micro-models-agent 0.63.0 → 1.1.0

package/dist/config/config.js

@@ -5,11 +5,14 @@ import { DEFAULTS } from "./defaults";
 import { DEFAULT_SECURITY_CONFIG } from "./security";
 import { DEFAULT_LSP_CONFIG } from "../modules/lsp/config";
 import { t } from "../i18n/index";
+import { deepMerge, regexReplacer, regexReviver } from "./utils";
+export { deepMerge };
 import { MigrationDetector } from "../migration/detect";
 import { BackupManager } from "../migration/backup";
 import { validateExpertConfig } from "./experts";
 import { ConfigEncryptor } from "../modules/security/encryption";
 import { loadDomainFiles, saveDomainFiles } from "./domains";
+import { defaultOutputBus } from "../output";
 // ── Centralized path constants ──────────────────────────────────────────
 export const CONFIG_DIR = join(homedir(), ".mma");
 export const CONFIG_FILE = join(CONFIG_DIR, "config.json");
@@ -42,50 +45,6 @@ function restoreDangerousPatterns(patterns, defaults) {
         return fallback[i] || fallback[0] || p;
     });
 }
-function deepMerge(target, source) {
-    const result = { ...target };
-    for (const key of Object.keys(source)) {
-        const srcVal = source[key];
-        const tgtVal = target[key];
-        if (srcVal !== null &&
-            srcVal !== undefined &&
-            typeof srcVal === "object" &&
-            !Array.isArray(srcVal) &&
-            typeof tgtVal === "object" &&
-            !Array.isArray(tgtVal)) {
-            result[key] = deepMerge(tgtVal, srcVal);
-        }
-        else if (srcVal !== undefined) {
-            result[key] = srcVal;
-        }
-    }
-    return result;
-}
-/**
- * JSON replacer that serializes RegExp objects as {__regex, source, flags}
- * so they survive JSON.stringify/parse round-trips.
- */
-function regexReplacer(_key, value) {
-    if (value instanceof RegExp) {
-        return { __regex: true, source: value.source, flags: value.flags };
-    }
-    return value;
-}
-/**
- * JSON reviver that restores RegExp objects serialized by regexReplacer.
- */
-function regexReviver(_key, value) {
-    if (value && typeof value === "object" && value.__regex === true) {
-        const { source, flags } = value;
-        try {
-            return new RegExp(source, flags);
-        }
-        catch {
-            return value;
-        }
-    }
-    return value;
-}
 /**
  * Legacy npx `args` for LSP servers that predate the fixed invocation.
  */
@@ -117,50 +76,133 @@ function normalizeLspServerArgs(config) {
     }
 }
 function loadJSON(path) {
+    if (!existsSync(path))
+        return null;
     try {
-        if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, "utf-8"), regexReviver);
-        }
+        return JSON.parse(readFileSync(path, "utf-8"), regexReviver);
     }
     catch {
-        /* ignore malformed files */
+        // Never silent: a typo'd config must not quietly wipe the user's settings.
+        defaultOutputBus.log("warn", "config", t("config.parse_failed", { path }));
     }
     return null;
 }
+/**
+ * Apply MMA_* env overrides. Returns the overridden keys with their PRE-ENV
+ * values so `saveConfig` can avoid persisting session-scoped env values (C4).
+ */
 function applyEnvVars(config) {
     const env = process.env;
+    const overrides = [];
     const result = { ...config };
-    if (env.MMA_MODEL)
+    const record = (key, envValue) => {
+        const original = result[key];
+        if (original !== envValue)
+            overrides.push({ key, envValue, originalValue: original });
+    };
+    if (env.MMA_MODEL) {
+        record("model", env.MMA_MODEL);
         result.model = env.MMA_MODEL;
-    if (env.MMA_PROVIDER_TYPE)
+    }
+    const originalProvider = result.provider;
+    // normalizeEntries prefers entries[] and ignores the flat provider fields, so
+    // a flat-only env override is a silent no-op on multi-provider configs (the
+    // certification harness depends on these vars working). Resolve the active
+    // entry and patch it too.
