@miphamai/cli 0.22.0 → 0.23.0

package/README.md

@@ -16,7 +16,7 @@ Requirements: **Bun 1.2+** (recommended) or **Node.js 22+**
 ## Features
 
 - **9 AI Providers** — Anthropic Claude · OpenAI GPT · DeepSeek · Kimi (Moonshot) · Google Gemini · Doubao 豆包 · Tencent Hunyuan 混元 · Qwen 通义千问 · MiphamAI
-- **66 Slash Commands** — Interactive command picker (↑↓ Enter Esc), Claude Code-compatible, zero re-learning
+- **66 Slash Commands** — Interactive command picker (↑↓ Enter Esc), intuitive command interface, zero re-learning
 - **16 Built-in Tools** — File ops, shell execution, agent dispatch, MCP integration, web search
 - **14 Skills + Marketplace** — 11 standard + 3 Mipham-exclusive skills. `/browse-skills` `/install-skill` community marketplace
 - **Self-Update** — `mipham update` / `/upgrade` — one command to check, backup config, upgrade, restore. API keys preserved

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/skills/workflows/audit.js

@@ -10,37 +10,85 @@ export const meta = {
 }
 
 phase('Scope')
-const targets = args.targets || (await agent(
-  'List all source files that need security auditing. Return { files: [{ path, reason }] }',
-  { schema: { type: 'object', properties: { files: { type: 'array', items: { type: 'object', properties: { path: { type: 'string' }, reason: { type: 'string' } }, required: ['path', 'reason'] } } }, required: ['files'] } },
-)).files
+const targets =
+  args.targets ||
+  (
+    await agent(
+      'List all source files that need security auditing. Return { files: [{ path, reason }] }',
+      {
+        schema: {
+          type: 'object',
+          properties: {
+            files: {
+              type: 'array',
+              items: {
+                type: 'object',
+                properties: { path: { type: 'string' }, reason: { type: 'string' } },
+                required: ['path', 'reason'],
+              },
+            },
+          },
+          required: ['files'],
+        },
+      },
+    )
+  ).files
 
 log(`Auditing ${targets.length} files`)
 
 phase('Audit')
-const raw = (await pipeline(
-  targets,
-  t => agent(`Security audit ${t.path}: injection, auth, crypto, secrets, input validation. Return { findings: [{ severity, file, line, summary }] }`,
-    { label: `audit:${t.path}`, schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'object', properties: { severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] }, file: { type: 'string' }, line: { type: 'number' }, summary: { type: 'string' } }, required: ['severity', 'file', 'summary'] } } }, required: ['findings'] } },
-  )),
+const raw = await pipeline(targets, (t) =>
+  agent(
+    `Security audit ${t.path}: injection, auth, crypto, secrets, input validation. Return { findings: [{ severity, file, line, summary }] }`,
+    {
+      label: `audit:${t.path}`,
+      schema: {
+        type: 'object',
+        properties: {
+          findings: {
+            type: 'array',
+            items: {
+              type: 'object',
+              properties: {
+                severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
+                file: { type: 'string' },
+                line: { type: 'number' },
+                summary: { type: 'string' },
+              },
+              required: ['severity', 'file', 'summary'],
+            },
+          },
+        },
+        required: ['findings'],
+      },
+    },
+  ),
 )
-const findings = raw.flatMap(r => (r && r.findings) || [])
+const findings = raw.flatMap((r) => (r && r.findings) || [])
 
 log(`Found ${findings.length} potential issues`)
 
 phase('Verify')
 const verified = await parallel(
-  findings.map(f => () =>
-    verify(f, {
-      mode: 'adversarial',
-      skeptics: 3,
-      threshold: 2,
-      schema: { type: 'object', properties: { real: { type: 'boolean' }, reason: { type: 'string' } }, required: ['real', 'reason'] },
-    })
+  findings.map(
+    (f) => () =>
+      verify(f, {
+        mode: 'adversarial',
+        skeptics: 3,
+        threshold: 2,
+        schema: {
+          type: 'object',
+          properties: { real: { type: 'boolean' }, reason: { type: 'string' } },
+          required: ['real', 'reason'],
+        },
+      }),
   ),
 )
 
