@miphamai/cli 0.13.0 → 0.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/skills/workflows/audit.js

@@ -0,0 +1,51 @@
+export const meta = {
+  name: 'audit',
+  description: 'Security audit: fan-out per file → verify → report',
+  phases: [
+    { title: 'Scope', detail: 'discover targets' },
+    { title: 'Audit', detail: 'one agent per target' },
+    { title: 'Verify', detail: 'adversarial verification' },
+    { title: 'Report', detail: 'synthesize findings' },
+  ],
+}
+
+phase('Scope')
+const targets = args.targets || (await agent(
+  'List all source files that need security auditing. Return { files: [{ path, reason }] }',
+  { schema: { type: 'object', properties: { files: { type: 'array', items: { type: 'object', properties: { path: { type: 'string' }, reason: { type: 'string' } }, required: ['path', 'reason'] } } }, required: ['files'] } },
+)).files
+
+log(`Auditing ${targets.length} files`)
+
+phase('Audit')
+const raw = (await pipeline(
+  targets,
+  t => agent(`Security audit ${t.path}: injection, auth, crypto, secrets, input validation. Return { findings: [{ severity, file, line, summary }] }`,
+    { label: `audit:${t.path}`, schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'object', properties: { severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] }, file: { type: 'string' }, line: { type: 'number' }, summary: { type: 'string' } }, required: ['severity', 'file', 'summary'] } } }, required: ['findings'] } },
+  )),
+)
+const findings = raw.flatMap(r => (r && r.findings) || [])
+
+log(`Found ${findings.length} potential issues`)
+
+phase('Verify')
+const verified = await parallel(
+  findings.map(f => () =>
+    verify(f, {
+      mode: 'adversarial',
+      skeptics: 3,
+      threshold: 2,
+      schema: { type: 'object', properties: { real: { type: 'boolean' }, reason: { type: 'string' } }, required: ['real', 'reason'] },
+    })
+  ),
+)
+
+const confirmed = verified.filter(Boolean).filter(v => v.survives).map(v => v.finding)
+log(`${confirmed.length}/${findings.length} findings verified`)
+
+phase('Report')
+const report = await agent(
+  `Synthesize audit report from confirmed findings:\n${JSON.stringify(confirmed)}`,
+  { label: 'report' },
+)
+return report

package/skills/workflows/hunt.js

@@ -0,0 +1,95 @@
+export const meta = {
+  name: 'hunt',
+  description: 'Bug hunt: loopUntilConvergence + adversarial verify',
+  phases: [
+    { title: 'Hunt', detail: 'iterative discovery + verify' },
+    { title: 'Report', detail: 'synthesize findings' },
+  ],
+}
+
+phase('Hunt')
+const target = args.target || 'this codebase'
+
+const { confirmed, totalSeen, rounds, converged } = await loopUntilConvergence({
+  finders: [
+    () =>
+      agent(
+        `Find bugs in ${target}. Look for: null safety, race conditions, resource leaks, edge cases. Return { items: [{ file, line, summary, type }] }`,
+        {
+          label: 'hunt:general',
+          schema: {
+            type: 'object',
+            properties: {
+              items: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: {
+                    file: { type: 'string' },
+                    line: { type: 'number' },
+                    summary: { type: 'string' },
+                    type: { type: 'string' },
+                  },
+                  required: ['file', 'summary', 'type'],
+                },
+              },
+            },
+            required: ['items'],
+          },
+        },
+      ),
+    () =>
+      agent(
+        `Find security vulnerabilities in ${target}: injection, auth bypass, insecure crypto, exposed secrets. Return { items: [{ file, line, summary, type }] }`,
+        {
+          label: 'hunt:security',
+          schema: {
+            type: 'object',
+            properties: {
+              items: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: {
+                    file: { type: 'string' },
+                    line: { type: 'number' },
+                    summary: { type: 'string' },
+                    type: { type: 'string' },
+                  },
+                  required: ['file', 'summary', 'type'],
+                },
+              },
+            },
+            required: ['items'],
+          },
+        },
+      ),
+  ],
+  keyFn: (bug) => `${bug.file}:${bug.line}:${bug.summary}`,
+  verify: async (bug) =>
+    verify(bug, {
+      mode: 'adversarial',
+      skeptics: 3,
+      threshold: 2,
+      schema: {
+        type: 'object',
+        properties: { real: { type: 'boolean' }, reason: { type: 'string' } },
+        required: ['real', 'reason'],
+      },
+    }),
+  dryRounds: 2,
+  maxRounds: 10,
+})
+
+log(
+  `${converged ? 'Converged' : 'Max rounds reached'} after ${rounds} rounds. ${totalSeen} unique bugs seen, ${confirmed.length} confirmed.`,
+)
+
+phase('Report')
+if (confirmed.length === 0) {
+  return `No confirmed bugs found after ${rounds} rounds of hunting.`
+}
+return await agent(
+  `Write a bug report from ${confirmed.length} confirmed bugs:\n${JSON.stringify(confirmed)}`,
+  { label: 'report' },
+)

