@miphamai/cli 0.15.0 → 0.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent/message-bus.ts

@@ -11,6 +11,8 @@
  *   const unread = bus.poll('bg-1')  // messages addressed TO bg-1
  */
 
+export type AgentMessageType = 'message' | 'warning' | 'error'
+
 export interface AgentMessage {
   id: string
   from: string
@@ -19,6 +21,7 @@ export interface AgentMessage {
   message: string
   timestamp: Date
   read: boolean
+  type: AgentMessageType
 }
 
 export class AgentMessageBus {
@@ -29,7 +32,7 @@ export class AgentMessageBus {
    * Post a message from one agent to another.
    * Returns the message ID.
    */
-  post(from: string, to: string, summary: string, message: string): string {
+  post(from: string, to: string, summary: string, message: string, type: AgentMessageType = 'message'): string {
     const id = `msg-${++this.idCounter}`
     this.messages.push({
       id,
@@ -39,6 +42,7 @@ export class AgentMessageBus {
       message,
       timestamp: new Date(),
       read: false,
+      type,
     })
     return id
   }
@@ -91,6 +95,14 @@ export class AgentMessageBus {
     return this.messages.filter((m) => m.to === agentId && !m.read).length
   }
 
+  /**
+   * Get all unread warning messages for an agent.
+   * Does NOT mark them as read — use markRead() for that.
+   */
+  getWarnings(agentId: string): AgentMessage[] {
+    return this.messages.filter((m) => m.to === agentId && m.type === 'warning' && !m.read)
+  }
+
   /**
    * Prune messages older than maxAgeMs. Returns the number pruned.
    */

package/src/agent/sub-agent.ts

@@ -3,6 +3,7 @@ import type { ToolDefinition } from '../shared/index.ts'
 import type { SubAgentType, SubAgentOptions, AgentDefinition } from './types'
 import { createAgentContext } from './agent-context'
 import { getBackgroundAgentRegistry } from './background-registry'
+import { getMessageBus } from './message-bus'
 import type { HookEngine } from '../core/hooks'
 import type { PermissionSystem } from '../core/permission'
 
@@ -156,6 +157,22 @@ export class SubAgent {
     // 'inherit' means use parent model
     const resolvedModel = modelToUse === 'inherit' ? model : modelToUse
 
+    // Validate resolved model exists in registry; fall back to parent model with warning
+    let finalModel = resolvedModel
+    if (resolvedModel !== model) {
+      const modelExists = this.registry.findModel(resolvedModel) !== undefined
+      if (!modelExists) {
+        const warnMsg = `Warning: model "${resolvedModel}" not found in provider registry. Falling back to "${model}".`
+        console.warn(warnMsg)
+
+        // Post warning to message bus for UI display
+        const bus = getMessageBus()
+        bus.post('system', 'main', `Sub-agent model fallback: ${resolvedModel} → ${model}`, warnMsg, 'warning')
+
+        finalModel = model
+      }
+    }
+
     const chunks: string[] = []
     const MAX_TOOL_TURNS = options.maxTurns || 5
 
@@ -173,7 +190,7 @@ export class SubAgent {
         let turnText = ''
 
         for await (const chunk of provider.chat({
-          model: resolvedModel,
+          model: finalModel,
           messages: currentMessages,
           systemPrompt: currentSystemPrompt,
           tools: toolDefs,
@@ -251,7 +268,7 @@ export class SubAgent {
               cwd: execCwd,
               sessionId: 'sub-agent',
               provider: '',
-              model: resolvedModel,
+              model: finalModel,
             })
 
             currentMessages.push({

package/src/config/defaults.ts

@@ -13,6 +13,10 @@ export const DEFAULT_CONFIG: MiphamConfig = {
   defaultModel: 'deepseek-v4-pro',
   permission: 'auto',
   providers: DEFAULT_PROVIDERS,
+  marketplace: {
+    strictKnownMarketplaces: [],
+    blockedMarketplaces: [],
+  },
 }
 
 export const DEFAULT_INFERENCE_HOOK_CONFIG: InferenceHookConfig = {

package/src/config/preferences.ts

@@ -0,0 +1,45 @@
+/**
+ * Lightweight preferences store backed by ~/.mipham/preferences.json.
+ * Used for persisting user-level UI state (e.g. last code review effort).
+ *
+ * NOT for config.yml settings — those belong in the YAML config system.
+ * NOT for secrets — this file is plain JSON, not encrypted.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+
+const PREFS_PATH = join(homedir(), '.mipham', 'preferences.json')
+
+function readPrefs(): Record<string, string> {
+  try {
+    if (!existsSync(PREFS_PATH)) return {}
+    const raw = readFileSync(PREFS_PATH, 'utf-8')
+    const parsed: unknown = JSON.parse(raw)
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return {}
+    return parsed as Record<string, string>
+  } catch {
+    return {}
+  }
+}
+
+function writePrefs(prefs: Record<string, string>): void {
+  try {
+    const dir = join(homedir(), '.mipham')
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 })
+    writeFileSync(PREFS_PATH, JSON.stringify(prefs, null, 2), { mode: 0o600, encoding: 'utf-8' })
+  } catch {
+    // best-effort; never crash because preferences failed to save
+  }
+}
+
+export function getPreference(key: string, defaultValue: string): string {
+  const prefs = readPrefs()
+  return prefs[key] ?? defaultValue
+}
+
+export function setPreference(key: string, value: string): void {
+  const prefs = readPrefs()
+  prefs[key] = value
+  writePrefs(prefs)
+}

package/src/core/context.ts

@@ -55,6 +55,15 @@ export class ContextManager {
 
   constructor(private config: ContextConfig) {}
 
+  /** Dynamically update the max token limit (e.g., when switching models). */
+  updateMaxTokens(maxTokens: number): void {
+    this.config.maxTokens = maxTokens
+  }
+
+  getMaxTokens(): number {
+    return this.config.maxTokens
+  }
+
   /** Set an optional LLM summarizer for intelligent compaction. */
   setSummarizer(fn: Summarizer): void {
     this.summarizer = fn

package/src/core/engine.ts

@@ -41,7 +41,7 @@ export class QueryEngine {
     private registry: ProviderRegistry,
     private context: ContextManager,
     private tools: Map<string, ToolDefinition>,
-    private permission: PermissionSystem = new PermissionSystem('bypass'),
+    private permission: PermissionSystem = new PermissionSystem('default'),
   ) {}
 
