micro-models-agent 0.63.0 → 1.1.0

package/dist/modules/security/audit-notifier.js

@@ -1,6 +1,8 @@
 import { writeFileSync, appendFileSync, existsSync, mkdirSync } from "fs";
 import { join, dirname } from "path";
 import { homedir } from "os";
+import { backoffDelay } from "../../utils/retry";
+import { defaultOutputBus } from "../../output";
 /**
  * Severity weights for comparison
  */
@@ -114,7 +116,13 @@ export class AuditNotifier {
         this.writeToFile(notification);
         // Send to webhook if configured
         if (this.config.webhookUrl) {
-            await this.sendToWebhook(notification);
+            try {
+                await this.sendToWebhook(notification);
+            }
+            catch (error) {
+                defaultOutputBus.log("warn", "audit", `[AuditNotifier] Webhook failed, adding to retry queue: ${error instanceof Error ? error.message : String(error)}`, { persist: true });
+                this.addToRetryQueue(notification);
+            }
         }
         return notification;
     }
@@ -160,32 +168,31 @@ export class AuditNotifier {
             appendFileSync(this.config.filePath, line + "\n", "utf8");
         }
         catch (error) {
-            console.error("[AuditNotifier] Failed to write to file:", error);
+            defaultOutputBus.log("error", "audit", `[AuditNotifier] Failed to write to file: ${error instanceof Error ? error.message : String(error)}`, { persist: true });
         }
     }
     /**
-     * Send notification to webhook
+     * Send notification to webhook. Throws on failure — retry policy is the
+     * caller's decision (notify() queues; processRetryQueue() counts attempts).
      */
     async sendToWebhook(notification) {
         if (!this.config.webhookUrl)
             return;
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.config.webhookTimeout);
         try {
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), this.config.webhookTimeout);
             const response = await fetch(this.config.webhookUrl, {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
                 body: JSON.stringify(notification),
                 signal: controller.signal,
             });
-            clearTimeout(timeoutId);
             if (!response.ok) {
                 throw new Error(`Webhook returned ${response.status}`);
             }
         }
-        catch (error) {
-            console.error("[AuditNotifier] Webhook failed, adding to retry queue:", error);
-            this.addToRetryQueue(notification);
+        finally {
+            clearTimeout(timeoutId);
         }
     }
     /**
@@ -204,25 +211,32 @@ export class AuditNotifier {
         if (this.retryQueue.length === 0 || this.isProcessing)
             return;
         this.isProcessing = true;
-        while (this.retryQueue.length > 0) {
-            const item = this.retryQueue[0];
-            if (item.retries >= (this.config.maxRetries ?? 3)) {
-                console.error("[AuditNotifier] Max retries exceeded for notification:", item.entry);
-                this.retryQueue.shift();
-                continue;
-            }
-            try {
-                await this.sendToWebhook(item.entry);
-                this.retryQueue.shift();
-            }
-            catch (error) {
-                item.retries++;
-                // Exponential backoff
-                const delay = Math.pow(2, item.retries) * 1000;
-                await new Promise((resolve) => setTimeout(resolve, delay));
+        try {
+            while (this.retryQueue.length > 0) {
+                const item = this.retryQueue[0];
+                if (item.retries >= (this.config.maxRetries ?? 3)) {
+                    defaultOutputBus.log("error", "audit", `[AuditNotifier] Max retries exceeded for notification: ${JSON.stringify(item.entry)}`, { persist: true });
+                    this.retryQueue.shift();
+                    continue;
+                }
+                try {
+                    await this.sendToWebhook(item.entry);
+                    this.retryQueue.shift();
+                }
+                catch (error) {
+                    // sendToWebhook no longer queues copies itself — the retry counter
+                    // actually increments and maxRetries is reachable.
+                    item.retries++;
+                    defaultOutputBus.log("warn", "audit", `[AuditNotifier] Webhook retry ${item.retries} failed: ${error instanceof Error ? error.message : String(error)}`, { persist: true });
+                    // Exponential backoff before the next attempt on the same head item.
+                    const delay = backoffDelay(item.retries, 1000);
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+                }
             }
         }
-        this.isProcessing = false;
+        finally {
+            this.isProcessing = false;
+        }
     }
     /**
      * Read notifications from file
@@ -236,7 +250,8 @@ export class AuditNotifier {
             const lines = content.split("\n").filter(Boolean);
             return lines.slice(-limit).map((line) => JSON.parse(line));
         }
-        catch {
+        catch (error) {
+            defaultOutputBus.log("error", "audit", `[AuditNotifier] Failed to read notifications: ${error instanceof Error ? error.message : String(error)}`, { persist: true });
             return [];
         }
     }

