micro-models-agent 0.47.1 → 0.48.2

package/dist/cli/security-commands.js

@@ -0,0 +1,164 @@
+import { bootstrap } from "../core/bootstrap";
+import { saveConfig } from "../config/config";
+import { join } from "path";
+import { homedir } from "os";
+import { SECURITY_POLICIES, applySecurityPolicy, getSecurityPolicy, } from "../modules/security/security-policies";
+import { globalAuditNotifier } from "../modules/security/audit-notifier";
+import { t } from "../i18n/index";
+/**
+ * Create security subcommand
+ */
+export function createSecurityCommand(program) {
+    const securityCmd = program.command("security").description(t("cli.security.description"));
+    // security status - show current security configuration
+    securityCmd
+        .command("status")
+        .description(t("cli.security.status"))
+        .action(async () => {
+        const { config } = await bootstrap();
+        const security = config.security || {};
+        const bash = security.bash || {};
+        const paths = security.paths || {};
+        const network = security.network || {};
+        const contentScan = security.contentScan || {};
+        const rateLimits = security.rateLimits || {};
+        const sessionEncryption = security.sessionEncryption || {};
+        const auditNotifier = security.auditNotifier || {};
+        console.log(t("cli.security.current_policy"));
+        console.log(`  ${t("cli.security.bash_enabled")}: ${bash.blacklist?.length > 0 ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.path_validation")}: ${paths.denied?.length > 0 ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.network_validation")}: ${network.deniedDomains?.length > 0 || network.allowedDomains?.length > 0 ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.content_scanning")}: ${contentScan.enabled ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.max_recursion")}: ${security.maxRecursionDepth ?? 3}`);
+        console.log(`  ${t("cli.security.max_file_ops")}: ${security.maxFileOperations ?? 100}`);
+        console.log(`  ${t("cli.security.rate_limit")}: ${rateLimits.maxRequestsPerMinute ?? 60}/min`);
+        console.log(`  ${t("cli.security.session_encryption")}: ${sessionEncryption.enabled ? t("cli.yes") : t("cli.no")}`);
+        console.log(`  ${t("cli.security.audit_notifier")}: ${auditNotifier.enabled ? t("cli.yes") : t("cli.no")}`);
+    });
+    // security policies - manage security policies
+    securityCmd
+        .command("policies")
+        .description(t("cli.security.policies"))
+        .action(async () => {
+        console.log(t("cli.security.available_policies"));
+        console.log("");
+        for (const [preset, policy] of Object.entries(SECURITY_POLICIES)) {
+            if (preset === "custom")
+                continue;
+            const marker = " ";
+            console.log(` ${marker}${preset.padEnd(12)}  ${policy.name}`);
+            console.log(`             ${policy.description}`);
+            console.log(`             ${t("cli.security.recommended_for")}: ${policy.recommendedFor.join(", ")}`);
+            console.log("");
+        }
+    });
+    // security set-policy - apply a security policy
+    securityCmd
+        .command("set-policy")
+        .argument("<preset>", t("cli.security.preset"))
+        .description(t("cli.security.set_policy"))
+        .action(async (preset) => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        const validPresets = ["strict", "balanced", "permissive"];
+        if (!validPresets.includes(preset)) {
+            console.log(t("cli.security.invalid_preset", { presets: validPresets.join(", ") }));
+            return;
+        }
+        const policy = getSecurityPolicy(preset);
+        const newSecurityConfig = applySecurityPolicy(preset);
+        // Merge with existing config
+        appConfig.security = newSecurityConfig;
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.policy_applied", { name: policy.name }));
+        console.log(t("cli.security.policy_description", { description: policy.description }));
+    });
+    // security enable-encryption - enable session file encryption
+    securityCmd
+        .command("enable-encryption")
+        .description(t("cli.security.enable_encryption"))
+        .action(async () => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        appConfig.security = appConfig.security || {};
+        appConfig.security.sessionEncryption = {
+            enabled: true,
+            encryptHistory: true,
+            encryptSessionLog: true,
+        };
