micro-models-agent 0.28.9 → 0.28.17

package/dist/modules/security/encryption.js

@@ -0,0 +1,240 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+import { homedir } from 'os';
+import { join } from 'path';
+import { readFileSync, writeFileSync, existsSync, copyFileSync } from 'fs';
+const DEFAULT_CONFIG = {
+    keyPath: join(homedir(), '.mma', '.encryption-key'),
+    algorithm: 'aes-256-gcm',
+};
+const IV_LENGTH = 16;
+const SALT_LENGTH = 16;
+const KEY_LENGTH = 32;
+const AUTH_TAG_LENGTH = 16;
+/**
+ * Generate a new encryption key
+ */
+export function generateEncryptionKey() {
+    return randomBytes(KEY_LENGTH);
+}
+/**
+ * Get or create encryption key from file
+ */
+export function getOrCreateEncryptionKey(config) {
+    const { keyPath } = { ...DEFAULT_CONFIG, ...config };
+    // Ensure directory exists
+    const dir = join(keyPath, '..');
+    if (!existsSync(dir)) {
+        // Note: We can't use mkdirSync here because we're in a pure function
+        // This will be handled by the caller
+    }
+    if (!existsSync(keyPath)) {
+        const key = generateEncryptionKey();
+        try {
+            writeFileSync(keyPath, key.toString('base64'), { mode: 0o600 });
+            return key;
+        }
+        catch {
+            // If we can't write the key file, return the key anyway
+            // The caller can handle the error
+            return key;
+        }
+    }
+    try {
+        const keyBase64 = readFileSync(keyPath, 'utf8');
+        return Buffer.from(keyBase64, 'base64');
+    }
+    catch {
+        // Backup the corrupted key file before throwing
+        try {
+            const backupPath = `${keyPath}.corrupted.${Date.now()}`;
+            copyFileSync(keyPath, backupPath);
+        }
+        catch { /* backup failed, continue */ }
+        throw new Error(`Encryption key file is corrupted or unreadable: ${keyPath}. ` +
+            `All previously encrypted data will be unrecoverable. ` +
+            `Delete the key file to generate a new one.`);
+    }
+}
+/**
+ * Encrypt a string using AES-256-GCM
+ * Note: Bun's crypto module doesn't support getAuthTag/setAuthTag directly,
+ * so we use a simpler approach with AES-256-CBC + HMAC for authentication
+ */
+export function encryptString(plaintext, key) {
+    const iv = randomBytes(IV_LENGTH);
+    const salt = randomBytes(SALT_LENGTH);
+    // Derive encryption key and HMAC key from the main key
+    const encKey = scryptSync(key, salt, KEY_LENGTH);
+    const hmacSalt = Buffer.concat([salt, Buffer.from([1, 2, 3, 4])]);
+    const hmacKey = scryptSync(key, hmacSalt, KEY_LENGTH);
+    // Encrypt with AES-256-CBC
+    const cipher = createCipheriv('aes-256-cbc', encKey, iv);
+    let encrypted = cipher.update(plaintext, 'utf8', 'base64');
+    encrypted += cipher.final('base64');
+    // Create HMAC for authentication
+    const hmac = createHmac('sha256', hmacKey);
+    hmac.update(iv);
+    hmac.update(Buffer.from(encrypted, 'base64'));
+    const authTag = hmac.digest();
+    // Format: salt:iv:authTag:encrypted
+    return `${salt.toString('base64')}:${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted}`;
+}
+/**
+ * Decrypt a string using AES-256-CBC + HMAC
+ */
+export function decryptString(encryptedText, key) {
+    const parts = encryptedText.split(':');
+    if (parts.length !== 4) {
+        throw new Error('Invalid encrypted format');
+    }
+    const salt = Buffer.from(parts[0], 'base64');
+    const iv = Buffer.from(parts[1], 'base64');
+    const authTag = Buffer.from(parts[2], 'base64');
+    const encrypted = parts[3];
+    // Derive encryption key and HMAC key from the main key
+    const encKey = scryptSync(key, salt, KEY_LENGTH);
+    const hmacSalt = Buffer.concat([salt, Buffer.from([1, 2, 3, 4])]);
+    const hmacKey = scryptSync(key, hmacSalt, KEY_LENGTH);
+    // Verify HMAC
+    const hmac = createHmac('sha256', hmacKey);
+    hmac.update(iv);
+    hmac.update(Buffer.from(encrypted, 'base64'));
+    const computedTag = hmac.digest();
+    if (!computedTag.equals(authTag)) {
+        throw new Error('Authentication failed: invalid tag');