-const confirmed = verified.filter(Boolean).filter(v => v.survives).map(v => v.finding)
+const confirmed = verified
+  .filter(Boolean)
+  .filter((v) => v.survives)
+  .map((v) => v.finding)
 log(`${confirmed.length}/${findings.length} findings verified`)
 
 phase('Report')

package/src/agent/cross-session/discovery.ts

@@ -0,0 +1,99 @@
+import {
+  readdirSync,
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  mkdirSync,
+  unlinkSync,
+} from 'node:fs'
+import { join } from 'node:path'
+import { homedir, hostname } from 'node:os'
+import type { SessionInfo } from '../../shared/types'
+
+const MIPHAM_HOME = join(homedir(), '.mipham')
+const ACTIVE_SESSIONS_DIR = join(MIPHAM_HOME, '.active-sessions')
+
+/**
+ * Register the current session as active.
+ * Writes a SessionInfo JSON file + updates mtime for heartbeat.
+ */
+export function registerActiveSession(info: SessionInfo): void {
+  mkdirSync(ACTIVE_SESSIONS_DIR, { recursive: true })
+  const filePath = join(ACTIVE_SESSIONS_DIR, `${info.id}.json`)
+  writeFileSync(filePath, JSON.stringify(info, null, 2), 'utf-8')
+}
+
+/**
+ * Update heartbeat (mtime) for an active session.
+ */
+export function heartbeatSession(sessionId: string): void {
+  const filePath = join(ACTIVE_SESSIONS_DIR, `${sessionId}.json`)
+  if (existsSync(filePath)) {
+    // Touch the file by rewriting it
+    const raw = readFileSync(filePath, 'utf-8')
+    writeFileSync(filePath, raw, 'utf-8') // updates mtime
+  }
+}
+
+/**
+ * Unregister a session (called on shutdown).
+ */
+export function unregisterSession(sessionId: string): void {
+  const filePath = join(ACTIVE_SESSIONS_DIR, `${sessionId}.json`)
+  try {
+    if (existsSync(filePath)) unlinkSync(filePath)
+  } catch {
+    // Best-effort
+  }
+}
+
+/**
+ * Discover all active sessions.
+ * Reads ~/.mipham/.active-sessions/ directory.
+ */
+export function discoverSessions(): SessionInfo[] {
+  if (!existsSync(ACTIVE_SESSIONS_DIR)) return []
+
+  try {
+    const files = readdirSync(ACTIVE_SESSIONS_DIR).filter((f) => f.endsWith('.json'))
+
+    const sessions: SessionInfo[] = []
+    for (const file of files) {
+      try {
+        const raw = readFileSync(join(ACTIVE_SESSIONS_DIR, file), 'utf-8')
+        const info = JSON.parse(raw) as SessionInfo
+        sessions.push(info)
+      } catch {
+        // Skip corrupt files
+      }
+    }
+
+    // Sort by most recently active
+    sessions.sort((a, b) => new Date(b.startedAt).getTime() - new Date(a.startedAt).getTime())
+    return sessions
+  } catch {
+    return []
+  }
+}
+
+/**
+ * Create a SessionInfo for the current process.
+ */
+export function createSessionInfo(
+  sessionId: string,
+  name: string,
+  cwd?: string,
+  provider?: string,
+  model?: string,
+): SessionInfo {
+  return {
+    id: sessionId,
+    name,
+    machine: hostname(),
+    pid: process.pid,
+    startedAt: new Date().toISOString(),
+    cwd,
+    provider,
+    model,
+  }
+}

