@miphamai/cli 0.17.0 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/commands/keys.ts

@@ -0,0 +1,94 @@
+import type { CommandHandler } from '../ui/commands'
+import { KeyManager } from '../config/keys-manager'
+
+export const keysCmd: CommandHandler = async (_ctx, args) => {
+  const manager = new KeyManager()
+  const sub = args[0]?.toLowerCase()
+
+  // /keys rotate <provider>
+  if (sub === 'rotate') {
+    const provider = args[1]
+    if (!provider) {
+      return {
+        content: 'Usage: /keys rotate <provider>\n\nExample: /keys rotate deepseek',
+      }
+    }
+    // Interactive: prompt user to provide new key via follow-up chat message
+    return {
+      content: [
+        '── Key Rotation ──',
+        '',
+        `Provider: ${provider}`,
+        '',
+        'To complete rotation, the new API key must be provided.',
+        'Type your new key in chat and the AI will handle rotation securely.',
+        '',
+        'The old key will be backed up to ~/.mipham/keys/<provider>.backup (chmod 600).',
+      ].join('\n'),
+      forwardToAI: `The user wants to rotate the API key for provider "${provider}". Ask them to provide the new key value, then:
+1. Call KeyManager.rotate("${provider}", newKey) with the provided key
+2. The new key should be stored in ~/.mipham/config.json (or appropriate config)
+3. Confirm rotation count and backup location
+4. Remind them the old key is backed up at ~/.mipham/keys/${provider}.backup`,
+    }
+  }
+
+  // /keys audit
+  if (sub === 'audit') {
+    const expired = manager.audit()
+    if (expired.length === 0) {
+      return {
+        content:
+          '── Key Audit ──\n\n✅ All keys are within the 90-day rotation window.\n\nNo expired keys found.',
+      }
+    }
+
+    const lines: string[] = [
+      '── Key Audit ──',
+      '',
+      `⚠️  ${expired.length} key(s) have exceeded the 90-day rotation threshold:`,
+      '',
+      ...expired.map(
+        (k) =>
+          `  🔴 ${k.provider.padEnd(16)} ${k.ageDays} days since last rotation (${k.lastRotated.slice(0, 10)})`,
+      ),
+      '',
+      'Rotate expired keys with: /keys rotate <provider>',
+    ]
+    return { content: lines.join('\n') }
+  }
+
+  // /keys (list)
+  const keys = manager.list()
+
+  if (keys.length === 0) {
+    return {
+      content: [
+        '── API Keys ──',
+        '',
+        'No API keys tracked yet.',
+        '',
+        'Keys are tracked in ~/.mipham/keys.json when you configure providers.',
+        'Use /keys rotate <provider> to begin tracking rotation for a provider.',
+      ].join('\n'),
+    }
+  }
+
+  const lines: string[] = [
+    '── API Keys ──',
+    '',
+    'Provider         Age     Rotations   Status',
+    '─'.repeat(55),
+    ...keys.map((k) => {
+      const status = k.expired ? '🔴 EXPIRED' : '🟢 OK'
+      return `  ${k.provider.padEnd(16)} ${String(k.ageDays).padStart(4)}d   ${String(k.rotationCount).padStart(5)}       ${status}`
+    }),
+    '',
+    `${keys.length} key(s) tracked.`,
+    '',
+    'Commands:',
+    '  /keys rotate <provider>  — rotate a key',
+    '  /keys audit             — check for expired keys',
+  ]
+  return { content: lines.join('\n') }
+}

