@miphamai/cli 0.69.0 → 0.70.0

package/src/core/instructions.ts

@@ -11,12 +11,12 @@ import {
   type CrsiLessonSummary,
 } from './crsi-producer'
 
-interface FrontmatterResult {
+export interface FrontmatterResult {
   data: Record<string, unknown>
   content: string
 }
 
-function parseFrontmatter(raw: string): FrontmatterResult {
+export function parseFrontmatter(raw: string): FrontmatterResult {
   // Strip a leading UTF-8 BOM — otherwise `^---` never matches and a
   // BOM-prefixed file is silently treated as body text (effectively ignored).
   const src = raw.replace(/^\uFEFF/, '')

package/src/i18n-core/locales/en-US.json

@@ -579,7 +579,7 @@
     },
     "hooks": {
       "title": "── Hooks ──",
-      "no_hooks": "── Hooks ──\n\nNo hooks configured.\n\nCreate hook scripts in .mipham/hooks/:\n  pre-tool-use.sh   — runs before each tool\n  post-tool-use.sh  — runs after each tool\n  stop.sh           — runs when session ends\n\nUse /loop init to scaffold hooks directory.",
+      "no_hooks": "── Hooks ──\n\nNo hooks configured.\n\nConfigure hooks in .mipham/settings.json under the hooks section:\n  PreToolUse   — before each tool\n  PostToolUse  — after each tool\n  Stop         — on session end\n\nCommand hooks read JSON from stdin; exit 2 blocks (stderr as reason).\nUse /loop init to scaffold settings.json.",
       "location": "Location: {path}",
       "found": "{count} hook(s) found.",
       "error": "── Hooks ──\n\nCould not read hooks directory."
@@ -609,6 +609,26 @@
       "audit_clean": "  ✓ no code-derivable sections found",
       "audit_found": "Add the sections above to the `prompt-exclude` frontmatter to stop sending them to the model."
     },
+    "fix": {
+      "title": "── Fix ──",
+      "dryrun_banner": "[dry-run] preview — no changes written",
+      "doctor_clean": "✓ no code-derivable CLAUDE.md sections to fix",
+      "doctor_fixed": "✓ {path}: added prompt-exclude [{added}]",
+      "config_clean": "✓ config healthy, no disabled hooks",
+      "config_corrupt": "⚠ {path}: config corrupt",
+      "config_restored": "✓ restored config from backup: {path}",
+      "hook_disabled": "⚠ hook disabled: {key}",
+      "hook_reenabled": "✓ re-enabled hook: {key}",
+      "cache_clean": "✓ no corrupt cache lines",
+      "cache_found": "⚠ {path}: {count} corrupt line(s)",
+      "cache_cleaned": "✓ cleaned {path}: removed {count} line(s)",
+      "cache_hint": "Run /fix cache --apply to remove corrupt lines",
+      "test_usage": "Usage: /fix test <test-file> [--apply]\n\nLLM-driven repair of a failing test (test frozen, source only). Dry-run by default; --apply writes the fix.",
+      "test_no_llm": "No LLM available in this session — cannot generate a fix.",
+      "test_fixed": "✓ fixed {test} (source {source}, {attempts} attempt(s))",
+      "test_failed": "✗ could not fix {test}: {detail}",
+      "test_hint": "Run /fix test <file> --apply to write the fix."
+    },
     "plugins": {
       "unavailable": "PluginManager not available in this session.",
       "title": "── Installed Plugins ──",