package/skills/workflows/judge.js

@@ -0,0 +1,55 @@
+export const meta = {
+  name: 'judge',
+  description: 'Judge panel: N competing approaches × M judges → winner + synthesis',
+  phases: [
+    { title: 'Generate', detail: 'generate competing approaches' },
+    { title: 'Judge', detail: 'score and rank' },
+    { title: 'Synthesize', detail: 'final recommendation' },
+  ],
+}
+
+phase('Generate')
+const problem = args.problem || (await agent('What problem are we solving?', { label: 'query' }))
+
+const approaches = await parallel([
+  () => agent(`Solve "${problem}" with an MVP-first approach.`, { label: 'gen:mvp' }),
+  () => agent(`Solve "${problem}" with a risk-first approach.`, { label: 'gen:risk' }),
+  () => agent(`Solve "${problem}" with a user-first approach.`, { label: 'gen:user' }),
+])
+
+const validApproaches = approaches.filter(Boolean)
+log(`Generated ${validApproaches.length} approaches`)
+
+phase('Judge')
+const { winner, winnerIndex, scores, synthesis } = await judge(validApproaches, {
+  criteria: ['feasibility', 'impact', 'simplicity', 'risk'],
+  judges: 3,
+  synthesize: true,
+  schema: {
+    type: 'object',
+    properties: {
+      scores: {
+        type: 'object',
+        properties: {
+          feasibility: { type: 'number' },
+          impact: { type: 'number' },
+          simplicity: { type: 'number' },
+          risk: { type: 'number' },
+        },
+        required: ['feasibility', 'impact', 'simplicity', 'risk'],
+      },
+      notes: { type: 'string' },
+    },
+    required: ['scores', 'notes'],
+  },
+})
+
+phase('Synthesize')
+return {
+  problem,
+  winner: `Approach #${winnerIndex + 1}`,
+  scores_summary: scores.map(
+    (s) => `Judge ${s.judgeIndex + 1}: approach ${s.attemptIndex + 1} = ${s.total}`,
+  ),
+  synthesis,
+}

package/skills/workflows/migrate.js

@@ -0,0 +1,92 @@
+export const meta = {
+  name: 'migrate',
+  description: 'Code migration: discover → fan-out transform → verify → integrate',
+  phases: [
+    { title: 'Discover', detail: 'find migration targets' },
+    { title: 'Transform', detail: 'one agent per file' },
+    { title: 'Verify', detail: 'validate transformations' },
+  ],
+}
+
+phase('Discover')
+const pattern =
+  args.pattern ||
+  (await agent('What code pattern needs migration? Return { pattern, replacement, reason }', {
+    schema: {
+      type: 'object',
+      properties: {
+        pattern: { type: 'string' },
+        replacement: { type: 'string' },
+        reason: { type: 'string' },
+      },
+      required: ['pattern', 'replacement'],
+    },
+  }))
+
+const files = await agent(
+  `Find all files matching pattern: ${pattern.pattern}. Return { files: [{ path }] }`,
+  {
+    schema: {
+      type: 'object',
+      properties: {
+        files: {
+          type: 'array',
+          items: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] },
+        },
+      },
+      required: ['files'],
+    },
+  },
+)
+
+log(`Migrating ${files.files.length} files: ${pattern.pattern} → ${pattern.replacement}`)
+
+phase('Transform')
+const results = await pipeline(files.files, (f) =>
+  agent(
+    `In ${f.path}, migrate "${pattern.pattern}" to "${pattern.replacement}". Reason: ${pattern.reason}. Return { path, changes, success }`,
+    {
+      label: `migrate:${f.path}`,
+      isolation: 'worktree',
+      schema: {
+        type: 'object',
+        properties: {
+          path: { type: 'string' },
+          changes: { type: 'number' },
+          success: { type: 'boolean' },
+        },
+        required: ['path', 'success'],
+      },
+    },
+  ),
+)
+
+const succeeded = results.filter(Boolean).filter((r) => r.success)
+const failed = results.filter(Boolean).filter((r) => !r.success)
+log(`${succeeded.length} migrated, ${failed.length} failed`)
+
+phase('Verify')
+const verified = await parallel(
+  succeeded.map(
+    (f) => () =>
+      verify(
+        { file: f.path, migration: pattern.replacement },
+        {
+          mode: 'perspective',
+          lenses: ['correctness', 'style'],
+          threshold: 1,
+          schema: {
+            type: 'object',
+            properties: { real: { type: 'boolean' }, reason: { type: 'string' } },
+            required: ['real', 'reason'],
+          },
+        },
+      ),
+  ),
+)
+
+return {
+  migrated: succeeded.length,
+  failed: failed.length,
+  verified: verified.filter(Boolean).filter((v) => v.survives).length,
+}

