micro-models-agent 0.24.10 → 0.24.12

package/dist/main.js

@@ -3810,10 +3810,6 @@ var init_data_sanitizer = __esm(() => {
     {
       pattern: /Bearer\s+[a-zA-Z0-9_-]{20,}/gi,
       replacement: "Bearer [REDACTED]"
-    },
-    {
-      pattern: /\b([a-zA-Z0-9_-]{30,})\b/g,
-      replacement: "[REDACTED]"
     }
   ];
 });
@@ -5012,6 +5008,14 @@ class ToolResultCache {
   has(key) {
     return this.get(key) !== undefined;
   }
+  cleanExpired() {
+    const now = Date.now();
+    for (const [key, entry] of this.cache) {
+      if (now > entry.expiresAt) {
+        this.cache.delete(key);
+      }
+    }
+  }
   clear() {
     this.cache.clear();
   }
@@ -5132,6 +5136,7 @@ class ToolExecutor {
       this.cache.set(key, result.output);
       this.ctx.logger.debug(`Tool ${call.name}: CACHED`);
     }
+    this.cache.cleanExpired();
     this.ctx.logger.debug(`Tool ${call.name}: ${result.success ? "OK" : "FAIL"}`);
     return result;
   }
@@ -5147,6 +5152,9 @@ class ToolExecutor {
   setScope(scope) {
     this.ctx.scope = scope;
   }
+  setOnMeta(onMeta) {
+    this.ctx.onMeta = onMeta;
+  }
   updateProvider(provider) {
     this.ctx.llmProvider = provider;
   }
@@ -6260,7 +6268,8 @@ var init_edit_file = __esm(() => {
           output: t("file.string_not_found", { str: oldStr })
         };
       }
-      const updated = content.replace(oldStr, newStr);
+      const occurrences = content.split(oldStr).length - 1;
+      const updated = occurrences > 1 ? content.replaceAll(oldStr, newStr) : content.replace(oldStr, newStr);
       const scanResult = scanContent(updated, path, ctx.config.security?.contentScan);
       if (!scanResult.allowed) {
         logSecurityBlock(ctx.sessionId, "file_write", scanResult.reason || "Content contains dangerous patterns", path);
@@ -6667,6 +6676,12 @@ var init_file_info = __esm(() => {
 });
 
 // src/modules/security/command-validator.ts
+function hasShellIndirection(command) {
+  return /\$\{[^}]+\}/.test(command) || /\$\(/.test(command) || /`[^`]+`/.test(command) || /\$\(\(/.test(command) || /\$\{[!]/.test(command);
+}
+function hasEvalConstruct(command) {
+  return /\beval\b/.test(command) || /\bsource\b/.test(command);
+}
 function extractBaseCommand(trimmed) {
   const tokens = trimmed.split(/\s+/);
   let i = 0;
@@ -6722,6 +6737,18 @@ function isCommandAllowed(command, securityConfig) {
       reason: `Shell wrapper "${baseForShellCheck}" is blocked — use the bash tool directly`
     };
   }
+  if (hasShellIndirection(trimmedCommand)) {
+    return {
+      allowed: false,
+      reason: `Shell indirection (variable expansion, command substitution, or backtick execution) is not allowed`
+    };
+  }
+  if (hasEvalConstruct(trimmedCommand)) {
+    return {
+      allowed: false,
+      reason: `eval/source constructs are not allowed`
+    };
+  }
   if (config.blockDangerousFlags) {
     for (const op of config.dangerousOperators || []) {
       if (containsOperator(trimmedCommand, op)) {
@@ -6732,7 +6759,15 @@ function isCommandAllowed(command, securityConfig) {
       }
     }
   }
-  const baseCommand = extractBaseCommand(trimmedCommand);
+  const baseCommand = baseForShellCheck;
+  if (!baseCommand || baseCommand === trimmedCommand.trim()) {
+    if (baseCommand === "sudo" || baseCommand === "env" || baseCommand === "nohup" || baseCommand === "exec") {
+      return {
+        allowed: false,
+        reason: `Prefix "${baseCommand}" requires a target command`
+      };
+    }
+  }
   if (config.whitelist.length > 0) {
     if (!config.whitelist.includes(baseCommand)) {
       return {
