@miphamai/cli 0.20.0 → 0.20.2

package/src/i18n-core/t.ts

@@ -0,0 +1,19 @@
+import type { TranslationMap } from './types'
+
+function getNested(obj: TranslationMap, key: string): unknown {
+  return key.split('.').reduce((o, k) => (o as any)?.[k], obj as any)
+}
+
+export function createT(
+  current: TranslationMap,
+  fallback: TranslationMap,
+): (key: string, params?: Record<string, string>) => string {
+  return function t(key: string, params?: Record<string, string>): string {
+    const val = getNested(current, key) ?? getNested(fallback, key) ?? key
+    if (typeof val !== 'string') return key
+    if (params) {
+      return val.replace(/\{(\w+)\}/g, (_, k: string) => params[k] ?? '')
+    }
+    return val
+  }
+}

package/src/i18n-core/types.ts

@@ -0,0 +1,10 @@
+export type Locale = 'en-US' | 'zh-CN'
+
+export const SUPPORTED_LOCALES: Locale[] = ['en-US', 'zh-CN']
+
+export const FALLBACK_LOCALE: Locale = 'en-US'
+
+/** A TranslationMap is a nested object where leaves are template strings. */
+export interface TranslationMap {
+  [key: string]: string | TranslationMap
+}

package/src/index.tsx

@@ -24,12 +24,12 @@ import { getMetrics } from './core/metrics'
 import { ARTIFACTS_DIR, ARTIFACT_PORT, MIPHAM_DIR } from './shared/constants'
 import { AgentViewManager } from './agent-view/agent-view-manager'
 import { AgentViewDashboard } from './agent-view/dashboard'
-import { createT } from '@mipham/shared/i18n/t'
-import { detectLocale } from '@mipham/shared/i18n/detect'
+import { createT } from './i18n-core/t'
+import { detectLocale } from './i18n-core/detect'
 import { I18nProvider } from './i18n-context'
-import enUS from '@mipham/shared/i18n/locales/en-US.json' with { type: 'json' }
-import zhCN from '@mipham/shared/i18n/locales/zh-CN.json' with { type: 'json' }
-import type { TranslationMap } from '@mipham/shared/i18n/types'
+import enUS from './i18n-core/locales/en-US.json' with { type: 'json' }
+import zhCN from './i18n-core/locales/zh-CN.json' with { type: 'json' }
+import type { TranslationMap } from './i18n-core/types'
 
 interface RunOptions {
   model?: string
@@ -69,7 +69,10 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   // Detect locale and create translation function
   const locale = detectLocale({ lang: options.lang })
-  const localeBundles: Record<string, TranslationMap> = { 'en-US': enUS as TranslationMap, 'zh-CN': zhCN as TranslationMap }
+  const localeBundles: Record<string, TranslationMap> = {
+    'en-US': enUS as TranslationMap,
+    'zh-CN': zhCN as TranslationMap,
+  }
   const t = createT(localeBundles[locale] || enUS, enUS)
 
   // Bootstrap providers

package/src/mcp/client.ts

@@ -10,10 +10,10 @@ import { StdioTransport } from './transport'
 import { McpProtocol } from './protocol'
 import { OAuthClient } from './oauth'
 import { TokenStore } from './token-store'
-import { createT } from '@mipham/shared/i18n/t'
-import enUS from '@mipham/shared/i18n/locales/en-US.json'
-import zhCN from '@mipham/shared/i18n/locales/zh-CN.json'
-import type { TranslationMap } from '@mipham/shared/i18n/types'
+import { createT } from '../i18n-core/t'
+import enUS from '../i18n-core/locales/en-US.json'
+import zhCN from '../i18n-core/locales/zh-CN.json'
+import type { TranslationMap } from '../i18n-core/types'
 
 const bundles: Record<string, TranslationMap> = {
   'en-US': enUS as TranslationMap,