   /** Register a hook engine for pre/post tool-use lifecycle events. */
@@ -821,6 +821,17 @@ export class QueryEngine {
 
   switchProvider(providerId: string, modelId?: string): void {
     this.registry.switchProvider(providerId, modelId)
+    // Update context manager's max tokens to match the new model's context window
+    if (modelId) {
+      const model = this.registry.findModel(modelId)
+      if (model) {
+        const DISABLE_1M = process.env.MIPHAM_DISABLE_1M_CONTEXT === '1'
+        const maxTokens = (DISABLE_1M && model.contextWindow > 200_000)
+          ? 200_000
+          : model.contextWindow
+        this.context.updateMaxTokens(maxTokens)
+      }
+    }
   }
 
   /** Wrap context compaction with PreCompact/PostCompact hooks. */

package/src/core/permission-config.ts

@@ -1,4 +1,4 @@
-import type { PermissionConfig, PermissionMode } from '../shared/index.ts'
+import type { PermissionConfig, PermissionMode, PermissionRestrictions } from '../shared/index.ts'
 
 const DEFAULT_CONFIG: PermissionConfig = {
   mode: 'default',
@@ -15,11 +15,15 @@ export function loadPermissionConfig(raw: Partial<PermissionConfig> = {}): Permi
     mode: (raw.mode as PermissionMode) || DEFAULT_CONFIG.mode,
     allow: Array.isArray(raw.allow) ? raw.allow : [...DEFAULT_CONFIG.allow],
     deny: Array.isArray(raw.deny) ? raw.deny : [...DEFAULT_CONFIG.deny],
+    restrictions: raw.restrictions ?? undefined,
   }
 }
 
-/** Valid mode transition order for Shift+Tab cycling. */
-export const MODE_CYCLE: PermissionMode[] = [
+/**
+ * Permission modes ordered from least to most permissive.
+ * Used to enforce maxAllowedMode: any mode ranked higher than the cap is forbidden.
+ */
+export const PERMISSION_MODE_HIERARCHY: PermissionMode[] = [
   'default',
   'acceptEdits',
   'plan',
@@ -28,7 +32,67 @@ export const MODE_CYCLE: PermissionMode[] = [
   'bypassPermissions',
 ]
 
-export function nextMode(current: PermissionMode): PermissionMode {
-  const idx = MODE_CYCLE.indexOf(current)
-  return MODE_CYCLE[(idx + 1) % MODE_CYCLE.length]!
+/** Valid mode transition order for Shift+Tab cycling. */
+export const MODE_CYCLE: PermissionMode[] = [...PERMISSION_MODE_HIERARCHY]
+
+/** Resolve which modes are actually permitted given the restrictions. */
+export function getAllowedModes(restrictions?: PermissionRestrictions): PermissionMode[] {
+  let allowed = [...MODE_CYCLE]
+
+  if (restrictions?.forbiddenModes && restrictions.forbiddenModes.length > 0) {
+    const forbidden = new Set(restrictions.forbiddenModes)
+    allowed = allowed.filter((m) => !forbidden.has(m))
+  }
+
+  if (restrictions?.maxAllowedMode) {
+    const capIdx = PERMISSION_MODE_HIERARCHY.indexOf(restrictions.maxAllowedMode)
+    if (capIdx >= 0) {
+      allowed = allowed.filter((m) => PERMISSION_MODE_HIERARCHY.indexOf(m) <= capIdx)
+    }
+  }
+
+  return allowed
+}
+
+/** Check whether a given mode is permitted under the restrictions. */
+export function isModeAllowed(
+  mode: PermissionMode,
+  restrictions?: PermissionRestrictions,
+): boolean {
+  return getAllowedModes(restrictions).includes(mode)
+}
+
+/**
+ * Return the highest allowed mode at or below `desired` given the restrictions.
+ * Used to silently downgrade when a forbidden mode is requested.
+ */
+export function clampMode(
+  desired: PermissionMode,
+  restrictions?: PermissionRestrictions,
+): PermissionMode {
+  const allowed = getAllowedModes(restrictions)
+  if (allowed.includes(desired)) return desired
+
+  // Walk downward through the hierarchy to find the closest allowed mode
+  const desiredIdx = PERMISSION_MODE_HIERARCHY.indexOf(desired)
+  for (let i = desiredIdx - 1; i >= 0; i--) {
+    const candidate = PERMISSION_MODE_HIERARCHY[i]!
+    if (allowed.includes(candidate)) return candidate
+  }
+
+  // Fallback: return the first allowed mode (should always be at least 'default')
+  return allowed[0] ?? 'default'
+}
+
+export function nextMode(
+  current: PermissionMode,
+  restrictions?: PermissionRestrictions,
+): PermissionMode {
+  const allowed = getAllowedModes(restrictions)
+  const idx = allowed.indexOf(current)
+  if (idx === -1) {
+    // Current mode is not in the allowed set — clamp then find next
+    return clampMode(current, restrictions)
+  }
+  return allowed[(idx + 1) % allowed.length]!
 }

package/src/core/permission.ts

@@ -3,10 +3,11 @@ import type {
   PermissionMode,
   PermissionLevel,
   PermissionRule,
+  PermissionRestrictions,
 } from '../shared/index.ts'
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchBashRule, compileRule } from './permission-rules'
-import { loadPermissionConfig, nextMode, MODE_CYCLE } from './permission-config'
+import { loadPermissionConfig, nextMode, clampMode, MODE_CYCLE } from './permission-config'
 
 const VALID_MODES: Set<string> = new Set<string>(MODE_CYCLE)
 
