micro-models-agent 0.40.1 → 0.41.2

package/dist/modules/security/encryption.js

@@ -1,10 +1,10 @@
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
-import { homedir } from 'os';
-import { join } from 'path';
-import { readFileSync, writeFileSync, existsSync, copyFileSync } from 'fs';
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+import { homedir } from "os";
+import { join } from "path";
+import { readFileSync, writeFileSync, existsSync, copyFileSync } from "fs";
 const DEFAULT_CONFIG = {
-    keyPath: join(homedir(), '.mma', '.encryption-key'),
-    algorithm: 'aes-256-gcm',
+    keyPath: join(homedir(), ".mma", ".encryption-key"),
+    algorithm: "aes-256-gcm",
 };
 const IV_LENGTH = 16;
 const SALT_LENGTH = 16;
@@ -22,7 +22,7 @@ export function generateEncryptionKey() {
 export function getOrCreateEncryptionKey(config) {
     const { keyPath } = { ...DEFAULT_CONFIG, ...config };
     // Ensure directory exists
-    const dir = join(keyPath, '..');
+    const dir = join(keyPath, "..");
     if (!existsSync(dir)) {
         // Note: We can't use mkdirSync here because we're in a pure function
         // This will be handled by the caller
@@ -30,7 +30,7 @@ export function getOrCreateEncryptionKey(config) {
     if (!existsSync(keyPath)) {
         const key = generateEncryptionKey();
         try {
-            writeFileSync(keyPath, key.toString('base64'), { mode: 0o600 });
+            writeFileSync(keyPath, key.toString("base64"), { mode: 0o600 });
             return key;
         }
         catch {
@@ -40,8 +40,8 @@ export function getOrCreateEncryptionKey(config) {
         }
     }
     try {
-        const keyBase64 = readFileSync(keyPath, 'utf8');
-        return Buffer.from(keyBase64, 'base64');
+        const keyBase64 = readFileSync(keyPath, "utf8");
+        return Buffer.from(keyBase64, "base64");
     }
     catch {
         // Backup the corrupted key file before throwing
@@ -49,7 +49,9 @@ export function getOrCreateEncryptionKey(config) {
             const backupPath = `${keyPath}.corrupted.${Date.now()}`;
             copyFileSync(keyPath, backupPath);
         }
-        catch { /* backup failed, continue */ }
+        catch {
+            /* backup failed, continue */
+        }
         throw new Error(`Encryption key file is corrupted or unreadable: ${keyPath}. ` +
             `All previously encrypted data will be unrecoverable. ` +
             `Delete the key file to generate a new one.`);
@@ -68,63 +70,63 @@ export function encryptString(plaintext, key) {
     const hmacSalt = Buffer.concat([salt, Buffer.from([1, 2, 3, 4])]);
     const hmacKey = scryptSync(key, hmacSalt, KEY_LENGTH);
     // Encrypt with AES-256-CBC
-    const cipher = createCipheriv('aes-256-cbc', encKey, iv);
-    let encrypted = cipher.update(plaintext, 'utf8', 'base64');
-    encrypted += cipher.final('base64');
+    const cipher = createCipheriv("aes-256-cbc", encKey, iv);
+    let encrypted = cipher.update(plaintext, "utf8", "base64");
+    encrypted += cipher.final("base64");
     // Create HMAC for authentication
-    const hmac = createHmac('sha256', hmacKey);
+    const hmac = createHmac("sha256", hmacKey);
     hmac.update(iv);
-    hmac.update(Buffer.from(encrypted, 'base64'));
+    hmac.update(Buffer.from(encrypted, "base64"));
     const authTag = hmac.digest();
     // Format: salt:iv:authTag:encrypted
-    return `${salt.toString('base64')}:${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted}`;
+    return `${salt.toString("base64")}:${iv.toString("base64")}:${authTag.toString("base64")}:${encrypted}`;
 }
 /**
  * Decrypt a string using AES-256-CBC + HMAC
  */
 export function decryptString(encryptedText, key) {
-    const parts = encryptedText.split(':');
+    const parts = encryptedText.split(":");
     if (parts.length !== 4) {
-        throw new Error('Invalid encrypted format');
+        throw new Error("Invalid encrypted format");
     }
-    const salt = Buffer.from(parts[0], 'base64');
-    const iv = Buffer.from(parts[1], 'base64');
-    const authTag = Buffer.from(parts[2], 'base64');
+    const salt = Buffer.from(parts[0], "base64");
+    const iv = Buffer.from(parts[1], "base64");
+    const authTag = Buffer.from(parts[2], "base64");
     const encrypted = parts[3];
     // Derive encryption key and HMAC key from the main key
     const encKey = scryptSync(key, salt, KEY_LENGTH);
     const hmacSalt = Buffer.concat([salt, Buffer.from([1, 2, 3, 4])]);
     const hmacKey = scryptSync(key, hmacSalt, KEY_LENGTH);
     // Verify HMAC
-    const hmac = createHmac('sha256', hmacKey);
+    const hmac = createHmac("sha256", hmacKey);
     hmac.update(iv);
-    hmac.update(Buffer.from(encrypted, 'base64'));
+    hmac.update(Buffer.from(encrypted, "base64"));
