micro-models-agent 0.28.9 → 0.29.0

package/dist/cli/security-commands.js

@@ -0,0 +1,166 @@
+import { bootstrap } from "../core/bootstrap";
+import { saveConfig } from "../config/config";
+import { join } from "path";
+import { homedir } from "os";
+import { SECURITY_POLICIES, applySecurityPolicy, getSecurityPolicy, } from "../modules/security/security-policies";
+import { globalAuditNotifier } from "../modules/security/audit-notifier";
+import { t } from "../i18n/index";
+/**
+ * Create security subcommand
+ */
+export function createSecurityCommand(program) {
+    const securityCmd = program
+        .command("security")
+        .description(t("cli.security.description"));
+    // security status - show current security configuration
+    securityCmd
+        .command("status")
+        .description(t("cli.security.status"))
+        .action(async () => {
+        const { config } = await bootstrap();
+        const security = config.security || {};
+        const bash = security.bash || {};
+        const paths = security.paths || {};
+        const network = security.network || {};
+        const contentScan = security.contentScan || {};
+        const rateLimits = security.rateLimits || {};
+        const sessionEncryption = security.sessionEncryption || {};
+        const auditNotifier = security.auditNotifier || {};
+        console.log(t("cli.security.current_policy"));
+        console.log(`  ${t("cli.security.bash_enabled")}: ${bash.blacklist?.length > 0 ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.path_validation")}: ${paths.denied?.length > 0 ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.network_validation")}: ${network.deniedDomains?.length > 0 || network.allowedDomains?.length > 0 ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.content_scanning")}: ${contentScan.enabled ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.max_recursion")}: ${security.maxRecursionDepth ?? 3}`);
+        console.log(`  ${t("cli.security.max_file_ops")}: ${security.maxFileOperations ?? 100}`);
+        console.log(`  ${t("cli.security.rate_limit")}: ${rateLimits.maxRequestsPerMinute ?? 60}/min`);
+        console.log(`  ${t("cli.security.session_encryption")}: ${sessionEncryption.enabled ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.audit_notifier")}: ${auditNotifier.enabled ? t("cli.yes") : t("cli.no")}`);
+    });
+    // security policies - manage security policies
+    securityCmd
+        .command("policies")
+        .description(t("cli.security.policies"))
+        .action(async () => {
+        console.log(t("cli.security.available_policies"));
+        console.log("");
+        for (const [preset, policy] of Object.entries(SECURITY_POLICIES)) {
+            if (preset === 'custom')
+                continue;
+            const marker = " ";
+            console.log(` ${marker}${preset.padEnd(12)}  ${policy.name}`);
+            console.log(`             ${policy.description}`);
+            console.log(`             ${t("cli.security.recommended_for")}: ${policy.recommendedFor.join(", ")}`);
+            console.log("");
+        }
+    });
+    // security set-policy - apply a security policy
+    securityCmd
+        .command("set-policy")
+        .argument("<preset>", t("cli.security.preset"))
+        .description(t("cli.security.set_policy"))
+        .action(async (preset) => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        const validPresets = ['strict', 'balanced', 'permissive'];
+        if (!validPresets.includes(preset)) {
+            console.log(t("cli.security.invalid_preset", { presets: validPresets.join(", ") }));
+            return;
+        }
+        const policy = getSecurityPolicy(preset);
+        const newSecurityConfig = applySecurityPolicy(preset);
+        // Merge with existing config
+        appConfig.security = newSecurityConfig;
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.policy_applied", { name: policy.name }));
+        console.log(t("cli.security.policy_description", { description: policy.description }));
+    });
+    // security enable-encryption - enable session file encryption
+    securityCmd
+        .command("enable-encryption")
+        .description(t("cli.security.enable_encryption"))
+        .action(async () => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        appConfig.security = appConfig.security || {};
+        appConfig.security.sessionEncryption = {
+            enabled: true,
+            encryptHistory: true,
+            encryptSessionLog: true,
+        };
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.encryption_enabled"));
+    });
+    // security disable-encryption - disable session file encryption
+    securityCmd
+        .command("disable-encryption")
+        .description(t("cli.security.disable_encryption"))
+        .action(async () => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        appConfig.security = appConfig.security || {};
+        appConfig.security.sessionEncryption = {
+            enabled: false,
+            encryptHistory: false,
+            encryptSessionLog: false,
+        };
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.encryption_disabled"));
+    });
+    // security enable-audit - enable audit notifications
+    securityCmd
+        .command("enable-audit")
+        .description(t("cli.security.enable_audit"))
+        .action(async () => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        appConfig.security = appConfig.security || {};
+        appConfig.security.auditNotifier = {
+            enabled: true,
+            minSeverity: 'medium',
+            eventTypes: ['security_block', 'bash_command', 'file_operation', 'network_request'],
+            maxRetries: 3,
+            webhookTimeout: 5000,
+        };
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.audit_enabled"));
+    });
+    // security disable-audit - disable audit notifications
+    securityCmd
+        .command("disable-audit")
+        .description(t("cli.security.disable_audit"))
+        .action(async () => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        appConfig.security = appConfig.security || {};
+        appConfig.security.auditNotifier = {
+            enabled: false,
+            maxRetries: 3,
+            webhookTimeout: 5000,
+        };
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.audit_disabled"));
+    });
+    // security audit-stats - show audit notification statistics
+    securityCmd
+        .command("audit-stats")
+        .description(t("cli.security.audit_stats"))
+        .action(async () => {
+        const stats = globalAuditNotifier.getStats();
+        console.log(t("cli.security.audit_stats_title"));
+        console.log(`  ${t("cli.security.total_notifications")}: ${stats.total}`);
+        console.log("");
+        console.log(t("cli.security.by_severity"));
+        console.log(`  ${t("cli.security.low")}: ${stats.bySeverity.low}`);
+        console.log(`  ${t("cli.security.medium")}: ${stats.bySeverity.medium}`);
+        console.log(`  ${t("cli.security.high")}: ${stats.bySeverity.high}`);
+        console.log(`  ${t("cli.security.critical")}: ${stats.bySeverity.critical}`);
+        console.log("");
+        console.log(t("cli.security.by_type"));
+        for (const [type, count] of Object.entries(stats.byType)) {
+            if (count > 0) {
+                console.log(`  ${type}: ${count}`);
+            }
+        }
+    });
+}

