micro-models-agent 0.24.11 → 0.24.12

package/dist/main.js

@@ -3810,10 +3810,6 @@ var init_data_sanitizer = __esm(() => {
     {
       pattern: /Bearer\s+[a-zA-Z0-9_-]{20,}/gi,
       replacement: "Bearer [REDACTED]"
-    },
-    {
-      pattern: /\b([a-zA-Z0-9_-]{30,})\b/g,
-      replacement: "[REDACTED]"
     }
   ];
 });
@@ -5012,6 +5008,14 @@ class ToolResultCache {
   has(key) {
     return this.get(key) !== undefined;
   }
+  cleanExpired() {
+    const now = Date.now();
+    for (const [key, entry] of this.cache) {
+      if (now > entry.expiresAt) {
+        this.cache.delete(key);
+      }
+    }
+  }
   clear() {
     this.cache.clear();
   }
@@ -5132,6 +5136,7 @@ class ToolExecutor {
       this.cache.set(key, result.output);
       this.ctx.logger.debug(`Tool ${call.name}: CACHED`);
     }
+    this.cache.cleanExpired();
     this.ctx.logger.debug(`Tool ${call.name}: ${result.success ? "OK" : "FAIL"}`);
     return result;
   }
@@ -5147,6 +5152,9 @@ class ToolExecutor {
   setScope(scope) {
     this.ctx.scope = scope;
   }
+  setOnMeta(onMeta) {
+    this.ctx.onMeta = onMeta;
+  }
   updateProvider(provider) {
     this.ctx.llmProvider = provider;
   }
@@ -6260,7 +6268,8 @@ var init_edit_file = __esm(() => {
           output: t("file.string_not_found", { str: oldStr })
         };
       }
-      const updated = content.replace(oldStr, newStr);
+      const occurrences = content.split(oldStr).length - 1;
+      const updated = occurrences > 1 ? content.replaceAll(oldStr, newStr) : content.replace(oldStr, newStr);
       const scanResult = scanContent(updated, path, ctx.config.security?.contentScan);
       if (!scanResult.allowed) {
         logSecurityBlock(ctx.sessionId, "file_write", scanResult.reason || "Content contains dangerous patterns", path);
@@ -6667,6 +6676,12 @@ var init_file_info = __esm(() => {
 });
 
 // src/modules/security/command-validator.ts
+function hasShellIndirection(command) {
+  return /\$\{[^}]+\}/.test(command) || /\$\(/.test(command) || /`[^`]+`/.test(command) || /\$\(\(/.test(command) || /\$\{[!]/.test(command);
+}
+function hasEvalConstruct(command) {
+  return /\beval\b/.test(command) || /\bsource\b/.test(command);
+}
 function extractBaseCommand(trimmed) {
   const tokens = trimmed.split(/\s+/);
   let i = 0;
@@ -6722,6 +6737,18 @@ function isCommandAllowed(command, securityConfig) {
       reason: `Shell wrapper "${baseForShellCheck}" is blocked — use the bash tool directly`
     };
   }
+  if (hasShellIndirection(trimmedCommand)) {
+    return {
+      allowed: false,
+      reason: `Shell indirection (variable expansion, command substitution, or backtick execution) is not allowed`
+    };
+  }
+  if (hasEvalConstruct(trimmedCommand)) {
+    return {
+      allowed: false,
+      reason: `eval/source constructs are not allowed`
+    };
+  }
   if (config.blockDangerousFlags) {
     for (const op of config.dangerousOperators || []) {
       if (containsOperator(trimmedCommand, op)) {
@@ -6732,7 +6759,15 @@ function isCommandAllowed(command, securityConfig) {
       }
     }
   }
-  const baseCommand = extractBaseCommand(trimmedCommand);
+  const baseCommand = baseForShellCheck;
+  if (!baseCommand || baseCommand === trimmedCommand.trim()) {
+    if (baseCommand === "sudo" || baseCommand === "env" || baseCommand === "nohup" || baseCommand === "exec") {
+      return {
+        allowed: false,
+        reason: `Prefix "${baseCommand}" requires a target command`
+      };
+    }
+  }
   if (config.whitelist.length > 0) {
     if (!config.whitelist.includes(baseCommand)) {
       return {
