@miphamai/cli 0.5.7 → 0.5.9

package/src/shared/update.ts

@@ -0,0 +1,158 @@
+/**
+ * Mipham Code — Self-update utilities.
+ *
+ * Shared between the CLI entry point (bin/mipham.ts) and the TUI slash
+ * command handler (commands.ts) so that both `mipham update` and `/upgrade`
+ * use the same logic.
+ */
+
+import { readFileSync, existsSync, copyFileSync, mkdirSync, chmodSync } from 'node:fs'
+import { join } from 'node:path'
+import { execSync } from 'node:child_process'
+import { homedir } from 'node:os'
+
+const PACKAGE = '@miphamai/cli'
+const HOME = homedir()
+const MIPHAM_HOME = join(HOME, '.mipham')
+const CONFIG_PATH = join(MIPHAM_HOME, 'config.yml')
+
+export interface UpdateCheck {
+  /** Current installed version */
+  current: string
+  /** Latest version on npm */
+  latest: string
+  /** Whether an update is available */
+  available: boolean
+}
+
+/**
+ * Read the currently installed version from package.json.
+ */
+export function getCurrentVersion(): string {
+  try {
+    // Try the CLI's own package.json first
+    const cliPkg = join(import.meta.dirname!, '..', '..', 'package.json')
+    if (existsSync(cliPkg)) {
+      const pkg = JSON.parse(readFileSync(cliPkg, 'utf-8'))
+      return pkg.version
+    }
+  } catch {
+    // fall through
+  }
+  return 'unknown'
+}
+
+/**
+ * Fetch the latest version from the npm registry.
+ * Returns the version string, or throws on failure.
+ */
+function fetchLatestVersion(): string {
+  const result = execSync(`npm view ${PACKAGE} version --json`, {
+    encoding: 'utf-8',
+    timeout: 10_000,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  }).trim()
+  return result.replace(/"/g, '')
+}
+
+/**
+ * Check if an update is available by comparing the local version
+ * against the npm registry.
+ */
+export function checkForUpdates(): UpdateCheck {
+  const current = getCurrentVersion()
+  let latest = current
+  let available = false
+
+  try {
+    latest = fetchLatestVersion()
+    available = compareVersions(latest, current) > 0
+  } catch {
+    // If we can't reach npm, treat as up-to-date (don't alarm the user)
+  }
+
+  return { current, latest, available }
+}
+
+/**
+ * Back up the user's config.yml before an update.
+ * Returns the backup path, or null if backup wasn't possible.
+ */
+export function backupConfig(label: string): string | null {
+  if (!existsSync(CONFIG_PATH)) return null
+  try {
+    mkdirSync(MIPHAM_HOME, { recursive: true, mode: 0o700 })
+    const ts = new Date().toISOString().replace(/[:.]/g, '-')
+    const backupPath = join(MIPHAM_HOME, `config.pre-${label}-${ts}.yml`)
+    copyFileSync(CONFIG_PATH, backupPath)
+    chmodSync(backupPath, 0o600) // owner read/write only — contains API keys
+    return backupPath
+  } catch {
+    return null
+  }
+}
+
+/** Validate a semver string before passing it to a shell command. */
+const SEMVER_RE = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.]+)?(\+[a-zA-Z0-9.]+)?$/
+
+function isValidSemver(v: string): boolean {
+  return SEMVER_RE.test(v)
+}
+
+/**
+ * Perform the actual update via npm install -g.
+ * Validates the version string before shell execution (prevents command injection).
+ * Returns true on success.
+ */
+export function performUpdate(version: string): boolean {
+  if (!isValidSemver(version)) {
+    process.stderr.write(`⚠ Refusing to install invalid version: "${version}"\n`)
+    return false
+  }
+
+  try {
+    execSync(`npm install -g ${PACKAGE}@${version}`, {
+      encoding: 'utf-8',
+      stdio: 'inherit',
+      timeout: 120_000,
+    })
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Restore config from a backup path.
+ */
+export function restoreConfig(backupPath: string): boolean {
+  if (!existsSync(backupPath)) return false
+  try {
+    copyFileSync(backupPath, CONFIG_PATH)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Get the config path so callers can verify it survived.
+ */
+export function getConfigPath(): string {
+  return CONFIG_PATH
+}
+
+/**
+ * Compare two semver strings. Returns >0 if a > b, <0 if a < b, 0 if equal.
+ */
+function compareVersions(a: string, b: string): number {
+  const pa = a.split('.').map(Number)
+  const pb = b.split('.').map(Number)
+  for (let i = 0; i < 3; i++) {
+    const da = pa[i] ?? 0
+    const db = pb[i] ?? 0
+    if (da > db) return 1
+    if (da < db) return -1
+  }
+  return 0
+}

package/src/skills/loader.ts

@@ -66,6 +66,19 @@ export class SkillsLoader {
     return this.skills.has(name)
   }
 
