micro-models-agent 0.15.0 → 0.16.0

package/dist/cli/main.js

@@ -87,6 +87,21 @@ async function main() {
             config.contextWindow = answers.contextWindow;
             config.maxToolIterations = answers.maxToolIterations;
             config.locale = answers.locale;
+            if (config.security) {
+                config.security.bash.blockDangerousFlags = answers.securityFlagsBlock;
+                if (answers.securityBashBlock) {
+                    config.security.bash.blacklist = [
+                        ...new Set([
+                            ...config.security.bash.blacklist,
+                            "rm", "dd", "chmod", "wget", "curl", "scp", "ssh", "nc", "netcat",
+                            "sudo", "su", "kill", "pkill", "killall", "shutdown", "reboot",
+                        ]),
+                    ];
+                }
+                if (!answers.securityPathsDeny) {
+                    config.security.paths.denied = [];
+                }
+            }
             saveConfig(config, configPath);
         }
         const { agent, config, sessionManager, skillsModule, pluginManager, configDir, baseDir, } = await bootstrap(undefined, projectDir, noAgentsMd, exitOnComplete);

package/dist/cli/setup.js

@@ -185,7 +185,19 @@ export async function runSetup() {
     }
     console.log(t("setup.agent_settings"));
     const contextWindow = parseInt(await ask(rl, t("setup.context_window"), "32768"));
-    const maxIterations = parseInt(await ask(rl, t("setup.max_iters"), "25"));
+    const maxIterations = parseInt(await ask(rl, t("setup.max_iters"), "1000"));
+    // Security settings
+    console.log(t("setup.security_header"));
+    console.log(pc.dim(t("setup.security_status_off")));
+    const configureSecurity = await ask(rl, t("setup.security_configure"), "n");
+    let securityBashBlock = false;
+    let securityFlagsBlock = false;
+    let securityPathsDeny = true;
+    if (configureSecurity.toLowerCase() === "y" || configureSecurity.toLowerCase() === "yes") {
+        securityBashBlock = (await ask(rl, t("setup.security_bash_block"), "n")).toLowerCase() === "y";
+        securityFlagsBlock = (await ask(rl, t("setup.security_flags_block"), "n")).toLowerCase() === "y";
+        securityPathsDeny = (await ask(rl, t("setup.security_paths_deny"), "Y")).toLowerCase() !== "n";
+    }
     rl.close();
     const answers = {
         provider,
@@ -195,6 +207,9 @@ export async function runSetup() {
         contextWindow,
         maxToolIterations: maxIterations,
         locale,
+        securityBashBlock,
+        securityFlagsBlock,
+        securityPathsDeny,
     };
     console.log(pc.green(pc.bold(t("setup.complete"))));
     const summary = renderTable([

package/dist/config/security.js

@@ -45,7 +45,8 @@ export const DEFAULT_SECURITY_CONFIG = {
         // If whitelist is non-empty, only these commands are allowed
         whitelist: [],
         // Block dangerous flags like --force, -rf, etc.
-        blockDangerousFlags: true,
+        // Disabled by default — enable in config if needed.
+        blockDangerousFlags: false,
         // Log all executed commands to audit log
         logCommands: true,
         // Dangerous flags that are always blocked

package/dist/i18n/en.json

@@ -354,6 +354,12 @@
     "setup.testing_spinner": "Testing chat with \"{model}\"…",
     "setup.summary_setting": "Setting",
     "setup.summary_value": "Value",
+    "setup.security_header": "\n  --- Security ---",
+    "setup.security_status_off": "  Security: OFF (default — all commands allowed)",
+    "setup.security_configure": "  Configure security? (y/N)",
+    "setup.security_bash_block": "  Block dangerous commands (rm, sudo, ssh, etc.)? (y/N)",
+    "setup.security_flags_block": "  Block dangerous flags (--force, -rf, etc.)? (y/N)",
+    "setup.security_paths_deny": "  Deny .git/, .env, node_modules/? (Y/n)",
     "skill.already_loaded": "Skill \"{name}\" is already loaded",
     "skill.not_found": "Skill \"{name}\" not found in any source directory",
     "skill.no_match": "No skills match for: {task}",

package/dist/i18n/ru.json

@@ -354,6 +354,12 @@
     "setup.testing_spinner": "Проверка чата с \"{model}\"…",
     "setup.summary_setting": "Параметр",
     "setup.summary_value": "Значение",
+    "setup.security_header": "\n  --- Безопасность ---",
+    "setup.security_status_off": "  Безопасность: ВЫКЛ (по умолчанию — все команды разрешены)",
+    "setup.security_configure": "  Настроить безопасность? (y/N)",
+    "setup.security_bash_block": "  Блокировать опасные команды (rm, sudo, ssh и т.д.)? (y/N)",
+    "setup.security_flags_block": "  Блокировать опасные флаги (--force, -rf и т.д.)? (y/N)",
+    "setup.security_paths_deny": "  Запретить .git/, .env, node_modules/? (Y/n)",
     "skill.already_loaded": "Скилл \"{name}\" уже загружен",
     "skill.not_found": "Скилл \"{name}\" не найден ни в одном каталоге",
     "skill.no_match": "Нет скиллов подходящих для: {task}",

package/dist/modules/security/command-validator.js

@@ -3,7 +3,7 @@ import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
 const FALLBACK_BASH_CONFIG = {
     blacklist: ['rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat'],
     whitelist: [],
-    blockDangerousFlags: true,
+    blockDangerousFlags: false,
     dangerousFlags: ['--force', '-rf', '--no-preserve-root'],
     dangerousOperators: ['>', '>>', '2>', '2>>', '|', '&&', '||', ';', '`'],
     logCommands: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "micro-models-agent",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)",
   "type": "module",
   "bin": {