@@ -8408,7 +8443,12 @@ function validatePlan(plan, config) {
   const warnings = [];
   const autoFixes = [];
   if (!plan.subtasks || plan.subtasks.length === 0) {
-    return { valid: false, errors: ["Plan has no subtasks"], warnings: [], autoFixes: [] };
+    return {
+      valid: false,
+      errors: ["Plan has no subtasks"],
+      warnings: [],
+      autoFixes: []
+    };
   }
   errors.push(...expertTagsExist(plan.subtasks, config));
   errors.push(...hasCycle(plan.subtasks));
@@ -8417,7 +8457,10 @@ function validatePlan(plan, config) {
   const readOverlaps = deleteReadOverlap(plan.subtasks);
   for (const overlap of readOverlaps) {
     if (overlap.canAutoFix) {
-      autoFixes.push({ subtaskId: overlap.subtaskId, fix: `Add depends_on: ${overlap.dependsOn}` });
+      autoFixes.push({
+        subtaskId: overlap.subtaskId,
+        fix: `Add depends_on: ${overlap.dependsOn}`
+      });
     } else if (overlap.error) {
       errors.push(overlap.error);
     }
@@ -8463,7 +8506,6 @@ function hasCycle(subtasks) {
   }
   const errors = [];
   for (const s of subtasks) {
-    visited.clear();
     inStack.clear();
     if (dfs(s.id)) {
       errors.push(`Cycle detected involving subtask "${s.id}"`);
@@ -8721,13 +8763,26 @@ class MoEExecutor {
   constructor(deps) {
     this.deps = deps;
   }
-  async executePlan(plan) {
+  async executePlan(plan, signal) {
     const results = [];
     const errors = [];
     const warnings = [];
+    if (signal?.aborted) {
+      return {
+        success: false,
+        results: [],
+        errors: ["Execution aborted before start"],
+        warnings: []
+      };
+    }
     const waves = topologicalSort(plan.subtasks);
     if (waves.length === 0) {
-      return { success: false, results: [], errors: ["Failed to topologically sort subtasks (possible cycle)"], warnings: [] };
+      return {
+        success: false,
+        results: [],
+        errors: ["Failed to topologically sort subtasks (possible cycle)"],
+        warnings: []
+      };
     }
     const sortedCount = waves.flat().length;
     if (sortedCount < plan.subtasks.length) {
@@ -8735,11 +8790,17 @@ class MoEExecutor {
       return {
         success: false,
         results: [],
-        errors: [`Missing subtasks after topological sort: ${missing.join(", ")} (dangling or invalid depends_on)`],
+        errors: [
+          `Missing subtasks after topological sort: ${missing.join(", ")} (dangling or invalid depends_on)`
+        ],
         warnings: []
       };
     }
     for (let waveIdx = 0;waveIdx < waves.length; waveIdx++) {
+      if (signal?.aborted) {
+        warnings.push(`Execution aborted during wave ${waveIdx + 1}/${waves.length}`);
+        break;
+      }
       const wave = waves[waveIdx];
       const wavePromises = wave.map((subtask) => executeSubtask(subtask, this.deps, plan.shared_context).then((result) => {
         results.push(result);
@@ -8939,7 +9000,12 @@ var init_verifier = __esm(() => {
 // src/core/agent-moe.ts
 async function runWithMoE(deps, input, fallback, opts = {}) {
   const { config, llmProvider, logger, toolExecutor, baseDir } = deps;
-  const { onMeta, onPhase } = opts;
+  const { onMeta, onPhase, signal } = opts;
+  const abortCheck = () => {
+    if (signal?.aborted)
+      return true;
+    return false;
+  };
   const orchestrator = new OrchestratorClient({
     model: config.orchestrator.model,
     provider: config.orchestrator.provider
@@ -8985,7 +9051,7 @@ async function runWithMoE(deps, input, fallback, opts = {}) {
   const executor = new MoEExecutor(moeDeps);
   onMeta?.(`⚙️ Executing ${plan.subtasks.length} subtasks...
