micro-models-agent 2.11.0 → 2.12.0

package/dist/config/env.js

@@ -0,0 +1,46 @@
+/**
+ * Единый реестр env-переменных `MMA_*`.
+ *
+ * Все обращения к окружению идут через `MMA_ENV`/`readEnv`, а не строковыми
+ * литералами по коду: переименование правится в одном месте.
+ */
+/** Реестр имя→имя переменной окружения (константный). */
+export const MMA_ENV = {
+    CONFIG_DIR: "MMA_CONFIG_DIR",
+    MODEL: "MMA_MODEL",
+    PROVIDER_TYPE: "MMA_PROVIDER_TYPE",
+    PROVIDER_BASEURL: "MMA_PROVIDER_BASEURL",
+    PROVIDER_APIKEY: "MMA_PROVIDER_APIKEY",
+    LOG_LEVEL: "MMA_LOG_LEVEL",
+    LOCALE: "MMA_LOCALE",
+    CONTEXT_WINDOW: "MMA_CONTEXT_WINDOW",
+    MAX_TOOL_ITERATIONS: "MMA_MAX_TOOL_ITERATIONS",
+    STUCK_THRESHOLD: "MMA_STUCK_THRESHOLD",
+    AUTO_PLAN: "MMA_AUTO_PLAN",
+    MOE_ENABLED: "MMA_MOE_ENABLED",
+    CONTEXT_LOG: "MMA_CONTEXT_LOG",
+    POST_SETUP: "MMA_POST_SETUP",
+    START_MEET: "MMA_START_MEET",
+    START_INIT: "MMA_START_INIT",
+    WEBUI_PORT: "MMA_WEBUI_PORT",
+    WEBUI_HOST: "MMA_WEBUI_HOST",
+    WEBUI_TOKEN: "MMA_WEBUI_TOKEN",
+    WEBUI_OPEN: "MMA_WEBUI_OPEN",
+    WEBUI_MAX_CLIENTS: "MMA_WEBUI_MAX_CLIENTS",
+    DSR: "MMA_DSR",
+    MODELS_DEV_CACHE: "MMA_MODELS_DEV_CACHE",
+    REASONING_CACHE: "MMA_REASONING_CACHE",
+    CERT_HOME: "MMA_CERT_HOME",
+    BROWSER_EXECUTABLE: "MMA_BROWSER_EXECUTABLE",
+    BROWSER_CHANNEL: "MMA_BROWSER_CHANNEL",
+};
+/**
+ * Читает переменную окружения в момент вызова (без кеширования): код и тесты
+ * меняют/удаляют переменные в рантайме, значение обязано быть свежим.
+ *
+ * @param key семантическое имя из `MMA_ENV`;
+ * @param env источник окружения (по умолчанию `process.env`).
+ */
+export function readEnv(key, env = process.env) {
+    return env[MMA_ENV[key]];
+}

package/dist/config/experts.js

@@ -1,6 +1,8 @@
+/** Конфиг эксперта по тегу. Нет такого — undefined. */
 export function getExpertConfig(config, tag) {
     return config.experts?.[tag];
 }
+/** Проверяет tool_tags всех экспертов против известных тегов. Возвращает список ошибок. */
 export function validateExpertConfig(config, allToolTags) {
     const errors = [];
     const knownTags = new Set(allToolTags);

package/dist/config/index.js

@@ -1,3 +1,4 @@
+// Фасад конфига: дефолты, загрузка/сохранение, домены, типы, эксперты.
 export { DEFAULTS } from "./defaults";
 export { loadConfig, saveConfig, validateConfig, CONFIG_DIR, CONFIG_FILE, CONFIG_DOMAIN_DIR } from "./config";
 export { getExpertConfig, validateExpertConfig } from "./experts";

package/dist/config/paths.js

@@ -0,0 +1,56 @@
+/**
+ * Канонические пути MMA на диске.
+ *
+ * Централизует имя каталога `.mma` и формы глобальных/проектных путей: смена
+ * (переименование, env-оверрайд) правится в одном месте, а не в ~50 литералах
+ * `join(…, ".mma", …)`.
+ *
+ * Слоистость: модуль импортит только `node:os`/`node:path`, его может импортить
+ * любой слой без циклов.
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { MMA_ENV } from "./env";
+/** Имя каталога данных агента (глобальный `~/.mma`, проектный `<ws>/.mma`). */
+export const MMA_DIR_NAME = ".mma";
+/** Имя legacy-файла глобального конфига (`~/.mma/config.json`). */
+export const MMA_CONFIG_FILE_NAME = "config.json";
+/**
+ * Глобальный каталог данных. Уважает `MMA_CONFIG_DIR` (тот же оверрайд, что у
+ * `loadConfig` и bootstrap), иначе `~/.mma`.
