@getaegis/cli 0.8.0 → 0.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (210) hide show
  1. package/README.md +5 -0
  2. package/dist/agent/agent.d.ts +98 -0
  3. package/dist/agent/agent.d.ts.map +1 -0
  4. package/dist/agent/agent.js +212 -0
  5. package/dist/agent/agent.js.map +1 -0
  6. package/dist/agent/index.d.ts +3 -0
  7. package/dist/agent/index.d.ts.map +1 -0
  8. package/dist/agent/index.js +2 -0
  9. package/dist/agent/index.js.map +1 -0
  10. package/dist/cli/auth.d.ts +19 -0
  11. package/dist/cli/auth.d.ts.map +1 -0
  12. package/dist/cli/auth.js +44 -0
  13. package/dist/cli/auth.js.map +1 -0
  14. package/dist/cli/commands/agent.d.ts +6 -0
  15. package/dist/cli/commands/agent.d.ts.map +1 -0
  16. package/dist/cli/commands/agent.js +241 -0
  17. package/dist/cli/commands/agent.js.map +1 -0
  18. package/dist/cli/commands/config.d.ts +6 -0
  19. package/dist/cli/commands/config.d.ts.map +1 -0
  20. package/dist/cli/commands/config.js +125 -0
  21. package/dist/cli/commands/config.js.map +1 -0
  22. package/dist/cli/commands/dashboard.d.ts +6 -0
  23. package/dist/cli/commands/dashboard.d.ts.map +1 -0
  24. package/dist/cli/commands/dashboard.js +189 -0
  25. package/dist/cli/commands/dashboard.js.map +1 -0
  26. package/dist/cli/commands/doctor.d.ts +6 -0
  27. package/dist/cli/commands/doctor.d.ts.map +1 -0
  28. package/dist/cli/commands/doctor.js +39 -0
  29. package/dist/cli/commands/doctor.js.map +1 -0
  30. package/dist/cli/commands/gate.d.ts +6 -0
  31. package/dist/cli/commands/gate.d.ts.map +1 -0
  32. package/dist/cli/commands/gate.js +196 -0
  33. package/dist/cli/commands/gate.js.map +1 -0
  34. package/dist/cli/commands/init.d.ts +6 -0
  35. package/dist/cli/commands/init.d.ts.map +1 -0
  36. package/dist/cli/commands/init.js +109 -0
  37. package/dist/cli/commands/init.js.map +1 -0
  38. package/dist/cli/commands/ledger.d.ts +6 -0
  39. package/dist/cli/commands/ledger.d.ts.map +1 -0
  40. package/dist/cli/commands/ledger.js +140 -0
  41. package/dist/cli/commands/ledger.js.map +1 -0
  42. package/dist/cli/commands/mcp.d.ts +6 -0
  43. package/dist/cli/commands/mcp.d.ts.map +1 -0
  44. package/dist/cli/commands/mcp.js +224 -0
  45. package/dist/cli/commands/mcp.js.map +1 -0
  46. package/dist/cli/commands/policy.d.ts +6 -0
  47. package/dist/cli/commands/policy.d.ts.map +1 -0
  48. package/dist/cli/commands/policy.js +126 -0
  49. package/dist/cli/commands/policy.js.map +1 -0
  50. package/dist/cli/commands/user.d.ts +6 -0
  51. package/dist/cli/commands/user.d.ts.map +1 -0
  52. package/dist/cli/commands/user.js +150 -0
  53. package/dist/cli/commands/user.js.map +1 -0
  54. package/dist/cli/commands/vault-manager.d.ts +6 -0
  55. package/dist/cli/commands/vault-manager.d.ts.map +1 -0
  56. package/dist/cli/commands/vault-manager.js +240 -0
  57. package/dist/cli/commands/vault-manager.js.map +1 -0
  58. package/dist/cli/commands/vault.d.ts +6 -0
  59. package/dist/cli/commands/vault.d.ts.map +1 -0
  60. package/dist/cli/commands/vault.js +241 -0
  61. package/dist/cli/commands/vault.js.map +1 -0
  62. package/dist/cli/commands/webhook.d.ts +6 -0
  63. package/dist/cli/commands/webhook.d.ts.map +1 -0
  64. package/dist/cli/commands/webhook.js +151 -0
  65. package/dist/cli/commands/webhook.js.map +1 -0
  66. package/dist/cli/helpers.d.ts +12 -0
  67. package/dist/cli/helpers.d.ts.map +1 -0
  68. package/dist/cli/helpers.js +61 -0
  69. package/dist/cli/helpers.js.map +1 -0
  70. package/dist/cli/index.d.ts +17 -0
  71. package/dist/cli/index.d.ts.map +1 -0
  72. package/dist/cli/index.js +17 -0
  73. package/dist/cli/index.js.map +1 -0
  74. package/dist/cli/validation.d.ts +37 -0
  75. package/dist/cli/validation.d.ts.map +1 -0
