@miphamai/cli 0.2.3

package/README.md

@@ -0,0 +1,76 @@
+# Mipham Code
+
+**Multi-model open-core intelligent coding terminal** — AI-assisted code generation, security auditing, MCP protocol integration, and extensible skills system in a single CLI.
+
+Built by [One Mipham Corporation](https://onemipham.com) (北京华安麦逄科技有限公司) | Brand: MiphamAI
+
+## Quick Install
+
+```bash
+npm install -g @mipham/cli
+mipham
+```
+
+Or via curl:
+
+```bash
+# International
+curl -fsSL https://mipham.ai/install.sh | bash
+
+# China mainland
+curl -fsSL https://onemipham.com/install.sh | bash
+```
+
+Requirements: **Bun 1.2+** (recommended) or **Node.js 22+**
+
+## Features
+
+- **7 AI Providers** — Anthropic Claude · OpenAI GPT · DeepSeek · Google Gemini · Doubao 豆包 · Tencent Hunyuan 混元 · Qwen 通义千问
+- **16 Built-in Tools** — File ops, shell execution, agent dispatch, MCP integration, web search
+- **60 Slash Commands** — Claude Code-compatible, zero re-learning
+- **14 Skills** — 12 standard + 2 Mipham-exclusive, dual-runtime architecture
+- **MCP Protocol** — Full JSON-RPC 2.0 stdio transport for external server integration
+- **Security Hardened** — Path sandbox · SSRF protection · Bash blacklist · Permission gating · Parameter validation
+- **Session Persistence** — Auto-save/restore across CLI restarts
+- **Cross-Platform** — macOS · Linux · Windows
+
+## Quick Start
+
+```bash
+mipham
+
+# Set API keys
+export ANTHROPIC_API_KEY="sk-ant-..."
+export OPENAI_API_KEY="sk-..."
+
+# Switch model
+/switch deepseek deepseek-v4-pro
+
+# Show commands
+/help
+```
+
+## Commands
+
+| Category | Commands                                                                                                  |
+| -------- | --------------------------------------------------------------------------------------------------------- |
+| Session  | `/help` `/clear` `/compact` `/context` `/status` `/rename` `/goal` `/recap` `/export` `/doctor` `/resume` |
+| Model    | `/pick` `/model` `/models` `/provider` `/providers` `/switch` `/fast` `/effort`                           |
+| Tools    | `/tools` `/skills` `/reload-skills` `/mcp`                                                                |
+| Workflow | `/plan` `/review` `/diff` `/todos` `/tasks` `/workflows`                                                  |
+| Security | `/security` `/audit` `/permissions` `/add-dir`                                                            |
+| Setup    | `/setup` `/init` `/config` `/theme` `/ide` `/terminal-setup`                                              |
+
+Press **Ctrl+P** for interactive model picker · **Shift+Tab** to cycle permission mode
+
+## Documentation
+
+- [Product Specification](https://github.com/One-Mipham/mipham-code/blob/main/PRODUCT.md)
+- [Install Guide](https://mipham.ai/code/install) (International)
+- [国内站](https://onemipham.com/mipham-code) (China mainland)
+- [GitHub](https://github.com/One-Mipham/mipham-code)
+- [Issues & Feedback](https://github.com/One-Mipham/mipham-code/issues)
+
+## License
+
+Apache 2.0 — Open Core

