micro-models-agent 0.44.0 → 0.45.0

package/dist/modules/security/audit-notifier.js

@@ -1,292 +0,0 @@
-import { writeFileSync, appendFileSync, existsSync, mkdirSync } from 'fs';
-import { join, dirname } from 'path';
-import { homedir } from 'os';
-/**
- * Severity weights for comparison
- */
-const SEVERITY_WEIGHTS = {
-    low: 1,
-    medium: 2,
-    high: 3,
-    critical: 4,
-};
-/**
- * Default audit notifier configuration
- */
-export const DEFAULT_AUDIT_NOTIFIER_CONFIG = {
-    enabled: false,
-    filePath: join(homedir(), '.mma', 'logs', 'audit-notifications.jsonl'),
-    webhookTimeout: 5000,
-    minSeverity: 'medium',
-    eventTypes: [
-        'security_block',
-        'bash_command',
-        'file_operation',
-        'network_request',
-        'authentication',
-        'configuration_change',
-    ],
-    maxRetries: 3,
-};
-/**
- * Audit notifier for sending notifications about security events
- */
-export class AuditNotifier {
-    config;
-    retryQueue = [];
-    isProcessing = false;
-    constructor(config) {
-        this.config = { ...DEFAULT_AUDIT_NOTIFIER_CONFIG, ...config };
-        this.ensureLogDirectory();
-    }
-    /**
-     * Check if notifier is enabled
-     */
-    isEnabled() {
-        return this.config.enabled;
-    }
-    /**
-     * Enable the notifier
-     */
-    enable() {
-        this.config.enabled = true;
-    }
-    /**
-     * Disable the notifier
-     */
-    disable() {
-        this.config.enabled = false;
-    }
-    /**
-     * Update configuration
-     */
-    updateConfig(config) {
-        this.config = { ...this.config, ...config };
-        this.ensureLogDirectory();
-    }
-    /**
-     * Ensure the log directory exists
-     */
-    ensureLogDirectory() {
-        if (this.config.filePath) {
-            const dir = dirname(this.config.filePath);
-            mkdirSync(dir, { recursive: true });
-        }
-    }
-    /**
-     * Check if an event type should be notified
-     */
-    shouldNotify(eventType) {
-        if (!this.config.enabled)
-            return false;
-        return this.config.eventTypes?.includes(eventType) ?? false;
-    }
-    /**
-     * Check if a severity level should be notified
-     */
-    shouldNotifySeverity(severity) {
-        const minSeverity = this.config.minSeverity ?? 'medium';
-        const minWeight = SEVERITY_WEIGHTS[minSeverity];
-        const eventWeight = SEVERITY_WEIGHTS[severity];
-        return eventWeight >= minWeight;
-    }
-    /**
-     * Send a notification for an audit event
-     */
-    async notify(entry) {
-        if (!this.config.enabled)
-            return null;
-        const eventType = this.mapEventType(entry.action);
-        if (!eventType || !this.shouldNotify(eventType))
-            return null;
-        const severity = this.determineSeverity(entry);
-        if (!this.shouldNotifySeverity(severity))
-            return null;
-        const notification = {
-            timestamp: new Date().toISOString(),
-            eventType,
-            severity,
-            message: entry.details || entry.reason || entry.action,
-            details: entry.details ? { details: entry.details } : undefined,
-            sessionId: entry.sessionId,
-        };
-        // Write to file
-        this.writeToFile(notification);
-        // Send to webhook if configured
-        if (this.config.webhookUrl) {
-            await this.sendToWebhook(notification);
-        }
-        return notification;
-    }
-    /**
-     * Map audit log entry action to notification event type
-     */
-    mapEventType(action) {
-        const typeMap = {
-            'tool_call': 'tool_call',
-            'bash_command': 'bash_command',
-            'file_write': 'file_operation',
-            'file_delete': 'file_operation',
-            'network_request': 'network_request',
-            'security_block': 'security_block',
-        };
-        return typeMap[action] || null;
-    }
-    /**
-     * Determine severity from audit log entry
-     */
-    determineSeverity(entry) {
-        // Default severity based on action type
-        const typeSeverity = {
-            'security_block': 'high',
-            'bash_command': 'high',
-            'file_delete': 'medium',
-            'file_write': 'medium',
-            'network_request': 'medium',
-            'tool_call': 'low',
-            'session_start': 'low',
-            'session_end': 'low',
-        };
-        return typeSeverity[entry.action] || 'low';
-    }
-    /**
-     * Write notification to file
-     */
-    writeToFile(notification) {
-        if (!this.config.filePath)
-            return;
-        try {
-            const line = JSON.stringify(notification);
-            appendFileSync(this.config.filePath, line + '\n', 'utf8');
-        }
-        catch (error) {