package/dist/cli/setup.js

@@ -0,0 +1,229 @@
+import * as readline from "readline";
+import { pc } from "../ui/colors";
+import { t, setLocale } from "../i18n/index";
+import { Spinner } from "../ui/spinner";
+import { box } from "../ui/box";
+import { renderTable } from "../ui/table";
+async function withSpinner(message, fn) {
+    const spinner = new Spinner();
+    spinner.start(message);
+    try {
+        return await fn();
+    }
+    finally {
+        spinner.stop();
+    }
+}
+/** Render a numbered list inside a box. */
+function menuList(items) {
+    const lines = items.map((it, i) => ` ${pc.cyan(`[${i + 1}]`)} ${it.label}${it.url ? `  ${pc.dim(it.url)}` : ""}`);
+    for (const l of box(lines, { width: 72 }))
+        console.log(l);
+}
+function ask(rl, question, defaultValue) {
+    return new Promise((resolve) => {
+        const prompt = defaultValue
+            ? `${question} [${defaultValue}]: `
+            : `${question}: `;
+        rl.question(prompt, (answer) => {
+            resolve(answer.trim() || defaultValue || "");
+        });
+    });
+}
+const PROVIDER_TYPES = [
+    {
+        value: "openai-compat",
+        label: "OpenAI-compatible (LM Studio, Ollama, vLLM, etc.)",
+    },
+    { value: "openai", label: "OpenAI API" },
+    { value: "anthropic", label: "Anthropic Claude" },
+];
+const KNOWN_PORTS = [
+    { port: 1234, label: "LM Studio" },
+    { port: 11434, label: "Ollama" },
+    { port: 8080, label: "vLLM / custom" },
+    { port: 4891, label: "GPT4All" },
+];
+async function scanPorts() {
+    const found = [];
+    for (const { port, label } of KNOWN_PORTS) {
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 2000);
+            const resp = await fetch(`http://localhost:${port}/v1/models`, {
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (resp.ok) {
+                found.push({ label, url: `http://localhost:${port}/v1` });
+            }
+        }
+        catch {
+            /* port not available */
+        }
+    }
+    return found;
+}
+async function fetchModels(apiBase, apiKey) {
+    try {
+        const url = `${apiBase.replace(/\/+$/, "")}/models`;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        const resp = await fetch(url, {
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            signal: controller.signal,
+        });
+        clearTimeout(timeout);
+        if (!resp.ok)
+            return [];
+        const data = (await resp.json());
+        const models = (data.data || data || [])
+            .map((m) => m.id || m.name || m.model || "")
+            .filter(Boolean);
+        return models;
+    }
+    catch {
+        return [];
+    }
+}
+async function testChat(apiBase, apiKey, model) {
+    try {
+        const url = `${apiBase.replace(/\/+$/, "")}/chat/completions`;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 10000);
+        const resp = await fetch(url, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                model,
+                messages: [{ role: "user", content: 'Say "ok"' }],
+                max_tokens: 20,
+            }),
+            signal: controller.signal,
+        });
+        clearTimeout(timeout);
+        if (!resp.ok)
+            return false;
+        const data = (await resp.json());
+        const msg = data.choices?.[0]?.message;
+        const text = msg?.content || msg?.reasoning_content || "";
+        return text.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export async function runSetup() {
+    console.log(t("setup.title"));
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    console.log(t("setup.language"));
+    const locale = await ask(rl, t("setup.ui_lang"), "en");
+    setLocale(locale);
+    console.log(t("setup.select_provider"));
+    menuList(PROVIDER_TYPES);
+    const providerChoice = await ask(rl, t("setup.select_provider_num", { max: PROVIDER_TYPES.length }), "1");
+    const providerIdx = Math.max(0, Math.min(PROVIDER_TYPES.length - 1, (parseInt(providerChoice) || 1) - 1));
+    const provider = PROVIDER_TYPES[providerIdx].value;
+    let apiBase = "";
