and parse content" },
-    "web_search": { "name": "WebSearch", "description": "Search the web" },
-    "agent": { "name": "Agent", "description": "Launch a sub-agent for complex tasks" },
-    "task": { "name": "Task", "description": "Create and track tasks" },
-    "skill": { "name": "Skill", "description": "Invoke a named skill" },
-    "memory": { "name": "Memory", "description": "Read/write persistent memory" },
-    "workflow": { "name": "Workflow", "description": "Execute a multi-agent workflow" },
-    "plan": { "name": "Plan", "description": "Enter plan mode for structured thinking" },
-    "config": { "name": "Config", "description": "View and modify configuration" },
-    "mcp": { "name": "MCP", "description": "Manage MCP server connections" }
+    "bash": {
+      "name": "Bash",
+      "description": "Execute shell commands"
+    },
+    "read": {
+      "name": "Read",
+      "description": "Read a file from the filesystem"
+    },
+    "write": {
+      "name": "Write",
+      "description": "Write content to a file"
+    },
+    "edit": {
+      "name": "Edit",
+      "description": "Edit a file with string replacement"
+    },
+    "glob": {
+      "name": "Glob",
+      "description": "Find files matching a pattern"
+    },
+    "grep": {
+      "name": "Grep",
+      "description": "Search file contents with regex"
+    },
+    "web_fetch": {
+      "name": "WebFetch",
+      "description": "Fetch a URL and parse content"
+    },
+    "web_search": {
+      "name": "WebSearch",
+      "description": "Search the web"
+    },
+    "agent": {
+      "name": "Agent",
+      "description": "Launch a sub-agent for complex tasks"
+    },
+    "task": {
+      "name": "Task",
+      "description": "Create and track tasks"
+    },
+    "skill": {
+      "name": "Skill",
+      "description": "Invoke a named skill"
+    },
+    "memory": {
+      "name": "Memory",
+      "description": "Read/write persistent memory"
+    },
+    "workflow": {
+      "name": "Workflow",
+      "description": "Execute a multi-agent workflow"
+    },
+    "plan": {
+      "name": "Plan",
+      "description": "Enter plan mode for structured thinking"
+    },
+    "config": {
+      "name": "Config",
+      "description": "View and modify configuration"
+    },
+    "mcp": {
+      "name": "MCP",
+      "description": "Manage MCP server connections"
+    }
   },
   "errors": {
     "tool_denied_deny_rule": "Tool \"{name}\" blocked by a deny rule (\"{pattern}\"). Deny rules override permission mode — try a different approach, or drop the rule with: /permissions remove \"{pattern}\"",