@miphamai/cli 0.11.0 → 0.13.0

package/src/core/permission.ts

@@ -20,6 +20,17 @@ export class PermissionSystem {
   private legacyDefaultFallback: PermissionLevel | null = null
   private mode: PermissionMode = 'default'
 
+  // ── Permission cache (P2) ──
+  /** Short-lived cache: toolName+input → permissionLevel. Invalidated on rule/mode change. */
+  private checkCache = new Map<string, PermissionLevel>()
+  private cacheMode: PermissionMode | null = null
+
+  /** Invalidate the permission cache (called on any rule/mode change). */
+  private invalidateCache(): void {
+    this.checkCache.clear()
+    this.cacheMode = null
+  }
+
   constructor(modeOrLevel: PermissionLevel = 'default') {
     if (VALID_MODES.has(modeOrLevel)) {
       this.mode = modeOrLevel as PermissionMode
@@ -34,6 +45,7 @@ export class PermissionSystem {
 
   setMode(mode: PermissionMode): void {
     this.mode = mode
+    this.invalidateCache()
   }
 
   getMode(): PermissionMode {
@@ -75,6 +87,8 @@ export class PermissionSystem {
     for (const rule of config.deny) {
       this.denyRules.push(compileRule(rule, 'deny'))
     }
+
+    this.invalidateCache()
   }
 
   // ── Permission check ──
@@ -91,37 +105,74 @@ export class PermissionSystem {
    * 8. System default → 'ask'
    */
   check(tool: ToolDefinition, input: Record<string, unknown>): PermissionLevel {
+    // ── Cache lookup (P2): reuse decision for same tool+mode+input ──
+    const cacheKey = tool.name + '|' + JSON.stringify(input, Object.keys(input).sort())
+    if (this.cacheMode === this.mode) {
+      const cached = this.checkCache.get(cacheKey)
+      if (cached !== undefined) return cached
+    } else {
+      // Mode changed — invalidate entire cache
+      this.checkCache.clear()
+      this.cacheMode = this.mode
+    }
+
     // 1. Check deny rules (always win)
     for (const rule of this.denyRules) {
-      if (this.ruleMatches(rule, tool, input)) return 'ask'
+      if (this.ruleMatches(rule, tool, input)) {
+        const result: PermissionLevel = 'ask'
+        this.checkCache.set(cacheKey, result)
+        return result
+      }
     }
 
     // 2. Check ask rules
     for (const rule of this.askRules) {
-      if (this.ruleMatches(rule, tool, input)) return 'ask'
+      if (this.ruleMatches(rule, tool, input)) {
+        const result: PermissionLevel = 'ask'
+        this.checkCache.set(cacheKey, result)
+        return result
+      }
     }
 
     // 3. Check allow rules
     for (const rule of this.allowRules) {
-      if (this.ruleMatches(rule, tool, input)) return 'bypass'
+      if (this.ruleMatches(rule, tool, input)) {
+        const result: PermissionLevel = 'bypass'
+        this.checkCache.set(cacheKey, result)
+        return result
+      }
     }
 
     // 4. Legacy exact-name rules (backward compat)
     const legacyLevel = this.legacyRules.get(tool.name)
-    if (legacyLevel !== undefined) return legacyLevel
+    if (legacyLevel !== undefined) {
+      this.checkCache.set(cacheKey, legacyLevel)
+      return legacyLevel
+    }
 
     // 5. Mode baseline
     const baseline = this.modeBaseline(tool)
-    if (baseline !== 'mode-baseline') return baseline
+    if (baseline !== 'mode-baseline') {
+      this.checkCache.set(cacheKey, baseline)
+      return baseline
+    }
 
     // 6. Tool's own permission level (backward compat fallback)
-    if (tool.permission) return tool.permission
+    if (tool.permission) {
+      this.checkCache.set(cacheKey, tool.permission)
+      return tool.permission
+    }
 
     // 7. Legacy constructor fallback
-    if (this.legacyDefaultFallback) return this.legacyDefaultFallback
+    if (this.legacyDefaultFallback) {
+      this.checkCache.set(cacheKey, this.legacyDefaultFallback)
+      return this.legacyDefaultFallback
+    }
 
