micro-models-agent 0.16.5 → 0.16.7

package/dist/cli/repl.js

@@ -59,6 +59,7 @@ export class Repl {
     configDir;
     baseDir;
     noAgentsMd;
+    pendingClipboardImage = null;
     constructor(agent, config, sessionManager, skillsModule, pluginManager, configDir, baseDir, noAgentsMd) {
         this.agent = agent;
         this.config = config;
@@ -738,7 +739,7 @@ export class Repl {
         });
         if (process.stdin.isTTY) {
             readline.emitKeypressEvents(process.stdin);
-            process.stdin.on("keypress", (str, key) => {
+            process.stdin.on("keypress", async (str, key) => {
                 if (key.name === "escape") {
                     const now = Date.now();
                     if (now - this.lastEscTime < this.doubleEscDelay) {
@@ -751,6 +752,23 @@ export class Repl {
                     }
                     this.lastEscTime = now;
                 }
+                // Ctrl+V: try to paste image from clipboard
+                if (key.ctrl && key.name === "v" && !this.agentRunning) {
+                    try {
+                        const { readClipboardImage, loadFileAsDataUrl } = await import("../llm/image-utils");
+                        const clipPath = await readClipboardImage();
+                        if (clipPath) {
+                            const { dataUrl } = loadFileAsDataUrl(clipPath);
+                            this.pendingClipboardImage = dataUrl;
+                            const sizeKb = Math.round((dataUrl.length * 3) / 4 / 1024);
+                            console.log(pc.green(`\n${t("image.attached", { source: "clipboard", size: `${sizeKb} KB` })}`));
+                            this.rl.prompt();
+                        }
+                    }
+                    catch {
+                        // clipboard read failed — ignore, let terminal paste text normally
+                    }
+                }
             });
         }
         // SIGINT: first Ctrl+C sends graceful shutdown, second forces exit
@@ -782,6 +800,17 @@ export class Repl {
         this.agentRunning = true;
         this.rl.pause();
         try {
+            // Attach pending clipboard image if Ctrl+V was pressed
+            if (this.pendingClipboardImage) {
+                const contextManager = this.agent.contextManager;
+                if (contextManager) {
+                    contextManager.addPendingImage({
+                        type: "image_url",
+                        image_url: { url: this.pendingClipboardImage },
+                    });
+                }
+                this.pendingClipboardImage = null;
+            }
             process.stdout.write("\n" + pc.green(t("repl.agent")));
             const renderer = new Renderer({ spinner: this.config.ui?.spinner ?? true });
             const result = await this.agent.run(input, (c) => renderer.text(c), (m) => renderer.meta(m), (ev) => {

package/dist/llm/image-utils.js

@@ -63,17 +63,9 @@ async function readClipboardWindows() {
     try {
         const { execSync } = await import("child_process");
         const tmpPath = `${process.env.TEMP || process.env.TMP || "/tmp"}\\mma-clip-${Date.now()}.png`;
-        const ps = [
-            "Add-Type -AssemblyName System.Windows.Forms",
-            "$img = [System.Windows.Forms.Clipboard]::GetImage()",
-            "if ($img -ne $null) {",
-            `  $img.Save("${tmpPath}")`,
-            '  Write-Output "OK"',
-            "} else {",
-            '  Write-Output "EMPTY"',
-            "}",
-        ].join("; ");
-        const out = execSync(`powershell -NoProfile -Command "${ps}"`, {
+        // Use single quotes in PowerShell to avoid backslash issues
+        const psScript = `Add-Type -AssemblyName System.Windows.Forms; $img = [System.Windows.Forms.Clipboard]::GetImage(); if ($img -ne $null) { $img.Save('${tmpPath}'); Write-Output 'OK' } else { Write-Output 'EMPTY' }`;
+        const out = execSync(`powershell -NoProfile -Command "${psScript}"`, {
             timeout: 5000,
             encoding: "utf-8",
         });

package/dist/modules/security/command-validator.js

@@ -85,6 +85,16 @@ export function isCommandAllowed(command, securityConfig) {
     if (!trimmedCommand) {
         return { allowed: false, reason: "Empty command" };
     }
+    // Shell wrappers are always blocked — they bypass all command validation.
+    // The agent should use the bash tool directly, not shell interpreters.
+    const ALWAYS_BLOCKED = ['powershell', 'pwsh', 'cmd'];
+    const baseForShellCheck = extractBaseCommand(trimmedCommand);
+    if (ALWAYS_BLOCKED.includes(baseForShellCheck)) {
+        return {
+            allowed: false,
+            reason: `Shell wrapper "${baseForShellCheck}" is blocked — use the bash tool directly`,
+        };
+    }
     // Check dangerous operators FIRST — before parsing the base command.
     // e.g. "curl http://x | bash" must be caught even though curl isn't blacklisted.
     if (config.blockDangerousFlags) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "micro-models-agent",
-  "version": "0.16.5",
+  "version": "0.16.7",
   "description": "Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)",
   "type": "module",
   "bin": {