package/src/i18n-core/locales/zh-CN.json

@@ -579,7 +579,7 @@
     },
     "hooks": {
       "title": "── 钩子 ──",
-      "no_hooks": "── 钩子 ──\n\n未配置钩子。\n\n在 .mipham/hooks/ 中创建钩子脚本:\n  pre-tool-use.sh   — 在每次工具执行前运行\n  post-tool-use.sh  — 在每次工具执行后运行\n  stop.sh           — 会话结束时运行\n\n使用 /loop init 初始化钩子目录。",
+      "no_hooks": "── 钩子 ──\n\n未配置钩子。\n\n在 .mipham/settings.json 的 hooks 段配置钩子:\n  PreToolUse   — 工具执行前\n  PostToolUse  — 工具执行后\n  Stop         — 会话结束\n\n命令钩子从 stdin 读 JSON，exit 2 拦截（stderr 作理由）。\n使用 /loop init 初始化 settings.json。",
       "location": "位置: {path}",
       "found": "找到 {count} 个钩子。",
       "error": "── 钩子 ──\n\n无法读取钩子目录。"
@@ -609,6 +609,26 @@
       "audit_clean": "  ✓ 未发现可从代码推断的冗余章节",
       "audit_found": "将上述章节加入 `prompt-exclude` frontmatter，可停止发送给模型、节省 token。"
     },
+    "fix": {
+      "title": "── 修复 ──",
+      "dryrun_banner": "[dry-run] 预览模式 — 不落盘",
+      "doctor_clean": "✓ CLAUDE.md 无需要修复的冗余章节",
+      "doctor_fixed": "✓ {path}: 已加 prompt-exclude [{added}]",
+      "config_clean": "✓ 配置无损坏、hooks 无禁用",
+      "config_corrupt": "⚠ {path}: 配置损坏",
+      "config_restored": "✓ 已从备份恢复 config: {path}",
+      "hook_disabled": "⚠ hook 已禁用: {key}",
+      "hook_reenabled": "✓ 已重新启用 hook: {key}",
+      "cache_clean": "✓ 缓存无损坏行",
+      "cache_found": "⚠ {path}: {count} 行损坏",
+      "cache_cleaned": "✓ 已清理 {path}: 移除 {count} 行",
+      "cache_hint": "使用 /fix cache --apply 清理损坏行",
+      "test_usage": "用法: /fix test <测试文件> [--apply]\n\nLLM 自动修复失败测试（测试冻结，只改源码）。默认 dry-run，--apply 落盘。",
+      "test_no_llm": "当前会话无可用 LLM，无法生成修复。",
+      "test_fixed": "✓ 已修复 {test}（源码 {source}，{attempts} 次尝试）",
+      "test_failed": "✗ 未能修复 {test}: {detail}",
+      "test_hint": "使用 /fix test <文件> --apply 落盘修复。"
+    },
     "plugins": {
       "unavailable": "当前会话中 PluginManager 不可用。",
       "title": "── 已安装插件 ──",

package/src/index.tsx

@@ -10,6 +10,7 @@ import {
   loadInferenceHookConfig,
   loadCredentialMaskingConfig,
   loadCrossSessionConfig,
+  loadSettingsJson,
 } from './config/loader'
 import {
   registerActiveSession,
@@ -44,6 +45,7 @@ import { registerMcpServerTools, syncMcpToolsOnChange } from './mcp/registry'
 import { formatMcpConnectFailures, type McpConnectFailure } from './mcp/connect-failures'
 import { AgentRegistry } from './agent/agent-registry'
 import { HookEngine } from './core/hooks'
+import { loadHookConfigs } from './core/hooks-config'
 import { ArtifactServer } from './artifacts/server'
 import { getMetrics } from './core/metrics'
 import { getWorkspaceTrust } from './core/workspace-trust'
@@ -514,6 +516,12 @@ export async function runApp(options: RunOptions): Promise<void> {
     }
   }
 
+  // Register settings.json hooks (Claude Code convention — additive across levels)
+  const settingsJson = loadSettingsJson(process.cwd())
+  for (const def of loadHookConfigs(settingsJson.hooks)) {
+    hookEngine.register(def)
+  }
+
   // Start artifact server (lazy — first artifact creation triggers listening)
   const artifactsDir = join(process.cwd(), MIPHAM_DIR, ARTIFACTS_DIR)
   const artifactServer = new ArtifactServer(artifactsDir, ARTIFACT_PORT)
@@ -547,6 +555,10 @@ export async function runApp(options: RunOptions): Promise<void> {
     for (const rule of config.permissionRules.deny ?? []) engine.getPermission().deny(rule)
   }
 
+  // Apply settings.json permissions (allow/deny) — Claude Code convention
+  for (const rule of settingsJson.permissions.allow) engine.getPermission().allow(rule)
+  for (const rule of settingsJson.permissions.deny) engine.getPermission().deny(rule)
+
   // Initialize agent registry and load plugin agents/skills/MCP/hooks
   const agentRegistry = new AgentRegistry()
   agentRegistry.loadUserAgents()