package/src/config/keys-manager.ts

@@ -0,0 +1,121 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import { homedir } from 'node:os'
+
+const MIPHAM_DIR = join(homedir(), '.mipham')
+const KEYS_FILE = join(MIPHAM_DIR, 'keys.json')
+
+export interface KeyEntry {
+  createdAt: string
+  lastRotated: string
+  rotationCount: number
+  provider: string
+}
+
+export interface KeyStatus {
+  provider: string
+  createdAt: string
+  lastRotated: string
+  rotationCount: number
+  ageDays: number
+  expired: boolean
+}
+
+export interface KeysData {
+  [provider: string]: KeyEntry
+}
+
+function loadKeys(): KeysData {
+  if (!existsSync(KEYS_FILE)) return {}
+  try {
+    const raw = readFileSync(KEYS_FILE, 'utf-8')
+    return JSON.parse(raw) as KeysData
+  } catch {
+    return {}
+  }
+}
+
+function saveKeys(data: KeysData): void {
+  mkdirSync(dirname(KEYS_FILE), { recursive: true })
+  const tmp = KEYS_FILE + '.tmp'
+  writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 })
+  writeFileSync(KEYS_FILE, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 })
+  try {
+    chmodSync(KEYS_FILE, 0o600)
+  } catch {
+    // chmod on Windows is a no-op
+  }
+}
+
+function daysSince(iso: string): number {
+  const then = new Date(iso).getTime()
+  const now = Date.now()
+  return Math.floor((now - then) / (1000 * 60 * 60 * 24))
+}
+
+export class KeyManager {
+  list(): KeyStatus[] {
+    const data = loadKeys()
+    return Object.entries(data).map(([provider, entry]) => ({
+      provider,
+      createdAt: entry.createdAt,
+      lastRotated: entry.lastRotated,
+      rotationCount: entry.rotationCount,
+      ageDays: daysSince(entry.lastRotated),
+      expired: daysSince(entry.lastRotated) > 90,
+    }))
+  }
+
+  rotate(provider: string, _newKey: string): { success: boolean; message: string } {
+    const data = loadKeys()
+    const now = new Date().toISOString()
+    const existing = data[provider]
+
+    // Backup old entry if it exists
+    if (existing) {
+      const backupDir = join(MIPHAM_DIR, 'keys')
+      mkdirSync(backupDir, { recursive: true })
+      const backupPath = join(backupDir, `${provider}.backup`)
+      writeFileSync(backupPath, JSON.stringify(existing, null, 2) + '\n', { mode: 0o600 })
+      try {
+        chmodSync(backupPath, 0o600)
+      } catch {
+        // Windows
+      }
+
+      data[provider] = {
+        createdAt: existing.createdAt,
+        lastRotated: now,
+        rotationCount: existing.rotationCount + 1,
+        provider,
+      }
+    } else {
+      data[provider] = {
+        createdAt: now,
+        lastRotated: now,
+        rotationCount: 1,
+        provider,
+      }
+    }
+
+    saveKeys(data)
+    return {
+      success: true,
+      message: `Key for "${provider}" rotated (rotation #${data[provider]!.rotationCount}). Backup saved to ~/.mipham/keys/${provider}.backup`,
+    }
+  }
+
+  audit(): KeyStatus[] {
+    return this.list().filter((k) => k.expired)
+  }
+
+  getExpiryReminder(): string | null {
+    const expired = this.audit()
+    if (expired.length === 0) return null
+
+    const lines = expired.map(
+      (k) => `  - ${k.provider}: last rotated ${k.ageDays} days ago (90-day threshold exceeded)`,
+    )
+    return `⚠️  API key rotation overdue:\n${lines.join('\n')}\n\nRun /keys rotate <provider> to rotate.`
+  }
+}

package/src/index.tsx

@@ -153,6 +153,15 @@ export async function runApp(options: RunOptions): Promise<void> {
     if (latestSession?.summary) {
       prompt = `${prompt}\n\n<system-context name="previous-session">\n# Previous Session Summary\n${latestSession.summary}\n</system-context>`
     }
+
+    // Key expiry reminder (Task 7)
+    const { KeyManager } = await import('./config/keys-manager')
+    const keyManager = new KeyManager()
+    const keyReminder = keyManager.getExpiryReminder()
+    if (keyReminder) {
+      prompt = `${prompt}\n\n<system-reminder name="key-expiry">\n${keyReminder}\n</system-reminder>`
+    }
+
     context.setSystemPrompt(prompt)
   }
 

