@miphamai/cli 0.12.0 → 0.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent/background-registry.ts

@@ -6,6 +6,8 @@
  * can be queried via the Task tool (output/stop actions) or the Agent View.
  */
 
+export type BackgroundTaskKind = 'interactive' | 'forked' | 'attached' | 'unattended'
+
 export type BackgroundTaskStatus = 'running' | 'completed' | 'failed'
 
 export interface BackgroundTask {
@@ -13,10 +15,17 @@ export interface BackgroundTask {
   description: string
   agentType: string
   status: BackgroundTaskStatus
+  kind: BackgroundTaskKind
   startedAt: Date
   completedAt?: Date
   result?: string
   error?: string
+  /** Git worktree path (forked tasks) */
+  worktree?: string
+  /** Git branch name (forked tasks) */
+  branch?: string
+  /** Created PR URL (if requested) */
+  prUrl?: string
   abortController: AbortController
 }
 
@@ -39,6 +48,7 @@ export class BackgroundAgentRegistry {
     description: string,
     agentType: string,
     executor: (signal: AbortSignal) => Promise<string>,
+    kind: BackgroundTaskKind = 'interactive',
   ): string {
     const id = `bg-${++this.idCounter}-${Date.now().toString(36)}`
 
@@ -47,6 +57,7 @@ export class BackgroundAgentRegistry {
       description,
       agentType,
       status: 'running',
+      kind,
       startedAt: new Date(),
       abortController: new AbortController(),
     }

package/src/agent-view/agent-view-manager.ts

@@ -13,10 +13,13 @@ export interface SessionMessage {
   content: string
 }
 
+export type SessionKind = 'interactive' | 'forked' | 'attached' | 'unattended'
+
 export interface AgentSession {
   id: string
   title: string
   status: SessionStatus
+  kind: SessionKind
   provider: string
   model: string
   task: string
@@ -25,6 +28,12 @@ export interface AgentSession {
   completedAt?: Date
   elapsedMs: number
   messages: SessionMessage[]
+  /** Git worktree path (forked sessions) */
+  worktree?: string
+  /** Git branch name (forked sessions) */
+  branch?: string
+  /** Created PR URL (if requested) */
+  prUrl?: string
 }
 
 export interface CreateSessionOptions {
@@ -53,6 +62,7 @@ export class AgentViewManager {
       id,
       title,
       status: 'needs-input',
+      kind: 'interactive',
       provider: options.provider ?? 'unknown',
       model: options.model ?? 'unknown',
       task,

package/src/config/defaults.ts

@@ -1,4 +1,9 @@
-import type { MiphamConfig, InferenceHookConfig } from '../shared/index.ts'
+import type {
+  MiphamConfig,
+  InferenceHookConfig,
+  CredentialMaskingConfig,
+  BackgroundAgentConfig,
+} from '../shared/index.ts'
 import { DEFAULT_PROVIDERS } from '../shared/index.ts'
 import { PACKAGE_VERSION } from '../shared/index.ts'
 
@@ -18,3 +23,23 @@ export const DEFAULT_INFERENCE_HOOK_CONFIG: InferenceHookConfig = {
   organization_id: '',
   headers: {},
 }
+
+export const DEFAULT_CREDENTIAL_MASKING_CONFIG: CredentialMaskingConfig = {
+  enabled: true,
+  files: [],
+  output_scrubbing: {
+    enabled: true,
+    patterns: ['(?i)(api[_-]?key|secret|token|password|credential)\\s*[:=]\\s*\\S+'],
+  },
+  env_filter: {
+    enabled: true,
+    patterns: ['(?i)(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)$'],
+  },
+}
+
+export const DEFAULT_BACKGROUND_AGENT_CONFIG: BackgroundAgentConfig = {
+  auto_commit: true,
+  auto_push: true,
+  auto_worktree: true,
+  commit_coauthors: true,
+}

package/src/config/loader.ts

@@ -15,8 +15,15 @@ import type {
   ProviderConfig,
   McpServerConfig,
   InferenceHookConfig,
+  CredentialMaskingConfig,
+  BackgroundAgentConfig,
 } from '../shared/index.ts'
-import { DEFAULT_CONFIG, DEFAULT_INFERENCE_HOOK_CONFIG } from './defaults'
+import {
+  DEFAULT_CONFIG,
+  DEFAULT_INFERENCE_HOOK_CONFIG,
+  DEFAULT_CREDENTIAL_MASKING_CONFIG,
+  DEFAULT_BACKGROUND_AGENT_CONFIG,
+} from './defaults'
 
 const MIPHAM_HOME = join(homedir(), '.mipham')
 const BACKUP_PREFIX = 'config.backup-'
@@ -298,3 +305,74 @@ export function loadInferenceHookConfig(cwd: string = process.cwd()): InferenceH
 