  76. package/dist/cli/validation.js +104 -0
  77. package/dist/cli/validation.js.map +1 -0
  78. package/dist/cli.d.ts +3 -0
  79. package/dist/cli.d.ts.map +1 -0
  80. package/dist/cli.js +30 -0
  81. package/dist/cli.js.map +1 -0
  82. package/dist/config.d.ts +108 -0
  83. package/dist/config.d.ts.map +1 -0
  84. package/dist/config.js +355 -0
  85. package/dist/config.js.map +1 -0
  86. package/dist/dashboard/dashboard-server.d.ts +95 -0
  87. package/dist/dashboard/dashboard-server.d.ts.map +1 -0
  88. package/dist/dashboard/dashboard-server.js +329 -0
  89. package/dist/dashboard/dashboard-server.js.map +1 -0
  90. package/dist/dashboard/index.d.ts +3 -0
  91. package/dist/dashboard/index.d.ts.map +1 -0
  92. package/dist/dashboard/index.js +2 -0
  93. package/dist/dashboard/index.js.map +1 -0
  94. package/dist/dashboard/public/assets/index-CpMruPNh.css +1 -0
  95. package/dist/dashboard/public/assets/index-DkHiw9_f.js +148 -0
  96. package/dist/dashboard/public/favicon.svg +6 -0
  97. package/dist/dashboard/public/index.html +14 -0
  98. package/dist/db.d.ts +15 -0
  99. package/dist/db.d.ts.map +1 -0
  100. package/dist/db.js +190 -0
  101. package/dist/db.js.map +1 -0
  102. package/dist/doctor.d.ts +37 -0
  103. package/dist/doctor.d.ts.map +1 -0
  104. package/dist/doctor.js +196 -0
  105. package/dist/doctor.js.map +1 -0
  106. package/dist/gate/body-inspector.d.ts +31 -0
  107. package/dist/gate/body-inspector.d.ts.map +1 -0
  108. package/dist/gate/body-inspector.js +193 -0
  109. package/dist/gate/body-inspector.js.map +1 -0
  110. package/dist/gate/gate.d.ts +168 -0
  111. package/dist/gate/gate.d.ts.map +1 -0
  112. package/dist/gate/gate.js +1016 -0
  113. package/dist/gate/gate.js.map +1 -0
  114. package/dist/gate/index.d.ts +7 -0
  115. package/dist/gate/index.d.ts.map +1 -0
  116. package/dist/gate/index.js +4 -0
  117. package/dist/gate/index.js.map +1 -0
  118. package/dist/gate/rate-limiter.d.ts +59 -0
  119. package/dist/gate/rate-limiter.d.ts.map +1 -0
  120. package/dist/gate/rate-limiter.js +120 -0
  121. package/dist/gate/rate-limiter.js.map +1 -0
  122. package/dist/index.d.ts +26 -0
  123. package/dist/index.d.ts.map +1 -0
  124. package/dist/index.js +16 -0
  125. package/dist/index.js.map +1 -0
  126. package/dist/ledger/index.d.ts +3 -0
  127. package/dist/ledger/index.d.ts.map +1 -0
  128. package/dist/ledger/index.js +2 -0
  129. package/dist/ledger/index.js.map +1 -0
  130. package/dist/ledger/ledger.d.ts +98 -0
  131. package/dist/ledger/ledger.d.ts.map +1 -0
  132. package/dist/ledger/ledger.js +145 -0
  133. package/dist/ledger/ledger.js.map +1 -0
  134. package/dist/logger/index.d.ts +3 -0
  135. package/dist/logger/index.d.ts.map +1 -0
  136. package/dist/logger/index.js +2 -0
  137. package/dist/logger/index.js.map +1 -0
  138. package/dist/logger/logger.d.ts +58 -0
  139. package/dist/logger/logger.d.ts.map +1 -0
  140. package/dist/logger/logger.js +201 -0
  141. package/dist/logger/logger.js.map +1 -0
  142. package/dist/mcp/index.d.ts +3 -0
  143. package/dist/mcp/index.d.ts.map +1 -0
  144. package/dist/mcp/index.js +2 -0
  145. package/dist/mcp/index.js.map +1 -0
  146. package/dist/mcp/mcp-server.d.ts +130 -0
  147. package/dist/mcp/mcp-server.d.ts.map +1 -0
  148. package/dist/mcp/mcp-server.js +775 -0
  149. package/dist/mcp/mcp-server.js.map +1 -0
  150. package/dist/metrics/index.d.ts +3 -0
  151. package/dist/metrics/index.d.ts.map +1 -0
  152. package/dist/metrics/index.js +2 -0
  153. package/dist/metrics/index.js.map +1 -0
  154. package/dist/metrics/metrics.d.ts +88 -0
  155. package/dist/metrics/metrics.d.ts.map +1 -0
  156. package/dist/metrics/metrics.js +179 -0
  157. package/dist/metrics/metrics.js.map +1 -0
