@miphamai/cli 0.50.0 → 0.52.0

package/bin/mipham.ts

@@ -530,9 +530,6 @@ async function runAgentCLI(): Promise<boolean> {
   if (args[0] !== 'agents' && args[0] !== 'agent') return false
 
   const { getPort, getDaemonStatus } = await import('../src/daemon/index')
-  const { join } = await import('node:path')
-  const { readFileSync, existsSync } = await import('node:fs')
-  const { homedir } = await import('node:os')
 
   // Check if daemon is running
   const status = getDaemonStatus()
@@ -542,11 +539,6 @@ async function runAgentCLI(): Promise<boolean> {
   }
 
   const port = getPort()
-  const tokenPath = join(homedir(), '.mipham', 'daemon.token')
-  let token = ''
-  if (existsSync(tokenPath)) {
-    token = readFileSync(tokenPath, 'utf-8').trim()
-  }
 
   const baseUrl = `http://127.0.0.1:${port}`
 
@@ -1020,7 +1012,7 @@ async function runTokenCLI(): Promise<boolean> {
   if (args[0] !== 'token') return false
 
   const { join } = await import('node:path')
-  const { readFileSync, existsSync } = await import('node:fs')
+  const { existsSync } = await import('node:fs')
   const { homedir } = await import('node:os')
   const { rotateToken, listTokens } = await import('../src/daemon/auth')
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.50.0",
+  "version": "0.52.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",
@@ -45,7 +45,6 @@
     "commander": "^13.1.0",
     "ink": "^5.2.1",
     "ink-text-input": "^6.0.0",
-    "js-tiktoken": "^1.0.21",
     "react": "^18.3.1",
     "react-devtools-core": "^4.28.5",
     "yaml": "^2.9.0"

package/skills/standard/web-access/references/cdp-api.md

@@ -3,9 +3,10 @@
 ## 基础信息
 
 - 地址：`http://localhost:3456`
-- 启动：`node ~/.claude/skills/web-access/scripts/cdp-proxy.mjs &`
+- 启动：`node ~/.mipham/skills/web-access/scripts/cdp-proxy.mjs &`
 - 启动后持续运行，不建议主动停止（重启需 Chrome 重新授权）
 - 强制停止：`pkill -f cdp-proxy.mjs`
+- 鉴权：除 `/health` 外，所有端点要求请求头 `X-CDP-Token`，值 = `~/.mipham/skills/web-access/.cdp-token` 的内容（下方示例省略此头）
 
 ## API 端点
 

package/skills/standard/web-access/scripts/cdp-proxy.mjs

@@ -4,11 +4,12 @@
 // Node.js 22+（使用原生 WebSocket）
 
 import http from 'node:http'
-import { URL } from 'node:url'
+import { URL, fileURLToPath } from 'node:url'
 import fs from 'node:fs'
 import path from 'node:path'
 import os from 'node:os'
 import net from 'node:net'
+import crypto from 'node:crypto'
 
 const PORT = parseInt(process.env.CDP_PROXY_PORT || '3456')
 let ws = null
@@ -19,6 +20,56 @@ const managedTabs = new Map() // targetId -> { lastAccessed: number }
 const TAB_IDLE_TIMEOUT = parseInt(process.env.CDP_TAB_IDLE_TIMEOUT || '900000') // 15 min default
 const CLEANUP_INTERVAL = 60000 // sweep every 60s
 
