micro-models-agent 0.40.1 → 0.41.2

package/dist/modules/plugins/manager.js

@@ -1,14 +1,44 @@
+import { semverGt } from "../updater/checker";
 export class PluginManager {
     plugins = [];
-    register(plugin) {
+    /**
+     * Register a plugin. Plugins with the same `name` are deduplicated — the
+     * higher `version` wins (unversioned plugins count as "0.0.0"). The loser is
+     * discarded; `skipped_older` lets the caller warn about the dropped copy.
+     */
+    register(plugin, source) {
+        if (source)
+            plugin.source = source;
+        const existing = this.plugins.find((p) => p.name === plugin.name);
+        if (existing) {
+            if (semverGt(plugin.version || "0.0.0", existing.version || "0.0.0")) {
+                this.plugins = this.plugins.filter((p) => p.name !== plugin.name);
+                this.plugins.push(plugin);
+                this.sort();
+                return { status: "registered" };
+            }
+            return { status: "skipped_older", existing };
+        }
         this.plugins.push(plugin);
+        this.sort();
+        return { status: "registered" };
+    }
+    sort() {
         this.plugins.sort((a, b) => (b.priority || 0) - (a.priority || 0));
     }
     getAllPlugins() {
         return [...this.plugins];
     }
+    /** Detailed plugin list (name, version, source) for REPL / CLI display. */
+    getPluginInfos() {
+        return [...this.plugins].map((plugin) => ({ plugin, source: plugin.source }));
+    }
+    /** Find a registered plugin by name, or null. */
+    getPlugin(name) {
+        return this.plugins.find((p) => p.name === name) ?? null;
+    }
     runOnBuildPrompt() {
-        return this.plugins.map(p => {
+        return this.plugins.map((p) => {
             try {
                 return p.onBuildPrompt?.() ?? null;
             }
@@ -25,7 +55,9 @@ export class PluginManager {
                     if (result === false)
                         return false;
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
         return true;
@@ -36,7 +68,9 @@ export class PluginManager {
                 try {
                     await plugin.onAfterTool(ctx, call, result);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -46,7 +80,9 @@ export class PluginManager {
                 try {
                     await plugin.onError(ctx, error);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -56,7 +92,9 @@ export class PluginManager {
                 try {
                     plugin.onSessionStart(ctx);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -66,7 +104,9 @@ export class PluginManager {
                 try {
                     plugin.onBeforeThink(ctx);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -76,7 +116,9 @@ export class PluginManager {
                 try {
                     plugin.onAfterThink(ctx, response);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -86,7 +128,9 @@ export class PluginManager {
                 try {
                     plugin.onSessionEnd(ctx);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -96,7 +140,9 @@ export class PluginManager {
                 try {
                     plugin.onToolCall(ctx);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -106,7 +152,9 @@ export class PluginManager {
                 try {
                     plugin.onPhase(ctx, phase);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -116,7 +164,9 @@ export class PluginManager {
                 try {
                     plugin.onToolStart(ctx, call);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -126,7 +176,9 @@ export class PluginManager {
                 try {
                     plugin.onToolEnd(ctx, call, result, durationMs);
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
     }
@@ -136,10 +188,12 @@ export class PluginManager {
             if (plugin.onText) {
                 try {
                     const out = plugin.onText(ctx, chunk);
-                    if (typeof out === 'string')
+                    if (typeof out === "string")
                         chunk = out;
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
         return chunk;
@@ -150,10 +204,12 @@ export class PluginManager {
             if (plugin.onMeta) {
                 try {
                     const out = plugin.onMeta(ctx, chunk);
-                    if (typeof out === 'string')
+                    if (typeof out === "string")
                         chunk = out;
                 }
-                catch { /* error isolation */ }
+                catch {
+                    /* error isolation */
+                }
             }
         }
         return chunk;