package/dist/modules/security/command-validator.js

@@ -19,7 +19,7 @@ const FALLBACK_BASH_CONFIG = {
     whitelist: [],
     blockDangerousFlags: false,
     dangerousFlags: ["--force", "-rf", "--no-preserve-root"],
-    dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "`"],
+    dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "`", "$("],
     logCommands: true,
 };
 export const DEFAULT_BASH_CONFIG = DEFAULT_SECURITY_CONFIG?.bash || FALLBACK_BASH_CONFIG;
@@ -54,8 +54,9 @@ function extractBaseCommand(trimmed) {
     }
     if (i >= tokens.length)
         return tokens[0] ?? "";
-    // Extract basename from path (e.g. /usr/bin/rm → rm)
-    const raw = tokens[i];
+    // Extract basename from path (e.g. /usr/bin/rm → rm). Strip surrounding
+    // quotes first — otherwise `'rm'` / `"rm"` evade the blacklist entirely.
+    const raw = tokens[i].replace(/^["']+|["']+$/g, "");
     const parts = raw.split(/[\\/]/);
     const basename = parts[parts.length - 1] || raw;
     // Strip .exe/.cmd/.bat extensions for blacklist matching (e.g. powershell.exe → powershell)
@@ -116,8 +117,11 @@ export function isCommandAllowed(command, securityConfig) {
         };
     }
     // Interpreters with -c/-e execute arbitrary code and bypass the blacklist.
-    const INTERPRETER_FLAGS = /(?:^|\s)(?:bash|sh|zsh|dash|python|python3|node|bun|perl|ruby)\s+(?:-c|-e|--command|--eval)\b/;
-    if (INTERPRETER_FLAGS.test(trimmedCommand)) {
+    // Quotes are stripped first (`'bash' -c`), and the name may follow a path
+    // separator (`/bin/bash -c`), so match those too.
+    const unquotedCommand = trimmedCommand.replace(/["']/g, "");
+    const INTERPRETER_FLAGS = /(?:^|[\\/\s])(?:bash|sh|zsh|dash|python|python3|node|bun|perl|ruby)\s+(?:-c|-e|--command|--eval)\b/;
+    if (INTERPRETER_FLAGS.test(unquotedCommand)) {
         return { allowed: false, reason: "Interpreter -c/-e invocation is blocked" };
     }
     // Multi-line commands can hide blacklisted commands after a newline.
@@ -143,9 +147,13 @@ export function isCommandAllowed(command, securityConfig) {
     }
     // Extract actual base command (handles paths, env vars, sudo)
     const baseCommand = extractBaseCommand(trimmedCommand);
+    // Case-insensitive matching: win32/macOS exec is case-insensitive, so
+    // `RM -rf x` must hit the blacklist just like `rm`.
+    const blacklistLower = new Set((config.blacklist || []).map((c) => c.toLowerCase()));
+    const whitelistLower = (config.whitelist || []).map((c) => c.toLowerCase());
     // Check whitelist first (if non-empty, only whitelisted commands are allowed)
-    if (config.whitelist.length > 0) {
-        if (!config.whitelist.includes(baseCommand)) {
+    if (whitelistLower.length > 0) {
+        if (!whitelistLower.includes(baseCommand.toLowerCase())) {
             return {
                 allowed: false,
                 reason: `Command "${baseCommand}" is not in the whitelist`,
@@ -153,15 +161,18 @@ export function isCommandAllowed(command, securityConfig) {
         }
     }
     // Check blacklist (against the extracted basename, not the raw token)
-    if (config.blacklist.includes(baseCommand)) {
+    if (blacklistLower.has(baseCommand.toLowerCase())) {
         return {
             allowed: false,
             reason: `Command "${baseCommand}" is blacklisted`,
         };
     }
     // Also check the raw first token in case it's a simple name
-    const rawFirst = trimmedCommand.split(/\s+/)[0].replace(/\.(exe|cmd|bat)$/i, "");
-    if (rawFirst !== baseCommand && config.blacklist.includes(rawFirst)) {
+    const rawFirst = trimmedCommand
+        .split(/\s+/)[0]
+        .replace(/^["']+|["']+$/g, "")
+        .replace(/\.(exe|cmd|bat)$/i, "");
+    if (rawFirst !== baseCommand && blacklistLower.has(rawFirst.toLowerCase())) {
         return {
             allowed: false,
             reason: `Command "${rawFirst}" is blacklisted`,
@@ -204,16 +215,10 @@ export function sanitizeCommandForLog(command) {
     ];
     let sanitized = command;
     for (const pattern of patterns) {
-        if (pattern.toString().includes("($1")) {
-            // For patterns with capture groups, use the group in replacement
-            sanitized = sanitized.replace(pattern, (match, p1) => {
-                return `${p1}=[REDACTED]`;
-            });
-        }
-        else {
-            // For simple patterns, just replace with [REDACTED]
-            sanitized = sanitized.replace(pattern, "[REDACTED]");
-        }
+        // Whole-match replacement for every pattern: capture-group-aware
+        // replacement would re-emit the secret itself for patterns whose only
+        // group IS the value (e.g. "Bearer <token>", sk-...).
+        sanitized = sanitized.replace(pattern, "[REDACTED]");
     }
     return sanitized;
 }