@@ -25,6 +26,9 @@ export class PermissionSystem {
   private checkCache = new Map<string, PermissionLevel>()
   private cacheMode: PermissionMode | null = null
 
+  // ── Org-level restrictions (P0 security) ──
+  private restrictions: PermissionRestrictions | undefined = undefined
+
   /** Invalidate the permission cache (called on any rule/mode change). */
   private invalidateCache(): void {
     this.checkCache.clear()
@@ -44,7 +48,7 @@ export class PermissionSystem {
   // ── Mode management ──
 
   setMode(mode: PermissionMode): void {
-    this.mode = mode
+    this.mode = clampMode(mode, this.restrictions)
     this.invalidateCache()
   }
 
@@ -53,10 +57,26 @@ export class PermissionSystem {
   }
 
   cycleMode(): PermissionMode {
-    this.mode = nextMode(this.mode)
+    this.mode = nextMode(this.mode, this.restrictions)
     return this.mode
   }
 
+  // ── Restrictions (P0: org-level policy gap) ──
+
+  /** Apply org-level permission restrictions. Overwrites any previous restrictions. */
+  setRestrictions(restrictions: PermissionRestrictions | undefined): void {
+    this.restrictions = restrictions
+    // Re-clamp current mode against new restrictions
+    if (restrictions) {
+      this.mode = clampMode(this.mode, restrictions)
+    }
+    this.invalidateCache()
+  }
+
+  getRestrictions(): PermissionRestrictions | undefined {
+    return this.restrictions
+  }
+
   // ── Rule management ──
 
   allow(rule: string): void {
@@ -71,11 +91,21 @@ export class PermissionSystem {
     this.askRules.push(compileRule(rule, 'ask'))
   }
 
-  loadConfig(raw: { mode?: string; allow?: string[]; deny?: string[] }): void {
+  loadConfig(raw: {
+    mode?: string
+    allow?: string[]
+    deny?: string[]
+    restrictions?: PermissionRestrictions
+  }): void {
     const config = loadPermissionConfig(
-      raw as Partial<{ mode: PermissionMode; allow: string[]; deny: string[] }>,
+      raw as Partial<{
+        mode: PermissionMode
+        allow: string[]
+        deny: string[]
+        restrictions: PermissionRestrictions
+      }>,
     )
-    this.mode = config.mode
+    this.mode = clampMode(config.mode, config.restrictions ?? this.restrictions)
 
     this.allowRules = []
     this.denyRules = []
@@ -88,6 +118,10 @@ export class PermissionSystem {
       this.denyRules.push(compileRule(rule, 'deny'))
     }
 
+    if (config.restrictions) {
+      this.restrictions = config.restrictions
+    }
+
     this.invalidateCache()
   }
 
@@ -246,9 +280,11 @@ export class PermissionSystem {
 
   setDefaultLevel(level: PermissionLevel): void {
     // Map legacy 3-level to new mode
-    if (level === 'auto') this.mode = 'auto'
-    else if (level === 'bypass') this.mode = 'bypassPermissions'
-    else this.mode = 'default'
+    let newMode: PermissionMode
+    if (level === 'auto') newMode = 'auto'
+    else if (level === 'bypass') newMode = 'bypassPermissions'
+    else newMode = 'default'
+    this.mode = clampMode(newMode, this.restrictions)
     this.invalidateCache()
   }
 

package/src/core/session-store.ts

@@ -17,6 +17,7 @@ export interface SessionMetadata {
   provider: string
   model: string
   messageCount: number
+  cwd?: string
 }
 
 export interface StoredSession {
@@ -44,7 +45,7 @@ export class SessionStore {
   static save(
     name: string,
     messages: Message[],
-    metadata?: { provider?: string; model?: string },
+    metadata?: { provider?: string; model?: string; cwd?: string },
   ): void {
     ensureDir()
     const path = filePath(name)
@@ -57,6 +58,7 @@ export class SessionStore {
         provider: metadata?.provider || 'unknown',
         model: metadata?.model || 'unknown',
         messageCount: messages.length,
+        cwd: metadata?.cwd,
       },
       messages,
     }
@@ -132,7 +134,7 @@ export class SessionStore {
   /**
    * Auto-save with timestamp-based name.
    */
-  static autoSave(messages: Message[], metadata?: { provider?: string; model?: string }): string {
+  static autoSave(messages: Message[], metadata?: { provider?: string; model?: string; cwd?: string }): string {
     const name = `session-${new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)}`
     SessionStore.save(name, messages, metadata)
     return name

package/src/index.tsx

@@ -1,4 +1,5 @@
 import { join } from 'node:path'
+import { existsSync } from 'node:fs'
 import { render } from 'ink'
 import { App } from './ui/app'
 import { loadConfig, loadInferenceHookConfig, loadCredentialMaskingConfig } from './config/loader'
@@ -85,12 +86,52 @@ export async function runApp(options: RunOptions): Promise<void> {
   // Initialize plugin manager
   const pluginManager = new PluginManager()
 