package/src/mcp/oauth.ts

@@ -4,10 +4,10 @@ import { createServer, Server } from 'node:http'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { McpServerConfig } from '../shared/types'
 import { TokenStore } from './token-store'
-import { createT } from '@mipham/shared/i18n/t'
-import enUS from '@mipham/shared/i18n/locales/en-US.json'
-import zhCN from '@mipham/shared/i18n/locales/zh-CN.json'
-import type { TranslationMap } from '@mipham/shared/i18n/types'
+import { createT } from '../i18n-core/t'
+import enUS from '../i18n-core/locales/en-US.json'
+import zhCN from '../i18n-core/locales/zh-CN.json'
+import type { TranslationMap } from '../i18n-core/types'
 
 const bundles: Record<string, TranslationMap> = {
   'en-US': enUS as TranslationMap,

package/src/mcp/registry.ts

@@ -9,10 +9,10 @@
 import type { ToolDefinition as McpToolDefinition, ToolCallResult } from './types'
 import type { ToolDefinition, ToolResult, ToolContext } from '../shared/types'
 import { McpClient } from './client'
-import { createT } from '@mipham/shared/i18n/t'
-import enUS from '@mipham/shared/i18n/locales/en-US.json'
-import zhCN from '@mipham/shared/i18n/locales/zh-CN.json'
-import type { TranslationMap } from '@mipham/shared/i18n/types'
+import { createT } from '../i18n-core/t'
+import enUS from '../i18n-core/locales/en-US.json'
+import zhCN from '../i18n-core/locales/zh-CN.json'
+import type { TranslationMap } from '../i18n-core/types'
 
 const bundles: Record<string, TranslationMap> = {
   'en-US': enUS as TranslationMap,
@@ -127,7 +127,11 @@ export function registerMcpServerTools(
       registered++
     } catch (err) {
       process.stderr.write(
-        t('errors.mcp_register_failed', { tool: mcpTool.name, server: serverName, error: String(err) }) + '\n',
+        t('errors.mcp_register_failed', {
+          tool: mcpTool.name,
+          server: serverName,
+          error: String(err),
+        }) + '\n',
       )
     }
   }

package/src/tools/index.ts

@@ -1,9 +1,9 @@
 import type { ToolDefinition, ToolResult } from '../shared/index.ts'
 import { sanitizeParams } from '../shared/sanitize'
-import { createT } from '@mipham/shared/i18n/t'
-import enUS from '@mipham/shared/i18n/locales/en-US.json'
-import zhCN from '@mipham/shared/i18n/locales/zh-CN.json'
-import type { TranslationMap } from '@mipham/shared/i18n/types'
+import { createT } from '../i18n-core/t'
+import enUS from '../i18n-core/locales/en-US.json'
+import zhCN from '../i18n-core/locales/zh-CN.json'
+import type { TranslationMap } from '../i18n-core/types'
 import { readTool } from './file/read'
 import { writeTool } from './file/write'
 import { editTool } from './file/edit'
@@ -110,7 +110,11 @@ function withValidation(tool: ToolDefinition): ToolDefinition {
       const cleanParams = sanitizeParams(params)
       const errors = validateParams(schema, cleanParams)
       if (errors.length > 0) {
-        return { success: false, content: '', error: t('errors.invalid_params', { errors: errors.join('; ') }) }
+        return {
+          success: false,
+          content: '',
+          error: t('errors.invalid_params', { errors: errors.join('; ') }),
+        }
       }
       return tool.execute(cleanParams, ctx)
     },

package/src/tools/network/web-fetch.ts

@@ -42,6 +42,21 @@ export const webFetchTool: ToolDefinition = {
           error: `HTTP ${response.status}: ${response.statusText}`,
         }
       }
+
+      // SSRF defense: re-validate the resolved URL after redirects.
+      // `redirect: 'follow'` may have landed on an internal IP — check again.
+      // Guard: response.url may not exist in some environments (e.g. mocked fetch).
+      if (response.url) {
+        const redirectError = validateUrl(response.url)
+        if (redirectError) {
+          return {
+            success: false,
+            content: '',
+            error: `Redirect blocked: ${redirectError}`,
+          }
+        }
+      }
+
       const html = await response.text()
       // Simple HTML-to-text extraction
       const text = html

