micro-models-agent 0.46.2 → 0.47.0

package/dist/modules/security/audit-log.js

@@ -1,136 +0,0 @@
-import { existsSync, mkdirSync, appendFileSync } from "fs";
-import { resolve, join } from "path";
-import { homedir } from "os";
-import { globalAuditNotifier } from "./audit-notifier";
-let _globalAuditDir = resolve(homedir(), ".mma", "logs");
-let _sessionAuditDir = null;
-function getAuditDir() {
-    return _sessionAuditDir ?? _globalAuditDir;
-}
-/**
- * Set the session directory for audit logs. When set, all audit entries
- * are written to the session-specific directory instead of the global one.
- */
-export function setAuditSessionDir(dir) {
-    _sessionAuditDir = dir;
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-}
-/**
- * Clear the session directory — fall back to global audit dir.
- */
-export function clearAuditSessionDir() {
-    _sessionAuditDir = null;
-}
-/**
- * Set the global audit log directory (used when no session dir is active).
- */
-export function setGlobalAuditDir(dir) {
-    _globalAuditDir = dir;
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-}
-/**
- * Write an audit log entry
- */
-export function logAudit(entry) {
-    const dir = getAuditDir();
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-    try {
-        const logEntry = JSON.stringify(entry);
-        appendFileSync(join(dir, "audit.jsonl"), logEntry + "\n", "utf8");
-    }
-    catch {
-        // Silently fail if we can't write to audit log
-        // This shouldn't break the agent
-    }
-    // Notify audit notifier if enabled
-    try {
-        globalAuditNotifier.notify(entry);
-    }
-    catch {
-        // Silently fail if notification fails
-    }
-}
-/**
- * Log a tool call
- */
-export function logToolCall(sessionId, tool, success, details) {
-    logAudit({
-        timestamp: new Date().toISOString(),
-        sessionId,
-        action: "tool_call",
-        tool,
-        success,
-        details,
-    });
-}
-/**
- * Log a file write operation
- */
-export function logFileWrite(sessionId, path, success, details) {
-    logAudit({
-        timestamp: new Date().toISOString(),
-        sessionId,
-        action: "file_write",
-        path,
-        success,
-        details,
-    });
-}
-/**
- * Log a file delete operation
- */
-export function logFileDelete(sessionId, path, success, details) {
-    logAudit({
-        timestamp: new Date().toISOString(),
-        sessionId,
-        action: "file_delete",
-        path,
-        success,
-        details,
-    });
-}
-/**
- * Log a bash command execution
- */
-export function logBashCommand(sessionId, command, success, details) {
-    logAudit({
-        timestamp: new Date().toISOString(),
-        sessionId,
-        action: "bash_command",
-        command,
-        success,
-        details,
-    });
-}
-/**
- * Log a network request
- */
-export function logNetworkRequest(sessionId, url, success, details) {
-    logAudit({
-        timestamp: new Date().toISOString(),
-        sessionId,
-        action: "network_request",
-        url,
-        success,
-        details,
-    });
-}
-/**
- * Log a security block event
- */
-export function logSecurityBlock(sessionId, action, reason, details) {
-    logAudit({
-        timestamp: new Date().toISOString(),
-        sessionId,
-        action: "security_block",
-        success: false,
-        reason,
-        details,
-    });
-}

package/dist/modules/security/audit-notifier.js

@@ -1,292 +0,0 @@
-import { writeFileSync, appendFileSync, existsSync, mkdirSync } from "fs";
-import { join, dirname } from "path";
-import { homedir } from "os";
-/**
- * Severity weights for comparison
- */
-const SEVERITY_WEIGHTS = {
-    low: 1,
-    medium: 2,
-    high: 3,
-    critical: 4,
-};
-/**
- * Default audit notifier configuration
- */
-export const DEFAULT_AUDIT_NOTIFIER_CONFIG = {
-    enabled: false,
-    filePath: join(homedir(), ".mma", "logs", "audit-notifications.jsonl"),
-    webhookTimeout: 5000,
-    minSeverity: "medium",
-    eventTypes: [
-        "security_block",
-        "bash_command",
-        "file_operation",
-        "network_request",
-        "authentication",
-        "configuration_change",
-    ],
-    maxRetries: 3,
-};
-/**
- * Audit notifier for sending notifications about security events
- */
-export class AuditNotifier {
-    config;
-    retryQueue = [];
