miii-agent 0.1.7 → 0.1.8

package/README.md

@@ -1,5 +1,7 @@
 # miii
 
+> small · simple · smart · strategic · semantic
+>
 > Your code never leaves your machine. No API keys. No cloud. No bullshit.
 
 **miii** is a local-first AI coding agent that lives in your terminal. Powered by [Ollama](https://ollama.com), it reads your code, writes features, runs tests, and fixes bugs — entirely on your hardware, at native speed.
@@ -10,6 +12,18 @@
 
 ---
 
+## The name
+
+**miii** stands for five principles it's built around:
+
+- **small** — tight codebase, no bloat. You can read the whole thing.
+- **simple** — no API keys, no accounts, no config ceremony. Just run it.
+- **smart** — decomposes problems and verifies its own work like an engineer.
+- **strategic** — plans before it acts; tools are gated, paths are confined.
+- **semantic** — works from the meaning of your code, not blind text matching.
+
+---
+
 ## Demo
 
 ![miii demo](demo.gif)
@@ -115,7 +129,7 @@ miii ships with a built-in tool suite the agent can invoke autonomously:
 | `grep` | Regex search across files |
 | `run_bash` | Execute shell commands |
 
-Every sensitive operation is gated by a permission system — you approve what the agent can touch.
+Every sensitive operation is gated by a permission system — you approve what the agent can touch, and "always" approvals persist to `~/.miii/permissions.json` so you're never asked twice. File tools are confined to your working directory; `../` traversal and absolute paths outside it are rejected.
 
 ---
 
@@ -137,8 +151,9 @@ graph TD
 
     subgraph Agent ["Agent Layer"]
         AgentLoop -->|"chat request"| Adapter["Ollama Adapter\n(agent/adapter.ts)"]
-        AgentLoop -->|"tool call"| ToolRegistry["Tool Registry\n(tools/registry.ts)"]
-        AgentLoop -->|"permission check"| Policy["Permission Policy\n(permissions/policy.ts)"]
+        AgentLoop -->|"1. validate input"| Validate["Input Validator\n(tools/validate.ts)"]
+        AgentLoop -->|"2. permission check"| Policy["Permission Policy\n(permissions/policy.ts)"]
+        AgentLoop -->|"3. tool call"| ToolRegistry["Tool Registry\n(tools/registry.ts)"]
         AgentLoop -->|"events"| EventBus["Event Bus\n(hooks/bus.ts)"]
     end
 
@@ -149,6 +164,9 @@ graph TD
         ToolRegistry --> Glob["glob"]
         ToolRegistry --> Grep["grep"]
         ToolRegistry --> RunBash["run_bash"]
+        ReadFile -.-> Confine["Path Confinement\n(tools/paths.ts)"]
+        WriteFile -.-> Confine
+        EditFile -.-> Confine
     end
 
     Adapter -->|"HTTP streaming"| Ollama["Ollama\n(local LLM server)"]
@@ -159,9 +177,11 @@ graph TD
 
     subgraph Storage ["Local Storage"]
         Config["~/.miii/config.json\n(model, host, effort)"]
+        Rules["~/.miii/permissions.json\n(saved allow rules)"]
     end
 
