@miphamai/cli 0.71.0 → 0.73.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.71.0",
+  "version": "0.73.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/commands/project.ts

@@ -553,9 +553,7 @@ async function setupStep3(ctx: CommandContext): Promise<CommandResult> {
     lines.push(`  ${p.id}${p.id === ctx.providerId ? ' ← current' : ''}`)
     for (const m of p.models.filter((m) => m.status === 'active')) {
       const marker = m.id === ctx.modelId ? ' ★' : '  '
-      lines.push(
-        `${marker}  ${m.id.padEnd(30)} ${m.contextWindow.toLocaleString()} ctx  ${m.vision ? '🖼' : '📝'}`,
-      )
+      lines.push(`${marker}  ${m.id.padEnd(30)}  ${m.vision ? '🖼' : '📝'}`)
     }
     lines.push('')
   }

package/src/core/permission-rules.ts

@@ -1,6 +1,182 @@
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchPath } from './credential-masker/matcher'
 
+// ── Bash command analysis (Read/Write/Edit deny-rule extension) ──
+//
+// A Read(/etc/passwd) deny rule must also refuse Bash commands that read that
+// file (`cat /etc/passwd`, `tac /etc/passwd`, `grep x /etc/passwd`,
+// `< /etc/passwd`) — not only the Read tool. Same for Write/Edit rules and
+// `> file` redirects / in-place editors. These helpers map a Bash command to
+// the file paths it touches, conservatively: over-matching is the safe
+// direction for a deny rule, under-matching is not.
+
+/** Commands that read a file and print its contents (bypass Read() rules today). */
+const READER_COMMANDS = new Set([
+  'cat',
+  'tac',
+  'head',
+  'tail',
+  'less',
+  'more',
+  'grep',
+  'egrep',
+  'fgrep',
+  'rg',
+  'sed',
+  'perl',
+  'awk',
+  'nl',
+  'sort',
+  'uniq',
+  'cut',
+  'diff',
+  'comm',
+  'join',
+  'paste',
+  'file',
+  'stat',
+  'xxd',
+  'od',
+  'hexdump',
+  'strings',
+  'wc',
+  'view',
+  'zcat',
+  'bzcat',
+])
+
+/** Commands that write/modify a file (bypass Write()/Edit() rules today). */
+const WRITER_COMMANDS = new Set([
+  'tee',
+  'touch',
+  'nano',
+  'vi',
+  'vim',
+  'emacs',
+  'ed',
+  'ex',
+  'cp',
+  'mv',
+  'rm',
+  'dd',
+  'install',
+  'truncate',
+])
+
+/**
+ * Split a (possibly compound) shell command into simple-command segments, so a
+ * Bash(pattern) rule matches any segment rather than only the whole string
+ * (`rm -rf /` buried in `foo && rm -rf /` must still match).
+ *
+ * Separators: `&&` `||` `;` `|` `&` and newline. Redirect operators (`>`,
+ * `>>`, `<`) are NOT separators — they belong to the same simple command.
+ * Quoting is not parsed (a `&` inside quotes still splits), which only
+ * over-matches — the safe direction for deny rules.
+ */
+export function splitShellSegments(command: string): string[] {
+  return command
+    .split(/&&|\|\||;|\||&|\n|\r/g)
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0)
+}
+
+function stripQuotes(s: string): string {
+  if (s.length >= 2) {
+    const first = s[0]
+    const last = s[s.length - 1]
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+      return s.slice(1, -1)
+    }
+  }
+  return s
+}
+
+function uniq(items: string[]): string[] {
+  return [...new Set(items)]
+}
+
+/** File paths a Bash command reads or writes. */
+export interface BashFileAccess {
+  read: string[]
+  write: string[]
+}
+
+/**
+ * Extract the file paths a Bash command reads or writes, so Read()/Write()/
+ * Edit() deny rules also apply to Bash (not just the Read/Write/Edit tools).
+ * Covers redirects (`<` reads, `>`/`>>` writes) and reader/writer command
+ * arguments — including inside `$(...)` and backtick substitutions. Deliberately
+ * conservative, not a full shell parser.
+ */
+export function extractBashFileAccess(command: string): BashFileAccess {
+  const read: string[] = []
+  const write: string[] = []
+
+  // 1. Redirect targets. Handles `> file` and `>file`, optional fd prefix
+  //    (`2>`, `&>`). Heredocs (`<<`) and fd-dup targets (`2>&1`) are skipped —
+  //    their "target" is a delimiter or file descriptor, not a path.
+  const redirectRe = /(?:^|[\s;|&])([0-9]*&?)?(>>|<<|<|>)\s*([^\s;|&<>]+)/g
+  let m: RegExpExecArray | null
+  while ((m = redirectRe.exec(command)) !== null) {
+    const op = m[2]!
+    if (op === '<<') continue // heredoc delimiter
+    const target = stripQuotes(m[3]!)
+    if (op === '<') read.push(target)
+    else write.push(target)
+  }
+
+  // 2. Reader/writer command arguments (non-flag args are candidate paths),
+  //    recursing into `$(...)` / backtick substitutions.
+  scanReaderWriterCommands(command, read, write)
+
+  return { read: uniq(read), write: uniq(write) }
+}
+
+/** Extract the inner commands of `$(...)` and backtick substitutions. */
+function extractSubstitutions(command: string): string[] {
+  const inners: string[] = []
+  let m: RegExpExecArray | null
+  // `$(...)` — non-nested groups; deeper nesting is handled by the recursion
+  // in scanReaderWriterCommands (each level is extracted on the next pass).
+  const dollarParen = /\$\(([^()]*)\)/g
+  while ((m = dollarParen.exec(command)) !== null) inners.push(m[1]!)
+  const backtick = /`([^`]*)`/g
+  while ((m = backtick.exec(command)) !== null) inners.push(m[1]!)
+  return inners
+}
+
+/**
+ * Detect reader/writer commands at the front of each shell segment and recurse
+ * into command substitutions, so `echo $(cat .git-credentials)` is caught.
+ */
+function scanReaderWriterCommands(command: string, read: string[], write: string[]): void {
+  for (const seg of splitShellSegments(command)) {
+    const tokens = seg.split(/\s+/).filter(Boolean)
+    if (tokens.length > 0) {
+      const base = (tokens[0] || '').split('/').pop() || ''
+      const args = tokens.slice(1)
+      if (READER_COMMANDS.has(base)) {
+        // `sed -i` / `perl -i` read AND write their file args.
+        const inPlace = args.some((a) => a === '-i' || a.startsWith('--in-place'))
+        for (const arg of args) {
+          if (arg.startsWith('-')) continue
+          const p = stripQuotes(arg)
+          read.push(p)
+          if (inPlace) write.push(p)
+        }
+      } else if (WRITER_COMMANDS.has(base)) {
+        for (const arg of args) {
+          if (arg.startsWith('-')) continue
+          write.push(stripQuotes(arg))
+        }
+      }
+    }
+    for (const inner of extractSubstitutions(seg)) {
+      scanReaderWriterCommands(inner, read, write)
+    }
+  }
+}
+
 // Match a tool(parameter) rule against an actual tool call.
 //
 // Pattern formats:
@@ -25,12 +201,24 @@ export function matchBashRule(
 
