@miphamai/cli 0.5.8 → 0.5.10

package/src/config/loader.ts

@@ -1,30 +1,194 @@
-import { readFileSync, existsSync } from 'node:fs'
-import { join } from 'node:path'
+import {
+  readFileSync,
+  existsSync,
+  copyFileSync,
+  mkdirSync,
+  readdirSync,
+  unlinkSync,
+  chmodSync,
+} from 'node:fs'
+import { join, dirname } from 'node:path'
+import { homedir } from 'node:os'
 import { parse as parseYaml } from 'yaml'
-import type { MiphamConfig } from '../shared/index.ts'
+import type { MiphamConfig, ProviderConfig } from '../shared/index.ts'
 import { DEFAULT_CONFIG } from './defaults'
 
+const MIPHAM_HOME = join(homedir(), '.mipham')
+const BACKUP_PREFIX = 'config.backup-'
+
+/**
+ * Parse a YAML config file safely. Returns null on any error (missing file, bad syntax, etc).
+ * Prints a warning to stderr so the user knows something is wrong.
+ */
+function safeParseYaml(path: string, label: string): Partial<MiphamConfig> | null {
+  try {
+    if (!existsSync(path)) return null
+    const raw = readFileSync(path, 'utf-8')
+    return parseYaml(raw) as Partial<MiphamConfig>
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    process.stderr.write(`⚠ Mipham Code: failed to parse ${label} (${path}): ${msg}\n`)
+    return null
+  }
+}
+
+/**
+ * Deep-merge providers: for each provider in the user config, only override
+ * the fields the user explicitly set (apiKey, baseUrl). All other fields
+ * (name, protocol, models, status) come from the base defaults.
+ *
+ * This prevents users from accidentally losing model definitions when they
+ * only want to set their API key.
+ */
+function mergeProviders(
+  baseProviders: ProviderConfig[],
+  overrideProviders: ProviderConfig[],
+): ProviderConfig[] {
+  const merged = [...baseProviders]
+
+  for (const op of overrideProviders) {
+    const idx = merged.findIndex((bp) => bp.id === op.id)
+    if (idx === -1) {
+      // Provider not in defaults — add it wholesale (custom provider)
+      merged.push(op)
+      continue
+    }
+
+    // Merge: user overrides only the fields they provide
+    const base = merged[idx]!
+    merged[idx] = {
+      id: base.id,
+      name: op.name || base.name,
+      protocol: op.protocol || base.protocol,
+      baseUrl: op.baseUrl ?? base.baseUrl,
+      apiKey: op.apiKey ?? base.apiKey,
+      models: op.models?.length ? op.models : base.models,
+      status: op.status ?? base.status,
+    }
+  }
+
+  return merged
+}
+
+function mergeConfig(base: MiphamConfig, override: Partial<MiphamConfig>): MiphamConfig {
+  const merged: MiphamConfig = { ...base, ...override }
+  if (override.providers) {
+    merged.providers = mergeProviders(base.providers, override.providers)
+  } else {
+    merged.providers = base.providers
+  }
+  return merged
+}
+
+/**
+ * Save a timestamped backup of config.yml to ~/.mipham/.
+ * Keeps at most 5 backups; older ones are pruned.
+ */
+function backupConfig(configPath: string): void {
+  try {
+    if (!existsSync(configPath)) return
+    mkdirSync(MIPHAM_HOME, { recursive: true, mode: 0o700 })
+
+    const ts = new Date().toISOString().replace(/[:.]/g, '-')
+    const backupPath = join(MIPHAM_HOME, `${BACKUP_PREFIX}${ts}.yml`)
+    copyFileSync(configPath, backupPath)
+    chmodSync(backupPath, 0o600) // owner read/write only — contains API keys
+
+    // Prune old backups (keep last 5)
+    const files = readdirSync(MIPHAM_HOME)
+      .filter((f) => f.startsWith(BACKUP_PREFIX) && f.endsWith('.yml'))
+      .sort()
+    while (files.length > 5) {
+      const old = files.shift()!
+      try {
+        unlinkSync(join(MIPHAM_HOME, old))
+      } catch {
+        // best-effort cleanup
+      }
+    }
+  } catch {
+    // best-effort; never crash because backup failed
+  }
+}
+
+/**
+ * Try to restore config from the most recent backup.
+ * Returns true if restored successfully.
+ */
+function tryRestoreFromBackup(configPath: string): boolean {
+  try {
+    if (!existsSync(MIPHAM_HOME)) return false
+    const files = readdirSync(MIPHAM_HOME)
+      .filter((f) => f.startsWith(BACKUP_PREFIX) && f.endsWith('.yml'))
+      .sort()
+      .reverse() // newest first
+
+    if (files.length === 0) return false
+
+    const latestBackup = join(MIPHAM_HOME, files[0]!)
+    copyFileSync(latestBackup, configPath)
+    process.stderr.write(`⚠ Mipham Code: restored config from backup (${files[0]})\n`)
+    return true
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    process.stderr.write(`⚠ Mipham Code: failed to restore config from backup: ${msg}\n`)
+    return false
+  }
+}
+
 export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
   const configPath = join(cwd, '.mipham', 'config.yml')
-  const userConfigPath = join(process.env.HOME || '~', '.mipham', 'config.yml')
+  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
 
