micro-models-agent 0.57.0 → 0.57.2

package/dist/modules/security/network-validator.js

@@ -0,0 +1,88 @@
+import { sanitizeLogMessage } from "./data-sanitizer";
+/**
+ * Check if a hostname is a private/link-local address (SSRF protection).
+ */
+export function isIpPrivate(hostname) {
+    const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    return (/^(localhost|127\.0\.0\.1|0\.0\.0\.0|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.)/.test(h) ||
+        h === "::1" ||
+        /^(fc|fd)/.test(h) ||
+        (h.includes(":") && h.startsWith("fe80")));
+}
+/**
+ * Check if a URL is allowed based on security configuration
+ */
+export function isUrlAllowed(url, securityConfig) {
+    // If security is disabled, allow everything
+    if (!securityConfig?.enabled) {
+        return { allowed: true };
+    }
+    try {
+        const urlObj = new URL(url);
+        const domain = urlObj.hostname.toLowerCase();
+        const scheme = urlObj.protocol.toLowerCase();
+        if (scheme !== "http:" && scheme !== "https:") {
+            return { allowed: false, reason: `Scheme "${scheme}" is not allowed` };
+        }
+        if (isIpPrivate(domain)) {
+            return { allowed: false, reason: `Private address "${domain}" is blocked (SSRF)` };
+        }
+        // Check denied domains first
+        if (securityConfig.deniedDomains?.length) {
+            for (const deniedDomain of securityConfig.deniedDomains) {
+                const denied = deniedDomain.toLowerCase();
+                if (domain === denied || domain.endsWith(`.${denied}`)) {
+                    return { allowed: false, reason: `Domain "${domain}" is denied` };
+                }
+            }
+        }
+        // Check allowed domains (if non-empty, only these are allowed)
+        if (securityConfig.allowedDomains?.length) {
+            let isAllowed = false;
+            for (const allowedDomain of securityConfig.allowedDomains) {
+                const allowed = allowedDomain.toLowerCase();
+                if (domain === allowed || domain.endsWith(`.${allowed}`)) {
+                    isAllowed = true;
+                    break;
+                }
+            }
+            if (!isAllowed) {
+                return {
+                    allowed: false,
+                    reason: `Domain "${domain}" is not in the allowed list`,
+                };
+            }
+        }
+        return { allowed: true };
+    }
+    catch {
+        return { allowed: false, reason: `Invalid URL: ${url}` };
+    }
+}
+/**
+ * Sanitize URL for logging (remove sensitive information)
+ */
+export function sanitizeUrl(url) {
+    try {
+        const urlObj = new URL(url);
+        const sensitiveKeys = ["api_key", "token", "password", "secret", "access_token", "auth", "key"];
+        const sanitizedParams = new URLSearchParams(urlObj.search);
+        for (const key of sensitiveKeys) {
+            if (sanitizedParams.has(key)) {
+                sanitizedParams.set(key, "[REDACTED]");
+            }
+        }
+        urlObj.search = sanitizedParams.toString();
+        let result = urlObj.toString();
+        // Also sanitize credentials in URL (user:pass@host)
+        if (urlObj.username || urlObj.password) {
+            result = result.replace(/:\/\/[^:]+:[^@]+@/, "://[REDACTED]:[REDACTED]@");
+        }
+        // Decode URL-encoded [REDACTED] back to plain text
+        result = decodeURIComponent(result);
+        return result;
+    }
+    catch {
+        return sanitizeLogMessage(url);
+    }
+}

