@miphamai/cli 0.5.12 → 0.6.0

package/bin/mipham.ts

@@ -174,6 +174,17 @@ async function runPluginCLI(): Promise<boolean> {
       process.exit(disabled ? 0 : 1)
     })
 
+  program
+    .command('install-npm <package>')
+    .description('Install a plugin from the npm registry')
+    .action(async (packageName: string) => {
+      const { PluginManager } = await import('../src/plugin/plugin-manager')
+      const manager = new PluginManager()
+      const result = manager.installFromNpm(packageName)
+      console.log(result.message)
+      process.exit(result.success ? 0 : 1)
+    })
+
   await program.parseAsync(process.argv)
   return true
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.5.12",
+  "version": "0.6.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/skills/standard/web-access.SKILL.md

@@ -0,0 +1,54 @@
+---
+name: web-access
+description: Web access, scraping, browser automation, and online content retrieval — search engines, page fetching, login-required sites, social media
+version: 1.0.0
+---
+
+# Web Access Skill
+
+Handle all network operations: search, web scraping, authenticated browsing, and dynamic page rendering.
+
+## When to Use
+
+- **Web search**: Finding current information, documentation, news
+- **Page scraping**: Extracting content from web pages
+- **Authenticated access**: Sites requiring login (via browser automation)
+- **Social media**: Content from Xiaohongshu, Weibo, Twitter, etc.
+- **Dynamic content**: JavaScript-rendered pages requiring a real browser
+- **API interaction**: REST/GraphQL endpoints with proper auth
+
+## Tools
+
+### WebSearch
+
+General web search for current information. Use for:
+
+- Documentation lookups, API references
+- News and current events
+- Technical troubleshooting
+- Technology comparisons
+
+### WebFetch
+
+Fetch and parse a single URL. Use for:
+
+- Reading documentation pages
+- Checking API responses
+- Extracting article content
+- Verifying links
+
+### Browser Automation
+
+For sites requiring login or JavaScript rendering:
+
+- Authenticated sessions
+- Single-page applications (SPAs)
+- Form submissions and multi-step workflows
+
+## Security Rules
+
+- Never submit credentials without explicit user approval
+- Respect robots.txt and rate limiting
+- Do not scrape PII or sensitive data
+- Validate all URLs against SSRF before fetching
+- Only HTTPS for remote requests

