@miphamai/cli 0.26.0 → 0.28.0

package/src/core/crsi-sandbox.ts

@@ -0,0 +1,546 @@
+/**
+ * CRSI Phase 3: Security Sandbox for Controlled Code Self-Modification
+ *
+ * Provides a safe execution environment where AI-generated code changes
+ * are:
+ *   1. Applied in an isolated git worktree (no effect on working tree)
+ *   2. Validated against the full test suite
+ *   3. Auto-rolled back on failure
+ *   4. Gated by human approval before merging
+ *
+ * Architecture:
+ *   AI proposes change → CrsiSandbox applies in worktree → runs tests →
+ *   if pass → presents diff for human approval → if approved → merges
+ *   if fail → auto-discards worktree → logs failure for CRSI learning
+ */
+
+import { execSync } from 'node:child_process'
+import { mkdirSync, rmSync, existsSync, writeFileSync, readFileSync, readdirSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { tmpdir, homedir } from 'node:os'
+import { randomUUID } from 'node:crypto'
+
+// ── Types ──
+
+export interface CrsiModification {
+  /** Unique ID for this modification attempt */
+  id: string
+  /** Human-readable description of what this change does */
+  description: string
+  /** The file path (relative to repo root) to modify */
+  filePath: string
+  /** The file content after modification */
+  newContent: string
+  /** The original file content (for rollback verification) */
+  originalContent: string
+  /** CRSI insight that triggered this modification */
+  crsiInsightId?: string
+  /** CRSI rule that generated this modification */
+  crsiRuleId?: string
+  /** Timestamp */
+  timestamp: string
+}
+
+export interface CrsiModificationResult {
+  modification: CrsiModification
+  /** Whether the modification was applied successfully */
+  applied: boolean
+  /** Test results after applying the modification */
+  testResult?: CrsiTestResult
+  /** Git diff of the change */
+  diff?: string
+  /** Error message if something failed */
+  error?: string
+  /** Current phase of the sandbox pipeline */
+  phase: 'pending' | 'applied' | 'testing' | 'passed' | 'failed' | 'approved' | 'merged' | 'rolled-back'
+}
+
+export interface CrsiTestResult {
+  /** Whether all tests passed */
+  passed: boolean
+  /** Total test count */
+  totalTests: number
+  /** Failed test count */
+  failedTests: number
+  /** Test output (truncated) */
+  output: string
+}
+
+export interface CrsiSessionReport {
+  sessionId: string
+  modifications: CrsiModificationResult[]
+  summary: {
+    total: number
+    applied: number
+    passed: number
+    merged: number
+    rolledBack: number
+  }
+  startedAt: string
+  completedAt?: string
+}
+
+// ── Constants ──
+
+const WORKTREE_PREFIX = 'crsi-sandbox-'
+const MAX_WORKTREE_AGE_MS = 30 * 60 * 1000 // 30 minutes
+const TEST_TIMEOUT_MS = 120_000 // 2 minutes
+const REPORT_DIR = join(homedir(), '.mipham', 'crsi-sandbox')
+
+// ── Sandbox ──
+
+export class CrsiSandbox {
+  private repoRoot: string
+  private worktreePath?: string
+  private worktreeBranch?: string
+  private sessionReport: CrsiSessionReport
+  private currentModification?: CrsiModification
+
+  constructor(repoRoot: string = process.cwd()) {
+    this.repoRoot = resolve(repoRoot)
+    this.sessionReport = {
+      sessionId: `crsi-session-${Date.now().toString(36)}`,
+      modifications: [],
+      summary: { total: 0, applied: 0, passed: 0, merged: 0, rolledBack: 0 },
+      startedAt: new Date().toISOString(),
+    }
+
+    // Ensure report directory exists
+    mkdirSync(REPORT_DIR, { recursive: true })
+  }
+
+  // ── Public API ──
+
+  /**
+   * Stage 1: Create an isolated git worktree for safe modification.
+   *
+   * Creates a temporary worktree on a new branch. All subsequent
+   * modifications happen in this isolated environment — the user's
+   * working tree is never touched.
+   */
+  createWorktree(): { worktreePath: string; branch: string } {
+    // Clean up any stale worktrees from previous crashed sessions
+    this.cleanupStaleWorktrees()
+
+    const branchName = `${WORKTREE_PREFIX}${randomUUID().slice(0, 8)}`
+    const worktreeDir = join(tmpdir(), branchName)
+
+    // Ensure the dir doesn't already exist
+    if (existsSync(worktreeDir)) {