 `);
-  const planResults = await executor.executePlan(plan);
+  const planResults = await executor.executePlan(plan, signal);
   onMeta?.(`✅ Execution complete: ${planResults.results.filter((r) => r.success).length}/${planResults.results.length} succeeded
 `);
   const verifier = new StepVerifier(baseDir);
@@ -9196,10 +9262,6 @@ class Agent {
     const systemBudget = Math.floor(this.deps.config.contextWindow * this.deps.config.contextBudget.systemPrompt);
     const builder = new PromptBuilder(systemBudget);
     builder.addBlocks(this.deps.promptBlocks);
-    const dynamic = this.deps.getDynamicPromptBlocks?.() ?? [];
-    if (dynamic.length > 0) {
-      builder.addBlocks(dynamic);
-    }
     const pluginBlocks = (this.deps.pluginManager.runOnBuildPrompt?.() ?? []).filter((s) => Boolean(s && s.trim() !== "")).map((content) => ({
       content,
       priority: "low",
@@ -9209,6 +9271,10 @@ class Agent {
     if (pluginBlocks.length > 0) {
       builder.addBlocks(pluginBlocks);
     }
+    const dynamic = this.deps.getDynamicPromptBlocks?.() ?? [];
+    if (dynamic.length > 0) {
+      builder.addBlocks(dynamic);
+    }
     return builder.build();
   }
   getSystemPromptInfo() {
@@ -9279,7 +9345,7 @@ ${t("tool.truncated", { tokens: Math.ceil(removedChars / 2) })}`;
         toolExecutor,
         logger,
         baseDir: this.deps.baseDir
-      }, input, () => this.executeSingleAgentLoop(input, onChunk, onMeta, onTool, onPhase), { onMeta, onTool, onPhase });
+      }, input, () => this.executeSingleAgentLoop(input, onChunk, onMeta, onTool, onPhase), { onMeta, onTool, onPhase, signal: this.abortController?.signal });
     }
     return this.executeSingleAgentLoop(input, onChunk, onMeta, onTool, onPhase);
   }
@@ -9449,15 +9515,7 @@ ${t("tool.truncated", { tokens: Math.ceil(removedChars / 2) })}`;
           onTool?.({ type: "start", tool: call.name, args: call.arguments });
           slog.logToolCall(call, iteration);
           const tokensBeforeTool = contextManager.getEstimatedTokens();
-          const toolCtx = this.deps.toolExecutor?.getContext?.();
-          const prevOnMeta = toolCtx?.onMeta;
-          if (toolCtx) {
-            toolCtx.onMeta = onMeta;
-          }
           const result = await toolExecutor.execute(call, this.abortController?.signal);
-          if (toolCtx) {
-            toolCtx.onMeta = prevOnMeta;
-          }
           const duration = Date.now() - startTime;
           pluginManager.runOnToolEnd({ iteration, logger }, { id: call.id, name: call.name, arguments: call.arguments }, result, duration);
           return { call, result, duration, tokensBefore: tokensBeforeTool };
@@ -9510,11 +9568,12 @@ ${t("tool.truncated", { tokens: Math.ceil(removedChars / 2) })}`;
           if (config.session.autoSave) {
             slog.logToolResult(call, result, duration, iteration);
           }
-          if (contextManager.needsCompaction()) {
-            contextManager.compact();
-            logger.debug("Context compacted after tool result");
-          }
         };
+        const toolExecutorForMeta = this.deps.toolExecutor;
+        const savedOnMeta = toolExecutorForMeta?.getContext?.()?.onMeta;
+        if (toolExecutorForMeta?.setOnMeta) {
+          toolExecutorForMeta.setOnMeta(onMeta);
+        }
         if (canRunInParallel(toolCalls)) {
           const entries = await Promise.all(toolCalls.map(executeToolCall));
           for (const entry of entries) {
@@ -9526,6 +9585,13 @@ ${t("tool.truncated", { tokens: Math.ceil(removedChars / 2) })}`;
             processToolResult(entry);
           }
         }
+        if (toolExecutorForMeta?.setOnMeta) {
+          toolExecutorForMeta.setOnMeta(savedOnMeta);
+        }
+        if (contextManager.needsCompaction()) {
+          contextManager.compact();
+          logger.debug("Context compacted after tool results");
+        }
         if (anyToolFailed) {
           consecutiveToolFailures++;
         } else {
@@ -10454,8 +10520,7 @@ var init_subagent = __esm(() => {
           baseDir: ctx.baseDir,
           scope,
           toolTags,
-          promptBlocks: [systemPrompt],
-          recursionDepth: currentDepth + 1
+          promptBlocks: [systemPrompt]
         };
         const subAgent = new Agent(subDeps);
         const fullTask = context ? `${task}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "micro-models-agent",
-  "version": "0.24.11",
+  "version": "0.24.12",
   "description": "Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)",
   "type": "module",
   "bin": {