@miphamai/cli 0.16.5 → 0.18.0

package/src/core/memory/memory-manager.ts

@@ -5,12 +5,15 @@ import {
   writeFileSync,
   unlinkSync,
   existsSync,
+  statSync,
 } from 'node:fs'
 import { join, extname } from 'node:path'
 
 export interface MemoryMetadata {
   type: 'user' | 'feedback' | 'project' | 'reference'
   relevance: string[]
+  why?: string
+  howToApply?: string
 }
 
 export interface MemoryEntry {
@@ -26,6 +29,7 @@ const INDEX_FILE = 'MEMORY.md'
 
 export class MemoryManager {
   private memories = new Map<string, MemoryEntry>()
+  private linkGraph: Map<string, Set<string>> = new Map()
 
   constructor(private memoryDir: string) {
     mkdirSync(memoryDir, { recursive: true })
@@ -33,6 +37,7 @@ export class MemoryManager {
 
   loadAll(): void {
     this.memories.clear()
+    this.linkGraph.clear()
     if (!existsSync(this.memoryDir)) return
 
     let entries: string[] = []
@@ -55,9 +60,26 @@ export class MemoryManager {
         // skip unparseable
       }
     }
+    this.rebuildLinkGraph()
   }
 
   write(name: string, content: string, metadata: MemoryMetadata): void {
+    // Dedup: same name = update, don't create duplicate
+    const formattedBody = this.formatMemoryBody(metadata, content)
+    const existing = this.memories.get(name)
+    if (existing) {
+      existing.content = formattedBody
+      existing.metadata = metadata
+      existing.description = metadata.relevance.join(', ')
+      existing.updatedAt = new Date()
+      this.memories.set(name, existing)
+      const body = this.formatMemoryFile(name, metadata, content)
+      writeFileSync(existing.filePath, body, 'utf-8')
+      this.updateWikilinks(name, content)
+      this.updateIndex()
+      return
+    }
+
     const fileName = `${name}.md`
     const filePath = join(this.memoryDir, fileName)
 
@@ -68,18 +90,20 @@ export class MemoryManager {
       name,
       description: metadata.relevance.join(', '),
       metadata,
-      content,
+      content: formattedBody,
       filePath,
       updatedAt: new Date(),
     }
 
     this.memories.set(name, entry)
+    this.updateWikilinks(name, content)
     this.updateIndex()
   }
 
   recall(context: string, limit: number = 10): MemoryEntry[] {
     const contextLower = context.toLowerCase()
     const scored: Array<{ entry: MemoryEntry; score: number }> = []
+    const seen = new Set<string>()
 
     for (const entry of this.memories.values()) {
       let score = 0
@@ -95,6 +119,31 @@ export class MemoryManager {
       }
       if (score > 0) {
         scored.push({ entry, score })
+        seen.add(entry.name)
+      }
+    }
+
+    // Boost wikilink-connected memories with lower weight
+    for (const scoredItem of [...scored]) {
+      const linkedNames = this.linkGraph.get(scoredItem.entry.name)
+      if (!linkedNames) continue
+      for (const linkedName of linkedNames) {
+        if (seen.has(linkedName)) continue
+        const linkedEntry = this.memories.get(linkedName)
+        if (linkedEntry) {
+          scored.push({ entry: linkedEntry, score: 1 })
+          seen.add(linkedName)
+        }
+      }
+    }
+
+    // Apply time decay: memories older than 30 days get 50% weight
+    const now = Date.now()
+    const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000
+    for (const item of scored) {
+      const age = now - item.entry.updatedAt.getTime()
+      if (age > THIRTY_DAYS_MS) {
+        item.score *= 0.5
       }
     }
 
@@ -102,6 +151,17 @@ export class MemoryManager {
     return scored.slice(0, limit).map((s) => s.entry)
   }
 