     // 8. System default
-    return 'ask'
+    const result: PermissionLevel = 'ask'
+    this.checkCache.set(cacheKey, result)
+    return result
   }
 
   needsApproval(tool: ToolDefinition, input: Record<string, unknown>): boolean {
@@ -193,6 +244,7 @@ export class PermissionSystem {
     if (level === 'auto') this.mode = 'auto'
     else if (level === 'bypass') this.mode = 'bypassPermissions'
     else this.mode = 'default'
+    this.invalidateCache()
   }
 
   getDefaultLevel(): PermissionLevel {
@@ -229,11 +281,13 @@ export class PermissionSystem {
         else if (rule.level === 'ask') this.ask(rule.toolName)
       }
     }
+    this.invalidateCache()
   }
 
   removeRule(toolName: string): void {
     this.legacyRules.delete(toolName)
     this.removeRuleFromArrays(toolName)
+    this.invalidateCache()
   }
 
   private removeRuleFromArrays(toolName: string): void {

package/src/index.tsx

@@ -1,7 +1,7 @@
 import { join } from 'node:path'
 import { render } from 'ink'
 import { App } from './ui/app'
-import { loadConfig } from './config/loader'
+import { loadConfig, loadInferenceHookConfig, loadCredentialMaskingConfig } from './config/loader'
 import { bootstrapProviders } from './providers/bootstrap'
 import { InstructionsLoader } from './core/instructions'
 import { loadSessionMemories } from './core/memory/memory-loader'
@@ -18,6 +18,7 @@ import { registerMcpServerTools } from './mcp/registry'
 import { AgentRegistry } from './agent/agent-registry'
 import { HookEngine } from './core/hooks'
 import { ArtifactServer } from './artifacts/server'
+import { getMetrics } from './core/metrics'
 import { ARTIFACTS_DIR, ARTIFACT_PORT, MIPHAM_DIR } from './shared/constants'
 import { AgentViewManager } from './agent-view/agent-view-manager'
 import { AgentViewDashboard } from './agent-view/dashboard'
@@ -32,6 +33,9 @@ interface RunOptions {
 }
 
 export async function runApp(options: RunOptions): Promise<void> {
+  // Metrics: count CLI invocation
+  getMetrics().cliInvocations.inc()
+
   // Handle `mipham agents` subcommand — launch standalone dashboard
   const args = process.argv.slice(2)
   if (args[0] === 'agents') {
@@ -149,6 +153,17 @@ export async function runApp(options: RunOptions): Promise<void> {
   engine.setAgentViewManager(agentViewManager)
   engine.setSkillsLoader(skillsLoader)
 
+  // Wire inference hooks (DLP) configuration
+  const inferenceHookConfig = loadInferenceHookConfig()
+  engine.setInferenceHookConfig(inferenceHookConfig)
+
+  // Wire credential masking configuration into tools
+  const credentialMaskingConfig = loadCredentialMaskingConfig()
+  const { setCredentialMaskingConfigForRead } = await import('./tools/file/read')
+  const { setCredentialMaskingConfigForBash } = await import('./tools/exec/bash')
+  setCredentialMaskingConfigForRead(credentialMaskingConfig)
+  setCredentialMaskingConfigForBash(credentialMaskingConfig)
+
   // Sync engine permission with config (fix: UI shows "auto" but engine defaulted to bypass-legacy)
   if (config.permission) {
     engine.getPermission().setDefaultLevel(config.permission as PermissionLevel)

package/src/plugin/plugin-manager.ts

@@ -45,6 +45,7 @@ export class PluginManager {
     mkdirSync(destDir, { recursive: true })
     this.copyDir(sourcePath, destDir)
 
+    const similarWarning = this.findSimilarWarning(validation.manifest.name)
     this.plugins.push({
       name: validation.manifest.name,
       version: validation.manifest.version,
@@ -56,7 +57,9 @@ export class PluginManager {
     this.saveState()
     return {
       success: true,
-      message: `Plugin "${validation.manifest.name}" v${validation.manifest.version} installed`,
+      message:
+        `Plugin "${validation.manifest.name}" v${validation.manifest.version} installed` +
+        (similarWarning ? `\n⚠ ${similarWarning}` : ''),
     }
   }
 
@@ -120,9 +123,12 @@ export class PluginManager {
       })
 
       this.saveState()
+      const similarWarning = this.findSimilarWarning(pluginName)
       return {
         success: true,
-        message: `Plugin "${pluginName}" installed from npm`,
+        message:
+          `Plugin "${pluginName}" installed from npm` +
+          (similarWarning ? `\n⚠ ${similarWarning}` : ''),
       }
     } catch (err: unknown) {
       const msg = err instanceof Error ? err.message : String(err)
@@ -140,6 +146,37 @@ export class PluginManager {
     return [...this.plugins]
   }
 
