@miphamai/cli 0.24.1 → 0.24.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.24.1",
+  "version": "0.24.3",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent/sub-agent.ts

@@ -8,6 +8,7 @@ import type { HookEngine } from '../core/hooks'
 import type { PermissionSystem } from '../core/permission'
 import { AgentExperience } from './agent-experience'
 import { PatternAnalyzer } from './pattern-analyzer.js'
+import { getWorkspaceTrust } from '../core/workspace-trust'
 import type { ExperienceRuleEngine } from '../core/rule-engine.js'
 
 // Singleton instances (created lazily)
@@ -200,6 +201,19 @@ export class SubAgent {
     // Resolve execution directory: worktree isolation or process cwd
     const execCwd = options.worktreePath || process.cwd()
 
+    // Check workspace trust for the execution directory.
+    // For worktree-isolated agents, auto-trust the worktree if the parent is trusted.
+    if (options.worktreePath) {
+      const trust = getWorkspaceTrust()
+      if (!trust.isTrusted(execCwd)) {
+        // Auto-trust worktree directories when the parent workspace is trusted
+        if (trust.isTrusted(process.cwd())) {
+          trust.trust(execCwd)
+        }
+        // Otherwise, proceed with a warning — don't block agent execution
+      }
+    }
+
     // Resolve system prompt: agentDef > options.systemPrompt > builtin type
     const systemPrompt =
       agentDef?.systemPrompt || options.systemPrompt || TYPE_SYSTEM_PROMPTS[agentType]

package/src/commands/project.ts

@@ -6,8 +6,18 @@
  * /security, /audit, /prompt-audit
  */
 import type { CommandHandler, CommandContext, CommandResult } from '../ui/commands.js'
-
-export { initCmd, permissionsCmd, recommendCmd, setupCmd, addDirCmd, promptAuditCmd, securityCmd }
+import { getWorkspaceTrust } from '../core/workspace-trust'
+
+export {
+  initCmd,
+  permissionsCmd,
+  recommendCmd,
+  setupCmd,
+  addDirCmd,
+  promptAuditCmd,
+  securityCmd,
+  trustCmd,
+}
 
 const initCmd: CommandHandler = async (ctx) => {
   const { existsSync, mkdirSync, writeFileSync } = await import('node:fs')
@@ -1004,3 +1014,35 @@ const securityCmd: CommandHandler = async () => {
 
   return { content: lines.join('\n') }
 }
+
+const trustCmd: CommandHandler = (ctx) => {
+  const trust = getWorkspaceTrust()
+  const cwd = process.cwd()
+  const trusted = trust.listTrusted()
+
+  const lines: string[] = [
+    '── Workspace Trust ──',
+    '',
+    `Current directory: ${cwd}`,
+    `Trusted: ${trust.isTrusted(cwd) ? '✅ Yes' : '⚠️  No (restart to trust)'}`,
+    `Trust store: ${trust.getStorePath()}`,
+    '',
+  ]
+
+  if (trusted.length === 0) {
+    lines.push('No trusted workspaces configured.')
+    lines.push('')
+    lines.push('Trust a workspace: restart Mipham Code in the directory')
+    lines.push('and accept the trust prompt.')
+  } else {
+    lines.push(`Trusted workspaces (${trusted.length}):`)
+    for (const dir of trusted) {
+      const marker = cwd.startsWith(dir) ? ' ← current' : ''
+      lines.push(`  • ${dir}${marker}`)
+    }
+    lines.push('')
+    lines.push('Remove a workspace: delete the directory entry from the trust store.')
+  }
+
+  return { content: lines.join('\n') }
+}

package/src/core/engine.ts

@@ -4,6 +4,7 @@ import type {
   ToolResult,
   InferenceHookConfig,
   CrsiConfig,
+  CrossSessionConfig,
 } from '../shared/index.ts'
 import { ProviderRegistry } from '../providers/registry'
 import { ContextManager } from './context'
@@ -69,6 +70,12 @@ export class QueryEngine {
   /** Session identifier for cross-session messaging. Set by the app startup via setSessionId(). */
   private sessionId: string = 'session-1'
 
