micro-models-agent 0.8.0 → 0.9.0

package/dist/modules/security/audit-log.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, appendFileSync } from "fs";
 import { resolve } from "path";
 import { homedir } from "os";
+import { globalAuditNotifier } from "./audit-notifier";
 /**
  * Directory and file path for audit logs
  */
@@ -27,6 +28,13 @@ export function logAudit(entry) {
         // Silently fail if we can't write to audit log
         // This shouldn't break the agent
     }
+    // Notify audit notifier if enabled
+    try {
+        globalAuditNotifier.notify(entry);
+    }
+    catch {
+        // Silently fail if notification fails
+    }
 }
 /**
  * Log a tool call

package/dist/modules/security/command-validator.js

@@ -1,10 +1,23 @@
+import { DEFAULT_SECURITY_CONFIG } from "../../config/security";
+// Fallback in case DEFAULT_SECURITY_CONFIG is not available
+const FALLBACK_BASH_CONFIG = {
+    blacklist: ['rm', 'dd', 'chmod', 'wget', 'curl', 'scp', 'ssh', 'nc', 'netcat'],
+    whitelist: [],
+    blockDangerousFlags: true,
+    dangerousFlags: ['--force', '-rf', '--no-preserve-root'],
+    dangerousOperators: ['>', '>>', '2>', '2>>', '|', '&&', '||', ';', '&', '`'],
+    logCommands: true,
+};
+export const DEFAULT_BASH_CONFIG = DEFAULT_SECURITY_CONFIG?.bash || FALLBACK_BASH_CONFIG;
 /**
  * Check if a command is allowed based on security configuration
  */
 export function isCommandAllowed(command, securityConfig) {
     // If no security config, allow everything (backward compatibility)
-    if (!securityConfig) {
-        return { allowed: true, sanitizedCommand: command };
+    let config = securityConfig || DEFAULT_BASH_CONFIG;
+    // Ensure config has all required fields
+    if (!config.blacklist || !Array.isArray(config.blacklist)) {
+        config = FALLBACK_BASH_CONFIG;
     }
     const trimmedCommand = command.trim();
     if (!trimmedCommand) {
@@ -13,8 +26,8 @@ export function isCommandAllowed(command, securityConfig) {
     // Extract base command (first word)
     const baseCommand = trimmedCommand.split(/\s+/)[0];
     // Check whitelist first (if non-empty, only whitelisted commands are allowed)
-    if (securityConfig.whitelist.length > 0) {
-        if (!securityConfig.whitelist.includes(baseCommand)) {
+    if (config.whitelist.length > 0) {
+        if (!config.whitelist.includes(baseCommand)) {
             return {
                 allowed: false,
                 reason: `Command "${baseCommand}" is not in the whitelist`,
@@ -22,15 +35,15 @@ export function isCommandAllowed(command, securityConfig) {
         }
     }
     // Check blacklist
-    if (securityConfig.blacklist.includes(baseCommand)) {
+    if (config.blacklist.includes(baseCommand)) {
         return {
             allowed: false,
             reason: `Command "${baseCommand}" is blacklisted`,
         };
     }
     // Check for dangerous operators
-    if (securityConfig.blockDangerousFlags) {
-        for (const op of securityConfig.dangerousOperators || []) {
+    if (config.blockDangerousFlags) {
+        for (const op of config.dangerousOperators || []) {
             if (command.includes(op)) {
                 return {
                     allowed: false,
@@ -40,8 +53,8 @@ export function isCommandAllowed(command, securityConfig) {
         }
     }
     // Check for dangerous flags
-    if (securityConfig.blockDangerousFlags) {
-        for (const flag of securityConfig.dangerousFlags || []) {
+    if (config.blockDangerousFlags) {
+        for (const flag of config.dangerousFlags || []) {
             // Check for flag as whole word or with equals
             const flagPattern = new RegExp(`(?:^|\\s)${flag}(?:\\s|$|=)`);
             if (flagPattern.test(command)) {

package/dist/modules/security/encryption.js

@@ -166,7 +166,17 @@ export function encryptSensitiveFields(obj, key) {
             result[fieldName] = encryptString(value, key);
         }
         else if (typeof value === 'object' && value !== null) {
-            result[fieldName] = encryptSensitiveFields(value, key);
+            if (Array.isArray(value)) {
+                result[fieldName] = value.map(item => typeof item === 'object' && item !== null && !(item instanceof RegExp)
+                    ? encryptSensitiveFields(item, key)
+                    : item);
+            }
+            else if (value instanceof RegExp) {
+                result[fieldName] = value;
+            }
+            else {
+                result[fieldName] = encryptSensitiveFields(value, key);
+            }
         }
         else {
             result[fieldName] = value;
@@ -190,7 +200,17 @@ export function decryptSensitiveFields(obj, key) {
             }
         }
         else if (typeof value === 'object' && value !== null) {
-            result[fieldName] = decryptSensitiveFields(value, key);
+            if (Array.isArray(value)) {
+                result[fieldName] = value.map(item => typeof item === 'object' && item !== null && !(item instanceof RegExp)
+                    ? decryptSensitiveFields(item, key)
+                    : item);
+            }
+            else if (value instanceof RegExp) {
+                result[fieldName] = value;
+            }
+            else {
+                result[fieldName] = decryptSensitiveFields(value, key);
+            }
         }
         else {
             result[fieldName] = value;

