@ch4p/cli 0.1.3 → 0.1.5

package/dist/chunk-3XAW4XHG.js

@@ -0,0 +1,185 @@
+import {
+  loadConfig
+} from "./chunk-AORLXQHZ.js";
+import {
+  BOLD,
+  DIM,
+  GREEN,
+  RED,
+  RESET,
+  TEAL,
+  YELLOW,
+  box
+} from "./chunk-NMGPBPNU.js";
+
+// src/commands/audit.ts
+function severityIcon(severity) {
+  switch (severity) {
+    case "pass":
+      return `${GREEN}PASS${RESET}`;
+    case "warn":
+      return `${YELLOW}WARN${RESET}`;
+    case "fail":
+      return `${RED}FAIL${RESET}`;
+  }
+}
+function severityPrefix(severity) {
+  switch (severity) {
+    case "pass":
+      return `${GREEN}+${RESET}`;
+    case "warn":
+      return `${YELLOW}~${RESET}`;
+    case "fail":
+      return `${RED}x${RESET}`;
+  }
+}
+function performAudit(config) {
+  const results = [];
+  let id = 0;
+  id++;
+  const port = config.gateway?.port ?? 18789;
+  const allowPublic = config.gateway?.allowPublicBind ?? false;
+  results.push({
+    id,
+    name: "Gateway binding",
+    severity: allowPublic ? "fail" : "pass",
+    message: allowPublic ? `Gateway allows public binding (0.0.0.0:${port}). Restrict to loopback.` : `Gateway bound to loopback (127.0.0.1:${port})`
+  });
+  id++;
+  const requirePairing = config.gateway?.requirePairing ?? true;
+  results.push({
+    id,
+    name: "Pairing required",
+    severity: requirePairing ? "pass" : "warn",
+    message: requirePairing ? "Gateway requires pairing for all connections" : "Pairing is disabled. Any local process can connect."
+  });
+  id++;
+  const workspaceOnly = config.security?.workspaceOnly ?? true;
+  results.push({
+    id,
+    name: "Workspace scoping",
+    severity: workspaceOnly ? "pass" : "warn",
+    message: workspaceOnly ? "Filesystem access restricted to workspace" : "Workspace scoping disabled. Agent can access files outside workspace."
+  });
+  id++;
+  const blockedPaths = config.security?.blockedPaths ?? [];
+  results.push({
+    id,
+    name: "Blocked paths",
+    severity: "pass",
+    message: blockedPaths.length > 0 ? `${blockedPaths.length} additional blocked path(s) configured` : "Using default system blocked paths (14 dirs + 4 dotfiles)"
+  });
+  id++;
+  const autonomy = config.autonomy?.level ?? "supervised";
+  results.push({
+    id,
+    name: "Autonomy level",
+    severity: autonomy === "full" ? "warn" : "pass",
+    message: autonomy === "full" ? "Full autonomy enabled. Agent will not ask for confirmation." : `Autonomy level: ${autonomy}`
+  });
+  id++;
+  const allowedCommands = config.autonomy?.allowedCommands ?? [];
+  results.push({
+    id,
+    name: "Command allowlist",
+    severity: allowedCommands.length > 0 ? "pass" : "warn",
+    message: allowedCommands.length > 0 ? `${allowedCommands.length} command(s) in allowlist` : "No command allowlist configured. All commands may be executed."
+  });
+  id++;
+  const encryptSecrets = config.secrets?.encrypt ?? true;
+  results.push({
+    id,
+    name: "Secrets encryption",
+    severity: encryptSecrets ? "pass" : "fail",
+    message: encryptSecrets ? "Secrets are encrypted at rest (AES-256-GCM)" : "Secrets encryption is disabled. Credentials stored in plaintext."
+  });
+  id++;
+  const engineDefault = config.engines?.default ?? "native";
+  const usesSubprocessEngine = engineDefault === "claude-cli" || engineDefault === "codex-cli";
+  const usesOllama = config.agent?.provider === "ollama";
+  if (usesSubprocessEngine) {
+    results.push({
+      id,
+      name: "API keys",
+      severity: "pass",
+      message: `Using ${engineDefault} engine. Auth handled by CLI tool.`
+    });
+  } else if (usesOllama) {
+    results.push({
+      id,
+      name: "API keys",
+      severity: "pass",
+      message: "Using Ollama provider. No API key required (local inference)."
+    });
+  } else {
+    const anthropicKey = config.providers?.["anthropic"]?.["apiKey"];
+    const openaiKey = config.providers?.["openai"]?.["apiKey"];
+    const hasAnthropicKey = typeof anthropicKey === "string" && anthropicKey.length > 0 && !anthropicKey.includes("${");
+    const hasOpenaiKey = typeof openaiKey === "string" && openaiKey.length > 0 && !openaiKey.includes("${");
+    const hasAnyKey = hasAnthropicKey || hasOpenaiKey;
+    results.push({
+      id,
+      name: "API keys",
+      severity: hasAnyKey ? "pass" : "warn",
+      message: hasAnyKey ? `API key(s) configured: ${[hasAnthropicKey && "Anthropic", hasOpenaiKey && "OpenAI"].filter(Boolean).join(", ")}` : "No API keys configured. Set keys via onboard or environment variables."
+    });
+  }
+  id++;
+  const tunnelProvider = config.tunnel?.provider ?? "none";
+  results.push({
+    id,
+    name: "Tunnel exposure",
+    severity: tunnelProvider === "none" ? "pass" : "warn",
+    message: tunnelProvider === "none" ? "No tunnel configured. Gateway is local only." : `Tunnel active via ${tunnelProvider}. Gateway is exposed to the internet.`
+  });
+  id++;
+  const observers = config.observability?.observers ?? [];
+  results.push({
+    id,
+    name: "Observability",
+    severity: observers.length > 0 ? "pass" : "warn",
+    message: observers.length > 0 ? `Observer(s) active: ${observers.join(", ")}` : "No observers configured. Security events may go unlogged."
+  });
+  return results;
+}
+function runAudit(config) {
+  const results = performAudit(config);
+  const lines = [];
+  for (const r of results) {
+    const padId = String(r.id).padStart(2, " ");
+    lines.push(`${severityPrefix(r.severity)} ${DIM}${padId}.${RESET} ${r.message}`);
+  }
+  const passed = results.filter((r) => r.severity === "pass").length;
+  const warned = results.filter((r) => r.severity === "warn").length;
+  const failed = results.filter((r) => r.severity === "fail").length;
+  lines.push("");
+  lines.push(
+    `${severityIcon("pass")} ${passed}  ${severityIcon("warn")} ${warned}  ${severityIcon("fail")} ${failed}  ${DIM}(${results.length} checks)${RESET}`
+  );
+  if (failed > 0) {
+    lines.push("");
+    lines.push(`${RED}${BOLD}Action required:${RESET} ${failed} check(s) failed. Review your config.`);
+  }
+  console.log(box("ch4p Security Audit", lines));
+}
+async function audit() {
+  try {
+    const config = loadConfig();
+    console.log("");
+    runAudit(config);
+    console.log("");
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`
+  ${RED}Failed to load config:${RESET} ${message}`);
+    console.error(`  ${DIM}Run ${TEAL}ch4p onboard${DIM} to create a config file.${RESET}
+`);
+    process.exitCode = 1;
+  }
+}
+
+export {
+  performAudit,
+  runAudit,
+  audit
+};