-            console.error('[AuditNotifier] Failed to write to file:', error);
-        }
-    }
-    /**
-     * Send notification to webhook
-     */
-    async sendToWebhook(notification) {
-        if (!this.config.webhookUrl)
-            return;
-        try {
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), this.config.webhookTimeout);
-            const response = await fetch(this.config.webhookUrl, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify(notification),
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            if (!response.ok) {
-                throw new Error(`Webhook returned ${response.status}`);
-            }
-        }
-        catch (error) {
-            console.error('[AuditNotifier] Webhook failed, adding to retry queue:', error);
-            this.addToRetryQueue(notification);
-        }
-    }
-    /**
-     * Add notification to retry queue
-     */
-    addToRetryQueue(notification) {
-        this.retryQueue.push({ entry: notification, retries: 0 });
-        if (!this.isProcessing) {
-            this.processRetryQueue();
-        }
-    }
-    /**
-     * Process the retry queue
-     */
-    async processRetryQueue() {
-        if (this.retryQueue.length === 0 || this.isProcessing)
-            return;
-        this.isProcessing = true;
-        while (this.retryQueue.length > 0) {
-            const item = this.retryQueue[0];
-            if (item.retries >= (this.config.maxRetries ?? 3)) {
-                console.error('[AuditNotifier] Max retries exceeded for notification:', item.entry);
-                this.retryQueue.shift();
-                continue;
-            }
-            try {
-                await this.sendToWebhook(item.entry);
-                this.retryQueue.shift();
-            }
-            catch (error) {
-                item.retries++;
-                // Exponential backoff
-                const delay = Math.pow(2, item.retries) * 1000;
-                await new Promise(resolve => setTimeout(resolve, delay));
-            }
-        }
-        this.isProcessing = false;
-    }
-    /**
-     * Read notifications from file
-     */
-    readNotifications(limit = 100) {
-        if (!this.config.filePath || !existsSync(this.config.filePath)) {
-            return [];
-        }
-        try {
-            const content = readFileSync(this.config.filePath, 'utf8');
-            const lines = content.split('\n').filter(Boolean);
-            return lines.slice(-limit).map(line => JSON.parse(line));
-        }
-        catch {
-            return [];
-        }
-    }
-    /**
-     * Clear all notifications
-     */
-    clearNotifications() {
-        if (this.config.filePath) {
-            writeFileSync(this.config.filePath, '', 'utf8');
-        }
-        this.retryQueue = [];
-    }
-    /**
-     * Get notification statistics
-     */
-    getStats() {
-        const notifications = this.readNotifications();
-        const bySeverity = { low: 0, medium: 0, high: 0, critical: 0 };
-        const byType = {
-            tool_call: 0,
-            tool_result: 0,
-            bash_command: 0,
-            file_operation: 0,
-            network_request: 0,
-            security_block: 0,
-            authentication: 0,
-            configuration_change: 0,
-            session_start: 0,
-            session_end: 0,
-        };
-        for (const n of notifications) {
-            bySeverity[n.severity] = (bySeverity[n.severity] || 0) + 1;
-            byType[n.eventType] = (byType[n.eventType] || 0) + 1;
-        }
-        return {
-            total: notifications.length,
-            bySeverity,
-            byType,
-        };
-    }
-}
-/**
- * Global audit notifier instance
- */
-export const globalAuditNotifier = new AuditNotifier();
-/**
- * Create an audit notifier with custom configuration
- */
-export function createAuditNotifier(config) {
-    return new AuditNotifier(config);
-}
-// Import readFileSync for readNotifications
-import { readFileSync } from 'fs';

package/dist/modules/security/command-validator.js

@@ -1,211 +0,0 @@
-import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
-// Fallback in case DEFAULT_SECURITY_CONFIG is not available
-const FALLBACK_BASH_CONFIG = {
-    enabled: false,
-    blacklist: [
-        "rm",
-        "dd",
-        "chmod",
-        "wget",
-        "curl",
-        "scp",
-        "ssh",
-        "nc",
-        "netcat",
-        "powershell",
-        "pwsh",
-        "cmd",
-    ],
-    whitelist: [],
-    blockDangerousFlags: false,
-    dangerousFlags: ["--force", "-rf", "--no-preserve-root"],
-    dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "`"],
-    logCommands: true,
-};
-export const DEFAULT_BASH_CONFIG = DEFAULT_SECURITY_CONFIG?.bash || FALLBACK_BASH_CONFIG;
-/**
- * Extract the actual base command from a shell command string.