package/dist/modules/processes/detect.js

@@ -0,0 +1,34 @@
+/**
+ * Heuristic detection of long-running (server/watch) commands.
+ *
+ * The explicit `background: true` bash parameter always wins; this list is a
+ * convenience so dev servers don't block the agent. It only inspects the raw
+ * shell command (a technical process-type decision, not task classification).
+ */
+const LONG_RUNNING_PATTERNS = [
+    /\b(npm|pnpm|yarn|bun|npx)\s+(run\s+)?(dev|start|serve|preview|watch|server)\b/i,
+    /\b(deno|node)\s+.*\b(run\s+)?(dev|serve|watch|server)\b/i,
+    /(^|\s)--watch\b/i,
+    /(^|\s)-w\b/i,
+    /\bnodemon\b/i,
+    /\btsx watch\b/i,
+    /\b(ts-node|tsc)\s+.*--watch\b/i,
+    /\bvite(?!\s+(build|create))\b/i,
+    /\bwebpack(-dev-server|\s+serve)\b/i,
+    /\bastro dev\b/i,
+    /\bnext (dev|start)\b/i,
+    /\bnuxt (dev|start)\b/i,
+    /\bsvelte-kit (dev|preview)\b/i,
+    /\bgatsby develop\b/i,
+    /\bdocker(-compose)?\s+.*\bup\b/i,
+    /\buvicorn\b|\bgunicorn\b/i,
+    /\bpython\s+-m\s+http\.server\b/i,
+    /\bflask run\b/i,
+    /\bphp artisan serve\b/i,
+    /\brails (server|s)\b/i,
+    /\bvitest watch\b/i,
+    /\bjest --watch\b/i,
+];
+export function isLongRunningCommand(command) {
+    return LONG_RUNNING_PATTERNS.some((pattern) => pattern.test(command));
+}

package/dist/modules/processes/index.js

@@ -1,2 +1,2 @@
-export { registerKillable, unregisterKillable, killByCallId, } from "./runner";
+export { registerKillable, unregisterKillable, killByCallId } from "./runner";
 export { processRegistry } from "./registry";

