@miphamai/cli 0.21.0 → 0.23.0

package/src/core/engine.ts

@@ -18,6 +18,8 @@ import { getBackgroundAgentRegistry } from '../agent/background-registry'
 import { RulesLoader } from './rules-loader'
 import { UsageTracker } from './usage-tracker'
 import { buildRequest, sendInferenceCheck, isInferenceHookEnabled } from './inference-hook'
+import { getFileInboxTransport } from '../agent/cross-session/file-inbox'
+import { getMessageBus } from '../agent/message-bus'
 import { createT } from '../i18n-core/t'
 import enUS from '../i18n-core/locales/en-US.json'
 import zhCN from '../i18n-core/locales/zh-CN.json'
@@ -54,6 +56,36 @@ export class QueryEngine {
     private permission: PermissionSystem = new PermissionSystem('default'),
   ) {}
 
+  /** Session identifier for cross-session messaging. Set by the app startup via setSessionId(). */
+  private sessionId: string = 'session-1'
+
+  /** Set the session identifier (called from index.tsx at startup with the actual session name). */
+  setSessionId(id: string): void {
+    this.sessionId = id
+  }
+
+  /** Get the current session identifier. */
+  getSessionId(): string {
+    return this.sessionId
+  }
+
+  /** Poll the cross-session file inbox for messages addressed to this session. */
+  async pollCrossSessionInbox(): Promise<void> {
+    try {
+      const transport = getFileInboxTransport()
+      const messages = await transport.poll(this.sessionId)
+      if (messages.length > 0) {
+        const bus = getMessageBus()
+        for (const msg of messages) {
+          bus.post(msg.from, msg.to, msg.summary, msg.message, msg.type)
+        }
+      }
+    } catch (err) {
+      // Best-effort: don't let a failed inbox poll break the turn
+      console.warn('Cross-session inbox poll failed:', err)
+    }
+  }
+
   /** Register a hook engine for pre/post tool-use lifecycle events. */
   setHookEngine(hooks: HookEngine): void {
     this.hookEngine = hooks
@@ -255,9 +287,12 @@ export class QueryEngine {
   }
 
   async *process(userInput: string, signal?: AbortSignal): AsyncGenerator<StreamChunk> {
+    // Poll for cross-session messages before each turn
+    await this.pollCrossSessionInbox()
+
     // Fire UserPromptSubmit hooks before processing
     if (this.hookEngine) {
-      const submitResult = await this.hookEngine.executeUserPromptSubmit(userInput, 'session-1')
+      const submitResult = await this.hookEngine.executeUserPromptSubmit(userInput, this.sessionId)
       if (submitResult.additionalContext) {
         this.context.addMessage({
           role: 'user',
@@ -292,7 +327,7 @@ export class QueryEngine {
       const model = this.registry.getActiveModel()
       const request = buildRequest(
         messages,
-        'session-1',
+        this.sessionId,
         provider,
         model,
         hookConfig.organization_id,
@@ -587,7 +622,7 @@ export class QueryEngine {
         const model = this.registry.getActiveModel()
         const request = buildRequest(
           messages,
-          'session-1',
+          this.sessionId,
           provider,
           model,
           hookConfig.organization_id,
@@ -762,7 +797,7 @@ export class QueryEngine {
     // Run PreToolUse hooks
     let effectiveParams = params
     if (this.hookEngine) {
-      const preResult = await this.hookEngine.executePreToolUse(name, params, 'session-1')
+      const preResult = await this.hookEngine.executePreToolUse(name, params, this.sessionId)
       if (!preResult.allowed) {
         return {
           success: false,
@@ -778,7 +813,7 @@ export class QueryEngine {
     try {
       const result = await tool.execute(effectiveParams, {
         cwd: process.cwd(),
-        sessionId: 'session-1',
+        sessionId: this.sessionId,
         provider: this.registry.getActive().config.id,
         model: this.registry.getActiveModel(),
         skillsLoader: this.skillsLoader,
@@ -795,7 +830,7 @@ export class QueryEngine {
 