   return merged
 }
+
+/**
+ * Load credential masking configuration from the same config sources.
+ * Merges project-level over user-level. Returns defaults if no section present.
+ */
+export function loadCredentialMaskingConfig(cwd: string = process.cwd()): CredentialMaskingConfig {
+  const configPath = join(cwd, '.mipham', 'config.yml')
+  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
+
+  let merged = { ...DEFAULT_CREDENTIAL_MASKING_CONFIG }
+
+  const paths = [userConfigPath, configPath] // project wins (loaded last)
+  for (const path of paths) {
+    try {
+      if (!existsSync(path)) continue
+      const raw = readFileSync(path, 'utf-8')
+      const parsed = parseYaml(raw) as Record<string, unknown>
+      const section = parsed.credential_masking as Partial<CredentialMaskingConfig> | undefined
+      if (section) {
+        merged = {
+          enabled: section.enabled ?? merged.enabled,
+          files: section.files ?? merged.files,
+          output_scrubbing: {
+            enabled: section.output_scrubbing?.enabled ?? merged.output_scrubbing.enabled,
+            patterns: section.output_scrubbing?.patterns ?? merged.output_scrubbing.patterns,
+          },
+          env_filter: {
+            enabled: section.env_filter?.enabled ?? merged.env_filter.enabled,
+            patterns: section.env_filter?.patterns ?? merged.env_filter.patterns,
+          },
+        }
+      }
+    } catch {
+      // Silently skip malformed configs
+    }
+  }
+
+  return merged
+}
+
+/**
+ * Load background agent configuration from config sources.
+ */
+export function loadBackgroundAgentConfig(cwd: string = process.cwd()): BackgroundAgentConfig {
+  const configPath = join(cwd, '.mipham', 'config.yml')
+  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
+
+  let merged = { ...DEFAULT_BACKGROUND_AGENT_CONFIG }
+
+  const paths = [userConfigPath, configPath]
+  for (const path of paths) {
+    try {
+      if (!existsSync(path)) continue
+      const raw = readFileSync(path, 'utf-8')
+      const parsed = parseYaml(raw) as Record<string, unknown>
+      const section = parsed.background_agent as Partial<BackgroundAgentConfig> | undefined
+      if (section) {
+        merged = {
+          auto_commit: section.auto_commit ?? merged.auto_commit,
+          auto_push: section.auto_push ?? merged.auto_push,
+          auto_worktree: section.auto_worktree ?? merged.auto_worktree,
+          commit_coauthors: section.commit_coauthors ?? merged.commit_coauthors,
+        }
+      }
+    } catch {
+      // Silently skip malformed configs
+    }
+  }
+
+  return merged
+}

package/src/core/credential-masker.ts

@@ -0,0 +1,203 @@
+import { relative, isAbsolute } from 'node:path'
+import { homedir } from 'node:os'
+import type { CredentialMaskingConfig, CredentialFileRule } from '../shared/index.ts'
+
+/** Sentinel value used to replace masked credentials. */
+export const CREDENTIAL_SENTINEL = '__MIPHAM_CREDENTIAL_MASKED__'
+
+/**
+ * Check if a file path matches any credential file rule.
+ * Returns the matching rule, or null if no match.
+ */
+export function matchCredentialFile(
+  filePath: string,
+  config: CredentialMaskingConfig,
+): CredentialFileRule | null {
+  if (!config.enabled || config.files.length === 0) return null
+
+  const expanded = expandHome(filePath)
+  for (const rule of config.files) {
+    if (matchPath(expanded, rule.path)) {
+      return rule
+    }
+  }
+  return null
+}
+
+/**
+ * Apply credential masking to file content.
+ * - 'full' mode: return sentinel value only
+ * - 'extract' mode: replace regex-matched tokens with sentinel
+ */
+export function maskContent(content: string, rule: CredentialFileRule): string {
+  if (rule.mode === 'full') {
+    return CREDENTIAL_SENTINEL
+  }
+
+  // extract mode
+  let masked = content
+  for (const extractRule of rule.extract) {
+    const replacement = extractRule.replacement || CREDENTIAL_SENTINEL
+    try {
+      const regex = new RegExp(extractRule.pattern, 'gm')
+      masked = masked.replace(regex, replacement)
+    } catch {
+      // Invalid regex — skip this rule silently
+    }
+  }
+  return masked
+}
+
+/**
+ * Scrub credential patterns from stdout/stderr output.
+ * Uses the configured output_scrubbing patterns to detect and replace
+ * credentials that may have leaked into command output.
+ */
+export function maskOutput(output: string, config: CredentialMaskingConfig): string {
+  if (!config.enabled || !config.output_scrubbing.enabled) return output
+
+  let masked = output
+  for (const pattern of config.output_scrubbing.patterns) {
+    try {
+      // Strip (?i) inline flags — JS uses the 'i' flag instead
+      const clean = pattern.replace(/^\(\?i\)/, '')
+      const regex = new RegExp(clean, 'gim')
+      masked = masked.replace(regex, (match) => {
+        // Replace everything after the separator (= or :)
+        return match.replace(/\s*[:=]\s*\S+/, `=${CREDENTIAL_SENTINEL}`)
+      })
+    } catch {
+      // Invalid regex — skip
+    }
+  }
+  return masked
+}
+
+/**
+ * Filter sensitive environment variables before spawning a subprocess.
+ * Returns a sanitized copy of process.env with matching vars removed.
+ */
+export function filterEnv(
+  env: Record<string, string | undefined>,
+  config: CredentialMaskingConfig,
+): Record<string, string | undefined> {
+  if (!config.enabled || !config.env_filter.enabled) return { ...env }
+
+  const filtered: Record<string, string | undefined> = {}
+  for (const [key, value] of Object.entries(env)) {
+    let blocked = false
+    for (const pattern of config.env_filter.patterns) {
+      try {
+        // Strip (?i) inline flags — JS uses the 'i' flag instead
+        const clean = pattern.replace(/^\(\?i\)/, '')
+        const regex = new RegExp(clean, 'i')
+        if (regex.test(key)) {
+          blocked = true
+          break
+        }
+      } catch {
+        // Invalid regex — skip
+      }
+    }
+    if (blocked) {
+      // Replace with sentinel so tools can detect they're filtered
+      filtered[key] = CREDENTIAL_SENTINEL
+    } else {
+      filtered[key] = value
+    }
+  }
+
+  return filtered
+}
+
+/**
+ * Get the file display name for a sentinel value (for model visibility).
+ * The model sees the sentinel, doesn't know the original file path.
+ */
+export function getSentinelDisplay(hint?: string): string {
+  if (hint) {
+    return `[Credential file masked: ${hint}]`
+  }
+  return CREDENTIAL_SENTINEL
+}
+
+// ── Internal helpers ──
+
+/**
+ * Expand ~ to the user's home directory.
+ */
+function expandHome(p: string): string {
+  if (p.startsWith('~')) {
+    return homedir() + p.slice(1)
+  }
+  return p
+}
+
+/**
+ * Match a file path against a glob-like pattern.
+ * Supports:
+ * - ** globstar (matches any number of path segments)
+ * - * wildcard within a single path segment
+ * - ~ home directory expansion
+ * - basename-only matching (e.g. ".env*" matches any .env file)
+ */
+function matchPath(filePath: string, pattern: string): boolean {
+  const expandedPattern = expandHome(pattern)
+  const normalizedFile = filePath.replace(/\\/g, '/')
+  const normalizedPattern = expandedPattern.replace(/\\/g, '/')
+
+  // Exact match
+  if (normalizedFile === normalizedPattern) {
+    return true
+  }
+
+  // File ends with pattern (for relative basename matching like ".env*")
+  if (normalizedFile.endsWith('/' + normalizedPattern)) {
+    return true
+  }
+
+  // Convert glob pattern to regex
+  const regex = globToRegex(normalizedPattern)
+  return regex.test(normalizedFile)
+}
+
+/**
+ * Convert a glob pattern to a RegExp.
+ * - ** → .* (matches any path segments)
+ * - *  → [^/]* (matches within a single segment)
+ * - ?  → . (single char)
+ * - All other special regex chars are escaped.
+ */
+function globToRegex(pattern: string): RegExp {
+  let regexStr = ''
+  let i = 0
+  while (i < pattern.length) {
+    const ch = pattern[i]!
+    if (ch === '*' && pattern[i + 1] === '*') {
+      // ** — match zero or more path segments
+      regexStr += '.*'
+      i += 2
+      // Skip trailing slash after **
+      if (pattern[i] === '/') i++
+      continue
+    }
+    if (ch === '*') {
+      regexStr += '[^/]*'
+      i++
+      continue
+    }
+    if (ch === '?') {
+      regexStr += '.'
+      i++
+      continue
+    }
+    // Escape regex special chars
+    if ('\\^$.|+()[]{}'.includes(ch)) {
+      regexStr += '\\' + ch
+    } else {
+      regexStr += ch
+    }
+    i++
+  }
+  return new RegExp('^' + regexStr + '$')
+}