     const computedTag = hmac.digest();
     if (!computedTag.equals(authTag)) {
-        throw new Error('Authentication failed: invalid tag');
+        throw new Error("Authentication failed: invalid tag");
     }
     // Decrypt with AES-256-CBC
-    const decipher = createDecipheriv('aes-256-cbc', encKey, iv);
-    let decrypted = decipher.update(encrypted, 'base64', 'utf8');
-    decrypted += decipher.final('utf8');
+    const decipher = createDecipheriv("aes-256-cbc", encKey, iv);
+    let decrypted = decipher.update(encrypted, "base64", "utf8");
+    decrypted += decipher.final("utf8");
     return decrypted;
 }
-import { createHmac } from 'node:crypto';
+import { createHmac } from "node:crypto";
 /**
  * Check if a string looks like it's encrypted
  */
 export function isEncryptedString(value) {
     // Encrypted strings have the format: salt:iv:authTag:encrypted
     // Each part is base64 encoded and separated by colons
-    const parts = value.split(':');
+    const parts = value.split(":");
     if (parts.length !== 4)
         return false;
     // Check if all parts are valid base64
     try {
-        Buffer.from(parts[0], 'base64');
-        Buffer.from(parts[1], 'base64');
-        Buffer.from(parts[2], 'base64');
-        Buffer.from(parts[3], 'base64');
+        Buffer.from(parts[0], "base64");
+        Buffer.from(parts[1], "base64");
+        Buffer.from(parts[2], "base64");
+        Buffer.from(parts[3], "base64");
         return true;
     }
     catch {
@@ -135,28 +137,28 @@ export function isEncryptedString(value) {
  * Sensitive field names that should be encrypted
  */
 export const SENSITIVE_FIELD_NAMES = [
-    'api_key',
-    'apikey',
-    'apiKey',
-    'token',
-    'access_token',
-    'accessToken',
-    'password',
-    'passwd',
-    'pwd',
-    'secret',
-    'private_key',
-    'privateKey',
-    'auth',
-    'authorization',
-    'key',
+    "api_key",
+    "apikey",
+    "apiKey",
+    "token",
+    "access_token",
+    "accessToken",
+    "password",
+    "passwd",
+    "pwd",
+    "secret",
+    "private_key",
+    "privateKey",
+    "auth",
+    "authorization",
+    "key",
 ];
 /**
  * Check if a field name indicates sensitive data
  */
 export function isSensitiveFieldName(fieldName) {
     const lowerFieldName = fieldName.toLowerCase();
-    return SENSITIVE_FIELD_NAMES.some(name => lowerFieldName.includes(name));
+    return SENSITIVE_FIELD_NAMES.some((name) => lowerFieldName.includes(name));
 }
 /**
  * Encrypt sensitive fields in an object
@@ -164,12 +166,12 @@ export function isSensitiveFieldName(fieldName) {
 export function encryptSensitiveFields(obj, key) {
     const result = {};
     for (const [fieldName, value] of Object.entries(obj)) {
-        if (isSensitiveFieldName(fieldName) && typeof value === 'string' && !isEncryptedString(value)) {
+        if (isSensitiveFieldName(fieldName) && typeof value === "string" && !isEncryptedString(value)) {
             result[fieldName] = encryptString(value, key);
         }
-        else if (typeof value === 'object' && value !== null) {
+        else if (typeof value === "object" && value !== null) {
             if (Array.isArray(value)) {
-                result[fieldName] = value.map(item => typeof item === 'object' && item !== null && !(item instanceof RegExp)
+                result[fieldName] = value.map((item) => typeof item === "object" && item !== null && !(item instanceof RegExp)
                     ? encryptSensitiveFields(item, key)
                     : item);
             }
@@ -192,7 +194,7 @@ export function encryptSensitiveFields(obj, key) {
 export function decryptSensitiveFields(obj, key) {
     const result = {};
     for (const [fieldName, value] of Object.entries(obj)) {
-        if (isSensitiveFieldName(fieldName) && typeof value === 'string' && isEncryptedString(value)) {
+        if (isSensitiveFieldName(fieldName) && typeof value === "string" && isEncryptedString(value)) {
             try {
                 result[fieldName] = decryptString(value, key);
             }
@@ -201,9 +203,9 @@ export function decryptSensitiveFields(obj, key) {
                 result[fieldName] = value;
             }
         }
-        else if (typeof value === 'object' && value !== null) {
+        else if (typeof value === "object" && value !== null) {
             if (Array.isArray(value)) {
-                result[fieldName] = value.map(item => typeof item === 'object' && item !== null && !(item instanceof RegExp)
+                result[fieldName] = value.map((item) => typeof item === "object" && item !== null && !(item instanceof RegExp)
                     ? decryptSensitiveFields(item, key)
                     : item);
             }

