micro-models-agent 0.39.0 → 0.40.0

package/dist/modules/security/command-validator.js

@@ -1,11 +1,25 @@
 import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
 // Fallback in case DEFAULT_SECURITY_CONFIG is not available
 const FALLBACK_BASH_CONFIG = {
-    blacklist: ['rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat', 'powershell', 'pwsh', 'cmd'],
+    enabled: false,
+    blacklist: [
+        "rm",
+        "dd",
+        "chmod",
+        "wget",
+        "curl",
+        "scp",
+        "ssh",
+        "nc",
+        "netcat",
+        "powershell",
+        "pwsh",
+        "cmd",
+    ],
     whitelist: [],
     blockDangerousFlags: false,
-    dangerousFlags: ['--force', '-rf', '--no-preserve-root'],
-    dangerousOperators: ['>', '>>', '2>', '2>>', '|', '&&', '||', ';', '`'],
+    dangerousFlags: ["--force", "-rf", "--no-preserve-root"],
+    dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "`"],
     logCommands: true,
 };
 export const DEFAULT_BASH_CONFIG = DEFAULT_SECURITY_CONFIG?.bash || FALLBACK_BASH_CONFIG;
@@ -32,7 +46,11 @@ function extractBaseCommand(trimmed) {
             i++;
             continue;
         }
-        if (tok === "sudo" || tok === "env" || tok === "command" || tok === "exec" || tok === "nohup") {
+        if (tok === "sudo" ||
+            tok === "env" ||
+            tok === "command" ||
+            tok === "exec" ||
+            tok === "nohup") {
             i++;
             continue;
         }
@@ -45,7 +63,7 @@ function extractBaseCommand(trimmed) {
     const parts = raw.split(/[\\/]/);
     const basename = parts[parts.length - 1] || raw;
     // Strip .exe/.cmd/.bat extensions for blacklist matching (e.g. powershell.exe → powershell)
-    return basename.replace(/\.(exe|cmd|bat)$/i, '') || basename;
+    return basename.replace(/\.(exe|cmd|bat)$/i, "") || basename;
 }
 /**
  * Check if a shell operator appears as a standalone token in the command.
@@ -56,16 +74,16 @@ function extractBaseCommand(trimmed) {
  *   "2>" does NOT match "2>>" (append stderr)
  */
 function containsOperator(command, op) {
-    const escaped = op.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const escaped = op.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     // For single-char operators that are prefixes of multi-char ones,
     // ensure they don't match when part of a longer sequence.
     // Note: "&" is no longer in dangerousOperators (&& is legitimate),
     // but keep the special case for defense-in-depth if manually added.
-    if (op === '&')
+    if (op === "&")
         return /(?<!&)&(?!&)/.test(command);
-    if (op === '|')
+    if (op === "|")
         return /(?<!\|)\|(?!\|)/.test(command);
-    if (op === '>')
+    if (op === ">")
         return /(?<!>)>(?!>)/.test(command);
     // For everything else (including multi-char like ">>", "2>", "2>>", ";", "`"),
     // match literally.
@@ -75,11 +93,17 @@ function containsOperator(command, op) {
  * Check if a command is allowed based on security configuration
  */
 export function isCommandAllowed(command, securityConfig) {
-    // If no security config, allow everything (backward compatibility)
-    let config = securityConfig || DEFAULT_BASH_CONFIG;
+    // If security is disabled, allow everything
+    if (!securityConfig?.enabled) {
+        return { allowed: true, sanitizedCommand: command };
+    }
     // Ensure config has all required fields
+    let config = securityConfig;
     if (!config.blacklist || !Array.isArray(config.blacklist)) {
-        config = FALLBACK_BASH_CONFIG;
+        config = {
+            ...FALLBACK_BASH_CONFIG,
+            enabled: config.enabled ?? FALLBACK_BASH_CONFIG.enabled,
+        };
     }
     const trimmedCommand = command.trim();
     if (!trimmedCommand) {
@@ -87,7 +111,7 @@ export function isCommandAllowed(command, securityConfig) {
     }
     // Shell wrappers are always blocked — they bypass all command validation.
     // The agent should use the bash tool directly, not shell interpreters.
-    const ALWAYS_BLOCKED = ['powershell', 'pwsh', 'cmd'];
+    const ALWAYS_BLOCKED = ["powershell", "pwsh", "cmd"];
     const baseForShellCheck = extractBaseCommand(trimmedCommand);
     if (ALWAYS_BLOCKED.includes(baseForShellCheck)) {
         return {
@@ -126,7 +150,9 @@ export function isCommandAllowed(command, securityConfig) {
         };
     }
     // Also check the raw first token in case it's a simple name
-    const rawFirst = trimmedCommand.split(/\s+/)[0].replace(/\.(exe|cmd|bat)$/i, '');
+    const rawFirst = trimmedCommand
+        .split(/\s+/)[0]
+        .replace(/\.(exe|cmd|bat)$/i, "");
     if (rawFirst !== baseCommand && config.blacklist.includes(rawFirst)) {
         return {
             allowed: false,
@@ -170,7 +196,7 @@ export function sanitizeCommandForLog(command) {
     ];
     let sanitized = command;
     for (const pattern of patterns) {
-        if (pattern.toString().includes('($1')) {
+        if (pattern.toString().includes("($1")) {
             // For patterns with capture groups, use the group in replacement
             sanitized = sanitized.replace(pattern, (match, p1) => {
                 return `${p1}=[REDACTED]`;
@@ -178,7 +204,7 @@ export function sanitizeCommandForLog(command) {
         }
         else {
             // For simple patterns, just replace with [REDACTED]
-            sanitized = sanitized.replace(pattern, '[REDACTED]');
+            sanitized = sanitized.replace(pattern, "[REDACTED]");
         }
     }
     return sanitized;