   let config = { ...DEFAULT_CONFIG }
 
-  if (existsSync(configPath)) {
-    const raw = readFileSync(configPath, 'utf-8')
-    const projectConfig = parseYaml(raw) as Partial<MiphamConfig>
+  // ── Load project-level config ──
+  const projectConfig = safeParseYaml(configPath, 'project config')
+  if (projectConfig) {
     config = mergeConfig(config, projectConfig)
+  } else if (existsSync(configPath)) {
+    // File exists but failed to parse — try to restore from backup
+    process.stderr.write(`⚠ Mipham Code: project config is corrupted, attempting recovery...\n`)
+    if (!tryRestoreFromBackup(configPath)) {
+      process.stderr.write(`⚠ Mipham Code: no backup available for project config. Skipping.\n`)
+    } else {
+      // Retry parsing after restore
+      const restored = safeParseYaml(configPath, 'restored project config')
+      if (restored) {
+        config = mergeConfig(config, restored)
+      }
+    }
   }
 
-  if (existsSync(userConfigPath)) {
-    const raw = readFileSync(userConfigPath, 'utf-8')
-    const userConfig = parseYaml(raw) as Partial<MiphamConfig>
+  // ── Load user-level config ──
+  const userConfig = safeParseYaml(userConfigPath, 'user config')
+  if (userConfig) {
     config = mergeConfig(config, userConfig)
+  } else if (existsSync(userConfigPath)) {
+    // File exists but failed to parse — try to restore from backup
+    process.stderr.write(`⚠ Mipham Code: user config is corrupted, attempting recovery...\n`)
+    if (!tryRestoreFromBackup(userConfigPath)) {
+      process.stderr.write(`⚠ Mipham Code: no backup available for user config. Skipping.\n`)
+    } else {
+      // Retry parsing after restore
+      const restored = safeParseYaml(userConfigPath, 'restored user config')
+      if (restored) {
+        config = mergeConfig(config, restored)
+      }
+    }
+  } else {
+    // No user config yet — create the directory so it's ready
+    try {
+      mkdirSync(MIPHAM_HOME, { recursive: true })
+    } catch {
+      // best-effort
+    }
   }
 
-  return config
-}
+  // ── Auto-backup: save a copy of the user config if it loaded successfully ──
+  if (userConfig) {
+    backupConfig(userConfigPath)
+  }
 
-function mergeConfig(base: MiphamConfig, override: Partial<MiphamConfig>): MiphamConfig {
-  return { ...base, ...override, providers: override.providers ?? base.providers }
+  return config
 }

package/src/plugin/plugin-manager.ts

@@ -1,6 +1,7 @@
 import { mkdirSync, existsSync, writeFileSync, readFileSync, readdirSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
+import { execSync } from 'node:child_process'
 import { validatePlugin } from './plugin-validator'
 
 const PLUGIN_DIR = join(homedir(), '.mipham', 'plugins')
@@ -58,6 +59,82 @@ export class PluginManager {
     }
   }
 
