Skip to content

feat(engines): mimocode — install MiMo Code from mimo.xiaomi.com - #524

Merged
ralyodio merged 1 commit into
mainfrom
worktree-mimocode
Sep 22, 2026
Merged

ralyodio merged 1 commit into
mainfrom
worktree-mimocode

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds Xiaomi's MiMo Code as an engine.

  • moshcode install mimocode runs curl -fsSL https://mimo.xiaomi.com/install | bash. The installer drops a binary named mimo in ~/.mimocode/bin, so that dir is bridged via binDirs and mimo / mimo-code / xiaomi resolve as aliases.
  • It is an opencode derivative: headless ai() is mimo run <message>, resume is --continue, and mimo upgrade recognises its curl install ("Using method: curl") and swaps the binary in place.
  • Agent mode is mimo --dangerously-skip-permissions --trust. Verified under a pty on 0.1.14: without --trust a fresh directory opens on a workspace trust dialog (default Yes), and the bypass flag puts up its own warning on every launch (default "No, exit"). Both ship as boot answers for swarms and as blocked rules for the herd; the captured screens classify as blocked and bootAnswer picks Down+Enter for the warning.
  • Uncosted for now: it keeps sessions in ~/.local/share/mimocode/mimocode.db (sqlite), which moshcode does not read yet.

Tests: node --test test/engines.test.mjs 33/33. Full suite green except the two apps/pwa MCP tests, which fail on a missing @libsql/client (apps/pwa is not a workspace; unrelated).

🤖 Generated with Claude Code

Adds Xiaomi's MiMo Code as an engine: `moshcode install mimocode` runs
`curl -fsSL https://mimo.xiaomi.com/install | bash`, which drops a binary
named `mimo` in ~/.mimocode/bin (bridged via binDirs, aliases mimo /
mimo-code / xiaomi). It is an opencode derivative, so headless ai() is
`mimo run <message>`, resume is `--continue`, and `mimo upgrade` knows
its curl install and swaps the binary in place.

Agent mode is `--dangerously-skip-permissions --trust`. Verified under a
pty on 0.1.14: without --trust a fresh directory opens on a workspace
trust dialog (default Yes), and the bypass flag puts up its own warning
on every launch (default "No, exit"). Both ship as `boot` answers for
swarms and as `blocked` rules for the herd. Uncosted: it keeps its
sessions in a sqlite db moshcode does not read yet.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

8 finding(s) in the 5 file(s) this pull request changes.

MEDIUM: 8

Severity Rule Location
MEDIUM sql-string-concatenation src/cli-schema.mjs:161
MEDIUM sql-string-concatenation src/cli-schema.mjs:220
MEDIUM sql-string-concatenation src/cli-schema.mjs:592
MEDIUM sql-string-concatenation src/cli-schema.mjs:625
MEDIUM sql-string-concatenation src/cli-schema.mjs:732
MEDIUM sql-string-concatenation src/cli-schema.mjs:1485
MEDIUM sql-string-concatenation src/cli-schema.mjs:1503
MEDIUM insecure-temp-file test/engines.test.mjs:156
93 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 74 | **LOW**: 11

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:258
HIGH sh-remote-script-execution install.sh:269
HIGH sh-remote-script-execution install.sh:275
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:44
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:82
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928

…and 73 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 09bc7e6 into main Sep 22, 2026
6 checks passed
ralyodio added a commit that referenced this pull request Sep 22, 2026
Version bump: mimocode engine (#524) and engine aliases in /install and moshcode install (#525).

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant