@miphamai/cli 0.5.7 → 0.5.9

package/bin/mipham.ts

@@ -178,6 +178,97 @@ async function runPluginCLI(): Promise<boolean> {
   return true
 }
 
+// ── Update self ────────────────────────────────────────────────────────────────
+
+async function runUpdate(): Promise<boolean> {
+  const args = process.argv.slice(2)
+  if (args[0] !== 'update' && args[0] !== 'upgrade') return false
+
+  const { getCurrentVersion, backupConfig, performUpdate, restoreConfig, getConfigPath } =
+    await import('../src/shared/update')
+
+  const { existsSync } = await import('node:fs')
+
+  const PACKAGE = '@miphamai/cli'
+
+  const currentVersion = getCurrentVersion()
+  console.log(`Mipham Code update`)
+  console.log(`  Current: v${currentVersion}`)
+  console.log(`  Checking npm registry for latest version...`)
+  console.log()
+
+  // Check latest version from npm
+  let latestVersion = ''
+  try {
+    const { execSync } = await import('node:child_process')
+    const result = execSync(`npm view ${PACKAGE} version --json`, {
+      encoding: 'utf-8',
+      timeout: 10_000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim()
+    latestVersion = result.replace(/"/g, '')
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    console.log(`✗ Failed to check latest version: ${msg}`)
+    console.log(`  Check manually: https://www.npmjs.com/package/${PACKAGE}`)
+    process.exit(1)
+  }
+
+  if (!latestVersion) {
+    console.log('✗ Could not determine latest version.')
+    process.exit(1)
+  }
+
+  console.log(`  Latest:  v${latestVersion}`)
+  console.log()
+
+  // Compare versions
+  if (currentVersion === latestVersion) {
+    console.log(`✓ Already up to date (v${currentVersion})`)
+    process.exit(0)
+  }
+
+  console.log(`→ New version available: v${currentVersion} → v${latestVersion}`)
+  console.log()
+
+  // Backup config before updating
+  const backupPath = backupConfig(`update-v${currentVersion}`)
+  if (backupPath) {
+    console.log(`✓ Config backed up to: ${backupPath}`)
+  }
+
+  console.log()
+  console.log(`Updating ${PACKAGE} to v${latestVersion}...`)
+
+  const ok = performUpdate(latestVersion)
+  if (!ok) {
+    console.log()
+    console.log(`✗ Update failed.`)
+    if (backupPath && existsSync(backupPath)) {
+      console.log(`  Your config backup is at: ${backupPath}`)
+    }
+    process.exit(1)
+  }
+
+  // Verify config survived
+  const configPath = getConfigPath()
+  if (existsSync(configPath)) {
+    console.log()
+    console.log(`✓ Config preserved: ${configPath}`)
+  } else if (backupPath && existsSync(backupPath)) {
+    console.log()
+    console.log('⚠ Config was removed during update. Restoring from backup...')
+    if (restoreConfig(backupPath)) {
+      console.log(`✓ Config restored.`)
+    }
+  }
+
+  console.log()
+  console.log(`✓ Updated to ${PACKAGE} v${latestVersion}`)
+  console.log(`  Run 'mipham --version' to verify.`)
+  process.exit(0)
+}
+
 async function main() {
   // ── Version flag ──────────────────────────────────────────────────────────
   if (
@@ -190,6 +281,10 @@ async function main() {
     process.exit(0)
   }
 
+  // ── Update / upgrade ──────────────────────────────────────────────────────
+  const handledUpdate = await runUpdate()
+  if (handledUpdate) return
+
   // Check for plugin subcommands first
   const handledPlugin = await runPluginCLI()
   if (handledPlugin) return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/config/loader.ts

