@miphamai/cli 0.12.0 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/skills/workflows/audit.js

@@ -0,0 +1,51 @@
+export const meta = {
+  name: 'audit',
+  description: 'Security audit: fan-out per file → verify → report',
+  phases: [
+    { title: 'Scope', detail: 'discover targets' },
+    { title: 'Audit', detail: 'one agent per target' },
+    { title: 'Verify', detail: 'adversarial verification' },
+    { title: 'Report', detail: 'synthesize findings' },
+  ],
+}
+
+phase('Scope')
+const targets = args.targets || (await agent(
+  'List all source files that need security auditing. Return { files: [{ path, reason }] }',
+  { schema: { type: 'object', properties: { files: { type: 'array', items: { type: 'object', properties: { path: { type: 'string' }, reason: { type: 'string' } }, required: ['path', 'reason'] } } }, required: ['files'] } },
+)).files
+
+log(`Auditing ${targets.length} files`)
+
+phase('Audit')
+const raw = (await pipeline(
+  targets,
+  t => agent(`Security audit ${t.path}: injection, auth, crypto, secrets, input validation. Return { findings: [{ severity, file, line, summary }] }`,
+    { label: `audit:${t.path}`, schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'object', properties: { severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] }, file: { type: 'string' }, line: { type: 'number' }, summary: { type: 'string' } }, required: ['severity', 'file', 'summary'] } } }, required: ['findings'] } },
+  )),
+)
+const findings = raw.flatMap(r => (r && r.findings) || [])
+
+log(`Found ${findings.length} potential issues`)
+
+phase('Verify')
+const verified = await parallel(
+  findings.map(f => () =>
+    verify(f, {
+      mode: 'adversarial',
+      skeptics: 3,
+      threshold: 2,
+      schema: { type: 'object', properties: { real: { type: 'boolean' }, reason: { type: 'string' } }, required: ['real', 'reason'] },
+    })
+  ),
+)
+
+const confirmed = verified.filter(Boolean).filter(v => v.survives).map(v => v.finding)
+log(`${confirmed.length}/${findings.length} findings verified`)
+
+phase('Report')
+const report = await agent(
+  `Synthesize audit report from confirmed findings:\n${JSON.stringify(confirmed)}`,
+  { label: 'report' },
+)
+return report

package/skills/workflows/hunt.js

@@ -0,0 +1,95 @@
+export const meta = {
+  name: 'hunt',
+  description: 'Bug hunt: loopUntilConvergence + adversarial verify',
+  phases: [
+    { title: 'Hunt', detail: 'iterative discovery + verify' },
+    { title: 'Report', detail: 'synthesize findings' },
+  ],
+}
+
+phase('Hunt')
+const target = args.target || 'this codebase'
+
+const { confirmed, totalSeen, rounds, converged } = await loopUntilConvergence({
+  finders: [
+    () =>
+      agent(
+        `Find bugs in ${target}. Look for: null safety, race conditions, resource leaks, edge cases. Return { items: [{ file, line, summary, type }] }`,
+        {
+          label: 'hunt:general',
+          schema: {
+            type: 'object',
+            properties: {
+              items: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: {
+                    file: { type: 'string' },
+                    line: { type: 'number' },
+                    summary: { type: 'string' },
+                    type: { type: 'string' },
+                  },
+                  required: ['file', 'summary', 'type'],
+                },
+              },
+            },
+            required: ['items'],
+          },
+        },
+      ),
+    () =>
+      agent(
+        `Find security vulnerabilities in ${target}: injection, auth bypass, insecure crypto, exposed secrets. Return { items: [{ file, line, summary, type }] }`,
+        {
+          label: 'hunt:security',
+          schema: {
+            type: 'object',
+            properties: {
+              items: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: {
+                    file: { type: 'string' },
+                    line: { type: 'number' },
+                    summary: { type: 'string' },
+                    type: { type: 'string' },
+                  },
+                  required: ['file', 'summary', 'type'],
+                },
+              },
+            },
+            required: ['items'],
+          },
+        },
+      ),
+  ],
+  keyFn: (bug) => `${bug.file}:${bug.line}:${bug.summary}`,
+  verify: async (bug) =>
+    verify(bug, {
+      mode: 'adversarial',
+      skeptics: 3,
+      threshold: 2,
+      schema: {
+        type: 'object',
+        properties: { real: { type: 'boolean' }, reason: { type: 'string' } },
+        required: ['real', 'reason'],
+      },
+    }),
+  dryRounds: 2,
+  maxRounds: 10,
+})
+
+log(
+  `${converged ? 'Converged' : 'Max rounds reached'} after ${rounds} rounds. ${totalSeen} unique bugs seen, ${confirmed.length} confirmed.`,
+)
+
+phase('Report')
+if (confirmed.length === 0) {
+  return `No confirmed bugs found after ${rounds} rounds of hunting.`
+}
+return await agent(
+  `Write a bug report from ${confirmed.length} confirmed bugs:\n${JSON.stringify(confirmed)}`,
+  { label: 'report' },
+)