@@ -8408,7 +8443,12 @@ function validatePlan(plan, config) {
   const warnings = [];
   const autoFixes = [];
   if (!plan.subtasks || plan.subtasks.length === 0) {
-    return { valid: false, errors: ["Plan has no subtasks"], warnings: [], autoFixes: [] };
+    return {
+      valid: false,
+      errors: ["Plan has no subtasks"],
+      warnings: [],
+      autoFixes: []
+    };
   }
   errors.push(...expertTagsExist(plan.subtasks, config));
   errors.push(...hasCycle(plan.subtasks));
@@ -8417,7 +8457,10 @@ function validatePlan(plan, config) {
   const readOverlaps = deleteReadOverlap(plan.subtasks);
   for (const overlap of readOverlaps) {
     if (overlap.canAutoFix) {
-      autoFixes.push({ subtaskId: overlap.subtaskId, fix: `Add depends_on: ${overlap.dependsOn}` });
+      autoFixes.push({
+        subtaskId: overlap.subtaskId,
+        fix: `Add depends_on: ${overlap.dependsOn}`
+      });
     } else if (overlap.error) {
       errors.push(overlap.error);
     }
@@ -8463,7 +8506,6 @@ function hasCycle(subtasks) {
   }
   const errors = [];
   for (const s of subtasks) {
-    visited.clear();
     inStack.clear();
     if (dfs(s.id)) {
       errors.push(`Cycle detected involving subtask "${s.id}"`);
@@ -8721,13 +8763,26 @@ class MoEExecutor {
   constructor(deps) {
     this.deps = deps;
   }
-  async executePlan(plan) {
+  async executePlan(plan, signal) {
     const results = [];
     const errors = [];
     const warnings = [];
+    if (signal?.aborted) {
+      return {
+        success: false,
+        results: [],
+        errors: ["Execution aborted before start"],
+        warnings: []
+      };
+    }
     const waves = topologicalSort(plan.subtasks);
     if (waves.length === 0) {
-      return { success: false, results: [], errors: ["Failed to topologically sort subtasks (possible cycle)"], warnings: [] };
+      return {
+        success: false,
+        results: [],
+        errors: ["Failed to topologically sort subtasks (possible cycle)"],
+        warnings: []
+      };
     }
     const sortedCount = waves.flat().length;
     if (sortedCount < plan.subtasks.length) {
@@ -8735,11 +8790,17 @@ class MoEExecutor {
       return {
         success: false,
         results: [],
-        errors: [`Missing subtasks after topological sort: ${missing.join(", ")} (dangling or invalid depends_on)`],
+        errors: [
+          `Missing subtasks after topological sort: ${missing.join(", ")} (dangling or invalid depends_on)`
+        ],
         warnings: []
       };
     }
     for (let waveIdx = 0;waveIdx < waves.length; waveIdx++) {
+      if (signal?.aborted) {
+        warnings.push(`Execution aborted during wave ${waveIdx + 1}/${waves.length}`);
+        break;
+      }
       const wave = waves[waveIdx];
       const wavePromises = wave.map((subtask) => executeSubtask(subtask, this.deps, plan.shared_context).then((result) => {
         results.push(result);
@@ -8939,7 +9000,12 @@ var init_verifier = __esm(() => {
 // src/core/agent-moe.ts
 async function runWithMoE(deps, input, fallback, opts = {}) {
   const { config, llmProvider, logger, toolExecutor, baseDir } = deps;
-  const { onMeta, onPhase } = opts;
+  const { onMeta, onPhase, signal } = opts;
+  const abortCheck = () => {
+    if (signal?.aborted)
+      return true;
+    return false;
+  };
   const orchestrator = new OrchestratorClient({
     model: config.orchestrator.model,
     provider: config.orchestrator.provider
@@ -8985,7 +9051,7 @@ async function runWithMoE(deps, input, fallback, opts = {}) {
   const executor = new MoEExecutor(moeDeps);
   onMeta?.(`⚙️ Executing ${plan.subtasks.length} subtasks...
