micro-models-agent 0.50.4 → 0.51.2

package/dist/cli/security-commands.js

@@ -1,164 +0,0 @@
-import { bootstrap } from "../core/bootstrap";
-import { saveConfig } from "../config/config";
-import { join } from "path";
-import { homedir } from "os";
-import { SECURITY_POLICIES, applySecurityPolicy, getSecurityPolicy, } from "../modules/security/security-policies";
-import { globalAuditNotifier } from "../modules/security/audit-notifier";
-import { t } from "../i18n/index";
-/**
- * Create security subcommand
- */
-export function createSecurityCommand(program) {
-    const securityCmd = program.command("security").description(t("cli.security.description"));
-    // security status - show current security configuration
-    securityCmd
-        .command("status")
-        .description(t("cli.security.status"))
-        .action(async () => {
-        const { config } = await bootstrap();
-        const security = config.security || {};
-        const bash = security.bash || {};
-        const paths = security.paths || {};
-        const network = security.network || {};
-        const contentScan = security.contentScan || {};
-        const rateLimits = security.rateLimits || {};
-        const sessionEncryption = security.sessionEncryption || {};
-        const auditNotifier = security.auditNotifier || {};
-        console.log(t("cli.security.current_policy"));
-        console.log(`  ${t("cli.security.bash_enabled")}: ${bash.blacklist?.length > 0 ? t("cli.yes") : t("cli.no")}`);
-        console.log(`  ${t("cli.security.path_validation")}: ${paths.denied?.length > 0 ? t("cli.yes") : t("cli.no")}`);
-        console.log(`  ${t("cli.security.network_validation")}: ${network.deniedDomains?.length > 0 || network.allowedDomains?.length > 0 ? t("cli.yes") : t("cli.no")}`);
-        console.log(`  ${t("cli.security.content_scanning")}: ${contentScan.enabled ? t("cli.yes") : t("cli.no")}`);
-        console.log(`  ${t("cli.security.max_recursion")}: ${security.maxRecursionDepth ?? 3}`);
-        console.log(`  ${t("cli.security.max_file_ops")}: ${security.maxFileOperations ?? 100}`);
-        console.log(`  ${t("cli.security.rate_limit")}: ${rateLimits.maxRequestsPerMinute ?? 60}/min`);
-        console.log(`  ${t("cli.security.session_encryption")}: ${sessionEncryption.enabled ? t("cli.yes") : t("cli.no")}`);
-        console.log(`  ${t("cli.security.audit_notifier")}: ${auditNotifier.enabled ? t("cli.yes") : t("cli.no")}`);
-    });
-    // security policies - manage security policies
-    securityCmd
-        .command("policies")
-        .description(t("cli.security.policies"))
-        .action(async () => {
-        console.log(t("cli.security.available_policies"));
-        console.log("");
-        for (const [preset, policy] of Object.entries(SECURITY_POLICIES)) {
-            if (preset === "custom")
-                continue;
-            const marker = " ";
-            console.log(` ${marker}${preset.padEnd(12)}  ${policy.name}`);
-            console.log(`             ${policy.description}`);
-            console.log(`             ${t("cli.security.recommended_for")}: ${policy.recommendedFor.join(", ")}`);
-            console.log("");
-        }
-    });
-    // security set-policy - apply a security policy
-    securityCmd
-        .command("set-policy")
-        .argument("<preset>", t("cli.security.preset"))
-        .description(t("cli.security.set_policy"))
-        .action(async (preset) => {
-        const configPath = join(homedir(), ".mma", "config.json");
-        const { config: appConfig } = await bootstrap();
-        const validPresets = ["strict", "balanced", "permissive"];
-        if (!validPresets.includes(preset)) {
-            console.log(t("cli.security.invalid_preset", { presets: validPresets.join(", ") }));
-            return;
-        }
-        const policy = getSecurityPolicy(preset);
-        const newSecurityConfig = applySecurityPolicy(preset);
-        // Merge with existing config
-        appConfig.security = newSecurityConfig;
-        saveConfig(appConfig, configPath);
-        console.log(t("cli.security.policy_applied", { name: policy.name }));
-        console.log(t("cli.security.policy_description", { description: policy.description }));
-    });
-    // security enable-encryption - enable session file encryption
-    securityCmd
-        .command("enable-encryption")
