@miphamai/cli 0.4.0 → 0.5.0

package/src/core/permission.ts

@@ -1,61 +1,127 @@
 import type {
   ToolDefinition,
-  ToolPermission,
+  PermissionMode,
   PermissionLevel,
   PermissionRule,
 } from '../shared/index.ts'
+import type { PermissionRuleEntry } from '../shared/index.ts'
+import { matchBashRule, compileRule } from './permission-rules'
+import { loadPermissionConfig, nextMode, MODE_CYCLE } from './permission-config'
+
+const VALID_MODES: Set<string> = new Set<string>(MODE_CYCLE)
 
 export class PermissionSystem {
-  private rules = new Map<string, PermissionLevel>()
-  private patternRules: Array<{ pattern: RegExp; level: PermissionLevel }> = []
+  private allowRules: PermissionRuleEntry[] = []
+  private denyRules: PermissionRuleEntry[] = []
+  private askRules: PermissionRuleEntry[] = []
+  /** Legacy exact-name rules for backward compat (set via setRule with 'auto' level). */
+  private legacyRules = new Map<string, PermissionLevel>()
+  /** Legacy default level from constructor when passed non-mode values like 'ask' or 'bypass'. */
+  private legacyDefaultFallback: PermissionLevel | null = null
+  private mode: PermissionMode = 'default'
 
-  constructor(private defaultLevel: ToolPermission = 'auto') {}
+  constructor(modeOrLevel: PermissionLevel = 'default') {
+    if (VALID_MODES.has(modeOrLevel)) {
+      this.mode = modeOrLevel as PermissionMode
+    } else {
+      // Legacy values ('ask', 'bypass') → store as fallback, use 'default' mode
+      this.mode = 'default'
+      this.legacyDefaultFallback = modeOrLevel
+    }
+  }
 
-  setDefaultLevel(level: PermissionLevel): void {
-    this.defaultLevel = level
+  // ── Mode management ──
+
+  setMode(mode: PermissionMode): void {
+    this.mode = mode
   }
 
-  getDefaultLevel(): PermissionLevel {
-    return this.defaultLevel
+  getMode(): PermissionMode {
+    return this.mode
   }
 
-  setRule(toolNameOrRule: string | PermissionRule, level?: PermissionLevel): void {
-    if (typeof toolNameOrRule === 'string') {
-      if (level) this.rules.set(toolNameOrRule, level)
-    } else {
-      const rule = toolNameOrRule
-      if (rule.pattern) {
-        this.patternRules.push({ pattern: new RegExp(rule.pattern), level: rule.level })
-      } else {
-        this.rules.set(rule.toolName, rule.level)
-      }
-    }
+  cycleMode(): PermissionMode {
+    this.mode = nextMode(this.mode)
+    return this.mode
   }
 
-  removeRule(toolName: string): void {
-    this.rules.delete(toolName)
+  // ── Rule management ──
+
+  allow(rule: string): void {
+    this.allowRules.push(compileRule(rule, 'allow'))
+  }
+
+  deny(rule: string): void {
+    this.denyRules.push(compileRule(rule, 'deny'))
   }
 