+ */
+export function globalMmaDir(env = process.env) {
+    return env[MMA_ENV.CONFIG_DIR] || join(homedir(), MMA_DIR_NAME);
+}
+/** Проектный каталог данных (`<baseDir>/.mma`). */
+export function projectMmaDir(baseDir) {
+    return join(baseDir, MMA_DIR_NAME);
+}
+/** Legacy-файл глобального конфига (`<global>/.mma/config.json`). */
+export function globalConfigFile(env = process.env) {
+    return join(globalMmaDir(env), MMA_CONFIG_FILE_NAME);
+}
+/** Глобальный каталог памяти (`<global>/.mma/memory`). */
+export function globalMemoryDir(env = process.env) {
+    return join(globalMmaDir(env), "memory");
+}
+/** Глобальный каталог сессий (`<global>/.mma/sessions`). */
+export function globalSessionsDir(env = process.env) {
+    return join(globalMmaDir(env), "sessions");
+}
+/** Глобальный каталог логов (`<global>/.mma/logs`). */
+export function globalLogsDir(env = process.env) {
+    return join(globalMmaDir(env), "logs");
+}
+/** Каталог экспорта по умолчанию (`<global>/.mma/exports`). */
+export function globalExportsDir(env = process.env) {
+    return join(globalMmaDir(env), "exports");
+}
+/** Глобальный каталог плагинов (`<global>/.mma/plugins`). */
+export function globalPluginsDir(env = process.env) {
+    return join(globalMmaDir(env), "plugins");
+}
+/** Файл аудит-лога в каталоге данных (`<dir>/audit.jsonl`). */
+export function auditLogFile(dir) {
+    return join(dir, "audit.jsonl");
+}

package/dist/config/redact.js

@@ -0,0 +1,44 @@
+// Маскирование секретов для показа конфига (`mma config show`).
+/** Ключи, чьи строковые значения — секреты и маскируются при показе. */
+const SECRET_KEYS = new Set([
+    "apiKey",
+    "api_key",
+    "apikey",
+    "token",
+    "tokens",
+    "secret",
+    "password",
+    "authorization",
+    "webhookUrl",
+]);
+/** Объектные ключи, где чувствительно КАЖДОЕ значение (карты headers/env). */
+const SECRET_MAPS = new Set(["headers", "env"]);
+const MASK = "***";
+function walk(value, parentKey, depth = 0) {
+    if (depth > 100)
+        return value;
+    if (typeof value === "string") {
+        return parentKey && SECRET_KEYS.has(parentKey) ? MASK : value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((v) => walk(v, parentKey, depth + 1));
+    }
+    if (value && typeof value === "object" && !(value instanceof RegExp)) {
+        if (parentKey && SECRET_MAPS.has(parentKey)) {
+            const masked = {};
+            for (const k of Object.keys(value))
+                masked[k] = MASK;
+            return masked;
+        }
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = walk(v, k, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
+/** Возвращает глубокую копию `config` с секретами, заменёнными на `***`. */
+export function redactConfigSecrets(config) {
+    return walk(config);
+}

package/dist/config/registry-extra.js

@@ -0,0 +1,334 @@
+import { DEFAULTS } from "./defaults";
+import { DEFAULT_SECURITY_CONFIG } from "./security";
+const REASONING_BOUNDS = ["low", "medium", "high"];
+/** Фабрика bool-дефа. */
+function bool(key, domain, reconfigure, get, set) {
+    return { key, aliases: [], domain, valueType: "bool", reconfigure, get, set };
+}
+/** Фабрика int-дефа с min/max/step. */
+function int(key, domain, min, max, step, reconfigure, get, set) {
+    return { key, aliases: [], domain, valueType: "int", min, max, step, reconfigure, get, set };
+}
+/** Фабрика share-дефа (доля 0.05–0.9). */
+function share(key, domain, reconfigure, get, set) {
+    return { key, aliases: [], domain, valueType: "share", min: 0.05, max: 0.9, step: 0.01, reconfigure, get, set };