package/dist/modules/security/network-validator.js

@@ -48,15 +48,7 @@ export function isUrlAllowed(url, securityConfig) {
 export function sanitizeUrl(url) {
     try {
         const urlObj = new URL(url);
-        const sensitiveKeys = [
-            "api_key",
-            "token",
-            "password",
-            "secret",
-            "access_token",
-            "auth",
-            "key",
-        ];
+        const sensitiveKeys = ["api_key", "token", "password", "secret", "access_token", "auth", "key"];
         const sanitizedParams = new URLSearchParams(urlObj.search);
         for (const key of sensitiveKeys) {
             if (sanitizedParams.has(key)) {

package/dist/modules/security/path-validator.js

@@ -199,9 +199,7 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
             .replace(/\?/g, ".")
             .replace(/\./g, "\\.");
         const regex = new RegExp(`^${regexPattern}$`);
-        const relativePath = resolvedTargetPath
-            .slice(resolvedBaseDir.length + 1)
-            .replace(/\\/g, "/");
+        const relativePath = resolvedTargetPath.slice(resolvedBaseDir.length + 1).replace(/\\/g, "/");
         return regex.test(relativePath);
     }
     // Exact match

package/dist/modules/security/security-policies.js

@@ -1,4 +1,4 @@
-import { mergeSecurityConfig, } from "../../config/security";
+import { mergeSecurityConfig } from "../../config/security";
 /**
  * Strict security policy - maximum security, minimum flexibility
  * Recommended for: production environments, sensitive data, multi-user systems
@@ -70,18 +70,7 @@ export const STRICT_POLICY = {
                 "-R",
                 "--no-clobber",
             ],
-            dangerousOperators: [
-                ">",
-                ">>",
-                "2>",
-                "2>>",
-                "|",
-                "&&",
-                "||",
-                ";",
-                "&",
-                "`",
-            ],
+            dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "&", "`"],
             logCommands: true,
         },
         paths: {
@@ -299,12 +288,7 @@ export const BALANCED_POLICY = {
         auditNotifier: {
             enabled: false,
             minSeverity: "medium",
-            eventTypes: [
-                "security_block",
-                "bash_command",
-                "file_operation",
-                "network_request",
-            ],
+            eventTypes: ["security_block", "bash_command", "file_operation", "network_request"],
             maxRetries: 3,
         },
     },

package/dist/modules/security/session-encryption.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, existsSync, readdirSync, unlinkSync, } from "fs";
+import { readFileSync, writeFileSync, existsSync, readdirSync, unlinkSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 import { encryptString, decryptString, isEncryptedString, ConfigEncryptor, } from "./encryption";

