micro-models-agent 0.28.17 → 0.29.0

package/dist/modules/security/security-policies.js

@@ -1,134 +1,46 @@
-import { mergeSecurityConfig, } from "../../config/security";
+import { mergeSecurityConfig } from '../../config/security';
 /**
  * Strict security policy - maximum security, minimum flexibility
  * Recommended for: production environments, sensitive data, multi-user systems
  */
 export const STRICT_POLICY = {
-    name: "Strict",
-    description: "Maximum security with minimal flexibility. Blocks most dangerous operations.",
-    preset: "strict",
-    recommendedFor: ["production", "sensitive-data", "multi-user", "enterprise"],
+    name: 'Strict',
+    description: 'Maximum security with minimal flexibility. Blocks most dangerous operations.',
+    preset: 'strict',
+    recommendedFor: ['production', 'sensitive-data', 'multi-user', 'enterprise'],
     config: {
-        enabled: true,
         bash: {
-            enabled: true,
             blacklist: [
-                "rm",
-                "dd",
-                "chmod",
-                "wget",
-                "curl",
-                "scp",
-                "ssh",
-                "nc",
-                "netcat",
-                "mknod",
-                "mkfifo",
-                "ln",
-                "chown",
-                "chgrp",
-                "useradd",
-                "usermod",
-                "passwd",
-                "sudo",
-                "su",
-                "exec",
-                "eval",
-                "source",
-                "kill",
-                "pkill",
-                "killall",
-                "shutdown",
-                "reboot",
-                "halt",
-                "poweroff",
-                "format",
-                "fdisk",
-                "parted",
-                "mkfs",
-                "mount",
-                "umount",
-                "mv",
-                "cp",
+                'rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat',
+                'mknod', 'mkfifo', 'ln', 'chown', 'chgrp', 'useradd', 'usermod',
+                'passwd', 'sudo', 'su', 'exec', 'eval', 'source', 'kill', 'pkill',
+                'killall', 'shutdown', 'reboot', 'halt', 'poweroff', 'format',
+                'fdisk', 'parted', 'mkfs', 'mount', 'umount', 'mv', 'cp',
             ],
-            whitelist: ["ls", "cat", "echo", "grep", "find", "pwd", "whoami", "date"],
+            whitelist: ['ls', 'cat', 'echo', 'grep', 'find', 'pwd', 'whoami', 'date'],
             blockDangerousFlags: true,
             dangerousFlags: [
-                "--force",
-                "-rf",
-                "--no-preserve-root",
-                "--recursive",
-                "--all",
-                "-x",
-                "-e",
-                "--delete",
-                "--remove",
-                "--dangerous",
-                "--yes",
-                "-y",
-                "--no-confirm",
-                "-R",
-                "--no-clobber",
-            ],
-            dangerousOperators: [
-                ">",
-                ">>",
-                "2>",
-                "2>>",
-                "|",
-                "&&",
-                "||",
-                ";",
-                "&",
-                "`",
+                '--force', '-rf', '--no-preserve-root', '--recursive', '--all',
+                '-x', '-e', '--delete', '--remove', '--dangerous', '--yes', '-y',
+                '--no-confirm', '-R', '--no-clobber',
             ],
+            dangerousOperators: ['>', '>>', '2>', '2>>', '|', '&&', '||', ';', '&', '`'],
             logCommands: true,
         },
         paths: {
-            enabled: true,
             denied: [
-                ".git/",
-                "node_modules/",
-                ".env",
-                "*.key",
-                "*.pem",
-                "*.crt",
-                "*.p12",
-                "*.pfx",
-                "*.secret",
-                "*.token",
-                "package-lock.json",
-                "bun.lock",
-                "yarn.lock",
-                "pnpm-lock.yaml",
-                ".ssh/",
-                ".config/",
-                ".bashrc",
-                ".bash_profile",
-                ".zshrc",
-                ".profile",
-                "/etc/",
-                "/usr/",
-                "/var/",
-                "/bin/",
-                "/sbin/",
-                "/root/",
-                "/home/",
+                '.git/', 'node_modules/', '.env', '*.key', '*.pem', '*.crt',
+                '*.p12', '*.pfx', '*.secret', '*.token', 'package-lock.json',
+                'bun.lock', 'yarn.lock', 'pnpm-lock.yaml', '.ssh/', '.config/',
+                '.bashrc', '.bash_profile', '.zshrc', '.profile', '/etc/',
+                '/usr/', '/var/', '/bin/', '/sbin/', '/root/', '/home/',
             ],
             allowed: [],
         },
