micro-models-agent 0.28.17 → 0.29.1

package/dist/modules/security/audit-log.js

@@ -1,48 +1,28 @@
 import { existsSync, mkdirSync, appendFileSync } from "fs";
-import { resolve, join } from "path";
+import { resolve } from "path";
 import { homedir } from "os";
 import { globalAuditNotifier } from "./audit-notifier";
-let _globalAuditDir = resolve(homedir(), ".mma", "logs");
-let _sessionAuditDir = null;
-function getAuditDir() {
-    return _sessionAuditDir ?? _globalAuditDir;
-}
 /**
- * Set the session directory for audit logs. When set, all audit entries
- * are written to the session-specific directory instead of the global one.
+ * Directory and file path for audit logs
  */
-export function setAuditSessionDir(dir) {
-    _sessionAuditDir = dir;
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-}
+const AUDIT_LOG_DIR = resolve(homedir(), ".mma", "logs");
+const AUDIT_LOG_PATH = resolve(AUDIT_LOG_DIR, "audit.jsonl");
 /**
- * Clear the session directory — fall back to global audit dir.
+ * Ensure audit log directory exists
  */
-export function clearAuditSessionDir() {
-    _sessionAuditDir = null;
-}
-/**
- * Set the global audit log directory (used when no session dir is active).
- */
-export function setGlobalAuditDir(dir) {
-    _globalAuditDir = dir;
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+function ensureAuditLogDir() {
+    if (!existsSync(AUDIT_LOG_DIR)) {
+        mkdirSync(AUDIT_LOG_DIR, { recursive: true, mode: 0o700 });
     }
 }
 /**
  * Write an audit log entry
  */
 export function logAudit(entry) {
-    const dir = getAuditDir();
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
+    ensureAuditLogDir();
     try {
         const logEntry = JSON.stringify(entry);
-        appendFileSync(join(dir, "audit.jsonl"), logEntry + "\n", "utf8");
+        appendFileSync(AUDIT_LOG_PATH, logEntry + "\n", "utf8");
     }
     catch {
         // Silently fail if we can't write to audit log

package/dist/modules/security/command-validator.js

@@ -1,25 +1,11 @@
 import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
 // Fallback in case DEFAULT_SECURITY_CONFIG is not available
 const FALLBACK_BASH_CONFIG = {
-    enabled: false,
-    blacklist: [
-        "rm",
-        "dd",
-        "chmod",
-        "wget",
-        "curl",
-        "scp",
-        "ssh",
-        "nc",
-        "netcat",
-        "powershell",
-        "pwsh",
-        "cmd",
-    ],
+    blacklist: ['rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat', 'powershell', 'pwsh', 'cmd'],
     whitelist: [],
     blockDangerousFlags: false,
-    dangerousFlags: ["--force", "-rf", "--no-preserve-root"],
-    dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "`"],
+    dangerousFlags: ['--force', '-rf', '--no-preserve-root'],
+    dangerousOperators: ['>', '>>', '2>', '2>>', '|', '&&', '||', ';', '`'],
     logCommands: true,
 };
 export const DEFAULT_BASH_CONFIG = DEFAULT_SECURITY_CONFIG?.bash || FALLBACK_BASH_CONFIG;
@@ -46,11 +32,7 @@ function extractBaseCommand(trimmed) {
             i++;
             continue;
         }
-        if (tok === "sudo" ||
-            tok === "env" ||
-            tok === "command" ||
-            tok === "exec" ||
-            tok === "nohup") {
+        if (tok === "sudo" || tok === "env" || tok === "command" || tok === "exec" || tok === "nohup") {
             i++;
             continue;
         }
@@ -63,7 +45,7 @@ function extractBaseCommand(trimmed) {
     const parts = raw.split(/[\\/]/);
     const basename = parts[parts.length - 1] || raw;
     // Strip .exe/.cmd/.bat extensions for blacklist matching (e.g. powershell.exe → powershell)
-    return basename.replace(/\.(exe|cmd|bat)$/i, "") || basename;
+    return basename.replace(/\.(exe|cmd|bat)$/i, '') || basename;
 }
 /**
  * Check if a shell operator appears as a standalone token in the command.
@@ -74,16 +56,16 @@ function extractBaseCommand(trimmed) {
  *   "2>" does NOT match "2>>" (append stderr)
  */
 function containsOperator(command, op) {
-    const escaped = op.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const escaped = op.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     // For single-char operators that are prefixes of multi-char ones,
     // ensure they don't match when part of a longer sequence.
     // Note: "&" is no longer in dangerousOperators (&& is legitimate),
     // but keep the special case for defense-in-depth if manually added.
-    if (op === "&")
+    if (op === '&')
         return /(?<!&)&(?!&)/.test(command);
-    if (op === "|")
+    if (op === '|')
         return /(?<!\|)\|(?!\|)/.test(command);
-    if (op === ">")
+    if (op === '>')
         return /(?<!>)>(?!>)/.test(command);
     // For everything else (including multi-char like ">>", "2>", "2>>", ";", "`"),
     // match literally.
@@ -93,17 +75,11 @@ function containsOperator(command, op) {
  * Check if a command is allowed based on security configuration
  */
 export function isCommandAllowed(command, securityConfig) {
-    // If security is disabled, allow everything
-    if (!securityConfig?.enabled) {
-        return { allowed: true, sanitizedCommand: command };
-    }
+    // If no security config, allow everything (backward compatibility)
+    let config = securityConfig || DEFAULT_BASH_CONFIG;
     // Ensure config has all required fields
-    let config = securityConfig;
     if (!config.blacklist || !Array.isArray(config.blacklist)) {
-        config = {
-            ...FALLBACK_BASH_CONFIG,
-            enabled: config.enabled ?? FALLBACK_BASH_CONFIG.enabled,
-        };
+        config = FALLBACK_BASH_CONFIG;
     }
     const trimmedCommand = command.trim();
     if (!trimmedCommand) {
@@ -111,7 +87,7 @@ export function isCommandAllowed(command, securityConfig) {
     }
     // Shell wrappers are always blocked — they bypass all command validation.
     // The agent should use the bash tool directly, not shell interpreters.
-    const ALWAYS_BLOCKED = ["powershell", "pwsh", "cmd"];
+    const ALWAYS_BLOCKED = ['powershell', 'pwsh', 'cmd'];
     const baseForShellCheck = extractBaseCommand(trimmedCommand);
     if (ALWAYS_BLOCKED.includes(baseForShellCheck)) {
         return {
@@ -150,9 +126,7 @@ export function isCommandAllowed(command, securityConfig) {
         };
     }
     // Also check the raw first token in case it's a simple name
-    const rawFirst = trimmedCommand
-        .split(/\s+/)[0]
-        .replace(/\.(exe|cmd|bat)$/i, "");
+    const rawFirst = trimmedCommand.split(/\s+/)[0].replace(/\.(exe|cmd|bat)$/i, '');
     if (rawFirst !== baseCommand && config.blacklist.includes(rawFirst)) {
         return {
             allowed: false,
@@ -196,7 +170,7 @@ export function sanitizeCommandForLog(command) {
     ];
     let sanitized = command;
     for (const pattern of patterns) {
-        if (pattern.toString().includes("($1")) {
+        if (pattern.toString().includes('($1')) {
             // For patterns with capture groups, use the group in replacement
             sanitized = sanitized.replace(pattern, (match, p1) => {
                 return `${p1}=[REDACTED]`;
@@ -204,7 +178,7 @@ export function sanitizeCommandForLog(command) {
         }
         else {
             // For simple patterns, just replace with [REDACTED]
-            sanitized = sanitized.replace(pattern, "[REDACTED]");
+            sanitized = sanitized.replace(pattern, '[REDACTED]');
         }
     }
     return sanitized;