+      rmSync(worktreeDir, { recursive: true, force: true })
+    }
+
+    try {
+      execSync(`git worktree add -b "${branchName}" "${worktreeDir}" HEAD`, {
+        cwd: this.repoRoot,
+        timeout: 30_000,
+        encoding: 'utf-8',
+      })
+    } catch (err) {
+      throw new Error(`Failed to create CRSI worktree: ${String(err)}`)
+    }
+
+    this.worktreePath = worktreeDir
+    this.worktreeBranch = branchName
+
+    return { worktreePath: worktreeDir, branch: branchName }
+  }
+
+  /**
+   * Stage 2: Apply a modification in the sandbox worktree.
+   *
+   * Writes the new content to the target file inside the worktree.
+   * The modification is NOT applied to the user's working tree.
+   */
+  applyModification(mod: CrsiModification): CrsiModificationResult {
+    if (!this.worktreePath) {
+      return { modification: mod, applied: false, phase: 'pending', error: 'No worktree created. Call createWorktree() first.' }
+    }
+
+    this.sessionReport.summary.total++
+    this.currentModification = mod
+
+    const result: CrsiModificationResult = {
+      modification: mod,
+      applied: false,
+      phase: 'pending',
+    }
+
+    const targetPath = join(this.worktreePath, mod.filePath)
+
+    // Verify the file exists in the worktree
+    if (!existsSync(targetPath)) {
+      result.error = `File not found in worktree: ${mod.filePath}`
+      result.phase = 'failed'
+      this.sessionReport.modifications.push(result)
+      return result
+    }
+
+    // Verify original content matches (safety check)
+    try {
+      const currentContent = readFileSync(targetPath, 'utf-8')
+      if (currentContent !== mod.originalContent && mod.originalContent) {
+        result.error = 'Original content mismatch — file may have been modified since the audit. Aborting.'
+        result.phase = 'failed'
+        this.sessionReport.modifications.push(result)
+        return result
+      }
+    } catch {
+      // If we can't read the file, proceed anyway — it's a worktree
+    }
+
+    // Apply the modification
+    try {
+      writeFileSync(targetPath, mod.newContent, 'utf-8')
+      result.applied = true
+      result.phase = 'applied'
+      this.sessionReport.summary.applied++
+
+      // Generate diff
+      try {
+        result.diff = execSync(`git diff -- "${mod.filePath}"`, {
+          cwd: this.worktreePath,
+          timeout: 10_000,
+          encoding: 'utf-8',
+        })
+      } catch {
+        // Diff generation is best-effort
+      }
+    } catch (err) {
+      result.error = `Failed to apply modification: ${String(err)}`
+      result.phase = 'failed'
+    }
+
+    this.sessionReport.modifications.push(result)
+    return result
+  }
+
+  /**
+   * Stage 3: Run the test suite against the modified worktree.
+   *
+   * Only modifications that have been successfully applied can be tested.
+   * If tests fail, the modification is marked as 'failed' and will be
+   * rolled back.
+   */
+  runTests(): CrsiTestResult {
+    if (!this.worktreePath) {
+      return { passed: false, totalTests: 0, failedTests: 0, output: 'No worktree available.' }
+    }
+
+    const result: CrsiTestResult = { passed: false, totalTests: 0, failedTests: 0, output: '' }
+
+    try {
+      const output = execSync('pnpm test 2>&1', {
+        cwd: this.worktreePath,
+        timeout: TEST_TIMEOUT_MS,
+        encoding: 'utf-8',
+      })
+
+      result.output = output.slice(-5000) // Keep last 5000 chars
+
+      // Parse test results from vitest output
+      const testMatch = output.match(/Tests\s+(\d+)\s+passed/)
+      const failMatch = output.match(/(\d+)\s+failed/)
+      const totalMatch = output.match(/Tests\s+(\d+)\s+passed.*?(\d+)\s+total/)
+
+      if (totalMatch) {
+        result.totalTests = parseInt(totalMatch[2]!, 10)
+      }
+      if (testMatch && !failMatch) {
+        result.passed = true
+        result.failedTests = 0
+      } else if (failMatch) {
+        result.failedTests = parseInt(failMatch[1]!, 10)
+      }
+
+      // Update all pending modifications to 'testing' → 'passed'/'failed'
+      for (const modResult of this.sessionReport.modifications) {
+        if (modResult.phase === 'applied') {
+          modResult.phase = 'testing'
