micro-models-agent 0.16.2 → 0.16.4

package/dist/config/config.js

@@ -7,13 +7,6 @@ import { MigrationDetector } from '../migration/detect';
 import { BackupManager } from '../migration/backup';
 import { validateExpertConfig } from './experts';
 import { ConfigEncryptor } from '../modules/security/encryption';
-/**
- * When the user's config version is older than this, force-overwrite
- * the security bash settings with the current defaults.
- * This ensures critical security changes (like operator allowlists)
- * are applied even if the user has a saved config.
- */
-const FORCE_SECURITY_UPDATE_VERSION = '2.1.0';
 /**
  * Restore RegExp instances in dangerousPatterns that were serialized as {}
  * (pre-0.8.0 configs) or as {__regex, source, flags} (new format).
@@ -122,42 +115,6 @@ function applyEnvVars(config) {
         result.moe = { ...result.moe, enabled: env.MMA_MOE_ENABLED === 'true' };
     return result;
 }
-/**
- * Force-update security settings when upgrading from an older version.
- * This overrides user config for critical security fields that must
- * match the current code defaults (e.g. dangerousOperators).
- */
-function forceSecurityUpdate(config) {
-    const userVersion = config.version || '0.0.0';
-    if (userVersion >= FORCE_SECURITY_UPDATE_VERSION)
-        return config;
-    // Force-overwrite bash security with current defaults
-    const security = config.security || {};
-    const userBash = security.bash || {};
-    security.bash = {
-        ...DEFAULT_SECURITY_CONFIG.bash,
-        // Keep user's custom blacklist additions, but ensure defaults are present
-        blacklist: [...new Set([
-                ...DEFAULT_SECURITY_CONFIG.bash.blacklist,
-                ...(userBash.blacklist || []),
-            ])],
-        whitelist: userBash.whitelist || DEFAULT_SECURITY_CONFIG.bash.whitelist,
-        dangerousFlags: [...new Set([
-                ...DEFAULT_SECURITY_CONFIG.bash.dangerousFlags,
-                ...(userBash.dangerousFlags || []),
-            ])],
-        // dangerousOperators: merge user's additions with defaults (user can add but not remove critical ones)
-        dangerousOperators: [...new Set([
-                ...DEFAULT_SECURITY_CONFIG.bash.dangerousOperators,
-                ...(userBash.dangerousOperators || []),
-            ])],
-        blockDangerousFlags: DEFAULT_SECURITY_CONFIG.bash.blockDangerousFlags,
-        logCommands: DEFAULT_SECURITY_CONFIG.bash.logCommands,
-    };
-    config.security = security;
-    console.log(t('migration.security_updated', { from: userVersion, to: FORCE_SECURITY_UPDATE_VERSION }));
-    return config;
-}
 export function loadConfig(options) {
     const globalPath = join(options.configDir, 'config.json');
     mkdirSync(options.configDir, { recursive: true });
@@ -189,8 +146,6 @@ export function loadConfig(options) {
     if (config.security?.contentScan?.dangerousPatterns) {
         config.security.contentScan.dangerousPatterns = restoreDangerousPatterns(config.security.contentScan.dangerousPatterns, DEFAULT_SECURITY_CONFIG.contentScan.dangerousPatterns);
     }
-    // Force-update security settings when upgrading from older version
-    config = forceSecurityUpdate(config);
     config = applyEnvVars(config);
     // Decrypt sensitive fields in the loaded config
     try {

package/dist/config/security.js

@@ -41,6 +41,9 @@ export const DEFAULT_SECURITY_CONFIG = {
             "mkfs",
             "mount",
             "umount",
+            "powershell",
+            "pwsh",
+            "cmd",
         ],
         // If whitelist is non-empty, only these commands are allowed
         whitelist: [],

package/dist/i18n/en.json

@@ -419,7 +419,6 @@
     "migration.dir_bak": "- .mma/ \u2192 .mma.bak/ ({count} files)",
     "migration.migrated": "Migrated:",
     "migration.not_needed": "No migration needed",
-    "migration.security_updated": "[MMA] Security config force-updated from v{from} to v{to} (dangerous operators reset to defaults)",
     "ui.error_prefix": "Error: ",
     "ui.success_prefix": "\u2713 ",
     "ui.warning_prefix": "\u26a0 ",

package/dist/i18n/ru.json

@@ -419,7 +419,6 @@
     "migration.dir_bak": "- .mma/ → .mma.bak/ ({count} файлов)",
     "migration.migrated": "Мигрировано:",
     "migration.not_needed": "Миграция не требуется",
-    "migration.security_updated": "[MMA] Конфигурация безопасности принудительно обновлена с v{from} до v{to} (опасные операторы сброшены)",
     "ui.error_prefix": "Ошибка: ",
     "ui.success_prefix": "✓ ",
     "ui.warning_prefix": "⚠ ",