+    const activeEntryIndex = (() => {
+        const entries = result.provider.entries;
+        if (!entries || entries.length === 0)
+            return -1;
+        const active = result.provider.active;
+        if (!active)
+            return 0;
+        const i = entries.findIndex((e) => e.label === active || e.type === active);
+        return i >= 0 ? i : 0;
+    })();
+    const patchActiveEntry = (patch) => {
+        if (activeEntryIndex < 0)
+            return;
+        const entries = result.provider.entries;
+        const next = [...entries];
+        next[activeEntryIndex] = { ...next[activeEntryIndex], ...patch };
+        result.provider = { ...result.provider, entries: next };
+    };
+    if (env.MMA_PROVIDER_TYPE) {
         result.provider = { ...result.provider, type: env.MMA_PROVIDER_TYPE };
-    if (env.MMA_PROVIDER_BASEURL)
+        patchActiveEntry({ type: env.MMA_PROVIDER_TYPE });
+    }
+    if (env.MMA_PROVIDER_BASEURL) {
         result.provider = { ...result.provider, baseUrl: env.MMA_PROVIDER_BASEURL };
-    if (env.MMA_PROVIDER_APIKEY)
+        patchActiveEntry({ baseUrl: env.MMA_PROVIDER_BASEURL });
+    }
+    if (env.MMA_PROVIDER_APIKEY) {
         result.provider = { ...result.provider, apiKey: env.MMA_PROVIDER_APIKEY };
-    if (env.MMA_LOG_LEVEL)
+        patchActiveEntry({ apiKey: env.MMA_PROVIDER_APIKEY });
+    }
+    if (env.MMA_PROVIDER_TYPE || env.MMA_PROVIDER_BASEURL || env.MMA_PROVIDER_APIKEY) {
+        // Record once with the FINAL env-mutated provider object so the identity
+        // check in stripEnvOverrides matches what the loaded config holds.
+        overrides.push({ key: "provider", envValue: result.provider, originalValue: originalProvider });
+    }
+    if (env.MMA_LOG_LEVEL) {
+        record("logLevel", env.MMA_LOG_LEVEL);
         result.logLevel = env.MMA_LOG_LEVEL;
-    if (env.MMA_LOCALE)
+    }
+    if (env.MMA_LOCALE) {
+        record("locale", env.MMA_LOCALE);
         result.locale = env.MMA_LOCALE;
+    }
     if (env.MMA_CONTEXT_WINDOW) {
         const v = parseInt(env.MMA_CONTEXT_WINDOW, 10);
-        if (!isNaN(v))
+        if (!isNaN(v)) {
+            record("contextWindow", v);
             result.contextWindow = v;
+        }
     }
     if (env.MMA_MAX_TOOL_ITERATIONS) {
         const v = parseInt(env.MMA_MAX_TOOL_ITERATIONS, 10);
-        if (!isNaN(v))
+        if (!isNaN(v)) {
+            record("maxToolIterations", v);
             result.maxToolIterations = v;
+        }
     }
     if (env.MMA_STUCK_THRESHOLD) {
         const v = parseInt(env.MMA_STUCK_THRESHOLD, 10);
-        if (!isNaN(v))
+        if (!isNaN(v)) {
+            record("stuckThreshold", v);
             result.stuckThreshold = v;
+        }
+    }
+    if (env.MMA_AUTO_PLAN) {
+        const v = env.MMA_AUTO_PLAN === "true";
+        record("autoPlan", v);
+        result.autoPlan = v;
+    }
+    if (env.MMA_MOE_ENABLED) {
+        const next = { ...result.moe, enabled: env.MMA_MOE_ENABLED === "true" };
+        record("moe", next);
+        result.moe = next;
+    }
+    return { config: result, overrides };
+}
+/** Pre-env values for env-touched keys, keyed by the loaded config object. */
+const envOverrideMap = new WeakMap();
+/**
+ * Restore pre-env values before persisting — session-scoped env overrides
+ * (e.g. the cert harness baseUrl) must NOT leak into domain files. An explicit
+ * later change (setProvider/reconfigure replacing provider, /model use) shows
+ * up as a different object/value and is kept as-is.