package/src/ui/app.tsx

@@ -146,6 +146,15 @@ export function App({
   const [goalText, setGoalText] = useState('')
   const [permissionMode, setPermissionMode] = useState<PermissionMode>('default')
   const abortRef = useRef<AbortController | null>(null)
+  // Stream buffer: accumulate text chunks and throttle state updates to ~16fps.
+  // Without this, every SSE chunk triggers setMessages → copies full array →
+  // re-renders ChatPanel → re-runs compactToolGroups O(n). At 20-50 chunks/sec
+  // with 200+ messages, this saturates the event loop and freezes the UI.
+  const streamBufferRef = useRef<{
+    turnContent: string
+    isFirst: boolean
+    timer: ReturnType<typeof setTimeout> | null
+  }>({ turnContent: '', isFirst: true, timer: null })
   const [agentProgress, setAgentProgress] = useState<AgentProgress | null>(null)
   // Multi-agent tracking: keyed by agent/task ID, shows all running + recently completed agents
   const [runningAgents, setRunningAgents] = useState<Record<string, AgentEntry>>({})
@@ -364,6 +373,25 @@ export function App({
       let turnContent = ''
       let isNewTurn = true
 
+      // Flush any pending stream buffer to state
+      const flushStreamBuffer = () => {
+        if (streamBufferRef.current.timer) {
+          clearTimeout(streamBufferRef.current.timer)
+          streamBufferRef.current.timer = null
+        }
+        const latest = streamBufferRef.current.turnContent
+        if (latest && !streamBufferRef.current.isFirst) {
+          setMessages((prev) => {
+            const updated = [...prev]
+            const last = updated[updated.length - 1]
+            if (last?.role === 'assistant') {
+              last.content = latest
+            }
+            return updated
+          })
+        }
+      }
+
       try {
         for await (const chunk of engine.process(input, controller.signal)) {
           // Reasoning content (DeepSeek V4 thinking mode) — silently consumed,
@@ -373,21 +401,34 @@ export function App({
           }
 
           if (chunk.type === 'text' && chunk.content) {
-            // New turn: reset per-turn accumulator and push a fresh assistant message
+            // New turn: push fresh assistant message, reset stream buffer
             if (isNewTurn) {
               turnContent = chunk.content
               isNewTurn = false
-              setMessages((prev) => [...prev, { role: 'assistant', content: turnContent }])
+              streamBufferRef.current = { turnContent: chunk.content, isFirst: false, timer: null }
+              setMessages((prev) => [
+                ...prev,
+                { role: 'assistant' as const, content: chunk.content || '' },
+              ])
             } else {
               turnContent += chunk.content
-              setMessages((prev) => {
-                const updated = [...prev]
-                const last = updated[updated.length - 1]
-                if (last?.role === 'assistant') {
-                  last.content = turnContent
-                }
-                return updated
-              })
+              streamBufferRef.current.turnContent = turnContent
+              // Throttle: flush to state at most every 60ms (~16 fps for text).
+              // The ref holds the latest text; state update copies the ref value.
+              if (!streamBufferRef.current.timer) {
+                streamBufferRef.current.timer = setTimeout(() => {
+                  streamBufferRef.current.timer = null
+                  const latest = streamBufferRef.current.turnContent
+                  setMessages((prev) => {
+                    const updated = [...prev]
+                    const last = updated[updated.length - 1]
+                    if (last?.role === 'assistant') {
+                      last.content = latest
+                    }
+                    return updated
+                  })
+                }, 60)
+              }
             }
             assistantContent += chunk.content
           }
@@ -417,6 +458,8 @@ export function App({
                 toolMeta: { name: toolName, input: detail, collapsed: true },
               },
             ])
+            // Flush stream buffer before showing tool card
+            flushStreamBuffer()
             // Mark that next text chunk starts a new turn
             isNewTurn = true
           }
@@ -487,6 +530,8 @@ export function App({
       } catch (err) {
         setMessages((prev) => [...prev, { role: 'system', content: `Error: ${String(err)}` }])
       } finally {
+        // Flush any remaining stream buffer before finishing
+        flushStreamBuffer()
         setIsLoading(false)
         abortRef.current = null
         // Auto-save checkpoint after each AI response

package/src/ui/chat.tsx

@@ -1,4 +1,4 @@
-import React from 'react'
+import React, { useMemo } from 'react'
 import { Box, Text } from 'ink'
 import { useI18n } from '../i18n-context'
 import type { ChatMessage } from './app'
@@ -96,16 +96,22 @@ const MessageRow = React.memo(
 