+  /**
+   * Check if the new plugin name is similar to any existing installed plugin.
+   * Warns about potential name squatting / confusion.
+   * Returns a warning string or empty string.
+   */
+  private findSimilarWarning(newName: string): string {
+    const existing = this.plugins.map((p) => p.name)
+    const similar = existing.filter((name) => this.areNamesSimilar(newName, name))
+    if (similar.length === 0) return ''
+    return `Similar plugin${similar.length > 1 ? 's' : ''} already installed: ${similar.join(', ')}. Verify you trust this source.`
+  }
+
+  /**
+   * Two names are "similar" if:
+   * - One is a prefix of the other (e.g. "auth" vs "auth-pro")
+   * - They differ by ≤ 2 characters (Levenshtein distance)
+   */
+  private areNamesSimilar(a: string, b: string): boolean {
+    if (a === b) return false // exact match is handled by "already installed" check
+    if (a.startsWith(b) || b.startsWith(a)) return true
+
+    // Simple edit-distance approximation: count differing chars
+    const maxLen = Math.max(a.length, b.length)
+    let diffs = 0
+    for (let i = 0; i < maxLen; i++) {
+      if (a[i] !== b[i]) diffs++
+      if (diffs > 2) return false
+    }
+    return diffs <= 2
+  }
+
   /**
    * Register a cleanup callback that will be invoked when the named plugin is removed.
    * This allows the plugin loader to tear down hooks, agents, MCP connections, and tools.

package/src/shared/types.ts

@@ -196,6 +196,7 @@ export type HookEvent =
   | 'ConfigChange'
   | 'SubagentStart'
   | 'SubagentStop'
+  | 'PreInference'
 
 export type HookType = 'command' | 'http' | 'code' | 'mcp_tool'
 
@@ -226,6 +227,18 @@ export interface HookContext {
   userPrompt?: string
   configKey?: string
   configValue?: unknown
+  /** PreInference: full conversation messages for DLP inspection. */
+  messages?: Array<{ role: string; content: string }>
+  /** PreInference: recent tool calls and their results. */
+  toolCalls?: Array<{
+    name: string
+    input: Record<string, unknown>
+    resultPreview: string
+  }>
+  /** PreInference: current provider ID. */
+  provider?: string
+  /** PreInference: current model ID. */
+  model?: string
 }
 
 export interface HookResult {
@@ -278,3 +291,90 @@ export interface PermissionRule {
   level: PermissionLevel
   pattern?: string
 }
+
+// ── Inference Hook (DLP) Types ──
+
+/** Configuration for the PreInference DLP hook, loaded from config.yml. */
+export interface InferenceHookConfig {
+  /** DLP server endpoint (HTTPS). Empty = feature disabled. */
+  endpoint: string
+  /** HMAC signing secret (format: mis_<random>). */
+  signing_secret: string
+  /** Request timeout in milliseconds. Default 5000. */
+  timeout: number
+  /** Failure posture: 'fail-closed' blocks on error, 'fail-open' allows. */
+  on_failure: 'fail-closed' | 'fail-open'
+  /** Organization identifier (optional, sent in payload). */
+  organization_id: string
+  /** Additional custom headers to send with each request. */
+  headers: Record<string, string>
+}
+
+/** Outgoing request to the DLP server. */
+export interface InferenceCheckRequest {
+  type: 'inference_check'
+  id: string
+  created_at: string
+  data: {
+    type: 'pre_inference'
+    session_id: string
+    organization_id?: string
+    provider: string
+    model: string
+    messages: Array<{ role: string; content: string }>
+    tool_calls: Array<{
+      name: string
+      input: Record<string, unknown>
+      result_preview: string
+    }>
+  }
+}
+
+/** Response from the DLP server. */
+export interface InferenceCheckResponse {
+  verdict: 'allow' | 'deny'
+  reason?: string
+}
+
+// ── Credential Masking Types ──
+
+/** Full-file masking rule: entire file content replaced with sentinel. */
+export interface CredentialFullMaskRule {
+  path: string
+  mode: 'full'
+}
+
+/** Extract-based masking rule: only regex-matched tokens are replaced. */
+export interface CredentialExtractRule {
+  path: string
+  mode: 'extract'
+  extract: Array<{
+    pattern: string
+    replacement?: string
+  }>
+}
+
+export type CredentialFileRule = CredentialFullMaskRule | CredentialExtractRule
+
+/** Configuration for credential masking, loaded from config.yml. */
+export interface CredentialMaskingConfig {
+  enabled: boolean
+  files: CredentialFileRule[]
+  output_scrubbing: {
+    enabled: boolean
+    patterns: string[]
+  }
+  env_filter: {
+    enabled: boolean
+    patterns: string[]
+  }
+}
+
+// ── Background Agent Types ──
+
+export interface BackgroundAgentConfig {
+  auto_commit: boolean
+  auto_push: boolean
+  auto_worktree: boolean
+  commit_coauthors: boolean
+}