+    if (provider === "openai-compat") {
+        const found = await withSpinner(t("setup.scanning_spinner"), async () => scanPorts());
+        if (found.length > 0) {
+            console.log(t("setup.found_servers", { count: found.length }));
+            menuList([
+                ...found.map((f) => ({ label: f.label, url: f.url })),
+                { label: t("setup.custom_url") },
+            ]);
+            const choice = await ask(rl, t("setup.select_server", { max: found.length + 1 }), "1");
+            const idx = (parseInt(choice) || 1) - 1;
+            if (idx >= found.length) {
+                apiBase = await ask(rl, t("setup.api_base"), "http://localhost:1234/v1");
+            }
+            else {
+                apiBase = found[Math.max(0, Math.min(found.length - 1, idx))].url;
+            }
+        }
+        else {
+            console.log(t("setup.no_servers"));
+            apiBase = await ask(rl, t("setup.api_base"), "http://localhost:1234/v1");
+        }
+    }
+    else if (provider === "openai") {
+        apiBase = "https://api.openai.com/v1";
+    }
+    else if (provider === "anthropic") {
+        apiBase = "https://api.anthropic.com";
+    }
+    const defaultKey = provider === "openai-compat" ? "not-needed" : "";
+    const apiKey = await ask(rl, t("setup.api_key"), defaultKey);
+    const models = await withSpinner(t("setup.fetching_spinner"), () => fetchModels(apiBase, apiKey));
+    let model = "";
+    if (models.length > 0) {
+        console.log(t("setup.available_models"));
+        menuList(models.slice(0, 10).map((m) => ({ label: m })));
+        const choice = await ask(rl, t("setup.select_model", { max: Math.min(models.length, 10) }), "1");
+        const idx = Math.max(0, Math.min(models.length - 1, (parseInt(choice) || 1) - 1));
+        model = models[idx];
+    }
+    else {
+        model = await ask(rl, t("setup.model_name"), "qwen3.5-9b");
+    }
+    const connected = await withSpinner(t("setup.testing_spinner", { model }), () => testChat(apiBase, apiKey, model));
+    if (connected) {
+        console.log(pc.green(t("setup.ok")));
+    }
+    else {
+        console.log(pc.yellow(t("setup.warning")));
+    }
+    console.log(t("setup.agent_settings"));
+    const contextWindow = parseInt(await ask(rl, t("setup.context_window"), "32768"));
+    const maxIterations = parseInt(await ask(rl, t("setup.max_iters"), "1000"));
+    // Security settings
+    console.log(t("setup.security_header"));
+    console.log(pc.dim(t("setup.security_status_off")));
+    const configureSecurity = await ask(rl, t("setup.security_configure"), "n");
+    let securityBashBlock = false;
+    let securityFlagsBlock = false;
+    let securityPathsDeny = true;
+    if (configureSecurity.toLowerCase() === "y" || configureSecurity.toLowerCase() === "yes") {
+        securityBashBlock = (await ask(rl, t("setup.security_bash_block"), "n")).toLowerCase() === "y";
+        securityFlagsBlock = (await ask(rl, t("setup.security_flags_block"), "n")).toLowerCase() === "y";
+        securityPathsDeny = (await ask(rl, t("setup.security_paths_deny"), "Y")).toLowerCase() !== "n";
+    }
+    rl.close();
+    const answers = {
+        provider,
+        apiBase,
+        apiKey: apiKey || "not-needed",
+        model,
+        contextWindow,
+        maxToolIterations: maxIterations,
+        locale,
+        securityBashBlock,
+        securityFlagsBlock,
+        securityPathsDeny,
+    };
+    console.log(pc.green(pc.bold(t("setup.complete"))));
+    const summary = renderTable([
+        t("setup.summary_setting"),
+        t("setup.summary_value"),
+        t("setup.summary_setting"),
+        t("setup.summary_value"),
+    ], [
+        [t("setup.provider_type"), provider, t("setup.model_name"), model],
+        ["API Base URL", apiBase, t("setup.context_window"), String(contextWindow)],
+        [t("setup.api_key"), apiKey || "not-needed", t("setup.max_iters"), String(maxIterations)],
+        [t("setup.ui_lang"), locale, "", ""],
+    ], { maxColumns: 4 });
+    for (const l of summary)
+        console.log(l);
+    return answers;
+}