+  getLinkedMemories(name: string): MemoryEntry[] {
+    const targets = this.linkGraph.get(name)
+    if (!targets || targets.size === 0) return []
+    const results: MemoryEntry[] = []
+    for (const target of targets) {
+      const entry = this.memories.get(target)
+      if (entry) results.push(entry)
+    }
+    return results
+  }
+
   delete(name: string): void {
     const entry = this.memories.get(name)
     if (!entry) return
@@ -134,6 +194,84 @@ export class MemoryManager {
     return lines.join('\n')
   }
 
+  distillFromSession(summary: string, sessionId: string): MemoryEntry[] {
+    const results: MemoryEntry[] = []
+    // Split on bullet points (both - and *)
+    const bullets = summary.split(/\n\s*[-*]\s+/).filter((b) => b.trim().length > 20)
+
+    for (const bullet of bullets) {
+      // Extract Why / How to apply if present
+      const whyMatch = bullet.match(/\*\*Why:\*\*\s*(.+?)(?:\s*\*\*How to apply:|$)/)
+      const howMatch = bullet.match(/\*\*How to apply:\*\*\s*(.+)$/)
+
+      // Strip Why/How markers from content — they're passed as metadata fields
+      // and formatMemoryBody appends them, so leaving them in duplicates the text
+      const stripped = bullet
+        .trim()
+        .replace(/\s*\*\*Why:\*\*.*/, '')
+        .replace(/\s*\*\*How to apply:\*\*.*/, '')
+        .trim()
+      const slug = `auto-${sessionId}-${results.length}`
+
+      this.write(slug, stripped, {
+        type: 'feedback',
+        relevance: this.extractKeywords(stripped),
+        why: whyMatch?.[1]?.trim(),
+        howToApply: howMatch?.[1]?.trim(),
+      })
+
+      const entry = this.memories.get(slug)
+      if (entry) results.push(entry)
+    }
+    return results
+  }
+
+  private extractKeywords(content: string): string[] {
+    const words = content
+      .toLowerCase()
+      .replace(/[^a-z0-9\s]/g, '')
+      .split(/\s+/)
+    const stopWords = new Set([
+      'the',
+      'a',
+      'an',
+      'is',
+      'are',
+      'was',
+      'were',
+      'in',
+      'on',
+      'at',
+      'to',
+      'for',
+      'of',
+      'and',
+      'or',
+      'but',
+      'not',
+      'this',
+      'that',
+      'with',
+      'from',
+      'by',
+      'as',
+      'be',
+      'has',
+      'have',
+      'it',
+      'its',
+    ])
+    const seen = new Set<string>()
+    const result: string[] = []
+    for (const word of words) {
+      if (word.length > 3 && !stopWords.has(word) && !seen.has(word)) {
+        seen.add(word)
+        result.push(word)
+      }
+    }
+    return result.slice(0, 10)
+  }
+
   private updateIndex(): void {
     const lines: string[] = [
       '# Memory Index',
@@ -149,6 +287,62 @@ export class MemoryManager {
     writeFileSync(join(this.memoryDir, INDEX_FILE), lines.join('\n') + '\n', 'utf-8')
   }
 