+}
+/** Фабрика enum-дефа. */
+function enumOf(key, domain, values, reconfigure, get, set) {
+    return { key, aliases: [], domain, valueType: "enum", enumValues: values, reconfigure, get, set };
+}
+/** Фабрика list-дефа (без reconfigure, опц. редактор). */
+function list(key, domain, get, set, editor) {
+    return { key, aliases: [], domain, valueType: "list", reconfigure: false, editor, get, set };
+}
+/** Фабрика string-дефа. */
+function str(key, domain, get, set) {
+    return { key, aliases: [], domain, valueType: "string", reconfigure: false, get, set };
+}
+/** Опциональная строка: get отдаёт "" при неустановленной, set чистит в undefined на пустой. */
+function strOpt(key, domain, get, set) {
+    return str(key, domain, get, set);
+}
+/** Фабрика json-дефа с опц. валидацией и редактором. */
+function json(key, domain, get, set, extraValidate, editor) {
+    return {
+        key,
+        aliases: [],
+        domain,
+        valueType: "json",
+        reconfigure: false,
+        editor,
+        get,
+        set,
+        extraValidate,
+    };
+}
+/** JSON-деф с предикатом формы; всё, не прошедшее проверку, — "invalid". */
+function jsonShape(key, domain, get, set, check, editor) {
+    const extraValidate = (_c, v) => check(v) ? null : "invalid";
+    return json(key, domain, get, set, extraValidate, editor);
+}
+/** Лениво создаёт опциональное гнездо security и возвращает его. */
+function sec(c) {
+    c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+    return c.security;
+}
+/** Проверка на запись (объект-не-массив). */
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Проверка на неотрицательное число. */
+function isNonNegNum(v) {
+    return typeof v === "number" && Number.isFinite(v) && v >= 0;
+}
+const AUDIT_EVENT_TYPES = [
+    "security_block",
+    "bash_command",
+    "file_operation",
+    "network_request",
+    "tool_call",
+    "authentication",
+    "configuration_change",
+    "session_start",
+    "session_end",
+];
+/** Доп. дефы реестра; мержится в DEFINITIONS конкатом (см. registry.ts). */
+export const EXTRA_DEFS = [
+    bool("provider.fallback", "provider", false, (c) => c.provider.fallback ?? false, (c, v) => { c.provider.fallback = v; }),
+    int("provider.maxCompletionTokens", "provider", 512, 128000, 1024, true, (c) => c.provider.maxCompletionTokens ?? 8192, (c, v) => { c.provider.maxCompletionTokens = v; }),
+    share("contextBudget.compactionThreshold", "budget", false, (c) => c.contextBudget.compactionThreshold, (c, v) => { c.contextBudget.compactionThreshold = v; }),
+    share("contextBudget.compactionMinLoad", "budget", false, (c) => c.contextBudget.compactionMinLoad ?? DEFAULTS.contextBudget.compactionMinLoad, (c, v) => { c.contextBudget.compactionMinLoad = v; }),
+    bool("instructions.summarize", "budget", true, (c) => c.instructions?.summarize ?? DEFAULTS.instructions.summarize, (c, v) => {
+        c.instructions ??= structuredClone(DEFAULTS.instructions);
+        c.instructions.summarize = v;
+    }),
+    bool("contextLog.enabled", "budget", false, (c) => c.contextLog?.enabled ?? DEFAULTS.contextLog.enabled, (c, v) => {
+        c.contextLog ??= structuredClone(DEFAULTS.contextLog);
+        c.contextLog.enabled = v;
+    }),
+    bool("contextLog.redact", "budget", false, (c) => c.contextLog?.redact ?? DEFAULTS.contextLog.redact, (c, v) => {
+        c.contextLog ??= structuredClone(DEFAULTS.contextLog);
+        c.contextLog.redact = v;
+    }),
+    enumOf("reasoning.min", "reasoning", REASONING_BOUNDS, true, (c) => c.reasoning?.min ?? DEFAULTS.reasoning.min, (c, v) => {