     App -.->|"reads"| Config
+    Policy -.->|"reads / persists 'always'"| Rules
 ```
 
 ---

package/dist/cli.js

@@ -7,8 +7,8 @@ import { createElement } from "react";
 // src/ui/App.tsx
 import { useState as useState4, useEffect as useEffect3 } from "react";
 import { Box as Box10, Text as Text10, useApp } from "ink";
-import { homedir as homedir3 } from "os";
-import { sep } from "path";
+import { homedir as homedir4 } from "os";
+import { sep as sep2 } from "path";
 
 // src/ollama/client.ts
 import { Ollama } from "ollama";
@@ -549,8 +549,8 @@ function searchFiles(cwd, query) {
   scored.sort((a, b) => a[0] - b[0] || a[1].length - b[1].length);
   return scored.slice(0, MAX_RESULTS).map(([, f]) => f);
 }
-function FilePicker({ matches, cursor }) {
-  if (matches.length === 0) return null;
+function FilePicker({ matches: matches2, cursor }) {
+  if (matches2.length === 0) return null;
   return /* @__PURE__ */ jsxs7(
     Box7,
     {
@@ -561,7 +561,7 @@ function FilePicker({ matches, cursor }) {
       marginBottom: 0,
       paddingX: 1,
       children: [
-        matches.map((f, i) => {
+        matches2.map((f, i) => {
           const active = i === cursor;
           return /* @__PURE__ */ jsx7(Box7, { children: /* @__PURE__ */ jsxs7(Text7, { bold: active, color: active ? "blue" : void 0, dimColor: !active, children: [
             active ? "\u276F " : "  ",
@@ -846,6 +846,7 @@ function PermissionPrompt({ req, cursor }) {
   const label = TOOL_LABEL[req.toolName] ?? req.toolName;
   const options = [
     { label: "Yes", key: "yes" },
+    { label: "Yes, don't ask again for this", key: "always" },
     { label: "No", key: "no" }
   ];
   const summary = summarizeInput(req.input);
@@ -914,6 +915,23 @@ import { useState as useState3, useRef } from "react";
 
 // src/tools/edit_file.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+
+// src/tools/paths.ts
+import { resolve, relative as relative2, isAbsolute, sep } from "path";
+function confinePath(p) {
+  if (typeof p !== "string" || p.length === 0) {
+    throw new Error("Path is required.");
+  }
+  const root = process.cwd();
+  const abs = resolve(root, p);
+  const rel = relative2(root, abs);
+  if (rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel)) {
+    throw new Error(`Path "${p}" is outside the working directory (${root}). Access denied.`);
+  }
+  return abs;
+}
+
+// src/tools/edit_file.ts
 var edit_file = {
   name: "edit_file",
   description: "Replace an exact string in a file. old_str must be unique.",
@@ -927,16 +945,21 @@ var edit_file = {
     required: ["path", "old_str", "new_str"]
   },
   handler: ({ path, old_str, new_str }) => {
-    const src = readFileSync3(path, "utf-8");
-    const first = src.indexOf(old_str);
-    if (first === -1) {
-      return { content: `old_str not found in ${path}`, is_error: true };
-    }
-    if (src.indexOf(old_str, first + 1) !== -1) {
-      return { content: `old_str not unique in ${path}`, is_error: true };
+    try {
+      const abs = confinePath(path);
+      const src = readFileSync3(abs, "utf-8");
+      const first = src.indexOf(old_str);
+      if (first === -1) {
+        return { content: `old_str not found in ${path}`, is_error: true };
+      }
+      if (src.indexOf(old_str, first + 1) !== -1) {
+        return { content: `old_str not unique in ${path}`, is_error: true };
+      }
+      writeFileSync3(abs, src.slice(0, first) + new_str + src.slice(first + old_str.length), "utf-8");
+      return { content: `Edited ${path}` };
+    } catch (err) {
+      return { content: err instanceof Error ? err.message : String(err), is_error: true };
     }
-    writeFileSync3(path, src.slice(0, first) + new_str + src.slice(first + old_str.length), "utf-8");
-    return { content: `Edited ${path}` };
   }
 };
 
@@ -955,7 +978,7 @@ var read_file = {
   handler: ({ path }) => {
     try {
       const MAX = 2e5;
-      const raw = readFileSync4(path, "utf-8");
+      const raw = readFileSync4(confinePath(path), "utf-8");
       const truncated = raw.length > MAX;
       const body = truncated ? raw.slice(0, MAX) + `
 [truncated: ${raw.length - MAX} more chars]` : raw;
@@ -982,8 +1005,9 @@ var write_file = {
   },
   handler: ({ path, content }) => {
     try {
-      mkdirSync3(dirname(path), { recursive: true });
