@miphamai/cli 0.14.0 → 0.16.0

package/src/index.tsx

@@ -1,4 +1,5 @@
 import { join } from 'node:path'
+import { existsSync } from 'node:fs'
 import { render } from 'ink'
 import { App } from './ui/app'
 import { loadConfig, loadInferenceHookConfig, loadCredentialMaskingConfig } from './config/loader'
@@ -85,12 +86,52 @@ export async function runApp(options: RunOptions): Promise<void> {
   // Initialize plugin manager
   const pluginManager = new PluginManager()
 
+  // Generate session name for tracking (used by /cd to persist cwd)
+  const sessionName = options.resume || `session-${new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)}`
+
   // Initialize context — restore saved session if available
-  const context = new ContextManager({ maxTokens: 200_000, compactionThreshold: 0.9 })
+  // Read the active model's context window for dynamic max-token sizing.
+  // MIPHAM_DISABLE_1M_CONTEXT=1 caps the effective window at 200K even for
+  // models that support larger contexts (e.g. 1M).
+  // When the model is unknown (not in any provider's model list), assume a
+  // conservative 128K context window. Set MIPHAM_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1
+  // to restore the old behavior (default 200K fallback for unknown models).
+  const activeModel = registry.findModel(defaultModel)
+  let modelContextWindow: number
+  if (activeModel) {
+    modelContextWindow = activeModel.contextWindow
+  } else if (process.env.MIPHAM_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT === '1') {
+    modelContextWindow = 200_000 // old behavior: default fallback
+  } else {
+    modelContextWindow = 128_000 // conservative assumption for unknown models
+    console.error(
+      `[mipham] ⚠ Unknown model "${defaultModel}": assuming 128K context window. ` +
+        `Set MIPHAM_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to disable.`,
+    )
+  }
+
+  const DISABLE_1M = process.env.MIPHAM_DISABLE_1M_CONTEXT === '1'
+  const contextMaxTokens = (DISABLE_1M && modelContextWindow > 200_000)
+    ? 200_000
+    : modelContextWindow
+
+  if (DISABLE_1M && modelContextWindow <= 200_000) {
+    console.error('[mipham] ⚠ MIPHAM_DISABLE_1M_CONTEXT is set but auto-compaction is not holding the session to 200K — model context window is already ≤ 200K')
+  }
+
+  const context = new ContextManager({ maxTokens: contextMaxTokens, compactionThreshold: 0.9 })
 
   if (options.resume) {
     const saved = SessionStore.load(options.resume)
     if (saved) {
+      // Restore working directory if saved
+      if (saved.metadata.cwd && existsSync(saved.metadata.cwd)) {
+        try {
+          process.chdir(saved.metadata.cwd)
+        } catch {
+          // cwd may no longer exist; silently continue
+        }
+      }
       for (const msg of saved.messages) {
         context.addMessage(msg)
       }
@@ -169,6 +210,11 @@ export async function runApp(options: RunOptions): Promise<void> {
     engine.getPermission().setDefaultLevel(config.permission as PermissionLevel)
   }
 
+  // Apply org-level permission restrictions (P0: bypassPermissions policy gap)
+  if (config.permissionRestrictions) {
+    engine.getPermission().setRestrictions(config.permissionRestrictions)
+  }
+
   // Initialize agent registry and load plugin agents/skills/MCP/hooks
   const agentRegistry = new AgentRegistry()
   agentRegistry.loadUserAgents()
@@ -190,9 +236,10 @@ export async function runApp(options: RunOptions): Promise<void> {
   const saveAndExit = () => {
     artifactServer.stop()
     if (context.getMessageCount() > 0) {
-      SessionStore.autoSave(context.getMessages(), {
+      SessionStore.save(sessionName, context.getMessages(), {
         provider: defaultProvider,
         model: defaultModel,
+        cwd: process.cwd(),
       })
     }
     process.exit(0)
@@ -211,6 +258,7 @@ export async function runApp(options: RunOptions): Promise<void> {
       skillsLoader={skillsLoader}
       pluginManager={pluginManager}
       version={options.version}
+      sessionId={sessionName}
     />,
   )
   await waitUntilExit()

package/src/providers/anthropic.ts

@@ -194,7 +194,15 @@ export class AnthropicProvider implements ProviderInstance {
             }
 