package/dist/modules/processes/registry.js

@@ -3,21 +3,107 @@ import { platform } from "os";
 const MAX_LOG_LINES = 2000;
 const MAX_KEPT_PROCESSES = 20;
 let seq = 0;
-function killTree(child) {
-    const pid = child.pid;
-    if (!pid)
-        return;
-    if (platform() === "win32") {
+/** OEM decoder (Russian CP866 / active code page) — cached after first use. */
+let oemDecoder;
+function getOemDecoder() {
+    if (oemDecoder !== undefined)
+        return oemDecoder;
+    oemDecoder = null;
+    try {
+        const cpOut = spawnSync("chcp.com", {
+            encoding: "buffer",
+            timeout: 2000,
+            windowsHide: true,
+        }).stdout;
+        const m = cpOut ? cpOut.toString("latin1").match(/(\d+)/) : null;
+        if (m) {
+            try {
+                oemDecoder = new TextDecoder("ibm" + m[1]);
+            }
+            catch {
+                oemDecoder = null;
+            }
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    if (!oemDecoder) {
         try {
-            spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], {
-                windowsHide: true,
-                stdio: "ignore",
-                timeout: 3000,
-            });
+            oemDecoder = new TextDecoder("ibm866");
         }
         catch {
-            /* already dead */
+            oemDecoder = null;
+        }
+    }
+    return oemDecoder;
+}
+/**
+ * Decode one complete line of output to UTF-8.
+ *
+ * Modern tools (Bun, Node, npm, git) write UTF-8 into the pipe regardless of
+ * the console code page, while built-in cmd.exe commands (echo, type, dir)
+ * emit the OEM code page (CP866 on Russian Windows). Try strict UTF-8 first;
+ * fall back to the OEM decoder when the bytes are not valid UTF-8.
+ */
+function decodeLineToUtf8(buf) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(buf);
+    }
+    catch {
+        /* not valid UTF-8 → OEM code page output */
+    }
+    const oem = getOemDecoder();
+    if (oem) {
+        try {
+            return oem.decode(buf);
+        }
+        catch {
+            /* unknown encoding — latin1 fallback */
         }
+    }
+    return buf.toString("latin1");
+}
+/** Synchronous pause without blocking the event loop (via Atomics.wait). */
+function sleepSync(ms) {
+    try {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+    }
+    catch {
+        /* ignore */
+    }
+}
+function taskkillPid(pid) {
+    try {
+        spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], {
+            windowsHide: true,
+            stdio: "ignore",
+            timeout: 5000,
+        });
+    }
+    catch {
+        /* already dead */
+    }
+}
+/**
+ * Kill a spawned tree on Windows.
+ *
+ * `taskkill /T` has a race: when cmd.exe is killed, a child (node) that is
+ * still starting up can survive as an orphan because it was never attached to
+ * the tree at kill time. A single pass misses it. Running taskkill twice with
+ * a settle gap catches those late starters on the second pass — the second
+ * tree walk sees the child that was still being created during the first one.
+ * This is much cheaper than enumerating processes (wmic/PowerShell), which
+ * slows every kill down to seconds under parallel load.
+ */
+export function killTree(child) {
+    const pid = child.pid;
+    if (!pid)
+        return;
+    if (platform() === "win32") {
+        taskkillPid(pid);
+        sleepSync(150);
+        taskkillPid(pid);
         return;
     }
     try {
@@ -73,31 +159,10 @@ class ProcessRegistry {
         }
         this.children.set(id, child);
         entry.pid = child.pid ?? 0;
-        // On Windows, children spawned via cmd.exe output in the OEM code page,
-        // NOT UTF-8. Detect the active code page via chcp.com; fall back to
-        // ibm866 (Russian CP866) when detection fails — still correct for the
-        // majority of users, and always better than the UTF-8 default.
-        const decoder = platform() === "win32"
-            ? (() => {
-                try {
-                    const cpOut = require("child_process")
-                        .execSync("chcp.com", {
-                        encoding: "buffer",
-                        timeout: 2000,
-                        windowsHide: true,
-                    })
-                        .toString("latin1");
-                    const m = cpOut.match(/(\d+)/);
-                    if (m)
-                        return new TextDecoder("ibm" + m[1]);
-                }
-                catch {
-                    /* ignore */
-                }
-                return new TextDecoder("ibm866");
-            })()
-            : new TextDecoder("utf-8");
         let buf = "";
+        let byteBuf = Buffer.alloc(0);
+        const isWin = platform() === "win32";
+        const unixDecoder = new TextDecoder("utf-8");
         const pushLine = (line) => {
             if (entry.log.length >= MAX_LOG_LINES) {
                 entry.log.shift();
@@ -105,19 +170,40 @@ class ProcessRegistry {
             entry.log.push(line);
         };
         const append = (chunk) => {
-            const decoded = decoder.decode(chunk, { stream: true });
-            buf += decoded;
-            const lines = buf.split(/\r?\n/);
-            buf = lines.pop() ?? "";
-            for (const line of lines) {
-                pushLine(line);
+            if (!isWin) {
+                const decoded = unixDecoder.decode(chunk, { stream: true });
+                buf += decoded;
+                const lines = buf.split(/\r?\n/);
+                buf = lines.pop() ?? "";
+                for (const line of lines) {
+                    pushLine(line);
+                }
+                return;
+            }
+            // Windows: buffer raw bytes and decode per line. Modern tools (Bun, Node,
+            // npm, git) write UTF-8 into the pipe regardless of the console code
+            // page; cmd.exe builtins (echo, type, dir) emit the OEM code page. Pick
+            // the right decoding per line so Russian text survives either way.
+            byteBuf = byteBuf.length ? Buffer.concat([byteBuf, chunk]) : Buffer.from(chunk);
+            let nl;
+            while ((nl = byteBuf.indexOf(0x0a)) !== -1) {
+                const raw = byteBuf.subarray(0, nl);
+                byteBuf = byteBuf.subarray(nl + 1);
+                pushLine(decodeLineToUtf8(raw).replace(/\r$/, ""));
             }
         };
         const flush = () => {
-            buf += decoder.decode();
-            if (buf) {
-                pushLine(buf);
-                buf = "";
+            if (!isWin) {
+                buf += unixDecoder.decode();
+                if (buf) {
+                    pushLine(buf);
+                    buf = "";
+                }
+                return;
+            }
+            if (byteBuf.length) {
+                pushLine(decodeLineToUtf8(byteBuf));
+                byteBuf = Buffer.alloc(0);
             }
         };
         const resolveExit = () => {
@@ -130,7 +216,10 @@ class ProcessRegistry {
                 entry.status = "killed";
             }
             entry.spawnError = err.message;
-            append(Buffer.from(`[process error] ${err.message}`));
+            // Write directly to the log, not through `append`: a failed spawn often
+            // never emits `close`, so the buffered line would never be flushed and
+            // the log would be empty (observed: "records a spawn error" test).
+            pushLine(`[process error] ${err.message}`);
             resolveExit();
         });
         child.on("close", (code) => {