       // Run PostToolUse hooks
       if (this.hookEngine) {
-        await this.hookEngine.executePostToolUse(name, effectiveParams, result, 'session-1')
+        await this.hookEngine.executePostToolUse(name, effectiveParams, result, this.sessionId)
       }
 
       return result
@@ -867,7 +902,7 @@ export class QueryEngine {
   /** Wrap context compaction with PreCompact/PostCompact hooks. */
   private async compactWithHooks(heading: string): Promise<void> {
     if (this.hookEngine) {
-      const preResult = await this.hookEngine.executePreCompact('session-1')
+      const preResult = await this.hookEngine.executePreCompact(this.sessionId)
       if (preResult.additionalContext) {
         this.context.addMessage({
           role: 'user',
@@ -879,7 +914,7 @@ export class QueryEngine {
     await this.context.compact(heading)
 
     if (this.hookEngine) {
-      const postResult = await this.hookEngine.executePostCompact('session-1')
+      const postResult = await this.hookEngine.executePostCompact(this.sessionId)
       if (postResult.additionalContext) {
         this.context.addMessage({
           role: 'user',
@@ -893,7 +928,7 @@ export class QueryEngine {
   private async *checkStopHook(signal?: AbortSignal): AsyncGenerator<StreamChunk> {
     if (!this.hookEngine) return
 
-    const stopResult = await this.hookEngine.executeStop('session-1')
+    const stopResult = await this.hookEngine.executeStop(this.sessionId)
     if (stopResult.decision === 'block') {
       // Feed the block reason back to the AI and continue
       this.context.addMessage({

package/src/core/session-store.ts

@@ -9,6 +9,7 @@ import {
   statSync,
 } from 'node:fs'
 import { join } from 'node:path'
+import { createHash } from 'node:crypto'
 import type { Message } from '../shared/types'
 
 export interface SessionMetadata {
@@ -50,7 +51,15 @@ function ensureDir(): void {
 
 function filePath(name: string): string {
   // Sanitize name for filesystem
-  const safe = name.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 100)
+  const safe = name.replace(/[^a-zA-Z0-9_-]/g, '_')
+
+  // For very long names (>100 chars), use SHA-256 hash suffix to prevent collision
+  if (safe.length > 100) {
+    const hash = createHash('sha256').update(safe).digest('hex').slice(0, 16)
+    const truncated = safe.slice(0, 80)
+    return join(SESSIONS_DIR, `${truncated}-${hash}.jsonl`)
+  }
+
   return join(SESSIONS_DIR, `${safe}.jsonl`)
 }
 
@@ -233,7 +242,11 @@ export class SessionStore {
     ensureDir()
     mkdirSync(SUMMARIES_DIR, { recursive: true })
 
-    const safe = name.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 100)
+    const safeRaw = name.replace(/[^a-zA-Z0-9_-]/g, '_')
+    const safe =
+      safeRaw.length > 100
+        ? `${safeRaw.slice(0, 80)}-${createHash('sha256').update(safeRaw).digest('hex').slice(0, 16)}`
+        : safeRaw
     const summaryPath = join(SUMMARIES_DIR, `${safe}.md`)
     writeFileSync(summaryPath, `# ${name}\n\n${summary}\n\nTags: ${tags.join(', ')}\n`, 'utf-8')
 

package/src/index.tsx

@@ -3,7 +3,18 @@ import { join } from 'node:path'
 import { existsSync } from 'node:fs'
 import { render } from 'ink'
 import { App } from './ui/app'
-import { loadConfig, loadInferenceHookConfig, loadCredentialMaskingConfig } from './config/loader'
+import {
+  loadConfig,
+  loadInferenceHookConfig,
+  loadCredentialMaskingConfig,
+  loadCrossSessionConfig,
+} from './config/loader'
+import {
+  registerActiveSession,
+  heartbeatSession,
+  unregisterSession,
+  createSessionInfo,
+} from './agent/cross-session/discovery'
 import { bootstrapProviders } from './providers/bootstrap'
 import { InstructionsLoader } from './core/instructions'
 import { loadSessionMemories, getMemoryManager } from './core/memory/memory-loader'
@@ -246,6 +257,10 @@ export async function runApp(options: RunOptions): Promise<void> {
   const inferenceHookConfig = loadInferenceHookConfig()
   engine.setInferenceHookConfig(inferenceHookConfig)
 