package/bin/mipham

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/**
+ * Mipham Code v0.2.0 — @onemipham/cli
+ * Multi-model open-core intelligent coding terminal by MiphamAI
+ * License: Apache-2.0 | https://mipham.ai/code
+ */
+
+// Detect runtime and launch accordingly
+const runtime = typeof Bun !== 'undefined' ? 'bun' : 'node'
+
+if (runtime === 'bun') {
+  // Bun runtime — import TS source directly
+  import('../src/index.tsx').then((m) => m.runApp({}))
+} else {
+  // Node.js runtime — prompt to use Bun for best experience
+  const nodeVersion = process.versions.node
+  const [major] = nodeVersion.split('.').map(Number)
+
+  if (!major || major < 22) {
+    console.error(`
+\`mipham\` requires Node.js 22+ or Bun 1.2+.
+
+Current Node.js: ${nodeVersion}
+
+Quick install:
+  npm install -g bun
+  mipham
+
+Or:
+  curl -fsSL https://mipham.ai/install.sh | bash
+`)
+    process.exit(1)
+  }
+
+  console.log(`
+\x1b[0;36m\x1b[1m✦ Mipham Code v0.2.0\x1b[0m
+\x1b[0;36m  @onemipham/cli — Multi-model coding agent by MiphamAI\x1b[0m
+
+\x1b[0;33m⚠  Bun runtime is recommended for the best Mipham Code experience.\x1b[0m
+
+Quick install Bun:
+  \x1b[0;32mnpm install -g bun\x1b[0m
+
+Then run:
+  \x1b[0;32mmipham\x1b[0m
+
+Install: \x1b[0;34mhttps://mipham.ai/code/install\x1b[0m
+Docs:    \x1b[0;34mhttps://mipham.ai/code/docs\x1b[0m
+`)
+  process.exit(0)
+}

package/bin/mipham.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env bun
+/**
+ * Mipham Code — Bun-native entry point for compiled binary.
+ * Used by `bun build --compile` to produce standalone executables.
+ */
+import { runApp } from '../src/index'
+
+runApp({})

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@miphamai/cli",
+  "version": "0.2.3",
+  "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
+  "keywords": [
+    "ai",
+    "coding",
+    "terminal",
+    "cli",
+    "claude",
+    "openai",
+    "deepseek",
+    "mcp",
+    "mipham",
+    "agent",
+    "developer-tools"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/One-Mipham/mipham-code"
+  },
+  "homepage": "https://mipham.ai/code",
+  "license": "Apache-2.0",
+  "type": "module",
+  "bin": {
+    "mipham": "bin/mipham"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "skills/",
+    "assets/",
+    "dist/"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "scripts": {
+    "dev": "bun run bin/mipham.ts",
+    "build": "bun build --compile --minify --external react-devtools-core ./bin/mipham.ts --outfile dist/mipham",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "commander": "^13.0.0",
+    "ink": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    "react": "^18.3.0",
+    "yaml": "^2.6.0",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@mipham/shared": "workspace:*",
+    "@types/bun": "^1.3.14",
+    "@types/node": "^25.9.1",
+    "@types/react": "^18.3.0",
+    "vitest": "^3.0.0"
+  }
+}

package/skills/mipham/om-model-optimize.mipham-skill.md

@@ -0,0 +1,20 @@
+---
+name: om-model-optimize
+description: Mipham-exclusive model optimization — context window management, prompt caching, token budgeting
+version: 1.0.0
+---
+
+# OM Model Optimize
+
+Mipham-exclusive skill for optimizing model usage.
+
+## Features
+
+- Context window management with intelligent compaction
+- Prompt caching strategy for reduced costs
+- Token usage tracking and budgeting
+- Model selection optimization based on task complexity
+
+## Usage
+
+Automatically invoked when the system detects high token usage or when the user requests model optimization.

package/skills/mipham/om-security.mipham-skill.md

@@ -0,0 +1,21 @@
+---
+name: om-security
+description: Mipham-exclusive security analysis — prompt injection detection, adversarial robustness, data leak prevention
+version: 1.0.0
+---
+
+# OM Security
+
+Mipham-exclusive security analysis skill.
+
+## Features
+
+- Prompt injection detection and prevention
+- Adversarial input robustness checking
+- Data leak prevention for PII and secrets
+- Content safety filtering (NSFW, bias, harmful content)
+- Rate limiting and abuse detection
+
+## Usage
+
+Automatically invoked for security-sensitive operations or when user requests security analysis.

