@miphamai/cli 0.20.1 → 0.20.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.20.1",
+  "version": "0.20.3",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent/sub-agent.ts

@@ -271,8 +271,10 @@ export class SubAgent {
             continue
           }
 
-          // Security: check permission before executing
-          // Sub-agents run without user interaction — tools requiring approval are rejected
+          // Security: check permission before executing.
+          // Sub-agents run without user interaction — tools requiring approval are rejected.
+          // When permission system is absent (undefined), allow all tools (backward compat
+          // for tests and headless usage). When present, always enforce approval checks.
           if (this.permission?.needsApproval(tool, tu.input)) {
             currentMessages.push({
               role: 'user' as const,

package/src/core/engine.ts

@@ -561,11 +561,14 @@ export class QueryEngine {
   private async runScriptVerification(): Promise<boolean> {
     if (!this.goalVerifyScript) return false
     try {
-      const { execSync } = await import('node:child_process')
-      execSync(this.goalVerifyScript, { timeout: 30000, stdio: 'pipe' })
-      return true // exit code 0 = success
+      const { spawnSync } = await import('node:child_process')
+      const { resolveSafe } = await import('../security/path')
+      // Validate the script path is within the workspace before execution
+      const safePath = resolveSafe(process.cwd(), this.goalVerifyScript)
+      const result = spawnSync(safePath, [], { timeout: 30000, stdio: 'pipe' })
+      return result.status === 0 // exit code 0 = success
     } catch {
-      return false // non-zero exit = not yet achieved
+      return false // non-zero exit or path rejection = not yet achieved
     }
   }
 
@@ -797,7 +800,11 @@ export class QueryEngine {
 
       return result
     } catch (err) {
-      return { success: false, content: '', error: String(err) }
+      // Sanitize error: strip stack traces and internal paths to prevent
+      // information disclosure to the LLM conversation context.
+      const message =
+        err instanceof Error ? err.message : String(err).split('\n')[0] || 'Unknown error'
+      return { success: false, content: '', error: `Tool execution failed: ${message}` }
     }
   }
 

package/src/core/hooks-executor.ts

@@ -1,4 +1,4 @@
-import { execSync } from 'node:child_process'
+import { spawnSync } from 'node:child_process'
 import type { HookConfig, HookContext, HookResult } from '../shared/index.ts'
 
 /**
@@ -36,21 +36,22 @@ function executeCommand(cfg: HookConfig, ctx: HookContext): HookResult {
   try {
     const args = cfg.args ? cfg.args.map((a) => substituteVars(a, ctx)) : []
 
-    const cmd = [cfg.command, ...args].join(' ')
-
-    execSync(cmd, {
+    // Use spawnSync with array args — no shell, no command injection
+    const result = spawnSync(cfg.command, args, {
       timeout: 30_000,
       encoding: 'utf-8',
       stdio: ['ignore', 'pipe', 'pipe'],
     })
 
     // Exit code 0 = success, allow
-    return { allowed: true }
-  } catch (err) {
-    const stderr = (err as { stderr?: string }).stderr || String(err)
+    if (result.status === 0) {
+      return { allowed: true }
+    }
+
+    // Non-zero exit: check for block signal (exit code 2)
+    const stderr = result.stderr?.toString() || ''
 
-    // Exit code 2 = block with reason
-    if ((err as { status?: number }).status === 2) {
+    if (result.status === 2) {
       return {
         allowed: false,
         reason: stderr.trim() || 'Blocked by hook',
@@ -63,6 +64,15 @@ function executeCommand(cfg: HookConfig, ctx: HookContext): HookResult {
       allowed: true,
       additionalContext: `Hook warning (${cfg.command}): ${stderr.trim()}`,
     }
+  } catch (err) {
+    // spawnSync errors (e.g., command not found, timeout, signal)
+    const message = (err as { message?: string }).message || String(err)
+
+    // Timeout/signal: treat as non-blocking warning
+    return {
+      allowed: true,
+      additionalContext: `Hook error (${cfg.command}): ${message}`,
+    }
   }
 }
 

package/src/tools/network/web-fetch.ts

@@ -42,6 +42,21 @@ export const webFetchTool: ToolDefinition = {
           error: `HTTP ${response.status}: ${response.statusText}`,
         }
       }
+
+      // SSRF defense: re-validate the resolved URL after redirects.
+      // `redirect: 'follow'` may have landed on an internal IP — check again.
+      // Guard: response.url may not exist in some environments (e.g. mocked fetch).
+      if (response.url) {
+        const redirectError = validateUrl(response.url)
+        if (redirectError) {
+          return {
+            success: false,
+            content: '',
+            error: `Redirect blocked: ${redirectError}`,
+          }
+        }
+      }
+
       const html = await response.text()
       // Simple HTML-to-text extraction
       const text = html

package/src/ui/commands.ts

@@ -2921,16 +2921,15 @@ const forkCmd: CommandHandler = async (ctx, args) => {
 }
 
 async function openBrowser(url: string): Promise<void> {
-  const cmd =
+  const { spawn } = await import('node:child_process')
+  // Use spawn with array args — no shell, no command injection
+  const [cmd, ...args] =
     process.platform === 'darwin'
-      ? `open "${url}"`
+      ? ['open', url]
       : process.platform === 'win32'
-        ? `start "" "${url}"`
-        : `xdg-open "${url}"`
-  const { exec } = await import('node:child_process')
-  exec(cmd, () => {
-    /* fire-and-forget */
-  })
+        ? ['cmd', '/c', 'start', '', url]
+        : ['xdg-open', url]
+  spawn(cmd!, args, { detached: true, stdio: 'ignore' }).unref()
 }
 
 const artifactOpenCmd: CommandHandler = async (ctx, args) => {