+          modResult.testResult = result
+        }
+        if (modResult.phase === 'testing') {
+          modResult.phase = result.passed ? 'passed' : 'failed'
+          if (result.passed) {
+            this.sessionReport.summary.passed++
+          }
+        }
+      }
+    } catch (err) {
+      result.output = String(err).slice(0, 5000)
+      result.failedTests = 1
+
+      // Mark all applied modifications as failed
+      for (const modResult of this.sessionReport.modifications) {
+        if (modResult.phase === 'applied' || modResult.phase === 'testing') {
+          modResult.phase = 'failed'
+          modResult.testResult = result
+        }
+      }
+    }
+
+    return result
+  }
+
+  /**
+   * Stage 4: Get the human-approvable diff of all modifications.
+   *
+   * Returns the full git diff so a human can review before approving.
+   */
+  getDiff(): string {
+    if (!this.worktreePath) return ''
+
+    try {
+      return execSync('git diff', {
+        cwd: this.worktreePath,
+        timeout: 10_000,
+        encoding: 'utf-8',
+      })
+    } catch {
+      return '(diff unavailable)'
+    }
+  }
+
+  /**
+   * Stage 5: Merge modifications back to the main repo.
+   *
+   * ONLY call this after human approval and successful test run.
+   * Cherry-picks the changes from the worktree branch to the current branch.
+   */
+  merge(): { success: boolean; message: string } {
+    if (!this.worktreePath || !this.worktreeBranch) {
+      return { success: false, message: 'No worktree to merge from.' }
+    }
+
+    // Check that all modifications passed tests
+    const failedCount = this.sessionReport.modifications.filter(
+      (m) => m.phase === 'failed',
+    ).length
+    if (failedCount > 0) {
+      return {
+        success: false,
+        message: `${failedCount} modification(s) failed tests. Cannot merge.`,
+      }
+    }
+
+    try {
+      // Commit in worktree
+      execSync('git add -A', { cwd: this.worktreePath, timeout: 10_000 })
+      execSync(
+        `git commit -m "CRSI auto-modification: ${this.sessionReport.sessionId}" --allow-empty`,
+        { cwd: this.worktreePath, timeout: 10_000 },
+      )
+
+      // Cherry-pick to main repo
+      const commitHash = execSync('git rev-parse HEAD', {
+        cwd: this.worktreePath,
+        timeout: 10_000,
+        encoding: 'utf-8',
+      }).trim()
+
+      execSync(`git cherry-pick "${commitHash}"`, {
+        cwd: this.repoRoot,
+        timeout: 30_000,
+      })
+
+      // Mark as merged
+      for (const modResult of this.sessionReport.modifications) {
+        if (modResult.phase === 'passed' || modResult.phase === 'approved') {
+          modResult.phase = 'merged'
+        }
+      }
+      this.sessionReport.summary.merged = this.sessionReport.modifications.filter(
+        (m) => m.phase === 'merged',
+      ).length
+
+      return {
+        success: true,
+        message: `Successfully merged ${this.sessionReport.summary.merged} modification(s).`,
+      }
+    } catch (err) {
+      return { success: false, message: `Merge failed: ${String(err)}` }
+    }
+  }
+
+  /**
+   * Stage 5-alt: Roll back all modifications.
+   *
+   * Discards the worktree and all changes. Called automatically when
+   * tests fail, or manually by the user if they reject the diff.
+   */
+  rollback(): { success: boolean; message: string } {
+    if (!this.worktreePath || !this.worktreeBranch) {
+      return { success: false, message: 'No worktree to roll back.' }
+    }
+
+    // Mark all modifications as rolled-back
+    for (const modResult of this.sessionReport.modifications) {
+      if (modResult.phase !== 'merged') {
+        modResult.phase = 'rolled-back'
+      }
+    }
+    this.sessionReport.summary.rolledBack = this.sessionReport.modifications.filter(
+      (m) => m.phase === 'rolled-back',
+    ).length
+
+    // Remove the worktree
+    this.removeWorktree()
+
+    return {
+      success: true,
+      message: `Rolled back ${this.sessionReport.summary.rolledBack} modification(s).`,
+    }
+  }
+
+  /**
+   * Clean up: remove the worktree and its branch.
+   * Safe to call at any time — does nothing if no worktree exists.
+   */