package/skills/workflows/judge.js

@@ -0,0 +1,55 @@
+export const meta = {
+  name: 'judge',
+  description: 'Judge panel: N competing approaches × M judges → winner + synthesis',
+  phases: [
+    { title: 'Generate', detail: 'generate competing approaches' },
+    { title: 'Judge', detail: 'score and rank' },
+    { title: 'Synthesize', detail: 'final recommendation' },
+  ],
+}
+
+phase('Generate')
+const problem = args.problem || (await agent('What problem are we solving?', { label: 'query' }))
+
+const approaches = await parallel([
+  () => agent(`Solve "${problem}" with an MVP-first approach.`, { label: 'gen:mvp' }),
+  () => agent(`Solve "${problem}" with a risk-first approach.`, { label: 'gen:risk' }),
+  () => agent(`Solve "${problem}" with a user-first approach.`, { label: 'gen:user' }),
+])
+
+const validApproaches = approaches.filter(Boolean)
+log(`Generated ${validApproaches.length} approaches`)
+
+phase('Judge')
+const { winner, winnerIndex, scores, synthesis } = await judge(validApproaches, {
+  criteria: ['feasibility', 'impact', 'simplicity', 'risk'],
+  judges: 3,
+  synthesize: true,
+  schema: {
+    type: 'object',
+    properties: {
+      scores: {
+        type: 'object',
+        properties: {
+          feasibility: { type: 'number' },
+          impact: { type: 'number' },
+          simplicity: { type: 'number' },
+          risk: { type: 'number' },
+        },
+        required: ['feasibility', 'impact', 'simplicity', 'risk'],
+      },
+      notes: { type: 'string' },
+    },
+    required: ['scores', 'notes'],
+  },
+})
+
+phase('Synthesize')
+return {
+  problem,
+  winner: `Approach #${winnerIndex + 1}`,
+  scores_summary: scores.map(
+    (s) => `Judge ${s.judgeIndex + 1}: approach ${s.attemptIndex + 1} = ${s.total}`,
+  ),
+  synthesis,
+}

package/skills/workflows/migrate.js

@@ -0,0 +1,92 @@
+export const meta = {
+  name: 'migrate',
+  description: 'Code migration: discover → fan-out transform → verify → integrate',
+  phases: [
+    { title: 'Discover', detail: 'find migration targets' },
+    { title: 'Transform', detail: 'one agent per file' },
+    { title: 'Verify', detail: 'validate transformations' },
+  ],
+}
+
+phase('Discover')
+const pattern =
+  args.pattern ||
+  (await agent('What code pattern needs migration? Return { pattern, replacement, reason }', {
+    schema: {
+      type: 'object',
+      properties: {
+        pattern: { type: 'string' },
+        replacement: { type: 'string' },
+        reason: { type: 'string' },
+      },
+      required: ['pattern', 'replacement'],
+    },
+  }))
+
+const files = await agent(
+  `Find all files matching pattern: ${pattern.pattern}. Return { files: [{ path }] }`,
+  {
+    schema: {
+      type: 'object',
+      properties: {
+        files: {
+          type: 'array',
+          items: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] },
+        },
+      },
+      required: ['files'],
+    },
+  },
+)
+
+log(`Migrating ${files.files.length} files: ${pattern.pattern} → ${pattern.replacement}`)
+
+phase('Transform')
+const results = await pipeline(files.files, (f) =>
+  agent(
+    `In ${f.path}, migrate "${pattern.pattern}" to "${pattern.replacement}". Reason: ${pattern.reason}. Return { path, changes, success }`,
+    {
+      label: `migrate:${f.path}`,
+      isolation: 'worktree',
+      schema: {
+        type: 'object',
+        properties: {
+          path: { type: 'string' },
+          changes: { type: 'number' },
+          success: { type: 'boolean' },
+        },
+        required: ['path', 'success'],
+      },
+    },
+  ),
+)
+
+const succeeded = results.filter(Boolean).filter((r) => r.success)
+const failed = results.filter(Boolean).filter((r) => !r.success)
+log(`${succeeded.length} migrated, ${failed.length} failed`)
+
+phase('Verify')
+const verified = await parallel(
+  succeeded.map(
+    (f) => () =>
+      verify(
+        { file: f.path, migration: pattern.replacement },
+        {
+          mode: 'perspective',
+          lenses: ['correctness', 'style'],
+          threshold: 1,
+          schema: {
+            type: 'object',
+            properties: { real: { type: 'boolean' }, reason: { type: 'string' } },
+            required: ['real', 'reason'],
+          },
+        },
+      ),
+  ),
+)
+
+return {
+  migrated: succeeded.length,
+  failed: failed.length,
+  verified: verified.filter(Boolean).filter((v) => v.survives).length,
+}

