micro-models-agent 0.63.0 → 1.1.0

package/dist/tools/executor.js

@@ -15,6 +15,11 @@ export class ToolExecutor {
      * wiring). Used internally — e.g. bash redirects a mistaken tool-call-as-
      * command into the real tool. Runs through the same registry and plugin
      * hooks as a normal call.
+     *
+     * **Reentrancy warning:** swaps `this.ctx` temporarily (line 30-39). Safe
+     * for sequential callers but NOT for concurrent calls on the same executor
+     * instance — they would race on the ctx swap. Today all callers are
+     * sequential (bash redirect, single subagent tool); keep it that way.
      */
     async executeByName(name, args, ctx) {
         const prevCtx = this.ctx;
@@ -53,6 +58,7 @@ export class ToolExecutor {
                         const reason = typeof proceed === "string" ? proceed : undefined;
                         return {
                             success: false,
+                            blocked: true,
                             output: reason
                                 ? t("tool.blocked_reason", { plugin: pluginName, reason })
                                 : t("tool.blocked", { plugin: pluginName }),
@@ -74,11 +80,25 @@ export class ToolExecutor {
             }
             else {
                 const timeoutMs = tool.timeoutMs ?? TOOL_EXECUTION_TIMEOUT_MS;
+                const failFast = (message) => {
+                    // Kill any long-running child process registered for this call.
+                    killByCallId(call.id);
+                    // Run tool-specific cleanup (e.g. subagent scope restore) before
+                    // rejecting so shared state is restored even on abandonment.
+                    const cleanup = this.ctx.cleanup;
+                    if (cleanup) {
+                        cleanup();
+                        // Clear only if no newer call has replaced it meanwhile.
+                        if (this.ctx.cleanup === cleanup)
+                            this.ctx.cleanup = undefined;
+                    }
+                    return new Error(message);
+                };
+                let timer;
+                let onAbort;
                 const timeoutPromise = new Promise((_, reject) => {
-                    setTimeout(() => {
-                        // Kill any long-running child process registered for this call.
-                        killByCallId(call.id);
-                        reject(new Error(t("tool.timeout", {
+                    timer = setTimeout(() => {
+                        reject(failFast(t("tool.timeout", {
                             name: call.name,
                             seconds: Math.round(timeoutMs / 1000),
                         })));
@@ -90,10 +110,7 @@ export class ToolExecutor {
                 ];
                 if (signal) {
                     const abortPromise = new Promise((_, reject) => {
-                        const onAbort = () => {
-                            killByCallId(call.id);
-                            reject(new Error(t("tool.aborted", { name: call.name })));
-                        };
+                        onAbort = () => reject(failFast(t("tool.aborted", { name: call.name })));
                         if (signal.aborted) {
                             onAbort();
                         }
@@ -103,7 +120,26 @@ export class ToolExecutor {
                     });
                     racePromises.push(abortPromise);
                 }
-                result = await Promise.race(racePromises);
+                try {
+                    result = await Promise.race(racePromises);
+                }
+                finally {
+                    // Stop the timer and detach the abort listener once settled so they
+                    // never fire against a DIFFERENT call's context/cleanup later.
+                    if (timer !== undefined)
+                        clearTimeout(timer);
+                    if (onAbort && signal)
+                        signal.removeEventListener("abort", onAbort);
+                    // Losing promises have no consumer after Promise.race settled
+                    // (their kill/cleanup effects were already applied in failFast).
+                    // Log the rejection, then detach it so it never surfaces as an
+                    // unhandled rejection.
+                    for (const p of racePromises.slice(1)) {
+                        p.catch((e) => {
+                            this.ctx.logger.debug(`Tool ${call.name}: discarded race loser: ${e.message}`);
+                        });
+                    }
+                }
             }
             result.toolCallId = call.id;
         }
@@ -148,6 +184,15 @@ export class ToolExecutor {
     setScope(scope) {
         this.ctx.scope = scope;
     }
+    setPromptIO(io) {
+        this.ctx.promptIO = io;
+    }
+    getRecursionDepth() {
+        return this.ctx.recursionDepth ?? 0;
+    }
+    setRecursionDepth(depth) {
+        this.ctx.recursionDepth = depth;
+    }
     updateProvider(provider) {
         this.ctx.llmProvider = provider;
     }