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const TOKEN_FILE = path.join(ROOT, '.cdp-token')
+
+// --- 共享密钥鉴权 ---
+// 防御浏览器 CSRF 到 localhost：恶意网页能 fetch 127.0.0.1:3456，但读不到本文件。
+let authToken = null
+function readToken() {
+  try {
+    const t = fs.readFileSync(TOKEN_FILE, 'utf-8').trim()
+    if (t) return t
+  } catch {
+    /* 尚未生成 */
+  }
+  return null
+}
+function ensureToken() {
+  const existing = readToken()
+  if (existing) {
+    authToken = existing
+    return existing
+  }
+  authToken = crypto.randomBytes(32).toString('hex')
+  try {
+    fs.writeFileSync(TOKEN_FILE, authToken, { mode: 0o600 })
+  } catch {
+    /* 无写权限时仅内存持有，进程存活期内仍可鉴权 */
+  }
+  return authToken
+}
+
+// --- 窄 SSRF 防护 ---
+// 本工具用途即访问组织内网（SSO 后台/内部系统），故不做私有网段全量屏蔽；
+// 仅挡云元数据端点与非 http(s)/about 协议。完整 rebinding 防护见 src/security/url.ts。
+function validateNavUrl(rawUrl) {
+  let u
+  try {
+    u = new URL(rawUrl)
+  } catch {
+    return { ok: false, reason: 'invalid URL' }
+  }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:' && u.protocol !== 'about:') {
+    return { ok: false, reason: `unsupported protocol: ${u.protocol}` }
+  }
+  const host = u.hostname.toLowerCase()
+  if (host === '169.254.169.254' || host === 'metadata.google.internal') {
+    return { ok: false, reason: 'blocked: cloud metadata endpoint' }
+  }
+  return { ok: true }
+}
+
 // --- WebSocket 兼容层 ---
 let WS
 if (typeof globalThis.WebSocket !== 'undefined') {
@@ -378,6 +429,14 @@ const server = http.createServer(async (req, res) => {
       return
     }
 
+    // 鉴权：非 /health 端点要求 X-CDP-Token（防浏览器 CSRF 到 localhost）
+    const provided = req.headers['x-cdp-token'] || ''
+    if (!authToken || provided !== authToken) {
+      res.statusCode = 401
+      res.end(JSON.stringify({ error: 'unauthorized: missing or invalid X-CDP-Token' }))
+      return
+    }
+
     await connect()
 
     // GET /targets - 列出所有页面
@@ -390,6 +449,12 @@ const server = http.createServer(async (req, res) => {
     // GET /new?url=xxx - 创建新后台 tab
     else if (pathname === '/new') {
       const targetUrl = q.url || 'about:blank'
+      const check = validateNavUrl(targetUrl)
+      if (!check.ok) {
+        res.statusCode = 400
+        res.end(JSON.stringify({ error: check.reason }))
+        return
+      }
       const resp = await sendCDP('Target.createTarget', { url: targetUrl, background: true })
       const targetId = resp.result.targetId
       managedTabs.set(targetId, { lastAccessed: Date.now() })
@@ -417,6 +482,12 @@ const server = http.createServer(async (req, res) => {
 
     // GET /navigate?target=xxx&url=yyy - 导航（自动等待加载）
     else if (pathname === '/navigate') {
+      const check = validateNavUrl(q.url || '')
+      if (!check.ok) {
+        res.statusCode = 400
+        res.end(JSON.stringify({ error: check.reason }))
+        return
+      }
       const sid = await ensureSession(q.target)
       const resp = await sendCDP('Page.navigate', { url: q.url }, sid)
 
@@ -723,6 +794,9 @@ async function main() {
     process.exit(1)
   }
 
+  // 只有成功绑定端口的实例才生成/复用 token（避免多实例竞态）
+  ensureToken()
+
   server.listen(PORT, '127.0.0.1', () => {
     console.log(`[CDP Proxy] 运行在 http://localhost:${PORT}`)
     // 启动时尝试连接 Chrome（非阻塞）

package/skills/standard/web-access/scripts/check-deps.mjs

@@ -11,6 +11,7 @@ import { fileURLToPath } from 'node:url'
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 const PROXY_SCRIPT = path.join(ROOT, 'scripts', 'cdp-proxy.mjs')
 const PROXY_PORT = Number(process.env.CDP_PROXY_PORT || 3456)
+const TOKEN_FILE = path.join(ROOT, '.cdp-token')
 
 // --- Node.js 版本检查 ---
 
@@ -81,7 +82,7 @@ async function detectChromePort() {
       if (port > 0 && port < 65536 && (await checkPort(port))) {
         return port
       }
-    } catch (_) {}
+    } catch {}
   }
   // 回退：探测常见端口
   for (const port of [9222, 9229, 9333]) {
@@ -94,8 +95,22 @@ async function detectChromePort() {
 