package/dist/modules/security/path-validator.js

@@ -0,0 +1,203 @@
+import { resolve, normalize } from "path";
+import { isInsideDir, matchesScopeEntry } from "../../tools/path-utils";
+/**
+ * Check if a path is within the allowed scope
+ * This combines global security settings with per-tool scope
+ */
+export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
+    const baseResolved = resolve(baseDir);
+    const targetResolved = resolve(baseDir, normalize(targetPath));
+    // First, check that path is within baseDir (separator- and case-safe: a
+    // sibling directory sharing the prefix must not pass).
+    if (!isInsideDir(targetResolved, baseResolved)) {
+        return {
+            allowed: false,
+            reason: "Path is outside the base working directory",
+        };
+    }
+    // If security is disabled, skip pattern validation
+    if (!securityConfig?.enabled) {
+        // Still enforce subagent scope if present
+        if (scope) {
+            const isReadScope = scope.read_only_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
+            const isWriteScope = scope.allowed_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
+            if (isWriteScope)
+                return { allowed: true };
+            if (isReadScope)
+                return { allowed: true, reason: "Read-only file" };
+            return {
+                allowed: false,
+                reason: "Path is not within the allowed scope for this sub-agent",
+            };
+        }
+        return { allowed: true };
+    }
+    // Check global denied patterns
+    if (securityConfig?.denied?.length) {
+        for (const pattern of securityConfig.denied) {
+            if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
+                return {
+                    allowed: false,
+                    reason: `Path matches denied pattern: ${pattern}`,
+                };
+            }
+        }
+    }
+    // Check global allowed patterns (if non-empty, only these are allowed)
+    if (securityConfig?.allowed?.length) {
+        let isAllowed = false;
+        for (const pattern of securityConfig.allowed) {
+            if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
+                isAllowed = true;
+                break;
+            }
+        }
+        if (!isAllowed) {
+            return {
+                allowed: false,
+                reason: "Path does not match any allowed pattern",
+            };
+        }
+    }
+    // Check tool-specific scope (for subagents)
+    if (!scope) {
+        return { allowed: true };
+    }
+    const isRead = scope.read_only_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
+    const isWrite = scope.allowed_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
+    if (isWrite)
+        return { allowed: true };
+    if (isRead)
+        return { allowed: true, reason: "Read-only file" };
+    return {
+        allowed: false,
+        reason: "Path is not within the allowed scope for this sub-agent",
+    };
+}
+/**
+ * Check if a path is writable (for write/delete operations)
+ */
+export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
+    const baseResolved = resolve(baseDir);
+    const targetResolved = resolve(baseDir, normalize(targetPath));
+    // First, check that path is within baseDir (separator- and case-safe: a
+    // sibling directory sharing the prefix must not pass).
+    if (!isInsideDir(targetResolved, baseResolved)) {
+        return {
+            allowed: false,
+            reason: "Path is outside the base working directory",
+        };
+    }
+    // If security is disabled, skip pattern validation
+    if (!securityConfig?.enabled) {
+        // Still enforce subagent scope if present
+        if (scope) {
+            const isWriteScope = scope.allowed_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
+            if (isWriteScope)
+                return { allowed: true };
+            return {
+                allowed: false,
+                reason: "Path is not within the allowed scope for this sub-agent",
+            };
+        }
+        return { allowed: true };
+    }
+    // Check global denied patterns
+    if (securityConfig?.denied?.length) {
+        for (const pattern of securityConfig.denied) {
+            if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
+                return {
+                    allowed: false,
+                    reason: `Path matches denied pattern: ${pattern}`,
+                };
+            }
+        }
+    }
+    // Check global allowed patterns (if non-empty, only these are allowed)
+    if (securityConfig?.allowed?.length) {
+        let isAllowed = false;
+        for (const pattern of securityConfig.allowed) {
+            if (matchesGlobPattern(targetResolved, baseDir, pattern)) {
+                isAllowed = true;
+                break;
+            }
+        }
+        if (!isAllowed) {
+            return {
+                allowed: false,
+                reason: "Path does not match any allowed pattern",
+            };
+        }
+    }
+    // Check tool-specific scope (for subagents)
+    if (!scope) {
+        return { allowed: true };
+    }
+    const isWrite = scope.allowed_files.some((f) => matchesScopeEntry(targetResolved, resolve(baseDir, f)));
+    if (isWrite)
+        return { allowed: true };
+    return {
+        allowed: false,
+        reason: "Path is not within the writable scope for this sub-agent",
+    };
+}
+/**
+ * Simple glob pattern matching (supports * and **)
+ * This is a simplified version that handles common cases
+ */
+function matchesGlobPattern(targetPath, baseDir, pattern) {
+    const resolvedBaseDir = resolve(baseDir);
+    const resolvedTargetPath = resolve(targetPath);
+    // Handle directory patterns (ending with /)
+    if (pattern.endsWith("/")) {
+        const dirPattern = pattern.slice(0, -1);
+        const resolvedDirPattern = resolve(baseDir, dirPattern);
+        return isInsideDir(resolvedTargetPath, resolvedDirPattern);
+    }
+    // Handle **/* pattern (recursive)
+    if (pattern.includes("**/")) {
+        const parts = pattern.split("**/");
+        const prefix = parts[0];
+        const suffix = parts[1];
+        const resolvedPrefix = resolve(baseDir, prefix);
+        if (!isInsideDir(resolvedTargetPath, resolvedPrefix)) {
+            return false;
+        }
+        const remainingPath = resolvedTargetPath.slice(resolvedPrefix.length);
+        if (suffix === "*" || suffix === "") {
+            return true; // Any path after prefix
+        }
+        // Check if remaining path contains the suffix
+        return remainingPath.includes(suffix.replace(/\*/g, ""));
+    }
+    // Handle ** pattern (recursive any)
+    if (pattern.includes("**")) {
+        const parts = pattern.split("**");
+        const prefix = parts[0];
+        const suffix = parts[1];
+        const resolvedPrefix = resolve(baseDir, prefix);
+        if (!isInsideDir(resolvedTargetPath, resolvedPrefix)) {
+            return false;
+        }
+        if (!suffix) {
+            return true; // ** at the end matches anything after prefix
+        }
+        return resolvedTargetPath.includes(suffix.replace(/\//g, ""));
+    }
+    // Handle * pattern (single level)
+    if (pattern.includes("*")) {
+        const regexPattern = pattern
+            .replace(/\*/g, "[^/\\\\]*")
+            .replace(/\?/g, ".")
+            .replace(/\./g, "\\.");
+        const regex = new RegExp(`^${regexPattern}$`);
+        const relativePath = resolvedTargetPath.slice(resolvedBaseDir.length + 1).replace(/\\/g, "/");
+        return regex.test(relativePath);
+    }
+    // Exact match (case-insensitive on win32, where the FS is case-insensitive)
+    const exactTarget = resolve(baseDir, pattern);
+    if (process.platform === "win32") {
+        return resolvedTargetPath.toLowerCase() === exactTarget.toLowerCase();
+    }
+    return resolvedTargetPath === exactTarget;
+}