+  /** Cross-session inbound policy. Default: 'ask' (messages require user review). */
+  private crossSessionConfig: CrossSessionConfig = {
+    crossSessionInbound: 'ask',
+    dialogExpiry: 300,
+  }
+
   /** Set the session identifier (called from index.tsx at startup with the actual session name). */
   setSessionId(id: string): void {
     this.sessionId = id
@@ -79,15 +86,45 @@ export class QueryEngine {
     return this.sessionId
   }
 
+  /** Set the cross-session messaging policy (called from index.tsx at startup). */
+  setCrossSessionConfig(config: CrossSessionConfig): void {
+    this.crossSessionConfig = config
+  }
+
   /** Poll the cross-session file inbox for messages addressed to this session. */
   async pollCrossSessionInbox(): Promise<void> {
+    const policy = this.crossSessionConfig.crossSessionInbound
+
+    // 'deny' — silently discard all inbound messages
+    if (policy === 'deny') {
+      try {
+        const transport = getFileInboxTransport()
+        await transport.poll(this.sessionId) // read + delete, don't forward
+      } catch {
+        // Best-effort discard
+      }
+      return
+    }
+
     try {
       const transport = getFileInboxTransport()
       const messages = await transport.poll(this.sessionId)
       if (messages.length > 0) {
         const bus = getMessageBus()
         for (const msg of messages) {
-          bus.post(msg.from, msg.to, msg.summary, msg.message, msg.type)
+          if (policy === 'ask') {
+            // Mark as awaiting approval — the model should verify with the user before acting
+            bus.post(
+              msg.from,
+              msg.to,
+              `[Awaiting Approval] ${msg.summary}`,
+              `[Cross-session message from ${msg.from} — verify with user before acting]\n\n${msg.message}`,
+              'warning',
+            )
+          } else {
+            // 'allow' — forward directly
+            bus.post(msg.from, msg.to, msg.summary, msg.message, msg.type)
+          }
         }
       }
     } catch (err) {