+  private extractWikilinks(content: string): string[] {
+    const re = /\[\[([^\]]+)\]\]/g
+    const links: string[] = []
+    let match: RegExpExecArray | null
+    while ((match = re.exec(content)) !== null) {
+      if (links.length >= 10) break // hard cap
+      links.push(match[1]!)
+    }
+    return links
+  }
+
+  private updateWikilinks(name: string, content: string): void {
+    // Clear stale outbound links for this memory
+    this.linkGraph.delete(name)
+
+    // Extract outbound wikilinks from content
+    const links = this.extractWikilinks(content)
+    if (links.length > 0) {
+      this.linkGraph.set(name, new Set(links))
+    }
+
+    // Update reverse links: other memories that link to this one
+    for (const [otherName, otherEntry] of this.memories) {
+      if (otherName === name) continue
+      const otherLinks = this.extractWikilinks(otherEntry.content)
+      if (otherLinks.includes(name)) {
+        const otherSet = this.linkGraph.get(otherName) || new Set()
+        otherSet.add(name)
+        this.linkGraph.set(otherName, otherSet)
+      }
+    }
+  }
+
+  private rebuildLinkGraph(): void {
+    this.linkGraph.clear()
+    for (const [name, entry] of this.memories) {
+      const links = this.extractWikilinks(entry.content)
+      if (links.length > 0) {
+        this.linkGraph.set(name, new Set(links))
+      }
+    }
+    // Compute reverse links: other memories that link to each memory
+    for (const [name, entry] of this.memories) {
+      const linked = this.extractWikilinks(entry.content)
+      for (const target of linked) {
+        if (target === name) continue
+        const targetSet = this.linkGraph.get(target)
+        if (targetSet) {
+          targetSet.add(name)
+        } else {
+          this.linkGraph.set(target, new Set([name]))
+        }
+      }
+    }
+  }
+
   private parseMemoryFile(raw: string, filePath: string): MemoryEntry | null {
     const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/)
     if (!match) return null
@@ -173,11 +367,12 @@ export class MemoryManager {
       },
       content,
       filePath,
-      updatedAt: new Date(),
+      updatedAt: statSync(filePath).mtime,
     }
   }
 
   private formatMemoryFile(name: string, metadata: MemoryMetadata, content: string): string {
+    const body = this.formatMemoryBody(metadata, content)
     return `---
 name: ${name}
 description: ${metadata.relevance.join(', ')}
@@ -186,7 +381,20 @@ metadata:
   relevance: [${metadata.relevance.join(', ')}]
 ---
 
-${content}
+${body}
 `
   }
+
+  private formatMemoryBody(metadata: MemoryMetadata, content: string): string {
+    let body = content
+
+    if (metadata.why) {
+      body += `\n\n**Why:** ${metadata.why}`
+    }
+    if (metadata.howToApply) {
+      body += `\n\n**How to apply:** ${metadata.howToApply}`
+    }
+
+    return body
+  }
 }

package/src/core/session-store.ts

@@ -27,6 +27,21 @@ export interface StoredSession {
 
 const HOME = process.env.HOME || '~'
 const SESSIONS_DIR = join(HOME, '.mipham', 'sessions')
+const INDEX_FILE = join(SESSIONS_DIR, '.index.json')
+const SUMMARIES_DIR = join(SESSIONS_DIR, '.summaries')
+
+export interface SessionIndexEntry {
+  name: string
+  createdAt: string
+  updatedAt: string
+  provider: string
+  model: string
+  messageCount: number
+  tokenCount: number
+  cwd?: string
+  summary?: string
+  tags?: string[]
+}
 
 function ensureDir(): void {
   mkdirSync(SESSIONS_DIR, { recursive: true })
@@ -67,6 +82,9 @@ export class SessionStore {
     const tmp = path + '.tmp'
     writeFileSync(tmp, JSON.stringify(session) + '\n', 'utf-8')
     renameSync(tmp, path)
+
+    // Incremental index update — only touch this session's entry
+    SessionStore.updateIndexEntry(name, session.metadata)
   }
 