- * Handles path prefixes, env assignments, and sudo.
- *
- * Examples:
- *   "/usr/bin/rm -rf /"           → "rm"
- *   "sudo /usr/bin/rm file"       → "rm"
- *   "NODE_ENV=prod node app.js"   → "node"
- *   "env PATH=/x rm -rf /"        → "rm"
- *   "cmd=rm; $cmd -rf /"          → "cmd" (variable indirection — not expanded)
- *   "powershell Remove-Item x"    → "Remove-Item"
- *   "cmd /c del /s /q"            → "del"
- */
-function extractBaseCommand(trimmed) {
-    const tokens = trimmed.split(/\s+/);
-    let i = 0;
-    // Skip env assignments (KEY=val, KEY="val", etc.) and prefixed commands
-    while (i < tokens.length) {
-        const tok = tokens[i];
-        if (/^[a-zA-Z_][a-zA-Z0-9_]*=/.test(tok)) {
-            i++;
-            continue;
-        }
-        if (tok === "sudo" ||
-            tok === "env" ||
-            tok === "command" ||
-            tok === "exec" ||
-            tok === "nohup") {
-            i++;
-            continue;
-        }
-        break;
-    }
-    if (i >= tokens.length)
-        return tokens[0] ?? "";
-    // Extract basename from path (e.g. /usr/bin/rm → rm)
-    const raw = tokens[i];
-    const parts = raw.split(/[\\/]/);
-    const basename = parts[parts.length - 1] || raw;
-    // Strip .exe/.cmd/.bat extensions for blacklist matching (e.g. powershell.exe → powershell)
-    return basename.replace(/\.(exe|cmd|bat)$/i, "") || basename;
-}
-/**
- * Check if a shell operator appears as a standalone token in the command.
- * Uses regex with lookbehind/lookahead so that:
- *   "&"  does NOT match "&&"  (AND operator)
- *   "|"  does NOT match "||"  (OR operator)
- *   ">"  does NOT match ">>"  (append)
- *   "2>" does NOT match "2>>" (append stderr)
- */
-function containsOperator(command, op) {
-    const escaped = op.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    // For single-char operators that are prefixes of multi-char ones,
-    // ensure they don't match when part of a longer sequence.
-    // Note: "&" is no longer in dangerousOperators (&& is legitimate),
-    // but keep the special case for defense-in-depth if manually added.
-    if (op === "&")
-        return /(?<!&)&(?!&)/.test(command);
-    if (op === "|")
-        return /(?<!\|)\|(?!\|)/.test(command);
-    if (op === ">")
-        return /(?<!>)>(?!>)/.test(command);
-    // For everything else (including multi-char like ">>", "2>", "2>>", ";", "`"),
-    // match literally.
-    return new RegExp(escaped).test(command);
-}
-/**
- * Check if a command is allowed based on security configuration
- */
-export function isCommandAllowed(command, securityConfig) {
-    // If security is disabled, allow everything
-    if (!securityConfig?.enabled) {
-        return { allowed: true, sanitizedCommand: command };
-    }
-    // Ensure config has all required fields
-    let config = securityConfig;
-    if (!config.blacklist || !Array.isArray(config.blacklist)) {
-        config = {
-            ...FALLBACK_BASH_CONFIG,
-            enabled: config.enabled ?? FALLBACK_BASH_CONFIG.enabled,
-        };
-    }
-    const trimmedCommand = command.trim();
-    if (!trimmedCommand) {
-        return { allowed: false, reason: "Empty command" };
-    }
-    // Shell wrappers are always blocked — they bypass all command validation.
-    // The agent should use the bash tool directly, not shell interpreters.
-    const ALWAYS_BLOCKED = ["powershell", "pwsh", "cmd"];
-    const baseForShellCheck = extractBaseCommand(trimmedCommand);
-    if (ALWAYS_BLOCKED.includes(baseForShellCheck)) {
-        return {
-            allowed: false,
-            reason: `Shell wrapper "${baseForShellCheck}" is blocked — use the bash tool directly`,
-        };
-    }
-    // Check dangerous operators FIRST — before parsing the base command.
