micro-models-agent 0.60.1 → 0.61.1

package/dist/modules/security/session-encryption.js

@@ -0,0 +1,210 @@
+import { readFileSync, writeFileSync, existsSync, readdirSync, unlinkSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { encryptString, decryptString, isEncryptedString, ConfigEncryptor, } from "./encryption";
+/**
+ * Default session encryption configuration
+ */
+export const DEFAULT_SESSION_ENCRYPTION = {
+    enabled: false,
+    encryptHistory: true,
+    encryptSessionLog: true,
+};
+/**
+ * Session file encryptor/decryptor
+ */
+export class SessionFileEncryptor {
+    config;
+    encryptor;
+    constructor(config) {
+        this.config = { ...DEFAULT_SESSION_ENCRYPTION, ...config };
+        this.encryptor = new ConfigEncryptor({
+            keyPath: config?.keyPath || join(homedir(), ".mma", ".session-encryption-key"),
+        });
+    }
+    /**
+     * Check if session file encryption is enabled
+     */
+    isEnabled() {
+        return this.config.enabled;
+    }
+    /**
+     * Encrypt a session file content
+     */
+    encryptFileContent(content) {
+        if (!this.config.enabled)
+            return content;
+        return encryptString(content, this.encryptor.getKey());
+    }
+    /**
+     * Decrypt a session file content
+     */
+    decryptFileContent(content) {
+        if (!this.config.enabled)
+            return content;
+        if (!isEncryptedString(content))
+            return content;
+        return decryptString(content, this.encryptor.getKey());
+    }
+    /**
+     * Encrypt a JSON object (for structured files)
+     */
+    encryptJSON(obj) {
+        if (!this.config.enabled)
+            return JSON.stringify(obj);
+        return this.encryptFileContent(JSON.stringify(obj));
+    }
+    /**
+     * Decrypt a JSON string
+     */
+    decryptJSON(content) {
+        let plain = content;
+        if (this.config.enabled) {
+            plain = this.decryptFileContent(content);
+        }
+        try {
+            return JSON.parse(plain);
+        }
+        catch {
+            throw new Error("Invalid JSON content in session file — file may be corrupted or encrypted with a different key");
+        }
+    }
+    /**
+     * Encrypt a JSONL file (one JSON object per line)
+     */
+    encryptJSONL(lines) {
+        if (!this.config.enabled)
+            return lines;
+        return lines.map((line) => this.encryptFileContent(line));
+    }
+    /**
+     * Decrypt a JSONL file
+     */
+    decryptJSONL(lines) {
+        if (!this.config.enabled)
+            return lines;
+        return lines.map((line) => this.decryptFileContent(line));
+    }
+    /**
+     * Read and decrypt a session file
+     */
+    readSessionFile(filePath) {
+        const content = readFileSync(filePath, "utf8");
+        return this.decryptFileContent(content);
+    }
+    /**
+     * Write and encrypt a session file
+     */
+    writeSessionFile(filePath, content) {
+        const encrypted = this.encryptFileContent(content);
+        writeFileSync(filePath, encrypted, "utf8");
+    }
+    /**
+     * Read and decrypt a JSON session file
+     */
+    readSessionJSON(filePath) {
+        const content = readFileSync(filePath, "utf8");
+        return this.decryptJSON(content);
+    }
+    /**
+     * Write and encrypt a JSON session file