+  // Initialize credential masking pipeline (strategies: Full, Extract, JWT)
+  const { initializePipeline } = await import('./core/credential-masker/index')
+  initializePipeline()
+
   // Wire credential masking configuration into tools
   const credentialMaskingConfig = loadCredentialMaskingConfig()
   const { setCredentialMaskingConfigForRead } = await import('./tools/file/read')
@@ -280,10 +295,36 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   engine.setupContextSummarizer()
 
+  // ── Cross-session messaging: register session, heartbeat, shutdown ──
+  engine.setSessionId(sessionName)
+  const sessionInfo = createSessionInfo(
+    sessionName,
+    sessionName,
+    process.cwd(),
+    defaultProvider,
+    defaultModel,
+  )
+  registerActiveSession(sessionInfo)
+
+  // 30-second heartbeat to keep the session file mtime fresh
+  const heartbeatInterval = setInterval(() => {
+    heartbeatSession(sessionName)
+  }, 30_000)
+
+  // Allow heartbeat to not keep the process alive
+  if (heartbeatInterval.unref) {
+    heartbeatInterval.unref()
+  }
+
+  // Load cross-session config (available for MessageRouter and future consumers)
+  loadCrossSessionConfig()
+
   // Auto-save session on exit
   let saved = false
   const saveAndExit = () => {
     saved = true
+    clearInterval(heartbeatInterval)
+    unregisterSession(sessionName)
     artifactServer.stop()
     if (context.getMessageCount() > 0) {
       SessionStore.save(sessionName, context.getMessages(), {
@@ -300,6 +341,8 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   // Safety net: auto-save on exit for paths that bypass saveAndExit
   process.on('exit', () => {
+    clearInterval(heartbeatInterval)
+    unregisterSession(sessionName)
     if (!saved && context.getMessageCount() > 0) {
       SessionStore.autoSave(context.getMessages(), {
         provider: defaultProvider,

package/src/shared/sanitize.ts

@@ -3,7 +3,7 @@
  * Strips invisible/control characters that could hide command content
  * from visual inspection or enable homoglyph attacks.
  *
- * Claude Code v2.1.223 parity: hidden command text via tabs/invisible Unicode.
+ * Protects against hidden command text via tabs/invisible Unicode characters.
  */
 
 const DANGEROUS_UNICODE = /[​‌‍‎‏‪‫‬‭‮⁠⁦⁧⁨⁩]/g

package/src/shared/types.ts

@@ -375,17 +375,44 @@ export interface CredentialFullMaskRule {
   mode: 'full'
 }
 
+/** Per-extract-pattern configuration with optional field-based extraction. */
+export interface CredentialExtractPattern {
+  /** Regex pattern to match. When `field` is set, applied to field value only. */
+  pattern: string
+  /** Optional replacement string. Defaults to CREDENTIAL_SENTINEL. */
+  replacement?: string
+  /** 🆕 JSON key to extract before applying pattern. If unset, pattern runs against full content. */
+  field?: string
+}
+
 /** Extract-based masking rule: only regex-matched tokens are replaced. */
 export interface CredentialExtractRule {
   path: string
   mode: 'extract'
-  extract: Array<{
-    pattern: string
-    replacement?: string
-  }>
+  extract: CredentialExtractPattern[]
+  /** 🆕 Behavior when no extract pattern matches: 'mask' (replace all) or 'passthrough' (keep). Default: 'mask'. */
+  onExtractNoMatch?: 'mask' | 'passthrough'
+}
+
+/** 🆕 JWT-aware masking rule: decode payload and mask specified claims. */
+export interface JwtMaskingRule {
+  path: string
+  type: 'jwt'
+  decode: 'jwt'
+  /** Claim names to mask in the JWT payload (e.g. ["sub", "email"]). */
+  maskClaims: string[]
 }
 