package/dist/modules/security/content-scanner.js

@@ -1,9 +1,5 @@
 /**
- * Default dangerous patterns to scan for in file content.
- * NOTE: only genuinely dangerous constructs are listed. Legitimate runtime
- * APIs (process.exit, setTimeout/setInterval, template literals `${}`,
- * backtick strings) are NOT scanned — they are valid JS/TS and blocking
- * them breaks ordinary CLI code (false positives).
+ * Default dangerous patterns to scan for in file content
  */
 const DEFAULT_DANGEROUS_PATTERNS = [
     /eval\(/gi,
@@ -15,6 +11,9 @@ const DEFAULT_DANGEROUS_PATTERNS = [
     /require\('net'\).createServer/gi,
     /require\('fs'\).writeFileSync/gi,
     /require\('fs'\).unlinkSync/gi,
+    /process\.exit\(/gi,
+    /setInterval\(/gi,
+    /setTimeout\(/gi,
     /while\(true\)/gi,
     /for\(;;\)/gi,
     /rm -rf/gi,
@@ -22,6 +21,8 @@ const DEFAULT_DANGEROUS_PATTERNS = [
     /chmod 777/gi,
     /wget.*\|.*sh/gi,
     /curl.*\|.*sh/gi,
+    /\$\{/gi,
+    /`[^`]+`/gi,
 ];
 /**
  * Scan file content for dangerous patterns
@@ -32,9 +33,7 @@ export function scanContent(content, filePath, config) {
         return { allowed: true };
     }
     // Use default patterns if none provided
-    const patterns = config.dangerousPatterns?.length
-        ? config.dangerousPatterns
-        : DEFAULT_DANGEROUS_PATTERNS;
+    const patterns = config.dangerousPatterns?.length ? config.dangerousPatterns : DEFAULT_DANGEROUS_PATTERNS;
     const matches = [];
     for (const pattern of patterns) {
         const match = content.match(pattern);
@@ -45,7 +44,7 @@ export function scanContent(content, filePath, config) {
     if (matches.length > 0) {
         return {
             allowed: false,
-            reason: `Content contains dangerous patterns in ${filePath}: ${matches.slice(0, 3).join(", ")}`,
+            reason: `Content contains dangerous patterns: ${matches.slice(0, 3).join(", ")}`,
             matches,
         };
     }