package/skills/workflows/research.js

@@ -0,0 +1,87 @@
+export const meta = {
+  name: 'research',
+  description: 'Deep research: scope → parallel search → verify → synthesize',
+  phases: [
+    { title: 'Scope', detail: 'define research angles' },
+    { title: 'Research', detail: 'parallel web searches' },
+    { title: 'Verify', detail: 'adversarial verification' },
+    { title: 'Synthesize', detail: 'final report' },
+  ],
+}
+
+phase('Scope')
+const topic = args.topic || (await agent('What topic should we research?', { label: 'query' }))
+
+phase('Research')
+const angles = ['overview', 'technical-details', 'competitors', 'criticism', 'future-trends']
+const raw = await parallel(
+  angles.map(
+    (angle) => () =>
+      agent(
+        `Research "${topic}" from angle: ${angle}. Return { sources: [{ title, url, keyPoint }] }`,
+        {
+          label: `research:${angle}`,
+          schema: {
+            type: 'object',
+            properties: {
+              sources: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: {
+                    title: { type: 'string' },
+                    url: { type: 'string' },
+                    keyPoint: { type: 'string' },
+                  },
+                  required: ['title', 'keyPoint'],
+                },
+              },
+            },
+            required: ['sources'],
+          },
+        },
+      ),
+  ),
+)
+
+const allSources = raw.filter(Boolean).flatMap((r) => r.sources)
+const seen = new Set()
+const unique = allSources.filter((s) => {
+  const k = s.url
+  if (seen.has(k)) return false
+  seen.add(k)
+  return true
+})
+log(`Collected ${unique.length} unique sources`)
+
+phase('Verify')
+const verified = await parallel(
+  unique.map(
+    (s) => () =>
+      verify(
+        { claim: s.keyPoint, source: s.title },
+        {
+          mode: 'adversarial',
+          skeptics: 2,
+          threshold: 1,
+          schema: {
+            type: 'object',
+            properties: { real: { type: 'boolean' }, reason: { type: 'string' } },
+            required: ['real', 'reason'],
+          },
+        },
+      ),
+  ),
+)
+
+const credible = verified
+  .filter(Boolean)
+  .filter((v) => v.survives)
+  .map((v) => v.finding)
+
+phase('Synthesize')
+const report = await agent(
+  `Synthesize research report on "${topic}" from credible sources:\n${JSON.stringify(credible)}`,
+  { label: 'synthesize' },
+)
+return report

package/skills/workflows/review.js

@@ -0,0 +1,92 @@
+export const meta = {
+  name: 'review',
+  description: 'Code review: fan-out per dimension → judge panel → report',
+  phases: [
+    { title: 'Review', detail: 'multi-dimensional review' },
+    { title: 'Judge', detail: 'judge panel scores findings' },
+    { title: 'Report', detail: 'final review report' },
+  ],
+}
+
+phase('Review')
+const dimensions = ['correctness', 'security', 'performance', 'maintainability']
+const rawFindings = await parallel(
+  dimensions.map(
+    (d) => () =>
+      agent(
+        `Review the code from the "${d}" lens. Return { findings: [{ severity, file, line, summary }] }`,
+        {
+          label: `review:${d}`,
+          schema: {
+            type: 'object',
+            properties: {
+              findings: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: {
+                    severity: { type: 'string', enum: ['blocker', 'high', 'medium', 'low'] },
+                    file: { type: 'string' },
+                    line: { type: 'number' },
+                    summary: { type: 'string' },
+                    dimension: { type: 'string' },
+                  },
+                  required: ['severity', 'file', 'summary'],
+                },
+              },
+            },
+            required: ['findings'],
+          },
+        },
+      ),
+  ),
+)
+
+// Edge logic: dedup across dimensions (pure JS)
+const allFindings = rawFindings.filter(Boolean).flatMap((r) => r.findings)
+const seen = new Set()
+const uniqueFindings = allFindings.filter((f) => {
+  const k = `${f.file}:${f.line}:${f.summary}`
+  if (seen.has(k)) return false
+  seen.add(k)
+  return true
+})
+
+log(`${uniqueFindings.length} unique findings across ${dimensions.length} dimensions`)
+
+phase('Judge')
+if (uniqueFindings.length === 0) {
+  return 'No findings — code looks clean across all dimensions.'
+}
+
+// Judge panel: rank findings by severity
+const judged = await judge(
+  uniqueFindings.map((f) => ({ finding: f })),
+  {
+    criteria: ['severity', 'actionability', 'confidence'],
+    judges: 2,
+    synthesize: false,
+    schema: {
+      type: 'object',
+      properties: {
+        scores: {
+          type: 'object',
+          properties: {
+            severity: { type: 'number' },
+            actionability: { type: 'number' },
+            confidence: { type: 'number' },
+          },
+          required: ['severity', 'actionability', 'confidence'],
+        },
+        notes: { type: 'string' },
+      },
+      required: ['scores', 'notes'],
+    },
+  },
+)
+
+phase('Report')
+return await agent(
+  `Write a code review report from ${uniqueFindings.length} findings (ranked by judge panel). Top finding: ${JSON.stringify(judged.winner)}`,
+  { label: 'report' },
+)