 `);
-  const planResults = await executor.executePlan(plan);
+  const planResults = await executor.executePlan(plan, signal);
   onMeta?.(`✅ Execution complete: ${planResults.results.filter((r) => r.success).length}/${planResults.results.length} succeeded
 `);
   const verifier = new StepVerifier(baseDir);
@@ -9196,10 +9262,6 @@ class Agent {
     const systemBudget = Math.floor(this.deps.config.contextWindow * this.deps.config.contextBudget.systemPrompt);
     const builder = new PromptBuilder(systemBudget);
     builder.addBlocks(this.deps.promptBlocks);
-    const dynamic = this.deps.getDynamicPromptBlocks?.() ?? [];
-    if (dynamic.length > 0) {
-      builder.addBlocks(dynamic);
-    }
     const pluginBlocks = (this.deps.pluginManager.runOnBuildPrompt?.() ?? []).filter((s) => Boolean(s && s.trim() !== "")).map((content) => ({
       content,
       priority: "low",
@@ -9209,6 +9271,10 @@ class Agent {
     if (pluginBlocks.length > 0) {
       builder.addBlocks(pluginBlocks);
     }
+    const dynamic = this.deps.getDynamicPromptBlocks?.() ?? [];
+    if (dynamic.length > 0) {
+      builder.addBlocks(dynamic);
+    }
     return builder.build();
   }
   getSystemPromptInfo() {
@@ -9279,7 +9345,7 @@ ${t("tool.truncated", { tokens: Math.ceil(removedChars / 2) })}`;
         toolExecutor,
         logger,
         baseDir: this.deps.baseDir
-      }, input, () => this.executeSingleAgentLoop(input, onChunk, onMeta, onTool, onPhase), { onMeta, onTool, onPhase });
+      }, input, () => this.executeSingleAgentLoop(input, onChunk, onMeta, onTool, onPhase), { onMeta, onTool, onPhase, signal: this.abortController?.signal });
     }
     return this.executeSingleAgentLoop(input, onChunk, onMeta, onTool, onPhase);
   }
@@ -9449,15 +9515,7 @@ ${t("tool.truncated", { tokens: Math.ceil(removedChars / 2) })}`;
           onTool?.({ type: "start", tool: call.name, args: call.arguments });
           slog.logToolCall(call, iteration);
           const tokensBeforeTool = contextManager.getEstimatedTokens();
-          const toolCtx = this.deps.toolExecutor?.getContext?.();
-          const prevOnMeta = toolCtx?.onMeta;
-          if (toolCtx) {
-            toolCtx.onMeta = onMeta;
-          }
           const result = await toolExecutor.execute(call, this.abortController?.signal);
-          if (toolCtx) {
-            toolCtx.onMeta = prevOnMeta;
-          }
           const duration = Date.now() - startTime;
           pluginManager.runOnToolEnd({ iteration, logger }, { id: call.id, name: call.name, arguments: call.arguments }, result, duration);
           return { call, result, duration, tokensBefore: tokensBeforeTool };
@@ -9510,11 +9568,12 @@ ${t("tool.truncated", { tokens: Math.ceil(removedChars / 2) })}`;
           if (config.session.autoSave) {
             slog.logToolResult(call, result, duration, iteration);
           }
-          if (contextManager.needsCompaction()) {
-            contextManager.compact();
-            logger.debug("Context compacted after tool result");
-          }
         };
+        const toolExecutorForMeta = this.deps.toolExecutor;
+        const savedOnMeta = toolExecutorForMeta?.getContext?.()?.onMeta;
+        if (toolExecutorForMeta?.setOnMeta) {
+          toolExecutorForMeta.setOnMeta(onMeta);