package/dist/modules/security/rate-limiter.js

@@ -0,0 +1,119 @@
+/**
+ * Rate limiter for LLM requests
+ * Prevents DoS attacks by limiting the number of requests per time window
+ */
+const DEFAULT_CONFIG = {
+    maxRequestsPerMinute: 60,
+    maxParallelTasks: 5,
+};
+/**
+ * Rate limiter class for tracking LLM requests
+ */
+export class RateLimiter {
+    config;
+    state;
+    lastCleanup = 0;
+    constructor(config) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.state = {
+            requests: [],
+            parallelTasks: 0,
+        };
+    }
+    /**
+     * Check if a new request is allowed
+     * Returns true if the request is allowed, false if rate limited
+     */
+    canMakeRequest() {
+        this.cleanupOldRequests();
+        if (this.state.requests.length >= this.config.maxRequestsPerMinute) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Record a request
+     */
+    recordRequest() {
+        this.cleanupOldRequests();
+        this.state.requests.push(Date.now());
+    }
+    /**
+     * Check if a new parallel task is allowed
+     */
+    canStartParallelTask() {
+        if (this.state.parallelTasks >= this.config.maxParallelTasks) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Start a parallel task
+     */
+    startParallelTask() {
+        this.state.parallelTasks++;
+    }
+    /**
+     * End a parallel task
+     */
+    endParallelTask() {
+        this.state.parallelTasks = Math.max(0, this.state.parallelTasks - 1);
+    }
+    /**
+     * Get current parallel task count
+     */
+    getParallelTaskCount() {
+        return this.state.parallelTasks;
+    }
+    /**
+     * Get remaining requests in current window
+     */
+    getRemainingRequests() {
+        this.cleanupOldRequests();
+        return Math.max(0, this.config.maxRequestsPerMinute - this.state.requests.length);
+    }
+    /**
+     * Clean up old requests (older than 1 minute)
+     */
+    cleanupOldRequests() {
+        const now = Date.now();
+        const oneMinuteAgo = now - 60_000;
+        // Only cleanup every 5 seconds to avoid performance overhead
+        if (now - this.lastCleanup < 5000) {
+            return;
+        }
+        this.state.requests = this.state.requests.filter((timestamp) => timestamp > oneMinuteAgo);
+        this.lastCleanup = now;
+    }
+    /**
+     * Reset the rate limiter
+     */
+    reset() {
+        this.state.requests = [];
+        this.state.parallelTasks = 0;
+        this.lastCleanup = 0;
+    }
+    /**
+     * Get rate limit configuration
+     */
+    getConfig() {
+        return this.config;
+    }
+    /**
+     * Update rate limit configuration
+     */
+    updateConfig(config) {
+        this.config = { ...this.config, ...config };
+    }
+}
+/**
+ * Global rate limiter instance
+ * Can be used by LLM provider to enforce rate limits
+ */
+export const globalRateLimiter = new RateLimiter();
+/**
+ * Create a rate limiter with custom configuration
+ */
+export function createRateLimiter(config) {
+    return new RateLimiter(config);
+}