         network: {
-            enabled: true,
             deniedDomains: [
-                "localhost",
-                "127.0.0.1",
-                "0.0.0.0",
-                "::1",
-                "*.internal",
-                "*.local",
-                "192.168.*",
-                "10.*",
-                "172.16.*",
+                'localhost', '127.0.0.1', '0.0.0.0', '::1',
+                '*.internal', '*.local', '192.168.*', '10.*', '172.16.*',
             ],
             allowedDomains: [],
             requestTimeout: 10000,
@@ -169,16 +81,11 @@ export const STRICT_POLICY = {
         },
         auditNotifier: {
             enabled: true,
-            minSeverity: "low",
+            minSeverity: 'low',
             eventTypes: [
-                "security_block",
-                "bash_command",
-                "file_operation",
-                "network_request",
-                "authentication",
-                "configuration_change",
-                "session_start",
-                "session_end",
+                'security_block', 'bash_command', 'file_operation',
+                'network_request', 'authentication', 'configuration_change',
+                'session_start', 'session_end',
             ],
             maxRetries: 3,
         },
@@ -189,81 +96,37 @@ export const STRICT_POLICY = {
  * Recommended for: development, single-user systems, general use
  */
 export const BALANCED_POLICY = {
-    name: "Balanced",
-    description: "Good security with reasonable flexibility. Default policy.",
-    preset: "balanced",
-    recommendedFor: ["development", "single-user", "general-use", "testing"],
+    name: 'Balanced',
+    description: 'Good security with reasonable flexibility. Default policy.',
+    preset: 'balanced',
+    recommendedFor: ['development', 'single-user', 'general-use', 'testing'],
     config: {
-        enabled: true,
         bash: {
-            enabled: true,
             blacklist: [
-                "rm",
-                "dd",
-                "chmod",
-                "wget",
-                "curl",
-                "scp",
-                "ssh",
-                "nc",
-                "netcat",
-                "mknod",
-                "mkfifo",
-                "useradd",
-                "usermod",
-                "passwd",
-                "sudo",
-                "su",
-                "shutdown",
-                "reboot",
-                "halt",
-                "poweroff",
-                "format",
-                "fdisk",
-                "parted",
-                "mkfs",
+                'rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat',
+                'mknod', 'mkfifo', 'useradd', 'usermod', 'passwd', 'sudo', 'su',
+                'shutdown', 'reboot', 'halt', 'poweroff', 'format',
+                'fdisk', 'parted', 'mkfs',
             ],
             whitelist: [],
             blockDangerousFlags: true,
             dangerousFlags: [
-                "--force",
-                "-rf",
-                "--no-preserve-root",
-                "--recursive",
-                "--all",
-                "--delete",
-                "--remove",
-                "--dangerous",
-                "--yes",
-                "-y",
-                "--no-confirm",
+                '--force', '-rf', '--no-preserve-root', '--recursive', '--all',
+                '--delete', '--remove', '--dangerous', '--yes', '-y',
+                '--no-confirm',
             ],
-            dangerousOperators: ["|", "&&", "||", ";", "&", "`"],
+            dangerousOperators: ['|', '&&', '||', ';', '&', '`'],
             logCommands: true,
         },
         paths: {
-            enabled: true,
             denied: [
-                ".git/",
-                "node_modules/",
-                ".env",
-                "*.key",
-                "*.pem",
-                "*.crt",
-                "*.p12",
-                "*.pfx",
-                "*.secret",
-                "*.token",
-                "package-lock.json",
-                "bun.lock",
-                "yarn.lock",
-                "pnpm-lock.yaml",
-                ".ssh/",
+                '.git/', 'node_modules/', '.env', '*.key', '*.pem', '*.crt',
+                '*.p12', '*.pfx', '*.secret', '*.token', 'package-lock.json',
+                'bun.lock', 'yarn.lock', 'pnpm-lock.yaml', '.ssh/',
             ],
             allowed: [],
         },
         network: {
-            enabled: true,
             deniedDomains: [],
             allowedDomains: [],
             requestTimeout: 15000,
@@ -298,13 +161,8 @@ export const BALANCED_POLICY = {
         },
         auditNotifier: {
             enabled: false,
-            minSeverity: "medium",
-            eventTypes: [
-                "security_block",
-                "bash_command",
-                "file_operation",
-                "network_request",
-            ],