package/src/core/permission.ts

@@ -20,6 +20,17 @@ export class PermissionSystem {
   private legacyDefaultFallback: PermissionLevel | null = null
   private mode: PermissionMode = 'default'
 
+  // ── Permission cache (P2) ──
+  /** Short-lived cache: toolName+input → permissionLevel. Invalidated on rule/mode change. */
+  private checkCache = new Map<string, PermissionLevel>()
+  private cacheMode: PermissionMode | null = null
+
+  /** Invalidate the permission cache (called on any rule/mode change). */
+  private invalidateCache(): void {
+    this.checkCache.clear()
+    this.cacheMode = null
+  }
+
   constructor(modeOrLevel: PermissionLevel = 'default') {
     if (VALID_MODES.has(modeOrLevel)) {
       this.mode = modeOrLevel as PermissionMode
@@ -34,6 +45,7 @@ export class PermissionSystem {
 
   setMode(mode: PermissionMode): void {
     this.mode = mode
+    this.invalidateCache()
   }
 
   getMode(): PermissionMode {
@@ -75,6 +87,8 @@ export class PermissionSystem {
     for (const rule of config.deny) {
       this.denyRules.push(compileRule(rule, 'deny'))
     }
+
+    this.invalidateCache()
   }
 
   // ── Permission check ──
@@ -91,37 +105,74 @@ export class PermissionSystem {
    * 8. System default → 'ask'
    */
   check(tool: ToolDefinition, input: Record<string, unknown>): PermissionLevel {
+    // ── Cache lookup (P2): reuse decision for same tool+mode+input ──
+    const cacheKey = tool.name + '|' + JSON.stringify(input, Object.keys(input).sort())
+    if (this.cacheMode === this.mode) {
+      const cached = this.checkCache.get(cacheKey)
+      if (cached !== undefined) return cached
+    } else {
+      // Mode changed — invalidate entire cache
+      this.checkCache.clear()
+      this.cacheMode = this.mode
+    }
+
     // 1. Check deny rules (always win)
     for (const rule of this.denyRules) {
-      if (this.ruleMatches(rule, tool, input)) return 'ask'
+      if (this.ruleMatches(rule, tool, input)) {
+        const result: PermissionLevel = 'ask'
+        this.checkCache.set(cacheKey, result)
+        return result
+      }
     }
 
     // 2. Check ask rules
     for (const rule of this.askRules) {
-      if (this.ruleMatches(rule, tool, input)) return 'ask'
+      if (this.ruleMatches(rule, tool, input)) {
+        const result: PermissionLevel = 'ask'
+        this.checkCache.set(cacheKey, result)
+        return result
+      }
     }
 
     // 3. Check allow rules
     for (const rule of this.allowRules) {
-      if (this.ruleMatches(rule, tool, input)) return 'bypass'
+      if (this.ruleMatches(rule, tool, input)) {
+        const result: PermissionLevel = 'bypass'
+        this.checkCache.set(cacheKey, result)
+        return result
+      }
     }
 
     // 4. Legacy exact-name rules (backward compat)
     const legacyLevel = this.legacyRules.get(tool.name)
-    if (legacyLevel !== undefined) return legacyLevel
+    if (legacyLevel !== undefined) {
+      this.checkCache.set(cacheKey, legacyLevel)
+      return legacyLevel
+    }
 
     // 5. Mode baseline
     const baseline = this.modeBaseline(tool)
-    if (baseline !== 'mode-baseline') return baseline
+    if (baseline !== 'mode-baseline') {
+      this.checkCache.set(cacheKey, baseline)
+      return baseline
+    }
 
     // 6. Tool's own permission level (backward compat fallback)
-    if (tool.permission) return tool.permission
+    if (tool.permission) {
+      this.checkCache.set(cacheKey, tool.permission)
+      return tool.permission
+    }
 
     // 7. Legacy constructor fallback
-    if (this.legacyDefaultFallback) return this.legacyDefaultFallback
+    if (this.legacyDefaultFallback) {
+      this.checkCache.set(cacheKey, this.legacyDefaultFallback)
+      return this.legacyDefaultFallback
+    }
 