+    }
+    // Decrypt with AES-256-CBC
+    const decipher = createDecipheriv('aes-256-cbc', encKey, iv);
+    let decrypted = decipher.update(encrypted, 'base64', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
+import { createHmac } from 'node:crypto';
+/**
+ * Check if a string looks like it's encrypted
+ */
+export function isEncryptedString(value) {
+    // Encrypted strings have the format: salt:iv:authTag:encrypted
+    // Each part is base64 encoded and separated by colons
+    const parts = value.split(':');
+    if (parts.length !== 4)
+        return false;
+    // Check if all parts are valid base64
+    try {
+        Buffer.from(parts[0], 'base64');
+        Buffer.from(parts[1], 'base64');
+        Buffer.from(parts[2], 'base64');
+        Buffer.from(parts[3], 'base64');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Sensitive field names that should be encrypted
+ */
+export const SENSITIVE_FIELD_NAMES = [
+    'api_key',
+    'apikey',
+    'apiKey',
+    'token',
+    'access_token',
+    'accessToken',
+    'password',
+    'passwd',
+    'pwd',
+    'secret',
+    'private_key',
+    'privateKey',
+    'auth',
+    'authorization',
+    'key',
+];
+/**
+ * Check if a field name indicates sensitive data
+ */
+export function isSensitiveFieldName(fieldName) {
+    const lowerFieldName = fieldName.toLowerCase();
+    return SENSITIVE_FIELD_NAMES.some(name => lowerFieldName.includes(name));
+}
+/**
+ * Encrypt sensitive fields in an object
+ */
+export function encryptSensitiveFields(obj, key) {
+    const result = {};
+    for (const [fieldName, value] of Object.entries(obj)) {
+        if (isSensitiveFieldName(fieldName) && typeof value === 'string' && !isEncryptedString(value)) {
+            result[fieldName] = encryptString(value, key);
+        }
+        else if (typeof value === 'object' && value !== null) {
+            if (Array.isArray(value)) {
+                result[fieldName] = value.map(item => typeof item === 'object' && item !== null && !(item instanceof RegExp)
+                    ? encryptSensitiveFields(item, key)
+                    : item);
+            }
+            else if (value instanceof RegExp) {
+                result[fieldName] = value;
+            }
+            else {
+                result[fieldName] = encryptSensitiveFields(value, key);
+            }
+        }
+        else {
+            result[fieldName] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Decrypt sensitive fields in an object
+ */
+export function decryptSensitiveFields(obj, key) {
+    const result = {};
+    for (const [fieldName, value] of Object.entries(obj)) {
+        if (isSensitiveFieldName(fieldName) && typeof value === 'string' && isEncryptedString(value)) {
+            try {
+                result[fieldName] = decryptString(value, key);
+            }
+            catch {
+                // If decryption fails, keep the encrypted value
+                result[fieldName] = value;
+            }
+        }
+        else if (typeof value === 'object' && value !== null) {
+            if (Array.isArray(value)) {
+                result[fieldName] = value.map(item => typeof item === 'object' && item !== null && !(item instanceof RegExp)
+                    ? decryptSensitiveFields(item, key)
+                    : item);
+            }
+            else if (value instanceof RegExp) {
+                result[fieldName] = value;
+            }
+            else {
+                result[fieldName] = decryptSensitiveFields(value, key);
+            }
+        }
+        else {
+            result[fieldName] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Create a wrapper for encrypting/decrypting config values
+ */
+export class ConfigEncryptor {
+    key;
+    constructor(config) {
+        this.key = getOrCreateEncryptionKey(config);
+    }
+    encrypt(config) {
+        return encryptSensitiveFields(config, this.key);
+    }
+    decrypt(config) {
+        return decryptSensitiveFields(config, this.key);
+    }
+    getKey() {
+        return this.key;
+    }
+}