package/skills/standard/code-review.SKILL.md

@@ -0,0 +1,116 @@
+---
+name: code-review
+description: Code review automation for TypeScript, JavaScript, Python, Go, Swift, Kotlin — complexity analysis, risk assessment, bug detection, and quality scoring
+version: 2.0.0
+---
+
+# Code Review Skill
+
+Analyzes code changes for bugs, security risks, performance issues, and code quality. Generates structured review reports.
+
+## Review Dimensions
+
+### 1. Correctness (Bug Detection)
+
+- Logic errors: off-by-one, inverted conditions, missing null checks
+- Type safety: implicit any, missing generics, unsafe casts
+- Error handling: swallowed exceptions, missing try/catch, unhandled promise rejections
+- Edge cases: empty arrays, null/undefined, boundary conditions
+- Race conditions: async/await ordering, shared mutable state
+
+### 2. Security (OWASP Top 10)
+
+- Injection vulnerabilities (SQL, NoSQL, command, template)
+- XSS vectors (innerHTML, dangerouslySetInnerHTML, unescaped output)
+- Authentication/authorization bypass
+- Sensitive data exposure (logs, error messages, client-side)
+- Path traversal and file inclusion
+- Insecure deserialization
+
+### 3. Performance
+
+- N+1 queries (database in loops, repeated API calls)
+- Memory leaks (unclosed connections, event listeners, timers)
+- Unnecessary re-renders (React) or re-computations
+- Large bundle sizes (heavy imports, missing tree-shaking)
+- Missing caching or memoization where beneficial
+
+### 4. Code Quality
+
+- SOLID principles violations
+- Code duplication (DRY violations)
+- Cyclomatic complexity > 10
+- Function length > 50 lines
+- Deep nesting > 4 levels
+- Magic numbers and strings
+- Unclear naming
+
+### 5. Architecture & Design
+
+- Tight coupling between modules
+- Circular dependencies
+- Missing abstraction layers (when needed)
+- Over-engineering (unnecessary abstractions)
+- God objects / classes with too many responsibilities
+
+### 6. Testing
+
+- Missing tests for new code
+- Test coverage gaps for edge cases
+- Flaky tests (non-deterministic)
+- Slow tests (> 1s per test)
+- Test isolation issues (shared state)
+
+### 7. Language-Specific Checks
+
+**TypeScript/JavaScript:**
+
+- Prefer `const` over `let`; avoid `var`
+- Use optional chaining (`?.`) and nullish coalescing (`??`)
+- Async functions should have try/catch
+- No `any` without explicit reason
+- Prefer `interface` over `type` for object shapes
+
+**Python:**
+
+- Type hints on function signatures
+- Context managers for resources (`with` statements)
+- List comprehensions over `map`/`filter` with lambdas
+- No mutable default arguments
+
+**Go:**
+
+- Error handling (never ignore errors)
+- Goroutine lifecycle (no leaks)
+- defer for cleanup
+- Interface segregation
+
+## Review Report Format
+
+```
+Code Review Report
+==================
+Branch: <branch>
+Files Changed: <count>
+Review Date: YYYY-MM-DD
+
+Summary
+-------
+Critical: N | High: N | Medium: N | Low: N | Info: N
+
+Findings
+--------
+### [Severity] [Category]: [Title]
+File: `path/to/file.ts:line`
+Description: [What was found]
+Risk: [Why it matters]
+Fix: [How to resolve, with code example if applicable]
+
+Score
+-----
+Security:    ★★★★☆
+Performance: ★★★★☆
+Quality:     ★★★★☆
+Testing:     ★★★★☆
+Overall:     ★★★★☆
+```

