@miphamai/cli 0.26.0 → 0.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/core/permission.ts

@@ -9,6 +9,53 @@ import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchBashRule, compileRule } from './permission-rules'
 import { loadPermissionConfig, nextMode, clampMode, MODE_CYCLE } from './permission-config'
 
+/**
+ * Check if a Bash command is a "verification-only" command that should be
+ * auto-approved in acceptEdits mode. These are non-destructive read/check
+ * operations that form the core of the vibe coding edit→test→fix loop.
+ */
+function isVerificationCommand(input: Record<string, unknown>): boolean {
+  const cmd = (input.command as string) || ''
+  // Patterns for verification-only commands (no side effects on codebase)
+  const verifyPatterns = [
+    /\bpnpm\s+test\b/, // test runner
+    /\bpnpm\s+t\b/, // shorthand test
+    /\bpnpm\s+typecheck\b/, // type checking
+    /\bpnpm\s+lint\b/, // linting
+    /\bpnpm\s+format:check\b/, // format check
+    /\bnpm\s+test\b/, // npm test
+    /\bnpm\s+run\s+test\b/, // npm run test
+    /\bvitest\b/, // vitest runner
+    /\bjest\b/, // jest runner
+    /\btsc\s+(?!init)/, // TypeScript compiler (not tsc init)
+    /\btsc\s+--noEmit\b/, // type check only
+    /\beslint\b/, // eslint
+    /\bprettier\s+--check\b/, // prettier check
+    /\bpytest\b/, // python test runner
+    /\bruff\s+check\b/, // python linter
+    /\bcargo\s+test\b/, // rust test
+    /\bcargo\s+check\b/, // rust check
+    /\bgo\s+test\b/, // go test
+    /\bgo\s+vet\b/, // go vet
+    /\bmake\s+test\b/, // make test
+    /\bgit\s+status\b/, // git status (read-only)
+    /\bgit\s+diff\b/, // git diff (read-only)
+    /\bgit\s+log\b/, // git log (read-only)
+    /\bgit\s+branch\b/, // git branch (read-only)
+    /\bls\b/, // list files
+    /\bcat\b/, // read file
+    /\bhead\b/, // read file start
+    /\btail\b/, // read file end
+    /\bwhich\b/, // find binary
+    /\becho\b/, // print text
+    /\bnode\s+-v\b/, // node version
+    /\bpython\s+--version\b/, // python version
+    /\bwhoami\b/, // current user
+    /\bpwd\b/, // current directory
+  ]
+  return verifyPatterns.some((p) => p.test(cmd))
+}
+
 const VALID_MODES: Set<string> = new Set<string>(MODE_CYCLE)
 
 export class PermissionSystem {
@@ -276,7 +323,7 @@ export class PermissionSystem {
     }
 
     // 5. Mode baseline
-    const baseline = this.modeBaseline(tool)
+    const baseline = this.modeBaseline(tool, input)
     if (baseline !== 'mode-baseline') {
       this.checkCache.set(cacheKey, baseline)
       return baseline
@@ -323,21 +370,29 @@ export class PermissionSystem {
     return rule.pattern === tool.name || rule.compiled.test(tool.name)
   }
 
-  private modeBaseline(tool: ToolDefinition): PermissionLevel | 'mode-baseline' {
+  private modeBaseline(
+    tool: ToolDefinition,
+    input?: Record<string, unknown>,
+  ): PermissionLevel | 'mode-baseline' {
     switch (this.mode) {
       case 'default':
         // Delegate to tool.permission (backward compat)
         return 'mode-baseline'
 
       case 'acceptEdits':
-        // Reads + file edits free; Bash requires approval
-        return tool.category === 'file'
-          ? ['Bash'].includes(tool.name)
-            ? 'ask'
-            : 'bypass'
-          : tool.name === 'Bash'
-            ? 'ask'
-            : 'ask'
+        // Reads + file edits free; Bash auto-approved for verification commands
+        if (tool.category === 'file' && tool.name !== 'Bash') {
+          return 'bypass'
+        }
+        if (tool.name === 'Bash') {
+          // Vibe coding fix: auto-approve verification commands
+          // so the edit→test→fix loop isn't interrupted by permission prompts
+          if (input && isVerificationCommand(input)) {
+            return 'bypass'
+          }
+          return 'ask'
+        }
+        return 'ask'
 