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.encryption_enabled"));
+    });
+    // security disable-encryption - disable session file encryption
+    securityCmd
+        .command("disable-encryption")
+        .description(t("cli.security.disable_encryption"))
+        .action(async () => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        appConfig.security = appConfig.security || {};
+        appConfig.security.sessionEncryption = {
+            enabled: false,
+            encryptHistory: false,
+            encryptSessionLog: false,
+        };
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.encryption_disabled"));
+    });
+    // security enable-audit - enable audit notifications
+    securityCmd
+        .command("enable-audit")
+        .description(t("cli.security.enable_audit"))
+        .action(async () => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        appConfig.security = appConfig.security || {};
+        appConfig.security.auditNotifier = {
+            enabled: true,
+            minSeverity: "medium",
+            eventTypes: ["security_block", "bash_command", "file_operation", "network_request"],
+            maxRetries: 3,
+            webhookTimeout: 5000,
+        };
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.audit_enabled"));
+    });
+    // security disable-audit - disable audit notifications
+    securityCmd
+        .command("disable-audit")
+        .description(t("cli.security.disable_audit"))
+        .action(async () => {
+        const configPath = join(homedir(), ".mma", "config.json");
+        const { config: appConfig } = await bootstrap();
+        appConfig.security = appConfig.security || {};
+        appConfig.security.auditNotifier = {
+            enabled: false,
+            maxRetries: 3,
+            webhookTimeout: 5000,
+        };
+        saveConfig(appConfig, configPath);
+        console.log(t("cli.security.audit_disabled"));
+    });
+    // security audit-stats - show audit notification statistics
+    securityCmd
+        .command("audit-stats")
+        .description(t("cli.security.audit_stats"))
+        .action(async () => {
+        const stats = globalAuditNotifier.getStats();
+        console.log(t("cli.security.audit_stats_title"));
+        console.log(`  ${t("cli.security.total_notifications")}: ${stats.total}`);
+        console.log("");
+        console.log(t("cli.security.by_severity"));
+        console.log(`  ${t("cli.security.low")}: ${stats.bySeverity.low}`);
+        console.log(`  ${t("cli.security.medium")}: ${stats.bySeverity.medium}`);
+        console.log(`  ${t("cli.security.high")}: ${stats.bySeverity.high}`);
+        console.log(`  ${t("cli.security.critical")}: ${stats.bySeverity.critical}`);
+        console.log("");
+        console.log(t("cli.security.by_type"));
+        for (const [type, count] of Object.entries(stats.byType)) {
+            if (count > 0) {
+                console.log(`  ${type}: ${count}`);
+            }
+        }
+    });
+}

package/dist/cli/setup.js

@@ -0,0 +1,231 @@
+import * as readline from "readline";
+import { pc } from "../ui/colors";
+import { t, setLocale } from "../i18n/index";
+import { Spinner } from "../ui/spinner";
+import { box } from "../ui/box";
+import { renderTable } from "../ui/table";
+async function withSpinner(message, fn) {
+    const spinner = new Spinner();
+    spinner.start(message);
+    try {
+        return await fn();
+    }
+    finally {
+        spinner.stop();
+    }
+}
+/** Render a numbered list inside a box. */
+function menuList(items) {
+    const lines = items.map((it, i) => ` ${pc.cyan(`[${i + 1}]`)} ${it.label}${it.url ? `  ${pc.dim(it.url)}` : ""}`);
+    for (const l of box(lines, { width: 72 }))
+        console.log(l);
+}
+function ask(rl, question, defaultValue) {
+    return new Promise((resolve) => {
+        const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
+        rl.question(prompt, (answer) => {
+            resolve(answer.trim() || defaultValue || "");
+        });
+    });
+}
+const PROVIDER_TYPES = [
+    {
+        value: "openai-compat",
+        label: "OpenAI-compatible (LM Studio, Ollama, vLLM, etc.)",
+    },
+    { value: "openai", label: "OpenAI API" },
+    { value: "anthropic", label: "Anthropic Claude" },
+];
+const KNOWN_PORTS = [
+    { port: 1234, label: "LM Studio" },
+    { port: 11434, label: "Ollama" },
+    { port: 8080, label: "vLLM / custom" },
+    { port: 4891, label: "GPT4All" },
+];
+async function scanPorts() {
+    const found = [];
+    for (const { port, label } of KNOWN_PORTS) {
