@miphamai/cli 0.15.0 → 0.16.1

package/src/skills/registry.ts

@@ -10,6 +10,8 @@ import { join } from 'node:path'
 import { homedir } from 'node:os'
 import { spawnSync } from 'node:child_process'
 import { URL } from 'node:url'
+import type { MiphamConfig } from '../shared/types.js'
+import communitySkills from './community-registry.json'
 
 const SKILLS_DIR = join(homedir(), '.mipham', 'skills')
 
@@ -38,81 +40,7 @@ export interface SkillEntry {
  * Embedded community skill registry.
  * In the future, this can be fetched from a remote URL.
  */
-const COMMUNITY_SKILLS: SkillEntry[] = [
-  {
-    name: 'code-review',
-    description:
-      'Automated code review with multiple dimensions — complexity, security, performance, quality',
-    url: 'https://github.com/One-Mipham/skill-code-review',
-    file: 'code-review.SKILL.md',
-    category: 'Development',
-    author: 'MiphamAI',
-    builtin: true,
-  },
-  {
-    name: 'systematic-debugging',
-    description: 'Systematic debugging workflow — find root cause before fixing',
-    url: 'https://github.com/anthropics/skills',
-    file: 'systematic-debugging.SKILL.md',
-    category: 'Development',
-    author: 'Anthropic',
-  },
-  {
-    name: 'test-driven-development',
-    description: 'TDD workflow — write failing test first, then implement',
-    url: 'https://github.com/anthropics/skills',
-    file: 'test-driven-development.SKILL.md',
-    category: 'Development',
-    author: 'Anthropic',
-    builtin: true,
-  },
-  {
-    name: 'web-access',
-    description:
-      'Web search, scraping, and browser automation — search engines, page fetching, authenticated sites',
-    url: 'https://github.com/One-Mipham/skill-web-access',
-    file: 'web-access.SKILL.md',
-    category: 'Network',
-    author: 'MiphamAI',
-    builtin: true,
-  },
-  {
-    name: 'doc-generator',
-    description: 'Generate API docs, READMEs, and changelogs from code analysis',
-    url: 'https://github.com/One-Mipham/skill-doc-generator',
-    file: 'doc-generator.SKILL.md',
-    category: 'Documentation',
-    author: 'MiphamAI',
-    builtin: true,
-  },
-  {
-    name: 'github-ops',
-    description: 'GitHub PR/issue management and automation — labels, milestones, reviews',
-    url: 'https://github.com/One-Mipham/skill-github-ops',
-    file: 'github-ops.SKILL.md',
-    category: 'DevOps',
-    author: 'MiphamAI',
-    builtin: true,
-  },
-  {
-    name: 'security-review',
-    description:
-      'Security audit and vulnerability scanning for code changes — OWASP, secrets, supply chain',
-    url: 'https://github.com/One-Mipham/skill-security-review',
-    file: 'security-review.SKILL.md',
-    category: 'Security',
-    author: 'MiphamAI',
-    builtin: true,
-  },
-  {
-    name: 'frontend-design',
-    description: 'Distinctive visual design guidance for UI components — typography, color, layout',
-    url: 'https://github.com/anthropics/skills',
-    file: 'frontend-design.SKILL.md',
-    category: 'Design',
-    author: 'Anthropic',
-  },
-]
+const COMMUNITY_SKILLS: SkillEntry[] = communitySkills as SkillEntry[]
 
 // ═══════════════════════════════════════════════════════════════
 // Skill Installer
@@ -141,13 +69,58 @@ export function searchSkills(query: string): SkillEntry[] {
   )
 }
 