+  countByType(): { standard: number; mipham: number; total: number } {
+    const all = this.list()
+    return {
+      standard: all.filter((s) => s.type === 'standard').length,
+      mipham: all.filter((s) => s.type === 'mipham').length,
+      total: all.length,
+    }
+  }
+
+  getNamesByType(type: 'standard' | 'mipham'): string[] {
+    return this.listByType(type).map((s) => s.name)
+  }
+
   private loadDirectory(dir: string, type: 'standard' | 'mipham'): void {
     try {
       const entries = readdirSync(dir)

package/src/skills/registry.ts

@@ -0,0 +1,325 @@
+/**
+ * Mipham Code — Skill Registry & Installer
+ *
+ * Provides a community skill marketplace: browse, search, and install skills
+ * from remote sources (GitHub repos, direct URLs).
+ */
+
+import { existsSync, mkdirSync, writeFileSync, readdirSync, unlinkSync, chmodSync } from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+import { URL } from 'node:url'
+
+const SKILLS_DIR = join(homedir(), '.mipham', 'skills')
+
+// ═══════════════════════════════════════════════════════════════
+// Community Skill Registry
+// ═══════════════════════════════════════════════════════════════
+
+export interface SkillEntry {
+  /** Unique skill name (kebab-case) */
+  name: string
+  /** One-line description */
+  description: string
+  /** GitHub repo URL (https://github.com/owner/repo) */
+  url: string
+  /** Skill file path within the repo (e.g. "skill.SKILL.md") */
+  file?: string
+  /** Category for grouping */
+  category: string
+  /** Author */
+  author: string
+}
+
+/**
+ * Embedded community skill registry.
+ * In the future, this can be fetched from a remote URL.
+ */
+const COMMUNITY_SKILLS: SkillEntry[] = [
+  {
+    name: 'code-review',
+    description: 'Automated code review with multiple dimensions',
+    url: 'https://github.com/One-Mipham/skill-code-review',
+    file: 'code-review.SKILL.md',
+    category: 'Development',
+    author: 'MiphamAI',
+  },
+  {
+    name: 'systematic-debugging',
+    description: 'Systematic debugging workflow — find root cause before fixing',
+    url: 'https://github.com/anthropics/skills',
+    file: 'systematic-debugging.SKILL.md',
+    category: 'Development',
+    author: 'Anthropic',
+  },
+  {
+    name: 'test-driven-development',
+    description: 'TDD workflow — write failing test first, then implement',
+    url: 'https://github.com/anthropics/skills',
+    file: 'test-driven-development.SKILL.md',
+    category: 'Development',
+    author: 'Anthropic',
+  },
+  {
+    name: 'web-access',
+    description: 'Web search, scraping, and browser automation',
+    url: 'https://github.com/One-Mipham/skill-web-access',
+    file: 'web-access.SKILL.md',
+    category: 'Network',
+    author: 'MiphamAI',
+  },
+  {
+    name: 'doc-generator',
+    description: 'Generate API docs, READMEs, and changelogs',
+    url: 'https://github.com/One-Mipham/skill-doc-generator',
+    file: 'doc-generator.SKILL.md',
+    category: 'Documentation',
+    author: 'MiphamAI',
+  },
+  {
+    name: 'github-ops',
+    description: 'GitHub PR/issue management and automation',
+    url: 'https://github.com/One-Mipham/skill-github-ops',
+    file: 'github-ops.SKILL.md',
+    category: 'DevOps',
+    author: 'MiphamAI',
+  },
+  {
+    name: 'security-review',
+    description: 'Security audit and vulnerability scanning for code changes',
+    url: 'https://github.com/One-Mipham/skill-security-review',
+    file: 'security-review.SKILL.md',
+    category: 'Security',
+    author: 'MiphamAI',
+  },
+  {
+    name: 'frontend-design',
+    description: 'Distinctive visual design guidance for UI components',
+    url: 'https://github.com/anthropics/skills',
+    file: 'frontend-design.SKILL.md',
+    category: 'Design',
+    author: 'Anthropic',
+  },
+]
+
+// ═══════════════════════════════════════════════════════════════
+// Skill Installer
+// ═══════════════════════════════════════════════════════════════
+
+export interface InstallResult {
+  success: boolean
+  name: string
+  message: string
+}
+
+/**
+ * Get the list of available community skills.
+ */
+export function getAvailableSkills(): SkillEntry[] {
+  return [...COMMUNITY_SKILLS]
+}
+
+/**
+ * Search for skills by name or description.
+ */
+export function searchSkills(query: string): SkillEntry[] {
+  const q = query.toLowerCase()
+  return COMMUNITY_SKILLS.filter(
+    (s) => s.name.toLowerCase().includes(q) || s.description.toLowerCase().includes(q),
+  )
+}
+
+/**
+ * Install a skill from a GitHub repository.
+ *
+ * Clones the repo to a temp directory, copies the skill file(s),
+ * and cleans up.
+ */
+export function installSkill(skillName: string): InstallResult {
+  const entry = COMMUNITY_SKILLS.find((s) => s.name === skillName)
+  if (!entry) {
+    return {
+      success: false,
+      name: skillName,
+      message: `Skill "${skillName}" not found in the registry. Use /browse-skills to see available skills.`,
+    }
+  }
+
+  const destDir = join(SKILLS_DIR)