             case 'message_delta': {
-              // Contains stop_reason and usage info
+              // Capture token usage for accurate cost tracking
+              if (event.usage) {
+                yield {
+                  type: 'usage',
+                  inputTokens: event.usage.input_tokens,
+                  outputTokens: event.usage.output_tokens,
+                }
+              }
+              // Contains stop_reason; also handles late input_json_delta
               if (event.delta?.type === 'input_json_delta' && event.delta.partial_json) {
                 accumulatedToolInput += event.delta.partial_json
               }

package/src/providers/openai-compat.ts

@@ -99,6 +99,16 @@ export class OpenAICompatProvider implements ProviderInstance {
         try {
           const parsed = JSON.parse(data)
           const choice = parsed.choices?.[0]
+
+          // Capture token usage when available (final chunk with stream_options.include_usage)
+          if (parsed.usage) {
+            yield {
+              type: 'usage',
+              inputTokens: parsed.usage.prompt_tokens,
+              outputTokens: parsed.usage.completion_tokens,
+            }
+          }
+
           if (!choice) continue
 
           const delta = choice.delta

package/src/providers/registry.ts

@@ -64,6 +64,14 @@ export class ProviderRegistry {
     return provider.config.models.filter((m) => m.status === 'active')
   }
 
+  findModel(modelId: string): ModelInfo | undefined {
+    for (const provider of this.providers.values()) {
+      const model = provider.config.models.find((m) => m.id === modelId)
+      if (model) return model
+    }
+    return undefined
+  }
+
   async *chat(req: ChatRequest): AsyncGenerator<StreamChunk> {
     const provider = this.getActive()
     yield* provider.chat({ ...req, model: req.model || this.activeModelId })

package/src/shared/sanitize.ts

@@ -0,0 +1,38 @@
+/**
+ * Unicode sanitization for tool inputs.
+ * Strips invisible/control characters that could hide command content
+ * from visual inspection or enable homoglyph attacks.
+ *
+ * Claude Code v2.1.223 parity: hidden command text via tabs/invisible Unicode.
+ */
+
+const DANGEROUS_UNICODE = /[​‌‍‎‏‪‫‬‭‮⁠⁦⁧⁨⁩]/g
+
+/**
+ * Strip dangerous invisible Unicode characters from a string.
+ * - Zero-width: U+200B (ZWSP), U+200C (ZWNJ), U+200D (ZWJ), U+200E/F (LTR/RTL marks)
+ * - Bidi controls: U+202A-E, U+2066-9
+ * - Word joiner: U+2060
+ * - BOM: U+FEFF
+ */
+export function stripDangerousUnicode(input: string): string {
+  if (!input) return input
+  return input.replace(DANGEROUS_UNICODE, '')
+}
+
+/**
+ * Recursively sanitize all string values in a params object.
+ */
+export function sanitizeParams(params: Record<string, unknown>): Record<string, unknown> {
+  const result: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(params)) {
+    if (typeof value === 'string') {
+      result[key] = stripDangerousUnicode(value)
+    } else if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+      result[key] = sanitizeParams(value as Record<string, unknown>)
+    } else {
+      result[key] = value
+    }
+  }
+  return result
+}

package/src/shared/types.ts

@@ -81,6 +81,7 @@ export interface ToolContext {
   artifactServer?: import('../artifacts/server').ArtifactServer
   agentRegistry?: import('../agent/agent-registry').AgentRegistry
   backgroundAgentRegistry?: import('../agent/background-registry').BackgroundAgentRegistry
+  permissionSystem?: import('../core/permission').PermissionSystem
 }
 
 // ── Artifact Types ──
@@ -128,7 +129,15 @@ export interface TaskNotification {
 
 // ── Stream Types ──
 export interface StreamChunk {
-  type: 'text' | 'tool_use' | 'tool_result' | 'thinking' | 'stop' | 'error' | 'task_notification'
+  type:
+    | 'text'
+    | 'tool_use'
+    | 'tool_result'
+    | 'thinking'
+    | 'stop'
+    | 'error'
+    | 'task_notification'
+    | 'usage'
   content?: string
   toolUse?: ToolUseContent
   tool_use_id?: string
@@ -139,6 +148,10 @@ export interface StreamChunk {
   thinking?: string
   /** Background task notification payload (type: 'task_notification'). */
   taskNotification?: TaskNotification
+  /** API-reported input token count (type: 'usage'). */
+  inputTokens?: number
+  /** API-reported output token count (type: 'usage'). */
+  outputTokens?: number
 }
 