+  /** Validate npm package name against the npm spec. */
+  private isValidPackageName(name: string): boolean {
+    // npm package name regex: optional @scope/ + package name
+    return /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/.test(name)
+  }
+
+  /**
+   * Install a plugin from npm (e.g. `npm install <package>` into the plugins dir).
+   * The npm package must export a valid plugin manifest at its root.
+   */
+  installFromNpm(packageName: string): { success: boolean; message: string } {
+    if (!this.isValidPackageName(packageName)) {
+      return { success: false, message: `Invalid package name: "${packageName}"` }
+    }
+
+    // Derive plugin name from npm package name (strip scope prefix)
+    const pluginName = packageName.replace(/^@.+\//, '').replace(/^mipham-plugin-/, '')
+
+    const destDir = join(this.pluginDir, pluginName)
+    if (existsSync(destDir)) {
+      return {
+        success: false,
+        message: `Plugin "${pluginName}" is already installed`,
+      }
+    }
+
+    try {
+      // Install the npm package into the plugins directory
+      mkdirSync(destDir, { recursive: true })
+
+      // Create a minimal package.json so npm install works in a subdirectory
+      writeFileSync(
+        join(destDir, 'package.json'),
+        JSON.stringify({ private: true }, null, 2),
+        'utf-8',
+      )
+
+      execSync(`npm install ${packageName} --prefix "${destDir}" --no-save`, {
+        encoding: 'utf-8',
+        stdio: 'pipe',
+        timeout: 60_000,
+      })
+
+      // Validate the installed plugin
+      const validation = validatePlugin(destDir)
+      if (!validation.valid) {
+        // Clean up on invalid plugin
+        rmSync(destDir, { recursive: true, force: true })
+        return { success: false, message: validation.errors.join('; ') }
+      }
+
+      this.plugins.push({
+        name: validation.manifest?.name || pluginName,
+        version: validation.manifest?.version || '0.0.0',
+        path: destDir,
+        enabled: true,
+        installedAt: new Date().toISOString(),
+      })
+
+      this.saveState()
+      return {
+        success: true,
+        message: `Plugin "${pluginName}" installed from npm`,
+      }
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : String(err)
+      // Clean up on failure
+      try {
+        rmSync(destDir, { recursive: true, force: true })
+      } catch {
+        /* ok */
+      }
+      return { success: false, message: `npm install failed: ${msg}` }
+    }
+  }
+
   list(): InstalledPlugin[] {
     return [...this.plugins]
   }

package/src/providers/anthropic.ts

@@ -278,9 +278,19 @@ export class AnthropicProvider implements ProviderInstance {
   }
 
   private resolveApiKey(keyTemplate: string): string {
-    const match = keyTemplate.match(/^\$\{(.+)\}$/)
+    // Accept both ${VAR} and $VAR syntax
+    let match = keyTemplate.match(/^\$\{(.+)\}$/)
+    if (!match) match = keyTemplate.match(/^\$([A-Z_][A-Z0-9_]*)$/)
     if (match?.[1]) {
-      return process.env[match[1]] || ''
+      const varName = match[1]
+      const value = process.env[varName]
+      if (!value) {
+        process.stderr.write(
+          `⚠ Anthropic provider: apiKey references $${varName} but that environment variable is not set\n`,
+        )
+        return ''
+      }
+      return value
     }
     return keyTemplate
   }

package/src/providers/bootstrap.ts

@@ -13,8 +13,18 @@ export function bootstrapProviders(
   for (const config of configs) {
     if (config.status === 'upcoming') continue
 