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 2000);
+            const resp = await fetch(`http://localhost:${port}/v1/models`, {
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (resp.ok) {
+                found.push({ label, url: `http://localhost:${port}/v1` });
+            }
+        }
+        catch {
+            /* port not available */
+        }
+    }
+    return found;
+}
+async function fetchModels(apiBase, apiKey) {
+    try {
+        const url = `${apiBase.replace(/\/+$/, "")}/models`;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        const resp = await fetch(url, {
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            signal: controller.signal,
+        });
+        clearTimeout(timeout);
+        if (!resp.ok)
+            return [];
+        const data = (await resp.json());
+        const models = (data.data || data || [])
+            .map((m) => m.id || m.name || m.model || "")
+            .filter(Boolean);
+        return models;
+    }
+    catch {
+        return [];
+    }
+}
+async function testChat(apiBase, apiKey, model) {
+    try {
+        const url = `${apiBase.replace(/\/+$/, "")}/chat/completions`;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 10000);
+        const resp = await fetch(url, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                model,
+                messages: [{ role: "user", content: 'Say "ok"' }],
+                max_tokens: 20,
+            }),
+            signal: controller.signal,
+        });
+        clearTimeout(timeout);
+        if (!resp.ok)
+            return false;
+        const data = (await resp.json());
+        const msg = data.choices?.[0]?.message;
+        const text = msg?.content || msg?.reasoning_content || "";
+        return text.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export async function runSetup(externalRl) {
+    console.log(t("setup.title"));
+    const rl = externalRl ||
+        readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+    const ownRl = !externalRl;
+    console.log(t("setup.language"));
+    const locale = await ask(rl, t("setup.ui_lang"), "en");
+    setLocale(locale);
+    console.log(t("setup.select_provider"));
+    menuList(PROVIDER_TYPES);
+    const providerChoice = await ask(rl, t("setup.select_provider_num", { max: PROVIDER_TYPES.length }), "1");
+    const providerIdx = Math.max(0, Math.min(PROVIDER_TYPES.length - 1, (parseInt(providerChoice) || 1) - 1));
+    const provider = PROVIDER_TYPES[providerIdx].value;
+    let apiBase = "";
+    if (provider === "openai-compat") {
+        const found = await withSpinner(t("setup.scanning_spinner"), async () => scanPorts());
+        if (found.length > 0) {
+            console.log(t("setup.found_servers", { count: found.length }));
+            menuList([
+                ...found.map((f) => ({ label: f.label, url: f.url })),
+                { label: t("setup.custom_url") },
+            ]);
+            const choice = await ask(rl, t("setup.select_server", { max: found.length + 1 }), "1");
+            const idx = (parseInt(choice) || 1) - 1;
+            if (idx >= found.length) {
+                apiBase = await ask(rl, t("setup.api_base"), "http://localhost:1234/v1");
+            }
+            else {
+                apiBase = found[Math.max(0, Math.min(found.length - 1, idx))].url;
+            }
+        }
+        else {
+            console.log(t("setup.no_servers"));
+            apiBase = await ask(rl, t("setup.api_base"), "http://localhost:1234/v1");
+        }
+    }
+    else if (provider === "openai") {
+        apiBase = "https://api.openai.com/v1";
+    }
+    else if (provider === "anthropic") {
+        apiBase = "https://api.anthropic.com";
+    }
+    const defaultKey = provider === "openai-compat" ? "not-needed" : "";
+    const apiKey = await ask(rl, t("setup.api_key"), defaultKey);
+    const models = await withSpinner(t("setup.fetching_spinner"), () => fetchModels(apiBase, apiKey));
+    let model = "";
+    if (models.length > 0) {
+        console.log(t("setup.available_models"));
+        menuList(models.slice(0, 10).map((m) => ({ label: m })));
+        const choice = await ask(rl, t("setup.select_model", { max: Math.min(models.length, 10) }), "1");
+        const idx = Math.max(0, Math.min(models.length - 1, (parseInt(choice) || 1) - 1));
+        model = models[idx];
+    }
+    else {
+        model = await ask(rl, t("setup.model_name"), "qwen/qwen3.5-9b");
+    }
+    const connected = await withSpinner(t("setup.testing_spinner", { model }), () => testChat(apiBase, apiKey, model));