package/skills/workflows/research.js

@@ -0,0 +1,87 @@
+export const meta = {
+  name: 'research',
+  description: 'Deep research: scope → parallel search → verify → synthesize',
+  phases: [
+    { title: 'Scope', detail: 'define research angles' },
+    { title: 'Research', detail: 'parallel web searches' },
+    { title: 'Verify', detail: 'adversarial verification' },
+    { title: 'Synthesize', detail: 'final report' },
+  ],
+}
+
+phase('Scope')
+const topic = args.topic || (await agent('What topic should we research?', { label: 'query' }))
+
+phase('Research')
+const angles = ['overview', 'technical-details', 'competitors', 'criticism', 'future-trends']
+const raw = await parallel(
+  angles.map(
+    (angle) => () =>
+      agent(
+        `Research "${topic}" from angle: ${angle}. Return { sources: [{ title, url, keyPoint }] }`,
+        {
+          label: `research:${angle}`,
+          schema: {
+            type: 'object',
+            properties: {
+              sources: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: {
+                    title: { type: 'string' },
+                    url: { type: 'string' },
+                    keyPoint: { type: 'string' },
+                  },
+                  required: ['title', 'keyPoint'],
+                },
+              },
+            },
+            required: ['sources'],
+          },
+        },
+      ),
+  ),
+)
+
+const allSources = raw.filter(Boolean).flatMap((r) => r.sources)
+const seen = new Set()
+const unique = allSources.filter((s) => {
+  const k = s.url
+  if (seen.has(k)) return false
+  seen.add(k)
+  return true
+})
+log(`Collected ${unique.length} unique sources`)
+
+phase('Verify')
+const verified = await parallel(
+  unique.map(
+    (s) => () =>
+      verify(
+        { claim: s.keyPoint, source: s.title },
+        {
+          mode: 'adversarial',
+          skeptics: 2,
+          threshold: 1,
+          schema: {
+            type: 'object',
+            properties: { real: { type: 'boolean' }, reason: { type: 'string' } },
+            required: ['real', 'reason'],
+          },
+        },
+      ),
+  ),
+)
+
+const credible = verified
+  .filter(Boolean)
+  .filter((v) => v.survives)
+  .map((v) => v.finding)
+
+phase('Synthesize')
+const report = await agent(
+  `Synthesize research report on "${topic}" from credible sources:\n${JSON.stringify(credible)}`,
+  { label: 'synthesize' },
+)
+return report