  158. package/dist/policy/index.d.ts +3 -0
  159. package/dist/policy/index.d.ts.map +1 -0
  160. package/dist/policy/index.js +2 -0
  161. package/dist/policy/index.js.map +1 -0
  162. package/dist/policy/policy.d.ts +119 -0
  163. package/dist/policy/policy.d.ts.map +1 -0
  164. package/dist/policy/policy.js +426 -0
  165. package/dist/policy/policy.js.map +1 -0
  166. package/dist/user/index.d.ts +3 -0
  167. package/dist/user/index.d.ts.map +1 -0
  168. package/dist/user/index.js +2 -0
  169. package/dist/user/index.js.map +1 -0
  170. package/dist/user/user.d.ts +102 -0
  171. package/dist/user/user.d.ts.map +1 -0
  172. package/dist/user/user.js +216 -0
  173. package/dist/user/user.js.map +1 -0
  174. package/dist/vault/crypto.d.ts +28 -0
  175. package/dist/vault/crypto.d.ts.map +1 -0
  176. package/dist/vault/crypto.js +44 -0
  177. package/dist/vault/crypto.js.map +1 -0
  178. package/dist/vault/index.d.ts +10 -0
  179. package/dist/vault/index.d.ts.map +1 -0
  180. package/dist/vault/index.js +6 -0
  181. package/dist/vault/index.js.map +1 -0
  182. package/dist/vault/seal.d.ts +68 -0
  183. package/dist/vault/seal.d.ts.map +1 -0
  184. package/dist/vault/seal.js +110 -0
  185. package/dist/vault/seal.js.map +1 -0
  186. package/dist/vault/shamir.d.ts +33 -0
  187. package/dist/vault/shamir.d.ts.map +1 -0
  188. package/dist/vault/shamir.js +174 -0
  189. package/dist/vault/shamir.js.map +1 -0
  190. package/dist/vault/vault-manager.d.ts +62 -0
  191. package/dist/vault/vault-manager.d.ts.map +1 -0
  192. package/dist/vault/vault-manager.js +141 -0
  193. package/dist/vault/vault-manager.js.map +1 -0
  194. package/dist/vault/vault.d.ts +104 -0
  195. package/dist/vault/vault.d.ts.map +1 -0
  196. package/dist/vault/vault.js +259 -0
  197. package/dist/vault/vault.js.map +1 -0
  198. package/dist/version.d.ts +3 -0
  199. package/dist/version.d.ts.map +1 -0
  200. package/dist/version.js +18 -0
  201. package/dist/version.js.map +1 -0
  202. package/dist/webhook/index.d.ts +3 -0
  203. package/dist/webhook/index.d.ts.map +1 -0
  204. package/dist/webhook/index.js +2 -0
  205. package/dist/webhook/index.js.map +1 -0
  206. package/dist/webhook/webhook.d.ts +114 -0
  207. package/dist/webhook/webhook.d.ts.map +1 -0
  208. package/dist/webhook/webhook.js +269 -0
  209. package/dist/webhook/webhook.js.map +1 -0
  210. package/package.json +7 -3
package/dist/dashboard/public/favicon.svg ADDED
@@ -0,0 +1,6 @@
1
+ <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none">
2
+ <circle cx="32" cy="32" r="30" stroke="#C8973E" stroke-width="2.5"/>
3
+ <circle cx="32" cy="32" r="23" stroke="#C8973E" stroke-width="1.5"/>
4
+ <circle cx="32" cy="32" r="10" stroke="#C8973E" stroke-width="2"/>
5
+ <circle cx="32" cy="32" r="3" fill="#C8973E"/>
6
+ </svg>
package/dist/dashboard/public/index.html ADDED
@@ -0,0 +1,14 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
+ <title>Aegis Dashboard</title>
7
+ <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
8
+ <script type="module" crossorigin src="/assets/index-DkHiw9_f.js"></script>
9
+ <link rel="stylesheet" crossorigin href="/assets/index-CpMruPNh.css">
10
+ </head>
11
+ <body class="bg-surface-0 text-primary antialiased">
12
+ <div id="root"></div>
13
+ </body>
14
+ </html>
package/dist/db.d.ts ADDED
@@ -0,0 +1,15 @@
1
+ import Database from 'better-sqlite3';
2
+ import type { AegisConfig } from './config.js';
3
+ /**
4
+ * Open the SQLite database for the active vault.
5
+ * Uses VaultManager to resolve vault name → database path.
6
+ * Falls back to `.aegis/aegis.db` only if no vaults exist (pre-init state).
7
+ */
8
+ export declare function getDb(config: AegisConfig): Database.Database;
9
+ /**
10
+ * Get the salt for the active vault.