package/src/commands/loop-scaffold.ts

@@ -0,0 +1,342 @@
+/**
+ * Mipham Code — LoopKit Scaffold
+ *
+ * Creates a LoopKit Vault project structure under .mipham/.
+ * Mirrors the Claude Code .claude/ convention adapted for Mipham Code.
+ *
+ * Reference: LoopKit Vault structure
+ *   .claude/CLAUDE.md, settings.json, hooks/, agents/, skills/<9 domains>/
+ *   .mcp.json, MEMORY.md, run.sh, install.sh, README.md
+ */
+
+import { mkdirSync, writeFileSync, existsSync, chmodSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+
+export interface ScaffoldResult {
+  created: string[]
+  skipped: string[]
+}
+
+/** 9 skill domain directories matching the LoopKit Vault convention */
+const SKILL_DOMAINS = [
+  'agents-llm',
+  'debug',
+  'security',
+  'frontend',
+  'testing',
+  'refactor',
+  'docs',
+  'data',
+  'git-ops',
+]
+
+function ensureDir(dir: string, created: string[], _skipped: string[]): void {
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true })
+    created.push(dir)
+  }
+}
+
+function writeTemplate(
+  path: string,
+  content: string,
+  executable: boolean,
+  created: string[],
+  skipped: string[],
+): void {
+  if (existsSync(path)) {
+    skipped.push(path)
+    return
+  }
+  writeFileSync(path, content, 'utf-8')
+  if (executable) {
+    chmodSync(path, 0o755)
+  }
+  created.push(path)
+}
+
+/**
+ * Create the LoopKit Vault project structure at the given base path.
+ *
+ * Directory tree created:
+ * ```
+ * <basePath>/
+ * ├── .mipham/
+ * │   ├── CLAUDE.md
+ * │   ├── settings.json
+ * │   ├── hooks/
+ * │   │   ├── pre-tool-use.sh
+ * │   │   ├── post-tool-use.sh
+ * │   │   └── stop.sh
+ * │   ├── agents/
+ * │   │   └── verifier.md
+ * │   └── skills/
+ * │       ├── agents-llm/
+ * │       ├── debug/
+ * │       ├── security/
+ * │       ├── frontend/
+ * │       ├── testing/
+ * │       ├── refactor/
+ * │       ├── docs/
+ * │       ├── data/
+ * │       └── git-ops/
+ * ├── .mcp.json
+ * ├── MEMORY.md
+ * ├── README.md
+ * ├── run.sh
+ * └── install.sh
+ * ```
+ */
+export function scaffoldLoopKit(basePath: string): ScaffoldResult {
+  const created: string[] = []
+  const skipped: string[] = []
+
+  const resolved = resolve(basePath.replace(/^~/, process.env.HOME || '~'))
+  const miphamDir = join(resolved, '.mipham')
+
+  // ── .mipham/ root ──
+  ensureDir(miphamDir, created, skipped)
+
+  // ── .mipham/CLAUDE.md ──
+  writeTemplate(join(miphamDir, 'CLAUDE.md'), TEMPLATES.claudeMd, false, created, skipped)
+
+  // ── .mipham/settings.json ──
+  writeTemplate(join(miphamDir, 'settings.json'), TEMPLATES.settingsJson, false, created, skipped)
+
+  // ── .mipham/hooks/ ──
+  const hooksDir = join(miphamDir, 'hooks')
+  ensureDir(hooksDir, created, skipped)
+  writeTemplate(join(hooksDir, 'pre-tool-use.sh'), TEMPLATES.preToolUse, true, created, skipped)
+  writeTemplate(join(hooksDir, 'post-tool-use.sh'), TEMPLATES.postToolUse, true, created, skipped)
+  writeTemplate(join(hooksDir, 'stop.sh'), TEMPLATES.stopHook, true, created, skipped)
+
+  // ── .mipham/agents/ ──
+  const agentsDir = join(miphamDir, 'agents')
+  ensureDir(agentsDir, created, skipped)
+  writeTemplate(join(agentsDir, 'verifier.md'), TEMPLATES.verifierAgent, false, created, skipped)
+
+  // ── .mipham/skills/<9 domains>/ ──
+  const skillsDir = join(miphamDir, 'skills')
+  ensureDir(skillsDir, created, skipped)
+  for (const domain of SKILL_DOMAINS) {
+    const domainDir = join(skillsDir, domain)
+    ensureDir(domainDir, created, skipped)
+    // Add .gitkeep so git tracks empty directories
+    writeTemplate(join(domainDir, '.gitkeep'), '', false, created, skipped)
+  }
+
+  // ── Root-level files ──
+
+  // .mcp.json
+  writeTemplate(join(resolved, '.mcp.json'), TEMPLATES.mcpJson, false, created, skipped)
+
+  // MEMORY.md
+  writeTemplate(join(resolved, 'MEMORY.md'), TEMPLATES.memoryMd, false, created, skipped)
+
+  // README.md
+  writeTemplate(join(resolved, 'README.md'), TEMPLATES.readmeMd, false, created, skipped)
+
+  // run.sh
+  writeTemplate(join(resolved, 'run.sh'), TEMPLATES.runSh, true, created, skipped)
+
+  // install.sh
+  writeTemplate(join(resolved, 'install.sh'), TEMPLATES.installSh, true, created, skipped)
+
+  return { created, skipped }
+}
+
+// ═══════════════════════════════════════════════════════════════
+// Templates