+  // Generate session name for tracking (used by /cd to persist cwd)
+  const sessionName = options.resume || `session-${new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)}`
+
   // Initialize context — restore saved session if available
-  const context = new ContextManager({ maxTokens: 200_000, compactionThreshold: 0.9 })
+  // Read the active model's context window for dynamic max-token sizing.
+  // MIPHAM_DISABLE_1M_CONTEXT=1 caps the effective window at 200K even for
+  // models that support larger contexts (e.g. 1M).
+  // When the model is unknown (not in any provider's model list), assume a
+  // conservative 128K context window. Set MIPHAM_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1
+  // to restore the old behavior (default 200K fallback for unknown models).
+  const activeModel = registry.findModel(defaultModel)
+  let modelContextWindow: number
+  if (activeModel) {
+    modelContextWindow = activeModel.contextWindow
+  } else if (process.env.MIPHAM_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT === '1') {
+    modelContextWindow = 200_000 // old behavior: default fallback
+  } else {
+    modelContextWindow = 128_000 // conservative assumption for unknown models
+    console.error(
+      `[mipham] ⚠ Unknown model "${defaultModel}": assuming 128K context window. ` +
+        `Set MIPHAM_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to disable.`,
+    )
+  }
+
+  const DISABLE_1M = process.env.MIPHAM_DISABLE_1M_CONTEXT === '1'
+  const contextMaxTokens = (DISABLE_1M && modelContextWindow > 200_000)
+    ? 200_000
+    : modelContextWindow
+
+  if (DISABLE_1M && modelContextWindow <= 200_000) {
+    console.error('[mipham] ⚠ MIPHAM_DISABLE_1M_CONTEXT is set but auto-compaction is not holding the session to 200K — model context window is already ≤ 200K')
+  }
+
+  const context = new ContextManager({ maxTokens: contextMaxTokens, compactionThreshold: 0.9 })
 
   if (options.resume) {
     const saved = SessionStore.load(options.resume)
     if (saved) {
+      // Restore working directory if saved
+      if (saved.metadata.cwd && existsSync(saved.metadata.cwd)) {
+        try {
+          process.chdir(saved.metadata.cwd)
+        } catch {
+          // cwd may no longer exist; silently continue
+        }
+      }
       for (const msg of saved.messages) {
         context.addMessage(msg)
       }
@@ -169,6 +210,11 @@ export async function runApp(options: RunOptions): Promise<void> {
     engine.getPermission().setDefaultLevel(config.permission as PermissionLevel)
   }
 
+  // Apply org-level permission restrictions (P0: bypassPermissions policy gap)
+  if (config.permissionRestrictions) {
+    engine.getPermission().setRestrictions(config.permissionRestrictions)
+  }
+
   // Initialize agent registry and load plugin agents/skills/MCP/hooks
   const agentRegistry = new AgentRegistry()
   agentRegistry.loadUserAgents()
@@ -190,9 +236,10 @@ export async function runApp(options: RunOptions): Promise<void> {
   const saveAndExit = () => {
     artifactServer.stop()
     if (context.getMessageCount() > 0) {
-      SessionStore.autoSave(context.getMessages(), {
+      SessionStore.save(sessionName, context.getMessages(), {
         provider: defaultProvider,
         model: defaultModel,
+        cwd: process.cwd(),
       })
     }
     process.exit(0)
@@ -211,6 +258,7 @@ export async function runApp(options: RunOptions): Promise<void> {
       skillsLoader={skillsLoader}
       pluginManager={pluginManager}
       version={options.version}
+      sessionId={sessionName}
     />,
   )
   await waitUntilExit()

package/src/providers/registry.ts

@@ -64,6 +64,14 @@ export class ProviderRegistry {
     return provider.config.models.filter((m) => m.status === 'active')
   }
 
+  findModel(modelId: string): ModelInfo | undefined {
+    for (const provider of this.providers.values()) {
+      const model = provider.config.models.find((m) => m.id === modelId)
+      if (model) return model
+    }
+    return undefined
+  }
+
   async *chat(req: ChatRequest): AsyncGenerator<StreamChunk> {
     const provider = this.getActive()
     yield* provider.chat({ ...req, model: req.model || this.activeModelId })

package/src/shared/sanitize.ts

@@ -0,0 +1,38 @@
+/**
+ * Unicode sanitization for tool inputs.
+ * Strips invisible/control characters that could hide command content
+ * from visual inspection or enable homoglyph attacks.
+ *
+ * Claude Code v2.1.223 parity: hidden command text via tabs/invisible Unicode.
+ */
+
+const DANGEROUS_UNICODE = /[​‌‍‎‏‪‫‬‭‮⁠⁦⁧⁨⁩]/g
+
+/**
+ * Strip dangerous invisible Unicode characters from a string.
+ * - Zero-width: U+200B (ZWSP), U+200C (ZWNJ), U+200D (ZWJ), U+200E/F (LTR/RTL marks)
+ * - Bidi controls: U+202A-E, U+2066-9
+ * - Word joiner: U+2060
+ * - BOM: U+FEFF
+ */
+export function stripDangerousUnicode(input: string): string {
+  if (!input) return input
+  return input.replace(DANGEROUS_UNICODE, '')
+}
+
+/**
+ * Recursively sanitize all string values in a params object.
+ */
+export function sanitizeParams(params: Record<string, unknown>): Record<string, unknown> {
+  const result: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(params)) {
+    if (typeof value === 'string') {
+      result[key] = stripDangerousUnicode(value)
+    } else if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+      result[key] = sanitizeParams(value as Record<string, unknown>)
+    } else {
+      result[key] = value
+    }
+  }
+  return result
+}

package/src/shared/types.ts

@@ -160,8 +160,16 @@ export interface MiphamConfig {
   defaultProvider: string
   defaultModel: string
   permission: ToolPermission
+  /** Org-level permission restrictions (forbiddenModes, maxAllowedMode). */
+  permissionRestrictions?: PermissionRestrictions
   providers: ProviderConfig[]
   skills?: { paths: string[]; mcpServers: McpServerConfig[] }
+  marketplace?: {
+    /** If set, only allow installs from matching repos (e.g. ["One-Mipham/*"]) */
+    strictKnownMarketplaces?: string[]
+    /** Block installs from matching repos (e.g. ["malicious-org/*"]) */
+    blockedMarketplaces?: string[]
+  }
 }
 
 export interface McpServerConfig {
@@ -287,10 +295,20 @@ export type PermissionMode =
 /** Backward-compatible alias: PermissionMode plus legacy 'ask' and 'bypass' */
 export type PermissionLevel = PermissionMode | 'ask' | 'bypass'
 