package/dist/tools/glob-tool.js

@@ -15,6 +15,13 @@ export const globTool = {
     },
     handler: async (ctx, args) => {
         const pattern = String(args.pattern);
+        // Security: absolute patterns (/etc/*) and ".." segments escape baseDir.
+        if (/^([a-zA-Z]:)?[\\/]/.test(pattern) || pattern.split(/[\\/]/).includes("..")) {
+            return {
+                success: false,
+                output: t("file.path_not_allowed", { path: pattern }),
+            };
+        }
         const results = globSync(pattern, { cwd: ctx.baseDir });
         if (results.length === 0) {
             return { success: true, output: t("file.no_matches") };

package/dist/tools/grep-tool.js

@@ -1,7 +1,9 @@
 import { spawn } from "child_process";
 import { resolve } from "path";
 import { t } from "../i18n/index";
-import { logBashCommand } from "../modules/security/audit-log";
+import { logBashCommand, logSecurityBlock } from "../modules/security/audit-log";
+import { isPathInScope } from "../modules/security/path-validator";
+import { DEFAULT_SECURITY_CONFIG } from "../config/security";
 import { MAX_PREVIEW_LINES } from "./preview";
 function truncateLines(output) {
     const lines = output.split("\n");
@@ -74,6 +76,18 @@ export const grepTool = {
     handler: async (ctx, args) => {
         const pattern = String(args.pattern);
         const searchPath = args.path ? resolve(ctx.baseDir, String(args.path)) : ctx.baseDir;
+        // Security: the search directory must stay inside baseDir / scope /
+        // allowed paths — `path: "../../.."` must not read outside the sandbox.
+        const scopeCheck = isPathInScope(ctx.baseDir, searchPath, ctx.scope, ctx.config?.security?.paths || DEFAULT_SECURITY_CONFIG.paths);
+        if (!scopeCheck.allowed) {
+            logSecurityBlock(ctx.sessionId || undefined, "file_read", scopeCheck.reason || "grep path not allowed", String(args.path ?? ctx.baseDir));
+            return {
+                success: false,
+                output: t("file.path_not_allowed", {
+                    path: `${args.path ?? "."} — ${scopeCheck.reason}`,
+                }),
+            };
+        }
         // Build rg arguments as an array to avoid shell interpretation of regex
         // metacharacters like |, (, ) — these are regex patterns, not shell operators.
         const rgArgs = ["-n", "--with-filename", pattern, searchPath];

package/dist/tools/index.js

@@ -33,9 +33,10 @@ import { recallTool } from "./recall";
 import { createBrowserTool } from "./browser";
 import { attachImageTool } from "./attach-image";
 import { enableToolsTool } from "./enable-tools";
+import { sessionInfoTool } from "./session-info";
 export { ToolRegistry, ToolExecutor };
 export { filterToolsByTags } from "./filter-tools";
-export { readFileTool, writeFileTool, editFileTool, globTool, grepTool, listDirTool, createDirTool, deleteFileTool, moveFileTool, fileInfoTool, bashTool, subagentTool, chunkQueryTool, processListTool, processLogTool, processKillTool, webSearchTool, webFetchTool, webBrowseTool, downloadFileTool, createLoadSkillTool, pipelineRunTool, mcpCallTool, searchHistoryTool, rememberTool, recallTool, createBrowserTool, attachImageTool, enableToolsTool, };
+export { readFileTool, writeFileTool, editFileTool, globTool, grepTool, listDirTool, createDirTool, deleteFileTool, moveFileTool, fileInfoTool, bashTool, subagentTool, chunkQueryTool, processListTool, processLogTool, processKillTool, webSearchTool, webFetchTool, webBrowseTool, downloadFileTool, createLoadSkillTool, pipelineRunTool, mcpCallTool, searchHistoryTool, rememberTool, recallTool, createBrowserTool, attachImageTool, enableToolsTool, sessionInfoTool, };
 export function registerAllTools(registry, skillsModule, opts) {
     const tools = [
         readFileTool,
@@ -62,6 +63,7 @@ export function registerAllTools(registry, skillsModule, opts) {
         mcpCallTool,
         searchHistoryTool,
         attachImageTool,
+        sessionInfoTool,
     ];
     // On-demand tool activation is the default. When explicitly disabled
     // (enableOnDemand: false), the tool is not registered at all — combined