@@ -1,30 +1,194 @@
-import { readFileSync, existsSync } from 'node:fs'
-import { join } from 'node:path'
+import {
+  readFileSync,
+  existsSync,
+  copyFileSync,
+  mkdirSync,
+  readdirSync,
+  unlinkSync,
+  chmodSync,
+} from 'node:fs'
+import { join, dirname } from 'node:path'
+import { homedir } from 'node:os'
 import { parse as parseYaml } from 'yaml'
-import type { MiphamConfig } from '../shared/index.ts'
+import type { MiphamConfig, ProviderConfig } from '../shared/index.ts'
 import { DEFAULT_CONFIG } from './defaults'
 
+const MIPHAM_HOME = join(homedir(), '.mipham')
+const BACKUP_PREFIX = 'config.backup-'
+
+/**
+ * Parse a YAML config file safely. Returns null on any error (missing file, bad syntax, etc).
+ * Prints a warning to stderr so the user knows something is wrong.
+ */
+function safeParseYaml(path: string, label: string): Partial<MiphamConfig> | null {
+  try {
+    if (!existsSync(path)) return null
+    const raw = readFileSync(path, 'utf-8')
+    return parseYaml(raw) as Partial<MiphamConfig>
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    process.stderr.write(`⚠ Mipham Code: failed to parse ${label} (${path}): ${msg}\n`)
+    return null
+  }
+}
+
+/**
+ * Deep-merge providers: for each provider in the user config, only override
+ * the fields the user explicitly set (apiKey, baseUrl). All other fields
+ * (name, protocol, models, status) come from the base defaults.
+ *
+ * This prevents users from accidentally losing model definitions when they
+ * only want to set their API key.
+ */
+function mergeProviders(
+  baseProviders: ProviderConfig[],
+  overrideProviders: ProviderConfig[],
+): ProviderConfig[] {
+  const merged = [...baseProviders]
+
+  for (const op of overrideProviders) {
+    const idx = merged.findIndex((bp) => bp.id === op.id)
+    if (idx === -1) {
+      // Provider not in defaults — add it wholesale (custom provider)
+      merged.push(op)
+      continue
+    }
+
+    // Merge: user overrides only the fields they provide
+    const base = merged[idx]!
+    merged[idx] = {
+      id: base.id,
+      name: op.name || base.name,
+      protocol: op.protocol || base.protocol,
+      baseUrl: op.baseUrl ?? base.baseUrl,
+      apiKey: op.apiKey ?? base.apiKey,
+      models: op.models?.length ? op.models : base.models,
+      status: op.status ?? base.status,
+    }
+  }
+
+  return merged
+}
+
+function mergeConfig(base: MiphamConfig, override: Partial<MiphamConfig>): MiphamConfig {
+  const merged: MiphamConfig = { ...base, ...override }
+  if (override.providers) {
+    merged.providers = mergeProviders(base.providers, override.providers)
+  } else {
+    merged.providers = base.providers
+  }
+  return merged
+}
+
+/**
+ * Save a timestamped backup of config.yml to ~/.mipham/.
+ * Keeps at most 5 backups; older ones are pruned.
+ */
+function backupConfig(configPath: string): void {
+  try {
+    if (!existsSync(configPath)) return
+    mkdirSync(MIPHAM_HOME, { recursive: true, mode: 0o700 })
+
+    const ts = new Date().toISOString().replace(/[:.]/g, '-')
+    const backupPath = join(MIPHAM_HOME, `${BACKUP_PREFIX}${ts}.yml`)
+    copyFileSync(configPath, backupPath)
+    chmodSync(backupPath, 0o600) // owner read/write only — contains API keys
+
+    // Prune old backups (keep last 5)
+    const files = readdirSync(MIPHAM_HOME)
+      .filter((f) => f.startsWith(BACKUP_PREFIX) && f.endsWith('.yml'))
+      .sort()
+    while (files.length > 5) {
+      const old = files.shift()!
+      try {
+        unlinkSync(join(MIPHAM_HOME, old))
+      } catch {
+        // best-effort cleanup
+      }
+    }
+  } catch {
+    // best-effort; never crash because backup failed
+  }
+}
+
+/**
+ * Try to restore config from the most recent backup.
+ * Returns true if restored successfully.
+ */
+function tryRestoreFromBackup(configPath: string): boolean {
+  try {
+    if (!existsSync(MIPHAM_HOME)) return false
+    const files = readdirSync(MIPHAM_HOME)
+      .filter((f) => f.startsWith(BACKUP_PREFIX) && f.endsWith('.yml'))
+      .sort()
+      .reverse() // newest first
+
+    if (files.length === 0) return false
+
+    const latestBackup = join(MIPHAM_HOME, files[0]!)
+    copyFileSync(latestBackup, configPath)
+    process.stderr.write(`⚠ Mipham Code: restored config from backup (${files[0]})\n`)
+    return true
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    process.stderr.write(`⚠ Mipham Code: failed to restore config from backup: ${msg}\n`)
+    return false
+  }
+}
+
 export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
   const configPath = join(cwd, '.mipham', 'config.yml')
-  const userConfigPath = join(process.env.HOME || '~', '.mipham', 'config.yml')
+  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
 