-      writeFileSync4(path, content, "utf-8");
+      const abs = confinePath(path);
+      mkdirSync3(dirname(abs), { recursive: true });
+      writeFileSync4(abs, content, "utf-8");
       return { content: `Wrote ${path} (${content.length} bytes)` };
     } catch (err) {
       return { content: err instanceof Error ? err.message : String(err), is_error: true };
@@ -1161,6 +1185,42 @@ function toOllamaTools(tools = TOOLS) {
   }));
 }
 
+// src/tools/validate.ts
+import { z } from "zod";
+function propSchema(spec) {
+  if (spec.enum && spec.enum.length) return z.enum(spec.enum);
+  switch (spec.type) {
+    case "string":
+      return z.string();
+    case "number":
+      return z.number();
+    case "integer":
+      return z.number().int();
+    case "boolean":
+      return z.boolean();
+    case "array":
+      return z.array(z.unknown());
+    case "object":
+      return z.record(z.unknown());
+    default:
+      return z.unknown();
+  }
+}
+function toZod(schema) {
+  const required = new Set(schema.required ?? []);
+  const shape = {};
+  for (const [key, spec] of Object.entries(schema.properties)) {
+    shape[key] = required.has(key) ? propSchema(spec) : z.unknown().optional();
+  }
+  return z.object(shape).passthrough();
+}
+function validateInput(schema, input) {
+  const result = toZod(schema).safeParse(input ?? {});
+  if (result.success) return null;
+  const issues = result.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+  return `Invalid arguments: ${issues}`;
+}
+
 // src/prompt/system.ts
 function buildSystemPrompt(tools, cwd) {
   const toolLines = tools.map((t) => `- ${t.name}: ${t.description}`).join("\n");
@@ -1235,16 +1295,65 @@ ${toolLines}
 - Treat a green test run or a successful command as the completion signal. If it fails, fix and re-run.
 
 # Permissions
-- When a new bash command pattern, file path, or glob pattern is needed, ask the user once; on approval it persists as a Tool(pattern) rule (e.g. Bash(npm test *), WriteFile(src/*)).
+- File tools are confined to the working directory; paths outside it are denied.
+- Each tool call may prompt the user for approval. If they choose "don't ask again", the exact command or path is persisted to ~/.miii/permissions.json and the same call is auto-allowed thereafter.
 `;
 }
 
 // src/permissions/policy.ts
-var DEFAULT_ALLOW = /* @__PURE__ */ new Set(["read_file"]);
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync3, renameSync } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+var RULES_DIR = join4(homedir3(), ".miii");
+var RULES_PATH = join4(RULES_DIR, "permissions.json");
+function loadRules() {
+  if (!existsSync3(RULES_PATH)) return [];
+  try {
+    const data = JSON.parse(readFileSync5(RULES_PATH, "utf-8"));
+    return Array.isArray(data.rules) ? data.rules : [];
+  } catch {
+    return [];
+  }
+}
+function saveRules(rules) {
+  mkdirSync4(RULES_DIR, { recursive: true });
+  const tmp = RULES_PATH + ".tmp";
+  writeFileSync5(tmp, JSON.stringify({ rules }, null, 2), "utf-8");
+  renameSync(tmp, RULES_PATH);
+}
+function addRule(tool, pattern) {
+  const rules = loadRules();
+  if (rules.some((r) => r.tool === tool && r.pattern === pattern)) return;
+  rules.push({ tool, pattern });
+  saveRules(rules);
+}
+function subjectFor(toolName, input) {
+  const obj = input ?? {};
+  if (toolName === "run_bash") return typeof obj.command === "string" ? obj.command : "";
+  if (typeof obj.path === "string") return obj.path;
+  return "";
+}
+function globToRegExp(glob2) {
+  const escaped = glob2.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const pattern = escaped.replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${pattern}$`);
+}
+function matches(rule, toolName, subject) {
+  if (rule.tool !== toolName) return false;
+  try {
+    return globToRegExp(rule.pattern).test(subject);
+  } catch {
+    return false;
+  }
+}
 async function check(toolName, input, ctx) {
-  if (DEFAULT_ALLOW.has(toolName)) return "allow";
+  const subject = subjectFor(toolName, input);
+  const rules = loadRules();
+  if (rules.some((r) => matches(r, toolName, subject))) return "allow";
   const answer = await ctx.ask(toolName, input);
-  return answer === "no" ? "deny" : "allow";
+  if (answer === "no") return "deny";
+  if (answer === "always") addRule(toolName, subject);