+            minSeverity: 'medium',
+            eventTypes: ['security_block', 'bash_command', 'file_operation', 'network_request'],
             maxRetries: 3,
         },
     },
@@ -314,39 +172,27 @@ export const BALANCED_POLICY = {
  * Recommended for: trusted environments, local development, testing
  */
 export const PERMISSIVE_POLICY = {
-    name: "Permissive",
-    description: "Minimal security with maximum flexibility. Use with caution.",
-    preset: "permissive",
-    recommendedFor: ["trusted-environment", "local-dev", "testing", "sandbox"],
+    name: 'Permissive',
+    description: 'Minimal security with maximum flexibility. Use with caution.',
+    preset: 'permissive',
+    recommendedFor: ['trusted-environment', 'local-dev', 'testing', 'sandbox'],
     config: {
-        enabled: true,
         bash: {
-            enabled: true,
             blacklist: [
-                "rm",
-                "dd",
-                "shutdown",
-                "reboot",
-                "halt",
-                "poweroff",
-                "format",
-                "fdisk",
-                "parted",
-                "mkfs",
+                'rm', 'dd', 'shutdown', 'reboot', 'halt', 'poweroff',
+                'format', 'fdisk', 'parted', 'mkfs',
             ],
             whitelist: [],
             blockDangerousFlags: false,
-            dangerousFlags: ["--force", "-rf", "--no-preserve-root"],
+            dangerousFlags: ['--force', '-rf', '--no-preserve-root'],
             dangerousOperators: [],
             logCommands: true,
         },
         paths: {
-            enabled: true,
-            denied: [".env", "*.key", "*.pem", "*.crt", "*.p12", "*.pfx"],
+            denied: ['.env', '*.key', '*.pem', '*.crt', '*.p12', '*.pfx'],
             allowed: [],
         },
         network: {
-            enabled: true,
             deniedDomains: [],
             allowedDomains: [],
             requestTimeout: 30000,
@@ -376,8 +222,8 @@ export const PERMISSIVE_POLICY = {
         },
         auditNotifier: {
             enabled: false,
-            minSeverity: "high",
-            eventTypes: ["security_block"],
+            minSeverity: 'high',
+            eventTypes: ['security_block'],
             maxRetries: 2,
         },
     },
@@ -390,9 +236,9 @@ export const SECURITY_POLICIES = {
     balanced: BALANCED_POLICY,
     permissive: PERMISSIVE_POLICY,
     custom: {
-        name: "Custom",
-        description: "Custom security configuration",
-        preset: "custom",
+        name: 'Custom',
+        description: 'Custom security configuration',
+        preset: 'custom',
         recommendedFor: [],
         config: {},
     },
@@ -401,7 +247,7 @@ export const SECURITY_POLICIES = {
  * Security policy manager
  */
 export class SecurityPolicyManager {
-    currentPolicy = "balanced";
+    currentPolicy = 'balanced';
     customConfig = {};
     /**
      * Get all available policies
@@ -419,7 +265,7 @@ export class SecurityPolicyManager {
      * Get the current policy
      */
     getCurrentPolicy() {
-        if (this.currentPolicy === "custom") {
+        if (this.currentPolicy === 'custom') {
             return {
                 ...SECURITY_POLICIES.custom,
                 config: this.customConfig,
@@ -438,7 +284,7 @@ export class SecurityPolicyManager {
      */
     setCustomConfig(config) {
         this.customConfig = config;
-        this.currentPolicy = "custom";
+        this.currentPolicy = 'custom';
     }
     /**
      * Get the current security configuration
@@ -447,7 +293,7 @@ export class SecurityPolicyManager {
         const policy = this.getCurrentPolicy();
         return mergeSecurityConfig({
             ...policy.config,
-            ...(this.currentPolicy === "custom" ? this.customConfig : {}),
+            ...(this.currentPolicy === 'custom' ? this.customConfig : {}),
         });
     }
     /**
@@ -457,7 +303,7 @@ export class SecurityPolicyManager {
         this.setPolicy(preset);
         if (customOverrides) {
             this.customConfig = customOverrides;
-            this.currentPolicy = "custom";
+            this.currentPolicy = 'custom';
         }
         return this.getConfig();
     }
@@ -478,25 +324,25 @@ export class SecurityPolicyManager {
     allowsAction(action, context) {
         const config = this.getConfig();
         switch (action) {
-            case "bash":
+            case 'bash':
                 if (context?.command) {
-                    const cmd = context.command.split(" ")[0];
+                    const cmd = context.command.split(' ')[0];
                     return !config.bash.blacklist.includes(cmd);
                 }
                 return true;
-            case "file_access":
+            case 'file_access':
                 if (context?.path) {
                     for (const denied of config.paths.denied) {