package/skills/workflows/review.js

@@ -0,0 +1,92 @@
+export const meta = {
+  name: 'review',
+  description: 'Code review: fan-out per dimension → judge panel → report',
+  phases: [
+    { title: 'Review', detail: 'multi-dimensional review' },
+    { title: 'Judge', detail: 'judge panel scores findings' },
+    { title: 'Report', detail: 'final review report' },
+  ],
+}
+
+phase('Review')
+const dimensions = ['correctness', 'security', 'performance', 'maintainability']
+const rawFindings = await parallel(
+  dimensions.map(
+    (d) => () =>
+      agent(
+        `Review the code from the "${d}" lens. Return { findings: [{ severity, file, line, summary }] }`,
+        {
+          label: `review:${d}`,
+          schema: {
+            type: 'object',
+            properties: {
+              findings: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: {
+                    severity: { type: 'string', enum: ['blocker', 'high', 'medium', 'low'] },
+                    file: { type: 'string' },
+                    line: { type: 'number' },
+                    summary: { type: 'string' },
+                    dimension: { type: 'string' },
+                  },
+                  required: ['severity', 'file', 'summary'],
+                },
+              },
+            },
+            required: ['findings'],
+          },
+        },
+      ),
+  ),
+)
+
+// Edge logic: dedup across dimensions (pure JS)
+const allFindings = rawFindings.filter(Boolean).flatMap((r) => r.findings)
+const seen = new Set()
+const uniqueFindings = allFindings.filter((f) => {
+  const k = `${f.file}:${f.line}:${f.summary}`
+  if (seen.has(k)) return false
+  seen.add(k)
+  return true
+})
+
+log(`${uniqueFindings.length} unique findings across ${dimensions.length} dimensions`)
+
+phase('Judge')
+if (uniqueFindings.length === 0) {
+  return 'No findings — code looks clean across all dimensions.'
+}
+
+// Judge panel: rank findings by severity
+const judged = await judge(
+  uniqueFindings.map((f) => ({ finding: f })),
+  {
+    criteria: ['severity', 'actionability', 'confidence'],
+    judges: 2,
+    synthesize: false,
+    schema: {
+      type: 'object',
+      properties: {
+        scores: {
+          type: 'object',
+          properties: {
+            severity: { type: 'number' },
+            actionability: { type: 'number' },
+            confidence: { type: 'number' },
+          },
+          required: ['severity', 'actionability', 'confidence'],
+        },
+        notes: { type: 'string' },
+      },
+      required: ['scores', 'notes'],
+    },
+  },
+)
+
+phase('Report')
+return await agent(
+  `Write a code review report from ${uniqueFindings.length} findings (ranked by judge panel). Top finding: ${JSON.stringify(judged.winner)}`,
+  { label: 'report' },
+)

package/src/agent/background-registry.ts

@@ -6,6 +6,8 @@
  * can be queried via the Task tool (output/stop actions) or the Agent View.
  */
 
+export type BackgroundTaskKind = 'interactive' | 'forked' | 'attached' | 'unattended'
+
 export type BackgroundTaskStatus = 'running' | 'completed' | 'failed'
 
 export interface BackgroundTask {
@@ -13,10 +15,17 @@ export interface BackgroundTask {
   description: string
   agentType: string
   status: BackgroundTaskStatus
+  kind: BackgroundTaskKind
   startedAt: Date
   completedAt?: Date
   result?: string
   error?: string
+  /** Git worktree path (forked tasks) */
+  worktree?: string
+  /** Git branch name (forked tasks) */
+  branch?: string
+  /** Created PR URL (if requested) */
+  prUrl?: string
   abortController: AbortController
 }
 
@@ -39,6 +48,7 @@ export class BackgroundAgentRegistry {
     description: string,
     agentType: string,
     executor: (signal: AbortSignal) => Promise<string>,
+    kind: BackgroundTaskKind = 'interactive',
   ): string {
     const id = `bg-${++this.idCounter}-${Date.now().toString(36)}`
 
@@ -47,6 +57,7 @@ export class BackgroundAgentRegistry {
       description,
       agentType,
       status: 'running',
+      kind,
       startedAt: new Date(),
       abortController: new AbortController(),
     }

package/src/agent-view/agent-view-manager.ts

@@ -13,10 +13,13 @@ export interface SessionMessage {
   content: string
 }
 
+export type SessionKind = 'interactive' | 'forked' | 'attached' | 'unattended'
+
 export interface AgentSession {
   id: string
   title: string
   status: SessionStatus
+  kind: SessionKind
   provider: string
   model: string
   task: string
@@ -25,6 +28,12 @@ export interface AgentSession {
   completedAt?: Date
   elapsedMs: number
   messages: SessionMessage[]
+  /** Git worktree path (forked sessions) */
+  worktree?: string
+  /** Git branch name (forked sessions) */
+  branch?: string
+  /** Created PR URL (if requested) */
+  prUrl?: string
 }
 
 export interface CreateSessionOptions {
@@ -53,6 +62,7 @@ export class AgentViewManager {
       id,
       title,
       status: 'needs-input',
+      kind: 'interactive',
       provider: options.provider ?? 'unknown',
       model: options.model ?? 'unknown',
       task,

package/src/config/defaults.ts

@@ -1,4 +1,9 @@
-import type { MiphamConfig, InferenceHookConfig } from '../shared/index.ts'
+import type {
+  MiphamConfig,
+  InferenceHookConfig,
+  CredentialMaskingConfig,
+  BackgroundAgentConfig,
+} from '../shared/index.ts'
 import { DEFAULT_PROVIDERS } from '../shared/index.ts'
 import { PACKAGE_VERSION } from '../shared/index.ts'
 