 // ── Config Types ──
@@ -147,8 +160,16 @@ export interface MiphamConfig {
   defaultProvider: string
   defaultModel: string
   permission: ToolPermission
+  /** Org-level permission restrictions (forbiddenModes, maxAllowedMode). */
+  permissionRestrictions?: PermissionRestrictions
   providers: ProviderConfig[]
   skills?: { paths: string[]; mcpServers: McpServerConfig[] }
+  marketplace?: {
+    /** If set, only allow installs from matching repos (e.g. ["One-Mipham/*"]) */
+    strictKnownMarketplaces?: string[]
+    /** Block installs from matching repos (e.g. ["malicious-org/*"]) */
+    blockedMarketplaces?: string[]
+  }
 }
 
 export interface McpServerConfig {
@@ -274,10 +295,20 @@ export type PermissionMode =
 /** Backward-compatible alias: PermissionMode plus legacy 'ask' and 'bypass' */
 export type PermissionLevel = PermissionMode | 'ask' | 'bypass'
 
+/** Org-level restrictions that cap or forbid specific permission modes. */
+export interface PermissionRestrictions {
+  /** Modes that may not be entered (cycle skips them). */
+  forbiddenModes?: PermissionMode[]
+  /** Ceiling — modes ranked higher (more permissive) than this are treated as forbidden. */
+  maxAllowedMode?: PermissionMode
+}
+
 export interface PermissionConfig {
   mode: PermissionMode
   allow: string[]
   deny: string[]
+  /** Optional org-level restrictions enforced on every mode transition. */
+  restrictions?: PermissionRestrictions
 }
 
 export interface PermissionRuleEntry {

package/src/skills/fork-executor.ts

@@ -2,6 +2,7 @@ import { SubAgent } from '../agent/sub-agent'
 import type { ProviderRegistry } from '../providers/registry'
 import type { ToolDefinition, SkillDefinition } from '../shared/index.ts'
 import type { AgentDefinition } from '../agent/types'
+import type { PermissionSystem } from '../core/permission'
 
 /**
  * Execute a skill in an isolated subagent context (context: fork).
@@ -15,6 +16,7 @@ export async function executeForkedSkill(
   args: string,
   registry: ProviderRegistry,
   toolRegistry: Map<string, ToolDefinition>,
+  permissionSystem?: PermissionSystem,
 ): Promise<string> {
   const agentDef: AgentDefinition = {
     name: `skill:${skill.name}`,
@@ -27,7 +29,7 @@ export async function executeForkedSkill(
     source: 'builtin',
   }
 
-  const sub = new SubAgent(registry, toolRegistry)
+  const sub = new SubAgent(registry, toolRegistry, permissionSystem)
   const prompt = args
     ? `Execute the "${skill.name}" skill with arguments: ${args}`
     : `Execute the "${skill.name}" skill.`

package/src/skills/registry.ts

@@ -10,6 +10,7 @@ import { join } from 'node:path'
 import { homedir } from 'node:os'
 import { spawnSync } from 'node:child_process'
 import { URL } from 'node:url'
+import type { MiphamConfig } from '../shared/types.js'
 
 const SKILLS_DIR = join(homedir(), '.mipham', 'skills')
 
@@ -141,13 +142,58 @@ export function searchSkills(query: string): SkillEntry[] {
   )
 }
 
+/**
+ * Match a marketplace pattern against an owner/repo.
+ *
+ * - "owner/*"  → matches any repo under that owner
+ * - "owner/repo" → exact match
+ */
+function matchOwnerPattern(pattern: string, owner: string, repo: string): boolean {
+  if (pattern.endsWith('/*')) {
+    return pattern.slice(0, -2) === owner
+  }
+  return pattern === repo
+}
+
+/**
+ * Check whether a GitHub URL (or any URL) is allowed by the marketplace config.
+ *
+ * Rules (in order):
+ * 1. No config → allow everything
+ * 2. blockedMarketplaces matched → deny (deny wins over allow)
+ * 3. strictKnownMarketplaces set → deny unless matched
+ * 4. Non-GitHub URL with no strict list → allow
+ * 5. Non-GitHub URL with strict list → deny
+ */
+function isMarketplaceAllowed(url: string, config?: MiphamConfig['marketplace']): boolean {
+  if (!config) return true
+  const { strictKnownMarketplaces, blockedMarketplaces } = config
+  const match = url.match(/github\.com\/([^/]+\/[^/]+)/)
+  if (!match) return !strictKnownMarketplaces?.length // non-GitHub: allow only if no strict list
+  const repo = match[1]! // "owner/repo"
+  const [owner] = repo.split('/')
+
+  // Check blocked first (deny wins)
+  if (blockedMarketplaces?.some((pattern) => matchOwnerPattern(pattern, owner!, repo))) return false
+  // Check strict allowlist
+  if (
+    strictKnownMarketplaces?.length &&
+    !strictKnownMarketplaces.some((pattern) => matchOwnerPattern(pattern, owner!, repo))
+  )
+    return false
+  return true
+}
+
 /**
  * Install a skill from a GitHub repository.
  *
  * Clones the repo to a temp directory, copies the skill file(s),
  * and cleans up.
  */
-export function installSkill(skillName: string): InstallResult {
+export function installSkill(
+  skillName: string,
+  marketplaceConfig?: MiphamConfig['marketplace'],
+): InstallResult {
   const entry = COMMUNITY_SKILLS.find((s) => s.name === skillName)
   if (!entry) {
     return {
@@ -157,6 +203,15 @@ export function installSkill(skillName: string): InstallResult {
     }
   }
 
