micro-models-agent 0.52.0 → 0.52.1

package/dist/modules/security/command-validator.js

@@ -1,219 +0,0 @@
-import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
-// Fallback in case DEFAULT_SECURITY_CONFIG is not available
-const FALLBACK_BASH_CONFIG = {
-    enabled: false,
-    blacklist: [
-        "rm",
-        "dd",
-        "chmod",
-        "wget",
-        "curl",
-        "scp",
-        "ssh",
-        "nc",
-        "netcat",
-        "powershell",
-        "pwsh",
-        "cmd",
-    ],
-    whitelist: [],
-    blockDangerousFlags: false,
-    dangerousFlags: ["--force", "-rf", "--no-preserve-root"],
-    dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "`"],
-    logCommands: true,
-};
-export const DEFAULT_BASH_CONFIG = DEFAULT_SECURITY_CONFIG?.bash || FALLBACK_BASH_CONFIG;
-/**
- * Extract the actual base command from a shell command string.
- * Handles path prefixes, env assignments, and sudo.
- *
- * Examples:
- *   "/usr/bin/rm -rf /"           → "rm"
- *   "sudo /usr/bin/rm file"       → "rm"
- *   "NODE_ENV=prod node app.js"   → "node"
- *   "env PATH=/x rm -rf /"        → "rm"
- *   "cmd=rm; $cmd -rf /"          → "cmd" (variable indirection — not expanded)
- *   "powershell Remove-Item x"    → "Remove-Item"
- *   "cmd /c del /s /q"            → "del"
- */
-function extractBaseCommand(trimmed) {
-    const tokens = trimmed.split(/\s+/);
-    let i = 0;
-    // Skip env assignments (KEY=val, KEY="val", etc.) and prefixed commands
-    while (i < tokens.length) {
-        const tok = tokens[i];
-        if (/^[a-zA-Z_][a-zA-Z0-9_]*=/.test(tok)) {
-            i++;
-            continue;
-        }
-        if (tok === "sudo" || tok === "env" || tok === "command" || tok === "exec" || tok === "nohup") {
-            i++;
-            continue;
-        }
-        break;
-    }
-    if (i >= tokens.length)
-        return tokens[0] ?? "";
-    // Extract basename from path (e.g. /usr/bin/rm → rm)
-    const raw = tokens[i];
-    const parts = raw.split(/[\\/]/);
-    const basename = parts[parts.length - 1] || raw;
-    // Strip .exe/.cmd/.bat extensions for blacklist matching (e.g. powershell.exe → powershell)
-    return basename.replace(/\.(exe|cmd|bat)$/i, "") || basename;
-}
-/**
- * Check if a shell operator appears as a standalone token in the command.
- * Uses regex with lookbehind/lookahead so that:
- *   "&"  does NOT match "&&"  (AND operator)
- *   "|"  does NOT match "||"  (OR operator)
- *   ">"  does NOT match ">>"  (append)
- *   "2>" does NOT match "2>>" (append stderr)
- */
-function containsOperator(command, op) {
-    const escaped = op.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    // For single-char operators that are prefixes of multi-char ones,
-    // ensure they don't match when part of a longer sequence.
-    // Note: "&" is no longer in dangerousOperators (&& is legitimate),
-    // but keep the special case for defense-in-depth if manually added.
-    if (op === "&")
-        return /(?<!&)&(?!&)/.test(command);
-    if (op === "|")
-        return /(?<!\|)\|(?!\|)/.test(command);
-    if (op === ">")
-        return /(?<!>)>(?!>)/.test(command);
-    // For everything else (including multi-char like ">>", "2>", "2>>", ";", "`"),
-    // match literally.
