micro-models-agent 0.14.3 → 0.15.1

package/dist/cli/main.js

@@ -36,6 +36,9 @@ async function main() {
                 iterationCount: result.iterationCount,
                 contextUsed: result.contextUsed ?? null,
                 contextLimit: result.contextLimit ?? null,
+                promptTokens: result.promptTokens ?? null,
+                completionTokens: result.completionTokens ?? null,
+                totalTokens: result.totalTokens ?? null,
             }, null, 2));
             process.stdout.write("\n");
             process.exit(result.success ? 0 : 1);

package/dist/cli/repl.js

@@ -358,7 +358,7 @@ export class Repl {
             action: (args) => {
                 if (args.length === 0) {
                     console.log(`/context ${t("repl.context")}  ${this.config.contextWindow}`);
-                    console.log(t("repl.model_usage").replace("/model", "/context"));
+                    console.log(`Usage: /context <size>  (min 1024)`);
                     return;
                 }
                 const size = parseInt(args[0], 10);
@@ -862,7 +862,12 @@ export class Repl {
             result.contextLimit !== undefined &&
             result.contextLimit > 0) {
             console.log();
-            console.log(formatContextBar(result.contextUsed, result.contextLimit));
+            const ctxLine = formatContextBar(result.contextUsed, result.contextLimit);
+            console.log(ctxLine);
+            if (result.totalTokens !== undefined && result.totalTokens > 0) {
+                const apiLine = pc.dim(`  API: ${result.promptTokens} prompt + ${result.completionTokens} completion = ${result.totalTokens} total`);
+                console.log(apiLine);
+            }
         }
     }
     start() {

package/dist/cli/setup.js

@@ -185,7 +185,7 @@ export async function runSetup() {
     }
     console.log(t("setup.agent_settings"));
     const contextWindow = parseInt(await ask(rl, t("setup.context_window"), "32768"));
-    const maxIterations = parseInt(await ask(rl, t("setup.max_iters"), "25"));
+    const maxIterations = parseInt(await ask(rl, t("setup.max_iters"), "1000"));
     rl.close();
     const answers = {
         provider,

package/dist/config/config.js

@@ -146,8 +146,11 @@ function forceSecurityUpdate(config) {
                 ...DEFAULT_SECURITY_CONFIG.bash.dangerousFlags,
                 ...(userBash.dangerousFlags || []),
             ])],
-        // dangerousOperators: ALWAYS use defaults — user overrides are dangerous
-        dangerousOperators: [...DEFAULT_SECURITY_CONFIG.bash.dangerousOperators],
+        // dangerousOperators: merge user's additions with defaults (user can add but not remove critical ones)
+        dangerousOperators: [...new Set([
+                ...DEFAULT_SECURITY_CONFIG.bash.dangerousOperators,
+                ...(userBash.dangerousOperators || []),
+            ])],
         blockDangerousFlags: DEFAULT_SECURITY_CONFIG.bash.blockDangerousFlags,
         logCommands: DEFAULT_SECURITY_CONFIG.bash.logCommands,
     };

package/dist/config/defaults.js

@@ -48,7 +48,7 @@ export const DEFAULTS = {
         baseDelay: 1000,
         maxDelay: 30000,
     },
-    maxToolIterations: 25,
+    maxToolIterations: 1000,
     stuckThreshold: 8,
     autoPlan: true,
     showReasoning: false,

package/dist/config/security.js

@@ -45,7 +45,8 @@ export const DEFAULT_SECURITY_CONFIG = {
         // If whitelist is non-empty, only these commands are allowed
         whitelist: [],
         // Block dangerous flags like --force, -rf, etc.
-        blockDangerousFlags: true,
+        // Disabled by default — enable in config if needed.
+        blockDangerousFlags: false,
         // Log all executed commands to audit log
         logCommands: true,
         // Dangerous flags that are always blocked
@@ -65,7 +66,9 @@ export const DEFAULT_SECURITY_CONFIG = {
             "--no-confirm",
         ],
         // Dangerous operators that are always blocked
-        dangerousOperators: [">", ">>", "2>", "2>>", "&", "`"],
+        // Note: "&" (background) is not blocked — "&&" (AND) is a legitimate shell operator.
+        // Single "&" for backgrounding is harmless and blocking it breaks "cd dir && npm install".
+        dangerousOperators: [">", ">>", "2>", "2>>", "`"],
     },
     paths: {
         // Glob patterns for paths that are always denied