+  removeWorktree(): void {
+    if (!this.worktreePath || !this.worktreeBranch) return
+
+    try {
+      // Remove worktree
+      execSync(`git worktree remove --force "${this.worktreePath}"`, {
+        cwd: this.repoRoot,
+        timeout: 15_000,
+      })
+    } catch {
+      // Best-effort: if worktree remove fails, try manual cleanup
+      try {
+        if (existsSync(this.worktreePath)) {
+          rmSync(this.worktreePath, { recursive: true, force: true })
+        }
+        execSync(`git worktree prune`, { cwd: this.repoRoot, timeout: 10_000 })
+      } catch {
+        // Give up — stale worktrees will be cleaned up on next createWorktree()
+      }
+    }
+
+    // Delete the branch
+    try {
+      execSync(`git branch -D "${this.worktreeBranch}"`, {
+        cwd: this.repoRoot,
+        timeout: 10_000,
+      })
+    } catch {
+      // Branch may already be gone
+    }
+
+    this.worktreePath = undefined
+    this.worktreeBranch = undefined
+  }
+
+  /**
+   * Generate and persist the session report.
+   */
+  finalize(): CrsiSessionReport {
+    this.sessionReport.completedAt = new Date().toISOString()
+
+    // Persist to ~/.mipham/crsi-sandbox/
+    const reportPath = join(REPORT_DIR, `${this.sessionReport.sessionId}.json`)
+    try {
+      writeFileSync(reportPath, JSON.stringify(this.sessionReport, null, 2), 'utf-8')
+    } catch {
+      // Best-effort persistence
+    }
+
+    // Clean up worktree
+    this.removeWorktree()
+
+    return this.sessionReport
+  }
+
+  /**
+   * Get the current session report (for live status checks).
+   */
+  getReport(): CrsiSessionReport {
+    return this.sessionReport
+  }
+
+  /**
+   * Load a historical session report.
+   */
+  static loadReport(sessionId: string): CrsiSessionReport | null {
+    const reportPath = join(REPORT_DIR, `${sessionId}.json`)
+    if (!existsSync(reportPath)) return null
+    try {
+      return JSON.parse(readFileSync(reportPath, 'utf-8'))
+    } catch {
+      return null
+    }
+  }
+
+  /**
+   * List all session reports.
+   */
+  static listReports(): string[] {
+    if (!existsSync(REPORT_DIR)) return []
+    try {
+      return readdirSync(REPORT_DIR)
+        .filter((f: string) => f.endsWith('.json'))
+        .map((f: string) => f.replace('.json', ''))
+    } catch {
+      return []
+    }
+  }
+
+  // ── Private Helpers ──
+
+  /**
+   * Remove stale worktrees from previous sessions that may have crashed
+   * before cleanup.
+   */
+  private cleanupStaleWorktrees(): void {
+    try {
+      const listOutput = execSync('git worktree list --porcelain', {
+        cwd: this.repoRoot,
+        timeout: 10_000,
+        encoding: 'utf-8',
+      })
+
+      const worktrees = this.parseWorktreeList(listOutput)
+
+      for (const wt of worktrees) {
+        // Only clean up CRSI sandbox worktrees
+        if (!wt.branch.includes(WORKTREE_PREFIX)) continue
+
+        // Check if the worktree path still exists
+        if (!existsSync(wt.path)) {
+          // Stale entry — prune it
+          try {
+            execSync(`git worktree prune`, { cwd: this.repoRoot, timeout: 5_000 })
+            execSync(`git branch -D "${wt.branch}"`, { cwd: this.repoRoot, timeout: 5_000 })
+          } catch {
+            // Best-effort cleanup
+          }
+        }
+      }
+    } catch {
+      // Not a git repo or worktree command failed — skip cleanup
+    }
+  }
+
+  private parseWorktreeList(output: string): Array<{ path: string; branch: string }> {
+    const worktrees: Array<{ path: string; branch: string }> = []
+    let current: { path?: string; branch?: string } = {}
+
+    for (const line of output.split('\n')) {
+      if (line.startsWith('worktree ')) {
+        if (current.path && current.branch) {
+          worktrees.push({ path: current.path, branch: current.branch })
+        }
+        current = { path: line.slice('worktree '.length) }
+      }
+      if (line.startsWith('branch ')) {
+        current.branch = line.slice('branch '.length).replace('refs/heads/', '')
+      }
+    }
+
+    if (current.path && current.branch) {
+      worktrees.push({ path: current.path, branch: current.branch })
+    }
+
+    return worktrees
+  }
+}