+/** Org-level restrictions that cap or forbid specific permission modes. */
+export interface PermissionRestrictions {
+  /** Modes that may not be entered (cycle skips them). */
+  forbiddenModes?: PermissionMode[]
+  /** Ceiling — modes ranked higher (more permissive) than this are treated as forbidden. */
+  maxAllowedMode?: PermissionMode
+}
+
 export interface PermissionConfig {
   mode: PermissionMode
   allow: string[]
   deny: string[]
+  /** Optional org-level restrictions enforced on every mode transition. */
+  restrictions?: PermissionRestrictions
 }
 
 export interface PermissionRuleEntry {

package/src/skills/registry.ts

@@ -10,6 +10,7 @@ import { join } from 'node:path'
 import { homedir } from 'node:os'
 import { spawnSync } from 'node:child_process'
 import { URL } from 'node:url'
+import type { MiphamConfig } from '../shared/types.js'
 
 const SKILLS_DIR = join(homedir(), '.mipham', 'skills')
 
@@ -141,13 +142,58 @@ export function searchSkills(query: string): SkillEntry[] {
   )
 }
 
+/**
+ * Match a marketplace pattern against an owner/repo.
+ *
+ * - "owner/*"  → matches any repo under that owner
+ * - "owner/repo" → exact match
+ */
+function matchOwnerPattern(pattern: string, owner: string, repo: string): boolean {
+  if (pattern.endsWith('/*')) {
+    return pattern.slice(0, -2) === owner
+  }
+  return pattern === repo
+}
+
+/**
+ * Check whether a GitHub URL (or any URL) is allowed by the marketplace config.
+ *
+ * Rules (in order):
+ * 1. No config → allow everything
+ * 2. blockedMarketplaces matched → deny (deny wins over allow)
+ * 3. strictKnownMarketplaces set → deny unless matched
+ * 4. Non-GitHub URL with no strict list → allow
+ * 5. Non-GitHub URL with strict list → deny
+ */
+function isMarketplaceAllowed(url: string, config?: MiphamConfig['marketplace']): boolean {
+  if (!config) return true
+  const { strictKnownMarketplaces, blockedMarketplaces } = config
+  const match = url.match(/github\.com\/([^/]+\/[^/]+)/)
+  if (!match) return !strictKnownMarketplaces?.length // non-GitHub: allow only if no strict list
+  const repo = match[1]! // "owner/repo"
+  const [owner] = repo.split('/')
+
+  // Check blocked first (deny wins)
+  if (blockedMarketplaces?.some((pattern) => matchOwnerPattern(pattern, owner!, repo))) return false
+  // Check strict allowlist
+  if (
+    strictKnownMarketplaces?.length &&
+    !strictKnownMarketplaces.some((pattern) => matchOwnerPattern(pattern, owner!, repo))
+  )
+    return false
+  return true
+}
+
 /**
  * Install a skill from a GitHub repository.
  *
  * Clones the repo to a temp directory, copies the skill file(s),
  * and cleans up.
  */
-export function installSkill(skillName: string): InstallResult {
+export function installSkill(
+  skillName: string,
+  marketplaceConfig?: MiphamConfig['marketplace'],
+): InstallResult {
   const entry = COMMUNITY_SKILLS.find((s) => s.name === skillName)
   if (!entry) {
     return {
@@ -157,6 +203,15 @@ export function installSkill(skillName: string): InstallResult {
     }
   }
 
+  // Check marketplace restrictions
+  if (!isMarketplaceAllowed(entry.url, marketplaceConfig)) {
+    return {
+      success: false,
+      name: skillName,
+      message: `Skill "${skillName}" is from a blocked or unapproved marketplace: ${entry.url}`,
+    }
+  }
+
   // Built-in skills are already available — no download needed
   if (entry.builtin) {
     return {
@@ -214,7 +269,19 @@ export function installSkill(skillName: string): InstallResult {
 /**
  * Install a skill from a direct URL (GitHub raw, gist, or any HTTP URL).
  */
-export function installSkillFromUrl(url: string): InstallResult {
+export function installSkillFromUrl(
+  url: string,
+  marketplaceConfig?: MiphamConfig['marketplace'],
+): InstallResult {
+  // Check marketplace restrictions
+  if (!isMarketplaceAllowed(url, marketplaceConfig)) {
+    return {
+      success: false,
+      name: url,
+      message: `URL is from a blocked or unapproved marketplace: ${url}`,
+    }
+  }
+
   // Derive skill name from URL
   const name =
     url

package/src/tools/exec/bash.ts

@@ -52,6 +52,18 @@ const BLOCKED_PATTERNS = [
   /\bscp\s+.*(?:\.ssh|\.aws|\.env)/,
   // Write to system paths
   />\s*\/(?:etc|usr|boot|sys|proc)\//,
+  // P0 hardening — ANSI-C quoting bypass (e.g. $'\x72\x6d' = rm)
+  /\$'\\x[0-9a-fA-F]{2}/,
+  // P0 hardening — nested interpreter invocation
+  /\b(?:bash|sh|zsh|dash|ksh)\s+-c\b/,
+  // P0 hardening — eval builtin (obfuscation vector)
+  /\beval\s+/,
+  // P0 hardening — exec redirect bypass (e.g. exec >/dev/sda)
+  /\bexec\s+\d*>/,
+  // P0 hardening — source/dot builtin (script sourcing)
+  /\bsource\s+/,
+  // P0 hardening — base64 decode + pipe
+  /\bbase64\s+(?:-d|--decode)\b/,
 ]
 
 const BLOCKED_COMMANDS = [
@@ -71,18 +83,38 @@ const BLOCKED_COMMANDS = [
   'init',
   'telinit',
   'systemctl',
+  'eval',
+  'exec',
+  'source',
+  '.',
 ]
 