package/src/agent/sub-agent.ts

@@ -4,6 +4,7 @@ import type { SubAgentType, SubAgentOptions, AgentDefinition } from './types'
 import { createAgentContext } from './agent-context'
 import { getBackgroundAgentRegistry } from './background-registry'
 import type { HookEngine } from '../core/hooks'
+import type { PermissionSystem } from '../core/permission'
 
 const TYPE_SYSTEM_PROMPTS: Record<SubAgentType, string> = {
   general: 'You are a focused sub-agent. Complete the assigned task thoroughly and return results.',
@@ -27,6 +28,7 @@ export class SubAgent {
   constructor(
     private registry: ProviderRegistry,
     private toolRegistry: Map<string, ToolDefinition>,
+    private permission?: PermissionSystem,
     private hookEngine?: HookEngine,
   ) {}
 
@@ -113,6 +115,9 @@ export class SubAgent {
     const agentType = options.type || 'general'
     const agentDef = options.agentDef
 
+    // Resolve execution directory: worktree isolation or process cwd
+    const execCwd = options.worktreePath || process.cwd()
+
     // Resolve system prompt: agentDef > options.systemPrompt > builtin type
     const systemPrompt =
       agentDef?.systemPrompt || options.systemPrompt || TYPE_SYSTEM_PROMPTS[agentType]
@@ -229,9 +234,21 @@ export class SubAgent {
             continue
           }
 
+          // Security: check permission before executing
+          // Sub-agents run without user interaction — tools requiring approval are rejected
+          if (this.permission?.needsApproval(tool, tu.input)) {
+            currentMessages.push({
+              role: 'user' as const,
+              content:
+                `Tool "${tu.name}" requires user approval (permission: ask). ` +
+                `Cannot execute in non-interactive sub-agent context.`,
+            })
+            continue
+          }
+
           try {
             const result = await tool.execute(tu.input, {
-              cwd: process.cwd(),
+              cwd: execCwd,
               sessionId: 'sub-agent',
               provider: '',
               model: resolvedModel,

package/src/agent/types.ts

@@ -44,4 +44,6 @@ export interface SubAgentOptions {
   runInBackground?: boolean
   /** Optional callback for streaming progress chunks during background execution. */
   onProgress?: (chunk: string) => void
+  /** When set, tool executions use this path as cwd (git worktree isolation). */
+  worktreePath?: string
 }

package/src/core/engine.ts

@@ -16,6 +16,7 @@ import type { AgentViewManager } from '../agent-view/agent-view-manager'
 import type { SkillsLoader } from '../skills/loader'
 import { getBackgroundAgentRegistry } from '../agent/background-registry'
 import { RulesLoader } from './rules-loader'
+import { UsageTracker } from './usage-tracker'
 import { buildRequest, sendInferenceCheck, isInferenceHookEnabled } from './inference-hook'
 
 export class QueryEngine {
@@ -82,6 +83,7 @@ export class QueryEngine {
   private rulesLoader?: RulesLoader
   /** Files touched in the current turn (for rules matching). */
   private touchedFiles: Set<string> = new Set()
+  private usageTracker = new UsageTracker()
   /** Inference hook (DLP) configuration. */
   private inferenceHookConfig?: InferenceHookConfig
 