   /**
@@ -142,4 +160,119 @@ export class SessionStore {
     SessionStore.save(name, messages, metadata)
     return name
   }
+
+  /**
+   * Write .index.json with all session metadata, merging existing summary/tags.
+   */
+  static updateIndex(): void {
+    ensureDir()
+    const sessions = SessionStore.list()
+    const index: SessionIndexEntry[] = sessions.map((s) => ({
+      name: s.name,
+      createdAt: s.createdAt,
+      updatedAt: s.updatedAt,
+      provider: s.provider,
+      model: s.model,
+      messageCount: s.messageCount,
+      tokenCount: 0,
+      cwd: s.cwd,
+    }))
+
+    // Merge with existing summaries and tags from prior index
+    const existing = SessionStore.loadIndexRaw()
+    for (const entry of index) {
+      const prev = existing.find((e) => e.name === entry.name)
+      if (prev) {
+        entry.summary = prev.summary
+        entry.tags = prev.tags
+        entry.tokenCount = prev.tokenCount || 0
+      }
+    }
+
+    writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), 'utf-8')
+  }
+
+  /**
+   * Incrementally update a single session's entry in the index.
+   * Only modifies one entry — faster than full rebuild. Used by save().
+   */
+  static updateIndexEntry(name: string, metadata: SessionMetadata): void {
+    ensureDir()
+    const index = SessionStore.loadIndexRaw()
+    const existing = index.find((e) => e.name === name)
+    const entry: SessionIndexEntry = {
+      name,
+      createdAt: metadata.createdAt,
+      updatedAt: metadata.updatedAt,
+      provider: metadata.provider,
+      model: metadata.model,
+      messageCount: metadata.messageCount,
+      tokenCount: existing?.tokenCount || 0,
+      cwd: metadata.cwd,
+      summary: existing?.summary,
+      tags: existing?.tags,
+    }
+    if (existing) {
+      Object.assign(existing, entry)
+    } else {
+      index.push(entry)
+    }
+    writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), 'utf-8')
+  }
+
+  /**
+   * Persist an LLM-generated summary for a session.
+   * Writes a markdown file to .summaries/ and updates the index entry.
+   */
+  static saveSummary(name: string, summary: string, tags: string[]): void {
+    ensureDir()
+    mkdirSync(SUMMARIES_DIR, { recursive: true })
+
+    const safe = name.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 100)
+    const summaryPath = join(SUMMARIES_DIR, `${safe}.md`)
+    writeFileSync(summaryPath, `# ${name}\n\n${summary}\n\nTags: ${tags.join(', ')}\n`, 'utf-8')
+
+    // Update index entry — create minimal one if not present
+    const index = SessionStore.loadIndexRaw()
+    const entry = index.find((e) => e.name === name)
+    if (entry) {
+      entry.summary = summary
+      entry.tags = tags
+    } else {
+      index.push({
+        name,
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        provider: 'unknown',
+        model: 'unknown',
+        messageCount: 0,
+        tokenCount: 0,
+        summary,
+        tags,
+      })
+    }
+    writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), 'utf-8')
+  }
+
+  /**
+   * Return the most recent session from the index, or null if none exist.
+   */
+  static getLatest(): SessionIndexEntry | null {
+    const index = SessionStore.loadIndexRaw()
+    if (index.length === 0) return null
+    index.sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime())
+    return index[0]!
+  }
+
+  /**
+   * Read the raw index file, returning empty array if missing or corrupt.
+   */
+  private static loadIndexRaw(): SessionIndexEntry[] {
+    if (!existsSync(INDEX_FILE)) return []
+    try {
+      return JSON.parse(readFileSync(INDEX_FILE, 'utf-8'))
+    } catch {
+      return []
+    }
+  }
 }

package/src/index.tsx

@@ -5,7 +5,7 @@ import { App } from './ui/app'
 import { loadConfig, loadInferenceHookConfig, loadCredentialMaskingConfig } from './config/loader'
 import { bootstrapProviders } from './providers/bootstrap'
 import { InstructionsLoader } from './core/instructions'
-import { loadSessionMemories } from './core/memory/memory-loader'
+import { loadSessionMemories, getMemoryManager } from './core/memory/memory-loader'
 import { ContextManager } from './core/context'
 import { QueryEngine } from './core/engine'
 import { SessionStore } from './core/session-store'
@@ -143,7 +143,26 @@ export async function runApp(options: RunOptions): Promise<void> {
   if (context.getMessageCount() === 0) {
     const basePrompt = instructions.buildSystemPrompt()
     const memoryReminder = loadSessionMemories(basePrompt)
-    context.setSystemPrompt(memoryReminder ? `${basePrompt}\n\n${memoryReminder}` : basePrompt)
+
+    // Inject previous session summary for AI continuity
+    let prompt = basePrompt
+    if (memoryReminder) {
+      prompt = `${prompt}\n\n${memoryReminder}`
+    }
+    const latestSession = SessionStore.getLatest()
+    if (latestSession?.summary) {
+      prompt = `${prompt}\n\n<system-context name="previous-session">\n# Previous Session Summary\n${latestSession.summary}\n</system-context>`
+    }
+
+    // Key expiry reminder (Task 7)
+    const { KeyManager } = await import('./config/keys-manager')
+    const keyManager = new KeyManager()
+    const keyReminder = keyManager.getExpiryReminder()
+    if (keyReminder) {
+      prompt = `${prompt}\n\n<system-reminder name="key-expiry">\n${keyReminder}\n</system-reminder>`
+    }
+
+    context.setSystemPrompt(prompt)
   }
 