package/dist/config/config.js

@@ -0,0 +1,186 @@
+import { existsSync, readFileSync, unlinkSync, writeFileSync, mkdirSync } from 'fs';
+import { join, dirname } from 'path';
+import { DEFAULTS } from './defaults';
+import { DEFAULT_SECURITY_CONFIG } from './security';
+import { t } from '../i18n/index';
+import { MigrationDetector } from '../migration/detect';
+import { BackupManager } from '../migration/backup';
+import { validateExpertConfig } from './experts';
+import { ConfigEncryptor } from '../modules/security/encryption';
+/**
+ * Restore RegExp instances in dangerousPatterns that were serialized as {}
+ * (pre-0.8.0 configs) or as {__regex, source, flags} (new format).
+ * Falls back to default patterns for any entry that is not a real RegExp.
+ */
+function restoreDangerousPatterns(patterns, defaults) {
+    const fallback = (Array.isArray(defaults) ? defaults : []);
+    if (!Array.isArray(patterns) || patterns.length === 0) {
+        return fallback;
+    }
+    return patterns.map((p, i) => {
+        if (p instanceof RegExp)
+            return p;
+        // If the pattern was serialized as {__regex, source, flags}, revive it
+        if (p && typeof p === "object") {
+            const { source, flags } = p;
+            if (source && typeof source === "string") {
+                try {
+                    return new RegExp(source, flags || "");
+                }
+                catch {
+                    // fall through
+                }
+            }
+        }
+        // Corrupted entry (e.g. serialized as {} pre-0.8.0): use default by index
+        return fallback[i] || fallback[0] || p;
+    });
+}
+function deepMerge(target, source) {
+    const result = { ...target };
+    for (const key of Object.keys(source)) {
+        const srcVal = source[key];
+        const tgtVal = target[key];
+        if (srcVal !== null && srcVal !== undefined &&
+            typeof srcVal === 'object' && !Array.isArray(srcVal) &&
+            typeof tgtVal === 'object' && !Array.isArray(tgtVal)) {
+            result[key] = deepMerge(tgtVal, srcVal);
+        }
+        else if (srcVal !== undefined) {
+            result[key] = srcVal;
+        }
+    }
+    return result;
+}
+/**
+ * JSON replacer that serializes RegExp objects as {__regex, source, flags}
+ * so they survive JSON.stringify/parse round-trips.
+ */
+function regexReplacer(_key, value) {
+    if (value instanceof RegExp) {
+        return { __regex: true, source: value.source, flags: value.flags };
+    }
+    return value;
+}
+/**
+ * JSON reviver that restores RegExp objects serialized by regexReplacer.
+ */
+function regexReviver(_key, value) {
+    if (value &&
+        typeof value === "object" &&
+        value.__regex === true) {
+        const { source, flags } = value;
+        try {
+            return new RegExp(source, flags);
+        }
+        catch {
+            return value;
+        }
+    }
+    return value;
+}
+function loadJSON(path) {
+    try {
+        if (existsSync(path)) {
+            return JSON.parse(readFileSync(path, 'utf-8'), regexReviver);
+        }
+    }
+    catch { /* ignore malformed files */ }
+    return null;
+}
+function applyEnvVars(config) {
+    const env = process.env;
+    const result = { ...config };
+    if (env.MMA_MODEL)
+        result.model = env.MMA_MODEL;
+    if (env.MMA_PROVIDER_TYPE)
+        result.provider = { ...result.provider, type: env.MMA_PROVIDER_TYPE };
+    if (env.MMA_PROVIDER_BASEURL)
+        result.provider = { ...result.provider, baseUrl: env.MMA_PROVIDER_BASEURL };
+    if (env.MMA_PROVIDER_APIKEY)