package/src/core/engine.ts

@@ -14,6 +14,7 @@ import type { ArtifactServer } from '../artifacts/server'
 import type { AgentRegistry } from '../agent/agent-registry'
 import { analyzeForMemory } from './memory/memory-writer'
 import { getMemoryManager } from './memory/memory-loader'
+import { AutoMemoryEngine } from './auto-memory.js'
 import type { AgentViewManager } from '../agent-view/agent-view-manager'
 import type { SkillsLoader } from '../skills/loader'
 import { getBackgroundAgentRegistry } from '../agent/background-registry'
@@ -45,6 +46,7 @@ export class QueryEngine {
   private ruleEngine?: ExperienceRuleEngine
   private _patternAnalyzer?: PatternAnalyzer
   private _effectivenessTracker?: EffectivenessTracker
+  private _autoMemory?: AutoMemoryEngine
   private goal?: string
   private maxGoalLoops = 20
   private lastAssistantContent?: string
@@ -1017,6 +1019,24 @@ export class QueryEngine {
     return this._effectivenessTracker
   }
 
+  /**
+   * CRSI Phase 2: Lazily-initialized AutoMemoryEngine singleton.
+   * Wires the CRSI Phase 1 pipeline (PatternAnalyzer, RuleEngine, EffectivenessTracker)
+   * into the auto-reflection engine so that post-turn insights can feed rule generation.
+   */
+  getAutoMemory(): AutoMemoryEngine {
+    if (!this._autoMemory) {
+      this._autoMemory = new AutoMemoryEngine()
+      // Wire CRSI Phase 1 → Phase 2 bridge
+      this._autoMemory.setCrsiPipeline(
+        this.getPatternAnalyzer(),
+        this.getRuleEngine() || new ExperienceRuleEngine(),
+        this.getEffectivenessTracker(),
+      )
+    }
+    return this._autoMemory
+  }
+
   /** Register a tool dynamically (used by MCP auto-registration). */
   registerTool(tool: ToolDefinition): void {
     if (this.tools.has(tool.name)) {

package/src/core/permission.ts

@@ -9,6 +9,53 @@ import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchBashRule, compileRule } from './permission-rules'
 import { loadPermissionConfig, nextMode, clampMode, MODE_CYCLE } from './permission-config'
 