-        .description(t("cli.security.enable_encryption"))
-        .action(async () => {
-        const configPath = join(homedir(), ".mma", "config.json");
-        const { config: appConfig } = await bootstrap();
-        appConfig.security = appConfig.security || {};
-        appConfig.security.sessionEncryption = {
-            enabled: true,
-            encryptHistory: true,
-            encryptSessionLog: true,
-        };
-        saveConfig(appConfig, configPath);
-        console.log(t("cli.security.encryption_enabled"));
-    });
-    // security disable-encryption - disable session file encryption
-    securityCmd
-        .command("disable-encryption")
-        .description(t("cli.security.disable_encryption"))
-        .action(async () => {
-        const configPath = join(homedir(), ".mma", "config.json");
-        const { config: appConfig } = await bootstrap();
-        appConfig.security = appConfig.security || {};
-        appConfig.security.sessionEncryption = {
-            enabled: false,
-            encryptHistory: false,
-            encryptSessionLog: false,
-        };
-        saveConfig(appConfig, configPath);
-        console.log(t("cli.security.encryption_disabled"));
-    });
-    // security enable-audit - enable audit notifications
-    securityCmd
-        .command("enable-audit")
-        .description(t("cli.security.enable_audit"))
-        .action(async () => {
-        const configPath = join(homedir(), ".mma", "config.json");
-        const { config: appConfig } = await bootstrap();
-        appConfig.security = appConfig.security || {};
-        appConfig.security.auditNotifier = {
-            enabled: true,
-            minSeverity: "medium",
-            eventTypes: ["security_block", "bash_command", "file_operation", "network_request"],
-            maxRetries: 3,
-            webhookTimeout: 5000,
-        };
-        saveConfig(appConfig, configPath);
-        console.log(t("cli.security.audit_enabled"));
-    });
-    // security disable-audit - disable audit notifications
-    securityCmd
-        .command("disable-audit")
-        .description(t("cli.security.disable_audit"))
-        .action(async () => {
-        const configPath = join(homedir(), ".mma", "config.json");
-        const { config: appConfig } = await bootstrap();
-        appConfig.security = appConfig.security || {};
-        appConfig.security.auditNotifier = {
-            enabled: false,
-            maxRetries: 3,
-            webhookTimeout: 5000,
-        };
-        saveConfig(appConfig, configPath);
-        console.log(t("cli.security.audit_disabled"));
-    });
-    // security audit-stats - show audit notification statistics
-    securityCmd
-        .command("audit-stats")
-        .description(t("cli.security.audit_stats"))
-        .action(async () => {
-        const stats = globalAuditNotifier.getStats();
-        console.log(t("cli.security.audit_stats_title"));
-        console.log(`  ${t("cli.security.total_notifications")}: ${stats.total}`);
-        console.log("");
-        console.log(t("cli.security.by_severity"));
-        console.log(`  ${t("cli.security.low")}: ${stats.bySeverity.low}`);
-        console.log(`  ${t("cli.security.medium")}: ${stats.bySeverity.medium}`);
-        console.log(`  ${t("cli.security.high")}: ${stats.bySeverity.high}`);
-        console.log(`  ${t("cli.security.critical")}: ${stats.bySeverity.critical}`);
-        console.log("");
-        console.log(t("cli.security.by_type"));
-        for (const [type, count] of Object.entries(stats.byType)) {
-            if (count > 0) {
-                console.log(`  ${type}: ${count}`);
-            }
-        }
-    });
-}

package/dist/cli/setup.js

@@ -1,231 +0,0 @@
-import * as readline from "readline";
-import { pc } from "../ui/colors";
-import { t, setLocale } from "../i18n/index";
-import { Spinner } from "../ui/spinner";
-import { box } from "../ui/box";
-import { renderTable } from "../ui/table";
-async function withSpinner(message, fn) {
-    const spinner = new Spinner();
-    spinner.start(message);
-    try {
-        return await fn();
-    }
-    finally {
-        spinner.stop();
-    }
-}
-/** Render a numbered list inside a box. */
-function menuList(items) {
-    const lines = items.map((it, i) => ` ${pc.cyan(`[${i + 1}]`)} ${it.label}${it.url ? `  ${pc.dim(it.url)}` : ""}`);
-    for (const l of box(lines, { width: 72 }))