package/src/tools/exec/bash.ts

@@ -1,4 +1,11 @@
-import type { ToolDefinition } from '../../shared/index.ts'
+import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
+
+// Injected at startup — set via index.tsx
+let credentialConfig: CredentialMaskingConfig | undefined
+
+export function setCredentialMaskingConfigForBash(config: CredentialMaskingConfig): void {
+  credentialConfig = config
+}
 
 // ── Dangerous command patterns ──
 const BLOCKED_PATTERNS = [
@@ -115,19 +122,38 @@ export const bashTool: ToolDefinition = {
     }
 
     try {
+      // ── Credential masking: filter sensitive env vars ──
+      let spawnEnv: Record<string, string | undefined> | undefined
+      if (credentialConfig?.enabled && credentialConfig.env_filter.enabled) {
+        const { filterEnv } = await import('../../core/credential-masker')
+        spawnEnv = filterEnv(process.env as Record<string, string | undefined>, credentialConfig)
+      }
+
       const proc = Bun.spawn(['bash', '-c', command], {
         cwd: ctx.cwd,
         stdout: 'pipe',
         stderr: 'pipe',
+        env: spawnEnv,
       })
 
       const timer = setTimeout(() => proc.kill(), timeout)
-      const output = await new Response(proc.stdout).text()
+      const rawOutput = await new Response(proc.stdout).text()
       const exitCode = await proc.exited
       clearTimeout(timer)
 
+      // ── Credential masking: scrub output ──
+      let output = rawOutput
+      if (credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled) {
+        const { maskOutput } = await import('../../core/credential-masker')
+        output = maskOutput(rawOutput, credentialConfig)
+      }
+
       if (exitCode !== 0) {
-        const stderr = await new Response(proc.stderr).text()
+        const rawStderr = await new Response(proc.stderr).text()
+        const stderr =
+          credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled
+            ? (await import('../../core/credential-masker')).maskOutput(rawStderr, credentialConfig)
+            : rawStderr
         return {
           success: false,
           content: output.slice(0, 5_000),

package/src/tools/file/read.ts

@@ -1,7 +1,14 @@
 import { readFileSync, existsSync, statSync } from 'node:fs'
-import type { ToolDefinition } from '../../shared/index.ts'
+import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
 import { resolveSafe } from '../../security/path'
 
+// Injected at startup — set via index.tsx
+let credentialConfig: CredentialMaskingConfig | undefined
+
+export function setCredentialMaskingConfigForRead(config: CredentialMaskingConfig): void {
+  credentialConfig = config
+}
+
 export const readTool: ToolDefinition = {
   name: 'Read',
   description: 'Read a file from the local filesystem. Supports offset and limit for large files.',
@@ -37,6 +44,28 @@ export const readTool: ToolDefinition = {
     const offset = (params.offset as number) || 0
     const limit = (params.limit as number) || 2000
     const content = readFileSync(filePath, 'utf-8')
+
+    // ── Credential masking ──
+    if (credentialConfig) {
+      const { matchCredentialFile, maskContent, CREDENTIAL_SENTINEL } =
+        await import('../../core/credential-masker')
+      const rule = matchCredentialFile(filePath, credentialConfig)
+      if (rule) {
+        const masked = maskContent(content, rule)
+        // Full-file mask: return sentinel immediately (offset/limit don't apply)
+        if (masked === CREDENTIAL_SENTINEL) {
+          return { success: true, content: masked }
+        }
+        // Extract mode: apply offset/limit on masked content
+        const maskedLines = masked.split('\n')
+        const maskedSlice = maskedLines.slice(offset, offset + limit)
+        const maskedResult = maskedSlice
+          .map((l, i) => `${String(offset + i + 1).padStart(6, ' ')}\t${l}`)
+          .join('\n')
+        return { success: true, content: maskedResult }
+      }
+    }
+
     const lines = content.split('\n')
     const slice = lines.slice(offset, offset + limit)
     const result = slice