+        result.provider = { ...result.provider, apiKey: env.MMA_PROVIDER_APIKEY };
+    if (env.MMA_LOG_LEVEL)
+        result.logLevel = env.MMA_LOG_LEVEL;
+    if (env.MMA_LOCALE)
+        result.locale = env.MMA_LOCALE;
+    if (env.MMA_CONTEXT_WINDOW)
+        result.contextWindow = parseInt(env.MMA_CONTEXT_WINDOW, 10);
+    if (env.MMA_MAX_TOOL_ITERATIONS)
+        result.maxToolIterations = parseInt(env.MMA_MAX_TOOL_ITERATIONS, 10);
+    if (env.MMA_STUCK_THRESHOLD)
+        result.stuckThreshold = parseInt(env.MMA_STUCK_THRESHOLD, 10);
+    if (env.MMA_AUTO_PLAN)
+        result.autoPlan = env.MMA_AUTO_PLAN === 'true';
+    if (env.MMA_MOE_ENABLED)
+        result.moe = { ...result.moe, enabled: env.MMA_MOE_ENABLED === 'true' };
+    return result;
+}
+export function loadConfig(options) {
+    const globalPath = join(options.configDir, 'config.json');
+    mkdirSync(options.configDir, { recursive: true });
+    const detector = new MigrationDetector(options.configDir);
+    if (detector.needsMigration()) {
+        const backup = new BackupManager(options.configDir);
+        backup.backupConfig();
+        const summary = backup.getBackupSummary();
+        console.log(t('migration.detected', { summary }));
+        try {
+            unlinkSync(globalPath);
+        }
+        catch { }
+    }
+    let config = { ...DEFAULTS };
+    const globalData = loadJSON(globalPath);
+    if (globalData) {
+        config = deepMerge(config, globalData);
+    }
+    if (!existsSync(globalPath)) {
+        saveConfig(config, globalPath);
+    }
+    const projectData = loadJSON(options.projectConfigPath);
+    if (projectData) {
+        config = deepMerge(config, projectData);
+    }
+    // Restore RegExp patterns in contentScan that may have been serialized
+    // as {} in pre-0.8.0 config files, or merged from user config.
+    if (config.security?.contentScan?.dangerousPatterns) {
+        config.security.contentScan.dangerousPatterns = restoreDangerousPatterns(config.security.contentScan.dangerousPatterns, DEFAULT_SECURITY_CONFIG.contentScan.dangerousPatterns);
+    }
+    config = applyEnvVars(config);
+    // Decrypt sensitive fields in the loaded config
+    try {
+        const encryptor = new ConfigEncryptor();
+        const decrypted = encryptor.decrypt(config);
+        // Merge decrypted sensitive fields back into config
+        for (const key of Object.keys(decrypted)) {
+            config[key] = decrypted[key];
+        }
+    }
+    catch (e) {
+        // If decryption fails, log a warning but continue with the config
+        console.warn(t('config.decryption_warning', { error: e.message }));
+    }
+    // Update global audit notifier with config (done in bootstrap.ts)
+    return config;
+}
+export function validateConfig(config, allToolTags) {
+    const errors = validateExpertConfig(config, allToolTags);
+    if (errors.length > 0) {
+        throw new Error(`Config validation failed:\n${errors.join('\n')}`);
+    }
+}
+export function saveConfig(config, configPath) {
+    const dir = dirname(configPath);
+    mkdirSync(dir, { recursive: true });
+    // Encrypt sensitive fields before saving
+    try {
+        const encryptor = new ConfigEncryptor();
+        const encryptedConfig = encryptor.encrypt({ ...config });
+        writeFileSync(configPath, JSON.stringify(encryptedConfig, regexReplacer, 2), 'utf-8');
+    }
+    catch (e) {
+        // If encryption fails, save without encryption
+        console.warn(t('config.encryption_warning', { error: e.message }));
+        writeFileSync(configPath, JSON.stringify(config, regexReplacer, 2), 'utf-8');
+    }
+}