+        c.reasoning ??= structuredClone(DEFAULTS.reasoning);
+        c.reasoning.min = v;
+    }),
+    enumOf("reasoning.max", "reasoning", REASONING_BOUNDS, true, (c) => c.reasoning?.max ?? DEFAULTS.reasoning.max, (c, v) => {
+        c.reasoning ??= structuredClone(DEFAULTS.reasoning);
+        c.reasoning.max = v;
+    }),
+    enumOf("reasoning.baseline", "reasoning", REASONING_BOUNDS, true, (c) => c.reasoning?.baseline ?? DEFAULTS.reasoning.baseline, (c, v) => {
+        c.reasoning ??= structuredClone(DEFAULTS.reasoning);
+        c.reasoning.baseline = v;
+    }),
+    int("reasoning.overrideCooldown", "reasoning", 1, 60, 1, true, (c) => c.reasoning?.overrideCooldown ?? DEFAULTS.reasoning.overrideCooldown, (c, v) => {
+        c.reasoning ??= structuredClone(DEFAULTS.reasoning);
+        c.reasoning.overrideCooldown = v;
+    }),
+    bool("autoPlan", "agent", true, (c) => c.autoPlan, (c, v) => { c.autoPlan = v; }),
+    bool("tools.enableOnDemand", "agent", true, (c) => c.tools.enableOnDemand, (c, v) => { c.tools.enableOnDemand = v; }),
+    bool("session.autoSave", "session", false, (c) => c.session?.autoSave ?? DEFAULTS.session.autoSave, (c, v) => {
+        c.session ??= structuredClone(DEFAULTS.session);
+        c.session.autoSave = v;
+    }),
+    int("session.maxSessions", "session", 1, 500, 1, false, (c) => c.session?.maxSessions ?? DEFAULTS.session.maxSessions, (c, v) => {
+        c.session ??= structuredClone(DEFAULTS.session);
+        c.session.maxSessions = v;
+    }),
+    bool("session.isolateMemory", "session", false, (c) => c.session?.isolateMemory ?? DEFAULTS.session.isolateMemory, (c, v) => {
+        c.session ??= structuredClone(DEFAULTS.session);
+        c.session.isolateMemory = v;
+    }),
+    bool("session.autoName", "session", false, (c) => c.session?.autoName ?? DEFAULTS.session.autoName, (c, v) => {
+        c.session ??= structuredClone(DEFAULTS.session);
+        c.session.autoName = v;
+    }),
+    bool("sessionIsolation.enabled", "session", false, (c) => c.sessionIsolation?.enabled ?? DEFAULTS.sessionIsolation.enabled, (c, v) => {
+        c.sessionIsolation ??= structuredClone(DEFAULTS.sessionIsolation);
+        c.sessionIsolation.enabled = v;
+    }),
+    bool("sessionIsolation.isolatePlugins", "session", false, (c) => c.sessionIsolation?.isolatePlugins ?? DEFAULTS.sessionIsolation.isolatePlugins, (c, v) => {
+        c.sessionIsolation ??= structuredClone(DEFAULTS.sessionIsolation);
+        c.sessionIsolation.isolatePlugins = v;
+    }),
+    bool("sessionIsolation.isolateTempFiles", "session", false, (c) => c.sessionIsolation?.isolateTempFiles ?? DEFAULTS.sessionIsolation.isolateTempFiles, (c, v) => {
+        c.sessionIsolation ??= structuredClone(DEFAULTS.sessionIsolation);
+        c.sessionIsolation.isolateTempFiles = v;
+    }),
+    bool("ui.spinner", "ui", false, (c) => c.ui.spinner, (c, v) => { c.ui.spinner = v; }),
+    enumOf("ui.activityRail", "ui", ["off", "line", "meta", "full"], false, (c) => c.ui.activityRail ?? "line", (c, v) => { c.ui.activityRail = v; }),
+    bool("ui.showContextStats", "ui", false, (c) => c.ui.showContextStats, (c, v) => { c.ui.showContextStats = v; }),
+    bool("ui.showCompaction", "ui", false, (c) => c.ui.showCompaction, (c, v) => { c.ui.showCompaction = v; }),
+    enumOf("ui.fontSize", "ui", ["compact", "comfortable", "large"], false, (c) => c.ui.fontSize ?? "comfortable", (c, v) => { c.ui.fontSize = v; }),
+    int("retry.maxRetries", "agent", 0, 10, 1, false, (c) => c.retry.maxRetries, (c, v) => { c.retry.maxRetries = v; }),