package/dist/modules/execution/stuck-detector.js

@@ -97,16 +97,18 @@ export class StuckDetector {
         if (this.isStuck()) {
             return t('exec.stuck_recovery', { iterations: this.iterationsOnCurrentStep });
         }
+        // Per-tool error recovery (more specific — e.g., "bash failed 3 times")
+        const errorTool = Array.from(this.toolErrors.entries()).find(([_, c]) => c >= this.errorThreshold);
+        if (errorTool) {
+            return t('exec.tool_errors_recovery', { tool: errorTool[0], count: errorTool[1] });
+        }
+        // Consecutive failures from different tools (generic — e.g., "5 consecutive failures")
         if (this.hasConsecutiveFailures()) {
             return t('exec.consecutive_failures_recovery', { count: this.consecutiveFailures });
         }
         if (this.hasRepetitiveToolCalls()) {
             return this.getRepetitiveToolMessage();
         }
-        const errorTool = Array.from(this.toolErrors.entries()).find(([_, c]) => c >= this.errorThreshold);
-        if (errorTool) {
-            return t('exec.tool_errors_recovery', { tool: errorTool[0], count: errorTool[1] });
-        }
         return '';
     }
     checkOffTrack(toolName, call) {

package/dist/modules/security/command-validator.js

@@ -1,7 +1,7 @@
 import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
 // Fallback in case DEFAULT_SECURITY_CONFIG is not available
 const FALLBACK_BASH_CONFIG = {
-    blacklist: ['rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat'],
+    blacklist: ['rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat', 'powershell', 'pwsh', 'cmd'],
     whitelist: [],
     blockDangerousFlags: false,
     dangerousFlags: ['--force', '-rf', '--no-preserve-root'],
@@ -32,8 +32,7 @@ function extractBaseCommand(trimmed) {
             i++;
             continue;
         }
-        if (tok === "sudo" || tok === "env" || tok === "command" || tok === "exec" || tok === "nohup" ||
-            tok === "powershell" || tok === "pwsh" || tok === "cmd") {
+        if (tok === "sudo" || tok === "env" || tok === "command" || tok === "exec" || tok === "nohup") {
             i++;
             continue;
         }

package/dist/tools/bash.js

@@ -5,8 +5,8 @@ import { DEFAULT_SECURITY_CONFIG } from '../config/security';
 import { runCommand, processRegistry, isLongRunningCommand } from '../modules/processes';
 import { t } from '../i18n/index';
 import { platform } from 'os';
+import { MAX_PREVIEW_LINES } from './preview';
 const BASH_TIMEOUT_MS = 120_000;
-const MAX_PREVIEW_LINES = 25;
 function adaptCommandForWindows(command) {
     if (platform() !== 'win32')
         return command;

package/dist/tools/glob-tool.js

@@ -1,6 +1,6 @@
 import { globSync } from 'fs';
 import { t } from '../i18n/index';
-const MAX_PREVIEW_LINES = 25;
+import { MAX_PREVIEW_LINES } from './preview';
 export const globTool = {
     name: 'glob',
     description: `Search for files matching a glob pattern. Shows up to ${MAX_PREVIEW_LINES} results by default. Uses standard glob syntax (e.g., **/*.ts, src/**/*.test.ts).`,

package/dist/tools/grep-tool.js

@@ -2,7 +2,7 @@ import { execFileSync, execSync } from 'child_process';
 import { resolve } from 'path';
 import { t } from '../i18n/index';
 import { logBashCommand } from '../modules/security/audit-log';
-const MAX_PREVIEW_LINES = 25;
+import { MAX_PREVIEW_LINES } from './preview';
 function truncateLines(output) {
     const lines = output.split('\n');
     if (lines.length <= MAX_PREVIEW_LINES)

package/dist/tools/list-dir.js

@@ -3,7 +3,7 @@ import { resolve } from 'path';
 import { t } from '../i18n/index';
 import { isPathInScope } from '../modules/security/path-validator';
 import { safeResolvePath } from './path-utils';
-const MAX_PREVIEW_LINES = 25;
+import { MAX_PREVIEW_LINES } from './preview';
 export const listDirTool = {
     name: 'list_dir',
     description: `List files and directories in a given path. Shows up to ${MAX_PREVIEW_LINES} entries by default.`,

package/dist/tools/preview.js

@@ -0,0 +1,2 @@
+/** Maximum number of lines shown in tool output previews. */
+export const MAX_PREVIEW_LINES = 15;

package/dist/tools/process-log.js

@@ -1,6 +1,7 @@
 import { processRegistry } from '../modules/processes';
 import { t } from '../i18n/index';
-const DEFAULT_TAIL = 25;
+import { MAX_PREVIEW_LINES } from './preview';
+const DEFAULT_TAIL = MAX_PREVIEW_LINES;
 export const processLogTool = {
     name: 'process_log',
     description: `Show the buffered output of a background process started via bash. Shows the last ${DEFAULT_TAIL} lines by default. Use after starting a dev server to verify it came up without errors, and while it runs to check its state.`,