+     */
+    writeSessionJSON(filePath, obj) {
+        const content = this.encryptJSON(obj);
+        writeFileSync(filePath, content, "utf8");
+    }
+    /**
+     * Read and decrypt a JSONL session file
+     */
+    readSessionJSONL(filePath) {
+        const content = readFileSync(filePath, "utf8");
+        const lines = content.split("\n").filter((line) => line.trim());
+        const decryptedLines = this.decryptJSONL(lines);
+        // Skip malformed lines instead of crashing the whole session log
+        return decryptedLines.flatMap((line) => {
+            try {
+                return [JSON.parse(line)];
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+    /**
+     * Append an encrypted entry to a JSONL file
+     */
+    appendToSessionJSONL(filePath, obj) {
+        const encryptedLine = this.encryptFileContent(JSON.stringify(obj));
+        writeFileSync(filePath, encryptedLine + "\n", {
+            flag: "a",
+            encoding: "utf8",
+        });
+    }
+    /**
+     * Encrypt all session files in a directory
+     */
+    encryptSessionDirectory(sessionDir) {
+        if (!this.config.enabled)
+            return;
+        const files = readdirSync(sessionDir);
+        for (const file of files) {
+            const filePath = join(sessionDir, file);
+            if (existsSync(filePath) && !file.endsWith(".enc")) {
+                try {
+                    const content = readFileSync(filePath, "utf8");
+                    const encrypted = this.encryptFileContent(content);
+                    writeFileSync(filePath + ".enc", encrypted, "utf8");
+                    unlinkSync(filePath);
+                }
+                catch {
+                    // Skip binary files or files we can't read
+                }
+            }
+        }
+    }
+    /**
+     * Decrypt all session files in a directory
+     */
+    decryptSessionDirectory(sessionDir) {
+        if (!this.config.enabled)
+            return;
+        const files = readdirSync(sessionDir);
+        for (const file of files) {
+            if (file.endsWith(".enc")) {
+                const encFilePath = join(sessionDir, file);
+                const decFilePath = encFilePath.slice(0, -4); // Remove .enc
+                try {
+                    const content = readFileSync(encFilePath, "utf8");
+                    const decrypted = this.decryptFileContent(content);
+                    writeFileSync(decFilePath, decrypted, "utf8");
+                    unlinkSync(encFilePath);
+                }
+                catch {
+                    // Skip files we can't decrypt
+                }
+            }
+        }
+    }
+}
+/**
+ * Global session file encryptor instance
+ */
+export const globalSessionEncryptor = new SessionFileEncryptor();
+/**
+ * Create a session file encryptor with custom configuration
+ */
+export function createSessionFileEncryptor(config) {
+    return new SessionFileEncryptor(config);
+}
+/**
+ * Helper to encrypt a message object (for SessionMessage)
+ */
+export function encryptSessionMessage(msg) {
+    return globalSessionEncryptor.encryptJSON(msg);
+}
+/**
+ * Helper to decrypt a session message
+ */
+export function decryptSessionMessage(encrypted) {
+    return globalSessionEncryptor.decryptJSON(encrypted);
+}