package/dist/tools/list-dir.js

@@ -4,6 +4,8 @@ import { t } from "../i18n/index";
 import { isPathInScope } from "../modules/security/path-validator";
 import { safeResolvePath } from "./path-utils";
 import { MAX_PREVIEW_LINES } from "./preview";
+/** Directories hidden from list_dir output (consistent with indexer walker). */
+const IGNORED_DIRS = new Set(["node_modules", ".git", "dist", "build", "coverage", ".mma"]);
 export const listDirTool = {
     name: "list_dir",
     icon: "📂",
@@ -33,7 +35,7 @@ export const listDirTool = {
         if (!existsSync(resolved)) {
             return { success: false, output: t("file.dir_notfound", { path }) };
         }
-        const entries = readdirSync(resolved);
+        const entries = readdirSync(resolved).filter((e) => !IGNORED_DIRS.has(e));
         const lines = entries.map((e) => {
             const full = resolve(resolved, e);
             return statSync(full).isDirectory() ? `${e}/` : e;

package/dist/tools/load-skill.js

@@ -1,4 +1,5 @@
 import { t } from "../i18n/index";
+import { estimateTokens } from "../llm/token-counter";
 export function createLoadSkillTool(skillsModule) {
     return {
         name: "load_skill",
@@ -29,7 +30,7 @@ export function createLoadSkillTool(skillsModule) {
                 return { success: false, output: result.message + hint };
             }
             const budget = skillsModule.getBudget();
-            const tokens = result.skill ? Math.ceil(result.skill.content.length / 4) : 0;
+            const tokens = result.skill ? estimateTokens(result.skill.content) : 0;
             return {
                 success: true,
                 output: t("tool.skill_budget", {

package/dist/tools/mcp-call.js

@@ -26,7 +26,7 @@ export const mcpCallTool = {
     name: "mcp_call",
     icon: "🔗",
     description: "Call a tool on an MCP (Model Context Protocol) server. MCP servers provide external capabilities like databases, APIs, or specialized tools.",
-    tags: ["code", "research"],
+    tags: ["research"],
     parameters: {
         type: "object",
         properties: {

package/dist/tools/move-file.js

@@ -39,8 +39,9 @@ export const moveFileTool = {
                 output: `[SECURITY BLOCKED] Maximum file operations (${maxFileOps}) exceeded`,
             };
         }
-        // Check source path permissions
-        const fromCheck = isPathWritable(ctx.baseDir, fromPath, ctx.scope, ctx.config.security?.paths);
+        // Check source path permissions — against the RESOLVED path (the same
+        // one renameSync will act on), never the raw argument.
+        const fromCheck = isPathWritable(ctx.baseDir, fromResolved, ctx.scope, ctx.config.security?.paths);
         if (!fromCheck.allowed) {
             logSecurityBlock(ctx.sessionId, "file_write", fromCheck.reason || "Source path not allowed", fromPath);
             return {
@@ -50,8 +51,8 @@ export const moveFileTool = {
                 }),
             };
         }
-        // Check destination path permissions
-        const toCheck = isPathWritable(ctx.baseDir, toPath, ctx.scope, ctx.config.security?.paths);
+        // Check destination path permissions — resolved, same as above.
+        const toCheck = isPathWritable(ctx.baseDir, toResolved, ctx.scope, ctx.config.security?.paths);
         if (!toCheck.allowed) {
             logSecurityBlock(ctx.sessionId, "file_write", toCheck.reason || "Destination path not allowed", toPath);
             return {