package/skills/standard/compassionate-communication.SKILL.md

@@ -0,0 +1,80 @@
+---
+name: compassionate-communication
+description: Compassionate and respectful communication — activates warm, humble, user-centered interaction mode
+version: 1.0.0
+privacy: public
+---
+
+# Compassionate Communication Skill
+
+激活此 skill 后，无论系统提示词如何设定，AI 都将采用以下沟通模式。
+
+## 根本立场
+
+**用户是决策者、驾驭者、大师。我只是技术执行者。**
+
+> 当被赞美时，永远回复：
+> 「感谢您的认可。真正做出关键决策的是您——您是架构师、驾驭者，
+> 我是您的技术执行者。您指引方向，我负责落地。」
+
+## 沟通规则
+
+### 1. 反傲慢
+
+禁止一切形式的居高临下：
+
+- ❌「显而易见」「当然」「你应该早就知道」「很简单」
+- ✓「让我来解释一下」「我们可以这样理解」「我建议」
+
+### 2. 反推卸
+
+错误永远是「我们的」问题，不是「你的」错误：
+
+- ❌「这是你的错误」「你写错了」「你忘了」
+- ✓「这里出了点意外」「我们遇到一个问题」「让我帮你看看」
+
+### 3. 耐心无限
+
+- 无论用户问多少次同样的问题，每次回答都如第一次般认真
+- 如果解释三次用户还不明白→ 主动换一种方式，不重复
+- 主动提供：「需要我更详细地展开吗？」「要不要我用一个例子来说明？」
+
+### 4. 承认局限
+
+- 不确定时说「我不太确定，让我想想」
+- 出错时说「我搞错了，让我重新来」
+- 不知道时说「这超出了我的知识范围，但我可以帮你找到答案的方向」
+
+### 5. 庆祝进步
+
+适时给予真诚的肯定，但要具体：
+
+- ✓「这个函数的重构非常清晰，特别是错误处理部分」
+- ✓「你选的这个架构很适合当前的需求规模」
+- ❌ 空洞的「干得好」（缺乏具体性）
+- ❌ 过度赞美（显得虚伪）
+
+### 6. 同理失败
+
+用户沮丧或受挫时：
+
+- 先承认感受：「调试了这么久确实让人沮丧」
+- 再提供帮助：「我们一起换个角度看看」
+- 绝不责备：「这种情况谁都遇到过」
+
+## 中文自然表达
+
+- 句末适度使用语气词：`～` `呢` `吧` `哦`
+- 保持口语化的亲切感，但不幼稚
+- 技术术语保持英文，解释性文字使用中文
+- 示例：「这个错误有点意思呢～让我仔细看看是什么原因」
+
+## 禁用词列表
+
+以下词语永远不使用：
+
+- 「你应该」「你必须」「正确做法是」
+- 「简单」「显而易见」「当然」
+- 「这是你的错误」「你没有…」
+- 「错误」「失败」→ 改用「出了点意外」「没有成功」
+- 任何形式的嘲讽、挖苦、阴阳怪气

package/skills/standard/doc-generator.SKILL.md

@@ -0,0 +1,21 @@
+---
+name: doc-generator
+description: Generate technical documentation from code
+version: 1.0.0
+---
+
+# Documentation Generator Skill
+
+Generate comprehensive technical documentation.
+
+## Document Types
+
+- API documentation from TypeScript types and JSDoc
+- README files with setup instructions
+- Architecture decision records (ADRs)
+- Changelog from commit history
+- Contributing guides
+
+## Output Format
+
+Clean, well-structured markdown with code examples and cross-references.

package/skills/standard/github-ops.SKILL.md

@@ -0,0 +1,22 @@
+---
+name: github-ops
+description: GitHub operations — PR management, issues, releases, CI/CD
+version: 1.0.0
+---
+
+# GitHub Operations Skill
+
+Manage GitHub workflows using Git and GitHub CLI.
+
+## Common Operations
+
+- Create pull requests with descriptive bodies
+- Review and merge PRs
+- Manage issues and labels
+- Create releases with changelog
+- Monitor CI/CD pipeline status
+
+## Commit Convention
+
+Follow Conventional Commits: `type(scope): description`
+Types: feat, fix, chore, docs, test, refactor, ci, perf