package/dist/tools/read-file.js

@@ -5,8 +5,8 @@ import { isPathInScope } from "../modules/security/path-validator";
 import { DEFAULT_SECURITY_CONFIG } from "../config/security";
 import { logSecurityBlock } from "../modules/security/audit-log";
 import { safeResolvePath } from "./path-utils";
-/** Default number of lines returned when the caller omits `limit`. */
-const DEFAULT_LIMIT = 25;
+import { MAX_PREVIEW_LINES } from "./preview";
+const DEFAULT_LIMIT = MAX_PREVIEW_LINES;
 export const readFileTool = {
     name: "read_file",
     description: `Read a file from the filesystem. Reads up to ${DEFAULT_LIMIT} lines at a time by default; use offset to page through large files.`,

package/dist/tools/web-browse.js

@@ -2,9 +2,11 @@ import { t } from '../i18n/index';
 import { isUrlAllowed, sanitizeUrl } from '../modules/security/network-validator';
 import { logNetworkRequest, logSecurityBlock } from '../modules/security/audit-log';
 import { getSessionSecurityConfig } from '../modules/security/session-isolation';
+import { MAX_PREVIEW_LINES } from './preview';
+const MAX_CHARS = 3000;
 export const webBrowseTool = {
     name: 'web_browse',
-    description: 'Fetch and read a web page. Returns the page content as plain text.',
+    description: `Fetch and read a web page. Returns the page content as plain text (max ${MAX_PREVIEW_LINES} lines / ${MAX_CHARS} chars).`,
     tags: ['research'],
     parameters: {
         type: 'object',
@@ -39,8 +41,12 @@ export const webBrowseTool = {
                 .trim();
             // Log successful network request
             logNetworkRequest(ctx.sessionId, sanitizeUrl(url), true, `Status: ${response.status}`);
-            const maxLen = securityConfig?.maxResponseSize || 8000;
-            const content = stripped.length > maxLen ? stripped.slice(0, maxLen) + t('file.truncated') : stripped;
+            const maxLen = securityConfig?.maxResponseSize || MAX_CHARS;
+            let content = stripped.length > maxLen ? stripped.slice(0, maxLen) + t('file.truncated') : stripped;
+            const lines = content.split('\n');
+            if (lines.length > MAX_PREVIEW_LINES) {
+                content = lines.slice(0, MAX_PREVIEW_LINES).join('\n') + `\n... (${lines.length - MAX_PREVIEW_LINES} more lines)`;
+            }
             return { success: true, output: content || t('file.empty_page') };
         }
         catch (err) {

package/dist/tools/web-fetch.js

@@ -3,7 +3,8 @@ import { isUrlAllowed, sanitizeUrl } from '../modules/security/network-validator
 import { logNetworkRequest, logSecurityBlock } from '../modules/security/audit-log';
 import { getSessionSecurityConfig } from '../modules/security/session-isolation';
 import { DEFAULT_SECURITY_CONFIG } from '../config/security';
-const MAX_CHARS = 15000;
+import { MAX_PREVIEW_LINES } from './preview';
+const MAX_CHARS = 5000;
 function stripHtml(html) {
     return html
         .replace(/<script[\s\S]*?<\/script>/gi, '')
@@ -50,7 +51,16 @@ export const webFetchTool = {
             // Log successful network request
             logNetworkRequest(ctx.sessionId, sanitizeUrl(url), true, `Status: ${response.status}`);
             if (cleaned.length > (securityConfig?.maxResponseSize || MAX_CHARS)) {
-                return { success: true, output: cleaned.slice(0, securityConfig?.maxResponseSize || MAX_CHARS) + t('file.truncated') };
+                let content = cleaned.slice(0, securityConfig?.maxResponseSize || MAX_CHARS) + t('file.truncated');
+                const lines = content.split('\n');
+                if (lines.length > MAX_PREVIEW_LINES) {
+                    content = lines.slice(0, MAX_PREVIEW_LINES).join('\n') + `\n... (${lines.length - MAX_PREVIEW_LINES} more lines)`;
+                }
+                return { success: true, output: content };
+            }
+            const lines = cleaned.split('\n');
+            if (lines.length > MAX_PREVIEW_LINES) {
+                return { success: true, output: lines.slice(0, MAX_PREVIEW_LINES).join('\n') + `\n... (${lines.length - MAX_PREVIEW_LINES} more lines)` };
             }
             return { success: true, output: cleaned || t('file.empty_page') };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "micro-models-agent",
-  "version": "0.16.2",
+  "version": "0.16.4",
   "description": "Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)",
   "type": "module",
   "bin": {