 export function ChatPanel({ messages, focusMode }: ChatPanelProps) {
   const { t } = useI18n()
-  // Group consecutive tool calls into compact summaries to reduce visual noise.
-  // In focus mode, use the more aggressive compactForFocus.
-  const displayMessages = focusMode ? compactForFocus(messages) : compactToolGroups(messages)
+  // Memoize display message computation to avoid O(n) compact on every render.
+  // During streaming, messages changes on every chunk; without memoization,
+  // compactToolGroups/compactForFocus re-iterates the full message list on each
+  // chunk, saturating the event loop at 20-50 chunks/sec.
+  const displayMessages = useMemo(
+    () => (focusMode ? compactForFocus(messages) : compactToolGroups(messages)),
+    [messages, focusMode],
+  )
 
   return (
     <Box flexDirection="column" marginY={1} flexGrow={1}>
       {focusMode && messages.length > 0 && (
         <Box marginBottom={1}>
           <Text dimColor>
-            🔍 {t('ui.chat.focus_hint')} — {countHidden(messages, displayMessages, t)} · {t('ui.chat.toggle_focus_hint')} · {t('ui.chat.expand_hint')}
+            🔍 {t('ui.chat.focus_hint')} — {countHidden(messages, displayMessages, t)} ·{' '}
+            {t('ui.chat.toggle_focus_hint')} · {t('ui.chat.expand_hint')}
           </Text>
         </Box>
       )}
@@ -124,14 +130,10 @@ export function ChatPanel({ messages, focusMode }: ChatPanelProps) {
             </Text>
           </Box>
           <Box marginTop={1}>
-            <Text dimColor>
-              {t('ui.banner.controls_hint')}
-            </Text>
+            <Text dimColor>{t('ui.banner.controls_hint')}</Text>
           </Box>
           <Box marginTop={1}>
-            <Text dimColor>
-              {t('ui.banner.tip_clear')}
-            </Text>
+            <Text dimColor>{t('ui.banner.tip_clear')}</Text>
           </Box>
         </Box>
       )}
@@ -243,7 +245,11 @@ function summarizeToolGroup(tools: ChatMessage[]): ChatMessage {
 }
 
 /** Count how many messages are hidden in focus mode. */
-function countHidden(all: ChatMessage[], compacted: ChatMessage[], t: (key: string, params?: Record<string, string>) => string): string {
+function countHidden(
+  all: ChatMessage[],
+  compacted: ChatMessage[],
+  t: (key: string, params?: Record<string, string>) => string,
+): string {
   const toolCount = all.filter((m) => m.toolMeta).length
   const hidden = all.length - compacted.length
   if (hidden <= 0) return t('ui.chat.showing_all', { count: String(all.length) })

package/src/ui/command-picker.tsx

@@ -101,7 +101,9 @@ export function CommandPicker({
 
       {/* Command list */}
       <Box flexDirection="column" marginBottom={1}>
-        {visible.length === 0 && <Text dimColor> {t('ui.command_picker.no_matches', { filter })}</Text>}
+        {visible.length === 0 && (
+          <Text dimColor> {t('ui.command_picker.no_matches', { filter })}</Text>
+        )}
         {visible.map((cmd, i) => {
           const globalIdx = i + scrollStart
           const isCursor = globalIdx === cursorIdx

package/src/ui/commands.ts

@@ -13,10 +13,10 @@ import { McpClient } from '../mcp/client'
 import { NPM_UPDATE_COMMAND, PACKAGE_VERSION } from '../shared/index.ts'
 import { getPreference } from '../config/preferences'
 import { stripIndent } from './strip-indent.js'
-import { createT } from '@mipham/shared/i18n/t'
-import type { TranslationMap } from '@mipham/shared/i18n/types'
-import enUS from '@mipham/shared/i18n/locales/en-US.json' with { type: 'json' }
-import zhCN from '@mipham/shared/i18n/locales/zh-CN.json' with { type: 'json' }
+import { createT } from '../i18n-core/t'
+import type { TranslationMap } from '../i18n-core/types'
+import enUS from '../i18n-core/locales/en-US.json' with { type: 'json' }
+import zhCN from '../i18n-core/locales/zh-CN.json' with { type: 'json' }
 