+/**
+ * Check if a Bash command is a "verification-only" command that should be
+ * auto-approved in acceptEdits mode. These are non-destructive read/check
+ * operations that form the core of the vibe coding edit→test→fix loop.
+ */
+function isVerificationCommand(input: Record<string, unknown>): boolean {
+  const cmd = (input.command as string) || ''
+  // Patterns for verification-only commands (no side effects on codebase)
+  const verifyPatterns = [
+    /\bpnpm\s+test\b/, // test runner
+    /\bpnpm\s+t\b/, // shorthand test
+    /\bpnpm\s+typecheck\b/, // type checking
+    /\bpnpm\s+lint\b/, // linting
+    /\bpnpm\s+format:check\b/, // format check
+    /\bnpm\s+test\b/, // npm test
+    /\bnpm\s+run\s+test\b/, // npm run test
+    /\bvitest\b/, // vitest runner
+    /\bjest\b/, // jest runner
+    /\btsc\s+(?!init)/, // TypeScript compiler (not tsc init)
+    /\btsc\s+--noEmit\b/, // type check only
+    /\beslint\b/, // eslint
+    /\bprettier\s+--check\b/, // prettier check
+    /\bpytest\b/, // python test runner
+    /\bruff\s+check\b/, // python linter
+    /\bcargo\s+test\b/, // rust test
+    /\bcargo\s+check\b/, // rust check
+    /\bgo\s+test\b/, // go test
+    /\bgo\s+vet\b/, // go vet
+    /\bmake\s+test\b/, // make test
+    /\bgit\s+status\b/, // git status (read-only)
+    /\bgit\s+diff\b/, // git diff (read-only)
+    /\bgit\s+log\b/, // git log (read-only)
+    /\bgit\s+branch\b/, // git branch (read-only)
+    /\bls\b/, // list files
+    /\bcat\b/, // read file
+    /\bhead\b/, // read file start
+    /\btail\b/, // read file end
+    /\bwhich\b/, // find binary
+    /\becho\b/, // print text
+    /\bnode\s+-v\b/, // node version
+    /\bpython\s+--version\b/, // python version
+    /\bwhoami\b/, // current user
+    /\bpwd\b/, // current directory
+  ]
+  return verifyPatterns.some((p) => p.test(cmd))
+}
+
 const VALID_MODES: Set<string> = new Set<string>(MODE_CYCLE)
 
 export class PermissionSystem {
@@ -276,7 +323,7 @@ export class PermissionSystem {
     }
 
     // 5. Mode baseline
-    const baseline = this.modeBaseline(tool)
+    const baseline = this.modeBaseline(tool, input)
     if (baseline !== 'mode-baseline') {
       this.checkCache.set(cacheKey, baseline)
       return baseline
@@ -323,21 +370,29 @@ export class PermissionSystem {
     return rule.pattern === tool.name || rule.compiled.test(tool.name)
   }
 
-  private modeBaseline(tool: ToolDefinition): PermissionLevel | 'mode-baseline' {
+  private modeBaseline(
+    tool: ToolDefinition,
+    input?: Record<string, unknown>,
+  ): PermissionLevel | 'mode-baseline' {
     switch (this.mode) {
       case 'default':
         // Delegate to tool.permission (backward compat)
         return 'mode-baseline'
 
       case 'acceptEdits':
-        // Reads + file edits free; Bash requires approval
-        return tool.category === 'file'
-          ? ['Bash'].includes(tool.name)
-            ? 'ask'
-            : 'bypass'
-          : tool.name === 'Bash'
-            ? 'ask'
-            : 'ask'
+        // Reads + file edits free; Bash auto-approved for verification commands
+        if (tool.category === 'file' && tool.name !== 'Bash') {
+          return 'bypass'
+        }
+        if (tool.name === 'Bash') {
+          // Vibe coding fix: auto-approve verification commands
+          // so the edit→test→fix loop isn't interrupted by permission prompts
+          if (input && isVerificationCommand(input)) {
+            return 'bypass'
+          }
+          return 'ask'
+        }
+        return 'ask'
 
       case 'plan':
         // Only reads, no writes or executes

package/src/tools/agent/enter-plan.ts

@@ -80,12 +80,12 @@ export const enterPlanModeTool: ToolDefinition = {
         '  ⚠️  All other tools — require confirmation',
         '',
         'Design your approach, explore the codebase, then:',
-        '  • Use ExitPlanMode to submit your plan for approval',
-        '  • The user will review and approve before code changes begin',
+        '  • Use ExitPlanMode to submit your plan for user review',
+        '  • Present your plan and ask for explicit approval',
+        '  • The user must say "approved" before you switch to acceptEdits mode',
         '',
-        'ExitPlanMode parameters:',
-        '  approved: true → switch to acceptEdits mode (code changes allowed)',
-        '  approved: false → revert to default mode',
+        '⚠️  You CANNOT self-approve your plan. The user must explicitly confirm.',
+        '    After ExitPlanMode, wait for user approval before making code changes.',
       ].join('\n'),
     }
   },