 // --- CDP Proxy 启动与等待 ---
 
+function readToken() {
+  try {
+    const t = fs.readFileSync(TOKEN_FILE, 'utf8').trim()
+    if (t) return t
+  } catch {
+    /* proxy 尚未生成 token */
+  }
+  return null
+}
+
 function httpGetJson(url, timeoutMs = 3000) {
-  return fetch(url, { signal: AbortSignal.timeout(timeoutMs) })
+  const token = readToken()
+  return fetch(url, {
+    signal: AbortSignal.timeout(timeoutMs),
+    headers: token ? { 'X-CDP-Token': token } : {},
+  })
     .then(async (res) => {
       try {
         return JSON.parse(await res.text())

package/skills/standard/web-access.SKILL.md

@@ -44,7 +44,14 @@ node ~/.mipham/skills/web-access/scripts/check-deps.mjs
 
 通过 CDP Proxy 直连用户日常 Chrome，天然携带登录态。**不主动操作用户已有 tab**，所有操作在自己创建的后台 tab 中进行，任务结束关闭自建 tab（保留用户原 tab）。
 
-Proxy（`scripts/cdp-proxy.mjs`）由 `check-deps.mjs` 自动拉起并常驻。Proxy API（curl 调 `http://localhost:3456/...`）：
+Proxy（`scripts/cdp-proxy.mjs`）由 `check-deps.mjs` 自动拉起并常驻。Proxy 首次启动生成共享密钥 `~/.mipham/skills/web-access/.cdp-token`（0600），除 `/health` 外所有端点都要求请求头 `X-CDP-Token`。先取 token 再调 API：
+
+```bash
+TOKEN=$(cat ~/.mipham/skills/web-access/.cdp-token)
+curl -H "X-CDP-Token: $TOKEN" http://localhost:3456/targets
+```
+
+端点列表：
 
 | 端点                                       | 用途                                                                     |
 | ------------------------------------------ | ------------------------------------------------------------------------ |
@@ -122,8 +129,8 @@ Sources:
 - 不主动操作用户已有 tab；任务结束关闭自建 tab。
 - 不提交凭据（除非用户显式批准）。
 - 尊重 robots.txt 与速率限制；不抓 PII。
-- proxy 仅绑 127.0.0.1，不暴露外网；端口 3456 无鉴权，依赖本机信任边界，勿在共享/多用户主机运行。
-- ⚠️ proxy 不做 URL SSRF 校验（照搬上游，与 computer-use/Playwright 同类）：避免驱动 Chrome 访问本机内部服务/内网地址。
+- proxy 仅绑 127.0.0.1，不暴露外网；除 `/health` 外所有端点要求 `X-CDP-Token` 共享密钥（`~/.mipham/skills/web-access/.cdp-token`，0600），防浏览器 CSRF 到 localhost。勿在共享/多用户主机运行。
+- URL 过窄 SSRF 校验：拒绝非 http(s)/about 协议与云元数据端点（`169.254.169.254` / `metadata.google.internal`）。⚠️ 私有网段（10.x / 172.16 / 192.168 / localhost）**有意放行**——本工具用途即访问组织内网（SSO 后台/内部系统），与 web-fetch 的完整 SSRF 屏蔽不同。
 
 ## 何时不用本 skill
 

package/src/commands/keys.ts

@@ -1,5 +1,6 @@
 import type { CommandHandler } from '../ui/commands'
 import { KeyManager } from '../config/keys-manager'
+import { getProviderApiKey } from '../config/loader'
 
 export const keysCmd: CommandHandler = async (_ctx, args) => {
   const manager = new KeyManager()
@@ -58,6 +59,31 @@ export const keysCmd: CommandHandler = async (_ctx, args) => {
     return { content: lines.join('\n') }
   }
 
+  // /keys view <provider> — show the plaintext API key (decrypting if stored encrypted)
+  if (sub === 'view' || sub === 'show') {
+    const provider = args[1]
+    if (!provider) {
+      return { content: 'Usage: /keys view <provider>\n\nExample: /keys view deepseek' }
+    }
+    const key = getProviderApiKey(provider)
+    if (key === null) {
+      return {
+        content: `No API key found for provider "${provider}".\n\nIf it was stored encrypted, it may be unreadable (missing/corrupt credential key).`,
+      }
+    }
+    return {
+      content: [
+        '── Key View ──',
+        '',
+        `Provider: ${provider}`,
+        `API Key:  ${key}`,
+        '',
+        '⚠️  This is your plaintext API key. Do not share it or paste it anywhere.',
+        '    Rotate it at any time with /keys rotate <provider>.',
+      ].join('\n'),
+    }
+  }
+
   // /keys (list)
   const keys = manager.list()
 

package/src/commands/project.ts

@@ -1015,7 +1015,7 @@ const securityCmd: CommandHandler = async () => {
   return { content: lines.join('\n') }
 }
 
