@goodandready/dsh-approval-gate 0.1.15 → 0.1.16

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.16
+
+- Audit: Отказоустойчивый аудит с блокировкой (`fail-closed audit`) при невозможности записи в append-only журнал (Refs: #53).
+- Audit: Однопроходная обратная ротация лога аудита без амплификации ввода-вывода (`auditRotateContent` до 5 МБ / 5000 строк) с сохранением хвоста (Refs: #54).
+- Security: Нестираемые метки очистки журнала аудита (`tombstones`) вместо тихого удаления с сохранением sha256 и непрерывной цепочки событий (Refs: #55).
+- Metrics: Счетчики перехватов (`BlockCounters`) и метрики частоты срабатывания правил (по стадиям, вердиктам, категориям и правилам) со snapshot в настройках (Refs: #48).
+- Security: Блокировка таймаута на безусловный отказ (`lockedAsk`) для критических операций (sudo, rm -rf, ssh-keys, mkfs, reverse shell) с запретом обхода в unattended режиме (Refs: #52).
+
 ## 0.1.15
 
 - Rules: Каскадный декларативный YAML-конфиг правил `rules.yaml` (`.dsh/rules.yaml` в проекте и `~/.dsh/rules.yaml` пользователя) с поддержкой allow/deny/ask политик (Refs: #38).

package/lib/audit-log.js

@@ -1,7 +1,10 @@
 // lib/audit-log.js
-// Isolated append-only audit logger for dsh-approval-gate (#56).
+// Isolated append-only audit logger for dsh-approval-gate (#56, #53, #54, #55).
 // Logs gate decisions to ~/.dsh/approval-gate-audit.jsonl out-of-band to prevent prompt injection.
+// Features: fail-closed write verification (#53), single-pass reverse rotation up to 5MB (#54),
+// and non-erasable tombstones for tamper resistance (#55).
 
+import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -9,13 +12,89 @@ import { computeFingerprint } from "./fingerprint.js";
 import { redactCredentials } from "./redact.js";
 
 export const DEFAULT_AUDIT_LOG_RELATIVE = path.join(".dsh", "approval-gate-audit.jsonl");
+export const DEFAULT_MAX_AUDIT_BYTES = 5 * 1024 * 1024; // 5 MB (#54)
+export const DEFAULT_MAX_AUDIT_LINES = 5000;
+export const DEFAULT_RETAIN_LINES = 2500;
+export const SCAN_CHUNK_SIZE = 64 * 1024; // 64 KB single-pass chunk
+
+/**
+ * Pure function: single-pass reverse scan rotation for string or buffer content (#54).
+ * Scans from the tail backwards to avoid write amplification and full array allocation.
+ *
+ * @param {string} content
+ * @param {number} [maxBytes=DEFAULT_MAX_AUDIT_BYTES]
+ * @param {number} [maxLines=DEFAULT_MAX_AUDIT_LINES]
+ * @param {number} [retainLines=DEFAULT_RETAIN_LINES]
+ * @returns {{ rotated: boolean, content: string, previousBytes: number, previousLinesCount: number, retainedLinesCount: number }}
+ */
+export function auditRotateContent(
+  content,
+  maxBytes = DEFAULT_MAX_AUDIT_BYTES,
+  maxLines = DEFAULT_MAX_AUDIT_LINES,
+  retainLines = DEFAULT_RETAIN_LINES
+) {
+  if (typeof content !== "string" || content.length === 0) {
+    return { rotated: false, content: "", previousBytes: 0, previousLinesCount: 0, retainedLinesCount: 0 };
+  }
+
+  const byteLength = Buffer.byteLength(content, "utf8");
+  const allLines = content.split("\n");
+  const nonEmptyLines = allLines[allLines.length - 1] === "" ? allLines.slice(0, -1) : allLines;
+  const lineCount = nonEmptyLines.length;
+
+  if (byteLength < maxBytes && lineCount < maxLines) {
+    return { rotated: false, content, previousBytes: byteLength, previousLinesCount: lineCount, retainedLinesCount: lineCount };
+  }
+
+  let end = content.length;
+  if (end > 0 && content.charCodeAt(end - 1) === 10) {
+    end--; // skip trailing newline for line scanning
+  }
+
+  let targetCutoff = 0;
+  let linesSeen = 0;
+  for (let i = end - 1; i >= 0; i--) {
+    if (content.charCodeAt(i) === 10) {
+      linesSeen++;
+      if (linesSeen === retainLines) {
+        targetCutoff = i + 1;
+        break;
+      }
+    }
+  }
+  if (linesSeen < retainLines) {
+    targetCutoff = 0;
+  }
+
+  const retained = content.slice(targetCutoff);
+  return {
+    rotated: true,
+    content: retained,
+    previousBytes: byteLength,
+    previousLinesCount: lineCount,
+    retainedLinesCount: Math.min(lineCount, retainLines),
+  };
+}
 