+/**
+ * Match a marketplace pattern against an owner/repo.
+ *
+ * - "owner/*"  → matches any repo under that owner
+ * - "owner/repo" → exact match
+ */
+function matchOwnerPattern(pattern: string, owner: string, repo: string): boolean {
+  if (pattern.endsWith('/*')) {
+    return pattern.slice(0, -2) === owner
+  }
+  return pattern === repo
+}
+
+/**
+ * Check whether a GitHub URL (or any URL) is allowed by the marketplace config.
+ *
+ * Rules (in order):
+ * 1. No config → allow everything
+ * 2. blockedMarketplaces matched → deny (deny wins over allow)
+ * 3. strictKnownMarketplaces set → deny unless matched
+ * 4. Non-GitHub URL with no strict list → allow
+ * 5. Non-GitHub URL with strict list → deny
+ */
+function isMarketplaceAllowed(url: string, config?: MiphamConfig['marketplace']): boolean {
+  if (!config) return true
+  const { strictKnownMarketplaces, blockedMarketplaces } = config
+  const match = url.match(/github\.com\/([^/]+\/[^/]+)/)
+  if (!match) return !strictKnownMarketplaces?.length // non-GitHub: allow only if no strict list
+  const repo = match[1]! // "owner/repo"
+  const [owner] = repo.split('/')
+
+  // Check blocked first (deny wins)
+  if (blockedMarketplaces?.some((pattern) => matchOwnerPattern(pattern, owner!, repo))) return false
+  // Check strict allowlist
+  if (
+    strictKnownMarketplaces?.length &&
+    !strictKnownMarketplaces.some((pattern) => matchOwnerPattern(pattern, owner!, repo))
+  )
+    return false
+  return true
+}
+
 /**
  * Install a skill from a GitHub repository.
  *
  * Clones the repo to a temp directory, copies the skill file(s),
  * and cleans up.
  */
-export function installSkill(skillName: string): InstallResult {
+export function installSkill(
+  skillName: string,
+  marketplaceConfig?: MiphamConfig['marketplace'],
+): InstallResult {
   const entry = COMMUNITY_SKILLS.find((s) => s.name === skillName)
   if (!entry) {
     return {
@@ -157,6 +130,15 @@ export function installSkill(skillName: string): InstallResult {
     }
   }
 
+  // Check marketplace restrictions
+  if (!isMarketplaceAllowed(entry.url, marketplaceConfig)) {
+    return {
+      success: false,
+      name: skillName,
+      message: `Skill "${skillName}" is from a blocked or unapproved marketplace: ${entry.url}`,
+    }
+  }
+
   // Built-in skills are already available — no download needed
   if (entry.builtin) {
     return {
@@ -214,7 +196,19 @@ export function installSkill(skillName: string): InstallResult {
 /**
  * Install a skill from a direct URL (GitHub raw, gist, or any HTTP URL).
  */
-export function installSkillFromUrl(url: string): InstallResult {
+export function installSkillFromUrl(
+  url: string,
+  marketplaceConfig?: MiphamConfig['marketplace'],
+): InstallResult {
+  // Check marketplace restrictions
+  if (!isMarketplaceAllowed(url, marketplaceConfig)) {
+    return {
+      success: false,
+      name: url,
+      message: `URL is from a blocked or unapproved marketplace: ${url}`,
+    }
+  }
+
   // Derive skill name from URL
   const name =
     url

package/src/tools/exec/bash.ts

@@ -28,9 +28,9 @@ const BLOCKED_PATTERNS = [
   /\$\(/,
   // Backtick command substitution
   /`[^`]+`/,
-  // Interpreter code execution (bypass vector)
-  /\bpython3?\s+-c\b/,
-  /\bpython3?\s+-m\b/,
+  // Interpreter code execution (bypass vector) — covers python, python2, python3
+  /\bpython[23]?\s+-c\b/,
+  /\bpython[23]?\s+-m\b/,
   /\bperl\s+-[ep]\b/,
   /\bruby\s+-e\b/,
   /\bnode\s+-e\b/,
@@ -52,6 +52,18 @@ const BLOCKED_PATTERNS = [
   /\bscp\s+.*(?:\.ssh|\.aws|\.env)/,
   // Write to system paths
   />\s*\/(?:etc|usr|boot|sys|proc)\//,
+  // P0 hardening — ANSI-C quoting bypass (e.g. $'\x72\x6d' = rm)
+  /\$'\\x[0-9a-fA-F]{2}/,
+  // P0 hardening — nested interpreter invocation
+  /\b(?:bash|sh|zsh|dash|ksh)\s+-c\b/,
+  // P0 hardening — eval builtin (obfuscation vector)
+  /\beval\s+/,
+  // P0 hardening — exec redirect bypass (e.g. exec >/dev/sda)
+  /\bexec\s+\d*>/,
+  // P0 hardening — source/dot builtin (script sourcing)
+  /\bsource\s+/,
+  // P0 hardening — base64 decode + pipe
+  /\bbase64\s+(?:-d|--decode)\b/,
 ]
 