+    if (connected) {
+        console.log(pc.green(t("setup.ok")));
+    }
+    else {
+        console.log(pc.yellow(t("setup.warning")));
+    }
+    console.log(t("setup.agent_settings"));
+    const contextWindow = parseInt(await ask(rl, t("setup.context_window"), "32768"));
+    const maxIterations = parseInt(await ask(rl, t("setup.max_iters"), "1000"));
+    // Security settings
+    console.log(t("setup.security_header"));
+    console.log(pc.dim(t("setup.security_status_off")));
+    const configureSecurity = await ask(rl, t("setup.security_configure"), "n");
+    let securityBashBlock = false;
+    let securityFlagsBlock = false;
+    let securityPathsDeny = true;
+    if (configureSecurity.toLowerCase() === "y" || configureSecurity.toLowerCase() === "yes") {
+        securityBashBlock = (await ask(rl, t("setup.security_bash_block"), "n")).toLowerCase() === "y";
+        securityFlagsBlock =
+            (await ask(rl, t("setup.security_flags_block"), "n")).toLowerCase() === "y";
+        securityPathsDeny = (await ask(rl, t("setup.security_paths_deny"), "Y")).toLowerCase() !== "n";
+    }
+    if (ownRl)
+        rl.close();
+    const answers = {
+        provider,
+        apiBase,
+        apiKey: apiKey || "not-needed",
+        model,
+        contextWindow,
+        maxToolIterations: maxIterations,
+        locale,
+        securityBashBlock,
+        securityFlagsBlock,
+        securityPathsDeny,
+    };
+    console.log(pc.green(pc.bold(t("setup.complete"))));
+    const summary = renderTable([
+        t("setup.summary_setting"),
+        t("setup.summary_value"),
+        t("setup.summary_setting"),
+        t("setup.summary_value"),
+    ], [
+        [t("setup.provider_type"), provider, t("setup.model_name"), model],
+        ["API Base URL", apiBase, t("setup.context_window"), String(contextWindow)],
+        [t("setup.api_key"), apiKey || "not-needed", t("setup.max_iters"), String(maxIterations)],
+        [t("setup.ui_lang"), locale, "", ""],
+    ], { maxColumns: 4 });
+    for (const l of summary)
+        console.log(l);
+    return answers;
+}

package/dist/config/config.js

@@ -0,0 +1,249 @@
+import { existsSync, readFileSync, unlinkSync, writeFileSync, mkdirSync } from "fs";
+import { join, dirname } from "path";
+import { DEFAULTS } from "./defaults";
+import { DEFAULT_SECURITY_CONFIG } from "./security";
+import { DEFAULT_LSP_CONFIG } from "../modules/lsp/config";
+import { t } from "../i18n/index";
+import { MigrationDetector } from "../migration/detect";
+import { BackupManager } from "../migration/backup";
+import { validateExpertConfig } from "./experts";
+import { ConfigEncryptor } from "../modules/security/encryption";
+/**
+ * Restore RegExp instances in dangerousPatterns that were serialized as {}
+ * (pre-0.8.0 configs) or as {__regex, source, flags} (new format).
+ * Falls back to default patterns for any entry that is not a real RegExp.
+ */
+function restoreDangerousPatterns(patterns, defaults) {
+    const fallback = (Array.isArray(defaults) ? defaults : []);
+    if (!Array.isArray(patterns) || patterns.length === 0) {
+        return fallback;
+    }
+    return patterns.map((p, i) => {
+        if (p instanceof RegExp)
+            return p;
+        // If the pattern was serialized as {__regex, source, flags}, revive it
+        if (p && typeof p === "object") {
+            const { source, flags } = p;
+            if (source && typeof source === "string") {
+                try {
+                    return new RegExp(source, flags || "");
+                }
+                catch {
+                    // fall through
+                }
+            }
+        }
+        // Corrupted entry (e.g. serialized as {} pre-0.8.0): use default by index
+        return fallback[i] || fallback[0] || p;
+    });
+}
+function deepMerge(target, source) {
+    const result = { ...target };
+    for (const key of Object.keys(source)) {
+        const srcVal = source[key];
+        const tgtVal = target[key];
+        if (srcVal !== null &&
+            srcVal !== undefined &&
+            typeof srcVal === "object" &&
+            !Array.isArray(srcVal) &&
+            typeof tgtVal === "object" &&
+            !Array.isArray(tgtVal)) {
+            result[key] = deepMerge(tgtVal, srcVal);
+        }
+        else if (srcVal !== undefined) {
+            result[key] = srcVal;
+        }
+    }
+    return result;
+}
+/**
+ * JSON replacer that serializes RegExp objects as {__regex, source, flags}
+ * so they survive JSON.stringify/parse round-trips.