     // 8. System default
-    return 'ask'
+    const result: PermissionLevel = 'ask'
+    this.checkCache.set(cacheKey, result)
+    return result
   }
 
   needsApproval(tool: ToolDefinition, input: Record<string, unknown>): boolean {
@@ -193,6 +244,7 @@ export class PermissionSystem {
     if (level === 'auto') this.mode = 'auto'
     else if (level === 'bypass') this.mode = 'bypassPermissions'
     else this.mode = 'default'
+    this.invalidateCache()
   }
 
   getDefaultLevel(): PermissionLevel {
@@ -229,11 +281,13 @@ export class PermissionSystem {
         else if (rule.level === 'ask') this.ask(rule.toolName)
       }
     }
+    this.invalidateCache()
   }
 
   removeRule(toolName: string): void {
     this.legacyRules.delete(toolName)
     this.removeRuleFromArrays(toolName)
+    this.invalidateCache()
   }
 
   private removeRuleFromArrays(toolName: string): void {

package/src/index.tsx

@@ -1,7 +1,7 @@
 import { join } from 'node:path'
 import { render } from 'ink'
 import { App } from './ui/app'
-import { loadConfig, loadInferenceHookConfig } from './config/loader'
+import { loadConfig, loadInferenceHookConfig, loadCredentialMaskingConfig } from './config/loader'
 import { bootstrapProviders } from './providers/bootstrap'
 import { InstructionsLoader } from './core/instructions'
 import { loadSessionMemories } from './core/memory/memory-loader'
@@ -157,6 +157,13 @@ export async function runApp(options: RunOptions): Promise<void> {
   const inferenceHookConfig = loadInferenceHookConfig()
   engine.setInferenceHookConfig(inferenceHookConfig)
 
+  // Wire credential masking configuration into tools
+  const credentialMaskingConfig = loadCredentialMaskingConfig()
+  const { setCredentialMaskingConfigForRead } = await import('./tools/file/read')
+  const { setCredentialMaskingConfigForBash } = await import('./tools/exec/bash')
+  setCredentialMaskingConfigForRead(credentialMaskingConfig)
+  setCredentialMaskingConfigForBash(credentialMaskingConfig)
+
   // Sync engine permission with config (fix: UI shows "auto" but engine defaulted to bypass-legacy)
   if (config.permission) {
     engine.getPermission().setDefaultLevel(config.permission as PermissionLevel)

package/src/plugin/plugin-manager.ts

@@ -45,6 +45,7 @@ export class PluginManager {
     mkdirSync(destDir, { recursive: true })
     this.copyDir(sourcePath, destDir)
 
+    const similarWarning = this.findSimilarWarning(validation.manifest.name)
     this.plugins.push({
       name: validation.manifest.name,
       version: validation.manifest.version,
@@ -56,7 +57,9 @@ export class PluginManager {
     this.saveState()
     return {
       success: true,
-      message: `Plugin "${validation.manifest.name}" v${validation.manifest.version} installed`,
+      message:
+        `Plugin "${validation.manifest.name}" v${validation.manifest.version} installed` +
+        (similarWarning ? `\n⚠ ${similarWarning}` : ''),
     }
   }
 
@@ -120,9 +123,12 @@ export class PluginManager {
       })
 
       this.saveState()
+      const similarWarning = this.findSimilarWarning(pluginName)
       return {
         success: true,
-        message: `Plugin "${pluginName}" installed from npm`,
+        message:
+          `Plugin "${pluginName}" installed from npm` +
+          (similarWarning ? `\n⚠ ${similarWarning}` : ''),
       }
     } catch (err: unknown) {
       const msg = err instanceof Error ? err.message : String(err)
@@ -140,6 +146,37 @@ export class PluginManager {
     return [...this.plugins]
   }
 
+  /**
+   * Check if the new plugin name is similar to any existing installed plugin.
+   * Warns about potential name squatting / confusion.
+   * Returns a warning string or empty string.
+   */
+  private findSimilarWarning(newName: string): string {
+    const existing = this.plugins.map((p) => p.name)
+    const similar = existing.filter((name) => this.areNamesSimilar(newName, name))
+    if (similar.length === 0) return ''
+    return `Similar plugin${similar.length > 1 ? 's' : ''} already installed: ${similar.join(', ')}. Verify you trust this source.`
+  }
+
+  /**
+   * Two names are "similar" if:
+   * - One is a prefix of the other (e.g. "auth" vs "auth-pro")
+   * - They differ by ≤ 2 characters (Levenshtein distance)
+   */
+  private areNamesSimilar(a: string, b: string): boolean {
+    if (a === b) return false // exact match is handled by "already installed" check
+    if (a.startsWith(b) || b.startsWith(a)) return true
+
+    // Simple edit-distance approximation: count differing chars
+    const maxLen = Math.max(a.length, b.length)
+    let diffs = 0
+    for (let i = 0; i < maxLen; i++) {
+      if (a[i] !== b[i]) diffs++
+      if (diffs > 2) return false
+    }
+    return diffs <= 2
+  }
+
   /**
    * Register a cleanup callback that will be invoked when the named plugin is removed.
    * This allows the plugin loader to tear down hooks, agents, MCP connections, and tools.