+  const destPath = join(destDir, `${skillName}.SKILL.md`)
+
+  // Check if already installed
+  if (existsSync(destPath)) {
+    return {
+      success: false,
+      name: skillName,
+      message: `Skill "${skillName}" is already installed. Remove it first to reinstall.`,
+    }
+  }
+
+  mkdirSync(destDir, { recursive: true })
+
+  try {
+    // Download the skill file from GitHub raw content
+    const rawUrl = githubRawUrl(entry.url, entry.file || `${skillName}.SKILL.md`)
+    const content = downloadFile(rawUrl)
+
+    // Validate it's a proper skill file (has frontmatter)
+    if (!content.includes('---')) {
+      return {
+        success: false,
+        name: skillName,
+        message: `Downloaded file does not appear to be a valid skill (missing frontmatter).`,
+      }
+    }
+
+    writeFileSync(destPath, content, 'utf-8')
+
+    return {
+      success: true,
+      name: skillName,
+      message: `Skill "${skillName}" installed to ${destPath}\nRun /reload-skills to activate it.`,
+    }
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    return {
+      success: false,
+      name: skillName,
+      message: `Failed to install "${skillName}": ${msg}`,
+    }
+  }
+}
+
+/**
+ * Install a skill from a direct URL (GitHub raw, gist, or any HTTP URL).
+ */
+export function installSkillFromUrl(url: string): InstallResult {
+  // Derive skill name from URL
+  const name =
+    url
+      .split('/')
+      .pop()
+      ?.replace(/\.(SKILL\.)?md$/i, '') || 'custom-skill'
+
+  const destDir = join(SKILLS_DIR)
+  const destPath = join(destDir, `${name}.SKILL.md`)
+
+  mkdirSync(destDir, { recursive: true })
+
+  try {
+    const content = downloadFile(url)
+
+    if (!content.includes('---')) {
+      return {
+        success: false,
+        name,
+        message: `Downloaded file does not appear to be a valid skill (missing frontmatter).`,
+      }
+    }
+
+    writeFileSync(destPath, content, 'utf-8')
+
+    return {
+      success: true,
+      name,
+      message: `Skill "${name}" installed from URL to ${destPath}\nRun /reload-skills to activate it.`,
+    }
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    return { success: false, name, message: `Failed to install from URL: ${msg}` }
+  }
+}
+
+/**
+ * List installed skills (files in ~/.mipham/skills/).
+ */
+export function listInstalledSkills(): string[] {
+  if (!existsSync(SKILLS_DIR)) return []
+  return readdirSync(SKILLS_DIR).filter(
+    (f: string) => f.endsWith('.SKILL.md') || f.endsWith('.mipham-skill.md'),
+  )
+}
+
+/**
+ * Remove an installed skill.
+ */
+export function removeSkill(skillName: string): InstallResult {
+  const destPath = join(SKILLS_DIR, `${skillName}.SKILL.md`)
+  if (!existsSync(destPath)) {
+    return { success: false, name: skillName, message: `Skill "${skillName}" is not installed.` }
+  }
+  try {
+    unlinkSync(destPath)
+    return {
+      success: true,
+      name: skillName,
+      message: `Skill "${skillName}" removed. Run /reload-skills to refresh.`,
+    }
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    return { success: false, name: skillName, message: `Failed to remove: ${msg}` }
+  }
+}
+
+// ═══════════════════════════════════════════════════════════════
+// Helpers
+// ═══════════════════════════════════════════════════════════════
+
+/**
+ * Convert a GitHub repo URL to a raw content URL.
+ *   https://github.com/owner/repo → https://raw.githubusercontent.com/owner/repo/main/<file>
+ */
+function githubRawUrl(repoUrl: string, file: string): string {
+  const base = repoUrl.replace('https://github.com/', 'https://raw.githubusercontent.com/')
+  return `${base}/main/${file}`
+}
+
+/** Allowed domains for remote skill installation */
+const ALLOWED_DOMAINS = [
+  'raw.githubusercontent.com',
+  'github.com',
+  'gist.githubusercontent.com',
+  'gitlab.com',
+]
+
+/**
+ * Download a file from a URL using curl with spawn (no shell injection).
+ * Only allows HTTPS URLs from known safe domains.
+ */
+function downloadFile(rawUrl: string): string {
+  let parsed: URL
+  try {
+    parsed = new URL(rawUrl)
+  } catch {
+    throw new Error(`Invalid URL: ${rawUrl}`)
+  }
+
+  // Protocol must be HTTPS
+  if (parsed.protocol !== 'https:') {
+    throw new Error(`Only HTTPS URLs are allowed (got: ${parsed.protocol})`)
+  }
+
+  // Domain must be in allowlist
+  if (!ALLOWED_DOMAINS.some((d) => parsed.hostname === d || parsed.hostname.endsWith('.' + d))) {
+    throw new Error(
+      `Domain not allowed: ${parsed.hostname}. Allowed: ${ALLOWED_DOMAINS.join(', ')}`,
+    )
+  }
+
+  // Use spawnSync with args array — no shell, no injection
+  const result = spawnSync('curl', ['-fsSL', rawUrl], {
+    encoding: 'utf-8',
+    timeout: 15_000,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  })
+
+  if (result.error) {
+    throw new Error(`Failed to download: ${result.error.message}`)
+  }
+  if (result.status !== 0) {
+    throw new Error(`Download failed with status ${result.status}`)
+  }
+
+  return result.stdout
+}