 // Default t() fallback for plain-function contexts (tests, bootstrap).
 // When called from the React tree, ctx.t is populated from useI18n().
@@ -351,7 +351,9 @@ const modelsCmd: CommandHandler = (ctx) => {
 
 const providerCmd: CommandHandler = (ctx) => {
   const t = resolveT(ctx)
-  return { content: t('commands.provider.current', { provider: ctx.providerId, model: ctx.modelId }) }
+  return {
+    content: t('commands.provider.current', { provider: ctx.providerId, model: ctx.modelId }),
+  }
 }
 
 const providersCmd: CommandHandler = (ctx) => {
@@ -417,7 +419,9 @@ const toolsCmd: CommandHandler = (ctx) => {
     .filter(([, v]) => v!.length > 0)
     .map(([cat, items]) => `── ${cat.toUpperCase()} ──\n${items!.join('\n')}`)
 
-  return { content: `${t('commands.tools.title', { count: String(tools.size) })}\n\n${sections.join('\n\n')}` }
+  return {
+    content: `${t('commands.tools.title', { count: String(tools.size) })}\n\n${sections.join('\n\n')}`,
+  }
 }
 
 const skillsCmd: CommandHandler = (ctx) => {
@@ -548,10 +552,17 @@ const goalCmd: CommandHandler = (ctx, args) => {
     if (!state.goal) {
       return { content: t('commands.goal.usage') }
     }
-    const lines = [t('commands.goal.status_title'), '', t('commands.goal.status_goal', { goal: state.goal })]
-    if (state.verifyScript) lines.push(t('commands.goal.status_verify_script', { script: state.verifyScript }))
-    if (state.verifySkill) lines.push(t('commands.goal.status_verify_skill', { skill: state.verifySkill }))
-    if (state.decompose) lines.push(t('commands.goal.status_decompose', { count: String(state.subtasks.length) }))
+    const lines = [
+      t('commands.goal.status_title'),
+      '',
+      t('commands.goal.status_goal', { goal: state.goal }),
+    ]
+    if (state.verifyScript)
+      lines.push(t('commands.goal.status_verify_script', { script: state.verifyScript }))
+    if (state.verifySkill)
+      lines.push(t('commands.goal.status_verify_skill', { skill: state.verifySkill }))
+    if (state.decompose)
+      lines.push(t('commands.goal.status_decompose', { count: String(state.subtasks.length) }))
     lines.push('', t('commands.goal.status_clear_hint'))
     return { content: lines.join('\n') }
   }
@@ -670,10 +681,15 @@ const usageCmd: CommandHandler = (ctx) => {
   const apiTotal = summary.apiInputTokens + summary.apiOutputTokens
   const apiLine =
     summary.apiInputTokens > 0 || summary.apiOutputTokens > 0
-      ? t('commands.usage.api_tokens', { in: summary.apiInputTokens.toLocaleString(), out: summary.apiOutputTokens.toLocaleString(), total: apiTotal.toLocaleString() })
+      ? t('commands.usage.api_tokens', {
+          in: summary.apiInputTokens.toLocaleString(),
+          out: summary.apiOutputTokens.toLocaleString(),
+          total: apiTotal.toLocaleString(),
+        })
       : t('commands.usage.no_api')
 
-  const toolSection = toolLines.length > 0 ? `\n${t('commands.usage.tool_section')}\n${toolLines.join('\n')}` : ''
+  const toolSection =
+    toolLines.length > 0 ? `\n${t('commands.usage.tool_section')}\n${toolLines.join('\n')}` : ''
 
   return {
     content: stripIndent`
@@ -976,7 +992,11 @@ const rewindCmd: CommandHandler = (ctx) => {
   }
 
   return {
-    content: t('commands.rewind.confirmed', { label: result.label, count: String(result.messageCount), remaining: String(c.getCheckpoints().length) }),
+    content: t('commands.rewind.confirmed', {
+      label: result.label,
+      count: String(result.messageCount),
+      remaining: String(c.getCheckpoints().length),
+    }),
     clearMessages: true,
   }
 }
@@ -1164,7 +1184,11 @@ const branchCmd: CommandHandler = (ctx, args) => {
 
   const checkpointId = c.saveCheckpoint(name)
   return {
-    content: t('commands.branch.details', { name, checkpoint: String(checkpointId), messages: String(msgs.length) }),
+    content: t('commands.branch.details', {
+      name,
+      checkpoint: String(checkpointId),
+      messages: String(msgs.length),
+    }),
   }
 }
 