+  ask(rule: string): void {
+    this.askRules.push(compileRule(rule, 'ask'))
+  }
+
+  loadConfig(raw: { mode?: string; allow?: string[]; deny?: string[] }): void {
+    const config = loadPermissionConfig(
+      raw as Partial<{ mode: PermissionMode; allow: string[]; deny: string[] }>,
+    )
+    this.mode = config.mode
+
+    this.allowRules = []
+    this.denyRules = []
+    this.askRules = []
+
+    for (const rule of config.allow) {
+      this.allowRules.push(compileRule(rule, 'allow'))
+    }
+    for (const rule of config.deny) {
+      this.denyRules.push(compileRule(rule, 'deny'))
+    }
+  }
+
+  // ── Permission check ──
+
   /**
-   * Resolve permission level for a tool call.
-   *
-   * Fallback chain: exact rule → pattern rule → tool permission → system default
+   * Resolution chain (first match wins):
+   * 1. Deny rules → block
+   * 2. Ask rules → require approval
+   * 3. Allow rules → permit
+   * 4. Legacy exact-name rules (backward compat — e.g. setRule('tool', 'auto'))
+   * 5. Mode baseline → mode-specific default (overrides tool.permission for explicit modes)
+   * 6. Tool's own permission → tool-specific default (backward compat)
+   * 7. Legacy constructor fallback (when constructed with 'ask'/'bypass')
+   * 8. System default → 'ask'
    */
-  check(tool: ToolDefinition, _input: Record<string, unknown>): PermissionLevel {
-    // 1. Exact-name rule wins
-    const ruleLevel = this.rules.get(tool.name)
-    if (ruleLevel) return ruleLevel
-
-    // 2. Pattern-based rules (e.g. "file_*" → bypass)
-    for (const { pattern, level } of this.patternRules) {
-      if (pattern.test(tool.name)) return level
+  check(tool: ToolDefinition, input: Record<string, unknown>): PermissionLevel {
+    // 1. Check deny rules (always win)
+    for (const rule of this.denyRules) {
+      if (this.ruleMatches(rule, tool, input)) return 'ask'
     }
 
-    // 3. Tool's own permission level
+    // 2. Check ask rules
+    for (const rule of this.askRules) {
+      if (this.ruleMatches(rule, tool, input)) return 'ask'
+    }
+
+    // 3. Check allow rules
+    for (const rule of this.allowRules) {
+      if (this.ruleMatches(rule, tool, input)) return 'bypass'
+    }
+
+    // 4. Legacy exact-name rules (backward compat)
+    const legacyLevel = this.legacyRules.get(tool.name)
+    if (legacyLevel !== undefined) return legacyLevel
+
+    // 5. Mode baseline
+    const baseline = this.modeBaseline(tool)
+    if (baseline !== 'mode-baseline') return baseline
+
+    // 6. Tool's own permission level (backward compat fallback)
     if (tool.permission) return tool.permission
 
-    // 4. System default
-    return this.defaultLevel
+    // 7. Legacy constructor fallback
+    if (this.legacyDefaultFallback) return this.legacyDefaultFallback
+
+    // 8. System default
+    return 'ask'
   }
 
   needsApproval(tool: ToolDefinition, input: Record<string, unknown>): boolean {
@@ -66,8 +132,127 @@ export class PermissionSystem {
     return this.check(tool, input) === 'bypass'
   }
 