package/dist/config/defaults.js

@@ -0,0 +1,91 @@
+import { DEFAULT_SECURITY_CONFIG } from "./security";
+export const DEFAULTS = {
+    version: "2.0.0",
+    model: "qwen3.5-9b",
+    provider: {
+        type: "openai-compat",
+        baseUrl: "http://localhost:1234/v1",
+        apiKey: "not-needed",
+    },
+    orchestrator: {
+        model: undefined,
+        provider: undefined,
+    },
+    moe: {
+        enabled: false,
+    },
+    experts: {
+        code: {
+            model: "qwen3.5-9b",
+            tool_tags: ["file", "code", "shell"],
+            max_attempts: 3,
+        },
+        research: { model: "qwen3.5-9b", tool_tags: ["research"], max_attempts: 3 },
+        browser: {
+            model: "qwen3.5-9b",
+            tool_tags: ["browser", "vision"],
+            max_attempts: 3,
+        },
+        vision: {
+            model: "qwen3.5-9b",
+            tool_tags: ["browser", "vision", "file"],
+            max_attempts: 2,
+        },
+    },
+    contextWindow: 32768,
+    contextBudget: {
+        systemPrompt: 0.1,
+        responseReserve: 0.15,
+        compactionThreshold: 0.75,
+    },
+    modelLoad: {
+        autoLoad: false,
+        flashAttention: true,
+        offloadKvCacheToGpu: true,
+    },
+    retry: {
+        maxRetries: 3,
+        baseDelay: 1000,
+        maxDelay: 30000,
+    },
+    maxToolIterations: 1000,
+    stuckThreshold: 8,
+    autoPlan: true,
+    showReasoning: false,
+    logLevel: "info",
+    locale: "en",
+    session: {
+        autoSave: true,
+        maxSessions: 50,
+        isolateMemory: false,
+    },
+    browser: {
+        enabled: true,
+        headless: true,
+        maxElements: 30,
+        viewportWidth: 1280,
+        viewportHeight: 720,
+        navigationTimeout: 15000,
+    },
+    ui: {
+        spinner: true,
+    },
+    mcpServers: {
+        context7: {
+            name: "context7",
+            transport: "http",
+            url: "https://mcp.context7.com/mcp",
+            headers: {
+                CONTEXT7_API_KEY: process.env.CONTEXT7_API_KEY || "",
+            },
+            enabled: true,
+            timeout: 30000,
+        },
+    },
+    security: DEFAULT_SECURITY_CONFIG,
+    sessionIsolation: {
+        enabled: false,
+        isolatePlugins: true,
+        isolateTempFiles: true,
+    },
+};

package/dist/config/experts.js

@@ -0,0 +1,15 @@
+export function getExpertConfig(config, tag) {
+    return config.experts?.[tag];
+}
+export function validateExpertConfig(config, allToolTags) {
+    const errors = [];
+    const knownTags = new Set(allToolTags);
+    for (const [name, expert] of Object.entries(config.experts || {})) {
+        for (const tag of expert.tool_tags) {
+            if (!knownTags.has(tag)) {
+                errors.push(`Expert "${name}" references unknown tool_tag "${tag}". Known tags: ${Array.from(knownTags).join(', ')}`);
+            }
+        }
+    }
+    return errors;
+}

package/dist/config/index.js

@@ -0,0 +1,3 @@
+export { DEFAULTS } from './defaults';
+export { loadConfig, saveConfig, validateConfig } from './config';
+export { getExpertConfig, validateExpertConfig } from './experts';