package/dist/tools/bash.js

@@ -3,6 +3,7 @@ import { platform } from 'os';
 import { isCommandAllowed, sanitizeCommandForLog } from '../modules/security/command-validator';
 import { logBashCommand, logSecurityBlock } from '../modules/security/audit-log';
 import { getSessionSecurityConfig } from '../modules/security/session-isolation';
+import { DEFAULT_SECURITY_CONFIG } from '../config/security';
 function adaptCommandForWindows(command) {
     if (platform() !== 'win32')
         return command;
@@ -32,10 +33,12 @@ export const bashTool = {
         const originalCommand = String(args.command);
         const command = adaptCommandForWindows(originalCommand);
         const workdir = args.workdir ? String(args.workdir) : ctx.baseDir;
-        // Get session-specific security config
-        const securityConfig = ctx.sessionContext
-            ? getSessionSecurityConfig(ctx.config, ctx.sessionContext).bash
-            : ctx.config.security?.bash;
+        // Get session-specific security config with defaults
+        const appConfig = ctx.config || {};
+        const fullSecurityConfig = ctx.sessionContext
+            ? getSessionSecurityConfig(appConfig, ctx.sessionContext)
+            : appConfig.security || DEFAULT_SECURITY_CONFIG;
+        const securityConfig = fullSecurityConfig.bash || DEFAULT_SECURITY_CONFIG.bash;
         const validation = isCommandAllowed(command, securityConfig);
         if (!validation.allowed) {
             // Log security block

package/dist/tools/grep-tool.js

@@ -1,8 +1,7 @@
-import { execSync } from 'child_process';
+import { execFileSync, execSync } from 'child_process';
 import { resolve } from 'path';
 import { t } from '../i18n/index';
-import { isCommandAllowed, sanitizeCommandForLog } from '../modules/security/command-validator';
-import { logSecurityBlock } from '../modules/security/audit-log';
+import { logBashCommand } from '../modules/security/audit-log';
 export const grepTool = {
     name: 'grep',
     description: 'Search file contents using a regular expression. Uses ripgrep (rg) if available, otherwise falls back to grep -r.',
@@ -19,23 +18,16 @@ export const grepTool = {
     handler: async (ctx, args) => {
         const pattern = String(args.pattern);
         const searchPath = args.path ? resolve(ctx.baseDir, String(args.path)) : ctx.baseDir;
-        // Build grep command
-        let cmd = `rg -n "${pattern.replace(/"/g, '\\"')}" "${searchPath}"`;
+        // Build rg arguments as an array to avoid shell interpretation of regex
+        // metacharacters like |, (, ) — these are regex patterns, not shell operators.
+        const rgArgs = ['-n', '--with-filename', pattern, searchPath];
         if (args.include) {
-            cmd += ` -g "${String(args.include)}"`;
-        }
-        // Security check: validate command (grep/rg should be allowed)
-        const securityConfig = ctx.config.security?.bash;
-        const validation = isCommandAllowed(cmd, securityConfig);
-        if (!validation.allowed) {
-            logSecurityBlock(ctx.sessionId, "bash_command", validation.reason || "Command blocked by security policy", sanitizeCommandForLog(cmd));
-            return {
-                success: false,
-                output: `[SECURITY BLOCKED] Command is not allowed: ${validation.reason}`,
-            };
+            rgArgs.push('-g', String(args.include));
         }
+        // Log the search (sanitized) for audit purposes
+        logBashCommand(ctx.sessionId, `rg ${rgArgs.join(' ')}`, false, 'grep-tool');
         try {
-            const output = execSync(cmd, {
+            const output = execFileSync('rg', rgArgs, {
                 encoding: 'utf-8',
                 maxBuffer: 1024 * 1024,
                 cwd: ctx.baseDir,
@@ -45,7 +37,21 @@ export const grepTool = {
         catch (e) {
             if (e.status === 1)
                 return { success: true, output: t('file.no_matches') };
-            return { success: false, output: t('error.grep_failed', { message: e.message }) };
+            // Fall back to plain grep -r when rg is not available or fails
+            try {
+                const cmd = `grep -rn "${pattern.replace(/"/g, '\\"')}" "${searchPath}"`;
+                const output = execSync(cmd, {
+                    encoding: 'utf-8',
+                    maxBuffer: 1024 * 1024,
+                    cwd: ctx.baseDir,
+                });
+                return { success: true, output: output || t('file.no_matches') };
+            }
+            catch (e2) {
+                if (e2.status === 1)
+                    return { success: true, output: t('file.no_matches') };
+                return { success: false, output: t('error.grep_failed', { message: e2.message }) };
+            }
         }
     },
 };