package/src/ui/app.tsx

@@ -423,7 +423,7 @@ export function App({
           </Text>
           <Text dimColor> · ⏵⏵ accept edits on</Text>
           <Text dimColor> (Shift+Tab to cycle)</Text>
-          <Text dimColor> · Ctrl+P pick · /help · Esc cancel</Text>
+          <Text dimColor> · Ctrl+P pick · /help /commands · Esc cancel</Text>
           <Text dimColor> · ← agents</Text>
         </Box>
       </Box>

package/src/ui/chat.tsx

@@ -7,6 +7,16 @@ interface ChatPanelProps {
   focusMode?: boolean
 }
 
+/** Format cwd for display: replace HOME with ~, truncate if too long */
+function displayCwd(): string {
+  const cwd = process.cwd()
+  const home = process.env.HOME || ''
+  if (home && cwd.startsWith(home)) {
+    return '~' + cwd.slice(home.length)
+  }
+  return cwd
+}
+
 export function ChatPanel({ messages, focusMode }: ChatPanelProps) {
   // In focus mode, show only the last user+assistant exchange
   const displayMessages = focusMode ? getLastExchange(messages) : messages
@@ -61,7 +71,7 @@ export function ChatPanel({ messages, focusMode }: ChatPanelProps) {
                 color={msg.role === 'user' ? 'green' : msg.role === 'system' ? 'yellow' : 'blue'}
               >
                 {msg.role === 'user'
-                  ? '▸ You'
+                  ? `▸ ${displayCwd()}`
                   : msg.role === 'assistant'
                     ? 'Mipham Code'
                     : '⚠ System'}