-    isProcessing = false;
-    constructor(config) {
-        this.config = { ...DEFAULT_AUDIT_NOTIFIER_CONFIG, ...config };
-        this.ensureLogDirectory();
-    }
-    /**
-     * Check if notifier is enabled
-     */
-    isEnabled() {
-        return this.config.enabled;
-    }
-    /**
-     * Enable the notifier
-     */
-    enable() {
-        this.config.enabled = true;
-    }
-    /**
-     * Disable the notifier
-     */
-    disable() {
-        this.config.enabled = false;
-    }
-    /**
-     * Update configuration
-     */
-    updateConfig(config) {
-        this.config = { ...this.config, ...config };
-        this.ensureLogDirectory();
-    }
-    /**
-     * Ensure the log directory exists
-     */
-    ensureLogDirectory() {
-        if (this.config.filePath) {
-            const dir = dirname(this.config.filePath);
-            mkdirSync(dir, { recursive: true });
-        }
-    }
-    /**
-     * Check if an event type should be notified
-     */
-    shouldNotify(eventType) {
-        if (!this.config.enabled)
-            return false;
-        return this.config.eventTypes?.includes(eventType) ?? false;
-    }
-    /**
-     * Check if a severity level should be notified
-     */
-    shouldNotifySeverity(severity) {
-        const minSeverity = this.config.minSeverity ?? "medium";
-        const minWeight = SEVERITY_WEIGHTS[minSeverity];
-        const eventWeight = SEVERITY_WEIGHTS[severity];
-        return eventWeight >= minWeight;
-    }
-    /**
-     * Send a notification for an audit event
-     */
-    async notify(entry) {
-        if (!this.config.enabled)
-            return null;
-        const eventType = this.mapEventType(entry.action);
-        if (!eventType || !this.shouldNotify(eventType))
-            return null;
-        const severity = this.determineSeverity(entry);
-        if (!this.shouldNotifySeverity(severity))
-            return null;
-        const notification = {
-            timestamp: new Date().toISOString(),
-            eventType,
-            severity,
-            message: entry.details || entry.reason || entry.action,
-            details: entry.details ? { details: entry.details } : undefined,
-            sessionId: entry.sessionId,
-        };
-        // Write to file
-        this.writeToFile(notification);
-        // Send to webhook if configured
-        if (this.config.webhookUrl) {
-            await this.sendToWebhook(notification);
-        }
-        return notification;
-    }
-    /**
-     * Map audit log entry action to notification event type
-     */
-    mapEventType(action) {
-        const typeMap = {
-            tool_call: "tool_call",
-            bash_command: "bash_command",
-            file_write: "file_operation",
-            file_delete: "file_operation",
-            network_request: "network_request",
-            security_block: "security_block",
-        };
-        return typeMap[action] || null;
-    }
-    /**
-     * Determine severity from audit log entry
-     */
-    determineSeverity(entry) {
-        // Default severity based on action type
-        const typeSeverity = {
-            security_block: "high",
-            bash_command: "high",
-            file_delete: "medium",
-            file_write: "medium",
-            network_request: "medium",
-            tool_call: "low",
-            session_start: "low",
-            session_end: "low",
-        };
-        return typeSeverity[entry.action] || "low";
-    }
-    /**
-     * Write notification to file
-     */
-    writeToFile(notification) {
-        if (!this.config.filePath)
-            return;
-        try {
-            const line = JSON.stringify(notification);
-            appendFileSync(this.config.filePath, line + "\n", "utf8");
-        }
-        catch (error) {
-            console.error("[AuditNotifier] Failed to write to file:", error);
-        }
-    }
-    /**
-     * Send notification to webhook
-     */
-    async sendToWebhook(notification) {
-        if (!this.config.webhookUrl)
-            return;
-        try {
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), this.config.webhookTimeout);
-            const response = await fetch(this.config.webhookUrl, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify(notification),
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            if (!response.ok) {