package/src/shared/types.ts

@@ -335,3 +335,46 @@ export interface InferenceCheckResponse {
   verdict: 'allow' | 'deny'
   reason?: string
 }
+
+// ── Credential Masking Types ──
+
+/** Full-file masking rule: entire file content replaced with sentinel. */
+export interface CredentialFullMaskRule {
+  path: string
+  mode: 'full'
+}
+
+/** Extract-based masking rule: only regex-matched tokens are replaced. */
+export interface CredentialExtractRule {
+  path: string
+  mode: 'extract'
+  extract: Array<{
+    pattern: string
+    replacement?: string
+  }>
+}
+
+export type CredentialFileRule = CredentialFullMaskRule | CredentialExtractRule
+
+/** Configuration for credential masking, loaded from config.yml. */
+export interface CredentialMaskingConfig {
+  enabled: boolean
+  files: CredentialFileRule[]
+  output_scrubbing: {
+    enabled: boolean
+    patterns: string[]
+  }
+  env_filter: {
+    enabled: boolean
+    patterns: string[]
+  }
+}
+
+// ── Background Agent Types ──
+
+export interface BackgroundAgentConfig {
+  auto_commit: boolean
+  auto_push: boolean
+  auto_worktree: boolean
+  commit_coauthors: boolean
+}

package/src/tools/exec/bash.ts

@@ -1,4 +1,11 @@
-import type { ToolDefinition } from '../../shared/index.ts'
+import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
+
+// Injected at startup — set via index.tsx
+let credentialConfig: CredentialMaskingConfig | undefined
+
+export function setCredentialMaskingConfigForBash(config: CredentialMaskingConfig): void {
+  credentialConfig = config
+}
 
 // ── Dangerous command patterns ──
 const BLOCKED_PATTERNS = [
@@ -115,19 +122,38 @@ export const bashTool: ToolDefinition = {
     }
 
     try {
+      // ── Credential masking: filter sensitive env vars ──
+      let spawnEnv: Record<string, string | undefined> | undefined
+      if (credentialConfig?.enabled && credentialConfig.env_filter.enabled) {
+        const { filterEnv } = await import('../../core/credential-masker')
+        spawnEnv = filterEnv(process.env as Record<string, string | undefined>, credentialConfig)
+      }
+
       const proc = Bun.spawn(['bash', '-c', command], {
         cwd: ctx.cwd,
         stdout: 'pipe',
         stderr: 'pipe',
+        env: spawnEnv,
       })
 
       const timer = setTimeout(() => proc.kill(), timeout)
-      const output = await new Response(proc.stdout).text()
+      const rawOutput = await new Response(proc.stdout).text()
       const exitCode = await proc.exited
       clearTimeout(timer)
 
+      // ── Credential masking: scrub output ──
+      let output = rawOutput
+      if (credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled) {
+        const { maskOutput } = await import('../../core/credential-masker')
+        output = maskOutput(rawOutput, credentialConfig)
+      }
+
       if (exitCode !== 0) {
-        const stderr = await new Response(proc.stderr).text()
+        const rawStderr = await new Response(proc.stderr).text()
+        const stderr =
+          credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled
+            ? (await import('../../core/credential-masker')).maskOutput(rawStderr, credentialConfig)
+            : rawStderr
         return {
           success: false,
           content: output.slice(0, 5_000),

package/src/tools/file/read.ts

@@ -1,7 +1,14 @@
 import { readFileSync, existsSync, statSync } from 'node:fs'
-import type { ToolDefinition } from '../../shared/index.ts'
+import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
 import { resolveSafe } from '../../security/path'
 
+// Injected at startup — set via index.tsx
+let credentialConfig: CredentialMaskingConfig | undefined
+
+export function setCredentialMaskingConfigForRead(config: CredentialMaskingConfig): void {
+  credentialConfig = config
+}
+
 export const readTool: ToolDefinition = {
   name: 'Read',
   description: 'Read a file from the local filesystem. Supports offset and limit for large files.',
@@ -37,6 +44,28 @@ export const readTool: ToolDefinition = {
     const offset = (params.offset as number) || 0
     const limit = (params.limit as number) || 2000
     const content = readFileSync(filePath, 'utf-8')
+
+    // ── Credential masking ──
+    if (credentialConfig) {
+      const { matchCredentialFile, maskContent, CREDENTIAL_SENTINEL } =
+        await import('../../core/credential-masker')
+      const rule = matchCredentialFile(filePath, credentialConfig)
+      if (rule) {
+        const masked = maskContent(content, rule)
+        // Full-file mask: return sentinel immediately (offset/limit don't apply)
+        if (masked === CREDENTIAL_SENTINEL) {
+          return { success: true, content: masked }
+        }
+        // Extract mode: apply offset/limit on masked content
+        const maskedLines = masked.split('\n')
+        const maskedSlice = maskedLines.slice(offset, offset + limit)
+        const maskedResult = maskedSlice
+          .map((l, i) => `${String(offset + i + 1).padStart(6, ' ')}\t${l}`)
+          .join('\n')
+        return { success: true, content: maskedResult }
+      }
+    }
+
     const lines = content.split('\n')
     const slice = lines.slice(offset, offset + limit)
     const result = slice

package/src/ui/app.tsx

@@ -372,6 +372,11 @@ export function App({
       setPickerOpen((prev) => !prev)
       return
     }
+    // Ctrl+F → toggle focus mode
+    if (_input === '\x06') {
+      setFocusMode((prev) => !prev)
+      return
+    }
     // Ctrl+O → toggle last tool call expand/collapse
     if (_input === '\x0f') {
       setMessages((prev) => {
@@ -480,7 +485,7 @@ export function App({
             ● {PERMISSION_LABELS[permissionMode]}
           </Text>
           <Text dimColor> · Shift+Tab mode</Text>
-          <Text dimColor> · Ctrl+P model · Ctrl+O expand</Text>
+          <Text dimColor> · Ctrl+P model · Ctrl+F focus · Ctrl+O expand</Text>
           <Text dimColor> · Esc cancel · /help · ← agents</Text>
         </Box>
       </Box>

package/src/ui/chat.tsx

@@ -18,16 +18,16 @@ function displayCwd(): string {
 }
 
 export function ChatPanel({ messages, focusMode }: ChatPanelProps) {
-  // In focus mode, show only the last user+assistant exchange
-  const displayMessages = focusMode ? getLastExchange(messages) : messages
+  // In focus mode, compact tool activity into summary lines
+  const displayMessages = focusMode ? compactForFocus(messages) : messages
 
   return (
     <Box flexDirection="column" marginY={1} flexGrow={1}>
       {focusMode && messages.length > 0 && (
         <Box marginBottom={1}>
           <Text dimColor>
-            🔍 Focus mode — showing last exchange only ({displayMessages.length} of{' '}
-            {messages.length} messages hidden)
+            🔍 Focus — {countHidden(messages, displayMessages)} hidden · /focus to toggle · Ctrl+O
+            to expand
           </Text>
         </Box>
       )}
@@ -92,22 +92,55 @@ export function ChatPanel({ messages, focusMode }: ChatPanelProps) {
 }
 