+  // ── Helpers ──
+
+  private ruleMatches(
+    rule: PermissionRuleEntry,
+    tool: ToolDefinition,
+    input: Record<string, unknown>,
+  ): boolean {
+    // Try Bash-style matching first
+    if (rule.pattern.includes('(')) {
+      return matchBashRule(rule.pattern, tool.name, input)
+    }
+    // Simple tool name match
+    return rule.pattern === tool.name || rule.compiled.test(tool.name)
+  }
+
+  private modeBaseline(tool: ToolDefinition): PermissionLevel | 'mode-baseline' {
+    switch (this.mode) {
+      case 'default':
+        // Delegate to tool.permission (backward compat)
+        return 'mode-baseline'
+
+      case 'acceptEdits':
+        // Reads + file edits free; Bash requires approval
+        return tool.category === 'file'
+          ? ['Bash'].includes(tool.name)
+            ? 'ask'
+            : 'bypass'
+          : tool.name === 'Bash'
+            ? 'ask'
+            : 'ask'
+
+      case 'plan':
+        // Only reads, no writes or executes
+        return tool.category === 'file' && ['Read', 'Grep', 'Glob'].includes(tool.name)
+          ? 'bypass'
+          : 'ask'
+
+      case 'auto':
+        // Respect tool-level permissions; safety checks handled by hook layer
+        return 'mode-baseline'
+
+      case 'dontAsk':
+        // Only allowlisted tools free (already handled above); everything else requires approval
+        return 'ask'
+
+      case 'bypassPermissions':
+        return 'bypass'
+
+      default:
+        return 'mode-baseline'
+    }
+  }
+
+  // ── Legacy compatibility ──
+
+  setDefaultLevel(level: PermissionLevel): void {
+    // Map legacy 3-level to new mode
+    if (level === 'auto') this.mode = 'auto'
+    else if (level === 'bypass') this.mode = 'bypassPermissions'
+    else this.mode = 'default'
+  }
+
+  getDefaultLevel(): PermissionLevel {
+    // Legacy constructor fallback takes priority
+    if (this.legacyDefaultFallback) return this.legacyDefaultFallback
+    if (this.mode === 'auto' || this.mode === 'bypassPermissions' || this.mode === 'dontAsk')
+      return 'bypass'
+    if (this.mode === 'plan') return 'ask'
+    return 'auto'
+  }
+
+  setRule(toolNameOrRule: string | PermissionRule, level?: PermissionLevel): void {
+    if (typeof toolNameOrRule === 'string') {
+      const toolName = toolNameOrRule
+      // Remove old entries for this tool
+      this.removeRuleFromArrays(toolName)
+      if (level !== undefined) {
+        this.legacyRules.set(toolName, level)
+        // Also sync to new-style arrays for listRules / new API consistency
+        if (level === 'bypass') this.allow(toolName)
+        else if (level === 'ask') this.ask(toolName)
+        // 'auto' is stored only in legacyRules (returns 'auto', not 'bypass')
+      }
+    } else {
+      const rule = toolNameOrRule
+      if (rule.pattern) {
+        const entry = compileRule(rule.pattern, rule.level === 'bypass' ? 'allow' : 'ask')
+        if (rule.level === 'bypass') this.allowRules.push(entry)
+        else this.askRules.push(entry)
+      } else {
+        this.removeRuleFromArrays(rule.toolName)
+        this.legacyRules.set(rule.toolName, rule.level)
+        if (rule.level === 'bypass') this.allow(rule.toolName)
+        else if (rule.level === 'ask') this.ask(rule.toolName)
+      }
+    }
+  }
+
+  removeRule(toolName: string): void {
+    this.legacyRules.delete(toolName)
+    this.removeRuleFromArrays(toolName)
+  }
+
+  private removeRuleFromArrays(toolName: string): void {
+    this.allowRules = this.allowRules.filter((r) => r.pattern !== toolName)
+    this.denyRules = this.denyRules.filter((r) => r.pattern !== toolName)
+    this.askRules = this.askRules.filter((r) => r.pattern !== toolName)
+  }
+
   listRules(): Map<string, PermissionLevel> {
-    return new Map(this.rules)
+    const map = new Map<string, PermissionLevel>(this.legacyRules)
+    for (const r of this.allowRules) {
+      if (!map.has(r.pattern)) map.set(r.pattern, 'bypass')
+    }
+    for (const r of this.denyRules) {
+      if (!map.has(r.pattern)) map.set(r.pattern, 'ask')
+    }
+    for (const r of this.askRules) {
+      if (!map.has(r.pattern)) map.set(r.pattern, 'ask')
+    }
+    return map
   }
 
   getByCategory(

package/src/index.tsx

@@ -13,6 +13,8 @@ import { McpClient } from './mcp/client'
 import { HookEngine } from './core/hooks'
 import { ArtifactServer } from './artifacts/server'
 import { ARTIFACTS_DIR, ARTIFACT_PORT, MIPHAM_DIR } from './shared/constants'
+import { AgentViewManager } from './agent-view/agent-view-manager'
+import { AgentViewDashboard } from './agent-view/dashboard'
 
 interface RunOptions {
   model?: string
@@ -23,6 +25,23 @@ interface RunOptions {
 }
 
 export async function runApp(options: RunOptions): Promise<void> {
+  // Handle `mipham agents` subcommand — launch standalone dashboard
+  const args = process.argv.slice(2)
+  if (args[0] === 'agents') {
+    const agentViewManager = new AgentViewManager()
+    const { waitUntilExit } = render(
+      <AgentViewDashboard
+        manager={agentViewManager}
+        onAttach={() => {}}
+        onExit={() => process.exit(0)}
+      />,
+    )
+    await waitUntilExit()
+    process.exit(0)
+  }
+
+  // Create AgentViewManager for the full app (shared across the session)
+  const agentViewManager = new AgentViewManager()
   // Set terminal window title
   process.stdout.write('\x1b]0;Mipham Code\x07')
 