-                        if (context.path.includes(denied.replace("*", ""))) {
+                        if (context.path.includes(denied.replace('*', ''))) {
                             return false;
                         }
                     }
                 }
                 return true;
-            case "network":
+            case 'network':
                 if (context?.path) {
                     for (const denied of config.network.deniedDomains) {
-                        if (context.path.includes(denied.replace("*", ""))) {
+                        if (context.path.includes(denied.replace('*', ''))) {
                             return false;
                         }
                     }

package/dist/modules/security/session-encryption.js

@@ -1,7 +1,7 @@
-import { readFileSync, writeFileSync, existsSync, readdirSync, unlinkSync, } from "fs";
-import { join } from "path";
-import { homedir } from "os";
-import { encryptString, decryptString, isEncryptedString, ConfigEncryptor, } from "./encryption";
+import { readFileSync, writeFileSync, existsSync, readdirSync, unlinkSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { encryptString, decryptString, isEncryptedString, ConfigEncryptor, } from './encryption';
 /**
  * Default session encryption configuration
  */
@@ -19,7 +19,7 @@ export class SessionFileEncryptor {
     constructor(config) {
         this.config = { ...DEFAULT_SESSION_ENCRYPTION, ...config };
         this.encryptor = new ConfigEncryptor({
-            keyPath: config?.keyPath || join(homedir(), ".mma", ".session-encryption-key"),
+            keyPath: config?.keyPath || join(homedir(), '.mma', '.session-encryption-key')
         });
     }
     /**
@@ -58,16 +58,10 @@ export class SessionFileEncryptor {
      * Decrypt a JSON string
      */
     decryptJSON(content) {
-        let plain = content;
-        if (this.config.enabled) {
-            plain = this.decryptFileContent(content);
-        }
-        try {
-            return JSON.parse(plain);
-        }
-        catch {
-            throw new Error("Invalid JSON content in session file — file may be corrupted or encrypted with a different key");
-        }
+        if (!this.config.enabled)
+            return JSON.parse(content);
+        const decrypted = this.decryptFileContent(content);
+        return JSON.parse(decrypted);
     }
     /**
      * Encrypt a JSONL file (one JSON object per line)
@@ -75,7 +69,7 @@ export class SessionFileEncryptor {
     encryptJSONL(lines) {
         if (!this.config.enabled)
             return lines;
-        return lines.map((line) => this.encryptFileContent(line));
+        return lines.map(line => this.encryptFileContent(line));
     }
     /**
      * Decrypt a JSONL file
@@ -83,13 +77,13 @@ export class SessionFileEncryptor {
     decryptJSONL(lines) {
         if (!this.config.enabled)
             return lines;
-        return lines.map((line) => this.decryptFileContent(line));
+        return lines.map(line => this.decryptFileContent(line));
     }
     /**
      * Read and decrypt a session file
      */
     readSessionFile(filePath) {
-        const content = readFileSync(filePath, "utf8");
+        const content = readFileSync(filePath, 'utf8');
         return this.decryptFileContent(content);
     }
     /**
@@ -97,13 +91,13 @@ export class SessionFileEncryptor {
      */
     writeSessionFile(filePath, content) {
         const encrypted = this.encryptFileContent(content);
-        writeFileSync(filePath, encrypted, "utf8");
+        writeFileSync(filePath, encrypted, 'utf8');
     }
     /**
      * Read and decrypt a JSON session file
      */
     readSessionJSON(filePath) {
-        const content = readFileSync(filePath, "utf8");
+        const content = readFileSync(filePath, 'utf8');
         return this.decryptJSON(content);
     }
     /**
@@ -111,34 +105,23 @@ export class SessionFileEncryptor {
      */
     writeSessionJSON(filePath, obj) {
         const content = this.encryptJSON(obj);
-        writeFileSync(filePath, content, "utf8");
+        writeFileSync(filePath, content, 'utf8');
     }
     /**
      * Read and decrypt a JSONL session file
      */
     readSessionJSONL(filePath) {
-        const content = readFileSync(filePath, "utf8");
-        const lines = content.split("\n").filter((line) => line.trim());
+        const content = readFileSync(filePath, 'utf8');
+        const lines = content.split('\n').filter(line => line.trim());
         const decryptedLines = this.decryptJSONL(lines);
-        // Skip malformed lines instead of crashing the whole session log
-        return decryptedLines.flatMap((line) => {
-            try {
-                return [JSON.parse(line)];
-            }
-            catch {
-                return [];
-            }
-        });
+        return decryptedLines.map(line => JSON.parse(line));
     }
     /**
      * Append an encrypted entry to a JSONL file
      */
