miii-cli 0.3.5 → 1.0.1

package/dist/config.js

@@ -7,15 +7,17 @@ const defaults = {
     baseUrl: 'http://localhost:11434',
 };
 const ALLOWED_KEYS = new Set(['model', 'provider', 'baseUrl', 'systemPrompt', 'apiKey', 'gitContext', 'tavilyApiKey', 'embedModel']);
+const PROJECT_CONFIG = join(process.cwd(), '.miii.json');
+const GLOBAL_CONFIG = join(homedir(), '.config', 'miii', 'config.json');
 export function loadConfig() {
-    const candidates = [
-        join(process.cwd(), '.miii.json'),
-        join(homedir(), '.config', 'miii', 'config.json'),
-    ];
+    const candidates = [PROJECT_CONFIG, GLOBAL_CONFIG];
     for (const p of candidates) {
         if (existsSync(p)) {
             try {
                 const raw = JSON.parse(readFileSync(p, 'utf-8'));
+                if (p === PROJECT_CONFIG && ('apiKey' in raw || 'tavilyApiKey' in raw)) {
+                    process.stderr.write('Warning: API keys found in .miii.json — add .miii.json to .gitignore to avoid committing secrets\n');
+                }
                 const safe = {};
                 for (const key of ALLOWED_KEYS) {
                     if (key in raw)

package/dist/sessions.js

@@ -1,9 +1,10 @@
-import { readFileSync, writeFileSync, mkdirSync, readdirSync, statSync, existsSync, unlinkSync } from 'fs';
+import { readFileSync, writeFileSync, mkdirSync, chmodSync, readdirSync, statSync, existsSync, unlinkSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 const SESSIONS_DIR = join(homedir(), '.config', 'miii', 'sessions');
 function ensureDir() {
-    mkdirSync(SESSIONS_DIR, { recursive: true });
+    mkdirSync(SESSIONS_DIR, { recursive: true, mode: 0o700 });
+    chmodSync(SESSIONS_DIR, 0o700);
 }
 function sanitizeName(name) {
     if (!/^[\w-]+$/.test(name))
@@ -45,7 +46,7 @@ export function loadSession(name) {
 export function saveSession(name, messages) {
     ensureDir();
     try {
-        writeFileSync(join(SESSIONS_DIR, `${sanitizeName(name)}.json`), JSON.stringify(messages));
+        writeFileSync(join(SESSIONS_DIR, `${sanitizeName(name)}.json`), JSON.stringify(messages), { mode: 0o600 });
     }
     catch { }
 }