package/dist/modules/security/content-scanner.js

@@ -1,5 +1,9 @@
 /**
- * Default dangerous patterns to scan for in file content
+ * Default dangerous patterns to scan for in file content.
+ * NOTE: only genuinely dangerous constructs are listed. Legitimate runtime
+ * APIs (process.exit, setTimeout/setInterval, template literals `${}`,
+ * backtick strings) are NOT scanned — they are valid JS/TS and blocking
+ * them breaks ordinary CLI code (false positives).
  */
 const DEFAULT_DANGEROUS_PATTERNS = [
     /eval\(/gi,
@@ -11,9 +15,6 @@ const DEFAULT_DANGEROUS_PATTERNS = [
     /require\('net'\).createServer/gi,
     /require\('fs'\).writeFileSync/gi,
     /require\('fs'\).unlinkSync/gi,
-    /process\.exit\(/gi,
-    /setInterval\(/gi,
-    /setTimeout\(/gi,
     /while\(true\)/gi,
     /for\(;;\)/gi,
     /rm -rf/gi,
@@ -21,8 +22,6 @@ const DEFAULT_DANGEROUS_PATTERNS = [
     /chmod 777/gi,
     /wget.*\|.*sh/gi,
     /curl.*\|.*sh/gi,
-    /\$\{/gi,
-    /`[^`]+`/gi,
 ];
 /**
  * Scan file content for dangerous patterns
@@ -33,7 +32,9 @@ export function scanContent(content, filePath, config) {
         return { allowed: true };
     }
     // Use default patterns if none provided
-    const patterns = config.dangerousPatterns?.length ? config.dangerousPatterns : DEFAULT_DANGEROUS_PATTERNS;
+    const patterns = config.dangerousPatterns?.length
+        ? config.dangerousPatterns
+        : DEFAULT_DANGEROUS_PATTERNS;
     const matches = [];
     for (const pattern of patterns) {
         const match = content.match(pattern);
@@ -44,7 +45,7 @@ export function scanContent(content, filePath, config) {
     if (matches.length > 0) {
         return {
             allowed: false,
-            reason: `Content contains dangerous patterns: ${matches.slice(0, 3).join(", ")}`,
+            reason: `Content contains dangerous patterns in ${filePath}: ${matches.slice(0, 3).join(", ")}`,
             matches,
         };
     }

package/dist/modules/security/network-validator.js

@@ -3,8 +3,8 @@ import { sanitizeLogMessage } from "./data-sanitizer";
  * Check if a URL is allowed based on security configuration
  */
 export function isUrlAllowed(url, securityConfig) {
-    // If no security config, allow everything (backward compatibility)
-    if (!securityConfig) {
+    // If security is disabled, allow everything
+    if (!securityConfig?.enabled) {
         return { allowed: true };
     }
     try {