       case 'plan':
         // Only reads, no writes or executes

package/src/tools/agent/enter-plan.ts

@@ -80,12 +80,12 @@ export const enterPlanModeTool: ToolDefinition = {
         '  ⚠️  All other tools — require confirmation',
         '',
         'Design your approach, explore the codebase, then:',
-        '  • Use ExitPlanMode to submit your plan for approval',
-        '  • The user will review and approve before code changes begin',
+        '  • Use ExitPlanMode to submit your plan for user review',
+        '  • Present your plan and ask for explicit approval',
+        '  • The user must say "approved" before you switch to acceptEdits mode',
         '',
-        'ExitPlanMode parameters:',
-        '  approved: true → switch to acceptEdits mode (code changes allowed)',
-        '  approved: false → revert to default mode',
+        '⚠️  You CANNOT self-approve your plan. The user must explicitly confirm.',
+        '    After ExitPlanMode, wait for user approval before making code changes.',
       ].join('\n'),
     }
   },

package/src/tools/agent/exit-plan.ts

@@ -1,53 +1,62 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
 import type { ToolDefinition } from '../../shared/index.ts'
 
 export const exitPlanModeTool: ToolDefinition = {
   name: 'ExitPlanMode',
   description:
-    'Exit plan mode and submit your plan for approval. ' +
-    'Set approved: true to switch to acceptEdits mode (code changes allowed). ' +
-    'Set approved: false to revert to default mode. ' +
-    'Use this after you have finished designing your approach in plan mode.',
+    'Exit plan mode and present your plan for user approval. ' +
+    'This tool does NOT switch to implementation mode — the user must explicitly approve first. ' +
+    'After calling this, present your plan and ask the user to confirm. ' +
+    'The user can approve by saying "approved" or "/approve", or by cycling to acceptEdits mode with Shift+Tab.',
   category: 'agent',
   permission: 'auto',
   parameters: {
     type: 'object',
     properties: {
-      approved: {
-        type: 'boolean',
+      planFile: {
+        type: 'string',
         description:
-          'Whether the user approved the plan. true → switch to acceptEdits mode. false → revert to default.',
+          'Path to the plan file you wrote (e.g., .mipham/plans/plan-2026-08-10T12-00-00.md). If omitted, the most recent plan file is used.',
       },
     },
-    required: ['approved'],
+    required: [],
   },
-  async execute(params, _ctx) {
-    const approved = params.approved === true
+  async execute(params, ctx) {
+    const planDir = join(ctx.cwd, '.mipham', 'plans')
+    const planFile = (params.planFile as string) || ''
 
-    if (approved) {
-      return {
-        success: true,
-        content: [
-          '── Plan Approved ──',
-          '',
-          '✓ Exiting plan mode.',
-          '✓ Switching to acceptEdits mode — reads and file edits are auto-approved.',
-          '',
-          'You can now implement the plan. The plan file is in .mipham/plans/.',
-          '',
-          'Use Shift+Tab to cycle permission modes if you need to change.',
-        ].join('\n'),
+    // Try to read the plan to confirm it exists
+    let planContent = ''
+    try {
+      const planPath = planFile || ''
+      if (planPath) {
+        planContent = readFileSync(planPath, 'utf-8')
       }
+    } catch {
+      // Plan file not found — still exit plan mode
     }
 
     return {
       success: true,
       content: [
-        '── Plan Mode Exited ──',
+        '── Plan Ready for Review ──',
         '',
-        '✓ Returning to default permission mode.',
+        '✓ Exiting plan mode.',
+        '✓ Plan file saved. Present your plan to the user now.',
         '',
-        'No code changes were made. The plan file is preserved in .mipham/plans/.',
-        'Use EnterPlanMode again when ready to resume planning.',
+        '⚠️  IMPORTANT: You are still in limited permission mode.',
+        '    The user must explicitly approve before you can make changes.',
+        '',
+        'Next steps:',
+        '  1. Present your plan to the user (summarize key decisions)',
+        '  2. Ask: "Does this plan look good? Reply approved to begin."',
+        '  3. Wait for the user to explicitly say "approved" or "/approve"',
+        '  4. Only then switch to acceptEdits mode (Shift+Tab or user action)',
+        '',
+        'DO NOT start implementing until the user explicitly approves.',
+        'DO NOT call ExitPlanMode with approved:true — that parameter no longer exists.',
+        planContent ? `\n── Plan Content (for reference) ──\n\n${planContent.slice(0, 3000)}` : '',
       ].join('\n'),
     }
   },

package/src/tools/exec/bash.ts

@@ -185,6 +185,105 @@ export function detectViolations(stderr: string): string[] {
   return violations
 }
 