+ */
+function regexReplacer(_key, value) {
+    if (value instanceof RegExp) {
+        return { __regex: true, source: value.source, flags: value.flags };
+    }
+    return value;
+}
+/**
+ * JSON reviver that restores RegExp objects serialized by regexReplacer.
+ */
+function regexReviver(_key, value) {
+    if (value && typeof value === "object" && value.__regex === true) {
+        const { source, flags } = value;
+        try {
+            return new RegExp(source, flags);
+        }
+        catch {
+            return value;
+        }
+    }
+    return value;
+}
+/**
+ * Legacy npx `args` for LSP servers that predate the fixed invocation
+ * (`--yes --package <server> --package typescript@5 …`). These exact arrays
+ * are unsafe: without `--yes`/`--package` the servers fail to bootstrap
+ * (`Could not find a valid TypeScript installation`) or the package name is
+ * wrong, so the server hangs until the initialize timeout. When a stored
+ * server's `args` matches one of these (or is missing) it is replaced with the
+ * current default args — user-customized arrays that differ are left alone.
+ */
+const LEGACY_LSP_SERVER_ARGS = {
+    typescript: { args: ["typescript-language-server", "--stdio"], timeout: 30000 },
+    javascript: { args: ["typescript-language-server", "--stdio"], timeout: 30000 },
+    json: { args: ["vscode-json-languageserver", "--stdio"], timeout: 30000 },
+    html: { args: ["vscode-html-languageserver", "--stdio"], timeout: 60000 },
+    css: { args: ["vscode-css-languageserver", "--stdio"], timeout: 60000 },
+};
+/**
+ * Replace stale pre-0.41.1 LSP server invocations (npx bootstrap args) with
+ * the current defaults, so an old `~/.mma/config.json` that overrides the
+ * fixed server args can't silently re-break every LSP server. In-memory only —
+ * mirrors the `restoreDangerousPatterns` precedent; the file keeps the old
+ * args and is normalized again on every load.
+ */
+function normalizeLspServerArgs(config) {
+    const servers = config.lsp?.servers;
+    if (!servers)
+        return;
+    for (const [lang, legacy] of Object.entries(LEGACY_LSP_SERVER_ARGS)) {
+        const server = servers[lang];
+        const def = DEFAULT_LSP_CONFIG.servers[lang];
+        if (!server || server.command !== "npx" || !def)
+            continue;
+        const storedArgs = Array.isArray(server.args) ? server.args : null;
+        const isLegacy = storedArgs === null || JSON.stringify(storedArgs) === JSON.stringify(legacy.args);
+        if (isLegacy) {
+            server.args = def.args;
+            server.timeout = def.timeout;
+        }
+    }
+}
+function loadJSON(path) {
+    try {
+        if (existsSync(path)) {
+            return JSON.parse(readFileSync(path, "utf-8"), regexReviver);
+        }
+    }
+    catch {
+        /* ignore malformed files */
+    }
+    return null;
+}
+function applyEnvVars(config) {
+    const env = process.env;
+    const result = { ...config };
+    if (env.MMA_MODEL)
+        result.model = env.MMA_MODEL;
+    if (env.MMA_PROVIDER_TYPE)
+        result.provider = { ...result.provider, type: env.MMA_PROVIDER_TYPE };
+    if (env.MMA_PROVIDER_BASEURL)
+        result.provider = { ...result.provider, baseUrl: env.MMA_PROVIDER_BASEURL };
+    if (env.MMA_PROVIDER_APIKEY)
+        result.provider = { ...result.provider, apiKey: env.MMA_PROVIDER_APIKEY };
+    if (env.MMA_LOG_LEVEL)
+        result.logLevel = env.MMA_LOG_LEVEL;
+    if (env.MMA_LOCALE)
+        result.locale = env.MMA_LOCALE;
+    if (env.MMA_CONTEXT_WINDOW) {
+        const v = parseInt(env.MMA_CONTEXT_WINDOW, 10);
+        if (!isNaN(v))
+            result.contextWindow = v;
+    }
+    if (env.MMA_MAX_TOOL_ITERATIONS) {
+        const v = parseInt(env.MMA_MAX_TOOL_ITERATIONS, 10);