package/dist/core/agent.js

@@ -110,6 +110,8 @@ export class Agent {
         let lastText = "";
         let hallucinationRetries = 0;
         let lastToolSignature = "";
+        let apiPromptTokens = 0;
+        let apiCompletionTokens = 0;
         const MAX_HALLUCINATION_RETRIES = 3;
         while (iteration < config.maxToolIterations) {
             iteration++;
@@ -177,6 +179,10 @@ export class Agent {
                             arguments: parsedArgs,
                         });
                     }
+                    if (chunk.type === "done" && chunk.usage) {
+                        apiPromptTokens += chunk.usage.promptTokens;
+                        apiCompletionTokens += chunk.usage.completionTokens;
+                    }
                 }
             }
             catch (err) {
@@ -381,6 +387,9 @@ export class Agent {
                 iterationCount: iteration,
                 contextUsed: tokensUsed,
                 contextLimit: budget.history,
+                promptTokens: apiPromptTokens,
+                completionTokens: apiCompletionTokens,
+                totalTokens: apiPromptTokens + apiCompletionTokens,
             };
         }
         return {
@@ -389,6 +398,9 @@ export class Agent {
             iterationCount: iteration,
             contextUsed: tokensUsed,
             contextLimit: budget.history,
+            promptTokens: apiPromptTokens,
+            completionTokens: apiCompletionTokens,
+            totalTokens: apiPromptTokens + apiCompletionTokens,
         };
     }
     clearContext() {

package/dist/core/bootstrap.js

@@ -33,7 +33,6 @@ function buildSystemInfo(config, baseDir, profileCompressed) {
         `Workspace: ${baseDir}`,
         `${profileCompressed}`,
         `Reply in the user's language. Use tools for filesystem, bash, web access.`,
-        `When the task is ambiguous or has multiple reasonable options, ask the user via the "question" tool instead of guessing.`,
         `When you need to act, call a tool immediately. Do not describe your plans in text — use tools to perform operations.`,
         `After every tool call, check whether the user's request is fully satisfied. If any files, commands, or checks are still missing, call the next needed tool right away. Do not stop with an empty or "done" response until the task is complete.`,
         `If you create a directory, continue creating the files that belong inside it. A created folder alone is not a completed task.`,

package/dist/llm/openai-compat.js

@@ -98,6 +98,7 @@ export class OpenAICompatProvider {
         const decoder = new TextDecoder();
         let buffer = "";
         const toolCallAccs = new Map();
+        let usage;
         try {
             while (true) {
                 const { done, value } = await reader.read();
@@ -116,8 +117,17 @@ export class OpenAICompatProvider {
                     try {
                         const parsed = JSON.parse(data);
                         const choice = parsed.choices?.[0];
-                        if (!choice)
+                        if (!choice) {
+                            // Usage comes in the last chunk with empty choices
+                            if (parsed.usage) {
+                                usage = {
+                                    promptTokens: parsed.usage.prompt_tokens ?? 0,
+                                    completionTokens: parsed.usage.completion_tokens ?? 0,
+                                    totalTokens: parsed.usage.total_tokens ?? 0,
+                                };
+                            }
                             continue;
+                        }
                         const delta = choice.delta || {};
                         const finishReason = choice.finish_reason;
                         if (delta.reasoning_content) {
@@ -163,6 +173,9 @@ export class OpenAICompatProvider {
                     }
                 }
             }
+            if (usage) {
+                yield { type: "done", usage };
+            }
         }
         finally {
             clearTimeout(timeoutId);
@@ -232,6 +245,17 @@ export class OpenAICompatProvider {
                     });
                 }
             }
+            // Append usage from API response
+            if (data.usage) {
+                chunks.push({
+                    type: "done",
+                    usage: {
+                        promptTokens: data.usage.prompt_tokens ?? 0,
+                        completionTokens: data.usage.completion_tokens ?? 0,
+                        totalTokens: data.usage.total_tokens ?? 0,
+                    },
+                });
+            }
             return chunks;
         }
         catch (err) {

package/dist/modules/security/command-validator.js

@@ -3,9 +3,9 @@ import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
 const FALLBACK_BASH_CONFIG = {
     blacklist: ['rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat'],
     whitelist: [],
-    blockDangerousFlags: true,
+    blockDangerousFlags: false,
     dangerousFlags: ['--force', '-rf', '--no-preserve-root'],
-    dangerousOperators: ['>', '>>', '2>', '2>>', '|', '&&', '||', ';', '&', '`'],
+    dangerousOperators: ['>', '>>', '2>', '2>>', '|', '&&', '||', ';', '`'],
     logCommands: true,
 };
 export const DEFAULT_BASH_CONFIG = DEFAULT_SECURITY_CONFIG?.bash || FALLBACK_BASH_CONFIG;
@@ -55,6 +55,8 @@ function containsOperator(command, op) {
     const escaped = op.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     // For single-char operators that are prefixes of multi-char ones,
     // ensure they don't match when part of a longer sequence.
+    // Note: "&" is no longer in dangerousOperators (&& is legitimate),
+    // but keep the special case for defense-in-depth if manually added.
     if (op === '&')
         return /(?<!&)&(?!&)/.test(command);
     if (op === '|')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "micro-models-agent",
-  "version": "0.14.3",
+  "version": "0.15.1",
   "description": "Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)",
   "type": "module",
   "bin": {