   const [, baseTool, subPattern] = parenMatch
 
+  // A Read/Write/Edit rule must also refuse a Bash command that touches the
+  // same file (via a reader/editor command or a redirect), not only the
+  // Read/Write/Edit tool itself. Otherwise `cat .git-credentials` bypasses a
+  // `Read(.git-credentials)` deny rule.
+  if (toolName === 'Bash' && (baseTool === 'Read' || baseTool === 'Write' || baseTool === 'Edit')) {
+    const cmd = String(toolInput.command || '')
+    const access = extractBashFileAccess(cmd)
+    const paths = baseTool === 'Read' ? access.read : access.write
+    return paths.some((p) => matchPath(p, subPattern!))
+  }
+
   if (toolName !== baseTool!) return false
 
-  // For Bash: match against the command string
+  // For Bash: match against the command string (any segment of a compound
+  // command — `rm -rf /` buried in `foo && rm -rf /` still matches).
   if (baseTool === 'Bash') {
     const cmd = String(toolInput.command || '')
-    return wildcardMatch(subPattern!, cmd.trim())
+    return splitShellSegments(cmd).some((seg) => wildcardMatch(subPattern!, seg))
   }
 
   // For Write/Edit/Read: match against the file_path with path-glob semantics.
@@ -63,8 +251,37 @@ export function wildcardMatch(pattern: string, input: string): boolean {
   return new RegExp(regexStr).test(input)
 }
 