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.69.0' as const
+export const PACKAGE_VERSION = '0.70.0' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/types.ts

@@ -234,6 +234,8 @@ export interface HookConfig {
   headers?: Record<string, string>
   mcpServer?: string
   mcpTool?: string
+  /** Command timeout in seconds (Claude Code default is 60). */
+  timeout?: number
   continueOnBlock?: boolean
 }
 

package/src/skills/community-registry.json

@@ -77,5 +77,21 @@
     "file": "frontend-design.SKILL.md",
     "category": "Design",
     "author": "Anthropic"
+  },
+  {
+    "name": "grill-me",
+    "description": "A relentless one-question-at-a-time interview that stress-tests your plan or design",
+    "url": "https://github.com/mattpocock/skills",
+    "file": "skills/productivity/grill-me/SKILL.md",
+    "category": "Development",
+    "author": "Matt Pocock"
+  },
+  {
+    "name": "eli5",
+    "description": "Explain any topic like the user knows nothing about it, using an HTML artifact with big pictures and few words",
+    "url": "https://github.com/anthropics/claude-plugins-community",
+    "file": "eli5/skills/eli5/SKILL.md",
+    "category": "Communication",
+    "author": "Anthropic"
   }
 ]

package/src/skills/marketplace.ts

@@ -0,0 +1,233 @@
+/**
+ * Marketplace sources — discover and install skills from any public GitHub
+ * repository that follows the standard `SKILL.md` (frontmatter name/description)
+ * convention. This lifts skill installation out of the hard-coded community
+ * registry so users can add any public repo as a source.
+ */
+import { parse as parseYaml } from 'yaml'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { spawn } from 'node:child_process'
+import { URL } from 'node:url'
+
+export const MARKETPLACES_PATH = join(homedir(), '.mipham', 'marketplaces.json')
+
+export interface SkillFrontmatter {
+  name: string
+  description: string
+}
+
+/**
+ * Parse a `SKILL.md` document's frontmatter for `name`/`description`. Returns
+ * null when there is no frontmatter, the YAML is invalid, or `name` is missing.
+ */
+export function parseSkillFrontmatter(content: string): SkillFrontmatter | null {
+  const src = content.replace(/^/, '')
+  const match = src.match(/^---\n([\s\S]*?)\n---/)
+  if (!match) return null
+  let data: Record<string, unknown>
+  try {
+    data = parseYaml(match[1] || '') as Record<string, unknown>
+  } catch {
+    return null
+  }
+  const name = typeof data.name === 'string' ? data.name.trim() : ''
+  if (!name) return null
+  const description = typeof data.description === 'string' ? data.description : ''
+  return { name, description }
+}
+
+export interface MarketplaceSource {
+  owner: string
+  repo: string
+}
+
+export const DEFAULT_MARKETPLACES: MarketplaceSource[] = [
+  { owner: 'anthropics', repo: 'claude-plugins-community' },
+  { owner: 'anthropics', repo: 'skills' },
+]
+
+/** owner/repo must be plain GitHub names (letters, digits, dot, dash, underscore). */
+export function isValidMarketplaceRef(owner: string, repo: string): boolean {
+  const valid = (s: string) => /^[a-zA-Z0-9._-]+$/.test(s) && s.length > 0
+  return valid(owner) && valid(repo)
+}
+
+/**
+ * Read the marketplace sources from disk. A missing or corrupt file falls back
+ * to the default Anthropic sources.
+ */
+export function readMarketplaces(readFile: (path: string) => string | null): MarketplaceSource[] {
+  const raw = readFile(MARKETPLACES_PATH)
+  if (raw === null) return [...DEFAULT_MARKETPLACES]
+  try {
+    const parsed = JSON.parse(raw)
+    if (!Array.isArray(parsed)) return [...DEFAULT_MARKETPLACES]
+    return parsed.filter(
+      (s): s is MarketplaceSource =>
+        !!s && typeof s === 'object' && typeof s.owner === 'string' && typeof s.repo === 'string',
+    )
+  } catch {
+    return [...DEFAULT_MARKETPLACES]
+  }
+}
+
+export function addMarketplace(
+  current: MarketplaceSource[],
+  owner: string,
+  repo: string,
+): { sources: MarketplaceSource[]; added: boolean } {
+  if (current.some((s) => s.owner === owner && s.repo === repo)) {
+    return { sources: current, added: false }
+  }
+  return { sources: [...current, { owner, repo }], added: true }
+}
+
+export function removeMarketplace(
+  current: MarketplaceSource[],
+  owner: string,
+  repo: string,
+): { sources: MarketplaceSource[]; removed: boolean } {
+  const sources = current.filter((s) => !(s.owner === owner && s.repo === repo))
+  return { sources, removed: sources.length !== current.length }