+// ═══════════════════════════════════════════════════════════════
+
+const TEMPLATES = {
+  claudeMd: `# CLAUDE.md
+
+> Mipham Code project instructions — defines how the AI assistant behaves in this project.
+> Edit this file to customize: coding conventions, project structure, AI preferences.
+
+## Project Overview
+
+[Describe your project — what it does, who it's for, key technologies]
+
+## Coding Conventions
+
+- [Add your team's coding rules, style preferences, naming conventions]
+- [Example: Use TypeScript strict mode, ESM modules, pnpm package manager]
+
+## AI Interaction Preferences
+
+- Response language: [English / 中文]
+- Comment language: [English / 中文]
+- Code style: [functional / OOP / mixed]
+- Testing: [always write tests / only for critical paths]
+`,
+
+  settingsJson:
+    JSON.stringify(
+      {
+        permissions: {
+          allow: [],
+          deny: [],
+        },
+        hooks: {
+          PreToolUse: [],
+          PostToolUse: [],
+          Stop: [],
+          SessionStart: [],
+          UserPromptSubmit: [],
+          Notification: [],
+        },
+      },
+      null,
+      2,
+    ) + '\n',
+
+  preToolUse: `#!/bin/bash
+# PreToolUse hook — runs before each tool execution.
+# Tool name passed as \$1, input JSON as \$2.
+# Exit non-zero to block the tool.
+# Write JSON to stdout to modify the tool input.
+
+TOOL_NAME="\$1"
+TOOL_INPUT="\$2"
+
+echo "{\\"decision\\": \\"allow\\"}" >&2
+exit 0
+`,
+
+  postToolUse: `#!/bin/bash
+# PostToolUse hook — runs after each tool execution.
+# Tool name passed as \$1, result JSON as \$2.
+
+TOOL_NAME="\$1"
+TOOL_RESULT="\$2"
+
+exit 0
+`,
+
+  stopHook: `#!/bin/bash
+# Stop hook — runs when the AI session ends.
+# Use for cleanup, notifications, or saving state.
+
+echo "Session ended at \$(date)" >&2
+exit 0
+`,
+
+  verifierAgent: `# Verifier Agent
+
+> Pre-commit audit specialist. Dispatched BEFORE committing to verify changes.
+
+## Role
+
+Verify staged changes against coding standards, security rules, and best practices.
+
+## When to Use
+
+- Before committing code changes
+- Quality gate in CI/CD pipelines
+- Post-implementation review
+
+## Instructions
+
+1. Read the staged diff
+2. Check for: security issues, code quality violations, test coverage gaps
+3. Report findings with file:line citations
+4. Return verdict: pass, needs-fix, or block
+`,
+
+  mcpJson:
+    JSON.stringify(
+      {
+        mcpServers: {
+          filesystem: {
+            command: 'npx',
+            args: ['-y', '@modelcontextprotocol/server-filesystem', '.'],
+          },
+        },
+      },
+      null,
+      2,
+    ) + '\n',
+
+  memoryMd: `# MEMORY.md
+
+> Persistent project memory — survives across AI sessions.
+> Add important facts, decisions, and context here.
+
+## Key Decisions
+
+- [Date]: [Decision made and why]
+
+## Project Context
+
+- [Important context for AI to remember across sessions]
+
+## Resources
+
+- [Links, references, external documentation]
+`,
+
+  readmeMd: `# [Project Name]
+
+> Generated by Mipham Code /loop init scaffold.
+
+## Quick Start
+
+\`\`\`bash
+./install.sh   # Install dependencies
+./run.sh       # Start the project
+\`\`\`
+
+## Structure
+
+- \`.mipham/\` — Mipham Code configuration (CLAUDE.md, settings, hooks, agents, skills)
+- \`.mcp.json\` — MCP server configuration
+- \`MEMORY.md\` — AI persistent memory
+- \`run.sh\` — Project launcher
+- \`install.sh\` — Dependency installer
+
+## Learn More
+
+- Mipham Code: https://mipham.ai/code
+- MCP Protocol: https://modelcontextprotocol.io
+`,
+
+  runSh: `#!/bin/bash
+# Mipham Code — project launcher
+# Generated by /loop init
+
+set -e
+
+echo "Starting project..."
+echo "Run 'mipham' to launch the AI coding assistant."
+
+# Uncomment to auto-start Mipham Code:
+# mipham
+`,
+
+  installSh: `#!/bin/bash
+# Mipham Code — dependency installer
+# Generated by /loop init
+
+set -e
+
+echo "Installing project dependencies..."
+
+# Check for Bun
+if command -v bun &> /dev/null; then
+  echo "✓ Bun found: \$(bun --version)"
+else
+  echo "⚠ Bun not found. Install from https://bun.sh"
+fi
+
+# Check for Mipham Code
+if command -v mipham &> /dev/null; then
+  echo "✓ Mipham Code found: \$(mipham --version 2>&1 | head -1)"
+else
+  echo "⚠ Mipham Code not found. Install: npm install -g @miphamai/cli"
+fi
+
+echo "Done. Run ./run.sh to start."
+`,
+}