-const trustCmd: CommandHandler = (ctx) => {
+const trustCmd: CommandHandler = (_ctx) => {
   const trust = getWorkspaceTrust()
   const cwd = process.cwd()
   const trusted = trust.listTrusted()

package/src/config/credential-crypto.ts

@@ -0,0 +1,114 @@
+import {
+  existsSync,
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  chmodSync,
+  copyFileSync,
+} from 'node:fs'
+import { dirname, join } from 'node:path'
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
+
+/**
+ * Shared AES-256-GCM primitives for encrypting credentials at rest.
+ *
+ * Extracted from the MCP token store so config.yml API keys get the exact
+ * same at-rest protection (parent/subsidiary CLAUDE.md mandate "存储层
+ * AES-256-GCM"). The wire format `iv || authTag || ciphertext` (base64) is
+ * preserved verbatim from the original token-store implementation so existing
+ * `~/.mipham/mcp-tokens/*.enc` files remain decryptable.
+ */
+
+const ALGORITHM = 'aes-256-gcm'
+const IV_LENGTH = 16
+const AUTH_TAG_LENGTH = 16
+const KEY_LENGTH = 32
+
+/** Prefix marking an encrypted API key value in config.yml. */
+export const ENC_PREFIX = 'enc:v1:'
+
+/** Shared master-credential key file (used by both MCP tokens and config.yml). */
+const CREDENTIAL_KEY_FILENAME = '.cred-key'
+/** Pre-shared-key filename; migrated to {@link CREDENTIAL_KEY_FILENAME} on first use. */
+const LEGACY_KEY_FILENAME = '.mcp-key'
+
+/**
+ * Load the shared credential key from `keyDir`, migrating the legacy
+ * MCP-only `.mcp-key` to the shared `.cred-key` so existing encrypted MCP
+ * tokens stay decryptable. Falls back to creating a fresh key when neither
+ * exists.
+ */
+export function getCredentialKey(keyDir: string): Buffer {
+  const keyPath = join(keyDir, CREDENTIAL_KEY_FILENAME)
+  if (!existsSync(keyPath)) {
+    const legacyPath = join(keyDir, LEGACY_KEY_FILENAME)
+    if (existsSync(legacyPath)) {
+      copyFileSync(legacyPath, keyPath)
+      chmodSync(keyPath, 0o400)
+    }
+  }
+  return getOrCreateKey(keyPath)
+}
+
+/**
+ * Load the 32-byte encryption key from `keyPath`, creating a fresh random key
+ * (with owner-only read permissions) on first use.
+ */
+export function getOrCreateKey(keyPath: string): Buffer {
+  if (existsSync(keyPath)) {
+    return readFileSync(keyPath)
+  }
+  const key = randomBytes(KEY_LENGTH)
+  mkdirSync(dirname(keyPath), { recursive: true })
+  writeFileSync(keyPath, key)
+  chmodSync(keyPath, 0o400)
+  return key
+}
+
+/** Encrypt plaintext with AES-256-GCM. Returns `base64(iv || authTag || ciphertext)`. */
+export function encrypt(plaintext: string, key: Buffer): string {
+  const iv = randomBytes(IV_LENGTH)
+  const cipher = createCipheriv(ALGORITHM, key, iv)
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()])
+  const authTag = cipher.getAuthTag()
+  return Buffer.concat([iv, authTag, encrypted]).toString('base64')
+}
+
+/** Decrypt a value produced by {@link encrypt}. Throws on wrong key / corrupt data. */
+export function decrypt(ciphertext: string, key: Buffer): string {
+  const buf = Buffer.from(ciphertext, 'base64')
+  const iv = buf.subarray(0, IV_LENGTH)
+  const authTag = buf.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH)
+  const encrypted = buf.subarray(IV_LENGTH + AUTH_TAG_LENGTH)
+  const decipher = createDecipheriv(ALGORITHM, key, iv)
+  decipher.setAuthTag(authTag)
+  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf-8')
+}
+
+/**
+ * True when `value` is an environment-variable template rather than a literal
+ * secret — both `${VAR}` and `$VAR` forms (the provider resolvers accept both).
+ */
+export function isEnvTemplate(value: string): boolean {
+  return /^\$\{.*\}$/.test(value) || /^\$[A-Z_][A-Z0-9_]*$/.test(value)
+}
+
+/**
+ * Encrypt an API key for storage. Environment-variable templates and empty
+ * values are not secrets, so they pass through unchanged (keeping config.yml
+ * readable for env-based setups). Literal secrets get the `enc:v1:` prefix.
+ */
+export function encryptApiKey(apiKey: string, key: Buffer): string {
+  if (!apiKey || isEnvTemplate(apiKey)) return apiKey
+  return ENC_PREFIX + encrypt(apiKey, key)
+}
+
+/**
+ * Decrypt a stored API key. Plaintext (legacy or template) values pass through
+ * unchanged; `enc:v1:` values are decrypted. Throws on a missing/corrupt key so
+ * the caller can surface a clear error instead of sending a garbage key.
+ */
+export function decryptApiKey(stored: string, key: Buffer): string {
+  if (!stored.startsWith(ENC_PREFIX)) return stored
+  return decrypt(stored.slice(ENC_PREFIX.length), key)
+}