@@ -1575,9 +1599,7 @@ const lintCmd: CommandHandler = async (ctx) => {
         '',
         truncated || '(no issues found)',
         '',
-        hasPackageJson
-          ? t('commands.lint.fix_hint')
-          : t('commands.lint.setup_hint'),
+        hasPackageJson ? t('commands.lint.fix_hint') : t('commands.lint.setup_hint'),
       ].join('\n'),
     }
   } catch {
@@ -1618,7 +1640,9 @@ const filesCmd: CommandHandler = async (ctx) => {
         t('commands.files.cwd', { path: cwd }),
         '',
         ...items,
-        entries.length > 40 ? t('commands.files.more_files', { count: String(entries.length - 40) }) : '',
+        entries.length > 40
+          ? t('commands.files.more_files', { count: String(entries.length - 40) })
+          : '',
         '',
         t('commands.files.hint'),
       ].join('\n'),
@@ -1643,7 +1667,12 @@ const statsCmd: CommandHandler = (ctx) => {
     content: [
       t('commands.stats.title'),
       '',
-      t('commands.stats.messages', { total: String(msgs.length), user: String(userMsgs), assistant: String(assistantMsgs), system: String(systemMsgs) }),
+      t('commands.stats.messages', {
+        total: String(msgs.length),
+        user: String(userMsgs),
+        assistant: String(assistantMsgs),
+        system: String(systemMsgs),
+      }),
       t('commands.stats.tokens', { tokens: tokens.toLocaleString() }),
       t('commands.stats.tools', { count: String(tools.size) }),
       t('commands.stats.provider', { provider: ctx.providerId }),
@@ -1738,7 +1767,12 @@ const hooksCmd: CommandHandler = async (ctx) => {
 
   try {
     const files = readdirSync(hooksDir).filter((f) => f.endsWith('.sh'))
-    const lines: string[] = [t('commands.hooks.title'), '', t('commands.hooks.location', { path: hooksDir }), '']
+    const lines: string[] = [
+      t('commands.hooks.title'),
+      '',
+      t('commands.hooks.location', { path: hooksDir }),
+      '',
+    ]
 
     for (const f of files) {
       try {
@@ -1801,7 +1835,11 @@ const exportCmd: CommandHandler = async (ctx) => {
 
   writeFileSync(filepath, lines.join('\n'), 'utf-8')
   return {
-    content: t('commands.export.confirmed', { path: filepath, count: String(msgs.length), lines: String(lines.length) }),
+    content: t('commands.export.confirmed', {
+      path: filepath,
+      count: String(msgs.length),
+      lines: String(lines.length),
+    }),
     copyContent: filepath,
   }
 }
@@ -1886,7 +1924,9 @@ const resumeLastCmd: CommandHandler = async (ctx) => {
 
   const latest = SessionStore.getLatest()
   if (!latest) {
-    return { content: `${t('commands.resume.restored')}\n\n${t('commands.resume.no_sessions')}\n\n${t('commands.resume.empty_footer')}` }
+    return {
+      content: `${t('commands.resume.restored')}\n\n${t('commands.resume.no_sessions')}\n\n${t('commands.resume.empty_footer')}`,
+    }
   }
 