-    return new RegExp(escaped).test(command);
-}
-/**
- * Check if a command is allowed based on security configuration
- */
-export function isCommandAllowed(command, securityConfig) {
-    // If security is disabled, allow everything
-    if (!securityConfig?.enabled) {
-        return { allowed: true, sanitizedCommand: command };
-    }
-    // Ensure config has all required fields
-    let config = securityConfig;
-    if (!config.blacklist || !Array.isArray(config.blacklist)) {
-        config = {
-            ...FALLBACK_BASH_CONFIG,
-            enabled: config.enabled ?? FALLBACK_BASH_CONFIG.enabled,
-        };
-    }
-    const trimmedCommand = command.trim();
-    if (!trimmedCommand) {
-        return { allowed: false, reason: "Empty command" };
-    }
-    // Shell wrappers are always blocked — they bypass all command validation.
-    // The agent should use the bash tool directly, not shell interpreters.
-    const ALWAYS_BLOCKED = ["powershell", "pwsh", "cmd"];
-    const baseForShellCheck = extractBaseCommand(trimmedCommand);
-    if (ALWAYS_BLOCKED.includes(baseForShellCheck)) {
-        return {
-            allowed: false,
-            reason: `Shell wrapper "${baseForShellCheck}" is blocked — use the bash tool directly`,
-        };
-    }
-    // Interpreters with -c/-e execute arbitrary code and bypass the blacklist.
-    const INTERPRETER_FLAGS = /(?:^|\s)(?:bash|sh|zsh|dash|python|python3|node|bun|perl|ruby)\s+(?:-c|-e|--command|--eval)\b/;
-    if (INTERPRETER_FLAGS.test(trimmedCommand)) {
-        return { allowed: false, reason: "Interpreter -c/-e invocation is blocked" };
-    }
-    // Multi-line commands can hide blacklisted commands after a newline.
-    if (/\r?\n/.test(trimmedCommand)) {
-        return { allowed: false, reason: "Multi-line commands are blocked" };
-    }
-    // Chained commands bypass the base-command check (e.g. "echo hi; rm -rf /").
-    if (/[;&|]/.test(trimmedCommand) &&
-        /(^|[;&|\s])(rm|del|rd|dd|chmod|chown|wget|curl|nc|netcat|shutdown|reboot|mkfs|fdisk)\b/.test(trimmedCommand)) {
-        return { allowed: false, reason: "Command chaining to a dangerous command is blocked" };
-    }
-    // Check dangerous operators FIRST — before parsing the base command.
-    // e.g. "curl http://x | bash" must be caught even though curl isn't blacklisted.
-    if (config.blockDangerousFlags) {
-        for (const op of config.dangerousOperators || []) {
-            if (containsOperator(trimmedCommand, op)) {
-                return {
-                    allowed: false,
-                    reason: `Operator "${op}" is not allowed`,
-                };
-            }
-        }
-    }
-    // Extract actual base command (handles paths, env vars, sudo)
-    const baseCommand = extractBaseCommand(trimmedCommand);
-    // Check whitelist first (if non-empty, only whitelisted commands are allowed)
-    if (config.whitelist.length > 0) {
-        if (!config.whitelist.includes(baseCommand)) {
-            return {
-                allowed: false,
-                reason: `Command "${baseCommand}" is not in the whitelist`,
-            };
-        }
-    }
-    // Check blacklist (against the extracted basename, not the raw token)
-    if (config.blacklist.includes(baseCommand)) {
-        return {
-            allowed: false,
-            reason: `Command "${baseCommand}" is blacklisted`,
-        };
-    }
-    // Also check the raw first token in case it's a simple name
-    const rawFirst = trimmedCommand.split(/\s+/)[0].replace(/\.(exe|cmd|bat)$/i, "");
-    if (rawFirst !== baseCommand && config.blacklist.includes(rawFirst)) {
-        return {
-            allowed: false,
-            reason: `Command "${rawFirst}" is blacklisted`,
-        };
-    }
-    // Check for dangerous flags
-    if (config.blockDangerousFlags) {
-        for (const flag of config.dangerousFlags || []) {
-            // Check for flag as whole word or with equals