@@ -94,6 +113,7 @@ export async function runApp(options: RunOptions): Promise<void> {
   const engine = new QueryEngine(registry, context, tools)
   engine.setHookEngine(hookEngine)
   engine.setArtifactServer(artifactServer)
+  engine.setAgentViewManager(agentViewManager)
   engine.setupContextSummarizer()
 
   // Auto-save session on exit

package/src/plugin/plugin-loader.ts

@@ -0,0 +1,36 @@
+import type { PluginManager } from './plugin-manager'
+import { join } from 'node:path'
+import { existsSync } from 'node:fs'
+
+export function loadPlugins(
+  pluginManager: PluginManager,
+  engine: unknown,
+  skillsLoader: unknown,
+): void {
+  for (const plugin of pluginManager.getEnabled()) {
+    // Load custom agents
+    const agentsDir = join(plugin.path, 'agents')
+    if (existsSync(agentsDir)) {
+      // → register with AgentRegistry
+    }
+
+    // Load custom skills
+    const skillsDir = join(plugin.path, 'skills')
+    if (existsSync(skillsDir)) {
+      // → register with SkillsLoader
+    }
+
+    // Load MCP servers
+    const mcpDir = join(plugin.path, 'mcp-servers')
+    if (existsSync(mcpDir)) {
+      // → register MCP configs
+    }
+
+    // Load hooks
+    // → parse plugin.json hooks → register with HookEngine
+  }
+
+  // Suppress unused parameter warnings — these are wiring stubs for future phases
+  void engine
+  void skillsLoader
+}

package/src/plugin/plugin-manager.ts

@@ -0,0 +1,125 @@
+import { mkdirSync, existsSync, writeFileSync, readFileSync, readdirSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+import { validatePlugin } from './plugin-validator'
+
+const PLUGIN_DIR = join(homedir(), '.mipham', 'plugins')
+
+export interface InstalledPlugin {
+  name: string
+  version: string
+  path: string
+  enabled: boolean
+  installedAt: string
+}
+
+export class PluginManager {
+  private plugins: InstalledPlugin[] = []
+  private pluginDir: string
+  private statePath: string
+
+  constructor(pluginDir?: string) {
+    this.pluginDir = pluginDir ?? PLUGIN_DIR
+    mkdirSync(this.pluginDir, { recursive: true })
+    this.statePath = join(this.pluginDir, 'state.json')
+    this.loadState()
+  }
+
+  install(sourcePath: string): { success: boolean; message: string } {
+    const validation = validatePlugin(sourcePath)
+    if (!validation.valid || !validation.manifest) {
+      return { success: false, message: validation.errors.join('; ') }
+    }
+
+    const destDir = join(this.pluginDir, validation.manifest.name)
+    if (existsSync(destDir)) {
+      return {
+        success: false,
+        message: `Plugin "${validation.manifest.name}" is already installed`,
+      }
+    }
+
+    // Copy plugin directory
+    mkdirSync(destDir, { recursive: true })
+    this.copyDir(sourcePath, destDir)
+
+    this.plugins.push({
+      name: validation.manifest.name,
+      version: validation.manifest.version,
+      path: destDir,
+      enabled: true,
+      installedAt: new Date().toISOString(),
+    })
+
+    this.saveState()
+    return {
+      success: true,
+      message: `Plugin "${validation.manifest.name}" v${validation.manifest.version} installed`,
+    }
+  }
+
+  list(): InstalledPlugin[] {
+    return [...this.plugins]
+  }
+
+  remove(name: string): boolean {
+    const plugin = this.plugins.find((p) => p.name === name)
+    if (!plugin) return false
+    try {
+      rmSync(plugin.path, { recursive: true, force: true })
+    } catch {
+      // Directory may already be gone — that's fine
+    }
+    this.plugins = this.plugins.filter((p) => p.name !== name)
+    this.saveState()
+    return true
+  }
+
+  enable(name: string): boolean {
+    const p = this.plugins.find((p) => p.name === name)
+    if (!p) return false
+    p.enabled = true
+    this.saveState()
+    return true
+  }
+
+  disable(name: string): boolean {
+    const p = this.plugins.find((p) => p.name === name)
+    if (!p) return false
+    p.enabled = false
+    this.saveState()
+    return true
+  }
+
+  getEnabled(): InstalledPlugin[] {
+    return this.plugins.filter((p) => p.enabled)
+  }
+
+  private copyDir(src: string, dest: string): void {
+    mkdirSync(dest, { recursive: true })
+    for (const entry of readdirSync(src, { withFileTypes: true })) {
+      const srcPath = join(src, entry.name)
+      const destPath = join(dest, entry.name)
+      if (entry.isDirectory()) {
+        this.copyDir(srcPath, destPath)
+      } else {
+        const content = readFileSync(srcPath)
+        writeFileSync(destPath, content)
+      }
+    }
+  }
+
+  private loadState(): void {
+    try {
+      if (existsSync(this.statePath)) {
+        this.plugins = JSON.parse(readFileSync(this.statePath, 'utf-8'))
+      }
+    } catch {
+      this.plugins = []
+    }
+  }
+
+  private saveState(): void {
+    writeFileSync(this.statePath, JSON.stringify(this.plugins, null, 2), 'utf-8')
+  }
+}