-        console.log(l);
-}
-function ask(rl, question, defaultValue) {
-    return new Promise((resolve) => {
-        const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-        rl.question(prompt, (answer) => {
-            resolve(answer.trim() || defaultValue || "");
-        });
-    });
-}
-const PROVIDER_TYPES = [
-    {
-        value: "openai-compat",
-        label: "OpenAI-compatible (LM Studio, Ollama, vLLM, etc.)",
-    },
-    { value: "openai", label: "OpenAI API" },
-    { value: "anthropic", label: "Anthropic Claude" },
-];
-const KNOWN_PORTS = [
-    { port: 1234, label: "LM Studio" },
-    { port: 11434, label: "Ollama" },
-    { port: 8080, label: "vLLM / custom" },
-    { port: 4891, label: "GPT4All" },
-];
-async function scanPorts() {
-    const found = [];
-    for (const { port, label } of KNOWN_PORTS) {
-        try {
-            const controller = new AbortController();
-            const timeout = setTimeout(() => controller.abort(), 2000);
-            const resp = await fetch(`http://localhost:${port}/v1/models`, {
-                signal: controller.signal,
-            });
-            clearTimeout(timeout);
-            if (resp.ok) {
-                found.push({ label, url: `http://localhost:${port}/v1` });
-            }
-        }
-        catch {
-            /* port not available */
-        }
-    }
-    return found;
-}
-async function fetchModels(apiBase, apiKey) {
-    try {
-        const url = `${apiBase.replace(/\/+$/, "")}/models`;
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), 5000);
-        const resp = await fetch(url, {
-            headers: {
-                Authorization: `Bearer ${apiKey}`,
-                "Content-Type": "application/json",
-            },
-            signal: controller.signal,
-        });
-        clearTimeout(timeout);
-        if (!resp.ok)
-            return [];
-        const data = (await resp.json());
-        const models = (data.data || data || [])
-            .map((m) => m.id || m.name || m.model || "")
-            .filter(Boolean);
-        return models;
-    }
-    catch {
-        return [];
-    }
-}
-async function testChat(apiBase, apiKey, model) {
-    try {
-        const url = `${apiBase.replace(/\/+$/, "")}/chat/completions`;
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), 10000);
-        const resp = await fetch(url, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${apiKey}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({
-                model,
-                messages: [{ role: "user", content: 'Say "ok"' }],
-                max_tokens: 20,
-            }),
-            signal: controller.signal,
-        });
-        clearTimeout(timeout);
-        if (!resp.ok)
-            return false;
-        const data = (await resp.json());
-        const msg = data.choices?.[0]?.message;
-        const text = msg?.content || msg?.reasoning_content || "";
-        return text.length > 0;
-    }
-    catch {
-        return false;
-    }
-}
-export async function runSetup(externalRl) {
-    console.log(t("setup.title"));
-    const rl = externalRl ||
-        readline.createInterface({
-            input: process.stdin,
-            output: process.stdout,
-        });
-    const ownRl = !externalRl;
-    console.log(t("setup.language"));
-    const locale = await ask(rl, t("setup.ui_lang"), "en");
-    setLocale(locale);
-    console.log(t("setup.select_provider"));
-    menuList(PROVIDER_TYPES);
-    const providerChoice = await ask(rl, t("setup.select_provider_num", { max: PROVIDER_TYPES.length }), "1");
-    const providerIdx = Math.max(0, Math.min(PROVIDER_TYPES.length - 1, (parseInt(providerChoice) || 1) - 1));
-    const provider = PROVIDER_TYPES[providerIdx].value;
-    let apiBase = "";
-    if (provider === "openai-compat") {
-        const found = await withSpinner(t("setup.scanning_spinner"), async () => scanPorts());
-        if (found.length > 0) {
-            console.log(t("setup.found_servers", { count: found.length }));
-            menuList([
-                ...found.map((f) => ({ label: f.label, url: f.url })),
-                { label: t("setup.custom_url") },
-            ]);
-            const choice = await ask(rl, t("setup.select_server", { max: found.length + 1 }), "1");
-            const idx = (parseInt(choice) || 1) - 1;
-            if (idx >= found.length) {