+ */
+function stripEnvOverrides(config) {
+    const overrides = envOverrideMap.get(config);
+    if (!overrides || overrides.length === 0)
+        return config;
+    const result = { ...config };
+    for (const o of overrides) {
+        if (result[o.key] === o.envValue) {
+            result[o.key] = o.originalValue;
+        }
     }
-    if (env.MMA_AUTO_PLAN)
-        result.autoPlan = env.MMA_AUTO_PLAN === "true";
-    if (env.MMA_MOE_ENABLED)
-        result.moe = { ...result.moe, enabled: env.MMA_MOE_ENABLED === "true" };
     return result;
 }
 /**
@@ -184,15 +226,24 @@ export function loadConfig(options) {
     const detector = new MigrationDetector(options.configDir);
     if (detector.needsMigration()) {
         const backup = new BackupManager(options.configDir);
+        // Full-directory backup (documented behavior) + config.json snapshot
+        // before we touch anything.
+        backup.backupAll();
         backup.backupConfig();
         const summary = backup.getBackupSummary();
-        console.log(t("migration.detected", { summary }));
+        defaultOutputBus.log("info", "config", t("migration.detected", { summary }));
         try {
             unlinkSync(globalPath);
         }
-        catch { }
+        catch (e) {
+            // Best-effort removal: loadConfig falls back to defaults either way,
+            // but a leftover v1 file would re-trigger migration on every startup.
+            defaultOutputBus.log("error", "config", `[config] failed to remove legacy config.json: ${e instanceof Error ? e.message : String(e)}`);
+        }
     }
-    let config = { ...DEFAULTS };
+    // Deep clone: DEFAULTS holds singleton objects (security, lsp, tools…)
+    // that must never be mutated by runtime config changes.
+    let config = structuredClone(DEFAULTS);
     let legacyDetected = false;
     // Step 1: legacy config.json (fallback)
     const globalData = loadJSON(globalPath);
@@ -221,7 +272,8 @@ export function loadConfig(options) {
     }
     normalizeLspServerArgs(config);
     // Step 6: env vars
-    config = applyEnvVars(config);
+    const { config: envConfig, overrides } = applyEnvVars(config);
+    config = envConfig;
     // Step 7: decrypt
     try {
         const encryptor = new ConfigEncryptor();
@@ -229,10 +281,18 @@ export function loadConfig(options) {
         for (const key of Object.keys(decrypted)) {
             config[key] = decrypted[key];
         }
+        // Decrypt rebuilds the object tree (new identities). Re-point the provider
+        // override at the post-decrypt provider so the save-time identity check in
+        // stripEnvOverrides still matches the loaded config.
+        const providerOverride = overrides.find((o) => o.key === "provider");
+        if (providerOverride)
+            providerOverride.envValue = config.provider;
     }
     catch (e) {
-        console.warn(t("config.decryption_warning", { error: e.message }));
+        defaultOutputBus.log("warn", "config", t("config.decryption_warning", { error: e.message }));
     }
+    if (overrides.length > 0)
+        envOverrideMap.set(config, overrides);
     return { config, legacyDetected };
 }
 export function validateConfig(config, allToolTags) {
@@ -255,8 +315,10 @@ export function validateConfig(config, allToolTags) {
  * @param configDir  Optional config directory (e.g. ~/.mma). When provided, writes domain files.
  */
 export function saveConfig(config, configPath, configDir) {
+    // Session-scoped MMA_* env overrides must not be persisted (C4).