 const BLOCKED_COMMANDS = [
@@ -71,18 +83,38 @@ const BLOCKED_COMMANDS = [
   'init',
   'telinit',
   'systemctl',
+  'eval',
+  'exec',
+  'source',
+  '.',
 ]
 
+/**
+ * Normalize ANSI-C escape sequences ($'...') in a command string.
+ * Converts hex escapes (\xHH) back to literal characters so that
+ * existing patterns (e.g. rm -rf /) still catch obfuscated payloads.
+ */
+function normalizeEscapes(command: string): string {
+  return command.replace(/\$'([^']*)'/g, (_, inner: string) =>
+    inner.replace(/\\x([0-9a-fA-F]{2})/g, (_, hex: string) =>
+      String.fromCharCode(parseInt(hex, 16)),
+    ),
+  )
+}
+
 function isBlocked(command: string): string | null {
-  // Check exact blocked commands
-  const firstWord = command.trim().split(/\s+/)[0]
+  // Normalize ANSI-C escape sequences for defense-in-depth
+  const normalized = normalizeEscapes(command)
+
+  // Check exact blocked commands (on normalized command)
+  const firstWord = normalized.trim().split(/\s+/)[0]
   if (firstWord && BLOCKED_COMMANDS.includes(firstWord)) {
-    return `Command "${firstWord}" is blocked (destructive filesystem operation).`
+    return `Command "${firstWord}" rejected by security policy.`
   }
 
-  // Check dangerous patterns
+  // Check dangerous patterns (on both original and normalized)
   for (const pattern of BLOCKED_PATTERNS) {
-    if (pattern.test(command)) {
+    if (pattern.test(command) || pattern.test(normalized)) {
       return `Command rejected by security policy. Pattern matched: ${pattern.source.slice(0, 40)}...`
     }
   }

package/src/tools/exec/enter-worktree.ts

@@ -45,9 +45,31 @@ export const enterWorktreeTool: ToolDefinition = {
           'Worktree name may only contain letters, digits, dots, underscores, dashes, and slashes.',
       }
     }
+    // Prevent path traversal via .. segments
+    if (name.includes('..')) {
+      return {
+        success: false,
+        content: '',
+        error: 'Worktree name may not contain ".." path segments.',
+      }
+    }
 
     const cwd = ctx.cwd
-    const worktreePath = `${cwd}/.claude/worktrees/${name}`
+    const { resolve } = await import('node:path')
+    const worktreePath = resolve(`${cwd}/.claude/worktrees/${name}`)
+    const allowedPrefix = resolve(`${cwd}/.claude/worktrees/`)
+
+    // Defense-in-depth: verify resolved path is within .claude/worktrees/
+    if (
+      !worktreePath.startsWith(allowedPrefix + '/') &&
+      worktreePath !== allowedPrefix.slice(0, -1)
+    ) {
+      return {
+        success: false,
+        content: '',
+        error: 'Worktree path must be within .claude/worktrees/.',
+      }
+    }
 
     try {
       // Validate we're in a git repo

package/src/tools/exec/exit-worktree.ts

@@ -36,6 +36,19 @@ export const exitWorktreeTool: ToolDefinition = {
 
     // Validate the path is under .claude/worktrees
     const cwd = ctx.cwd
+    const { resolve } = await import('node:path')
+    const resolvedPath = resolve(worktreePath)
+    const allowedPrefix = resolve(`${cwd}/.claude/worktrees/`)
+
+    if (!resolvedPath.startsWith(allowedPrefix)) {
+      return {
+        success: false,
+        content: '',
+        error:
+          `Path "${worktreePath}" is not under .claude/worktrees/. ` +
+          `Only worktrees created by EnterWorktree can be managed here.`,
+      }
+    }
 