+    int("retry.baseDelay", "agent", 0, 60000, 100, false, (c) => c.retry.baseDelay, (c, v) => { c.retry.baseDelay = v; }),
+    int("retry.maxDelay", "agent", 0, 300000, 1000, false, (c) => c.retry.maxDelay, (c, v) => { c.retry.maxDelay = v; }),
+    int("retry.maxStreamRetries", "agent", 0, 10, 1, false, (c) => c.retry.maxStreamRetries ?? DEFAULTS.retry.maxStreamRetries, (c, v) => { c.retry.maxStreamRetries = v; }),
+    int("retry.noDataTimeoutMs", "agent", 1000, 600000, 1000, false, (c) => c.retry.noDataTimeoutMs ?? DEFAULTS.retry.noDataTimeoutMs, (c, v) => { c.retry.noDataTimeoutMs = v; }),
+    bool("pricing.enabled", "pricing", false, (c) => c.pricing?.enabled ?? DEFAULTS.pricing.enabled, (c, v) => {
+        c.pricing ??= structuredClone(DEFAULTS.pricing);
+        c.pricing.enabled = v;
+    }),
+    bool("updater.enabled", "updater", false, (c) => c.updater.enabled, (c, v) => { c.updater.enabled = v; }),
+    bool("updater.checkOnStart", "updater", false, (c) => c.updater.checkOnStart, (c, v) => { c.updater.checkOnStart = v; }),
+    bool("updater.autoInstall", "updater", false, (c) => c.updater.autoInstall, (c, v) => { c.updater.autoInstall = v; }),
+    int("updater.intervalMs", "updater", 0, 86400000, 60000, false, (c) => c.updater.intervalMs, (c, v) => { c.updater.intervalMs = v; }),
+    share("skills.budget", "agent", false, (c) => c.skills.budget, (c, v) => { c.skills.budget = v; }),
+    bool("hallucination.judge.enabled", "agent", true, (c) => c.hallucination?.judge.enabled ?? DEFAULTS.hallucination.judge.enabled, (c, v) => {
+        c.hallucination ??= structuredClone(DEFAULTS.hallucination);
+        c.hallucination.judge.enabled = v;
+    }),
+    enumOf("subagent.resultMode", "agent", ["text", "file"], true, (c) => c.subagent?.resultMode ?? DEFAULTS.subagent.resultMode, (c, v) => {
+        c.subagent ??= structuredClone(DEFAULTS.subagent);
+        c.subagent.resultMode = v;
+    }),
+    int("subagent.maxSummaryChars", "agent", 100, 50000, 100, false, (c) => c.subagent?.maxSummaryChars ?? DEFAULTS.subagent.maxSummaryChars, (c, v) => {
+        c.subagent ??= structuredClone(DEFAULTS.subagent);
+        c.subagent.maxSummaryChars = v;
+    }),
+    int("subagent.maxParallelChunkQueries", "agent", 1, 16, 1, false, (c) => c.subagent?.maxParallelChunkQueries ?? DEFAULTS.subagent.maxParallelChunkQueries, (c, v) => {
+        c.subagent ??= structuredClone(DEFAULTS.subagent);
+        c.subagent.maxParallelChunkQueries = v;
+    }),
+    bool("subagent.stableSystemPrompt", "agent", false, (c) => c.subagent?.stableSystemPrompt ?? DEFAULTS.subagent.stableSystemPrompt, (c, v) => {
+        c.subagent ??= structuredClone(DEFAULTS.subagent);
+        c.subagent.stableSystemPrompt = v;
+    }),
+    bool("modelLoad.autoLoad", "provider", true, (c) => c.modelLoad?.autoLoad ?? DEFAULTS.modelLoad.autoLoad, (c, v) => {
+        c.modelLoad ??= structuredClone(DEFAULTS.modelLoad);
+        c.modelLoad.autoLoad = v;
+    }),
+    bool("modelLoad.flashAttention", "provider", true, (c) => c.modelLoad?.flashAttention ?? DEFAULTS.modelLoad.flashAttention, (c, v) => {
+        c.modelLoad ??= structuredClone(DEFAULTS.modelLoad);
+        c.modelLoad.flashAttention = v;
+    }),
+    bool("modelLoad.offloadKvCacheToGpu", "provider", true, (c) => c.modelLoad?.offloadKvCacheToGpu ?? DEFAULTS.modelLoad.offloadKvCacheToGpu, (c, v) => {
+        c.modelLoad ??= structuredClone(DEFAULTS.modelLoad);
+        c.modelLoad.offloadKvCacheToGpu = v;
+    }),
+    // Дефолта в схеме нет (поле опускается, пока не задано); 512 зеркалит дефолт llama.cpp.