11
+ * Returns the vault-specific salt from the registry, or the env salt for fallback.
12
+ */
13
+ export declare function getVaultSalt(config: AegisConfig): string;
14
+ export declare function migrate(db: Database.Database): void;
15
+ //# sourceMappingURL=db.d.ts.map
package/dist/db.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAEA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC,QAAQ,CA+B5D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAIxD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAgJnD"}
package/dist/db.js ADDED
@@ -0,0 +1,190 @@
1
+ import * as fs from 'node:fs';
2
+ import * as path from 'node:path';
3
+ import Database from 'better-sqlite3';
4
+ import { VaultManager } from './vault/vault-manager.js';
5
+ /**
6
+ * Open the SQLite database for the active vault.
7
+ * Uses VaultManager to resolve vault name → database path.
8
+ * Falls back to `.aegis/aegis.db` only if no vaults exist (pre-init state).
9
+ */
10
+ export function getDb(config) {
11
+ const manager = new VaultManager(config.dataDir);
12
+ const info = manager.getVaultInfo(config.vaultName);
13
+ let dbPath;
14
+ if (info) {
15
+ dbPath = path.join(config.dataDir, info.dbPath);
16
+ }
17
+ else {
18
+ // Fallback for commands that run before vault creation (e.g. doctor, init)
19
+ dbPath = path.join(config.dataDir, 'aegis.db');
20
+ }
21
+ const dir = path.dirname(dbPath);
22
+ if (!fs.existsSync(dir)) {
23
+ fs.mkdirSync(dir, { recursive: true });
24
+ }
25
+ try {
26
+ const db = new Database(dbPath);
27
+ db.pragma('journal_mode = WAL');
28
+ return db;
29
+ }
30
+ catch (err) {
31
+ const sqliteErr = err;
32
+ if (sqliteErr.code === 'SQLITE_NOTADB') {
33
+ throw new Error(`Database file is corrupted or not a valid SQLite database: ${dbPath}\n` +
34
+ ` Back up the file and reinitialize with: aegis init`);
35
+ }
36
+ throw err;
37
+ }
38
+ }
39
+ /**
40
+ * Get the salt for the active vault.
41
+ * Returns the vault-specific salt from the registry, or the env salt for fallback.
42
+ */
43
+ export function getVaultSalt(config) {
44
+ const manager = new VaultManager(config.dataDir);
45
+ const info = manager.getVaultInfo(config.vaultName);
46
+ return info ? info.salt : config.salt;
47
+ }
48
+ export function migrate(db) {
49
+ db.exec(`
50
+ CREATE TABLE IF NOT EXISTS credentials (
51
+ id TEXT PRIMARY KEY,
52
+ name TEXT NOT NULL UNIQUE,
53
+ service TEXT NOT NULL,
54
+ encrypted BLOB NOT NULL,
55
+ iv BLOB NOT NULL,
56
+ auth_tag BLOB NOT NULL,
57
+ auth_type TEXT NOT NULL DEFAULT 'bearer',
58
+ header_name TEXT,
59
+ domains TEXT NOT NULL,
60
+ scopes TEXT NOT NULL DEFAULT '*',
61
+ expires_at TEXT,
62
+ rate_limit TEXT,
63
+ body_inspection TEXT NOT NULL DEFAULT 'block',
64
+ created_at TEXT NOT NULL DEFAULT (datetime('now')),
65
+ updated_at TEXT NOT NULL DEFAULT (datetime('now'))
66
+ );
67
+
68
+ CREATE TABLE IF NOT EXISTS credential_history (
69
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
70
+ credential_id TEXT NOT NULL,
71
+ encrypted BLOB NOT NULL,
72
+ iv BLOB NOT NULL,
73
+ auth_tag BLOB NOT NULL,
74
+ rotated_at TEXT NOT NULL DEFAULT (datetime('now')),
75
+ grace_expires TEXT,
76
+ FOREIGN KEY (credential_id) REFERENCES credentials(id) ON DELETE CASCADE
77
+ );
78
+
79
+ CREATE TABLE IF NOT EXISTS audit_log (
80
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
81
+ timestamp TEXT NOT NULL DEFAULT (datetime('now')),
82
+ credential_id TEXT,
83
+ credential_name TEXT,
84
+ service TEXT NOT NULL,
85
+ target_domain TEXT NOT NULL,
86
+ method TEXT NOT NULL,
87