package/dist/modules/security/network-validator.js

@@ -3,8 +3,8 @@ import { sanitizeLogMessage } from "./data-sanitizer";
  * Check if a URL is allowed based on security configuration
  */
 export function isUrlAllowed(url, securityConfig) {
-    // If security is disabled, allow everything
-    if (!securityConfig?.enabled) {
+    // If no security config, allow everything (backward compatibility)
+    if (!securityConfig) {
         return { allowed: true };
     }
     try {

package/dist/modules/security/path-validator.js

@@ -8,36 +8,13 @@ export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
     const targetResolved = resolve(baseDir, normalize(targetPath));
     // First, check that path is within baseDir
     if (!targetResolved.startsWith(baseResolved)) {
-        return {
-            allowed: false,
-            reason: "Path is outside the base working directory",
-        };
-    }
-    // If security is disabled, skip pattern validation
-    if (!securityConfig?.enabled) {
-        // Still enforce subagent scope if present
-        if (scope) {
-            const isReadScope = scope.read_only_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
-            const isWriteScope = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
-            if (isWriteScope)
-                return { allowed: true };
-            if (isReadScope)
-                return { allowed: true, reason: "Read-only file" };
-            return {
-                allowed: false,
-                reason: "Path is not within the allowed scope for this sub-agent",
-            };
-        }
-        return { allowed: true };
+        return { allowed: false, reason: "Path is outside the base working directory" };
     }
     // Check global denied patterns
     if (securityConfig?.denied?.length) {
         for (const pattern of securityConfig.denied) {
             if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
-                return {
-                    allowed: false,
-                    reason: `Path matches denied pattern: ${pattern}`,
-                };
+                return { allowed: false, reason: `Path matches denied pattern: ${pattern}` };
             }
         }
     }
@@ -51,10 +28,7 @@ export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
             }
         }
         if (!isAllowed) {
-            return {
-                allowed: false,
-                reason: "Path does not match any allowed pattern",
-            };
+            return { allowed: false, reason: "Path does not match any allowed pattern" };
         }
     }
     // Check tool-specific scope (for subagents)
@@ -80,33 +54,13 @@ export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
     const targetResolved = resolve(baseDir, normalize(targetPath));
     // First, check that path is within baseDir
     if (!targetResolved.startsWith(baseResolved)) {
-        return {
-            allowed: false,
-            reason: "Path is outside the base working directory",
-        };
-    }
-    // If security is disabled, skip pattern validation
-    if (!securityConfig?.enabled) {
-        // Still enforce subagent scope if present
-        if (scope) {
-            const isWriteScope = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
-            if (isWriteScope)
-                return { allowed: true };
-            return {
-                allowed: false,
-                reason: "Path is not within the allowed scope for this sub-agent",
-            };
-        }
-        return { allowed: true };
+        return { allowed: false, reason: "Path is outside the base working directory" };
     }
     // Check global denied patterns
     if (securityConfig?.denied?.length) {
         for (const pattern of securityConfig.denied) {
             if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
-                return {
-                    allowed: false,
-                    reason: `Path matches denied pattern: ${pattern}`,
-                };
+                return { allowed: false, reason: `Path matches denied pattern: ${pattern}` };
             }
         }
     }
@@ -120,10 +74,7 @@ export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
             }
         }
         if (!isAllowed) {
-            return {
-                allowed: false,
-                reason: "Path does not match any allowed pattern",
-            };
+            return { allowed: false, reason: "Path does not match any allowed pattern" };
         }
     }
     // Check tool-specific scope (for subagents)
@@ -154,8 +105,7 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
             return true;
         }
         // Check if target is inside the directory
-        if (resolvedTargetPath.startsWith(resolvedDirPattern + "/") ||
-            resolvedTargetPath.startsWith(resolvedDirPattern + "\\")) {
+        if (resolvedTargetPath.startsWith(resolvedDirPattern + "/") || resolvedTargetPath.startsWith(resolvedDirPattern + "\\")) {
             return true;
         }
         return false;
@@ -166,8 +116,7 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
         const prefix = parts[0];
         const suffix = parts[1];
         const resolvedPrefix = resolve(baseDir, prefix);
-        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") &&
-            !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
+        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") && !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
             return false;
         }
         const remainingPath = resolvedTargetPath.slice(resolvedPrefix.length);
@@ -183,8 +132,7 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
         const prefix = parts[0];
         const suffix = parts[1];
         const resolvedPrefix = resolve(baseDir, prefix);
-        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") &&
-            !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
+        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") && !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
             return false;
         }
         if (!suffix) {
@@ -199,9 +147,7 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
             .replace(/\?/g, ".")
             .replace(/\./g, "\\.");
         const regex = new RegExp(`^${regexPattern}$`);
-        const relativePath = resolvedTargetPath
-            .slice(resolvedBaseDir.length + 1)
-            .replace(/\\/g, "/");
+        const relativePath = resolvedTargetPath.slice(resolvedBaseDir.length + 1).replace(/\\/g, "/");
         return regex.test(relativePath);
     }
     // Exact match