+    int("modelLoad.evalBatchSize", "provider", 1, 4096, 1, true, (c) => c.modelLoad?.evalBatchSize ?? 512, (c, v) => {
+        c.modelLoad ??= structuredClone(DEFAULTS.modelLoad);
+        c.modelLoad.evalBatchSize = v;
+    }),
+    bool("webSearch.enabled", "research", false, (c) => c.webSearch?.enabled ?? DEFAULTS.webSearch.enabled, (c, v) => {
+        c.webSearch ??= structuredClone(DEFAULTS.webSearch);
+        c.webSearch.enabled = v;
+    }),
+    bool("errorWebSearch.enabled", "research", false, (c) => c.errorWebSearch?.enabled ?? DEFAULTS.errorWebSearch.enabled, (c, v) => {
+        c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+        c.errorWebSearch.enabled = v;
+    }),
+    int("errorWebSearch.threshold", "research", 1, 20, 1, false, (c) => c.errorWebSearch?.threshold ?? DEFAULTS.errorWebSearch.threshold, (c, v) => {
+        c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+        c.errorWebSearch.threshold = v;
+    }),
+    int("errorWebSearch.maxResults", "research", 1, 20, 1, false, (c) => c.errorWebSearch?.maxResults ?? DEFAULTS.errorWebSearch.maxResults, (c, v) => {
+        c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+        c.errorWebSearch.maxResults = v;
+    }),
+    int("errorWebSearch.maxQueryChars", "research", 50, 2000, 10, false, (c) => c.errorWebSearch?.maxQueryChars ?? DEFAULTS.errorWebSearch.maxQueryChars, (c, v) => {
+        c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+        c.errorWebSearch.maxQueryChars = v;
+    }),
+    int("errorWebSearch.maxSearchesPerSession", "research", 0, 20, 1, false, (c) => c.errorWebSearch?.maxSearchesPerSession ?? DEFAULTS.errorWebSearch.maxSearchesPerSession, (c, v) => {
+        c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+        c.errorWebSearch.maxSearchesPerSession = v;
+    }),
+    int("errorWebSearch.requestTimeoutMs", "research", 1000, 120000, 1000, false, (c) => c.errorWebSearch?.requestTimeoutMs ?? DEFAULTS.errorWebSearch.requestTimeoutMs, (c, v) => {
+        c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+        c.errorWebSearch.requestTimeoutMs = v;
+    }),
+    bool("browser.enabled", "browser", false, (c) => c.browser.enabled, (c, v) => { c.browser.enabled = v; }),
+    bool("browser.headless", "browser", false, (c) => c.browser.headless, (c, v) => { c.browser.headless = v; }),
+    int("browser.maxElements", "browser", 1, 200, 1, false, (c) => c.browser.maxElements, (c, v) => { c.browser.maxElements = v; }),
+    int("browser.maxContentChars", "browser", 100, 50000, 100, false, (c) => c.browser.maxContentChars, (c, v) => { c.browser.maxContentChars = v; }),
+    int("browser.maxConsoleEntries", "browser", 1, 200, 1, false, (c) => c.browser.maxConsoleEntries, (c, v) => { c.browser.maxConsoleEntries = v; }),
+    int("browser.maxConsoleLineChars", "browser", 50, 5000, 10, false, (c) => c.browser.maxConsoleLineChars, (c, v) => { c.browser.maxConsoleLineChars = v; }),
+    int("browser.viewportWidth", "browser", 320, 4096, 10, false, (c) => c.browser.viewportWidth, (c, v) => { c.browser.viewportWidth = v; }),
+    int("browser.viewportHeight", "browser", 200, 2160, 10, false, (c) => c.browser.viewportHeight, (c, v) => { c.browser.viewportHeight = v; }),
+    int("browser.navigationTimeout", "browser", 1000, 120000, 1000, false, (c) => c.browser.navigationTimeout, (c, v) => { c.browser.navigationTimeout = v; }),
+    int("security.maxRecursionDepth", "security", 0, 20, 1, false, (c) => c.security?.maxRecursionDepth ?? DEFAULT_SECURITY_CONFIG.maxRecursionDepth, (c, v) => {
+        c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+        c.security.maxRecursionDepth = v;
+    }),
+    int("security.maxFileOperations", "security", 0, 10000, 10, false, (c) => c.security?.maxFileOperations ?? DEFAULT_SECURITY_CONFIG.maxFileOperations, (c, v) => {
+        c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+        c.security.maxFileOperations = v;
+    }),
+    int("security.rateLimits.maxRequestsPerMinute", "security", 1, 1000, 1, false, (c) => c.security?.rateLimits.maxRequestsPerMinute ?? DEFAULT_SECURITY_CONFIG.rateLimits.maxRequestsPerMinute, (c, v) => {
+        c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+        c.security.rateLimits.maxRequestsPerMinute = v;
+    }),
+    int("security.rateLimits.maxParallelTasks", "security", 1, 50, 1, false, (c) => c.security?.rateLimits.maxParallelTasks ?? DEFAULT_SECURITY_CONFIG.rateLimits.maxParallelTasks, (c, v) => {
+        c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+        c.security.rateLimits.maxParallelTasks = v;