+  // Check marketplace restrictions
+  if (!isMarketplaceAllowed(entry.url, marketplaceConfig)) {
+    return {
+      success: false,
+      name: skillName,
+      message: `Skill "${skillName}" is from a blocked or unapproved marketplace: ${entry.url}`,
+    }
+  }
+
   // Built-in skills are already available — no download needed
   if (entry.builtin) {
     return {
@@ -214,7 +269,19 @@ export function installSkill(skillName: string): InstallResult {
 /**
  * Install a skill from a direct URL (GitHub raw, gist, or any HTTP URL).
  */
-export function installSkillFromUrl(url: string): InstallResult {
+export function installSkillFromUrl(
+  url: string,
+  marketplaceConfig?: MiphamConfig['marketplace'],
+): InstallResult {
+  // Check marketplace restrictions
+  if (!isMarketplaceAllowed(url, marketplaceConfig)) {
+    return {
+      success: false,
+      name: url,
+      message: `URL is from a blocked or unapproved marketplace: ${url}`,
+    }
+  }
+
   // Derive skill name from URL
   const name =
     url

package/src/tools/agent/agent.ts

@@ -60,7 +60,7 @@ export const agentTool: ToolDefinition = {
     const agentDef = ctx.agentRegistry?.resolve(agentType)
 
     try {
-      const sub = new SubAgent(registry, toolRegistry)
+      const sub = new SubAgent(registry, toolRegistry, ctx.permissionSystem)
       const result = await sub.execute(prompt, description, {
         type: agentType,
         agentDef,

package/src/tools/agent/skill.ts

@@ -52,6 +52,7 @@ export const skillTool: ToolDefinition = {
             args,
             registry,
             ctx.toolRegistry || new Map(),
+            ctx.permissionSystem,
           )
           // Return to AI as internal context
           return { success: true, content: `[Forked skill "${skillName}" result]:\n${result}` }

package/src/tools/exec/bash.ts

@@ -52,6 +52,18 @@ const BLOCKED_PATTERNS = [
   /\bscp\s+.*(?:\.ssh|\.aws|\.env)/,
   // Write to system paths
   />\s*\/(?:etc|usr|boot|sys|proc)\//,
+  // P0 hardening — ANSI-C quoting bypass (e.g. $'\x72\x6d' = rm)
+  /\$'\\x[0-9a-fA-F]{2}/,
+  // P0 hardening — nested interpreter invocation
+  /\b(?:bash|sh|zsh|dash|ksh)\s+-c\b/,
+  // P0 hardening — eval builtin (obfuscation vector)
+  /\beval\s+/,
+  // P0 hardening — exec redirect bypass (e.g. exec >/dev/sda)
+  /\bexec\s+\d*>/,
+  // P0 hardening — source/dot builtin (script sourcing)
+  /\bsource\s+/,
+  // P0 hardening — base64 decode + pipe
+  /\bbase64\s+(?:-d|--decode)\b/,
 ]
 
 const BLOCKED_COMMANDS = [
@@ -71,18 +83,38 @@ const BLOCKED_COMMANDS = [
   'init',
   'telinit',
   'systemctl',
+  'eval',
+  'exec',
+  'source',
+  '.',
 ]
 