+ path TEXT NOT NULL,
88
+ status TEXT NOT NULL DEFAULT 'allowed',
89
+ blocked_reason TEXT,
90
+ response_code INTEGER,
91
+ channel TEXT NOT NULL DEFAULT 'gate'
92
+ );
93
+
94
+ CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON audit_log(timestamp);
95
+ CREATE INDEX IF NOT EXISTS idx_audit_credential ON audit_log(credential_id);
96
+ CREATE INDEX IF NOT EXISTS idx_audit_service ON audit_log(service);
97
+ CREATE INDEX IF NOT EXISTS idx_history_credential ON credential_history(credential_id);
98
+
99
+ CREATE TABLE IF NOT EXISTS agents (
100
+ id TEXT PRIMARY KEY,
101
+ name TEXT NOT NULL UNIQUE,
102
+ token_hash TEXT NOT NULL,
103
+ token_prefix TEXT NOT NULL,
104
+ rate_limit TEXT,
105
+ created_at TEXT NOT NULL DEFAULT (datetime('now')),
106
+ updated_at TEXT NOT NULL DEFAULT (datetime('now'))
107
+ );
108
+
109
+ CREATE TABLE IF NOT EXISTS agent_credentials (
110
+ agent_id TEXT NOT NULL,
111
+ credential_id TEXT NOT NULL,
112
+ granted_at TEXT NOT NULL DEFAULT (datetime('now')),
113
+ PRIMARY KEY (agent_id, credential_id),
114
+ FOREIGN KEY (agent_id) REFERENCES agents(id) ON DELETE CASCADE,
115
+ FOREIGN KEY (credential_id) REFERENCES credentials(id) ON DELETE CASCADE
116
+ );
117
+
118
+ CREATE INDEX IF NOT EXISTS idx_agents_token_hash ON agents(token_hash);
119
+ CREATE INDEX IF NOT EXISTS idx_agent_creds_agent ON agent_credentials(agent_id);
120
+ CREATE INDEX IF NOT EXISTS idx_agent_creds_cred ON agent_credentials(credential_id);
121
+
122
+ CREATE TABLE IF NOT EXISTS webhooks (
123
+ id TEXT PRIMARY KEY,
124
+ url TEXT NOT NULL,
125
+ events TEXT NOT NULL,
126
+ label TEXT,
127
+ secret TEXT NOT NULL,
128
+ created_at TEXT NOT NULL DEFAULT (datetime('now'))
129
+ );
130
+
131
+ CREATE TABLE IF NOT EXISTS users (
132
+ id TEXT PRIMARY KEY,
133
+ name TEXT NOT NULL UNIQUE,
134
+ role TEXT NOT NULL DEFAULT 'viewer',
135
+ token_hash TEXT NOT NULL,
136
+ token_prefix TEXT NOT NULL,
137
+ created_at TEXT NOT NULL DEFAULT (datetime('now')),
138
+ updated_at TEXT NOT NULL DEFAULT (datetime('now'))
139
+ );
140
+
141
+ CREATE INDEX IF NOT EXISTS idx_users_token_hash ON users(token_hash);
142
+ `);
143
+ // Migration: add expires_at column if not present (for pre-v0.2 databases)
144
+ const cols = db.prepare('PRAGMA table_info(credentials)').all();
145
+ const colNames = cols.map((c) => c.name);
146
+ if (!colNames.includes('expires_at')) {
147
+ db.exec('ALTER TABLE credentials ADD COLUMN expires_at TEXT');
148
+ }
149
+ if (!colNames.includes('rate_limit')) {
150
+ db.exec('ALTER TABLE credentials ADD COLUMN rate_limit TEXT');
151
+ }
152
+ if (!colNames.includes('body_inspection')) {
153
+ db.exec("ALTER TABLE credentials ADD COLUMN body_inspection TEXT NOT NULL DEFAULT 'block'");
154
+ }
155
+ // Migration: add agent identity columns to audit_log (for pre-v0.3 databases)
156
+ const auditCols = db.prepare('PRAGMA table_info(audit_log)').all();
157
+ const auditColNames = auditCols.map((c) => c.name);
158
+ if (!auditColNames.includes('agent_name')) {
159
+ db.exec('ALTER TABLE audit_log ADD COLUMN agent_name TEXT');
160
+ }
161
+ if (!auditColNames.includes('agent_token_prefix')) {
162
+ db.exec('ALTER TABLE audit_log ADD COLUMN agent_token_prefix TEXT');
163
+ }
164
+ if (!auditColNames.includes('channel')) {
165
+ db.exec("ALTER TABLE audit_log ADD COLUMN channel TEXT NOT NULL DEFAULT 'gate'");
166
+ }
167
+ // Migration: drop encrypted token columns from agents table (v0.3 security hardening)
168
+ // SQLite 3.35.0+ supports DROP COLUMN. For older versions, we recreate the table.
