micro-models-agent 0.16.3 → 0.16.4

package/dist/config/config.js

@@ -7,13 +7,6 @@ import { MigrationDetector } from '../migration/detect';
 import { BackupManager } from '../migration/backup';
 import { validateExpertConfig } from './experts';
 import { ConfigEncryptor } from '../modules/security/encryption';
-/**
- * When the user's config version is older than this, force-overwrite
- * the security bash settings with the current defaults.
- * This ensures critical security changes (like operator allowlists)
- * are applied even if the user has a saved config.
- */
-const FORCE_SECURITY_UPDATE_VERSION = '2.1.0';
 /**
  * Restore RegExp instances in dangerousPatterns that were serialized as {}
  * (pre-0.8.0 configs) or as {__regex, source, flags} (new format).
@@ -122,42 +115,6 @@ function applyEnvVars(config) {
         result.moe = { ...result.moe, enabled: env.MMA_MOE_ENABLED === 'true' };
     return result;
 }
-/**
- * Force-update security settings when upgrading from an older version.
- * This overrides user config for critical security fields that must
- * match the current code defaults (e.g. dangerousOperators).
- */
-function forceSecurityUpdate(config) {
-    const userVersion = config.version || '0.0.0';
-    if (userVersion >= FORCE_SECURITY_UPDATE_VERSION)
-        return config;
-    // Force-overwrite bash security with current defaults
-    const security = config.security || {};
-    const userBash = security.bash || {};
-    security.bash = {
-        ...DEFAULT_SECURITY_CONFIG.bash,
-        // Keep user's custom blacklist additions, but ensure defaults are present
-        blacklist: [...new Set([
-                ...DEFAULT_SECURITY_CONFIG.bash.blacklist,
-                ...(userBash.blacklist || []),
-            ])],
-        whitelist: userBash.whitelist || DEFAULT_SECURITY_CONFIG.bash.whitelist,
-        dangerousFlags: [...new Set([
-                ...DEFAULT_SECURITY_CONFIG.bash.dangerousFlags,
-                ...(userBash.dangerousFlags || []),
-            ])],
-        // dangerousOperators: merge user's additions with defaults (user can add but not remove critical ones)
-        dangerousOperators: [...new Set([
-                ...DEFAULT_SECURITY_CONFIG.bash.dangerousOperators,
-                ...(userBash.dangerousOperators || []),
-            ])],
-        blockDangerousFlags: DEFAULT_SECURITY_CONFIG.bash.blockDangerousFlags,
-        logCommands: DEFAULT_SECURITY_CONFIG.bash.logCommands,
-    };
-    config.security = security;
-    console.log(t('migration.security_updated', { from: userVersion, to: FORCE_SECURITY_UPDATE_VERSION }));
-    return config;
-}
 export function loadConfig(options) {
     const globalPath = join(options.configDir, 'config.json');
     mkdirSync(options.configDir, { recursive: true });
@@ -189,8 +146,6 @@ export function loadConfig(options) {
     if (config.security?.contentScan?.dangerousPatterns) {
         config.security.contentScan.dangerousPatterns = restoreDangerousPatterns(config.security.contentScan.dangerousPatterns, DEFAULT_SECURITY_CONFIG.contentScan.dangerousPatterns);
     }
-    // Force-update security settings when upgrading from older version
-    config = forceSecurityUpdate(config);
     config = applyEnvVars(config);
     // Decrypt sensitive fields in the loaded config
     try {

package/dist/config/security.js

@@ -41,6 +41,9 @@ export const DEFAULT_SECURITY_CONFIG = {
             "mkfs",
             "mount",
             "umount",
+            "powershell",
+            "pwsh",
+            "cmd",
         ],
         // If whitelist is non-empty, only these commands are allowed
         whitelist: [],

package/dist/i18n/en.json

@@ -419,7 +419,6 @@
     "migration.dir_bak": "- .mma/ \u2192 .mma.bak/ ({count} files)",
     "migration.migrated": "Migrated:",
     "migration.not_needed": "No migration needed",
-    "migration.security_updated": "[MMA] Security config force-updated from v{from} to v{to} (dangerous operators reset to defaults)",
     "ui.error_prefix": "Error: ",
     "ui.success_prefix": "\u2713 ",
     "ui.warning_prefix": "\u26a0 ",

package/dist/i18n/ru.json

@@ -419,7 +419,6 @@
     "migration.dir_bak": "- .mma/ → .mma.bak/ ({count} файлов)",
     "migration.migrated": "Мигрировано:",
     "migration.not_needed": "Миграция не требуется",
-    "migration.security_updated": "[MMA] Конфигурация безопасности принудительно обновлена с v{from} до v{to} (опасные операторы сброшены)",
     "ui.error_prefix": "Ошибка: ",
     "ui.success_prefix": "✓ ",
     "ui.warning_prefix": "⚠ ",

package/dist/modules/security/command-validator.js

@@ -1,7 +1,7 @@
 import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
 // Fallback in case DEFAULT_SECURITY_CONFIG is not available
 const FALLBACK_BASH_CONFIG = {
-    blacklist: ['rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat'],
+    blacklist: ['rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat', 'powershell', 'pwsh', 'cmd'],
     whitelist: [],
     blockDangerousFlags: false,
     dangerousFlags: ['--force', '-rf', '--no-preserve-root'],
@@ -32,8 +32,7 @@ function extractBaseCommand(trimmed) {
             i++;
             continue;
         }
-        if (tok === "sudo" || tok === "env" || tok === "command" || tok === "exec" || tok === "nohup" ||
-            tok === "powershell" || tok === "pwsh" || tok === "cmd") {
+        if (tok === "sudo" || tok === "env" || tok === "command" || tok === "exec" || tok === "nohup") {
             i++;
             continue;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "micro-models-agent",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)",
   "type": "module",
   "bin": {