package/dist/modules/registry.js

@@ -9,9 +9,11 @@ export class ModuleRegistry {
     listModules() {
         return Array.from(this.modules.keys()).sort();
     }
-    collectPromptBlocks() {
+    collectPromptBlocks(exclude = []) {
         const blocks = [];
-        for (const mod of this.modules.values()) {
+        for (const [name, mod] of this.modules) {
+            if (exclude.includes(name))
+                continue;
             if (mod.getSystemPromptBlock) {
                 const block = mod.getSystemPromptBlock();
                 if (block)

package/dist/modules/security/audit-notifier.js

@@ -1,6 +1,6 @@
-import { writeFileSync, appendFileSync, existsSync, mkdirSync } from 'fs';
-import { join, dirname } from 'path';
-import { homedir } from 'os';
+import { writeFileSync, appendFileSync, existsSync, mkdirSync } from "fs";
+import { join, dirname } from "path";
+import { homedir } from "os";
 /**
  * Severity weights for comparison
  */
@@ -15,16 +15,16 @@ const SEVERITY_WEIGHTS = {
  */
 export const DEFAULT_AUDIT_NOTIFIER_CONFIG = {
     enabled: false,
-    filePath: join(homedir(), '.mma', 'logs', 'audit-notifications.jsonl'),
+    filePath: join(homedir(), ".mma", "logs", "audit-notifications.jsonl"),
     webhookTimeout: 5000,
-    minSeverity: 'medium',
+    minSeverity: "medium",
     eventTypes: [
-        'security_block',
-        'bash_command',
-        'file_operation',
-        'network_request',
-        'authentication',
-        'configuration_change',
+        "security_block",
+        "bash_command",
+        "file_operation",
+        "network_request",
+        "authentication",
+        "configuration_change",
     ],
     maxRetries: 3,
 };
@@ -85,7 +85,7 @@ export class AuditNotifier {
      * Check if a severity level should be notified
      */
     shouldNotifySeverity(severity) {
-        const minSeverity = this.config.minSeverity ?? 'medium';
+        const minSeverity = this.config.minSeverity ?? "medium";
         const minWeight = SEVERITY_WEIGHTS[minSeverity];
         const eventWeight = SEVERITY_WEIGHTS[severity];
         return eventWeight >= minWeight;
@@ -123,12 +123,12 @@ export class AuditNotifier {
      */
     mapEventType(action) {
         const typeMap = {
-            'tool_call': 'tool_call',
-            'bash_command': 'bash_command',
-            'file_write': 'file_operation',
-            'file_delete': 'file_operation',
-            'network_request': 'network_request',
-            'security_block': 'security_block',
+            tool_call: "tool_call",
+            bash_command: "bash_command",
+            file_write: "file_operation",
+            file_delete: "file_operation",
+            network_request: "network_request",
+            security_block: "security_block",
         };
         return typeMap[action] || null;
     }
@@ -138,16 +138,16 @@ export class AuditNotifier {
     determineSeverity(entry) {
         // Default severity based on action type
         const typeSeverity = {
-            'security_block': 'high',
-            'bash_command': 'high',
-            'file_delete': 'medium',
-            'file_write': 'medium',
-            'network_request': 'medium',
-            'tool_call': 'low',
-            'session_start': 'low',
-            'session_end': 'low',
+            security_block: "high",
+            bash_command: "high",
+            file_delete: "medium",
+            file_write: "medium",
+            network_request: "medium",
+            tool_call: "low",
+            session_start: "low",
+            session_end: "low",
         };
-        return typeSeverity[entry.action] || 'low';
+        return typeSeverity[entry.action] || "low";
     }
     /**
      * Write notification to file
@@ -157,10 +157,10 @@ export class AuditNotifier {
             return;
         try {
             const line = JSON.stringify(notification);
-            appendFileSync(this.config.filePath, line + '\n', 'utf8');
+            appendFileSync(this.config.filePath, line + "\n", "utf8");
         }
         catch (error) {
-            console.error('[AuditNotifier] Failed to write to file:', error);
+            console.error("[AuditNotifier] Failed to write to file:", error);
         }
     }
     /**
@@ -173,8 +173,8 @@ export class AuditNotifier {
             const controller = new AbortController();
             const timeoutId = setTimeout(() => controller.abort(), this.config.webhookTimeout);
             const response = await fetch(this.config.webhookUrl, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
                 body: JSON.stringify(notification),
                 signal: controller.signal,
             });
@@ -184,7 +184,7 @@ export class AuditNotifier {
             }
         }
         catch (error) {
-            console.error('[AuditNotifier] Webhook failed, adding to retry queue:', error);
+            console.error("[AuditNotifier] Webhook failed, adding to retry queue:", error);
             this.addToRetryQueue(notification);
         }
     }
@@ -207,7 +207,7 @@ export class AuditNotifier {
         while (this.retryQueue.length > 0) {
             const item = this.retryQueue[0];
             if (item.retries >= (this.config.maxRetries ?? 3)) {
-                console.error('[AuditNotifier] Max retries exceeded for notification:', item.entry);
+                console.error("[AuditNotifier] Max retries exceeded for notification:", item.entry);
                 this.retryQueue.shift();
                 continue;
             }
@@ -219,7 +219,7 @@ export class AuditNotifier {
                 item.retries++;
                 // Exponential backoff
                 const delay = Math.pow(2, item.retries) * 1000;
-                await new Promise(resolve => setTimeout(resolve, delay));
+                await new Promise((resolve) => setTimeout(resolve, delay));
             }
         }
         this.isProcessing = false;
@@ -232,9 +232,9 @@ export class AuditNotifier {
             return [];
         }
         try {
-            const content = readFileSync(this.config.filePath, 'utf8');
-            const lines = content.split('\n').filter(Boolean);
-            return lines.slice(-limit).map(line => JSON.parse(line));
+            const content = readFileSync(this.config.filePath, "utf8");
+            const lines = content.split("\n").filter(Boolean);
+            return lines.slice(-limit).map((line) => JSON.parse(line));
         }
         catch {
             return [];
@@ -245,7 +245,7 @@ export class AuditNotifier {
      */
     clearNotifications() {
         if (this.config.filePath) {
-            writeFileSync(this.config.filePath, '', 'utf8');
+            writeFileSync(this.config.filePath, "", "utf8");
         }
         this.retryQueue = [];
     }
@@ -289,4 +289,4 @@ export function createAuditNotifier(config) {
     return new AuditNotifier(config);
 }
 // Import readFileSync for readNotifications
-import { readFileSync } from 'fs';
+import { readFileSync } from "fs";