@@ -18,3 +23,23 @@ export const DEFAULT_INFERENCE_HOOK_CONFIG: InferenceHookConfig = {
   organization_id: '',
   headers: {},
 }
+
+export const DEFAULT_CREDENTIAL_MASKING_CONFIG: CredentialMaskingConfig = {
+  enabled: true,
+  files: [],
+  output_scrubbing: {
+    enabled: true,
+    patterns: ['(?i)(api[_-]?key|secret|token|password|credential)\\s*[:=]\\s*\\S+'],
+  },
+  env_filter: {
+    enabled: true,
+    patterns: ['(?i)(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)$'],
+  },
+}
+
+export const DEFAULT_BACKGROUND_AGENT_CONFIG: BackgroundAgentConfig = {
+  auto_commit: true,
+  auto_push: true,
+  auto_worktree: true,
+  commit_coauthors: true,
+}

package/src/config/loader.ts

@@ -15,8 +15,15 @@ import type {
   ProviderConfig,
   McpServerConfig,
   InferenceHookConfig,
+  CredentialMaskingConfig,
+  BackgroundAgentConfig,
 } from '../shared/index.ts'
-import { DEFAULT_CONFIG, DEFAULT_INFERENCE_HOOK_CONFIG } from './defaults'
+import {
+  DEFAULT_CONFIG,
+  DEFAULT_INFERENCE_HOOK_CONFIG,
+  DEFAULT_CREDENTIAL_MASKING_CONFIG,
+  DEFAULT_BACKGROUND_AGENT_CONFIG,
+} from './defaults'
 
 const MIPHAM_HOME = join(homedir(), '.mipham')
 const BACKUP_PREFIX = 'config.backup-'
@@ -298,3 +305,74 @@ export function loadInferenceHookConfig(cwd: string = process.cwd()): InferenceH
 
   return merged
 }
+
+/**
+ * Load credential masking configuration from the same config sources.
+ * Merges project-level over user-level. Returns defaults if no section present.
+ */
+export function loadCredentialMaskingConfig(cwd: string = process.cwd()): CredentialMaskingConfig {
+  const configPath = join(cwd, '.mipham', 'config.yml')
+  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
+
+  let merged = { ...DEFAULT_CREDENTIAL_MASKING_CONFIG }
+
+  const paths = [userConfigPath, configPath] // project wins (loaded last)
+  for (const path of paths) {
+    try {
+      if (!existsSync(path)) continue
+      const raw = readFileSync(path, 'utf-8')
+      const parsed = parseYaml(raw) as Record<string, unknown>
+      const section = parsed.credential_masking as Partial<CredentialMaskingConfig> | undefined
+      if (section) {
+        merged = {
+          enabled: section.enabled ?? merged.enabled,
+          files: section.files ?? merged.files,
+          output_scrubbing: {
+            enabled: section.output_scrubbing?.enabled ?? merged.output_scrubbing.enabled,
+            patterns: section.output_scrubbing?.patterns ?? merged.output_scrubbing.patterns,
+          },
+          env_filter: {
+            enabled: section.env_filter?.enabled ?? merged.env_filter.enabled,
+            patterns: section.env_filter?.patterns ?? merged.env_filter.patterns,
+          },
+        }
+      }
+    } catch {
+      // Silently skip malformed configs
+    }
+  }
+
+  return merged
+}
+
+/**
+ * Load background agent configuration from config sources.
+ */
+export function loadBackgroundAgentConfig(cwd: string = process.cwd()): BackgroundAgentConfig {
+  const configPath = join(cwd, '.mipham', 'config.yml')
+  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
+
+  let merged = { ...DEFAULT_BACKGROUND_AGENT_CONFIG }
+
+  const paths = [userConfigPath, configPath]
+  for (const path of paths) {
+    try {
+      if (!existsSync(path)) continue
+      const raw = readFileSync(path, 'utf-8')
+      const parsed = parseYaml(raw) as Record<string, unknown>
+      const section = parsed.background_agent as Partial<BackgroundAgentConfig> | undefined
+      if (section) {
+        merged = {
+          auto_commit: section.auto_commit ?? merged.auto_commit,
+          auto_push: section.auto_push ?? merged.auto_push,
+          auto_worktree: section.auto_worktree ?? merged.auto_worktree,
+          commit_coauthors: section.commit_coauthors ?? merged.commit_coauthors,
+        }
+      }
+    } catch {
+      // Silently skip malformed configs
+    }
+  }
+
+  return merged
+}