-                throw new Error(`Webhook returned ${response.status}`);
-            }
-        }
-        catch (error) {
-            console.error("[AuditNotifier] Webhook failed, adding to retry queue:", error);
-            this.addToRetryQueue(notification);
-        }
-    }
-    /**
-     * Add notification to retry queue
-     */
-    addToRetryQueue(notification) {
-        this.retryQueue.push({ entry: notification, retries: 0 });
-        if (!this.isProcessing) {
-            this.processRetryQueue();
-        }
-    }
-    /**
-     * Process the retry queue
-     */
-    async processRetryQueue() {
-        if (this.retryQueue.length === 0 || this.isProcessing)
-            return;
-        this.isProcessing = true;
-        while (this.retryQueue.length > 0) {
-            const item = this.retryQueue[0];
-            if (item.retries >= (this.config.maxRetries ?? 3)) {
-                console.error("[AuditNotifier] Max retries exceeded for notification:", item.entry);
-                this.retryQueue.shift();
-                continue;
-            }
-            try {
-                await this.sendToWebhook(item.entry);
-                this.retryQueue.shift();
-            }
-            catch (error) {
-                item.retries++;
-                // Exponential backoff
-                const delay = Math.pow(2, item.retries) * 1000;
-                await new Promise((resolve) => setTimeout(resolve, delay));
-            }
-        }
-        this.isProcessing = false;
-    }
-    /**
-     * Read notifications from file
-     */
-    readNotifications(limit = 100) {
-        if (!this.config.filePath || !existsSync(this.config.filePath)) {
-            return [];
-        }
-        try {
-            const content = readFileSync(this.config.filePath, "utf8");
-            const lines = content.split("\n").filter(Boolean);
-            return lines.slice(-limit).map((line) => JSON.parse(line));
-        }
-        catch {
-            return [];
-        }
-    }
-    /**
-     * Clear all notifications
-     */
-    clearNotifications() {
-        if (this.config.filePath) {
-            writeFileSync(this.config.filePath, "", "utf8");
-        }
-        this.retryQueue = [];
-    }
-    /**
-     * Get notification statistics
-     */
-    getStats() {
-        const notifications = this.readNotifications();
-        const bySeverity = { low: 0, medium: 0, high: 0, critical: 0 };
-        const byType = {
-            tool_call: 0,
-            tool_result: 0,
-            bash_command: 0,
-            file_operation: 0,
-            network_request: 0,
-            security_block: 0,
-            authentication: 0,
-            configuration_change: 0,
-            session_start: 0,
-            session_end: 0,
-        };
-        for (const n of notifications) {
-            bySeverity[n.severity] = (bySeverity[n.severity] || 0) + 1;
-            byType[n.eventType] = (byType[n.eventType] || 0) + 1;
-        }
-        return {
-            total: notifications.length,
-            bySeverity,
-            byType,
-        };
-    }
-}
-/**
- * Global audit notifier instance
- */
-export const globalAuditNotifier = new AuditNotifier();
-/**
- * Create an audit notifier with custom configuration
- */
-export function createAuditNotifier(config) {
-    return new AuditNotifier(config);
-}
-// Import readFileSync for readNotifications
-import { readFileSync } from "fs";

package/dist/modules/security/command-validator.js

@@ -1,205 +0,0 @@
-import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
-// Fallback in case DEFAULT_SECURITY_CONFIG is not available
-const FALLBACK_BASH_CONFIG = {
-    enabled: false,
-    blacklist: [
-        "rm",
-        "dd",
-        "chmod",
-        "wget",
-        "curl",
-        "scp",
-        "ssh",
-        "nc",
-        "netcat",
-        "powershell",
-        "pwsh",
-        "cmd",
-    ],
-    whitelist: [],
-    blockDangerousFlags: false,
-    dangerousFlags: ["--force", "-rf", "--no-preserve-root"],
-    dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "`"],
-    logCommands: true,
-};
-export const DEFAULT_BASH_CONFIG = DEFAULT_SECURITY_CONFIG?.bash || FALLBACK_BASH_CONFIG;
-/**
- * Extract the actual base command from a shell command string.
- * Handles path prefixes, env assignments, and sudo.