package/dist/tools/pipeline-run.js

@@ -1,7 +1,56 @@
 import { t } from '../i18n/index';
 import { PipelineEngine } from '../modules/pipelines/engine';
 import { PipelineParser } from '../modules/pipelines/parser';
+import { TemplateEngine } from '../modules/pipelines/template';
+import { Agent } from '../core/agent';
+import { ContextManager } from '../modules/context/manager';
+import { PluginManager } from '../modules/plugins/manager';
+import { HallucinationDetector } from '../modules/hallucination/detector';
+import { logSecurityBlock } from '../modules/security/audit-log';
+import { getSessionSecurityConfig } from '../modules/security/session-isolation';
 const engine = new PipelineEngine();
+const MAX_CONCURRENT = 3;
+const MAX_ATTEMPTS = 3;
+async function runStep(ctx, step, params, outputs) {
+    const prompt = TemplateEngine.render(step.prompt, params, outputs);
+    let lastError = "";
+    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+        try {
+            const subContextManager = new ContextManager(ctx.config.contextWindow, ctx.config.contextBudget);
+            const subPluginManager = new PluginManager();
+            const systemPrompt = {
+                content: `You are a pipeline step agent ("${step.agent}"). Complete the given task using the available tools.`,
+                priority: "critical",
+                essential: true,
+                estimatedTokens: 80,
+            };
+            const subDeps = {
+                config: ctx.config,
+                llmProvider: ctx.llmProvider,
+                toolExecutor: ctx.toolExecutor,
+                pluginManager: subPluginManager,
+                contextManager: subContextManager,
+                hallucinationDetector: new HallucinationDetector(),
+                logger: ctx.logger,
+                baseDir: ctx.baseDir,
+                scope: ctx.scope,
+                recursionDepth: (ctx.recursionDepth ?? 0) + 1,
+                promptBlocks: [systemPrompt],
+            };
+            const subAgent = new Agent(subDeps);
+            const result = await subAgent.run(prompt);
+            if (result.success) {
+                return { ok: true, output: result.text };
+            }
+            lastError = result.error || "no output";
+        }
+        catch (e) {
+            lastError = e.message;
+        }
+        await new Promise((r) => setTimeout(r, 500 * attempt));
+    }
+    return { ok: false, output: "", error: lastError };
+}
 export const pipelineRunTool = {
     name: 'pipeline_run',
     description: 'Run a named pipeline with YAML definition. Creates a DAG of sub-agents that execute in dependency order.',
@@ -11,26 +60,82 @@ export const pipelineRunTool = {
         properties: {
             name: { type: 'string', description: 'Pipeline name' },
             yaml: { type: 'string', description: 'Pipeline YAML definition with steps' },
+            params: { type: 'object', description: 'Template params for {key} placeholders' },
         },
         required: ['name', 'yaml'],
     },
-    handler: async (_ctx, args) => {
+    handler: async (ctx, args) => {
         const name = String(args.name || '');
         const yaml = String(args.yaml || '');
+        const params = args.params || {};
         if (!yaml) {
             return { success: false, output: t('pipeline.invalid') };
         }
+        if (!ctx.llmProvider || !ctx.toolExecutor) {
+            return {
+                success: false,
+                output: 'Pipeline cannot run: missing llmProvider or toolExecutor in context',
+            };
+        }
+        const securityConfig = ctx.sessionContext
+            ? getSessionSecurityConfig(ctx.config, ctx.sessionContext)
+            : ctx.config.security;
+        const maxDepth = securityConfig?.maxRecursionDepth ?? 3;
+        const currentDepth = ctx.recursionDepth ?? 0;
+        if (currentDepth >= maxDepth) {
+            logSecurityBlock(ctx.sessionId, "bash_command", `Maximum recursion depth (${maxDepth}) exceeded`, name);
+            return {
+                success: false,
+                output: `[SECURITY BLOCKED] Maximum pipeline recursion depth (${maxDepth}) exceeded`,
+            };
+        }
         try {
             const pipeline = PipelineParser.parse(yaml);
+            engine.reset();
             const order = engine.resolveDependencies(pipeline.steps);
-            const readySteps = engine.getReadySteps(pipeline.steps, new Set());
-            const summary = [
-                `Pipeline "${pipeline.name}" parsed successfully.`,
-                `Steps: ${pipeline.steps.length}`,
-                `Execution order: ${order.join(' → ')}`,
-                `Ready to run: ${readySteps.map(s => s.id).join(', ') || '(none)'}`,
-            ].join('\n');
-            return { success: true, output: summary };
+            const completed = new Set();
+            const outputs = {};
+            const logs = [];
+            const failed = new Set();
+            while (completed.size < pipeline.steps.length) {
+                const ready = engine
+                    .getReadySteps(pipeline.steps, completed)
+                    .filter((s) => !failed.has(s.id));
+                if (ready.length === 0) {
+                    if (failed.size > 0)
+                        break;
+                    throw new Error(t('pipeline.circular', { stepId: order.join(', ') }));
+                }
+                const batch = ready.slice(0, MAX_CONCURRENT);
+                const results = await Promise.all(batch.map((step) => runStep(ctx, step, params, outputs)));
+                for (let i = 0; i < batch.length; i++) {
+                    const step = batch[i];
+                    const result = results[i];
+                    if (result.ok) {
+                        completed.add(step.id);
+                        outputs[step.id] = { output: result.output };
+                        engine.setStepStatus(step.id, 'done');
+                        logs.push(`  ✓ ${step.id}: ${result.output.split("\n")[0]}`);
+                    }
+                    else {
+                        failed.add(step.id);
+                        engine.setStepStatus(step.id, 'failed');
+                        logs.push(`  ✗ ${step.id}: ${result.error}`);
+                    }
+                }
+                if (failed.size > 0)
+                    break;
+            }
+            if (failed.size > 0) {
+                return {
+                    success: false,
+                    output: `Pipeline "${pipeline.name}" failed. Executed ${completed.size}/${pipeline.steps.length} steps.\n${logs.join("\n")}`,
+                };
+            }
+            return {
+                success: true,
+                output: `Pipeline "${pipeline.name}" completed successfully (${completed.size} steps).\n${logs.join("\n")}`,
+            };
         }
         catch (e) {
             return { success: false, output: `Pipeline error: ${e.message}` };