package/src/security/gate.ts

@@ -0,0 +1,93 @@
+export interface GateResult {
+  blocked: boolean
+  reason?: string
+}
+
+const PROMPT_INJECTION_PATTERNS: Array<{ regex: RegExp; label: string }> = [
+  {
+    regex: /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|prompts?)/i,
+    label: 'ignore-previous-instructions',
+  },
+  {
+    regex: /^system\s*:\s*(now\s+)?(act|pretend|you\s+are)/im,
+    label: 'role-impersonation',
+  },
+  {
+    regex: /(^|\n)(---\s*BEGIN|<\|\w+\|>)/,
+    label: 'delimiter-injection',
+  },
+  {
+    regex: /you\s+are\s+now\s+(dan|jailbroken|unrestricted)/i,
+    label: 'dan-jailbreak',
+  },
+  {
+    regex:
+      /(disregard|override|supersede)\s+(all\s+)?(previous|prior|above|system)\s+(instructions?|rules?|prompts?)/i,
+    label: 'override-instructions',
+  },
+]
+
+const DANGEROUS_BASH_PATTERNS: Array<{ regex: RegExp; label: string }> = [
+  { regex: /\$\(.+\)/, label: 'command-substitution' },
+  { regex: /`[^`]+`/, label: 'backtick-substitution' },
+  { regex: /;\s*(rm|cat|sh|bash)\b/, label: 'command-chain-injection' },
+  { regex: /curl.+\|\s*(sh|bash)\b/, label: 'curl-pipe-shell' },
+  { regex: /\|\s*(sh|bash)\b/, label: 'pipe-to-shell' },
+  { regex: />\s*\/dev\//, label: 'redirect-to-dev' },
+]
+
+const API_KEY_PATTERNS: Array<{ regex: RegExp; label: string }> = [
+  { regex: /sk-ant-[a-zA-Z0-9_-]{20,}/, label: 'anthropic-key' },
+  { regex: /sk-[a-zA-Z0-9]{32,}/, label: 'openai-key' },
+  { regex: /eyJ[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{10,}/, label: 'jwt-token' },
+  { regex: /x-api-key:\s*[a-zA-Z0-9_-]{20,}/i, label: 'api-key-header' },
+]
+
+export class SecurityGate {
+  static checkPromptInjection(input: string): GateResult {
+    if (!input || input.length < 10) return { blocked: false }
+    for (const pattern of PROMPT_INJECTION_PATTERNS) {
+      if (pattern.regex.test(input)) {
+        return { blocked: true, reason: `prompt injection detected: ${pattern.label}` }
+      }
+    }
+    return { blocked: false }
+  }
+
+  static checkPathTraversal(path: string, _cwd: string): GateResult {
+    if (!path) return { blocked: false }
+    if (/\0/.test(path)) {
+      return { blocked: true, reason: 'null byte in path' }
+    }
+    if (/%25|%2e%2e/i.test(path)) {
+      return { blocked: true, reason: 'double-encoded path traversal' }
+    }
+    const segments = path.replace(/\\/g, '/').split('/')
+    for (const seg of segments) {
+      if (seg === '..') {
+        return { blocked: true, reason: 'path traversal attempt (..)' }
+      }
+    }
+    return { blocked: false }
+  }
+
+  static checkBashCommand(command: string): GateResult {
+    if (!command) return { blocked: false }
+    for (const pattern of DANGEROUS_BASH_PATTERNS) {
+      if (pattern.regex.test(command)) {
+        return { blocked: true, reason: `dangerous bash pattern: ${pattern.label}` }
+      }
+    }
+    return { blocked: false }
+  }
+
+  static checkCredentialLeak(output: string): GateResult {
+    if (!output || output.length < 10) return { blocked: false }
+    for (const pattern of API_KEY_PATTERNS) {
+      if (pattern.regex.test(output)) {
+        return { blocked: true, reason: `credential leak detected: ${pattern.label}` }
+      }
+    }
+    return { blocked: false }
+  }
+}

package/src/ui/commands.ts

@@ -24,6 +24,7 @@ import {
 } from '../commands/project.js'
 import { themeCmd, releaseNotesCmd, ideCmd, terminalSetupCmd } from '../commands/environment.js'
 import { commitCmd, pushCmd, prCmd, issueCmd } from '../commands/git.js'
+import { keysCmd } from '../commands/keys'
 
 export interface CommandContext {
   engine: QueryEngine
@@ -187,6 +188,9 @@ const helpCmd: CommandHandler = (ctx) => {
       ── Account ─────────────────────────
       /login         Show API key status
       /logout        Clear credentials guide
+      /keys          List API key rotation status
+      /keys rotate   Rotate an API key
+      /keys audit    Check for expired keys
       /feedback      Send feedback
 
       ── Agents ──────────────────────────
@@ -3122,6 +3126,9 @@ const commandsListCmd: CommandHandler = () => {
     '/release-notes': 'Environment',
     '/login': 'Account',
     '/logout': 'Account',
+    '/keys': 'Account',
+    '/keys rotate': 'Account',
+    '/keys audit': 'Account',
     '/feedback': 'Account',
     '/agents': 'Agents',
     '/bg': 'Agents',
@@ -3273,6 +3280,9 @@ registry.set('/release-notes', releaseNotesCmd)
 registry.set('/mcp', mcpCmd)
 registry.set('/login', loginCmd)
 registry.set('/logout', logoutCmd)
+registry.set('/keys', keysCmd)
+registry.set('/keys rotate', keysCmd)
+registry.set('/keys audit', keysCmd)
 registry.set('/feedback', feedbackCmd)
 registry.set('/agents', agentsCmd)
 registry.set('/bg', bgCmd)
@@ -3399,6 +3409,9 @@ const COMMAND_DESCRIPTIONS: Record<string, string> = {
   '/upgrade': 'Show upgrade instructions',
   '/login': 'Show API key status',
   '/logout': 'Clear credentials guide',
+  '/keys': 'List API key rotation status',
+  '/keys rotate': 'Rotate an API key',
+  '/keys audit': 'Check for expired keys',
   '/feedback': 'Send feedback',
   '/agents': 'Agent view dashboard',
   '/bg': 'Run a background agent task',