package/dist/modules/security/index.js

@@ -0,0 +1,14 @@
+export * from "./command-validator";
+export * from "./path-validator";
+export * from "./network-validator";
+export * from "./content-scanner";
+export * from "./data-sanitizer";
+export * from "./audit-log";
+export * from "./rate-limiter";
+export * from "./encryption";
+export * from "./session-isolation";
+export * from "./session-encryption";
+export * from "./audit-notifier";
+export * from "./security-policies";
+// Re-export sanitizeUrl from network-validator to avoid conflicts
+export { sanitizeUrl } from "./network-validator";

package/dist/modules/security/network-validator.js

@@ -0,0 +1,79 @@
+import { sanitizeLogMessage } from "./data-sanitizer";
+/**
+ * Check if a URL is allowed based on security configuration
+ */
+export function isUrlAllowed(url, securityConfig) {
+    // If security is disabled, allow everything
+    if (!securityConfig?.enabled) {
+        return { allowed: true };
+    }
+    try {
+        const urlObj = new URL(url);
+        const domain = urlObj.hostname.toLowerCase();
+        // Check denied domains first
+        if (securityConfig.deniedDomains?.length) {
+            for (const deniedDomain of securityConfig.deniedDomains) {
+                const denied = deniedDomain.toLowerCase();
+                if (domain === denied || domain.endsWith(`.${denied}`)) {
+                    return { allowed: false, reason: `Domain "${domain}" is denied` };
+                }
+            }
+        }
+        // Check allowed domains (if non-empty, only these are allowed)
+        if (securityConfig.allowedDomains?.length) {
+            let isAllowed = false;
+            for (const allowedDomain of securityConfig.allowedDomains) {
+                const allowed = allowedDomain.toLowerCase();
+                if (domain === allowed || domain.endsWith(`.${allowed}`)) {
+                    isAllowed = true;
+                    break;
+                }
+            }
+            if (!isAllowed) {
+                return {
+                    allowed: false,
+                    reason: `Domain "${domain}" is not in the allowed list`,
+                };
+            }
+        }
+        return { allowed: true };
+    }
+    catch {
+        return { allowed: false, reason: `Invalid URL: ${url}` };
+    }
+}
+/**
+ * Sanitize URL for logging (remove sensitive information)
+ */
+export function sanitizeUrl(url) {
+    try {
+        const urlObj = new URL(url);
+        const sensitiveKeys = [
+            "api_key",
+            "token",
+            "password",
+            "secret",
+            "access_token",
+            "auth",
+            "key",
+        ];
+        const sanitizedParams = new URLSearchParams(urlObj.search);
+        for (const key of sensitiveKeys) {
+            if (sanitizedParams.has(key)) {
+                sanitizedParams.set(key, "[REDACTED]");
+            }
+        }
+        urlObj.search = sanitizedParams.toString();
+        let result = urlObj.toString();
+        // Also sanitize credentials in URL (user:pass@host)
+        if (urlObj.username || urlObj.password) {
+            result = result.replace(/:\/\/[^:]+:[^@]+@/, "://[REDACTED]:[REDACTED]@");
+        }
+        // Decode URL-encoded [REDACTED] back to plain text
+        result = decodeURIComponent(result);
+        return result;
+    }
+    catch {
+        return sanitizeLogMessage(url);
+    }
+}