-export type CredentialFileRule = CredentialFullMaskRule | CredentialExtractRule
+/** 🆕 AWS credential pair masking rule: detect key pairs and optionally re-sign. */
+export interface AwsMaskingRule {
+  path: string
+  type: 'aws'
+  awsPairs: boolean
+  sigv4: boolean
+}
+
+export type CredentialFileRule =
+  CredentialFullMaskRule | CredentialExtractRule | JwtMaskingRule | AwsMaskingRule
 
 /** Configuration for credential masking, loaded from config.yml. */
 export interface CredentialMaskingConfig {
@@ -401,6 +428,29 @@ export interface CredentialMaskingConfig {
   }
 }
 
+// ── Cross-Session Messaging Types ──
+
+/** Controls how inbound cross-session messages are handled. */
+export type CrossSessionInbound = 'allow' | 'ask' | 'deny'
+
+/** 🆕 Configuration for cross-session messaging. */
+export interface CrossSessionConfig {
+  crossSessionInbound: CrossSessionInbound
+  dialogExpiry: number // seconds
+}
+
+/** Session information exposed via ListAgents. */
+export interface SessionInfo {
+  id: string
+  name: string
+  machine: string
+  pid: number
+  startedAt: string
+  cwd?: string
+  provider?: string
+  model?: string
+}
+
 // ── Background Agent Types ──
 
 export interface BackgroundAgentConfig {

package/src/tools/agent/list-agents.ts

@@ -0,0 +1,67 @@
+import type { ToolDefinition } from '../../shared/index.ts'
+import { discoverSessions } from '../../agent/cross-session/discovery'
+
+export const listAgentsTool: ToolDefinition = {
+  name: 'ListAgents',
+  description:
+    'Discover active Mipham Code sessions running on this machine. ' +
+    'Returns session ID, name, machine, working directory, provider, and model for each session. ' +
+    'Use with SendMessage to communicate across sessions.',
+  category: 'agent',
+  permission: 'auto',
+  parameters: {
+    type: 'object',
+    properties: {
+      scope: {
+        type: 'string',
+        enum: ['local', 'all'],
+        default: 'local',
+        description:
+          'Discovery scope. "local" scans this machine only. "all" is reserved for future network discovery.',
+      },
+    },
+  },
+  async execute(params) {
+    const scope = (params.scope as string) || 'local'
+
+    if (scope === 'all') {
+      return {
+        success: true,
+        content:
+          'Network discovery is not yet available. Showing local sessions only.\n\n' +
+          formatSessionList(discoverSessions()),
+      }
+    }
+
+    const sessions = discoverSessions()
+
+    if (sessions.length === 0) {
+      return {
+        success: true,
+        content: 'No active Mipham Code sessions found on this machine.',
+      }
+    }
+
+    return {
+      success: true,
+      content: formatSessionList(sessions),
+    }
+  },
+}
+
+function formatSessionList(sessions: import('../../shared/types').SessionInfo[]): string {
+  const lines: string[] = [`${sessions.length} active session(s):\n`]
+
+  for (const s of sessions) {
+    const modelInfo = s.model ? ` · ${s.model}` : ''
+    const providerInfo = s.provider ? ` (${s.provider})` : ''
+    lines.push(`  ${s.id}`)
+    lines.push(`    Name:    ${s.name}`)
+    lines.push(`    Machine: ${s.machine}${modelInfo}${providerInfo}`)
+    lines.push(`    PID:     ${s.pid} · Started: ${s.startedAt}`)
+    if (s.cwd) lines.push(`    CWD:     ${s.cwd}`)
+    lines.push('')
+  }
+
+  return lines.join('\n').trim()
+}