package/src/config/defaults.ts

@@ -16,6 +16,11 @@ export const DEFAULT_CONFIG: MiphamConfig = {
   // Org 级权限限制（可选）：forbiddenModes 禁指定模式 / maxAllowedMode 封顶层级；
   // 请求被禁模式时 fail-closed 降级（如 forbiddenModes:['bypassPermissions']）。
   // permissionRestrictions: { forbiddenModes: ['bypassPermissions'] },
+  // 用户自定义权限规则（可选）：allow/deny 接入运行时 PermissionSystem。
+  // mask 与 deny 互补、勿重叠（重叠则 deny 先触发、mask 轮不到 → 白做）：
+  //   - mask（credential_masking，默认开启）管「可读但含机密」：.env / .ssh/id_* / *.pem / *.key…
+  //   - deny 管「根本不该碰」且未被 mask 覆盖的文件：.git-credentials / .npmrc / .kube/config…
+  // permissionRules: { deny: ['Read(**/.git-credentials)', 'Read(**/.npmrc)'] },
   providers: DEFAULT_PROVIDERS,
   marketplace: {
     strictKnownMarketplaces: [],
@@ -23,7 +28,7 @@ export const DEFAULT_CONFIG: MiphamConfig = {
   },
   features: {
     mcp: { oauthEnabled: true },
-    context: { useRealTokenizer: true, adaptiveThresholds: true },
+    context: { adaptiveThresholds: true },
   },
   crsi: {
     ruleInjection: true,

package/src/config/loader.ts

@@ -27,6 +27,7 @@ import {
   DEFAULT_BACKGROUND_AGENT_CONFIG,
   DEFAULT_CROSS_SESSION_CONFIG,
 } from './defaults'
+import { getCredentialKey, encryptApiKey, decryptApiKey, ENC_PREFIX } from './credential-crypto'
 
 const MIPHAM_HOME = join(homedir(), '.mipham')
 const BACKUP_PREFIX = 'config.backup-'
@@ -294,6 +295,9 @@ export function loadConfig(cwd: string = process.cwd()): MiphamConfig {
     backupConfig(userConfigPath)
   }
 
+  // ── Decrypt API keys at rest (enc:v1:) back to plaintext ──
+  decryptProviderApiKeys(config.providers)
+
   return config
 }
 
@@ -438,6 +442,58 @@ export function loadCrossSessionConfig(cwd: string = process.cwd()): CrossSessio
   return merged
 }
 