-            const flagPattern = new RegExp(`(?:^|\\s)${flag}(?:\\s|$|=)`);
-            if (flagPattern.test(trimmedCommand)) {
-                return {
-                    allowed: false,
-                    reason: `Dangerous flag "${flag}" is not allowed`,
-                };
-            }
-        }
-    }
-    // Command is allowed
-    return { allowed: true, sanitizedCommand: command };
-}
-/**
- * Sanitize command for logging (remove sensitive information)
- * Uses the same patterns as sanitizeLogMessage for consistency
- */
-export function sanitizeCommandForLog(command) {
-    // Import patterns from data-sanitizer to maintain consistency
-    const patterns = [
-        /(api[_-]?key|apikey|api_key)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        /(token|access[_-]?token|auth[_-]?token)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        /(password|passwd|pwd|pass)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        /(secret|private[_-]?key|secret[_-]?key)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        /\bsk-[a-zA-Z0-9_-]{20,}\b/gi,
-        /\bctx7sk-[a-zA-Z0-9_-]{10,}\b/gi,
-        /\bghp_[a-zA-Z0-9]{30,}\b/gi,
-        /\bgithub_pat_[a-zA-Z0-9]{20,}\b/gi,
-        /\bAKIA[0-9A-Z]{15,}\b/gi,
-        /Bearer\s+[a-zA-Z0-9_-]{20,}/gi,
-        /\b([a-zA-Z0-9_-]{30,})\b/g,
-    ];
-    let sanitized = command;
-    for (const pattern of patterns) {
-        if (pattern.toString().includes("($1")) {
-            // For patterns with capture groups, use the group in replacement
-            sanitized = sanitized.replace(pattern, (match, p1) => {
-                return `${p1}=[REDACTED]`;
-            });
-        }
-        else {
-            // For simple patterns, just replace with [REDACTED]
-            sanitized = sanitized.replace(pattern, "[REDACTED]");
-        }
-    }
-    return sanitized;
-}

package/dist/modules/security/content-scanner.js

@@ -1,53 +0,0 @@
-/**
- * Default dangerous patterns to scan for in file content.
- * NOTE: only genuinely dangerous constructs are listed. Legitimate runtime
- * APIs (process.exit, setTimeout/setInterval, template literals `${}`,
- * backtick strings) are NOT scanned — they are valid JS/TS and blocking
- * them breaks ordinary CLI code (false positives).
- */
-const DEFAULT_DANGEROUS_PATTERNS = [
-    /eval\(/gi,
-    /new Function\(/gi,
-    /child_process\.exec\(/gi,
-    /child_process\.spawn\(/gi,
-    /require\('child_process'\)/gi,
-    /require\('http'\).createServer/gi,
-    /require\('net'\).createServer/gi,
-    /require\('fs'\).writeFileSync/gi,
-    /require\('fs'\).unlinkSync/gi,
-    /while\(true\)/gi,
-    /for\(;;\)/gi,
-    /rm -rf/gi,
-    /dd if=/gi,
-    /chmod 777/gi,
-    /wget.*\|.*sh/gi,
-    /curl.*\|.*sh/gi,
-];
-/**
- * Scan file content for dangerous patterns
- */
-export function scanContent(content, filePath, config) {
-    // If scanning is disabled, allow everything
-    if (!config?.enabled) {
-        return { allowed: true };
-    }
-    // Use default patterns if none provided
-    const patterns = config.dangerousPatterns?.length
-        ? config.dangerousPatterns
-        : DEFAULT_DANGEROUS_PATTERNS;
-    const matches = [];
-    for (const pattern of patterns) {
-        const match = content.match(pattern);
-        if (match) {
-            matches.push(...match);
-        }
-    }
-    if (matches.length > 0) {
-        return {
-            allowed: false,
-            reason: `Content contains dangerous patterns in ${filePath}: ${matches.slice(0, 3).join(", ")}`,
-            matches,
-        };
-    }
-    return { allowed: true };
-}

package/dist/modules/security/data-sanitizer.js

@@ -1,89 +0,0 @@
-/**
- * Patterns for sensitive data that should be redacted from logs
- */
-const SENSITIVE_PATTERNS = [
-    // API keys and tokens in key=value format
-    {
-        pattern: /(api[_-]?key|apikey|api_key)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        replacement: "$1=[REDACTED]",