+        }
         if (canRunInParallel(toolCalls)) {
           const entries = await Promise.all(toolCalls.map(executeToolCall));
           for (const entry of entries) {
@@ -9526,6 +9585,13 @@ ${t("tool.truncated", { tokens: Math.ceil(removedChars / 2) })}`;
             processToolResult(entry);
           }
         }
+        if (toolExecutorForMeta?.setOnMeta) {
+          toolExecutorForMeta.setOnMeta(savedOnMeta);
+        }
+        if (contextManager.needsCompaction()) {
+          contextManager.compact();
+          logger.debug("Context compacted after tool results");
+        }
         if (anyToolFailed) {
           consecutiveToolFailures++;
         } else {
@@ -10454,8 +10520,7 @@ var init_subagent = __esm(() => {
           baseDir: ctx.baseDir,
           scope,
           toolTags,
-          promptBlocks: [systemPrompt],
-          recursionDepth: currentDepth + 1
+          promptBlocks: [systemPrompt]
         };
         const subAgent = new Agent(subDeps);
         const fullTask = context ? `${task}
@@ -25728,6 +25793,7 @@ init_colors();
 init_colors();
 init_i18n();
 init_table();
+init_string_width();
 var KW = /\b(import|export|from|const|let|var|function|return|if|else|for|while|do|switch|case|break|continue|new|class|extends|implements|interface|type|enum|namespace|module|declare|abstract|async|await|yield|throw|try|catch|finally|typeof|instanceof|in|of|as|is|keyof|readonly|static|private|public|protected|get|set|constructor|this|super|void|never|any|unknown|boolean|string|number|symbol|object|true|false|null|undefined|default)\b/g;
 var STRING = /('[^']*'|"[^"]*"|`[^`]*`)/g;
 var COMMENT = /(\/\/[^\n]*|\/\*[\s\S]*?\*\/|#[^\n]*)/g;
@@ -25776,9 +25842,13 @@ class FormattingStream {
   tableBuffer = [];
   onWrite;
   width;
-  constructor(onWrite, width) {
+  streaming;
+  partialEmitted = false;
+  lastPartial = "";
+  constructor(onWrite, width, streaming = false) {
     this.onWrite = onWrite;
     this.width = width ?? getTerminalWidth();
+    this.streaming = streaming;
   }
   write(chunk) {
     this.buffer += chunk;
@@ -25787,10 +25857,13 @@ class FormattingStream {
 `)) !== -1) {
       const line = this.buffer.slice(0, idx);
       this.buffer = this.buffer.slice(idx + 1);
+      this.clearPartial();
       this.processLine(line);
     }
+    this.emitPartial(this.buffer);
   }
   flush() {
+    this.clearPartial();
     if (this.inCodeBlock && this.codeLines.length > 0) {
       this.emitCodeBlock();
     }
@@ -25806,8 +25879,39 @@ class FormattingStream {
         }
         return;
       }
-      this.onWrite(this.formatLine(line));
+      this.emitLine(this.formatLine(line));
+    }
+  }
+  emitLine(text) {
+    this.onWrite(text, true);
+  }
+  emitRaw(text) {
+    this.onWrite(text, false);
+  }
+  clearPartial() {
+    if (!this.streaming || !this.partialEmitted)
+      return;
+    const rows = Math.max(1, Math.ceil(stringWidth(this.lastPartial) / Math.max(1, this.width)));
+    for (let i = 0;i < rows; i++) {
+      this.emitRaw("\x1B[2K");
+      if (i < rows - 1)
+        this.emitRaw("\x1B[1A");
+    }
+    this.emitRaw("\r");
+    this.lastPartial = "";
+    this.partialEmitted = false;
+  }
+  emitPartial(text) {
+    if (!this.streaming || !text)
+      return;