-    switch (config.protocol) {
+    // Warn if apiKey is empty (will cause API errors at runtime)
+    if (!config.apiKey || config.apiKey.trim() === '') {
+      process.stderr.write(
+        `⚠ Provider "${config.name}" (${config.id}): apiKey not set. ` +
+          `Set it in ~/.mipham/config.yml or via environment variable.\n`,
+      )
+    }
+
+    const protocol = config.protocol?.toLowerCase()
+    switch (protocol) {
       case 'openai-compatible':
+      case 'openai-compat': // common user typo
         registry.register(config.id, new OpenAICompatProvider(config))
         break
       case 'anthropic':

package/src/providers/openai-compat.ts

@@ -6,7 +6,9 @@ export class OpenAICompatProvider implements ProviderInstance {
   constructor(public config: ProviderConfig) {}
 
   async *chat(req: ChatRequest): AsyncGenerator<StreamChunk> {
-    const baseUrl = this.config.baseUrl?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
+    // Accept both baseUrl and baseURL (common YAML typo)
+    const rawBase = (this.config as any).baseUrl || (this.config as any).baseURL
+    const baseUrl = rawBase?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
     const apiKey = this.resolveApiKey(this.config.apiKey)
 
     const body = {
@@ -136,7 +138,8 @@ export class OpenAICompatProvider implements ProviderInstance {
 
   async healthCheck(): Promise<boolean> {
     try {
-      const baseUrl = this.config.baseUrl?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
+      const rawBase = (this.config as any).baseUrl || (this.config as any).baseURL
+      const baseUrl = rawBase?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
       const apiKey = this.resolveApiKey(this.config.apiKey)
       const res = await fetch(`${baseUrl}/models`, {
         headers: { Authorization: `Bearer ${apiKey}` },
@@ -187,9 +190,19 @@ export class OpenAICompatProvider implements ProviderInstance {
   }
 
   private resolveApiKey(keyTemplate: string): string {
-    const match = keyTemplate.match(/^\$\{(.+)\}$/)
+    // Accept both ${VAR} and $VAR syntax
+    let match = keyTemplate.match(/^\$\{(.+)\}$/)
+    if (!match) match = keyTemplate.match(/^\$([A-Z_][A-Z0-9_]*)$/)
     if (match?.[1]) {
-      return process.env[match[1]] || ''
+      const varName = match[1]
+      const value = process.env[varName]
+      if (!value) {
+        process.stderr.write(
+          `⚠ OpenAI-compatible provider: apiKey references $${varName} but that environment variable is not set\n`,
+        )
+        return ''
+      }
+      return value
     }
     return keyTemplate
   }

package/src/shared/constants.ts

@@ -244,6 +244,51 @@ export const DEFAULT_PROVIDERS: ProviderConfig[] = [
       },
     ],
   },
+  {
+    id: 'kimi',
+    name: 'Kimi (月之暗面)',
+    protocol: 'openai-compatible',
+    baseUrl: 'https://api.moonshot.cn/v1',
+    apiKey: '${KIMI_API_KEY}',
+    models: [
+      {
+        id: 'kimi-latest',
+        name: 'Kimi Latest',
+        providerId: 'kimi',
+        contextWindow: 128_000,
+        maxOutput: 16_000,
+        vision: true,
+        status: 'active',
+      },
+      {
+        id: 'moonshot-v1-8k',
+        name: 'Moonshot v1 8K',
+        providerId: 'kimi',
+        contextWindow: 8_000,
+        maxOutput: 4_000,
+        vision: false,
+        status: 'active',
+      },
+      {
+        id: 'moonshot-v1-32k',
+        name: 'Moonshot v1 32K',
+        providerId: 'kimi',
+        contextWindow: 32_000,
+        maxOutput: 4_000,
+        vision: false,
+        status: 'active',
+      },
+      {
+        id: 'moonshot-v1-128k',
+        name: 'Moonshot v1 128K',
+        providerId: 'kimi',
+        contextWindow: 128_000,
+        maxOutput: 4_000,
+        vision: false,
+        status: 'active',
+      },
+    ],
+  },
   {
     id: 'mipham',
     name: 'MiphamAI',