package/src/config/loader.ts

@@ -10,7 +10,7 @@ import {
 import { join, dirname } from 'node:path'
 import { homedir } from 'node:os'
 import { parse as parseYaml } from 'yaml'
-import type { MiphamConfig, ProviderConfig } from '../shared/index.ts'
+import type { MiphamConfig, ProviderConfig, McpServerConfig } from '../shared/index.ts'
 import { DEFAULT_CONFIG } from './defaults'
 
 const MIPHAM_HOME = join(homedir(), '.mipham')
@@ -136,6 +136,54 @@ function tryRestoreFromBackup(configPath: string): boolean {
   }
 }
 
+/**
+ * Load MCP servers from a .mcp.json file (Claude Code convention).
+ *
+ * Format:
+ *   { "mcpServers": { "name": { "command": "...", "args": [...], "env": {...} } } }
+ *
+ * Scans both project-level (.mipham/mcp.json) and user-level (~/.mipham/mcp.json).
+ * Config.yml entries take precedence over .mcp.json entries with the same name.
+ */
+function loadMcpJson(cwd: string): McpServerConfig[] {
+  const servers: McpServerConfig[] = []
+  const searchPaths = [
+    join(cwd, '.mipham', 'mcp.json'),
+    join(cwd, '.mcp.json'),
+    join(MIPHAM_HOME, 'mcp.json'),
+  ]
+
+  for (const path of searchPaths) {
+    try {
+      if (!existsSync(path)) continue
+      const raw = readFileSync(path, 'utf-8')
+      const parsed = JSON.parse(raw) as {
+        mcpServers?: Record<
+          string,
+          { command: string; args?: string[]; env?: Record<string, string> }
+        >
+      }
+
+      if (parsed.mcpServers) {
+        for (const [name, cfg] of Object.entries(parsed.mcpServers)) {
+          // Avoid duplicates by name
+          if (servers.some((s) => s.name === name)) continue
+          servers.push({
+            name,
+            command: cfg.command,
+            args: cfg.args || [],
+            env: cfg.env,
+          })
+        }
+      }
+    } catch {
+      // Silently skip malformed or missing .mcp.json files
+    }
+  }
+
+  return servers
+}
+
 export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
   const configPath = join(cwd, '.mipham', 'config.yml')
   const userConfigPath = join(MIPHAM_HOME, 'config.yml')
@@ -185,6 +233,22 @@ export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
     }
   }
 
+  // ── Load .mcp.json servers (project + user level) ──
+  const mcpJsonServers = loadMcpJson(cwd)
+  if (mcpJsonServers.length > 0) {
+    const existingServers = config.skills?.mcpServers ?? []
+    // Merge: config.yml servers take precedence by name
+    const existingNames = new Set(existingServers.map((s) => s.name))
+    const newFromJson = mcpJsonServers.filter((s) => !existingNames.has(s.name))
+    config = {
+      ...config,
+      skills: {
+        paths: config.skills?.paths ?? [],
+        mcpServers: [...existingServers, ...newFromJson],
+      },
+    }
+  }
+
   // ── Auto-backup: save a copy of the user config if it loaded successfully ──
   if (userConfig) {
     backupConfig(userConfigPath)