package/src/tools/agent/send-message.ts

@@ -1,13 +1,12 @@
 import type { ToolDefinition } from '../../shared/index.ts'
-import { getMessageBus } from '../../agent/message-bus'
+import { getMessageRouter } from '../../agent/message-router'
 
 export const sendMessageTool: ToolDefinition = {
   name: 'SendMessage',
   description:
-    'Send a message to another agent or the main conversation. ' +
-    'Use "main" as the recipient to message the parent session, ' +
-    'or a background task ID (e.g., "bg-1-xxx") to message a specific agent. ' +
-    'Messages are stored in the AgentMessageBus and can be polled by the recipient.',
+    'Send a message to another agent or session. ' +
+    'Use "main" for the parent conversation, a background task ID for same-process agents, ' +
+    'or a session ID for cross-session messaging (use ListAgents to discover sessions).',
   category: 'agent',
   permission: 'auto',
   parameters: {
@@ -16,7 +15,7 @@ export const sendMessageTool: ToolDefinition = {
       to: {
         type: 'string',
         description:
-          'Recipient: "main" for the parent conversation, a background task ID, or an agent name.',
+          'Recipient: "main" for the parent conversation, a background task ID, or a session ID for cross-session messaging.',
       },
       summary: {
         type: 'string',
@@ -34,34 +33,32 @@ export const sendMessageTool: ToolDefinition = {
     const summary = (params.summary as string) || '(no subject)'
     const message = params.message as string
 
-    // Determine sender: use sessionId or 'main'
     const from =
       ctx.sessionId === 'sub-agent'
         ? `sub-agent-${Date.now().toString(36)}`
         : ctx.sessionId || 'main'
 
-    try {
-      const bus = getMessageBus()
-      const msgId = bus.post(from, to, summary, message)
+    const router = getMessageRouter()
+    const result = await router.route(from, to, summary, message)
 
-      const unreadForRecipient = bus.unreadCount(to)
-
-      return {
-        success: true,
-        content:
-          `── Message Sent ──\n\n` +
-          `ID:      ${msgId}\n` +
-          `From:    ${from}\n` +
-          `To:      ${to}\n` +
-          `Summary: ${summary.slice(0, 100)}\n\n` +
-          `The recipient has ${unreadForRecipient} unread message(s).`,
-      }
-    } catch (err) {
+    if (!result.success) {
       return {
         success: false,
         content: '',
-        error: `Failed to send message: ${String(err)}`,
+        error: `Failed to send message: ${result.error}`,
       }
     }
+
+    const routedLabel = result.routedTo === 'bus' ? 'in-process' : 'cross-session'
+
+    return {
+      success: true,
+      content:
+        `── Message Sent (${routedLabel}) ──\n\n` +
+        `ID:      ${result.messageId}\n` +
+        `From:    ${from}\n` +
+        `To:      ${to}\n` +
+        `Summary: ${summary.slice(0, 100)}`,
+    }
   },
 }

package/src/tools/exec/bash.ts

@@ -122,6 +122,57 @@ function isBlocked(command: string): string | null {
   return null // safe
 }
 