package/src/agent/cross-session/file-inbox.ts

@@ -0,0 +1,118 @@
+import {
+  mkdirSync,
+  writeFileSync,
+  readdirSync,
+  readFileSync,
+  unlinkSync,
+  existsSync,
+  renameSync,
+} from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+import type { CrossSessionTransport } from './transport'
+import type { AgentMessage } from '../message-bus'
+import type { SessionInfo } from '../../shared/types'
+
+const MIPHAM_HOME = join(homedir(), '.mipham')
+const INBOX_DIR = join(MIPHAM_HOME, 'inbox')
+
+/**
+ * Filesystem-based cross-session transport.
+ *
+ * Messages are stored as JSON files in ~/.mipham/inbox/<session-id>/.
+ * Each message file is named: <ISO-timestamp>-<msg-id>.json
+ */
+export class FileInboxTransport implements CrossSessionTransport {
+  private ensureDir(dir: string): void {
+    mkdirSync(dir, { recursive: true })
+  }
+
+  async send(from: SessionInfo, toSessionId: string, msg: AgentMessage): Promise<boolean> {
+    try {
+      const inboxDir = join(INBOX_DIR, toSessionId)
+      this.ensureDir(inboxDir)
+
+      const timestamp = new Date().toISOString().replace(/[:.]/g, '-')
+      const filename = `${timestamp}-${msg.id}.json`
+      const filePath = join(inboxDir, filename)
+
+      // Atomic write: temp file then rename
+      const tmpPath = filePath + '.tmp'
+      writeFileSync(
+        tmpPath,
+        JSON.stringify({ ...msg, _fromSession: from.id, _fromMachine: from.machine }, null, 2),
+        'utf-8',
+      )
+      renameSync(tmpPath, filePath)
+
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  async poll(sessionId: string): Promise<AgentMessage[]> {
+    const inboxDir = join(INBOX_DIR, sessionId)
+    if (!existsSync(inboxDir)) return []
+
+    try {
+      const files = readdirSync(inboxDir)
+        .filter((f) => f.endsWith('.json') && !f.endsWith('.tmp'))
+        .sort() // chronological by timestamp prefix
+
+      const messages: AgentMessage[] = []
+      for (const file of files) {
+        try {
+          const raw = readFileSync(join(inboxDir, file), 'utf-8')
+          const parsed = JSON.parse(raw) as AgentMessage & {
+            _fromSession?: string
+            _fromMachine?: string
+          }
+
+          // Build the message body with cross-session origin prefix
+          const originPrefix = parsed._fromSession
+            ? `[From: ${parsed._fromSession}@${parsed._fromMachine || 'unknown'}]\n\n`
+            : ''
+
+          messages.push({
+            id: parsed.id,
+            from: parsed.from,
+            to: parsed.to,
+            summary: parsed.summary,
+            message: `${originPrefix}${parsed.message}`,
+            timestamp: new Date(parsed.timestamp),
+            read: parsed.read,
+            type: parsed.type,
+          })
+
+          // Mark as read by deleting the file (read-once)
+          unlinkSync(join(inboxDir, file))
+        } catch {
+          // Skip corrupt files
+        }
+      }
+
+      return messages
+    } catch {
+      return []
+    }
+  }
+
+  async listSessions(): Promise<SessionInfo[]> {
+    return discoverSessions()
+  }
+}
+
+// Import discoverSessions lazily to avoid circular dependency
+import { discoverSessions } from './discovery'
+
+// ── Singleton ──
+
+let _transport: FileInboxTransport | null = null
+
+export function getFileInboxTransport(): FileInboxTransport {
+  if (!_transport) {
+    _transport = new FileInboxTransport()
+  }
+  return _transport
+}

package/src/agent/cross-session/transport.ts

@@ -0,0 +1,17 @@
+import type { AgentMessage } from '../message-bus'
+import type { SessionInfo } from '../../shared/types'
+
+/**
+ * Transport layer for cross-session messaging.
+ * Implementations can use filesystem, unix sockets, TCP, etc.
+ */
+export interface CrossSessionTransport {
+  /** Send a message to a destination session's inbox. Returns true on success. */
+  send(from: SessionInfo, toSessionId: string, msg: AgentMessage): Promise<boolean>
+
+  /** Poll for unread messages addressed to the given session. */
+  poll(sessionId: string): Promise<AgentMessage[]>
+
+  /** List all discoverable active sessions. */
+  listSessions(): Promise<SessionInfo[]>
+}