 export class AuditLogger {
   /**
-   * @param {{ logPath?: string, disabled?: boolean }} [options]
+   * @param {{
+   *   logPath?: string,
+   *   disabled?: boolean,
+   *   failClosed?: boolean,
+   *   maxBytes?: number,
+   *   maxLines?: number,
+   *   retainLines?: number
+   * }} [options]
    */
   constructor(options = {}) {
     this.disabled = options.disabled === true;
+    this.failClosed = options.failClosed === true;
+    this.maxBytes = typeof options.maxBytes === "number" && options.maxBytes > 0 ? options.maxBytes : DEFAULT_MAX_AUDIT_BYTES;
+    this.maxLines = typeof options.maxLines === "number" && options.maxLines > 0 ? options.maxLines : DEFAULT_MAX_AUDIT_LINES;
+    this.retainLines = typeof options.retainLines === "number" && options.retainLines > 0 ? options.retainLines : DEFAULT_RETAIN_LINES;
+    this.lastError = null;
+
     if (options.logPath) {
       this.logPath = options.logPath;
     } else {
@@ -25,17 +104,18 @@ export class AuditLogger {
   }
 
   /**
-   * Write an audit record to the isolated log file.
+   * Write an audit record to the isolated log file. Returns boolean (#53).
    *
    * @param {{
    *   sessionId?: string,
    *   execution?: any,
-   *   decision: { verdict: string, stage?: string, reason?: string, detail?: string, dryRun?: boolean },
+   *   decision: { verdict: string, stage?: string, reason?: string, detail?: string, dryRun?: boolean, ruleId?: string },
    *   dryRun?: boolean
    * }} record
+   * @returns {boolean} True if append succeeded or disabled, false if write failed
    */
-  log(record) {
-    if (this.disabled || !this.logPath) return;
+  appendAuditLine(record) {
+    if (this.disabled || !this.logPath) return true;
 
