@getmikie/cli 1.1.108 → 1.1.113

package/README.md

@@ -3,28 +3,29 @@
 This package is a thin launcher for Mikie's compiled native relay.
 
 ```sh
-npx -y @getmikie/cli mcp
+npx --yes --ignore-scripts --registry=https://registry.npmjs.org @getmikie/cli@1.1.108 mcp
 ```
 
 For a persistent command path on Windows PowerShell:
 
 ```powershell
-npm.cmd install --global @getmikie/cli@latest --allow-scripts=@getmikie/cli
+npm.cmd install --global @getmikie/cli@1.1.108 --ignore-scripts --registry=https://registry.npmjs.org
 ```
 
-Mikie does not change your PowerShell execution policy. Do not shorten the
-command to `npm install -g --allow-scripts=@getmikie/cli`: without naming the
-package as the install target, that command incorrectly targets the current
-directory.
+Mikie does not change your PowerShell execution policy. Keep the exact package
+name in the command: without naming the package as the install target, npm
+incorrectly targets the current directory.
 
 For a persistent command path on macOS or Linux:
 
 ```sh
-npm install --global @getmikie/cli@latest --allow-scripts=@getmikie/cli
+npm install --global @getmikie/cli@1.1.108 --ignore-scripts --registry=https://registry.npmjs.org
 ```
 
-On every platform, `--allow-scripts=@getmikie/cli` approves only Mikie's
-packaged install script; it does not approve unrelated package scripts.
+These portable npm commands disable every lifecycle script and pin the public
+npm registry. The public OS installers additionally authenticate exact wrapper
+and native tarball bytes, install them offline, and explicitly run only Mikie's
+authenticated reconciliation script.
 
 Then run:
 