package/src/plugin/plugin-validator.ts

@@ -0,0 +1,41 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+export interface PluginManifest {
+  name: string
+  version: string
+  miphamVersion?: string
+  hooks?: Record<string, unknown>
+}
+
+export function validatePlugin(dir: string): {
+  valid: boolean
+  errors: string[]
+  manifest?: PluginManifest
+} {
+  const errors: string[] = []
+
+  try {
+    const raw = readFileSync(join(dir, 'plugin.json'), 'utf-8')
+    const manifest = JSON.parse(raw) as PluginManifest
+
+    if (!manifest.name || !/^[a-z0-9-]+$/.test(manifest.name)) {
+      errors.push('Invalid plugin name: must be lowercase alphanumeric with hyphens')
+    }
+    if (!manifest.version) {
+      errors.push('Missing required field: version')
+    }
+
+    // Check for suspicious hooks
+    if (manifest.hooks) {
+      const hooksStr = JSON.stringify(manifest.hooks)
+      if (hooksStr.includes('rm -rf') || hooksStr.includes('curl') || hooksStr.includes('eval')) {
+        errors.push('Suspicious hook commands detected — manual review required')
+      }
+    }
+
+    return { valid: errors.length === 0, errors, manifest }
+  } catch (err) {
+    return { valid: false, errors: [`Failed to read plugin.json: ${String(err)}`] }
+  }
+}

package/src/shared/types.ts

@@ -59,7 +59,9 @@ export interface ToolContext {
   model: string
   skillsLoader?: import('../skills/loader').SkillsLoader
   registry?: import('../providers/registry').ProviderRegistry
+  toolRegistry?: Map<string, ToolDefinition>
   artifactServer?: import('../artifacts/server').ArtifactServer
+  agentRegistry?: import('../agent/agent-registry').AgentRegistry
 }
 
 // ── Artifact Types ──
@@ -131,6 +133,16 @@ export interface SkillDefinition {
   tools?: ToolDefinition[]
   hooks?: HookDefinition[]
   prompts?: Record<string, string>
+  /** Frontmatter: 'fork' means execute in isolated subagent, undefined means inline */
+  context?: string
+  /** Model override for fork execution */
+  model?: string
+  /** Tool whitelist for fork mode */
+  allowedTools?: string[]
+  /** When true, the skill is NOT shown in system-reminder for AI auto-triggering */
+  disableModelInvocation?: boolean
+  /** When true, users can invoke this skill directly via /<name> */
+  userInvocable?: boolean
 }
 