+/**
+ * Normalize ANSI-C escape sequences ($'...') in a command string.
+ * Converts hex escapes (\xHH) back to literal characters so that
+ * existing patterns (e.g. rm -rf /) still catch obfuscated payloads.
+ */
+function normalizeEscapes(command: string): string {
+  return command.replace(/\$'([^']*)'/g, (_, inner: string) =>
+    inner.replace(/\\x([0-9a-fA-F]{2})/g, (_, hex: string) =>
+      String.fromCharCode(parseInt(hex, 16)),
+    ),
+  )
+}
+
 function isBlocked(command: string): string | null {
-  // Check exact blocked commands
-  const firstWord = command.trim().split(/\s+/)[0]
+  // Normalize ANSI-C escape sequences for defense-in-depth
+  const normalized = normalizeEscapes(command)
+
+  // Check exact blocked commands (on normalized command)
+  const firstWord = normalized.trim().split(/\s+/)[0]
   if (firstWord && BLOCKED_COMMANDS.includes(firstWord)) {
-    return `Command "${firstWord}" is blocked (destructive filesystem operation).`
+    return `Command "${firstWord}" rejected by security policy.`
   }
 
-  // Check dangerous patterns
+  // Check dangerous patterns (on both original and normalized)
   for (const pattern of BLOCKED_PATTERNS) {
-    if (pattern.test(command)) {
+    if (pattern.test(command) || pattern.test(normalized)) {
       return `Command rejected by security policy. Pattern matched: ${pattern.source.slice(0, 40)}...`
     }
   }

package/src/tools/index.ts

@@ -1,4 +1,5 @@
 import type { ToolDefinition, ToolResult } from '../shared/index.ts'
+import { sanitizeParams } from '../shared/sanitize'
 import { readTool } from './file/read'
 import { writeTool } from './file/write'
 import { editTool } from './file/edit'
@@ -96,11 +97,13 @@ function withValidation(tool: ToolDefinition): ToolDefinition {
   return {
     ...tool,
     async execute(params, ctx): Promise<ToolResult> {
-      const errors = validateParams(schema, params)
+      // Sanitize dangerous Unicode from all inputs
+      const cleanParams = sanitizeParams(params)
+      const errors = validateParams(schema, cleanParams)
       if (errors.length > 0) {
         return { success: false, content: '', error: `Invalid parameters: ${errors.join('; ')}` }
       }
-      return tool.execute(params, ctx)
+      return tool.execute(cleanParams, ctx)
     },
   }
 }

package/src/ui/app.tsx

@@ -1,9 +1,10 @@
-import React, { useState, useCallback, useRef, useMemo } from 'react'
+import React, { useState, useCallback, useEffect, useRef, useMemo } from 'react'
 import { Box, Text, useInput } from 'ink'
 import type { QueryEngine } from '../core/engine'
 import type { MiphamConfig } from '../shared/index.ts'
 import type { SkillsLoader } from '../skills/loader'
 import type { PluginManager } from '../plugin/plugin-manager'
+import { getPreference, setPreference } from '../config/preferences'
 import { AgentRegistry } from '../agent/agent-registry'
 import { ChatPanel } from './chat'
 import { InputBar } from './input'
@@ -26,6 +27,7 @@ interface AppProps {
   skillsLoader?: SkillsLoader
   pluginManager?: PluginManager
   version?: string
+  sessionId?: string
 }
 
 export interface ToolMeta {
@@ -84,6 +86,7 @@ export function App({
   skillsLoader,
   pluginManager,
   version,
+  sessionId,
 }: AppProps) {
   const [messages, setMessages] = useState<ChatMessage[]>([])
   const [isLoading, setIsLoading] = useState(false)
@@ -100,6 +103,12 @@ export function App({
   const [agentProgress, setAgentProgress] = useState<AgentProgress | null>(null)
   const [agentElapsed, setAgentElapsed] = useState(0)
 
+  // Load persisted effort on mount
+  useEffect(() => {
+    const saved = getPreference('lastCodeReviewEffort', 'high')
+    setEffort(saved)
+  }, [])
+
   // Agent elapsed timer
   React.useEffect(() => {
     if (!agentProgress) {
@@ -131,15 +140,19 @@ export function App({
       providerId,
       modelId,
       version: version || '0.0.0',
+      sessionId: sessionId || '',
       setSessionTitle: (title: string) => setSessionTitle(title),
       setFastMode: (on: boolean) => setFastMode(on),
-      setEffort: (level: string) => setEffort(level),
+      setEffort: (level: string) => {
+        setEffort(level)
+        setPreference('lastCodeReviewEffort', level)
+      },
       setFocusMode: (on: boolean) => setFocusMode(on),
       setGoal: (text: string) => setGoalText(text),
       skillsLoader,
       pluginManager,
     }),
-    [engine, config, providerId, modelId, skillsLoader, pluginManager],
+    [engine, config, providerId, modelId, skillsLoader, pluginManager, sessionId],
   )
 
   const handleSubmit = useCallback(

package/src/ui/commands.ts

@@ -10,6 +10,7 @@ import type { SkillsLoader } from '../skills/loader'
 import type { PluginManager } from '../plugin/plugin-manager'
 import { McpClient } from '../mcp/client'
 import { NPM_INSTALL_COMMAND, NPM_UPDATE_COMMAND, PACKAGE_VERSION } from '../shared/index.ts'
+import { getPreference } from '../config/preferences'
 
 export interface CommandContext {
   engine: QueryEngine
@@ -17,6 +18,7 @@ export interface CommandContext {
   providerId: string
   modelId: string
   version: string
+  sessionId: string
   // Callbacks for commands that mutate App state
   setSessionTitle: (title: string) => void
   setFastMode: (on: boolean) => void
@@ -799,7 +801,7 @@ const browseSkillsCmd: CommandHandler = async () => {
   return { content: lines.join('\n') }
 }
 