-    },
-    {
-        pattern: /(token|access[_-]?token|auth[_-]?token)\s*[=:\s]\s*["']?([a-zA-Z0-9_-]{10,})["']?/gi,
-        replacement: "$1=[REDACTED]",
-    },
-    {
-        pattern: /(password|passwd|pwd|pass)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        replacement: "$1=[REDACTED]",
-    },
-    {
-        pattern: /(secret|private[_-]?key|secret[_-]?key)\s*[=:\s]\s*["']?([^\s"'&]+)["']?/gi,
-        replacement: "$1=[REDACTED]",
-    },
-    // Standalone API keys (not in key=value format)
-    {
-        pattern: /\bsk-[a-zA-Z0-9_-]{20,}\b/gi,
-        replacement: "sk-[REDACTED]",
-    },
-    {
-        pattern: /\bctx7sk-[a-zA-Z0-9_-]{10,}\b/gi,
-        replacement: "ctx7sk-[REDACTED]",
-    },
-    {
-        pattern: /\bghp_[a-zA-Z0-9]{30,}\b/gi,
-        replacement: "ghp_[REDACTED]",
-    },
-    {
-        pattern: /\bgithub_pat_[a-zA-Z0-9]{20,}\b/gi,
-        replacement: "github_pat_[REDACTED]",
-    },
-    {
-        pattern: /\bAKIA[0-9A-Z]{15,}\b/gi,
-        replacement: "AKIA[REDACTED]",
-    },
-    // Bearer tokens in headers
-    {
-        pattern: /Bearer\s+[a-zA-Z0-9_-]{20,}/gi,
-        replacement: "Bearer [REDACTED]",
-    },
-    // Generic high-entropy strings that look like secrets (30+ chars, mixed case and numbers)
-    {
-        pattern: /\b([a-zA-Z0-9_-]{30,})\b/g,
-        replacement: "[REDACTED]",
-    },
-];
-/**
- * Sanitize a log message by removing sensitive information
- */
-export function sanitizeLogMessage(message) {
-    let sanitized = message;
-    for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
-        sanitized = sanitized.replace(pattern, replacement);
-    }
-    return sanitized;
-}
-/**
- * Sanitize a command string by removing sensitive information
- */
-export function sanitizeCommand(command) {
-    return sanitizeLogMessage(command);
-}
-/**
- * Sanitize a URL by removing sensitive query parameters
- */
-export function sanitizeUrl(url) {
-    try {
-        const urlObj = new URL(url);
-        const sensitiveKeys = ["api_key", "token", "password", "secret", "access_token", "auth", "key"];
-        const sanitizedParams = new URLSearchParams(urlObj.search);
-        for (const key of sensitiveKeys) {
-            if (sanitizedParams.has(key)) {
-                sanitizedParams.set(key, "[REDACTED]");
-            }
-        }
-        urlObj.search = sanitizedParams.toString();
-        return urlObj.toString();
-    }
-    catch {
-        return sanitizeLogMessage(url);
-    }
-}

package/dist/modules/security/encryption.js

@@ -1,242 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
-import { homedir } from "os";
-import { join } from "path";
-import { readFileSync, writeFileSync, existsSync, copyFileSync } from "fs";
-const DEFAULT_CONFIG = {
-    keyPath: join(homedir(), ".mma", ".encryption-key"),
-    algorithm: "aes-256-gcm",
-};
-const IV_LENGTH = 16;
-const SALT_LENGTH = 16;
-const KEY_LENGTH = 32;
-const AUTH_TAG_LENGTH = 16;
-/**
- * Generate a new encryption key
- */
-export function generateEncryptionKey() {
-    return randomBytes(KEY_LENGTH);
-}
-/**
- * Get or create encryption key from file
- */
-export function getOrCreateEncryptionKey(config) {
-    const { keyPath } = { ...DEFAULT_CONFIG, ...config };
-    // Ensure directory exists
-    const dir = join(keyPath, "..");
-    if (!existsSync(dir)) {
-        // Note: We can't use mkdirSync here because we're in a pure function
-        // This will be handled by the caller
-    }
-    if (!existsSync(keyPath)) {
-        const key = generateEncryptionKey();
-        try {
-            writeFileSync(keyPath, key.toString("base64"), { mode: 0o600 });
-            return key;
-        }
-        catch (e) {
-            // If we can't persist the key, encrypted data would be unrecoverable
-            // on the next run — fail loudly instead of silently degrading.