package/src/shared/update.ts

@@ -0,0 +1,158 @@
+/**
+ * Mipham Code — Self-update utilities.
+ *
+ * Shared between the CLI entry point (bin/mipham.ts) and the TUI slash
+ * command handler (commands.ts) so that both `mipham update` and `/upgrade`
+ * use the same logic.
+ */
+
+import { readFileSync, existsSync, copyFileSync, mkdirSync, chmodSync } from 'node:fs'
+import { join } from 'node:path'
+import { execSync } from 'node:child_process'
+import { homedir } from 'node:os'
+
+const PACKAGE = '@miphamai/cli'
+const HOME = homedir()
+const MIPHAM_HOME = join(HOME, '.mipham')
+const CONFIG_PATH = join(MIPHAM_HOME, 'config.yml')
+
+export interface UpdateCheck {
+  /** Current installed version */
+  current: string
+  /** Latest version on npm */
+  latest: string
+  /** Whether an update is available */
+  available: boolean
+}
+
+/**
+ * Read the currently installed version from package.json.
+ */
+export function getCurrentVersion(): string {
+  try {
+    // Try the CLI's own package.json first
+    const cliPkg = join(import.meta.dirname!, '..', '..', 'package.json')
+    if (existsSync(cliPkg)) {
+      const pkg = JSON.parse(readFileSync(cliPkg, 'utf-8'))
+      return pkg.version
+    }
+  } catch {
+    // fall through
+  }
+  return 'unknown'
+}
+
+/**
+ * Fetch the latest version from the npm registry.
+ * Returns the version string, or throws on failure.
+ */
+function fetchLatestVersion(): string {
+  const result = execSync(`npm view ${PACKAGE} version --json`, {
+    encoding: 'utf-8',
+    timeout: 10_000,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  }).trim()
+  return result.replace(/"/g, '')
+}
+
+/**
+ * Check if an update is available by comparing the local version
+ * against the npm registry.
+ */
+export function checkForUpdates(): UpdateCheck {
+  const current = getCurrentVersion()
+  let latest = current
+  let available = false
+
+  try {
+    latest = fetchLatestVersion()
+    available = compareVersions(latest, current) > 0
+  } catch {
+    // If we can't reach npm, treat as up-to-date (don't alarm the user)
+  }
+
+  return { current, latest, available }
+}
+
+/**
+ * Back up the user's config.yml before an update.
+ * Returns the backup path, or null if backup wasn't possible.
+ */
+export function backupConfig(label: string): string | null {
+  if (!existsSync(CONFIG_PATH)) return null
+  try {
+    mkdirSync(MIPHAM_HOME, { recursive: true, mode: 0o700 })
+    const ts = new Date().toISOString().replace(/[:.]/g, '-')
+    const backupPath = join(MIPHAM_HOME, `config.pre-${label}-${ts}.yml`)
+    copyFileSync(CONFIG_PATH, backupPath)
+    chmodSync(backupPath, 0o600) // owner read/write only — contains API keys
+    return backupPath
+  } catch {
+    return null
+  }
+}
+
+/** Validate a semver string before passing it to a shell command. */
+const SEMVER_RE = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.]+)?(\+[a-zA-Z0-9.]+)?$/
+
+function isValidSemver(v: string): boolean {
+  return SEMVER_RE.test(v)
+}
+
+/**
+ * Perform the actual update via npm install -g.
+ * Validates the version string before shell execution (prevents command injection).
+ * Returns true on success.
+ */
+export function performUpdate(version: string): boolean {
+  if (!isValidSemver(version)) {
+    process.stderr.write(`⚠ Refusing to install invalid version: "${version}"\n`)
+    return false
+  }
+
+  try {
+    execSync(`npm install -g ${PACKAGE}@${version}`, {
+      encoding: 'utf-8',
+      stdio: 'inherit',
+      timeout: 120_000,
+    })
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Restore config from a backup path.
+ */
+export function restoreConfig(backupPath: string): boolean {
+  if (!existsSync(backupPath)) return false
+  try {
+    copyFileSync(backupPath, CONFIG_PATH)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Get the config path so callers can verify it survived.
+ */
+export function getConfigPath(): string {
+  return CONFIG_PATH
+}
+
+/**
+ * Compare two semver strings. Returns >0 if a > b, <0 if a < b, 0 if equal.
+ */
+function compareVersions(a: string, b: string): number {
+  const pa = a.split('.').map(Number)
+  const pb = b.split('.').map(Number)
+  for (let i = 0; i < 3; i++) {
+    const da = pa[i] ?? 0
+    const db = pb[i] ?? 0
+    if (da > db) return 1
+    if (da < db) return -1
+  }
+  return 0
+}