-const installSkillCmd: CommandHandler = async (_ctx, args) => {
+const installSkillCmd: CommandHandler = async (ctx, args) => {
   const { installSkill, installSkillFromUrl } = await import('../skills/registry')
 
   const target = args[0]
@@ -807,12 +809,13 @@ const installSkillCmd: CommandHandler = async (_ctx, args) => {
     return { content: 'Usage: /install-skill <skill-name> or /install-skill <url>' }
   }
 
+  const marketplaceConfig = ctx.config.marketplace
   let result: { success: boolean; name: string; message: string }
 
   if (target.startsWith('http://') || target.startsWith('https://')) {
-    result = installSkillFromUrl(target)
+    result = installSkillFromUrl(target, marketplaceConfig)
   } else {
-    result = installSkill(target)
+    result = installSkill(target, marketplaceConfig)
   }
 
   return {
@@ -1681,7 +1684,7 @@ function gitDiffBridgeCmd(opts: {
   label: string
   noChangesHint: string
   runningMsg: string
-  forwardToAI: string
+  forwardToAI: string | (() => string)
 }): CommandHandler {
   return async () => {
     try {
@@ -1692,7 +1695,7 @@ function gitDiffBridgeCmd(opts: {
       }
       return {
         content: `─ ${opts.label} ─\n\n${opts.runningMsg}\n\nChanged files:\n${diff}`,
-        forwardToAI: opts.forwardToAI,
+        forwardToAI: typeof opts.forwardToAI === 'function' ? opts.forwardToAI() : opts.forwardToAI,
       }
     } catch {
       return {
@@ -1708,8 +1711,8 @@ const codeReviewCmd = gitDiffBridgeCmd({
     'No uncommitted changes to review.\n\nTo review a specific file: /code-review path/to/file.ts',
   runningMsg:
     'Reviewing uncommitted changes with the code-review skill (7 dimensions: correctness, security, performance, code quality, architecture, testing, language-specific)...',
-  forwardToAI:
-    'use the code-review skill to review all uncommitted changes. Check all 7 dimensions: correctness, security, performance, code quality, architecture & design, testing, and language-specific issues.',
+  forwardToAI: () =>
+    `use the code-review skill to review all uncommitted changes. Check all 7 dimensions: correctness, security, performance, code quality, architecture & design, testing, and language-specific issues. Use effort level: ${getPreference('lastCodeReviewEffort', 'high')}.`,
 })
 
 const simplifyCmd = gitDiffBridgeCmd({
@@ -1887,7 +1890,7 @@ const summaryCmd: CommandHandler = (ctx) => {
   }
 }
 
-const cdCmd: CommandHandler = async (_ctx, args) => {
+const cdCmd: CommandHandler = async (ctx, args) => {
   const target = args[0]
   if (!target) {
     return {
@@ -1912,6 +1915,22 @@ const cdCmd: CommandHandler = async (_ctx, args) => {
 
   try {
     process.chdir(resolved)
+
+    // Persist cwd to active session (best-effort)
+    try {
+      const { SessionStore } = await import('../core/session-store')
+      const saved = SessionStore.load(ctx.sessionId)
+      if (saved) {
+        SessionStore.save(ctx.sessionId, saved.messages, {
+          provider: saved.metadata.provider,
+          model: saved.metadata.model,
+          cwd: resolved,
+        })
+      }
+    } catch {
+      /* session persistence is best-effort */
+    }
+
     return {
       content: [
         '── Directory Changed ──',
@@ -2039,48 +2058,10 @@ const exportCmd: CommandHandler = async (ctx) => {
 }
 
 // ═══════════════════════════════════════════════════════════════
-// Review — code review workflow
+// Review — alias for /code-review (P1: 2026-08-06 polish)
 // ═══════════════════════════════════════════════════════════════
 
-const reviewCmd: CommandHandler = async () => {
-  try {
-    const { execSync } = await import('node:child_process')
-    const diff = execSync('git diff --stat', { encoding: 'utf-8', timeout: 5000 }).trim()
-    const unstaged = execSync('git diff --name-only', { encoding: 'utf-8', timeout: 3000 }).trim()
-    const staged = execSync('git diff --cached --name-only', {
-      encoding: 'utf-8',
-      timeout: 3000,
-    }).trim()
-
-    if (!diff) {
-      return {
-        content:
-          '─ Code Review ─\n\nNo uncommitted changes detected.\n\nUse /pr-comments for PR-level review, or make changes first.',
-      }
-    }
-
-    const lines: string[] = ['─ Code Review ─', '', 'Uncommitted changes:', '', diff]
-
-    if (staged) {
-      lines.push('')
-      lines.push('Staged files (ready for commit):')
-      for (const f of staged.split('\n')) lines.push(`  ✓ ${f}`)
-    }
-    if (unstaged) {
-      lines.push('')
-      lines.push('Unstaged files (working directory):')
-      for (const f of unstaged.split('\n')) lines.push(`  • ${f}`)
-    }
-
-    lines.push('')
-    lines.push('To review with AI: type "review these changes" in chat.')
-    lines.push('To commit: git add -A && git commit -m "..."')
-
-    return { content: lines.join('\n') }
-  } catch {
-    return { content: '─ Code Review ─\n\nCould not run git diff. Are you in a git repository?' }
-  }
-}
+const reviewCmd = codeReviewCmd
 