-                apiBase = await ask(rl, t("setup.api_base"), "http://localhost:1234/v1");
-            }
-            else {
-                apiBase = found[Math.max(0, Math.min(found.length - 1, idx))].url;
-            }
-        }
-        else {
-            console.log(t("setup.no_servers"));
-            apiBase = await ask(rl, t("setup.api_base"), "http://localhost:1234/v1");
-        }
-    }
-    else if (provider === "openai") {
-        apiBase = "https://api.openai.com/v1";
-    }
-    else if (provider === "anthropic") {
-        apiBase = "https://api.anthropic.com";
-    }
-    const defaultKey = provider === "openai-compat" ? "not-needed" : "";
-    const apiKey = await ask(rl, t("setup.api_key"), defaultKey);
-    const models = await withSpinner(t("setup.fetching_spinner"), () => fetchModels(apiBase, apiKey));
-    let model = "";
-    if (models.length > 0) {
-        console.log(t("setup.available_models"));
-        menuList(models.slice(0, 10).map((m) => ({ label: m })));
-        const choice = await ask(rl, t("setup.select_model", { max: Math.min(models.length, 10) }), "1");
-        const idx = Math.max(0, Math.min(models.length - 1, (parseInt(choice) || 1) - 1));
-        model = models[idx];
-    }
-    else {
-        model = await ask(rl, t("setup.model_name"), "qwen/qwen3.5-9b");
-    }
-    const connected = await withSpinner(t("setup.testing_spinner", { model }), () => testChat(apiBase, apiKey, model));
-    if (connected) {
-        console.log(pc.green(t("setup.ok")));
-    }
-    else {
-        console.log(pc.yellow(t("setup.warning")));
-    }
-    console.log(t("setup.agent_settings"));
-    const contextWindow = parseInt(await ask(rl, t("setup.context_window"), "32768"));
-    const maxIterations = parseInt(await ask(rl, t("setup.max_iters"), "1000"));
-    // Security settings
-    console.log(t("setup.security_header"));
-    console.log(pc.dim(t("setup.security_status_off")));
-    const configureSecurity = await ask(rl, t("setup.security_configure"), "n");
-    let securityBashBlock = false;
-    let securityFlagsBlock = false;
-    let securityPathsDeny = true;
-    if (configureSecurity.toLowerCase() === "y" || configureSecurity.toLowerCase() === "yes") {
-        securityBashBlock = (await ask(rl, t("setup.security_bash_block"), "n")).toLowerCase() === "y";
-        securityFlagsBlock =
-            (await ask(rl, t("setup.security_flags_block"), "n")).toLowerCase() === "y";
-        securityPathsDeny = (await ask(rl, t("setup.security_paths_deny"), "Y")).toLowerCase() !== "n";
-    }
-    if (ownRl)
-        rl.close();
-    const answers = {
-        provider,
-        apiBase,
-        apiKey: apiKey || "not-needed",
-        model,
-        contextWindow,
-        maxToolIterations: maxIterations,
-        locale,
-        securityBashBlock,
-        securityFlagsBlock,
-        securityPathsDeny,
-    };
-    console.log(pc.green(pc.bold(t("setup.complete"))));
-    const summary = renderTable([
-        t("setup.summary_setting"),
-        t("setup.summary_value"),
-        t("setup.summary_setting"),
-        t("setup.summary_value"),
-    ], [
-        [t("setup.provider_type"), provider, t("setup.model_name"), model],
-        ["API Base URL", apiBase, t("setup.context_window"), String(contextWindow)],
-        [t("setup.api_key"), apiKey || "not-needed", t("setup.max_iters"), String(maxIterations)],
-        [t("setup.ui_lang"), locale, "", ""],
-    ], { maxColumns: 4 });
-    for (const l of summary)
-        console.log(l);
-    return answers;
-}

package/dist/config/config.js

@@ -1,249 +0,0 @@
-import { existsSync, readFileSync, unlinkSync, writeFileSync, mkdirSync } from "fs";
-import { join, dirname } from "path";
-import { DEFAULTS } from "./defaults";
-import { DEFAULT_SECURITY_CONFIG } from "./security";
-import { DEFAULT_LSP_CONFIG } from "../modules/lsp/config";
-import { t } from "../i18n/index";
-import { MigrationDetector } from "../migration/detect";
-import { BackupManager } from "../migration/backup";
-import { validateExpertConfig } from "./experts";
-import { ConfigEncryptor } from "../modules/security/encryption";
-/**
- * Restore RegExp instances in dangerousPatterns that were serialized as {}
- * (pre-0.8.0 configs) or as {__regex, source, flags} (new format).
- * Falls back to default patterns for any entry that is not a real RegExp.