 // ── Hook Types ──
@@ -140,6 +152,25 @@ export type HookEvent =
   | 'SessionStart'
   | 'SessionEnd'
   | 'Notification'
+  | 'Stop'
+  | 'UserPromptSubmit'
+  | 'PreCompact'
+  | 'PostCompact'
+  | 'ConfigChange'
+
+export type HookType = 'command' | 'http' | 'code' | 'mcp_tool'
+
+export interface HookConfig {
+  type: HookType
+  command?: string
+  args?: string[]
+  url?: string
+  method?: 'GET' | 'POST'
+  headers?: Record<string, string>
+  mcpServer?: string
+  mcpTool?: string
+  continueOnBlock?: boolean
+}
 
 export interface HookDefinition {
   event: HookEvent
@@ -153,12 +184,19 @@ export interface HookContext {
   toolInput?: Record<string, unknown>
   toolResult?: ToolResult
   sessionId: string
+  userPrompt?: string
+  configKey?: string
+  configValue?: unknown
 }
 
 export interface HookResult {
   allowed: boolean
   reason?: string
   modifiedInput?: Record<string, unknown>
+  decision?: 'allow' | 'block'
+  permissionDecision?: 'allow' | 'deny' | 'ask' | 'defer'
+  additionalContext?: string
+  updatedOutput?: string
 }
 
 // ── Instruction Types ──
@@ -172,7 +210,29 @@ export interface InstructionFile {
 }
 
 // ── Permission Types ──
-export type PermissionLevel = 'auto' | 'ask' | 'bypass'
+/** Six explicit permission modes matching Claude Code's permission architecture */
+export type PermissionMode =
+  | 'default'
+  | 'acceptEdits'
+  | 'plan'
+  | 'auto'
+  | 'dontAsk'
+  | 'bypassPermissions'
+
+/** Backward-compatible alias: PermissionMode plus legacy 'ask' and 'bypass' */
+export type PermissionLevel = PermissionMode | 'ask' | 'bypass'
+
+export interface PermissionConfig {
+  mode: PermissionMode
+  allow: string[]
+  deny: string[]
+}
+
+export interface PermissionRuleEntry {
+  pattern: string // e.g., "Bash(git:*)"
+  level: 'allow' | 'deny' | 'ask'
+  compiled: RegExp
+}
 
 export interface PermissionRule {
   toolName: string

package/src/skills/fork-executor.ts

@@ -0,0 +1,40 @@
+import { SubAgent } from '../agent/sub-agent'
+import type { ProviderRegistry } from '../providers/registry'
+import type { ToolDefinition, SkillDefinition } from '../shared/index.ts'
+import type { AgentDefinition } from '../agent/types'
+
+/**
+ * Execute a skill in an isolated subagent context (context: fork).
+ *
+ * The skill's markdown body becomes the subagent's system prompt.
+ * The skill's allowed-tools become the subagent's tool whitelist.
+ * Results are returned to the AI as internal context (not shown directly to user).
+ */
+export async function executeForkedSkill(
+  skill: SkillDefinition,
+  args: string,
+  registry: ProviderRegistry,
+  toolRegistry: Map<string, ToolDefinition>,
+): Promise<string> {
+  const agentDef: AgentDefinition = {
+    name: `skill:${skill.name}`,
+    description: skill.description,
+    systemPrompt: buildSkillSystemPrompt(skill),
+    tools: skill.allowedTools?.join(', '),
+    model: skill.model || 'inherit',
+    permissionMode: 'inherit',
+    background: false,
+    source: 'builtin',
+  }
+
+  const sub = new SubAgent(registry, toolRegistry)
+  const prompt = args
+    ? `Execute the "${skill.name}" skill with arguments: ${args}`
+    : `Execute the "${skill.name}" skill.`
+
+  return sub.execute(prompt, `skill:${skill.name}`, { agentDef })
+}
+
+function buildSkillSystemPrompt(skill: SkillDefinition): string {
+  return `You are executing the "${skill.name}" skill (v${skill.version}).\n\n${skill.description}\n\nFollow the skill instructions precisely and return results.`
+}