package/dist/modules/security/path-validator.js

@@ -0,0 +1,209 @@
+import { resolve, normalize } from "path";
+/**
+ * Check if a path is within the allowed scope
+ * This combines global security settings with per-tool scope
+ */
+export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
+    const baseResolved = resolve(baseDir);
+    const targetResolved = resolve(baseDir, normalize(targetPath));
+    // First, check that path is within baseDir
+    if (!targetResolved.startsWith(baseResolved)) {
+        return {
+            allowed: false,
+            reason: "Path is outside the base working directory",
+        };
+    }
+    // If security is disabled, skip pattern validation
+    if (!securityConfig?.enabled) {
+        // Still enforce subagent scope if present
+        if (scope) {
+            const isReadScope = scope.read_only_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+            const isWriteScope = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+            if (isWriteScope)
+                return { allowed: true };
+            if (isReadScope)
+                return { allowed: true, reason: "Read-only file" };
+            return {
+                allowed: false,
+                reason: "Path is not within the allowed scope for this sub-agent",
+            };
+        }
+        return { allowed: true };
+    }
+    // Check global denied patterns
+    if (securityConfig?.denied?.length) {
+        for (const pattern of securityConfig.denied) {
+            if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
+                return {
+                    allowed: false,
+                    reason: `Path matches denied pattern: ${pattern}`,
+                };
+            }
+        }
+    }
+    // Check global allowed patterns (if non-empty, only these are allowed)
+    if (securityConfig?.allowed?.length) {
+        let isAllowed = false;
+        for (const pattern of securityConfig.allowed) {
+            if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
+                isAllowed = true;
+                break;
+            }
+        }
+        if (!isAllowed) {
+            return {
+                allowed: false,
+                reason: "Path does not match any allowed pattern",
+            };
+        }
+    }
+    // Check tool-specific scope (for subagents)
+    if (!scope) {
+        return { allowed: true };
+    }
+    const isRead = scope.read_only_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+    const isWrite = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+    if (isWrite)
+        return { allowed: true };
+    if (isRead)
+        return { allowed: true, reason: "Read-only file" };
+    return {
+        allowed: false,
+        reason: "Path is not within the allowed scope for this sub-agent",
+    };
+}
+/**
+ * Check if a path is writable (for write/delete operations)
+ */
+export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
+    const baseResolved = resolve(baseDir);
+    const targetResolved = resolve(baseDir, normalize(targetPath));
+    // First, check that path is within baseDir
+    if (!targetResolved.startsWith(baseResolved)) {
+        return {
+            allowed: false,
+            reason: "Path is outside the base working directory",
+        };
+    }
+    // If security is disabled, skip pattern validation
+    if (!securityConfig?.enabled) {
+        // Still enforce subagent scope if present
+        if (scope) {
+            const isWriteScope = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+            if (isWriteScope)
+                return { allowed: true };
+            return {
+                allowed: false,
+                reason: "Path is not within the allowed scope for this sub-agent",
+            };
+        }
+        return { allowed: true };
+    }
+    // Check global denied patterns
+    if (securityConfig?.denied?.length) {
+        for (const pattern of securityConfig.denied) {
+            if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
+                return {
+                    allowed: false,
+                    reason: `Path matches denied pattern: ${pattern}`,
+                };
+            }
+        }
+    }
+    // Check global allowed patterns (if non-empty, only these are allowed)
+    if (securityConfig?.allowed?.length) {
+        let isAllowed = false;
+        for (const pattern of securityConfig.allowed) {
+            if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
+                isAllowed = true;
+                break;
+            }
+        }
+        if (!isAllowed) {
+            return {
+                allowed: false,
+                reason: "Path does not match any allowed pattern",
+            };
+        }
+    }
+    // Check tool-specific scope (for subagents)
+    if (!scope) {
+        return { allowed: true };
+    }
+    const isWrite = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+    if (isWrite)
+        return { allowed: true };
+    return {
+        allowed: false,
+        reason: "Path is not within the writable scope for this sub-agent",
+    };
+}
+/**
+ * Simple glob pattern matching (supports * and **)
+ * This is a simplified version that handles common cases
+ */
+function matchesGlobPattern(targetPath, baseDir, pattern) {
+    const resolvedBaseDir = resolve(baseDir);
+    const resolvedTargetPath = resolve(targetPath);
+    // Handle directory patterns (ending with /)
+    if (pattern.endsWith("/")) {
+        const dirPattern = pattern.slice(0, -1);
+        const resolvedDirPattern = resolve(baseDir, dirPattern);
+        // Exact match
+        if (resolvedTargetPath === resolvedDirPattern) {
+            return true;
+        }
+        // Check if target is inside the directory
+        if (resolvedTargetPath.startsWith(resolvedDirPattern + "/") ||
+            resolvedTargetPath.startsWith(resolvedDirPattern + "\\")) {
+            return true;
+        }
+        return false;
+    }
+    // Handle **/* pattern (recursive)
+    if (pattern.includes("**/")) {
+        const parts = pattern.split("**/");
+        const prefix = parts[0];
+        const suffix = parts[1];
+        const resolvedPrefix = resolve(baseDir, prefix);
+        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") &&
+            !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
+            return false;
+        }
+        const remainingPath = resolvedTargetPath.slice(resolvedPrefix.length);
+        if (suffix === "*" || suffix === "") {
+            return true; // Any path after prefix
+        }
+        // Check if remaining path contains the suffix
+        return remainingPath.includes(suffix.replace(/\*/g, ""));
+    }
+    // Handle ** pattern (recursive any)
+    if (pattern.includes("**")) {
+        const parts = pattern.split("**");
+        const prefix = parts[0];
+        const suffix = parts[1];
+        const resolvedPrefix = resolve(baseDir, prefix);
+        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") &&
+            !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
+            return false;
+        }
+        if (!suffix) {
+            return true; // ** at the end matches anything after prefix
+        }
+        return resolvedTargetPath.includes(suffix.replace(/\//g, ""));
+    }
+    // Handle * pattern (single level)
+    if (pattern.includes("*")) {
+        const regexPattern = pattern
+            .replace(/\*/g, "[^/\\\\]*")
+            .replace(/\?/g, ".")
+            .replace(/\./g, "\\.");
+        const regex = new RegExp(`^${regexPattern}$`);
+        const relativePath = resolvedTargetPath
+            .slice(resolvedBaseDir.length + 1)
+            .replace(/\\/g, "/");
+        return regex.test(relativePath);
+    }
+    // Exact match
+    return resolvedTargetPath === resolve(baseDir, pattern);
+}