- */
-function restoreDangerousPatterns(patterns, defaults) {
-    const fallback = (Array.isArray(defaults) ? defaults : []);
-    if (!Array.isArray(patterns) || patterns.length === 0) {
-        return fallback;
-    }
-    return patterns.map((p, i) => {
-        if (p instanceof RegExp)
-            return p;
-        // If the pattern was serialized as {__regex, source, flags}, revive it
-        if (p && typeof p === "object") {
-            const { source, flags } = p;
-            if (source && typeof source === "string") {
-                try {
-                    return new RegExp(source, flags || "");
-                }
-                catch {
-                    // fall through
-                }
-            }
-        }
-        // Corrupted entry (e.g. serialized as {} pre-0.8.0): use default by index
-        return fallback[i] || fallback[0] || p;
-    });
-}
-function deepMerge(target, source) {
-    const result = { ...target };
-    for (const key of Object.keys(source)) {
-        const srcVal = source[key];
-        const tgtVal = target[key];
-        if (srcVal !== null &&
-            srcVal !== undefined &&
-            typeof srcVal === "object" &&
-            !Array.isArray(srcVal) &&
-            typeof tgtVal === "object" &&
-            !Array.isArray(tgtVal)) {
-            result[key] = deepMerge(tgtVal, srcVal);
-        }
-        else if (srcVal !== undefined) {
-            result[key] = srcVal;
-        }
-    }
-    return result;
-}
-/**
- * JSON replacer that serializes RegExp objects as {__regex, source, flags}
- * so they survive JSON.stringify/parse round-trips.
- */
-function regexReplacer(_key, value) {
-    if (value instanceof RegExp) {
-        return { __regex: true, source: value.source, flags: value.flags };
-    }
-    return value;
-}
-/**
- * JSON reviver that restores RegExp objects serialized by regexReplacer.
- */
-function regexReviver(_key, value) {
-    if (value && typeof value === "object" && value.__regex === true) {
-        const { source, flags } = value;
-        try {
-            return new RegExp(source, flags);
-        }
-        catch {
-            return value;
-        }
-    }
-    return value;
-}
-/**
- * Legacy npx `args` for LSP servers that predate the fixed invocation
- * (`--yes --package <server> --package typescript@5 …`). These exact arrays
- * are unsafe: without `--yes`/`--package` the servers fail to bootstrap
- * (`Could not find a valid TypeScript installation`) or the package name is
- * wrong, so the server hangs until the initialize timeout. When a stored
- * server's `args` matches one of these (or is missing) it is replaced with the
- * current default args — user-customized arrays that differ are left alone.
- */
-const LEGACY_LSP_SERVER_ARGS = {
-    typescript: { args: ["typescript-language-server", "--stdio"], timeout: 30000 },
-    javascript: { args: ["typescript-language-server", "--stdio"], timeout: 30000 },
-    json: { args: ["vscode-json-languageserver", "--stdio"], timeout: 30000 },
-    html: { args: ["vscode-html-languageserver", "--stdio"], timeout: 60000 },
-    css: { args: ["vscode-css-languageserver", "--stdio"], timeout: 60000 },
-};
-/**
- * Replace stale pre-0.41.1 LSP server invocations (npx bootstrap args) with
- * the current defaults, so an old `~/.mma/config.json` that overrides the
- * fixed server args can't silently re-break every LSP server. In-memory only —
- * mirrors the `restoreDangerousPatterns` precedent; the file keeps the old
- * args and is normalized again on every load.
- */
-function normalizeLspServerArgs(config) {
-    const servers = config.lsp?.servers;
-    if (!servers)
-        return;
-    for (const [lang, legacy] of Object.entries(LEGACY_LSP_SERVER_ARGS)) {
-        const server = servers[lang];
-        const def = DEFAULT_LSP_CONFIG.servers[lang];
-        if (!server || server.command !== "npx" || !def)
-            continue;
-        const storedArgs = Array.isArray(server.args) ? server.args : null;
-        const isLegacy = storedArgs === null || JSON.stringify(storedArgs) === JSON.stringify(legacy.args);
-        if (isLegacy) {
-            server.args = def.args;
-            server.timeout = def.timeout;
-        }
-    }
-}
-function loadJSON(path) {
-    try {
-        if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, "utf-8"), regexReviver);
-        }
-    }
-    catch {
-        /* ignore malformed files */
-    }
-    return null;
-}
-function applyEnvVars(config) {
-    const env = process.env;
-    const result = { ...config };