package/src/agent/message-router.ts

@@ -0,0 +1,83 @@
+import { getMessageBus } from './message-bus'
+import { getFileInboxTransport } from './cross-session/file-inbox'
+import { discoverSessions, createSessionInfo } from './cross-session/discovery'
+import type { AgentMessage } from './message-bus'
+
+export interface RouteResult {
+  success: boolean
+  routedTo: 'bus' | 'inbox' | 'unknown'
+  error?: string
+  messageId?: string
+}
+
+/**
+ * MessageRouter decides how to deliver a message based on the recipient.
+ *
+ * - "main" or background task IDs → in-memory AgentMessageBus (same process)
+ * - Session IDs matching discoverable sessions → file inbox (cross-session)
+ * - Unknown → error
+ */
+export class MessageRouter {
+  /**
+   * Route a message to the appropriate transport.
+   */
+  async route(from: string, to: string, summary: string, message: string): Promise<RouteResult> {
+    // Same-process routing: "main" or background task IDs
+    if (to === 'main' || to.startsWith('bg-') || to.startsWith('sub-agent-')) {
+      try {
+        const bus = getMessageBus()
+        const msgId = bus.post(from, to, summary, message)
+        return { success: true, routedTo: 'bus', messageId: msgId }
+      } catch (err) {
+        return { success: false, routedTo: 'bus', error: String(err) }
+      }
+    }
+
+    // Cross-session routing
+    const sessions = discoverSessions()
+    const targetSession = sessions.find((s) => s.id === to)
+
+    if (!targetSession) {
+      return {
+        success: false,
+        routedTo: 'unknown',
+        error: `No active session found with ID "${to}". Use ListAgents to discover available sessions.`,
+      }
+    }
+
+    // Get sender info
+    const senderSession = createSessionInfo(from, from)
+
+    try {
+      const transport = getFileInboxTransport()
+      const msg: AgentMessage = {
+        id: `xmsg-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
+        from,
+        to,
+        summary: summary.slice(0, 200),
+        message,
+        timestamp: new Date(),
+        read: false,
+        type: 'message',
+      }
+
+      const delivered = await transport.send(senderSession, to, msg)
+      if (!delivered) {
+        return { success: false, routedTo: 'inbox', error: 'Failed to write message to inbox.' }
+      }
+
+      return { success: true, routedTo: 'inbox', messageId: msg.id }
+    } catch (err) {
+      return { success: false, routedTo: 'inbox', error: String(err) }
+    }
+  }
+}
+
+let _router: MessageRouter | null = null
+
+export function getMessageRouter(): MessageRouter {
+  if (!_router) {
+    _router = new MessageRouter()
+  }
+  return _router
+}

package/src/config/defaults.ts

@@ -3,6 +3,7 @@ import type {
   InferenceHookConfig,
   CredentialMaskingConfig,
   BackgroundAgentConfig,
+  CrossSessionConfig,
 } from '../shared/index.ts'
 import { DEFAULT_PROVIDERS } from '../shared/index.ts'
 import { PACKAGE_VERSION } from '../shared/index.ts'
@@ -51,3 +52,8 @@ export const DEFAULT_BACKGROUND_AGENT_CONFIG: BackgroundAgentConfig = {
   auto_worktree: true,
   commit_coauthors: true,
 }
+
+export const DEFAULT_CROSS_SESSION_CONFIG: CrossSessionConfig = {
+  crossSessionInbound: 'ask',
+  dialogExpiry: 300,
+}