+}
+
+export interface DiscoveredSkill {
+  name: string
+  description: string
+  path: string
+}
+
+/** Minimal fetch shape (ok/json/text) so discovery is testable without real network. */
+export interface FetchLike {
+  (url: string): Promise<{ ok: boolean; json: () => Promise<unknown>; text: () => Promise<string> }>
+}
+
+/**
+ * List every `SKILL.md` blob path in a repository via the GitHub trees API.
+ * Returns [] on any failure (network, rate-limit, non-2xx).
+ */
+export async function listSkillPaths(
+  source: MarketplaceSource,
+  fetchFn: FetchLike,
+): Promise<string[]> {
+  const url = `https://api.github.com/repos/${source.owner}/${source.repo}/git/trees/HEAD?recursive=1`
+  try {
+    const res = await fetchFn(url)
+    if (!res.ok) return []
+    const data = (await res.json()) as { tree?: Array<{ path?: string; type?: string }> }
+    return (data.tree ?? [])
+      .filter((e) => e.type === 'blob' && e.path?.endsWith('SKILL.md'))
+      .map((e) => e.path!)
+  } catch {
+    return []
+  }
+}
+
+/**
+ * Discover every skill in a repository: list `SKILL.md` paths, fetch each from
+ * raw.githubusercontent.com, and parse its frontmatter for name/description.
+ */
+export async function discoverSkills(
+  source: MarketplaceSource,
+  fetchFn: FetchLike,
+  download: (url: string) => Promise<string>,
+): Promise<DiscoveredSkill[]> {
+  const paths = await listSkillPaths(source, fetchFn)
+  const skills = await Promise.all(
+    paths.map(async (path) => {
+      const rawUrl = `https://raw.githubusercontent.com/${source.owner}/${source.repo}/HEAD/${path}`
+      try {
+        const fm = parseSkillFrontmatter(await download(rawUrl))
+        return fm ? { name: fm.name, description: fm.description, path } : null
+      } catch {
+        return null
+      }
+    }),
+  )
+  return skills.filter((s): s is DiscoveredSkill => s !== null)
+}
+
+export interface FoundSkill {
+  name: string
+  description: string
+  source: MarketplaceSource
+  path: string
+  rawUrl: string
+}
+
+/**
+ * Search every marketplace source for a skill by name (first match wins, in
+ * source order). Returns null when no source exposes it.
+ */
+export async function findSkillInMarketplaces(
+  skillName: string,
+  sources: MarketplaceSource[],
+  fetchFn: FetchLike,
+  download: (url: string) => Promise<string>,
+): Promise<FoundSkill | null> {
+  for (const source of sources) {
+    const skills = await discoverSkills(source, fetchFn, download)
+    const found = skills.find((s) => s.name === skillName)
+    if (found) {
+      return {
+        name: found.name,
+        description: found.description,
+        source,
+        path: found.path,
+        rawUrl: `https://raw.githubusercontent.com/${source.owner}/${source.repo}/HEAD/${found.path}`,
+      }
+    }
+  }
+  return null
+}
+
+/** Allowed domains for remote skill installation. */
+const ALLOWED_DOMAINS = [
+  'raw.githubusercontent.com',
+  'github.com',
+  'gist.githubusercontent.com',
+  'gitlab.com',
+]
+
+/**
+ * Download a file over HTTPS via `curl` (spawn, no shell injection), restricted
+ * to known-safe domains. Async so multiple downloads can run in parallel.
+ */
+export async function downloadFile(rawUrl: string): Promise<string> {
+  let parsed: URL
+  try {
+    parsed = new URL(rawUrl)
+  } catch {
+    throw new Error(`Invalid URL: ${rawUrl}`)
+  }
+  if (parsed.protocol !== 'https:') {
+    throw new Error(`Only HTTPS URLs are allowed (got: ${parsed.protocol})`)
+  }
+  if (!ALLOWED_DOMAINS.some((d) => parsed.hostname === d || parsed.hostname.endsWith('.' + d))) {
+    throw new Error(
+      `Domain not allowed: ${parsed.hostname}. Allowed: ${ALLOWED_DOMAINS.join(', ')}`,
+    )
+  }
+
+  return new Promise<string>((resolve, reject) => {
+    const proc = spawn('curl', ['-fsSL', rawUrl], { stdio: ['pipe', 'pipe', 'pipe'] })
+    let stdout = ''
+    let stderr = ''
+    const timer = setTimeout(() => {
+      proc.kill()
+      reject(new Error(`Download timed out: ${rawUrl}`))
+    }, 15_000)
+    proc.stdout.on('data', (c) => (stdout += c))
+    proc.stderr.on('data', (c) => (stderr += c))
+    proc.on('error', (err) => {
+      clearTimeout(timer)
+      reject(new Error(`Failed to download: ${err.message}`))
+    })
+    proc.on('close', (code) => {
+      clearTimeout(timer)
+      if (code === 0) resolve(stdout)
+      else reject(new Error(`Download failed with status ${code}: ${stderr}`))
+    })
+  })
+}