+/**
+ * Vibe coding: Parse stderr output for error locations (file path + line + column).
+ * Supports common tool formats: TypeScript, ESLint, pytest, Rust, Go, Prettier, etc.
+ * Returns up to 10 unique locations sorted by file then line.
+ */
+interface ErrorLocation {
+  file: string
+  line: number
+  col?: number
+  message?: string
+}
+
+function parseErrorLocations(stderr: string): ErrorLocation[] {
+  const locations: ErrorLocation[] = []
+
+  // TypeScript / ESLint / Prettier: path(line,col): message
+  // e.g., src/foo.ts(42,10): error TS2304: Cannot find name 'foo'
+  const tsPattern = /([^\s(]+)\((\d+),(\d+)\):\s*(.+)/g
+  let match: RegExpExecArray | null
+  let m: RegExpExecArray | null
+  while ((m = tsPattern.exec(stderr)) !== null) {
+    locations.push({
+      file: m[1]!,
+      line: parseInt(m[2]!),
+      col: parseInt(m[3]!),
+      message: (m[4] || '').slice(0, 120),
+    })
+  }
+
+  // pytest / Python: path:line: message
+  // e.g., tests/test_foo.py:42: AssertionError: ...
+  const pyPattern = /([^\s:]+\.py):(\d+):\s*(.+)/g
+  while ((match = pyPattern.exec(stderr)) !== null) {
+    const pm = match
+    locations.push({
+      file: pm[1]!,
+      line: parseInt(pm[2]!),
+      message: (pm[3] || '').slice(0, 120),
+    })
+  }
+
+  // Rust: --> path:line:col
+  // e.g., --> src/main.rs:42:10
+  const rustPattern = /-->\s*([^\s:]+):(\d+):(\d+)/g
+  while ((match = rustPattern.exec(stderr)) !== null) {
+    const rm = match
+    locations.push({
+      file: rm[1]!,
+      line: parseInt(rm[2]!),
+      col: parseInt(rm[3]!),
+    })
+  }
+
+  // Go: path:line:col: message
+  // e.g., ./main.go:42:10: undefined: foo
+  const goPattern = /([^\s:]+\.go):(\d+):(\d+):\s*(.+)/g
+  while ((match = goPattern.exec(stderr)) !== null) {
+    const gm2 = match
+    locations.push({
+      file: gm2[1]!,
+      line: parseInt(gm2[2]!),
+      col: parseInt(gm2[3]!),
+      message: (gm2[4] || '').slice(0, 120),
+    })
+  }
+
+  // Generic: path:line (any file extension)
+  // e.g., src/foo.ts:42
+  const genericPattern = /([^\s:]+\.[a-zA-Z]{1,6}):(\d+)\b/g
+  while ((match = genericPattern.exec(stderr)) !== null) {
+    const gm = match
+    const file = gm[1]!
+    // Skip if we already have this exact location from a more specific pattern
+    const alreadyHave = locations.some((l) => l.file === file && l.line === parseInt(gm[2]!))
+    if (!alreadyHave) {
+      locations.push({ file, line: parseInt(match[2]!) })
+    }
+  }
+
+  // Deduplicate and sort: same file+line → keep first
+  const seen = new Set<string>()
+  const unique: ErrorLocation[] = []
+  for (const loc of locations) {
+    const key = `${loc.file}:${loc.line}`
+    if (!seen.has(key)) {
+      seen.add(key)
+      unique.push(loc)
+    }
+  }
+
+  // Sort by file path then line number
+  unique.sort((a, b) => {
+    const fileCmp = a.file.localeCompare(b.file)
+    return fileCmp !== 0 ? fileCmp : a.line - b.line
+  })
+
+  return unique.slice(0, 10)
+}
+
 export const bashTool: ToolDefinition = {
   name: 'Bash',
   description:
@@ -283,6 +382,20 @@ export const bashTool: ToolDefinition = {
         if (violations.length > 0) {
           errorContent += '\n\n── Sandbox Violations ──\n' + violations.join('\n')
         }
+        // Vibe coding fix: auto-parse error locations from stderr
+        const errorLocations = parseErrorLocations(rawStderr)
+        if (errorLocations.length > 0) {
+          errorContent +=
+            '\n\n── Error Locations (for quick fix) ──\n' +
+            errorLocations
+              .map(
+                (l) =>
+                  `  ${l.file}:${l.line}` +
+                  (l.col ? `:${l.col}` : '') +
+                  (l.message ? ` — ${l.message}` : ''),
+              )
+              .join('\n')
+        }
         return {
           success: false,
           content: errorContent,