package/dist/modules/security/session-isolation.js

@@ -1,7 +1,7 @@
-import { join, resolve } from 'path';
-import { homedir } from 'os';
-import { mkdirSync, existsSync } from 'fs';
-import { DEFAULT_SECURITY_CONFIG } from '../../config/security';
+import { join, resolve } from "path";
+import { homedir } from "os";
+import { mkdirSync, existsSync } from "fs";
+import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
 /**
  * Default session isolation configuration
  */
@@ -16,8 +16,8 @@ export const DEFAULT_SESSION_ISOLATION = {
 export function createSessionContext(sessionId, projectDir, isolationConfig, securityOverrides) {
     const config = { ...DEFAULT_SESSION_ISOLATION, ...isolationConfig };
     // Create session-specific temporary directory
-    const baseDir = config.baseDir || join(homedir(), '.mma', 'sessions', sessionId);
-    const tempDir = join(baseDir, 'temp');
+    const baseDir = config.baseDir || join(homedir(), ".mma", "sessions", sessionId);
+    const tempDir = join(baseDir, "temp");
     if (config.isolateTempFiles && !existsSync(tempDir)) {
         try {
             mkdirSync(tempDir, { recursive: true, mode: 0o700 });
@@ -84,11 +84,11 @@ export function isPathInSessionScope(sessionContext, path) {
     const workingDir = resolve(sessionContext.workingDir);
     const tempDir = resolve(sessionContext.tempDir);
     // Check if path is within working directory
-    if (resolvedPath.startsWith(workingDir + '/') || resolvedPath.startsWith(workingDir + '\\')) {
+    if (resolvedPath.startsWith(workingDir + "/") || resolvedPath.startsWith(workingDir + "\\")) {
         return true;
     }
     // Check if path is within temp directory
-    if (resolvedPath.startsWith(tempDir + '/') || resolvedPath.startsWith(tempDir + '\\')) {
+    if (resolvedPath.startsWith(tempDir + "/") || resolvedPath.startsWith(tempDir + "\\")) {
         return true;
     }
     return false;

package/dist/modules/session/index.js

@@ -1,3 +1,3 @@
-export { SessionStore } from './store';
-export { SessionManager } from './manager';
-export { SessionModule } from './module';
+export { SessionStore } from "./store";
+export { SessionManager } from "./manager";
+export { SessionModule } from "./module";

package/dist/modules/session/module.js

@@ -1,6 +1,6 @@
-import { t } from '../../i18n/index';
+import { t } from "../../i18n/index";
 export class SessionModule {
-    name = 'session';
+    name = "session";
     manager;
     constructor(manager) {
         this.manager = manager;
@@ -10,15 +10,15 @@ export class SessionModule {
         if (!meta || meta.messageCount === 0)
             return null;
         return {
-            content: t('session.info', { name: meta.name, id: meta.id, count: meta.messageCount }),
-            priority: 'low',
+            content: t("session.info", { name: meta.name, id: meta.id, count: meta.messageCount }),
+            priority: "low",
             essential: false,
             estimatedTokens: 20,
         };
     }
     getPlugin() {
         return {
-            name: 'session',
+            name: "session",
         };
     }
 }

package/dist/modules/session/store.js

@@ -72,9 +72,7 @@ export class SessionStore {
             return null;
         try {
             const raw = readFileSync(path, "utf-8");
-            const content = this.encryptor
-                ? this.encryptor.decryptFileContent(raw)
-                : raw;
+            const content = this.encryptor ? this.encryptor.decryptFileContent(raw) : raw;
             const meta = JSON.parse(content);
             this._metaCache.set(id, meta);
             return meta;
@@ -129,9 +127,7 @@ export class SessionStore {
                     .map(parseLine)
                     .filter((m) => m !== null);
             }
-            return lines
-                .map(parseLine)
-                .filter((m) => m !== null);
+            return lines.map(parseLine).filter((m) => m !== null);
         }
         catch {
             return [];
@@ -177,9 +173,7 @@ export class SessionStore {
                     .map(parseLine)
                     .filter((e) => e !== null);
             }
-            return lines
-                .map(parseLine)
-                .filter((e) => e !== null);
+            return lines.map(parseLine).filter((e) => e !== null);
         }
         catch {
             return [];

package/dist/modules/skills/matcher.js

@@ -0,0 +1,27 @@
+const MIN_WORD_LENGTH = 4;
+export class SkillsMatcher {
+    match(taskDescription, skills, maxResults = 3) {
+        const taskWords = taskDescription.toLowerCase().split(/\W+/).filter(w => w.length >= MIN_WORD_LENGTH);
+        const scored = skills.map(skill => {
+            const allKeywords = [
+                skill.name.toLowerCase(),
+                skill.description.toLowerCase(),
+                ...skill.keywords.map(k => k.toLowerCase()),
+            ];
+            let score = 0;
+            for (const word of taskWords) {
+                for (const kw of allKeywords) {
+                    if (kw === word || (kw.length >= MIN_WORD_LENGTH && kw.includes(word))) {
+                        score++;
+                    }
+                }
+            }
+            return { skill, score };
+        });
+        return scored
+            .filter(s => s.score > 0)
+            .sort((a, b) => b.score - a.score)
+            .slice(0, maxResults)
+            .map(s => s.skill);
+    }
+}