+/**
+ * Decrypt any encrypted (`enc:v1:`) provider API keys in place, after config
+ * merge. Plaintext (legacy / env-template) values pass through untouched. On
+ * decrypt failure (missing/corrupt credential key) the key is cleared and a
+ * warning is written, so the provider surfaces "apiKey not set" rather than
+ * sending a garbage value.
+ */
+function decryptProviderApiKeys(providers: ProviderConfig[] | undefined): void {
+  if (!providers) return
+  const needsKey = providers.some((p) => p.apiKey.startsWith(ENC_PREFIX))
+  if (!needsKey) return
+  const key = getCredentialKey(MIPHAM_HOME)
+  for (const p of providers) {
+    if (!p.apiKey.startsWith(ENC_PREFIX)) continue
+    try {
+      p.apiKey = decryptApiKey(p.apiKey, key)
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : String(err)
+      process.stderr.write(
+        `⚠ Mipham Code: failed to decrypt API key for "${p.id}" (credential key missing/corrupt?): ${msg}\n`,
+      )
+      p.apiKey = ''
+    }
+  }
+}
+
+/**
+ * Read a single provider's API key from config.yml, decrypting it if stored
+ * encrypted. Returns null when the provider has no key or the key can't be
+ * decrypted. Used by `/keys view` to show the plaintext key on request.
+ */
+export function getProviderApiKey(providerId: string, cwd: string = process.cwd()): string | null {
+  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
+  const projectConfigPath = join(cwd, '.mipham', 'config.yml')
+  const configPath = existsSync(userConfigPath) ? userConfigPath : projectConfigPath
+
+  try {
+    if (!existsSync(configPath)) return null
+    const raw = readFileSync(configPath, 'utf-8')
+    const doc = (parseYaml(raw) as Record<string, unknown>) || {}
+    const providers = (doc.providers as Array<Record<string, unknown>>) || []
+    const p = providers.find((x) => x.id === providerId)
+    if (!p || typeof p.apiKey !== 'string') return null
+    if (!p.apiKey.startsWith(ENC_PREFIX)) return p.apiKey
+    return decryptApiKey(p.apiKey, getCredentialKey(MIPHAM_HOME))
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    process.stderr.write(`⚠ Mipham Code: failed to read API key for "${providerId}": ${msg}\n`)
+    return null
+  }
+}
+
 /**
  * Persist an API key for a single provider to the user-level config.yml.
  * Reads the existing YAML, updates/replaces the provider's apiKey field,
@@ -445,16 +501,10 @@ export function loadCrossSessionConfig(cwd: string = process.cwd()): CrossSessio
  *
  * Returns true on success, false on failure.
  */
-export function saveProviderApiKey(
-  providerId: string,
-  apiKey: string,
-  cwd: string = process.cwd(),
-): boolean {
-  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
-  const projectConfigPath = join(cwd, '.mipham', 'config.yml')
-
-  // Prefer user-level config; fall back to project-level if no user config exists.
-  const configPath = existsSync(userConfigPath) ? userConfigPath : projectConfigPath
+export function saveProviderApiKey(providerId: string, apiKey: string): boolean {
+  // API keys are user-level secrets — always persist to the user config, never
+  // the project config (which lives in the repo and could be committed).
+  const configPath = join(MIPHAM_HOME, 'config.yml')
 
   try {
     mkdirSync(MIPHAM_HOME, { recursive: true, mode: 0o700 })
@@ -464,19 +514,20 @@ export function saveProviderApiKey(
     if (existsSync(configPath)) {
       const raw = readFileSync(configPath, 'utf-8')
       doc = (parseYaml(raw) as Record<string, unknown>) || {}
-    } else if (configPath === projectConfigPath) {
-      mkdirSync(join(cwd, '.mipham'), { recursive: true })
     }
 
     // Find and update the provider in the providers array
     const providers = (doc.providers as Array<Record<string, unknown>>) || []
     const idx = providers.findIndex((p) => p.id === providerId)
 
+    // Encrypt literal keys at rest (env-variable templates pass through).
+    const storedKey = encryptApiKey(apiKey, getCredentialKey(MIPHAM_HOME))
+
     if (idx >= 0) {
-      providers[idx] = { ...providers[idx], apiKey }
+      providers[idx] = { ...providers[idx], apiKey: storedKey }
     } else {
       // Provider not in config — append it
-      providers.push({ id: providerId, apiKey })
+      providers.push({ id: providerId, apiKey: storedKey })
     }
 