     appendToSessionJSONL(filePath, obj) {
         const encryptedLine = this.encryptFileContent(JSON.stringify(obj));
-        writeFileSync(filePath, encryptedLine + "\n", {
-            flag: "a",
-            encoding: "utf8",
-        });
+        writeFileSync(filePath, encryptedLine + '\n', { flag: 'a', encoding: 'utf8' });
     }
     /**
      * Encrypt all session files in a directory
@@ -149,11 +132,11 @@ export class SessionFileEncryptor {
         const files = readdirSync(sessionDir);
         for (const file of files) {
             const filePath = join(sessionDir, file);
-            if (existsSync(filePath) && !file.endsWith(".enc")) {
+            if (existsSync(filePath) && !file.endsWith('.enc')) {
                 try {
-                    const content = readFileSync(filePath, "utf8");
+                    const content = readFileSync(filePath, 'utf8');
                     const encrypted = this.encryptFileContent(content);
-                    writeFileSync(filePath + ".enc", encrypted, "utf8");
+                    writeFileSync(filePath + '.enc', encrypted, 'utf8');
                     unlinkSync(filePath);
                 }
                 catch {
@@ -170,13 +153,13 @@ export class SessionFileEncryptor {
             return;
         const files = readdirSync(sessionDir);
         for (const file of files) {
-            if (file.endsWith(".enc")) {
+            if (file.endsWith('.enc')) {
                 const encFilePath = join(sessionDir, file);
                 const decFilePath = encFilePath.slice(0, -4); // Remove .enc
                 try {
-                    const content = readFileSync(encFilePath, "utf8");
+                    const content = readFileSync(encFilePath, 'utf8');
                     const decrypted = this.decryptFileContent(content);
-                    writeFileSync(decFilePath, decrypted, "utf8");
+                    writeFileSync(decFilePath, decrypted, 'utf8');
                     unlinkSync(encFilePath);
                 }
                 catch {

package/dist/modules/session/manager.js

@@ -1,5 +1,5 @@
-import { t } from "../../i18n/index";
-import { createSessionContext, DEFAULT_SESSION_ISOLATION, } from "../../modules/security/session-isolation";
+import { t } from '../../i18n/index';
+import { createSessionContext, DEFAULT_SESSION_ISOLATION } from '../../modules/security/session-isolation';
 export class SessionManager {
     store;
     activeId = null;
@@ -32,7 +32,7 @@ export class SessionManager {
     create(name, securityOverrides) {
         const now = new Date().toISOString();
         const id = `ses_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
-        const sessionName = name || t("session.default_name", { date: now.slice(0, 10) });
+        const sessionName = name || t('session.default_name', { date: now.slice(0, 10) });
         const meta = {
             id,
             name: sessionName,
@@ -73,7 +73,7 @@ export class SessionManager {
     rename(id, name) {
         const meta = this.store.loadMeta(id);
         if (!meta)
-            throw new Error(t("session.not_found", { id }));
+            throw new Error(t('session.not_found', { id }));
         meta.name = name;
         this.store.saveMeta(id, meta);
     }
@@ -87,13 +87,13 @@ export class SessionManager {
     }
     setActive(id) {
         if (!this.store.sessionExists(id)) {
-            throw new Error(t("session.not_found", { id }));
+            throw new Error(t('session.not_found', { id }));
         }
         this.activeId = id;
     }
     appendMessage(msg) {
         if (!this.activeId)
-            throw new Error(t("session.no_active"));
+            throw new Error(t('session.no_active'));
         this.store.appendMessage(this.activeId, msg);
     }
     appendLog(entry) {
@@ -117,9 +117,6 @@ export class SessionManager {
     /**
      * Get the session context for a specific session
      */
-    getSessionDirectory(id) {
-        return this.store.getSessionDir(id);
-    }
     getSessionContextById(sessionId) {
         if (!this.sessionContexts.has(sessionId)) {
             const meta = this.store.loadMeta(sessionId);
@@ -151,12 +148,10 @@ export class SessionManager {
         return {
             maxFileOperations: overrides.maxFileOperations,
             maxRecursionDepth: overrides.maxRecursionDepth,
-            rateLimits: overrides.rateLimits
-                ? {
-                    maxRequestsPerMinute: overrides.rateLimits.maxRequestsPerMinute ?? 60,
-                    maxParallelTasks: overrides.rateLimits.maxParallelTasks ?? 5,
-                }
-                : undefined,
+            rateLimits: overrides.rateLimits ? {
+                maxRequestsPerMinute: overrides.rateLimits.maxRequestsPerMinute ?? 60,
+                maxParallelTasks: overrides.rateLimits.maxParallelTasks ?? 5,
+            } : undefined,
         };
     }
     enforceMaxSessions() {