+/**
+ * Detect sandbox violations from stderr output.
+ * Parses common OS-level error patterns indicating denied access.
+ */
+export function detectViolations(stderr: string): string[] {
+  const violations: string[] = []
+
+  // File access violations
+  const accessPatterns = /(?:Permission denied|EACCES|EPERM|Operation not permitted)/gi
+  const accessMatches = stderr.match(accessPatterns)
+  if (accessMatches && accessMatches.length > 0) {
+    // Extract file paths from error messages
+    const pathPattern =
+      /(?:Permission denied|EACCES|EPERM|Operation not permitted).*?['"]?(\/[^\s'"]+)['"]?/gi
+    const paths: string[] = []
+    let match: RegExpExecArray | null
+    while ((match = pathPattern.exec(stderr)) !== null) {
+      paths.push(match[1]!)
+    }
+
+    if (paths.length > 0) {
+      violations.push(`  File access denied: ${paths.join(', ')}`)
+    } else {
+      violations.push(`  File access denied (${accessMatches.length} occurrence(s))`)
+    }
+  }
+
+  // Network access violations
+  const netPatterns =
+    /(?:Network is unreachable|Connection refused|ECONNREFUSED|ENETUNREACH|Could not resolve host|Name or service not known|ETIMEDOUT|Connection timed out)/gi
+  const netMatches = stderr.match(netPatterns)
+  if (netMatches && netMatches.length > 0) {
+    // Extract host:port from error messages
+    const hostPattern =
+      /(?:connect to|Could not resolve host|Failed to connect to)\s+([^\s:]+(?::\d+)?)/gi
+    const hosts: string[] = []
+    let match: RegExpExecArray | null
+    while ((match = hostPattern.exec(stderr)) !== null) {
+      hosts.push(match[1]!)
+    }
+
+    if (hosts.length > 0) {
+      violations.push(`  Network access denied: ${hosts.join(', ')}`)
+    } else {
+      violations.push(`  Network access denied (${netMatches.length} occurrence(s))`)
+    }
+  }
+
+  return violations
+}
+
 export const bashTool: ToolDefinition = {
   name: 'Bash',
   description:
@@ -173,6 +224,9 @@ export const bashTool: ToolDefinition = {
       const exitCode = await proc.exited
       clearTimeout(timer)
 
+      // Read stderr for violation detection and error reporting
+      const rawStderr = await new Response(proc.stderr).text()
+
       // ── Credential masking: scrub output ──
       let output = rawOutput
       if (credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled) {
@@ -180,20 +234,30 @@ export const bashTool: ToolDefinition = {
         output = maskOutput(rawOutput, credentialConfig)
       }
 
+      // ── Sandbox violation detection ──
+      const violations = detectViolations(rawStderr)
+
       if (exitCode !== 0) {
-        const rawStderr = await new Response(proc.stderr).text()
         const stderr =
           credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled
             ? (await import('../../core/credential-masker')).maskOutput(rawStderr, credentialConfig)
             : rawStderr
+        let errorContent = output.slice(0, 5_000)
+        if (violations.length > 0) {
+          errorContent += '\n\n── Sandbox Violations ──\n' + violations.join('\n')
+        }
         return {
           success: false,
-          content: output.slice(0, 5_000),
+          content: errorContent,
           error: `Exit code ${exitCode}: ${stderr.slice(0, 1_000)}`,
         }
       }
 
-      return { success: true, content: output.slice(0, 100_000) || '(no output)' }
+      let successContent = output.slice(0, 100_000) || '(no output)'
+      if (violations.length > 0) {
+        successContent += '\n\n── Sandbox Violations ──\n' + violations.join('\n')
+      }
+      return { success: true, content: successContent }
     } catch (err) {
       return {
         success: false,

package/src/tools/index.ts

@@ -29,6 +29,7 @@ import { toolSearchTool } from './system/tool-search'
 import { artifactTool } from './artifact/artifact'
 import { reportFindingsTool } from './agent/report-findings'
 import { sendMessageTool } from './agent/send-message'
+import { listAgentsTool } from './agent/list-agents'
 import { computerUseTool } from './computer/computer-use'
 import { scheduleWakeupTool } from './scheduling/schedule-wakeup.js'
 import { cronCreateTool, cronDeleteTool, cronListTool } from './scheduling/cron.js'
@@ -145,6 +146,7 @@ export function createToolRegistry(): Map<string, ToolDefinition> {
     withValidation(workflowTool),
     withValidation(reportFindingsTool),
     withValidation(sendMessageTool),
+    withValidation(listAgentsTool),
     // Network tools
     withValidation(webFetchTool),
     withValidation(webSearchTool),