     doc.providers = providers

package/src/core/auto-memory.ts

@@ -13,7 +13,7 @@
 
 import { MemoryManager, type MemoryEntry } from './memory/memory-manager.js'
 import type { PatternAnalyzer, Pattern } from '../agent/pattern-analyzer.js'
-import type { ExperienceRuleEngine, ToolRule } from './rule-engine.js'
+import type { ExperienceRuleEngine } from './rule-engine.js'
 import type { EffectivenessTracker } from '../agent/effectiveness-tracker.js'
 import type { ErrorSignatureDB } from './error-signature-db.js'
 import type { CrsiProvenanceBridge } from '../agent/crsi-provenance-bridge.js'
@@ -152,7 +152,7 @@ export class AutoMemoryEngine {
     modelId: string
     turnDurationMs: number
   }): TurnReflection {
-    const { sessionId, userMessage, assistantContent, toolCalls, modelProvider, modelId } = params
+    const { sessionId, userMessage, assistantContent, toolCalls } = params
 
     // 1. Categorize tool calls
     const successes: string[] = []
@@ -345,7 +345,7 @@ export class AutoMemoryEngine {
    * Only insights that are auto-applicable and have sufficient evidence
    * (≥ CRSI_RULE_THRESHOLD similar failures) are converted to rules.
    */
-  private feedCrsiPipeline(reflection: TurnReflection): void {
+  private feedCrsiPipeline(_reflection: TurnReflection): void {
     if (!this.ruleEngine || !this.patternAnalyzer) return
 
     // Count failures by category across ALL reflections (not just this one)

package/src/core/constitution-loader.ts

@@ -167,7 +167,6 @@ export class ConstitutionLoader {
     const result: MiphamConstitution = { version: '0.0.0', last_modified: '', principles: [] }
     let currentPrinciple: Partial<ConstitutionalPrinciple> | null = null
     let inPrinciples = false
-    let inList = false
 
     for (const line of lines) {
       const trimmed = line.trim()
@@ -188,7 +187,6 @@ export class ConstitutionLoader {
 
       // List items in principles
       if (inPrinciples && trimmed === '- id:') {
-        inList = true
         continue
       }
 

package/src/core/context.ts

@@ -186,7 +186,6 @@ export class ContextManager {
   }
 
   async compact(heading: string): Promise<{ before: number; after: number }> {
-    const beforeMsgs = this.messages.length
     const beforeTokens = this.estimatedTokens
 
     if (this.messages.length <= 30) {

package/src/core/credential-masker/index.ts

@@ -5,6 +5,7 @@ export { MaskingPipeline, getPipeline, maskContent } from './pipeline'
 export { matchCredentialFile, matchPath, globToRegex } from './matcher'
 export { filterEnv } from './env-filter'
 export { maskOutput } from './output-scrub'
+export { maskSearchOutput, maskGlobOutput } from './search'
 
 // Strategies
 export { FullMaskingStrategy } from './strategies/full'

package/src/core/credential-masker/matcher.ts

@@ -65,13 +65,16 @@ export function matchPath(filePath: string, pattern: string): boolean {
 }
 
 /**
- * Convert a glob pattern to a RegExp.
- * - ** → .* (matches any path segments)
- * - *  → [^/]* (matches within a single segment)
- * - ?  → . (single char)
- * - All other special regex chars are escaped.
+ * Translate a glob pattern to an un-anchored RegExp source (no `^` or `$`).
+ * This is the shared path-glob core, reused by both credential-file matching
+ * (full-path anchored via `globToRegex`) and `.mipham/rules/` path scoping
+ * (suffix anchored in RulesLoader). Semantics:
+ * - ** → .*     (matches any number of path segments, crosses `/`)
+ * - *  → [^/]*  (matches within a single segment, does not cross `/`)
+ * - ?  → .      (single char)
+ * - regex specials are escaped (treated literally)
  */
-export function globToRegex(pattern: string): RegExp {
+export function globToRegexSource(pattern: string): string {
   let regexStr = ''
   let i = 0
   while (i < pattern.length) {
@@ -102,5 +105,13 @@ export function globToRegex(pattern: string): RegExp {
     }
     i++
   }
-  return new RegExp('^' + regexStr + '$')
+  return regexStr
+}
+
+/**
+ * Convert a glob pattern to a full-path-anchored RegExp (see `globToRegexSource`
+ * for the `*`/`**`/`?` translation and escaping rules).
+ */
+export function globToRegex(pattern: string): RegExp {
+  return new RegExp('^' + globToRegexSource(pattern) + '$')
 }