package/src/ui/app.tsx

@@ -372,6 +372,11 @@ export function App({
       setPickerOpen((prev) => !prev)
       return
     }
+    // Ctrl+F → toggle focus mode
+    if (_input === '\x06') {
+      setFocusMode((prev) => !prev)
+      return
+    }
     // Ctrl+O → toggle last tool call expand/collapse
     if (_input === '\x0f') {
       setMessages((prev) => {
@@ -480,7 +485,7 @@ export function App({
             ● {PERMISSION_LABELS[permissionMode]}
           </Text>
           <Text dimColor> · Shift+Tab mode</Text>
-          <Text dimColor> · Ctrl+P model · Ctrl+O expand</Text>
+          <Text dimColor> · Ctrl+P model · Ctrl+F focus · Ctrl+O expand</Text>
           <Text dimColor> · Esc cancel · /help · ← agents</Text>
         </Box>
       </Box>

package/src/ui/chat.tsx

@@ -18,16 +18,16 @@ function displayCwd(): string {
 }
 
 export function ChatPanel({ messages, focusMode }: ChatPanelProps) {
-  // In focus mode, show only the last user+assistant exchange
-  const displayMessages = focusMode ? getLastExchange(messages) : messages
+  // In focus mode, compact tool activity into summary lines
+  const displayMessages = focusMode ? compactForFocus(messages) : messages
 
   return (
     <Box flexDirection="column" marginY={1} flexGrow={1}>
       {focusMode && messages.length > 0 && (
         <Box marginBottom={1}>
           <Text dimColor>
-            🔍 Focus mode — showing last exchange only ({displayMessages.length} of{' '}
-            {messages.length} messages hidden)
+            🔍 Focus — {countHidden(messages, displayMessages)} hidden · /focus to toggle · Ctrl+O
+            to expand
           </Text>
         </Box>
       )}
@@ -92,22 +92,55 @@ export function ChatPanel({ messages, focusMode }: ChatPanelProps) {
 }
 
 /**
- * In focus mode, show only the last user→assistant exchange.
- * Walk backwards from the end to find the last user message, then include
- * everything from that point onward.
+ * Compact messages for focus view:
+ * - Groups consecutive tool calls into [▶ N tools] ↳ name1 ↳ name2 summary lines
+ * - Keeps all user, assistant, and system messages intact
  */
-function getLastExchange(messages: ChatMessage[]): ChatMessage[] {
-  if (messages.length <= 2) return messages
+function compactForFocus(messages: ChatMessage[]): ChatMessage[] {
+  const result: ChatMessage[] = []
+  let toolGroup: ChatMessage[] = []
 
-  // Find the last user message index
-  let lastUserIdx = -1
-  for (let i = messages.length - 1; i >= 0; i--) {
-    if (messages[i]!.role === 'user') {
-      lastUserIdx = i
-      break
+  for (const msg of messages) {
+    if (msg.toolMeta) {
+      toolGroup.push(msg)
+    } else {
+      // Flush pending tool group
+      if (toolGroup.length > 0) {
+        result.push(summarizeToolGroup(toolGroup))
+        toolGroup = []
+      }
+      result.push(msg)
     }
   }
+  // Flush remaining
+  if (toolGroup.length > 0) {
+    result.push(summarizeToolGroup(toolGroup))
+  }
+
+  return result
+}
+
+/** Summarize a group of tool calls into a single compact message. */
+function summarizeToolGroup(tools: ChatMessage[]): ChatMessage {
+  const names = tools.map((t) => t.toolMeta!.name)
+  const uniqueNames = [...new Set(names)]
+  const toolList = uniqueNames.map((n) => `↳ ${n}`).join('  ')
+  return {
+    role: 'system',
+    content: `[▶ ${tools.length} tool${tools.length > 1 ? 's' : ''}]  ${toolList}`,
+    toolMeta: {
+      name: `tools (${tools.length})`,
+      input: '',
+      output: tools.map((t) => t.content).join('\n'),
+      collapsed: true,
+    },
+  }
+}
 
-  if (lastUserIdx === -1) return messages
-  return messages.slice(lastUserIdx)
+/** Count how many messages are hidden in focus mode. */
+function countHidden(all: ChatMessage[], compacted: ChatMessage[]): string {
+  const toolCount = all.filter((m) => m.toolMeta).length
+  const hidden = all.length - compacted.length
+  if (hidden <= 0) return `showing all ${all.length} messages`
+  return `${hidden} tool outputs folded (${toolCount} total tool calls)`
 }