+    const toWrite = stripEnvOverrides(config);
     if (configDir) {
-        saveDomainFiles(config, configDir);
+        saveDomainFiles(toWrite, configDir);
         return;
     }
     // Legacy single-file write (backward compat for tests / edge cases)
@@ -265,12 +327,12 @@ export function saveConfig(config, configPath, configDir) {
     try {
         const encryptor = new ConfigEncryptor();
         const encryptedConfig = encryptor.encrypt({
-            ...config,
+            ...toWrite,
         });
         writeFileSync(configPath, JSON.stringify(encryptedConfig, regexReplacer, 2), "utf-8");
     }
     catch (e) {
-        console.warn(t("config.encryption_warning", { error: e.message }));
-        writeFileSync(configPath, JSON.stringify(config, regexReplacer, 2), "utf-8");
+        defaultOutputBus.log("warn", "config", t("config.encryption_warning", { error: e.message }));
+        writeFileSync(configPath, JSON.stringify(toWrite, regexReplacer, 2), "utf-8");
     }
 }

package/dist/config/defaults.js

@@ -1,8 +1,10 @@
 import { DEFAULT_SECURITY_CONFIG } from "./security";
 import { DEFAULT_LSP_CONFIG } from "../modules/lsp/config";
+/** Single source of truth for the default model (experts inherit it, C8). */
+const DEFAULT_MODEL = "qwen/qwen3.5-9b";
 export const DEFAULTS = {
     version: "2.0.0",
-    model: "qwen/qwen3.5-9b",
+    model: DEFAULT_MODEL,
     provider: {
         type: "openai-compat",
         baseUrl: "http://localhost:1234/v1",
@@ -14,31 +16,42 @@ export const DEFAULTS = {
     },
     moe: {
         enabled: false,
+        maxReplanCycles: 3,
     },
     tools: {
+        // TODO(2026-08-29): revisit tool-set visibility. enableOnDemand:false
+        // restores the full ~28-tool set (legacy behavior) — safe for small
+        // models but costs schema tokens per call. The on-demand narrowing
+        // (defaultTags + enable_tools) kept the footprint small but made the 9B
+        // model call hidden tools as shell commands / drift to MCP. Decide the
+        // right trade-off for small models and pick one mode.
         defaultTags: ["file", "code"],
-        enableOnDemand: true,
+        enableOnDemand: false,
     },
     experts: {
         code: {
-            model: "qwen/qwen3.5-9b",
+            model: DEFAULT_MODEL,
             tool_tags: ["file", "code", "shell"],
             max_attempts: 3,
+            description: "file operations, code editing, shell commands",
         },
         research: {
-            model: "qwen/qwen3.5-9b",
+            model: DEFAULT_MODEL,
             tool_tags: ["research"],
             max_attempts: 3,
+            description: "web search, web fetch, web browse, history search",
         },
         browser: {
-            model: "qwen/qwen3.5-9b",
+            model: DEFAULT_MODEL,
             tool_tags: ["browser", "vision"],
             max_attempts: 3,
+            description: "browser automation, screenshots",
         },
         vision: {
-            model: "qwen/qwen3.5-9b",
+            model: DEFAULT_MODEL,
             tool_tags: ["browser", "vision", "file"],
             max_attempts: 2,
+            description: "browser + file reading for visual tasks",
         },
     },
     contextWindow: 32768,
@@ -47,6 +60,9 @@ export const DEFAULTS = {
         responseReserve: 0.15,
         compactionThreshold: 0.75,
     },
+    instructions: {
+        summarize: true,
+    },
     modelLoad: {
         autoLoad: false,
         flashAttention: true,
@@ -62,7 +78,7 @@ export const DEFAULTS = {
     maxToolIterations: 1000,
     stuckThreshold: 6,
     autoPlan: true,
-    showReasoning: false,
+    showReasoning: true,
     logLevel: "info",
     locale: "en",
     session: {
@@ -98,10 +114,9 @@ export const DEFAULTS = {
     },
     ui: {
         spinner: true,
-        toolStyle: "inline",
-        toolComments: true,
         showContextStats: false,
         showCompaction: true,
+        verbose: false,
     },
     mcpServers: {
         context7: {
@@ -124,6 +139,11 @@ export const DEFAULTS = {
     skills: {
         budget: 0.15,
     },
+    hallucination: {
+        judge: {
+            enabled: false,
+        },
+    },
     subagent: {
         resultMode: "text",
         maxSummaryChars: 2000,
@@ -134,8 +154,14 @@ export const DEFAULTS = {
     lsp: DEFAULT_LSP_CONFIG,
     updater: {
         enabled: true,
-        checkOnStart: true,
-        autoInstall: true,
+        checkOnStart: false,
+        autoInstall: false,
         intervalMs: 0,
     },
+    reasoning: {
+        mode: "auto",
+        min: "low",
+        max: "high",
+        overrideCooldown: 5,
+    },
 };

package/dist/config/domains.js

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from "fs";
 import { join } from "path";
+import { t } from "../i18n/index";
+import { deepMerge, regexReplacer, regexReviver } from "./utils";
+import { defaultOutputBus } from "../output";
 /**
  * Mapping: domain name → AppConfig keys that belong to it.