   let config = { ...DEFAULT_CONFIG }
 
-  if (existsSync(configPath)) {
-    const raw = readFileSync(configPath, 'utf-8')
-    const projectConfig = parseYaml(raw) as Partial<MiphamConfig>
+  // ── Load project-level config ──
+  const projectConfig = safeParseYaml(configPath, 'project config')
+  if (projectConfig) {
     config = mergeConfig(config, projectConfig)
+  } else if (existsSync(configPath)) {
+    // File exists but failed to parse — try to restore from backup
+    process.stderr.write(`⚠ Mipham Code: project config is corrupted, attempting recovery...\n`)
+    if (!tryRestoreFromBackup(configPath)) {
+      process.stderr.write(`⚠ Mipham Code: no backup available for project config. Skipping.\n`)
+    } else {
+      // Retry parsing after restore
+      const restored = safeParseYaml(configPath, 'restored project config')
+      if (restored) {
+        config = mergeConfig(config, restored)
+      }
+    }
   }
 
-  if (existsSync(userConfigPath)) {
-    const raw = readFileSync(userConfigPath, 'utf-8')
-    const userConfig = parseYaml(raw) as Partial<MiphamConfig>
+  // ── Load user-level config ──
+  const userConfig = safeParseYaml(userConfigPath, 'user config')
+  if (userConfig) {
     config = mergeConfig(config, userConfig)
+  } else if (existsSync(userConfigPath)) {
+    // File exists but failed to parse — try to restore from backup
+    process.stderr.write(`⚠ Mipham Code: user config is corrupted, attempting recovery...\n`)
+    if (!tryRestoreFromBackup(userConfigPath)) {
+      process.stderr.write(`⚠ Mipham Code: no backup available for user config. Skipping.\n`)
+    } else {
+      // Retry parsing after restore
+      const restored = safeParseYaml(userConfigPath, 'restored user config')
+      if (restored) {
+        config = mergeConfig(config, restored)
+      }
+    }
+  } else {
+    // No user config yet — create the directory so it's ready
+    try {
+      mkdirSync(MIPHAM_HOME, { recursive: true })
+    } catch {
+      // best-effort
+    }
   }
 
-  return config
-}
+  // ── Auto-backup: save a copy of the user config if it loaded successfully ──
+  if (userConfig) {
+    backupConfig(userConfigPath)
+  }
 
-function mergeConfig(base: MiphamConfig, override: Partial<MiphamConfig>): MiphamConfig {
-  return { ...base, ...override, providers: override.providers ?? base.providers }
+  return config
 }

package/src/plugin/plugin-manager.ts

@@ -1,6 +1,7 @@
 import { mkdirSync, existsSync, writeFileSync, readFileSync, readdirSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
+import { execSync } from 'node:child_process'
 import { validatePlugin } from './plugin-validator'
 
 const PLUGIN_DIR = join(homedir(), '.mipham', 'plugins')
@@ -58,6 +59,82 @@ export class PluginManager {
     }
   }
 