- *
- * Examples:
- *   "/usr/bin/rm -rf /"           → "rm"
- *   "sudo /usr/bin/rm file"       → "rm"
- *   "NODE_ENV=prod node app.js"   → "node"
- *   "env PATH=/x rm -rf /"        → "rm"
- *   "cmd=rm; $cmd -rf /"          → "cmd" (variable indirection — not expanded)
- *   "powershell Remove-Item x"    → "Remove-Item"
- *   "cmd /c del /s /q"            → "del"
- */
-function extractBaseCommand(trimmed) {
-    const tokens = trimmed.split(/\s+/);
-    let i = 0;
-    // Skip env assignments (KEY=val, KEY="val", etc.) and prefixed commands
-    while (i < tokens.length) {
-        const tok = tokens[i];
-        if (/^[a-zA-Z_][a-zA-Z0-9_]*=/.test(tok)) {
-            i++;
-            continue;
-        }
-        if (tok === "sudo" || tok === "env" || tok === "command" || tok === "exec" || tok === "nohup") {
-            i++;
-            continue;
-        }
-        break;
-    }
-    if (i >= tokens.length)
-        return tokens[0] ?? "";
-    // Extract basename from path (e.g. /usr/bin/rm → rm)
-    const raw = tokens[i];
-    const parts = raw.split(/[\\/]/);
-    const basename = parts[parts.length - 1] || raw;
-    // Strip .exe/.cmd/.bat extensions for blacklist matching (e.g. powershell.exe → powershell)
-    return basename.replace(/\.(exe|cmd|bat)$/i, "") || basename;
-}
-/**
- * Check if a shell operator appears as a standalone token in the command.
- * Uses regex with lookbehind/lookahead so that:
- *   "&"  does NOT match "&&"  (AND operator)
- *   "|"  does NOT match "||"  (OR operator)
- *   ">"  does NOT match ">>"  (append)
- *   "2>" does NOT match "2>>" (append stderr)
- */
-function containsOperator(command, op) {
-    const escaped = op.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    // For single-char operators that are prefixes of multi-char ones,
-    // ensure they don't match when part of a longer sequence.
-    // Note: "&" is no longer in dangerousOperators (&& is legitimate),
-    // but keep the special case for defense-in-depth if manually added.
-    if (op === "&")
-        return /(?<!&)&(?!&)/.test(command);
-    if (op === "|")
-        return /(?<!\|)\|(?!\|)/.test(command);
-    if (op === ">")
-        return /(?<!>)>(?!>)/.test(command);
-    // For everything else (including multi-char like ">>", "2>", "2>>", ";", "`"),
-    // match literally.
-    return new RegExp(escaped).test(command);
-}
-/**
- * Check if a command is allowed based on security configuration
- */
-export function isCommandAllowed(command, securityConfig) {
-    // If security is disabled, allow everything
-    if (!securityConfig?.enabled) {
-        return { allowed: true, sanitizedCommand: command };
-    }
-    // Ensure config has all required fields
-    let config = securityConfig;
-    if (!config.blacklist || !Array.isArray(config.blacklist)) {
-        config = {
-            ...FALLBACK_BASH_CONFIG,
-            enabled: config.enabled ?? FALLBACK_BASH_CONFIG.enabled,
-        };
-    }
-    const trimmedCommand = command.trim();
-    if (!trimmedCommand) {
-        return { allowed: false, reason: "Empty command" };
-    }
-    // Shell wrappers are always blocked — they bypass all command validation.
-    // The agent should use the bash tool directly, not shell interpreters.
-    const ALWAYS_BLOCKED = ["powershell", "pwsh", "cmd"];
-    const baseForShellCheck = extractBaseCommand(trimmedCommand);
-    if (ALWAYS_BLOCKED.includes(baseForShellCheck)) {
-        return {
-            allowed: false,
-            reason: `Shell wrapper "${baseForShellCheck}" is blocked — use the bash tool directly`,
-        };
-    }
-    // Check dangerous operators FIRST — before parsing the base command.
-    // e.g. "curl http://x | bash" must be caught even though curl isn't blacklisted.