package/dist/modules/security/rate-limiter.js

@@ -0,0 +1,119 @@
+/**
+ * Rate limiter for LLM requests
+ * Prevents DoS attacks by limiting the number of requests per time window
+ */
+const DEFAULT_CONFIG = {
+    maxRequestsPerMinute: 60,
+    maxParallelTasks: 5,
+};
+/**
+ * Rate limiter class for tracking LLM requests
+ */
+export class RateLimiter {
+    config;
+    state;
+    lastCleanup = 0;
+    constructor(config) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.state = {
+            requests: [],
+            parallelTasks: 0,
+        };
+    }
+    /**
+     * Check if a new request is allowed
+     * Returns true if the request is allowed, false if rate limited
+     */
+    canMakeRequest() {
+        this.cleanupOldRequests();
+        if (this.state.requests.length >= this.config.maxRequestsPerMinute) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Record a request
+     */
+    recordRequest() {
+        this.cleanupOldRequests();
+        this.state.requests.push(Date.now());
+    }
+    /**
+     * Check if a new parallel task is allowed
+     */
+    canStartParallelTask() {
+        if (this.state.parallelTasks >= this.config.maxParallelTasks) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Start a parallel task
+     */
+    startParallelTask() {
+        this.state.parallelTasks++;
+    }
+    /**
+     * End a parallel task
+     */
+    endParallelTask() {
+        this.state.parallelTasks = Math.max(0, this.state.parallelTasks - 1);
+    }
+    /**
+     * Get current parallel task count
+     */
+    getParallelTaskCount() {
+        return this.state.parallelTasks;
+    }
+    /**
+     * Get remaining requests in current window
+     */
+    getRemainingRequests() {
+        this.cleanupOldRequests();
+        return Math.max(0, this.config.maxRequestsPerMinute - this.state.requests.length);
+    }
+    /**
+     * Clean up old requests (older than 1 minute)
+     */
+    cleanupOldRequests() {
+        const now = Date.now();
+        const oneMinuteAgo = now - 60_000;
+        // Only cleanup every 5 seconds to avoid performance overhead
+        if (now - this.lastCleanup < 5000) {
+            return;
+        }
+        this.state.requests = this.state.requests.filter((timestamp) => timestamp > oneMinuteAgo);
+        this.lastCleanup = now;
+    }
+    /**
+     * Reset the rate limiter
+     */
+    reset() {
+        this.state.requests = [];
+        this.state.parallelTasks = 0;
+        this.lastCleanup = 0;
+    }
+    /**
+     * Get rate limit configuration
+     */
+    getConfig() {
+        return this.config;
+    }
+    /**
+     * Update rate limit configuration
+     */
+    updateConfig(config) {
+        this.config = { ...this.config, ...config };
+    }
+}
+/**
+ * Global rate limiter instance
+ * Can be used by LLM provider to enforce rate limits
+ */
+export const globalRateLimiter = new RateLimiter();
+/**
+ * Create a rate limiter with custom configuration
+ */
+export function createRateLimiter(config) {
+    return new RateLimiter(config);
+}