+    }),
+    list("tools.defaultTags", "tools", (c) => c.tools.defaultTags, (c, v) => { c.tools.defaultTags = v; }, { kind: "tags", placeholder: "file" }),
+    list("security.bash.blacklist", "security", (c) => c.security?.bash.blacklist ?? DEFAULT_SECURITY_CONFIG.bash.blacklist, (c, v) => { sec(c).bash.blacklist = v; }, { kind: "tags", placeholder: "rm" }),
+    list("security.bash.whitelist", "security", (c) => c.security?.bash.whitelist ?? DEFAULT_SECURITY_CONFIG.bash.whitelist, (c, v) => { sec(c).bash.whitelist = v; }, { kind: "tags", placeholder: "bun" }),
+    list("security.bash.dangerousFlags", "security", (c) => c.security?.bash.dangerousFlags ?? DEFAULT_SECURITY_CONFIG.bash.dangerousFlags, (c, v) => { sec(c).bash.dangerousFlags = v; }, { kind: "tags", placeholder: "--force" }),
+    list("security.bash.dangerousOperators", "security", (c) => c.security?.bash.dangerousOperators ?? DEFAULT_SECURITY_CONFIG.bash.dangerousOperators, (c, v) => { sec(c).bash.dangerousOperators = v; }, { kind: "tags", placeholder: "&&" }),
+    list("security.paths.denied", "security", (c) => c.security?.paths.denied ?? DEFAULT_SECURITY_CONFIG.paths.denied, (c, v) => { sec(c).paths.denied = v; }, { kind: "tags", placeholder: ".git/" }),
+    list("security.paths.allowed", "security", (c) => c.security?.paths.allowed ?? DEFAULT_SECURITY_CONFIG.paths.allowed, (c, v) => { sec(c).paths.allowed = v; }, { kind: "tags", placeholder: "src/**" }),
+    list("security.network.deniedDomains", "security", (c) => c.security?.network.deniedDomains ?? DEFAULT_SECURITY_CONFIG.network.deniedDomains, (c, v) => { sec(c).network.deniedDomains = v; }, { kind: "tags", placeholder: "localhost" }),
+    list("security.network.allowedDomains", "security", (c) => c.security?.network.allowedDomains ?? DEFAULT_SECURITY_CONFIG.network.allowedDomains, (c, v) => { sec(c).network.allowedDomains = v; }, { kind: "tags", placeholder: "api.example.com" }),
+    int("security.network.requestTimeout", "security", 1000, 120000, 1000, false, (c) => c.security?.network.requestTimeout ?? DEFAULT_SECURITY_CONFIG.network.requestTimeout, (c, v) => { sec(c).network.requestTimeout = v; }),
+    int("security.network.maxResponseSize", "security", 1024, 1000000, 1024, false, (c) => c.security?.network.maxResponseSize ?? DEFAULT_SECURITY_CONFIG.network.maxResponseSize, (c, v) => { sec(c).network.maxResponseSize = v; }),
+    jsonShape("security.contentScan.dangerousPatterns", "security", (c) => (c.security?.contentScan.dangerousPatterns ?? DEFAULT_SECURITY_CONFIG.contentScan.dangerousPatterns)
+        .map((r) => r.source), (c, v) => { sec(c).contentScan.dangerousPatterns = v.map((s) => new RegExp(s)); }, (v) => Array.isArray(v) && v.every((s) => {
+        if (typeof s !== "string")
+            return false;
+        try {
+            new RegExp(s);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }), { kind: "tags", placeholder: "eval\\(" }),
+    bool("security.auditNotifier.enabled", "security", false, (c) => c.security?.auditNotifier.enabled ?? DEFAULT_SECURITY_CONFIG.auditNotifier.enabled, (c, v) => { sec(c).auditNotifier.enabled = v; }),
+    strOpt("security.auditNotifier.filePath", "security", (c) => c.security?.auditNotifier.filePath ?? "", (c, v) => {
+        const s = String(v).trim();
+        sec(c).auditNotifier.filePath = s.length === 0 ? undefined : s;
+    }),
+    strOpt("security.auditNotifier.webhookUrl", "security", (c) => c.security?.auditNotifier.webhookUrl ?? "", (c, v) => {
+        const s = String(v).trim();
+        sec(c).auditNotifier.webhookUrl = s.length === 0 ? undefined : s;
+    }),
+    int("security.auditNotifier.webhookTimeout", "security", 1000, 60000, 1000, false, (c) => c.security?.auditNotifier.webhookTimeout ?? DEFAULT_SECURITY_CONFIG.auditNotifier.webhookTimeout, (c, v) => { sec(c).auditNotifier.webhookTimeout = v; }),
+    enumOf("security.auditNotifier.minSeverity", "security", ["low", "medium", "high", "critical"], false, (c) => c.security?.auditNotifier.minSeverity ?? DEFAULT_SECURITY_CONFIG.auditNotifier.minSeverity, (c, v) => { sec(c).auditNotifier.minSeverity = v; }),
+    jsonShape("security.auditNotifier.eventTypes", "security", (c) => c.security?.auditNotifier.eventTypes ?? DEFAULT_SECURITY_CONFIG.auditNotifier.eventTypes, (c, v) => { sec(c).auditNotifier.eventTypes = v; }, (v) => Array.isArray(v) && v.every((e) => typeof e === "string" && AUDIT_EVENT_TYPES.includes(e)), 
+    // Пустой массив = все типы событий (см. описание ключа).