-    // e.g. "curl http://x | bash" must be caught even though curl isn't blacklisted.
-    if (config.blockDangerousFlags) {
-        for (const op of config.dangerousOperators || []) {
-            if (containsOperator(trimmedCommand, op)) {
-                return {
-                    allowed: false,
-                    reason: `Operator "${op}" is not allowed`,
-                };
-            }
-        }
-    }
-    // Extract actual base command (handles paths, env vars, sudo)
-    const baseCommand = extractBaseCommand(trimmedCommand);
-    // Check whitelist first (if non-empty, only whitelisted commands are allowed)
-    if (config.whitelist.length > 0) {
-        if (!config.whitelist.includes(baseCommand)) {
-            return {
-                allowed: false,
-                reason: `Command "${baseCommand}" is not in the whitelist`,
-            };
-        }
-    }
-    // Check blacklist (against the extracted basename, not the raw token)
-    if (config.blacklist.includes(baseCommand)) {
-        return {
-            allowed: false,
-            reason: `Command "${baseCommand}" is blacklisted`,
-        };
-    }
-    // Also check the raw first token in case it's a simple name
-    const rawFirst = trimmedCommand
-        .split(/\s+/)[0]
-        .replace(/\.(exe|cmd|bat)$/i, "");
-    if (rawFirst !== baseCommand && config.blacklist.includes(rawFirst)) {
-        return {
-            allowed: false,
-            reason: `Command "${rawFirst}" is blacklisted`,
-        };
-    }
-    // Check for dangerous flags
-    if (config.blockDangerousFlags) {
-        for (const flag of config.dangerousFlags || []) {
-            // Check for flag as whole word or with equals
-            const flagPattern = new RegExp(`(?:^|\\s)${flag}(?:\\s|$|=)`);
-            if (flagPattern.test(trimmedCommand)) {
-                return {
-                    allowed: false,
-                    reason: `Dangerous flag "${flag}" is not allowed`,
-                };
-            }
-        }
-    }
-    // Command is allowed
-    return { allowed: true, sanitizedCommand: command };
-}
-/**
- * Sanitize command for logging (remove sensitive information)
- * Uses the same patterns as sanitizeLogMessage for consistency
- */
-export function sanitizeCommandForLog(command) {
-    // Import patterns from data-sanitizer to maintain consistency
-    const patterns = [
-        /(api[_-]?key|apikey|api_key)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        /(token|access[_-]?token|auth[_-]?token)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        /(password|passwd|pwd|pass)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        /(secret|private[_-]?key|secret[_-]?key)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        /\bsk-[a-zA-Z0-9_-]{20,}\b/gi,
-        /\bctx7sk-[a-zA-Z0-9_-]{10,}\b/gi,
-        /\bghp_[a-zA-Z0-9]{30,}\b/gi,
-        /\bgithub_pat_[a-zA-Z0-9]{20,}\b/gi,
-        /\bAKIA[0-9A-Z]{15,}\b/gi,
-        /Bearer\s+[a-zA-Z0-9_-]{20,}/gi,
-        /\b([a-zA-Z0-9_-]{30,})\b/g,
-    ];
-    let sanitized = command;
-    for (const pattern of patterns) {
-        if (pattern.toString().includes("($1")) {
-            // For patterns with capture groups, use the group in replacement
-            sanitized = sanitized.replace(pattern, (match, p1) => {
-                return `${p1}=[REDACTED]`;
-            });
-        }
-        else {
-            // For simple patterns, just replace with [REDACTED]
-            sanitized = sanitized.replace(pattern, "[REDACTED]");
-        }
-    }
-    return sanitized;
-}

package/dist/modules/security/content-scanner.js

@@ -1,53 +0,0 @@
-/**
- * Default dangerous patterns to scan for in file content.
- * NOTE: only genuinely dangerous constructs are listed. Legitimate runtime
- * APIs (process.exit, setTimeout/setInterval, template literals `${}`,
- * backtick strings) are NOT scanned — they are valid JS/TS and blocking
- * them breaks ordinary CLI code (false positives).