+/**
+ * Validate a rule pattern string's structure, mirroring exactly what
+ * `matchBashRule` / `ruleMatches` will actually match. A pattern that is
+ * syntactically valid but never matches (e.g. `Bash(ls) x`, `Read(foo`,
+ * `Bash()`) is silently dead today — this returns a human-readable reason so
+ * the caller can report it as an invalid setting instead of ignoring it.
+ *
+ * Returns null when the pattern is valid, or a reason string when malformed.
+ */
+export function validateRulePattern(pattern: string): string | null {
+  if (!pattern.trim()) return 'rule pattern is empty'
+
+  if (pattern.includes('(')) {
+    if (!pattern.includes(')')) return 'unclosed parenthesis'
+    // Empty parameter: `Bash()` or `Bash( )`
+    if (/\(\s*\)$/.test(pattern)) return 'empty parameter'
+    // Must be exactly `ToolName(param)` with nothing before or after.
+    if (!/^(\w+)\((.+)\)$/.test(pattern)) {
+      return 'unexpected text after the closing parenthesis'
+    }
+    return null
+  }
+
+  // No parenthesis → must be a plain tool name (matched via `pattern === tool.name`).
+  if (!/^\w+$/.test(pattern)) return 'not a single tool name'
+  return null
+}
+
 /** Compile a rule pattern string into a PermissionRuleEntry. */
 export function compileRule(pattern: string, level: 'allow' | 'deny' | 'ask'): PermissionRuleEntry {
+  const invalid = validateRulePattern(pattern)
   const regexStr =
     '^' +
     pattern
@@ -73,5 +290,5 @@ export function compileRule(pattern: string, level: 'allow' | 'deny' | 'ask'): P
       .replace(/\\\*/g, '.*')
       .replace(/\\\?/g, '.') +
     '$'
-  return { pattern, level, compiled: new RegExp(regexStr) }
+  return { pattern, level, compiled: new RegExp(regexStr), ...(invalid ? { invalid } : {}) }
 }

package/src/core/permission.ts

@@ -489,6 +489,24 @@ export class PermissionSystem {
     this.invalidateCache()
   }
 
+  /**
+   * Report any rule whose pattern is structurally invalid and can therefore
+   * never match (e.g. `Bash(ls) x`, `Read(foo`, `Bash()`). These are silently
+   * dead today — callers should surface them as invalid settings rather than
+   * let a deny rule fail closed without the user noticing.
+   */
+  getInvalidRules(): string[] {
+    const invalid: string[] = []
+    for (const entry of [...this.allowRules, ...this.denyRules, ...this.askRules]) {
+      if (entry.invalid) {
+        invalid.push(
+          `permission rule "${entry.pattern}" is invalid (${entry.invalid}) and will never match`,
+        )
+      }
+    }
+    return invalid
+  }
+
   removeRule(toolName: string): void {
     this.legacyRules.delete(toolName)
     this.removeRuleFromArrays(toolName)

package/src/daemon/server.ts

@@ -95,6 +95,9 @@ export function buildDaemonPermission(
     for (const rule of rules.allow ?? []) permission.allow(rule)
     for (const rule of rules.deny ?? []) permission.deny(rule)
   }
+  for (const msg of permission.getInvalidRules()) {
+    process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
+  }
   return permission
 }
 

package/src/index.tsx

@@ -559,6 +559,12 @@ export async function runApp(options: RunOptions): Promise<void> {
   for (const rule of settingsJson.permissions.allow) engine.getPermission().allow(rule)
   for (const rule of settingsJson.permissions.deny) engine.getPermission().deny(rule)
 
+  // Surface malformed permission rules as warnings instead of silently letting
+  // them never match (e.g. a deny rule typed `Bash(ls) x` would fail closed).
+  for (const msg of engine.getPermission().getInvalidRules()) {
+    process.stderr.write(`⚠ Mipham Code: ${msg}\n`)
+  }
+
   // Initialize agent registry and load plugin agents/skills/MCP/hooks
   const agentRegistry = new AgentRegistry()
   agentRegistry.loadUserAgents()

package/src/shared/format.ts

@@ -0,0 +1,15 @@
+/**
+ * Format a model's context window (token count) into a friendly unit string.
+ * Decimal K/M: 16384 → "16K", 131072 → "131K", 200000 → "200K", 1000000 → "1M".
+ * Used only on the developer-facing `/models` command — the first-run model
+ * picker deliberately omits context window (raw token counts make Mipham's own
+ * models look small next to 1M-context competitors).
+ */
+export function formatContextWindow(tokens: number): string {
+  if (tokens >= 1_000_000) {
+    const m = tokens / 1_000_000
+    return `${Number.isInteger(m) ? m : m.toFixed(1)}M`
+  }
+  if (tokens >= 1_000) return `${Math.round(tokens / 1_000)}K`
+  return `${tokens}`
+}