package/src/index.tsx

@@ -8,6 +8,7 @@ import { ContextManager } from './core/context'
 import { QueryEngine } from './core/engine'
 import { SessionStore } from './core/session-store'
 import { SkillsLoader } from './skills/loader'
+import { PluginManager } from './plugin/plugin-manager'
 import { createToolRegistry } from './tools'
 import { McpClient } from './mcp/client'
 import { HookEngine } from './core/hooks'
@@ -76,6 +77,9 @@ export async function runApp(options: RunOptions): Promise<void> {
     skillsLoader.loadExternal(config.skills.paths)
   }
 
+  // Initialize plugin manager
+  const pluginManager = new PluginManager()
+
   // Initialize context — restore saved session if available
   const context = new ContextManager({ maxTokens: 200_000, compactionThreshold: 0.9 })
 
@@ -140,6 +144,7 @@ export async function runApp(options: RunOptions): Promise<void> {
       initialModel={defaultModel}
       lang={options.lang}
       skillsLoader={skillsLoader}
+      pluginManager={pluginManager}
       version={options.version}
     />,
   )

package/src/plugin/plugin-registry.ts

@@ -0,0 +1,69 @@
+/**
+ * Mipham Code — Community Plugin Registry
+ *
+ * Provides a discoverable list of community plugins installable via npm.
+ * Mirrors the community skill registry pattern.
+ */
+
+export interface CommunityPlugin {
+  /** Unique plugin name (kebab-case) */
+  name: string
+  /** One-line description */
+  description: string
+  /** npm package name */
+  npmPackage: string
+  /** Category for grouping */
+  category: string
+  /** Author */
+  author: string
+}
+
+const COMMUNITY_PLUGINS: CommunityPlugin[] = [
+  {
+    name: 'notebooklm',
+    description:
+      'Google NotebookLM integration — citation-backed Q&A, content generation, 31 tools',
+    npmPackage: '@roomi-fields/notebooklm-mcp',
+    category: 'AI & Data',
+    author: 'roomi-fields',
+  },
+  {
+    name: 'plugin-dev',
+    description: 'Plugin development toolkit — scaffolding, testing, and build utilities',
+    npmPackage: 'mipham-plugin-dev',
+    category: 'Development',
+    author: 'MiphamAI',
+  },
+  {
+    name: 'security-scanner',
+    description: 'Enhanced security scanning — dependency audit, SAST, secret detection',
+    npmPackage: 'mipham-plugin-security',
+    category: 'Security',
+    author: 'MiphamAI',
+  },
+  {
+    name: 'db-explorer',
+    description: 'Database exploration — SQL generation, schema analysis, query optimization',
+    npmPackage: 'mipham-plugin-db',
+    category: 'Data',
+    author: 'MiphamAI',
+  },
+  {
+    name: 'i18n',
+    description: 'Internationalization helper — translation, locale detection, i18n key management',
+    npmPackage: 'mipham-plugin-i18n',
+    category: 'Development',
+    author: 'MiphamAI',
+  },
+]
+
+export function getAvailablePlugins(): CommunityPlugin[] {
+  return [...COMMUNITY_PLUGINS]
+}
+
+export function searchPlugins(query: string): CommunityPlugin[] {
+  const q = query.toLowerCase()
+  return COMMUNITY_PLUGINS.filter(
+    (p) => p.name.toLowerCase().includes(q) || p.description.toLowerCase().includes(q),
+  )
+}

package/src/shared/constants.ts

@@ -260,6 +260,15 @@ export const DEFAULT_PROVIDERS: ProviderConfig[] = [
         vision: true,
         status: 'active',
       },
+      {
+        id: 'kimi-k3',
+        name: 'Kimi K3',
+        providerId: 'kimi',
+        contextWindow: 1_000_000,
+        maxOutput: 128_000,
+        vision: true,
+        status: 'active',
+      },
       {
         id: 'moonshot-v1-8k',
         name: 'Moonshot v1 8K',