 /**
- * In focus mode, show only the last user→assistant exchange.
- * Walk backwards from the end to find the last user message, then include
- * everything from that point onward.
+ * Compact messages for focus view:
+ * - Groups consecutive tool calls into [▶ N tools] ↳ name1 ↳ name2 summary lines
+ * - Keeps all user, assistant, and system messages intact
  */
-function getLastExchange(messages: ChatMessage[]): ChatMessage[] {
-  if (messages.length <= 2) return messages
+function compactForFocus(messages: ChatMessage[]): ChatMessage[] {
+  const result: ChatMessage[] = []
+  let toolGroup: ChatMessage[] = []
 
-  // Find the last user message index
-  let lastUserIdx = -1
-  for (let i = messages.length - 1; i >= 0; i--) {
-    if (messages[i]!.role === 'user') {
-      lastUserIdx = i
-      break
+  for (const msg of messages) {
+    if (msg.toolMeta) {
+      toolGroup.push(msg)
+    } else {
+      // Flush pending tool group
+      if (toolGroup.length > 0) {
+        result.push(summarizeToolGroup(toolGroup))
+        toolGroup = []
+      }
+      result.push(msg)
     }
   }
+  // Flush remaining
+  if (toolGroup.length > 0) {
+    result.push(summarizeToolGroup(toolGroup))
+  }
+
+  return result
+}
+
+/** Summarize a group of tool calls into a single compact message. */
+function summarizeToolGroup(tools: ChatMessage[]): ChatMessage {
+  const names = tools.map((t) => t.toolMeta!.name)
+  const uniqueNames = [...new Set(names)]
+  const toolList = uniqueNames.map((n) => `↳ ${n}`).join('  ')
+  return {
+    role: 'system',
+    content: `[▶ ${tools.length} tool${tools.length > 1 ? 's' : ''}]  ${toolList}`,
+    toolMeta: {
+      name: `tools (${tools.length})`,
+      input: '',
+      output: tools.map((t) => t.content).join('\n'),
+      collapsed: true,
+    },
+  }
+}
 
-  if (lastUserIdx === -1) return messages
-  return messages.slice(lastUserIdx)
+/** Count how many messages are hidden in focus mode. */
+function countHidden(all: ChatMessage[], compacted: ChatMessage[]): string {
+  const toolCount = all.filter((m) => m.toolMeta).length
+  const hidden = all.length - compacted.length
+  if (hidden <= 0) return `showing all ${all.length} messages`
+  return `${hidden} tool outputs folded (${toolCount} total tool calls)`
 }

package/src/ui/commands.ts

@@ -3052,6 +3052,223 @@ Permission level is controlled by /config permission <level>.`,
 // Security / Audit — security review checklist
 // ═══════════════════════════════════════════════════════════════
 
