micro-models-agent 0.8.0 → 0.9.0

package/dist/config/config.js

@@ -1,11 +1,41 @@
 import { existsSync, readFileSync, unlinkSync, writeFileSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { DEFAULTS } from './defaults';
+import { DEFAULT_SECURITY_CONFIG } from './security';
 import { t } from '../i18n/index';
 import { MigrationDetector } from '../migration/detect';
 import { BackupManager } from '../migration/backup';
 import { validateExpertConfig } from './experts';
 import { ConfigEncryptor } from '../modules/security/encryption';
+/**
+ * Restore RegExp instances in dangerousPatterns that were serialized as {}
+ * (pre-0.8.0 configs) or as {__regex, source, flags} (new format).
+ * Falls back to default patterns for any entry that is not a real RegExp.
+ */
+function restoreDangerousPatterns(patterns, defaults) {
+    const fallback = (Array.isArray(defaults) ? defaults : []);
+    if (!Array.isArray(patterns) || patterns.length === 0) {
+        return fallback;
+    }
+    return patterns.map((p, i) => {
+        if (p instanceof RegExp)
+            return p;
+        // If the pattern was serialized as {__regex, source, flags}, revive it
+        if (p && typeof p === "object") {
+            const { source, flags } = p;
+            if (source && typeof source === "string") {
+                try {
+                    return new RegExp(source, flags || "");
+                }
+                catch {
+                    // fall through
+                }
+            }
+        }
+        // Corrupted entry (e.g. serialized as {} pre-0.8.0): use default by index
+        return fallback[i] || fallback[0] || p;
+    });
+}
 function deepMerge(target, source) {
     const result = { ...target };
     for (const key of Object.keys(source)) {
@@ -22,10 +52,37 @@ function deepMerge(target, source) {
     }
     return result;
 }
+/**
+ * JSON replacer that serializes RegExp objects as {__regex, source, flags}
+ * so they survive JSON.stringify/parse round-trips.
+ */
+function regexReplacer(_key, value) {
+    if (value instanceof RegExp) {
+        return { __regex: true, source: value.source, flags: value.flags };
+    }
+    return value;
+}
+/**
+ * JSON reviver that restores RegExp objects serialized by regexReplacer.
+ */
+function regexReviver(_key, value) {
+    if (value &&
+        typeof value === "object" &&
+        value.__regex === true) {
+        const { source, flags } = value;
+        try {
+            return new RegExp(source, flags);
+        }
+        catch {
+            return value;
+        }
+    }
+    return value;
+}
 function loadJSON(path) {
     try {
         if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, 'utf-8'));
+            return JSON.parse(readFileSync(path, 'utf-8'), regexReviver);
         }
     }
     catch { /* ignore malformed files */ }
@@ -84,6 +141,11 @@ export function loadConfig(options) {
     if (projectData) {
         config = deepMerge(config, projectData);
     }
+    // Restore RegExp patterns in contentScan that may have been serialized
+    // as {} in pre-0.8.0 config files, or merged from user config.
+    if (config.security?.contentScan?.dangerousPatterns) {
+        config.security.contentScan.dangerousPatterns = restoreDangerousPatterns(config.security.contentScan.dangerousPatterns, DEFAULT_SECURITY_CONFIG.contentScan.dangerousPatterns);
+    }
     config = applyEnvVars(config);
     // Decrypt sensitive fields in the loaded config
     try {
@@ -98,6 +160,7 @@ export function loadConfig(options) {
         // If decryption fails, log a warning but continue with the config
         console.warn(t('config.decryption_warning', { error: e.message }));
     }
+    // Update global audit notifier with config (done in bootstrap.ts)
     return config;
 }
 export function validateConfig(config, allToolTags) {
@@ -113,11 +176,11 @@ export function saveConfig(config, configPath) {
     try {
         const encryptor = new ConfigEncryptor();
         const encryptedConfig = encryptor.encrypt({ ...config });
-        writeFileSync(configPath, JSON.stringify(encryptedConfig, null, 2), 'utf-8');
+        writeFileSync(configPath, JSON.stringify(encryptedConfig, regexReplacer, 2), 'utf-8');
     }
     catch (e) {
         // If encryption fails, save without encryption
         console.warn(t('config.encryption_warning', { error: e.message }));
-        writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
+        writeFileSync(configPath, JSON.stringify(config, regexReplacer, 2), 'utf-8');
     }
 }

package/dist/config/security.js

@@ -90,7 +90,7 @@ export const DEFAULT_SECURITY_CONFIG = {
     },
     network: {
         // Domains that are always denied
-        deniedDomains: [],
+        deniedDomains: ["localhost", "127.0.0.1", "::1"],
         // If allowedDomains is non-empty, only these domains are allowed
         allowedDomains: [],
         // Timeout for network requests (ms)

package/dist/core/bootstrap.js

@@ -64,6 +64,16 @@ export async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplet
         : join(process.cwd(), ".mmrc");
     const config = loadConfig({ configDir: dir, projectConfigPath });
     setLocale(config.locale);
+    // Update global audit notifier with config
+    try {
+        const { globalAuditNotifier } = await import("../modules/security/audit-notifier");
+        if (config.security?.auditNotifier) {
+            globalAuditNotifier.updateConfig(config.security.auditNotifier);
+        }
+    }
+    catch {
+        // Ignore if audit notifier is not available
+    }
     const logger = new Logger(config.logLevel);
     logger.setLogDir(join(dir, "logs"));
     logger.debug("MMA bootstrap", {