package/src/core/workspace-trust.ts

@@ -0,0 +1,144 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
+import { join, dirname, resolve } from 'node:path'
+import { homedir } from 'node:os'
+
+const MIPHAM_HOME = join(homedir(), '.mipham')
+const TRUST_STORE_PATH = join(MIPHAM_HOME, 'trusted-workspaces.json')
+
+export interface TrustedWorkspaces {
+  version: 1
+  directories: string[]
+  updatedAt: string
+}
+
+/**
+ * Resolves a directory to its real absolute path, following symlinks.
+ * Falls back to the resolved path if realpath fails.
+ */
+function realPath(dir: string): string {
+  try {
+    // Use resolve to normalize, but don't require the directory to exist yet
+    const resolved = resolve(dir)
+    return resolved
+  } catch {
+    return resolve(dir)
+  }
+}
+
+/**
+ * Manages the workspace trust store.
+ *
+ * Trust is hierarchical: a directory is trusted if it or any of its
+ * ancestor directories are in the trust store. This means trusting
+ * /Users/me/Projects implicitly trusts all subdirectories.
+ */
+export class WorkspaceTrust {
+  private store: TrustedWorkspaces
+
+  constructor() {
+    this.store = this.load()
+  }
+
+  /** Load the trust store from disk, or return a fresh default. */
+  private load(): TrustedWorkspaces {
+    try {
+      if (!existsSync(TRUST_STORE_PATH)) {
+        return { version: 1, directories: [], updatedAt: new Date().toISOString() }
+      }
+      const raw = readFileSync(TRUST_STORE_PATH, 'utf-8')
+      const parsed = JSON.parse(raw) as TrustedWorkspaces
+      if (parsed.version !== 1) {
+        // Unknown version — reset
+        return { version: 1, directories: [], updatedAt: new Date().toISOString() }
+      }
+      return parsed
+    } catch {
+      return { version: 1, directories: [], updatedAt: new Date().toISOString() }
+    }
+  }
+
+  /** Persist the trust store to disk. */
+  private save(): void {
+    try {
+      if (!existsSync(MIPHAM_HOME)) {
+        mkdirSync(MIPHAM_HOME, { recursive: true })
+      }
+      this.store.updatedAt = new Date().toISOString()
+      writeFileSync(TRUST_STORE_PATH, JSON.stringify(this.store, null, 2), 'utf-8')
+    } catch {
+      // Best-effort: don't crash if we can't save
+    }
+  }
+
+  /**
+   * Check whether a directory is trusted.
+   * A directory is trusted if it or any ancestor is in the trust list.
+   */
+  isTrusted(dir: string): boolean {
+    const resolved = realPath(dir)
+    const resolvedLower = resolved.toLowerCase()
+
+    for (const trusted of this.store.directories) {
+      const trustedLower = trusted.toLowerCase()
+      // Exact match
+      if (resolvedLower === trustedLower) return true
+      // Ancestor match: trusted dir is a parent of the target
+      if (resolvedLower.startsWith(trustedLower + '/')) return true
+    }
+
+    return false
+  }
+
+  /** Add a directory to the trust store. */
+  trust(dir: string): void {
+    const resolved = realPath(dir)
+    // Don't add duplicates
+    if (this.store.directories.includes(resolved)) return
+    // Don't add subdirectories of already-trusted paths
+    if (this.isTrusted(resolved)) return
+
+    this.store.directories.push(resolved)
+    // Sort for readability
+    this.store.directories.sort()
+    this.save()
+  }
+
+  /** Remove a directory from the trust store (and any subdirectories). */
+  untrust(dir: string): void {
+    const resolved = realPath(dir)
+    const resolvedLower = resolved.toLowerCase()
+
+    this.store.directories = this.store.directories.filter((d) => {
+      const lower = d.toLowerCase()
+      // Remove exact match and all subdirectories
+      return lower !== resolvedLower && !lower.startsWith(resolvedLower + '/')
+    })
+    this.save()
+  }
+
+  /** List all trusted directories. */
+  listTrusted(): string[] {
+    return [...this.store.directories]
+  }
+
+  /** Get the path to the trust store. */
+  getStorePath(): string {
+    return TRUST_STORE_PATH
+  }
+}
+
+// ── Singleton ──
+
+let _instance: WorkspaceTrust | null = null
+
+export function getWorkspaceTrust(): WorkspaceTrust {
+  if (!_instance) {
+    _instance = new WorkspaceTrust()
+  }
+  return _instance
+}
+
+/** Reset the singleton (for tests). */
+export function resetWorkspaceTrust(): void {
+  _instance = null
+}

package/src/index.tsx

@@ -2,6 +2,7 @@ import React from 'react'
 import { join } from 'node:path'
 import { existsSync } from 'node:fs'
 import { render } from 'ink'
+import * as readline from 'node:readline'
 import { App } from './ui/app'
 import {
   loadConfig,
@@ -33,6 +34,7 @@ import { AgentRegistry } from './agent/agent-registry'
 import { HookEngine } from './core/hooks'
 import { ArtifactServer } from './artifacts/server'
 import { getMetrics } from './core/metrics'
+import { getWorkspaceTrust } from './core/workspace-trust'
 import { ARTIFACTS_DIR, ARTIFACT_PORT, MIPHAM_DIR } from './shared/constants'
 import { AgentViewManager } from './agent-view/agent-view-manager'
 import { AgentViewDashboard } from './agent-view/dashboard'
@@ -52,10 +54,69 @@ interface RunOptions {
   version?: string
 }
 