+        if (!isNaN(v))
+            result.maxToolIterations = v;
+    }
+    if (env.MMA_STUCK_THRESHOLD) {
+        const v = parseInt(env.MMA_STUCK_THRESHOLD, 10);
+        if (!isNaN(v))
+            result.stuckThreshold = v;
+    }
+    if (env.MMA_AUTO_PLAN)
+        result.autoPlan = env.MMA_AUTO_PLAN === "true";
+    if (env.MMA_MOE_ENABLED)
+        result.moe = { ...result.moe, enabled: env.MMA_MOE_ENABLED === "true" };
+    return result;
+}
+export function loadConfig(options) {
+    const globalPath = join(options.configDir, "config.json");
+    mkdirSync(options.configDir, { recursive: true });
+    const detector = new MigrationDetector(options.configDir);
+    if (detector.needsMigration()) {
+        const backup = new BackupManager(options.configDir);
+        backup.backupConfig();
+        const summary = backup.getBackupSummary();
+        console.log(t("migration.detected", { summary }));
+        try {
+            unlinkSync(globalPath);
+        }
+        catch { }
+    }
+    let config = { ...DEFAULTS };
+    const globalData = loadJSON(globalPath);
+    if (globalData) {
+        config = deepMerge(config, globalData);
+    }
+    if (!existsSync(globalPath)) {
+        saveConfig(config, globalPath);
+    }
+    const projectData = loadJSON(options.projectConfigPath);
+    if (projectData) {
+        config = deepMerge(config, projectData);
+    }
+    // Restore RegExp patterns in contentScan that may have been serialized
+    // as {} in pre-0.8.0 config files, or merged from user config.
+    if (config.security?.contentScan?.dangerousPatterns) {
+        config.security.contentScan.dangerousPatterns = restoreDangerousPatterns(config.security.contentScan.dangerousPatterns, DEFAULT_SECURITY_CONFIG.contentScan.dangerousPatterns);
+    }
+    // Replace stale pre-0.41.1 LSP server args with the current defaults.
+    normalizeLspServerArgs(config);
+    config = applyEnvVars(config);
+    // Decrypt sensitive fields in the loaded config
+    try {
+        const encryptor = new ConfigEncryptor();
+        const decrypted = encryptor.decrypt(config);
+        // Merge decrypted sensitive fields back into config
+        for (const key of Object.keys(decrypted)) {
+            config[key] = decrypted[key];
+        }
+    }
+    catch (e) {
+        // If decryption fails, log a warning but continue with the config
+        console.warn(t("config.decryption_warning", { error: e.message }));
+    }
+    // Update global audit notifier with config (done in bootstrap.ts)
+    return config;
+}
+export function validateConfig(config, allToolTags) {
+    const errors = validateExpertConfig(config, allToolTags);
+    const knownTags = new Set(allToolTags);
+    for (const tag of config.tools?.defaultTags ?? []) {
+        if (!knownTags.has(tag)) {
+            errors.push(`tools.defaultTags references unknown tag "${tag}". Known tags: ${Array.from(knownTags).join(", ")}`);
+        }
+    }
+    if (errors.length > 0) {
+        throw new Error(`Config validation failed:\n${errors.join("\n")}`);
+    }
+}
+export function saveConfig(config, configPath) {
+    const dir = dirname(configPath);
+    mkdirSync(dir, { recursive: true });
+    // Encrypt sensitive fields before saving
+    try {
+        const encryptor = new ConfigEncryptor();
+        const encryptedConfig = encryptor.encrypt({
+            ...config,
+        });
+        writeFileSync(configPath, JSON.stringify(encryptedConfig, regexReplacer, 2), "utf-8");
+    }
+    catch (e) {
+        // If encryption fails, save without encryption
+        console.warn(t("config.encryption_warning", { error: e.message }));
+        writeFileSync(configPath, JSON.stringify(config, regexReplacer, 2), "utf-8");
+    }
+}