+  /** Validate npm package name against the npm spec. */
+  private isValidPackageName(name: string): boolean {
+    // npm package name regex: optional @scope/ + package name
+    return /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/.test(name)
+  }
+
+  /**
+   * Install a plugin from npm (e.g. `npm install <package>` into the plugins dir).
+   * The npm package must export a valid plugin manifest at its root.
+   */
+  installFromNpm(packageName: string): { success: boolean; message: string } {
+    if (!this.isValidPackageName(packageName)) {
+      return { success: false, message: `Invalid package name: "${packageName}"` }
+    }
+
+    // Derive plugin name from npm package name (strip scope prefix)
+    const pluginName = packageName.replace(/^@.+\//, '').replace(/^mipham-plugin-/, '')
+
+    const destDir = join(this.pluginDir, pluginName)
+    if (existsSync(destDir)) {
+      return {
+        success: false,
+        message: `Plugin "${pluginName}" is already installed`,
+      }
+    }
+
+    try {
+      // Install the npm package into the plugins directory
+      mkdirSync(destDir, { recursive: true })
+
+      // Create a minimal package.json so npm install works in a subdirectory
+      writeFileSync(
+        join(destDir, 'package.json'),
+        JSON.stringify({ private: true }, null, 2),
+        'utf-8',
+      )
+
+      execSync(`npm install ${packageName} --prefix "${destDir}" --no-save`, {
+        encoding: 'utf-8',
+        stdio: 'pipe',
+        timeout: 60_000,
+      })
+
+      // Validate the installed plugin
+      const validation = validatePlugin(destDir)
+      if (!validation.valid) {
+        // Clean up on invalid plugin
+        rmSync(destDir, { recursive: true, force: true })
+        return { success: false, message: validation.errors.join('; ') }
+      }
+
+      this.plugins.push({
+        name: validation.manifest?.name || pluginName,
+        version: validation.manifest?.version || '0.0.0',
+        path: destDir,
+        enabled: true,
+        installedAt: new Date().toISOString(),
+      })
+
+      this.saveState()
+      return {
+        success: true,
+        message: `Plugin "${pluginName}" installed from npm`,
+      }
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : String(err)
+      // Clean up on failure
+      try {
+        rmSync(destDir, { recursive: true, force: true })
+      } catch {
+        /* ok */
+      }
+      return { success: false, message: `npm install failed: ${msg}` }
+    }
+  }
+
   list(): InstalledPlugin[] {
     return [...this.plugins]
   }

package/src/providers/anthropic.ts

@@ -278,9 +278,19 @@ export class AnthropicProvider implements ProviderInstance {
   }
 
   private resolveApiKey(keyTemplate: string): string {
-    const match = keyTemplate.match(/^\$\{(.+)\}$/)
+    // Accept both ${VAR} and $VAR syntax
+    let match = keyTemplate.match(/^\$\{(.+)\}$/)
+    if (!match) match = keyTemplate.match(/^\$([A-Z_][A-Z0-9_]*)$/)
     if (match?.[1]) {
-      return process.env[match[1]] || ''
+      const varName = match[1]
+      const value = process.env[varName]
+      if (!value) {
+        process.stderr.write(
+          `⚠ Anthropic provider: apiKey references $${varName} but that environment variable is not set\n`,
+        )
+        return ''
+      }
+      return value
     }
     return keyTemplate
   }

package/src/providers/bootstrap.ts

@@ -13,8 +13,18 @@ export function bootstrapProviders(
   for (const config of configs) {
     if (config.status === 'upcoming') continue
 