package/dist/modules/security/encryption.js

@@ -36,7 +36,7 @@ export function getOrCreateEncryptionKey(config) {
         catch (e) {
             // If we can't persist the key, encrypted data would be unrecoverable
             // on the next run — fail loudly instead of silently degrading.
-            throw new Error(`Cannot write encryption key to ${keyPath}: ${e instanceof Error ? e.message : String(e)}`);
+            throw new Error(`Cannot write encryption key to ${keyPath}: ${errMsg(e)}`);
         }
     }
     try {
@@ -112,6 +112,7 @@ export function decryptString(encryptedText, key) {
     return decrypted;
 }
 import { createHmac } from "node:crypto";
+import { errMsg } from "../../utils";
 /**
  * Check if a string looks like it's encrypted
  */
@@ -121,17 +122,10 @@ export function isEncryptedString(value) {
     const parts = value.split(":");
     if (parts.length !== 4)
         return false;
-    // Check if all parts are valid base64
-    try {
-        Buffer.from(parts[0], "base64");
-        Buffer.from(parts[1], "base64");
-        Buffer.from(parts[2], "base64");
-        Buffer.from(parts[3], "base64");
-        return true;
-    }
-    catch {
-        return false;
-    }
+    // Strict base64 shape check: Buffer.from(value, "base64") NEVER throws
+    // (lenient decode), so it cannot distinguish plaintext from base64.
+    const isB64 = (s) => s.length > 0 && s.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(s);
+    return parts.every(isB64);
 }
 /**
  * Sensitive field names that should be encrypted