169
+ const agentCols = db.prepare('PRAGMA table_info(agents)').all();
170
+ const agentColNames = agentCols.map((c) => c.name);
171
+ if (agentColNames.includes('encrypted_token')) {
172
+ db.exec(`
173
+ CREATE TABLE IF NOT EXISTS agents_new (
174
+ id TEXT PRIMARY KEY,
175
+ name TEXT NOT NULL UNIQUE,
176
+ token_hash TEXT NOT NULL,
177
+ token_prefix TEXT NOT NULL,
178
+ rate_limit TEXT,
179
+ created_at TEXT NOT NULL DEFAULT (datetime('now')),
180
+ updated_at TEXT NOT NULL DEFAULT (datetime('now'))
181
+ );
182
+ INSERT OR IGNORE INTO agents_new (id, name, token_hash, token_prefix, rate_limit, created_at, updated_at)
183
+ SELECT id, name, token_hash, token_prefix, rate_limit, created_at, updated_at FROM agents;
184
+ DROP TABLE agents;
185
+ ALTER TABLE agents_new RENAME TO agents;
186
+ CREATE INDEX IF NOT EXISTS idx_agents_token_hash ON agents(token_hash);
187
+ `);
188
+ }
189
+ }
190
+ //# sourceMappingURL=db.js.map
package/dist/db.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,MAAmB;IACvC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEpD,IAAI,MAAc,CAAC;IACnB,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,2EAA2E;QAC3E,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,GAA0C,CAAC;QAC7D,IAAI,SAAS,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,8DAA8D,MAAM,IAAI;gBACtE,sDAAsD,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,EAAqB;IAC3C,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FP,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,EAA6B,CAAC;IAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,EAAE,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,EAAE,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1C,EAAE,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC9F,CAAC;IAED,8EAA8E;IAC9E,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAA6B,CAAC;IAC9F,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,EAAE,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAClD,EAAE,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,EAAE,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACnF,CAAC;IAED,sFAAsF;IACtF,kFAAkF;IAClF,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,GAAG,EAA6B,CAAC;IAC3F,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,aAAa,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC9C,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;KAeP,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
package/dist/doctor.d.ts ADDED
@@ -0,0 +1,37 @@
1
+ /**
2
+ * Aegis Doctor — health check diagnostics.
3
+ *
4
+ * Validates the Aegis installation by checking:
5
+ * 1. Config file and configuration
6
+ * 2. Database accessibility and schema
7
+ * 3. Credential decryption (master key correctness)
8
+ * 4. Expired / expiring-soon credentials
9
+ *
10
+ * Returns a structured list of check results that the CLI can render.
11
+ */
12
+ import type Database from 'better-sqlite3';
13
+ import type { AegisConfig } from './config.js';
14
+ export interface CheckResult {
15
+ label: string;
16
+ status: 'pass' | 'warn' | 'fail';
17
+ detail: string;
18
+ }
19
+ export interface DoctorReport {
20
+ checks: CheckResult[];
21
+ overall: 'pass' | 'warn' | 'fail';
22
+ }
23
+ export interface DoctorOptions {
24
+ /** Resolved Aegis configuration */
25
+ config: AegisConfig;
26
+ /** An open better-sqlite3 database, or null if no DB is available */
27
+ db: Database.Database | null;
28
+ }
29
+ /**
30
+ * Run all Aegis health checks and return a structured report.
31
+ */
32
+ export declare function runDoctor(opts: DoctorOptions): DoctorReport;
33
+ /**
34
+ * Render a DoctorReport to the console with coloured output.
35
+ */
36
+ export declare function printDoctorReport(report: DoctorReport): void;
37
+ //# sourceMappingURL=doctor.d.ts.map
package/dist/doctor.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC;CAC9B;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CAwK3D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAiB5D"}
package/dist/doctor.js ADDED
@@ -0,0 +1,196 @@
1
+ /**
2
+ * Aegis Doctor — health check diagnostics.
3
+ *
4
+ * Validates the Aegis installation by checking:
5
+ * 1. Config file and configuration
6
+ * 2. Database accessibility and schema
7
+ * 3. Credential decryption (master key correctness)
8
+ * 4. Expired / expiring-soon credentials
9
+ *
10
+ * Returns a structured list of check results that the CLI can render.
11
+ */
12
+ import { getVaultSalt, migrate } from './db.js';
13
+ import { Vault } from './vault/index.js';
14
+ /**
15
+ * Run all Aegis health checks and return a structured report.