package/dist/tools/path-utils.js

@@ -1,5 +1,12 @@
 import { resolve, normalize, dirname, basename, sep, relative, isAbsolute } from "path";
 import { existsSync } from "fs";
+/**
+ * Normalize backslashes to forward slashes for display and comparison.
+ * On POSIX this is a no-op; on Windows it converts `src\foo\bar.ts` → `src/foo/bar.ts`.
+ */
+export function toForwardSlash(p) {
+    return p.replace(/\\/g, "/");
+}
 /**
  * True when targetPath equals dirPath or lies inside it.
  *

package/dist/tools/pipeline-run.js

@@ -55,7 +55,7 @@ export const pipelineRunTool = {
     name: "pipeline_run",
     icon: "▶️",
     description: "Run a named pipeline with YAML definition. Creates a DAG of sub-agents that execute in dependency order.",
-    tags: ["shell", "code"],
+    tags: ["shell"],
     parameters: {
         type: "object",
         properties: {

package/dist/tools/prompt-io.js

@@ -0,0 +1,28 @@
+import { formatMenu, choicePrompt, parseSelection, CUSTOM_INDEX, } from "./user-input";
+import { t } from "../i18n/index";
+/** Build a PromptIO from injectable ask/print primitives (testable, terminal-agnostic). */
+export function createPromptIO(deps) {
+    return {
+        async askText(question) {
+            return (await deps.ask(`${question} `)).trim();
+        },
+        async askChoice(question, options, opts = {}) {
+            const multiple = opts.multiple ?? false;
+            const entryCount = options.length + (opts.allowCustom ? 1 : 0);
+            // No selectable entries (and no custom entry) — parseSelection can never
+            // succeed, so return without printing a dead menu or looping forever.
+            if (entryCount === 0)
+                return [];
+            const customEntry = options.length;
+            deps.print(formatMenu(question, options, opts));
+            for (;;) {
+                const answer = await deps.ask(choicePrompt(entryCount, multiple));
+                const parsed = parseSelection(answer, entryCount, multiple);
+                if (parsed) {
+                    return parsed.map((i) => (opts.allowCustom && i === customEntry ? CUSTOM_INDEX : i));
+                }
+                deps.print(t("tool.user_input.invalid"));
+            }
+        },
+    };
+}

package/dist/tools/question.js

@@ -1,16 +1,16 @@
 import { t } from "../i18n/index";
 import { askUser } from "./user-input";
-const DESCRIPTION = `Use this tool when you need to ask the user questions during execution. This allows you to:
-1. Gather user preferences or requirements
-2. Clarify ambiguous instructions
-3. Get decisions on implementation choices as you work
-4. Offer choices to the user about what direction to take.
-
-Usage notes:
-- When "custom" is enabled (default), a "Type your own answer" option is added automatically; don't include "Other" or catch-all options
-- Answers are returned as arrays of labels; set "multiple": true to allow selecting more than one
-- If you recommend a specific option, make that the first option in the list and add "(Recommended)" at the end of the label
-- Execution blocks until the user answers every question
+const DESCRIPTION = `Use this tool when you need to ask the user questions during execution. This allows you to:
+1. Gather user preferences or requirements
+2. Clarify ambiguous instructions
+3. Get decisions on implementation choices as you work
+4. Offer choices to the user about what direction to take.
+
+Usage notes:
+- When "custom" is enabled (default), a "Type your own answer" option is added automatically; don't include "Other" or catch-all options
+- Answers are returned as arrays of labels; set "multiple": true to allow selecting more than one
+- If you recommend a specific option, make that the first option in the list and add "(Recommended)" at the end of the label
+- Execution blocks until the user answers every question
 - Omit "options" for a free-text question`;
 function isOption(val) {
     if (!val || typeof val !== "object")
@@ -128,7 +128,7 @@ export const questionTool = {
                 multiple: q.multiple,
                 custom: q.custom,
                 progress,
-            }));
+            }, ctx.promptIO));
         }
         const formatted = questions
             .map((q, i) => `"${q.question}"="${answers[i].length ? answers[i].join(", ") : t("tool.question.unanswered")}"`)