-    if (env.MMA_MODEL)
-        result.model = env.MMA_MODEL;
-    if (env.MMA_PROVIDER_TYPE)
-        result.provider = { ...result.provider, type: env.MMA_PROVIDER_TYPE };
-    if (env.MMA_PROVIDER_BASEURL)
-        result.provider = { ...result.provider, baseUrl: env.MMA_PROVIDER_BASEURL };
-    if (env.MMA_PROVIDER_APIKEY)
-        result.provider = { ...result.provider, apiKey: env.MMA_PROVIDER_APIKEY };
-    if (env.MMA_LOG_LEVEL)
-        result.logLevel = env.MMA_LOG_LEVEL;
-    if (env.MMA_LOCALE)
-        result.locale = env.MMA_LOCALE;
-    if (env.MMA_CONTEXT_WINDOW) {
-        const v = parseInt(env.MMA_CONTEXT_WINDOW, 10);
-        if (!isNaN(v))
-            result.contextWindow = v;
-    }
-    if (env.MMA_MAX_TOOL_ITERATIONS) {
-        const v = parseInt(env.MMA_MAX_TOOL_ITERATIONS, 10);
-        if (!isNaN(v))
-            result.maxToolIterations = v;
-    }
-    if (env.MMA_STUCK_THRESHOLD) {
-        const v = parseInt(env.MMA_STUCK_THRESHOLD, 10);
-        if (!isNaN(v))
-            result.stuckThreshold = v;
-    }
-    if (env.MMA_AUTO_PLAN)
-        result.autoPlan = env.MMA_AUTO_PLAN === "true";
-    if (env.MMA_MOE_ENABLED)
-        result.moe = { ...result.moe, enabled: env.MMA_MOE_ENABLED === "true" };
-    return result;
-}
-export function loadConfig(options) {
-    const globalPath = join(options.configDir, "config.json");
-    mkdirSync(options.configDir, { recursive: true });
-    const detector = new MigrationDetector(options.configDir);
-    if (detector.needsMigration()) {
-        const backup = new BackupManager(options.configDir);
-        backup.backupConfig();
-        const summary = backup.getBackupSummary();
-        console.log(t("migration.detected", { summary }));
-        try {
-            unlinkSync(globalPath);
-        }
-        catch { }
-    }
-    let config = { ...DEFAULTS };
-    const globalData = loadJSON(globalPath);
-    if (globalData) {
-        config = deepMerge(config, globalData);
-    }
-    if (!existsSync(globalPath)) {
-        saveConfig(config, globalPath);
-    }
-    const projectData = loadJSON(options.projectConfigPath);
-    if (projectData) {
-        config = deepMerge(config, projectData);
-    }
-    // Restore RegExp patterns in contentScan that may have been serialized
-    // as {} in pre-0.8.0 config files, or merged from user config.
-    if (config.security?.contentScan?.dangerousPatterns) {
-        config.security.contentScan.dangerousPatterns = restoreDangerousPatterns(config.security.contentScan.dangerousPatterns, DEFAULT_SECURITY_CONFIG.contentScan.dangerousPatterns);
-    }
-    // Replace stale pre-0.41.1 LSP server args with the current defaults.
-    normalizeLspServerArgs(config);
-    config = applyEnvVars(config);
-    // Decrypt sensitive fields in the loaded config
-    try {
-        const encryptor = new ConfigEncryptor();
-        const decrypted = encryptor.decrypt(config);
-        // Merge decrypted sensitive fields back into config
-        for (const key of Object.keys(decrypted)) {
-            config[key] = decrypted[key];
-        }
-    }
-    catch (e) {
-        // If decryption fails, log a warning but continue with the config
-        console.warn(t("config.decryption_warning", { error: e.message }));
-    }
-    // Update global audit notifier with config (done in bootstrap.ts)
-    return config;
-}
-export function validateConfig(config, allToolTags) {
-    const errors = validateExpertConfig(config, allToolTags);
-    const knownTags = new Set(allToolTags);
-    for (const tag of config.tools?.defaultTags ?? []) {
-        if (!knownTags.has(tag)) {
-            errors.push(`tools.defaultTags references unknown tag "${tag}". Known tags: ${Array.from(knownTags).join(", ")}`);
-        }
-    }
-    if (errors.length > 0) {
-        throw new Error(`Config validation failed:\n${errors.join("\n")}`);
-    }
-}
-export function saveConfig(config, configPath) {
-    const dir = dirname(configPath);
-    mkdirSync(dir, { recursive: true });
-    // Encrypt sensitive fields before saving
-    try {
-        const encryptor = new ConfigEncryptor();
-        const encryptedConfig = encryptor.encrypt({
-            ...config,
-        });
-        writeFileSync(configPath, JSON.stringify(encryptedConfig, regexReplacer, 2), "utf-8");
-    }
-    catch (e) {
-        // If encryption fails, save without encryption
-        console.warn(t("config.encryption_warning", { error: e.message }));
-        writeFileSync(configPath, JSON.stringify(config, regexReplacer, 2), "utf-8");
-    }
-}