-            throw new Error(`Cannot write encryption key to ${keyPath}: ${e instanceof Error ? e.message : String(e)}`);
-        }
-    }
-    try {
-        const keyBase64 = readFileSync(keyPath, "utf8");
-        return Buffer.from(keyBase64, "base64");
-    }
-    catch {
-        // Backup the corrupted key file before throwing
-        try {
-            const backupPath = `${keyPath}.corrupted.${Date.now()}`;
-            copyFileSync(keyPath, backupPath);
-        }
-        catch {
-            /* backup failed, continue */
-        }
-        throw new Error(`Encryption key file is corrupted or unreadable: ${keyPath}. ` +
-            `All previously encrypted data will be unrecoverable. ` +
-            `Delete the key file to generate a new one.`);
-    }
-}
-/**
- * Encrypt a string using AES-256-GCM
- * Note: Bun's crypto module doesn't support getAuthTag/setAuthTag directly,
- * so we use a simpler approach with AES-256-CBC + HMAC for authentication
- */
-export function encryptString(plaintext, key) {
-    const iv = randomBytes(IV_LENGTH);
-    const salt = randomBytes(SALT_LENGTH);
-    // Derive encryption key and HMAC key from the main key
-    const encKey = scryptSync(key, salt, KEY_LENGTH);
-    const hmacSalt = Buffer.concat([salt, Buffer.from([1, 2, 3, 4])]);
-    const hmacKey = scryptSync(key, hmacSalt, KEY_LENGTH);
-    // Encrypt with AES-256-CBC
-    const cipher = createCipheriv("aes-256-cbc", encKey, iv);
-    let encrypted = cipher.update(plaintext, "utf8", "base64");
-    encrypted += cipher.final("base64");
-    // Create HMAC for authentication
-    const hmac = createHmac("sha256", hmacKey);
-    hmac.update(iv);
-    hmac.update(Buffer.from(encrypted, "base64"));
-    const authTag = hmac.digest();
-    // Format: salt:iv:authTag:encrypted
-    return `${salt.toString("base64")}:${iv.toString("base64")}:${authTag.toString("base64")}:${encrypted}`;
-}
-/**
- * Decrypt a string using AES-256-CBC + HMAC
- */
-export function decryptString(encryptedText, key) {
-    const parts = encryptedText.split(":");
-    if (parts.length !== 4) {
-        throw new Error("Invalid encrypted format");
-    }
-    const salt = Buffer.from(parts[0], "base64");
-    const iv = Buffer.from(parts[1], "base64");
-    const authTag = Buffer.from(parts[2], "base64");
-    const encrypted = parts[3];
-    // Derive encryption key and HMAC key from the main key
-    const encKey = scryptSync(key, salt, KEY_LENGTH);
-    const hmacSalt = Buffer.concat([salt, Buffer.from([1, 2, 3, 4])]);
-    const hmacKey = scryptSync(key, hmacSalt, KEY_LENGTH);
-    // Verify HMAC
-    const hmac = createHmac("sha256", hmacKey);
-    hmac.update(iv);
-    hmac.update(Buffer.from(encrypted, "base64"));
-    const computedTag = hmac.digest();
-    if (computedTag.length !== authTag.length || !timingSafeEqual(computedTag, authTag)) {
-        throw new Error("Authentication failed: invalid tag");
-    }
-    // Decrypt with AES-256-CBC
-    const decipher = createDecipheriv("aes-256-cbc", encKey, iv);
-    let decrypted = decipher.update(encrypted, "base64", "utf8");
-    decrypted += decipher.final("utf8");
-    return decrypted;
-}
-import { createHmac } from "node:crypto";
-/**
- * Check if a string looks like it's encrypted
- */
-export function isEncryptedString(value) {
-    // Encrypted strings have the format: salt:iv:authTag:encrypted
-    // Each part is base64 encoded and separated by colons
-    const parts = value.split(":");
-    if (parts.length !== 4)
-        return false;
-    // Check if all parts are valid base64
-    try {
-        Buffer.from(parts[0], "base64");
-        Buffer.from(parts[1], "base64");
-        Buffer.from(parts[2], "base64");
-        Buffer.from(parts[3], "base64");
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Sensitive field names that should be encrypted