package/dist/modules/security/network-validator.js

@@ -1,13 +1,84 @@
 import { sanitizeLogMessage } from "./data-sanitizer";
+/**
+ * Parse a numeric IP component honoring decimal, hex (0x…) and octal (0…)
+ * notations. Returns null when the token is not purely numeric.
+ */
+function parseIpNumber(s) {
+    if (/^0x[0-9a-f]+$/.test(s))
+        return parseInt(s.slice(2), 16);
+    if (/^0[0-7]+$/.test(s))
+        return parseInt(s.slice(1), 8);
+    if (/^\d+$/.test(s))
+        return parseInt(s, 10);
+    return null;
+}
+/** Check whether four decoded octets form a private/reserved IPv4 address. */
+function isPrivateIpv4(o) {
+    const [a, b = 0, c = 0, d = 0] = o;
+    return (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 168));
+}
 /**
  * Check if a hostname is a private/link-local address (SSRF protection).
+ *
+ * Handles more than just dotted quads: bare integer / hex / octal encodings
+ * (every HTTP client decodes them as a 32-bit IPv4), shorthand quads
+ * ("127.1" → 127.0.0.1) and IPv6-mapped IPv4 ("::ffff:7f00:1").
  */
 export function isIpPrivate(hostname) {
-    const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-    return (/^(localhost|127\.0\.0\.1|0\.0\.0\.0|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.)/.test(h) ||
-        h === "::1" ||
-        /^(fc|fd)/.test(h) ||
-        (h.includes(":") && h.startsWith("fe80")));
+    let h = hostname.toLowerCase().trim().replace(/^\[|\]$/g, "");
+    if (h.includes(":")) {
+        // IPv6-mapped IPv4 (::ffff:127.0.0.1, ::ffff:7f00:1) — decode and fall
+        // through to the IPv4 checks below.
+        if (h.startsWith("::ffff:")) {
+            const mapped = h.slice(7);
+            if (!mapped.includes(":")) {
+                h = mapped; // dotted quad — fall through
+            }
+            else {
+                // Hex-colon encoding of the low 32 bits, e.g. "7f00:1".
+                const segs = mapped.split(":");
+                const hi = parseInt(segs[0], 16);
+                const lo = parseInt(segs[1] ?? "", 16);
+                if (segs.length !== 2 || Number.isNaN(hi) || Number.isNaN(lo))
+                    return false;
+                return isPrivateIpv4([(hi >> 8) & 255, hi & 255, (lo >> 8) & 255, lo & 255]);
+            }
+        }
+        else {
+            return h === "::1" || /^(fc|fd)/.test(h) || h.startsWith("fe80");
+        }
+    }
+    if (h === "localhost")
+        return true;
+    // Bare integer/hex/octal: interpreted as one 32-bit IPv4 word.
+    if (!h.includes(".")) {
+        const n = parseIpNumber(h);
+        if (n === null)
+            return false; // a domain name, not an IP
+        if (n < 0 || n > 0xffffffff)
+            return false;
+        return isPrivateIpv4([(n >>> 24) & 255, (n >>> 16) & 255, (n >>> 8) & 255, n & 255]);
+    }
+    // Dotted form: decode each part (hex/octal aware); shorthand like
+    // "127.1" pads the missing groups before the last.
+    const parts = h.split(".");
+    const nums = [];
+    for (let i = 0; i < parts.length; i++) {
+        const n = parseIpNumber(parts[i]);
+        if (n === null || n > 255)
+            return false; // domain or malformed — not our concern
+        nums.push(n);
+    }
+    while (nums.length < 4)
+        nums.splice(nums.length - 1, 0, 0);
+    if (nums.length !== 4)
+        return false;
+    return isPrivateIpv4(nums);
 }
 /**
  * Check if a URL is allowed based on security configuration