16
+ */
17
+ export function runDoctor(opts) {
18
+ const checks = [];
19
+ // ── 1. Validate config file and configuration ──────────────────
20
+ const { config } = opts;
21
+ if (config.configFilePath) {
22
+ checks.push({
23
+ label: 'Config file',
24
+ status: 'pass',
25
+ detail: `Found at ${config.configFilePath}`,
26
+ });
27
+ }
28
+ else {
29
+ checks.push({
30
+ label: 'Config file',
31
+ status: 'warn',
32
+ detail: 'No aegis.config.yaml found — using environment variables or defaults',
33
+ });
34
+ }
35
+ if (!config.masterKey) {
36
+ checks.push({
37
+ label: 'Master key',
38
+ status: 'fail',
39
+ detail: 'AEGIS_MASTER_KEY is not set. Run: aegis init',
40
+ });
41
+ }
42
+ else {
43
+ checks.push({ label: 'Master key', status: 'pass', detail: 'AEGIS_MASTER_KEY is set' });
44
+ }
45
+ // ── 2. Verify database accessibility and schema ────────────────
46
+ const { db } = opts;
47
+ const effectiveSalt = db ? getVaultSalt(config) : config.salt;
48
+ if (effectiveSalt === 'aegis-vault-v1') {
49
+ checks.push({
50
+ label: 'Salt',
51
+ status: 'warn',
52
+ detail: 'AEGIS_SALT is using the default value — run: aegis init to generate a random salt',
53
+ });
54
+ }
55
+ else {
56
+ checks.push({ label: 'Salt', status: 'pass', detail: 'AEGIS_SALT is set (custom)' });
57
+ }
58
+ if (!db) {
59
+ checks.push({
60
+ label: 'Database',
61
+ status: 'fail',
62
+ detail: 'Database is not available. Run: aegis init',
63
+ });
64
+ }
65
+ else {
66
+ try {
67
+ migrate(db);
68
+ checks.push({ label: 'Database', status: 'pass', detail: 'SQLite accessible' });
69
+ const tables = db
70
+ .prepare("SELECT name FROM sqlite_master WHERE type='table'")
71
+ .all();
72
+ const tableNames = tables.map((t) => t.name);
73
+ const requiredTables = ['credentials', 'credential_history', 'audit_log'];
74
+ const missingTables = requiredTables.filter((t) => !tableNames.includes(t));
75
+ if (missingTables.length > 0) {
76
+ checks.push({
77
+ label: 'Schema',
78
+ status: 'fail',
79
+ detail: `Missing tables: ${missingTables.join(', ')}`,
80
+ });
81
+ }
82
+ else {
83
+ checks.push({
84
+ label: 'Schema',
85
+ status: 'pass',
86
+ detail: 'All required tables present (credentials, credential_history, audit_log)',
87
+ });
88
+ }
89
+ }
90
+ catch (err) {
91
+ const message = err instanceof Error ? err.message : String(err);
92
+ checks.push({
93
+ label: 'Database',
94
+ status: 'fail',
95
+ detail: `Cannot access database: ${message}`,
96
+ });
97
+ }
98
+ }
99
+ // ── 3. Test-decrypt a credential ───────────────────────────────
100
+ if (db && config.masterKey) {
101
+ try {
102
+ const vault = new Vault(db, config.masterKey, effectiveSalt);
103
+ const creds = vault.list();
104
+ if (creds.length === 0) {
105
+ checks.push({
106
+ label: 'Decrypt test',
107
+ status: 'warn',
108
+ detail: 'No credentials stored — cannot verify decryption. Add one with: aegis vault add',
109
+ });
110
+ }
111
+ else {
112
+ // Key verification already passed in constructor — confirm with explicit decrypt
113
+ checks.push({
114
+ label: 'Decrypt test',
115
+ status: 'pass',
116
+ detail: `Successfully decrypted credential "${creds[0].name}"`,
117
+ });
118
+ }
119
+ // ── 4. Expired / expiring-soon credentials ──────────────────
120
+ const expired = creds.filter((c) => vault.isExpired(c));
121
+ const expiringSoon = creds.filter((c) => {
122
+ if (!c.expiresAt || vault.isExpired(c))
123
+ return false;
124
+ const expiryDate = new Date(c.expiresAt);
125
+ const now = new Date();
126
+ const daysLeft = (expiryDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24);
127
+ return daysLeft <= 7;
128
+ });
129
+ if (expired.length > 0) {
130
+ checks.push({
131
+ label: 'Expired creds',
132
+ status: 'warn',
133
+ detail: `${expired.length} expired: ${expired.map((c) => c.name).join(', ')}`,
134
+ });
135
+ }
136
+ else {
137
+ checks.push({
138
+ label: 'Expired creds',
139
+ status: 'pass',
140
+ detail: 'No expired credentials',
141
+ });
142
+ }
143
+ if (expiringSoon.length > 0) {
144
+ checks.push({
145
+ label: 'Expiring soon',
146
+ status: 'warn',
147
+ detail: `${expiringSoon.length} expiring within 7 days: ${expiringSoon.map((c) => c.name).join(', ')}`,
148
+ });
149
+ }
150
+ // Summary stats
151
+ checks.push({
152
+ label: 'Credentials',
153
+ status: 'pass',
154
+ detail: `${creds.length} stored (${creds.length - expired.length} active, ${expired.length} expired)`,
155
+ });
156
+ }
157
+ catch (err) {
158
+ const message = err instanceof Error ? err.message : String(err);
159
+ const isKeyError = message.includes('Invalid master key');
160
+ checks.push({
161
+ label: isKeyError ? 'Decrypt test' : 'Vault',
162
+ status: 'fail',
163
+ detail: isKeyError
164
+ ? 'Decryption failed — master key or salt may be incorrect'
165
+ : `Cannot initialize vault: ${message}`,
166
+ });
167
+ }
168
+ }
169
+ // ── Compute overall status ─────────────────────────────────────
170
+ const hasFailure = checks.some((c) => c.status === 'fail');
171
+ const hasWarning = checks.some((c) => c.status === 'warn');
172
+ const overall = hasFailure ? 'fail' : hasWarning ? 'warn' : 'pass';
173
+ return { checks, overall };
174
+ }
175
+ /**
176
+ * Render a DoctorReport to the console with coloured output.