     try {
       const now = Date.now();
@@ -57,6 +137,7 @@ export class AuditLogger {
         verdict: decision.verdict,
         stage: decision.stage,
         reason: decision.reason,
+        ruleId: decision.ruleId,
         detail: decision.detail,
         fingerprint: fp,
         dryRun: Boolean(record.dryRun || decision.dryRun),
@@ -67,10 +148,198 @@ export class AuditLogger {
       if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
       }
+
       fs.appendFileSync(this.logPath, line, "utf8");
+      this.lastError = null;
+
+      // Check if rotation is needed (#54)
+      this._checkRotation();
+      return true;
+    } catch (err) {
+      this.lastError = err;
+      if (this.failClosed) {
+        return false;
+      }
+      return false;
+    }
+  }
+
+  /**
+   * Alias for backward compatibility.
+   * @param {any} record
+   * @returns {boolean}
+   */
+  log(record) {
+    return this.appendAuditLine(record);
+  }
+
+  /**
+   * Single-pass reverse scan rotation (#54).
+   * @private
+   */
+  _checkRotation() {
+    if (!this.logPath || !fs.existsSync(this.logPath)) return;
+    try {
+      const stat = fs.statSync(this.logPath);
+      if (stat.size >= this.maxBytes) {
+        this.rotate();
+      }
+    } catch {
+      // Rotation check failure must not crash logger
+    }
+  }
+
+  /**
+   * Explicitly rotate audit log using single-pass reverse scan and tombstone (#54, #55).
+   * @returns {boolean}
+   */
+  rotate() {
+    if (!this.logPath || !fs.existsSync(this.logPath)) return false;
+
+    try {
+      const raw = fs.readFileSync(this.logPath, "utf8");
+      const prevSha256 = crypto.createHash("sha256").update(raw, "utf8").digest("hex");
+      // Force rotation to retainLines
+      const rot = auditRotateContent(raw, 0, 0, this.retainLines);
+
+      const now = Date.now();
+      const tombstone = {
+        tombstone: true,
+        timestamp: now,
+        iso: new Date(now).toISOString(),
+        reason: "rotation",
+        clearedBy: "system:rotator",
+        previousSha256: prevSha256,
+        previousBytes: rot.previousBytes,
+        previousLinesCount: rot.previousLinesCount,
+        retainedLinesCount: rot.retainedLinesCount,
+      };
+
+      const tombstoneLine = JSON.stringify(tombstone) + "\n";
+      const newContent = tombstoneLine + rot.content;
+
+      const tmpPath = this.logPath + ".tmp." + now;
+      fs.writeFileSync(tmpPath, newContent, "utf8");
+      fs.renameSync(tmpPath, this.logPath);
+      return true;
+    } catch (err) {
+      this.lastError = err;
+      return false;
+    }
+  }
+
+  /**
+   * Clear the audit log with a non-erasable tombstone (#55).
+   * Instead of silent deletion, creates an immutable tombstone record preserving hash and event chain.
+   *
+   * @param {{ reason?: string, clearedBy?: string }} [options]
+   * @returns {{
+   *   tombstone: boolean,
+   *   timestamp: number,
+   *   iso: string,
+   *   reason: string,
+   *   clearedBy: string,
+   *   previousSha256: string,
+   *   previousBytes: number,
+   *   previousLinesCount: number
+   * }}
+   */
+  clear(options = {}) {
+    const reason = options.reason || "manual_clear";
+    const clearedBy = options.clearedBy || "admin";
+    let prevSha256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+    let prevBytes = 0;
+    let prevLines = 0;
+
+    if (this.logPath && fs.existsSync(this.logPath)) {
+      try {
+        const raw = fs.readFileSync(this.logPath, "utf8");
+        prevBytes = Buffer.byteLength(raw, "utf8");
+        prevSha256 = crypto.createHash("sha256").update(raw, "utf8").digest("hex");
+        prevLines = raw.split("\n").filter((l) => l.trim().length > 0).length;
+      } catch {
+        // Read error
+      }
+    }
+
+    const now = Date.now();
+    const tombstone = {
+      tombstone: true,
+      timestamp: now,
+      iso: new Date(now).toISOString(),
+      reason,
+      clearedBy,
+      previousSha256: prevSha256,
+      previousBytes: prevBytes,
+      previousLinesCount: prevLines,
+    };
+
+    if (this.logPath) {
+      const dir = path.dirname(this.logPath);
+      if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+      }
+      const line = JSON.stringify(tombstone) + "\n";
+      fs.writeFileSync(this.logPath, line, "utf8");
+    }
+
+    return tombstone;
+  }
+
+  /**
+   * Read all tombstones from the log file (#55).
+   * @returns {Array<any>}
+   */
+  getTombstones() {
+    if (!this.logPath || !fs.existsSync(this.logPath)) return [];
+    try {
+      const raw = fs.readFileSync(this.logPath, "utf8");
+      const lines = raw.split("\n").filter((l) => l.trim().length > 0);
+      const tombstones = [];
+      for (const line of lines) {
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed && parsed.tombstone === true) {
+            tombstones.push(parsed);
+          }
+        } catch {
+          // ignore corrupted lines
+        }
+      }
+      return tombstones;
+    } catch {
+      return [];
+    }
+  }
+
+  /**
+   * Read recent entries from the audit log.
+   * @param {{ includeTombstones?: boolean, limit?: number }} [options]
+   * @returns {Array<any>}
+   */
+  readEntries(options = {}) {
+    if (!this.logPath || !fs.existsSync(this.logPath)) return [];
+    const includeTombstones = options.includeTombstones !== false;
+    const limit = typeof options.limit === "number" && options.limit > 0 ? options.limit : 100;
+
+    try {
+      const raw = fs.readFileSync(this.logPath, "utf8");
+      const lines = raw.split("\n").filter((l) => l.trim().length > 0);
+      const entries = [];
+      for (let i = lines.length - 1; i >= 0 && entries.length < limit; i--) {
+        try {
+          const parsed = JSON.parse(lines[i]);
+          if (!includeTombstones && parsed.tombstone === true) {
+            continue;
+          }
+          entries.push(parsed);
+        } catch {
+          // ignore
+        }
+      }
+      return entries.reverse();
     } catch {
-      // Security audit failures fail open to prevent DoS,
-      // but never leak errors into agent prompt.
+      return [];
     }
   }
 }