package/dist/tools/index.js

@@ -1,10 +1,11 @@
 import { readFile, writeFile, deleteFile, listFiles, createDir, moveFile, guardPath } from '../files/ops.js';
 import { existsSync } from 'fs';
 import { join } from 'path';
-import { exec } from 'child_process';
+import { exec, execFile } from 'child_process';
 import { promisify } from 'util';
 import { getTavilyKey, tavilySearch, tavilyExtract } from '../tavily/client.js';
 const run = promisify(exec);
+const runFile = promisify(execFile);
 const EXEC_TIMEOUT_MS = 30_000;
 export const tools = [
     {
@@ -126,10 +127,13 @@ export const tools = [
         description: 'Show git diff. staged=true for staged changes, path for specific file',
         params: '{"staged": "boolean (optional)", "path": "string (optional)"}',
         execute: async ({ staged = false, path = '' }) => {
-            const args = staged ? '--staged' : '';
-            const target = path ? `-- "${path}"` : '';
             try {
-                const { stdout } = await run(`git diff ${args} ${target}`.trim(), { timeout: EXEC_TIMEOUT_MS });
+                const args = ['diff'];
+                if (staged)
+                    args.push('--staged');
+                if (path)
+                    args.push('--', String(path));
+                const { stdout } = await runFile('git', args, { timeout: EXEC_TIMEOUT_MS });
                 const out = stdout.trim();
                 if (!out)
                     return '(no diff)';
@@ -146,7 +150,7 @@ export const tools = [
         params: '{"n": "number (optional, default 10)"}',
         execute: async ({ n = 10 }) => {
             try {
-                const { stdout } = await run(`git log --oneline -${Math.min(Number(n), 50)}`, { timeout: EXEC_TIMEOUT_MS });
+                const { stdout } = await runFile('git', ['log', '--oneline', `-${Math.min(Number(n), 50)}`], { timeout: EXEC_TIMEOUT_MS });
                 return stdout.trim() || '(no commits)';
             }
             catch (e) {
@@ -156,14 +160,18 @@ export const tools = [
     },
     {
         name: 'git_commit',
-        description: 'Stage files and create a git commit. Use files="-A" to stage all.',
+        description: 'Stage files and create a git commit. Use files="-A" to stage all, or list specific paths.',
         params: '{"message": "string", "files": "string (optional, default -A)"}',
         execute: async ({ message, files = '-A' }) => {
             if (!message)
                 throw new Error('git_commit: message required');
+            const fileStr = String(files);
+            if (/\.\./.test(fileStr) || !/^(-A|\.|[\w./\-\s]+)$/.test(fileStr))
+                throw new Error('git_commit: invalid files argument — use -A, ., or space-separated paths (no .. allowed)');
             try {
-                await run(`git add ${files}`, { timeout: EXEC_TIMEOUT_MS });
-                const { stdout } = await run(`git commit -m ${JSON.stringify(String(message))}`, { timeout: EXEC_TIMEOUT_MS });
+                const fileArgs = fileStr === '-A' ? ['-A'] : fileStr === '.' ? ['.'] : fileStr.split(/\s+/).filter(Boolean);
+                await runFile('git', ['add', ...fileArgs], { timeout: EXEC_TIMEOUT_MS });
+                const { stdout } = await runFile('git', ['commit', '-m', String(message)], { timeout: EXEC_TIMEOUT_MS });
                 return stdout.trim();
             }
             catch (e) {
@@ -190,9 +198,9 @@ export const tools = [
             if (!testScript || testScript === 'echo "Error: no test specified" && exit 1') {
                 return '(no test script configured in package.json)';
             }
-            const cmd = path ? `npm test -- ${path}` : 'npm test';
+            const npmArgs = path ? ['test', '--', String(path)] : ['test'];
             try {
-                const { stdout, stderr } = await run(cmd, { cwd: process.cwd(), timeout: 60_000 });
+                const { stdout, stderr } = await runFile('npm', npmArgs, { cwd: process.cwd(), timeout: 60_000 });
                 const out = (stdout + (stderr ? '\nstderr: ' + stderr : '')).trim();
                 return out.length > 4000 ? '…[truncated]\n' + out.slice(-4000) : out;
             }
@@ -210,9 +218,12 @@ export const tools = [
             const key = getTavilyKey();
             if (!key)
                 throw new Error('Tavily API key not set — user must run /tavily-key <key> first');
+            const q = query != null ? String(query).trim() : '';
+            if (!q)
+                throw new Error('web_search: "query" argument is required and must be a non-empty string');
             return tavilySearch({
                 apiKey: key,
-                query: String(query),
+                query: q,
                 maxResults: typeof max_results === 'number' ? max_results : undefined,
                 searchDepth: search_depth,
                 includeDomains: include_domains,
@@ -228,6 +239,8 @@ export const tools = [
             const key = getTavilyKey();
             if (!key)
                 throw new Error('Tavily API key not set — user must run /tavily-key <key> first');
+            if (!urls)
+                throw new Error('web_extract: "urls" argument is required');
             const list = Array.isArray(urls) ? urls : [String(urls)];
             return tavilyExtract({ apiKey: key, urls: list });
         },
@@ -288,6 +301,7 @@ Rules:
 - If run_tests fails, read the failing test output and fix the code, then run_tests again (max 3 retries)
 - You have web_search and web_extract tools — use them whenever the user asks about anything requiring internet access, current information, documentation, library versions, news, or external URLs
 - NEVER say you cannot search the web — always call web_search instead
+- web_search REQUIRES the "query" key exactly — never omit it, never use "q" or "search_query" or any other key name
 - Use deep_think when the question requires gathering from multiple files or sources before you can answer well — it runs a safe read-only research phase and returns a summary you can reason over
 - deep_think cannot edit files or run shell commands — it is purely for information gathering${extra}`;
 }