package/dist/tools/scope-request.js

@@ -0,0 +1,91 @@
+const WRITE_TOOLS = new Set([
+    "write_file",
+    "edit_file",
+    "delete_file",
+    "create_dir",
+    "move_file",
+    "download_file",
+]);
+/**
+ * Scope denials funnel through i18n keys file.path_not_allowed(_short)
+ * ("Path not allowed" / "Путь недопустим") and chunk-query's "[SCOPE]" prefix.
+ */
+export function isPathDenialOutput(output) {
+    if (!output)
+        return false;
+    return (output.includes("Path not allowed") ||
+        output.includes("Путь недопустим") ||
+        output.startsWith("[SCOPE]"));
+}
+function pathArgOf(args) {
+    if (!args)
+        return "";
+    for (const key of ["path", "file", "input_path", "target", "source", "destination", "dir"]) {
+        const v = args[key];
+        if (typeof v === "string" && v.trim())
+            return v.trim();
+    }
+    for (const v of Object.values(args)) {
+        if (typeof v === "string" && /\.[\w-]+$/.test(v))
+            return v.trim();
+    }
+    return "";
+}
+/** Observes the sub-agent's tool results and records scope-denied paths. */
+export class ScopeDenialCollector {
+    denied = new Map();
+    plugin = {
+        name: "scope-denial-collector",
+        isBuiltin: true,
+        onAfterTool: (_ctx, call, result) => {
+            const name = call?.name;
+            if (!name || !result || result.success)
+                return;
+            if (!isPathDenialOutput(typeof result.output === "string" ? result.output : undefined)) {
+                return;
+            }
+            const path = pathArgOf(call?.arguments);
+            if (!path)
+                return;
+            const write = WRITE_TOOLS.has(name);
+            this.denied.set(path, { path, write });
+        },
+    };
+    getDenied() {
+        return Array.from(this.denied.values());
+    }
+    /** read_only=true only when every denial was a pure read denial. */
+    toScopeRequest(reason = "sub-agent was denied access to files needed for the task") {
+        const all = this.getDenied();
+        if (all.length === 0)
+            return null;
+        return {
+            files: all.map((d) => d.path),
+            read_only: !all.some((d) => d.write),
+            reason,
+        };
+    }
+}
+export function formatScopeRequest(req) {
+    return `<scope-request>${JSON.stringify(req)}</scope-request>`;
+}
+export function parseScopeRequest(text) {
+    if (!text)
+        return null;
+    const match = text.match(/<scope-request>([\s\S]*?)<\/scope-request>/);
+    if (!match)
+        return null;
+    try {
+        const parsed = JSON.parse(match[1]);
+        if (!Array.isArray(parsed.files) || parsed.files.length === 0)
+            return null;
+        return {
+            files: parsed.files.map(String),
+            read_only: !!parsed.read_only,
+            reason: String(parsed.reason || "access denied"),
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/tools/session-info.js