package/src/skills/registry.ts

@@ -5,13 +5,19 @@
  * from remote sources (GitHub repos, direct URLs).
  */
 
-import { existsSync, mkdirSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  writeFileSync,
+  readdirSync,
+  unlinkSync,
+  readFileSync,
+} from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
-import { spawnSync } from 'node:child_process'
-import { URL } from 'node:url'
 import type { MiphamConfig } from '../shared/types.js'
 import communitySkills from './community-registry.json'
+import { readMarketplaces, findSkillInMarketplaces, downloadFile } from './marketplace'
 
 const SKILLS_DIR = join(homedir(), '.mipham', 'skills')
 
@@ -117,17 +123,13 @@ function isMarketplaceAllowed(url: string, config?: MiphamConfig['marketplace'])
  * Clones the repo to a temp directory, copies the skill file(s),
  * and cleans up.
  */
-export function installSkill(
+export async function installSkill(
   skillName: string,
   marketplaceConfig?: MiphamConfig['marketplace'],
-): InstallResult {
+): Promise<InstallResult> {
   const entry = COMMUNITY_SKILLS.find((s) => s.name === skillName)
   if (!entry) {
-    return {
-      success: false,
-      name: skillName,
-      message: `Skill "${skillName}" not found in the registry. Use /browse-skills to see available skills.`,
-    }
+    return installFromMarketplace(skillName, marketplaceConfig)
   }
 
   // Check marketplace restrictions
@@ -165,7 +167,7 @@ export function installSkill(
   try {
     // Download the skill file from GitHub raw content
     const rawUrl = githubRawUrl(entry.url, entry.file || `${skillName}.SKILL.md`)
-    const content = downloadFile(rawUrl)
+    const content = await downloadFile(rawUrl)
 
     // Validate it's a proper skill file (has frontmatter)
     if (!content.includes('---')) {
@@ -193,13 +195,74 @@ export function installSkill(
   }
 }
 