@@ -238,6 +240,10 @@ export class QueryEngine {
     return this.permission
   }
 
+  getUsageTracker(): UsageTracker {
+    return this.usageTracker
+  }
+
   async *process(userInput: string, signal?: AbortSignal): AsyncGenerator<StreamChunk> {
     // Fire UserPromptSubmit hooks before processing
     if (this.hookEngine) {
@@ -293,6 +299,8 @@ export class QueryEngine {
     let assistantContent = ''
     let reasoningContent = ''
     let thinkingContent = ''
+    let turnApiInputTokens = 0
+    let turnApiOutputTokens = 0
     const toolUses: Array<{ id: string; name: string; input: Record<string, unknown> }> = []
 
     // Stream model response
@@ -331,6 +339,12 @@ export class QueryEngine {
           })
         }
 
+        if (chunk.type === 'usage' && chunk.inputTokens !== undefined) {
+          // Accumulate API-reported token counts for this turn
+          turnApiInputTokens += chunk.inputTokens
+          turnApiOutputTokens += chunk.outputTokens || 0
+        }
+
         if (chunk.type === 'stop') {
           // Add assistant response to context
           if (assistantContent || reasoningContent || thinkingContent) {
@@ -417,6 +431,31 @@ export class QueryEngine {
       })
     }
 
+    // Record API token usage for this turn, attributed to executed tools
+    if (turnApiInputTokens > 0 || turnApiOutputTokens > 0) {
+      if (toolUses.length > 0) {
+        // Attribute tokens equally across all tools invoked this turn
+        const perTool = toolUses.length
+        for (const tu of toolUses) {
+          this.usageTracker.recordApiUsage(
+            Math.round(turnApiInputTokens / perTool),
+            Math.round(turnApiOutputTokens / perTool),
+            tu.name,
+          )
+        }
+      } else {
+        this.usageTracker.recordApiUsage(turnApiInputTokens, turnApiOutputTokens, 'chat')
+      }
+    } else {
+      // Fallback: API doesn't report usage — use char-based estimate
+      const estimated = Math.round((assistantContent.length + userInput.length) / 4)
+      if (toolUses.length > 0) {
+        for (const tu of toolUses) {
+          this.usageTracker.recordEstimatedUsage(Math.round(estimated / toolUses.length), tu.name)
+        }
+      }
+    }
+
     // Inject path-scoped rules for touched files
     this.injectRules()
 
@@ -721,6 +760,7 @@ export class QueryEngine {
         artifactServer: this.artifactServer,
         agentRegistry: this.agentRegistry,
         backgroundAgentRegistry: getBackgroundAgentRegistry(),
+        permissionSystem: this.permission,
       })
 
       // Track touched files for rules matching

package/src/core/instructions.ts

@@ -66,6 +66,34 @@ export class InstructionsLoader {
       parts.push(this.skillsReminder)
     }
 
+    // Inject workflow auto-generation guidance
+    parts.push(`## Workflow Auto-Generation
+
+When a task involves 3+ independent subtasks, multi-file operations,
+or unknown-size discovery, generate a workflow script and execute it
+via the Workflow tool instead of running agents sequentially. The
+orchestration itself is code (zero tokens for inter-agent coordination).
+
+Prefer workflows for: audits across many files, web research with multiple
+sources, code migrations touching many files, security scans, bug hunts
+with unknown scope, multi-dimensional code reviews.
+
+Available primitives: agent(), parallel(), pipeline(), verify(),
+judge(), loopUntilConvergence(), phase(), log(), args, budget.
+
+Key rules:
+- Default to pipeline() — only use parallel() barrier when a stage
+  genuinely needs all prior results at once
+- Edge logic (flatten, dedupe, filter) is plain JS — not agent calls
+- Use verify() on edges where confidence matters
+- Use loopUntilConvergence() for discovery tasks with unknown size
+
+When a workflow completes successfully, offer to save it:
+"Workflow complete. Save this script? /workflow save <name>"
+
+Script format: export const meta = { name, description, phases: [...] }
+// script body using primitives...`)
+
     return parts.join('\n\n---\n\n')
   }
 

package/src/core/permission.ts

@@ -223,6 +223,11 @@ export class PermissionSystem {
       case 'auto':
         // Safety checks handled by hook layer (PreToolUse hooks).
         // Bypass the static permission system so hooks are the sole gate.
+        // Exception: SendMessage always goes through the permission classifier
+        // so deny/allow rules are honored for cross-session messages.
+        if (tool.name === 'SendMessage') {
+          return 'mode-baseline'
+        }
         return 'bypass'
 
       case 'dontAsk':