  * Each domain becomes one JSON file in ~/.mma/config/<domain>.json.
@@ -10,6 +13,7 @@ export const CONFIG_DOMAINS = {
         "model",
         "contextWindow",
         "contextBudget",
+        "instructions",
         "modelLoad",
         "maxToolIterations",
         "stuckThreshold",
@@ -17,6 +21,8 @@ export const CONFIG_DOMAINS = {
         "showReasoning",
         "logLevel",
         "locale",
+        "reasoning",
+        "hallucination",
     ],
     provider: ["provider", "orchestrator", "retry", "pricing"],
     moe: ["moe", "experts"],
@@ -31,55 +37,6 @@ export const CONFIG_DOMAINS = {
     skills: ["skills"],
     updater: ["updater"],
 };
-/**
- * JSON replacer that serializes RegExp objects as {__regex, source, flags}
- * so they survive JSON.stringify/parse round-trips.
- */
-function regexReplacer(_key, value) {
-    if (value instanceof RegExp) {
-        return { __regex: true, source: value.source, flags: value.flags };
-    }
-    return value;
-}
-/**
- * JSON reviver that restores RegExp objects serialized by regexReplacer.
- */
-function regexReviver(_key, value) {
-    if (value &&
-        typeof value === "object" &&
-        value.__regex === true) {
-        const { source, flags } = value;
-        try {
-            return new RegExp(source, flags);
-        }
-        catch {
-            return value;
-        }
-    }
-    return value;
-}
-/**
- * Deep merge two objects. Arrays and scalars in source replace target.
- */
-function deepMerge(target, source) {
-    const result = { ...target };
-    for (const key of Object.keys(source)) {
-        const srcVal = source[key];
-        const tgtVal = target[key];
-        if (srcVal !== null &&
-            srcVal !== undefined &&
-            typeof srcVal === "object" &&
-            !Array.isArray(srcVal) &&
-            typeof tgtVal === "object" &&
-            !Array.isArray(tgtVal)) {
-            result[key] = deepMerge(tgtVal, srcVal);
-        }
-        else if (srcVal !== undefined) {
-            result[key] = srcVal;
-        }
-    }
-    return result;
-}
 /**
  * Extract a domain subset from a full AppConfig.
  */
@@ -138,7 +95,9 @@ export function loadDomainFiles(configDir) {
             anyLoaded = true;
         }
         catch {
-            // Skip malformed domain files
+            // Never silent: surface the offending path instead of silently ignoring
+            // a domain the user believes is active.
+            defaultOutputBus.log("warn", "config", t("config.parse_failed", { path: filePath }));
         }
     }
     return anyLoaded ? result : null;

package/dist/config/utils.js

@@ -0,0 +1,56 @@
+// src/config/utils.ts
+// Shared deep-merge + RegExp-safe JSON helpers. Previously duplicated across
+// config.ts and domains.ts, where the two copies had drifted (config.ts
+// assigned RegExp by reference; domains.ts spread it into {} and destroyed it).