     try {
       // Verify the worktree exists in git's worktree list

package/src/tools/index.ts

@@ -1,4 +1,5 @@
 import type { ToolDefinition, ToolResult } from '../shared/index.ts'
+import { sanitizeParams } from '../shared/sanitize'
 import { readTool } from './file/read'
 import { writeTool } from './file/write'
 import { editTool } from './file/edit'
@@ -96,11 +97,13 @@ function withValidation(tool: ToolDefinition): ToolDefinition {
   return {
     ...tool,
     async execute(params, ctx): Promise<ToolResult> {
-      const errors = validateParams(schema, params)
+      // Sanitize dangerous Unicode from all inputs
+      const cleanParams = sanitizeParams(params)
+      const errors = validateParams(schema, cleanParams)
       if (errors.length > 0) {
         return { success: false, content: '', error: `Invalid parameters: ${errors.join('; ')}` }
       }
-      return tool.execute(params, ctx)
+      return tool.execute(cleanParams, ctx)
     },
   }
 }

package/src/ui/agent-footer.tsx

@@ -0,0 +1,89 @@
+import React from 'react'
+import { Box, Text } from 'ink'
+
+export interface AgentEntry {
+  id: string
+  name: string
+  description: string
+  startTime: number
+  tokensUsed: number
+  status: 'running' | 'completed'
+}
+
+interface AgentFooterProps {
+  agents: AgentEntry[]
+  gitBranch: string
+  /** Tick counter for live elapsed-time re-renders. */
+  tick: number
+}
+
+/** Format elapsed seconds into human-readable string (e.g. "2m 51s", "38s"). */
+function formatElapsed(seconds: number): string {
+  if (seconds < 60) return `${seconds}s`
+  const m = Math.floor(seconds / 60)
+  const s = seconds % 60
+  return `${m}m ${s}s`
+}
+
+/** Format token count: 42400 → "42.4k", 1500000 → "1.5M". */
+function formatTokens(n: number): string {
+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)}M`
+  if (n >= 1000) return `${(n / 1000).toFixed(1)}k`
+  return String(n)
+}
+
+export function AgentFooter({ agents, gitBranch, tick: _tick }: AgentFooterProps) {
+  const hasAgents = agents.length > 0
+  const hasBranch = gitBranch.length > 0
+
+  if (!hasAgents && !hasBranch) return null
+
+  return (
+    <Box flexDirection="column" marginTop={1}>
+      {/* Git branch indicator */}
+      {hasBranch && (
+        <Box>
+          <Text dimColor>
+            {'  '}⏺ {gitBranch}
+          </Text>
+        </Box>
+      )}
+
+      {/* Agent status lines */}
+      {agents.map((agent) => {
+        const elapsed = Math.floor((Date.now() - agent.startTime) / 1000)
+        const isRunning = agent.status === 'running'
+        const symbol = isRunning ? '◯' : '◼'
+        const symbolColor = isRunning ? 'cyan' : undefined
+
+        // Truncate description to keep lines readable
+        const desc =
+          agent.description.length > 80 ? agent.description.slice(0, 80) + '...' : agent.description
+
+        return (
+          <Box key={agent.id}>
+            <Text dimColor={!isRunning} color={symbolColor}>
+              {'  '}
+              {symbol}{' '}
+            </Text>
+            <Text bold color={isRunning ? 'cyan' : undefined} dimColor={!isRunning}>
+              {agent.name}
+            </Text>
+            <Text dimColor> {desc}</Text>
+            {/* Spacer pushes stats to the right — Ink handles this naturally */}
+            <Text dimColor>
+              {'  '}
+              {isRunning ? formatElapsed(elapsed) : 'finished'}
+            </Text>
+            {isRunning && agent.tokensUsed > 0 && (
+              <Text dimColor>
+                {' · ↓ '}
+                {formatTokens(agent.tokensUsed)} tokens
+              </Text>
+            )}
+          </Box>
+        )
+      })}
+    </Box>
+  )
+}