@miphamai/cli 0.31.0 → 0.32.0

package/src/index.tsx

@@ -47,6 +47,13 @@ import enUS from './i18n-core/locales/en-US.json' with { type: 'json' }
 import zhCN from './i18n-core/locales/zh-CN.json' with { type: 'json' }
 import type { TranslationMap } from './i18n-core/types'
 
+// Locale bundles — defined at module level so the remote-attach branch can
+// reference them before the full bootstrap path runs.
+const localeBundles: Record<string, TranslationMap> = {
+  'en-US': enUS as TranslationMap,
+  'zh-CN': zhCN as TranslationMap,
+}
+
 interface RunOptions {
   model?: string
   provider?: string
@@ -54,6 +61,8 @@ interface RunOptions {
   permission?: string
   resume?: string
   version?: string
+  /** When set, launch TUI in remote mode connected to a daemon session. */
+  remoteSession?: { sessionId: string; port: number; token: string }
 }
 
 /**
@@ -183,6 +192,41 @@ export async function runApp(options: RunOptions): Promise<void> {
   // ── Workspace Trust Check ──
   await checkWorkspaceTrust()
 
+  // ── Remote attach mode ──────────────────────────────────────────────────
+  // When the TUI is launched via `mipham attach`, skip the entire local
+  // engine bootstrap and connect to the daemon via WebSocket instead.
+  if (options.remoteSession) {
+    const { RemoteEngine } = await import('./daemon/remote-engine')
+    const engine = new RemoteEngine(options.remoteSession)
+
+    // Detect locale and create translation function (same as local path)
+    const locale = detectLocale({ lang: options.lang })
+    const t = createT(localeBundles[locale] || enUS, enUS)
+
+    // Set terminal window title
+    process.stdout.write('\x1b]0;Mipham Code\x07')
+
+    const { waitUntilExit } = render(
+      React.createElement(I18nProvider, {
+        locale,
+        t,
+        children: React.createElement(App, {
+          engine,
+          config: {} as MiphamConfig,
+          initialProvider: 'remote',
+          initialModel: 'remote',
+          version: options.version,
+          sessionId: options.remoteSession.sessionId,
+        }),
+      }),
+    )
+    await waitUntilExit()
+
+    // Close the WebSocket connection on the way out
+    engine.close()
+    return
+  }
+
   // Handle `mipham agents` subcommand — launch standalone dashboard
   const args = process.argv.slice(2)
   if (args[0] === 'agents') {
@@ -208,10 +252,6 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   // Detect locale and create translation function
   const locale = detectLocale({ lang: options.lang })
-  const localeBundles: Record<string, TranslationMap> = {
-    'en-US': enUS as TranslationMap,
-    'zh-CN': zhCN as TranslationMap,
-  }
   const t = createT(localeBundles[locale] || enUS, enUS)
 
   // Bootstrap providers

package/src/shared/update.ts

@@ -139,19 +139,30 @@ function isValidSemver(v: string): boolean {
 /**
  * Perform the actual update via npm install -g.
  * Validates the version string before shell execution (prevents command injection).
+ *
+ * @param version  Target semver version (must pass isValidSemver).
+ * @param registry Optional npm registry URL — when provided the install uses it
+ *                 directly (useful when the primary registry is slow, e.g. China).
+ *                 Falls back to the npm default if omitted.
  * Returns true on success.
  */
-export function performUpdate(version: string): boolean {
+export function performUpdate(version: string, registry?: string): boolean {
   if (!isValidSemver(version)) {
     process.stderr.write(`⚠ Refusing to install invalid version: "${version}"\n`)
     return false
   }
 
+  // Sanitize registry — only allow known URLs to prevent command injection
+  const allowedRegistries = REGISTRIES.map((r) => r.url)
+  const safeRegistry = registry && allowedRegistries.includes(registry) ? registry : undefined
+
+  const registryFlag = safeRegistry ? ` --registry=${safeRegistry}` : ''
+
   try {
-    execSync(`npm install -g ${PACKAGE}@${version}`, {
+    execSync(`npm install -g ${PACKAGE}@${version}${registryFlag}`, {
       encoding: 'utf-8',
       stdio: 'inherit',
-      timeout: 120_000,
+      timeout: 600_000, // 10 min — slow networks (e.g. China → npmjs) may need 7+ min
     })
     return true
   } catch {

package/src/ui/app.tsx

@@ -3,6 +3,7 @@ import { Box, Text, useInput } from 'ink'
 import TextInput from 'ink-text-input'
 import { readFileSync } from 'node:fs'
 import type { QueryEngine } from '../core/engine'
+import type { RemoteEngine } from '../daemon/remote-engine'
 import type { MiphamConfig } from '../shared/index.ts'
 import type { SkillsLoader } from '../skills/loader'
 import type { PluginManager } from '../plugin/plugin-manager'
@@ -29,7 +30,7 @@ import type { PermissionMode } from '../shared/index.ts'
 import { sanitizeForDisplay } from '../shared/sanitize.ts'
 
 interface AppProps {
-  engine: QueryEngine
+  engine: QueryEngine | RemoteEngine
   config: MiphamConfig
   initialProvider?: string
   initialModel?: string
@@ -265,7 +266,10 @@ export function App({
 
   const mkCtx = useCallback(
     (): CommandContext => ({
-      engine,
+      // In remote attach mode, RemoteEngine provides stub methods for all the
+      // QueryEngine APIs that slash commands need. The cast is safe because
+      // stubs cover every method that CommandContext consumers call.
+      engine: engine as QueryEngine,
       config,
       providerId,
       modelId,