package/dist/modules/security/session-isolation.js

@@ -0,0 +1,95 @@
+import { join, resolve } from "path";
+import { homedir } from "os";
+import { mkdirSync, existsSync } from "fs";
+import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
+/**
+ * Default session isolation configuration
+ */
+export const DEFAULT_SESSION_ISOLATION = {
+    enabled: false,
+    isolatePlugins: true,
+    isolateTempFiles: true,
+};
+/**
+ * Create a session context with isolation
+ */
+export function createSessionContext(sessionId, projectDir, isolationConfig, securityOverrides) {
+    const config = { ...DEFAULT_SESSION_ISOLATION, ...isolationConfig };
+    // Create session-specific temporary directory
+    const baseDir = config.baseDir || join(homedir(), ".mma", "sessions", sessionId);
+    const tempDir = join(baseDir, "temp");
+    if (config.isolateTempFiles && !existsSync(tempDir)) {
+        try {
+            mkdirSync(tempDir, { recursive: true, mode: 0o700 });
+        }
+        catch {
+            // If we can't create the temp dir, continue without isolation
+        }
+    }
+    return {
+        sessionId,
+        tempDir,
+        securityOverrides,
+        workingDir: projectDir,
+    };
+}
+/**
+ * Get session-specific security configuration
+ * Merges global security config with session overrides
+ */
+export function getSessionSecurityConfig(globalConfig, sessionContext) {
+    const globalSecurity = globalConfig.security || DEFAULT_SECURITY_CONFIG;
+    const sessionOverrides = sessionContext?.securityOverrides;
+    if (!sessionOverrides) {
+        return globalSecurity;
+    }
+    return {
+        ...globalSecurity,
+        ...sessionOverrides,
+        // Merge nested objects
+        bash: { ...globalSecurity.bash, ...sessionOverrides.bash },
+        paths: { ...globalSecurity.paths, ...sessionOverrides.paths },
+        network: { ...globalSecurity.network, ...sessionOverrides.network },
+        rateLimits: { ...globalSecurity.rateLimits, ...sessionOverrides.rateLimits },
+        contentScan: { ...globalSecurity.contentScan, ...sessionOverrides.contentScan },
+    };
+}
+/**
+ * Get session-specific temporary directory
+ */
+export function getSessionTempDir(sessionContext) {
+    return sessionContext.tempDir;
+}
+/**
+ * Clean up session-specific temporary data
+ */
+export function cleanupSessionTempDir(sessionContext) {
+    // Note: In a real implementation, we would recursively delete the temp dir
+    // For now, we just leave it as the OS will clean up eventually
+    // In production, you might want to implement proper cleanup
+}
+/**
+ * Create a session-specific file path
+ * Ensures the path is within the session's working directory or temp directory
+ */
+export function createSessionFilePath(sessionContext, relativePath, useTempDir = false) {
+    const baseDir = useTempDir ? sessionContext.tempDir : sessionContext.workingDir;
+    return resolve(baseDir, relativePath);
+}
+/**
+ * Check if a path is within the session's allowed directories
+ */
+export function isPathInSessionScope(sessionContext, path) {
+    const resolvedPath = resolve(path);
+    const workingDir = resolve(sessionContext.workingDir);
+    const tempDir = resolve(sessionContext.tempDir);
+    // Check if path is within working directory
+    if (resolvedPath.startsWith(workingDir + "/") || resolvedPath.startsWith(workingDir + "\\")) {
+        return true;
+    }
+    // Check if path is within temp directory
+    if (resolvedPath.startsWith(tempDir + "/") || resolvedPath.startsWith(tempDir + "\\")) {
+        return true;
+    }
+    return false;
+}

package/dist/modules/session/index.js

@@ -0,0 +1,3 @@
+export { SessionStore } from "./store";
+export { SessionManager } from "./manager";
+export { SessionModule } from "./module";