-    switch (config.protocol) {
+    // Warn if apiKey is empty (will cause API errors at runtime)
+    if (!config.apiKey || config.apiKey.trim() === '') {
+      process.stderr.write(
+        `⚠ Provider "${config.name}" (${config.id}): apiKey not set. ` +
+          `Set it in ~/.mipham/config.yml or via environment variable.\n`,
+      )
+    }
+
+    const protocol = config.protocol?.toLowerCase()
+    switch (protocol) {
       case 'openai-compatible':
+      case 'openai-compat': // common user typo
         registry.register(config.id, new OpenAICompatProvider(config))
         break
       case 'anthropic':

package/src/providers/openai-compat.ts

@@ -6,7 +6,9 @@ export class OpenAICompatProvider implements ProviderInstance {
   constructor(public config: ProviderConfig) {}
 
   async *chat(req: ChatRequest): AsyncGenerator<StreamChunk> {
-    const baseUrl = this.config.baseUrl?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
+    // Accept both baseUrl and baseURL (common YAML typo)
+    const rawBase = (this.config as any).baseUrl || (this.config as any).baseURL
+    const baseUrl = rawBase?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
     const apiKey = this.resolveApiKey(this.config.apiKey)
 
     const body = {
@@ -136,7 +138,8 @@ export class OpenAICompatProvider implements ProviderInstance {
 
   async healthCheck(): Promise<boolean> {
     try {
-      const baseUrl = this.config.baseUrl?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
+      const rawBase = (this.config as any).baseUrl || (this.config as any).baseURL
+      const baseUrl = rawBase?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
       const apiKey = this.resolveApiKey(this.config.apiKey)
       const res = await fetch(`${baseUrl}/models`, {
         headers: { Authorization: `Bearer ${apiKey}` },
@@ -187,9 +190,19 @@ export class OpenAICompatProvider implements ProviderInstance {
   }
 
   private resolveApiKey(keyTemplate: string): string {
-    const match = keyTemplate.match(/^\$\{(.+)\}$/)
+    // Accept both ${VAR} and $VAR syntax
+    let match = keyTemplate.match(/^\$\{(.+)\}$/)
+    if (!match) match = keyTemplate.match(/^\$([A-Z_][A-Z0-9_]*)$/)
     if (match?.[1]) {
-      return process.env[match[1]] || ''
+      const varName = match[1]
+      const value = process.env[varName]
+      if (!value) {
+        process.stderr.write(
+          `⚠ OpenAI-compatible provider: apiKey references $${varName} but that environment variable is not set\n`,
+        )
+        return ''
+      }
+      return value
     }
     return keyTemplate
   }

package/src/shared/constants.ts

@@ -244,6 +244,51 @@ export const DEFAULT_PROVIDERS: ProviderConfig[] = [
       },
     ],
   },
+  {
+    id: 'kimi',
+    name: 'Kimi (月之暗面)',
+    protocol: 'openai-compatible',
+    baseUrl: 'https://api.moonshot.cn/v1',
+    apiKey: '${KIMI_API_KEY}',
+    models: [
+      {
+        id: 'kimi-latest',
+        name: 'Kimi Latest',
+        providerId: 'kimi',
+        contextWindow: 128_000,
+        maxOutput: 16_000,
+        vision: true,
+        status: 'active',
+      },
+      {
+        id: 'moonshot-v1-8k',
+        name: 'Moonshot v1 8K',
+        providerId: 'kimi',
+        contextWindow: 8_000,
+        maxOutput: 4_000,
+        vision: false,
+        status: 'active',
+      },
+      {
+        id: 'moonshot-v1-32k',
+        name: 'Moonshot v1 32K',
+        providerId: 'kimi',
+        contextWindow: 32_000,
+        maxOutput: 4_000,
+        vision: false,
+        status: 'active',
+      },
+      {
+        id: 'moonshot-v1-128k',
+        name: 'Moonshot v1 128K',
+        providerId: 'kimi',
+        contextWindow: 128_000,
+        maxOutput: 4_000,
+        vision: false,
+        status: 'active',
+      },
+    ],
+  },
   {
     id: 'mipham',
     name: 'MiphamAI',