+  return "allow";
 }
 
 // src/agent/adapter.ts
@@ -1494,6 +1603,18 @@ async function* runAgent(opts) {
         yield { type: "tool-result", block: r2 };
         continue;
       }
+      const invalid = validateInput(tool.input_schema, use.input);
+      if (invalid) {
+        const r2 = {
+          type: "tool_result",
+          tool_use_id: use.id,
+          content: `${invalid} for ${use.name}.`,
+          is_error: true
+        };
+        results.push(r2);
+        yield { type: "tool-result", block: r2 };
+        continue;
+      }
       const decision = await check(use.name, use.input, permissions);
       if (decision === "deny") {
         const r2 = {
@@ -1507,7 +1628,10 @@ async function* runAgent(opts) {
         yield { type: "tool-result", block: r2 };
         continue;
       }
-      await hooks?.firePre(use);
+      try {
+        await hooks?.firePre(use);
+      } catch {
+      }
       let r;
       try {
         const out = await tool.handler(use.input);
@@ -1525,7 +1649,10 @@ async function* runAgent(opts) {
           is_error: true
         };
       }
-      await hooks?.firePost(use, r);
+      try {
+        await hooks?.firePost(use, r);
+      } catch {
+      }
       results.push(r);
       yield { type: "tool-result", block: r };
     }
@@ -1556,8 +1683,8 @@ function useAgentRunner(model, activeCtx) {
   const abortRef = useRef(null);
   const pendingPermissionRef = useRef(null);
   function askPermission(toolName, input) {
-    return new Promise((resolve) => {
-      const req = { toolName, input, resolve };
+    return new Promise((resolve2) => {
+      const req = { toolName, input, resolve: resolve2 };
       pendingPermissionRef.current = req;
       setPermissionCursor(0);
       setPendingPermission(req);
@@ -1566,7 +1693,7 @@ function useAgentRunner(model, activeCtx) {
   function resolvePermission(cursor) {
     const req = pendingPermissionRef.current;
     if (!req) return;
-    const answers = ["yes", "no"];
+    const answers = ["yes", "always", "no"];
     pendingPermissionRef.current = null;
     setPendingPermission(null);
     req.resolve(answers[cursor]);
@@ -1902,7 +2029,7 @@ function useKeyboard(opts) {
         return;
       }
       if (key.downArrow) {
-        setPermissionCursor((i) => Math.min(1, i + 1));
+        setPermissionCursor((i) => Math.min(2, i + 1));
         return;
       }
       if (key.return) {
@@ -1914,7 +2041,7 @@ function useKeyboard(opts) {
     if (state === "ready") {
       if (busyRef.current) return;
       const paletteOpen = input.startsWith("/");
-      const matches = paletteOpen ? filteredCommands(input) : [];
+      const matches2 = paletteOpen ? filteredCommands(input) : [];
       const mention = !paletteOpen ? parseMention(input) : null;
       const fileMatches = mention ? searchFiles(process.cwd(), mention.query) : [];
       const fileOpen = mention !== null && fileMatches.length > 0;
@@ -1923,11 +2050,11 @@ function useKeyboard(opts) {
         return;
       }
       if (paletteOpen && key.downArrow) {
-        setPaletteCursor((i) => Math.min(matches.length - 1, i + 1));
+        setPaletteCursor((i) => Math.min(matches2.length - 1, i + 1));
         return;
       }
-      if (paletteOpen && (key.tab || key.return) && matches[paletteCursor] && input !== matches[paletteCursor].name) {
-        setInput(() => matches[paletteCursor].name);
+      if (paletteOpen && (key.tab || key.return) && matches2[paletteCursor] && input !== matches2[paletteCursor].name) {
+        setInput(() => matches2[paletteCursor].name);
         setPaletteCursor(() => 0);
         return;
       }
@@ -2046,7 +2173,7 @@ async function checkForUpdate() {
 import { Fragment as Fragment2, jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
 function App() {
   const { exit } = useApp();
-  const cwd = process.cwd().replace(homedir3(), "~").split(sep).join("/");
+  const cwd = process.cwd().replace(homedir4(), "~").split(sep2).join("/");
   const [cfg, setCfg] = useState4(loadConfig());
   const [models, setModels] = useState4([]);
   const [contexts, setContexts] = useState4({});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "miii-agent",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Terminal AI coding agent powered by Ollama",
   "type": "module",
   "bin": {