- */
-export const SENSITIVE_FIELD_NAMES = [
-    "api_key",
-    "apikey",
-    "apiKey",
-    "token",
-    "access_token",
-    "accessToken",
-    "password",
-    "passwd",
-    "pwd",
-    "secret",
-    "private_key",
-    "privateKey",
-    "auth",
-    "authorization",
-    "key",
-];
-/**
- * Check if a field name indicates sensitive data
- */
-export function isSensitiveFieldName(fieldName) {
-    const lowerFieldName = fieldName.toLowerCase();
-    return SENSITIVE_FIELD_NAMES.some((name) => lowerFieldName.includes(name));
-}
-/**
- * Encrypt sensitive fields in an object
- */
-export function encryptSensitiveFields(obj, key) {
-    const result = {};
-    for (const [fieldName, value] of Object.entries(obj)) {
-        if (isSensitiveFieldName(fieldName) && typeof value === "string" && !isEncryptedString(value)) {
-            result[fieldName] = encryptString(value, key);
-        }
-        else if (typeof value === "object" && value !== null) {
-            if (Array.isArray(value)) {
-                result[fieldName] = value.map((item) => typeof item === "object" && item !== null && !(item instanceof RegExp)
-                    ? encryptSensitiveFields(item, key)
-                    : item);
-            }
-            else if (value instanceof RegExp) {
-                result[fieldName] = value;
-            }
-            else {
-                result[fieldName] = encryptSensitiveFields(value, key);
-            }
-        }
-        else {
-            result[fieldName] = value;
-        }
-    }
-    return result;
-}
-/**
- * Decrypt sensitive fields in an object
- */
-export function decryptSensitiveFields(obj, key) {
-    const result = {};
-    for (const [fieldName, value] of Object.entries(obj)) {
-        if (isSensitiveFieldName(fieldName) && typeof value === "string" && isEncryptedString(value)) {
-            try {
-                result[fieldName] = decryptString(value, key);
-            }
-            catch {
-                // If decryption fails, keep the encrypted value
-                result[fieldName] = value;
-            }
-        }
-        else if (typeof value === "object" && value !== null) {
-            if (Array.isArray(value)) {
-                result[fieldName] = value.map((item) => typeof item === "object" && item !== null && !(item instanceof RegExp)
-                    ? decryptSensitiveFields(item, key)
-                    : item);
-            }
-            else if (value instanceof RegExp) {
-                result[fieldName] = value;
-            }
-            else {
-                result[fieldName] = decryptSensitiveFields(value, key);
-            }
-        }
-        else {
-            result[fieldName] = value;
-        }
-    }
-    return result;
-}
-/**
- * Create a wrapper for encrypting/decrypting config values
- */
-export class ConfigEncryptor {
-    key;
-    constructor(config) {
-        this.key = getOrCreateEncryptionKey(config);
-    }
-    encrypt(config) {
-        return encryptSensitiveFields(config, this.key);
-    }
-    decrypt(config) {
-        return decryptSensitiveFields(config, this.key);
-    }
-    getKey() {
-        return this.key;
-    }
-}

package/dist/modules/security/index.js

@@ -1,14 +0,0 @@
-export * from "./command-validator";
-export * from "./path-validator";
-export * from "./network-validator";
-export * from "./content-scanner";
-export * from "./data-sanitizer";
-export * from "./audit-log";
-export * from "./rate-limiter";
-export * from "./encryption";
-export * from "./session-isolation";
-export * from "./session-encryption";
-export * from "./audit-notifier";
-export * from "./security-policies";
-// Re-export sanitizeUrl from network-validator to avoid conflicts
-export { sanitizeUrl } from "./network-validator";