+    if (this.inCodeBlock || this.tableBuffer.length > 0) {
+      this.clearPartial();
+      return;
     }
+    this.clearPartial();
+    this.emitRaw(text);
+    this.lastPartial = text;
+    this.partialEmitted = true;
   }
   processLine(line) {
     if (line.trim() === "```" || line.trim().startsWith("```")) {
@@ -25831,7 +25935,7 @@ class FormattingStream {
     if (this.tableBuffer.length > 0) {
       this.flushTable();
     }
-    this.onWrite(this.formatLine(line));
+    this.emitLine(this.formatLine(line));
   }
   flushTable() {
     const lines = this.tableBuffer;
@@ -25839,11 +25943,11 @@ class FormattingStream {
     const hasSeparator = lines.length >= 2 && /^\s*\|?[\s:|-]+\|?\s*$/.test(lines[1].trim());
     if (hasSeparator) {
       for (const l of formatTable(lines, { maxWidth: this.width })) {
-        this.onWrite(l);
+        this.emitLine(l);
       }
     } else {
       for (const l of lines) {
-        this.onWrite(this.formatLine(l));
+        this.emitLine(this.formatLine(l));
       }
     }
   }
@@ -25855,12 +25959,12 @@ class FormattingStream {
       const highlighted = highlight(code, this.codeLang);
       const lang = this.codeLang ? ` ${this.codeLang} ` : " ";
       const top = pc.dim(`┌─${lang}${"─".repeat(Math.max(0, this.width - 3 - lang.length))}┐`);
-      this.onWrite(top);
+      this.emitLine(top);
       for (const l of highlighted.split(`
 `)) {
-        this.onWrite(pc.dim("│ ") + l);
+        this.emitLine(pc.dim("│ ") + l);
       }
-      this.onWrite(pc.dim(`└${"─".repeat(Math.max(0, this.width - 1))}┘`));
+      this.emitLine(pc.dim(`└${"─".repeat(Math.max(0, this.width - 1))}┘`));
     }
     this.codeLines = [];
     this.codeLang = "";
@@ -25972,8 +26076,8 @@ class Renderer {
       stream: this.err,
       width: this.width
     });
-    this.fmt = new FormattingStream((line) => this.out.write(`${line}
-`), this.width);
+    this.fmt = new FormattingStream((line, eol) => this.out.write(eol ? `${line}
+` : line), this.width, this.rich);
   }
   text(chunk) {
     this.endCard();
@@ -25982,6 +26086,7 @@ class Renderer {
   }
   meta(chunk) {
     this.spinner.stop();
+    this.fmt.clearPartial();
     if (this.card) {
       this.card.body.push(chunk);
     } else {
@@ -25990,6 +26095,7 @@ class Renderer {
   }
   reasoning(chunk) {
     this.spinner.stop();
+    this.fmt.clearPartial();
     this.out.write(pc.dim(chunk));
   }
   thinkingStart() {
@@ -26001,6 +26107,7 @@ class Renderer {
   toolStart(tool, args) {
     this.endCard();
     this.spinner.stop();
+    this.fmt.clearPartial();
     const summary = summarizeArgs2(args);
     if (!this.rich) {
       this.out.write(`
@@ -26052,11 +26159,13 @@ ${pc.dim("⚙")} ${friendlyTool(tool)}${summary ? ` ${pc.dim(summary)}` : ""}
   raw(text) {
     this.endCard();
     this.spinner.stop();
+    this.fmt.clearPartial();
     this.out.write(text);
   }
   error(text) {
     this.endCard();
     this.spinner.stop();
+    this.fmt.clearPartial();
     this.err.write(`${pc.red(text)}
 `);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "micro-models-agent",
-  "version": "0.24.10",
+  "version": "0.24.12",
   "description": "Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)",
   "type": "module",
   "bin": {