package/lib/counters.js

@@ -0,0 +1,144 @@
+// lib/counters.js
+// In-memory block counters and rule hit frequency metrics for dsh-approval-gate (#48).
+// Tracks total evaluated decisions, verdicts, pipeline stages, top rules, and risk categories.
+
+/**
+ * Categorize a decision reason into a high-level risk category.
+ * @param {string} [reason]
+ * @returns {string}
+ */
+export function categorizeReason(reason) {
+  const r = String(reason || "").toLowerCase();
+  if (r.includes("band") || r.includes("hard-deny") || r.includes("rm") || r.includes("destructive") || r.includes("delete") || r.includes("drop") || r.includes("truncate") || r.includes("wipe") || r.includes("clean")) {
+    return "destructive";
+  }
+  if (r.includes("privilege") || r.includes("sudo") || r.includes("systemctl") || r.includes("reboot") || r.includes("service") || r.includes("kill") || r.includes("chmod") || r.includes("chown")) {
+    return "system";
+  }
+  if (r.includes("network") || r.includes("egress") || r.includes("curl") || r.includes("wget") || r.includes("ssh") || r.includes("socket") || r.includes("connect")) {
+    return "network";
+  }
+  if (r.includes("secret") || r.includes("env") || r.includes("token") || r.includes("key") || r.includes("credential") || r.includes("password")) {
+    return "secrets";
+  }
+  if (r.includes("persist") || r.includes("crontab") || r.includes("profile") || r.includes("bashrc") || r.includes("startup")) {
+    return "persistence";
+  }
+  if (r.includes("syntax") || r.includes("parser") || r.includes("subshell") || r.includes("uncertain")) {
+    return "syntax";
+  }
+  return "other";
+}
+
+export class BlockCounters {
+  constructor() {
+    this.reset();
+  }
+
+  /**
+   * Reset all counters to zero.
+   */
+  reset() {
+    this.totalEvaluated = 0;
+    this.byVerdict = {
+      allow: 0,
+      deny: 0,
+      ask: 0,
+    };
+    this.byStage = {
+      P0: 0,
+      P1: 0,
+      P2: 0,
+      P3: 0,
+      P4: 0,
+    };
+    this.byCategory = {
+      destructive: 0,
+      system: 0,
+      network: 0,
+      secrets: 0,
+      persistence: 0,
+      syntax: 0,
+      other: 0,
+    };
+    /** @type {Map<string, { hits: number, lastHitAt: number, lastVerdict: string, category: string }>} */
+    this.byRule = new Map();
+  }
+
+  /**
+   * Record a decision event.
+   * @param {{ verdict: string, stage?: string, reason?: string, ruleId?: string }} decision
+   * @param {any} [execution]
+   */
+  record(decision, execution) {
+    if (!decision || typeof decision !== "object") return;
+
+    this.totalEvaluated++;
+
+    const v = decision.verdict;
+    if (v === "allow" || v === "deny" || v === "ask") {
+      this.byVerdict[v] = (this.byVerdict[v] || 0) + 1;
+    }
+
+    const st = decision.stage;
+    if (st && this.byStage[st] !== undefined) {
+      this.byStage[st] = (this.byStage[st] || 0) + 1;
+    }
+
+    const ruleKey = String(decision.ruleId || decision.reason || "unspecified").trim();
+    const category = categorizeReason(decision.reason);
+
+    this.byCategory[category] = (this.byCategory[category] || 0) + 1;
+
+    const existing = this.byRule.get(ruleKey);
+    const now = Date.now();
+    if (existing) {
+      existing.hits++;
+      existing.lastHitAt = now;
+      existing.lastVerdict = decision.verdict;
+      existing.category = category;
+    } else {
+      this.byRule.set(ruleKey, {
+        hits: 1,
+        lastHitAt: now,
+        lastVerdict: decision.verdict,
+        category,
+      });
+    }
+  }
+
+  /**
+   * Get stats for a specific rule.
+   * @param {string} ruleId
+   * @returns {{ rule: string, hits: number, lastHitAt: number, lastVerdict: string, category: string } | null}
+   */
+  getRuleStats(ruleId) {
+    const s = this.byRule.get(String(ruleId || "").trim());
+    if (!s) return null;
+    return { rule: ruleId, ...s };
+  }
+
+  /**
+   * Get complete snapshot of all counters for settings UI / API.
+   * @returns {{
+   *   total: number,
+   *   byVerdict: { allow: number, deny: number, ask: number },
+   *   byStage: { P0: number, P1: number, P2: number, P3: number, P4: number },
+   *   byCategory: Record<string, number>,
+   *   rules: Array<{ rule: string, hits: number, lastHitAt: number, lastVerdict: string, category: string }>
+   * }}
+   */
+  getSnapshot() {
+    const rulesList = Array.from(this.byRule.entries())
+      .map(([rule, data]) => ({ rule, ...data }))
+      .sort((a, b) => b.hits - a.hits);
+
+    return {
+      total: this.totalEvaluated,
+      byVerdict: { ...this.byVerdict },
+      byStage: { ...this.byStage },
+      byCategory: { ...this.byCategory },
+      rules: rulesList,
+    };
+  }
+}