package/dist/modules/security/path-validator.js

@@ -8,13 +8,36 @@ export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
     const targetResolved = resolve(baseDir, normalize(targetPath));
     // First, check that path is within baseDir
     if (!targetResolved.startsWith(baseResolved)) {
-        return { allowed: false, reason: "Path is outside the base working directory" };
+        return {
+            allowed: false,
+            reason: "Path is outside the base working directory",
+        };
+    }
+    // If security is disabled, skip pattern validation
+    if (!securityConfig?.enabled) {
+        // Still enforce subagent scope if present
+        if (scope) {
+            const isReadScope = scope.read_only_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+            const isWriteScope = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+            if (isWriteScope)
+                return { allowed: true };
+            if (isReadScope)
+                return { allowed: true, reason: "Read-only file" };
+            return {
+                allowed: false,
+                reason: "Path is not within the allowed scope for this sub-agent",
+            };
+        }
+        return { allowed: true };
     }
     // Check global denied patterns
     if (securityConfig?.denied?.length) {
         for (const pattern of securityConfig.denied) {
             if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
-                return { allowed: false, reason: `Path matches denied pattern: ${pattern}` };
+                return {
+                    allowed: false,
+                    reason: `Path matches denied pattern: ${pattern}`,
+                };
             }
         }
     }
@@ -28,7 +51,10 @@ export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
             }
         }
         if (!isAllowed) {
-            return { allowed: false, reason: "Path does not match any allowed pattern" };
+            return {
+                allowed: false,
+                reason: "Path does not match any allowed pattern",
+            };
         }
     }
     // Check tool-specific scope (for subagents)
@@ -54,13 +80,33 @@ export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
     const targetResolved = resolve(baseDir, normalize(targetPath));
     // First, check that path is within baseDir
     if (!targetResolved.startsWith(baseResolved)) {
-        return { allowed: false, reason: "Path is outside the base working directory" };
+        return {
+            allowed: false,
+            reason: "Path is outside the base working directory",
+        };
+    }
+    // If security is disabled, skip pattern validation
+    if (!securityConfig?.enabled) {
+        // Still enforce subagent scope if present
+        if (scope) {
+            const isWriteScope = scope.allowed_files.some((f) => targetResolved.startsWith(resolve(baseDir, f)));
+            if (isWriteScope)
+                return { allowed: true };
+            return {
+                allowed: false,
+                reason: "Path is not within the allowed scope for this sub-agent",
+            };
+        }
+        return { allowed: true };
     }
     // Check global denied patterns
     if (securityConfig?.denied?.length) {
         for (const pattern of securityConfig.denied) {
             if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
-                return { allowed: false, reason: `Path matches denied pattern: ${pattern}` };
+                return {
+                    allowed: false,
+                    reason: `Path matches denied pattern: ${pattern}`,
+                };
             }
         }
     }
@@ -74,7 +120,10 @@ export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
             }
         }
         if (!isAllowed) {
-            return { allowed: false, reason: "Path does not match any allowed pattern" };
+            return {
+                allowed: false,
+                reason: "Path does not match any allowed pattern",
+            };
         }
     }
     // Check tool-specific scope (for subagents)
@@ -105,7 +154,8 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
             return true;
         }
         // Check if target is inside the directory
-        if (resolvedTargetPath.startsWith(resolvedDirPattern + "/") || resolvedTargetPath.startsWith(resolvedDirPattern + "\\")) {
+        if (resolvedTargetPath.startsWith(resolvedDirPattern + "/") ||
+            resolvedTargetPath.startsWith(resolvedDirPattern + "\\")) {
             return true;
         }
         return false;
@@ -116,7 +166,8 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
         const prefix = parts[0];
         const suffix = parts[1];
         const resolvedPrefix = resolve(baseDir, prefix);
-        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") && !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
+        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") &&
+            !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
             return false;
         }
         const remainingPath = resolvedTargetPath.slice(resolvedPrefix.length);
@@ -132,7 +183,8 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
         const prefix = parts[0];
         const suffix = parts[1];
         const resolvedPrefix = resolve(baseDir, prefix);
-        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") && !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
+        if (!resolvedTargetPath.startsWith(resolvedPrefix + "/") &&
+            !resolvedTargetPath.startsWith(resolvedPrefix + "\\")) {
             return false;
         }
         if (!suffix) {
@@ -147,7 +199,9 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
             .replace(/\?/g, ".")
             .replace(/\./g, "\\.");
         const regex = new RegExp(`^${regexPattern}$`);
-        const relativePath = resolvedTargetPath.slice(resolvedBaseDir.length + 1).replace(/\\/g, "/");
+        const relativePath = resolvedTargetPath
+            .slice(resolvedBaseDir.length + 1)
+            .replace(/\\/g, "/");
         return regex.test(relativePath);
     }
     // Exact match