+export function isPlainObject(v) {
+    if (typeof v !== "object" || v === null)
+        return false;
+    const proto = Object.getPrototypeOf(v);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Deep merge two objects. Arrays, scalars, and non-plain values (RegExp, Date)
+ * in source replace target by reference — spreading a RegExp would silently
+ * destroy it to {}.
+ */
+export function deepMerge(target, source) {
+    const result = { ...target };
+    for (const key of Object.keys(source)) {
+        const srcVal = source[key];
+        const tgtVal = target[key];
+        if (isPlainObject(srcVal) && isPlainObject(tgtVal)) {
+            result[key] = deepMerge(tgtVal, srcVal);
+        }
+        else if (srcVal !== undefined) {
+            result[key] = srcVal;
+        }
+    }
+    return result;
+}
+/**
+ * JSON replacer that serializes RegExp objects as {__regex, source, flags}
+ * so they survive JSON.stringify/parse round-trips.
+ */
+export function regexReplacer(_key, value) {
+    if (value instanceof RegExp) {
+        return { __regex: true, source: value.source, flags: value.flags };
+    }
+    return value;
+}
+/**
+ * JSON reviver that restores RegExp objects serialized by regexReplacer.
+ */
+export function regexReviver(_key, value) {
+    if (value &&
+        typeof value === "object" &&
+        value.__regex === true) {
+        const { source, flags } = value;
+        try {
+            return new RegExp(source, flags);
+        }
+        catch {
+            return value;
+        }
+    }
+    return value;
+}

package/dist/core/agent/audit-gate.js

@@ -0,0 +1,49 @@
+import { t } from "../../i18n/index";
+import { MAX_AUDIT_RETRIES } from "./constants";
+/**
+ * Финальный аудит-вентиль: проверяет, что текстовый ответ действительно
+ * выполнил задачу (при активном плане/скрипте), прежде чем принять его.
+ *
+ * Отклонение переспрашивает модель через <system-summary> и взводит
+ * suppressRepetitionRetry — повторный ответ на выполненную задачу
+ * естественно "повторяющийся" и не должен жечь бюджет халлюцинаций.
+ * Исчерпание повторов (MAX_AUDIT_RETRIES или упор в лимит итераций)
+ * переводит цикл в состояние auditFailed → success:false.
+ */
+export class AuditGate {
+    finalAudit;
+    constructor(finalAudit) {
+        this.finalAudit = finalAudit;
+    }
+    /** Возвращает null, если аудит не настроен (ответ принимается безусловно). */
+    async evaluate(deps) {
+        if (!this.finalAudit)
+            return null;
+        const audit = await this.finalAudit();
+        if (!audit || audit.passed)
+            return { action: "pass" };
+        const { state, logger, contextManager } = deps;
+        state.iterAuditRejection = true;
+        logger.warn(`Final audit incomplete: ${audit.summary}`);
+        const steps = audit.pendingSteps.slice(0, 5).join("; ") || "—";
+        contextManager.addMessage({
+            role: "user",
+            content: `<system-summary>${t("exec.audit_incomplete", {
+                summary: audit.summary,
+                steps,
+            })}</system-summary>`,
+        });
+        deps.slog.logAudit(audit.summary, deps.iteration);
+        state.auditRetries++;
+        state.lastAuditSummary = audit.summary;
+        if (state.auditRetries >= MAX_AUDIT_RETRIES || deps.iteration >= deps.maxIterations - 1) {
+            logger.warn(`Final audit still incomplete after ${state.auditRetries} retries — reporting failure`);
+            state.auditFailed = true;
+            return { action: "exhausted", summary: audit.summary };
+        }
+        // Следующий текстовый ответ — принудительный повтор уже выполненной
+        // задачи: разрешаем одну повторность без халлюцинационного повтора.
+        state.suppressRepetitionRetry = true;
+        return { action: "reject" };
+    }
+}