- */
-const DEFAULT_DANGEROUS_PATTERNS = [
-    /eval\(/gi,
-    /new Function\(/gi,
-    /child_process\.exec\(/gi,
-    /child_process\.spawn\(/gi,
-    /require\('child_process'\)/gi,
-    /require\('http'\).createServer/gi,
-    /require\('net'\).createServer/gi,
-    /require\('fs'\).writeFileSync/gi,
-    /require\('fs'\).unlinkSync/gi,
-    /while\(true\)/gi,
-    /for\(;;\)/gi,
-    /rm -rf/gi,
-    /dd if=/gi,
-    /chmod 777/gi,
-    /wget.*\|.*sh/gi,
-    /curl.*\|.*sh/gi,
-];
-/**
- * Scan file content for dangerous patterns
- */
-export function scanContent(content, filePath, config) {
-    // If scanning is disabled, allow everything
-    if (!config?.enabled) {
-        return { allowed: true };
-    }
-    // Use default patterns if none provided
-    const patterns = config.dangerousPatterns?.length
-        ? config.dangerousPatterns
-        : DEFAULT_DANGEROUS_PATTERNS;
-    const matches = [];
-    for (const pattern of patterns) {
-        const match = content.match(pattern);
-        if (match) {
-            matches.push(...match);
-        }
-    }
-    if (matches.length > 0) {
-        return {
-            allowed: false,
-            reason: `Content contains dangerous patterns in ${filePath}: ${matches.slice(0, 3).join(", ")}`,
-            matches,
-        };
-    }
-    return { allowed: true };
-}

package/dist/modules/security/data-sanitizer.js

@@ -1,97 +0,0 @@
-/**
- * Patterns for sensitive data that should be redacted from logs
- */
-const SENSITIVE_PATTERNS = [
-    // API keys and tokens in key=value format
-    {
-        pattern: /(api[_-]?key|apikey|api_key)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        replacement: "$1=[REDACTED]",
-    },
-    {
-        pattern: /(token|access[_-]?token|auth[_-]?token)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        replacement: "$1=[REDACTED]",
-    },
-    {
-        pattern: /(password|passwd|pwd|pass)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        replacement: "$1=[REDACTED]",
-    },
-    {
-        pattern: /(secret|private[_-]?key|secret[_-]?key)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        replacement: "$1=[REDACTED]",
-    },
-    // Standalone API keys (not in key=value format)
-    {
-        pattern: /\bsk-[a-zA-Z0-9_-]{20,}\b/gi,
-        replacement: "sk-[REDACTED]",
-    },
-    {
-        pattern: /\bctx7sk-[a-zA-Z0-9_-]{10,}\b/gi,
-        replacement: "ctx7sk-[REDACTED]",
-    },
-    {
-        pattern: /\bghp_[a-zA-Z0-9]{30,}\b/gi,
-        replacement: "ghp_[REDACTED]",
-    },
-    {
-        pattern: /\bgithub_pat_[a-zA-Z0-9]{20,}\b/gi,
-        replacement: "github_pat_[REDACTED]",
-    },
-    {
-        pattern: /\bAKIA[0-9A-Z]{15,}\b/gi,
-        replacement: "AKIA[REDACTED]",
-    },
-    // Bearer tokens in headers
-    {
-        pattern: /Bearer\s+[a-zA-Z0-9_-]{20,}/gi,
-        replacement: "Bearer [REDACTED]",
-    },
-    // Generic high-entropy strings that look like secrets (30+ chars, mixed case and numbers)
-    {
-        pattern: /\b([a-zA-Z0-9_-]{30,})\b/g,
-        replacement: "[REDACTED]",
-    },
-];
-/**
- * Sanitize a log message by removing sensitive information
- */
-export function sanitizeLogMessage(message) {
-    let sanitized = message;
-    for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
-        sanitized = sanitized.replace(pattern, replacement);
-    }
-    return sanitized;
-}
-/**
- * Sanitize a command string by removing sensitive information
- */
-export function sanitizeCommand(command) {
-    return sanitizeLogMessage(command);
-}
-/**
- * Sanitize a URL by removing sensitive query parameters
- */
-export function sanitizeUrl(url) {
-    try {
-        const urlObj = new URL(url);
-        const sensitiveKeys = [
-            "api_key",
-            "token",
-            "password",
-            "secret",
-            "access_token",
-            "auth",
-            "key",
-        ];
-        const sanitizedParams = new URLSearchParams(urlObj.search);
-        for (const key of sensitiveKeys) {
-            if (sanitizedParams.has(key)) {
-                sanitizedParams.set(key, "[REDACTED]");
-            }
-        }
-        urlObj.search = sanitizedParams.toString();
-        return urlObj.toString();
-    }
-    catch {
-        return sanitizeLogMessage(url);
-    }
-}