@miphamai/cli 0.31.0 → 0.31.1

package/bin/mipham.ts

@@ -208,8 +208,10 @@ async function runUpdate(): Promise<boolean> {
   console.log(`  Checking npm registry for latest version...`)
   console.log()
 
-  // Check latest version from npm with retry + mirror fallback
+  // Check latest version from npm with retry + mirror fallback.
+  // Track which registry responded so we can use it for the install step too.
   let latestVersion = ''
+  let workingRegistry = 'https://registry.npmjs.org/' // default
   try {
     const { execSync } = await import('node:child_process')
 
@@ -233,7 +235,10 @@ async function runUpdate(): Promise<boolean> {
           { encoding: 'utf-8', timeout: attempt.timeout, stdio: ['pipe', 'pipe', 'pipe'] },
         ).trim()
         latestVersion = result.replace(/"/g, '')
-        if (latestVersion) break
+        if (latestVersion) {
+          workingRegistry = attempt.registry
+          break
+        }
       } catch (err) {
         lastError = err instanceof Error ? err : new Error(String(err))
         // Continue to next attempt
@@ -278,7 +283,7 @@ async function runUpdate(): Promise<boolean> {
   console.log()
   console.log(`Updating ${PACKAGE} to v${latestVersion}...`)
 
-  const ok = performUpdate(latestVersion)
+  const ok = performUpdate(latestVersion, workingRegistry)
   if (!ok) {
     console.log()
     console.log(`✗ Update failed.`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.31.0",
+  "version": "0.31.1",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/shared/update.ts

@@ -139,19 +139,30 @@ function isValidSemver(v: string): boolean {
 /**
  * Perform the actual update via npm install -g.
  * Validates the version string before shell execution (prevents command injection).
+ *
+ * @param version  Target semver version (must pass isValidSemver).
+ * @param registry Optional npm registry URL — when provided the install uses it
+ *                 directly (useful when the primary registry is slow, e.g. China).
+ *                 Falls back to the npm default if omitted.
  * Returns true on success.
  */
-export function performUpdate(version: string): boolean {
+export function performUpdate(version: string, registry?: string): boolean {
   if (!isValidSemver(version)) {
     process.stderr.write(`⚠ Refusing to install invalid version: "${version}"\n`)
     return false
   }
 
+  // Sanitize registry — only allow known URLs to prevent command injection
+  const allowedRegistries = REGISTRIES.map((r) => r.url)
+  const safeRegistry = registry && allowedRegistries.includes(registry) ? registry : undefined
+
+  const registryFlag = safeRegistry ? ` --registry=${safeRegistry}` : ''
+
   try {
-    execSync(`npm install -g ${PACKAGE}@${version}`, {
+    execSync(`npm install -g ${PACKAGE}@${version}${registryFlag}`, {
       encoding: 'utf-8',
       stdio: 'inherit',
-      timeout: 120_000,
+      timeout: 600_000, // 10 min — slow networks (e.g. China → npmjs) may need 7+ min
     })
     return true
   } catch {