package/dist/modules/security/command-validator.js

@@ -46,11 +46,7 @@ function extractBaseCommand(trimmed) {
             i++;
             continue;
         }
-        if (tok === "sudo" ||
-            tok === "env" ||
-            tok === "command" ||
-            tok === "exec" ||
-            tok === "nohup") {
+        if (tok === "sudo" || tok === "env" || tok === "command" || tok === "exec" || tok === "nohup") {
             i++;
             continue;
         }
@@ -150,9 +146,7 @@ export function isCommandAllowed(command, securityConfig) {
         };
     }
     // Also check the raw first token in case it's a simple name
-    const rawFirst = trimmedCommand
-        .split(/\s+/)[0]
-        .replace(/\.(exe|cmd|bat)$/i, "");
+    const rawFirst = trimmedCommand.split(/\s+/)[0].replace(/\.(exe|cmd|bat)$/i, "");
     if (rawFirst !== baseCommand && config.blacklist.includes(rawFirst)) {
         return {
             allowed: false,

package/dist/modules/security/data-sanitizer.js

@@ -73,15 +73,7 @@ export function sanitizeCommand(command) {
 export function sanitizeUrl(url) {
     try {
         const urlObj = new URL(url);
-        const sensitiveKeys = [
-            "api_key",
-            "token",
-            "password",
-            "secret",
-            "access_token",
-            "auth",
-            "key",
-        ];
+        const sensitiveKeys = ["api_key", "token", "password", "secret", "access_token", "auth", "key"];
         const sanitizedParams = new URLSearchParams(urlObj.search);
         for (const key of sensitiveKeys) {
             if (sanitizedParams.has(key)) {