package/src/config/loader.ts

@@ -17,12 +17,14 @@ import type {
   InferenceHookConfig,
   CredentialMaskingConfig,
   BackgroundAgentConfig,
+  CrossSessionConfig,
 } from '../shared/index.ts'
 import {
   DEFAULT_CONFIG,
   DEFAULT_INFERENCE_HOOK_CONFIG,
   DEFAULT_CREDENTIAL_MASKING_CONFIG,
   DEFAULT_BACKGROUND_AGENT_CONFIG,
+  DEFAULT_CROSS_SESSION_CONFIG,
 } from './defaults'
 
 const MIPHAM_HOME = join(homedir(), '.mipham')
@@ -376,3 +378,34 @@ export function loadBackgroundAgentConfig(cwd: string = process.cwd()): Backgrou
 
   return merged
 }
+
+/**
+ * Load cross-session messaging configuration from the same config sources.
+ * Merges project-level over user-level. Returns defaults if no section present.
+ */
+export function loadCrossSessionConfig(cwd: string = process.cwd()): CrossSessionConfig {
+  const configPath = join(cwd, '.mipham', 'config.yml')
+  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
+
+  let merged = { ...DEFAULT_CROSS_SESSION_CONFIG }
+
+  const paths = [userConfigPath, configPath] // project wins (loaded last)
+  for (const path of paths) {
+    try {
+      if (!existsSync(path)) continue
+      const raw = readFileSync(path, 'utf-8')
+      const parsed = parseYaml(raw) as Record<string, unknown>
+      const section = parsed.cross_session as Partial<CrossSessionConfig> | undefined
+      if (section) {
+        merged = {
+          crossSessionInbound: section.crossSessionInbound ?? merged.crossSessionInbound,
+          dialogExpiry: section.dialogExpiry ?? merged.dialogExpiry,
+        }
+      }
+    } catch {
+      // Silently skip malformed configs
+    }
+  }
+
+  return merged
+}

package/src/core/credential-masker/env-filter.ts

@@ -0,0 +1,39 @@
+import { CREDENTIAL_SENTINEL } from './types'
+import type { CredentialMaskingConfig } from '../../shared/index.ts'
+
+/**
+ * Filter sensitive environment variables before spawning a subprocess.
+ * Returns a sanitized copy of process.env with matching vars removed.
+ */
+export function filterEnv(
+  env: Record<string, string | undefined>,
+  config: CredentialMaskingConfig,
+): Record<string, string | undefined> {
+  if (!config.enabled || !config.env_filter.enabled) return { ...env }
+
+  const filtered: Record<string, string | undefined> = {}
+  for (const [key, value] of Object.entries(env)) {
+    let blocked = false
+    for (const pattern of config.env_filter.patterns) {
+      try {
+        // Strip (?i) inline flags — JS uses the 'i' flag instead
+        const clean = pattern.replace(/^\(\?i\)/, '')
+        const regex = new RegExp(clean, 'i')
+        if (regex.test(key)) {
+          blocked = true
+          break
+        }
+      } catch {
+        // Invalid regex — skip
+      }
+    }
+    if (blocked) {
+      // Replace with sentinel so tools can detect they're filtered
+      filtered[key] = CREDENTIAL_SENTINEL
+    } else {
+      filtered[key] = value
+    }
+  }
+
+  return filtered
+}

package/src/core/credential-masker/index.ts

@@ -0,0 +1,35 @@
+export { CREDENTIAL_SENTINEL } from './types'
+export type { MaskingStrategy } from './types'
+
+export { MaskingPipeline, getPipeline, maskContent } from './pipeline'
+export { matchCredentialFile, matchPath, globToRegex } from './matcher'
+export { filterEnv } from './env-filter'
+export { maskOutput } from './output-scrub'
+
+// Strategies
+export { FullMaskingStrategy } from './strategies/full'
+export { ExtractMaskingStrategy } from './strategies/extract'
+export { JwtMaskingStrategy } from './strategies/jwt'
+export { AwsMaskingStrategy } from './strategies/aws'
+
+import { getPipeline } from './pipeline'
+import { FullMaskingStrategy } from './strategies/full'
+import { ExtractMaskingStrategy } from './strategies/extract'
+import { JwtMaskingStrategy } from './strategies/jwt'
+import { AwsMaskingStrategy } from './strategies/aws'
+
+/**
+ * Initialize the masking pipeline with all built-in strategies.
+ * Call once at startup. Safe to call multiple times (idempotent).
+ */
+let _initialized = false
+
+export function initializePipeline(): void {
+  if (_initialized) return
+  const pipeline = getPipeline()
+  pipeline.register(new FullMaskingStrategy())
+  pipeline.register(new ExtractMaskingStrategy())
+  pipeline.register(new JwtMaskingStrategy())
+  pipeline.register(new AwsMaskingStrategy())
+  _initialized = true
+}