+/**
+ * Install a skill by discovering it across the user's marketplace sources.
+ * Called when the name is not in the built-in community registry.
+ */
+async function installFromMarketplace(
+  skillName: string,
+  marketplaceConfig?: MiphamConfig['marketplace'],
+): Promise<InstallResult> {
+  const sources = readMarketplaces((p) => (existsSync(p) ? readFileSync(p, 'utf-8') : null))
+  const found = await findSkillInMarketplaces(skillName, sources, globalThis.fetch, downloadFile)
+
+  if (!found) {
+    return {
+      success: false,
+      name: skillName,
+      message: `Skill "${skillName}" not found in the registry or any marketplace. Use /browse-skills or /browse-marketplace.`,
+    }
+  }
+  if (!isMarketplaceAllowed(found.rawUrl, marketplaceConfig)) {
+    return {
+      success: false,
+      name: skillName,
+      message: `Skill "${skillName}" is from a blocked or unapproved marketplace: ${found.rawUrl}`,
+    }
+  }
+
+  const destPath = join(SKILLS_DIR, `${found.name}.SKILL.md`)
+  if (existsSync(destPath)) {
+    return {
+      success: false,
+      name: found.name,
+      message: `Skill "${found.name}" is already installed. Remove it first to reinstall.`,
+    }
+  }
+
+  mkdirSync(SKILLS_DIR, { recursive: true })
+  try {
+    const content = await downloadFile(found.rawUrl)
+    if (!content.includes('---')) {
+      return {
+        success: false,
+        name: found.name,
+        message: `Downloaded file does not appear to be a valid skill (missing frontmatter).`,
+      }
+    }
+    writeFileSync(destPath, content, 'utf-8')
+    return {
+      success: true,
+      name: found.name,
+      message: `Skill "${found.name}" installed from ${found.source.owner}/${found.source.repo} to ${destPath}\nRun /reload-skills to activate it.`,
+    }
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err)
+    return {
+      success: false,
+      name: found.name,
+      message: `Failed to install "${found.name}": ${msg}`,
+    }
+  }
+}
+
 /**
  * Install a skill from a direct URL (GitHub raw, gist, or any HTTP URL).
  */
-export function installSkillFromUrl(
+export async function installSkillFromUrl(
   url: string,
   marketplaceConfig?: MiphamConfig['marketplace'],
-): InstallResult {
+): Promise<InstallResult> {
   // Check marketplace restrictions
   if (!isMarketplaceAllowed(url, marketplaceConfig)) {
     return {
@@ -222,7 +285,7 @@ export function installSkillFromUrl(
   mkdirSync(destDir, { recursive: true })
 
   try {
-    const content = downloadFile(url)
+    const content = await downloadFile(url)
 
     if (!content.includes('---')) {
       return {
@@ -288,52 +351,3 @@ function githubRawUrl(repoUrl: string, file: string): string {
   const base = repoUrl.replace('https://github.com/', 'https://raw.githubusercontent.com/')
   return `${base}/main/${file}`
 }
-
-/** Allowed domains for remote skill installation */
-const ALLOWED_DOMAINS = [
-  'raw.githubusercontent.com',
-  'github.com',
-  'gist.githubusercontent.com',
-  'gitlab.com',
-]
-
-/**
- * Download a file from a URL using curl with spawn (no shell injection).
- * Only allows HTTPS URLs from known safe domains.
- */
-function downloadFile(rawUrl: string): string {
-  let parsed: URL
-  try {
-    parsed = new URL(rawUrl)
-  } catch {
-    throw new Error(`Invalid URL: ${rawUrl}`)
-  }
-
-  // Protocol must be HTTPS
-  if (parsed.protocol !== 'https:') {
-    throw new Error(`Only HTTPS URLs are allowed (got: ${parsed.protocol})`)
-  }
-
-  // Domain must be in allowlist
-  if (!ALLOWED_DOMAINS.some((d) => parsed.hostname === d || parsed.hostname.endsWith('.' + d))) {
-    throw new Error(
-      `Domain not allowed: ${parsed.hostname}. Allowed: ${ALLOWED_DOMAINS.join(', ')}`,
-    )
-  }
-
-  // Use spawnSync with args array — no shell, no injection
-  const result = spawnSync('curl', ['-fsSL', rawUrl], {
-    encoding: 'utf-8',
-    timeout: 15_000,
-    stdio: ['pipe', 'pipe', 'pipe'],
-  })
-
-  if (result.error) {
-    throw new Error(`Failed to download: ${result.error.message}`)
-  }
-  if (result.status !== 0) {
-    throw new Error(`Download failed with status ${result.status}`)
-  }
-
-  return result.stdout
-}