@avcodes/mi
Advanced tools
+3
-3
@@ -6,3 +6,3 @@ #!/usr/bin/env node | ||
| // Node builtins only — no npm deps. These four cover REPL, filesystem, subprocesses, and home directory. | ||
| import { createInterface } from 'readline'; import { readFileSync, existsSync, readdirSync } from 'fs'; import { spawn } from 'child_process'; import { homedir } from 'os'; | ||
| import { createInterface } from 'readline'; import { readFileSync, existsSync, readdirSync } from 'fs'; import { spawn, execFileSync } from 'child_process'; import { homedir } from 'os'; | ||
| // Globals: tools run in a separate module scope but need fs/spawn — expose via global rather than re-importing. | ||
@@ -12,3 +12,3 @@ // DIR = package root (for tool/skill discovery); MI_DIR/MI_PATH = env vars so tools can locate project assets. | ||
| const MI_HOME = process.env.MI_HOME || `${homedir()}/.mi`, rc = `${MI_HOME}/config.json`; if (existsSync(rc)) Object.entries(JSON.parse(readFileSync(rc, 'utf8'))).forEach(([k, v]) => process.env[k] ||= v); | ||
| if (!process.env.OPENAI_API_KEY && !process.argv.includes('-h') && !process.argv.includes('--help')) { console.error('OPENAI_API_KEY required'); process.exit(1); } | ||
| if (process.argv.includes('--sandbox') || process.env.MI_SANDBOX) { const img = process.env.MI_IMAGE || 'ghcr.io/av/mi:latest', args = process.argv.slice(2).filter(a => a !== '--sandbox'), da = ['run', '--rm', process.stdin.isTTY ? '-it' : '-i', '--network=host', '-v', `${process.cwd()}:/work`, '-w', '/work']; if (existsSync(rc)) da.push('-v', `${rc}:/home/mi/.mi/config.json:ro`); da.push(img, ...args); try { execFileSync('docker', da, { stdio: 'inherit' }); } catch (e) { process.exit(e.status || 1); } process.exit(0); } if (!process.env.OPENAI_API_KEY && !process.argv.includes('-h') && !process.argv.includes('--help')) { console.error('OPENAI_API_KEY required'); process.exit(1); } | ||
@@ -62,3 +62,3 @@ // ── Tool discovery ─────────────────────────────────────────────────── | ||
| if (process.argv.includes('-h') || process.argv.includes('--help')) { console.log('usage: mi [-p prompt] [-f file] [-h]\n pipe: echo "..." | mi repl: /reset clears history\nenv: OPENAI_API_KEY, MODEL, OPENAI_BASE_URL, REASONING_EFFORT, SYSTEM_PROMPT\nbash tool args: timeout=<ms> kills after delay · bg=truthy detaches and returns pid+log'); process.exit(0); } | ||
| if (process.argv.includes('-h') || process.argv.includes('--help')) { console.log('usage: mi [-p prompt] [-f file] [--sandbox] [-h]\n pipe: echo "..." | mi repl: /reset clears history --sandbox: run in Docker\nenv: OPENAI_API_KEY, MODEL, OPENAI_BASE_URL, REASONING_EFFORT, SYSTEM_PROMPT, MI_IMAGE\nbash tool args: timeout=<ms> kills after delay · bg=truthy detaches and returns pid+log'); process.exit(0); } | ||
@@ -65,0 +65,0 @@ // Append -f file contents, AGENTS.md (auto-ingested repo context), and skill summaries to system message. |
+1
-1
| { | ||
| "name": "@avcodes/mi", | ||
| "version": "1.7.4", | ||
| "version": "1.7.5", | ||
| "description": "agentic coding in 30 loc. a loop, two tools, and an llm.", | ||
@@ -5,0 +5,0 @@ "type": "module", |
+13
-0
@@ -24,2 +24,3 @@ [](https://www.youtube.com/watch?v=JdMBn7FXilg) | ||
| - optional `~/.mi/config.json` config file (env vars always override) | ||
| - `--sandbox` mode: run inside a Docker container with PWD mounted — safe for destructive experiments | ||
@@ -35,2 +36,5 @@ ## install | ||
| mi | ||
| # or run via docker | ||
| docker run --rm -it -e OPENAI_API_KEY ghcr.io/av/mi | ||
| ``` | ||
@@ -55,2 +59,9 @@ | ||
| MODEL=qwen3.5:4b OPENAI_BASE_URL=http://localhost:33821 mi | ||
| # sandbox mode: run in a docker container with current dir mounted | ||
| mi --sandbox -p 'rm -rf node_modules && reinstall everything' | ||
| # or always run sandboxed via env var | ||
| export MI_SANDBOX=1 | ||
| mi | ||
| ``` | ||
@@ -82,2 +93,4 @@ | ||
| | `MI_HOME` | `~/.mi` | config directory (reads `config.json`) | | ||
| | `MI_SANDBOX` | (unset) | truthy = always run in Docker container | | ||
| | `MI_IMAGE` | `ghcr.io/av/mi:latest` | docker image for sandbox mode | | ||
@@ -84,0 +97,0 @@ ## deep dive |
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 12 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 10 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
70177
1.59%145
1.4%256
5.35%19
11.76%