package/src/ui/command-picker.tsx

@@ -0,0 +1,145 @@
+import React, { useState, useMemo, useEffect } from 'react'
+import { Box, Text, useInput } from 'ink'
+import TextInput from 'ink-text-input'
+import { getCommandList, type CommandEntry } from './commands.js'
+
+interface CommandPickerProps {
+  /** Text already typed (e.g. "/", "/age") — used as initial filter */
+  initialFilter: string
+  /** Called when user selects a command */
+  onSelect: (commandName: string) => void
+  /** Called when user presses Esc */
+  onClose: () => void
+  /** Max visible items before scrolling */
+  maxVisible?: number
+}
+
+const PAGE_SIZE = 12
+
+/**
+ * CommandPicker — interactive slash-command selector.
+ *
+ * Reuses the ModelPicker's Ink interaction pattern:
+ *   ↑/↓ cursor navigation (wrapping), Enter to select, Esc to close.
+ * Plus real-time filtering — user types to narrow the command list.
+ */
+export function CommandPicker({
+  initialFilter,
+  onSelect,
+  onClose,
+  maxVisible = PAGE_SIZE,
+}: CommandPickerProps) {
+  const allCommands = useMemo(() => getCommandList(), [])
+  const [filter, setFilter] = useState(initialFilter)
+  const [cursorIdx, setCursorIdx] = useState(0)
+
+  // Filter commands based on user input
+  const filtered = useMemo(() => {
+    const q = filter.startsWith('/') ? filter.slice(1).toLowerCase() : filter.toLowerCase()
+    if (!q) return allCommands
+    return allCommands.filter(
+      (cmd) => cmd.name.toLowerCase().includes(q) || cmd.description.toLowerCase().includes(q),
+    )
+  }, [filter, allCommands])
+
+  // Reset cursor when filter changes
+  useEffect(() => {
+    setCursorIdx(0)
+  }, [filter])
+
+  // Scroll window: keep cursor in the visible range
+  const scrollStart = Math.max(
+    0,
+    Math.min(cursorIdx - Math.floor(maxVisible / 2), filtered.length - maxVisible),
+  )
+  const visible = filtered.slice(scrollStart, scrollStart + maxVisible)
+  const adjustedCursor = cursorIdx - scrollStart
+
+  // Wrap cursor safely
+  const safeCursor = (i: number) =>
+    filtered.length === 0 ? 0 : ((i % filtered.length) + filtered.length) % filtered.length
+
+  useInput((_input, key) => {
+    if (key.escape) {
+      onClose()
+      return
+    }
+
+    if (key.return) {
+      const selected = filtered[cursorIdx]
+      if (selected) {
+        onSelect(selected.name)
+      }
+      return
+    }
+
+    if (key.upArrow) {
+      setCursorIdx((prev) => safeCursor(prev - 1))
+      return
+    }
+
+    if (key.downArrow) {
+      setCursorIdx((prev) => safeCursor(prev + 1))
+      return
+    }
+  })
+
+  const itemColor = (isCursor: boolean) => (isCursor ? 'cyan' : undefined)
+  const itemBold = (isCursor: boolean) => isCursor
+
+  return (
+    <Box flexDirection="column" borderStyle="round" borderColor="cyan" padding={1}>
+      {/* Title */}
+      <Box marginBottom={1}>
+        <Text bold color="cyan">
+          Commands
+        </Text>
+        <Text dimColor> ↑↓ navigate · Enter select · Esc close</Text>
+      </Box>
+
+      {/* Command list */}
+      <Box flexDirection="column" marginBottom={1}>
+        {visible.length === 0 && <Text dimColor> No commands match "{filter}"</Text>}
+        {visible.map((cmd, i) => {
+          const globalIdx = i + scrollStart
+          const isCursor = globalIdx === cursorIdx
+          return (
+            <Box key={cmd.name}>
+              <Text color={itemColor(isCursor)} bold={itemBold(isCursor)}>
+                {isCursor ? '▶ ' : '  '}
+                {cmd.name.padEnd(20)}
+              </Text>
+              <Text dimColor>{cmd.description}</Text>
+            </Box>
+          )
+        })}
+      </Box>
+
+      {/* Scroll indicator */}
+      {filtered.length > maxVisible && (
+        <Box marginBottom={1}>
+          <Text dimColor>
+            {scrollStart + 1}–{Math.min(scrollStart + maxVisible, filtered.length)} of{' '}
+            {filtered.length} commands
+          </Text>
+        </Box>
+      )}
+
+      {/* Filter input */}
+      <Box>
+        <Text color="cyan">/ </Text>
+        <TextInput
+          value={filter.startsWith('/') ? filter.slice(1) : filter}
+          onChange={(val) => setFilter(`/${val}`)}
+          onSubmit={() => {
+            const selected = filtered[cursorIdx]
+            if (selected) {
+              onSelect(selected.name)
+            }
+          }}
+          placeholder="Type to filter commands..."
+        />
+      </Box>
+    </Box>
+  )
+}