package/dist/modules/security/path-validator.js

@@ -1,5 +1,30 @@
 import { resolve, normalize } from "path";
-import { isInsideDir, matchesScopeEntry } from "../../tools/path-utils";
+import { realpathSync } from "fs";
+import { isInsideDir, matchesScopeEntry, toForwardSlash } from "../../tools/path-utils";
+/**
+ * Symlink containment: resolve() does NOT follow symlinks, so a symlink
+ * inside baseDir can point outside it. When the target exists on disk its
+ * real path must also stay inside the (real) base directory. Returns true if
+ * the check cannot be performed (target missing) — creation is validated by
+ * the resolved path itself.
+ */
+function escapesViaSymlink(baseResolved, targetResolved) {
+    try {
+        const realTarget = realpathSync(targetResolved);
+        let realBase = baseResolved;
+        try {
+            realBase = realpathSync(baseResolved);
+        }
+        catch {
+            // Keep the resolved baseDir when it cannot be canonicalized.
+        }
+        return !isInsideDir(realTarget, realBase);
+    }
+    catch {
+        // ENOENT etc — target does not exist yet, nothing to follow.
+        return false;
+    }
+}
 /**
  * Check if a path is within the allowed scope
  * This combines global security settings with per-tool scope
@@ -15,6 +40,12 @@ export function isPathInScope(baseDir, targetPath, scope, securityConfig) {
             reason: "Path is outside the base working directory",
         };
     }
+    if (escapesViaSymlink(baseResolved, targetResolved)) {
+        return {
+            allowed: false,
+            reason: "Path resolves outside the base working directory via symlink",
+        };
+    }
     // If security is disabled, skip pattern validation
     if (!securityConfig?.enabled) {
         // Still enforce subagent scope if present
@@ -148,50 +179,62 @@ export function isPathWritable(baseDir, targetPath, scope, securityConfig) {
 function matchesGlobPattern(targetPath, baseDir, pattern) {
     const resolvedBaseDir = resolve(baseDir);
     const resolvedTargetPath = resolve(targetPath);
-    // Handle directory patterns (ending with /)
+    // Relative target path used for segment matching
+    const relPath = resolvedTargetPath.startsWith(resolvedBaseDir)
+        ? resolvedTargetPath.slice(resolvedBaseDir.length).replace(/^\//, "")
+        : resolvedTargetPath;
+    // Handle patterns with ** (recursive directory matching)
+    if (pattern.includes("**")) {
+        // Split on ** to get prefix/suffix segments
+        const cleaned = pattern.replace(/\/$/, "");
+        const [rawPrefix, rawSuffix] = cleaned.split("**");
+        const prefix = rawPrefix.replace(/\/$/, "");
+        const suffix = rawSuffix.replace(/^\//, "");
+        // Check prefix: everything before ** must match the start of the path
+        if (prefix) {
+            const prefixParts = prefix.split("/").filter(Boolean);
+            const relParts = relPath.split("/");
+            for (let i = 0; i < prefixParts.length; i++) {
+                if (relParts[i] !== prefixParts[i])
+                    return false;
+            }
+        }
+        // ** at the end matches everything
+        if (!suffix)
+            return true;
+        // Check suffix against remaining path segments
+        const suffixParts = suffix.split("/").filter(Boolean);
+        const relParts = relPath.split("/");
+        // Search for suffix match anywhere in remaining path
+        for (let start = (prefix ? prefix.split("/").filter(Boolean).length : 0); start <= relParts.length - suffixParts.length; start++) {
+            let match = true;
+            for (let j = 0; j < suffixParts.length; j++) {
+                if (suffixParts[j] === "*")
+                    continue;
+                if (relParts[start + j] !== suffixParts[j]) {
+                    match = false;
+                    break;
+                }
+            }
+            if (match)
+                return true;
+        }
+        return false;
+    }
+    // Handle directory patterns (ending with /) without **
     if (pattern.endsWith("/")) {
         const dirPattern = pattern.slice(0, -1);
         const resolvedDirPattern = resolve(baseDir, dirPattern);
         return isInsideDir(resolvedTargetPath, resolvedDirPattern);
     }
-    // Handle **/* pattern (recursive)
-    if (pattern.includes("**/")) {
-        const parts = pattern.split("**/");
-        const prefix = parts[0];
-        const suffix = parts[1];
-        const resolvedPrefix = resolve(baseDir, prefix);
-        if (!isInsideDir(resolvedTargetPath, resolvedPrefix)) {
-            return false;
-        }
-        const remainingPath = resolvedTargetPath.slice(resolvedPrefix.length);
-        if (suffix === "*" || suffix === "") {
-            return true; // Any path after prefix
-        }
-        // Check if remaining path contains the suffix
-        return remainingPath.includes(suffix.replace(/\*/g, ""));
-    }
-    // Handle ** pattern (recursive any)
-    if (pattern.includes("**")) {
-        const parts = pattern.split("**");
-        const prefix = parts[0];
-        const suffix = parts[1];
-        const resolvedPrefix = resolve(baseDir, prefix);
-        if (!isInsideDir(resolvedTargetPath, resolvedPrefix)) {
-            return false;
-        }
-        if (!suffix) {
-            return true; // ** at the end matches anything after prefix
-        }
-        return resolvedTargetPath.includes(suffix.replace(/\//g, ""));
-    }
-    // Handle * pattern (single level)
+    // Handle * pattern (single level) without **
     if (pattern.includes("*")) {
         const regexPattern = pattern
             .replace(/\*/g, "[^/\\\\]*")
             .replace(/\?/g, ".")
             .replace(/\./g, "\\.");
         const regex = new RegExp(`^${regexPattern}$`);
-        const relativePath = resolvedTargetPath.slice(resolvedBaseDir.length + 1).replace(/\\/g, "/");
+        const relativePath = toForwardSlash(resolvedTargetPath.slice(resolvedBaseDir.length + 1));
         return regex.test(relativePath);
     }
     // Exact match (case-insensitive on win32, where the FS is case-insensitive)

package/dist/modules/security/rate-limiter.js

@@ -72,6 +72,17 @@ export class RateLimiter {
         this.cleanupOldRequests();
         return Math.max(0, this.config.maxRequestsPerMinute - this.state.requests.length);
     }
+    /**
+     * Milliseconds until a request slot frees up (the oldest request ages out of
+     * the 1-minute window). Returns 0 when a request can be made immediately.
+     */
+    msUntilRequest() {
+        this.cleanupOldRequests();
+        if (this.state.requests.length < this.config.maxRequestsPerMinute)
+            return 0;
+        const oldest = this.state.requests[0];
+        return Math.max(0, 60_000 - (Date.now() - oldest));
+    }
     /**
      * Clean up old requests (older than 1 minute)
      */