package/src/core/credential-masker/matcher.ts

@@ -0,0 +1,106 @@
+import { homedir } from 'node:os'
+import type { CredentialMaskingConfig, CredentialFileRule } from '../../shared/index.ts'
+
+/**
+ * Check if a file path matches any credential file rule.
+ * Returns the matching rule, or null if no match.
+ */
+export function matchCredentialFile(
+  filePath: string,
+  config: CredentialMaskingConfig,
+): CredentialFileRule | null {
+  if (!config.enabled || config.files.length === 0) return null
+
+  const expanded = expandHome(filePath)
+  for (const rule of config.files) {
+    if (matchPath(expanded, rule.path)) {
+      return rule
+    }
+  }
+  return null
+}
+
+// ── Internal helpers ──
+
+/**
+ * Expand ~ to the user's home directory.
+ */
+export function expandHome(p: string): string {
+  if (p.startsWith('~')) {
+    return homedir() + p.slice(1)
+  }
+  return p
+}
+
+/**
+ * Match a file path against a glob-like pattern.
+ * Supports:
+ * - ** globstar (matches any number of path segments)
+ * - * wildcard within a single path segment
+ * - ? single char
+ * - ~ home directory expansion
+ * - basename-only matching (e.g. ".env*" matches any .env file)
+ */
+export function matchPath(filePath: string, pattern: string): boolean {
+  const expandedPattern = expandHome(pattern)
+  const normalizedFile = filePath.replace(/\\/g, '/')
+  const normalizedPattern = expandedPattern.replace(/\\/g, '/')
+
+  if (normalizedFile === normalizedPattern) return true
+
+  // File ends with pattern (for relative basename matching like ".env*")
+  if (normalizedFile.endsWith('/' + normalizedPattern)) return true
+
+  const regex = globToRegex(normalizedPattern)
+  if (regex.test(normalizedFile)) return true
+
+  // Basename-only matching: patterns without path separators match
+  // against the last component of the file path (e.g. ".env*" matches any .env file)
+  if (!normalizedPattern.includes('/')) {
+    const basename = normalizedFile.split('/').pop() || normalizedFile
+    if (regex.test(basename)) return true
+  }
+
+  return false
+}
+
+/**
+ * Convert a glob pattern to a RegExp.
+ * - ** → .* (matches any path segments)
+ * - *  → [^/]* (matches within a single segment)
+ * - ?  → . (single char)
+ * - All other special regex chars are escaped.
+ */
+export function globToRegex(pattern: string): RegExp {
+  let regexStr = ''
+  let i = 0
+  while (i < pattern.length) {
+    const ch = pattern[i]!
+    if (ch === '*' && pattern[i + 1] === '*') {
+      // ** — match zero or more path segments
+      regexStr += '.*'
+      i += 2
+      // Skip trailing slash after **
+      if (pattern[i] === '/') i++
+      continue
+    }
+    if (ch === '*') {
+      regexStr += '[^/]*'
+      i++
+      continue
+    }
+    if (ch === '?') {
+      regexStr += '.'
+      i++
+      continue
+    }
+    // Escape regex special chars
+    if ('\\^$.|+()[]{}'.includes(ch)) {
+      regexStr += '\\' + ch
+    } else {
+      regexStr += ch
+    }
+    i++
+  }
+  return new RegExp('^' + regexStr + '$')
+}