package/src/shared/mipham-models.json

@@ -11,34 +11,34 @@
   "models": [
     {
       "id": "om-v5-flash",
-      "name": "OM V5 Flash",
+      "name": "om-V5-Flash",
       "providerId": "mipham",
       "contextWindow": 16384,
       "maxOutput": 4096,
       "vision": false,
       "status": "active"
     },
-    {
-      "id": "om-v5-pro",
-      "name": "OM V5 Pro",
-      "providerId": "mipham",
-      "contextWindow": 131072,
-      "maxOutput": 16384,
-      "vision": false,
-      "status": "active"
-    },
     {
       "id": "om-v5-visual",
-      "name": "OM V5 Visual",
+      "name": "om-V5-Visual",
       "providerId": "mipham",
       "contextWindow": 65536,
       "maxOutput": 4096,
       "vision": true,
       "status": "active"
     },
+    {
+      "id": "om-v5-pro",
+      "name": "om-V5-Pro",
+      "providerId": "mipham",
+      "contextWindow": 131072,
+      "maxOutput": 16384,
+      "vision": false,
+      "status": "active"
+    },
     {
       "id": "om-v5-apex",
-      "name": "OM V5 Apex",
+      "name": "om-V5-Apex",
       "providerId": "mipham",
       "contextWindow": 200000,
       "maxOutput": 32768,
@@ -46,5 +46,5 @@
       "status": "active"
     }
   ],
-  "synced_at": "2026-08-04T00:00:00Z"
+  "synced_at": "2026-09-04T02:32:33.479Z"
 }

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.71.0' as const
+export const PACKAGE_VERSION = '0.73.0' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/types.ts

@@ -315,6 +315,8 @@ export interface PermissionRuleEntry {
   pattern: string // e.g., "Bash(git:*)"
   level: 'allow' | 'deny' | 'ask'
   compiled: RegExp
+  /** Set when the pattern is structurally invalid and can never match. */
+  invalid?: string
 }
 
 export interface PermissionRule {

package/src/tools/network/web-fetch.ts

@@ -276,7 +276,7 @@ export const webFetchTool: ToolDefinition = {
       const message =
         err instanceof Error && err.name === 'AbortError'
           ? 'Request timed out (30s)'
-          : `Fetch failed: ${String(err)}`
+          : `Fetch failed: ${String(err)}. If direct network is blocked, retry via the web-access skill (CDP through the user's logged-in Chrome).`
       return { success: false, content: '', error: message }
     }
   },

package/src/tools/network/web-search.ts

@@ -126,6 +126,8 @@ export const webSearchTool: ToolDefinition = {
           'Alternatives (add API key for any):',
           '   TAVILY_API_KEY   — https://tavily.com',
           '   SERPAPI_API_KEY  — https://serpapi.com',
+          '',
+          'No API key? Use the web-access skill (CDP through your logged-in Chrome) for live web search.',
         ].join('\n'),
       }
     }
@@ -199,7 +201,7 @@ export const webSearchTool: ToolDefinition = {
       const message =
         err instanceof Error && err.name === 'AbortError'
           ? 'Search timed out (15s). Try a more specific query.'
-          : `Search failed: ${String(err)}`
+          : `Search failed: ${String(err)}. If direct network is blocked, retry via the web-access skill (CDP through the user's logged-in Chrome).`
       return { success: false, content: '', error: message }
     }
   },

package/src/ui/commands.ts

@@ -6,6 +6,7 @@
  */
 import type { QueryEngine } from '../core/engine'
 import type { MiphamConfig } from '../shared/index.ts'
+import { formatContextWindow } from '../shared/format'
 import type { SkillsLoader } from '../skills/loader'
 import type { PluginManager } from '../plugin/plugin-manager'
 import type { Message } from '../shared/types.js'
@@ -438,7 +439,7 @@ const modelsCmd: CommandHandler = (ctx) => {
         .filter((m) => m.status === 'active')
         .map(
           (m) =>
-            `  ${p.id.padEnd(12)} ${m.id.padEnd(30)} ${m.contextWindow.toLocaleString()} ctx  ${m.vision ? '🖼' : '📝'}`,
+            `  ${p.id.padEnd(12)} ${m.id.padEnd(30)} ${formatContextWindow(m.contextWindow)} ctx  ${m.vision ? '🖼' : '📝'}`,
         ),
     )
 

package/src/ui/picker.tsx

@@ -198,7 +198,7 @@ export function ModelPicker({
                 </Text>
                 <Text dimColor>
                   {'   '}
-                  {m.id} · {m.contextWindow.toLocaleString()} ctx
+                  {m.id}
                   {m.vision ? ' · 🖼 vision' : ''}
                 </Text>
               </Box>