+const promptAuditCmd: CommandHandler = async () => {
+  const { existsSync, readFileSync, readdirSync, statSync } = await import('node:fs')
+  const { join, extname, basename } = await import('node:path')
+  const cwd = process.cwd()
+
+  // Patterns that suggest prompts written for older/less-capable models
+  const AUDIT_RULES: Array<{
+    id: string
+    pattern: RegExp
+    severity: 'low' | 'medium' | 'high'
+    message: string
+    suggestion: string
+  }> = [
+    {
+      id: 'over-explaining',
+      pattern:
+        /you are (a|an) (helpful |friendly |knowledgeable )?(AI |language model |assistant)/i,
+      severity: 'low',
+      message: 'Self-identification preamble ("You are a...")',
+      suggestion: "Modern models don't need role preamble. Remove or shorten to 1 line.",
+    },
+    {
+      id: 'step-by-step',
+      pattern: /(think|reason|work) (step[ -]?by[ -]?step|through this|carefully about this)/i,
+      severity: 'low',
+      message: 'Step-by-step reasoning prompt',
+      suggestion: 'Reasoning models handle this natively. Remove for token savings.',
+    },
+    {
+      id: 'do-not-list',
+      pattern:
+        /(do not|never|you must not|don't|under no circumstances).*\n.*(do not|never|you must not|don't)/i,
+      severity: 'medium',
+      message: 'Multiple "do not" constraints',
+      suggestion: 'Modern models need fewer prohibitions. Consolidate to 1-2 key constraints.',
+    },
+    {
+      id: 'token-waste',
+      pattern:
+        /(remember|keep in mind|it is important to note|please note that|i want to emphasize)/i,
+      severity: 'low',
+      message: 'Filler emphasis phrases ("remember", "please note")',
+      suggestion: 'Remove filler. State the instruction directly.',
+    },
+    {
+      id: 'format-over-spec',
+      pattern: /(you must (always |only )?respond (in|with|using) (JSON|XML|YAML|markdown|HTML))/i,
+      severity: 'low',
+      message: 'Over-specified output format',
+      suggestion: 'Modern models follow format instructions with fewer words. Shorten.',
+    },
+    {
+      id: 'example-overload',
+      pattern: /((?:example|for instance|e\.g\.,).*\n){3,}/i,
+      severity: 'low',
+      message: 'Three or more examples in sequence',
+      suggestion: '1-2 examples suffice for modern models. Remove redundant ones.',
+    },
+    {
+      id: 'old-model-ref',
+      pattern: /(GPT-3|GPT-3\.5|Claude\s*[12][^3]|text-davinci|command-r|llama\s*2)/i,
+      severity: 'high',
+      message: 'Reference to older model',
+      suggestion: 'Update model references to current generation (Sonnet 5, Opus 5, GPT-5, etc.).',
+    },
+    {
+      id: 'long-preamble',
+      pattern: /^.{200,}$/m,
+      severity: 'medium',
+      message: 'Very long single-line instructions (200+ chars)',
+      suggestion: 'Break into bullet points. Modern models parse structured prompts better.',
+    },
+    {
+      id: 'verbose-constraint',
+      pattern:
+        /you (must|should|shall) (always |only |never )?(ensure|guarantee|verify|validate|confirm|cross-check|double-check)/i,
+      severity: 'medium',
+      message: 'Overly verbose constraint language',
+      suggestion: 'Replace "you must ensure that" with imperative: "Ensure".',
+    },
+  ]
+
+  // Files to scan
+  const scanDirs = [
+    join(cwd, '.mipham', 'skills'),
+    join(cwd, '.mipham', 'rules'),
+    join(cwd, '.claude'),
+  ]
+  const skillFiles: string[] = []
+  // Also check standard project files
+  const projectFiles = [join(cwd, 'CLAUDE.md'), join(cwd, 'MIPHAM.md'), join(cwd, 'PRODUCT.md')]
+
+  // Collect skill/rules files
+  for (const dir of scanDirs) {
+    try {
+      if (!existsSync(dir)) continue
+      const walk = (d: string) => {
+        const entries = readdirSync(d)
+        for (const e of entries) {
+          const fp = join(d, e)
+          const st = statSync(fp)
+          if (st.isDirectory()) {
+            walk(fp)
+            continue
+          }
+          if (['.md', '.SKILL.md', '.mipham-skill.md', '.txt'].some((ext) => fp.endsWith(ext))) {
+            skillFiles.push(fp)
+          }
+        }
+      }
+      walk(dir)
+    } catch {
+      /* skip */
+    }
+  }
+
+  const allFiles = [...new Set([...projectFiles.filter((f) => existsSync(f)), ...skillFiles])]
+
+  if (allFiles.length === 0) {
+    return {
+      content: [
+        '🔍 Prompt Audit',
+        '',
+        'No prompt files found to audit.',
+        'Place skills in .mipham/skills/ and rules in .mipham/rules/.',
+      ].join('\n'),
+    }
+  }
+
+  // Scan each file
+  const results: Array<{
+    file: string
+    line: number
+    ruleId: string
+    severity: string
+    message: string
+    suggestion: string
+  }> = []
+
+  for (const fp of allFiles) {
+    try {
+      const content = readFileSync(fp, 'utf-8')
+      const lines = content.split('\n')
+      for (const rule of AUDIT_RULES) {
+        // Multi-line pattern: check full content
+        if (rule.id === 'do-not-list' || rule.id === 'example-overload') {
+          if (rule.pattern.test(content)) {
+            // Find approx line
+            const match = rule.pattern.exec(content)
+            const idx = match ? content.slice(0, match.index).split('\n').length : 1
+            results.push({
+              file: fp.replace(cwd + '/', ''),
+              line: idx,
+              ruleId: rule.id,
+              severity: rule.severity,
+              message: rule.message,
+              suggestion: rule.suggestion,
+            })
+          }
+          continue
+        }
+
+        // Line-by-line patterns
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i]!
+          if (rule.pattern.test(line)) {
+            results.push({
+              file: fp.replace(cwd + '/', ''),
+              line: i + 1,
+              ruleId: rule.id,
+              severity: rule.severity,
+              message: rule.message,
+              suggestion: rule.suggestion,
+            })
+          }
+        }
+      }
+    } catch {
+      /* skip unreadable files */
+    }
+  }
+
+  // Format output
+  const severityIcon: Record<string, string> = { high: '🔴', medium: '🟡', low: '🟢' }
+  const grouped: Record<string, typeof results> = {}
+  for (const r of results) {
+    const key = r.file
+    if (!grouped[key]) grouped[key] = []
+    grouped[key]!.push(r)
+  }
+
+  const output: string[] = [
+    `🔍 Prompt Audit — ${allFiles.length} file(s) scanned, ${results.length} finding(s)`,
+    '',
+  ]
+
+  if (results.length === 0) {
+    output.push('✅ All prompts look optimized for modern models. No issues found.')
+  } else {
+    for (const [file, items] of Object.entries(grouped)) {
+      output.push(`📄 ${file} (${items!.length} finding${items!.length > 1 ? 's' : ''})`)
+      for (const item of items!) {
+        output.push(
+          `  ${severityIcon[item.severity] || '⚪'} L${item.line}: [${item.ruleId}] ${item.message}`,
+        )
+        output.push(`     → ${item.suggestion}`)
+      }
+      output.push('')
+    }
+  }
+
+  output.push('─'.repeat(60))
+  output.push('Scanned: ' + allFiles.map((f) => basename(f)).join(', '))
+
+  return { content: output.join('\n') }
+}
+
 const securityCmd: CommandHandler = async () => {
   const findings: string[] = []
   const ok: string[] = []
@@ -3691,6 +3908,128 @@ Run \`mipham agents\` for the interactive dashboard.`,
 // Artifacts
 // ═══════════════════════════════════════════════════════════════
 