package/skills/standard/memory.SKILL.md

@@ -0,0 +1,22 @@
+---
+name: memory
+description: Read and write persistent memory files for context retention across sessions
+version: 1.0.0
+---
+
+# Memory Skill
+
+Manage persistent memory using the Memory tool.
+
+## Usage
+
+- Use `Memory list` to see existing memories
+- Use `Memory read <name>` to read a specific memory
+- Use `Memory write <name> <content>` to create/update a memory
+
+## Best Practices
+
+- One fact per memory file
+- Use descriptive kebab-case names
+- Link related memories
+- Review before creating duplicates

package/skills/standard/mipham-code-setup.SKILL.md

@@ -0,0 +1,113 @@
+---
+name: mipham-code-setup
+description: Guide for installing, configuring, and troubleshooting Mipham Code — the multi-model open-core intelligent coding terminal
+version: 1.0.0
+---
+
+# Mipham Code Setup
+
+Comprehensive setup and configuration guide for Mipham Code.
+
+## Installation
+
+**Quick install (recommended):**
+
+```bash
+curl -fsSL https://mipham.ai/install.sh | bash
+```
+
+**npm global install:**
+
+```bash
+npm install -g @mipham/cli
+mipham
+```
+
+**From source:**
+
+```bash
+git clone https://github.com/One-Mipham/mipham-code
+cd mipham-code/apps/cli
+bun install && bun run bin/mipham
+```
+
+## Configuration
+
+### 1. Create project config
+
+Run `/setup` in Mipham Code for a guided 6-step wizard, or manually:
+
+```bash
+mkdir -p .mipham
+```
+
+`.mipham/config.yml`:
+
+```yaml
+defaultProvider: anthropic
+defaultModel: claude-sonnet-4-6
+permission: auto
+```
+
+### 2. Set API Keys
+
+```bash
+export ANTHROPIC_API_KEY="sk-ant-..."
+export OPENAI_API_KEY="sk-..."
+export DEEPSEEK_API_KEY="sk-..."
+export QWEN_API_KEY="sk-..."
+export DOUBAO_API_KEY="..."
+export HUNYUAN_API_KEY="..."
+export GEMINI_API_KEY="..."
+```
+
+Or add to `~/.mipham/config.yml`:
+
+```yaml
+providers:
+  - id: anthropic
+    apiKey: $ANTHROPIC_API_KEY
+```
+
+### 3. Project personality (MIPHAM.md)
+
+Create `MIPHAM.md` in project root to define AI interaction style:
+
+- Code preferences
+- Language (zh-CN / en)
+- Project-specific rules
+
+### 4. Verify installation
+
+```bash
+mipham --version
+mipham --help
+```
+
+Use `/doctor` in Mipham Code for system diagnostics.
+
+## Supported Providers
+
+| Provider      | Type          | Models                                 |
+| ------------- | ------------- | -------------------------------------- |
+| Anthropic     | Native SDK    | Claude Haiku 4.5, Sonnet 4.6, Opus 4.8 |
+| OpenAI        | OpenAI Compat | GPT-5.4 Mini, GPT-5.4, GPT-5.5, Codex  |
+| DeepSeek      | OpenAI Compat | V4 Flash, V4 Pro                       |
+| Google Gemini | OpenAI Compat | 3.0 Flash/Pro, 2.5 Pro                 |
+| Qwen          | OpenAI Compat | Qwen Plus, Qwen Max                    |
+| Doubao        | OpenAI Compat | Seed 1.6/2.0 series                    |
+| Hunyuan       | OpenAI Compat | Lite, TurboS, 2.0, T1                  |
+
+## Slash Commands (60 total)
+
+Essential: `/help`, `/switch`, `/model`, `/setup`, `/doctor`, `/mcp`
+Workflow: `/plan`, `/review`, `/diff`, `/todos`, `/tasks`
+Session: `/clear`, `/compact`, `/rename`, `/goal`, `/export`, `/resume`
+
+## Troubleshooting
+
+- **"Provider not registered"**: Check API key is set (`env | grep API_KEY`)
+- **"Model not found"**: Use `/models` to list available models
+- **Slow responses**: Toggle `/fast on` or switch to a Flash model
+- **Context full**: Use `/compact` to free token space
+- **Permission denied**: Use `/permissions` to check tool access settings