-    if (config.blockDangerousFlags) {
-        for (const op of config.dangerousOperators || []) {
-            if (containsOperator(trimmedCommand, op)) {
-                return {
-                    allowed: false,
-                    reason: `Operator "${op}" is not allowed`,
-                };
-            }
-        }
-    }
-    // Extract actual base command (handles paths, env vars, sudo)
-    const baseCommand = extractBaseCommand(trimmedCommand);
-    // Check whitelist first (if non-empty, only whitelisted commands are allowed)
-    if (config.whitelist.length > 0) {
-        if (!config.whitelist.includes(baseCommand)) {
-            return {
-                allowed: false,
-                reason: `Command "${baseCommand}" is not in the whitelist`,
-            };
-        }
-    }
-    // Check blacklist (against the extracted basename, not the raw token)
-    if (config.blacklist.includes(baseCommand)) {
-        return {
-            allowed: false,
-            reason: `Command "${baseCommand}" is blacklisted`,
-        };
-    }
-    // Also check the raw first token in case it's a simple name
-    const rawFirst = trimmedCommand.split(/\s+/)[0].replace(/\.(exe|cmd|bat)$/i, "");
-    if (rawFirst !== baseCommand && config.blacklist.includes(rawFirst)) {
-        return {
-            allowed: false,
-            reason: `Command "${rawFirst}" is blacklisted`,
-        };
-    }
-    // Check for dangerous flags
-    if (config.blockDangerousFlags) {
-        for (const flag of config.dangerousFlags || []) {
-            // Check for flag as whole word or with equals
-            const flagPattern = new RegExp(`(?:^|\\s)${flag}(?:\\s|$|=)`);
-            if (flagPattern.test(trimmedCommand)) {
-                return {
-                    allowed: false,
-                    reason: `Dangerous flag "${flag}" is not allowed`,
-                };
-            }
-        }
-    }
-    // Command is allowed
-    return { allowed: true, sanitizedCommand: command };
-}
-/**
- * Sanitize command for logging (remove sensitive information)
- * Uses the same patterns as sanitizeLogMessage for consistency
- */
-export function sanitizeCommandForLog(command) {
-    // Import patterns from data-sanitizer to maintain consistency
-    const patterns = [
-        /(api[_-]?key|apikey|api_key)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        /(token|access[_-]?token|auth[_-]?token)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        /(password|passwd|pwd|pass)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        /(secret|private[_-]?key|secret[_-]?key)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        /\bsk-[a-zA-Z0-9_-]{20,}\b/gi,
-        /\bctx7sk-[a-zA-Z0-9_-]{10,}\b/gi,
-        /\bghp_[a-zA-Z0-9]{30,}\b/gi,
-        /\bgithub_pat_[a-zA-Z0-9]{20,}\b/gi,
-        /\bAKIA[0-9A-Z]{15,}\b/gi,
-        /Bearer\s+[a-zA-Z0-9_-]{20,}/gi,
-        /\b([a-zA-Z0-9_-]{30,})\b/g,
-    ];
-    let sanitized = command;
-    for (const pattern of patterns) {
-        if (pattern.toString().includes("($1")) {
-            // For patterns with capture groups, use the group in replacement
-            sanitized = sanitized.replace(pattern, (match, p1) => {
-                return `${p1}=[REDACTED]`;
-            });
-        }
-        else {
-            // For simple patterns, just replace with [REDACTED]
-            sanitized = sanitized.replace(pattern, "[REDACTED]");
-        }
-    }
-    return sanitized;
-}

package/dist/modules/security/content-scanner.js

@@ -1,53 +0,0 @@
-/**
- * Default dangerous patterns to scan for in file content.
- * NOTE: only genuinely dangerous constructs are listed. Legitimate runtime
- * APIs (process.exit, setTimeout/setInterval, template literals `${}`,
- * backtick strings) are NOT scanned — they are valid JS/TS and blocking
- * them breaks ordinary CLI code (false positives).
- */
-const DEFAULT_DANGEROUS_PATTERNS = [
-    /eval\(/gi,
-    /new Function\(/gi,
-    /child_process\.exec\(/gi,
-    /child_process\.spawn\(/gi,
-    /require\('child_process'\)/gi,
-    /require\('http'\).createServer/gi,
-    /require\('net'\).createServer/gi,
-    /require\('fs'\).writeFileSync/gi,
-    /require\('fs'\).unlinkSync/gi,
-    /while\(true\)/gi,
-    /for\(;;\)/gi,
-    /rm -rf/gi,
-    /dd if=/gi,
-    /chmod 777/gi,
-    /wget.*\|.*sh/gi,
-    /curl.*\|.*sh/gi,
-];
-/**
- * Scan file content for dangerous patterns
- */
-export function scanContent(content, filePath, config) {
-    // If scanning is disabled, allow everything
-    if (!config?.enabled) {
-        return { allowed: true };
-    }
-    // Use default patterns if none provided
-    const patterns = config.dangerousPatterns?.length
-        ? config.dangerousPatterns
-        : DEFAULT_DANGEROUS_PATTERNS;
-    const matches = [];
-    for (const pattern of patterns) {
-        const match = content.match(pattern);
-        if (match) {
-            matches.push(...match);
-        }
-    }
-    if (matches.length > 0) {
-        return {
-            allowed: false,
-            reason: `Content contains dangerous patterns in ${filePath}: ${matches.slice(0, 3).join(", ")}`,
-            matches,
-        };
-    }
-    return { allowed: true };
-}