177
+ */
178
+ export function printDoctorReport(report) {
179
+ for (const check of report.checks) {
180
+ const icon = check.status === 'pass' ? '✓' : check.status === 'warn' ? '⚠' : '✗';
181
+ const color = check.status === 'pass' ? '\x1b[32m' : check.status === 'warn' ? '\x1b[33m' : '\x1b[31m';
182
+ const reset = '\x1b[0m';
183
+ console.log(` ${color}${icon}${reset} ${check.label}: ${check.detail}`);
184
+ }
185
+ console.log();
186
+ if (report.overall === 'fail') {
187
+ console.log(' Overall: ✗ Issues found — fix the failures above\n');
188
+ }
189
+ else if (report.overall === 'warn') {
190
+ console.log(' Overall: ⚠ Healthy with warnings\n');
191
+ }
192
+ else {
193
+ console.log(' Overall: ✓ All checks passed\n');
194
+ }
195
+ }
196
+ //# sourceMappingURL=doctor.js.map
package/dist/doctor.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAoBzC;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC3C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,kEAAkE;IAElE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAExB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,MAAM,CAAC,cAAc,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,sEAAsE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,8CAA8C;SACvD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,kEAAkE;IAElE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9D,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,mFAAmF;SAC5F,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,4CAA4C;SACrD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAEhF,MAAM,MAAM,GAAG,EAAE;iBACd,OAAO,CAAC,mDAAmD,CAAC;iBAC5D,GAAG,EAA6B,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAC1E,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAE5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,mBAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACtD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,0EAA0E;iBACnF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU;gBACjB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,2BAA2B,OAAO,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAElE,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAE3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,iFAAiF;iBAC1F,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,iFAAiF;gBACjF,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG;iBAC/D,CAAC,CAAC;YACL,CAAC;YAED,+DAA+D;YAE/D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACrD,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChF,OAAO,QAAQ,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC9E,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,wBAAwB;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,4BAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACvG,CAAC,CAAC;YACL,CAAC;YAED,gBAAgB;YAChB,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,MAAM,WAAW;aACtG,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;gBAC5C,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU;oBAChB,CAAC,CAAC,yDAAyD;oBAC3D,CAAC,CAAC,4BAA4B,OAAO,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAElE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAEnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjF,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,MAAM,KAAK,GAAG,SAAS,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}
package/dist/gate/body-inspector.d.ts ADDED
@@ -0,0 +1,31 @@
1
+ /**
2
+ * Request Body Inspector — scans outbound request bodies for credential-like
3
+ * patterns that may indicate an agent is trying to exfiltrate secrets.
4
+ *
5
+ * This is a defence-in-depth measure. Even though the agent never sees
6
+ * decrypted credentials directly, an agent could attempt to send previously
7
+ * obtained secrets (e.g. from environment variables, config files) through
8
+ * Gate to an attacker-controlled domain. The body inspector catches this.
9
+ *
10
+ * Sensitivity modes:
11
+ * - "off" — no scanning (fastest, least secure)
12
+ * - "warn" — scan and log matches but allow the request through
13
+ * - "block" — scan and block requests containing credential patterns (default)
14
+ */
15
+ export type BodyInspectionMode = 'off' | 'warn' | 'block';
16
+ export interface InspectionResult {
17
+ /** Whether any credential-like patterns were found */
18
+ suspicious: boolean;
19
+ /** Human-readable descriptions of what was found */
20
+ matches: string[];
21
+ }
22
+ export declare class BodyInspector {
23
+ /**
24
+ * Scan a request body string for credential-like patterns.
25
+ *
26
+ * @param body The raw request body as a string
27
+ * @returns An InspectionResult indicating whether suspicious patterns were found
28
+ */
29
+ inspect(body: string): InspectionResult;
30
+ }
31
+ //# sourceMappingURL=body-inspector.d.ts.map
package/dist/gate/body-inspector.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"body-inspector.d.ts","sourceRoot":"","sources":["../../src/gate/body-inspector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,UAAU,EAAE,OAAO,CAAC;IACpB,oDAAoD;IACpD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA4KD,qBAAa,aAAa;IACxB;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB;CA0BxC"}