   const session = SessionStore.load(latest.name)
@@ -1907,10 +1947,20 @@ const resumeLastCmd: CommandHandler = async (ctx) => {
     content: [
       t('commands.resume.restored'),
       '',
-      t('commands.resume.restored_content', { name: latest.name, total: String(session.messages.length), truncated: truncatedStr, provider: latest.provider, model: latest.model, date }),
+      t('commands.resume.restored_content', {
+        name: latest.name,
+        total: String(session.messages.length),
+        truncated: truncatedStr,
+        provider: latest.provider,
+        model: latest.model,
+        date,
+      }),
       '',
       truncated
-        ? t('commands.resume.restored_footer', { loaded: String(messages.length), total: String(session.messages.length) })
+        ? t('commands.resume.restored_footer', {
+            loaded: String(messages.length),
+            total: String(session.messages.length),
+          })
         : t('commands.resume.restored_full_footer', { loaded: String(messages.length) }),
     ].join('\n'),
     forwardedMessages: messages,
@@ -1954,13 +2004,17 @@ const resumeCmd: CommandHandler = async (ctx, args) => {
         content: `${t('commands.resume.found_title')}\n\n${t('commands.resume.found_content', { name: session.metadata.name, messages: String(session.metadata.messageCount), provider: session.metadata.provider, model: session.metadata.model, updated: session.metadata.updatedAt, target: targetName })}`,
       }
     }
-    return { content: `${t('commands.resume.not_found_title')}\n\n${t('commands.resume.not_found_content', { name: targetName })}` }
+    return {
+      content: `${t('commands.resume.not_found_title')}\n\n${t('commands.resume.not_found_content', { name: targetName })}`,
+    }
   }
 
   const sessions = SessionStore.list()
 
   if (sessions.length === 0) {
-    return { content: `${t('commands.resume.restored')}\n\n${t('commands.resume.no_sessions')}\n\n${t('commands.resume.empty_footer')}` }
+    return {
+      content: `${t('commands.resume.restored')}\n\n${t('commands.resume.no_sessions')}\n\n${t('commands.resume.empty_footer')}`,
+    }
   }
 
   const recent = sessions.slice(0, 10)
@@ -2029,7 +2083,10 @@ const memoryCmd: CommandHandler = async (ctx) => {
       t('commands.memories.title'),
       '',
       t('commands.memories.location', { path: memoryDir }),
-      t('commands.memories.total', { count: String(memories.length), plural: memories.length === 1 ? 'y' : 'ies' }),
+      t('commands.memories.total', {
+        count: String(memories.length),
+        plural: memories.length === 1 ? 'y' : 'ies',
+      }),
       '',
       ...memories.map(
         (m, i) =>
@@ -2095,7 +2152,9 @@ const upgradeCmd: CommandHandler = async (ctx) => {
     lines.push(t('commands.upgrade.old_version_warning'))
   } else {
     lines.push('')
-    lines.push(t('commands.upgrade.update_failed', { command: NPM_UPDATE_COMMAND, path: backupPath || '' }))
+    lines.push(
+      t('commands.upgrade.update_failed', { command: NPM_UPDATE_COMMAND, path: backupPath || '' }),
+    )
   }
 
   return { content: lines.join('\n') }
@@ -2862,16 +2921,15 @@ const forkCmd: CommandHandler = async (ctx, args) => {
 }
 
 async function openBrowser(url: string): Promise<void> {
-  const cmd =
+  const { spawn } = await import('node:child_process')
+  // Use spawn with array args — no shell, no command injection
+  const [cmd, ...args] =
     process.platform === 'darwin'
-      ? `open "${url}"`
+      ? ['open', url]
       : process.platform === 'win32'
-        ? `start "" "${url}"`
-        : `xdg-open "${url}"`
-  const { exec } = await import('node:child_process')
-  exec(cmd, () => {
-    /* fire-and-forget */
-  })
+        ? ['cmd', '/c', 'start', '', url]
+        : ['xdg-open', url]
+  spawn(cmd!, args, { detached: true, stdio: 'ignore' }).unref()
 }
 
 const artifactOpenCmd: CommandHandler = async (ctx, args) => {

package/src/ui/picker.tsx

@@ -152,7 +152,9 @@ export function ModelPicker({
                   {isCurrent ? '✓' : ' '}
                   {p.name.padEnd(16)}
                 </Text>
-                <Text dimColor>{isUpcoming ? t('ui.picker.coming_soon') : `${activeModels(p).length}m`}</Text>
+                <Text dimColor>
+                  {isUpcoming ? t('ui.picker.coming_soon') : `${activeModels(p).length}m`}
+                </Text>
               </Box>
             )
           })}