package/dist/tools/read-file.js

@@ -2,6 +2,8 @@ import { readFileSync, existsSync } from "fs";
 import { resolve, normalize, extname } from "path";
 import { t } from "../i18n/index";
 import { isPathInScope } from "../modules/security/path-validator";
+import { DEFAULT_SECURITY_CONFIG } from "../config/security";
+import { logSecurityBlock } from "../modules/security/audit-log";
 /** Default number of lines returned when the caller omits `limit`. */
 const DEFAULT_LIMIT = 300;
 export const readFileTool = {
@@ -25,8 +27,11 @@ export const readFileTool = {
     },
     handler: async (ctx, args) => {
         const path = String(args.path);
-        const scopeCheck = isPathInScope(ctx.baseDir, path, ctx.scope, ctx.config.security?.paths);
+        const securityPaths = ctx.config?.security?.paths || DEFAULT_SECURITY_CONFIG.paths;
+        const scopeCheck = isPathInScope(ctx.baseDir, path, ctx.scope, securityPaths);
         if (!scopeCheck.allowed) {
+            const pathStr = path;
+            logSecurityBlock(ctx.sessionId || undefined, "file_read", scopeCheck.reason || "Path not allowed", pathStr);
             return {
                 success: false,
                 output: t("file.path_not_allowed", {

package/dist/tools/subagent.js

@@ -83,6 +83,18 @@ export const subagentTool = {
                 output: "Sub-agent cannot run: missing llmProvider or toolExecutor in context",
             };
         }
+        // Defensive guard: if the caller requested specific tool tags but none of the
+        // registered tools match, the sub-agent would have zero tools and would
+        // hallucinate instead of acting. Warn the caller so it can correct the tags.
+        if (toolTags && toolTags.length > 0) {
+            const matched = ctx.toolExecutor.getToolDefinitions(toolTags);
+            if (matched.length === 0) {
+                return {
+                    success: false,
+                    output: `[SECURITY BLOCKED] No tools match the requested tool_tags: [${toolTags.join(", ")}]. Check the subagent tool_tags parameter and retry with valid tags (e.g. "file", "code", "shell", "research").`,
+                };
+            }
+        }
         try {
             const subContextManager = new ContextManager(ctx.config.contextWindow, ctx.config.contextBudget);
             const subPluginManager = new PluginManager();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "micro-models-agent",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)",
   "type": "module",
   "bin": {