package/dist/modules/skills/module.js

@@ -38,8 +38,7 @@ export class SkillsModule {
     }
     search(query) {
         const q = query.toLowerCase();
-        return this.availableSkills.filter((s) => s.name.toLowerCase().includes(q) ||
-            s.description.toLowerCase().includes(q));
+        return this.availableSkills.filter((s) => s.name.toLowerCase().includes(q) || s.description.toLowerCase().includes(q));
     }
     getBudget() {
         return {

package/dist/modules/updater/checker.js

@@ -1,32 +1,96 @@
+import { platform } from "os";
+import { resolveSpawnCommand } from "../lsp/command";
+/** Numeric semver comparison (x.y.z, prerelease ignored). */
+export function semverGt(a, b) {
+    const pa = a
+        .replace(/^v/, "")
+        .split(/[.-]/)
+        .map((p) => Number.parseInt(p, 10) || 0);
+    const pb = b
+        .replace(/^v/, "")
+        .split(/[.-]/)
+        .map((p) => Number.parseInt(p, 10) || 0);
+    for (let i = 0; i < 3; i++) {
+        const na = pa[i] ?? 0;
+        const nb = pb[i] ?? 0;
+        if (na !== nb)
+            return na > nb;
+    }
+    return false;
+}
+const defaultRunner = async (command, args, options) => {
+    const { execFile } = await import("child_process");
+    return new Promise((resolve) => {
+        execFile(command, args, options, (err) => resolve({ error: err?.message }));
+    });
+};
 export class Updater {
     currentVersion;
     packageName;
-    constructor(currentVersion, packageName) {
+    runner;
+    constructor(currentVersion, packageName, runner) {
         this.currentVersion = currentVersion;
         this.packageName = packageName;
+        this.runner = runner ?? defaultRunner;
     }
     getCurrentVersion() {
         return this.currentVersion;
     }
+    getPackageName() {
+        return this.packageName;
+    }
     async check() {
         try {
             const response = await fetch(`https://registry.npmjs.org/${this.packageName}`, {
-                headers: { Accept: 'application/vnd.npm.install-v1+json' },
+                headers: { Accept: "application/vnd.npm.install-v1+json" },
                 signal: AbortSignal.timeout(5000),
             });
             if (!response.ok) {
-                return { updateAvailable: false, current: this.currentVersion, error: `HTTP ${response.status}` };
+                return {
+                    updateAvailable: false,
+                    current: this.currentVersion,
+                    error: `HTTP ${response.status}`,
+                };
             }
             const data = await response.json();
-            const latest = data['dist-tags']?.latest;
+            const latest = data["dist-tags"]?.latest;
             if (!latest) {
-                return { updateAvailable: false, current: this.currentVersion, error: 'No latest tag' };
+                return { updateAvailable: false, current: this.currentVersion, error: "No latest tag" };
             }
-            const updateAvailable = latest !== this.currentVersion;
+            const updateAvailable = semverGt(latest, this.currentVersion);
             return { updateAvailable, current: this.currentVersion, latest };
         }
         catch (e) {
             return { updateAvailable: false, current: this.currentVersion, error: e.message };
         }
     }
+    /**
+     * Install the latest version globally via `npm install -g`.
+     * Returns an InstallResult (never throws).
+     */
+    async install(latest) {
+        try {
+            const { command, args } = this.buildInstallCommand(latest);
+            const res = await this.runner(command, args, {
+                timeout: 120000,
+                windowsHide: true,
+            });
+            if (res.error)
+                return { success: false, error: res.error };
+            return { success: true, installed: latest };
+        }
+        catch (e) {
+            const msg = e?.message ?? String(e);
+            return { success: false, error: msg.split("\n")[0] };
+        }
+    }
+    buildInstallCommand(latest) {
+        const npmArgs = ["install", "-g", `${this.packageName}@${latest}`];
+        const command = resolveSpawnCommand("npm");
+        if (platform() === "win32" && /\.(cmd|bat)$/i.test(command)) {
+            // Node cannot spawn .cmd/.bat shims directly (spawn EINVAL) — route via cmd.exe.
+            return { command: "cmd.exe", args: ["/c", command, ...npmArgs] };
+        }
+        return { command, args: npmArgs };
+    }
 }

package/dist/modules/updater/index.js

@@ -1 +1,2 @@
-export { Updater } from './checker';
+export { Updater } from "./checker";
+export { UpdaterModule } from "./module";