@@ -46,7 +47,9 @@ mikie control run --request C:\absolute\path\control-request.json --json
 ```
 
 The request must be an existing absolute JSON file. Mikie validates the frozen
-repository, allowed paths, deterministic verifier, exact model and reasoning
-effort, bounded model-turn timeout, and private temporary root before execution. The JSON result is
+repository, allowed paths, exact model and reasoning effort, bounded model-turn
+timeout, and private temporary root before execution. The verifier argv is
+restricted to `git diff --check`; interpreters, build tools, and test runners
+that could execute repository-controlled code are rejected. The JSON result is
 content-free: it reports terminal status and hashes, never prompts, context,
 patch bodies, verifier output, or credentials.

package/bin/mikie.mjs

@@ -47,12 +47,23 @@ if (["--version", "-v"].includes(singleFlag)) {
   console.log(`Mikie ${packageMetadata.version}
 
 Usage:
+  mikie savings history [options]
+  mikie savings export-meter-history
   mikie mcp [--adapter codex|claude_code]
   mikie login
-  mikie connect .
+  mikie logout
+  mikie connect .|<absolute-directory>
+  mikie privacy review
+  mikie setup codex
+  mikie setup claude
+  mikie mode codex [active|shadow] [--json]
   mikie control run --request <absolute-json> --json
-  mikie doctor
+  mikie doctor [--client codex]
   mikie update
+  mikie device revoke
+  mikie uninstall
+  mikie --help
+  mikie --version
 
 All commands execute the compiled Mikie native engine.`);
 } else if (arguments_.length === 1 && arguments_[0].toLowerCase() === "update") {

package/lib/launcher.mjs

@@ -616,6 +616,13 @@ export function selectPlatformPackage({
 }
 
 export function translateArguments(arguments_) {
+  if (
+    arguments_.length === 2 &&
+    arguments_[0] === "setup" &&
+    arguments_[1] === "claude-code"
+  ) {
+    return ["setup", "claude"];
+  }
   if (arguments_[0] !== "mcp") {
     return [...arguments_];
   }

package/lib/update.mjs

@@ -23,7 +23,7 @@ const REPAIR_SCHEMA = "mikie.claude-hook-repair.v1";
 const TRAJECTORY_RECONCILIATION_SCHEMA = "mikie.trajectory-store-reconciliation.v1";
 const RERUN_COMMAND = "npx -y @getmikie/cli@latest update";
 const MAX_COMMAND_OUTPUT_BYTES = 1024 * 1024;
-const DEFAULT_COMMAND_TIMEOUT_MS = 30_000;
+const DEFAULT_COMMAND_TIMEOUT_MS = 120_000;
 const TRANSACTION_SCHEMA = "mikie.npm-update-transaction.v1";
 const LOCK_SCHEMA = "mikie.npm-update-lock.v1";
 const MAX_TRANSACTION_TREE_ENTRIES = 16_384;
@@ -935,7 +935,15 @@ export function createCommandAdapter({
       ? environmentNpmCli
       : path.join(path.dirname(nodeExecutable), "node_modules", "npm", "bin", "npm-cli.js"));
   return {
-    run(executable, args, { shell = false, environment: commandEnvironment = {} } = {}) {
+    run(
+      executable,
+      args,
+      {
+        shell = false,
+        environment: commandEnvironment = {},
+        timeoutMs = commandTimeoutMs,
+      } = {},
+    ) {
       if (
         shell !== false ||
         !Array.isArray(args) ||
@@ -945,6 +953,9 @@ export function createCommandAdapter({
       ) {
         throw new Error("Mikie update commands require argument arrays with shell disabled");
       }
+      if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+        throw new Error("Mikie update command timeout is invalid");
+      }
       return new Promise((resolve, reject) => {
         const stdout = [];
         const stderr = [];
@@ -970,7 +981,7 @@ export function createCommandAdapter({
             // The child may already have exited.
           }
           reject(new Error("Mikie update command timed out"));
-        }, commandTimeoutMs);
+        }, timeoutMs);
         const finish = (callback) => {
           if (settled) return false;
           settled = true;
@@ -1041,11 +1052,19 @@ export function createRegistryAdapter({
   return {
     async resolveExactCompatibleVersion({ packageName, nodeVersion }) {
       const deadline = now() + resolutionTimeoutMs;
-      const versionsResponse = await commands.run(
-        npmExecutable,
+      const runWithinDeadline = async (args) => {
+        const timeoutMs = deadline - now();
+        if (timeoutMs <= 0) return null;
+        return commands.run(npmExecutable, args, {
+          shell: false,
+          capture: true,
+          timeoutMs,
+        });
+      };
+      const versionsResponse = await runWithinDeadline(
         ["view", packageName, "versions", "--json", "--registry", registryUrl],
-        { shell: false, capture: true },
       );
+      if (versionsResponse === null) return { public: false, compatible: false };
       if (versionsResponse.code !== 0) return { public: false, compatible: false };
       let published;
       try {
@@ -1059,8 +1078,7 @@ export function createRegistryAdapter({
       }
       for (const version of published.slice(0, 64)) {
         if (now() >= deadline) break;
-        const response = await commands.run(
-          npmExecutable,
+        const response = await runWithinDeadline(
           [
             "view",
             `${packageName}@${version}`,
@@ -1070,8 +1088,8 @@ export function createRegistryAdapter({
             "--registry",
             registryUrl,
           ],
-          { shell: false, capture: true },
         );
+        if (response === null) break;
         if (response.code !== 0) continue;
         let metadata;
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmikie/cli",
-  "version": "1.1.108",
+  "version": "1.1.113",
   "description": "Native Mikie relay launcher for MCP clients",
   "license": "Apache-2.0",
   "repository": {
@@ -24,10 +24,10 @@
     "node": ">=22"
   },
   "optionalDependencies": {
-    "@getmikie/darwin-arm64": "1.1.108",
-    "@getmikie/darwin-x64": "1.1.108",
-    "@getmikie/linux-x64-gnu": "1.1.108",
-    "@getmikie/win32-x64": "1.1.108"
+    "@getmikie/darwin-arm64": "1.1.113",
+    "@getmikie/darwin-x64": "1.1.113",
+    "@getmikie/linux-x64-gnu": "1.1.113",
+    "@getmikie/win32-x64": "1.1.113"
   },
   "publishConfig": {
     "access": "public",