@miphamai/cli 0.80.1 → 0.81.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.80.1",
+  "version": "0.81.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",
@@ -51,10 +51,10 @@
   },
   "devDependencies": {
     "@mipham/shared": "workspace:*",
-    "@types/bun": "^1.3.14",
+    "@types/bun": "^1.4.2",
     "@types/node": "^22.19.19",
     "@types/react": "^19.3.0",
     "ink-testing-library": "^4.0.0",
-    "vitest": "^4.1.7"
+    "vitest": "^5.0.0"
   }
 }

package/src/core/permission-rules.ts

@@ -63,6 +63,56 @@ const WRITER_COMMANDS = new Set([
   'truncate',
 ])
 
+/**
+ * Commands that wrap another command as their payload. A Read/Edit deny rule
+ * must still apply when the reader/writer is wrapped (`sudo cat X`, `env -C / X`,
+ * `timeout 5 X`) — otherwise the wrapper silently bypasses the rule.
+ */
+const PREFIX_COMMANDS = new Set([
+  'sudo',
+  'doas',
+  'nohup',
+  'command',
+  'exec',
+  'nice',
+  'timeout',
+  'env',
+  'xargs',
+  'eval',
+  'stdbuf',
+])
+
+/** Value-taking options of wrapper commands (consume the following token). */
+const PREFIX_VALUE_OPTIONS = new Set([
+  '-u',
+  '--user',
+  '-g',
+  '--group',
+  '-h',
+  '--host',
+  '-p',
+  '--prompt', // sudo/doas
+  '-n',
+  '--adjustment', // nice (and xargs --max-args)
+  '-k',
+  '--kill-after',
+  '-s',
+  '--signal', // timeout
+  '-C',
+  '--chdir',
+  '--unset',
+  '-S',
+  '--split-string', // env
+  '-a',
+  '--arg-file',
+  '-E',
+  '--eof',
+  '-I',
+  '--replace',
+  '-P',
+  '--max-procs', // xargs
+])
+
 /**
  * Split a (possibly compound) shell command into simple-command segments, so a
  * Bash(pattern) rule matches any segment rather than only the whole string
@@ -156,6 +206,8 @@ function flattenCommand(command: string): string[] {
   const out: string[] = []
   for (const seg of splitShellSegments(command)) {
     out.push(seg)
+    const stripped = stripPrefixCommand(seg)
+    if (stripped !== seg) out.push(stripped)
     for (const inner of extractSubstitutions(seg)) {
       out.push(...flattenCommand(inner))
     }
@@ -163,6 +215,46 @@ function flattenCommand(command: string): string[] {
   return out
 }
 
+/**
+ * Resolve the effective command and its arguments after any wrapper prefix
+ * commands (`sudo`, `env`, `timeout`, …). Skips the wrapper and its own options
+ * (flags, the values of value-taking flags, `env`'s `VAR=value` assignments, and
+ * `timeout`'s positional duration) to reach the real command. Conservative, not a
+ * full parser: only recognized wrappers are stripped, so an unrecognized token is
+ * always treated as the command (never skipped) — which over-matches, the safe
+ * direction for a deny rule.
+ */
+function effectiveCommand(tokens: string[]): { base: string; args: string[] } {
+  let i = 0
+  while (i < tokens.length) {
+    const name = (tokens[i] || '').split('/').pop() || ''
+    if (!PREFIX_COMMANDS.has(name)) break
+    i++ // skip the wrapper
+    while (i < tokens.length && tokens[i]!.startsWith('-')) {
+      const opt = tokens[i]!
+      i++
+      if (PREFIX_VALUE_OPTIONS.has(opt) && i < tokens.length) i++ // skip the flag's value
+    }
+    if (name === 'env') {
+      while (i < tokens.length && tokens[i]!.includes('=')) i++ // `VAR=value` assignments
+    }
+    if (name === 'timeout') i++ // positional duration
+  }
+  if (i >= tokens.length) return { base: '', args: [] }
+  return { base: (tokens[i] || '').split('/').pop() || '', args: tokens.slice(i + 1) }
+}
+
+/** A command with any wrapper prefix commands stripped, so `sudo rm -rf /`
+ *  matches a `Bash(rm *)` rule. Returns the input unchanged when there is no
+ *  wrapper (or nothing but wrappers). */
+function stripPrefixCommand(command: string): string {
+  const tokens = command.split(/\s+/).filter(Boolean)
+  if (tokens.length === 0) return command
+  const { base, args } = effectiveCommand(tokens)
+  if (!base) return command
+  return [base, ...args].join(' ')
+}
+
 /**
  * Detect reader/writer commands at the front of each shell segment and recurse
  * into command substitutions, so `echo $(cat .git-credentials)` is caught.
@@ -171,8 +263,7 @@ function scanReaderWriterCommands(command: string, read: string[], write: string
   for (const seg of splitShellSegments(command)) {
     const tokens = seg.split(/\s+/).filter(Boolean)
     if (tokens.length > 0) {
-      const base = (tokens[0] || '').split('/').pop() || ''
-      const args = tokens.slice(1)
+      const { base, args } = effectiveCommand(tokens)
       if (READER_COMMANDS.has(base)) {
         // `sed -i` / `perl -i` read AND write their file args.
         const inPlace = args.some((a) => a === '-i' || a.startsWith('--in-place'))

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.80.1' as const
+export const PACKAGE_VERSION = '0.81.0' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/workflow/primitives/parallel.ts

@@ -23,7 +23,21 @@ function detectParallelism(): number {
   return os.cpus().length || 1
 }
 
-const MAX_CONCURRENT = Math.max(1, Math.min(16, detectParallelism()))
+/**
+ * Resolve the concurrency cap for parallel() fan-out. Defaults to CPU-derived
+ * parallelism capped at 16. An explicit `MIPHAM_WORKFLOW_MAX_CONCURRENT_AGENTS`
+ * (1–256) overrides it, for inference-bound fan-outs whose bottleneck is LLM
+ * latency rather than CPU. Invalid / out-of-range values fall back to the default.
+ */
+export function resolveMaxConcurrent(envValue: string | undefined): number {
+  if (envValue !== undefined && envValue !== '') {
+    const n = Number(envValue)
+    if (Number.isInteger(n) && n >= 1) return Math.min(n, 256)
+  }
+  return Math.max(1, Math.min(16, detectParallelism()))
+}
+
+const MAX_CONCURRENT = resolveMaxConcurrent(process.env.MIPHAM_WORKFLOW_MAX_CONCURRENT_AGENTS)
 
 /**
  * Simple async semaphore for concurrency limiting.