package/dist/modules/session/manager.js

@@ -0,0 +1,172 @@
+import { t } from "../../i18n/index";
+import { createSessionContext, DEFAULT_SESSION_ISOLATION, } from "../../modules/security/session-isolation";
+export class SessionManager {
+    store;
+    activeId = null;
+    options;
+    /**
+     * Map of session ID to session context (for isolation)
+     */
+    sessionContexts = new Map();
+    constructor(store, options) {
+        this.store = store;
+        this.options = options;
+        // Initialize encryption if configured
+        if (options.encryption) {
+            this.store.updateEncryption(options.encryption);
+        }
+    }
+    /**
+     * Check if session file encryption is enabled
+     */
+    isEncryptionEnabled() {
+        return this.store.isEncryptionEnabled();
+    }
+    /**
+     * Update encryption configuration
+     */
+    updateEncryption(config) {
+        this.store.updateEncryption(config);
+        this.options.encryption = config;
+    }
+    create(name, securityOverrides) {
+        const now = new Date().toISOString();
+        const id = `ses_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+        const sessionName = name || t("session.default_name", { date: now.slice(0, 10) });
+        const meta = {
+            id,
+            name: sessionName,
+            createdAt: now,
+            updatedAt: now,
+            messageCount: 0,
+            model: this.options.model,
+            contextWindow: this.options.contextWindow,
+            projectDir: this.options.projectDir,
+            securityOverrides,
+        };
+        this.store.saveMeta(id, meta);
+        this.activeId = id;
+        this.enforceMaxSessions();
+        // Create session context
+        const context = createSessionContext(id, this.options.projectDir, this.options.isolation, this.normalizeSecurityOverrides(securityOverrides));
+        this.sessionContexts.set(id, context);
+        return meta;
+    }
+    list() {
+        return this.store.listSessions();
+    }
+    get(id) {
+        return this.store.loadMeta(id);
+    }
+    delete(id) {
+        // Clean up session context
+        const context = this.sessionContexts.get(id);
+        if (context) {
+            // In a real implementation, we would clean up temp files here
+            this.sessionContexts.delete(id);
+        }
+        this.store.deleteSession(id);
+        if (this.activeId === id) {
+            this.activeId = null;
+        }
+    }
+    rename(id, name) {
+        const meta = this.store.loadMeta(id);
+        if (!meta)
+            throw new Error(t("session.not_found", { id }));
+        meta.name = name;
+        this.store.saveMeta(id, meta);
+    }
+    getActive() {
+        return this.activeId;
+    }
+    getActiveMeta() {
+        if (!this.activeId)
+            return null;
+        return this.store.loadMeta(this.activeId);
+    }
+    setActive(id) {
+        if (!this.store.sessionExists(id)) {
+            throw new Error(t("session.not_found", { id }));
+        }
+        this.activeId = id;
+    }
+    appendMessage(msg) {
+        if (!this.activeId)
+            throw new Error(t("session.no_active"));
+        this.store.appendMessage(this.activeId, msg);
+    }
+    appendLog(entry) {
+        if (!this.activeId)
+            return;
+        this.store.appendSessionLog(this.activeId, entry);
+    }
+    loadHistory() {
+        if (!this.activeId)
+            return [];
+        return this.store.loadHistory(this.activeId);
+    }
+    /**
+     * Get the session context for the active session
+     */
+    getSessionContext() {
+        if (!this.activeId)
+            return undefined;
+        return this.getSessionContextById(this.activeId);
+    }
+    /**
+     * Get the session context for a specific session
+     */
+    getSessionDirectory(id) {
+        return this.store.getSessionDir(id);
+    }
+    getSessionContextById(sessionId) {
+        if (!this.sessionContexts.has(sessionId)) {
+            const meta = this.store.loadMeta(sessionId);
+            if (!meta)
+                return undefined;
+            const context = createSessionContext(sessionId, meta.projectDir, this.options.isolation, this.normalizeSecurityOverrides(meta.securityOverrides));
+            this.sessionContexts.set(sessionId, context);
+        }
+        return this.sessionContexts.get(sessionId);
+    }
+    /**
+     * Get session isolation configuration
+     */
+    getIsolationConfig() {
+        return this.options.isolation ?? DEFAULT_SESSION_ISOLATION;
+    }
+    /**
+     * Check if session isolation is enabled
+     */
+    isIsolationEnabled() {
+        return this.getIsolationConfig().enabled;
+    }
+    /**
+     * Normalize security overrides to match SecurityConfig structure
+     */
+    normalizeSecurityOverrides(overrides) {
+        if (!overrides)
+            return undefined;
+        return {
+            maxFileOperations: overrides.maxFileOperations,
+            maxRecursionDepth: overrides.maxRecursionDepth,
+            rateLimits: overrides.rateLimits
+                ? {
+                    maxRequestsPerMinute: overrides.rateLimits.maxRequestsPerMinute ?? 60,
+                    maxParallelTasks: overrides.rateLimits.maxParallelTasks ?? 5,
+                }
+                : undefined,
+        };
+    }
+    enforceMaxSessions() {
+        const max = this.options.maxSessions ?? 50;
+        const sessions = this.store.listSessions();
+        if (sessions.length > max) {
+            const toDelete = sessions.slice(max);
+            for (const s of toDelete) {
+                this.delete(s.id);
+            }
+        }
+    }
+}

package/dist/modules/session/module.js

@@ -0,0 +1,24 @@
+import { t } from "../../i18n/index";
+export class SessionModule {
+    name = "session";
+    manager;
+    constructor(manager) {
+        this.manager = manager;
+    }
+    getSystemPromptBlock() {
+        const meta = this.manager.getActiveMeta();
+        if (!meta || meta.messageCount === 0)
+            return null;
+        return {
+            content: t("session.info", { name: meta.name, id: meta.id, count: meta.messageCount }),
+            priority: "low",
+            essential: false,
+            estimatedTokens: 20,
+        };
+    }
+    getPlugin() {
+        return {
+            name: "session",
+        };
+    }
+}