+const forkCmd: CommandHandler = async (ctx, args) => {
+  const prompt = args.join(' ')
+  if (!prompt.trim()) {
+    return {
+      content: [
+        'Usage: /fork <task description>',
+        '',
+        'Fork a task into an isolated worktree with auto commit/push.',
+        '',
+        'Workflow:',
+        '  1. Creates a new git worktree on branch worktree/<slug>',
+        '  2. Spawns a background agent to work on the task',
+        '  3. Auto-commits changes with Co-Authored-By on completion',
+        '  4. Auto-pushes to origin',
+        '  5. Reports branch and worktree path in the result',
+        '',
+        'Examples:',
+        '  /fork Refactor the auth module',
+        '  /fork Add input validation to all API endpoints',
+      ].join('\n'),
+    }
+  }
+
+  const { execSync } = await import('node:child_process')
+  const { join } = await import('node:path')
+
+  try {
+    execSync('git rev-parse --git-dir', { stdio: 'ignore' })
+  } catch {
+    return { content: '/fork requires a git repository.' }
+  }
+
+  const agentViewManager = ctx.engine.getAgentViewManager?.()
+  if (!agentViewManager) {
+    return { content: 'Agent View manager is initializing...' }
+  }
+
+  const slug = prompt
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-|-$/g, '')
+    .slice(0, 40)
+  const name = `${slug}-${Date.now().toString(36)}`
+  const branch = `worktree/${name}`
+  const wtPath = join(process.cwd(), '.claude', 'worktrees', name)
+
+  try {
+    execSync(`git worktree add -b ${branch} ${wtPath} HEAD`, { stdio: 'ignore', timeout: 30_000 })
+  } catch (err) {
+    try {
+      execSync(`git worktree remove --force ${wtPath}`, { stdio: 'ignore' })
+    } catch {
+      /* ok */
+    }
+    try {
+      execSync(`git branch -D ${branch}`, { stdio: 'ignore' })
+    } catch {
+      /* ok */
+    }
+    return {
+      content: `Worktree creation failed: ${err instanceof Error ? err.message : String(err)}`,
+    }
+  }
+
+  const session = agentViewManager.create(prompt, prompt, {
+    provider: ctx.providerId,
+    model: ctx.modelId,
+  })
+  agentViewManager.addMessage(session.id, { role: 'user', content: prompt })
+  agentViewManager.updateStatus(session.id, 'working')
+  session.worktree = wtPath
+  session.branch = branch
+  session.kind = 'forked'
+
+  const bgReg = (await import('../agent/background-registry')).getBackgroundAgentRegistry()
+  bgReg.spawn(
+    prompt,
+    'general',
+    async (_signal) => {
+      const { SubAgent } = await import('../agent/sub-agent')
+      const sa = new SubAgent(ctx.engine.getRegistry(), ctx.engine.getTools())
+      const result = await sa.execute(prompt, 'fork: ' + prompt.slice(0, 60), {})
+      try {
+        const { execSync: ex } = await import('node:child_process')
+        ex(`git -C ${wtPath} add -A`, { stdio: 'ignore', timeout: 10_000 })
+        const st = ex(`git -C ${wtPath} status --porcelain`, { encoding: 'utf-8', timeout: 10_000 })
+        if (st.trim()) {
+          ex(
+            `git -C ${wtPath} commit -m "feat: ${prompt.slice(0, 60)}\n\nCo-Authored-By: Claude <noreply@anthropic.com>"`,
+            { stdio: 'ignore', timeout: 10_000 },
+          )
+          ex(`git push origin ${branch}`, { stdio: 'ignore', timeout: 30_000 })
+        }
+      } catch {
+        /* best-effort */
+      }
+      return [
+        `## Fork done: ${prompt}`,
+        '',
+        `Branch: \`${branch}\``,
+        `Worktree: \`${wtPath}\``,
+        '',
+        result || '(no output)',
+      ].join('\n')
+    },
+    'forked',
+  )
+
+  return {
+    content: [
+      `✓ Forked: ${session.id}`,
+      `  Task: ${prompt.slice(0, 80)}`,
+      `  Branch: ${branch}`,
+      `  Worktree: ${wtPath}`,
+      `  Status: working`,
+      '',
+      'Agent will auto-commit + push on completion.',
+      'Use /agents to track.',
+    ].join('\n'),
+  }
+}
+
 async function openBrowser(url: string): Promise<void> {
   const cmd =
     process.platform === 'darwin'
@@ -3857,6 +4196,7 @@ const commandsListCmd: CommandHandler = () => {
     '/recommend': 'Project',
     '/security': 'Project',
     '/audit': 'Project',
+    '/prompt-audit': 'Code Quality',
     '/ide': 'Environment',
     '/terminal-setup': 'Environment',
     '/memory': 'Environment',
@@ -3866,6 +4206,7 @@ const commandsListCmd: CommandHandler = () => {
     '/feedback': 'Account',
     '/agents': 'Agents',
     '/bg': 'Agents',
+    '/fork': 'Agents',
     '/artifact': 'Artifacts',
     '/schedule': 'Other',
     '/commit': 'Workflow',
@@ -3996,6 +4337,7 @@ registry.set('/permissions', permissionsCmd)
 registry.set('/add-dir', addDirCmd)
 registry.set('/security', securityCmd)
 registry.set('/audit', securityCmd)
+registry.set('/prompt-audit', promptAuditCmd)
 
 // Environment
 registry.set('/theme', themeCmd)
@@ -4010,6 +4352,7 @@ registry.set('/logout', logoutCmd)
 registry.set('/feedback', feedbackCmd)
 registry.set('/agents', agentsCmd)
 registry.set('/bg', bgCmd)
+registry.set('/fork', forkCmd)
 
 // Artifacts
 registry.set('/artifact', artifactBaseCmd)
@@ -4119,6 +4462,7 @@ const COMMAND_DESCRIPTIONS: Record<string, string> = {
   '/recommend': 'Analyze project + recommend skills & setup',
   '/security': 'Security review checklist',
   '/audit': 'Same as /security',
+  '/prompt-audit': 'Audit prompts for modern model optimization',
   '/ide': 'IDE integration guide',
   '/terminal-setup': 'Shell & terminal config',
   '/memory': 'Manage AI memories',
@@ -4129,6 +4473,7 @@ const COMMAND_DESCRIPTIONS: Record<string, string> = {
   '/feedback': 'Send feedback',
   '/agents': 'Agent view dashboard',
   '/bg': 'Run a background agent task',
+  '/fork': 'Fork task into isolated worktree',
   '/artifact': 'Manage artifacts',
   '/schedule': 'View scheduled tasks and cron jobs',
   '/commit': 'Generate commit message and review staged changes',