+/**
+ * Normalize ANSI-C escape sequences ($'...') in a command string.
+ * Converts hex escapes (\xHH) back to literal characters so that
+ * existing patterns (e.g. rm -rf /) still catch obfuscated payloads.
+ */
+function normalizeEscapes(command: string): string {
+  return command.replace(/\$'([^']*)'/g, (_, inner: string) =>
+    inner.replace(/\\x([0-9a-fA-F]{2})/g, (_, hex: string) =>
+      String.fromCharCode(parseInt(hex, 16)),
+    ),
+  )
+}
+
 function isBlocked(command: string): string | null {
-  // Check exact blocked commands
-  const firstWord = command.trim().split(/\s+/)[0]
+  // Normalize ANSI-C escape sequences for defense-in-depth
+  const normalized = normalizeEscapes(command)
+
+  // Check exact blocked commands (on normalized command)
+  const firstWord = normalized.trim().split(/\s+/)[0]
   if (firstWord && BLOCKED_COMMANDS.includes(firstWord)) {
-    return `Command "${firstWord}" is blocked (destructive filesystem operation).`
+    return `Command "${firstWord}" rejected by security policy.`
   }
 
-  // Check dangerous patterns
+  // Check dangerous patterns (on both original and normalized)
   for (const pattern of BLOCKED_PATTERNS) {
-    if (pattern.test(command)) {
+    if (pattern.test(command) || pattern.test(normalized)) {
       return `Command rejected by security policy. Pattern matched: ${pattern.source.slice(0, 40)}...`
     }
   }

package/src/tools/index.ts

@@ -1,4 +1,5 @@
 import type { ToolDefinition, ToolResult } from '../shared/index.ts'
+import { sanitizeParams } from '../shared/sanitize'
 import { readTool } from './file/read'
 import { writeTool } from './file/write'
 import { editTool } from './file/edit'
@@ -96,11 +97,13 @@ function withValidation(tool: ToolDefinition): ToolDefinition {
   return {
     ...tool,
     async execute(params, ctx): Promise<ToolResult> {
-      const errors = validateParams(schema, params)
+      // Sanitize dangerous Unicode from all inputs
+      const cleanParams = sanitizeParams(params)
+      const errors = validateParams(schema, cleanParams)
       if (errors.length > 0) {
         return { success: false, content: '', error: `Invalid parameters: ${errors.join('; ')}` }
       }
-      return tool.execute(params, ctx)
+      return tool.execute(cleanParams, ctx)
     },
   }
 }

package/src/ui/app.tsx

@@ -1,9 +1,10 @@
-import React, { useState, useCallback, useRef, useMemo } from 'react'
+import React, { useState, useCallback, useEffect, useRef, useMemo } from 'react'
 import { Box, Text, useInput } from 'ink'
 import type { QueryEngine } from '../core/engine'
 import type { MiphamConfig } from '../shared/index.ts'
 import type { SkillsLoader } from '../skills/loader'
 import type { PluginManager } from '../plugin/plugin-manager'
+import { getPreference, setPreference } from '../config/preferences'
 import { AgentRegistry } from '../agent/agent-registry'
 import { ChatPanel } from './chat'
 import { InputBar } from './input'
@@ -26,6 +27,7 @@ interface AppProps {
   skillsLoader?: SkillsLoader
   pluginManager?: PluginManager
   version?: string
+  sessionId?: string
 }
 
 export interface ToolMeta {
@@ -84,6 +86,7 @@ export function App({
   skillsLoader,
   pluginManager,
   version,
+  sessionId,
 }: AppProps) {
   const [messages, setMessages] = useState<ChatMessage[]>([])
   const [isLoading, setIsLoading] = useState(false)
@@ -100,6 +103,12 @@ export function App({
   const [agentProgress, setAgentProgress] = useState<AgentProgress | null>(null)
   const [agentElapsed, setAgentElapsed] = useState(0)
 
+  // Load persisted effort on mount
+  useEffect(() => {
+    const saved = getPreference('lastCodeReviewEffort', 'high')
+    setEffort(saved)
+  }, [])
+
   // Agent elapsed timer
   React.useEffect(() => {
     if (!agentProgress) {
@@ -131,15 +140,19 @@ export function App({
       providerId,
       modelId,
       version: version || '0.0.0',
+      sessionId: sessionId || '',
       setSessionTitle: (title: string) => setSessionTitle(title),
       setFastMode: (on: boolean) => setFastMode(on),
-      setEffort: (level: string) => setEffort(level),
+      setEffort: (level: string) => {
+        setEffort(level)
+        setPreference('lastCodeReviewEffort', level)
+      },
       setFocusMode: (on: boolean) => setFocusMode(on),
       setGoal: (text: string) => setGoalText(text),
       skillsLoader,
       pluginManager,
     }),
-    [engine, config, providerId, modelId, skillsLoader, pluginManager],
+    [engine, config, providerId, modelId, skillsLoader, pluginManager, sessionId],
   )
 
   const handleSubmit = useCallback(