 // ═══════════════════════════════════════════════════════════════
 // PR Comments
@@ -4320,7 +4301,7 @@ const commandsListCmd: CommandHandler = () => {
     '/tdd': 'Workflow',
     '/todos': 'Workflow',
     '/tasks': 'Workflow',
-    '/review': 'Workflow',
+    '/review': 'Code Quality',
     '/pr-comments': 'Workflow',
     '/diff': 'Workflow',
     '/workflows': 'Workflow',
@@ -4587,7 +4568,7 @@ const COMMAND_DESCRIPTIONS: Record<string, string> = {
   '/tdd': 'Test-Driven Development workflow (RED → GREEN → REFACTOR)',
   '/todos': 'Task management (list/create tasks)',
   '/tasks': 'Background tasks',
-  '/review': 'Code review workflow',
+  '/review': 'Review code for bugs, security, performance (alias for /code-review)',
   '/pr-comments': 'PR review summary',
   '/diff': 'Show git diff',
   '/workflows': 'List workflow scripts',

package/src/workflow/runtime.ts

@@ -1,3 +1,4 @@
+import vm from 'node:vm'
 import { createSandbox } from './sandbox'
 import { createJournal, appendJournal, loadJournal, loadScript } from './journal'
 import { createBudget } from './budget'
@@ -47,7 +48,8 @@ function agentCacheKey(prompt: string, opts: Record<string, unknown> = {}): stri
  *   - Returns cacheHits and cacheMisses counts
  *
  * The sandbox blocks non-deterministic APIs (Date.now, Math.random) to make
- * this deterministic replay possible.
+ * this deterministic replay possible. Scripts execute inside a node:vm.Context
+ * that blocks sandbox escape vectors (eval, Function, import, require, process, etc.).
  */
 export async function runWorkflow(
   script: string,
@@ -134,42 +136,28 @@ export async function runWorkflow(
     appendJournal(runId, { type: 'log', message })
   }
 
-  const sandbox = createSandbox(args, budget)
-
   // Build the script wrapper
   const wrappedScript = `
-    return (async () => {
+    (async () => {
       ${script}
     })()
   `
 
-  // Execute in sandboxed context
-  const scriptFn = new Function(
-    'agent',
-    'parallel',
-    'pipeline',
-    'verify',
-    'judge',
-    'loopUntilConvergence',
-    'phase',
-    'log',
-    'args',
-    'budget',
-    wrappedScript,
-  )
-
-  const result = await scriptFn(
-    agent,
-    parallel,
-    pipeline,
-    verify,
-    judge,
-    loopUntilConvergence,
-    wrappedPhase,
-    log,
-    args,
-    budget,
-  )
+  // Execute in node:vm sandbox — no access to host globals
+  const vmScript = new vm.Script(wrappedScript, { filename: 'workflow.js' })
+  const sandboxCtx = createSandbox(args, budget)
+
+  // Inject primitives into the sandbox context (whitelist approach)
+  sandboxCtx.agent = agent
+  sandboxCtx.parallel = parallel
+  sandboxCtx.pipeline = pipeline
+  sandboxCtx.verify = verify
+  sandboxCtx.judge = judge
+  sandboxCtx.loopUntilConvergence = loopUntilConvergence
+  sandboxCtx.phase = wrappedPhase
+  sandboxCtx.log = log
+
+  const result = await vmScript.runInContext(sandboxCtx, { timeout: 120_000 })
 
   // Count journal entries from state
   const priorEntries = loadJournal(runId)

package/src/workflow/sandbox.ts

@@ -1,27 +1,39 @@
-/** APIs disabled in workflow scripts to ensure deterministic replay. */
+import vm from 'node:vm'
+
+/** APIs disabled in workflow scripts to ensure deterministic replay + sandbox escape prevention. */
 const FORBIDDEN = new Set(['Date.now', 'Math.random', 'crypto.randomUUID'])
 
 /**
- * Create a sandboxed global scope for workflow script execution.
- * Blocks Date.now(), Math.random(), argless new Date(), crypto.randomUUID().
+ * Create a sandboxed VM context for workflow script execution.
+ * Blocks Date.now(), Math.random(), argless new Date(), crypto.randomUUID(),
+ * plus explicit sandbox escape vectors: eval, Function constructor, import(),
+ * require(), process, Bun, fetch, setTimeout/setInterval, etc.
  */
 export function createSandbox(
   args: unknown,
   budget: { total: number | null; spent(): number; remaining(): number },
-): Record<string, unknown> {
-  const sandbox: Record<string, unknown> = {
+): vm.Context {
+  const sandboxObj: Record<string, unknown> = {
     args,
     budget,
     console: {
       log: (..._a: unknown[]) => {}, // no-op in sandbox
       error: (..._a: unknown[]) => {},
     },
-    // Primitives are injected by the runtime, not the sandbox
+
+    // ── Explicit sandbox escape prevention ──
+    // V8 builtins that would otherwise be available in a vm.Context
+    eval: () => {
+      throw new Error('eval() is disabled in workflow sandbox.')
+    },
+    Function: () => {
+      throw new Error('new Function() is disabled in workflow sandbox.')
+    },
   }
 
   // Override Date to block now() and argless constructor
   const OriginalDate = Date
-  sandbox.Date = new Proxy(OriginalDate, {
+  sandboxObj.Date = new Proxy(OriginalDate, {
     construct(_target, constructorArgs) {
       if (constructorArgs.length === 0) {
         throw new Error('new Date() is disabled in workflow sandbox. Pass timestamps via args.')
@@ -42,7 +54,7 @@ export function createSandbox(
   })
 
   // Override Math.random
-  sandbox.Math = new Proxy(Math, {
+  sandboxObj.Math = new Proxy(Math, {
     get(_target, prop) {
       if (prop === 'random') {
         throw new Error('Math.random() is disabled in workflow sandbox. Use a seed from args.')
@@ -57,7 +69,7 @@ export function createSandbox(
     | { randomUUID?: unknown; [key: string]: unknown }
     | undefined
   if (globalCrypto) {
-    sandbox.crypto = new Proxy(globalCrypto, {
+    sandboxObj.crypto = new Proxy(globalCrypto, {
       get(_target, prop) {
         if (prop === 'randomUUID') {
           throw new Error('crypto.randomUUID() is disabled in workflow sandbox.')
@@ -70,7 +82,7 @@ export function createSandbox(
     })
   }
 
-  return sandbox
+  return vm.createContext(sandboxObj)
 }
 
 /** Check whether a given API identifier is in the forbidden set. */