@@ -0,0 +1,44 @@
+import { t } from "../i18n/index";
+export const sessionInfoTool = {
+    name: "session_info",
+    icon: "ℹ️",
+    description: "Show metadata about the current session: id, name, model, provider, context window, message count, and how much of the context budget is used. Use when the user asks which session this is or how much context is left.",
+    alwaysOn: true,
+    boundedOutput: true,
+    parameters: {
+        type: "object",
+        properties: {},
+    },
+    handler: async (ctx) => {
+        const meta = ctx.sessionManager?.getActiveMeta();
+        if (!meta) {
+            return { success: true, output: t("tool.session_info.no_active") };
+        }
+        const provider = ctx.config.provider;
+        const providerName = provider.active ?? provider.type ?? "unknown";
+        const lines = [
+            t("tool.session_info.result", {
+                id: meta.id,
+                name: meta.name,
+                model: meta.model ?? ctx.config.model ?? "unknown",
+                provider: providerName,
+                contextWindow: String(meta.contextWindow ?? ctx.config.contextWindow),
+                messages: String(meta.messageCount),
+                createdAt: meta.createdAt,
+                updatedAt: meta.updatedAt,
+            }),
+        ];
+        const snapshot = ctx.contextManager?.getSnapshot();
+        if (snapshot) {
+            const used = snapshot.tokens;
+            const budget = snapshot.budget.history;
+            const percent = budget > 0 ? Math.round((used / budget) * 100) : 0;
+            lines.push(t("tool.session_info.context", {
+                used: String(used),
+                budget: String(budget),
+                percent: String(percent),
+            }));
+        }
+        return { success: true, output: lines.join("\n") };
+    },
+};

package/dist/tools/set-thinking.js

@@ -0,0 +1,71 @@
+// src/tools/set-thinking.ts
+import { t } from "../i18n/index";
+const VALID_LEVELS = ["default", "none", "low", "medium", "high", "max"];
+export function createSetThinkingTool(state, config, getCurrentIteration) {
+    return {
+        name: "set_thinking",
+        description: "Set reasoning effort level for the next LLM call. Normally managed automatically by the harness. Use only to force deeper thinking for genuinely hard subproblems or shallower for mechanical batches.",
+        icon: "🧠",
+        tags: [],
+        alwaysOn: true,
+        parameters: {
+            type: "object",
+            properties: {
+                level: {
+                    type: "string",
+                    enum: ["none", "low", "high", "max"],
+                    description: "Reasoning effort level to set",
+                },
+                reason: {
+                    type: "string",
+                    description: "Why changing the level",
+                },
+            },
+            required: ["level"],
+        },
+        handler: async (_ctx, args) => {
+            const requested = args.level;
+            const reason = args.reason || "agent override";
+            if (!VALID_LEVELS.includes(requested) && requested !== "auto") {
+                return {
+                    success: false,
+                    output: t("tool.thinking_invalid_level", { level: requested }),
+                };
+            }
+            // Cooldown check
+            const currentIter = getCurrentIteration();
+            const elapsed = currentIter - state.overrideIteration;
+            if (elapsed > 0 && elapsed < config.overrideCooldown) {
+                return {
+                    success: true,
+                    output: t("tool.thinking_cooldown", {
+                        remaining: config.overrideCooldown - elapsed,
+                        current: state.level,
+                    }),
+                };
+            }
+            // Clamp to configured bounds
+            let level = requested;
+            const levelOrder = ["none", "low", "medium", "high", "max"];
+            const minIdx = levelOrder.indexOf(config.min);
+            const maxIdx = levelOrder.indexOf(config.max);
+            const reqIdx = levelOrder.indexOf(level);
+            let clamped = false;
+            if (reqIdx >= 0 && reqIdx < minIdx) {
+                level = config.min;
+                clamped = true;
+            }
+            else if (reqIdx > maxIdx) {
+                level = config.max;
+                clamped = true;
+            }
+            // Apply
+            state.level = level;
+            state.overrideIteration = currentIter;
+            const msg = clamped
+                ? t("tool.thinking_set_clamped", { level, reason })
+                : t("tool.thinking_set", { level, reason });
+            return { success: true, output: msg };
+        },
+    };
+}