+/**
+ * Check workspace trust before starting the session.
+ * If the cwd is not trusted, prompt the user via stdin.
+ * Exits the process if the user declines.
+ */
+async function checkWorkspaceTrust(): Promise<void> {
+  const cwd = process.cwd()
+  const trust = getWorkspaceTrust()
+
+  if (trust.isTrusted(cwd)) return
+
+  // Non-interactive mode (piped stdin, headless) — skip prompt, proceed
+  if (!process.stdin.isTTY) return
+
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stderr, // use stderr to avoid interfering with stdout rendering
+  })
+
+  const question = (prompt: string): Promise<string> =>
+    new Promise((resolve) => {
+      rl.question(prompt, (answer) => {
+        resolve(answer.trim().toLowerCase())
+      })
+    })
+
+  process.stderr.write('\n')
+  process.stderr.write('╔══════════════════════════════════════════════╗\n')
+  process.stderr.write('║  ⚠️  Workspace Trust                          ║\n')
+  process.stderr.write('╠══════════════════════════════════════════════╣\n')
+  process.stderr.write('║                                              ║\n')
+  process.stderr.write(`║  Directory not trusted:                      ║\n`)
+  process.stderr.write(`║  ${cwd.slice(0, 42).padEnd(42)}║\n`)
+  process.stderr.write('║                                              ║\n')
+  process.stderr.write('║  Trust this workspace?                       ║\n')
+  process.stderr.write('║  [Y] Trust and continue                      ║\n')
+  process.stderr.write('║  [N] Exit                                    ║\n')
+  process.stderr.write('║                                              ║\n')
+  process.stderr.write('╚══════════════════════════════════════════════╝\n')
+  process.stderr.write('\n')
+
+  try {
+    const answer = await question('Trust this workspace? [Y/N]: ')
+    if (answer === 'y' || answer === 'yes') {
+      trust.trust(cwd)
+      process.stderr.write(`✓ Workspace trusted: ${cwd}\n\n`)
+    } else {
+      process.stderr.write('✗ Workspace not trusted. Exiting.\n')
+      rl.close()
+      process.exit(1)
+    }
+  } finally {
+    rl.close()
+  }
+}
+
 export async function runApp(options: RunOptions): Promise<void> {
   // Metrics: count CLI invocation
   getMetrics().cliInvocations.inc()
 
+  // ── Workspace Trust Check ──
+  await checkWorkspaceTrust()
+
   // Handle `mipham agents` subcommand — launch standalone dashboard
   const args = process.argv.slice(2)
   if (args[0] === 'agents') {
@@ -318,8 +379,9 @@ export async function runApp(options: RunOptions): Promise<void> {
     heartbeatInterval.unref()
   }
 
-  // Load cross-session config (available for MessageRouter and future consumers)
-  loadCrossSessionConfig()
+  // Load cross-session config and wire into the engine's inbound policy
+  const crossSessionConfig = loadCrossSessionConfig(process.cwd())
+  engine.setCrossSessionConfig(crossSessionConfig)
 
   // Auto-save session on exit
   let saved = false

package/src/ui/commands.ts

@@ -35,6 +35,7 @@ import {
   addDirCmd,
   securityCmd,
   promptAuditCmd,
+  trustCmd,
 } from '../commands/project.js'
 import { themeCmd, releaseNotesCmd, ideCmd, terminalSetupCmd } from '../commands/environment.js'
 import { commitCmd, pushCmd, prCmd, issueCmd } from '../commands/git.js'
@@ -3215,6 +3216,7 @@ const commandsListCmd: CommandHandler = () => {
     '/recommend': 'Project',
     '/security': 'Project',
     '/audit': 'Project',
+    '/trust': 'Project',
     '/prompt-audit': 'Code Quality',
     '/ide': 'Environment',
     '/terminal-setup': 'Environment',
@@ -3371,6 +3373,7 @@ registry.set('/permissions', permissionsCmd)
 registry.set('/add-dir', addDirCmd)
 registry.set('/security', securityCmd)
 registry.set('/audit', securityCmd)
+registry.set('/trust', trustCmd)
 registry.set('/prompt-audit', promptAuditCmd)
 
 // Environment
@@ -3513,6 +3516,7 @@ const COMMAND_DESCRIPTIONS: Record<string, string> = {
   '/recommend': 'Analyze project + recommend skills & setup',
   '/security': 'Security review checklist',
   '/audit': 'Same as /security',
+  '/trust': 'Show and manage trusted workspaces',
   '/prompt-audit': 'Audit prompts for modern model optimization',
   '/ide': 'IDE integration guide',
   '/terminal-setup': 'Shell & terminal config',