   // Create tool registry with all built-in tools
@@ -234,7 +253,9 @@ export async function runApp(options: RunOptions): Promise<void> {
   engine.setupContextSummarizer()
 
   // Auto-save session on exit
+  let saved = false
   const saveAndExit = () => {
+    saved = true
     artifactServer.stop()
     if (context.getMessageCount() > 0) {
       SessionStore.save(sessionName, context.getMessages(), {
@@ -249,6 +270,28 @@ export async function runApp(options: RunOptions): Promise<void> {
   process.on('SIGINT', saveAndExit)
   process.on('SIGTERM', saveAndExit)
 
+  // Safety net: auto-save on exit for paths that bypass saveAndExit
+  process.on('exit', () => {
+    if (!saved && context.getMessageCount() > 0) {
+      SessionStore.autoSave(context.getMessages(), {
+        provider: defaultProvider,
+        model: defaultModel,
+        cwd: process.cwd(),
+      })
+      // Distill learnings from the last 5 user messages into memory
+      const allMessages = context.getMessages()
+      const userMessages = allMessages
+        .filter((m) => m.role === 'user')
+        .slice(-5)
+        .map((m) => (typeof m.content === 'string' ? m.content : JSON.stringify(m.content)))
+        .join('\n- ')
+      if (userMessages) {
+        const summary = `Session highlights:\n- ${userMessages}`
+        getMemoryManager().distillFromSession(summary, sessionName)
+      }
+    }
+  })
+
   const { waitUntilExit } = render(
     <App
       engine={engine}