+    { kind: "checkboxes", options: AUDIT_EVENT_TYPES }),
+    int("security.auditNotifier.maxRetries", "security", 0, 10, 1, false, (c) => c.security?.auditNotifier.maxRetries ?? DEFAULT_SECURITY_CONFIG.auditNotifier.maxRetries, (c, v) => { sec(c).auditNotifier.maxRetries = v; }),
+    strOpt("security.sessionEncryption.keyPath", "security", (c) => c.security?.sessionEncryption.keyPath ?? "", (c, v) => {
+        const s = String(v).trim();
+        sec(c).sessionEncryption.keyPath = s.length === 0 ? undefined : s;
+    }),
+    bool("security.sessionEncryption.encryptHistory", "security", false, (c) => c.security?.sessionEncryption.encryptHistory ?? DEFAULT_SECURITY_CONFIG.sessionEncryption.encryptHistory, (c, v) => { sec(c).sessionEncryption.encryptHistory = v; }),
+    bool("security.sessionEncryption.encryptSessionLog", "security", false, (c) => c.security?.sessionEncryption.encryptSessionLog ?? DEFAULT_SECURITY_CONFIG.sessionEncryption.encryptSessionLog, (c, v) => { sec(c).sessionEncryption.encryptSessionLog = v; }),
+    jsonShape("pricing.overrides", "pricing", (c) => c.pricing?.overrides ?? {}, (c, v) => {
+        c.pricing ??= structuredClone(DEFAULTS.pricing);
+        c.pricing.overrides = v;
+    }, (v) => isRecord(v) && Object.values(v).every((e) => isRecord(e) &&
+        isNonNegNum(e.input) &&
+        isNonNegNum(e.output) &&
+        (e.cachedInput === undefined || isNonNegNum(e.cachedInput)) &&
+        (e.cacheWrite === undefined || isNonNegNum(e.cacheWrite))), {
+        kind: "table",
+        columns: [
+            { key: "name" },
+            { key: "input", type: "number" },
+            { key: "output", type: "number" },
+            { key: "cachedInput", type: "number", optional: true },
+            { key: "cacheWrite", type: "number", optional: true },
+        ],
+    }),
+    jsonShape("modelCapabilities", "provider", (c) => c.modelCapabilities ?? {}, (c, v) => { c.modelCapabilities = v; }, (v) => isRecord(v) && Object.values(v).every((e) => isRecord(e) &&
+        (e.vision === undefined || typeof e.vision === "boolean") &&
+        (e.tools === undefined || typeof e.tools === "boolean")), {
+        kind: "table",
+        columns: [
+            { key: "name" },
+            { key: "vision", type: "bool", optional: true },
+            { key: "tools", type: "bool", optional: true },
+        ],
+    }),
+    jsonShape("experts", "agent", (c) => c.experts, (c, v) => { c.experts = v; }, (v) => isRecord(v) && Object.values(v).every((e) => isRecord(e) &&
+        typeof e.model === "string" &&
+        Array.isArray(e.tool_tags) &&
+        e.tool_tags.every((t) => typeof t === "string") &&
+        (e.max_attempts === undefined || (typeof e.max_attempts === "number" && Number.isFinite(e.max_attempts))) &&
+        (e.description === undefined || typeof e.description === "string")), {
+        kind: "table",
+        columns: [
+            { key: "name" },
+            { key: "model" },
+            { key: "tool_tags", array: true },
+            { key: "max_attempts", type: "number", optional: true },
+            { key: "description", optional: true },
+        ],
+    }),
+];