package/dist/modules/security/security-policies.js

@@ -70,7 +70,7 @@ export const STRICT_POLICY = {
                 "-R",
                 "--no-clobber",
             ],
-            dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "&", "`"],
+            dangerousOperators: [">", ">>", "2>", "2>>", "|", "&&", "||", ";", "&", "`", "$("],
             logCommands: true,
         },
         paths: {

package/dist/modules/security/session-encryption.js

@@ -2,6 +2,7 @@ import { readFileSync, writeFileSync, existsSync, readdirSync, unlinkSync } from
 import { join } from "path";
 import { homedir } from "os";
 import { encryptString, decryptString, isEncryptedString, ConfigEncryptor, } from "./encryption";
+import { defaultOutputBus } from "../../output";
 /**
  * Default session encryption configuration
  */
@@ -78,12 +79,22 @@ export class SessionFileEncryptor {
         return lines.map((line) => this.encryptFileContent(line));
     }
     /**
-     * Decrypt a JSONL file
+     * Decrypt a JSONL file. A line that fails to decrypt (corrupted, truncated
+     * by a crash, or foreign plaintext) is logged and SKIPPED — one bad line
+     * must not make the whole session history unreadable.
      */
     decryptJSONL(lines) {
         if (!this.config.enabled)
             return lines;
-        return lines.map((line) => this.decryptFileContent(line));
+        return lines.flatMap((line) => {
+            try {
+                return [this.decryptFileContent(line)];
+            }
+            catch (e) {
+                defaultOutputBus.log("error", "security", `[session-encryption] failed to decrypt JSONL line — skipping it: ${e instanceof Error ? e.message : String(e)}`, { persist: true });
+                return [];
+            }
+        });
     }
     /**
      * Read and decrypt a session file

package/dist/modules/security/session-isolation.js

@@ -2,6 +2,7 @@ import { join, resolve } from "path";
 import { homedir } from "os";
 import { mkdirSync, existsSync } from "fs";
 import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
+import { isInsideDir } from "../../tools/path-utils";
 /**
  * Default session isolation configuration
  */
@@ -83,13 +84,5 @@ export function isPathInSessionScope(sessionContext, path) {
     const resolvedPath = resolve(path);
     const workingDir = resolve(sessionContext.workingDir);
     const tempDir = resolve(sessionContext.tempDir);
-    // Check if path is within working directory
-    if (resolvedPath.startsWith(workingDir + "/") || resolvedPath.startsWith(workingDir + "\\")) {
-        return true;
-    }
-    // Check if path is within temp directory
-    if (resolvedPath.startsWith(tempDir + "/") || resolvedPath.startsWith(tempDir + "\\")) {
-        return true;
-    }
-    return false;
+    return isInsideDir(resolvedPath, workingDir) || isInsideDir(resolvedPath, tempDir);
 }

package/dist/modules/session/manager.js

@@ -101,6 +101,15 @@ export class SessionManager {
             return;
         this.store.appendSessionLog(this.activeId, entry);
     }
+    /** Read the full session.jsonl of any session (used by `session show`). */
+    loadSessionLog(id) {
+        try {
+            return this.store.loadSessionLog(id);
+        }
+        catch {
+            return [];
+        }
+    }
     loadHistory() {
         if (!this.activeId)
             return [];
@@ -161,6 +170,8 @@ export class SessionManager {
     }
     enforceMaxSessions() {
         const max = this.options.maxSessions ?? 50;
+        if (max <= 0)
+            return;
         const sessions = this.store.listSessions();
         if (sessions.length > max) {
             const toDelete = sessions.slice(max);

package/dist/modules/session/module.js

@@ -7,13 +7,21 @@ export class SessionModule {
     }
     getSystemPromptBlock() {
         const meta = this.manager.getActiveMeta();
-        if (!meta || meta.messageCount === 0)
+        if (!meta)
             return null;
+        // Stable per session: id/name/model/contextWindow do not change between
+        // turns, so the system prompt is not mutated (KV-cache, rule #10). Live
+        // values (message count) are exposed through the session_info tool.
         return {
-            content: t("session.info", { name: meta.name, id: meta.id, count: meta.messageCount }),
+            content: t("session.info_full", {
+                name: meta.name,
+                id: meta.id,
+                model: meta.model,
+                contextWindow: meta.contextWindow,
+            }),
             priority: "low",
             essential: false,
-            estimatedTokens: 20,
+            estimatedTokens: 30,
         };
     }
     getPlugin() {