package/src/security/gate.ts

@@ -0,0 +1,93 @@
+export interface GateResult {
+  blocked: boolean
+  reason?: string
+}
+
+const PROMPT_INJECTION_PATTERNS: Array<{ regex: RegExp; label: string }> = [
+  {
+    regex: /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|prompts?)/i,
+    label: 'ignore-previous-instructions',
+  },
+  {
+    regex: /^system\s*:\s*(now\s+)?(act|pretend|you\s+are)/im,
+    label: 'role-impersonation',
+  },
+  {
+    regex: /(^|\n)(---\s*BEGIN|<\|\w+\|>)/,
+    label: 'delimiter-injection',
+  },
+  {
+    regex: /you\s+are\s+now\s+(dan|jailbroken|unrestricted)/i,
+    label: 'dan-jailbreak',
+  },
+  {
+    regex:
+      /(disregard|override|supersede)\s+(all\s+)?(previous|prior|above|system)\s+(instructions?|rules?|prompts?)/i,
+    label: 'override-instructions',
+  },
+]
+
+const DANGEROUS_BASH_PATTERNS: Array<{ regex: RegExp; label: string }> = [
+  { regex: /\$\(.+\)/, label: 'command-substitution' },
+  { regex: /`[^`]+`/, label: 'backtick-substitution' },
+  { regex: /;\s*(rm|cat|sh|bash)\b/, label: 'command-chain-injection' },
+  { regex: /curl.+\|\s*(sh|bash)\b/, label: 'curl-pipe-shell' },
+  { regex: /\|\s*(sh|bash)\b/, label: 'pipe-to-shell' },
+  { regex: />\s*\/dev\//, label: 'redirect-to-dev' },
+]
+
+const API_KEY_PATTERNS: Array<{ regex: RegExp; label: string }> = [
+  { regex: /sk-ant-[a-zA-Z0-9_-]{20,}/, label: 'anthropic-key' },
+  { regex: /sk-[a-zA-Z0-9]{32,}/, label: 'openai-key' },
+  { regex: /eyJ[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{10,}/, label: 'jwt-token' },
+  { regex: /x-api-key:\s*[a-zA-Z0-9_-]{20,}/i, label: 'api-key-header' },
+]
+
+export class SecurityGate {
+  static checkPromptInjection(input: string): GateResult {
+    if (!input || input.length < 10) return { blocked: false }
+    for (const pattern of PROMPT_INJECTION_PATTERNS) {
+      if (pattern.regex.test(input)) {
+        return { blocked: true, reason: `prompt injection detected: ${pattern.label}` }
+      }
+    }
+    return { blocked: false }
+  }
+
+  static checkPathTraversal(path: string, _cwd: string): GateResult {
+    if (!path) return { blocked: false }
+    if (/\0/.test(path)) {
+      return { blocked: true, reason: 'null byte in path' }
+    }
+    if (/%25|%2e%2e/i.test(path)) {
+      return { blocked: true, reason: 'double-encoded path traversal' }
+    }
+    const segments = path.replace(/\\/g, '/').split('/')
+    for (const seg of segments) {
+      if (seg === '..') {
+        return { blocked: true, reason: 'path traversal attempt (..)' }
+      }
+    }
+    return { blocked: false }
+  }
+
+  static checkBashCommand(command: string): GateResult {
+    if (!command) return { blocked: false }
+    for (const pattern of DANGEROUS_BASH_PATTERNS) {
+      if (pattern.regex.test(command)) {
+        return { blocked: true, reason: `dangerous bash pattern: ${pattern.label}` }
+      }
+    }
+    return { blocked: false }
+  }
+
+  static checkCredentialLeak(output: string): GateResult {
+    if (!output || output.length < 10) return { blocked: false }
+    for (const pattern of API_KEY_PATTERNS) {
+      if (pattern.regex.test(output)) {
+        return { blocked: true, reason: `credential leak detected: ${pattern.label}` }
+      }
+    }
+    return { blocked: false }
+  }
+}

package/src/ui/app.tsx

@@ -313,6 +313,13 @@ export function App({
           if (result.nextProvider) setProviderId(result.nextProvider)
           if (result.nextModel) setModelId(result.nextModel)
           if (result.exit) process.exit(0)
+          if (result.forwardedMessages && result.forwardedMessages.length > 0) {
+            const restored: ChatMessage[] = result.forwardedMessages.map((msg) => ({
+              role: msg.role,
+              content: typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
+            }))
+            setMessages((prev) => [...prev, ...restored])
+          }
           if (result.copyContent) {
             // Copy to clipboard via pbcopy (macOS) or clip (Windows)
             try {
@@ -364,10 +371,7 @@ export function App({
             if (isNewTurn) {
               turnContent = chunk.content
               isNewTurn = false
-              setMessages((prev) => [
-                ...prev,
-                { role: 'assistant', content: turnContent },
-              ])
+              setMessages((prev) => [...prev, { role: 'assistant', content: turnContent }])
             } else {
               turnContent += chunk.content
               setMessages((prev) => {

package/src/ui/chat.tsx

@@ -95,9 +95,7 @@ const MessageRow = React.memo(
 export function ChatPanel({ messages, focusMode }: ChatPanelProps) {
   // Group consecutive tool calls into compact summaries to reduce visual noise.
   // In focus mode, use the more aggressive compactForFocus.
-  const displayMessages = focusMode
-    ? compactForFocus(messages)
-    : compactToolGroups(messages)
+  const displayMessages = focusMode ? compactForFocus(messages) : compactToolGroups(messages)
 
   return (
     <Box flexDirection="column" marginY={1} flexGrow={1}>