package/dist/tui/hooks/useGit.js

@@ -1,16 +1,16 @@
 import { useCallback, useRef } from 'react';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { promisify } from 'util';
 import * as printer from '../printer.js';
-const gitRun = promisify(exec);
+const runFile = promisify(execFile);
 export function useGit(deps) {
     const depsRef = useRef(deps);
     depsRef.current = deps;
     const handleGit = useCallback(async (sub) => {
         const { pushHistory, buildContext, runLoop } = depsRef.current;
-        const git = async (args) => {
+        const git = async (...args) => {
             try {
-                const { stdout, stderr } = await gitRun(`git ${args}`, { timeout: 15_000 });
+                const { stdout, stderr } = await runFile('git', args, { timeout: 15_000 });
                 return (stdout + stderr).trim();
             }
             catch (e) {
@@ -23,18 +23,19 @@ export function useGit(deps) {
         }
         if (sub === 'log' || sub.startsWith('log ')) {
             const n = parseInt(sub.split(' ')[1] ?? '10', 10) || 10;
-            printer.systemMsg(await git(`log --oneline --decorate -${Math.min(n, 50)}`));
+            printer.systemMsg(await git('log', '--oneline', '--decorate', `-${Math.min(n, 50)}`));
             return;
         }
         if (sub === 'diff' || sub.startsWith('diff ')) {
-            const args = sub.slice(4).trim();
-            const out = await git(`diff ${args}`.trim());
+            const extra = sub.slice(4).trim();
+            const args = ['diff', ...extra.split(/\s+/).filter(Boolean)];
+            const out = await git(...args);
             printer.systemMsg(out.length > 6000 ? out.slice(0, 6000) + '\n…[truncated]' : out || '(no diff)');
             return;
         }
         if (sub === 'review') {
-            const diff = await git('diff HEAD');
-            const staged = await git('diff --staged');
+            const diff = await git('diff', 'HEAD');
+            const staged = await git('diff', '--staged');
             const combined = [diff, staged].filter(Boolean).join('\n').trim();
             if (!combined || combined === '(no diff)') {
                 printer.systemMsg('no changes to review');
@@ -48,7 +49,8 @@ export function useGit(deps) {
             return;
         }
         if (sub === 'branch' || sub.startsWith('branch ')) {
-            printer.systemMsg(await git(`branch ${sub.slice(6).trim()}`.trim()) || '(done)');
+            const extra = sub.slice(6).trim();
+            printer.systemMsg(await git('branch', ...extra.split(/\s+/).filter(Boolean)) || '(done)');
             return;
         }
         if (sub.startsWith('commit ')) {
@@ -57,19 +59,25 @@ export function useGit(deps) {
                 printer.systemMsg('usage: /git commit <message>');
                 return;
             }
-            const gitStatus = await git('status --short');
+            const gitStatus = await git('status', '--short');
             if (!gitStatus || gitStatus === '(clean — no changes)') {
                 printer.systemMsg('nothing to commit — working tree clean');
                 return;
             }
             printer.systemMsg(`staging and committing:\n${gitStatus}`);
-            const stageOut = await git('add -A');
+            const stageOut = await git('add', '-A');
             if (stageOut)
                 printer.systemMsg(stageOut);
-            printer.systemMsg(await git(`commit -m ${JSON.stringify(msg)}`));
+            printer.systemMsg(await git('commit', '-m', msg));
             return;
         }
-        printer.systemMsg(await git(sub) || '(done)');
+        // Catch-all: split on whitespace and run via execFile (no shell expansion)
+        const parts = sub.split(/\s+/).filter(Boolean);
+        if (!parts.length) {
+            printer.systemMsg('usage: /git <subcommand>');
+            return;
+        }
+        printer.systemMsg(await git(...parts) || '(done)');
     }, []);
     return { handleGit };
 }

package/dist/tui/hooks/useSubmit.js

@@ -1,5 +1,5 @@
 import { useCallback, useRef } from 'react';
-import { readFile } from '../../files/ops.js';
+import { readFile, guardPath } from '../../files/ops.js';
 import { getSystemPrompt } from '../../tools/index.js';
 import { loadSession, saveSession, listSessions, deleteSession, deleteAllSessions } from '../../sessions.js';
 import { runDeepThink } from '../deepThink.js';
@@ -11,6 +11,9 @@ import { embed } from '../../index/embedder.js';
 import { loadIndex } from '../../index/store.js';
 import { topK } from '../../index/search.js';
 import * as printer from '../printer.js';
+function sanitizeInjected(content) {
+    return content.replace(/<tool_call>[\s\S]*?<\/tool_call>/g, '[tool_call block removed]');
+}
 function buildAtContext(text) {
     const refs = [...text.matchAll(/@([\w./\-]+)/g)];
     if (!refs.length)
@@ -18,9 +21,10 @@ function buildAtContext(text) {
     const parts = [];
     for (const m of refs) {
         try {
-            const content = readFile(m[1]);
+            const safe = guardPath(m[1]);
+            const content = readFile(safe);
             if (content)
-                parts.push(`<file path="${m[1]}">\n${content}\n</file>`);
+                parts.push(`<file path="${m[1]}">\n${sanitizeInjected(content)}\n</file>`);
         }
         catch { }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "miii-cli",
-  "version": "0.3.5",
+  "version": "1.0.1",
   "type": "module",
   "description": "The high-performance local AI coding agent for your terminal. Automate complex workflows with local LLMs.",
   "license": "MIT",
@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/maruakshay/miii-cli.git"
   },
-  "homepage": "https://github.com/maruakshay/miii-cli#readme",
+  "homepage": "https://www.miii.in",
   "bugs": {
     "url": "https://github.com/maruakshay/miii-cli/issues"
   },